From 2710fd3484f1c9a83582ec70270f1146fa4cd8f2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Jun 2024 11:16:23 +0100 Subject: [PATCH 0001/1455] feat(profile): ensure steam can update itself. --- apparmor.d/abstractions/common/steam-game | 7 +- apparmor.d/profiles-s-z/steam | 110 +++++++++++++--------- apparmor.d/profiles-s-z/steam-runtime | 9 +- 3 files changed, 73 insertions(+), 53 deletions(-) diff --git a/apparmor.d/abstractions/common/steam-game b/apparmor.d/abstractions/common/steam-game index 9c1df7d51..c6a7aff75 100644 --- a/apparmor.d/abstractions/common/steam-game +++ b/apparmor.d/abstractions/common/steam-game @@ -16,7 +16,6 @@ @{bin}/env r, - @{app_dirs}/ r, @{lib_dirs}/ r, @{lib}/ r, / r, @@ -42,6 +41,9 @@ owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw, owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, + owner @{app_dirs}/ r, + owner @{app_dirs}/[^S]*/** rwlk, # No access to "SteamLinuxRuntime_sniper" + owner @{share_dirs}/ r, owner @{share_dirs}/* r, owner @{share_dirs}/appcache/** rk, @@ -51,8 +53,7 @@ owner @{share_dirs}/logs/* rwk, owner @{share_dirs}/shader_cache_temp_dir_*/fozpipelinesv@{int}/{,**} rw, owner @{share_dirs}/steamapps/ r, - owner @{share_dirs}/steamapps/common/ r, - owner @{share_dirs}/steamapps/common/[^S]*/** rwlk, + owner @{share_dirs}/steamapps/appmanifest_* rw, owner @{share_dirs}/steamapps/shadercache/{,**} rwk, @{tmp}/ r, diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 8de447bfe..ecd8d743e 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -45,8 +45,8 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { capability sys_ptrace, network inet dgram, - network inet6 dgram, network inet stream, + network inet6 dgram, network inet6 stream, network netlink raw, network unix, @@ -65,6 +65,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sh_path} rix, @{coreutils_path} rix, + @{open_path} rPx -> child-open, @{bin}/getopt rix, @{bin}/journalctl rPx -> systemctl, @{bin}/ldconfig rix, @@ -72,37 +73,46 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/lsb_release rPx -> lsb_release, @{bin}/lsof rix, @{bin}/lspci rCx -> lspci, + @{bin}/tar rix, @{bin}/which{,.debianutils} rix, @{bin}/xdg-icon-resource rPx, @{bin}/xdg-user-dir rix, + @{bin}/xz rix, + @{bin}/zenity rix, @{lib}/@{multiarch}/ld-*.so* rix, @{lib}/ld-linux.so* rix, - @{open_path} rPx -> child-open, - @{lib_dirs}/** mr, - @{lib_dirs}/*driverquery rix, - @{lib_dirs}/fossilize_replay rpx, - @{lib_dirs}/gameoverlayui rpx, - @{lib_dirs}/reaper rpx, # steam-runtime - @{lib_dirs}/steam* rix, + @{lib_dirs}/** mr, + @{lib_dirs}/*driverquery rix, + @{lib_dirs}/fossilize_replay rpx, + @{lib_dirs}/gameoverlayui rpx, + @{lib_dirs}/reaper rpx, # steam-runtime + @{lib_dirs}/steam* rix, @{app_dirs}/@{runtime}/*entry-point rpx -> steam-runtime, @{share_dirs}/linux{32,64}/steamerrorreporter rpx, - @{runtime_dirs}/@{arch}/@{bin}/srt-logger rix, - @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements rcx -> check, - @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-identify-library-abi rix, - @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, - @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-supervisor rix, - @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-system-info rix, - @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, - @{runtime_dirs}/*entry-point rix, - @{runtime_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix, - @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, - @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rcx -> web, - @{runtime_dirs}/run{,.sh} rix, - @{runtime_dirs}/setup.sh rix, + @{runtime_dirs}/*entry-point rix, + @{runtime_dirs}/@{arch}/@{bin}/srt-logger rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements rcx -> check, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-dialog{,-ui} rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-identify-library-abi rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-input-monitor rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launch-* rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-interface-@{int} rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-libcurl-* rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-supervisor rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-system-info rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-urlopen rix, + @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, + @{runtime_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix, + @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, + @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rcx -> web, + @{runtime_dirs}/run{,.sh} rix, + @{runtime_dirs}/setup.sh rix, @{lib}/os-release rk, @@ -111,16 +121,22 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { /etc/lsb-release r, /etc/machine-id r, /etc/timezone r, + /var/lib/dbus/machine-id r, + / r, + @{bin}/ r, @{lib}/ r, - / r, + /etc/ r, + /home/ r, + /usr/ r, /usr/local/ r, /usr/local/lib/ r, + /var/ r, /var/tmp/ r, @@ -131,7 +147,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{HOME}/.steampid rw, owner @{share_dirs}/ rw, - owner @{share_dirs}/** rwkl -> @{share_dirs}/**, + owner @{share_dirs}/** rwlk -> @{share_dirs}/**, owner @{user_games_dirs}/ rw, owner @{user_games_dirs}/** rwlk -> @{user_games_dirs}/**, @@ -141,7 +157,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_config_dirs}/autostart/ r, owner @{user_config_dirs}/cef_user_data/{,**} r, owner @{user_config_dirs}/cef_user_data/Dictionaries/* rw, - owner @{user_config_dirs}/cef_user_data/WidevineCdm/** rwm, + owner @{user_config_dirs}/cef_user_data/WidevineCdm/** mrw, owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw, owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, @@ -150,17 +166,17 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/vulkan/implicit_layer.d/steam*.json rwk, @{tmp}/ r, + owner @{tmp}/#@{int} rw, owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/ rw, owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, - owner @{tmp}/#@{int} rw, owner @{tmp}/dumps/ rw, owner @{tmp}/dumps/** rwk, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, owner @{tmp}/glx-icds-@{rand6}/{,**} rw, owner @{tmp}/runtime-info.txt.@{rand6} rwk, - owner @{tmp}/steam@{rand6}/{,**} rw, owner @{tmp}/steam/ rw, owner @{tmp}/steam/** rwk, + owner @{tmp}/steam@{rand6}/{,**} rw, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, owner /dev/shm/fossilize-*-@{int}-@{int} rw, @@ -174,7 +190,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/c13:@{int} r, # for /dev/input/* + @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/n@{int} r, @{sys}/ r, @@ -185,15 +201,15 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/class/net/ r, @{sys}/class/power_supply/ r, @{sys}/devices/ r, - @{sys}/devices/@{pci}/boot_vga r, - @{sys}/devices/@{pci}/sound/card@{int}/input@{int}/properties r, - @{sys}/devices/**/input@{int}/ r, - @{sys}/devices/**/input@{int}/capabilities/* r, @{sys}/devices/**/input/input@{int}/ r, @{sys}/devices/**/input/input@{int}/properties r, + @{sys}/devices/**/input@{int}/ r, + @{sys}/devices/**/input@{int}/capabilities/* r, @{sys}/devices/**/power_supply/{AC,BAT@{int},hidpp_battery_@{int}}/{,*} r, @{sys}/devices/**/report_descriptor r, @{sys}/devices/**/uevent r, + @{sys}/devices/@{pci}/boot_vga r, + @{sys}/devices/@{pci}/sound/card@{int}/input@{int}/properties r, @{sys}/devices/system/ r, @{sys}/devices/system/cpu/cpu@{int}/ r, @{sys}/devices/virtual/dmi/id/bios_vendor r, @@ -209,7 +225,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{PROC}/@{pid}/fdinfo/@{int} r, @{PROC}/@{pid}/net/* r, @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/stat r, @{PROC}/1/cgroup r, @{PROC}/locks r, @{PROC}/sys/kernel/sched_autogroup_enabled r, @@ -242,13 +257,14 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include capability dac_read_search, capability sys_chroot, network inet dgram, - network inet6 dgram, network inet stream, + network inet6 dgram, network inet6 stream, network netlink raw, @@ -258,19 +274,19 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { unix receive type=stream, - @{bin}/ldconfig rix, @{bin}/getopt rix, @{bin}/gzip rix, - @{bin}/true rix, + @{bin}/ldconfig rix, @{bin}/localedef rix, @{bin}/readlink rix, + @{bin}/true rix, - @{lib_dirs}/** mr, - @{lib_dirs}/steamwebhelper rix, - @{lib_dirs}/steamwebhelper_sniper_wrap.sh rix, + @{lib_dirs}/** mr, + @{lib_dirs}/steamwebhelper rix, + @{lib_dirs}/steamwebhelper_sniper_wrap.sh rix, - @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap mr, - @{runtime_dirs}/pressure-vessel/@{bin}/steam-runtime-launcher-interface-@{int} rix, + @{runtime_dirs}/pressure-vessel/@{bin}/steam-runtime-launcher-interface-@{int} rix, + @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap mr, @{lib}/pressure-vessel/from-host/** rix, @{run}/host/@{bin}/* rix, @@ -295,23 +311,23 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{HOME}/.pki/ rw, owner @{HOME}/.pki/nssdb/ rw, - owner @{HOME}/.pki/nssdb/pkcs11.txt rw, owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, + owner @{HOME}/.pki/nssdb/pkcs11.txt rw, owner @{lib_dirs}/.cef-* wk, owner @{share_dirs}/{,**} r, + owner @{share_dirs}/clientui/** k, owner @{share_dirs}/config/** rwk, owner @{share_dirs}/logs/** rwk, - owner @{share_dirs}/clientui/** k, owner @{share_dirs}/public/** k, @{tmp}/ r, owner @{tmp}/#@{int} rw, + owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/dumps/ rw, owner @{tmp}/dumps/** rwk, - owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/pressure-vessel-*-@{rand6}/ rw, owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, @@ -327,7 +343,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{run}/pressure-vessel/** r, - @{run}/udev/data/c13:@{int} r, # for /dev/input/* + @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{sys}/bus/ r, @{sys}/bus/*/devices/ r, @@ -366,9 +382,9 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/true rix, - @{lib_dirs}/** mr, - @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements mr, - @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rix, + @{lib_dirs}/** mr, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements mr, + @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rix, / r, diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index 5d6d0f856..a8ff7874a 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -26,7 +26,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{sh_path} r, + @{sh_path} rix, @{bin}/getopt rix, @{bin}/readlink rix, @@ -34,7 +34,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { @{lib_dirs}/steam-launch-wrapper rix, # Native linux games (steam-game-native) - @{app_dirs}/[^S]*/** rpx -> steam-game-native, + @{app_dirs}/[^S]*/** rpx -> steam-game-native, # Only for @{app_dirs}/@{runtime}/** # Proton games, sandboxed (steam-game-proton) @{app_dirs}/@{runtime}/*entry-point rmix, @@ -54,7 +54,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.steam/steam.pipe r, owner @{app_dirs}/*/ r, - owner @{app_dirs}/config/config.vdf rw, + owner @{app_dirs}/config/config.vdf{,.*} rw, owner @{app_dirs}/@{runtime}/** r, owner @{app_dirs}/@{runtime}/pressure-vessel/** rwk, owner @{app_dirs}/@{runtime}/sniper_platform_*/** rwk, @@ -62,6 +62,9 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/pressure-vessel/**, owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/sniper_platform_*/**, + owner @{share_dirs}/config/config.vdf{,.*} rw, + owner @{share_dirs}/steamapps/appmanifest_* rw, + owner @{tmp}/ r, owner @{tmp}/#@{int} rw, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, From 856a9a467efa1f9368387e5a96a2902ad740702a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Jun 2024 11:17:01 +0100 Subject: [PATCH 0002/1455] feat(profile): improve chromium tmp file restriction. --- apparmor.d/abstractions/app/chromium | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index d7ffd9fa7..e80a7e0f4 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -125,7 +125,7 @@ owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, owner @{user_config_dirs}/gtk-3.0/servers r, - owner @{user_share_dirs}/.@{domain}.* rw, + owner @{user_share_dirs}/.@{domain}.@{rand6} rw, owner @{user_cache_dirs}/gtk-3.0/**/*.cache r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -147,8 +147,8 @@ /tmp/ r, /var/tmp/ r, - owner @{tmp}/.@{domain}.* rw, - owner @{tmp}/.@{domain}*/{,**} rw, + owner @{tmp}/.@{domain}.@{rand6} rw, + owner @{tmp}/.@{domain}.@{rand6}/{,**} rw, owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw, owner @{tmp}/scoped_dir@{rand6}/{,**} rw, owner @{tmp}/tmp.@{rand6} rw, @@ -159,7 +159,7 @@ owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw, /dev/shm/ r, - owner /dev/shm/.@{domain}* rw, + owner /dev/shm/.@{domain}.@{rand6} rw, @{run}/udev/data/c13:@{int} r, # for /dev/input/* From 2e127ace4b7862516126a4f809404dbb768c6495 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Jun 2024 11:17:56 +0100 Subject: [PATCH 0003/1455] feat(abs): general update. --- apparmor.d/abstractions/app/open | 1 + apparmor.d/abstractions/common/app | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index f93a1c444..f21a2a7de 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -9,6 +9,7 @@ @{open_path} mrix, @{sh_path} r, + @{bin}/env rix, /dev/tty rw, diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index e44d8509c..dc598cfa1 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -33,7 +33,7 @@ dbus bus=system, /usr/cache/** r, - /usr/local/** r, + /usr/local/{,**} r, /usr/share/** rk, /etc/{,**} r, @@ -84,7 +84,7 @@ @{PROC}/ r, @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/comm rk, @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/net/** r, @@ -94,6 +94,7 @@ @{PROC}/@{pid}/task/@{tid}/stat r, @{PROC}/@{pid}/task/@{tid}/status r, @{PROC}/bus/pci/devices r, + @{PROC}/cmdline r, @{PROC}/driver/** r, @{PROC}/locks r, @{PROC}/pressure/cpu r, @@ -104,6 +105,7 @@ @{PROC}/sys/kernel/pid_max r, @{PROC}/sys/kernel/sched_autogroup_enabled r, @{PROC}/sys/kernel/yama/ptrace_scope r, + @{PROC}/sys/net/core/bpf_jit_enable r, @{PROC}/uptime r, @{PROC}/version r, @{PROC}/zoneinfo r, @@ -119,15 +121,18 @@ owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/net/if_inet6 r, owner @{PROC}/@{pid}/oom_score_adj rw, + owner @{PROC}/@{pid}/pagemap r, owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/hidraw@{int} rw, /dev/input/ r, + /dev/input/event@{int} rw, /dev/ptmx rw, /dev/pts/ptmx rw, /dev/tty rw, + /dev/udmabuf rw, include if exists From ae71b323c216a5a7ea09e6f9abf8c05ac3b4d5e7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Jun 2024 11:25:17 +0100 Subject: [PATCH 0004/1455] feat(profile): general update. --- apparmor.d/groups/apt/command-not-found | 2 ++ apparmor.d/groups/children/child-dpkg | 2 +- apparmor.d/groups/children/child-open | 2 +- .../groups/children/child-open-browsers | 2 +- apparmor.d/groups/children/child-pager | 2 ++ apparmor.d/groups/freedesktop/pipewire | 4 +--- apparmor.d/groups/freedesktop/xwayland | 2 ++ apparmor.d/groups/gnome/gjs-console | 6 ++++-- apparmor.d/groups/gnome/gnome-control-center | 2 +- .../groups/gnome/gnome-remote-desktop-daemon | 2 +- apparmor.d/groups/gnome/session-migration | 1 + .../groups/systemd/systemd-machine-id-setup | 1 + apparmor.d/groups/systemd/systemd-udevd | 1 + .../groups/systemd/systemd-user-runtime-dir | 2 ++ apparmor.d/groups/ubuntu/do-release-upgrade | 9 +++++++-- apparmor.d/groups/xfce/xfce-panel | 2 +- apparmor.d/groups/xfce/xfce-session | 2 +- apparmor.d/profiles-a-f/flatpak-app | 3 ++- apparmor.d/profiles-g-l/git | 10 +++++----- apparmor.d/profiles-g-l/ifup | 1 + apparmor.d/profiles-g-l/lsusb | 2 ++ apparmor.d/profiles-m-r/nvidia-settings | 7 +++++++ apparmor.d/profiles-m-r/pass | 19 +++++++++++++++++-- apparmor.d/profiles-m-r/pcscd | 6 +++--- apparmor.d/profiles-m-r/qemu-ga | 7 +++---- apparmor.d/profiles-s-z/smplayer | 3 +-- apparmor.d/profiles-s-z/top | 6 ++---- apparmor.d/profiles-s-z/wl-copy | 3 ++- apparmor.d/profiles-s-z/yadifad | 9 +++++---- 29 files changed, 80 insertions(+), 40 deletions(-) diff --git a/apparmor.d/groups/apt/command-not-found b/apparmor.d/groups/apt/command-not-found index 6650ccedf..00818d011 100644 --- a/apparmor.d/groups/apt/command-not-found +++ b/apparmor.d/groups/apt/command-not-found @@ -25,6 +25,8 @@ profile command-not-found @{exec_path} { @{lib}/python3/dist-packages/CommandNotFound/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, + @{lib}/ r, + /usr/share/command-not-found/{,**} r, /var/lib/command-not-found/commands.db rwk, diff --git a/apparmor.d/groups/children/child-dpkg b/apparmor.d/groups/children/child-dpkg index 4f65ab28b..a90f2a85b 100644 --- a/apparmor.d/groups/children/child-dpkg +++ b/apparmor.d/groups/children/child-dpkg @@ -43,7 +43,7 @@ profile child-dpkg { /var/lib/dpkg/tmp.ci/md5sums rw, /var/lib/dpkg/triggers/Lock rw, /var/lib/dpkg/updates/* rw, - /var/log/dpkg.log ra, + /var/log/dpkg.log rw, # file_inherit /tmp/#@{int} rw, diff --git a/apparmor.d/groups/children/child-open b/apparmor.d/groups/children/child-open index 3a10d9273..9b34f319e 100644 --- a/apparmor.d/groups/children/child-open +++ b/apparmor.d/groups/children/child-open @@ -19,7 +19,7 @@ abi , include -profile child-open { +profile child-open flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/children/child-open-browsers b/apparmor.d/groups/children/child-open-browsers index 639c32a9b..e3da8f38d 100644 --- a/apparmor.d/groups/children/child-open-browsers +++ b/apparmor.d/groups/children/child-open-browsers @@ -15,7 +15,7 @@ abi , include -profile child-open-browsers { +profile child-open-browsers flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/children/child-pager b/apparmor.d/groups/children/child-pager index cfcc832be..ebaf6724d 100644 --- a/apparmor.d/groups/children/child-pager +++ b/apparmor.d/groups/children/child-pager @@ -28,6 +28,8 @@ profile child-pager { @{system_share_dirs}/terminfo/{,**} r, + @{HOME}/.lesshst r, + owner @{HOME}/ r, owner @{HOME}/.lesshs* rw, owner @{HOME}/.terminfo/@{int}/* r, diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index f8385a89b..bdadeabe3 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -56,7 +56,6 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/pipewire-@{int}.lock rwk, owner @{run}/user/@{uid}/pulse/pid rw, - @{run}/udev/data/c81:@{int} r, # For video4linux @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/bus/ r, @@ -65,12 +64,11 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/usb@{int}/**/{idVendor,idProduct,removable,uevent} r, @{sys}/devices/**/device:*/**/path r, @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name,bios_vendor,board_vendor} r, - @{sys}/module/apparmor/parameters/enabled r, # deny ? + @{sys}/module/apparmor/parameters/enabled r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/media@{int} rw, - /dev/video@{int} rw, include if exists } diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland index 93a652573..a4f98c096 100644 --- a/apparmor.d/groups/freedesktop/xwayland +++ b/apparmor.d/groups/freedesktop/xwayland @@ -18,6 +18,8 @@ profile xwayland @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term hup) peer=kwin_wayland, signal (receive) set=(term hup) peer=login, + unix type=stream addr=none peer=(label=gnome-shell, addr=none), + @{exec_path} mrix, @{sh_path} rix, diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index 0fc2add0e..e51ed5b8d 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -64,14 +64,16 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { /usr/share/gnome-shell/{,**} r, /usr/share/icu/@{int}.@{int}/*.dat r, + /tmp/ r, + /var/tmp/ r, + owner @{gdm_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rwl, owner @{gdm_cache_dirs}/gstreamer-1.0/ rw, owner @{gdm_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, owner @{gdm_config_dirs}/dconf/user r, owner @{GDM_HOME}/greeter-dconf-defaults r, - /tmp/ r, - /var/tmp/ r, + owner @{HOME}/ r, owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, owner @{user_cache_dirs}/gstreamer-1.0/ rw, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 08ae20d49..c1802c0a5 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -153,7 +153,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{sys}/devices/platform/**/uevent r, @{sys}/devices/virtual/**/uevent r, @{sys}/devices/virtual/dmi/id/chassis_type r, - @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r, + @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/temp* r, @{sys}/firmware/acpi/pm_profile r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw, diff --git a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon index dab1f58a9..46d21977c 100644 --- a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon +++ b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon @@ -19,7 +19,7 @@ profile gnome-remote-desktop-daemon @{exec_path} { network inet stream, network inet6 stream, - #aa:dbus own bus=session name=org.gnome.RemoteDesktop.User + #aa:dbus own bus=session name=org.gnome.RemoteDesktop #aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/session-migration b/apparmor.d/groups/gnome/session-migration index 570515cd7..1f82e7fe0 100644 --- a/apparmor.d/groups/gnome/session-migration +++ b/apparmor.d/groups/gnome/session-migration @@ -13,6 +13,7 @@ profile session-migration @{exec_path} { @{exec_path} mr, @{sh_path} rix, + @{bin}/gsettings rPx, /usr/share/session-migration/scripts/*.sh rix, /usr/share/session-migration/{,**} r, diff --git a/apparmor.d/groups/systemd/systemd-machine-id-setup b/apparmor.d/groups/systemd/systemd-machine-id-setup index 71c9d0467..26e5e5980 100644 --- a/apparmor.d/groups/systemd/systemd-machine-id-setup +++ b/apparmor.d/groups/systemd/systemd-machine-id-setup @@ -19,6 +19,7 @@ profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) { ptrace (read), + mount options=(rw rshared) -> /, mount options=(rw rslave) -> /, umount /etc/machine-id, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 220cbb54c..e5be870f4 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -93,6 +93,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{run}/udev/ rw, @{run}/udev/** rwk, + @{run}/credentials/systemd-udev-load-credentials.service/ r, @{run}/systemd/network/ r, @{run}/systemd/network/*.link rw, @{run}/systemd/notify rw, diff --git a/apparmor.d/groups/systemd/systemd-user-runtime-dir b/apparmor.d/groups/systemd/systemd-user-runtime-dir index 38d2d3931..cd70cc8bd 100644 --- a/apparmor.d/groups/systemd/systemd-user-runtime-dir +++ b/apparmor.d/groups/systemd/systemd-user-runtime-dir @@ -20,6 +20,8 @@ profile systemd-user-runtime-dir @{exec_path} { capability net_admin, capability sys_admin, + network unix stream, + mount fstype=tmpfs options=(rw,nosuid,nodev) -> @{run}/user/@{uid}/, umount @{run}/user/@{uid}/, diff --git a/apparmor.d/groups/ubuntu/do-release-upgrade b/apparmor.d/groups/ubuntu/do-release-upgrade index a2f93f42d..4ee62b2e0 100644 --- a/apparmor.d/groups/ubuntu/do-release-upgrade +++ b/apparmor.d/groups/ubuntu/do-release-upgrade @@ -37,10 +37,15 @@ profile do-release-upgrade @{exec_path} { /var/lib/ubuntu-release-upgrader/release-upgrade-available rw, /var/lib/update-manager/* rw, - /var/cache/apt/pkgcache.bin{,.*} rw, - owner @{PROC}/@{pid}/fd/ r, + /var/cache/apt/ rw, + /var/cache/apt/pkgcache.bin rw, + /var/cache/apt/pkgcache.bin.@{rand6} rw, + /var/cache/apt/srcpkgcache.bin rw, + /var/cache/apt/srcpkgcache.bin.@{rand6} rw, + @{PROC}/@{pids}/mountinfo r, + owner @{PROC}/@{pid}/fd/ r, include if exists } diff --git a/apparmor.d/groups/xfce/xfce-panel b/apparmor.d/groups/xfce/xfce-panel index 0b3530b48..44c9be032 100644 --- a/apparmor.d/groups/xfce/xfce-panel +++ b/apparmor.d/groups/xfce/xfce-panel @@ -23,7 +23,7 @@ profile xfce-panel @{exec_path} { @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix, @{lib}/gio-launch-desktop rix, - @{bin}/sudo rCx -> root, + @{bin}/sudo rCx -> root, /usr/share/desktop-directories/{,**} r, /usr/share/livecheck/** r, diff --git a/apparmor.d/groups/xfce/xfce-session b/apparmor.d/groups/xfce/xfce-session index f2b14b313..b19c11b3b 100644 --- a/apparmor.d/groups/xfce/xfce-session +++ b/apparmor.d/groups/xfce/xfce-session @@ -58,7 +58,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) { profile systemctl flags=(attach_disconnected) { include include - + include if exists } diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app index 41d72d143..83be5477c 100644 --- a/apparmor.d/profiles-a-f/flatpak-app +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -39,11 +39,12 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { network inet6 stream, network netlink dgram, network netlink raw, + network unix stream, ptrace (read), ptrace trace peer=flatpak-app, - signal (receive) set=(int) peer=flatpak-portal, + signal (receive) set=(int term) peer=flatpak-portal, signal (receive) set=(int) peer=flatpak-session-helper, @{bin}/** rmix, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index d147d77b0..e03479003 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -12,7 +12,7 @@ include @{exec_path} = @{bin}/git @{bin}/git-* @{exec_path} += @{lib_dirs}/git @{lib_dirs}/git-* @{lib_dirs}/mergetools/* -profile git @{exec_path} { +profile git @{exec_path} flags=(attach_disconnected) { include include include @@ -110,7 +110,7 @@ profile git @{exec_path} { deny /dev/shm/.org.chromium.Chromium* rw, deny owner @{code_config_dirs}/** rw, - profile gpg { + profile gpg flags=(attach_disconnected) { include include @@ -127,7 +127,7 @@ profile git @{exec_path} { include if exists } - profile ssh { + profile ssh flags=(attach_disconnected) { include include @@ -156,7 +156,7 @@ profile git @{exec_path} { include if exists } - profile exec { + profile exec flags=(attach_disconnected) { include owner @{user_build_dirs}/**/bin/* mr, @@ -164,7 +164,7 @@ profile git @{exec_path} { include if exists } - profile editor { + profile editor flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-g-l/ifup b/apparmor.d/profiles-g-l/ifup index 605c26f92..e621bd7f0 100644 --- a/apparmor.d/profiles-g-l/ifup +++ b/apparmor.d/profiles-g-l/ifup @@ -119,6 +119,7 @@ profile ifup @{exec_path} { @{PROC}/sys/net/ipv6/conf/*/accept_ra rw, @{PROC}/sys/net/ipv6/conf/*/autoconf rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/lsusb b/apparmor.d/profiles-g-l/lsusb index eadda4785..22e8a7cd2 100644 --- a/apparmor.d/profiles-g-l/lsusb +++ b/apparmor.d/profiles-g-l/lsusb @@ -13,6 +13,8 @@ profile lsusb @{exec_path} { include include + capability net_admin, + network netlink raw, @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/nvidia-settings b/apparmor.d/profiles-m-r/nvidia-settings index d4bda6123..87271a03d 100644 --- a/apparmor.d/profiles-m-r/nvidia-settings +++ b/apparmor.d/profiles-m-r/nvidia-settings @@ -17,6 +17,13 @@ profile nvidia-settings @{exec_path} { /usr/share/pixmaps/{,**} r, + owner @{HOME}/.nvidia-settings-rc rw, + + @{sys}/bus/pci/devices/ r, + @{sys}/devices/@{pci}/config r, + + @{PROC}/devices r, + include if exists } diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 724bd8f38..7c4f697e0 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -29,7 +29,6 @@ profile pass @{exec_path} { @{bin}/mkdir rix, @{bin}/mktemp rix, @{bin}/mv rix, - @{bin}/pkill rix, @{bin}/rm rix, @{bin}/rmdir rix, @{bin}/sed rix, @@ -44,10 +43,11 @@ profile pass @{exec_path} { @{bin}/which rix, @{bin}/git rCx -> git, - @{lib}/git{,-core}/git rCx -> git, @{bin}/gpg{2,} rCx -> gpg, + @{bin}/pkill rCx -> pkill, @{bin}/qdbus rCx -> qdbus, @{bin}/vim{,.*} rCx -> editor, + @{lib}/git{,-core}/git rCx -> git, @{bin}/wl-{copy,paste} rPx, @{bin}/xclip rPx, @@ -72,6 +72,21 @@ profile pass @{exec_path} { /dev/tty rw, + profile pkill { + include + + capability sys_ptrace, + + ptrace read, + + @{bin}/pkill mr, + + @{PROC}/@{pid}/cgroup r, + @{PROC}/tty/drivers r, + + include if exists + } + profile editor { include include diff --git a/apparmor.d/profiles-m-r/pcscd b/apparmor.d/profiles-m-r/pcscd index 085061b15..9a25cd7d2 100644 --- a/apparmor.d/profiles-m-r/pcscd +++ b/apparmor.d/profiles-m-r/pcscd @@ -16,6 +16,8 @@ profile pcscd @{exec_path} { network netlink raw, + ptrace (read) peer=veracrypt, + ptrace (read) peer=@{p_systemd_user}, ptrace (read) peer=gsd-smartcard, ptrace (read) peer=pkcs11-register, ptrace (read) peer=rngd, @@ -24,9 +26,7 @@ profile pcscd @{exec_path} { @{exec_path} mr, /etc/libccid_Info.plist r, - /etc/reader.conf.d/ r, - /etc/reader.conf.d/libccidtwin r, - /etc/reader.conf.d/reader.conf r, + /etc/reader.conf.d/{,**} r, owner @{run}/pcscd/{,pcscd.pid} rw, diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index 958706374..ac94727c3 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -21,10 +21,9 @@ profile qemu-ga @{exec_path} { ptrace (read) peer=@{p_systemd}, - dbus send bus=system path=/org/freedesktop/login1 - interface=org.freedesktop.login1.Manager - member={ScheduleShutdown,SetWallMessage} - peer=(name=org.freedesktop.login1, label=systemd-logind), + unix type=stream addr=@@{hex16}/bus/shutdown/system, + + #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/smplayer b/apparmor.d/profiles-s-z/smplayer index d8de18f20..54b4080f1 100644 --- a/apparmor.d/profiles-s-z/smplayer +++ b/apparmor.d/profiles-s-z/smplayer @@ -44,7 +44,7 @@ profile smplayer @{exec_path} { @{bin}/pacmd rPx, @{bin}/smtube rPx, @{bin}/youtube-dl rPx, - @{bin}/yt-dlp rPx, + @{bin}/{y,}t-dlp rPx, /usr/share/hwdata/pnp.ids r, @@ -87,5 +87,4 @@ profile smplayer @{exec_path} { include if exists } - # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/top b/apparmor.d/profiles-s-z/top index 9e4b7c11a..09728ef45 100644 --- a/apparmor.d/profiles-s-z/top +++ b/apparmor.d/profiles-s-z/top @@ -11,8 +11,8 @@ include profile top @{exec_path} flags=(attach_disconnected) { include include - include include + include capability dac_read_search, capability kill, @@ -36,16 +36,14 @@ profile top @{exec_path} flags=(attach_disconnected) { @{run}/systemd/sessions/ r, @{sys}/devices/system/node/ r, - @{sys}/devices/system/node/node@{int}/meminfo r, @{sys}/devices/system/node/node@{int}/cpumap r, + @{sys}/devices/system/node/node@{int}/meminfo r, @{PROC}/ r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/environ r, @{PROC}/@{pids}/oom_{,score_}adj r, - @{PROC}/@{pids}/oom_{,score_}adj r, - @{PROC}/@{pids}/oom_score r, @{PROC}/@{pids}/oom_score r, @{PROC}/@{pids}/stat r, @{PROC}/@{pids}/statm r, diff --git a/apparmor.d/profiles-s-z/wl-copy b/apparmor.d/profiles-s-z/wl-copy index 3ea916395..a71e4cbd9 100644 --- a/apparmor.d/profiles-s-z/wl-copy +++ b/apparmor.d/profiles-s-z/wl-copy @@ -7,8 +7,9 @@ abi , include @{exec_path} = @{bin}/wl-{copy,paste} -profile wl-copy @{exec_path} { +profile wl-copy @{exec_path} flags=(attach_disconnected) { include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/yadifad b/apparmor.d/profiles-s-z/yadifad index c22e3cdd9..bb896bd8c 100644 --- a/apparmor.d/profiles-s-z/yadifad +++ b/apparmor.d/profiles-s-z/yadifad @@ -21,14 +21,15 @@ profile yadifad @{exec_path} { @{exec_path} mr, - /etc/yadifa/yadifad.conf r, + /etc/yadifa/* r, /var/log/yadifa/{,**} rw, - owner /var/lib/yadifa/{,**} rw, + owner /var/lib/yadifa/ rw, + owner /var/lib/yadifa/** rwk, - owner @{run}/yadifa/{,*} rw, - owner @{run}/yadifa/yadifad.pid rwk, + owner @{run}/yadifa/ rw, + owner @{run}/yadifa/** rwk, include if exists } From e8aa338d5e9aadee5f2281740de20077cbbdfe3e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Jun 2024 11:26:15 +0100 Subject: [PATCH 0005/1455] feat(profile): gnome-shell//open: ensure gnome can start any program. --- apparmor.d/groups/gnome/gnome-shell | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index f1b3ad7a0..8baf75c4e 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -394,18 +394,21 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include if exists } - profile open flags=(attach_disconnected,mediate_deleted) { + profile open flags=(attach_disconnected,mediate_deleted,complain) { include - include - unix receive type=stream, + network inet stream, + network unix stream, - @{lib}/gio-launch-desktop mr, @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, + @{lib}/gio-launch-desktop mr, - @{lib}/* PUx, - /usr/games/* PUx, - /usr/share/gnome-shell/extensions/ding@rastersoft.com/{,*/}ding.js rPx, + @{lib}/** PUx, + @{bin}/** PUx, + /opt/*/** PUx, + /usr/share/*/** PUx, + /usr/local/bin/** PUx, + /usr/games/** PUx, owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, From e17add7e63b3a77f2cadaf3f5b7b5a4366e1b454 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 24 Jun 2024 13:47:24 +0100 Subject: [PATCH 0006/1455] fix(profile): keyboard backlight on all hardware fix #402 --- apparmor.d/groups/freedesktop/upowerd | 6 +++--- apparmor.d/groups/systemd/systemd-backlight | 7 +++---- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index d57efafc4..92e6148b3 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -49,11 +49,11 @@ profile upowerd @{exec_path} flags=(attach_disconnected) { @{sys}/class/sound/ r, @{sys}/devices/ r, @{sys}/devices/**/capabilities/* r, + @{sys}/devices/**/leds/**/brightness rw, + @{sys}/devices/**/leds/**/brightness_hw_changed r, + @{sys}/devices/**/leds/**/max_brightness r, @{sys}/devices/**/power_supply/**/* r, @{sys}/devices/**/uevent r, - @{sys}/devices/platform/**/leds/**/brightness rw, - @{sys}/devices/platform/**/leds/**/brightness_hw_changed r, - @{sys}/devices/platform/**/leds/**/max_brightness r, @{sys}/devices/virtual/dmi/id/product_name r, /dev/input/event* r, diff --git a/apparmor.d/groups/systemd/systemd-backlight b/apparmor.d/groups/systemd/systemd-backlight index 4a80835ed..3617ddd33 100644 --- a/apparmor.d/groups/systemd/systemd-backlight +++ b/apparmor.d/groups/systemd/systemd-backlight @@ -37,10 +37,9 @@ profile systemd-backlight @{exec_path} { @{sys}/devices/@{pci}/drm/card@{int}/**/{uevent,type} r, @{sys}/devices/@{pci}/drm/card@{int}/**/brightness rw, @{sys}/devices/@{pci}/uevent r, - - @{sys}/devices/platform/**/leds/*backlight*/brightness rw, - @{sys}/devices/platform/**/leds/*backlight*/max_brightness r, - @{sys}/devices/platform/**/leds/*backlight*/uevent r, + @{sys}/devices/**/leds/**/brightness rw, + @{sys}/devices/**/leds/**/brightness_hw_changed r, + @{sys}/devices/**/leds/**/max_brightness r, include if exists } From 81ac0d0b6ddd4baf4c7fa34418b27fd6b5965d0a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 24 Jun 2024 17:39:08 +0100 Subject: [PATCH 0007/1455] feat(profile): add ollama. --- apparmor.d/profiles-m-r/ollama | 50 ++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 apparmor.d/profiles-m-r/ollama diff --git a/apparmor.d/profiles-m-r/ollama b/apparmor.d/profiles-m-r/ollama new file mode 100644 index 000000000..483e97864 --- /dev/null +++ b/apparmor.d/profiles-m-r/ollama @@ -0,0 +1,50 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ollama +profile ollama @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + /tmp/ollama@{int}/runners/*/* mr, + /tmp/ollama@{int}/runners/*/ollama_*_server rix, # TODO: rPx and remove graphics from here. + + /usr/ r, + /usr/local/ r, + /usr/local/lib/ r, + + @{lib}/ r, + + owner /var/lib/ollama/ rw, + owner /var/lib/ollama/** rwlk, + + /tmp/ r, + owner @{tmp}/ollama@{int}/{,**} rw, + owner @{tmp}/ollama@{int}/runners/{,**} mr, + + @{sys}/devices/@{pci}/numa_node r, + @{sys}/devices/system/node/node@{int}/cpumap r, + + @{PROC}/devices r, + @{PROC}/sys/net/core/somaxconn r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/task/@{tid}/comm w, + + include if exists +} \ No newline at end of file From cf8ae8b147235f08b5ea10492801fe50d64dcad7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 24 Jun 2024 17:40:34 +0100 Subject: [PATCH 0008/1455] feat(profile): add snapshot. --- apparmor.d/profiles-s-z/snapshot | 28 ++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 29 insertions(+) create mode 100644 apparmor.d/profiles-s-z/snapshot diff --git a/apparmor.d/profiles-s-z/snapshot b/apparmor.d/profiles-s-z/snapshot new file mode 100644 index 000000000..5afff36e6 --- /dev/null +++ b/apparmor.d/profiles-s-z/snapshot @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only +# vim:syntax=apparmor + +abi , + +include + +@{exec_path} = @{bin}/snapshot +profile snapshot @{exec_path} { + include + include + include + include + include + + @{exec_path} mr, + + owner @{user_pictures_dirs}/Camera/{,**} rw, + owner @{user_videos_dirs}/Camera/{,**} rw, + + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 1bcf1e7d9..f92e225fb 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -294,6 +294,7 @@ snap-update-ns complain snapd complain snapd-apparmor complain snapd-core-fixup complain +snapshot complain ssservice complain startplasma complain startx attach_disconnected,complain From 09bcdf20d833629687e78a8237d218681acd6ac3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 24 Jun 2024 18:00:48 +0100 Subject: [PATCH 0009/1455] build: update flags manifest. --- dists/flags/main.flags | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index f92e225fb..6da4d4bc4 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -50,7 +50,9 @@ busctl complain cc-remote-login-helper complain cctk complain child-modprobe-nvidia attach_disconnected,complain -child-open complain +child-open attach_disconnected,complain +child-open-any attach_disconnected,complain +child-open-browsers attach_disconnected,complain chronyd attach_disconnected,complain cockpit-askpass complain cockpit-bridge complain @@ -102,8 +104,6 @@ evolution-user-prompter complain fail2ban-client attach_disconnected,complain fail2ban-server attach_disconnected,complain fdisk complain -file-roller complain -firefox-kmozillahelper complain firewall-applet attach_disconnected,complain firewall-config complain flameshot complain @@ -118,7 +118,6 @@ foliate attach_disconnected,complain fractal attach_disconnected,complain fuse-overlayfs complain fusermount complain -gcr-ssh-agent complain gdm-generate-config complain gdm-runtime-config complain gdm-session attach_disconnected,complain @@ -171,12 +170,11 @@ grub-syslinux2cfg complain gsd-printer attach_disconnected,complain gsd-wwan complain gsettings complain -gvfs-udisks2-volume-monitor attach_disconnected,complain gvfsd-dav complain gvfsd-wsdd complain hostnamectl complain ibus-engine-table complain -ibus-memconf complain +ibus-memconf attach_disconnected,complain im-launch complain init-exim4 complain install-info complain @@ -226,7 +224,6 @@ locale-gen complain localectl complain login attach_disconnected,complain loginctl complain -loupe attach_disconnected,complain low-memory-monitor attach_disconnected,complain lvm attach_disconnected,complain lvmconfig complain @@ -253,6 +250,7 @@ nmcli complain nvidia-detector complain nvidia-persistenced complain okular complain +ollama attach_disconnected,complain os-prober attach_disconnected,complain package-data-downloader complain packagekitd attach_disconnected,complain @@ -303,7 +301,7 @@ steam-fossilize attach_disconnected,complain steam-game-native attach_disconnected,complain steam-game-proton attach_disconnected,complain steam-gameoverlayui attach_disconnected,complain -steam-launch complain +steam-launch attach_disconnected,complain steam-launcher attach_disconnected,complain steam-runtime attach_disconnected,complain steamerrorreporter attach_disconnected,complain @@ -356,7 +354,6 @@ systemd-shutdown complain systemd-socket-proxyd complain systemd-udevd attach_disconnected,complain systemd-user-sessions complain -systemd-userdbd attach_disconnected,mediate_deleted,complain systemd-userwork attach_disconnected,complain systemsettings complain tracker-writeback complain From 8da557ba0462ee2d6aaa8b6f95bb4b6902bce90c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 24 Jun 2024 18:01:41 +0100 Subject: [PATCH 0010/1455] feat(profile): add totem. --- apparmor.d/profiles-s-z/totem | 85 +++++++++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 86 insertions(+) create mode 100644 apparmor.d/profiles-s-z/totem diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem new file mode 100644 index 000000000..c75cea7ff --- /dev/null +++ b/apparmor.d/profiles-s-z/totem @@ -0,0 +1,85 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/totem +profile totem @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + include + include + + network netlink raw, + + signal (send) set=(kill) peer=totem//bwrap, + + #aa:dbus own bus=session name=org.mpris.MediaPlayer2.totem + #aa:dbus talk bus=session name=org.gnome.Nautilus label=nautilus + #aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + + @{exec_path} mr, + + @{bin}/bwrap rCx -> bwrap, + + /usr/share/xml/iso-codes/{,**} r, + /usr/share/grilo-plugins/{,**} r, + /usr/share/thumbnailers/{,**} r, + + owner @{user_music_dirs}/{,**} rw, + owner @{user_pictures_dirs}/{,**} rw, + owner @{user_torrents_dirs}/{,**} rw, + owner @{user_videos_dirs}/{,**} rw, + + owner @{user_cache_dirs}/gnome-desktop-thumbnailer/gstreamer-1.0/{,**} r, + owner @{user_share_dirs}/grilo-plugins/ rw, + owner @{user_share_dirs}/grilo-plugins/** rwlk, + + owner @{tmp}/flatpak-seccomp-@{rand6} rw, + owner @{tmp}/gnome-desktop-thumbnailer-@{rand6}/{,**} rw, + + owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r, + owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=** r, + + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/task/@{tid}/comm w, + + deny @{user_share_dirs}/gvfs-metadata/* r, + + profile bwrap flags=(attach_disconnected) { + include + include + include + include + include + + capability dac_override, + + @{bin}/bwrap mr, + @{bin}/totem-video-thumbnailer rix, + + owner @{tmp}/flatpak-seccomp-@{rand6} rw, + owner @{tmp}/gnome-desktop-file-to-thumbnail.* rw, + owner @{user_cache_dirs}/gnome-desktop-thumbnailer/{,**} rw, + + @{PROC}/sys/vm/mmap_min_addr r, + owner @{PROC}/@{pid}/task/@{tid}/comm w, + + /dev/ r, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 6da4d4bc4..8bb7843b8 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -356,6 +356,7 @@ systemd-udevd attach_disconnected,complain systemd-user-sessions complain systemd-userwork attach_disconnected,complain systemsettings complain +totem attach_disconnected,complain tracker-writeback complain udev-dmi-memory-id complain udisksctl complain From 5b739233852cae62848dbcb9f84cf473bab89516 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 25 Jun 2024 12:27:22 +0100 Subject: [PATCH 0011/1455] fix(profile): ensure backlight on all hardware --- apparmor.d/groups/freedesktop/xorg | 9 +++++---- apparmor.d/groups/gnome/gsd-power | 19 ++++++++++--------- apparmor.d/groups/kde/kauth-backlighthelper | 10 +++++----- apparmor.d/groups/systemd/systemd-backlight | 15 ++++++++------- .../groups/xfce/xfpm-power-backlight-helper | 10 +++++----- apparmor.d/profiles-g-l/light | 14 ++++++++------ apparmor.d/profiles-s-z/thermald | 2 +- 7 files changed, 42 insertions(+), 37 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 9e1625e8e..378c81119 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -92,13 +92,14 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{sys}/class/ r, @{sys}/class/{tty,input,drm}/ r, @{sys}/class/power_supply/ r, + @{sys}/devices/@{pci}/ r, + @{sys}/devices/@{pci}/backlight/**/{,max_,actual_}brightness r, + @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/backlight/**/brightness rw, + @{sys}/devices/@{pci}/boot_vga r, @{sys}/devices/**/{uevent,name,id,config} r, @{sys}/devices/**/hid r, @{sys}/devices/**/power_supply/**/{type,online} r, - @{sys}/devices/@{pci}/ r, - @{sys}/devices/@{pci}/backlight/*/{,max_}brightness r, - @{sys}/devices/@{pci}/backlight/*/brightness rw, - @{sys}/devices/@{pci}/boot_vga r, @{sys}/devices/platform/ r, @{sys}/module/i915/{,**} r, diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 03c23744f..096839994 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -69,17 +69,18 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { @{sys}/class/ r, @{sys}/class/backlight/ r, - @{sys}/devices/@{pci}/class r, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/*_backlight/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/backlight/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/backlight/**/brightness rw, - @{sys}/devices/@{pci}/backlight/**/{max_brightness,actual_brightness} r, - @{sys}/devices/@{pci}/backlight/**/{uevent,type} r, - @{sys}/devices/@{pci}/drm/card@{int}/**/brightness rw, - @{sys}/devices/@{pci}/drm/card@{int}/**/{max_brightness,actual_brightness} r, + @{sys}/devices/@{pci}/class r, + @{sys}/devices/@{pci}/drm/card@{int}/**/{,max_,actual_}brightness rw, @{sys}/devices/@{pci}/drm/card@{int}/**/{uevent,type,enabled} r, - - @{sys}/devices/platform/**/leds/*backlight*/uevent r, - @{sys}/devices/platform/**/leds/*backlight*/max_brightness r, - @{sys}/devices/platform/**/leds/*backlight*/brightness rw, + @{sys}/devices/@{pci}/drm/card@{int}/**/brightness rw, + @{sys}/devices/**/leds/**/{,max_,actual_}brightness rw, + @{sys}/devices/**/leds/**/{uevent,type,enabled} r, + @{sys}/devices/**/leds/**/brightness_hw_changed r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, diff --git a/apparmor.d/groups/kde/kauth-backlighthelper b/apparmor.d/groups/kde/kauth-backlighthelper index 0098d81c0..9b42d9a10 100644 --- a/apparmor.d/groups/kde/kauth-backlighthelper +++ b/apparmor.d/groups/kde/kauth-backlighthelper @@ -22,14 +22,14 @@ profile kauth-backlighthelper @{exec_path} { @{sys}/class/backlight/ r, @{sys}/class/leds/ r, - @{sys}/devices/@{pci}/backlight/**/{max_brightness,actual_brightness} r, - @{sys}/devices/@{pci}/backlight/**/{uevent,type} r, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/*_backlight/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/backlight/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/backlight/**/brightness rw, - @{sys}/devices/@{pci}/drm/card@{int}/**/{max_brightness,actual_brightness} r, + @{sys}/devices/@{pci}/drm/card@{int}/**/{,max_,actual_}brightness rw, @{sys}/devices/@{pci}/drm/card@{int}/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/drm/card@{int}/**/brightness rw, - @{sys}/devices/@{pci}/intel_backlight/{max_,}brightness rw, - @{sys}/devices/@{pci}/intel_backlight/type r, /dev/tty r, diff --git a/apparmor.d/groups/systemd/systemd-backlight b/apparmor.d/groups/systemd/systemd-backlight index 3617ddd33..066dbf33e 100644 --- a/apparmor.d/groups/systemd/systemd-backlight +++ b/apparmor.d/groups/systemd/systemd-backlight @@ -27,19 +27,20 @@ profile systemd-backlight @{exec_path} { @{sys}/class/ r, @{sys}/class/backlight/ r, - @{sys}/devices/@{pci}/*:@{int}.@{int}/**/ r, @{sys}/devices/@{pci}/ r, - @{sys}/devices/@{pci}/backlight/**/{max_brightness,actual_brightness} r, - @{sys}/devices/@{pci}/backlight/**/{uevent,type} r, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/*_backlight/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/backlight/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/backlight/**/brightness rw, @{sys}/devices/@{pci}/class r, - @{sys}/devices/@{pci}/drm/card@{int}/**/{max_brightness,actual_brightness} r, - @{sys}/devices/@{pci}/drm/card@{int}/**/{uevent,type} r, + @{sys}/devices/@{pci}/drm/card@{int}/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/drm/card@{int}/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/drm/card@{int}/**/brightness rw, @{sys}/devices/@{pci}/uevent r, - @{sys}/devices/**/leds/**/brightness rw, + @{sys}/devices/**/leds/**/{,max_,actual_}brightness rw, + @{sys}/devices/**/leds/**/{uevent,type,enabled} r, @{sys}/devices/**/leds/**/brightness_hw_changed r, - @{sys}/devices/**/leds/**/max_brightness r, include if exists } diff --git a/apparmor.d/groups/xfce/xfpm-power-backlight-helper b/apparmor.d/groups/xfce/xfpm-power-backlight-helper index a00ebb094..5f71150e1 100644 --- a/apparmor.d/groups/xfce/xfpm-power-backlight-helper +++ b/apparmor.d/groups/xfce/xfpm-power-backlight-helper @@ -15,14 +15,14 @@ profile xfpm-power-backlight-helper @{exec_path} { @{sys}/class/backlight/ r, @{sys}/class/leds/ r, - @{sys}/devices/@{pci}/backlight/**/{max_brightness,actual_brightness} r, - @{sys}/devices/@{pci}/backlight/**/{uevent,type} r, + @{sys}/devices/@{pci}/backlight/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/backlight/**/brightness rw, - @{sys}/devices/@{pci}/drm/card@{int}/**/{max_brightness,actual_brightness} r, + @{sys}/devices/@{pci}/drm/card@{int}/**/{,max_,actual_}brightness rw, @{sys}/devices/@{pci}/drm/card@{int}/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/drm/card@{int}/**/brightness rw, - @{sys}/devices/@{pci}/intel_backlight/{max_,}brightness rw, - @{sys}/devices/@{pci}/intel_backlight/type r, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/*_backlight/{uevent,type,enabled} r, include if exists } diff --git a/apparmor.d/profiles-g-l/light b/apparmor.d/profiles-g-l/light index d4ff8a7d7..379f32ac8 100644 --- a/apparmor.d/profiles-g-l/light +++ b/apparmor.d/profiles-g-l/light @@ -23,12 +23,14 @@ profile light @{exec_path} { @{sys}/class/backlight/ r, @{sys}/class/leds/ r, - - @{sys}/devices/@{pci}/drm/**/intel_backlight/{,max_}brightness r, - @{sys}/devices/@{pci}/drm/**/intel_backlight/brightness rw, - - @{sys}/devices/@{pci}/backlight/*/{,max_}brightness r, - @{sys}/devices/@{pci}/backlight/*/brightness rw, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/*_backlight/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/backlight/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/backlight/**/brightness rw, + @{sys}/devices/**/leds/**/{,max_,actual_}brightness rw, + @{sys}/devices/**/leds/**/{uevent,type,enabled} r, + @{sys}/devices/**/leds/**/brightness_hw_changed r, # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-s-z/thermald b/apparmor.d/profiles-s-z/thermald index 1e72d45ec..abea43b61 100644 --- a/apparmor.d/profiles-s-z/thermald +++ b/apparmor.d/profiles-s-z/thermald @@ -38,7 +38,7 @@ profile thermald @{exec_path} flags=(attach_disconnected) { @{sys}/devices/system/cpu/intel_pstate/no_turbo rw, @{sys}/devices/system/cpu/intel_pstate/status r, - @{sys}/devices/@{pci}/drm/**/intel_backlight/max_brightness r, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness r, @{sys}/devices/@{pci}/power_limits/power_limit_@{int}_max_uw r, @{sys}/devices/@{pci}/power_limits/power_limit_@{int}_min_uw r, @{sys}/devices/@{pci}/power_limits/power_limit_@{int}_tmax_us r, From 272072d2a57465ebf90bf117239a30aedcb9694d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 25 Jun 2024 19:50:27 +0100 Subject: [PATCH 0012/1455] refractor(aa): rename base struct from RuleBase to Base --- pkg/aa/all.go | 8 ++++---- pkg/aa/apparmor_test.go | 10 +++++----- pkg/aa/base.go | 14 +++++++------- pkg/aa/blocks.go | 2 +- pkg/aa/capability.go | 6 +++--- pkg/aa/change_profile.go | 6 +++--- pkg/aa/data_test.go | 24 ++++++++++++------------ pkg/aa/dbus.go | 10 +++++----- pkg/aa/file.go | 16 ++++++++-------- pkg/aa/io_uring.go | 10 +++++----- pkg/aa/mount.go | 30 +++++++++++++++--------------- pkg/aa/mqueue.go | 10 +++++----- pkg/aa/network.go | 6 +++--- pkg/aa/parse_test.go | 38 +++++++++++++++++++------------------- pkg/aa/pivot_root.go | 6 +++--- pkg/aa/preamble.go | 34 +++++++++++++++++----------------- pkg/aa/profile.go | 2 +- pkg/aa/ptrace.go | 10 +++++----- pkg/aa/resolve_test.go | 2 +- pkg/aa/rlimit.go | 18 +++++++++--------- pkg/aa/signal.go | 14 +++++++------- pkg/aa/unix.go | 10 +++++----- pkg/aa/userns.go | 10 +++++----- pkg/logs/logs_test.go | 4 ++-- 24 files changed, 150 insertions(+), 150 deletions(-) diff --git a/pkg/aa/all.go b/pkg/aa/all.go index b3acb5d96..3004bbf95 100644 --- a/pkg/aa/all.go +++ b/pkg/aa/all.go @@ -9,11 +9,11 @@ const ( ) type All struct { - RuleBase + Base } func newAll(q Qualifier, rule rule) (Rule, error) { - return &All{RuleBase: newBase(rule)}, nil + return &All{Base: newBase(rule)}, nil } func (r *All) Validate() error { @@ -26,8 +26,8 @@ func (r *All) Compare(other Rule) int { func (r *All) Merge(other Rule) bool { o, _ := other.(*All) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } func (r *All) String() string { diff --git a/pkg/aa/apparmor_test.go b/pkg/aa/apparmor_test.go index 10cf366b4..d7a22b5bb 100644 --- a/pkg/aa/apparmor_test.go +++ b/pkg/aa/apparmor_test.go @@ -40,7 +40,7 @@ func TestAppArmorProfileFile_String(t *testing.T) { name: "foo", f: &AppArmorProfileFile{ Preamble: Rules{ - &Comment{RuleBase: RuleBase{Comment: " Simple test profile for the AppArmorProfileFile.String() method", IsLineRule: true}}, + &Comment{Base: Base{Comment: " Simple test profile for the AppArmorProfileFile.String() method", IsLineRule: true}}, nil, &Abi{IsMagic: true, Path: "abi/4.0"}, &Alias{Path: "/mnt/usr", RewrittenPath: "/usr"}, @@ -66,7 +66,7 @@ func TestAppArmorProfileFile_String(t *testing.T) { &Network{Domain: "inet", Type: "stream"}, &Network{Domain: "inet6", Type: "stream"}, &Mount{ - RuleBase: RuleBase{Comment: " failed perms check"}, + Base: Base{Comment: " failed perms check"}, MountConditions: MountConditions{ FsType: "fuse.portal", Options: []string{"rw", "rbind"}, @@ -204,9 +204,9 @@ func TestAppArmorProfileFile_Integration(t *testing.T) { name: "aa-status", f: &AppArmorProfileFile{ Preamble: Rules{ - &Comment{RuleBase: RuleBase{Comment: " apparmor.d - Full set of apparmor profiles", IsLineRule: true}}, - &Comment{RuleBase: RuleBase{Comment: " Copyright (C) 2021-2024 Alexandre Pujol ", IsLineRule: true}}, - &Comment{RuleBase: RuleBase{Comment: " SPDX-License-Identifier: GPL-2.0-only", IsLineRule: true}}, + &Comment{Base: Base{Comment: " apparmor.d - Full set of apparmor profiles", IsLineRule: true}}, + &Comment{Base: Base{Comment: " Copyright (C) 2021-2024 Alexandre Pujol ", IsLineRule: true}}, + &Comment{Base: Base{Comment: " SPDX-License-Identifier: GPL-2.0-only", IsLineRule: true}}, nil, &Abi{IsMagic: true, Path: "abi/3.0"}, &Include{IsMagic: true, Path: "tunables/global"}, diff --git a/pkg/aa/base.go b/pkg/aa/base.go index c05954267..6302a0fac 100644 --- a/pkg/aa/base.go +++ b/pkg/aa/base.go @@ -8,7 +8,7 @@ import ( "strings" ) -type RuleBase struct { +type Base struct { IsLineRule bool Comment string NoNewPrivs bool @@ -19,7 +19,7 @@ type RuleBase struct { Optional bool } -func newBase(rule rule) RuleBase { +func newBase(rule rule) Base { comment := "" fileInherit, noNewPrivs, optional := false, false, false @@ -44,7 +44,7 @@ func newBase(rule rule) RuleBase { optional = true comment = strings.Replace(comment, "optional: ", "", 1) } - return RuleBase{ + return Base{ Comment: comment, NoNewPrivs: noNewPrivs, FileInherit: fileInherit, @@ -52,7 +52,7 @@ func newBase(rule rule) RuleBase { } } -func newBaseFromLog(log map[string]string) RuleBase { +func newBaseFromLog(log map[string]string) Base { comment := "" fileInherit, noNewPrivs, optional := false, false, false @@ -70,7 +70,7 @@ func newBaseFromLog(log map[string]string) RuleBase { if log["info"] != "" { comment += " " + log["info"] } - return RuleBase{ + return Base{ IsLineRule: false, Comment: comment, NoNewPrivs: noNewPrivs, @@ -79,11 +79,11 @@ func newBaseFromLog(log map[string]string) RuleBase { } } -func (r RuleBase) Merge(other Rule) bool { +func (r Base) Merge(other Rule) bool { return false } -func (r *RuleBase) merge(other RuleBase) bool { +func (r *Base) merge(other Base) bool { if other.Comment != "" { r.Comment += " " + other.Comment } diff --git a/pkg/aa/blocks.go b/pkg/aa/blocks.go index b3ce0ba77..85f754958 100644 --- a/pkg/aa/blocks.go +++ b/pkg/aa/blocks.go @@ -10,7 +10,7 @@ const ( // Hat represents a single AppArmor hat. type Hat struct { - RuleBase + Base Name string Rules Rules } diff --git a/pkg/aa/capability.go b/pkg/aa/capability.go index f9f083f98..8a4d453b8 100644 --- a/pkg/aa/capability.go +++ b/pkg/aa/capability.go @@ -26,7 +26,7 @@ func init() { } type Capability struct { - RuleBase + Base Qualifier Names []string } @@ -37,7 +37,7 @@ func newCapability(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Capability{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Names: names, }, nil @@ -45,7 +45,7 @@ func newCapability(q Qualifier, rule rule) (Rule, error) { func newCapabilityFromLog(log map[string]string) Rule { return &Capability{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Names: Must(toValues(CAPABILITY, "name", log["capname"])), } diff --git a/pkg/aa/change_profile.go b/pkg/aa/change_profile.go index a6abb8772..4fc35a323 100644 --- a/pkg/aa/change_profile.go +++ b/pkg/aa/change_profile.go @@ -18,7 +18,7 @@ func init() { } type ChangeProfile struct { - RuleBase + Base Qualifier ExecMode string Exec string @@ -49,7 +49,7 @@ func newChangeProfile(q Qualifier, rule rule) (Rule, error) { } } return &ChangeProfile{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, ExecMode: mode, Exec: exec, @@ -59,7 +59,7 @@ func newChangeProfile(q Qualifier, rule rule) (Rule, error) { func newChangeProfileFromLog(log map[string]string) Rule { return &ChangeProfile{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), ExecMode: log["mode"], Exec: log["exec"], diff --git a/pkg/aa/data_test.go b/pkg/aa/data_test.go index b4e247868..b96fd865f 100644 --- a/pkg/aa/data_test.go +++ b/pkg/aa/data_test.go @@ -6,8 +6,8 @@ package aa var ( // Comment - comment1 = &Comment{RuleBase: RuleBase{Comment: "comment", IsLineRule: true}} - comment2 = &Comment{RuleBase: RuleBase{Comment: "another comment", IsLineRule: true}} + comment1 = &Comment{Base: Base{Comment: "comment", IsLineRule: true}} + comment2 = &Comment{Base: Base{Comment: "another comment", IsLineRule: true}} // Abi abi1 = &Abi{IsMagic: true, Path: "abi/4.0"} @@ -28,7 +28,7 @@ var ( // All all1 = &All{} - all2 = &All{RuleBase: RuleBase{Comment: "comment"}} + all2 = &All{Base: Base{Comment: "comment"}} // Rlimit rlimit1 = &Rlimit{Key: "nproc", Op: "<=", Value: "200"} @@ -94,13 +94,13 @@ var ( "flags": "rw, rbind", } mount1 = &Mount{ - RuleBase: RuleBase{Comment: " failed perms check"}, + Base: Base{Comment: " failed perms check"}, MountConditions: MountConditions{FsType: "overlay"}, Source: "overlay", MountPoint: "/var/lib/docker/overlay2/opaque-bug-check1209538631/merged/", } mount2 = &Mount{ - RuleBase: RuleBase{Comment: " failed perms check"}, + Base: Base{Comment: " failed perms check"}, MountConditions: MountConditions{Options: []string{"rw", "rbind"}}, Source: "/oldroot/dev/tty", MountPoint: "/newroot/dev/tty", @@ -238,9 +238,9 @@ var ( PeerLabel: "dbus-daemon", } unix2 = &Unix{ - RuleBase: RuleBase{FileInherit: true}, - Access: []string{"receive"}, - Type: "stream", + Base: Base{FileInherit: true}, + Access: []string{"receive"}, + Type: "stream", } // Dbus @@ -318,10 +318,10 @@ var ( } file1 = &File{Path: "/usr/share/poppler/cMap/Identity-H", Access: []string{"r"}} file2 = &File{ - RuleBase: RuleBase{NoNewPrivs: true}, - Owner: true, - Path: "@{PROC}/4163/cgroup", - Access: []string{"r"}, + Base: Base{NoNewPrivs: true}, + Owner: true, + Path: "@{PROC}/4163/cgroup", + Access: []string{"r"}, } // Link diff --git a/pkg/aa/dbus.go b/pkg/aa/dbus.go index f34b8e09c..95b731531 100644 --- a/pkg/aa/dbus.go +++ b/pkg/aa/dbus.go @@ -21,7 +21,7 @@ func init() { } type Dbus struct { - RuleBase + Base Qualifier Access []string Bus string @@ -39,7 +39,7 @@ func newDbus(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Dbus{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Access: accesses, Bus: rule.GetValuesAsString("bus"), @@ -61,7 +61,7 @@ func newDbusFromLog(log map[string]string) Rule { peerName = log["name"] } return &Dbus{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Access: []string{log["mask"]}, Bus: log["bus"], @@ -120,8 +120,8 @@ func (r *Dbus) Merge(other Rule) bool { r.Interface == o.Interface && r.Member == o.Member && r.PeerName == o.PeerName && r.PeerLabel == o.PeerLabel { r.Access = merge(r.Kind(), "access", r.Access, o.Access) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 56ae9c499..1955884cf 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -38,7 +38,7 @@ func isOwner(log map[string]string) bool { } type File struct { - RuleBase + Base Qualifier Owner bool Path string @@ -76,7 +76,7 @@ func newFile(q Qualifier, rule rule) (Rule, error) { return nil, err } return &File{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Owner: owner, Path: path, @@ -94,7 +94,7 @@ func newFileFromLog(log map[string]string) Rule { return newLinkFromLog(log) } return &File{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Owner: isOwner(log), Path: log["name"], @@ -138,8 +138,8 @@ func (r *File) Merge(other Rule) bool { } if r.Owner == o.Owner && r.Path == o.Path && r.Target == o.Target { r.Access = merge(r.Kind(), "access", r.Access, o.Access) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } @@ -157,7 +157,7 @@ func (r *File) Kind() Kind { } type Link struct { - RuleBase + Base Qualifier Owner bool Subset bool @@ -190,7 +190,7 @@ func newLink(q Qualifier, rule rule) (Rule, error) { } } return &Link{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Owner: owner, Subset: subset, @@ -201,7 +201,7 @@ func newLink(q Qualifier, rule rule) (Rule, error) { func newLinkFromLog(log map[string]string) Rule { return &Link{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Owner: isOwner(log), Path: log["name"], diff --git a/pkg/aa/io_uring.go b/pkg/aa/io_uring.go index 4402f07a9..40152cee3 100644 --- a/pkg/aa/io_uring.go +++ b/pkg/aa/io_uring.go @@ -17,7 +17,7 @@ func init() { } type IOUring struct { - RuleBase + Base Qualifier Access []string Label string @@ -29,7 +29,7 @@ func newIOUring(q Qualifier, rule rule) (Rule, error) { return nil, err } return &IOUring{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Access: accesses, Label: rule.GetValuesAsString("label"), @@ -38,7 +38,7 @@ func newIOUring(q Qualifier, rule rule) (Rule, error) { func newIOUringFromLog(log map[string]string) Rule { return &IOUring{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Access: Must(toAccess(IOURING, log["requested"])), Label: log["label"], @@ -71,8 +71,8 @@ func (r *IOUring) Merge(other Rule) bool { } if r.Label == o.Label { r.Access = merge(r.Kind(), "access", r.Access, o.Access) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/mount.go b/pkg/aa/mount.go index 272076d07..37f2aa3f3 100644 --- a/pkg/aa/mount.go +++ b/pkg/aa/mount.go @@ -74,7 +74,7 @@ func (m *MountConditions) Merge(other MountConditions) bool { } type Mount struct { - RuleBase + Base Qualifier MountConditions Source string @@ -102,7 +102,7 @@ func newMount(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Mount{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, MountConditions: conditions, Source: src, @@ -112,7 +112,7 @@ func newMount(q Qualifier, rule rule) (Rule, error) { func newMountFromLog(log map[string]string) Rule { return &Mount{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), MountConditions: newMountConditionsFromLog(log), Source: log["srcname"], @@ -150,8 +150,8 @@ func (r *Mount) Merge(other Rule) bool { } if r.Source == o.Source && r.MountPoint == o.MountPoint && mc.Merge(o.MountConditions) { - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } @@ -169,7 +169,7 @@ func (r *Mount) Kind() Kind { } type Umount struct { - RuleBase + Base Qualifier MountConditions MountPoint string @@ -186,7 +186,7 @@ func newUmount(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Umount{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, MountConditions: conditions, MountPoint: mount, @@ -195,7 +195,7 @@ func newUmount(q Qualifier, rule rule) (Rule, error) { func newUmountFromLog(log map[string]string) Rule { return &Umount{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), MountConditions: newMountConditionsFromLog(log), MountPoint: log["name"], @@ -228,8 +228,8 @@ func (r *Umount) Merge(other Rule) bool { return false } if r.MountPoint == o.MountPoint && mc.Merge(o.MountConditions) { - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } @@ -247,7 +247,7 @@ func (r *Umount) Kind() Kind { } type Remount struct { - RuleBase + Base Qualifier MountConditions MountPoint string @@ -265,7 +265,7 @@ func newRemount(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Remount{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, MountConditions: conditions, MountPoint: mount, @@ -274,7 +274,7 @@ func newRemount(q Qualifier, rule rule) (Rule, error) { func newRemountFromLog(log map[string]string) Rule { return &Remount{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), MountConditions: newMountConditionsFromLog(log), MountPoint: log["name"], @@ -307,8 +307,8 @@ func (r *Remount) Merge(other Rule) bool { return false } if r.MountPoint == o.MountPoint && mc.Merge(o.MountConditions) { - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/mqueue.go b/pkg/aa/mqueue.go index 889dcde6c..67b0ad2f0 100644 --- a/pkg/aa/mqueue.go +++ b/pkg/aa/mqueue.go @@ -23,7 +23,7 @@ func init() { } type Mqueue struct { - RuleBase + Base Qualifier Access []string Type string @@ -47,7 +47,7 @@ func newMqueue(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Mqueue{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Access: accesses, Type: rule.GetValuesAsString("type"), @@ -64,7 +64,7 @@ func newMqueueFromLog(log map[string]string) Rule { mqueueType = "sysv" } return &Mqueue{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Access: Must(toAccess(MQUEUE, log["requested"])), Type: mqueueType, @@ -105,8 +105,8 @@ func (r *Mqueue) Merge(other Rule) bool { } if r.Type == o.Type && r.Label == o.Label && r.Name == o.Name { r.Access = merge(r.Kind(), "access", r.Access, o.Access) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/network.go b/pkg/aa/network.go index 38818de13..0820e187c 100644 --- a/pkg/aa/network.go +++ b/pkg/aa/network.go @@ -58,7 +58,7 @@ func (r AddressExpr) Compare(other AddressExpr) int { } type Network struct { - RuleBase + Base Qualifier AddressExpr Domain string @@ -80,7 +80,7 @@ func newNetwork(q Qualifier, rule rule) (Rule, error) { } } return &Network{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Domain: domain, Type: nType, @@ -90,7 +90,7 @@ func newNetwork(q Qualifier, rule rule) (Rule, error) { func newNetworkFromLog(log map[string]string) Rule { return &Network{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), AddressExpr: newAddressExprFromLog(log), Domain: log["family"], diff --git a/pkg/aa/parse_test.go b/pkg/aa/parse_test.go index a1016b19b..3bfc1eae4 100644 --- a/pkg/aa/parse_test.go +++ b/pkg/aa/parse_test.go @@ -755,14 +755,14 @@ var ( @{lib_dirs} = @{lib}/@{name} /opt/@{name} # comment in variable`, want: "\n\n\n", rules: Rules{ - &Comment{RuleBase: RuleBase{IsLineRule: true, Comment: " IsLineRule comment"}}, + &Comment{Base: Base{IsLineRule: true, Comment: " IsLineRule comment"}}, &Include{ - RuleBase: RuleBase{Comment: " comment included"}, - IsMagic: true, Path: "tunables/global", + Base: Base{Comment: " comment included"}, + IsMagic: true, Path: "tunables/global", }, &Variable{ - RuleBase: RuleBase{Comment: " comment in variable"}, - Name: "lib_dirs", Define: true, + Base: Base{Comment: " comment in variable"}, + Name: "lib_dirs", Define: true, Values: []string{"@{lib}/@{name}", "/opt/@{name}"}, }, }, @@ -862,14 +862,14 @@ var ( @{lib_dirs} = @{lib}/@{name} /opt/@{name} # comment in variable`, apparmor: &AppArmorProfileFile{ Preamble: Rules{ - &Comment{RuleBase: RuleBase{IsLineRule: true, Comment: " IsLineRule comment"}}, + &Comment{Base: Base{IsLineRule: true, Comment: " IsLineRule comment"}}, &Include{ - RuleBase: RuleBase{Comment: " comment included"}, - Path: "tunables/global", IsMagic: true, + Base: Base{Comment: " comment included"}, + Path: "tunables/global", IsMagic: true, }, &Variable{ - RuleBase: RuleBase{Comment: " comment in variable"}, - Name: "lib_dirs", Define: true, + Base: Base{Comment: " comment in variable"}, + Name: "lib_dirs", Define: true, Values: []string{"@{lib}/@{name}", "/opt/@{name}"}, }, }, @@ -893,9 +893,9 @@ var ( `, apparmor: &AppArmorProfileFile{ Preamble: Rules{ - &Comment{RuleBase: RuleBase{IsLineRule: true, Comment: " Simple test"}}, + &Comment{Base: Base{IsLineRule: true, Comment: " Simple test"}}, &Include{IsMagic: true, Path: "tunables/global"}, - &Comment{RuleBase: RuleBase{IsLineRule: true, Comment: " { commented block }"}}, + &Comment{Base: Base{IsLineRule: true, Comment: " { commented block }"}}, &Variable{Name: "name", Values: []string{"{D,d}ummy"}, Define: true}, &Variable{Name: "exec_path", Values: []string{"@{bin}/@{name}"}, Define: true}, &Variable{Name: "exec_path", Values: []string{"@{lib}/@{name}"}}, @@ -922,7 +922,7 @@ var ( raw: util.MustReadFile(testData.Join("string.aa")), apparmor: &AppArmorProfileFile{ Preamble: Rules{ - &Comment{RuleBase: RuleBase{Comment: " Simple test profile for the AppArmorProfileFile.String() method", IsLineRule: true}}, + &Comment{Base: Base{Comment: " Simple test profile for the AppArmorProfileFile.String() method", IsLineRule: true}}, &Include{IsMagic: true, Path: "tunables/global"}, &Variable{ Name: "exec_path", Define: true, @@ -961,7 +961,7 @@ var ( }, { &Mount{ - RuleBase: RuleBase{IsLineRule: false, Comment: " failed perms check"}, + Base: Base{IsLineRule: false, Comment: " failed perms check"}, MountConditions: MountConditions{ FsType: "fuse.portal", Options: []string{"rw", "rbind"}, @@ -1020,15 +1020,15 @@ var ( raw: util.MustReadFile(testData.Join("full.aa")), apparmor: &AppArmorProfileFile{ Preamble: Rules{ - &Comment{RuleBase: RuleBase{IsLineRule: true, Comment: " Simple test profile with all rules used"}}, + &Comment{Base: Base{IsLineRule: true, Comment: " Simple test profile with all rules used"}}, &Include{ - RuleBase: RuleBase{Comment: " a comment", Optional: true}, - IsMagic: true, Path: "tunables/global", + Base: Base{Comment: " a comment", Optional: true}, + IsMagic: true, Path: "tunables/global", }, &Include{IfExists: true, Path: "/etc/apparmor.d/global/dummy space"}, &Variable{Name: "name", Values: []string{"torbrowser", "\"tor browser\""}, Define: true}, &Variable{ - RuleBase: RuleBase{Comment: " another comment"}, Define: true, + Base: Base{Comment: " another comment"}, Define: true, Name: "lib_dirs", Values: []string{"@{lib}/@{name}", "/opt/@{name}"}, }, &Variable{Name: "config_dirs", Values: []string{"@{HOME}/.mozilla/"}, Define: true}, @@ -1152,7 +1152,7 @@ var ( }, }, { - &Comment{RuleBase: RuleBase{IsLineRule: true, Comment: " A comment! before a paragraph of rules"}}, + &Comment{Base: Base{IsLineRule: true, Comment: " A comment! before a paragraph of rules"}}, &File{ Path: "\"/opt/Mullvad VPN/resources/*.so*\"", Access: []string{"m", "r"}, diff --git a/pkg/aa/pivot_root.go b/pkg/aa/pivot_root.go index cfa6833ad..e0b8452c7 100644 --- a/pkg/aa/pivot_root.go +++ b/pkg/aa/pivot_root.go @@ -9,7 +9,7 @@ import "fmt" const PIVOTROOT Kind = "pivot_root" type PivotRoot struct { - RuleBase + Base Qualifier OldRoot string NewRoot string @@ -32,7 +32,7 @@ func newPivotRoot(q Qualifier, rule rule) (Rule, error) { } } return &PivotRoot{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, OldRoot: rule.GetValuesAsString("oldroot"), NewRoot: newroot, @@ -42,7 +42,7 @@ func newPivotRoot(q Qualifier, rule rule) (Rule, error) { func newPivotRootFromLog(log map[string]string) Rule { return &PivotRoot{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), OldRoot: log["srcname"], NewRoot: log["name"], diff --git a/pkg/aa/preamble.go b/pkg/aa/preamble.go index 4ad65fe97..fdff066c0 100644 --- a/pkg/aa/preamble.go +++ b/pkg/aa/preamble.go @@ -20,13 +20,13 @@ const ( ) type Comment struct { - RuleBase + Base } func newComment(rule rule) (Rule, error) { base := newBase(rule) base.IsLineRule = true - return &Comment{RuleBase: base}, nil + return &Comment{Base: base}, nil } func (r *Comment) Validate() error { @@ -50,7 +50,7 @@ func (r *Comment) Kind() Kind { } type Abi struct { - RuleBase + Base Path string IsMagic bool } @@ -71,9 +71,9 @@ func newAbi(q Qualifier, rule rule) (Rule, error) { return nil, fmt.Errorf("invalid path %s in rule: %s", path, rule) } return &Abi{ - RuleBase: newBase(rule), - Path: strings.Trim(path, "\"<>"), - IsMagic: magic, + Base: newBase(rule), + Path: strings.Trim(path, "\"<>"), + IsMagic: magic, }, nil } @@ -102,7 +102,7 @@ func (r *Abi) Kind() Kind { } type Alias struct { - RuleBase + Base Path string RewrittenPath string } @@ -115,7 +115,7 @@ func newAlias(q Qualifier, rule rule) (Rule, error) { return nil, fmt.Errorf("invalid alias format, missing %s in: %s", tokARROW, rule) } return &Alias{ - RuleBase: newBase(rule), + Base: newBase(rule), Path: rule.Get(0), RewrittenPath: rule.Get(2), }, nil @@ -146,7 +146,7 @@ func (r *Alias) Kind() Kind { } type Include struct { - RuleBase + Base IfExists bool Path string IsMagic bool @@ -177,7 +177,7 @@ func newInclude(rule rule) (Rule, error) { return nil, fmt.Errorf("invalid path format: %v", path) } return &Include{ - RuleBase: newBase(rule), + Base: newBase(rule), IfExists: ifexists, Path: strings.Trim(path, "\"<>"), IsMagic: magic, @@ -219,7 +219,7 @@ func (r *Include) Kind() Kind { } type Variable struct { - RuleBase + Base Name string Values []string Define bool @@ -245,10 +245,10 @@ func newVariable(rule rule) (Rule, error) { return nil, fmt.Errorf("invalid operator in variable: %v", rule) } return &Variable{ - RuleBase: newBase(rule), - Name: name, - Values: values, - Define: define, + Base: newBase(rule), + Name: name, + Values: values, + Define: define, }, nil } @@ -261,8 +261,8 @@ func (r *Variable) Merge(other Rule) bool { if r.Name == o.Name && r.Define == o.Define { r.Values = merge(r.Kind(), "access", r.Values, o.Values) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/profile.go b/pkg/aa/profile.go index a5ed8a6a5..ae6e01451 100644 --- a/pkg/aa/profile.go +++ b/pkg/aa/profile.go @@ -30,7 +30,7 @@ func init() { // Profile represents a single AppArmor profile. type Profile struct { - RuleBase + Base Header Rules Rules } diff --git a/pkg/aa/ptrace.go b/pkg/aa/ptrace.go index 2c7f9f225..82883bb21 100644 --- a/pkg/aa/ptrace.go +++ b/pkg/aa/ptrace.go @@ -19,7 +19,7 @@ func init() { } type Ptrace struct { - RuleBase + Base Qualifier Access []string Peer string @@ -31,7 +31,7 @@ func newPtrace(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Ptrace{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Access: accesses, Peer: rule.GetValuesAsString("peer"), @@ -40,7 +40,7 @@ func newPtrace(q Qualifier, rule rule) (Rule, error) { func newPtraceFromLog(log map[string]string) Rule { return &Ptrace{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Access: Must(toAccess(PTRACE, log["requested_mask"])), Peer: log["peer"], @@ -62,8 +62,8 @@ func (r *Ptrace) Merge(other Rule) bool { } if r.Peer == o.Peer { r.Access = merge(r.Kind(), "access", r.Access, o.Access) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/resolve_test.go b/pkg/aa/resolve_test.go index 52168cc7a..5c9c9026f 100644 --- a/pkg/aa/resolve_test.go +++ b/pkg/aa/resolve_test.go @@ -31,7 +31,7 @@ func TestAppArmorProfileFile_resolveInclude(t *testing.T) { Preamble: Rules{ &Alias{Path: "/usr/", RewrittenPath: "/User/"}, &Alias{Path: "/lib/", RewrittenPath: "/Libraries/"}, - &Comment{RuleBase: RuleBase{IsLineRule: true, Comment: " variable declarations for inclusion"}}, + &Comment{Base: Base{IsLineRule: true, Comment: " variable declarations for inclusion"}}, &Variable{ Name: "FOO", Define: true, Values: []string{ diff --git a/pkg/aa/rlimit.go b/pkg/aa/rlimit.go index 959ac4eec..f362d555e 100644 --- a/pkg/aa/rlimit.go +++ b/pkg/aa/rlimit.go @@ -21,7 +21,7 @@ func init() { } type Rlimit struct { - RuleBase + Base Key string Op string Value string @@ -35,19 +35,19 @@ func newRlimit(q Qualifier, rule rule) (Rule, error) { return nil, fmt.Errorf("invalid rlimit format: %s", rule) } return &Rlimit{ - RuleBase: newBase(rule), - Key: rule.Get(1), - Op: rule.Get(2), - Value: rule.Get(3), + Base: newBase(rule), + Key: rule.Get(1), + Op: rule.Get(2), + Value: rule.Get(3), }, nil } func newRlimitFromLog(log map[string]string) Rule { return &Rlimit{ - RuleBase: newBaseFromLog(log), - Key: log["key"], - Op: log["op"], - Value: log["value"], + Base: newBaseFromLog(log), + Key: log["key"], + Op: log["op"], + Value: log["value"], } } diff --git a/pkg/aa/signal.go b/pkg/aa/signal.go index 097e8b827..aec7117a5 100644 --- a/pkg/aa/signal.go +++ b/pkg/aa/signal.go @@ -32,7 +32,7 @@ func init() { } type Signal struct { - RuleBase + Base Qualifier Access []string Set []string @@ -49,7 +49,7 @@ func newSignal(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Signal{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Access: accesses, Set: set, @@ -59,7 +59,7 @@ func newSignal(q Qualifier, rule rule) (Rule, error) { func newSignalFromLog(log map[string]string) Rule { return &Signal{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Access: Must(toAccess(SIGNAL, log["requested_mask"])), Set: []string{log["signal"]}, @@ -86,12 +86,12 @@ func (r *Signal) Merge(other Rule) bool { switch { case r.Peer == o.Peer && compare(r.Set, o.Set) == 0: r.Access = merge(r.Kind(), "access", r.Access, o.Access) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) case r.Peer == o.Peer && compare(r.Access, o.Access) == 0: r.Set = merge(r.Kind(), "set", r.Set, o.Set) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/unix.go b/pkg/aa/unix.go index 677330ecb..490ad7f6e 100644 --- a/pkg/aa/unix.go +++ b/pkg/aa/unix.go @@ -21,7 +21,7 @@ func init() { } type Unix struct { - RuleBase + Base Qualifier Access []string Type string @@ -40,7 +40,7 @@ func newUnix(q Qualifier, rule rule) (Rule, error) { return nil, err } return &Unix{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Access: accesses, Type: rule.GetValuesAsString("type"), @@ -56,7 +56,7 @@ func newUnix(q Qualifier, rule rule) (Rule, error) { func newUnixFromLog(log map[string]string) Rule { return &Unix{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Access: Must(toAccess(UNIX, log["requested_mask"])), Type: log["sock_type"], @@ -119,8 +119,8 @@ func (r *Unix) Merge(other Rule) bool { r.Label == o.Label && r.Attr == o.Attr && r.Opt == o.Opt && r.PeerLabel == o.PeerLabel && r.PeerAddr == o.PeerAddr { r.Access = merge(r.Kind(), "access", r.Access, o.Access) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } return false } diff --git a/pkg/aa/userns.go b/pkg/aa/userns.go index 424911f08..7e3a7567b 100644 --- a/pkg/aa/userns.go +++ b/pkg/aa/userns.go @@ -9,7 +9,7 @@ import "fmt" const USERNS Kind = "userns" type Userns struct { - RuleBase + Base Qualifier Create bool } @@ -28,7 +28,7 @@ func newUserns(q Qualifier, rule rule) (Rule, error) { return nil, fmt.Errorf("invalid userns format: %s", rule) } return &Userns{ - RuleBase: newBase(rule), + Base: newBase(rule), Qualifier: q, Create: create, }, nil @@ -36,7 +36,7 @@ func newUserns(q Qualifier, rule rule) (Rule, error) { func newUsernsFromLog(log map[string]string) Rule { return &Userns{ - RuleBase: newBaseFromLog(log), + Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), Create: true, } @@ -56,8 +56,8 @@ func (r *Userns) Compare(other Rule) int { func (r *Userns) Merge(other Rule) bool { o, _ := other.(*Userns) - b := &r.RuleBase - return b.merge(o.RuleBase) + b := &r.Base + return b.merge(o.Base) } func (r *Userns) String() string { diff --git a/pkg/logs/logs_test.go b/pkg/logs/logs_test.go index aa5865eae..cc4b93ed9 100644 --- a/pkg/logs/logs_test.go +++ b/pkg/logs/logs_test.go @@ -303,13 +303,13 @@ func TestAppArmorLogs_ParseToProfiles(t *testing.T) { Header: aa.Header{Name: "kmod"}, Rules: aa.Rules{ &aa.Unix{ - RuleBase: aa.RuleBase{FileInherit: true}, + Base: aa.Base{FileInherit: true}, Access: []string{"send", "receive"}, Type: "stream", Protocol: "0", }, &aa.Unix{ - RuleBase: aa.RuleBase{FileInherit: true}, + Base: aa.Base{FileInherit: true}, Access: []string{"send", "receive"}, Type: "stream", Protocol: "0", From 880f0ef37e736795536bb42eaa4b07f0a4b9c7dc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 25 Jun 2024 19:56:36 +0100 Subject: [PATCH 0013/1455] refractor(aa): ensure methods order in rules definitions. --- pkg/aa/all.go | 24 +++---- pkg/aa/blocks.go | 24 +++---- pkg/aa/capability.go | 24 +++---- pkg/aa/change_profile.go | 24 +++---- pkg/aa/dbus.go | 24 +++---- pkg/aa/file.go | 48 +++++++------- pkg/aa/io_uring.go | 24 +++---- pkg/aa/mount.go | 72 ++++++++++----------- pkg/aa/mqueue.go | 24 +++---- pkg/aa/network.go | 24 +++---- pkg/aa/pivot_root.go | 24 +++---- pkg/aa/preamble.go | 134 +++++++++++++++++++-------------------- pkg/aa/profile.go | 24 +++---- pkg/aa/ptrace.go | 24 +++---- pkg/aa/rlimit.go | 24 +++---- pkg/aa/rules.go | 6 +- pkg/aa/signal.go | 24 +++---- pkg/aa/unix.go | 24 +++---- pkg/aa/userns.go | 24 +++---- 19 files changed, 310 insertions(+), 310 deletions(-) diff --git a/pkg/aa/all.go b/pkg/aa/all.go index 3004bbf95..1ca5ba70e 100644 --- a/pkg/aa/all.go +++ b/pkg/aa/all.go @@ -16,6 +16,18 @@ func newAll(q Qualifier, rule rule) (Rule, error) { return &All{Base: newBase(rule)}, nil } +func (r *All) Kind() Kind { + return ALL +} + +func (r *All) Constraint() constraint { + return blockKind +} + +func (r *All) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *All) Validate() error { return nil } @@ -29,15 +41,3 @@ func (r *All) Merge(other Rule) bool { b := &r.Base return b.merge(o.Base) } - -func (r *All) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *All) Constraint() constraint { - return blockKind -} - -func (r *All) Kind() Kind { - return ALL -} diff --git a/pkg/aa/blocks.go b/pkg/aa/blocks.go index 85f754958..ed1f8fdec 100644 --- a/pkg/aa/blocks.go +++ b/pkg/aa/blocks.go @@ -15,6 +15,18 @@ type Hat struct { Rules Rules } +func (p *Hat) Kind() Kind { + return HAT +} + +func (p *Hat) Constraint() constraint { + return blockKind +} + +func (p *Hat) String() string { + return renderTemplate(p.Kind(), p) +} + func (r *Hat) Validate() error { return nil } @@ -23,15 +35,3 @@ func (r *Hat) Compare(other Rule) int { o, _ := other.(*Hat) return compare(r.Name, o.Name) } - -func (p *Hat) String() string { - return renderTemplate(p.Kind(), p) -} - -func (p *Hat) Constraint() constraint { - return blockKind -} - -func (p *Hat) Kind() Kind { - return HAT -} diff --git a/pkg/aa/capability.go b/pkg/aa/capability.go index 8a4d453b8..d3629411f 100644 --- a/pkg/aa/capability.go +++ b/pkg/aa/capability.go @@ -51,6 +51,18 @@ func newCapabilityFromLog(log map[string]string) Rule { } } +func (r *Capability) Kind() Kind { + return CAPABILITY +} + +func (r *Capability) Constraint() constraint { + return blockKind +} + +func (r *Capability) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Capability) Validate() error { if err := validateValues(r.Kind(), "name", r.Names); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -65,15 +77,3 @@ func (r *Capability) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } - -func (r *Capability) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Capability) Constraint() constraint { - return blockKind -} - -func (r *Capability) Kind() Kind { - return CAPABILITY -} diff --git a/pkg/aa/change_profile.go b/pkg/aa/change_profile.go index 4fc35a323..a6e3bb6e4 100644 --- a/pkg/aa/change_profile.go +++ b/pkg/aa/change_profile.go @@ -67,6 +67,18 @@ func newChangeProfileFromLog(log map[string]string) Rule { } } +func (r *ChangeProfile) Kind() Kind { + return CHANGEPROFILE +} + +func (r *ChangeProfile) Constraint() constraint { + return blockKind +} + +func (r *ChangeProfile) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *ChangeProfile) Validate() error { if err := validateValues(r.Kind(), "mode", []string{r.ExecMode}); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -87,15 +99,3 @@ func (r *ChangeProfile) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } - -func (r *ChangeProfile) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *ChangeProfile) Constraint() constraint { - return blockKind -} - -func (r *ChangeProfile) Kind() Kind { - return CHANGEPROFILE -} diff --git a/pkg/aa/dbus.go b/pkg/aa/dbus.go index 95b731531..13a600280 100644 --- a/pkg/aa/dbus.go +++ b/pkg/aa/dbus.go @@ -74,6 +74,18 @@ func newDbusFromLog(log map[string]string) Rule { } } +func (r *Dbus) Kind() Kind { + return DBUS +} + +func (r *Dbus) Constraint() constraint { + return blockKind +} + +func (r *Dbus) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Dbus) Validate() error { if err := validateValues(r.Kind(), "access", r.Access); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -125,15 +137,3 @@ func (r *Dbus) Merge(other Rule) bool { } return false } - -func (r *Dbus) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Dbus) Constraint() constraint { - return blockKind -} - -func (r *Dbus) Kind() Kind { - return DBUS -} diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 1955884cf..3b58e4e19 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -103,6 +103,18 @@ func newFileFromLog(log map[string]string) Rule { } } +func (r *File) Kind() Kind { + return FILE +} + +func (r *File) Constraint() constraint { + return blockKind +} + +func (r *File) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *File) Validate() error { return nil } @@ -144,18 +156,6 @@ func (r *File) Merge(other Rule) bool { return false } -func (r *File) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *File) Constraint() constraint { - return blockKind -} - -func (r *File) Kind() Kind { - return FILE -} - type Link struct { Base Qualifier @@ -209,6 +209,18 @@ func newLinkFromLog(log map[string]string) Rule { } } +func (r *Link) Kind() Kind { + return LINK +} + +func (r *Link) Constraint() constraint { + return blockKind +} + +func (r *Link) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Link) Validate() error { return nil } @@ -230,15 +242,3 @@ func (r *Link) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } - -func (r *Link) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Link) Constraint() constraint { - return blockKind -} - -func (r *Link) Kind() Kind { - return LINK -} diff --git a/pkg/aa/io_uring.go b/pkg/aa/io_uring.go index 40152cee3..6d7755d1e 100644 --- a/pkg/aa/io_uring.go +++ b/pkg/aa/io_uring.go @@ -45,6 +45,18 @@ func newIOUringFromLog(log map[string]string) Rule { } } +func (r *IOUring) Kind() Kind { + return IOURING +} + +func (r *IOUring) Constraint() constraint { + return blockKind +} + +func (r *IOUring) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *IOUring) Validate() error { if err := validateValues(r.Kind(), "access", r.Access); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -76,15 +88,3 @@ func (r *IOUring) Merge(other Rule) bool { } return false } - -func (r *IOUring) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *IOUring) Constraint() constraint { - return blockKind -} - -func (r *IOUring) Kind() Kind { - return IOURING -} diff --git a/pkg/aa/mount.go b/pkg/aa/mount.go index 37f2aa3f3..9833ac8f1 100644 --- a/pkg/aa/mount.go +++ b/pkg/aa/mount.go @@ -120,6 +120,18 @@ func newMountFromLog(log map[string]string) Rule { } } +func (r *Mount) Kind() Kind { + return MOUNT +} + +func (r *Mount) Constraint() constraint { + return blockKind +} + +func (r *Mount) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Mount) Validate() error { if err := r.MountConditions.Validate(); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -156,18 +168,6 @@ func (r *Mount) Merge(other Rule) bool { return false } -func (r *Mount) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Mount) Constraint() constraint { - return blockKind -} - -func (r *Mount) Kind() Kind { - return MOUNT -} - type Umount struct { Base Qualifier @@ -202,6 +202,18 @@ func newUmountFromLog(log map[string]string) Rule { } } +func (r *Umount) Kind() Kind { + return UMOUNT +} + +func (r *Umount) Constraint() constraint { + return blockKind +} + +func (r *Umount) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Umount) Validate() error { if err := r.MountConditions.Validate(); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -234,18 +246,6 @@ func (r *Umount) Merge(other Rule) bool { return false } -func (r *Umount) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Umount) Constraint() constraint { - return blockKind -} - -func (r *Umount) Kind() Kind { - return UMOUNT -} - type Remount struct { Base Qualifier @@ -281,6 +281,18 @@ func newRemountFromLog(log map[string]string) Rule { } } +func (r *Remount) Kind() Kind { + return REMOUNT +} + +func (r *Remount) Constraint() constraint { + return blockKind +} + +func (r *Remount) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Remount) Validate() error { if err := r.MountConditions.Validate(); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -312,15 +324,3 @@ func (r *Remount) Merge(other Rule) bool { } return false } - -func (r *Remount) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Remount) Constraint() constraint { - return blockKind -} - -func (r *Remount) Kind() Kind { - return REMOUNT -} diff --git a/pkg/aa/mqueue.go b/pkg/aa/mqueue.go index 67b0ad2f0..b511666c6 100644 --- a/pkg/aa/mqueue.go +++ b/pkg/aa/mqueue.go @@ -73,6 +73,18 @@ func newMqueueFromLog(log map[string]string) Rule { } } +func (r *Mqueue) Kind() Kind { + return MQUEUE +} + +func (r *Mqueue) Constraint() constraint { + return blockKind +} + +func (r *Mqueue) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Mqueue) Validate() error { if err := validateValues(r.Kind(), "access", r.Access); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -110,15 +122,3 @@ func (r *Mqueue) Merge(other Rule) bool { } return false } - -func (r *Mqueue) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Mqueue) Constraint() constraint { - return blockKind -} - -func (r *Mqueue) Kind() Kind { - return MQUEUE -} diff --git a/pkg/aa/network.go b/pkg/aa/network.go index 0820e187c..989b9b16a 100644 --- a/pkg/aa/network.go +++ b/pkg/aa/network.go @@ -99,6 +99,18 @@ func newNetworkFromLog(log map[string]string) Rule { } } +func (r *Network) Kind() Kind { + return NETWORK +} + +func (r *Network) Constraint() constraint { + return blockKind +} + +func (r *Network) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Network) Validate() error { if err := validateValues(r.Kind(), "domains", []string{r.Domain}); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -128,15 +140,3 @@ func (r *Network) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } - -func (r *Network) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Network) Constraint() constraint { - return blockKind -} - -func (r *Network) Kind() Kind { - return NETWORK -} diff --git a/pkg/aa/pivot_root.go b/pkg/aa/pivot_root.go index e0b8452c7..219435fcc 100644 --- a/pkg/aa/pivot_root.go +++ b/pkg/aa/pivot_root.go @@ -50,6 +50,18 @@ func newPivotRootFromLog(log map[string]string) Rule { } } +func (r *PivotRoot) Kind() Kind { + return PIVOTROOT +} + +func (r *PivotRoot) Constraint() constraint { + return blockKind +} + +func (r *PivotRoot) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *PivotRoot) Validate() error { return nil } @@ -67,15 +79,3 @@ func (r *PivotRoot) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } - -func (r *PivotRoot) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *PivotRoot) Constraint() constraint { - return blockKind -} - -func (r *PivotRoot) Kind() Kind { - return PIVOTROOT -} diff --git a/pkg/aa/preamble.go b/pkg/aa/preamble.go index fdff066c0..c66471c04 100644 --- a/pkg/aa/preamble.go +++ b/pkg/aa/preamble.go @@ -29,24 +29,24 @@ func newComment(rule rule) (Rule, error) { return &Comment{Base: base}, nil } -func (r *Comment) Validate() error { - return nil -} - -func (r *Comment) Compare(other Rule) int { - return 0 // Comments are always equal to each other as they are not compared -} - -func (r *Comment) String() string { - return renderTemplate(r.Kind(), r) +func (r *Comment) Kind() Kind { + return COMMENT } func (r *Comment) Constraint() constraint { return anyKind } -func (r *Comment) Kind() Kind { - return COMMENT +func (r *Comment) String() string { + return renderTemplate(r.Kind(), r) +} + +func (r *Comment) Validate() error { + return nil +} + +func (r *Comment) Compare(other Rule) int { + return 0 // Comments are always equal to each other as they are not compared } type Abi struct { @@ -77,6 +77,18 @@ func newAbi(q Qualifier, rule rule) (Rule, error) { }, nil } +func (r *Abi) Kind() Kind { + return ABI +} + +func (r *Abi) Constraint() constraint { + return preambleKind +} + +func (r *Abi) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Abi) Validate() error { return nil } @@ -89,18 +101,6 @@ func (r *Abi) Compare(other Rule) int { return compare(r.IsMagic, o.IsMagic) } -func (r *Abi) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Abi) Constraint() constraint { - return preambleKind -} - -func (r *Abi) Kind() Kind { - return ABI -} - type Alias struct { Base Path string @@ -121,6 +121,18 @@ func newAlias(q Qualifier, rule rule) (Rule, error) { }, nil } +func (r *Alias) Kind() Kind { + return ALIAS +} + +func (r *Alias) Constraint() constraint { + return preambleKind +} + +func (r *Alias) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Alias) Validate() error { return nil } @@ -133,18 +145,6 @@ func (r *Alias) Compare(other Rule) int { return compare(r.RewrittenPath, o.RewrittenPath) } -func (r *Alias) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Alias) Constraint() constraint { - return preambleKind -} - -func (r *Alias) Kind() Kind { - return ALIAS -} - type Include struct { Base IfExists bool @@ -184,6 +184,18 @@ func newInclude(rule rule) (Rule, error) { }, nil } +func (r *Include) Kind() Kind { + return INCLUDE +} + +func (r *Include) Constraint() constraint { + return anyKind +} + +func (r *Include) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Include) Validate() error { return nil } @@ -206,18 +218,6 @@ func (r *Include) Compare(other Rule) int { return compare(r.IfExists, o.IfExists) } -func (r *Include) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Include) Constraint() constraint { - return anyKind -} - -func (r *Include) Kind() Kind { - return INCLUDE -} - type Variable struct { Base Name string @@ -252,19 +252,20 @@ func newVariable(rule rule) (Rule, error) { }, nil } -func (r *Variable) Validate() error { - return nil +func (r *Variable) Kind() Kind { + return VARIABLE } -func (r *Variable) Merge(other Rule) bool { - o, _ := other.(*Variable) +func (r *Variable) Constraint() constraint { + return preambleKind +} - if r.Name == o.Name && r.Define == o.Define { - r.Values = merge(r.Kind(), "access", r.Values, o.Values) - b := &r.Base - return b.merge(o.Base) - } - return false +func (r *Variable) String() string { + return renderTemplate(r.Kind(), r) +} + +func (r *Variable) Validate() error { + return nil } func (r *Variable) Compare(other Rule) int { @@ -278,14 +279,13 @@ func (r *Variable) Compare(other Rule) int { return compare(r.Values, o.Values) } -func (r *Variable) String() string { - return renderTemplate(r.Kind(), r) -} +func (r *Variable) Merge(other Rule) bool { + o, _ := other.(*Variable) -func (r *Variable) Constraint() constraint { - return preambleKind -} - -func (r *Variable) Kind() Kind { - return VARIABLE + if r.Name == o.Name && r.Define == o.Define { + r.Values = merge(r.Kind(), "access", r.Values, o.Values) + b := &r.Base + return b.merge(o.Base) + } + return false } diff --git a/pkg/aa/profile.go b/pkg/aa/profile.go index ae6e01451..c1400da48 100644 --- a/pkg/aa/profile.go +++ b/pkg/aa/profile.go @@ -69,6 +69,18 @@ func newHeader(rule rule) (Header, error) { }, nil } +func (p *Profile) Kind() Kind { + return PROFILE +} + +func (p *Profile) Constraint() constraint { + return blockKind +} + +func (p *Profile) String() string { + return renderTemplate(p.Kind(), p) +} + func (r *Profile) Validate() error { if err := validateValues(r.Kind(), tokFLAGS, r.Flags); err != nil { return fmt.Errorf("profile %s: %w", r.Name, err) @@ -84,18 +96,6 @@ func (r *Profile) Compare(other Rule) int { return compare(r.Attachments, o.Attachments) } -func (p *Profile) String() string { - return renderTemplate(p.Kind(), p) -} - -func (p *Profile) Constraint() constraint { - return blockKind -} - -func (p *Profile) Kind() Kind { - return PROFILE -} - func (p *Profile) Merge(other Rule) bool { slices.Sort(p.Flags) p.Flags = slices.Compact(p.Flags) diff --git a/pkg/aa/ptrace.go b/pkg/aa/ptrace.go index 82883bb21..3c907bc76 100644 --- a/pkg/aa/ptrace.go +++ b/pkg/aa/ptrace.go @@ -47,6 +47,18 @@ func newPtraceFromLog(log map[string]string) Rule { } } +func (r *Ptrace) Kind() Kind { + return PTRACE +} + +func (r *Ptrace) Constraint() constraint { + return blockKind +} + +func (r *Ptrace) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Ptrace) Validate() error { if err := validateValues(r.Kind(), "access", r.Access); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -78,15 +90,3 @@ func (r *Ptrace) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } - -func (r *Ptrace) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Ptrace) Constraint() constraint { - return blockKind -} - -func (r *Ptrace) Kind() Kind { - return PTRACE -} diff --git a/pkg/aa/rlimit.go b/pkg/aa/rlimit.go index f362d555e..7fffbb782 100644 --- a/pkg/aa/rlimit.go +++ b/pkg/aa/rlimit.go @@ -51,6 +51,18 @@ func newRlimitFromLog(log map[string]string) Rule { } } +func (r *Rlimit) Kind() Kind { + return RLIMIT +} + +func (r *Rlimit) Constraint() constraint { + return blockKind +} + +func (r *Rlimit) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Rlimit) Validate() error { if err := validateValues(r.Kind(), "keys", []string{r.Key}); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -68,15 +80,3 @@ func (r *Rlimit) Compare(other Rule) int { } return compare(r.Value, o.Value) } - -func (r *Rlimit) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Rlimit) Constraint() constraint { - return blockKind -} - -func (r *Rlimit) Kind() Kind { - return RLIMIT -} diff --git a/pkg/aa/rules.go b/pkg/aa/rules.go index d216c758b..6a0d68519 100644 --- a/pkg/aa/rules.go +++ b/pkg/aa/rules.go @@ -37,12 +37,12 @@ func (k Kind) Tok() string { // Rule generic interface for all AppArmor rules type Rule interface { + Kind() Kind + Constraint() constraint + String() string Validate() error Compare(other Rule) int Merge(other Rule) bool - String() string - Constraint() constraint - Kind() Kind } type Rules []Rule diff --git a/pkg/aa/signal.go b/pkg/aa/signal.go index aec7117a5..30b7aea83 100644 --- a/pkg/aa/signal.go +++ b/pkg/aa/signal.go @@ -67,6 +67,18 @@ func newSignalFromLog(log map[string]string) Rule { } } +func (r *Signal) Kind() Kind { + return SIGNAL +} + +func (r *Signal) Constraint() constraint { + return blockKind +} + +func (r *Signal) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Signal) Validate() error { if err := validateValues(r.Kind(), "access", r.Access); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -109,15 +121,3 @@ func (r *Signal) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } - -func (r *Signal) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Signal) Constraint() constraint { - return blockKind -} - -func (r *Signal) Kind() Kind { - return SIGNAL -} diff --git a/pkg/aa/unix.go b/pkg/aa/unix.go index 490ad7f6e..7d882ea40 100644 --- a/pkg/aa/unix.go +++ b/pkg/aa/unix.go @@ -70,6 +70,18 @@ func newUnixFromLog(log map[string]string) Rule { } } +func (r *Unix) Kind() Kind { + return UNIX +} + +func (r *Unix) Constraint() constraint { + return blockKind +} + +func (r *Unix) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Unix) Validate() error { if err := validateValues(r.Kind(), "access", r.Access); err != nil { return fmt.Errorf("%s: %w", r, err) @@ -124,15 +136,3 @@ func (r *Unix) Merge(other Rule) bool { } return false } - -func (r *Unix) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Unix) Constraint() constraint { - return blockKind -} - -func (r *Unix) Kind() Kind { - return UNIX -} diff --git a/pkg/aa/userns.go b/pkg/aa/userns.go index 7e3a7567b..baa50f0cc 100644 --- a/pkg/aa/userns.go +++ b/pkg/aa/userns.go @@ -42,6 +42,18 @@ func newUsernsFromLog(log map[string]string) Rule { } } +func (r *Userns) Kind() Kind { + return USERNS +} + +func (r *Userns) Constraint() constraint { + return blockKind +} + +func (r *Userns) String() string { + return renderTemplate(r.Kind(), r) +} + func (r *Userns) Validate() error { return nil } @@ -59,15 +71,3 @@ func (r *Userns) Merge(other Rule) bool { b := &r.Base return b.merge(o.Base) } - -func (r *Userns) String() string { - return renderTemplate(r.Kind(), r) -} - -func (r *Userns) Constraint() constraint { - return blockKind -} - -func (r *Userns) Kind() Kind { - return USERNS -} From 7c006dee0a0385d49b106c43925f19ea34be8a82 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 25 Jun 2024 20:10:12 +0100 Subject: [PATCH 0014/1455] feat(aa): be more verbose on rule.Merge --- pkg/aa/base.go | 4 ---- pkg/aa/blocks.go | 4 ++++ pkg/aa/capability.go | 4 ++++ pkg/aa/change_profile.go | 4 ++++ pkg/aa/file.go | 4 ++++ pkg/aa/network.go | 4 ++++ pkg/aa/pivot_root.go | 4 ++++ pkg/aa/preamble.go | 16 ++++++++++++++++ pkg/aa/ptrace.go | 22 +++++++++++----------- pkg/aa/rlimit.go | 4 ++++ pkg/aa/signal.go | 28 ++++++++++++++-------------- 11 files changed, 69 insertions(+), 29 deletions(-) diff --git a/pkg/aa/base.go b/pkg/aa/base.go index 6302a0fac..6e40e46df 100644 --- a/pkg/aa/base.go +++ b/pkg/aa/base.go @@ -79,10 +79,6 @@ func newBaseFromLog(log map[string]string) Base { } } -func (r Base) Merge(other Rule) bool { - return false -} - func (r *Base) merge(other Base) bool { if other.Comment != "" { r.Comment += " " + other.Comment diff --git a/pkg/aa/blocks.go b/pkg/aa/blocks.go index ed1f8fdec..ecc931d0d 100644 --- a/pkg/aa/blocks.go +++ b/pkg/aa/blocks.go @@ -35,3 +35,7 @@ func (r *Hat) Compare(other Rule) int { o, _ := other.(*Hat) return compare(r.Name, o.Name) } + +func (r *Hat) Merge(other Rule) bool { + return false // Never merge hat blocks +} diff --git a/pkg/aa/capability.go b/pkg/aa/capability.go index d3629411f..a91fad7ab 100644 --- a/pkg/aa/capability.go +++ b/pkg/aa/capability.go @@ -77,3 +77,7 @@ func (r *Capability) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } + +func (r *Capability) Merge(other Rule) bool { + return false // Never merge capabilities +} diff --git a/pkg/aa/change_profile.go b/pkg/aa/change_profile.go index a6e3bb6e4..f0e9a5d0b 100644 --- a/pkg/aa/change_profile.go +++ b/pkg/aa/change_profile.go @@ -99,3 +99,7 @@ func (r *ChangeProfile) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } + +func (r *ChangeProfile) Merge(other Rule) bool { + return false // Never merge change_profile +} diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 3b58e4e19..4255c4de7 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -242,3 +242,7 @@ func (r *Link) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } + +func (r *Link) Merge(other Rule) bool { + return false // Never merge link +} diff --git a/pkg/aa/network.go b/pkg/aa/network.go index 989b9b16a..383d8692a 100644 --- a/pkg/aa/network.go +++ b/pkg/aa/network.go @@ -140,3 +140,7 @@ func (r *Network) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } + +func (r *Network) Merge(other Rule) bool { + return false // Never merge network +} diff --git a/pkg/aa/pivot_root.go b/pkg/aa/pivot_root.go index 219435fcc..255e6563f 100644 --- a/pkg/aa/pivot_root.go +++ b/pkg/aa/pivot_root.go @@ -79,3 +79,7 @@ func (r *PivotRoot) Compare(other Rule) int { } return r.Qualifier.Compare(o.Qualifier) } + +func (r *PivotRoot) Merge(other Rule) bool { + return false // Never merge pivot root +} diff --git a/pkg/aa/preamble.go b/pkg/aa/preamble.go index c66471c04..7b3d372cd 100644 --- a/pkg/aa/preamble.go +++ b/pkg/aa/preamble.go @@ -49,6 +49,10 @@ func (r *Comment) Compare(other Rule) int { return 0 // Comments are always equal to each other as they are not compared } +func (r *Comment) Merge(other Rule) bool { + return false // Never merge comments +} + type Abi struct { Base Path string @@ -101,6 +105,10 @@ func (r *Abi) Compare(other Rule) int { return compare(r.IsMagic, o.IsMagic) } +func (r *Abi) Merge(other Rule) bool { + return false // Never merge abi +} + type Alias struct { Base Path string @@ -145,6 +153,10 @@ func (r *Alias) Compare(other Rule) int { return compare(r.RewrittenPath, o.RewrittenPath) } +func (r *Alias) Merge(other Rule) bool { + return false // Never merge alias +} + type Include struct { Base IfExists bool @@ -218,6 +230,10 @@ func (r *Include) Compare(other Rule) int { return compare(r.IfExists, o.IfExists) } +func (r *Include) Merge(other Rule) bool { + return false // Never merge include +} + type Variable struct { Base Name string diff --git a/pkg/aa/ptrace.go b/pkg/aa/ptrace.go index 3c907bc76..e4b174a88 100644 --- a/pkg/aa/ptrace.go +++ b/pkg/aa/ptrace.go @@ -66,6 +66,17 @@ func (r *Ptrace) Validate() error { return nil } +func (r *Ptrace) Compare(other Rule) int { + o, _ := other.(*Ptrace) + if res := compare(r.Access, o.Access); res != 0 { + return res + } + if res := compare(r.Peer, o.Peer); res != 0 { + return res + } + return r.Qualifier.Compare(o.Qualifier) +} + func (r *Ptrace) Merge(other Rule) bool { o, _ := other.(*Ptrace) @@ -79,14 +90,3 @@ func (r *Ptrace) Merge(other Rule) bool { } return false } - -func (r *Ptrace) Compare(other Rule) int { - o, _ := other.(*Ptrace) - if res := compare(r.Access, o.Access); res != 0 { - return res - } - if res := compare(r.Peer, o.Peer); res != 0 { - return res - } - return r.Qualifier.Compare(o.Qualifier) -} diff --git a/pkg/aa/rlimit.go b/pkg/aa/rlimit.go index 7fffbb782..8efe2fa14 100644 --- a/pkg/aa/rlimit.go +++ b/pkg/aa/rlimit.go @@ -80,3 +80,7 @@ func (r *Rlimit) Compare(other Rule) int { } return compare(r.Value, o.Value) } + +func (r *Rlimit) Merge(other Rule) bool { + return false // Never merge rlimit +} diff --git a/pkg/aa/signal.go b/pkg/aa/signal.go index 30b7aea83..f33304ccf 100644 --- a/pkg/aa/signal.go +++ b/pkg/aa/signal.go @@ -89,6 +89,20 @@ func (r *Signal) Validate() error { return nil } +func (r *Signal) Compare(other Rule) int { + o, _ := other.(*Signal) + if res := compare(r.Access, o.Access); res != 0 { + return res + } + if res := compare(r.Set, o.Set); res != 0 { + return res + } + if res := compare(r.Peer, o.Peer); res != 0 { + return res + } + return r.Qualifier.Compare(o.Qualifier) +} + func (r *Signal) Merge(other Rule) bool { o, _ := other.(*Signal) @@ -107,17 +121,3 @@ func (r *Signal) Merge(other Rule) bool { } return false } - -func (r *Signal) Compare(other Rule) int { - o, _ := other.(*Signal) - if res := compare(r.Access, o.Access); res != 0 { - return res - } - if res := compare(r.Set, o.Set); res != 0 { - return res - } - if res := compare(r.Peer, o.Peer); res != 0 { - return res - } - return r.Qualifier.Compare(o.Qualifier) -} From 732134bd968bd83cbc817dcf3bd351e4d4a337cb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 25 Jun 2024 20:11:24 +0100 Subject: [PATCH 0015/1455] feat(aa): improve internal sorting order. --- pkg/aa/profile.go | 8 ++++---- pkg/aa/signal.go | 10 +++++----- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/pkg/aa/profile.go b/pkg/aa/profile.go index c1400da48..15d05cff0 100644 --- a/pkg/aa/profile.go +++ b/pkg/aa/profile.go @@ -20,10 +20,10 @@ const ( func init() { requirements[PROFILE] = requirement{ tokFLAGS: { - "enforce", "complain", "kill", "default_allow", "unconfined", - "prompt", "audit", "mediate_deleted", "attach_disconnected", - "attach_disconneced.path=", "chroot_relative", "debug", - "interruptible", "kill", "kill.signal=", + "attach_disconneced.path=", "attach_disconnected", "audit", + "chroot_relative", "complain", "debug", "default_allow", "enforce", + "interruptible", "kill.signal=", "kill", "kill", "mediate_deleted", + "prompt", "unconfined", }, } } diff --git a/pkg/aa/signal.go b/pkg/aa/signal.go index f33304ccf..29ce88740 100644 --- a/pkg/aa/signal.go +++ b/pkg/aa/signal.go @@ -16,11 +16,11 @@ func init() { "r", "w", "rw", "read", "write", "send", "receive", }, "set": { - "hup", "int", "quit", "ill", "trap", "abrt", "bus", "fpe", - "kill", "usr1", "segv", "usr2", "pipe", "alrm", "term", "stkflt", - "chld", "cont", "stop", "stp", "ttin", "ttou", "urg", "xcpu", - "xfsz", "vtalrm", "prof", "winch", "io", "pwr", "sys", "emt", - "exists", "rtmin+0", "rtmin+1", "rtmin+2", "rtmin+3", "rtmin+4", + "abrt", "alrm", "bus", "chld", "cont", "emt", "exists", "fpe", "hup", + "ill", "int", "io", "kill", "pipe", "prof", "pwr", "quit", "segv", + "stkflt", "stop", "stp", "sys", "term", "trap", "ttin", "ttou", + "urg", "usr1", "usr2", "vtalrm", "winch", "xcpu", "xfsz", + "rtmin+0", "rtmin+1", "rtmin+2", "rtmin+3", "rtmin+4", "rtmin+5", "rtmin+6", "rtmin+7", "rtmin+8", "rtmin+9", "rtmin+10", "rtmin+11", "rtmin+12", "rtmin+13", "rtmin+14", "rtmin+15", "rtmin+16", "rtmin+17", "rtmin+18", "rtmin+19", "rtmin+20", From 86b2f74a24fdf2957f6aad28fb999fa6a2e43e82 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 27 Jun 2024 11:39:36 +0100 Subject: [PATCH 0016/1455] test(aa): refractor interface rule unit tests. --- pkg/aa/parse_test.go | 14 ++++---- pkg/aa/{rules_test.go => rule_test.go} | 46 +++++++++++++------------- 2 files changed, 30 insertions(+), 30 deletions(-) rename pkg/aa/{rules_test.go => rule_test.go} (98%) diff --git a/pkg/aa/parse_test.go b/pkg/aa/parse_test.go index 3bfc1eae4..9cc011f38 100644 --- a/pkg/aa/parse_test.go +++ b/pkg/aa/parse_test.go @@ -14,7 +14,7 @@ import ( func Test_tokenizeRule(t *testing.T) { inHeader = true - for _, tt := range testRules { + for _, tt := range testParseRules { t.Run(tt.name, func(t *testing.T) { if got := tokenizeRule(tt.raw); !reflect.DeepEqual(got, tt.tokens) { t.Errorf("tokenize() = %v, want %v", got, tt.tokens) @@ -25,7 +25,7 @@ func Test_tokenizeRule(t *testing.T) { func Test_parseRule(t *testing.T) { inHeader = true - for _, tt := range testRules { + for _, tt := range testParseRules { t.Run(tt.name, func(t *testing.T) { if got := parseRule(tt.raw); !reflect.DeepEqual(got, tt.rule) { t.Errorf("parseRule() = %v, want %v", got, tt.rule) @@ -35,7 +35,7 @@ func Test_parseRule(t *testing.T) { } func Test_rule_Getter(t *testing.T) { - for _, tt := range testRules { + for _, tt := range testParseRules { t.Run(tt.name, func(t *testing.T) { if tt.wGetAsMap == nil { tt.wGetAsMap = map[string][]string{} @@ -113,7 +113,7 @@ func Test_parseCommaRules(t *testing.T) { } func Test_newRules(t *testing.T) { - for _, tt := range testRules { + for _, tt := range testParseRules { if tt.wRule == nil { continue } @@ -159,7 +159,7 @@ func Test_AppArmorProfileFile_Parse(t *testing.T) { var ( // Test cases for tokenizeRule, parseRule,rule getters, and newRules - testRules = []struct { + testParseRules = []struct { name string raw string tokens []string @@ -497,7 +497,7 @@ var ( wString: "signal receive set=(cont term winch) peer=at-spi-bus-launcher", wRule: &Signal{ Access: []string{"receive"}, - Set: []string{"term", "cont", "winch"}, + Set: []string{"cont", "term", "winch"}, Peer: "at-spi-bus-launcher", }, }, @@ -1123,7 +1123,7 @@ var ( { &Signal{ Access: []string{"receive"}, - Set: []string{"term", "cont", "winch"}, + Set: []string{"cont", "term", "winch"}, Peer: "at-spi-bus-launcher", }, }, diff --git a/pkg/aa/rules_test.go b/pkg/aa/rule_test.go similarity index 98% rename from pkg/aa/rules_test.go rename to pkg/aa/rule_test.go index b3aa67b75..77e05e320 100644 --- a/pkg/aa/rules_test.go +++ b/pkg/aa/rule_test.go @@ -9,7 +9,7 @@ import ( "testing" ) -func TestRules_FromLog(t *testing.T) { +func TestRule_FromLog(t *testing.T) { for _, tt := range testRule { if tt.fromLog == nil { continue @@ -22,27 +22,7 @@ func TestRules_FromLog(t *testing.T) { } } -func TestRules_Validate(t *testing.T) { - for _, tt := range testRule { - t.Run(tt.name, func(t *testing.T) { - if err := tt.rule.Validate(); (err != nil) != tt.wValidErr { - t.Errorf("Rules.Validate() error = %v, wantErr %v", err, tt.wValidErr) - } - }) - } -} - -func TestCapability_Compare(t *testing.T) { - for _, tt := range testRule { - t.Run(tt.name, func(t *testing.T) { - if got := tt.rule.Compare(tt.other); got != tt.wCompare { - t.Errorf("Rule.Compare() = %v, want %v", got, tt.wCompare) - } - }) - } -} - -func TestRules_String(t *testing.T) { +func TestRule_String(t *testing.T) { for _, tt := range testRule { t.Run(tt.name, func(t *testing.T) { if got := tt.rule.String(); got != tt.wString { @@ -52,7 +32,27 @@ func TestRules_String(t *testing.T) { } } -func TestCapability_Merge(t *testing.T) { +func TestRule_Validate(t *testing.T) { + for _, tt := range testRule { + t.Run(tt.name, func(t *testing.T) { + if err := tt.rule.Validate(); (err != nil) != tt.wValidErr { + t.Errorf("Rules.Validate() error = %v, wantErr %v", err, tt.wValidErr) + } + }) + } +} + +func TestRule_Compare(t *testing.T) { + for _, tt := range testRule { + t.Run(tt.name, func(t *testing.T) { + if got := tt.rule.Compare(tt.other); got != tt.wCompare { + t.Errorf("Rule.Compare() = %v, want %v", got, tt.wCompare) + } + }) + } +} + +func TestRule_Merge(t *testing.T) { for _, tt := range testRule { t.Run(tt.name, func(t *testing.T) { if got := tt.rule.Merge(tt.other); got != tt.wMerge { From 191c72fcb62a4e5f712572845dac7d8d73f12451 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 27 Jun 2024 18:45:32 +0100 Subject: [PATCH 0017/1455] chore(aa): minor cosmetic of the rule interface. --- pkg/aa/all.go | 4 ++-- pkg/aa/blocks.go | 4 ++-- pkg/aa/capability.go | 4 ++-- pkg/aa/change_profile.go | 4 ++-- pkg/aa/dbus.go | 4 ++-- pkg/aa/file.go | 8 ++++---- pkg/aa/io_uring.go | 4 ++-- pkg/aa/mount.go | 12 ++++++------ pkg/aa/mqueue.go | 4 ++-- pkg/aa/network.go | 4 ++-- pkg/aa/parse.go | 4 ++-- pkg/aa/pivot_root.go | 4 ++-- pkg/aa/preamble.go | 20 ++++++++++---------- pkg/aa/profile.go | 4 ++-- pkg/aa/ptrace.go | 4 ++-- pkg/aa/rlimit.go | 4 ++-- pkg/aa/rules.go | 20 ++++++++++---------- pkg/aa/signal.go | 4 ++-- pkg/aa/unix.go | 4 ++-- pkg/aa/userns.go | 4 ++-- 20 files changed, 62 insertions(+), 62 deletions(-) diff --git a/pkg/aa/all.go b/pkg/aa/all.go index 1ca5ba70e..3e29505ad 100644 --- a/pkg/aa/all.go +++ b/pkg/aa/all.go @@ -20,8 +20,8 @@ func (r *All) Kind() Kind { return ALL } -func (r *All) Constraint() constraint { - return blockKind +func (r *All) Constraint() Constraint { + return BlockRule } func (r *All) String() string { diff --git a/pkg/aa/blocks.go b/pkg/aa/blocks.go index ecc931d0d..6aa10c94d 100644 --- a/pkg/aa/blocks.go +++ b/pkg/aa/blocks.go @@ -19,8 +19,8 @@ func (p *Hat) Kind() Kind { return HAT } -func (p *Hat) Constraint() constraint { - return blockKind +func (p *Hat) Constraint() Constraint { + return BlockRule } func (p *Hat) String() string { diff --git a/pkg/aa/capability.go b/pkg/aa/capability.go index a91fad7ab..e438a7614 100644 --- a/pkg/aa/capability.go +++ b/pkg/aa/capability.go @@ -55,8 +55,8 @@ func (r *Capability) Kind() Kind { return CAPABILITY } -func (r *Capability) Constraint() constraint { - return blockKind +func (r *Capability) Constraint() Constraint { + return BlockRule } func (r *Capability) String() string { diff --git a/pkg/aa/change_profile.go b/pkg/aa/change_profile.go index f0e9a5d0b..15e357d91 100644 --- a/pkg/aa/change_profile.go +++ b/pkg/aa/change_profile.go @@ -71,8 +71,8 @@ func (r *ChangeProfile) Kind() Kind { return CHANGEPROFILE } -func (r *ChangeProfile) Constraint() constraint { - return blockKind +func (r *ChangeProfile) Constraint() Constraint { + return BlockRule } func (r *ChangeProfile) String() string { diff --git a/pkg/aa/dbus.go b/pkg/aa/dbus.go index 13a600280..23c517f6e 100644 --- a/pkg/aa/dbus.go +++ b/pkg/aa/dbus.go @@ -78,8 +78,8 @@ func (r *Dbus) Kind() Kind { return DBUS } -func (r *Dbus) Constraint() constraint { - return blockKind +func (r *Dbus) Constraint() Constraint { + return BlockRule } func (r *Dbus) String() string { diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 4255c4de7..31ebf3fdf 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -107,8 +107,8 @@ func (r *File) Kind() Kind { return FILE } -func (r *File) Constraint() constraint { - return blockKind +func (r *File) Constraint() Constraint { + return BlockRule } func (r *File) String() string { @@ -213,8 +213,8 @@ func (r *Link) Kind() Kind { return LINK } -func (r *Link) Constraint() constraint { - return blockKind +func (r *Link) Constraint() Constraint { + return BlockRule } func (r *Link) String() string { diff --git a/pkg/aa/io_uring.go b/pkg/aa/io_uring.go index 6d7755d1e..ceda00c76 100644 --- a/pkg/aa/io_uring.go +++ b/pkg/aa/io_uring.go @@ -49,8 +49,8 @@ func (r *IOUring) Kind() Kind { return IOURING } -func (r *IOUring) Constraint() constraint { - return blockKind +func (r *IOUring) Constraint() Constraint { + return BlockRule } func (r *IOUring) String() string { diff --git a/pkg/aa/mount.go b/pkg/aa/mount.go index 9833ac8f1..822d11933 100644 --- a/pkg/aa/mount.go +++ b/pkg/aa/mount.go @@ -124,8 +124,8 @@ func (r *Mount) Kind() Kind { return MOUNT } -func (r *Mount) Constraint() constraint { - return blockKind +func (r *Mount) Constraint() Constraint { + return BlockRule } func (r *Mount) String() string { @@ -206,8 +206,8 @@ func (r *Umount) Kind() Kind { return UMOUNT } -func (r *Umount) Constraint() constraint { - return blockKind +func (r *Umount) Constraint() Constraint { + return BlockRule } func (r *Umount) String() string { @@ -285,8 +285,8 @@ func (r *Remount) Kind() Kind { return REMOUNT } -func (r *Remount) Constraint() constraint { - return blockKind +func (r *Remount) Constraint() Constraint { + return BlockRule } func (r *Remount) String() string { diff --git a/pkg/aa/mqueue.go b/pkg/aa/mqueue.go index b511666c6..927606c9b 100644 --- a/pkg/aa/mqueue.go +++ b/pkg/aa/mqueue.go @@ -77,8 +77,8 @@ func (r *Mqueue) Kind() Kind { return MQUEUE } -func (r *Mqueue) Constraint() constraint { - return blockKind +func (r *Mqueue) Constraint() Constraint { + return BlockRule } func (r *Mqueue) String() string { diff --git a/pkg/aa/network.go b/pkg/aa/network.go index 383d8692a..aa7d89da6 100644 --- a/pkg/aa/network.go +++ b/pkg/aa/network.go @@ -103,8 +103,8 @@ func (r *Network) Kind() Kind { return NETWORK } -func (r *Network) Constraint() constraint { - return blockKind +func (r *Network) Constraint() Constraint { + return BlockRule } func (r *Network) String() string { diff --git a/pkg/aa/parse.go b/pkg/aa/parse.go index 24117700a..90286f4d5 100644 --- a/pkg/aa/parse.go +++ b/pkg/aa/parse.go @@ -188,7 +188,7 @@ func parseParagraph(input string) (Rules, error) { res = append(res, rrr...) for _, r := range res { - if r.Constraint() == preambleKind { + if r.Constraint() == PreambleRule { return nil, fmt.Errorf("Rule not allowed in block: %s", r) } } @@ -588,7 +588,7 @@ func (f *AppArmorProfileFile) parsePreamble(preamble string) error { f.Preamble = append(f.Preamble, commaRules...) for _, r := range f.Preamble { - if r.Constraint() == blockKind { + if r.Constraint() == BlockRule { f.Preamble = nil return fmt.Errorf("Rule not allowed in preamble: %s", r) } diff --git a/pkg/aa/pivot_root.go b/pkg/aa/pivot_root.go index 255e6563f..7366be189 100644 --- a/pkg/aa/pivot_root.go +++ b/pkg/aa/pivot_root.go @@ -54,8 +54,8 @@ func (r *PivotRoot) Kind() Kind { return PIVOTROOT } -func (r *PivotRoot) Constraint() constraint { - return blockKind +func (r *PivotRoot) Constraint() Constraint { + return BlockRule } func (r *PivotRoot) String() string { diff --git a/pkg/aa/preamble.go b/pkg/aa/preamble.go index 7b3d372cd..eeae1a5c6 100644 --- a/pkg/aa/preamble.go +++ b/pkg/aa/preamble.go @@ -33,8 +33,8 @@ func (r *Comment) Kind() Kind { return COMMENT } -func (r *Comment) Constraint() constraint { - return anyKind +func (r *Comment) Constraint() Constraint { + return AnyRule } func (r *Comment) String() string { @@ -85,8 +85,8 @@ func (r *Abi) Kind() Kind { return ABI } -func (r *Abi) Constraint() constraint { - return preambleKind +func (r *Abi) Constraint() Constraint { + return PreambleRule } func (r *Abi) String() string { @@ -133,8 +133,8 @@ func (r *Alias) Kind() Kind { return ALIAS } -func (r *Alias) Constraint() constraint { - return preambleKind +func (r *Alias) Constraint() Constraint { + return PreambleRule } func (r *Alias) String() string { @@ -200,8 +200,8 @@ func (r *Include) Kind() Kind { return INCLUDE } -func (r *Include) Constraint() constraint { - return anyKind +func (r *Include) Constraint() Constraint { + return AnyRule } func (r *Include) String() string { @@ -272,8 +272,8 @@ func (r *Variable) Kind() Kind { return VARIABLE } -func (r *Variable) Constraint() constraint { - return preambleKind +func (r *Variable) Constraint() Constraint { + return PreambleRule } func (r *Variable) String() string { diff --git a/pkg/aa/profile.go b/pkg/aa/profile.go index 15d05cff0..ee359beec 100644 --- a/pkg/aa/profile.go +++ b/pkg/aa/profile.go @@ -73,8 +73,8 @@ func (p *Profile) Kind() Kind { return PROFILE } -func (p *Profile) Constraint() constraint { - return blockKind +func (p *Profile) Constraint() Constraint { + return BlockRule } func (p *Profile) String() string { diff --git a/pkg/aa/ptrace.go b/pkg/aa/ptrace.go index e4b174a88..8f0dc1c62 100644 --- a/pkg/aa/ptrace.go +++ b/pkg/aa/ptrace.go @@ -51,8 +51,8 @@ func (r *Ptrace) Kind() Kind { return PTRACE } -func (r *Ptrace) Constraint() constraint { - return blockKind +func (r *Ptrace) Constraint() Constraint { + return BlockRule } func (r *Ptrace) String() string { diff --git a/pkg/aa/rlimit.go b/pkg/aa/rlimit.go index 8efe2fa14..9ad1dd30f 100644 --- a/pkg/aa/rlimit.go +++ b/pkg/aa/rlimit.go @@ -55,8 +55,8 @@ func (r *Rlimit) Kind() Kind { return RLIMIT } -func (r *Rlimit) Constraint() constraint { - return blockKind +func (r *Rlimit) Constraint() Constraint { + return BlockRule } func (r *Rlimit) String() string { diff --git a/pkg/aa/rules.go b/pkg/aa/rules.go index 6a0d68519..077a6506e 100644 --- a/pkg/aa/rules.go +++ b/pkg/aa/rules.go @@ -13,12 +13,12 @@ import ( type requirement map[string][]string -type constraint uint +type Constraint uint const ( - anyKind constraint = iota // The rule can be found in either preamble or profile - preambleKind // The rule can only be found in the preamble - blockKind // The rule can only be found in a profile + AnyRule Constraint = iota // The rule can be found in either preamble or profile + PreambleRule // The rule can only be found in the preamble + BlockRule // The rule can only be found in a profile ) // Kind represents an AppArmor rule kind. @@ -37,12 +37,12 @@ func (k Kind) Tok() string { // Rule generic interface for all AppArmor rules type Rule interface { - Kind() Kind - Constraint() constraint - String() string - Validate() error - Compare(other Rule) int - Merge(other Rule) bool + Kind() Kind // Kind of the rule + Constraint() Constraint // Where the rule can be found (preamble, profile, any) + String() string // Render the rule as a string + Validate() error // Validate the rule. Return an error if the rule is invalid + Compare(other Rule) int // Compare two rules. Return 0 if they are identical + Merge(other Rule) bool // Merge rules of same kind together. Return true if merged } type Rules []Rule diff --git a/pkg/aa/signal.go b/pkg/aa/signal.go index 29ce88740..62c41f0aa 100644 --- a/pkg/aa/signal.go +++ b/pkg/aa/signal.go @@ -71,8 +71,8 @@ func (r *Signal) Kind() Kind { return SIGNAL } -func (r *Signal) Constraint() constraint { - return blockKind +func (r *Signal) Constraint() Constraint { + return BlockRule } func (r *Signal) String() string { diff --git a/pkg/aa/unix.go b/pkg/aa/unix.go index 7d882ea40..a14c5816b 100644 --- a/pkg/aa/unix.go +++ b/pkg/aa/unix.go @@ -74,8 +74,8 @@ func (r *Unix) Kind() Kind { return UNIX } -func (r *Unix) Constraint() constraint { - return blockKind +func (r *Unix) Constraint() Constraint { + return BlockRule } func (r *Unix) String() string { diff --git a/pkg/aa/userns.go b/pkg/aa/userns.go index baa50f0cc..a594bd487 100644 --- a/pkg/aa/userns.go +++ b/pkg/aa/userns.go @@ -46,8 +46,8 @@ func (r *Userns) Kind() Kind { return USERNS } -func (r *Userns) Constraint() constraint { - return blockKind +func (r *Userns) Constraint() Constraint { + return BlockRule } func (r *Userns) String() string { From d9bbdb77faf9ea2b908b09ecbee4874b47a2022f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 29 Jun 2024 20:01:00 +0100 Subject: [PATCH 0018/1455] feat(aa): rename: convert -> util. --- pkg/aa/{convert.go => util.go} | 0 pkg/aa/{convert_test.go => util_test.go} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename pkg/aa/{convert.go => util.go} (100%) rename pkg/aa/{convert_test.go => util_test.go} (100%) diff --git a/pkg/aa/convert.go b/pkg/aa/util.go similarity index 100% rename from pkg/aa/convert.go rename to pkg/aa/util.go diff --git a/pkg/aa/convert_test.go b/pkg/aa/util_test.go similarity index 100% rename from pkg/aa/convert_test.go rename to pkg/aa/util_test.go From 8b24f3521d571ac93a3d53a67f2b8069f122cc17 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 29 Jun 2024 22:20:42 +0100 Subject: [PATCH 0019/1455] feat(aa): add new formatting methods to the rule interface. --- pkg/aa/base.go | 37 ++++++++++++++++++++++++++++++++++--- pkg/aa/rules.go | 16 ++++++++++------ 2 files changed, 44 insertions(+), 9 deletions(-) diff --git a/pkg/aa/base.go b/pkg/aa/base.go index 6e40e46df..967466520 100644 --- a/pkg/aa/base.go +++ b/pkg/aa/base.go @@ -13,10 +13,8 @@ type Base struct { Comment string NoNewPrivs bool FileInherit bool - Prefix string - Padding string - Suffix string Optional bool + Paddings []string } func newBase(rule rule) Base { @@ -79,13 +77,27 @@ func newBaseFromLog(log map[string]string) Base { } } +func (r Base) Padding(i int) string { + if i >= len(r.Paddings) { + return "" + } + return r.Paddings[i] +} + func (r *Base) merge(other Base) bool { + r.NoNewPrivs = r.NoNewPrivs || other.NoNewPrivs + r.FileInherit = r.FileInherit || other.FileInherit + r.Optional = r.Optional || other.Optional if other.Comment != "" { r.Comment += " " + other.Comment } return true } +func (r Base) addLine(other Rule) bool { + return false +} + type Qualifier struct { Audit bool AccessType string @@ -109,3 +121,22 @@ func (r Qualifier) Compare(o Qualifier) int { func (r Qualifier) Equal(o Qualifier) bool { return r.Audit == o.Audit && r.AccessType == o.AccessType } + +func (r Qualifier) getLenAudit() int { + return length("audit", r.Audit) +} + +func (r Qualifier) getLenAccess() int { + lenAccess := 0 + if r.AccessType != "" { + lenAccess = length("", r.AccessType) + } + return lenAccess +} + +func (r Qualifier) setPaddings(max []int) []string { + return setPaddings(max, + []string{"audit", ""}, + []any{r.Audit, r.AccessType}, + ) +} diff --git a/pkg/aa/rules.go b/pkg/aa/rules.go index 077a6506e..8ab469aa5 100644 --- a/pkg/aa/rules.go +++ b/pkg/aa/rules.go @@ -37,12 +37,16 @@ func (k Kind) Tok() string { // Rule generic interface for all AppArmor rules type Rule interface { - Kind() Kind // Kind of the rule - Constraint() Constraint // Where the rule can be found (preamble, profile, any) - String() string // Render the rule as a string - Validate() error // Validate the rule. Return an error if the rule is invalid - Compare(other Rule) int // Compare two rules. Return 0 if they are identical - Merge(other Rule) bool // Merge rules of same kind together. Return true if merged + Kind() Kind // Kind of the rule + Constraint() Constraint // Where the rule can be found (preamble, profile, any) + String() string // Render the rule as a string + Validate() error // Validate the rule. Return an error if the rule is invalid + Compare(other Rule) int // Compare two rules. Return 0 if they are identical + Merge(other Rule) bool // Merge rules of same kind together. Return true if merged + Padding(i int) string // Padding for rule items at index i + Lengths() []int // Length of each item in the rule + setPaddings(max []int) // Set paddings for each item in the rule + addLine(other Rule) bool // Check either a new line should be added before the rule } type Rules []Rule From 0e0f87611abfff4375801cccb9a64d34d82ceb2f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 29 Jun 2024 22:27:39 +0100 Subject: [PATCH 0020/1455] feat(aa): add implementation of the new rule methods. --- pkg/aa/all.go | 8 ++++- pkg/aa/blocks.go | 6 ++++ pkg/aa/capability.go | 14 +++++++++ pkg/aa/change_profile.go | 17 ++++++++++ pkg/aa/dbus.go | 6 ++++ pkg/aa/file.go | 38 +++++++++++++++++++++++ pkg/aa/io_uring.go | 16 ++++++++++ pkg/aa/mount.go | 67 ++++++++++++++++++++++++++++++++++++++++ pkg/aa/mqueue.go | 18 +++++++++++ pkg/aa/network.go | 17 ++++++++++ pkg/aa/pivot_root.go | 17 ++++++++++ pkg/aa/preamble.go | 30 ++++++++++++++++++ pkg/aa/profile.go | 6 ++++ pkg/aa/ptrace.go | 16 ++++++++++ pkg/aa/rlimit.go | 15 +++++++++ pkg/aa/signal.go | 17 ++++++++++ pkg/aa/unix.go | 19 ++++++++++++ pkg/aa/userns.go | 8 ++++- pkg/aa/util.go | 47 ++++++++++++++++++++++++++++ 19 files changed, 380 insertions(+), 2 deletions(-) diff --git a/pkg/aa/all.go b/pkg/aa/all.go index 3e29505ad..21368d320 100644 --- a/pkg/aa/all.go +++ b/pkg/aa/all.go @@ -39,5 +39,11 @@ func (r *All) Compare(other Rule) int { func (r *All) Merge(other Rule) bool { o, _ := other.(*All) b := &r.Base - return b.merge(o.Base) + return b.merge(o.Base) // Always merge all rules } + +func (r *All) Lengths() []int { + return []int{} // No len for all +} + +func (r *All) setPaddings(max []int) {} // No paddings for all diff --git a/pkg/aa/blocks.go b/pkg/aa/blocks.go index 6aa10c94d..901fdaae8 100644 --- a/pkg/aa/blocks.go +++ b/pkg/aa/blocks.go @@ -39,3 +39,9 @@ func (r *Hat) Compare(other Rule) int { func (r *Hat) Merge(other Rule) bool { return false // Never merge hat blocks } + +func (r *Hat) Lengths() []int { + return []int{} // No len for hat +} + +func (r *Hat) setPaddings(max []int) {} // No paddings for hat diff --git a/pkg/aa/capability.go b/pkg/aa/capability.go index e438a7614..b1ba27c6a 100644 --- a/pkg/aa/capability.go +++ b/pkg/aa/capability.go @@ -81,3 +81,17 @@ func (r *Capability) Compare(other Rule) int { func (r *Capability) Merge(other Rule) bool { return false // Never merge capabilities } + +func (r *Capability) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.Names), + } +} + +func (r *Capability) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{""}, []any{r.Names})..., + ) +} diff --git a/pkg/aa/change_profile.go b/pkg/aa/change_profile.go index 15e357d91..769427024 100644 --- a/pkg/aa/change_profile.go +++ b/pkg/aa/change_profile.go @@ -103,3 +103,20 @@ func (r *ChangeProfile) Compare(other Rule) int { func (r *ChangeProfile) Merge(other Rule) bool { return false // Never merge change_profile } + +func (r *ChangeProfile) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.ExecMode), + length("", r.Exec), + length("", r.ProfileName), + } +} + +func (r *ChangeProfile) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"", "", ""}, + []any{r.ExecMode, r.Exec, r.ProfileName})..., + ) +} diff --git a/pkg/aa/dbus.go b/pkg/aa/dbus.go index 23c517f6e..79072925f 100644 --- a/pkg/aa/dbus.go +++ b/pkg/aa/dbus.go @@ -137,3 +137,9 @@ func (r *Dbus) Merge(other Rule) bool { } return false } + +func (r *Dbus) Lengths() []int { + return []int{} // No len for dbus +} + +func (r *Dbus) setPaddings(max []int) {} // No paddings for dbus diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 31ebf3fdf..88b08c088 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -8,6 +8,8 @@ import ( "fmt" "slices" "strings" + + "github.com/roddhjav/apparmor.d/pkg/util" ) const ( @@ -156,6 +158,42 @@ func (r *File) Merge(other Rule) bool { return false } +func (r *File) Lengths() []int { + // Add padding to align with other transition rule + lenPath := 0 + isTransition := util.Intersect( + append(requirements[FILE]["transition"], "m"), r.Access, + ) + if len(isTransition) > 0 { + lenPath = length("", r.Path) + } + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("owner", r.Owner), + lenPath, + } +} + +func (r *File) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"owner", ""}, + []any{r.Owner, r.Path})..., + ) +} + +func (r *File) addLine(other Rule) bool { + if other.Kind() != r.Kind() { + return false + } + + letterI := getLetterIn(fileAlphabet, r.Path) + letterJ := getLetterIn(fileAlphabet, other.(*File).Path) + groupI, ok1 := fileAlphabetGroups[letterI] + groupJ, ok2 := fileAlphabetGroups[letterJ] + return letterI != letterJ && !(ok1 && ok2 && groupI == groupJ) +} + type Link struct { Base Qualifier diff --git a/pkg/aa/io_uring.go b/pkg/aa/io_uring.go index ceda00c76..3346ed4c6 100644 --- a/pkg/aa/io_uring.go +++ b/pkg/aa/io_uring.go @@ -88,3 +88,19 @@ func (r *IOUring) Merge(other Rule) bool { } return false } + +func (r *IOUring) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.Access), + length("label=", r.Label), + } +} + +func (r *IOUring) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"", "label="}, + []any{r.Access, r.Label})..., + ) +} diff --git a/pkg/aa/mount.go b/pkg/aa/mount.go index 822d11933..914efc2ff 100644 --- a/pkg/aa/mount.go +++ b/pkg/aa/mount.go @@ -73,6 +73,21 @@ func (m *MountConditions) Merge(other MountConditions) bool { return false } +func (m MountConditions) getLenFsType() int { + return length("fstype=", m.FsType) +} + +func (m MountConditions) getLenOptions() int { + return length("options=", m.Options) +} + +func (m MountConditions) setPaddings(max []int) []string { + return setPaddings(max, + []string{"fstype=", "options="}, + []any{m.FsType, m.Options}, + ) +} + type Mount struct { Base Qualifier @@ -168,6 +183,24 @@ func (r *Mount) Merge(other Rule) bool { return false } +func (r *Mount) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + r.MountConditions.getLenFsType(), + r.MountConditions.getLenOptions(), + length("", r.Source), + length("", r.MountPoint), + } +} + +func (r *Mount) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), r.MountConditions.setPaddings(max[2:4])...) + r.Paddings = append(r.Paddings, + setPaddings(max[4:], []string{"", ""}, []any{r.Source, r.MountPoint})..., + ) +} + type Umount struct { Base Qualifier @@ -246,6 +279,23 @@ func (r *Umount) Merge(other Rule) bool { return false } +func (r *Umount) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + r.MountConditions.getLenFsType(), + r.MountConditions.getLenOptions(), + length("", r.MountPoint), + } +} + +func (r *Umount) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), r.MountConditions.setPaddings(max[2:4])...) + r.Paddings = append(r.Paddings, + setPaddings(max[4:], []string{""}, []any{r.MountPoint})..., + ) +} + type Remount struct { Base Qualifier @@ -324,3 +374,20 @@ func (r *Remount) Merge(other Rule) bool { } return false } + +func (r *Remount) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + r.MountConditions.getLenFsType(), + r.MountConditions.getLenOptions(), + length("", r.MountPoint), + } +} + +func (r *Remount) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), r.MountConditions.setPaddings(max[2:4])...) + r.Paddings = append(r.Paddings, + setPaddings(max[4:], []string{""}, []any{r.MountPoint})..., + ) +} diff --git a/pkg/aa/mqueue.go b/pkg/aa/mqueue.go index 927606c9b..82106ec79 100644 --- a/pkg/aa/mqueue.go +++ b/pkg/aa/mqueue.go @@ -122,3 +122,21 @@ func (r *Mqueue) Merge(other Rule) bool { } return false } + +func (r *Mqueue) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.Access), + length("type=", r.Type), + length("label=", r.Label), + length("", r.Name), + } +} + +func (r *Mqueue) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"", "type=", "label=", ""}, + []any{r.Access, r.Type, r.Label, r.Name})..., + ) +} diff --git a/pkg/aa/network.go b/pkg/aa/network.go index aa7d89da6..69bd01c83 100644 --- a/pkg/aa/network.go +++ b/pkg/aa/network.go @@ -144,3 +144,20 @@ func (r *Network) Compare(other Rule) int { func (r *Network) Merge(other Rule) bool { return false // Never merge network } + +func (r *Network) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.Domain), + length("", r.Type), + length("", r.Protocol), + } +} + +func (r *Network) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"", "", ""}, + []any{r.Domain, r.Type, r.Protocol})..., + ) +} diff --git a/pkg/aa/pivot_root.go b/pkg/aa/pivot_root.go index 7366be189..2341f4458 100644 --- a/pkg/aa/pivot_root.go +++ b/pkg/aa/pivot_root.go @@ -83,3 +83,20 @@ func (r *PivotRoot) Compare(other Rule) int { func (r *PivotRoot) Merge(other Rule) bool { return false // Never merge pivot root } + +func (r *PivotRoot) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("oldroot=", r.OldRoot), + length("", r.NewRoot), + length("", r.TargetProfile), + } +} + +func (r *PivotRoot) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"oldroot=", "", ""}, + []any{r.OldRoot, r.NewRoot, r.TargetProfile})..., + ) +} diff --git a/pkg/aa/preamble.go b/pkg/aa/preamble.go index eeae1a5c6..4b54954a9 100644 --- a/pkg/aa/preamble.go +++ b/pkg/aa/preamble.go @@ -53,6 +53,12 @@ func (r *Comment) Merge(other Rule) bool { return false // Never merge comments } +func (r *Comment) Lengths() []int { + return []int{} // No len for comments +} + +func (r *Comment) setPaddings(max []int) {} // No paddings for comments + type Abi struct { Base Path string @@ -109,6 +115,12 @@ func (r *Abi) Merge(other Rule) bool { return false // Never merge abi } +func (r *Abi) Lengths() []int { + return []int{} // No len for abi +} + +func (r *Abi) setPaddings(max []int) {} // No paddings for abi + type Alias struct { Base Path string @@ -157,6 +169,12 @@ func (r *Alias) Merge(other Rule) bool { return false // Never merge alias } +func (r *Alias) Lengths() []int { + return []int{} // No len for alias +} + +func (r *Alias) setPaddings(max []int) {} // No paddings for alias + type Include struct { Base IfExists bool @@ -234,6 +252,12 @@ func (r *Include) Merge(other Rule) bool { return false // Never merge include } +func (r *Include) Lengths() []int { + return []int{} // No len for include +} + +func (r *Include) setPaddings(max []int) {} // No paddings for include + type Variable struct { Base Name string @@ -305,3 +329,9 @@ func (r *Variable) Merge(other Rule) bool { } return false } + +func (r *Variable) Lengths() []int { + return []int{} // No len for variable +} + +func (r *Variable) setPaddings(max []int) {} // No paddings for variable diff --git a/pkg/aa/profile.go b/pkg/aa/profile.go index ee359beec..ec5068971 100644 --- a/pkg/aa/profile.go +++ b/pkg/aa/profile.go @@ -103,6 +103,12 @@ func (p *Profile) Merge(other Rule) bool { return false } +func (r *Profile) Lengths() []int { + return []int{} // No len for profile +} + +func (r *Profile) setPaddings(max []int) {} // No paddings for profile + func (p *Profile) Sort() { p.Rules = p.Rules.Sort() } diff --git a/pkg/aa/ptrace.go b/pkg/aa/ptrace.go index 8f0dc1c62..91547087c 100644 --- a/pkg/aa/ptrace.go +++ b/pkg/aa/ptrace.go @@ -90,3 +90,19 @@ func (r *Ptrace) Merge(other Rule) bool { } return false } + +func (r *Ptrace) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.Access), + length("peer=", r.Peer), + } +} + +func (r *Ptrace) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"", "peer="}, + []any{r.Access, r.Peer})..., + ) +} diff --git a/pkg/aa/rlimit.go b/pkg/aa/rlimit.go index 9ad1dd30f..d7b9a0518 100644 --- a/pkg/aa/rlimit.go +++ b/pkg/aa/rlimit.go @@ -84,3 +84,18 @@ func (r *Rlimit) Compare(other Rule) int { func (r *Rlimit) Merge(other Rule) bool { return false // Never merge rlimit } + +func (r *Rlimit) Lengths() []int { + return []int{ + length("", r.Key), + length("", r.Op), + length("", r.Value), + } +} + +func (r *Rlimit) setPaddings(max []int) { + r.Paddings = setPaddings( + max, []string{"", "", ""}, + []any{r.Key, r.Op, r.Value}, + ) +} diff --git a/pkg/aa/signal.go b/pkg/aa/signal.go index 62c41f0aa..c0fa4e1be 100644 --- a/pkg/aa/signal.go +++ b/pkg/aa/signal.go @@ -121,3 +121,20 @@ func (r *Signal) Merge(other Rule) bool { } return false } + +func (r *Signal) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.Access), + length("set=", r.Set), + length("peer=", r.Peer), + } +} + +func (r *Signal) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"", "set=", "peer="}, + []any{r.Access, r.Set, r.Peer})..., + ) +} diff --git a/pkg/aa/unix.go b/pkg/aa/unix.go index a14c5816b..3b14c2984 100644 --- a/pkg/aa/unix.go +++ b/pkg/aa/unix.go @@ -136,3 +136,22 @@ func (r *Unix) Merge(other Rule) bool { } return false } + +func (r *Unix) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("", r.Access), + length("type=", r.Type), + length("protocol=", r.Protocol), + length("addr=", r.Address), + length("label=", r.Label), + } +} + +func (r *Unix) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"", "type=", "protocol=", "addr=", "label="}, + []any{r.Access, r.Type, r.Protocol, r.Address, r.Label})..., + ) +} diff --git a/pkg/aa/userns.go b/pkg/aa/userns.go index a594bd487..f4a9815c6 100644 --- a/pkg/aa/userns.go +++ b/pkg/aa/userns.go @@ -69,5 +69,11 @@ func (r *Userns) Compare(other Rule) int { func (r *Userns) Merge(other Rule) bool { o, _ := other.(*Userns) b := &r.Base - return b.merge(o.Base) + return b.merge(o.Base) // Always merge userns rules } + +func (r *Userns) Lengths() []int { + return []int{} // No len for userns +} + +func (r *Userns) setPaddings(max []int) {} // No paddings for userns diff --git a/pkg/aa/util.go b/pkg/aa/util.go index e0889360c..485478fef 100644 --- a/pkg/aa/util.go +++ b/pkg/aa/util.go @@ -43,6 +43,53 @@ func merge(kind Kind, key string, a, b []string) []string { return slices.Compact(a) } +func length(prefix string, value any) int { + var res int + switch value := value.(type) { + case bool: + if value { + return len(prefix) + 1 + } + return 0 + case string: + if value != "" { + res = len(value) + len(prefix) + 1 + } + return res + case []string: + for _, v := range value { + lenV := len(v) + if lenV > 0 { + res += lenV + 1 // Space between values + } + } + if len(value) > 1 { + res += 2 // Brackets on slices + } + return res + default: + panic("length: unsupported type") + } +} + +func setPaddings(max []int, prefixes []string, values []any) []string { + if len(max) != len(values) || len(max) != len(prefixes) { + panic("setPaddings: max, prefix, and values must have the same length") + } + res := make([]string, len(max)) + for i, v := range values { + if max[i] == 0 { + res[i] = "" + continue + } + count := max[i] - length(prefixes[i], v) + if count > 0 { + res[i] = strings.Repeat(" ", count) + } + } + return res +} + func compare(a, b any) int { switch a := a.(type) { case int: From 4e1b972ee5c37356aaf123e3bf1cbef0984f3c0d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 29 Jun 2024 22:31:36 +0100 Subject: [PATCH 0021/1455] feat(aa): rewrite the rules Format method. Automate padding regardless of rule kind. --- pkg/aa/rules.go | 117 ++++++++++++++++-------------------------------- 1 file changed, 38 insertions(+), 79 deletions(-) diff --git a/pkg/aa/rules.go b/pkg/aa/rules.go index 8ab469aa5..637412278 100644 --- a/pkg/aa/rules.go +++ b/pkg/aa/rules.go @@ -6,9 +6,6 @@ package aa import ( "slices" - "strings" - - "github.com/roddhjav/apparmor.d/pkg/util" ) type requirement map[string][]string @@ -144,8 +141,7 @@ func (r Rules) GetIncludes() []*Include { return res } -// Merge merge similar rules together. -// Steps: +// Merge merge similar rules together: // - Remove identical rules // - Merge rule access. Eg: for same path, 'r' and 'w' becomes 'rw' // @@ -201,90 +197,53 @@ func (r Rules) Sort() Rules { return r } -// Format the rules for better readability before printing it. +// setPaddings set paddings for each element in each rules +func (r *Rules) setPaddings(paddingsIndex map[Kind][]int, paddingsMaxLen map[Kind][]int) { + for kind, index := range paddingsIndex { + if len(index) <= 1 { + continue + } + for _, i := range index { + (*r)[i].setPaddings(paddingsMaxLen[kind]) + } + } +} + +// Format the rules for better readability before printing it. Format supposes +// the rules are merged and sorted. // Follow: https://apparmor.pujol.io/development/guidelines/#the-file-block func (r Rules) Format() Rules { - const prefixOwner = " " - suffixMaxlen := 36 - transitions := append(requirements[FILE]["transition"], "m") + // Insert new line between rule of different type/subtype. + for i := len(r) - 1; i >= 0; i-- { + j := i - 1 + if j < 0 || r[j] == nil { + continue + } + if r[i].addLine(r[j]) { + r = r.Insert(i, nil) + } + } - paddingIndex := []int{} - paddingMaxLenght := 0 + // Find max paddings for each element in each rules + paddingsIndex := map[Kind][]int{} + paddingsMaxLen := map[Kind][]int{} for i, rule := range r { if rule == nil { + r.setPaddings(paddingsIndex, paddingsMaxLen) + paddingsIndex = map[Kind][]int{} + paddingsMaxLen = map[Kind][]int{} continue } - if rule.Kind() == FILE { - rule := r[i].(*File) - - // Add padding to align with other transition rule - isTransition := util.Intersect(transitions, rule.Access) - if len(isTransition) > 0 { - ruleLen := len(rule.Path) + 1 - paddingMaxLenght = max(ruleLen, paddingMaxLenght) - paddingIndex = append(paddingIndex, i) - } - - // Add suffix to align comment on udev/data rule - if rule.Comment != "" && strings.HasPrefix(rule.Path, "@{run}/udev/data/") { - suffixlen := suffixMaxlen - len(rule.Path) - if suffixlen < 0 { - suffixlen = 0 - } - rule.Suffix = strings.Repeat(" ", suffixlen) - } - } - } - if len(paddingIndex) > 1 { - r.setPadding(paddingIndex, paddingMaxLenght) - } - - hasOwnerRule := false - for i := len(r) - 1; i >= 0; i-- { - if r[i] == nil { - hasOwnerRule = false - continue - } - - // File rule - if r[i].Kind() == FILE { - rule := r[i].(*File) - - // Add prefix before rule path to align with other rule - if rule.Owner { - hasOwnerRule = true - } else if hasOwnerRule { - rule.Prefix = prefixOwner - } - - // Do not add new line on executable rule - isTransition := util.Intersect(transitions, rule.Access) - if len(isTransition) > 0 { - continue - } - - // Add a new line between Files rule of different group type - j := i - 1 - if j < 0 || r[j] == nil || r[j].Kind() != FILE { - continue - } - letterI := getLetterIn(fileAlphabet, rule.Path) - letterJ := getLetterIn(fileAlphabet, r[j].(*File).Path) - groupI, ok1 := fileAlphabetGroups[letterI] - groupJ, ok2 := fileAlphabetGroups[letterJ] - if letterI != letterJ && !(ok1 && ok2 && groupI == groupJ) { - hasOwnerRule = false - r = r.Insert(i, nil) + lengths := rule.Lengths() + paddingsIndex[rule.Kind()] = append(paddingsIndex[rule.Kind()], i) + for idx, length := range lengths { + if _, ok := paddingsMaxLen[rule.Kind()]; !ok { + paddingsMaxLen[rule.Kind()] = make([]int, len(lengths)) } + paddingsMaxLen[rule.Kind()][idx] = max(paddingsMaxLen[rule.Kind()][idx], length) } } + r.setPaddings(paddingsIndex, paddingsMaxLen) return r } - -// setPadding adds padding to the rule path to align with other rules. -func (r *Rules) setPadding(paddingIndex []int, paddingMaxLenght int) { - for _, i := range paddingIndex { - (*r)[i].(*File).Padding = strings.Repeat(" ", paddingMaxLenght-len((*r)[i].(*File).Path)) - } -} From 8377dde5d2f58ad7f40c268d22b4d2f66e839a02 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 29 Jun 2024 22:33:45 +0100 Subject: [PATCH 0022/1455] feat(aa): update templates to last struct changes. --- pkg/aa/templates/rule/file.j2 | 15 ++++++--------- pkg/aa/templates/rule/io_uring.j2 | 6 ++++-- pkg/aa/templates/rule/mount.j2 | 10 ++++++++++ pkg/aa/templates/rule/mqueue.j2 | 4 ++++ pkg/aa/templates/rule/pivot_root.j2 | 3 +++ pkg/aa/templates/rule/ptrace.j2 | 2 ++ pkg/aa/templates/rule/qualifier.j2 | 5 ++--- pkg/aa/templates/rule/rlimit.j2 | 14 ++++++++++++-- pkg/aa/templates/rule/signal.j2 | 3 +++ pkg/aa/templates/rule/unix.j2 | 5 +++++ 10 files changed, 51 insertions(+), 16 deletions(-) diff --git a/pkg/aa/templates/rule/file.j2 b/pkg/aa/templates/rule/file.j2 index 8fc82698b..52a41a318 100644 --- a/pkg/aa/templates/rule/file.j2 +++ b/pkg/aa/templates/rule/file.j2 @@ -7,11 +7,10 @@ {{- if .Owner -}} {{- "owner " -}} {{- end -}} + {{- .Padding 2 -}} {{- .Path -}} {{- " " -}} - {{- with .Padding -}} - {{ . }} - {{- end -}} + {{- .Padding 3 -}} {{- range .Access -}} {{- . -}} {{- end -}} @@ -19,9 +18,7 @@ {{ " -> " }}{{ . }} {{- end -}} {{- "," -}} - {{- with .Suffix -}} - {{ . }} - {{- end -}} + {{- .Padding 4 -}} {{- template "comment" . -}} {{- end -}} @@ -30,18 +27,18 @@ {{- if .Owner -}} {{- "owner " -}} {{- end -}} + {{- .Padding 2 -}} {{- "link " -}} {{- if .Subset -}} {{- "subset " -}} {{- end -}} + {{- .Padding 3 -}} {{- .Path -}} {{- " " -}} {{- with .Target -}} {{ "-> " }}{{ . }} {{- end -}} {{- "," -}} - {{- with .Suffix -}} - {{ . }} - {{- end -}} + {{- .Padding 4 -}} {{- template "comment" . -}} {{- end -}} diff --git a/pkg/aa/templates/rule/io_uring.j2 b/pkg/aa/templates/rule/io_uring.j2 index 78e1aa17a..2bbaeda59 100644 --- a/pkg/aa/templates/rule/io_uring.j2 +++ b/pkg/aa/templates/rule/io_uring.j2 @@ -5,12 +5,14 @@ {{- define "io_uring" -}} {{- template "qualifier" . -}} {{- "io_uring" -}} - {{- range .Access -}} - {{ " " }}{{ . }} + {{- with .Access -}} + {{ " " }}{{ cjoin . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Label -}} {{ " label=" }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 3 -}} {{- template "comment" . -}} {{- end -}} diff --git a/pkg/aa/templates/rule/mount.j2 b/pkg/aa/templates/rule/mount.j2 index c97ead101..31e83567f 100644 --- a/pkg/aa/templates/rule/mount.j2 +++ b/pkg/aa/templates/rule/mount.j2 @@ -8,16 +8,20 @@ {{- with .FsType -}} {{ " fstype=" }}{{ . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Options -}} {{ " options=" }}{{ cjoin . }} {{- end -}} + {{- .Padding 3 -}} {{- with .Source -}} {{ " " }}{{ . }} {{- end -}} + {{- .Padding 4 -}} {{- with .MountPoint -}} {{ " -> " }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 5 -}} {{- template "comment" . -}} {{- end -}} @@ -27,13 +31,16 @@ {{- with .FsType -}} {{ " fstype=" }}{{ . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Options -}} {{ " options=" }}{{ cjoin . }} {{- end -}} + {{- .Padding 3 -}} {{- with .MountPoint -}} {{ " " }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 4 -}} {{- template "comment" . -}} {{- end -}} @@ -43,12 +50,15 @@ {{- with .FsType -}} {{ " fstype=" }}{{ . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Options -}} {{ " options=" }}{{ cjoin . }} {{- end -}} + {{- .Padding 3 -}} {{- with .MountPoint -}} {{ " " }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 4 -}} {{- template "comment" . -}} {{- end -}} diff --git a/pkg/aa/templates/rule/mqueue.j2 b/pkg/aa/templates/rule/mqueue.j2 index e2df27562..47147be4b 100644 --- a/pkg/aa/templates/rule/mqueue.j2 +++ b/pkg/aa/templates/rule/mqueue.j2 @@ -8,15 +8,19 @@ {{- with .Access -}} {{ " " }}{{ cjoin . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Type -}} {{ " type=" }}{{ . }} {{- end -}} + {{- .Padding 3 -}} {{- with .Label -}} {{ " label=" }}{{ . }} {{- end -}} + {{- .Padding 4 -}} {{- with .Name -}} {{ " " }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 5 -}} {{- template "comment" . -}} {{- end -}} diff --git a/pkg/aa/templates/rule/pivot_root.j2 b/pkg/aa/templates/rule/pivot_root.j2 index d779e2c11..678617ca0 100644 --- a/pkg/aa/templates/rule/pivot_root.j2 +++ b/pkg/aa/templates/rule/pivot_root.j2 @@ -8,12 +8,15 @@ {{- with .OldRoot -}} {{ " oldroot=" }}{{ . }} {{- end -}} + {{- .Padding 2 -}} {{- with .NewRoot -}} {{ " " }}{{ . }} {{- end -}} + {{- .Padding 3 -}} {{- with .TargetProfile -}} {{ " -> " }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 4 -}} {{- template "comment" . -}} {{- end -}} \ No newline at end of file diff --git a/pkg/aa/templates/rule/ptrace.j2 b/pkg/aa/templates/rule/ptrace.j2 index c499890b0..5f4fe3567 100644 --- a/pkg/aa/templates/rule/ptrace.j2 +++ b/pkg/aa/templates/rule/ptrace.j2 @@ -8,9 +8,11 @@ {{- with .Access -}} {{ " " }}{{ cjoin . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Peer -}} {{ " peer=" }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 3 -}} {{- template "comment" . -}} {{- end -}} \ No newline at end of file diff --git a/pkg/aa/templates/rule/qualifier.j2 b/pkg/aa/templates/rule/qualifier.j2 index ed89f63e0..a0ff554ec 100644 --- a/pkg/aa/templates/rule/qualifier.j2 +++ b/pkg/aa/templates/rule/qualifier.j2 @@ -3,13 +3,12 @@ {{- /* SPDX-License-Identifier: GPL-2.0-only */ -}} {{- define "qualifier" -}} - {{- with .Prefix -}} - {{ . }} - {{- end -}} {{- if .Audit -}} {{- "audit " -}} {{- end -}} + {{- .Padding 0 -}} {{- if eq .AccessType "deny" -}} {{- "deny " -}} {{- end -}} + {{- .Padding 1 -}} {{- end -}} diff --git a/pkg/aa/templates/rule/rlimit.j2 b/pkg/aa/templates/rule/rlimit.j2 index 5061c1c45..c6996ac28 100644 --- a/pkg/aa/templates/rule/rlimit.j2 +++ b/pkg/aa/templates/rule/rlimit.j2 @@ -3,5 +3,15 @@ {{- /* SPDX-License-Identifier: GPL-2.0-only */ -}} {{- define "rlimit" -}} - {{ "set rlimit " }}{{ .Key }} {{ .Op }} {{ .Value }}{{ "," }}{{ template "comment" . }} -{{- end -}} \ No newline at end of file + {{- "set rlimit " -}} + {{- .Key -}} + {{- " " -}} + {{- .Padding 2 -}} + {{- .Op -}} + {{- " " -}} + {{- .Padding 3 -}} + {{- .Value -}} + {{- "," -}} + {{- .Padding 4 -}} + {{- template "comment" . -}} +{{- end -}} diff --git a/pkg/aa/templates/rule/signal.j2 b/pkg/aa/templates/rule/signal.j2 index b56085d8d..fd2edd99d 100644 --- a/pkg/aa/templates/rule/signal.j2 +++ b/pkg/aa/templates/rule/signal.j2 @@ -8,12 +8,15 @@ {{- with .Access -}} {{ " " }}{{ cjoin . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Set -}} {{ " set=" }}{{ cjoin . }} {{- end -}} + {{- .Padding 3 -}} {{- with .Peer -}} {{ " peer=" }}{{ . }} {{- end -}} {{- "," -}} + {{- .Padding 4 -}} {{- template "comment" . -}} {{- end -}} \ No newline at end of file diff --git a/pkg/aa/templates/rule/unix.j2 b/pkg/aa/templates/rule/unix.j2 index 531eaaf9e..fae6a5429 100644 --- a/pkg/aa/templates/rule/unix.j2 +++ b/pkg/aa/templates/rule/unix.j2 @@ -8,18 +8,23 @@ {{- with .Access -}} {{ " " }}{{ cjoin . }} {{- end -}} + {{- .Padding 2 -}} {{- with .Type -}} {{ " type=" }}{{ . }} {{- end -}} + {{- .Padding 3 -}} {{- with .Protocol -}} {{ " protocol=" }}{{ . }} {{- end -}} + {{- .Padding 4 -}} {{- with .Address -}} {{ " addr=" }}{{ . }} {{- end -}} + {{- .Padding 5 -}} {{- with .Label -}} {{ " label=" }}{{ . }} {{- end -}} + {{- .Padding 6 -}} {{- if and .PeerLabel .PeerAddr -}} {{ " peer=(label=" }}{{ .PeerLabel }}{{ ", addr="}}{{ .PeerAddr }}{{ ")" }} {{- else -}} From 7c5ba70b402fd1ceb4641fb2f5be4196357a645a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 29 Jun 2024 22:52:31 +0100 Subject: [PATCH 0023/1455] feat(aa): add missing methods for the Link struct. --- pkg/aa/file.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 88b08c088..50b23bae9 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -284,3 +284,21 @@ func (r *Link) Compare(other Rule) int { func (r *Link) Merge(other Rule) bool { return false // Never merge link } + +func (r *Link) Lengths() []int { + return []int{ + r.Qualifier.getLenAudit(), + r.Qualifier.getLenAccess(), + length("owner", r.Owner), + length("subset", r.Subset), + length("", r.Path), + length("", r.Target), + } +} + +func (r *Link) setPaddings(max []int) { + r.Paddings = append(r.Qualifier.setPaddings(max[:2]), setPaddings( + max[2:], []string{"owner", "subset", "", ""}, + []any{r.Owner, r.Subset, r.Path, r.Target})..., + ) +} From f9a93ab67e0317e9dd53050da4b1f35d9bec50bf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 29 Jun 2024 23:05:45 +0100 Subject: [PATCH 0024/1455] feat(profile): general update. --- apparmor.d/groups/bus/dbus-session | 2 + .../groups/children/child-modprobe-nvidia | 4 ++ apparmor.d/groups/freedesktop/xdg-dbus-proxy | 2 + apparmor.d/groups/gnome/gnome-session-binary | 50 ++++--------------- apparmor.d/groups/systemd/systemd-hostnamed | 2 + apparmor.d/groups/systemd/systemd-networkd | 7 +-- apparmor.d/groups/virt/cockpit-bridge | 2 + apparmor.d/profiles-a-f/adb | 4 +- apparmor.d/profiles-m-r/mount | 1 - apparmor.d/profiles-m-r/ntfs-3g | 3 +- apparmor.d/profiles-m-r/ollama | 4 +- apparmor.d/profiles-m-r/pam-tmpdir-helper | 2 +- apparmor.d/profiles-m-r/run-parts | 2 +- apparmor.d/profiles-s-z/scrcpy | 2 + apparmor.d/profiles-s-z/smplayer | 13 +---- apparmor.d/profiles-s-z/steam | 14 +++--- apparmor.d/profiles-s-z/steam-game-native | 10 ++-- apparmor.d/profiles-s-z/steam-runtime | 2 + 18 files changed, 51 insertions(+), 75 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index 38259afc2..88266bcbf 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -20,6 +20,8 @@ profile dbus-session flags=(attach_disconnected) { include include + network unix stream, + unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none), signal (receive) set=(term hup) peer=gdm-session-worker, diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index 1812463fc..afb48573c 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -55,6 +55,8 @@ profile child-modprobe-nvidia flags=(attach_disconnected) { /dev/tty@{int} rw, + deny @{HOME}/.steam/** r, + profile kmod { include include @@ -69,6 +71,8 @@ profile child-modprobe-nvidia flags=(attach_disconnected) { # @{sys}/module/{drm,nvidia}/initstate r, @{sys}/module/compression r, + deny @{HOME}/.steam/** r, + include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index 6a4da425e..bfc159897 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -18,6 +18,8 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { include include + network unix stream, + dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Realtime member=MakeThreadRealtimeWithPID diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 49ed8285a..46a1b22d0 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -111,49 +111,21 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { profile open flags=(attach_disconnected) { include - include + include - @{lib}/gio-launch-desktop mr, + @{bin}/env rix, + @{sh_path} r, @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, - @{sh_path} rix, + @{lib}/gio-launch-desktop mr, - @{bin}/aa-notify rPx, - @{bin}/blueman-applet rPx, - @{bin}/firewall-applet rPx, - @{bin}/gnome-keyring-daemon rPx, - @{bin}/gnome-shell rPx, - @{bin}/gnome-software rPx, - @{bin}/im-launch rPx, - @{bin}/keepassxc rPx, - @{bin}/opensuse-welcome rPx, - @{bin}/parcellite rPUx, - @{bin}/pkcs11-register rPx, - @{bin}/snap rPUx, - @{bin}/snapshot-detect rPUx, - @{bin}/spice-vdagent rPx, - @{bin}/start-pulseaudio-x11 rPx, - @{bin}/ubuntu-report rPx, - @{bin}/update-notifier rPx, - @{bin}/xbrlapi rPx, - @{bin}/xdg-user-dirs-gtk-update rPx, - @{bin}/xdg-user-dirs-update rPx, - @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx, - @{lib}/{,gnome-shell/}gnome-shell-overrides-migration.sh rPx, - @{lib}/@{multiarch}/xapps/sn-watcher/xapp-sn-watcher rPUx, - @{lib}/caribou/caribou rPUx, - @{lib}/deja-dup/deja-dup-monitor rPx, - @{lib}/gsd-* rPx, - @{lib}/update-notifier/ubuntu-advantage-notification rPx, - @{lib}/xapps/sn-watcher/* rPUx, - @{thunderbird_path} rPx, - /usr/share/libpam-kwallet-common/pam_kwallet_init rPUx, + @{lib}/** PUx, + @{bin}/** PUx, + /opt/*/** PUx, + /usr/share/*/** PUx, + /usr/local/bin/** PUx, + /usr/games/** PUx, - #aa:exec baloo - #aa:exec evolution-alarm-notify - @{lib}/kdeconnectd rPUx, - @{lib}/@{multiarch}/{,libexec/}kdeconnectd rPUx, - - /dev/tty@{int} rw, + /dev/tty rw, include if exists include if exists diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index b81b16403..9686f1864 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -16,6 +16,8 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { capability sys_admin, # To set a hostname + network unix stream, + unix (bind) type=stream addr=@@{hex16}/bus/systemd-hostnam/system, #aa:dbus own bus=system name=org.freedesktop.hostname1 diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index f0f97433d..3aece9650 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -53,12 +53,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { @{run}/systemd/network/ r, @{run}/systemd/network/*.network r, @{run}/systemd/notify rw, - owner @{run}/systemd/netif/.#state rw, - owner @{run}/systemd/netif/.#state* rw, - owner @{run}/systemd/netif/leases/{,*} rw, - owner @{run}/systemd/netif/links/{,*} rw, - owner @{run}/systemd/netif/lldp/{,*} rw, - owner @{run}/systemd/netif/state rw, + owner @{run}/systemd/netif/** rw, @{run}/udev/data/n@{int} r, diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index ad3eee9f6..c4337d77a 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -40,6 +40,7 @@ profile cockpit-bridge @{exec_path} { @{lib}/cockpit/cockpit-ssh rPx, /usr/share/cockpit/{,**} r, + /usr/{,local/}share/ r, /etc/cockpit/{,**} r, /etc/httpd/conf/mime.types r, @@ -51,6 +52,7 @@ profile cockpit-bridge @{exec_path} { /etc/shells r, owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw, + owner @{user_share_dirs}/ r, @{run}/user/@{uid}/ssh-agent.[0-9A-Z]* rw, @{run}/utmp r, diff --git a/apparmor.d/profiles-a-f/adb b/apparmor.d/profiles-a-f/adb index 13863c03a..52e2621fe 100644 --- a/apparmor.d/profiles-a-f/adb +++ b/apparmor.d/profiles-a-f/adb @@ -9,14 +9,16 @@ include @{exec_path} = @{bin}/adb @{exec_path} += @{lib}/android-sdk/platform-tools/adb -profile adb @{exec_path} { +profile adb @{exec_path} flags=(attach_disconnected) { include + include include include include network inet stream, network inet6 stream, + network netlink raw, signal (receive) set=(kill) peer=scrcpy, diff --git a/apparmor.d/profiles-m-r/mount b/apparmor.d/profiles-m-r/mount index f122b8f27..c9db3c083 100644 --- a/apparmor.d/profiles-m-r/mount +++ b/apparmor.d/profiles-m-r/mount @@ -49,7 +49,6 @@ profile mount @{exec_path} flags=(attach_disconnected) { @{MOUNTS}/ rw, @{MOUNTS}/*/ rw, @{MOUNTS}/*/*/ rw, - /media/cdrom[0-9]/ r, # Mount iso/img files owner @{user_img_dirs}/{,**} rwk, diff --git a/apparmor.d/profiles-m-r/ntfs-3g b/apparmor.d/profiles-m-r/ntfs-3g index e5ae871b6..a7a580c41 100644 --- a/apparmor.d/profiles-m-r/ntfs-3g +++ b/apparmor.d/profiles-m-r/ntfs-3g @@ -9,8 +9,9 @@ include @{exec_path} = @{bin}/{low,}ntfs{,-3g} @{exec_path} += @{bin}/mount.{low,}ntfs{,-3g} -profile ntfs-3g @{exec_path} { +profile ntfs-3g @{exec_path} flags=(attach_disconnected) { include + include include include diff --git a/apparmor.d/profiles-m-r/ollama b/apparmor.d/profiles-m-r/ollama index 483e97864..e7ff1db50 100644 --- a/apparmor.d/profiles-m-r/ollama +++ b/apparmor.d/profiles-m-r/ollama @@ -47,4 +47,6 @@ profile ollama @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/task/@{tid}/comm w, include if exists -} \ No newline at end of file +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/pam-tmpdir-helper b/apparmor.d/profiles-m-r/pam-tmpdir-helper index 983ca7d42..5c86a1b27 100644 --- a/apparmor.d/profiles-m-r/pam-tmpdir-helper +++ b/apparmor.d/profiles-m-r/pam-tmpdir-helper @@ -15,7 +15,7 @@ profile pam-tmpdir-helper @{exec_path} { @{exec_path} mr, - owner @{tmp}/user/ rw, + owner /tmp/user/ rw, owner @{tmp}/ rw, /dev/ptmx rw, diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 8fe649ff5..08dcaaeaf 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -137,7 +137,7 @@ profile run-parts @{exec_path} { owner @{tmp}/#@{int} rw, owner @{tmp}/$anacron* rw, - owner @{tmp}/file@{rand6} ra, + owner @{tmp}/file@{rand6} rw, owner @{sys}/class/power_supply/ r, diff --git a/apparmor.d/profiles-s-z/scrcpy b/apparmor.d/profiles-s-z/scrcpy index 8903fe287..f1af86477 100644 --- a/apparmor.d/profiles-s-z/scrcpy +++ b/apparmor.d/profiles-s-z/scrcpy @@ -34,6 +34,8 @@ profile scrcpy @{exec_path} { owner @{user_config_dirs}/ibus/bus/ r, owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, + owner @{PROC}/@{pid}/cmdline r, + deny @{user_share_dirs}/gvfs-metadata/* r, include if exists diff --git a/apparmor.d/profiles-s-z/smplayer b/apparmor.d/profiles-s-z/smplayer index 54b4080f1..28065ac24 100644 --- a/apparmor.d/profiles-s-z/smplayer +++ b/apparmor.d/profiles-s-z/smplayer @@ -12,22 +12,13 @@ profile smplayer @{exec_path} { include include include - include + include include - include - include - include - include + include include - include include include include - include - include - - # Needed for hardware decoding - ##include signal (send) set=(term, kill), signal (receive) set=(term, kill), diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index ecd8d743e..d091c4b55 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -84,14 +84,14 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{lib_dirs}/** mr, @{lib_dirs}/*driverquery rix, - @{lib_dirs}/fossilize_replay rpx, - @{lib_dirs}/gameoverlayui rpx, + @{lib_dirs}/fossilize_replay rpx, # steam-fossilize + @{lib_dirs}/gameoverlayui rpx, # steam-gameoverlayui @{lib_dirs}/reaper rpx, # steam-runtime @{lib_dirs}/steam* rix, @{app_dirs}/@{runtime}/*entry-point rpx -> steam-runtime, - @{share_dirs}/linux{32,64}/steamerrorreporter rpx, + @{share_dirs}/linux{32,64}/steamerrorreporter rpx, # steamerrorreporter @{runtime_dirs}/*entry-point rix, @{runtime_dirs}/@{arch}/@{bin}/srt-logger rix, @@ -101,7 +101,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-input-monitor rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launch-* rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-interface-@{int} rix, - @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, # steam-launcher @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-libcurl-* rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-supervisor rix, @@ -125,14 +125,10 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { /var/lib/dbus/machine-id r, / r, - @{bin}/ r, @{lib}/ r, - /etc/ r, - /home/ r, - /usr/ r, /usr/local/ r, /usr/local/lib/ r, @@ -350,6 +346,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/class/*/ r, @{sys}/devices/**/report_descriptor r, @{sys}/devices/**/uevent r, + @{sys}/devices/@{pci}/usb@{int}/**/{idVendor,idProduct,interface} r, @{sys}/devices/system/cpu/kernel_max r, @{sys}/devices/virtual/tty/tty@{int}/active r, @@ -365,6 +362,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/task/@{tid}/comm r, owner @{PROC}/@{pid}/task/@{tid}/status r, + /dev/ r, /dev/hidraw@{int} rw, /dev/tty rw, diff --git a/apparmor.d/profiles-s-z/steam-game-native b/apparmor.d/profiles-s-z/steam-game-native index 9453076ea..2817006f2 100644 --- a/apparmor.d/profiles-s-z/steam-game-native +++ b/apparmor.d/profiles-s-z/steam-game-native @@ -19,20 +19,20 @@ profile steam-game-native @{exec_path} flags=(attach_disconnected) { include network inet dgram, - network inet6 dgram, network inet stream, + network inet6 dgram, network inet6 stream, network netlink raw, network unix stream, signal receive peer=steam, - @{exec_path} rmix, + @{exec_path} mrix, - @{sh_path} rix, + @{sh_path} rix, - @{app_dirs}/** mr, - @{lib_dirs}/** mr, + @{app_dirs}/** mr, + @{lib_dirs}/** mr, include if exists } diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index a8ff7874a..6fde5418f 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -22,6 +22,8 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { include include + network inet stream, + network inet6 stream, network unix stream, @{exec_path} mr, From c0a081b82718d2822bad29d06370699af8895257 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 2 Jul 2024 22:05:36 +0100 Subject: [PATCH 0025/1455] feat(profile): add label for help program. --- apparmor.d/abstractions/app-open | 1 + apparmor.d/groups/children/child-open-help | 2 +- apparmor.d/tunables/multiarch.d/paths | 2 ++ apparmor.d/tunables/multiarch.d/programs | 3 +++ 4 files changed, 7 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 513924de6..942e0a55b 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -20,6 +20,7 @@ @{document_viewers_path} rPUx, @{emails_path} rPUx, @{file_explorers_path} rPx, + @{help_path} rPx, @{image_viewers_path} rPUx, @{offices_path} rPUx, @{text_editors_path} rPUx, diff --git a/apparmor.d/groups/children/child-open-help b/apparmor.d/groups/children/child-open-help index c9c49e142..23f9beade 100644 --- a/apparmor.d/groups/children/child-open-help +++ b/apparmor.d/groups/children/child-open-help @@ -11,7 +11,7 @@ profile child-open-help { include @{browsers_path} rPx, - @{bin}/yelp rPUx, + @{help_path} rPx, include if exists include if exists diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 67f32bf8c..605dede92 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -53,5 +53,7 @@ # Office suites @{offices_path} = @{bin}/@{offices} @{lib}/libreoffice/program/soffice +# Help +@{help_path} = @{bin}/@{help} # vim:syntax=apparmor diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index a118d0cbe..786101ffe 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -69,4 +69,7 @@ # Office suites @{offices} = libreoffice soffice +# Help +@{help} = yelp + # vim:syntax=apparmor From 1675a26fbf06d3085759ccd63b102b3ce8583c3a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 2 Jul 2024 22:08:15 +0100 Subject: [PATCH 0026/1455] feat(profile): general update. --- .../abstractions/authentication.d/complete | 6 +- apparmor.d/groups/systemd/systemd-udevd | 76 +++++++++---------- apparmor.d/profiles-g-l/libreoffice | 6 +- 3 files changed, 44 insertions(+), 44 deletions(-) diff --git a/apparmor.d/abstractions/authentication.d/complete b/apparmor.d/abstractions/authentication.d/complete index 63819cc1b..738166dba 100644 --- a/apparmor.d/abstractions/authentication.d/complete +++ b/apparmor.d/abstractions/authentication.d/complete @@ -8,8 +8,8 @@ @{bin}/unix_chkpwd rPx, #aa:only whonix - @{lib}/security-misc/pam_faillock_not_if_x rPx, - @{lib}/security-misc/pam-abort-on-locked-password rPx, - @{lib}/security-misc/pam-info rPx, + @{lib}/security-misc/pam-abort-on-locked-password rPx, + @{lib}/security-misc/pam-info rPx, + @{lib}/security-misc/pam_faillock_not_if_x rPx, # vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index e5be870f4..76a7e21ca 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -10,9 +10,9 @@ include @{exec_path} = @{bin}/udevadm @{lib}/systemd/systemd-udevd profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { include + include include include - include capability chown, capability dac_override, @@ -27,7 +27,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { capability sys_rawio, capability sys_resource, - ptrace (read), + ptrace read, network inet dgram, network inet6 dgram, @@ -35,54 +35,52 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{exec_path} mrix, - @{sh_path} rix, - @{coreutils_path} rix, - @{bin}/*-print-pci-ids rix, + @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/*-print-pci-ids rix, @{bin}/alsactl rPUx, - @{bin}/ddcutil rPx, + @{bin}/ddcutil rPx, @{bin}/dmsetup rPUx, - @{bin}/ethtool rix, - @{bin}/issue-generator rPx, - @{bin}/kmod rPx, - @{bin}/less rPx -> child-pager, - @{bin}/logger rix, - @{bin}/ls rix, - @{bin}/lvm rPx, - @{bin}/mknod rix, - @{bin}/more rPx -> child-pager, - @{bin}/multipath rPx, - @{bin}/nfsrahead rix, - @{bin}/pager rPx -> child-pager, - @{bin}/perl rix, - @{bin}/setfacl rix, - @{bin}/sg_inq rix, + @{bin}/ethtool rix, + @{bin}/issue-generator rPx, + @{bin}/kmod rPx, + @{bin}/less rPx -> child-pager, + @{bin}/logger rix, + @{bin}/ls rix, + @{bin}/lvm rPx, + @{bin}/mknod rix, + @{bin}/more rPx -> child-pager, + @{bin}/multipath rPx, + @{bin}/nfsrahead rix, + @{bin}/pager rPx -> child-pager, + @{bin}/perl rix, + @{bin}/setfacl rix, + @{bin}/sg_inq rix, @{bin}/snap rPUx, - @{bin}/systemctl rCx -> systemctl, - @{bin}/systemd-run rix, - @{bin}/unshare rix, + @{bin}/systemctl rCx -> systemctl, + @{bin}/systemd-run rix, + @{bin}/unshare rix, - @{lib}/crda/* rPUx, - @{lib}/gdm-runtime-config rPx, - @{lib}/nfsrahead rPUx, - @{lib}/open-iscsi/net-interface-handler rPUx, - @{lib}/pm-utils/power.d/* rPUx, - @{lib}/snapd/snap-device-helper rPx, - @{lib}/systemd/systemd-* rPx, - @{lib}/udev/* rPUx, - /usr/share/hplip/config_usb_printer.py rPUx, + @{lib}/crda/* rPUx, + @{lib}/gdm-runtime-config rPx, + @{lib}/nfsrahead rPUx, + @{lib}/open-iscsi/net-interface-handler rPUx, + @{lib}/pm-utils/power.d/* rPUx, + @{lib}/snapd/snap-device-helper rPx, + @{lib}/systemd/systemd-* rPx, + @{lib}/udev/* rPUx, + /usr/share/hplip/config_usb_printer.py rPUx, - /etc/console-setup/*.sh rPUx, - /etc/network/cloud-ifupdown-helper rPUx, - - /etc/machine-id r, + /etc/console-setup/*.sh rPUx, + /etc/network/cloud-ifupdown-helper rPUx, /etc/default/* r, - + /etc/machine-id r, /etc/nfs.conf rk, /etc/udev/{,**} r, - /etc/udev/hwdb.bin rw, /etc/udev/.#hwdb.bin* rw, + /etc/udev/hwdb.bin rw, /etc/modprobe.d/ r, /etc/modprobe.d/*.conf r, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 313b34a23..2a7295f49 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -39,7 +39,7 @@ profile libreoffice @{exec_path} { @{bin}/sed rix, @{bin}/uname rix, - @{open_path} rpx -> child-open-browsers, + @{open_path} rPx -> child-open-browsers, @{bin}/gpgconf rPx, @{bin}/gpgsm rPx, @@ -51,8 +51,10 @@ profile libreoffice @{exec_path} { @{lib}/jvm/java*/bin/java rix, @{lib}/jvm/java*/lib/** rm, - @{lib}/libreoffice/share/uno_packages/cache/stamp.sys w, @{lib}/libreoffice/{,**} rm, + @{lib}/libreoffice/share/uno_packages/cache/stamp.sys w, + @{lib}/libreoffice/program/{,**/}__pycache__/ w, + @{lib}/libreoffice/share/extensions/{,**/}__pycache__/ w, /usr/share/hyphen/{,**} r, /usr/share/libexttextcat/{,**} r, From 897bda824f857b7af01aa6a2ba7e1cdd27619738 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 4 Jul 2024 21:36:09 +0100 Subject: [PATCH 0027/1455] feat(profile): update akonadi profiles. --- .../groups/akonadi/akonadi_akonotes_resource | 15 +-------------- .../groups/akonadi/akonadi_archivemail_agent | 14 ++------------ .../groups/akonadi/akonadi_birthdays_resource | 15 +-------------- .../groups/akonadi/akonadi_contacts_resource | 15 +-------------- apparmor.d/groups/akonadi/akonadi_control | 11 +---------- .../akonadi/akonadi_followupreminder_agent | 15 +-------------- apparmor.d/groups/akonadi/akonadi_ical_resource | 13 +++---------- apparmor.d/groups/akonadi/akonadi_indexing_agent | 13 +------------ .../groups/akonadi/akonadi_maildir_resource | 14 +------------- .../groups/akonadi/akonadi_maildispatcher_agent | 13 +------------ .../groups/akonadi/akonadi_mailfilter_agent | 14 +------------- .../groups/akonadi/akonadi_mailmerge_agent | 16 +--------------- .../groups/akonadi/akonadi_migration_agent | 15 +-------------- .../groups/akonadi/akonadi_newmailnotifier_agent | 1 - apparmor.d/groups/akonadi/akonadi_notes_agent | 15 +-------------- .../groups/akonadi/akonadi_sendlater_agent | 16 +--------------- .../groups/akonadi/akonadi_unifiedmailbox_agent | 15 +-------------- 17 files changed, 19 insertions(+), 211 deletions(-) diff --git a/apparmor.d/groups/akonadi/akonadi_akonotes_resource b/apparmor.d/groups/akonadi/akonadi_akonotes_resource index 8b9e434a5..086c29a40 100644 --- a/apparmor.d/groups/akonadi/akonadi_akonotes_resource +++ b/apparmor.d/groups/akonadi/akonadi_akonotes_resource @@ -9,20 +9,12 @@ include @{exec_path} = @{bin}/akonadi_akonotes_resource profile akonadi_akonotes_resource @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, - /usr/share/hwdata/*.ids r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_akonotes_resource_[0-9]rc r, @@ -31,11 +23,6 @@ profile akonadi_akonotes_resource @{exec_path} { owner @{user_share_dirs}/notes/**/ r, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, - /dev/tty r, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_archivemail_agent b/apparmor.d/groups/akonadi/akonadi_archivemail_agent index 5d305062d..aea424deb 100644 --- a/apparmor.d/groups/akonadi/akonadi_archivemail_agent +++ b/apparmor.d/groups/akonadi/akonadi_archivemail_agent @@ -9,21 +9,15 @@ include @{exec_path} = @{bin}/akonadi_archivemail_agent profile akonadi_archivemail_agent @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, /usr/share/akonadi/plugins/serializer/{,*.desktop} r, - /usr/share/hwdata/*.ids r, /etc/machine-id r, - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -34,12 +28,8 @@ profile akonadi_archivemail_agent @{exec_path} { owner @{user_config_dirs}/emaildefaults r, owner @{user_config_dirs}/emailidentities.lock rwk, owner @{user_config_dirs}/emailidentities{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kmail2rc r, - owner @{user_config_dirs}/kwinrc r, - + owner @{user_share_dirs}/akonadi/file_db_data/{,**} r, /dev/tty r, diff --git a/apparmor.d/groups/akonadi/akonadi_birthdays_resource b/apparmor.d/groups/akonadi/akonadi_birthdays_resource index a4adaf453..14b354b7e 100644 --- a/apparmor.d/groups/akonadi/akonadi_birthdays_resource +++ b/apparmor.d/groups/akonadi/akonadi_birthdays_resource @@ -9,32 +9,19 @@ include @{exec_path} = @{bin}/akonadi_birthdays_resource profile akonadi_birthdays_resource @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, /usr/share/akonadi/plugins/{,**} r, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, - /dev/tty r, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_contacts_resource b/apparmor.d/groups/akonadi/akonadi_contacts_resource index 9646d1ca4..c90d09a4a 100644 --- a/apparmor.d/groups/akonadi/akonadi_contacts_resource +++ b/apparmor.d/groups/akonadi/akonadi_contacts_resource @@ -9,21 +9,13 @@ include @{exec_path} = @{bin}/akonadi_contacts_resource profile akonadi_contacts_resource @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, /usr/share/akonadi/plugins/serializer/{,*.desktop} r, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -31,11 +23,6 @@ profile akonadi_contacts_resource @{exec_path} { owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, - owner @{user_share_dirs}/contacts/ r, owner @{user_share_dirs}/contacts/*.vcf w, diff --git a/apparmor.d/groups/akonadi/akonadi_control b/apparmor.d/groups/akonadi/akonadi_control index 444fb5199..f52c3e14f 100644 --- a/apparmor.d/groups/akonadi/akonadi_control +++ b/apparmor.d/groups/akonadi/akonadi_control @@ -9,12 +9,9 @@ include @{exec_path} = @{bin}/akonadi_control profile akonadi_control @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, @@ -22,11 +19,7 @@ profile akonadi_control @{exec_path} { @{bin}/akonadiserver rPx, /usr/share/akonadi/{,**} r, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, /etc/machine-id r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -34,8 +27,6 @@ profile akonadi_control @{exec_path} { owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk, owner @{user_share_dirs}/akonadi/{,**} rwl, diff --git a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent index 4c13bcbe0..9af94de78 100644 --- a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent +++ b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent @@ -9,12 +9,9 @@ include @{exec_path} = @{bin}/akonadi_followupreminder_agent profile akonadi_followupreminder_agent @{exec_path} { include - include - include include + include include - include - include network inet dgram, network inet6 dgram, @@ -22,21 +19,11 @@ profile akonadi_followupreminder_agent @{exec_path} { @{exec_path} mr, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_followupreminder_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, /dev/tty r, diff --git a/apparmor.d/groups/akonadi/akonadi_ical_resource b/apparmor.d/groups/akonadi/akonadi_ical_resource index fea2fb594..d8d87dcfb 100644 --- a/apparmor.d/groups/akonadi/akonadi_ical_resource +++ b/apparmor.d/groups/akonadi/akonadi_ical_resource @@ -10,25 +10,18 @@ include profile akonadi_ical_resource @{exec_path} { include include + include include - include - include @{exec_path} mr, - /usr/share/hwdata/*.ids r, - /usr/share/icons/{,**} r, - /usr/share/mime/{,**} r, - owner @{user_cache_dirs}/akonadi_ical_resource_[0-9]/{,*} rwl, owner @{user_cache_dirs}/icon-cache.kcache rw, + owner @{user_config_dirs}/akonadi_ical_resource_[0-9]rc rwl, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, + owner @{user_share_dirs}/apps/korganizer/{,**} rw, /dev/tty r, diff --git a/apparmor.d/groups/akonadi/akonadi_indexing_agent b/apparmor.d/groups/akonadi/akonadi_indexing_agent index 9a5cc32f2..e2e60c67f 100644 --- a/apparmor.d/groups/akonadi/akonadi_indexing_agent +++ b/apparmor.d/groups/akonadi/akonadi_indexing_agent @@ -9,12 +9,9 @@ include @{exec_path} = @{bin}/akonadi_indexing_agent profile akonadi_indexing_agent @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, @@ -22,12 +19,8 @@ profile akonadi_indexing_agent @{exec_path} { /usr/share/akonadi/plugins/serializer/ r, /usr/share/akonadi/plugins/serializer/*.desktop r, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, /etc/machine-id r, - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -37,10 +30,6 @@ profile akonadi_indexing_agent @{exec_path} { owner @{user_config_dirs}/akonadi_indexing_agentrc.lock rwk, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, owner @{user_share_dirs}/akonadi/ rw, owner @{user_share_dirs}/akonadi/** rwlk -> @{user_share_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_maildir_resource b/apparmor.d/groups/akonadi/akonadi_maildir_resource index a04ee16bf..a534c7aad 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildir_resource +++ b/apparmor.d/groups/akonadi/akonadi_maildir_resource @@ -9,31 +9,19 @@ include @{exec_path} = @{bin}/akonadi_maildir_resource profile akonadi_maildir_resource @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, /usr/share/akonadi/plugins/serializer/{,*.desktop} r, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_maildir_resource_[0-9]rc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, owner @{user_share_dirs}/akonadi_maildir_resource_[0-9]/{,**} rw, owner @{user_share_dirs}/akonadi/{,**} rwk, diff --git a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent index cc19a136f..e81a1c3e9 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent +++ b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent @@ -9,13 +9,10 @@ include @{exec_path} = @{bin}/akonadi_maildispatcher_agent profile akonadi_maildispatcher_agent @{exec_path} { include - include - include include + include include - include include - include network inet dgram, network inet6 dgram, @@ -27,12 +24,8 @@ profile akonadi_maildispatcher_agent @{exec_path} { @{exec_path} mr, /usr/share/akonadi/plugins/{,**} r, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/knotifications{5,6}/akonadi_maildispatcher_agent.notifyrc r, - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, /etc/machine-id r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -40,11 +33,7 @@ profile akonadi_maildispatcher_agent @{exec_path} { owner @{user_config_dirs}/akonadi_maildispatcher_agent.notifyrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/ksslcertificatemanager r, - owner @{user_config_dirs}/kwinrc r, owner @{user_config_dirs}/mailtransports r, owner @{user_config_dirs}/specialmailcollectionsrc r, diff --git a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent index 8d8c30343..03fb464a4 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent @@ -9,12 +9,9 @@ include @{exec_path} = @{bin}/akonadi_mailfilter_agent profile akonadi_mailfilter_agent @{exec_path} { include - include - include include + include include - include - include ptrace (read) peer=akonadi_archivemail_agent, @@ -23,12 +20,7 @@ profile akonadi_mailfilter_agent @{exec_path} { /usr/share/akonadi/plugins/serializer/ r, /usr/share/akonadi/plugins/serializer/*.desktop r, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - /etc/machine-id r, - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -43,11 +35,7 @@ profile akonadi_mailfilter_agent @{exec_path} { owner @{user_config_dirs}/emailidentities.lock rwk, owner @{user_config_dirs}/emailidentities* rwl, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kmail2rc r, - owner @{user_config_dirs}/kwinrc r, owner @{tmp}/#@{int} rw, owner @{tmp}/akonadi_mailfilter_agent.* rwl, diff --git a/apparmor.d/groups/akonadi/akonadi_mailmerge_agent b/apparmor.d/groups/akonadi/akonadi_mailmerge_agent index fd9012142..f10a8ea13 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailmerge_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailmerge_agent @@ -9,12 +9,9 @@ include @{exec_path} = @{bin}/akonadi_mailmerge_agent profile akonadi_mailmerge_agent @{exec_path} { include - include - include include + include include - include - include network inet dgram, network inet6 dgram, @@ -23,22 +20,11 @@ profile akonadi_mailmerge_agent @{exec_path} { @{exec_path} mr, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, - /dev/tty r, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_migration_agent b/apparmor.d/groups/akonadi/akonadi_migration_agent index 832e5760b..7200357f0 100644 --- a/apparmor.d/groups/akonadi/akonadi_migration_agent +++ b/apparmor.d/groups/akonadi/akonadi_migration_agent @@ -9,30 +9,17 @@ include @{exec_path} = @{bin}/akonadi_migration_agent profile akonadi_migration_agent @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi-migrationrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, owner @{user_share_dirs}/akonadi_migration_agent/{,**} rw, diff --git a/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent b/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent index b5a0d7577..cb98b328a 100644 --- a/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent +++ b/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent @@ -29,7 +29,6 @@ profile akonadi_newmailnotifier_agent @{exec_path} { owner @{user_config_dirs}/emaildefaults r, owner @{user_config_dirs}/emailidentities.lock rwk, owner @{user_config_dirs}/emailidentities* rwl, - owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kmail2rc r, owner @{user_config_dirs}/specialmailcollectionsrc r, diff --git a/apparmor.d/groups/akonadi/akonadi_notes_agent b/apparmor.d/groups/akonadi/akonadi_notes_agent index d2c1fe059..791f90d06 100644 --- a/apparmor.d/groups/akonadi/akonadi_notes_agent +++ b/apparmor.d/groups/akonadi/akonadi_notes_agent @@ -9,12 +9,9 @@ include @{exec_path} = @{bin}/akonadi_notes_agent profile akonadi_notes_agent @{exec_path} { include - include - include include + include include - include - include network inet dgram, network inet6 dgram, @@ -23,21 +20,11 @@ profile akonadi_notes_agent @{exec_path} { @{exec_path} mr, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_*_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, /dev/tty r, diff --git a/apparmor.d/groups/akonadi/akonadi_sendlater_agent b/apparmor.d/groups/akonadi/akonadi_sendlater_agent index f640ca86f..6062b4857 100644 --- a/apparmor.d/groups/akonadi/akonadi_sendlater_agent +++ b/apparmor.d/groups/akonadi/akonadi_sendlater_agent @@ -9,12 +9,9 @@ include @{exec_path} = @{bin}/akonadi_sendlater_agent profile akonadi_sendlater_agent @{exec_path} { include - include - include include + include include - include - include network inet dgram, network inet6 dgram, @@ -23,23 +20,12 @@ profile akonadi_sendlater_agent @{exec_path} { @{exec_path} mr, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_sendlater_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, - /dev/tty r, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent index cc0807a6b..94c63a06b 100644 --- a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent +++ b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent @@ -9,30 +9,17 @@ include @{exec_path} = @{bin}/akonadi_unifiedmailbox_agent profile akonadi_unifiedmailbox_agent @{exec_path} { include - include - include include + include include - include - include @{exec_path} mr, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_unifiedmailbox_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, /dev/tty r, From dcf92e8e885fd1d6d5d9c42a35671df62dd7de20 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 4 Jul 2024 21:38:46 +0100 Subject: [PATCH 0028/1455] feat(profile): update kde profiles. --- apparmor.d/groups/bus/dbus-session | 2 +- apparmor.d/groups/kde/DiscoverNotifier | 11 +++-- apparmor.d/groups/kde/baloo | 3 ++ apparmor.d/groups/kde/dolphin | 3 ++ .../groups/kde/drkonqi-coredump-processor | 4 +- apparmor.d/groups/kde/kbuildsycoca5 | 2 +- .../groups/kde/kde-systemd-start-condition | 3 ++ apparmor.d/groups/kde/kded | 1 + apparmor.d/groups/kde/kglobalacceld | 8 +++- apparmor.d/groups/kde/ksmserver | 2 +- apparmor.d/groups/kde/kwin_x11 | 13 ++++-- apparmor.d/groups/kde/plasmashell | 3 ++ apparmor.d/groups/kde/sddm | 1 + apparmor.d/groups/kde/systemsettings | 40 ++++++++++++++++--- apparmor.d/profiles-m-r/qdbus | 18 +++++++++ 15 files changed, 94 insertions(+), 20 deletions(-) create mode 100644 apparmor.d/profiles-m-r/qdbus diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index 88266bcbf..423df6a26 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -11,7 +11,7 @@ abi , include -@{exec_path} = @{bin}/dbus-run-session +@{exec_path} = @{bin}/dbus-run-session @{bin}/dbus-update-activation-environment @{exec_path} += @{bin}/dbus-broker @{bin}/dbus-broker-launch @{exec_path} += @{bin}/dbus-daemon @{lib}/dbus-1{,.0}/dbus-daemon-launch-helper profile dbus-session flags=(attach_disconnected) { diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 972173e61..9b305e5fb 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}DiscoverNotifier profile DiscoverNotifier @{exec_path} { include + include include include include @@ -41,7 +42,7 @@ profile DiscoverNotifier @{exec_path} { /var/cache/swcatalog/cache/ w, owner @{user_cache_dirs}/appstream/ r, - owner @{user_cache_dirs}/appstream/** r, + owner @{user_cache_dirs}/appstream/** rw, owner @{user_cache_dirs}/flatpak/{,**} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -53,7 +54,9 @@ profile DiscoverNotifier @{exec_path} { owner @{user_share_dirs}/flatpak/{,**} rw, - owner @{tmp}/ostree-gpg-*/ rw, + owner @{tmp}/ostree-gpg-@{rand6}/ rw, + owner @{tmp}/ostree-gpg-@{rand6}/pubring.gpg rw, + owner @{tmp}/ostree-gpg-@{rand6}/trustdb.gpg rw, /dev/tty r, @@ -67,8 +70,8 @@ profile DiscoverNotifier @{exec_path} { @{HOME}/@{XDG_GPG_DIR}/*.conf r, @{tmp}/ r, - owner @{tmp}/ostree-gpg-*/ r, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ r, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-*/**, owner @{run}/user/@{uid}/gnupg/ w, diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index 0fdfa3919..3b5efe387 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -42,6 +42,9 @@ profile baloo @{exec_path} { owner @{user_share_dirs}/baloo/{,**} rwk, + @{sys}/bus/ r, + @{sys}/bus/*/devices/ r, + owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index bb5ab9fe5..89e5685d9 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -86,6 +86,9 @@ profile dolphin @{exec_path} { owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, owner @{run}/user/@{uid}/#@{int} rw, + @{sys}/bus/ r, + @{sys}/bus/*/devices/ r, + owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/kde/drkonqi-coredump-processor b/apparmor.d/groups/kde/drkonqi-coredump-processor index bfe6ec108..f014b671b 100644 --- a/apparmor.d/groups/kde/drkonqi-coredump-processor +++ b/apparmor.d/groups/kde/drkonqi-coredump-processor @@ -24,9 +24,9 @@ profile drkonqi-coredump-processor @{exec_path} { /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/ r, /{run,var}/log/journal/@{hex32}/system.journal r, - /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal r, + /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* r, /{run,var}/log/journal/@{hex32}/user-@{uid}.journal r, - /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* r, /{run,var}/log/journal/remote/ r, include if exists diff --git a/apparmor.d/groups/kde/kbuildsycoca5 b/apparmor.d/groups/kde/kbuildsycoca5 index 5bd97e1ac..8d9fa0bca 100644 --- a/apparmor.d/groups/kde/kbuildsycoca5 +++ b/apparmor.d/groups/kde/kbuildsycoca5 @@ -15,7 +15,7 @@ profile kbuildsycoca5 @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - owner @{user_cache_dirs}/ksycoca5_* rw, + owner @{user_cache_dirs}/ksycoca{5,6}_* rw, owner link @{user_cache_dirs}/ksycoca5_* -> @{user_cache_dirs}/#@{int}, /dev/tty r, diff --git a/apparmor.d/groups/kde/kde-systemd-start-condition b/apparmor.d/groups/kde/kde-systemd-start-condition index 8f368ef73..a913dba60 100644 --- a/apparmor.d/groups/kde/kde-systemd-start-condition +++ b/apparmor.d/groups/kde/kde-systemd-start-condition @@ -16,6 +16,9 @@ profile kde-systemd-start-condition @{exec_path} { /usr/share/desktop-base/kf{5,6}-settings/baloofilerc r, owner @{user_config_dirs}/baloofilerc r, + owner @{user_config_dirs}/kalendaracrc r, + owner @{user_config_dirs}/kgpgrc r, + owner @{user_config_dirs}/kmixrc r, owner @{user_config_dirs}/konquerorrc r, owner @{user_config_dirs}/plasma-welcomerc r, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 6fc974030..e0cc7f5b3 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -157,6 +157,7 @@ profile kded @{exec_path} { @{PROC}/@{pids}/fdinfo/@{int} r, @{PROC}/@{pids}/fd/info/@{int} r, @{PROC}/sys/fs/inotify/max_user_{instances,watches} r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index 85ff38d65..1995838c1 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -18,10 +18,16 @@ profile kglobalacceld @{exec_path} { /usr/share/kglobalaccel/{,**} r, /etc/machine-id r, + /etc/xdg/menus/ r, + + owner @{user_cache_dirs}/ksycoca{5,6}_* rw, owner @{user_config_dirs}/#@{int} rw, - owner @{user_config_dirs}/kglobalshortcutsrc* rwl, owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk, + owner @{user_config_dirs}/kglobalshortcutsrc* rwl, + owner @{user_config_dirs}/khotkeysrc r, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, /dev/tty r, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index 08db56872..b7e1858da 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -57,7 +57,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_config_dirs}/ksmserverrc.@{rand6} rwl, owner @{user_config_dirs}/ksmserverrc.lock rwk, owner @{user_config_dirs}/menus/ r, - # owner @{user_config_dirs}/session/*_[0-9]*_[0-9]*_[0-9]* rw, + owner @{user_config_dirs}/session/*_[0-9]*_[0-9]*_[0-9]* rw, owner @{user_share_dirs}/kservices{5,6}/ r, owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r, diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index f53e9803b..a52a22330 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -14,6 +14,7 @@ profile kwin_x11 @{exec_path} { include include include + include network inet dgram, network inet6 dgram, @@ -32,30 +33,34 @@ profile kwin_x11 @{exec_path} { /usr/share/plasma/desktoptheme/{,**} r, /etc/machine-id r, - /etc/xdg/kcminputrc r, /etc/xdg/plasmarc r, owner @{user_cache_dirs}/ r, owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kcrash-metadata/*.ini rw, + owner @{user_cache_dirs}/ksvg-elements r, owner @{user_cache_dirs}/kwin/{,**} rwl, - owner @{user_cache_dirs}/plasmarc r, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, owner @{user_cache_dirs}/plasma-svgelements rw, owner @{user_cache_dirs}/plasma-svgelements.@{rand6} rwl -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/plasma-svgelements.lock rwk, + owner @{user_cache_dirs}/plasmarc r, owner @{user_cache_dirs}/session/#@{int} rw, owner @{user_config_dirs}/#@{int} rw, - owner @{user_config_dirs}/kcminputrc r, + owner @{user_config_dirs}/kdedefaults/plasmarc r, + owner @{user_config_dirs}/kwinoutputconfig.json r, owner @{user_config_dirs}/kwinrc.lock rwk, owner @{user_config_dirs}/kwinrc{,.@{rand6}} rwl, owner @{user_config_dirs}/kwinrulesrc r, owner @{user_config_dirs}/kxkbrc r, - owner @{user_config_dirs}/session/kwin_* rwk, owner @{user_config_dirs}/plasmarc r, owner @{user_config_dirs}/session/#@{int} rw, + owner @{user_config_dirs}/session/kwin_* rwk, + + owner @{user_share_dirs}/kwin/scripts/ r, + owner @{tmp}/#@{int} rw, owner @{tmp}/kwin.@{rand6} rwl, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index e4cde431b..9a21b9dff 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -56,6 +56,9 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { #aa:exec kioworker + /opt/**/share/icons/{,**} r, + /opt/*/**/*.desktop r, + /opt/*/**/*.png r, /usr/share/akonadi/{,**} r, /usr/share/desktop-base/{,**} r, /usr/share/desktop-directories/kf5-*.directory r, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 8aea34ad4..1b52954d6 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -88,6 +88,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/xmodmap rix, @{bin}/dbus-run-session rPx -> dbus-session, + @{bin}/dbus-update-activation-environment rPx -> dbus-session, @{bin}/flatpak rPx, @{bin}/gnome-keyring-daemon rPx, @{bin}/kwalletd{5,6} rPx, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index 8de52a49c..ffcf93783 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -14,14 +14,27 @@ profile systemsettings @{exec_path} { include include include + include network netlink raw, + signal send set=term peer=kioworker, + @{exec_path} mr, + @{bin}/cat rix, @{bin}/kcminit rPx, + @{bin}/lspci rPx, + @{bin}/openssl rix, + @{bin}/pactl rPx, + @{bin}/plasma-discover rPx, + @{bin}/plasmashell rPx, + @{bin}/xdpyinfo rPUx, + @{lib}/qt{5,6}/bin/qdbus rPx, + #aa:exec kioworker /usr/share/kcm_networkmanagement/{,**} r, + /usr/share/kcm_recentFiles/{,**} r, /usr/share/kcmkeys/{,*.kksrc} r, /usr/share/kglobalaccel/* r, /usr/share/kinfocenter/{,**} r, @@ -29,15 +42,18 @@ profile systemsettings @{exec_path} { /usr/share/kpackage/{,**} r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,**} r, + /usr/share/kwin/{,**} r, /usr/share/kxmlgui5/systemsettings/systemsettingsui.rc r, /usr/share/plasma/{,**} r, /usr/share/sddm/themes/{,**} r, /usr/share/sddm/themes/{,**} r, /usr/share/systemsettings/{,**} r, + /usr/share/wallpapers/{,**} r, /etc/fstab r, /etc/machine-id r, /etc/xdg/menus/{,applications-merged/} r, + /etc/xdg/plasmanotifyrc r, /etc/xdg/ui/ui_standards.rc r, /var/lib/dbus/machine-id r, @@ -52,23 +68,35 @@ profile systemsettings @{exec_path} { owner @{user_cache_dirs}/systemsettings/ rw, owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**, + owner @{user_config_dirs}/{P,p}lasma* r, owner @{user_config_dirs}/#@{int} rw, - owner @{user_config_dirs}/khotkeysrc r, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/plasmarc r, + owner @{user_config_dirs}/kactivitymanagerdrc r, owner @{user_config_dirs}/kde.org/{,**} rwlk, + owner @{user_config_dirs}/kdedefaults/kscreenlockerrc r, owner @{user_config_dirs}/kdedefaults/plasmarc r, + owner @{user_config_dirs}/khotkeysrc r, owner @{user_config_dirs}/kinfocenterrc* rwlk, + owner @{user_config_dirs}/kscreenlockerrc r, + owner @{user_config_dirs}/kxkbrc r, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/plasmarc r, + owner @{user_config_dirs}/session/ rw, + owner @{user_config_dirs}/session/** rwlk, owner @{user_config_dirs}/systemsettingsrc.lock rwk, owner @{user_config_dirs}/systemsettingsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_share_dirs}/kservices5/{,ServiceMenus/} r, - owner @{user_share_dirs}/kactivitymanagerd/resources/database rk, + owner @{user_share_dirs}/kactivitymanagerd/resources/database rwk, owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk, owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw, - + owner @{user_share_dirs}/kinfocenter/ rw, + owner @{user_share_dirs}/kinfocenter/** rwlk, + owner @{user_share_dirs}/knotifications{5,6}/{,**} r, + owner @{user_share_dirs}/krdpserver/ rw, + owner @{user_share_dirs}/kservices{5,6}/{,ServiceMenus/} r, owner @{user_share_dirs}/systemsettings/ rw, owner @{user_share_dirs}/systemsettings/** rwlk, + owner @{user_share_dirs}/wallpapers/{,**} r, @{sys}/bus/ r, @{sys}/bus/cpu/devices/ r, diff --git a/apparmor.d/profiles-m-r/qdbus b/apparmor.d/profiles-m-r/qdbus new file mode 100644 index 000000000..f8e028b88 --- /dev/null +++ b/apparmor.d/profiles-m-r/qdbus @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/qdbus @{lib}/qt{5,6}/bin/qdbus +profile qdbus @{exec_path} { + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From 8b8a81200a56734730de3b4426b1587a47d1e3c9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 4 Jul 2024 21:59:07 +0100 Subject: [PATCH 0029/1455] fix: temporary allows xdg-mime to open any resources. This profile needs to be rewritten and integrated with the xdg-open profiles. fix: #378 --- apparmor.d/groups/freedesktop/xdg-mime | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index badefb819..c279c41ad 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -3,6 +3,8 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# TODO: This profile needs to be rewritten and integrated with the xdg-open profiles. + abi , include @@ -36,8 +38,10 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{bin}/mimetype rPx, @{bin}/xprop rPx, + /usr/share/file/misc/** r, /usr/share/terminfo/** r, + owner @{HOME}/** r, owner @{HOME}/.Xauthority r, owner @{user_config_dirs}/mimeapps.list{,.new} rw, @@ -49,6 +53,8 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { /dev/dri/card@{int} rw, /dev/tty rw, + @{PROC}/version r, + # When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two # following root processes: # dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr From 62e18d04d70ae1d3671c768265d8fbc8889daad5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 4 Jul 2024 22:22:48 +0100 Subject: [PATCH 0030/1455] feat(profile): general update. --- apparmor.d/groups/freedesktop/colord | 2 +- .../groups/gvfs/gvfs-udisks2-volume-monitor | 2 ++ apparmor.d/groups/systemd/systemd-networkd | 2 ++ apparmor.d/groups/virt/virtstoraged | 1 + apparmor.d/profiles-a-f/anyremote | 15 +++------------ apparmor.d/profiles-a-f/fusermount | 4 +++- apparmor.d/profiles-a-f/fwupd | 1 + apparmor.d/profiles-m-r/mount | 2 +- apparmor.d/profiles-m-r/run-parts | 1 - apparmor.d/profiles-s-z/steam | 2 +- apparmor.d/profiles-s-z/strawberry | 5 +++++ apparmor.d/profiles-s-z/top | 4 ++-- apparmor.d/profiles-s-z/update-ca-trust | 5 +---- apparmor.d/profiles-s-z/wireplumber | 2 +- 14 files changed, 24 insertions(+), 24 deletions(-) diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index f20cebeb7..418864a6f 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -62,7 +62,7 @@ profile colord @{exec_path} flags=(attach_disconnected) { @{sys}/class/drm/ r, @{sys}/class/video4linux/ r, @{sys}/devices/@{pci}/{vendor,model,type} r, - @{sys}/devices/@{pci}/drm/card@{int}/card[0-9]-{HDMI,VGA,LVDS,DP,eDP,Virtual}-*/{enabled,edid} r, + @{sys}/devices/@{pci}/drm/card@{int}/**/{enabled,edid} r, @{sys}/devices/@{pci}/uevent r, @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r, diff --git a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor index 57e6cf476..8c8a1c069 100644 --- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor @@ -53,6 +53,8 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) { @{MOUNTS}/**/ r, @{HOME}/**/ r, + owner @{MOUNTS}/autorun.inf r, + owner @{desktop_config_dirs}/dconf/user r, @{run}/mount/utab r, diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 3aece9650..d8ebf39ba 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -50,6 +50,8 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { /etc/networkd-dispatcher/carrier.d/{,*} r, + / r, + @{run}/systemd/network/ r, @{run}/systemd/network/*.network r, @{run}/systemd/notify rw, diff --git a/apparmor.d/groups/virt/virtstoraged b/apparmor.d/groups/virt/virtstoraged index 943315a8f..7c6f7207b 100644 --- a/apparmor.d/groups/virt/virtstoraged +++ b/apparmor.d/groups/virt/virtstoraged @@ -25,6 +25,7 @@ profile virtstoraged @{exec_path} flags=(attach_disconnected) { @{bin}/qemu-system* rUx, # TODO: Integration with virt-aa-helper @{bin}/qemu-img rUx, # TODO: Integration with virt-aa-helper + /etc/libvirt/**/ r, /etc/libvirt/libvirt.conf r, # For disk images diff --git a/apparmor.d/profiles-a-f/anyremote b/apparmor.d/profiles-a-f/anyremote index b9031360f..4953ab293 100644 --- a/apparmor.d/profiles-a-f/anyremote +++ b/apparmor.d/profiles-a-f/anyremote @@ -46,14 +46,13 @@ profile anyremote @{exec_path} { @{bin}/convert-im6.q16 rCx -> imagemagic, @{bin}/killall rCx -> killall, @{bin}/pgrep rCx -> pgrep, - @{lib}/qt5/bin/qdbus rCx -> qdbus, - @{bin}/pacmd rPx, @{bin}/pactl rPx, - @{bin}/wmctrl rPx, - @{bin}/qtchooser rPx, @{bin}/ps rPx, + @{bin}/qtchooser rPx, + @{bin}/wmctrl rPx, + @{lib}/qt{5,6}/bin/qdbus rPx, # Players @{bin}/smplayer rPx, @@ -128,14 +127,6 @@ profile anyremote @{exec_path} { include if exists } - profile qdbus { - include - - @{lib}/qt5/bin/qdbus mr, - - include if exists - } - include if exists } diff --git a/apparmor.d/profiles-a-f/fusermount b/apparmor.d/profiles-a-f/fusermount index 6774ffa96..4695c2d3b 100644 --- a/apparmor.d/profiles-a-f/fusermount +++ b/apparmor.d/profiles-a-f/fusermount @@ -23,7 +23,7 @@ profile fusermount @{exec_path} { mount fstype={fuse,fuse.*} -> @{MOUNTS}/*/*/, mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/*/, mount fstype={fuse,fuse.*} -> /var/tmp/flatpak-cache-*/*/, - mount fstype={fuse,fuse.*} -> /tmp/.mount_nextcl@{rand6}/, + mount fstype={fuse,fuse.*} -> /tmp/.mount_*@{rand6}/, umount @{HOME}/*/, umount @{HOME}/*/*/, @@ -47,6 +47,8 @@ profile fusermount @{exec_path} { owner @{user_cache_dirs}/**/ rw, + /tmp/.mount_*@{rand6}/ r, + @{run}/user/@{uid}/doc/ r, @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 316f6ebdd..a2cfea343 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -113,6 +113,7 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) { /dev/bus/usb/ r, /dev/bus/usb/@{int}/@{int} rw, /dev/cpu/@{int}/msr rw, + /dev/dri/card@{int} rw, /dev/drm_dp_aux@{int} rw, /dev/gpiochip@{int} r, /dev/hidraw@{int} rw, diff --git a/apparmor.d/profiles-m-r/mount b/apparmor.d/profiles-m-r/mount index c9db3c083..09b682c6b 100644 --- a/apparmor.d/profiles-m-r/mount +++ b/apparmor.d/profiles-m-r/mount @@ -14,7 +14,7 @@ profile mount @{exec_path} flags=(attach_disconnected) { include include include - + capability chown, capability dac_read_search, capability setgid, diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 08dcaaeaf..18c70b240 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -30,7 +30,6 @@ profile run-parts @{exec_path} { /etc/anacrontab r, /etc/conf.d/snapper{,**} r, /etc/snapper/configs/root r, - # Crontab /etc/cron.{hourly,daily,weekly,monthly}/ r, diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index d091c4b55..82deb0d65 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -266,7 +266,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { ptrace trace peer=steam//web, - signal receive set=kill peer=steam, + signal receive set=(cont kill term) peer=steam, unix receive type=stream, diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index a790e6b7b..2d72bc83c 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -40,6 +40,8 @@ profile strawberry @{exec_path} { @{open_path} rPx -> child-open-help, + /etc/fstab r, + /var/lib/dbus/machine-id r, /etc/machine-id r, @@ -50,6 +52,7 @@ profile strawberry @{exec_path} { owner @{user_config_dirs}/strawberry/ rw, owner @{user_config_dirs}/strawberry/* rwkl -> @{user_config_dirs}/strawberry/#@{int}, + owner @{user_config_dirs}/strawberryrc r, owner @{user_share_dirs}/strawberry/ rw, owner @{user_share_dirs}/strawberry/** rwk, @@ -65,6 +68,8 @@ profile strawberry @{exec_path} { owner @{tmp}/*= w, owner @{tmp}/#@{int} rw, owner @{tmp}/etilqs_@{hex16} rw, + owner @{tmp}/kdsingleapp-daemonspudguy-strawberry w, + owner @{tmp}/kdsingleapp-daemonspudguy-strawberry.lock rwk, owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw, owner @{tmp}/strawberry-cover-@{rand6}.jpg rwl -> @{tmp}/#@{int}, owner @{tmp}/strawberry*[0-9] w, diff --git a/apparmor.d/profiles-s-z/top b/apparmor.d/profiles-s-z/top index 09728ef45..418accd3c 100644 --- a/apparmor.d/profiles-s-z/top +++ b/apparmor.d/profiles-s-z/top @@ -19,9 +19,9 @@ profile top @{exec_path} flags=(attach_disconnected) { capability sys_nice, capability sys_ptrace, - signal (send), + signal send, - ptrace (read), + ptrace read, @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/update-ca-trust b/apparmor.d/profiles-s-z/update-ca-trust index 6ebcf7f83..6e70a0310 100644 --- a/apparmor.d/profiles-s-z/update-ca-trust +++ b/apparmor.d/profiles-s-z/update-ca-trust @@ -24,10 +24,7 @@ profile update-ca-trust @{exec_path} { / r, /usr/share/p11-kit/modules/{,*} r, - /etc/ca-certificates/extracted/{tls,email,objsign}-ca-bundle.pem{,.*} w, - /etc/ca-certificates/extracted/ca-bundle.trust.crt{,.*} w, - /etc/ca-certificates/extracted/cadir/{,*} rw, - /etc/ca-certificates/extracted/edk2-cacerts.bin{,.*} w, + /etc/ca-certificates/extracted/** rw, /etc/ssl/certs/{,*} rw, /etc/ssl/certs/java/cacerts{,.*} w, diff --git a/apparmor.d/profiles-s-z/wireplumber b/apparmor.d/profiles-s-z/wireplumber index 146408bc7..6b8bca6c0 100644 --- a/apparmor.d/profiles-s-z/wireplumber +++ b/apparmor.d/profiles-s-z/wireplumber @@ -61,7 +61,7 @@ profile wireplumber @{exec_path} { @{sys}/bus/ r, @{sys}/bus/media/devices/ r, @{sys}/devices/@{pci}/video4linux/video@{int}/uevent r, - @{sys}/devices/**/device:*/**/path r, + @{sys}/devices/**/device:*/{,**/}path r, @{sys}/devices/**/sound/**/pcm_class r, @{sys}/devices/**/sound/**/uevent r, @{sys}/devices/system/node/ r, From ee3322c463ecc463346a86d72909eb4eabaef6c7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 4 Jul 2024 22:25:09 +0100 Subject: [PATCH 0031/1455] feat(aa-log): full detection of pci path. --- pkg/logs/logs.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index 9771bd82c..c1bcf81df 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -49,7 +49,7 @@ var ( `(?m)^.*/dev/(u|)random.*$`, ``, }) regResolveLogs = util.ToRegexRepl([]string{ - // Resolve classic user variables + // Resolve user variables `/home/[^/]+/.cache`, `@{user_cache_dirs}`, `/home/[^/]+/.config`, `@{user_config_dirs}`, `/home/[^/]+/.local/share`, `@{user_share_dirs}`, @@ -60,7 +60,7 @@ var ( `/home/[^/]+/.gnupg`, `@{HOME}/@{XDG_GPG_DIR}`, `/home/[^/]+/`, `@{HOME}/`, - // Resolve classic system variables + // Resolve system variables `/usr/(lib|lib32|lib64|libexec)`, `@{lib}`, `/usr/(bin|sbin)`, `@{bin}`, `x86_64-pc-linux-gnu[^/]?`, `@{multiarch}`, @@ -75,7 +75,8 @@ var ( `/sys/`, `@{sys}/`, `@{PROC}@{sys}/`, `@{PROC}/sys/`, `pci` + strings.Repeat(_hex, 4) + `:` + strings.Repeat(_hex, 2), `@{pci_bus}`, - `1000`, `@{pid}`, + `@{pci_bus}/[0-9a-f:*./]*`, `@{pci}/`, + `1000`, `@{uid}`, // Some system glob `:1.[0-9]*`, `:*`, // dbus peer name From 4289965cb830ad29cc4c534a98c4d94e34143175 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 4 Jul 2024 22:36:35 +0100 Subject: [PATCH 0032/1455] feat(tunable): clarify the naming scheme for programs name. --- apparmor.d/tunables/multiarch.d/paths | 16 ++++++++-------- apparmor.d/tunables/multiarch.d/programs | 20 ++++++++++++-------- 2 files changed, 20 insertions(+), 16 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 605dede92..3fb6ce44d 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -28,7 +28,7 @@ # Emails @{thunderbird_path} = @{bin}/@{thunderbird_name} @{thunderbird_lib_dirs}/@{thunderbird_name} -@{emails_path} = @{thunderbird_path} @{bin}/@{emails} +@{emails_path} = @{thunderbird_path} @{bin}/@{emails_names} # Open @{open_path} = @{bin}/exo-open @{bin}/xdg-open @{bin}/gio @@ -36,24 +36,24 @@ @{open_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop # File explorers -@{file_explorers_path} = @{bin}/@{file_explorers} +@{file_explorers_path} = @{bin}/@{file_explorers_names} # Text editors -@{text_editors_path} = @{bin}/@{text_editors} /usr/share/code/{bin/,}code +@{text_editors_path} = @{bin}/@{text_editors_names} /usr/share/code/{bin/,}code # Document viewers -@{document_viewers_path} = @{bin}/@{document_viewers} +@{document_viewers_path} = @{bin}/@{document_viewers_names} # Image viewers -@{image_viewers_path} = @{bin}/@{image_viewers} +@{image_viewers_path} = @{bin}/@{image_viewers_names} # Archive viewers -@{archive_viewers_path} = @{bin}/@{archive_viewers} +@{archive_viewers_path} = @{bin}/@{archive_viewers_names} # Office suites -@{offices_path} = @{bin}/@{offices} @{lib}/libreoffice/program/soffice +@{offices_path} = @{bin}/@{offices_names} @{lib}/libreoffice/program/soffice # Help -@{help_path} = @{bin}/@{help} +@{help_path} = @{bin}/@{help_names} # vim:syntax=apparmor diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 786101ffe..f72e56921 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -5,6 +5,10 @@ # Define some some commonly used programs. This is not an exhaustive list. # It is meant to label programs to easily provide access in profiles. +# All variables that refer to a program name should have the `_name` suffix. +# variables that refer to a list of progran should have the `_names` suffix. +# @{sh}, @{shells}, and @{coreutils} are the only exceptions. + # Default distribution shells @{sh} = sh bash dash @@ -49,27 +53,27 @@ @{thunderbird_name} = thunderbird{,.sh,-bin} @{thunderbird_lib_dirs} = @{lib}/@{thunderbird_name} -@{emails} = evolution geary +@{emails_names} = evolution geary # File explorers -@{file_explorers} = dolphin nautilus thunar +@{file_explorers_names} = dolphin nautilus thunar # Text editors -@{text_editors} = code gedit mousepad gnome-text-editor +@{text_editors_names} = code gedit mousepad gnome-text-editor # Document viewers -@{document_viewers} = evince okular *{F,f}oliate YACReader +@{document_viewers_names} = evince okular *{F,f}oliate YACReader # Image viewers -@{image_viewers} = eog loupe ristretto +@{image_viewers_names} = eog loupe ristretto # Archive viewers -@{archive_viewers} = engrampa file-roller xarchiver +@{archive_viewers_names} = engrampa file-roller xarchiver # Office suites -@{offices} = libreoffice soffice +@{offices_names} = libreoffice soffice # Help -@{help} = yelp +@{help_names} = yelp # vim:syntax=apparmor From 120db25fc6a5dfe5f2c46242dbbf447c4cf48e46 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 5 Jul 2024 12:38:32 +0100 Subject: [PATCH 0033/1455] fix: ensure xdg-dbus-proxy have access to download files. fix: #400 --- apparmor.d/groups/freedesktop/xdg-dbus-proxy | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index bfc159897..dea66efb8 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -17,6 +17,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { include include include + include network unix stream, @@ -31,6 +32,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw, + owner @{run}/flatpak/doc/** r, owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw, owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw, owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw, From aa58062eb6203db95e197f2ac6ac8e7981892b4c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 5 Jul 2024 16:00:54 +0100 Subject: [PATCH 0034/1455] chore: correct misspelled english words --- pkg/aa/parse.go | 2 +- pkg/paths/paths.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/aa/parse.go b/pkg/aa/parse.go index 90286f4d5..88808a375 100644 --- a/pkg/aa/parse.go +++ b/pkg/aa/parse.go @@ -599,7 +599,7 @@ func (f *AppArmorProfileFile) parsePreamble(preamble string) error { // Parse an apparmor profile file. // -// Warning: It is purposelly an uncomplete basic parser for apparmor profile, +// Warning: It is purposely an uncomplete basic parser for apparmor profile, // it is only aimed for internal tooling purpose. For "simplicity", it is not // using antlr / participle. It is only used for experimental feature in the // apparmor.d project. diff --git a/pkg/paths/paths.go b/pkg/paths/paths.go index a734d17ed..b77adfa66 100644 --- a/pkg/paths/paths.go +++ b/pkg/paths/paths.go @@ -176,7 +176,7 @@ func (p *Path) IsAbs() bool { return filepath.IsAbs(p.path) } -// ToAbs transofrm the current Path to the corresponding absolute path +// ToAbs transform the current Path to the corresponding absolute path func (p *Path) ToAbs() error { abs, err := filepath.Abs(p.path) if err != nil { @@ -552,7 +552,7 @@ func (p *Path) String() string { // Canonical return a "canonical" Path for the given filename. // The meaning of "canonical" is OS-dependent but the goal of this method // is to always return the same path for a given file (factoring out all the -// possibile ambiguities including, for example, relative paths traversal, +// possible ambiguities including, for example, relative paths traversal, // symlinks, drive volume letter case, etc). func (p *Path) Canonical() *Path { canonical := p.Clone() From 8b2434c0a5489cdd4b5a057d860d2d349173cd0e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 5 Jul 2024 23:45:51 +0100 Subject: [PATCH 0035/1455] doc: recomand to frequently check aa-log. --- docs/install.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/install.md b/docs/install.md index 8f234872c..bf6e65fc0 100644 --- a/docs/install.md +++ b/docs/install.md @@ -6,6 +6,8 @@ title: Installation To prevent the risk of breaking your system, the default package configuration installs all profiles in complain mode. They can be enforced later. See the [Enforce Mode](enforce.md) page. + After installation, you need to regularly check AppArmor log with [`aa-log`](usage.md#apparmor-log). You can also configure [a desktop notification on denied actions](https://wiki.archlinux.org/title/AppArmor#Get_desktop_notification_on_DENIED_actions). + !!! danger Do **not** expect this project to work correctly if your Desktop Environment and Display Manager are not supported. Your Desktop Environment or Display Manager might not load, and that would be a feature. From d480156e09234252cfa67afa8060878e11ddcfea Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Jul 2024 23:46:06 +0100 Subject: [PATCH 0036/1455] feat(profile): general update. --- apparmor.d/abstractions/mesa.d/complete | 2 ++ .../groups/freedesktop/xdg-desktop-portal-gtk | 5 +++++ apparmor.d/groups/gnome/gnome-session-binary | 1 + apparmor.d/groups/gnome/gnome-shell | 1 + apparmor.d/groups/gnome/gnome-software | 8 ++++---- apparmor.d/groups/gpg/dirmngr | 7 +++++++ apparmor.d/groups/gpg/gpg | 6 +++--- apparmor.d/groups/gpg/gpg-agent | 14 ++++++++------ apparmor.d/groups/kde/DiscoverNotifier | 2 +- apparmor.d/groups/kde/plasma-discover | 8 ++++---- apparmor.d/groups/systemd/networkctl | 6 +++++- apparmor.d/groups/systemd/systemd-homed | 1 + apparmor.d/groups/systemd/systemd-hostnamed | 2 ++ apparmor.d/groups/systemd/systemd-networkd | 2 ++ apparmor.d/profiles-a-f/aa-enforce | 3 +++ apparmor.d/profiles-a-f/agetty | 1 + apparmor.d/profiles-a-f/flatpak | 6 +++--- apparmor.d/profiles-a-f/flatpak-system-helper | 8 ++++---- apparmor.d/profiles-s-z/spotify | 12 ++++++------ docs/install.md | 2 +- 20 files changed, 64 insertions(+), 33 deletions(-) diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index ed3306e42..976b6cc47 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -11,4 +11,6 @@ owner @{desktop_cache_dirs}/mesa_shader_cache/index rw, owner @{desktop_cache_dirs}/mesa_shader_cache/marker rw, + owner @{user_cache_dirs}/mesa_shader_cache/marker rw, + # vim:syntax=apparmor diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index a06b898d3..c21b955d0 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -61,6 +61,11 @@ profile xdg-desktop-portal-gtk @{exec_path} { @{run}/mount/utab r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + owner @{PROC}/@{pid}/mountinfo r, include if exists diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 46a1b22d0..c53f26eb2 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -126,6 +126,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { /usr/games/** PUx, /dev/tty rw, + /dev/tty@{int} rw, include if exists include if exists diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 8baf75c4e..5e469e625 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -339,6 +339,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r, @{sys}/devices/**/power_supply/{,**} r, @{sys}/devices/platform/**/input@{int}/{properties,name} r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, @{sys}/devices/virtual/net/*/statistics/collisions r, @{sys}/devices/virtual/net/*/statistics/rx_{bytes,errors,packets} r, @{sys}/devices/virtual/net/*/statistics/tx_{bytes,errors,packets} r, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 9bdb0cfc0..ddb95f1b9 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -86,8 +86,8 @@ profile gnome-software @{exec_path} { owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**, owner @{user_share_dirs}/gnome-software/{,**} rw, - owner @{tmp}/ostree-gpg-*/ rw, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ rw, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, owner @{tmp}/#@{int} rw, owner @{run}/user/@{uid}/.dbus-proxy/ rw, @@ -125,8 +125,8 @@ profile gnome-software @{exec_path} { @{HOME}/@{XDG_GPG_DIR}/*.conf r, @{tmp}/ r, - owner @{tmp}/ostree-gpg-*/ r, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ r, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, owner @{run}/user/@{uid}/gnupg/ w, diff --git a/apparmor.d/groups/gpg/dirmngr b/apparmor.d/groups/gpg/dirmngr index d2afa3462..a0c131bcd 100644 --- a/apparmor.d/groups/gpg/dirmngr +++ b/apparmor.d/groups/gpg/dirmngr @@ -39,6 +39,13 @@ profile dirmngr @{exec_path} { owner @{run}/user/@{uid}/gnupg/S.dirmngr rw, owner @{run}/user/@{uid}/gnupg/d.*/S.dirmngr rw, + # FIXME: Needed by dirmngr@.service + owner /etc/pacman.d/gnupg/ rw, + owner /etc/pacman.d/gnupg/S.dirmngr rw, + owner /etc/pacman.d/gnupg/d.*/S.dirmngr rw, + owner /etc/pacman.d/gnupg/crls.d/ rw, + owner /etc/pacman.d/gnupg/crls.d/DIR.txt rw, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 4fcc8946d..c108215fa 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -60,10 +60,10 @@ profile gpg @{exec_path} { owner /var/tmp/zypp.@{rand6}/** rwkl -> /var/tmp/zypp.@{rand6}/**, #aa:exclude ubuntu - owner @{tmp}/ostree-gpg-*/ r, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ r, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, - owner @{tmp}/tmp.[a-zA-Z0-9]* rw, + owner /tmp/@{int}@{int} rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index 336d491b1..f7580a8aa 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -58,6 +58,13 @@ profile gpg-agent @{exec_path} { owner @{user_tmp_dirs}/**/{.,}gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{user_tmp_dirs}/**/{.,}gnupg/sshcontrol r, + #aa:only pacman + owner /etc/pacman.d/gnupg/ rw, + owner /etc/pacman.d/gnupg/private-keys-v1.d/ rw, + owner /etc/pacman.d/gnupg/private-keys-v1.d/@{hex}.key rw, + owner /etc/pacman.d/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner /etc/pacman.d/gnupg/sshcontrol r, + owner /var/lib/*/.gnupg/ rw, owner /var/lib/*/.gnupg/private-keys-v1.d/ rw, owner /var/lib/*/.gnupg/private-keys-v1.d/@{hex}.key rw, @@ -70,17 +77,12 @@ profile gpg-agent @{exec_path} { owner /var/lib/*/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner /var/lib/*/gnupg/sshcontrol r, + #aa:only zypper owner /var/tmp/zypp.*/ rw, owner /var/tmp/zypp.*/{,*/}private-keys-v1.d/ rw, owner /var/tmp/zypp.*/{,*/}private-keys-v1.d/@{hex}.key rw, owner /var/tmp/zypp.*/{,*/}S.gpg-agent{,.ssh,.browser,.extra} rw, - owner @{tmp}/tmp.*/gnupg/ rw, - owner @{tmp}/tmp.*/gnupg/private-keys-v1.d/ rw, - owner @{tmp}/tmp.*/gnupg/private-keys-v1.d/@{hex}.key rw, - owner @{tmp}/tmp.*/gnupg/{,d.*/}S.gpg-agent rw, - owner @{tmp}/tmp.*/gnupg/sshcontrol r, - @{PROC}/@{pid}/fd/ r, # Silencer diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 9b305e5fb..db870bd82 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -71,7 +71,7 @@ profile DiscoverNotifier @{exec_path} { @{tmp}/ r, owner @{tmp}/ostree-gpg-@{rand6}/ r, - owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, owner @{run}/user/@{uid}/gnupg/ w, diff --git a/apparmor.d/groups/kde/plasma-discover b/apparmor.d/groups/kde/plasma-discover index 5d0884026..542110454 100644 --- a/apparmor.d/groups/kde/plasma-discover +++ b/apparmor.d/groups/kde/plasma-discover @@ -86,8 +86,8 @@ profile plasma-discover @{exec_path} { owner @{tmp}/*.kwinscript rwl -> /tmp/#@{int}, owner @{tmp}/#@{int} rw, owner @{tmp}/discover-@{rand6}/{,**} rw, - owner @{tmp}/ostree-gpg-*/ rw, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ rw, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, owner @{run}/user/@{uid}/.flatpak-cache rw, owner @{run}/user/@{uid}/.flatpak/{,**} rw, @@ -108,8 +108,8 @@ profile plasma-discover @{exec_path} { @{HOME}/@{XDG_GPG_DIR}/*.conf r, - owner @{tmp}/ostree-gpg-*/ r, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ r, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, include if exists } diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index f570d5eab..4c841e97d 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -43,6 +43,8 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { /var/lib/dbus/machine-id r, /etc/machine-id r, + owner /var/lib/systemd/network/ r, + # To be able to read logs @{run}/log/ r, /{run,var}/log/journal/ r, @@ -60,8 +62,10 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { @{sys}/devices/**/net/**/uevent r, - @{PROC}/sys/kernel/random/boot_id r, @{PROC}/1/cgroup r, + @{PROC}/cmdline r, + @{PROC}/sys/kernel/osrelease r, + @{PROC}/sys/kernel/random/boot_id r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/systemd/systemd-homed b/apparmor.d/groups/systemd/systemd-homed index a9f9d7fb1..2fae7144d 100644 --- a/apparmor.d/groups/systemd/systemd-homed +++ b/apparmor.d/groups/systemd/systemd-homed @@ -48,6 +48,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { /etc/systemd/homed.conf r, /etc/skel/{,**} r, + /var/cache/systemd/home/{,**} rw, /var/lib/systemd/home/{,**} rw, / r, diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index 9686f1864..39fcd9886 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -53,6 +53,8 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { @{sys}/firmware/acpi/pm_profile r, @{sys}/firmware/dmi/entries/*/raw r, + /dev/vsock r, + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index d8ebf39ba..18f1e6ab2 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -52,6 +52,8 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { / r, + owner /var/lib/systemd/network/ r, + @{run}/systemd/network/ r, @{run}/systemd/network/*.network r, @{run}/systemd/notify rw, diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index a6f3d2b9e..2028e713f 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -29,6 +29,9 @@ profile aa-enforce @{exec_path} { owner /snap/core@{int}/@{int}/etc/apparmor.d/{,**} rw, owner /var/lib/snapd/apparmor/{,**} rw, + /tmp/@{rand8} rw, + /tmp/apparmor-bugreport-@{rand8}.txt rw, + owner @{PROC}/@{pid}/fd r, include if exists diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/profiles-a-f/agetty index c15748c6a..c1436f9ad 100644 --- a/apparmor.d/profiles-a-f/agetty +++ b/apparmor.d/profiles-a-f/agetty @@ -34,6 +34,7 @@ profile agetty @{exec_path} { /etc/os-release r, /usr/etc/login.defs r, + @{run}/credentials/serial-getty@ttyS@{int}.service/ r, owner @{run}/agetty.reload rw, /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index 4d3220a08..8722612d1 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -70,7 +70,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain /tmp/#@{int} rw, owner /dev/shm/flatpak*/{,**} rw, - owner @{tmp}/ostree-gpg-*/{,**} rw, + owner @{tmp}/ostree-gpg-@{rand6}/{,**} rw, @{run}/.userns r, @{run}/user/@{uid}/.dbus-proxy/ w, @@ -107,8 +107,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain @{HOME}/@{XDG_GPG_DIR}/*.conf r, - owner @{tmp}/ostree-gpg-*/ rw, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ rw, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, include if exists } diff --git a/apparmor.d/profiles-a-f/flatpak-system-helper b/apparmor.d/profiles-a-f/flatpak-system-helper index 81a1231cb..a2141b111 100644 --- a/apparmor.d/profiles-a-f/flatpak-system-helper +++ b/apparmor.d/profiles-a-f/flatpak-system-helper @@ -44,8 +44,8 @@ profile flatpak-system-helper @{exec_path} { /var/tmp/flatpak-cache-*/{,**} rw, owner /{var/,}tmp/#@{int} rw, - owner /{var/,}tmp/ostree-gpg-*/ rw, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner /{var/,}tmp/ostree-gpg-@{rand6}/ rw, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/fd/ r, @@ -62,8 +62,8 @@ profile flatpak-system-helper @{exec_path} { @{lib}/{,gnupg/}scdaemon rix, @{bin}/gpg-agent rix, - owner @{tmp}/ostree-gpg-*/ r, - owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + owner @{tmp}/ostree-gpg-@{rand6}/ r, + owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index db2e7ebe9..ef939ef07 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -43,16 +43,16 @@ profile spotify @{exec_path} { owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw, - @{sys}/bus/ r, - @{sys}/bus/*/devices/ r, - - @{PROC}/pressure/* r, + @{PROC}/pressure/* r, + owner @{PROC}/@{pid}/clear_refs w, /dev/tty rw, - deny @{user_share_dirs}/gvfs-metadata/* r, + deny @{sys}/bus/ r, + deny @{sys}/bus/*/devices/ r, deny @{sys}/class/*/ r, - deny owner @{PROC}/@{pid}/clear_refs w, + deny @{sys}/devices/@{pci}/usb@{int}/** r, + deny @{user_share_dirs}/gvfs-metadata/* r, include if exists } diff --git a/docs/install.md b/docs/install.md index bf6e65fc0..c08072343 100644 --- a/docs/install.md +++ b/docs/install.md @@ -6,7 +6,7 @@ title: Installation To prevent the risk of breaking your system, the default package configuration installs all profiles in complain mode. They can be enforced later. See the [Enforce Mode](enforce.md) page. - After installation, you need to regularly check AppArmor log with [`aa-log`](usage.md#apparmor-log). You can also configure [a desktop notification on denied actions](https://wiki.archlinux.org/title/AppArmor#Get_desktop_notification_on_DENIED_actions). + After installation, you **must** regularly check AppArmor log with [`aa-log`](usage.md#apparmor-log). You can also configure [a desktop notification on denied actions](https://wiki.archlinux.org/title/AppArmor#Get_desktop_notification_on_DENIED_actions). !!! danger From 435cf47359d0931584800780ec99cbb66d1cf2e7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 9 Jul 2024 12:10:21 +0100 Subject: [PATCH 0037/1455] fix: ensure dkms module can be installed on system update. fix #377 --- apparmor.d/groups/pacman/pacman-hook-dkms | 3 ++- dists/flags/main.flags | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/pacman/pacman-hook-dkms b/apparmor.d/groups/pacman/pacman-hook-dkms index 8d0fb58ca..fd449cd10 100644 --- a/apparmor.d/groups/pacman/pacman-hook-dkms +++ b/apparmor.d/groups/pacman/pacman-hook-dkms @@ -14,6 +14,8 @@ profile pacman-hook-dkms @{exec_path} flags=(attach_disconnected) { capability dac_read_search, capability mknod, + network unix stream, + @{exec_path} mr, @{sh_path} rix, @@ -31,7 +33,6 @@ profile pacman-hook-dkms @{exec_path} flags=(attach_disconnected) { # Inherit Silencer deny network inet stream, deny network inet6 stream, - deny unix (receive) type=stream, include if exists } diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 8bb7843b8..bff50ba9b 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -254,6 +254,7 @@ ollama attach_disconnected,complain os-prober attach_disconnected,complain package-data-downloader complain packagekitd attach_disconnected,complain +pacman-hook-dkms complain pam_kwallet_init complain pam-tmpdir-helper complain passim complain From 1db2c01117fb49ba8ce5af193baec21f6b4d14cc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 10 Jul 2024 12:48:15 +0100 Subject: [PATCH 0038/1455] feat(tunable): add kde-open to open_path. --- apparmor.d/tunables/multiarch.d/paths | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 3fb6ce44d..69ca70ef7 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -31,7 +31,7 @@ @{emails_path} = @{thunderbird_path} @{bin}/@{emails_names} # Open -@{open_path} = @{bin}/exo-open @{bin}/xdg-open @{bin}/gio +@{open_path} = @{bin}/exo-open @{bin}/xdg-open @{bin}/gio @{bin}/kde-open @{open_path} += @{bin}/gio-launch-desktop @{lib}/gio-launch-desktop @{open_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop From 872b8fc30ad7525e1bc3141a5955716d1cd17316 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Jul 2024 14:29:43 +0100 Subject: [PATCH 0039/1455] fix(profile): strawberry & nemo. see #407 --- apparmor.d/profiles-m-r/nemo | 1 + apparmor.d/profiles-s-z/strawberry | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-m-r/nemo b/apparmor.d/profiles-m-r/nemo index f28d053cd..4021836ec 100644 --- a/apparmor.d/profiles-m-r/nemo +++ b/apparmor.d/profiles-m-r/nemo @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/nemo profile nemo @{exec_path} { include + include include include diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index 2d72bc83c..db48ee100 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/strawberry -profile strawberry @{exec_path} { +profile strawberry @{exec_path} flags=(attach_disconnected) { include include include From d864f5c97542952945357ae1915240e8a40f0d7c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 12 Jul 2024 20:08:58 +0100 Subject: [PATCH 0040/1455] feat(profile): improve general integration See #407 --- apparmor.d/groups/freedesktop/xdg-user-dir | 5 +++-- apparmor.d/groups/freedesktop/xhost | 2 +- .../groups/systemd/systemd-generator-fstab | 1 + .../systemd/systemd-generator-user-autostart | 2 ++ apparmor.d/groups/systemd/systemd-machined | 3 +++ apparmor.d/profiles-a-f/dunst | 3 +++ apparmor.d/profiles-g-l/id | 2 +- apparmor.d/profiles-g-l/lspci | 1 + apparmor.d/profiles-m-r/nemo | 18 +++++++++++++++++- apparmor.d/profiles-m-r/pkexec | 11 ++++------- apparmor.d/profiles-m-r/run-parts | 13 ++++++++++--- apparmor.d/profiles-s-z/strawberry | 3 ++- apparmor.d/profiles-s-z/virt-manager | 4 ++++ dists/flags/main.flags | 1 + 14 files changed, 53 insertions(+), 16 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-user-dir b/apparmor.d/groups/freedesktop/xdg-user-dir index fa52d6f52..47184420b 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dir +++ b/apparmor.d/groups/freedesktop/xdg-user-dir @@ -9,11 +9,12 @@ include @{exec_path} = @{bin}/xdg-user-dir profile xdg-user-dir @{exec_path} flags=(attach_disconnected) { include + include @{exec_path} mr, - @{sh_path} rix, - @{bin}/env rix, + @{sh_path} rix, + @{bin}/env rix, owner @{user_config_dirs}/user-dirs.dirs r, diff --git a/apparmor.d/groups/freedesktop/xhost b/apparmor.d/groups/freedesktop/xhost index 467a92e03..26b1bc598 100644 --- a/apparmor.d/groups/freedesktop/xhost +++ b/apparmor.d/groups/freedesktop/xhost @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/xhost -profile xhost @{exec_path} { +profile xhost @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-generator-fstab b/apparmor.d/groups/systemd/systemd-generator-fstab index 075c5c6af..a15100300 100644 --- a/apparmor.d/groups/systemd/systemd-generator-fstab +++ b/apparmor.d/groups/systemd/systemd-generator-fstab @@ -13,6 +13,7 @@ profile systemd-generator-fstab @{exec_path} { capability dac_override, capability dac_read_search, + capability mknod, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-generator-user-autostart b/apparmor.d/groups/systemd/systemd-generator-user-autostart index 95dab2026..8ca09d56b 100644 --- a/apparmor.d/groups/systemd/systemd-generator-user-autostart +++ b/apparmor.d/groups/systemd/systemd-generator-user-autostart @@ -16,6 +16,8 @@ profile systemd-generator-user-autostart @{exec_path} { @{exec_path} mr, + @{system_share_dirs}/applications/*.desktop r, + @{etc_ro}/xdg/autostart/{,*.desktop} r, owner @{user_config_dirs}/autostart/{,*.desktop} r, diff --git a/apparmor.d/groups/systemd/systemd-machined b/apparmor.d/groups/systemd/systemd-machined index 512fdde82..cb0eab79b 100644 --- a/apparmor.d/groups/systemd/systemd-machined +++ b/apparmor.d/groups/systemd/systemd-machined @@ -49,6 +49,9 @@ profile systemd-machined @{exec_path} { @{PROC}/pressure/io r, @{PROC}/pressure/memory r, + /dev/ptmx rw, + /dev/pts/@{int} rw, + include if exists } diff --git a/apparmor.d/profiles-a-f/dunst b/apparmor.d/profiles-a-f/dunst index 8fb895029..220652247 100644 --- a/apparmor.d/profiles-a-f/dunst +++ b/apparmor.d/profiles-a-f/dunst @@ -17,10 +17,13 @@ profile dunst @{exec_path} { @{exec_path} mr, /etc/xdg/dunst/dunstrc r, + owner @{user_config_dirs}/dunst/dunstrc r, owner @{HOME}/.Xauthority r, + owner /dev/shm/dunst-@{rand6} rw, + include if exists } diff --git a/apparmor.d/profiles-g-l/id b/apparmor.d/profiles-g-l/id index 061313d42..6ba6001b6 100644 --- a/apparmor.d/profiles-g-l/id +++ b/apparmor.d/profiles-g-l/id @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/id -profile id @{exec_path} { +profile id @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/profiles-g-l/lspci b/apparmor.d/profiles-g-l/lspci index 0d6936d22..656597c1c 100644 --- a/apparmor.d/profiles-g-l/lspci +++ b/apparmor.d/profiles-g-l/lspci @@ -37,6 +37,7 @@ profile lspci @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/** r, @{sys}/module/compression r, + @{PROC}/bus/pci/devices r, @{PROC}/cmdline r, @{PROC}/ioports r, diff --git a/apparmor.d/profiles-m-r/nemo b/apparmor.d/profiles-m-r/nemo index 4021836ec..a51854414 100644 --- a/apparmor.d/profiles-m-r/nemo +++ b/apparmor.d/profiles-m-r/nemo @@ -11,15 +11,31 @@ include profile nemo @{exec_path} { include include + include include include + include network inet stream, network inet6 stream, @{exec_path} mr, -# @{lib}/@{multiarch}/nemo/** mrix, + /usr/share/nemo/** r, + + # Full access to user's data + / r, + /*/ r, + @{bin}/ r, + @{lib}/ r, + @{MOUNTDIRS}/ r, + @{MOUNTS}/ r, + @{MOUNTS}/** rw, + owner @{HOME}/{,**} rw, + owner @{run}/user/@{uid}/{,**} rw, + owner @{tmp}/{,**} rw, + + @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-m-r/pkexec b/apparmor.d/profiles-m-r/pkexec index 923d955af..49c762df9 100644 --- a/apparmor.d/profiles-m-r/pkexec +++ b/apparmor.d/profiles-m-r/pkexec @@ -35,13 +35,10 @@ profile pkexec @{exec_path} { @{exec_path} mr, - # Apps to be run via pkexec - @{bin}/* rPUx, - @{lib}/{,gvfs/}gvfsd-admin rPx, - @{lib}/cc-remote-login-helper rPx, - @{lib}/update-notifier/package-system-locked rPx, - /usr/share/apport/apport-gtk rPx, - #aa:exec polkit-agent-helper + @{bin}/* PUx, + @{lib}/** PUx, + /opt/*/** PUx, + /usr/share/** PUx, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*} r, diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 18c70b240..f166e0fd0 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -14,7 +14,9 @@ profile run-parts @{exec_path} { include include - @{exec_path} mr, + capability mknod, + + @{exec_path} mrix, @{sh_path} rix, @{bin}/anacron rix, @@ -29,6 +31,7 @@ profile run-parts @{exec_path} { /etc/ r, /etc/anacrontab r, /etc/conf.d/snapper{,**} r, + /etc/default/* r, /etc/snapper/configs/root r, # Crontab @@ -134,10 +137,14 @@ profile run-parts @{exec_path} { /usr/share/landscape/landscape-sysinfo.wrapper rPUx, + /root/ r, + + /var/spool/anacron/cron.daily k, + owner @{tmp}/#@{int} rw, - owner @{tmp}/$anacron* rw, + owner @{tmp}/$anacron@{rand6} rw, owner @{tmp}/file@{rand6} rw, - + owner @{sys}/class/power_supply/ r, /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index db48ee100..484a4069d 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -8,10 +8,11 @@ abi , include @{exec_path} = @{bin}/strawberry -profile strawberry @{exec_path} flags=(attach_disconnected) { +profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include include diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index 9fa13e500..c1bd7fbde 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -84,8 +84,12 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r, @{sys}/devices/virtual/drm/ttm/uevent r, + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, @{PROC}/@{pids}/net/route r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index bff50ba9b..06eae76b7 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -306,6 +306,7 @@ steam-launch attach_disconnected,complain steam-launcher attach_disconnected,complain steam-runtime attach_disconnected,complain steamerrorreporter attach_disconnected,complain +strawberry attach_disconnected,mediate_deleted,complain sulogin complain switcherooctl complain swtpm complain From bd1239b46a006d3cb227fc6fffcf95cf684e1ea2 Mon Sep 17 00:00:00 2001 From: valoq Date: Fri, 12 Jul 2024 20:11:32 +0100 Subject: [PATCH 0041/1455] add profiles for cmus and ouch (#408) * add profiles for cmus and ouch * minor corrections --- apparmor.d/profiles-a-f/cmus | 31 +++++++++++++++++++++++++++++++ apparmor.d/profiles-m-r/ouch | 26 ++++++++++++++++++++++++++ 2 files changed, 57 insertions(+) create mode 100644 apparmor.d/profiles-a-f/cmus create mode 100644 apparmor.d/profiles-m-r/ouch diff --git a/apparmor.d/profiles-a-f/cmus b/apparmor.d/profiles-a-f/cmus new file mode 100644 index 000000000..b667d81f0 --- /dev/null +++ b/apparmor.d/profiles-a-f/cmus @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/cmus +profile cmus @{exec_path} { + include + include + + @{exec_path} mr, + + /usr/share/cmus/{,**} r, + /usr/share/terminfo/{,**} r, + + /etc/machine-id r, + + owner @{user_music_dirs}/{,**} r, + + owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/cmus/{,**} rw, + + owner @{run}/user/@{uid}/cmus-socket w, + + /dev/shm/ r, + + include if exists +} diff --git a/apparmor.d/profiles-m-r/ouch b/apparmor.d/profiles-m-r/ouch new file mode 100644 index 000000000..efd796d19 --- /dev/null +++ b/apparmor.d/profiles-m-r/ouch @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ouch +profile ouch @{exec_path} { + include + include + include + + @{exec_path} mr, + + owner @{HOME}/.tmp@{rand6}/{,**} rw, + + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, + + owner @{PROC}/@{pid}/cgroup r, + + include if exists +} From 9c9f743e1ea6747e12dd52ef1cbe5325e9ad3279 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Jul 2024 12:12:30 +0100 Subject: [PATCH 0042/1455] fix: variour small fixes. See #409 --- apparmor.d/groups/bus/ibus-daemon | 1 + apparmor.d/groups/freedesktop/xdg-desktop-portal | 5 +++++ apparmor.d/groups/gnome/gio-launch-desktop | 5 +++++ apparmor.d/groups/gnome/gsd-color | 2 ++ apparmor.d/groups/gnome/gsd-keyboard | 2 ++ apparmor.d/groups/gnome/gsd-power | 1 + apparmor.d/groups/gnome/gsd-smartcard | 10 +++++++--- apparmor.d/groups/systemd/systemd-sleep-tlp | 1 + apparmor.d/profiles-s-z/usbguard-daemon | 2 +- dists/flags/main.flags | 1 + 10 files changed, 26 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/bus/ibus-daemon b/apparmor.d/groups/bus/ibus-daemon index b072bcae9..52707ff63 100644 --- a/apparmor.d/groups/bus/ibus-daemon +++ b/apparmor.d/groups/bus/ibus-daemon @@ -42,6 +42,7 @@ profile ibus-daemon @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{lib}/{,ibus/}ibus-* rPUx, + @{lib}/ibus-*/ibus-* rPUx, /usr/share/ibus/{,**} r, /usr/share/ibus-table/{,**} r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 65420a2ee..59ef5a734 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -84,6 +84,11 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/.flatpak/{,*/*} r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{PROC}/ r, @{PROC}/*/ r, @{PROC}/1/cgroup r, diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 19b33d743..8e6d80f9e 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -3,6 +3,11 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# TODO: Rethink this profile: +# - Access to gio from a profile is handled by child-open-* +# - Direct access should only be needed is some special context and it should not +# require access to that much resources. + abi , include diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 5c43cddf4..8d77f6cb2 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -21,6 +21,8 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { include include + network inet stream, + signal (receive) set=(term, hup) peer=gdm*, #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Color diff --git a/apparmor.d/groups/gnome/gsd-keyboard b/apparmor.d/groups/gnome/gsd-keyboard index c87d6c9be..d621a43ae 100644 --- a/apparmor.d/groups/gnome/gsd-keyboard +++ b/apparmor.d/groups/gnome/gsd-keyboard @@ -21,6 +21,8 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { include include + network inet stream, + signal (receive) set=(term, hup) peer=gdm*, #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Keyboard diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 096839994..2c21bc4fd 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -30,6 +30,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include + network inet stream, network netlink raw, signal (receive) set=(term, hup) peer=gdm*, diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index c72c9a8eb..b0ff24b58 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -31,13 +31,17 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { /usr/share/glib-2.0/schemas/gschemas.compiled r, /etc/{,opensc/}opensc.conf r, - - owner @{GDM_HOME}/greeter-dconf-defaults r, - owner @{gdm_config_dirs}/dconf/user r, + /etc/tpm2-tss/* r, /var/tmp/ r, /tmp/ r, + owner @{GDM_HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw, + owner @{GDM_HOME}/greeter-dconf-defaults r, + owner @{gdm_config_dirs}/dconf/user r, + + owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw, + owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/groups/systemd/systemd-sleep-tlp b/apparmor.d/groups/systemd/systemd-sleep-tlp index 1e7d3fe34..03fb69356 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-tlp +++ b/apparmor.d/groups/systemd/systemd-sleep-tlp @@ -12,6 +12,7 @@ profile systemd-sleep-tlp @{exec_path} { @{exec_path} mr, + @{sh_path} rix, @{bin}/tlp rPUx, include if exists diff --git a/apparmor.d/profiles-s-z/usbguard-daemon b/apparmor.d/profiles-s-z/usbguard-daemon index d6c05f782..674da7ad4 100644 --- a/apparmor.d/profiles-s-z/usbguard-daemon +++ b/apparmor.d/profiles-s-z/usbguard-daemon @@ -24,8 +24,8 @@ profile usbguard-daemon @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + /etc/usbguard/{,**} r, /etc/usbguard/*.conf rw, - /etc/usbguard/IPCAccessControl.d/{,*} r, owner @{run}/usbguard.pid rwk, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 06eae76b7..53631aaeb 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -353,6 +353,7 @@ systemd-portabled complain systemd-remount-fs complain systemd-resolve complain systemd-shutdown complain +systemd-sleep-tlp complain systemd-socket-proxyd complain systemd-udevd attach_disconnected,complain systemd-user-sessions complain From a270b7c6d4e379efe849cdedd06032d8069affc3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Jul 2024 12:13:16 +0100 Subject: [PATCH 0043/1455] fix(tunable): username can have uppercase letter. See #409 --- apparmor.d/tunables/multiarch.d/system | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index d219c1d4d..f2e7c2563 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -55,8 +55,8 @@ @{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} # Username & group valid characters -@{u}=[a-z0-9_] -@{user}=[a-z_]{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},} +@{u}=[a-zA-Z0-9_] +@{user}=[a-zA-Z_]{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},} @{group}=@{user} # Shortcut for PCI device From 68da315ac23f03e98a4129b81a192e7b9b89844d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Jul 2024 12:34:12 +0100 Subject: [PATCH 0044/1455] fix(profile): minor fixes. see #410 --- apparmor.d/groups/gpg/gpg | 6 +++--- apparmor.d/profiles-a-f/btrfs | 1 + apparmor.d/profiles-a-f/dunstify | 2 ++ apparmor.d/profiles-m-r/run-parts | 2 +- apparmor.d/profiles-s-z/wmctrl | 1 + apparmor.d/profiles-s-z/xsel | 4 +--- dists/ignore/main.ignore | 1 + 7 files changed, 10 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index c108215fa..9d23622d2 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -44,9 +44,9 @@ profile gpg @{exec_path} { owner /etc/apt/keyrings/** rwkl -> /etc/apt/keyrings/**, #aa:only pacman - owner /etc/pacman.d/gnupg/gpg.conf r, - owner /etc/pacman.d/gnupg/pubring.gpg r, - owner /etc/pacman.d/gnupg/trustdb.gpg r, + /etc/pacman.d/gnupg/gpg.conf r, + /etc/pacman.d/gnupg/pubring.gpg r, + /etc/pacman.d/gnupg/trustdb.gpg r, owner /var/lib/*/gnupg/ rw, owner /var/lib/*/gnupg/** rwkl -> /var/lib/*/gnupg/**, diff --git a/apparmor.d/profiles-a-f/btrfs b/apparmor.d/profiles-a-f/btrfs index f056d12ca..45e50da9c 100644 --- a/apparmor.d/profiles-a-f/btrfs +++ b/apparmor.d/profiles-a-f/btrfs @@ -25,6 +25,7 @@ profile btrfs @{exec_path} flags=(attach_disconnected) { / r, /boot/ r, + /home/ r, /.snapshots/ r, @{MOUNTS}/ r, @{MOUNTS}/ext2_saved/ rw, diff --git a/apparmor.d/profiles-a-f/dunstify b/apparmor.d/profiles-a-f/dunstify index 3a8f16c2f..42a8be4ad 100644 --- a/apparmor.d/profiles-a-f/dunstify +++ b/apparmor.d/profiles-a-f/dunstify @@ -13,6 +13,8 @@ profile dunstify @{exec_path} { @{exec_path} mr, + owner @{PROC}/@{pid}/cgroup r, + # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index f166e0fd0..b37172246 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -45,7 +45,6 @@ profile run-parts @{exec_path} { /etc/cron.{hourly,daily,weekly,monthly}/aptitude rPx, /etc/cron.{hourly,daily,weekly,monthly}/bsdmainutils rPUx, /etc/cron.{hourly,daily,weekly,monthly}/checksecurity rPUx, - /etc/cron.{hourly,daily,weekly,monthly}/cracklib-runtime rPx, /etc/cron.{hourly,daily,weekly,monthly}/debsums rPx, /etc/cron.{hourly,daily,weekly,monthly}/debtags rPx, /etc/cron.{hourly,daily,weekly,monthly}/dlocate rPx, @@ -58,6 +57,7 @@ profile run-parts @{exec_path} { /etc/cron.{hourly,daily,weekly,monthly}/passwd rPUx, /etc/cron.{hourly,daily,weekly,monthly}/plocate rPx, /etc/cron.{hourly,daily,weekly,monthly}/popularity-contest rPx, + /etc/cron.{hourly,daily,weekly,monthly}/snapper rPUx, /etc/cron.{hourly,daily,weekly,monthly}/spamassassin rPUx, /etc/cron.{hourly,daily,weekly,monthly}/sysstat rPx, /etc/cron.{hourly,daily,weekly,monthly}/tor rPUx, diff --git a/apparmor.d/profiles-s-z/wmctrl b/apparmor.d/profiles-s-z/wmctrl index 8d99da352..47a17669d 100644 --- a/apparmor.d/profiles-s-z/wmctrl +++ b/apparmor.d/profiles-s-z/wmctrl @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/wmctrl profile wmctrl @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/xsel b/apparmor.d/profiles-s-z/xsel index 949aa19f7..5f97c83f3 100644 --- a/apparmor.d/profiles-s-z/xsel +++ b/apparmor.d/profiles-s-z/xsel @@ -11,6 +11,7 @@ include profile xsel @{exec_path} { include include + include @{exec_path} mr, @@ -18,9 +19,6 @@ profile xsel @{exec_path} { owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/xsel.log rw, - owner @{HOME}/.Xauthority r, - owner @{tmp}/xauth-@{int}-_[0-9] r, - # file_inherit owner /dev/tty@{int} rw, owner @{HOME}/.xsession-errors w, diff --git a/dists/ignore/main.ignore b/dists/ignore/main.ignore index 0e89a76c5..fe61aaf2f 100644 --- a/dists/ignore/main.ignore +++ b/dists/ignore/main.ignore @@ -14,6 +14,7 @@ code-wrapper man # Work in progress profiles +dunst plasma-discover steam steam-fossilize From 85ccc46e44b7903cc9dd46edd5dc97e84884a8db Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Jul 2024 18:08:45 +0100 Subject: [PATCH 0045/1455] feat(profile): cleanup mount dir access. see #412 --- apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome | 1 + apparmor.d/groups/freedesktop/xdg-document-portal | 8 +++++--- apparmor.d/profiles-s-z/totem | 5 +++++ apparmor.d/profiles-s-z/vlc | 3 +++ 4 files changed, 14 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index fecaa51b7..89135381c 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -72,6 +72,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { owner @{HOME}/ r, owner @{HOME}/*/{,**} rw, + owner @{MOUNTS}/ r, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index 86633e72f..2735c8633 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -42,7 +42,9 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { / r, owner /.flatpak-info r, - owner @{HOME}/** r, + owner @{HOME}/ r, + owner @{HOME}/*/{,**} rw, + owner @{MOUNTS}/ r, owner @{user_share_dirs}/flatpak/db/documents r, owner @{user_share_dirs}/Trash/files/** r, @@ -54,8 +56,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, - /dev/fuse rw, - owner /dev/tty@{int} rw, + /dev/fuse rw, + owner /dev/tty@{int} rw, profile fusermount { include diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index c75cea7ff..ef11ad786 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -35,6 +35,9 @@ profile totem @{exec_path} flags=(attach_disconnected) { /usr/share/grilo-plugins/{,**} r, /usr/share/thumbnailers/{,**} r, + owner @{HOME}/ r, + owner @{MOUNTS}/ r, + owner @{user_music_dirs}/{,**} rw, owner @{user_pictures_dirs}/{,**} rw, owner @{user_torrents_dirs}/{,**} rw, @@ -50,6 +53,8 @@ profile totem @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r, owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=** r, + @{run}/mount/utab r, + owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/task/@{tid}/comm w, diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index 5d113ba3b..b5ea8b272 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -41,6 +41,7 @@ profile vlc @{exec_path} { @{exec_path} mrix, + @{open_path} rPx -> child-open-help, @{bin}/xdg-screensaver rPx, /usr/share/vlc/{,**} r, @@ -48,6 +49,8 @@ profile vlc @{exec_path} { /etc/fstab r, owner @{HOME}/ r, + owner @{MOUNTS}/ r, + owner @{user_music_dirs}/{,**} rw, owner @{user_pictures_dirs}/{,**} rw, owner @{user_torrents_dirs}/{,**} rw, From 56f3332163dbdb8ebb93df0e1efcc3a3eee2e051 Mon Sep 17 00:00:00 2001 From: odomingao Date: Mon, 15 Jul 2024 18:56:55 -0300 Subject: [PATCH 0046/1455] add profiles for waybar and some hypr utilities (#414) --- apparmor.d/groups/hypr/hyprctl | 21 ++++++++++++++++ apparmor.d/groups/hypr/hyprlock | 37 ++++++++++++++++++++++++++++ apparmor.d/groups/hypr/hyprpaper | 31 +++++++++++++++++++++++ apparmor.d/groups/hypr/hyprpicker | 25 +++++++++++++++++++ apparmor.d/groups/hypr/hyprpm | 41 +++++++++++++++++++++++++++++++ apparmor.d/profiles-s-z/waybar | 34 +++++++++++++++++++++++++ 6 files changed, 189 insertions(+) create mode 100644 apparmor.d/groups/hypr/hyprctl create mode 100644 apparmor.d/groups/hypr/hyprlock create mode 100644 apparmor.d/groups/hypr/hyprpaper create mode 100644 apparmor.d/groups/hypr/hyprpicker create mode 100644 apparmor.d/groups/hypr/hyprpm create mode 100644 apparmor.d/profiles-s-z/waybar diff --git a/apparmor.d/groups/hypr/hyprctl b/apparmor.d/groups/hypr/hyprctl new file mode 100644 index 000000000..4c8a72110 --- /dev/null +++ b/apparmor.d/groups/hypr/hyprctl @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/hyprctl + +profile hyprctl @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor + diff --git a/apparmor.d/groups/hypr/hyprlock b/apparmor.d/groups/hypr/hyprlock new file mode 100644 index 000000000..9f400c90b --- /dev/null +++ b/apparmor.d/groups/hypr/hyprlock @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/hyprlock + +profile hyprlock @{exec_path} { + include + include + include + include + include + + network netlink raw, + + @{exec_path} mr, + + /etc/security/faillock.conf r, + /etc/shells r, + + owner @{HOME}/@{XDG_WALLPAPERS_DIR}/** r, + owner @{user_pictures_dirs}/** r, + + owner @{user_config_dirs}/hypr/hyprlock.conf r, + + owner @{run}/faillock/@{user} rwk, + + owner /dev/tty@{int} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/hypr/hyprpaper b/apparmor.d/groups/hypr/hyprpaper new file mode 100644 index 000000000..616ff6c57 --- /dev/null +++ b/apparmor.d/groups/hypr/hyprpaper @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/hyprpaper + +profile hyprpaper @{exec_path} flags=(attach_disconnected) { + include + include + + @{exec_path} mr, + + /usr/share/icons/** r, + + owner @{HOME}/@{XDG_WALLPAPERS_DIR}/** r, + + owner @{user_config_dirs}/hypr/hyprpaper.conf r, + + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/.hyprpaper* rw, + owner @{run}/user/@{uid}/hypr/*/.hyprpaper.sock w, + owner @{run}/user/@{uid}/hyprpaper.lock rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/hypr/hyprpicker b/apparmor.d/groups/hypr/hyprpicker new file mode 100644 index 000000000..bbeb59a71 --- /dev/null +++ b/apparmor.d/groups/hypr/hyprpicker @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/hyprpicker + +profile hyprpicker @{exec_path} { + include + + @{exec_path} mr, + @{bin}/wl-copy Px, + + /usr/share/icons/** r, + + owner @{run}/user/@{uid}/.hyprpicker* rw, + + include if exists +} + +# vim:syntax=apparmor + diff --git a/apparmor.d/groups/hypr/hyprpm b/apparmor.d/groups/hypr/hyprpm new file mode 100644 index 000000000..77c6bfe69 --- /dev/null +++ b/apparmor.d/groups/hypr/hyprpm @@ -0,0 +1,41 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/hyprpm + +profile hyprpm @{exec_path} { + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + + @{exec_path} mr, + + @{bin}/** rix, + @{lib}/gcc/** rix, + @{lib}/git-core/** rix, + + /usr/include/** r, + /usr/share/git-core/** r, + /usr/share/pkgconfig/** r, + + owner @{HOME}/.gitconfig r, + + owner @{user_share_dirs}/hyprpm/{,**} rw, + + /tmp/hyprpm/** rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar new file mode 100644 index 000000000..b740485fd --- /dev/null +++ b/apparmor.d/profiles-s-z/waybar @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/waybar + +profile waybar @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + + network inet dgram, + network inet6 dgram, + network netlink raw, + + @{exec_path} mr, + + @{bin}/** rPUx, + @{user_bin_dirs}/** rPUx, + + owner @{user_config_dirs}/waybar/{,**} r, + + owner /dev/tty@{int} rw, + + include if exists +} + +# vim:syntax=apparmor From 3f16003ff9ec858447342643262f53394167508e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 15 Jul 2024 23:01:04 +0100 Subject: [PATCH 0047/1455] build: ensure hyprland profiles are in complain mode. --- dists/flags/main.flags | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 53631aaeb..3239cd47b 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -173,6 +173,11 @@ gsettings complain gvfsd-dav complain gvfsd-wsdd complain hostnamectl complain +hyprctl complain +hyprlock complain +hyprpaper attach_disconnected,complain +hyprpicker complain +hyprpm complain ibus-engine-table complain ibus-memconf attach_disconnected,complain im-launch complain @@ -376,6 +381,7 @@ virtnetworkd complain,attach_disconnected virtnodedevd attach_disconnected,complain virtsecretd attach_disconnected,complain virtstoraged attach_disconnected,complain +waybar attach_disconnected,complain wg complain wg-quick complain wsdd complain From 8ef9a1824295fccba3fecadbf0b9fd1125c0f754 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 15 Jul 2024 23:02:54 +0100 Subject: [PATCH 0048/1455] refractor: hypr group -> hyprland --- apparmor.d/groups/{hypr => hyprland}/hyprctl | 1 - apparmor.d/groups/{hypr => hyprland}/hyprlock | 1 - apparmor.d/groups/{hypr => hyprland}/hyprpaper | 1 - apparmor.d/groups/{hypr => hyprland}/hyprpicker | 1 - apparmor.d/groups/{hypr => hyprland}/hyprpm | 1 - 5 files changed, 5 deletions(-) rename apparmor.d/groups/{hypr => hyprland}/hyprctl (99%) rename apparmor.d/groups/{hypr => hyprland}/hyprlock (99%) rename apparmor.d/groups/{hypr => hyprland}/hyprpaper (99%) rename apparmor.d/groups/{hypr => hyprland}/hyprpicker (99%) rename apparmor.d/groups/{hypr => hyprland}/hyprpm (99%) diff --git a/apparmor.d/groups/hypr/hyprctl b/apparmor.d/groups/hyprland/hyprctl similarity index 99% rename from apparmor.d/groups/hypr/hyprctl rename to apparmor.d/groups/hyprland/hyprctl index 4c8a72110..f7d41d484 100644 --- a/apparmor.d/groups/hypr/hyprctl +++ b/apparmor.d/groups/hyprland/hyprctl @@ -7,7 +7,6 @@ abi , include @{exec_path} = @{bin}/hyprctl - profile hyprctl @{exec_path} { include include diff --git a/apparmor.d/groups/hypr/hyprlock b/apparmor.d/groups/hyprland/hyprlock similarity index 99% rename from apparmor.d/groups/hypr/hyprlock rename to apparmor.d/groups/hyprland/hyprlock index 9f400c90b..86cc79570 100644 --- a/apparmor.d/groups/hypr/hyprlock +++ b/apparmor.d/groups/hyprland/hyprlock @@ -7,7 +7,6 @@ abi , include @{exec_path} = @{bin}/hyprlock - profile hyprlock @{exec_path} { include include diff --git a/apparmor.d/groups/hypr/hyprpaper b/apparmor.d/groups/hyprland/hyprpaper similarity index 99% rename from apparmor.d/groups/hypr/hyprpaper rename to apparmor.d/groups/hyprland/hyprpaper index 616ff6c57..1005ee8f1 100644 --- a/apparmor.d/groups/hypr/hyprpaper +++ b/apparmor.d/groups/hyprland/hyprpaper @@ -7,7 +7,6 @@ abi , include @{exec_path} = @{bin}/hyprpaper - profile hyprpaper @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/hypr/hyprpicker b/apparmor.d/groups/hyprland/hyprpicker similarity index 99% rename from apparmor.d/groups/hypr/hyprpicker rename to apparmor.d/groups/hyprland/hyprpicker index bbeb59a71..d9af7f884 100644 --- a/apparmor.d/groups/hypr/hyprpicker +++ b/apparmor.d/groups/hyprland/hyprpicker @@ -7,7 +7,6 @@ abi , include @{exec_path} = @{bin}/hyprpicker - profile hyprpicker @{exec_path} { include diff --git a/apparmor.d/groups/hypr/hyprpm b/apparmor.d/groups/hyprland/hyprpm similarity index 99% rename from apparmor.d/groups/hypr/hyprpm rename to apparmor.d/groups/hyprland/hyprpm index 77c6bfe69..5f5ce4c66 100644 --- a/apparmor.d/groups/hypr/hyprpm +++ b/apparmor.d/groups/hyprland/hyprpm @@ -7,7 +7,6 @@ abi , include @{exec_path} = @{bin}/hyprpm - profile hyprpm @{exec_path} { include include From 9b2470462f09766760fee6436927a6df3b97c30d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 15 Jul 2024 23:04:35 +0100 Subject: [PATCH 0049/1455] build: ensure @{exec_path} is present in profile att. --- pkg/prebuild/builder/userspace.go | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/pkg/prebuild/builder/userspace.go b/pkg/prebuild/builder/userspace.go index 9925734c3..8a7df0bc9 100644 --- a/pkg/prebuild/builder/userspace.go +++ b/pkg/prebuild/builder/userspace.go @@ -5,6 +5,7 @@ package builder import ( + "fmt" "regexp" "strings" @@ -12,8 +13,10 @@ import ( "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" ) +const tokATTACHMENT = "@{exec_path}" + var ( - regAttachments = regexp.MustCompile(`(profile .* @{exec_path})`) + regAttachments = regexp.MustCompile(`(profile .* ` + tokATTACHMENT + `)`) ) type Userspace struct { @@ -41,13 +44,18 @@ func (b Userspace) Apply(opt *Option, profile string) (string, error) { if _, err := f.Parse(profile); err != nil { return "", err } + if len(f.GetDefaultProfile().Attachments) > 0 && + f.GetDefaultProfile().Attachments[0] != tokATTACHMENT { + return "", fmt.Errorf("missing '%s' attachment", tokATTACHMENT) + } if err := f.Resolve(); err != nil { return "", err } - att := f.GetDefaultProfile().GetAttachments() + matches := regAttachments.FindAllString(profile, -1) if len(matches) > 0 { - strheader := strings.Replace(matches[0], "@{exec_path}", att, -1) + att := f.GetDefaultProfile().GetAttachments() + strheader := strings.Replace(matches[0], tokATTACHMENT, att, -1) return regAttachments.ReplaceAllLiteralString(profile, strheader), nil } return profile, nil From 6cd01064aee554acd33365e88ce3f00f414e53b9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 15 Jul 2024 23:12:39 +0100 Subject: [PATCH 0050/1455] feat(profile): general update. --- apparmor.d/abstractions/app/sudo | 1 + apparmor.d/abstractions/common/systemd | 2 +- apparmor.d/abstractions/gnome-strict | 2 ++ apparmor.d/groups/_full/default | 5 +---- .../groups/browsers/firefox-crashreporter | 3 +++ .../groups/children/child-modprobe-nvidia | 2 +- apparmor.d/groups/gnome/gdm-session-worker | 1 + apparmor.d/groups/gnome/gsd-media-keys | 1 + apparmor.d/groups/gnome/session-migration | 2 ++ apparmor.d/groups/pacman/aurpublish | 21 ++++++++++++++++--- apparmor.d/groups/systemd/systemd-cryptsetup | 1 + apparmor.d/groups/systemd/systemd-logind | 1 + apparmor.d/groups/systemd/systemd-udevd | 1 + apparmor.d/groups/ubuntu/apport-gtk | 8 +++++-- apparmor.d/profiles-a-f/agetty | 1 + apparmor.d/profiles-a-f/dino-im | 5 ++--- apparmor.d/profiles-a-f/dkms | 2 +- apparmor.d/profiles-a-f/fractal | 2 ++ apparmor.d/profiles-a-f/fwupd | 3 ++- apparmor.d/profiles-g-l/issue-generator | 2 ++ apparmor.d/profiles-g-l/keepassxc | 1 + apparmor.d/profiles-s-z/snapd | 1 + apparmor.d/profiles-s-z/spice-vdagent | 3 +++ apparmor.d/profiles-s-z/steam-gameoverlayui | 1 + apparmor.d/profiles-s-z/sudo | 2 ++ apparmor.d/profiles-s-z/update-ca-trust | 2 +- apparmor.d/profiles-s-z/waybar | 1 - 27 files changed, 59 insertions(+), 18 deletions(-) diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 6fba1adfd..fdd348587 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -41,6 +41,7 @@ / r, /etc/machine-id r, + /var/db/sudo/lectured/ r, owner /var/lib/sudo/ts/ rw, owner /var/lib/sudo/ts/@{uid} rwk, owner /var/log/sudo.log wk, diff --git a/apparmor.d/abstractions/common/systemd b/apparmor.d/abstractions/common/systemd index 0ed3a824b..34e9be9d7 100644 --- a/apparmor.d/abstractions/common/systemd +++ b/apparmor.d/abstractions/common/systemd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - ptrace (read) peer=@{p_systemd}, + ptrace read peer=@{p_systemd}, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, @{sys}/fs/cgroup/system.slice/@{profile_name}.service/memory.pressure rw, diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 891e5a573..e9a06e8aa 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -13,6 +13,8 @@ member=Introspect peer=(name=:*, label=gnome-shell), + /usr/share/icu/@{int}.@{int}/*.dat r, + /usr/{local/,}share/ r, /usr/{local/,}share/glib-@{int}.@{int}/schemas/** r, /usr/{local/,}share/gvfs/remote-volume-monitors/{,*} r, diff --git a/apparmor.d/groups/_full/default b/apparmor.d/groups/_full/default index 8e0a3a535..733d227cb 100644 --- a/apparmor.d/groups/_full/default +++ b/apparmor.d/groups/_full/default @@ -70,11 +70,8 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{MOUNTS}/** rwl, owner @{HOME}/{,**} rwlk, owner @{run}/user/@{uid}/{,**} rw, - owner @{user_config_dirs}/** rwkl, - owner @{user_share_dirs}/** rwkl, owner @{tmp}/{,**} rwk, - - owner @{run}/user/@{uid}/{,**} rw, + owner @{run}/user/@{uid}/{,**} rwlk, @{run}/motd.dynamic.new rw, diff --git a/apparmor.d/groups/browsers/firefox-crashreporter b/apparmor.d/groups/browsers/firefox-crashreporter index c1afb00e4..8d62a6fbf 100644 --- a/apparmor.d/groups/browsers/firefox-crashreporter +++ b/apparmor.d/groups/browsers/firefox-crashreporter @@ -30,6 +30,9 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{bin}/curl rix, + @{bin}/mv rix, + @{lib_dirs}/minidump-analyzer rPx, @{bin}/mv rix, diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index afb48573c..fb91234b0 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -71,7 +71,7 @@ profile child-modprobe-nvidia flags=(attach_disconnected) { # @{sys}/module/{drm,nvidia}/initstate r, @{sys}/module/compression r, - deny @{HOME}/.steam/** r, + deny @{HOME}/.steam/** r, include if exists } diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 48ac848c1..c5b220145 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -29,6 +29,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { capability sys_tty_config, network netlink raw, + network unix stream, signal (receive) set=term peer=gdm, signal (send) set=(hup term) peer=gdm-session, diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 1dee19713..9a799d444 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -27,6 +27,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term, hup) peer=gdm*, + network inet stream, network netlink raw, #aa:dbus own bus=session name=org.gnome.SettingsDaemon.MediaKeys diff --git a/apparmor.d/groups/gnome/session-migration b/apparmor.d/groups/gnome/session-migration index 1f82e7fe0..41c9b28af 100644 --- a/apparmor.d/groups/gnome/session-migration +++ b/apparmor.d/groups/gnome/session-migration @@ -21,6 +21,8 @@ profile session-migration @{exec_path} { owner @{gdm_share_dirs}/session_migration-* rw, owner @{user_share_dirs}/session_migration-* rw, + /dev/tty@{int} rw, + include if exists } diff --git a/apparmor.d/groups/pacman/aurpublish b/apparmor.d/groups/pacman/aurpublish index 8aba909e4..3f46e2fa6 100644 --- a/apparmor.d/groups/pacman/aurpublish +++ b/apparmor.d/groups/pacman/aurpublish @@ -29,7 +29,7 @@ profile aurpublish @{exec_path} { @{bin}/date rix, @{bin}/gettext rix, @{bin}/git rPx, - @{bin}/gpg{,2} rPx, + @{bin}/gpg{,2} rCx -> gpg, @{bin}/grep rix, @{bin}/makepkg rix, @{bin}/mkdir rix, @@ -48,10 +48,9 @@ profile aurpublish @{exec_path} { /etc/makepkg.conf.d/{,**} r, owner @{user_build_dirs}/**/ w, - owner @{user_projects_dirs}/**/ r, + owner @{user_projects_dirs}/** r, owner @{user_projects_dirs}/**/.git/COMMIT_EDITMSG rw, owner @{user_projects_dirs}/**/.SRCINFO rw, - owner @{user_projects_dirs}/**/PKGBUILD r, owner @{user_cache_dirs}/makepkg/src/* rw, owner @{user_config_dirs}/pacman/makepkg.conf r, @@ -62,6 +61,22 @@ profile aurpublish @{exec_path} { /dev/tty rw, + profile gpg { + include + + @{bin}/gpg{,2} mr, + @{bin}/gpgconf mr, + + owner @{HOME}/@{XDG_GPG_DIR}/ rw, + owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + + owner @{user_cache_dirs}/makepkg/src/*.asc r, + + owner @{tmp}/tmp.@{rand10} rw, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-cryptsetup b/apparmor.d/groups/systemd/systemd-cryptsetup index fba766fe8..6ca3e3237 100644 --- a/apparmor.d/groups/systemd/systemd-cryptsetup +++ b/apparmor.d/groups/systemd/systemd-cryptsetup @@ -12,6 +12,7 @@ profile systemd-cryptsetup @{exec_path} { include include + capability dac_read_search, capability ipc_lock, capability net_admin, capability sys_admin, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 855d0d58c..d5c7b963e 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -63,6 +63,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { /var/lib/systemd/linger/ r, @{run}/.#nologin* rw, + @{run}/credentials/getty@tty@{int}.service/ r, @{run}/host/container-manager r, @{run}/nologin rw, @{run}/utmp rk, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 76a7e21ca..8b1351997 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -52,6 +52,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{bin}/more rPx -> child-pager, @{bin}/multipath rPx, @{bin}/nfsrahead rix, + @{bin}/nvidia-modprobe rPx -> child-modprobe-nvidia, @{bin}/pager rPx -> child-pager, @{bin}/perl rix, @{bin}/setfacl rix, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index a63f38890..0fd5fb7d9 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -51,6 +51,7 @@ profile apport-gtk @{exec_path} { @{bin}/pkexec rPx, # TODO: rCx or something @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, + @{bin}/uname rix, @{bin}/which{,.debianutils} rix, @{lib}/{,colord/}colord-sane rPx, @{lib}/@{multiarch}/ld*.so* rix, @@ -60,8 +61,8 @@ profile apport-gtk @{exec_path} { /usr/share/apport/general-hooks/*.py r, /etc/apport/{,**} r, - /etc/cloud/cloud.cfg.d/{,**} r, /etc/bash_completion.d/apport_completion r, + /etc/cloud/{,**} r, /etc/cron.daily/apport r, /etc/default/apport r, /etc/gtk-3.0/settings.ini r, @@ -69,13 +70,15 @@ profile apport-gtk @{exec_path} { /etc/logrotate.d/apport r, /etc/xdg/autostart/*.desktop r, - /var/crash/{,*.@{uid}.crash} rw, /var/lib/dpkg/info/ r, /var/lib/dpkg/info/*.list r, /var/lib/usbutils/*.ids r, /var/lib/dpkg/info/*.md5sums r, /var/log/installer/media-info r, + /var/crash/ rw, + owner /var/crash/*.@{uid}.{crash,upload} rw, + @{run}/snapd.socket rw, /tmp/[a-z0-9]* rw, @@ -104,6 +107,7 @@ profile apport-gtk @{exec_path} { @{bin}/* r, /usr/share/gcc/python/{,**/}__pycache__/{,**} rw, + /usr/share/gdb/python/{,**/}__pycache__/{,**} rw, /usr/share/gdb/{,**} r, /usr/share/glib-2.0/schemas/gschemas.compiled r, diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/profiles-a-f/agetty index c1436f9ad..ec711895d 100644 --- a/apparmor.d/profiles-a-f/agetty +++ b/apparmor.d/profiles-a-f/agetty @@ -34,6 +34,7 @@ profile agetty @{exec_path} { /etc/os-release r, /usr/etc/login.defs r, + @{run}/credentials/getty@tty@{int}.service/ r, @{run}/credentials/serial-getty@ttyS@{int}.service/ r, owner @{run}/agetty.reload rw, diff --git a/apparmor.d/profiles-a-f/dino-im b/apparmor.d/profiles-a-f/dino-im index f06989836..07fba44a5 100644 --- a/apparmor.d/profiles-a-f/dino-im +++ b/apparmor.d/profiles-a-f/dino-im @@ -11,10 +11,8 @@ include profile dino-im @{exec_path} { include include + include include - include - include - include include include @@ -46,6 +44,7 @@ profile dino-im @{exec_path} { owner @{HOME}/.gnupg/ rw, owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 03fab4ec9..6d836c63d 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -104,7 +104,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) { owner /boot/System.map-* r, - audit owner @{tmp}/tmp.* r, + owner @{tmp}/tmp.@{rand10} r, @{sys}/module/compression r, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index c6355c2ff..c7df958f7 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -23,6 +23,8 @@ profile fractal @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + /usr/share/xml/iso-codes/{,**} r, + owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index a2cfea343..474ab630b 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -142,7 +142,8 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) { owner /var/lib/fwupd/gnupg/ rw, owner /var/lib/fwupd/gnupg/** rwkl -> /var/lib/fwupd/gnupg/**, - owner @{PROC}/@{pids}/fd/ r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists } diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index a54b024ad..00600b72b 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -26,6 +26,8 @@ profile issue-generator @{exec_path} { @{run}/issue.@{rand10} rw, @{run}/issue.d/{,**} r, + /dev/tty rw, + include if exists } diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index 20be091cc..f79a3464e 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -74,6 +74,7 @@ profile keepassxc @{exec_path} { owner @{tmp}/keepassxc-*.socket rw, owner @{tmp}/keepassxc.lock rw, owner @{tmp}/keepassxc.socket rw, + owner @{tmp}/runtime-user/ w, owner @{run}/user/@{pid}/app/ w, owner @{run}/user/@{pid}/app/org.keepassxc.KeePassXC/{,**} rw, diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index 3892a8ca4..fa5ef1956 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -40,6 +40,7 @@ profile snapd @{exec_path} { network inet dgram, network inet6 dgram, network netlink raw, + network unix stream, mount fstype=squashfs /dev/loop@{int} -> /tmp/syscheck-mountpoint-@{int}/, umount /tmp/syscheck-mountpoint-@{int}/, diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index c2fd27ced..93be9c783 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -41,6 +41,9 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { @{run}/spice-vdagentd/spice-vdagent-sock rw, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + owner @{PROC}/@{pids}/task/@{tid}/comm rw, owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui index bbe2452e2..077e6cf8b 100644 --- a/apparmor.d/profiles-s-z/steam-gameoverlayui +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -18,6 +18,7 @@ profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) { include include include + include include network inet stream, diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index 0ba2694bd..6f4e290d6 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -35,6 +35,8 @@ profile sudo @{exec_path} flags=(attach_disconnected) { /opt/*/** PUx, /snap/snapd/@{int}@{bin}/snap rPUx, + /etc/default/locale r, + /var/db/sudo/lectured/ r, owner /var/db/sudo/lectured/@{uid} rw, owner /var/lib/extrausers/shadow r, diff --git a/apparmor.d/profiles-s-z/update-ca-trust b/apparmor.d/profiles-s-z/update-ca-trust index 6e70a0310..8b69cd1f4 100644 --- a/apparmor.d/profiles-s-z/update-ca-trust +++ b/apparmor.d/profiles-s-z/update-ca-trust @@ -26,7 +26,7 @@ profile update-ca-trust @{exec_path} { /etc/ca-certificates/extracted/** rw, /etc/ssl/certs/{,*} rw, - /etc/ssl/certs/java/cacerts{,.*} w, + /etc/ssl/certs/java/** rw, /dev/tty rw, diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index b740485fd..d5116b043 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -7,7 +7,6 @@ abi , include @{exec_path} = @{bin}/waybar - profile waybar @{exec_path} flags=(attach_disconnected) { include include From 960135e593c9a2ea16ce5e3af0d63c133594bdcf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 15 Jul 2024 23:18:04 +0100 Subject: [PATCH 0051/1455] test(build): update userspace unit test. --- pkg/prebuild/builder/core_test.go | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/pkg/prebuild/builder/core_test.go b/pkg/prebuild/builder/core_test.go index c242259f9..597832b91 100644 --- a/pkg/prebuild/builder/core_test.go +++ b/pkg/prebuild/builder/core_test.go @@ -228,14 +228,8 @@ func TestBuilder_Apply(t *testing.T) { include if exists }`, - want: ` - profile foo /usr/bin/foo { - include - - /usr/bin/foo mr, - - include if exists - }`, + want: "", + wantErr: true, }, } for _, tt := range tests { From cb30dcc4bc874f9745afe145191be5016df3122b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 15 Jul 2024 23:47:01 +0100 Subject: [PATCH 0052/1455] feat(profile): general update. see #416 --- apparmor.d/groups/cron/crontab | 8 ++++---- apparmor.d/groups/gnome/gnome-shell | 7 +++++-- apparmor.d/groups/gnome/gsd-smartcard | 6 +++--- apparmor.d/groups/network/dhcpcd | 14 +++----------- apparmor.d/profiles-g-l/git | 2 +- apparmor.d/profiles-m-r/nft | 6 +++--- apparmor.d/profiles-s-z/udisksd | 3 ++- 7 files changed, 21 insertions(+), 25 deletions(-) diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index c1fae96e4..3490199a1 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -25,6 +25,7 @@ profile crontab @{exec_path} { @{bin}/vim.* rCx -> editor, /etc/cron.{allow,deny} r, + /etc/pam.d/* r, /var/spool/cron/ r, /var/spool/cron/crontabs/ rw, @@ -32,19 +33,18 @@ profile crontab @{exec_path} { owner @{tmp}/crontab.*/{,crontab} rw, - profile editor { include include capability fsetid, + /etc/cron.{allow,deny} r, + /tmp/ r, owner @{tmp}/crontab.*/crontab rw, - # file_inherit - /etc/cron.{allow,deny} r, - + include if exists } include if exists diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 5e469e625..4e36f1020 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -218,6 +218,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /.flatpak-info r, /etc/fstab r, /etc/timezone r, + /etc/tpm2-tss/*.json r, /etc/udev/hwdb.bin r, /etc/xdg/menus/gnome-applications.menu r, @@ -249,10 +250,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{HOME}/.face r, owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r, - owner @{HOME}/.var/app/**/ r, + owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw, owner @{HOME}/.var/app/**.{png,jpg,svg} r, + owner @{HOME}/.var/app/**/ r, owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} rw, - owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, + owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} rw, owner @{user_games_dirs}/**.{png,jpg,svg} r, owner @{user_music_dirs}/**.{png,jpg,svg} r, @@ -282,6 +284,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_cache_dirs}/vlc/**/*.jpg r, @{run}/gdm{3,}/dbus/dbus-@{rand8} rw, + owner @{run}/user/@{uid}/app/*/*.@{rand6} r, owner @{run}/user/@{uid}/gnome-shell-disable-extensions rw, owner @{run}/user/@{uid}/gnome-shell/{,**} rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index b0ff24b58..0f04ae120 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -31,16 +31,16 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { /usr/share/glib-2.0/schemas/gschemas.compiled r, /etc/{,opensc/}opensc.conf r, - /etc/tpm2-tss/* r, + /etc/tpm2-tss/* rk, /var/tmp/ r, /tmp/ r, - owner @{GDM_HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw, + owner @{GDM_HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3{,.lock} rwk, owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, - owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw, + owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3{,.lock} rwk, owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/network/dhcpcd b/apparmor.d/groups/network/dhcpcd index e1b039ad8..79b7283eb 100644 --- a/apparmor.d/groups/network/dhcpcd +++ b/apparmor.d/groups/network/dhcpcd @@ -39,20 +39,12 @@ profile dhcpcd @{exec_path} flags=(attach_disconnected) { @{bin}/sed rix, @{lib}/dhcpcd/dhcpcd-run-hooks rix, - /var/lib/dhcpcd/*.lease{,6} rw, - /var/lib/dhcpcd/secret rw, - /etc/dhcpcd.conf r, /etc/resolv.conf rw, - @{run}/dhcpcd/{.pid,pid} rwk, - @{run}/dhcpcd/{.sock,sock} w, - @{run}/dhcpcd/*.pid wk, - @{run}/dhcpcd/*.sock w, - @{run}/dhcpcd/hook-state/ rw, - @{run}/dhcpcd/hook-state/resolv.conf.*.{dhcp,link} rw, - @{run}/dhcpcd/hook-state/resolv.conf/ rw, - @{run}/dhcpcd/unpriv.sock w, + /var/lib/dhcpcd/** rw, + + @{run}/dhcpcd/** rwk, @{run}/udev/data/n@{int} r, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index e03479003..ba37f7bcc 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -24,7 +24,7 @@ profile git @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, - signal (send) peer=aurpublish, + signal send peer=aurpublish, @{exec_path} mrix, diff --git a/apparmor.d/profiles-m-r/nft b/apparmor.d/profiles-m-r/nft index 50ee826cf..1255ca401 100644 --- a/apparmor.d/profiles-m-r/nft +++ b/apparmor.d/profiles-m-r/nft @@ -20,9 +20,9 @@ profile nft @{exec_path} { @{exec_path} mr, - owner /etc/iproute2/** r, - - owner /etc/nftables/**.nft r, + /etc/iproute2/** r, + /etc/nftables.conf r, + /etc/nftables/{,**} r, @{PROC}/1/environ r, @{PROC}/cmdline r, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 365044702..83561941c 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -118,12 +118,13 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{sys}/bus/ r, @{sys}/bus/pci/slots/ r, + @{sys}/bus/pci/slots/@{int}/address r, @{sys}/class/ r, @{sys}/class/nvme-subsystem/ r, @{sys}/class/nvme/ r, - @{sys}/devices/@{pci}/uevent r, @{sys}/devices/@{pci}/{ata,usb,mmc,virtio}[0-9]/{,**/}uevent w, @{sys}/devices/@{pci}/{ata,usb,mmc}[0-9]/{,**/}remove rw, + @{sys}/devices/@{pci}/uevent r, @{sys}/devices/virtual/bdi/**/read_ahead_kb r, @{sys}/devices/virtual/block/*/{,**} rw, @{sys}/devices/virtual/block/loop@{int}/uevent rw, From ef9000e59edb1a93645514f02423a6e40a2dd1a5 Mon Sep 17 00:00:00 2001 From: REmerald <55359236+REmerald@users.noreply.github.com> Date: Sun, 14 Jul 2024 14:56:37 +0300 Subject: [PATCH 0053/1455] Update firewalld Add changes from aa-log -r. Add attach_disconnected. Add profile to main.flags, it was missing there for some reason. There's some uncertainty about some lines, see comments. --- apparmor.d/profiles-a-f/firewalld | 25 +++++++++++++++++++++++-- dists/flags/main.flags | 1 + 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/profiles-a-f/firewalld index 143719f0d..fdca331a4 100644 --- a/apparmor.d/profiles-a-f/firewalld +++ b/apparmor.d/profiles-a-f/firewalld @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/firewalld -profile firewalld @{exec_path} { +profile firewalld @{exec_path} flags=(attach_disconnected) { include include include @@ -15,10 +15,12 @@ profile firewalld @{exec_path} { include include + capability dac_read_search, capability mknod, capability net_admin, capability net_raw, capability setpcap, + capability sys_module, network inet raw, network inet6 raw, @@ -50,10 +52,11 @@ profile firewalld @{exec_path} { @{bin}/false rix, @{bin}/ipset rix, @{bin}/kmod rPx, + @{bin}/modprobe rPx, @{bin}/xtables-legacy-multi rix, @{bin}/xtables-nft-multi rix, - /usr/local/lib/python3.10/dist-packages/ r, + /usr/local/lib/python*/dist-packages/ r, /usr/share/libalternatives/ r, /usr/share/libalternatives/ebtables*/{,*} r, @@ -62,20 +65,38 @@ profile firewalld @{exec_path} { /etc/firewalld/{,**} rw, /etc/iproute2/group r, /etc/iproute2/rt_realms r, + # Maybe change to as in kmod,lspci,...? + # /etc/modprobe.d/{,*.conf} r, + /etc/modprobe.d/ r, + /etc/modprobe.d/firewalld-sysctls.conf r, /var/lib/ebtables/lock rwk, /var/log/firewalld rw, @{run}/firewalld/{,*} rw, + @{run}/modprobe.d/ r, # Maybe change to as in kmod,lspci? + # @{run}/modprobe.d/{,*.conf} r, @{run}/xtables.lock rwk, + @{PROC}/cmdline r, @{PROC}/sys/kernel/modprobe r, @{PROC}/sys/net/ipv{4,6}/ip_forward rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pids}/net/ip_tables_names r, + @{sys}/module/compression r, + # Maybe change to as in systemd-modules-load? + # @{sys}/module/*/initstate r, + @{sys}/module/crc32c_generic/initstate r, + @{sys}/module/crc32c_intel/initstate r, + @{sys}/module/libcrc32c/initstate r, + @{sys}/module/nf_conntrack/initstate r, + @{sys}/module/nf_conntrack_tftp/initstate r, + @{sys}/module/nf_defrag_ipv{4,6}/initstate r, + @{sys}/module/nf_nat/initstate r, + include if exists } diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 3239cd47b..737531b47 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -106,6 +106,7 @@ fail2ban-server attach_disconnected,complain fdisk complain firewall-applet attach_disconnected,complain firewall-config complain +firewalld attach_disconnected,complain flameshot complain flatpak attach_disconnected,mediate_deleted,complain flatpak-app attach_disconnected,mediate_deleted,complain From d96550cd279370913fa36f12a960aa5cc6c286c8 Mon Sep 17 00:00:00 2001 From: REmerald <55359236+REmerald@users.noreply.github.com> Date: Tue, 16 Jul 2024 17:25:02 +0300 Subject: [PATCH 0054/1455] firewalld: make changes from the reviews See #441 Also, I changed @{run}/modprobe.d/ to @{run}/modprobe.d/{,*.conf} --- apparmor.d/profiles-a-f/firewalld | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/profiles-a-f/firewalld index fdca331a4..1d683c327 100644 --- a/apparmor.d/profiles-a-f/firewalld +++ b/apparmor.d/profiles-a-f/firewalld @@ -14,6 +14,7 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { include include include + include capability dac_read_search, capability mknod, @@ -51,12 +52,12 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{bin}/ebtables-legacy-restore rix, @{bin}/false rix, @{bin}/ipset rix, - @{bin}/kmod rPx, + @{bin}/kmod rix, @{bin}/modprobe rPx, @{bin}/xtables-legacy-multi rix, @{bin}/xtables-nft-multi rix, - /usr/local/lib/python*/dist-packages/ r, + /usr/local/lib/python3.@{int}/dist-packages/ r, /usr/share/libalternatives/ r, /usr/share/libalternatives/ebtables*/{,*} r, @@ -65,38 +66,28 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { /etc/firewalld/{,**} rw, /etc/iproute2/group r, /etc/iproute2/rt_realms r, - # Maybe change to as in kmod,lspci,...? - # /etc/modprobe.d/{,*.conf} r, - /etc/modprobe.d/ r, - /etc/modprobe.d/firewalld-sysctls.conf r, /var/lib/ebtables/lock rwk, /var/log/firewalld rw, @{run}/firewalld/{,*} rw, - @{run}/modprobe.d/ r, # Maybe change to as in kmod,lspci? - # @{run}/modprobe.d/{,*.conf} r, + @{run}/modprobe.d/{,*.conf} r, @{run}/xtables.lock rwk, - @{PROC}/cmdline r, + @{sys}/module/compression r, + @{sys}/module/crc32c_{generic,intel}/initstate r, + @{sys}/module/libcrc32c/initstate r, + @{sys}/module/nf_conntrack{,_tftp}/initstate r, + @{sys}/module/nf_defrag_ipv{4,6}/initstate r, + @{sys}/module/nf_nat/initstate r, + @{PROC}/sys/kernel/modprobe r, @{PROC}/sys/net/ipv{4,6}/ip_forward rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pids}/net/ip_tables_names r, - @{sys}/module/compression r, - # Maybe change to as in systemd-modules-load? - # @{sys}/module/*/initstate r, - @{sys}/module/crc32c_generic/initstate r, - @{sys}/module/crc32c_intel/initstate r, - @{sys}/module/libcrc32c/initstate r, - @{sys}/module/nf_conntrack/initstate r, - @{sys}/module/nf_conntrack_tftp/initstate r, - @{sys}/module/nf_defrag_ipv{4,6}/initstate r, - @{sys}/module/nf_nat/initstate r, - include if exists } From d05c9b92765412aa0e0dc8824fb3f2598ad4fcf0 Mon Sep 17 00:00:00 2001 From: odomingao Date: Fri, 19 Jul 2024 13:54:08 -0300 Subject: [PATCH 0055/1455] Fix hyprpicker (#418) --- apparmor.d/groups/hyprland/hyprpicker | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/groups/hyprland/hyprpicker b/apparmor.d/groups/hyprland/hyprpicker index d9af7f884..77edc07dc 100644 --- a/apparmor.d/groups/hyprland/hyprpicker +++ b/apparmor.d/groups/hyprland/hyprpicker @@ -16,6 +16,9 @@ profile hyprpicker @{exec_path} { /usr/share/icons/** r, owner @{run}/user/@{uid}/.hyprpicker* rw, + owner /dev/shm/wlroots-@{rand6} r, + + owner /dev/tty@{int} rw, include if exists } From aaf435ece166d4fc0765fd96b2554293184f5bcc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 19 Jul 2024 19:22:32 +0100 Subject: [PATCH 0056/1455] feat(profile): general update. --- .../abstractions/freedesktop.org.d/complete | 2 -- apparmor.d/groups/grub/grub-mkconfig | 4 ++- apparmor.d/groups/grub/grub-probe | 2 ++ apparmor.d/groups/systemd/systemd-logind | 2 ++ apparmor.d/profiles-a-f/firewalld | 27 ++++--------------- apparmor.d/profiles-g-l/ifup | 6 ++--- apparmor.d/profiles-m-r/os-prober | 6 +++-- apparmor.d/profiles-s-z/wsdd | 3 +++ 8 files changed, 21 insertions(+), 31 deletions(-) diff --git a/apparmor.d/abstractions/freedesktop.org.d/complete b/apparmor.d/abstractions/freedesktop.org.d/complete index 3e669f4dc..ed4f067a5 100644 --- a/apparmor.d/abstractions/freedesktop.org.d/complete +++ b/apparmor.d/abstractions/freedesktop.org.d/complete @@ -13,8 +13,6 @@ @{system_share_dirs}/ r, @{system_share_dirs}/mime/ r, - /usr/share/mime/ r, - /etc/gnome/defaults.list r, /etc/xfce4/defaults.list r, diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index d44ffcf3d..cd9c825f6 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -32,6 +32,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { @{bin}/find rix, @{bin}/findmnt rPx, @{bin}/gettext rix, + @{bin}/grub-editenv rPx, @{bin}/grub-mkrelpath rPx, @{bin}/grub-probe rPx, @{bin}/grub-script-check rPx, @@ -60,6 +61,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { @{bin}/zpool rPx, /etc/grub.d/{,**} rix, + @{lib}/grub-customizer/* rix, @{lib}/grub/grub-sort-version rPx, @{lib}/libostree/grub[0-9]-@{int}_ostree rix, @@ -81,7 +83,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { /boot/{,**} r, /boot/grub/{,**} rw, - # owner /tmp/** rw, + /tmp/grub-*.@{rand10}/{,**} rw, @{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r, diff --git a/apparmor.d/groups/grub/grub-probe b/apparmor.d/groups/grub/grub-probe index f0bbf8e41..d0ef6b78b 100644 --- a/apparmor.d/groups/grub/grub-probe +++ b/apparmor.d/groups/grub/grub-probe @@ -13,6 +13,7 @@ profile grub-probe @{exec_path} { include include + capability dac_read_search, capability sys_admin, @{exec_path} mr, @@ -36,6 +37,7 @@ profile grub-probe @{exec_path} { /dev/bus/ r, /dev/bus/usb/ r, /dev/bus/usb/@{int}/ r, + /dev/char/ r, /dev/cpu/ r, /dev/cpu/@{int}/ r, /dev/dma_heap/ r, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index d5c7b963e..9a0a2c7d7 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -79,7 +79,9 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+hid:* r, @{run}/udev/data/+i2c:* r, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/+leds:* r, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) + @{run}/udev/data/+wakeup:* r, @{run}/udev/data/c1:@{int} r, # For RAM disk @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features @{run}/udev/data/c13:@{int} r, # For /dev/input/* diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/profiles-a-f/firewalld index 1d683c327..ea083ed96 100644 --- a/apparmor.d/profiles-a-f/firewalld +++ b/apparmor.d/profiles-a-f/firewalld @@ -9,12 +9,12 @@ include @{exec_path} = @{bin}/firewalld profile firewalld @{exec_path} flags=(attach_disconnected) { include + include include include - include include + include include - include capability dac_read_search, capability mknod, @@ -27,21 +27,6 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { network inet6 raw, network netlink raw, - dbus receive bus=system path=/org/fedoraproject/FirewallD1 - interface=org.fedoraproject.FirewallD1.direct - member=passthrough - peer=(name=:*, label=libvirtd), - - dbus receive bus=system path=/org/fedoraproject/FirewallD1 - interface=org.fedoraproject.FirewallD1.zone - member={changeZoneOfInterface,getZones} - peer=(name=:*, label=libvirtd), - - dbus receive bus=system path=/org/fedoraproject/FirewallD1 - interface=org.fedoraproject.FirewallD1.zone - member={changeZoneOfInterface,removeInterface} - peer=(name=:*, label=libvirtd), - #aa:dbus own bus=system name=org.fedoraproject.FirewallD1 @{exec_path} mr, @@ -53,7 +38,7 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{bin}/false rix, @{bin}/ipset rix, @{bin}/kmod rix, - @{bin}/modprobe rPx, + @{bin}/modprobe rix, @{bin}/xtables-legacy-multi rix, @{bin}/xtables-nft-multi rix, @@ -76,11 +61,9 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{run}/xtables.lock rwk, @{sys}/module/compression r, - @{sys}/module/crc32c_{generic,intel}/initstate r, + @{sys}/module/crc32c_*/initstate r, @{sys}/module/libcrc32c/initstate r, - @{sys}/module/nf_conntrack{,_tftp}/initstate r, - @{sys}/module/nf_defrag_ipv{4,6}/initstate r, - @{sys}/module/nf_nat/initstate r, + @{sys}/module/nf_*/initstate r, @{PROC}/sys/kernel/modprobe r, @{PROC}/sys/net/ipv{4,6}/ip_forward rw, diff --git a/apparmor.d/profiles-g-l/ifup b/apparmor.d/profiles-g-l/ifup index e621bd7f0..4788daeb6 100644 --- a/apparmor.d/profiles-g-l/ifup +++ b/apparmor.d/profiles-g-l/ifup @@ -106,10 +106,8 @@ profile ifup @{exec_path} { profile sysctl { include -# capability mac_admin, - capability net_admin, - capability sys_admin, -# capability sys_resource, + capability net_admin, + capability sys_admin, @{bin}/sysctl mr, diff --git a/apparmor.d/profiles-m-r/os-prober b/apparmor.d/profiles-m-r/os-prober index 819c4c9bd..c9c9ea2df 100644 --- a/apparmor.d/profiles-m-r/os-prober +++ b/apparmor.d/profiles-m-r/os-prober @@ -10,6 +10,7 @@ include profile os-prober @{exec_path} flags=(attach_disconnected) { include include + include capability dac_read_search, capability sys_admin, @@ -59,11 +60,12 @@ profile os-prober @{exec_path} flags=(attach_disconnected) { / r, /boot/{efi/,} r, /boot/{efi/,}EFI/ r, - /boot/{efi/,}EFI/*/ r, + /boot/{efi/,}EFI/**/ r, owner @{tmp}/os-prober.*/{,**} rw, - @{sys}/block/ r, + @{run}/mount/utab r, + @{sys}/devices/@{pci}/block/*/ r, @{sys}/devices/virtual/block/*/ r, diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd index 92b0f360f..56a852d11 100644 --- a/apparmor.d/profiles-s-z/wsdd +++ b/apparmor.d/profiles-s-z/wsdd @@ -10,9 +10,12 @@ include profile wsdd @{exec_path} { include include + include network inet dgram, + network inet stream, network inet6 dgram, + network inet6 stream, network netlink raw, @{exec_path} mr, From 6073dc491f0fdd56f83bcfd2beb74a07591badad Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 19 Jul 2024 19:23:48 +0100 Subject: [PATCH 0057/1455] feat(profile): add nvidia-smi. --- apparmor.d/profiles-m-r/nvidia-smi | 34 ++++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 35 insertions(+) create mode 100644 apparmor.d/profiles-m-r/nvidia-smi diff --git a/apparmor.d/profiles-m-r/nvidia-smi b/apparmor.d/profiles-m-r/nvidia-smi new file mode 100644 index 000000000..571ab3311 --- /dev/null +++ b/apparmor.d/profiles-m-r/nvidia-smi @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/nvidia-smi +profile nvidia-smi @{exec_path} { + include + include + include + + @{exec_path} mr, + + @{sys}/devices/system/node/ r, + @{sys}/devices/system/node/node@{int}/cpumap r, + + @{PROC}/devices r, + @{PROC}/driver/nvidia/capabilities/mig/config r, + @{PROC}/driver/nvidia/capabilities/mig/monitor r, + owner @{PROC}/@{pid}/cmdline r, + + /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 + /dev/nvidia-caps/ rw, + /dev/nvidia-caps/nvidia-cap@{int} r, + /dev/nvidia-uvm rw, + /dev/nvidia-uvm-tools r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 737531b47..57862b8ce 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -255,6 +255,7 @@ nmap complain nmcli complain nvidia-detector complain nvidia-persistenced complain +nvidia-smi complain okular complain ollama attach_disconnected,complain os-prober attach_disconnected,complain From 245898a9d2da324c99f33dded2406be659ff7806 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 20 Jul 2024 13:06:30 +0100 Subject: [PATCH 0058/1455] feat(profile): ensure any gnome extension can be launched. see #422 --- apparmor.d/groups/bus/dbus-session | 1 + apparmor.d/groups/gnome/gnome-extension-ding | 7 +++++-- apparmor.d/groups/gnome/gnome-extension-gsconnect | 4 ++-- apparmor.d/groups/gnome/gnome-shell | 3 ++- 4 files changed, 10 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index 423df6a26..d3da171f1 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -40,6 +40,7 @@ profile dbus-session flags=(attach_disconnected) { @{bin}/** PUx, @{lib}/** PUx, + @{user_share_dirs}/*/** PUx, /usr/share/*/** PUx, /etc/dbus-1/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index d8c5a9cfe..1cef7f074 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -6,7 +6,10 @@ abi , include -@{exec_path} = /usr/share/gnome-shell/extensions/ding@rastersoft.com/{,app/}ding.js +@{share_dirs} = /usr/share/gnome-shell/extensions/ding@rastersoft.com +@{share_dirs} += @{user_share_dirs}/gnome-shell/extensions/ding@rastersoft.com + +@{exec_path} = @{share_dirs}/{,app/}ding.js profile gnome-extension-ding @{exec_path} { include include @@ -57,7 +60,7 @@ profile gnome-extension-ding @{exec_path} { @{bin}/gnome-control-center rPx, @{bin}/nautilus rPx, - /usr/share/gnome-shell/extensions/ding@rastersoft.com/{,app/}* r, + @{share_dirs}/{,**} r, /usr/share/thumbnailers/{,*.thumbnailer} r, owner @{HOME}/@{XDG_TEMPLATES_DIR}/ r, diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 5808aecad..10db5f66d 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -6,8 +6,8 @@ abi , include -@{share_dirs} = /usr/share/gnome-shell/extensions/gsconnect@andyholmes.github.io/ -@{share_dirs} += @{user_share_dirs}/gnome-shell/extensions/gsconnect@andyholmes.github.io/ +@{share_dirs} = /usr/share/gnome-shell/extensions/gsconnect@andyholmes.github.io +@{share_dirs} += @{user_share_dirs}/gnome-shell/extensions/gsconnect@andyholmes.github.io @{exec_path} = @{share_dirs}/service/daemon.js profile gnome-extension-gsconnect @{exec_path} { diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 4e36f1020..0e68c90a9 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -188,7 +188,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{lib}/gio-launch-desktop rCx -> open, @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, - /usr/share/gnome-shell/extensions/ding@rastersoft.com/{,*/}ding.js rPx, + @{user_share_dirs}/gnome-shell/extensions/*/** rPUx, + /usr/share/gnome-shell/extensions/*/** rPUx, /opt/**/share/icons/{,**} r, /opt/*/**/*.png r, From 52a2ae8c230cf85767eb99e2d7479bcf2e5647b1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 20 Jul 2024 13:13:27 +0100 Subject: [PATCH 0059/1455] feat(profile): general update. see #422 --- apparmor.d/abstractions/app-open | 3 +++ apparmor.d/abstractions/app/firefox | 9 ++++++--- apparmor.d/groups/browsers/firefox-crashreporter | 2 ++ apparmor.d/groups/bus/dbus-session | 2 ++ apparmor.d/groups/freedesktop/plymouthd | 1 + apparmor.d/groups/gnome/gnome-extension-gsconnect | 12 ++---------- apparmor.d/groups/gnome/gnome-keyring-daemon | 1 + apparmor.d/groups/gnome/gnome-software | 1 + apparmor.d/groups/gnome/gnome-tweaks | 4 ++++ apparmor.d/groups/gpg/gpg | 2 ++ apparmor.d/groups/ssh/ssh | 5 ++--- apparmor.d/profiles-a-f/agetty | 2 +- apparmor.d/profiles-a-f/file-roller | 1 + apparmor.d/profiles-a-f/firewalld | 4 +--- apparmor.d/profiles-m-r/pcscd | 3 ++- apparmor.d/profiles-m-r/power-profiles-daemon | 1 + apparmor.d/profiles-s-z/smartd | 6 ++---- apparmor.d/profiles-s-z/su | 2 ++ apparmor.d/profiles-s-z/w3m | 15 ++++++++++++--- 19 files changed, 48 insertions(+), 28 deletions(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 942e0a55b..8c4efc350 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -50,6 +50,9 @@ @{bin}/vlc rPUx, @{bin}/xbrlapi rPx, + #aa:only opensuse + @{lib}/YaST2/** rPUx, + include if exists diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index bf86f419c..9de4359e1 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -100,6 +100,12 @@ owner @{tmp}/tmpaddon r, owner @{tmp}/tmpaddon-@{int} r, + owner /dev/shm/org.chromium.@{rand6} rw, + owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, + owner /dev/shm/wayland.mozilla.ipc.@{int} rw, + + owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer w, + @{run}/mount/utab r, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @@ -144,9 +150,6 @@ /dev/hidraw@{int} rw, /dev/tty rw, /dev/video@{int} rw, - owner /dev/shm/org.chromium.* rw, - owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, - owner /dev/shm/wayland.mozilla.ipc.@{int} rw, owner /dev/tty@{int} rw, # File Inherit # Silencer diff --git a/apparmor.d/groups/browsers/firefox-crashreporter b/apparmor.d/groups/browsers/firefox-crashreporter index 8d62a6fbf..5223486d0 100644 --- a/apparmor.d/groups/browsers/firefox-crashreporter +++ b/apparmor.d/groups/browsers/firefox-crashreporter @@ -54,6 +54,8 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) { owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r, + owner @{PROC}/@{pid}/cmdline r, + /dev/dri/card@{int} rw, /dev/dri/renderD128 rw, diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index d3da171f1..e5e382795 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -54,6 +54,8 @@ profile dbus-session flags=(attach_disconnected) { owner @{HOME}/.var/app/*/**/.ref rw, owner @{HOME}/.var/app/*/**/logs/* rw, + owner @{user_share_dirs}/dbus-1/services/{,**} r, + @{run}/systemd/users/@{uid} r, owner @{run}/user/@{uid}/dbus-1/ rw, owner @{run}/user/@{uid}/dbus-1/services/ rw, diff --git a/apparmor.d/groups/freedesktop/plymouthd b/apparmor.d/groups/freedesktop/plymouthd index 16e87a50d..815375f20 100644 --- a/apparmor.d/groups/freedesktop/plymouthd +++ b/apparmor.d/groups/freedesktop/plymouthd @@ -42,6 +42,7 @@ profile plymouthd @{exec_path} { /etc/vconsole.conf r, /var/lib/plymouth/{,**} rw, + /var/log/plymouth-*.log w, @{run}/plymouth/{,**} rw, diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 10db5f66d..3083c73f9 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -17,9 +17,7 @@ profile gnome-extension-gsconnect @{exec_path} { include include include - include - include - include + include include include include @@ -32,10 +30,10 @@ profile gnome-extension-gsconnect @{exec_path} { @{exec_path} mr, + @{sh_path} rix, @{bin}/env rix, @{bin}/gjs-console rix, @{bin}/openssl rix, - @{sh_path} rix, @{bin}/ssh-add rix, @{bin}/ssh-keygen rPx, @@ -49,18 +47,12 @@ profile gnome-extension-gsconnect @{exec_path} { @{share_dirs}/{,**} r, @{share_dirs}/gsconnect-preferences rix, - /etc/machine-id r, - owner @{user_cache_dirs}/gsconnect/{,**} rw, - owner @{user_config_dirs}/ r, - owner @{user_config_dirs}/gsconnect/{,**} rw, owner @{user_config_dirs}/mimeapps.list w, owner @{user_config_dirs}/mimeapps.list.@{rand6} rw, - owner @{user_share_dirs}/ r, - owner @{run}/user/@{uid}/gsconnect/ w, @{sys}/devices/virtual/dmi/id/chassis_type r, diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index 722a69fe7..5d945b641 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -38,6 +38,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { @{bin}/ssh-add rix, @{bin}/ssh-agent rPx, + @{lib}/gcr-ssh-askpass rPUx, /etc/gcrypt/hwf.deny r, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index ddb95f1b9..b1a0bd8ac 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -78,6 +78,7 @@ profile gnome-software @{exec_path} { owner @{user_cache_dirs}/flatpak/{,**} rwl, owner @{user_cache_dirs}/gnome-software/{,**} rw, + owner @{user_config_dirs}/flatpak/{,**} r, owner @{user_config_dirs}/pulse/*.conf r, owner @{user_share_dirs}/ r, diff --git a/apparmor.d/groups/gnome/gnome-tweaks b/apparmor.d/groups/gnome/gnome-tweaks index a04234cce..84f37da76 100644 --- a/apparmor.d/groups/gnome/gnome-tweaks +++ b/apparmor.d/groups/gnome/gnome-tweaks @@ -12,6 +12,7 @@ profile gnome-tweaks @{exec_path} { include include include + include include include @@ -38,6 +39,9 @@ profile gnome-tweaks @{exec_path} { owner @{user_share_dirs}/gnome-shell/extensions/**/schemas/* r, owner @{user_share_dirs}/recently-used.xbel* rw, + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + owner @{PROC}/@{pid}/fd/ r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 9d23622d2..b549f1477 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -65,6 +65,8 @@ profile gpg @{exec_path} { owner /tmp/@{int}@{int} rw, + owner @{run}/user/@{uid}/gnupg/d.*/ rw, + owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat rw, diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index d4c948f86..1dac2be00 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -27,12 +27,11 @@ profile ssh @{exec_path} { @{bin}/{c,k,tc,z}sh rix, @{etc_ro}/ssh/ssh_config r, + @{etc_ro}/ssh/ssh_config.d/{,*} r, @{etc_ro}/ssh/sshd_config r, @{etc_ro}/ssh/sshd_config.d/{,*} r, /etc/machine-id r, - /etc/ssh/ssh_config r, - /etc/ssh/ssh_config.d/{,*} r, - + owner @{HOME}/@{XDG_SSH_DIR}/ r, owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r, owner @{HOME}/@{XDG_SSH_DIR}/config r, diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/profiles-a-f/agetty index ec711895d..3db817006 100644 --- a/apparmor.d/profiles-a-f/agetty +++ b/apparmor.d/profiles-a-f/agetty @@ -30,7 +30,7 @@ profile agetty @{exec_path} { /{etc,run,lib,usr/lib}/issue.d/{,*} r, /etc/inittab r, /etc/login.defs r, - /etc/login.defs.d/ r, + /etc/login.defs.d/{,*} r, /etc/os-release r, /usr/etc/login.defs r, diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index 4e432e2f1..e82f0d372 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -25,6 +25,7 @@ profile file-roller @{exec_path} { # Archivers @{bin}/7z rix, + @{bin}/7zz rix, @{bin}/ar rix, @{bin}/bzip2 rix, @{bin}/cpio rix, diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/profiles-a-f/firewalld index ea083ed96..d32790f0b 100644 --- a/apparmor.d/profiles-a-f/firewalld +++ b/apparmor.d/profiles-a-f/firewalld @@ -61,9 +61,7 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{run}/xtables.lock rwk, @{sys}/module/compression r, - @{sys}/module/crc32c_*/initstate r, - @{sys}/module/libcrc32c/initstate r, - @{sys}/module/nf_*/initstate r, + @{sys}/module/*/initstate r, @{PROC}/sys/kernel/modprobe r, @{PROC}/sys/net/ipv{4,6}/ip_forward rw, diff --git a/apparmor.d/profiles-m-r/pcscd b/apparmor.d/profiles-m-r/pcscd index 9a25cd7d2..200319c6c 100644 --- a/apparmor.d/profiles-m-r/pcscd +++ b/apparmor.d/profiles-m-r/pcscd @@ -16,12 +16,13 @@ profile pcscd @{exec_path} { network netlink raw, - ptrace (read) peer=veracrypt, ptrace (read) peer=@{p_systemd_user}, ptrace (read) peer=gsd-smartcard, + ptrace (read) peer=keepassxc, ptrace (read) peer=pkcs11-register, ptrace (read) peer=rngd, ptrace (read) peer=scdaemon, + ptrace (read) peer=veracrypt, @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index 067968258..8f85f3c03 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -28,6 +28,7 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { /var/lib/power-profiles-daemon/{,**} rw, @{run}/udev/data/+platform:* r, + @{run}/udev/data/+power_supply:* r, @{sys}/bus/ r, @{sys}/bus/platform/devices/ r, diff --git a/apparmor.d/profiles-s-z/smartd b/apparmor.d/profiles-s-z/smartd index 4548813bf..bdac4d92f 100644 --- a/apparmor.d/profiles-s-z/smartd +++ b/apparmor.d/profiles-s-z/smartd @@ -14,11 +14,9 @@ profile smartd @{exec_path} { include include - capability sys_rawio, + capability net_admin, capability sys_admin, - - # Needed? - audit capability net_admin, + capability sys_rawio, @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/su b/apparmor.d/profiles-s-z/su index 429c48938..237d5ed02 100644 --- a/apparmor.d/profiles-s-z/su +++ b/apparmor.d/profiles-s-z/su @@ -26,6 +26,8 @@ profile su @{exec_path} { @{bin}/@{shells} rUx, @{bin}/nologin rPx, + @{etc_ro}/default/su r, + include if exists } diff --git a/apparmor.d/profiles-s-z/w3m b/apparmor.d/profiles-s-z/w3m index 5b919ecc0..b4601147a 100644 --- a/apparmor.d/profiles-s-z/w3m +++ b/apparmor.d/profiles-s-z/w3m @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only @@ -9,6 +10,7 @@ include @{exec_path} = @{bin}/w3m profile w3m @{exec_path} { include + include include include include @@ -21,13 +23,20 @@ profile w3m @{exec_path} { @{exec_path} mr, + @{sh_path} rix, + @{lib}/w3m/cgi-bin/* rix, + @{lib}/w3m/* rix, + /usr/share/terminfo/{,**} r, + /etc/mime.types r, /etc/w3m/{,**} r, - owner @{HOME}/.w3m/{,**} r, - owner @{user_config_dirs}/w3m/{,**} r, - owner /tmp/@{rand6}/{,**} rw, + owner @{HOME}/.w3m/{,**} rw, + + owner @{user_config_dirs}/w3m/{,**} rw, + + owner @{tmp}/@{rand6}/{,**} rw, include if exists } From d9ca201519ddd361987860efccf95babbe24163c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 20 Jul 2024 13:20:45 +0100 Subject: [PATCH 0060/1455] feat(profile): cleanup handling of gnome session. --- apparmor.d/groups/gnome/gdm-prime-defaut | 18 ++++++++++++++++++ apparmor.d/groups/gnome/gdm-session | 9 +-------- apparmor.d/groups/gnome/gnome-control-center | 5 +---- apparmor.d/groups/gnome/gnome-session-binary | 5 +---- 4 files changed, 21 insertions(+), 16 deletions(-) create mode 100644 apparmor.d/groups/gnome/gdm-prime-defaut diff --git a/apparmor.d/groups/gnome/gdm-prime-defaut b/apparmor.d/groups/gnome/gdm-prime-defaut new file mode 100644 index 000000000..5e4e02b6f --- /dev/null +++ b/apparmor.d/groups/gnome/gdm-prime-defaut @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/gdm{3,}/{Init,Prime}/Default +profile gdm-defaut @{exec_path} flags=(complain) { + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gdm-session b/apparmor.d/groups/gnome/gdm-session index d889a708a..da99a23db 100644 --- a/apparmor.d/groups/gnome/gdm-session +++ b/apparmor.d/groups/gnome/gdm-session @@ -34,21 +34,14 @@ profile gdm-session @{exec_path} { # only: xorg @{bin}/Xorg rPx, - /etc/gdm{3,}/Prime/Default rix, + /etc/gdm{3,}/Prime/Default rPx, /etc/gdm{3,}/Xsession rPx, /usr/share/gdm{3,}/gdm.schemas r, - /etc/default/locale r, /etc/gdm{3,}/custom.conf r, /etc/gdm{3,}/daemon.conf r, - /etc/locale.conf r, - /etc/sysconfig/console r, /etc/sysconfig/displaymanager r, - /etc/sysconfig/language r, - /etc/sysconfig/mail r, - /etc/sysconfig/proxy r, - /etc/sysconfig/windowmanager r, owner @{gdm_cache_dirs}/gdm/ rw, owner @{gdm_cache_dirs}/gdm/Xauthority rw, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index c1802c0a5..7643844c5 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -37,9 +37,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { unix (send, receive, connect) type=stream peer=(addr="@/home/*/.cache/ibus/dbus-????????", label=ibus-daemon), - dbus bus=session, - dbus bus=system, - #aa:dbus own bus=session name=org.gnome.Settings #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell @@ -68,7 +65,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{bin}/pkexec rCx -> pkexec, @{bin}/software-properties-gtk rPx, @{bin}/usermod rPx, - @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rPx, + @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, @{lib}/cups/backend/snmp rPx, @{lib}/gnome-control-center-goa-helper rPx, @{lib}/gnome-control-center-print-renderer rPx, diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index c53f26eb2..962897ea8 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -51,10 +51,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, - @{bin}/dbus-daemon rPx -> dbus-session, - @{bin}/env rix, - @{bin}/gnome-session rPx, - @{bin}/gnome-shell rPx, + @{bin}/tput rix, @{bin}/session-migration rPx, @{lib}/gnome-session-check-accelerated rix, From a8509af857da9b2a8ad68d35433333f255db3bac Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 27 Jul 2024 15:07:20 +0200 Subject: [PATCH 0061/1455] build: update overwrite list from upstream fix #427 --- dists/overwrite | 1 + 1 file changed, 1 insertion(+) diff --git a/dists/overwrite b/dists/overwrite index bea6d574b..bbeb46bea 100644 --- a/dists/overwrite +++ b/dists/overwrite @@ -5,6 +5,7 @@ brave chrome +chromium element-desktop epiphany firefox From 28d5ea034e9f8b15897407c62799b3a68aeef52e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 27 Jul 2024 15:15:26 +0200 Subject: [PATCH 0062/1455] feat(profile): merge transmission gui profiles. Fix conflicting file naming with upstream. fix #429 --- .../{transmission-gtk => transmission} | 9 +-- apparmor.d/profiles-s-z/transmission-qt | 56 ------------------- dists/flags/main.flags | 1 + dists/overwrite | 1 + 4 files changed, 7 insertions(+), 60 deletions(-) rename apparmor.d/profiles-s-z/{transmission-gtk => transmission} (88%) delete mode 100644 apparmor.d/profiles-s-z/transmission-qt diff --git a/apparmor.d/profiles-s-z/transmission-gtk b/apparmor.d/profiles-s-z/transmission similarity index 88% rename from apparmor.d/profiles-s-z/transmission-gtk rename to apparmor.d/profiles-s-z/transmission index 40586fa03..07aca1890 100644 --- a/apparmor.d/profiles-s-z/transmission-gtk +++ b/apparmor.d/profiles-s-z/transmission @@ -6,8 +6,8 @@ abi , include -@{exec_path} = @{bin}/transmission-gtk -profile transmission-gtk @{exec_path} { +@{exec_path} = @{bin}/transmission-{gtk,qt} +profile transmission @{exec_path} { include include include @@ -33,10 +33,11 @@ profile transmission-gtk @{exec_path} { owner @{user_config_dirs}/transmission/ rw, owner @{user_config_dirs}/transmission/** rwk, - owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/transmission/ rw, owner @{user_cache_dirs}/transmission/** rwk, + owner @{tmp}/tr_session_id_* rwk, + @{run}/mount/utab r, @{PROC}/@{pid}/net/route r, @@ -48,7 +49,7 @@ profile transmission-gtk @{exec_path} { deny @{user_share_dirs}/gvfs-metadata/* r, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/transmission-qt b/apparmor.d/profiles-s-z/transmission-qt deleted file mode 100644 index bbfe5bff4..000000000 --- a/apparmor.d/profiles-s-z/transmission-qt +++ /dev/null @@ -1,56 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/transmission-qt -profile transmission-qt @{exec_path} { - include - include - include - include - include - include - include - include - include - include - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - network netlink dgram, - network netlink raw, - - @{exec_path} mr, - - # Torrent files - owner @{user_torrents_dirs}/ r, - owner @{user_torrents_dirs}/** rw, - - owner @{user_config_dirs}/transmission/ rw, - owner @{user_config_dirs}/transmission/** rwk, - - owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/transmission/ rw, - owner @{user_cache_dirs}/transmission/** rwk, - - owner @{tmp}/tr_session_id_* rwk, - - deny owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - @{PROC}/@{pid}/net/route r, - @{PROC}/sys/kernel/random/uuid r, - - /usr/share/hwdata/pnp.ids r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 57862b8ce..940b7b0b1 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -368,6 +368,7 @@ systemd-userwork attach_disconnected,complain systemsettings complain totem attach_disconnected,complain tracker-writeback complain +transmission complain udev-dmi-memory-id complain udisksctl complain udisksd attach_disconnected,complain diff --git a/dists/overwrite b/dists/overwrite index bbeb46bea..ec35b79cd 100644 --- a/dists/overwrite +++ b/dists/overwrite @@ -19,5 +19,6 @@ plasmashell slirp4netns systemd-coredump thunderbird +transmission unix-chkpwd virtiofsd From 7d9ae262c95539593e286823b009499acb3ca8e5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 2 Aug 2024 14:54:32 +0200 Subject: [PATCH 0063/1455] fix: borg profile mounting issues. fix 431 --- apparmor.d/profiles-a-f/borg | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apparmor.d/profiles-a-f/borg b/apparmor.d/profiles-a-f/borg index 107330419..6a8eff043 100644 --- a/apparmor.d/profiles-a-f/borg +++ b/apparmor.d/profiles-a-f/borg @@ -21,6 +21,9 @@ profile borg @{exec_path} { network inet6 dgram, network netlink raw, + mount fstype=fuse options=(ro nosuid nodev) borgfs -> @{MOUNTS}/, + mount fstype=fuse options=(ro nosuid nodev) borgfs -> @{MOUNTS}/*/, + @{exec_path} r, @{bin}/ r, @@ -107,6 +110,9 @@ profile borg @{exec_path} { /etc/fuse.conf r, + @{MOUNTS}/ r, + @{MOUNTS}/*/ r, + @{PROC}/@{pids}/mounts r, /dev/fuse rw, From ad60ee11ad6c43d32ef0396e340ec4e446288d69 Mon Sep 17 00:00:00 2001 From: valoq Date: Mon, 5 Aug 2024 09:31:02 +0200 Subject: [PATCH 0064/1455] minor improvements --- apparmor.d/profiles-s-z/zathura | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/zathura b/apparmor.d/profiles-s-z/zathura index b055fe31b..d45ad5f1e 100644 --- a/apparmor.d/profiles-s-z/zathura +++ b/apparmor.d/profiles-s-z/zathura @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/zathura +@{exec_path} = @{bin}/zathura{,-sandbox} profile zathura @{exec_path} { include include @@ -18,11 +18,13 @@ profile zathura @{exec_path} { @{exec_path} mr, /usr/share/file/{,**} r, + /usr/share/poppler/{,**} r, /etc/xdg/{,**} r, /etc/zathurarc r, owner @{user_config_dirs}/zathura/** r, + owner @{user_share_dirs}/zathura/ r, owner @{user_share_dirs}/zathura/** rwk, owner @{tmp}/gtkprint* rw, From da27a6b27e774807554f2230c54ef9dcd79546b0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 17:46:46 +0100 Subject: [PATCH 0065/1455] fix: mpv needs access to /dev/snd files for the alsa audio backend to work fix #433 --- apparmor.d/profiles-m-r/mpv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-m-r/mpv b/apparmor.d/profiles-m-r/mpv index 1629176dd..88a5078aa 100644 --- a/apparmor.d/profiles-m-r/mpv +++ b/apparmor.d/profiles-m-r/mpv @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/mpv profile mpv @{exec_path} { include - include + include include include include From e3e6c2f5b60675dd85125495f295d29c0aefae6c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 17:51:23 +0100 Subject: [PATCH 0066/1455] feat(profile): add NTS support for chronyd. fix #438 --- apparmor.d/profiles-a-f/chronyd | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/profiles-a-f/chronyd b/apparmor.d/profiles-a-f/chronyd index 5aa5c5ed2..490afddb2 100644 --- a/apparmor.d/profiles-a-f/chronyd +++ b/apparmor.d/profiles-a-f/chronyd @@ -12,6 +12,8 @@ include profile chronyd @{exec_path} flags=(attach_disconnected) { include include + include + include capability chown, capability dac_override, From fc1ae32e4e0e5aa54edd9a3aeb0008df8be6eafa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 17:54:34 +0100 Subject: [PATCH 0067/1455] fix(profile): virtlogd: support for user libvirtd. fix #436 --- apparmor.d/groups/virt/virtlogd | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/virt/virtlogd b/apparmor.d/groups/virt/virtlogd index 1a3ecb06b..b06ad67f1 100644 --- a/apparmor.d/groups/virt/virtlogd +++ b/apparmor.d/groups/virt/virtlogd @@ -24,6 +24,7 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/libvirt/qemu/log/{,**} rw, owner @{run}/user/@{uid}/common/system.token rw, + owner @{run}/user/@{uid}/libvirt/common/system.token rwk, owner @{run}/user/@{uid}/libvirt/virtlogd.pid rwk, owner @{run}/user/@{uid}/libvirt/virtlogd* w, From 14fae89fddc4280298ec949a6b7b73cf3d2c3c52 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 17:59:24 +0100 Subject: [PATCH 0068/1455] fix(profile): modprobed-db access to config files. fix #435 --- apparmor.d/profiles-m-r/modprobed-db | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-m-r/modprobed-db b/apparmor.d/profiles-m-r/modprobed-db index 29125f192..3798332ea 100644 --- a/apparmor.d/profiles-m-r/modprobed-db +++ b/apparmor.d/profiles-m-r/modprobed-db @@ -28,9 +28,10 @@ profile modprobed-db @{exec_path} { @{bin}/uniq rix, @{bin}/wc rix, + /usr/share/modprobed-db/** r, /usr/share/terminfo/** r, - owner @{user_config_dirs}/modprobed-db.conf r, + owner @{user_config_dirs}/modprobed-db.conf rw, owner @{user_config_dirs}/modprobed.db rw, owner @{tmp}/.inmem rw, From 93313422bdc71324a8a886c4cabab33bfe32a7cd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 18:49:52 +0100 Subject: [PATCH 0069/1455] feat(profile): update kde profiles on openSUSE Tumbleweed. See #424 --- apparmor.d/abstractions/app/firefox | 1 + apparmor.d/groups/akonadi/akonadi_control | 2 ++ apparmor.d/groups/browsers/firefox | 10 ++++---- .../groups/browsers/firefox-kmozillahelper | 2 +- apparmor.d/groups/bus/dbus-accessibility | 8 +++++++ apparmor.d/groups/bus/dbus-system | 1 + apparmor.d/groups/cron/cron | 5 ++-- .../groups/display-manager/xdm-xsession | 5 +++- .../polkit-kde-authentication-agent | 2 ++ apparmor.d/groups/freedesktop/pulseaudio | 2 ++ apparmor.d/groups/gpg/gpg-connect-agent | 1 + apparmor.d/groups/kde/DiscoverNotifier | 3 +++ apparmor.d/groups/kde/gmenudbusmenuproxy | 2 ++ apparmor.d/groups/kde/kalendarac | 4 +++- apparmor.d/groups/kde/kde-powerdevil | 3 ++- apparmor.d/groups/kde/kded | 7 +++--- apparmor.d/groups/kde/kglobalacceld | 3 +++ apparmor.d/groups/kde/kiod | 1 + apparmor.d/groups/kde/konsole | 9 +++++++- apparmor.d/groups/kde/kscreenlocker_greet | 1 + apparmor.d/groups/kde/ksmserver | 7 ++++++ apparmor.d/groups/kde/kwalletd | 2 ++ apparmor.d/groups/kde/plasma_waitforname | 1 + apparmor.d/groups/kde/plasmashell | 7 +++++- apparmor.d/groups/kde/sddm-greeter | 2 ++ apparmor.d/groups/kde/startplasma | 1 + apparmor.d/groups/kde/xembedsniproxy | 2 ++ apparmor.d/profiles-a-f/amixer | 2 +- apparmor.d/profiles-a-f/dmesg | 2 +- apparmor.d/profiles-g-l/git | 11 +++++---- apparmor.d/profiles-g-l/issue-generator | 1 + apparmor.d/profiles-m-r/pinentry-qt | 23 +++---------------- apparmor.d/tunables/home.d/apparmor.d | 2 +- apparmor.d/tunables/multiarch.d/system | 1 + 34 files changed, 93 insertions(+), 43 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 9de4359e1..7895db4e9 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -104,6 +104,7 @@ owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer w, @{run}/mount/utab r, diff --git a/apparmor.d/groups/akonadi/akonadi_control b/apparmor.d/groups/akonadi/akonadi_control index f52c3e14f..f21b968d2 100644 --- a/apparmor.d/groups/akonadi/akonadi_control +++ b/apparmor.d/groups/akonadi/akonadi_control @@ -31,6 +31,8 @@ profile akonadi_control @{exec_path} { owner @{user_share_dirs}/akonadi/{,**} rwl, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + /dev/tty r, include if exists diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 41ce67746..6d50db9dc 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -57,14 +57,14 @@ profile firefox @{exec_path} flags=(attach_disconnected) { owner @{tmp}/@{rand6}.tmp r, owner @{tmp}/@{rand8}.txt w, owner @{tmp}/* w, # file downloads (to anywhere) - owner @{tmp}/Mozilla@{uuid}-cachePurge-??????????????? rwk, + owner @{tmp}/Mozilla@{uuid}-cachePurge-{@{hex15},@{hex16}} rwk, owner @{tmp}/mozilla* rw, owner @{tmp}/mozilla*/ rw, owner @{tmp}/mozilla*/* rwk, - owner @{tmp}/Mozilla\{@{uuid}\}-cachePurge-??????????????? rwk, - owner @{tmp}/MozillaBackgroundTask-???????????????-removeDirectory/.parentlock k, - owner @{tmp}/MozillaBackgroundTask-???????????????-removeDirectory/{**,} rw, - owner @{tmp}/Mozillato-be-removed-cachePurge-??????????????? rwk, + owner @{tmp}/Mozilla\{@{uuid}\}-cachePurge-{@{hex15},@{hex16}} rwk, + owner @{tmp}/MozillaBackgroundTask-{@{hex15},@{hex16}}-removeDirectory/.parentlock k, + owner @{tmp}/MozillaBackgroundTask-{@{hex15},@{hex16}}-removeDirectory/{**,} rw, + owner @{tmp}/Mozillato-be-removed-cachePurge-{@{hex15},@{hex16}} rwk, # Silencer deny @{lib_dirs}/** w, diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index d23d94bb8..b4202ed0d 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -10,8 +10,8 @@ include profile firefox-kmozillahelper @{exec_path} { include include - include include + include include include include diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index dc4ded9cd..1c5f8cd30 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -16,6 +16,12 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { include include + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + signal (receive) set=(term hup kill) peer=dbus-session, signal (receive) set=(term hup kill) peer=gdm{,-session-worker}, @@ -50,6 +56,8 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.Xauthority r, + owner @{tmp}/xauth_@{rand6} r, + @{run}/systemd/users/@{uid} r, owner @{run}/user/@{uid}/gdm/Xauthority r, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index f001c27b7..e63d51eaa 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -66,6 +66,7 @@ profile dbus-system flags=(attach_disconnected) { @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/environ r, @{PROC}/@{pid}/mounts r, + @{PROC}/@{pid}/oom_score_adj r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index a1a04dfa3..3636138c0 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -57,9 +57,10 @@ profile cron @{exec_path} flags=(attach_disconnected) { owner @{tmp}/#@{int} rw, - owner @{PROC}/@{pid}/uid_map r, - owner @{PROC}/@{pid}/loginuid rw, + @{PROC}/@{pid}/fd/ r, @{PROC}/1/limits r, + owner @{PROC}/@{pid}/loginuid rw, + owner @{PROC}/@{pid}/uid_map r, /dev/tty rw, diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index 6278d2ac7..522d4ad58 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -18,9 +18,9 @@ profile xdm-xsession @{exec_path} { @{shells_path} rix, - @{bin}/checkproc rix, @{bin}/basename rix, @{bin}/cat rix, + @{bin}/checkproc rix, @{bin}/dirname rix, @{bin}/gpg-agent rPx, @{bin}/gpg-connect-agent rPx, @@ -28,8 +28,10 @@ profile xdm-xsession @{exec_path} { @{bin}/locale rix, @{bin}/manpath rix, @{bin}/readlink rix, + @{bin}/realpath rix @{bin}/sed rix, @{bin}/ssh-agent rix, + @{bin}/tput rix @{bin}/tr rix, @{bin}/tty rix, @{bin}/uname rix, @@ -56,6 +58,7 @@ profile xdm-xsession @{exec_path} { /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/mc/mc.sh r, + /usr/share/terminfo/{,**} r, @{etc_ro}/X11/xdm/scripts/{,*} r, @{etc_ro}/X11/xim r, diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index 7754ee09f..f8a9700f5 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -46,6 +46,8 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected, owner @{tmp}/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int}, # owner /tmp/xauth_@{rand6} r, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + /dev/shm/#@{int} rw, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 0bb878ab6..5fc356133 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -84,12 +84,14 @@ profile pulseaudio @{exec_path} { owner @{desktop_config_dirs}/pulse/{,**} rw, owner @{desktop_config_dirs}/pulse/cookie k, + owner @{HOME}/.pulse/{,**} rw, owner @{user_config_dirs}/ w, owner @{user_config_dirs}/pulse/{,**} rw, owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin r, owner @{run}/user/@{uid}/ rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/pulse/ rw, owner @{run}/user/@{uid}/pulse/** rwk, owner @{run}/user/@{uid}/systemd/notify rw, diff --git a/apparmor.d/groups/gpg/gpg-connect-agent b/apparmor.d/groups/gpg/gpg-connect-agent index ae8f90ed5..1e257cfc0 100644 --- a/apparmor.d/groups/gpg/gpg-connect-agent +++ b/apparmor.d/groups/gpg/gpg-connect-agent @@ -20,6 +20,7 @@ profile gpg-connect-agent @{exec_path} { owner @{PROC}/@{pid}/fd/ r, + owner @{run}/user/@{uid}/gnupg/ w, owner @{run}/user/@{uid}/gnupg/d.*/ rw, owner @{tmp}/tmp.*/.#lk0x@{hex}.*.@{pid} rw, diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index db870bd82..227f4e062 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -40,6 +40,7 @@ profile DiscoverNotifier @{exec_path} { /var/lib/flatpak/{,**} r, /var/cache/swcatalog/cache/ w, + /var/cache/swcatalog/xml/{,**} r, owner @{user_cache_dirs}/appstream/ r, owner @{user_cache_dirs}/appstream/** rw, @@ -58,6 +59,8 @@ profile DiscoverNotifier @{exec_path} { owner @{tmp}/ostree-gpg-@{rand6}/pubring.gpg rw, owner @{tmp}/ostree-gpg-@{rand6}/trustdb.gpg rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + /dev/tty r, profile gpg { diff --git a/apparmor.d/groups/kde/gmenudbusmenuproxy b/apparmor.d/groups/kde/gmenudbusmenuproxy index c1a63931e..d1e48f849 100644 --- a/apparmor.d/groups/kde/gmenudbusmenuproxy +++ b/apparmor.d/groups/kde/gmenudbusmenuproxy @@ -25,6 +25,8 @@ profile gmenudbusmenuproxy @{exec_path} { owner @{user_config_dirs}/gtk-{2,3}.0/settings.ini{,.@{rand6}} rwl, owner @{user_config_dirs}/gtk-{2,3}.0/settings.ini.lock rwk, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + include if exists } diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index daf880cf9..471812c7c 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/kalendarac profile kalendarac @{exec_path} { include - include + include include include include @@ -36,6 +36,8 @@ profile kalendarac @{exec_path} { owner @{user_config_dirs}/kalendaracrc.lock rwk, owner @{user_config_dirs}/kmail2rc r, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 960747c21..09ebb0d7c 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -36,6 +36,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) owner @{HOME}/ r, + owner @{user_cache_dirs}/ddcutil/* r, owner @{user_cache_dirs}/kcrash-metadata/{,*} rw, owner @{user_config_dirs}/#@{int} rw, @@ -63,7 +64,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{sys}/devices/@{pci}/drm/card@{int}/*/enabled r, @{sys}/devices/@{pci}/drm/card@{int}/*/status r, @{sys}/devices/@{pci}/i2c-@{int}/**/dev r, - @{sys}/devices/@{pci}/i2c-@{int}/name r, + @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, @{sys}/devices/**/ r, @{sys}/devices/i2c-@{int}/name r, @{sys}/devices/platform/**/i2c-@{int}/**/name r, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index e0cc7f5b3..422fc103c 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -59,7 +59,7 @@ profile kded @{exec_path} { @{bin}/xsettingsd rPx, @{lib}/drkonqi rPx, - #aa:exec utempter + @{lib}/{,@{multiarch}/}utempter/utempter rPx, #aa:exec kconf_update /usr/share/color-schemes/{,**} r, @@ -123,8 +123,7 @@ profile kded @{exec_path} { owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk, owner @{user_config_dirs}/menus/{,**} r, owner @{user_config_dirs}/networkmanagement.notifyrc r, - owner @{user_config_dirs}/plasma-nm r, - owner @{user_config_dirs}/plasma-welcomerc r, + owner @{user_config_dirs}/plasma* r, owner @{user_config_dirs}/touchpadrc r, owner @{user_config_dirs}/Trolltech.conf.lock rwk, owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl, @@ -151,6 +150,8 @@ profile kded @{exec_path} { owner @{tmp}/kded6.@{rand6} rwl -> /tmp/#@{int}, owner @{tmp}/plasma-csd-generator.@{rand6}/{,**} rw, + @{sys}/class/leds/ r, + @{PROC}/ r, @{PROC}/@{pids}/cmdline/ r, @{PROC}/@{pids}/fd/ r, diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index 1995838c1..f71f9734c 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -19,6 +19,7 @@ profile kglobalacceld @{exec_path} { /etc/machine-id r, /etc/xdg/menus/ r, + /etc/xdg/menus/applications-merged/ r, owner @{user_cache_dirs}/ksycoca{5,6}_* rw, @@ -29,6 +30,8 @@ profile kglobalacceld @{exec_path} { owner @{user_config_dirs}/menus/ r, owner @{user_config_dirs}/menus/applications-merged/ r, + @{PROC}/sys/kernel/random/boot_id r, + /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/kiod b/apparmor.d/groups/kde/kiod index 7462d6c5b..5b6c7184a 100644 --- a/apparmor.d/groups/kde/kiod +++ b/apparmor.d/groups/kde/kiod @@ -13,6 +13,7 @@ profile kiod @{exec_path} { include include include + include network netlink raw, diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 054731148..3151156a7 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -26,7 +26,9 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/@{shells} rUx, @{browsers_path} rPx, - #aa:exec utempter + @{lib}/libheif/ r, + @{lib}/libheif/** mr, + @{lib}/{,@{multiarch}/}utempter/utempter rPx, /usr/share/color-schemes/{,**} r, /usr/share/kf6/{,**} r, @@ -47,12 +49,15 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_config_dirs}/#@{int} rwl, owner @{user_config_dirs}/breezerc r, + owner @{user_config_dirs}/kbookmarkrc r, + owner @{user_config_dirs}/konsole.notifyrc r, owner @{user_config_dirs}/konsolerc{,*} rwlk, owner @{user_config_dirs}/konsolesshconfig rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/konsolesshconfig.@{rand6} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/konsolesshconfig.lock rwk, owner @{user_config_dirs}/kservicemenurc r, owner @{user_config_dirs}/menus/{,**} r, + owner @{user_config_dirs}/session/** rwlk, owner @{user_share_dirs}/color-schemes/{,**} r, owner @{user_share_dirs}/konsole/ rw, @@ -62,6 +67,8 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/#@{int} rw, owner @{tmp}/konsole.@{rand6} rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index 1884414a9..bd1666a06 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -85,6 +85,7 @@ profile kscreenlocker_greet @{exec_path} { owner @{user_config_dirs}/kscreenlockerrc r, owner @{user_config_dirs}/ksmserverrc r, owner @{user_config_dirs}/plasmarc r, + owner @{user_config_dirs}/plasmashellrc r, # If one is blocked, the others are probed. deny owner @{HOME}/#@{int} mrw, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index b7e1858da..858bc4b9a 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -52,6 +52,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_cache_dirs}/ksycoca{5,6}_* rwlk, owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/kdedefaults/kscreenlockerrc r, owner @{user_config_dirs}/kscreenlockerrc r, owner @{user_config_dirs}/ksmserverrc rw, owner @{user_config_dirs}/ksmserverrc.@{rand6} rwl, @@ -62,6 +63,12 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/kservices{5,6}/ r, owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r, + owner @{run}/user/@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} wl -> @{run}/user/@{uid}/#@{int}, + owner @{run}/user/@{uid}/iceauth_@{rand6}-c w, + owner @{run}/user/@{uid}/iceauth_@{rand6}-l wl -> @{run}/user/@{uid}/iceauth_@{rand6}-c, + owner @{run}/user/@{uid}/iceauth_@{rand6}-n rw, + owner @{tmp}/@{rand6} rw, @{run}/systemd/inhibit/[0-9]*.ref rw, diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index 5005dde31..2b2545b33 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -43,6 +43,8 @@ profile kwalletd @{exec_path} { owner @{tmp}/kwalletd5.* rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/kde/plasma_waitforname b/apparmor.d/groups/kde/plasma_waitforname index c987a4759..432c49ac3 100644 --- a/apparmor.d/groups/kde/plasma_waitforname +++ b/apparmor.d/groups/kde/plasma_waitforname @@ -10,6 +10,7 @@ include profile plasma_waitforname @{exec_path} { include include + include @{exec_path} mr, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 9a21b9dff..fe79dccd7 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -178,6 +178,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{run}/mount/utab r, @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/kdesud_:@{int} w, owner @{run}/user/@{uid}/plasmashell@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, @@ -187,9 +188,13 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{sys}/devices/platform/** r, @{sys}/devices/@{pci}/name r, - @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/ r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/thermal/**/{name,type} r, + @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/ r, @{PROC}/ r, @{PROC}/cmdline r, diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index f249d911e..dba650f2c 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -49,6 +49,8 @@ profile sddm-greeter @{exec_path} { owner @{SDDM_HOME}/#@{int} mrw, owner @{sddm_cache_dirs}/** mrwkl -> @{sddm_cache_dirs}/**, + owner @{HOME}/.face.icon r, + owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index e575f3bb2..149df7695 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -22,6 +22,7 @@ profile startplasma @{exec_path} { @{bin}/env rix, @{bin}/grep rix, @{bin}/kapplymousetheme rPUx, + @{bin}/kdeinit5_shutdown rPUx, @{bin}/ksplashqml rPUx, @{bin}/plasma_session rPx, @{bin}/xrdb rPx, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index a4474a64a..57e32b960 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -20,6 +20,8 @@ profile xembedsniproxy @{exec_path} { owner @{tmp}/xauth_@{rand6} r, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + @{run}/user/@{uid}/xauth_@{rand6} rl, include if exists diff --git a/apparmor.d/profiles-a-f/amixer b/apparmor.d/profiles-a-f/amixer index ea2842a74..8a625b547 100644 --- a/apparmor.d/profiles-a-f/amixer +++ b/apparmor.d/profiles-a-f/amixer @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/amixer profile amixer @{exec_path} { include - include + include include @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/dmesg b/apparmor.d/profiles-a-f/dmesg index 6dcd5cbb8..819cd234e 100644 --- a/apparmor.d/profiles-a-f/dmesg +++ b/apparmor.d/profiles-a-f/dmesg @@ -24,7 +24,7 @@ profile dmesg @{exec_path} { /usr/share/terminfo/** r, - owner @{PROC}/sys/kernel/pid_max r, + @{PROC}/sys/kernel/pid_max r, /dev/kmsg r, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index ba37f7bcc..2c0eb2fac 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -43,6 +43,7 @@ profile git @{exec_path} flags=(attach_disconnected) { # These are needed for "git submodule update" @{sh_path} rix, @{bin}/{,e}grep rix, + @{bin}/alts rix, @{bin}/basename rix, @{bin}/cat rix, @{bin}/date rix, @@ -78,6 +79,7 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/vim.* rCx -> editor, /usr/share/git{,-core}/{,**} r, + /usr/share/libalternatives/{,**} r, /usr/share/terminfo/** r, /etc/gitconfig r, @@ -139,14 +141,15 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/ssh mr, - /etc/ssh/ssh_config.d/{,*} r, - /etc/ssh/ssh_config r, + @{etc_ro}/ssh/ssh_config.d/{,*} r, + @{etc_ro}/ssh/ssh_config r, owner @{HOME}/@{XDG_SSH_DIR}/* r, - owner @{HOME}/@{XDG_SSH_DIR}/known_hosts{,.*} rw, owner @{HOME}/@{XDG_SSH_DIR}/known_hosts.old rwl, + owner @{HOME}/@{XDG_SSH_DIR}/known_hosts{,.*} rw, + owner @{HOME}/@{XDG_SSH_DIR}/ssh_control_* rwl, - owner @{tmp}/git@*:@{int} rwl -> /tmp/git@*:@{int}.*, + owner @{tmp}/git@*:@{int} rwl -> @{tmp}/git@*:@{int}.*, owner @{tmp}/ssh-*/agent.@{int} rw, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index 00600b72b..57de7cab8 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -21,6 +21,7 @@ profile issue-generator @{exec_path} { @{bin}/sort rix, /etc/issue.d/{,**} r, + /etc/sysconfig/issue-generator r, @{run}/issue r, @{run}/issue.@{rand10} rw, diff --git a/apparmor.d/profiles-m-r/pinentry-qt b/apparmor.d/profiles-m-r/pinentry-qt index 947350b8a..1763bd96f 100644 --- a/apparmor.d/profiles-m-r/pinentry-qt +++ b/apparmor.d/profiles-m-r/pinentry-qt @@ -10,40 +10,23 @@ include @{exec_path} = @{bin}/pinentry-qt profile pinentry-qt @{exec_path} { include - include include - include - include - include - include + include + include include include - include - include - include @{exec_path} mr, - /usr/share/hwdata/pnp.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /var/lib/dbus/machine-id r, /etc/machine-id r, - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, + /var/lib/dbus/machine-id r, owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwinrc r, - owner @{tmp}/xauth_@{rand6} r, owner /dev/shm/#@{int} rw, - @{sys}/devices/system/node/ r, - @{sys}/devices/system/node/node@{int}/meminfo r, - owner @{PROC}/@{pid}/cmdline r, include if exists diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index c23a8d956..110c562e2 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -39,7 +39,7 @@ @{XDG_CONFIG_DIR}=".config" @{XDG_DATA_DIR}=".local/share" @{XDG_STATE_DIR}=".local/state" -@{XDG_BIN_DIR}=".local/bin" +@{XDG_BIN_DIR}="bin" ".bin" ".local/bin" @{XDG_LIB_DIR}=".local/lib" # Full path of the user configuration directories diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index f2e7c2563..1b4206dad 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -35,6 +35,7 @@ @{hex8}=@{hex4}@{hex4} @{hex9}=@{hex8}@{h} @{hex10}=@{hex8}@{hex2} +@{hex15}=@{hex8}@{hex4}@{hex2}@{h} @{hex16}=@{hex8}@{hex8} @{hex32}=@{hex16}@{hex16} @{hex38}=@{hex32}@{hex6} From 4f4e37387787d45c484a897c04bda405bed9f693 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 19:07:56 +0100 Subject: [PATCH 0070/1455] chore: make go vet happy. --- cmd/aa/main.go | 4 ++-- cmd/prebuild/main.go | 2 +- pkg/logging/logging.go | 12 ++++++------ pkg/logging/logging_test.go | 22 +++++++++++----------- tests/cmd/main.go | 2 +- tests/integration/scenario.go | 4 ++-- 6 files changed, 23 insertions(+), 23 deletions(-) diff --git a/cmd/aa/main.go b/cmd/aa/main.go index 8fa7cce66..ec64e8cfd 100644 --- a/cmd/aa/main.go +++ b/cmd/aa/main.go @@ -199,7 +199,7 @@ func main() { case format: files, err = pathsFromArgs() if err != nil { - logging.Fatal(err.Error()) + logging.Fatal("%s", err.Error()) } err = aaFormat(files) case tree: @@ -207,6 +207,6 @@ func main() { } if err != nil { - logging.Fatal(err.Error()) + logging.Fatal("%s", err.Error()) } } diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index c39d4cbbd..d909cc818 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -91,6 +91,6 @@ func main() { os.Exit(0) } if err := aaPrebuild(); err != nil { - logging.Fatal(err.Error()) + logging.Fatal("%s", err.Error()) } } diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go index e6c91ac93..7f5af2e08 100644 --- a/pkg/logging/logging.go +++ b/pkg/logging/logging.go @@ -37,7 +37,7 @@ func Print(msg string, a ...interface{}) int { // Println prints a formatted message. Arguments are handled in the manner of fmt.Println. func Println(msg string) int { - n, _ := fmt.Fprintf(os.Stdout, msg+"\n") + n, _ := fmt.Fprintf(os.Stdout, "%s\n", msg) return n } @@ -48,7 +48,7 @@ func Bulletf(msg string, a ...interface{}) string { // Bullet prints a formatted bullet point string func Bullet(msg string, a ...interface{}) int { - return Print(Bulletf(msg, a...)) + return Print("%s", Bulletf(msg, a...)) } // Stepf returns a formatted step string @@ -58,7 +58,7 @@ func Stepf(msg string, a ...interface{}) string { // Step prints a step title func Step(msg string, a ...interface{}) int { - return Print(Stepf(msg, a...)) + return Print("%s", Stepf(msg, a...)) } // Successf returns a formatted success string @@ -68,7 +68,7 @@ func Successf(msg string, a ...interface{}) string { // Success prints a formatted success message to stdout func Success(msg string, a ...interface{}) int { - return Print(Successf(msg, a...)) + return Print("%s", Successf(msg, a...)) } // Warningf returns a formatted warning string @@ -78,12 +78,12 @@ func Warningf(msg string, a ...interface{}) string { // Warning prints a formatted warning message to stdout func Warning(msg string, a ...interface{}) int { - return Print(Warningf(msg, a...)) + return Print("%s", Warningf(msg, a...)) } // Fatalf returns a formatted error message func Error(msg string, a ...interface{}) int { - return Print(fmt.Sprintf("%s%s%s\n", Indent, errorText, fmt.Sprintf(msg, a...))) + return Print("%s", fmt.Sprintf("%s%s%s\n", Indent, errorText, fmt.Sprintf(msg, a...))) } // Fatalf returns a formatted error message diff --git a/pkg/logging/logging_test.go b/pkg/logging/logging_test.go index ebfe48afd..eb912595e 100644 --- a/pkg/logging/logging_test.go +++ b/pkg/logging/logging_test.go @@ -10,7 +10,7 @@ func TestPrint(t *testing.T) { msg := "Print message" wantN := 13 - gotN := Print(msg) + gotN := Print("%s", msg) if gotN != wantN { t.Errorf("Print() = %v, want %v", gotN, wantN) } @@ -28,7 +28,7 @@ func TestPrintln(t *testing.T) { func TestBulletf(t *testing.T) { msg := "Bullet message" want := "\033[1m ⋅ \033[0mBullet message\n" - if got := Bulletf(msg); got != want { + if got := Bulletf("%s", msg); got != want { t.Errorf("Bulletf() = %v, want %v", got, want) } } @@ -36,7 +36,7 @@ func TestBulletf(t *testing.T) { func TestBullet(t *testing.T) { msg := "Bullet message" wantN := 28 - gotN := Bullet(msg) + gotN := Bullet("%s", msg) if gotN != wantN { t.Errorf("Bullet() = %v, want %v", gotN, wantN) } @@ -45,7 +45,7 @@ func TestBullet(t *testing.T) { func TestStepf(t *testing.T) { msg := "Step message" want := "\033[1;32mStep message\033[0m\n" - if got := Stepf(msg); got != want { + if got := Stepf("%s", msg); got != want { t.Errorf("Stepf() = %v, want %v", got, want) } } @@ -53,7 +53,7 @@ func TestStepf(t *testing.T) { func TestStep(t *testing.T) { msg := "Step message" wantN := 24 - gotN := Step(msg) + gotN := Step("%s", msg) if gotN != wantN { t.Errorf("Step() = %v, want %v", gotN, wantN) } @@ -62,7 +62,7 @@ func TestStep(t *testing.T) { func TestSuccessf(t *testing.T) { msg := "Success message" want := "\033[1;32m ✓ \033[0mSuccess message\n" - if got := Successf(msg); got != want { + if got := Successf("%s", msg); got != want { t.Errorf("Successf() = %v, want %v", got, want) } } @@ -70,7 +70,7 @@ func TestSuccessf(t *testing.T) { func TestSuccess(t *testing.T) { msg := "Success message" wantN := 32 - gotN := Success(msg) + gotN := Success("%s", msg) if gotN != wantN { t.Errorf("Success() = %v, want %v", gotN, wantN) } @@ -79,7 +79,7 @@ func TestSuccess(t *testing.T) { func TestWarningf(t *testing.T) { msg := "Warning message" want := "\033[1;33m ‼ \033[0mWarning message\n" - if got := Warningf(msg); got != want { + if got := Warningf("%s", msg); got != want { t.Errorf("Warningf() = %v, want %v", got, want) } } @@ -87,7 +87,7 @@ func TestWarningf(t *testing.T) { func TestWarning(t *testing.T) { msg := "Warning message" wantN := 32 - gotN := Warning(msg) + gotN := Warning("%s", msg) if gotN != wantN { t.Errorf("Warning() = %v, want %v", gotN, wantN) } @@ -96,7 +96,7 @@ func TestWarning(t *testing.T) { func TestError(t *testing.T) { msg := "Error message" wantN := 30 - gotN := Error(msg) + gotN := Error("%s", msg) if gotN != wantN { t.Errorf("Error() = %v, want %v", gotN, wantN) } @@ -105,7 +105,7 @@ func TestError(t *testing.T) { func TestFatalf(t *testing.T) { msg := "Error message" want := "\033[1;31m ✗ Error: \033[0mError message\n" - if got := Fatalf(msg); got != want { + if got := Fatalf("%s", msg); got != want { t.Errorf("Fatalf() = %v, want %v", got, want) } } diff --git a/tests/cmd/main.go b/tests/cmd/main.go index de1d27561..057994f86 100644 --- a/tests/cmd/main.go +++ b/tests/cmd/main.go @@ -197,6 +197,6 @@ func main() { os.Exit(1) } if err != nil { - logging.Fatal(err.Error()) + logging.Fatal("%s", err.Error()) } } diff --git a/tests/integration/scenario.go b/tests/integration/scenario.go index 53758fb42..94e9a728f 100644 --- a/tests/integration/scenario.go +++ b/tests/integration/scenario.go @@ -102,13 +102,13 @@ func (t *Test) Run(dryRun bool) (ran int, nb int, err error) { if !strings.Contains(cmd, "{{") { nb++ if dryRun { - logging.Bullet(cmd) + logging.Bullet("%s", cmd) } else { cmdErr := t.run(cmd, strings.Join(test.Stdin, "\n")) if cmdErr != nil { logging.Error("%v", cmdErr) } else { - logging.Success(cmd) + logging.Success("%s", cmd) } } } From dc8cc1eb09be90abf3559ddb94a70d34a4545248 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 19:09:19 +0100 Subject: [PATCH 0071/1455] fix: compilation issue. --- apparmor.d/groups/display-manager/xdm-xsession | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index 522d4ad58..6d6bcddff 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -28,7 +28,7 @@ profile xdm-xsession @{exec_path} { @{bin}/locale rix, @{bin}/manpath rix, @{bin}/readlink rix, - @{bin}/realpath rix + @{bin}/realpath rix, @{bin}/sed rix, @{bin}/ssh-agent rix, @{bin}/tput rix From fb6e718b9872aa0e258cc76afd8ecad67b867f52 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 19:29:43 +0100 Subject: [PATCH 0072/1455] feat(profile): gdm-session-worker: initial support for fscrypt. fix #430 --- apparmor.d/groups/gnome/gdm-session-worker | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index c5b220145..92744652b 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -77,6 +77,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*.conf} r, /etc/default/locale r, + /etc/fscrypt.conf r, /etc/gdm{3,}/custom.conf r, /etc/gdm{3,}/daemon.conf r, /etc/locale.conf r, @@ -93,7 +94,14 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { /var/lib/wtmpdb/ r, /var/lib/wtmpdb/* rwk, + /.fscrypt/policies/ r, + /.fscrypt/protectors/ r, + owner /.fscrypt/protectors/@{hex16} r, + + /home/ r, owner @{HOME}/.pam_environment r, + owner @{HOME}/policies/@{hex32} r, + owner @{HOME}/protectors/@{hex16}.link r, @{run}/cockpit/inactive.motd r, owner @{run}/systemd/seats/seat@{int} r, @@ -106,12 +114,15 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { @{run}/cockpit/active.motd r, @{run}/faillock/@{user} rwk, + @{run}/fscrypt/ rw, + @{run}/fscrypt/@{uid}.count rwk, @{run}/motd.d/{,*} r, @{run}/systemd/sessions/* r, @{run}/systemd/sessions/*.ref rw, @{run}/systemd/users/@{uid} r, @{run}/utmp rwk, + @{PROC}/@{pid}/mountinfo r, @{PROC}/@{pids}/cgroup r, @{PROC}/1/limits r, @{PROC}/keys r, From e74fade49a07d45534f7bc127cee1607c18cbb65 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 19:54:54 +0100 Subject: [PATCH 0073/1455] fix: compilation issue 2/2 revert adding `bin` to XDG_BIN_DIR due to undetected conflicting x modifiers. See #424 --- apparmor.d/groups/display-manager/xdm-xsession | 2 +- apparmor.d/tunables/home.d/apparmor.d | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index 6d6bcddff..962a97c3b 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -31,7 +31,7 @@ profile xdm-xsession @{exec_path} { @{bin}/realpath rix, @{bin}/sed rix, @{bin}/ssh-agent rix, - @{bin}/tput rix + @{bin}/tput rix, @{bin}/tr rix, @{bin}/tty rix, @{bin}/uname rix, diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index 110c562e2..c23a8d956 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -39,7 +39,7 @@ @{XDG_CONFIG_DIR}=".config" @{XDG_DATA_DIR}=".local/share" @{XDG_STATE_DIR}=".local/state" -@{XDG_BIN_DIR}="bin" ".bin" ".local/bin" +@{XDG_BIN_DIR}=".local/bin" @{XDG_LIB_DIR}=".local/lib" # Full path of the user configuration directories From f14ed2f024a52eccf073cb44e741cee4bc5e3864 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 20:13:00 +0100 Subject: [PATCH 0074/1455] feat(profile): rewrite the dino profile. see #426 --- apparmor.d/profiles-a-f/{dino-im => dino} | 39 +++++++++++------------ dists/flags/main.flags | 1 + 2 files changed, 20 insertions(+), 20 deletions(-) rename apparmor.d/profiles-a-f/{dino-im => dino} (51%) diff --git a/apparmor.d/profiles-a-f/dino-im b/apparmor.d/profiles-a-f/dino similarity index 51% rename from apparmor.d/profiles-a-f/dino-im rename to apparmor.d/profiles-a-f/dino index 07fba44a5..f7d057f8d 100644 --- a/apparmor.d/profiles-a-f/dino-im +++ b/apparmor.d/profiles-a-f/dino @@ -7,13 +7,16 @@ abi , include -@{exec_path} = @{bin}/dino-im -profile dino-im @{exec_path} { +@{exec_path} = @{bin}/dino{,-im} +profile dino @{exec_path} flags=(attach_disconnected) { include + include include include include + include include + include include network inet dgram, @@ -24,30 +27,26 @@ profile dino-im @{exec_path} { @{exec_path} mr, - # Needed for GPG/PGP support - @{bin}/gpg{,2} rCx -> gpg, - @{bin}/gpgconf rCx -> gpg, - @{bin}/gpgsm rCx -> gpg, + # Not in a subprofile because of no new privs + @{bin}/gpg{,2} rix, + @{bin}/gpgconf rix, + @{bin}/gpgsm rix, + @{lib}/gnupg/keyboxd rix, + + owner @{HOME}/@{XDG_GPG_DIR}/ rw, + owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, owner @{user_share_dirs}/dino/ rw, owner @{user_share_dirs}/dino/** rwk, + owner @{run}/user/@{uid}/gnupg/ rw, + owner @{run}/user/@{uid}/gnupg/S.keyboxd rw, + + @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, - profile gpg { - include - - @{bin}/gpg{,2} mr, - @{bin}/gpgconf mr, - @{bin}/gpgsm mr, - - owner @{HOME}/.gnupg/ rw, - owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**, - - include if exists - } - - include if exists + include if exists } # vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 940b7b0b1..bb995d3b2 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -87,6 +87,7 @@ cups-notifier-rss complain cups-pk-helper-mechanism complain cupsd attach_disconnected,complain ddcutil complain +dino attach_disconnected,complain DiscoverNotifier complain dkms attach_disconnected,complain dockerd attach_disconnected,complain From 788d86593930d16bb2979f3598fb13cc2af14df5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 20:56:58 +0100 Subject: [PATCH 0075/1455] feat(profile): general update. --- apparmor.d/abstractions/app/firefox | 5 +++-- apparmor.d/abstractions/audio-client | 2 +- apparmor.d/abstractions/audio-server | 4 ---- apparmor.d/groups/browsers/firefox-glxtest | 4 ++++ apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome | 1 + apparmor.d/groups/gnome/gnome-clocks | 3 +++ apparmor.d/groups/gnome/gnome-software | 5 +++++ apparmor.d/groups/gnome/gnome-system-monitor | 2 ++ apparmor.d/groups/gnome/gnome-tweaks | 2 ++ apparmor.d/groups/gnome/gsd-datetime | 1 + apparmor.d/groups/gnome/org.gnome.NautilusPreviewer | 1 + apparmor.d/groups/gnome/tracker-miner | 2 ++ apparmor.d/groups/gvfs/gvfsd-mtp | 2 +- apparmor.d/groups/gvfs/gvfsd-recent | 2 +- apparmor.d/groups/pacman/pacman | 3 +++ apparmor.d/groups/virt/libvirtd | 1 + apparmor.d/groups/virt/virtnodedevd | 1 + apparmor.d/groups/xfce/xfce-sensors | 2 +- apparmor.d/profiles-a-f/engrampa | 3 +-- apparmor.d/profiles-a-f/firewalld | 5 ++--- apparmor.d/profiles-a-f/flatpak-app | 1 + apparmor.d/profiles-g-l/htop | 2 +- apparmor.d/profiles-m-r/monitorix | 2 +- apparmor.d/profiles-m-r/mullvad-setup | 2 ++ apparmor.d/profiles-m-r/qnapi | 1 - apparmor.d/profiles-s-z/YACReaderLibrary | 9 +++++++++ apparmor.d/profiles-s-z/sanoid | 2 -- apparmor.d/profiles-s-z/sensors-detect | 2 +- apparmor.d/profiles-s-z/steam-game-proton | 1 + apparmor.d/profiles-s-z/steam-gameoverlayui | 3 ++- apparmor.d/profiles-s-z/syncoid | 2 -- apparmor.d/profiles-s-z/system-config-printer | 2 -- apparmor.d/profiles-s-z/waybar | 3 ++- apparmor.d/tunables/multiarch.d/system | 1 + 34 files changed, 57 insertions(+), 27 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 7895db4e9..f1443a936 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -69,11 +69,12 @@ /usr/share/webext/{,**} r, /usr/share/xul-ext/kwallet5/* r, + /etc/{,opensc/}opensc.conf r, /etc/@{name}/{,**} r, /etc/fstab r, + /etc/lsb-release r, /etc/mailcap r, /etc/mime.types r, - /etc/{,opensc/}opensc.conf r, /etc/sysconfig/proxy r, /etc/xdg/* r, /etc/xul-ext/kwallet5.js r, @@ -96,7 +97,7 @@ owner @{tmp}/firefox/* rwk, owner @{tmp}/Temp-@{uuid}/ rw, owner @{tmp}/Temp-@{uuid}/* rwk, - owner @{tmp}/tmp-???.xpi rw, + owner @{tmp}/tmp-*.xpi rw, owner @{tmp}/tmpaddon r, owner @{tmp}/tmpaddon-@{int} r, diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index ca4a8e16c..ceacbae9c 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -5,7 +5,7 @@ # Most programs do not need access to audio devices, audio-client only includes # configuration files to be used by client applications. - /usr/share/alsa/** r, + /usr/share/alsa/{,**} r, /usr/share/openal/hrtf/{,**} r, /usr/share/pipewire/client-rt.conf r, /usr/share/pipewire/client.conf r, diff --git a/apparmor.d/abstractions/audio-server b/apparmor.d/abstractions/audio-server index 619ba1111..ef69d2d54 100644 --- a/apparmor.d/abstractions/audio-server +++ b/apparmor.d/abstractions/audio-server @@ -7,10 +7,6 @@ include - /usr/share/alsa/{,**} r, - - /etc/alsa/conf.d/{,**} r, - @{run}/udev/data/+sound:card@{int} r, # for sound card @{sys}/class/ r, diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest index f2526292b..995f94f8f 100644 --- a/apparmor.d/groups/browsers/firefox-glxtest +++ b/apparmor.d/groups/browsers/firefox-glxtest @@ -9,6 +9,7 @@ include @{name} = firefox{,.sh,-esr,-bin} @{lib_dirs} = @{lib}/@{name} /opt/@{name} @{config_dirs} = @{HOME}/.mozilla/ +@{cache_dirs} = @{user_cache_dirs}/mozilla/ @{exec_path} = @{lib_dirs}/glxtest profile firefox-glxtest @{exec_path} flags=(attach_disconnected) { @@ -19,6 +20,9 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + owner @{cache_dirs}/firefox/*/startupCache/scriptCache-* r, + owner @{cache_dirs}/firefox/*/startupCache/startupCache* r, + owner @{config_dirs}/firefox/*/.parentlock rw, owner @{tmp}/@{name}/.parentlock rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 89135381c..588d4d393 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -71,6 +71,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { owner @{desktop_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rw, owner @{HOME}/ r, + owner @{HOME}/* r, owner @{HOME}/*/{,**} rw, owner @{MOUNTS}/ r, diff --git a/apparmor.d/groups/gnome/gnome-clocks b/apparmor.d/groups/gnome/gnome-clocks index fbb3942f7..5ebd08e5a 100644 --- a/apparmor.d/groups/gnome/gnome-clocks +++ b/apparmor.d/groups/gnome/gnome-clocks @@ -14,8 +14,11 @@ profile gnome-clocks @{exec_path} { include include include + include include + network netlink raw, + #aa:dbus own bus=session name=org.gnome.clocks @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index b1a0bd8ac..2ebff5ddf 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -83,6 +83,11 @@ profile gnome-software @{exec_path} { owner @{user_share_dirs}/ r, owner @{user_share_dirs}/flatpak/.changed w, + owner @{user_share_dirs}/flatpak/{app,runtime}/ r, + owner @{user_share_dirs}/flatpak/{app,runtime}/*/ r, + owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/deploy r, + owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/metadata r, + owner @{user_share_dirs}/flatpak/{app,runtime}/*/*/ r, owner @{user_share_dirs}/flatpak/repo/ rw, owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**, owner @{user_share_dirs}/gnome-software/{,**} rw, diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 126140401..8e79bd015 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -38,6 +38,8 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { /usr/share/gnome-system-monitor/{,**} r, /usr/share/firefox-esr/browser/chrome/icons/default/*.png r, + owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, + owner @{run}/user/@{uid}/doc/ rw, owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, diff --git a/apparmor.d/groups/gnome/gnome-tweaks b/apparmor.d/groups/gnome/gnome-tweaks index 84f37da76..01518446b 100644 --- a/apparmor.d/groups/gnome/gnome-tweaks +++ b/apparmor.d/groups/gnome/gnome-tweaks @@ -16,6 +16,8 @@ profile gnome-tweaks @{exec_path} { include include + network netlink raw, + @{exec_path} mr, @{bin}/ r, diff --git a/apparmor.d/groups/gnome/gsd-datetime b/apparmor.d/groups/gnome/gsd-datetime index d25b4cdcc..d125cd13d 100644 --- a/apparmor.d/groups/gnome/gsd-datetime +++ b/apparmor.d/groups/gnome/gsd-datetime @@ -34,6 +34,7 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/geocode-glib/* r, + owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/stat r, owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index ee2de80ce..6b2544a84 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -47,6 +47,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/@{tid}/comm w, owner @{PROC}/@{pid}/task/@{tid}/stat r, /dev/media@{int} r, diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index b037db499..a49f28b47 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -65,7 +65,9 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_share_dirs}/applications/ r, + owner /var/tmp/etilqs_@{hex15} rw, owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{hex15} rw, owner @{tmp}/etilqs_@{hex16} rw, # Allow to search user files diff --git a/apparmor.d/groups/gvfs/gvfsd-mtp b/apparmor.d/groups/gvfs/gvfsd-mtp index d8ea92d1f..a5a4c8ce2 100644 --- a/apparmor.d/groups/gvfs/gvfsd-mtp +++ b/apparmor.d/groups/gvfs/gvfsd-mtp @@ -21,7 +21,7 @@ profile gvfsd-mtp @{exec_path} { @{exec_path} mr, - owner @{HOME}/{,**} rw, + owner @{HOME}/{,**} rw, # FIXME: ? owner @{MOUNTS}/{,**} rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-recent b/apparmor.d/groups/gvfs/gvfsd-recent index ab2ea4677..9509d3184 100644 --- a/apparmor.d/groups/gvfs/gvfsd-recent +++ b/apparmor.d/groups/gvfs/gvfsd-recent @@ -36,7 +36,7 @@ profile gvfsd-recent @{exec_path} { @{exec_path} mr, # Full access to user's data - owner @{HOME}/{,**} rw, + owner @{HOME}/{,**} rw, # FIXME: ? owner @{MOUNTS}/{,**} rw, owner @{HOME}/.zshenv r, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 1f3d9ad8b..ab08d1f18 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -118,6 +118,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { /var/** rwlk -> /var/**, # Read packages files + @{user_pkg_dirs}/ r, @{user_pkg_dirs}/**/ r, @{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r, @@ -193,6 +194,8 @@ profile pacman @{exec_path} flags=(attach_disconnected) { capability dac_read_search, capability sys_resource, + signal send set=cont peer=child-pager, + @{bin}/pager rPx -> child-pager, @{bin}/less rPx -> child-pager, @{bin}/more rPx -> child-pager, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 376749d9e..3fbbfc51f 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -131,6 +131,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { /usr/share/edk2*/{,**} rk, /usr/share/hwdata/* r, + /usr/share/iproute2/{,**} r, /usr/share/libvirt/{,**} r, /usr/share/mime/mime.cache r, /usr/share/misc/pci.ids r, diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index 50b8e4889..a39c04504 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -62,6 +62,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c21:@{int} r, # Generic SCSI access @{run}/udev/data/c29:@{int} r, # For /dev/fb[0-9]* @{run}/udev/data/c81:@{int} r, # For video4linux + @{run}/udev/data/c89:@{int} r, # For I2C bus interface @{run}/udev/data/c90:@{int} r, # For RAM, ROM, Flash @{run}/udev/data/c116:@{int} r, # For ALSA @{run}/udev/data/c202:@{int} r, # CPU model-specific registers diff --git a/apparmor.d/groups/xfce/xfce-sensors b/apparmor.d/groups/xfce/xfce-sensors index c2eb97c30..ae72f8dbc 100644 --- a/apparmor.d/groups/xfce/xfce-sensors +++ b/apparmor.d/groups/xfce/xfce-sensors @@ -16,7 +16,7 @@ profile xfce-sensors @{exec_path} { @{sys}/class/hwmon/ r, @{sys}/class/power_supply/ r, @{sys}/class/thermal/ r, - @{sys}/devices/@{pci}/i2c-@{int}/name r, + @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, @{sys}/devices/**/hwmon@{int}/ r, @{sys}/devices/**/hwmon@{int}/{name,temp*} r, @{sys}/devices/**/hwmon@{int}/**/ r, diff --git a/apparmor.d/profiles-a-f/engrampa b/apparmor.d/profiles-a-f/engrampa index 78fa87937..86077c89b 100644 --- a/apparmor.d/profiles-a-f/engrampa +++ b/apparmor.d/profiles-a-f/engrampa @@ -75,8 +75,7 @@ profile engrampa @{exec_path} { owner @{user_share_dirs}/ r, - /tmp/ r, - owner @{tmp}/** rw, + /tmp/ r, @{run}/mount/utab r, diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/profiles-a-f/firewalld index d32790f0b..e450c78cd 100644 --- a/apparmor.d/profiles-a-f/firewalld +++ b/apparmor.d/profiles-a-f/firewalld @@ -44,9 +44,8 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { /usr/local/lib/python3.@{int}/dist-packages/ r, - /usr/share/libalternatives/ r, - /usr/share/libalternatives/ebtables*/{,*} r, - /usr/share/libalternatives/ip{,4,6}tables*/{,*} r, + /usr/share/iproute2/{,**} r, + /usr/share/libalternatives/{,**} r, /etc/firewalld/{,**} rw, /etc/iproute2/group r, diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app index 83be5477c..87e9b443d 100644 --- a/apparmor.d/profiles-a-f/flatpak-app +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -89,6 +89,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { owner @{run}/flatpak/app/** rw, owner @{run}/flatpak/doc/** rw, owner @{run}/ld-so-cache-dir/* rw, + owner @{run}/user/ r, owner @{run}/user/@{uid}/*.kioworker.socket r, owner @{run}/user/@{uid}/#@{int} rwl, diff --git a/apparmor.d/profiles-g-l/htop b/apparmor.d/profiles-g-l/htop index d06991025..7e8faecfa 100644 --- a/apparmor.d/profiles-g-l/htop +++ b/apparmor.d/profiles-g-l/htop @@ -89,7 +89,7 @@ profile htop @{exec_path} { @{sys}/class/hwmon/ r, @{sys}/class/i2c-adapter/ r, @{sys}/class/power_supply/ r, - @{sys}/devices/@{pci}/i2c-@{int}/name r, + @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, @{sys}/devices/**/hwmon@{int}/ r, @{sys}/devices/**/hwmon@{int}/{name,temp*} r, @{sys}/devices/**/hwmon@{int}/**/ r, diff --git a/apparmor.d/profiles-m-r/monitorix b/apparmor.d/profiles-m-r/monitorix index cb220a7b6..38cbecd71 100644 --- a/apparmor.d/profiles-m-r/monitorix +++ b/apparmor.d/profiles-m-r/monitorix @@ -95,7 +95,7 @@ profile monitorix @{exec_path} { @{PROC}/@{pids}/io r, @{sys}/class/i2c-adapter/ r, - @{sys}/devices/@{pci}/i2c-@{int}/name r, + @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, @{sys}/class/hwmon/ r, @{sys}/devices/**/thermal*/{,**} r, @{sys}/devices/**/hwmon*/{,**} r, diff --git a/apparmor.d/profiles-m-r/mullvad-setup b/apparmor.d/profiles-m-r/mullvad-setup index db29113ce..46e10927b 100644 --- a/apparmor.d/profiles-m-r/mullvad-setup +++ b/apparmor.d/profiles-m-r/mullvad-setup @@ -9,9 +9,11 @@ include @{exec_path} = /opt/Mullvad*/resources/mullvad-setup profile mullvad-setup @{exec_path} { include + include @{exec_path} mr, + @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/cgroup r, # File Inherit diff --git a/apparmor.d/profiles-m-r/qnapi b/apparmor.d/profiles-m-r/qnapi index 911519459..e72a6a5c6 100644 --- a/apparmor.d/profiles-m-r/qnapi +++ b/apparmor.d/profiles-m-r/qnapi @@ -55,7 +55,6 @@ profile qnapi @{exec_path} { /tmp/ r, owner @{tmp}/@{hex}.* rw, - owner @{tmp}/** rw, owner @{tmp}/#@{int} rw, owner @{tmp}/QNapi-*-rc wl -> /tmp/#@{int}, owner @{tmp}/QNapi-*-rc.lock rwk, diff --git a/apparmor.d/profiles-s-z/YACReaderLibrary b/apparmor.d/profiles-s-z/YACReaderLibrary index 418167345..5d773292d 100644 --- a/apparmor.d/profiles-s-z/YACReaderLibrary +++ b/apparmor.d/profiles-s-z/YACReaderLibrary @@ -14,11 +14,16 @@ profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted include include include + include include + include + network inet dgram, network inet stream, + network inet6 dgram, network inet6 stream, network netlink dgram, + network netlink raw, @{exec_path} mr, @@ -31,6 +36,7 @@ profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted owner @{user_books_dirs}/{,**} r, owner @{user_books_dirs}/**/.yacreaderlibrary/{,**} rwk, + owner @{user_books_dirs}/**/None rw, owner @{user_cache_dirs}/YACReader/ rw, owner @{user_cache_dirs}/YACReader/YACReaderLibrary/ rw, @@ -43,7 +49,10 @@ profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted owner @{tmp}/@{uuid} w, + @{run}/mount/utab r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, include if exists } diff --git a/apparmor.d/profiles-s-z/sanoid b/apparmor.d/profiles-s-z/sanoid index aadad6860..755efba9b 100644 --- a/apparmor.d/profiles-s-z/sanoid +++ b/apparmor.d/profiles-s-z/sanoid @@ -27,8 +27,6 @@ profile sanoid @{exec_path} flags=(complain) { @{run}/sanoid/sanoid_cacheupdate.lock rwk, @{run}/sanoid/sanoid_pruning.lock rwk, - owner @{tmp}/** rw, - include if exists } diff --git a/apparmor.d/profiles-s-z/sensors-detect b/apparmor.d/profiles-s-z/sensors-detect index 5eececb0b..18e4c135f 100644 --- a/apparmor.d/profiles-s-z/sensors-detect +++ b/apparmor.d/profiles-s-z/sensors-detect @@ -27,7 +27,7 @@ profile sensors-detect @{exec_path} { @{sys}/bus/pci/devices/ r, @{sys}/class/i2c-adapter/ r, @{sys}/devices/@{pci}/{class,vendor,device} r, - @{sys}/devices/@{pci}/i2c-@{int}/name r, + @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, @{sys}/devices/@{pci}/modalias r, @{sys}/devices/virtual/dmi/id/board_{version,vendor,name} r, @{sys}/devices/virtual/dmi/id/chassis_type r, diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton index 49a668996..95eec5abc 100644 --- a/apparmor.d/profiles-s-z/steam-game-proton +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -29,6 +29,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected) { network unix stream, signal receive peer=steam, + unix, @{exec_path} mr, @{bin}/bwrap mrix, diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui index 077e6cf8b..d6680ac61 100644 --- a/apparmor.d/profiles-s-z/steam-gameoverlayui +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -23,7 +23,8 @@ profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) { network inet stream, network inet6 stream, - network unix stream, + + unix, @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/syncoid b/apparmor.d/profiles-s-z/syncoid index c90665cdf..ba3e774e6 100644 --- a/apparmor.d/profiles-s-z/syncoid +++ b/apparmor.d/profiles-s-z/syncoid @@ -25,8 +25,6 @@ profile syncoid @{exec_path} flags=(complain) { /etc/mbuffer.rc r, - owner @{tmp}/** rw, - @{PROC}/@{pids}/maps r, include if exists diff --git a/apparmor.d/profiles-s-z/system-config-printer b/apparmor.d/profiles-s-z/system-config-printer index ab36047f2..f929adcae 100644 --- a/apparmor.d/profiles-s-z/system-config-printer +++ b/apparmor.d/profiles-s-z/system-config-printer @@ -46,8 +46,6 @@ profile system-config-printer @{exec_path} flags=(complain) { @{run}/cups/cups.sock rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, - owner @{tmp}/* rw, - owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index d5116b043..e6cd61581 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -9,7 +9,8 @@ include @{exec_path} = @{bin}/waybar profile waybar @{exec_path} flags=(attach_disconnected) { include - include + include + include include include include diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 1b4206dad..aaebe5ed1 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -48,6 +48,7 @@ @{rand8}=@{rand4}@{rand4} @{rand9}=@{rand8}@{c} @{rand10}=@{rand8}@{rand2} +@{rand15}=@{rand8}@{rand4}@{rand2}@{c} @{rand16}=@{rand8}@{rand8} @{rand32}=@{rand16}@{rand16} @{rand64}=@{rand64}@{rand64} From 50831a2fc88e0943eb6ebfb210589716d80592af Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 Aug 2024 21:06:34 +0100 Subject: [PATCH 0076/1455] feat(abs): split steam-game abstraction to game and steam-game abstractions. --- apparmor.d/abstractions/common/game | 112 ++++++++++++++++++++++ apparmor.d/abstractions/common/steam-game | 94 +----------------- docs/development/abstractions.md | 9 ++ 3 files changed, 122 insertions(+), 93 deletions(-) create mode 100644 apparmor.d/abstractions/common/game diff --git a/apparmor.d/abstractions/common/game b/apparmor.d/abstractions/common/game new file mode 100644 index 000000000..a3619b164 --- /dev/null +++ b/apparmor.d/abstractions/common/game @@ -0,0 +1,112 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Core set of resources for any games on Linux. Runtimes such as sandboxing, +# wine, proton, game launchers should use this abstraction. + +# This abstraction use the following tunables: +# - @{XDG_GAMESSTUDIO_DIR} for game studio and game engines specific directories +# (Default: @{XDG_GAMESSTUDIO_DIR}="unity3d") +# - @{user_games_dirs} for user specific game directories (eg: steam storage dir) + + include + include + include + include + include + include + include + + @{bin}/uname rix, + @{bin}/xdg-settings rPx, + @{browsers_path} rPx, + + @{bin}/env r, + + @{lib}/ r, + / r, + /home/ r, + /usr/ r, + /usr/local/ r, + /usr/local/lib/ r, + + /etc/machine-id r, + /var/lib/dbus/machine-id r, + + owner @{HOME}/ r, + + owner @{user_games_dirs}/ r, + owner @{user_games_dirs}/*/ r, + owner @{user_games_dirs}/*/{,**} rwkl, + + owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw, + owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, + + owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw, + owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, + + @{tmp}/ r, + owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/ rw, + owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, + owner @{tmp}/#@{int} rw, + owner @{tmp}/CASESENSITIVETEST@{hex32} rw, + owner @{tmp}/crashes/ rw, + owner @{tmp}/crashes/** rwk, + owner @{tmp}/miles_image_@{rand6} mrw, + owner @{tmp}/runtime-info.txt.@{rand6} rw, + owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, + + owner /dev/shm/mono.@{int} rw, + owner /dev/shm/softbuffer-x11-@{rand6}@{c} rw, + + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + + @{sys}/ r, + @{sys}/bus/ r, + @{sys}/class/ r, + @{sys}/class/hidraw/ r, + @{sys}/class/input/ r, + @{sys}/devices/ r, + @{sys}/devices/@{pci}/boot_vga r, + @{sys}/devices/@{pci}/net/*/carrier r, + @{sys}/devices/**/input@{int}/ r, + @{sys}/devices/**/input@{int}/**/{vendor,product} r, + @{sys}/devices/**/input@{int}/capabilities/* r, + @{sys}/devices/**/input/input@{int}/ r, + @{sys}/devices/**/uevent r, + @{sys}/devices/system/ r, + @{sys}/devices/system/clocksource/clocksource@{int}/current_clocksource r, + @{sys}/devices/system/cpu/cpu@{int}/ r, + @{sys}/devices/virtual/dmi/id/* r, + @{sys}/devices/virtual/net/*/carrier r, + @{sys}/kernel/ r, + + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, + + @{PROC}/uptime r, + @{PROC}/version r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/pagemap r, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{PROC}/@{pid}/task/@{tid}/stat r, + + /dev/ r, + /dev/hidraw@{int} rw, + /dev/input/ r, + /dev/input/event@{int} rw, + /dev/tty rw, + /dev/uinput rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/common/steam-game b/apparmor.d/abstractions/common/steam-game index c6a7aff75..4bd211f27 100644 --- a/apparmor.d/abstractions/common/steam-game +++ b/apparmor.d/abstractions/common/steam-game @@ -2,45 +2,13 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - include - include - include - include - include - include - include - - @{bin}/uname rix, - @{bin}/xdg-settings rPx, - @{browsers_path} rPx, - - @{bin}/env r, + include @{lib_dirs}/ r, - @{lib}/ r, - / r, - /home/ r, - /usr/ r, - /usr/local/ r, - /usr/local/lib/ r, - /etc/machine-id r, - /var/lib/dbus/machine-id r, - - owner @{HOME}/ r, owner @{HOME}/.steam/steam.pid r, owner @{HOME}/.steam/steam.pipe r, - owner @{user_games_dirs}/ r, - owner @{user_games_dirs}/*/ r, - owner @{user_games_dirs}/*/{,**} rwkl, - - owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw, - owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, - - owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw, - owner @{user_share_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, - owner @{app_dirs}/ r, owner @{app_dirs}/[^S]*/** rwlk, # No access to "SteamLinuxRuntime_sniper" @@ -56,19 +24,6 @@ owner @{share_dirs}/steamapps/appmanifest_* rw, owner @{share_dirs}/steamapps/shadercache/{,**} rwk, - @{tmp}/ r, - owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/ rw, - owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, - owner @{tmp}/#@{int} rw, - owner @{tmp}/CASESENSITIVETEST@{hex32} rw, - owner @{tmp}/crashes/ rw, - owner @{tmp}/crashes/** rwk, - owner @{tmp}/miles_image_@{rand6} mrw, - owner @{tmp}/runtime-info.txt.@{rand6} rw, - owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, - - owner /dev/shm/mono.@{int} rw, - owner /dev/shm/softbuffer-x11-@{rand6}@{c} rw, owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw, owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, @@ -76,53 +31,6 @@ owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, owner /dev/shm/ValveIPCSHM_@{uid} rw, - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/c13:@{int} r, # for /dev/input/* - - @{sys}/ r, - @{sys}/bus/ r, - @{sys}/class/ r, - @{sys}/class/hidraw/ r, - @{sys}/class/input/ r, - @{sys}/devices/ r, - @{sys}/devices/@{pci}/boot_vga r, - @{sys}/devices/@{pci}/net/*/carrier r, - @{sys}/devices/**/input@{int}/ r, - @{sys}/devices/**/input@{int}/**/{vendor,product} r, - @{sys}/devices/**/input@{int}/capabilities/* r, - @{sys}/devices/**/input/input@{int}/ r, - @{sys}/devices/**/uevent r, - @{sys}/devices/system/ r, - @{sys}/devices/system/clocksource/clocksource@{int}/current_clocksource r, - @{sys}/devices/system/cpu/cpu@{int}/ r, - @{sys}/devices/virtual/dmi/id/* r, - @{sys}/devices/virtual/net/*/carrier r, - @{sys}/kernel/ r, - - @{sys}/fs/cgroup/user.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, - owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, - - @{PROC}/uptime r, - @{PROC}/version r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/pagemap r, - owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/task/ r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner @{PROC}/@{pid}/task/@{tid}/stat r, - - /dev/ r, - /dev/hidraw@{int} rw, - /dev/input/ r, - /dev/input/event@{int} rw, - /dev/tty rw, - /dev/uinput rw, - include if exists # vim:syntax=apparmor diff --git a/docs/development/abstractions.md b/docs/development/abstractions.md index 82c7f4b04..1e075e66c 100644 --- a/docs/development/abstractions.md +++ b/docs/development/abstractions.md @@ -122,6 +122,15 @@ A minimal set of rules for all electron based UI applications. It works as a *fu @{cache_dirs} = @{user_cache_dirs}/@{name} ``` +### **`common/game`** + +Core set of resources for any games on Linux. Runtimes such as sandboxing, wine, proton, game launchers should use this abstraction. + +This abstraction uses the following tunables: + +- `@{XDG_GAMESSTUDIO_DIR}` for game studio and game engines specific directories (Default: `@{XDG_GAMESSTUDIO_DIR}="unity3d"`) +- `@{user_games_dirs}` for user specific game directories (e.g.: steam storage dir) + ### **`common/systemd`** Common set of rules for internal systemd suite. From 03639c56bc879a71988123ba3dfa76699eb9edc9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 21 Aug 2024 10:01:36 +0100 Subject: [PATCH 0077/1455] fix(profile): add graphics to dino. See #426 --- apparmor.d/profiles-a-f/dino | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-a-f/dino b/apparmor.d/profiles-a-f/dino index f7d057f8d..dad921850 100644 --- a/apparmor.d/profiles-a-f/dino +++ b/apparmor.d/profiles-a-f/dino @@ -14,6 +14,7 @@ profile dino @{exec_path} flags=(attach_disconnected) { include include include + include include include include From 006ed3f681783dda476ede44101ed4bf39db96ba Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 21 Aug 2024 10:10:28 +0100 Subject: [PATCH 0078/1455] fix(profile): fscrypt works on a specific homedir. fix #430 --- apparmor.d/groups/gnome/gdm-session-worker | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 92744652b..f50e30311 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -99,9 +99,11 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { owner /.fscrypt/protectors/@{hex16} r, /home/ r, + /home/.fscrypt/policies/ r, + owner /home/.fscrypt/policies/@{hex32} r, + owner /home/.fscrypt/protectors/@{hex16}.link r, + owner @{HOME}/.pam_environment r, - owner @{HOME}/policies/@{hex32} r, - owner @{HOME}/protectors/@{hex16}.link r, @{run}/cockpit/inactive.motd r, owner @{run}/systemd/seats/seat@{int} r, From 6b822d01341568d3648ae1bc2b35523efd317392 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 21 Aug 2024 10:26:12 +0100 Subject: [PATCH 0079/1455] feat(profile): add veracrypt. --- apparmor.d/profiles-s-z/veracrypt | 96 +++++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 97 insertions(+) create mode 100644 apparmor.d/profiles-s-z/veracrypt diff --git a/apparmor.d/profiles-s-z/veracrypt b/apparmor.d/profiles-s-z/veracrypt new file mode 100644 index 000000000..148d28957 --- /dev/null +++ b/apparmor.d/profiles-s-z/veracrypt @@ -0,0 +1,96 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/veracrypt +profile veracrypt @{exec_path} { + include + include + include + include + include + include + include + include + + capability chown, + capability dac_read_search, + capability fsetid, + capability sys_admin, + capability sys_ptrace, + + mount fstype=fuse.veracrypt options=(rw nodev nosuid) veracrypt -> /tmp/.veracrypt_*/, + + @{exec_path} mrix, + + @{sh_path} rix, + @{open_path} rPx -> child-open-help, + @{bin}/dmsetup rPx, + @{bin}/grep rix, + @{bin}/kmod rix, + @{bin}/ldconfig rix, + @{bin}/losetup rCx -> losetup, + @{bin}/mount rPx, + @{bin}/sudo rix, + @{bin}/umount rCx -> umount, + @{bin}/wc rix, + @{file_explorers_path} rPx, + + /home/ r, + + # Mount points + @{MOUNTS}/ rw, + @{MOUNTS}/*/ rw, + + owner @{HOME}/ r, + owner @{HOME}/.VeraCrypt-lock-@{user} rwk, + + owner @{user_config_dirs}/VeraCrypt/ rw, + owner @{user_config_dirs}/VeraCrypt/** rwk, + + /tmp/.veracrypt_*/ rw, + /tmp/.veracrypt_*/** rwk, + + @{sys}/module/compression r, + @{sys}/module/dm_mod/initstate r, + + @{PROC}/partitions r, + owner @{PROC}/@{pid}/mounts r, + + /dev/fuse rw, + /dev/tty rw, + + profile umount { + include + + capability sys_admin, + + umount /tmp/.veracrypt_*/, + umount @{MOUNTS}/{,*/}, + + @{bin}/umount mr, + + owner @{run}/mount/utab r, + + include if exists + } + + profile losetup { + include + include + + capability sys_rawio, + + @{bin}/losetup mr, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index bb995d3b2..f37e7f991 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -377,6 +377,7 @@ update-grub complain update-secureboot-policy complain userdbctl complain utempter attach_disconnected,complain +veracrypt complain virt-manager attach_disconnected,complain virtinterfaced attach_disconnected,complain virtiofsd complain,attach_disconnected From c25b76c2334f22d764d62f4d08b9492e9dafbf90 Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 21 Aug 2024 11:55:04 +0200 Subject: [PATCH 0080/1455] allow read access to atool config files --- apparmor.d/profiles-a-f/atool | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apparmor.d/profiles-a-f/atool b/apparmor.d/profiles-a-f/atool index 947245d2a..5568b9e15 100644 --- a/apparmor.d/profiles-a-f/atool +++ b/apparmor.d/profiles-a-f/atool @@ -38,6 +38,7 @@ profile atool @{exec_path} { @{bin}/lzma rix, @{bin}/lzop rix, @{bin}/lzop rix, + @{lib}/p7zip/7z rix, @{bin}/rar rix, @{bin}/tar rix, @{bin}/unace rix, @@ -47,6 +48,9 @@ profile atool @{exec_path} { @{bin}/xz rix, @{bin}/zip rix, + /etc/atool.conf r, + owner @{HOME}/.atoolrc r, + include if exists } From f4330796c454bea5dd0a1c7289d4d4ff9914318c Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 21 Aug 2024 12:34:14 +0200 Subject: [PATCH 0081/1455] add write permissions to remove metadata --- apparmor.d/profiles-a-f/exiftool | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-a-f/exiftool b/apparmor.d/profiles-a-f/exiftool index 23aac34d4..9db5d83ea 100644 --- a/apparmor.d/profiles-a-f/exiftool +++ b/apparmor.d/profiles-a-f/exiftool @@ -11,6 +11,7 @@ profile exiftool @{exec_path} { include include include + include @{exec_path} mr, From 909d3062b570e8183f6661aa419975ab8e11a5fb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 22 Aug 2024 17:43:00 +0100 Subject: [PATCH 0082/1455] feat(profile): ssh: add sshd-session fix #442 --- apparmor.d/groups/ssh/sshd | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 1410d090f..3746c4261 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -67,6 +67,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { @{bin}/nologin rPx, @{bin}/passwd rPx, @{lib}/openssh/sftp-server rPx, + @{lib}/ssh/sshd-session rix, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*.conf} r, From 96d774a9ebae3fe61623029389d763e0c73aa362 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 25 Aug 2024 07:28:12 -0300 Subject: [PATCH 0083/1455] Update systemd-journald apparmor="DENIED" operation="open" class="file" profile="systemd-journald" name="/run/udev/data/+mdio_bus:r8169-0-300:00" comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 FSUID="root" OUID="root" --- apparmor.d/groups/systemd/systemd-journald | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index 29191a95d..3d1fdfa6d 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -50,6 +50,7 @@ profile systemd-journald @{exec_path} { @{run}/udev/data/+bluetooth:* r, @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/+mdio_bus:* r, @{run}/udev/data/+pci:* r, @{run}/udev/data/+platform:* r, @{run}/udev/data/+scsi:* r, From 1655a9f5ab0956142d78a8795d491a9e836d1ad9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 18:30:39 +0100 Subject: [PATCH 0084/1455] feat(profile): more kde integration. fix #442 --- apparmor.d/abstractions/bash-strict | 1 + .../groups/akonadi/akonadi_birthdays_resource | 1 + .../groups/akonadi/akonadi_maildir_resource | 2 + .../akonadi/akonadi_unifiedmailbox_agent | 1 + .../groups/browsers/firefox-kmozillahelper | 5 ++ .../groups/display-manager/xdm-xsession | 5 +- apparmor.d/groups/freedesktop/pulseaudio | 2 + apparmor.d/groups/kde/kaccess | 3 ++ apparmor.d/groups/kde/kde-powerdevil | 3 +- apparmor.d/groups/kde/kded | 15 ++++-- apparmor.d/groups/kde/konsole | 5 ++ apparmor.d/groups/kde/ksmserver | 4 +- apparmor.d/groups/kde/kwin_x11 | 2 +- apparmor.d/groups/kde/okular | 54 ++++++++++++++++++- apparmor.d/groups/kde/plasmashell | 3 ++ apparmor.d/groups/kde/sddm-greeter | 2 +- apparmor.d/groups/network/nm-dispatcher | 5 +- apparmor.d/groups/systemd/systemd-udevd | 7 +-- apparmor.d/profiles-a-f/btrfs | 16 +++--- apparmor.d/profiles-g-l/issue-generator | 1 + apparmor.d/profiles-m-r/pass | 8 +-- apparmor.d/profiles-m-r/pinentry-qt | 1 + apparmor.d/profiles-s-z/su | 2 + apparmor.d/profiles-s-z/xauth | 1 + apparmor.d/profiles-s-z/xclip | 3 +- 25 files changed, 120 insertions(+), 32 deletions(-) diff --git a/apparmor.d/abstractions/bash-strict b/apparmor.d/abstractions/bash-strict index eb4f65230..832f2add6 100644 --- a/apparmor.d/abstractions/bash-strict +++ b/apparmor.d/abstractions/bash-strict @@ -24,6 +24,7 @@ owner @{HOME}/.alias r, owner @{HOME}/.bash_aliases r, + owner @{HOME}/.bash_complete r, owner @{HOME}/.bash_history rw, owner @{HOME}/.bash_profile r, owner @{HOME}/.bashrc r, diff --git a/apparmor.d/groups/akonadi/akonadi_birthdays_resource b/apparmor.d/groups/akonadi/akonadi_birthdays_resource index 14b354b7e..70ff765b3 100644 --- a/apparmor.d/groups/akonadi/akonadi_birthdays_resource +++ b/apparmor.d/groups/akonadi/akonadi_birthdays_resource @@ -19,6 +19,7 @@ profile akonadi_birthdays_resource @{exec_path} { owner @{user_cache_dirs}/icon-cache.kcache rw, + owner @{user_config_dirs}/akonadi_birthdays_resourcerc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_maildir_resource b/apparmor.d/groups/akonadi/akonadi_maildir_resource index a534c7aad..7340d58a2 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildir_resource +++ b/apparmor.d/groups/akonadi/akonadi_maildir_resource @@ -17,6 +17,8 @@ profile akonadi_maildir_resource @{exec_path} { /usr/share/akonadi/plugins/serializer/{,*.desktop} r, + owner @{user_mail_dirs}/{,**} rw, + owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_maildir_resource_[0-9]rc r, diff --git a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent index 94c63a06b..d8af9fa47 100644 --- a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent +++ b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent @@ -17,6 +17,7 @@ profile akonadi_unifiedmailbox_agent @{exec_path} { owner @{user_cache_dirs}/icon-cache.kcache rw, + owner "@{user_config_dirs}/Unknown Organization/akonadi_unifiedmailbox_agent.conf_changes.dat" r, # see https://bugs.kde.org/show_bug.cgi?id=452565 owner @{user_config_dirs}/akonadi_unifiedmailbox_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index b4202ed0d..cac83b364 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -47,6 +47,11 @@ profile firefox-kmozillahelper @{exec_path} { owner @{user_config_dirs}/kmozillahelperrc r, owner @{user_config_dirs}/kmozillahelperrc.@{rand6} rwl, owner @{user_config_dirs}/kwinrc r, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, + + owner @{user_share_dirs}/kservices5/ r, + owner @{user_share_dirs}/kservices5/searchproviders/ r, owner @{run}/user/@{uid}/kmozillahelper@{rand6}.@{int}.kioworker.socket wl, owner @{run}/user/@{uid}/xauth_@{rand6} rl, diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index 962a97c3b..346f0e5b1 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -22,6 +22,7 @@ profile xdm-xsession @{exec_path} { @{bin}/cat rix, @{bin}/checkproc rix, @{bin}/dirname rix, + @{bin}/fortune rPUx, @{bin}/gpg-agent rPx, @{bin}/gpg-connect-agent rPx, @{bin}/grep rix, @@ -36,6 +37,7 @@ profile xdm-xsession @{exec_path} { @{bin}/tty rix, @{bin}/uname rix, @{bin}/whoami rix, + @{bin}/xmodmap rPUx, @{bin}/dbus-update-activation-environment rCx -> dbus, @{bin}/flatpak rPx, @@ -53,7 +55,7 @@ profile xdm-xsession @{exec_path} { @{etc_ro}/X11/xdm/sys.xsession rix, @{etc_ro}/X11/xinit/xinitrc.d/50-systemd-user.sh rix, @{etc_ro}/X11/xinit/xinitrc.d/xdg-user-dirs.sh rix, - @{HOME}/.xinitrc rPix, + @{HOME}/.xinitrc rPix, # TODO: rCx @{lib}/xinit/xinitrc rix, /usr/share/glib-2.0/schemas/gschemas.compiled r, @@ -73,6 +75,7 @@ profile xdm-xsession @{exec_path} { /etc/sysconfig/* r, owner @{HOME}/ r, + owner @{HOME}/@{XDG_GPG_DIR}/gpg-agent.conf r, owner @{user_share_dirs}/sddm/xorg-session.log rw, diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 5fc356133..029d7d4ad 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -78,6 +78,8 @@ profile pulseaudio @{exec_path} { /etc/pulse/{,**} r, + / r, + owner @{desktop_cache_dirs}/gstreamer-1.0/ rw, owner @{desktop_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, owner @{desktop_config_dirs}/dconf/user r, diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index fb6a01c8a..7d6e4867e 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/kaccess profile kaccess @{exec_path} { include + include include include include @@ -19,6 +20,8 @@ profile kaccess @{exec_path} { /usr/share/icons/{,**} r, + /etc/machine-id r, + owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/breezerc r, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 09ebb0d7c..64371caaa 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -57,14 +57,15 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{sys}/class/i2c-dev/ r, @{sys}/class/usbmisc/ r, @{sys}/devices/ r, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness r, @{sys}/devices/@{pci}/card@{int}/*/dpms r, @{sys}/devices/@{pci}/drm/card@{int}/**/dev r, @{sys}/devices/@{pci}/drm/card@{int}/*/dpms r, @{sys}/devices/@{pci}/drm/card@{int}/*/edid r, @{sys}/devices/@{pci}/drm/card@{int}/*/enabled r, @{sys}/devices/@{pci}/drm/card@{int}/*/status r, - @{sys}/devices/@{pci}/i2c-@{int}/**/dev r, @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, + @{sys}/devices/@{pci}/i2c-@{int}/**/dev r, @{sys}/devices/**/ r, @{sys}/devices/i2c-@{int}/name r, @{sys}/devices/platform/**/i2c-@{int}/**/name r, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 422fc103c..64fa472bb 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -12,10 +12,10 @@ profile kded @{exec_path} { include include include + include include include - include - include + include include include include @@ -31,7 +31,8 @@ profile kded @{exec_path} { ptrace (read), - signal (send) set=hup peer=xsettingsd, + signal send set=hup peer=xsettingsd, + signal send set=term peer=kioworker, #aa:dbus own bus=system name=com.redhat.NewPrinterNotification #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager @@ -54,6 +55,7 @@ profile kded @{exec_path} { @{bin}/plasma-welcome rPUx, @{bin}/python3.@{int} rix, @{bin}/setxkbmap rix, + @{bin}/xmodmap rPUx, @{bin}/xrdb rPx, @{bin}/xsetroot rPx, @{bin}/xsettingsd rPx, @@ -73,6 +75,7 @@ profile kded @{exec_path} { /etc/fstab r, /etc/xdg/accept-languages.codes r, + /etc/xdg/baloofilerc r, /etc/xdg/kcminputrc r, /etc/xdg/kde* r, /etc/xdg/kioslaverc r, @@ -83,6 +86,7 @@ profile kded @{exec_path} { / r, + owner @{HOME}/ r, owner @{HOME}/.gtkrc-2.0 rw, @{user_cache_dirs}/ksycoca{5,6}_* rwlk -> @{user_cache_dirs}/#@{int}, @@ -94,6 +98,7 @@ profile kded @{exec_path} { @{user_config_dirs}/kcookiejarrc.lock rwk, @{user_config_dirs}/kcookiejarrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/bluedevilglobalrc.lock rwk, owner @{user_config_dirs}/bluedevilglobalrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/breezerc r, @@ -125,20 +130,22 @@ profile kded @{exec_path} { owner @{user_config_dirs}/networkmanagement.notifyrc r, owner @{user_config_dirs}/plasma* r, owner @{user_config_dirs}/touchpadrc r, + owner @{user_config_dirs}/trashrc r, owner @{user_config_dirs}/Trolltech.conf.lock rwk, owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl, owner @{user_config_dirs}/xsettingsd/{,**} rw, - owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int}, owner @{user_share_dirs}/icc/{,edid-*} r, owner @{user_share_dirs}/kcookiejar/#@{int} rw, owner @{user_share_dirs}/kcookiejar/cookies.lock rwk, + owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int}, owner @{user_share_dirs}/kded{5,6}/{,**} rw, owner @{user_share_dirs}/kscreen/{,**} rwl, owner @{user_share_dirs}/kservices{5,6}/{,**} r, owner @{user_share_dirs}/ktp/cache.db rwk, owner @{user_share_dirs}/remoteview/ r, owner @{user_share_dirs}/services5/{,**} r, + owner @{user_share_dirs}/user-places.xbel r, @{run}/mount/utab r, @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 3151156a7..359297e42 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -64,6 +64,11 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/konsole/** rwlk, owner @{user_share_dirs}/kxmlgui5/konsole/{,**} r, + owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/konsolestaterc rw, + owner @{user_state_dirs}/konsolestaterc.@{rand6} rwl -> @{user_state_dirs}/#@{int}, + owner @{user_state_dirs}/konsolestaterc.lock rwk, + owner @{tmp}/#@{int} rw, owner @{tmp}/konsole.@{rand6} rw, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index 858bc4b9a..edfc3adea 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -16,11 +16,11 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include - signal (send) set=(usr1,term) peer=kscreenlocker-greet, + signal send set=(usr1,term) peer=kscreenlocker_greet, ptrace (read) peer=kbuildsycoca5, - unix (send, receive) type=stream peer=(label="kscreenlocker-greet",addr=none), + unix (send, receive) type=stream peer=(label="kscreenlocker_greet",addr=none), @{exec_path} mr, diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index a52a22330..8ee46455e 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -50,7 +50,7 @@ profile kwin_x11 @{exec_path} { owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/kdedefaults/plasmarc r, - owner @{user_config_dirs}/kwinoutputconfig.json r, + owner @{user_config_dirs}/kwinoutputconfig.json rw, owner @{user_config_dirs}/kwinrc.lock rwk, owner @{user_config_dirs}/kwinrc{,.@{rand6}} rwl, owner @{user_config_dirs}/kwinrulesrc r, diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index d732ee0f7..775491bdd 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -11,27 +11,47 @@ include profile okular @{exec_path} { include include + include include + include include include + include include include include + network netlink raw, + + signal send set=term peer=kioworker, + @{exec_path} mr, @{bin}/ps2pdf rPUx, @{bin}/gpg{,2} rCx -> gpg, - @{bin}/gpgcon rCx -> gpg, + @{bin}/gpgconf rCx -> gpg, @{bin}/gpgsm rCx -> gpg, @{open_path} rPx -> child-open, + #aa:exec kioworker /usr/share/color-schemes/{,**} r, /usr/share/okular/{,**} r, /usr/share/poppler/{,**} r, + /etc/fstab r, + /etc/xdg/baloofilerc r, + /etc/xdg/dolphinrc r, + /etc/xdg/menus/ r, + /etc/xdg/menus/applications-merged/ r, + + / r, + @{MOUNTS}/ r, + + owner @{user_cache_dirs}/ksycoca{5,6}_* r, + owner @{user_cache_dirs}/okular/{,**} rw, + owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/okularpartrc rw, owner @{user_config_dirs}/okularpartrc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, @@ -39,22 +59,52 @@ profile okular @{exec_path} { owner @{user_config_dirs}/okularrc rw, owner @{user_config_dirs}/okularrc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/okularrc.lock rwk, + owner @{user_config_dirs}/baloofilerc r, + owner @{user_config_dirs}/dolphinrc r, + owner @{user_config_dirs}/okular-generator-popplerrc r, + owner @{user_config_dirs}/KDE/*.conf r, + owner @{user_config_dirs}/kioslaverc r, + owner @{user_config_dirs}/kservicemenurc r, + owner @{user_config_dirs}/kwalletrc r, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/trashrc r, + owner @{user_share_dirs}/#@{int} rw, + owner @{user_share_dirs}/kxmlgui{5,6}/okular/{,*} r, owner @{user_share_dirs}/okular/ rw, owner @{user_share_dirs}/okular/** rwlk -> @{user_share_dirs}/okular/**, + owner @{user_share_dirs}/recently-used.xbel.@{rand6} rwl -> @{user_share_dirs}/#@{int}, + owner @{user_share_dirs}/recently-used.xbel.lock rk, + owner @{user_share_dirs}/user-places.xbel r, - owner @{user_cache_dirs}/okular/{,**} rw, + owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/okularstaterc rw, + owner @{user_state_dirs}/okularstaterc.@{rand6} rwl -> @{user_state_dirs}/#@{int}, + owner @{user_state_dirs}/okularstaterc.lock rwk, owner @{tmp}/#@{int} rw, + owner @{tmp}/okular.@{rand6} rwl -> /tmp/#@{int}, owner @{tmp}/okular_@{rand6}.ps rwl -> /tmp/#@{int}, + owner @{tmp}/messageviewer_attachment_@{rand6}/{,*} r, # files opened from KMail as mail attachment, + + owner @{run}/user/@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + owner @{run}/user/@{uid}/okular@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, + + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, profile gpg { include + include @{bin}/gpg{,2} mr, @{bin}/gpgcon mr, @{bin}/gpgsm mr, + owner @{HOME}/@{XDG_GPG_DIR}/*.conf r, + owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/gnupg/ r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index fe79dccd7..06a816026 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -90,6 +90,8 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { /var/lib/AccountsService/icons/* r, + @{MOUNTS}/ r, + @{HOME}/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, @@ -197,6 +199,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/ r, @{PROC}/ r, + @{PROC}/@{pid}/stat r, @{PROC}/cmdline r, @{PROC}/diskstats r, @{PROC}/loadavg r, diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index dba650f2c..4872716fc 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -49,7 +49,7 @@ profile sddm-greeter @{exec_path} { owner @{SDDM_HOME}/#@{int} mrw, owner @{sddm_cache_dirs}/** mrwkl -> @{sddm_cache_dirs}/**, - owner @{HOME}/.face.icon r, + @{HOME}/.face.icon r, owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/icon-cache.kcache rw, diff --git a/apparmor.d/groups/network/nm-dispatcher b/apparmor.d/groups/network/nm-dispatcher index 9e2904a54..1a82fdbf5 100644 --- a/apparmor.d/groups/network/nm-dispatcher +++ b/apparmor.d/groups/network/nm-dispatcher @@ -31,20 +31,21 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, - @{bin}/python3.@{int} rix, @{bin}/basename rix, @{bin}/cat rix, - @{bin}/chronyc rPUx, @{bin}/chown rix, + @{bin}/chronyc rPUx, @{bin}/date rix, @{bin}/gawk rix, @{bin}/grep rix, @{bin}/id rix, @{bin}/invoke-rc.d rCx -> invoke-rc, + @{bin}/logger rix, @{bin}/mkdir rix, @{bin}/mktemp rix, @{bin}/netconfig rPUx, @{bin}/nmcli rix, + @{bin}/python3.@{int} rix, @{bin}/readlink rix, @{bin}/rm rix, @{bin}/run-parts rCx -> run-parts, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 8b1351997..fa096a35d 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -89,15 +89,16 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { /etc/systemd/network/ r, /etc/systemd/network/@{int2}-*.link r, - @{run}/udev/ rw, - @{run}/udev/** rwk, - @{run}/credentials/systemd-udev-load-credentials.service/ r, + @{run}/modprobe.d/ r, @{run}/systemd/network/ r, @{run}/systemd/network/*.link rw, @{run}/systemd/notify rw, @{run}/systemd/seats/seat@{int} r, + @{run}/udev/ rw, + @{run}/udev/** rwk, + @{sys}/** rw, @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-a-f/btrfs b/apparmor.d/profiles-a-f/btrfs index 45e50da9c..41e6fff57 100644 --- a/apparmor.d/profiles-a-f/btrfs +++ b/apparmor.d/profiles-a-f/btrfs @@ -24,9 +24,15 @@ profile btrfs @{exec_path} flags=(attach_disconnected) { /var/lib/btrfs/scrub.status.@{uuid}{,_tmp} rwk, / r, - /boot/ r, - /home/ r, /.snapshots/ r, + /boot/ r, + /boot/**/ r, + /home/ r, + /opt/ r, + /root/ r, + /srv/ r, + /usr/local/ r, + /var/ r, @{MOUNTS}/ r, @{MOUNTS}/ext2_saved/ rw, @{MOUNTS}/ext2_saved/image rw, @@ -44,10 +50,8 @@ profile btrfs @{exec_path} flags=(attach_disconnected) { @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab, @{run}/snapper-tools-*/ r, @{run}/snapper-tools-@{rand6}/@/.snapshots/@{int}/snapshot r, - - @{sys}/fs/btrfs/@{uuid}/exclusive_operation r, - @{sys}/fs/btrfs/@{uuid}/devinfo/@{int}/fsid r, - @{sys}/fs/btrfs/@{uuid}/devinfo/@{int}/scrub_speed_max r, + + @{sys}/fs/btrfs/@{uuid}/** r, @{PROC}/partitions r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index 57de7cab8..60f5f22ee 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -13,6 +13,7 @@ profile issue-generator @{exec_path} { @{exec_path} mr, + @{sh_path} r, @{bin}/basename rix, @{bin}/cat rix, @{bin}/cmp rix, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 7c4f697e0..5bd851921 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -74,16 +74,10 @@ profile pass @{exec_path} { profile pkill { include - - capability sys_ptrace, - - ptrace read, + include @{bin}/pkill mr, - @{PROC}/@{pid}/cgroup r, - @{PROC}/tty/drivers r, - include if exists } diff --git a/apparmor.d/profiles-m-r/pinentry-qt b/apparmor.d/profiles-m-r/pinentry-qt index 1763bd96f..93dc4aded 100644 --- a/apparmor.d/profiles-m-r/pinentry-qt +++ b/apparmor.d/profiles-m-r/pinentry-qt @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/pinentry-qt profile pinentry-qt @{exec_path} { include + include include include include diff --git a/apparmor.d/profiles-s-z/su b/apparmor.d/profiles-s-z/su index 237d5ed02..d292cab8b 100644 --- a/apparmor.d/profiles-s-z/su +++ b/apparmor.d/profiles-s-z/su @@ -28,6 +28,8 @@ profile su @{exec_path} { @{etc_ro}/default/su r, + @{HOME}/.xauth@{rand6} rw, + include if exists } diff --git a/apparmor.d/profiles-s-z/xauth b/apparmor.d/profiles-s-z/xauth index f051fdc0c..ad57f8615 100644 --- a/apparmor.d/profiles-s-z/xauth +++ b/apparmor.d/profiles-s-z/xauth @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xauth profile xauth @{exec_path} { include + include include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/xclip b/apparmor.d/profiles-s-z/xclip index 378e8cae3..9f82aff64 100644 --- a/apparmor.d/profiles-s-z/xclip +++ b/apparmor.d/profiles-s-z/xclip @@ -10,14 +10,13 @@ include @{exec_path} = @{bin}/xclip profile xclip @{exec_path} { include + include include network unix stream, @{exec_path} mr, - deny /dev/tty rw, - include if exists } From f9169bc40b2d04d4a12172e2e21c2f6247d91064 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 18:43:34 +0100 Subject: [PATCH 0085/1455] feat(profile): use the kde-globals-write abstaction when needed. --- apparmor.d/groups/browsers/firefox-kmozillahelper | 3 +-- apparmor.d/groups/freedesktop/xdg-desktop-portal-kde | 3 +-- apparmor.d/groups/kde/kconf_update | 4 +--- apparmor.d/groups/kde/kded | 4 +--- apparmor.d/groups/kde/startplasma | 6 ++---- 5 files changed, 6 insertions(+), 14 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index cac83b364..d7162578b 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -11,6 +11,7 @@ profile firefox-kmozillahelper @{exec_path} { include include include + include include include include @@ -42,8 +43,6 @@ profile firefox-kmozillahelper @{exec_path} { owner @{user_config_dirs}/kdedefaults/kdeglobals r, owner @{user_config_dirs}/kdedefaults/kwinrc r, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kdeglobals.@{rand6} rwl, owner @{user_config_dirs}/kmozillahelperrc r, owner @{user_config_dirs}/kmozillahelperrc.@{rand6} rwl, owner @{user_config_dirs}/kwinrc r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde index a5329097b..3b6fa1112 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde @@ -11,6 +11,7 @@ include profile xdg-desktop-portal-kde @{exec_path} { include include + include include include @@ -30,10 +31,8 @@ profile xdg-desktop-portal-kde @{exec_path} { owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/autostart/org.kde.*.desktop r, owner @{user_config_dirs}/breezerc r, - owner @{user_config_dirs}/kdeglobals{,.*} rwlk, owner @{user_config_dirs}/xdg-desktop-portal-kderc{,.*} rwlk, owner @{run}/user/@{uid}/xdg-desktop-portal-kde@{rand6}.*.socket rw, diff --git a/apparmor.d/groups/kde/kconf_update b/apparmor.d/groups/kde/kconf_update index bcab6d31b..5d0914b52 100644 --- a/apparmor.d/groups/kde/kconf_update +++ b/apparmor.d/groups/kde/kconf_update @@ -13,6 +13,7 @@ profile kconf_update @{exec_path} { include include include + include include include include @@ -45,7 +46,6 @@ profile kconf_update @{exec_path} { owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/akregatorrc.lock rwk, owner @{user_config_dirs}/akregatorrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/dolphinrc.lock rwk, @@ -58,8 +58,6 @@ profile kconf_update @{exec_path} { owner @{user_config_dirs}/kcminputrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/kconf_updaterc.lock rwk, owner @{user_config_dirs}/kconf_updaterc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kdeglobals.lock rwk, - owner @{user_config_dirs}/kdeglobals{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk, owner @{user_config_dirs}/kglobalshortcutsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/khotkeysrc.lock rwk, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 64fa472bb..5620d7dee 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -18,6 +18,7 @@ profile kded @{exec_path} { include include include + include include include include @@ -97,7 +98,6 @@ profile kded @{exec_path} { @{user_config_dirs}/kcookiejarrc.lock rwk, @{user_config_dirs}/kcookiejarrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/bluedevilglobalrc.lock rwk, owner @{user_config_dirs}/bluedevilglobalrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, @@ -112,8 +112,6 @@ profile kded @{exec_path} { owner @{user_config_dirs}/kded{5,6}rc.lock rwk, owner @{user_config_dirs}/kded{5,6}rc{,.@{rand6}} rwl, owner @{user_config_dirs}/kdedefaults/{,**} r, - owner @{user_config_dirs}/kdeglobals.lock rwk, - owner @{user_config_dirs}/kdeglobals{,.@{rand6}} rwl, owner @{user_config_dirs}/khotkeysrc.lock rwk, owner @{user_config_dirs}/khotkeysrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/kioslaverc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index 149df7695..81b1a1243 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -10,8 +10,9 @@ include profile startplasma @{exec_path} { include include - include include + include + include signal (receive) set=(hup) peer=@{p_systemd}, signal (receive) set=(term) peer=sddm, @@ -50,13 +51,10 @@ profile startplasma @{exec_path} { owner @{user_cache_dirs}/kcrash-metadata/ rw, owner @{user_cache_dirs}/plasma-svgelements rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/gtkrc{,*} rwlk, owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kdedefaults/ rw, owner @{user_config_dirs}/kdedefaults/** rwkl -> @{user_config_dirs}/kdedefaults/**, - owner @{user_config_dirs}/kdeglobals.lock rwk, - owner @{user_config_dirs}/kdeglobals{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/ksplashrc r, owner @{user_config_dirs}/kwinkdeglobalsrc.lock rwk, owner @{user_config_dirs}/menus/{,**} r, From c13aa711da3546053de4644c3a50fc51f20bb2c1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 18:46:35 +0100 Subject: [PATCH 0086/1455] feat(abs): add user bin to the app launch abs. --- apparmor.d/abstractions/app-launcher-user | 3 +++ apparmor.d/groups/kde/ksmserver | 2 -- apparmor.d/profiles-s-z/waybar | 1 - 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app-launcher-user b/apparmor.d/abstractions/app-launcher-user index 5e7c50824..edf96b05a 100644 --- a/apparmor.d/abstractions/app-launcher-user +++ b/apparmor.d/abstractions/app-launcher-user @@ -21,6 +21,9 @@ /usr/ r, /usr/local/bin/ r, + @{user_bin_dirs}/ r, + @{user_bin_dirs}/** PUx, + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index edfc3adea..5f6c9ceb6 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -31,8 +31,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:exec drkonqi #aa:exec kscreenlocker_greet - @{user_bin_dirs}/** rPUx, - /usr/share/color-schemes/{,**} r, /usr/share/knotifications{5,6}/*.notifyrc r, /usr/share/kservices{5,6}/{,**} r, diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index e6cd61581..250a6a731 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -10,7 +10,6 @@ include profile waybar @{exec_path} flags=(attach_disconnected) { include include - include include include include From ec7715aaf3e35cd307f94129bec7fbb43215cc05 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 18:52:55 +0100 Subject: [PATCH 0087/1455] feat(profile): general update. --- apparmor.d/groups/gnome/gnome-music | 1 + apparmor.d/groups/gnome/gnome-session | 3 ++- apparmor.d/groups/gnome/gnome-software | 3 +++ .../groups/gnome/org.gnome.NautilusPreviewer | 3 +++ apparmor.d/groups/gnome/tracker-miner | 2 ++ apparmor.d/groups/kde/kreadconfig | 7 +---- apparmor.d/groups/virt/cockpit-bridge | 16 ++++++++--- apparmor.d/profiles-a-f/element-desktop | 3 ++- apparmor.d/profiles-g-l/keepassxc | 2 ++ apparmor.d/profiles-m-r/pinentry-kwallet | 27 ++++++------------- apparmor.d/profiles-m-r/qt5ct | 2 -- apparmor.d/profiles-s-z/YACReaderLibrary | 3 +-- apparmor.d/profiles-s-z/steam-launch | 3 +++ apparmor.d/profiles-s-z/thunderbird-vaapitest | 2 +- apparmor.d/profiles-s-z/waybar | 1 + apparmor.d/profiles-s-z/whereis | 2 +- 16 files changed, 44 insertions(+), 36 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index be07256ae..69273720e 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -48,6 +48,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { @{run}/systemd/inhibit/[0-9]*.ref rw, owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw, + owner /var/tmp/etilqs_@{hex15} rw, owner /var/tmp/etilqs_@{hex16} rw, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index e349d85c1..171a93338 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -17,8 +17,8 @@ profile gnome-session @{exec_path} { @{shells_path} rix, @{bin}/cat rix, - @{bin}/gettext.sh r, @{bin}/gettext rix, + @{bin}/gettext.sh r, @{bin}/grep rix, @{bin}/head rix, @{bin}/id rix, @@ -28,6 +28,7 @@ profile gnome-session @{exec_path} { @{bin}/readlink rix, @{bin}/realpath rix, @{bin}/sed rix, + @{bin}/tput rix, @{bin}/tr rix, @{bin}/tty rix, @{bin}/uname rPx, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 2ebff5ddf..f5652135a 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -109,9 +109,12 @@ profile gnome-software @{exec_path} { owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw, @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/sessions/@{int} r, + @{run}/systemd/users/@{uid} r, @{sys}/module/nvidia/version r, + @{PROC}/@{pid}/cgroup r, @{PROC}/@{pids}/mounts r, @{PROC}/sys/fs/pipe-max-size r, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index 6b2544a84..cc08462e8 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -39,9 +39,11 @@ profile org.gnome.NautilusPreviewer @{exec_path} { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{sys}/devices/system/node/node@{int}/cpumap r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.NautilusPreviewer.slice/*/memory.* r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r, + @{PROC}/devices r, @{PROC}/@{pid}/cgroup r, @{PROC}/zoneinfo r, owner @{PROC}/@{pid}/cmdline r, @@ -51,6 +53,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/stat r, /dev/media@{int} r, + /dev/nvidia-uvm rw, include if exists } diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index a49f28b47..9ebdd9fe8 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -87,8 +87,10 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pid}/cmdline r, @{PROC}/sys/fs/fanotify/max_user_marks r, @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/sys/vm/mmap_min_addr r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/media@{int} rw, /dev/video@{int} rw, diff --git a/apparmor.d/groups/kde/kreadconfig b/apparmor.d/groups/kde/kreadconfig index fc14b9536..33cf23a9b 100644 --- a/apparmor.d/groups/kde/kreadconfig +++ b/apparmor.d/groups/kde/kreadconfig @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/kreadconfig5 profile kreadconfig @{exec_path} { include + include capability dac_read_search, @@ -16,14 +17,8 @@ profile kreadconfig @{exec_path} { @{exec_path} mr, - /usr/share/icu/@{int}.@{int}/*.dat r, - - /etc/xdg/kdeglobals r, /etc/xdg/kioslaverc r, - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdeglobals r, - include if exists } diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index c4337d77a..0a6ae6246 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -35,9 +35,18 @@ profile cockpit-bridge @{exec_path} { @{exec_path} mr, - @{bin}/journalctl rPx, - @{lib}/cockpit/cockpit-pcp rPx, - @{lib}/cockpit/cockpit-ssh rPx, + @{bin}/cat ix, + @{bin}/date ix, + @{bin}/findmnt Px, + @{bin}/journalctl Px, + @{bin}/python3.@{int} ix, + @{bin}/ssh-agent Px, + @{bin}/sudo Px, # TODO: rCx -> privilieged ? or rix? + @{lib}/cockpit/cockpit-pcp Px, + @{lib}/cockpit/cockpit-ssh Px, + + # The shell is not confined on purpose. + @{bin}/@{shells} Ux, /usr/share/cockpit/{,**} r, /usr/{,local/}share/ r, @@ -64,6 +73,7 @@ profile cockpit-bridge @{exec_path} { @{sys}/fs/cgroup/**/ r, @{sys}/fs/cgroup/**/cpu.{stat,weight} r, @{sys}/fs/cgroup/**/memory* r, + @{sys}/kernel/kexec_crash_size r, @{PROC}/ r, @{PROC}/@{pids}/cgroup r, diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index 1dd15b4b9..b3cd7e34b 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -31,7 +31,8 @@ profile element-desktop @{exec_path} { @{exec_path} mr, @{sh_path} r, - @{open_path} rPx -> child-open-strict, + @{open_path} rPx -> child-open-strict, + @{bin}/xdg-settings rPx, /usr/share/webapps/element/{,**} r, diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index f79a3464e..4315fb6e5 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -43,6 +43,8 @@ profile keepassxc @{exec_path} { /etc/fstab r, + @{bin}/ r, + owner @{HOME}/ r, owner @{HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json rw, owner @{HOME}/@{XDG_SSH_DIR}/ r, diff --git a/apparmor.d/profiles-m-r/pinentry-kwallet b/apparmor.d/profiles-m-r/pinentry-kwallet index 235c256a7..c9dc12ba1 100644 --- a/apparmor.d/profiles-m-r/pinentry-kwallet +++ b/apparmor.d/profiles-m-r/pinentry-kwallet @@ -11,42 +11,31 @@ include profile pinentry-kwallet @{exec_path} { include include - include + include signal (send) set=(term, kill) peer=gpg-agent, @{exec_path} mr, - @{bin}/pinentry-* rPx, - - @{bin}/kwalletcli_getpin rix, - @{bin}/kwalletcli rCx -> kwalletcli, - - # when wrong PIN is provided @{bin}/date rix, - - @{bin}/mksh rix, @{bin}/env rix, - - owner @{HOME}/.Xauthority r, - - /usr/share/hwdata/pnp.ids r, - + @{bin}/kwalletcli rCx -> kwalletcli, + @{bin}/kwalletcli_getpin rix, + @{bin}/mksh rix, + @{bin}/pinentry-* rPx, profile kwalletcli { include + include @{bin}/kwalletcli mr, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_config_dirs}/kwalletrc r, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemKWaylandPlugin.so mr, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr, - owner @{HOME}/.Xauthority r, - - /usr/share/hwdata/pnp.ids r, + owner @{user_config_dirs}/kwalletrc r, + include if exists } include if exists diff --git a/apparmor.d/profiles-m-r/qt5ct b/apparmor.d/profiles-m-r/qt5ct index 43964d950..3052736b6 100644 --- a/apparmor.d/profiles-m-r/qt5ct +++ b/apparmor.d/profiles-m-r/qt5ct @@ -28,8 +28,6 @@ profile qt5ct @{exec_path} { owner @{user_config_dirs}/fontconfig/** rw, owner @{user_config_dirs}/fontconfig/fonts.conf.back rwl -> @{user_config_dirs}/fontconfig/#@{int}, - owner @{user_config_dirs}/kdeglobals r, - owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/icon-cache.kcache rw, diff --git a/apparmor.d/profiles-s-z/YACReaderLibrary b/apparmor.d/profiles-s-z/YACReaderLibrary index 5d773292d..19bf0e9c2 100644 --- a/apparmor.d/profiles-s-z/YACReaderLibrary +++ b/apparmor.d/profiles-s-z/YACReaderLibrary @@ -34,9 +34,8 @@ profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted /etc/machine-id r, - owner @{user_books_dirs}/{,**} r, + owner @{user_books_dirs}/{,**} rw, owner @{user_books_dirs}/**/.yacreaderlibrary/{,**} rwk, - owner @{user_books_dirs}/**/None rw, owner @{user_cache_dirs}/YACReader/ rw, owner @{user_cache_dirs}/YACReader/YACReaderLibrary/ rw, diff --git a/apparmor.d/profiles-s-z/steam-launch b/apparmor.d/profiles-s-z/steam-launch index 877181b61..11c7b76b2 100644 --- a/apparmor.d/profiles-s-z/steam-launch +++ b/apparmor.d/profiles-s-z/steam-launch @@ -23,6 +23,7 @@ profile steam-launch @{exec_path} { @{exec_path} mr, @{sh_path} rix, + @{bin}/cmp rix, @{bin}/cp rix, @{bin}/dirname rix, @{bin}/env rix, @@ -33,6 +34,8 @@ profile steam-launch @{exec_path} { @{lib}/steam/bin_steam.sh rix, @{share_dirs}/steam.sh rPx, + @{runtime_dirs}/@{arch}/steam-runtime-steam-remote rPUx, + /usr/ r, /usr/local/ r, diff --git a/apparmor.d/profiles-s-z/thunderbird-vaapitest b/apparmor.d/profiles-s-z/thunderbird-vaapitest index 85c1a08cb..a401173f1 100644 --- a/apparmor.d/profiles-s-z/thunderbird-vaapitest +++ b/apparmor.d/profiles-s-z/thunderbird-vaapitest @@ -12,7 +12,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name}/ @{exec_path} = @{lib_dirs}/vaapitest -profile thunderbird-vaapitest @{exec_path} { +profile thunderbird-vaapitest @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index 250a6a731..8da427a64 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only diff --git a/apparmor.d/profiles-s-z/whereis b/apparmor.d/profiles-s-z/whereis index 330957a62..e7bc743a5 100644 --- a/apparmor.d/profiles-s-z/whereis +++ b/apparmor.d/profiles-s-z/whereis @@ -30,7 +30,7 @@ profile whereis @{exec_path} { /opt/cni/bin/ r, /opt/containerd/bin/ r, - /etc/ r, + @{etc_ro}/ r, /snap/bin/ r, /var/lib/flatpak/exports/bin/ r, From 72d8d144805aefa7a5d2e440266ff43f219337ae Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 18:53:31 +0100 Subject: [PATCH 0088/1455] feat(tunables): expand coreutils with findutils & diffutils. --- apparmor.d/tunables/multiarch.d/programs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index f72e56921..e8c6b9022 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -15,15 +15,15 @@ # All interactive shells users may want to use @{shells} = sh zsh bash dash fish rbash ksh tcsh csh -# Coreutils programs that should not have dedicated profile +# Coreutils programs that should not have dedicated profile. Also includes findutils and diffutils. @{coreutils} = {,g,m}awk b2sum base32 base64 basename basenc cat chcon chgrp chmod chown -@{coreutils} += cksum comm cp csplit cut date dd df dir dircolors dirname diff du echo env expand +@{coreutils} += cksum cmp comm cp csplit cut date dd df dir dircolors dirname diff diff3 du echo env expand @{coreutils} += expr factor false find fmt fold {,e,f}grep head hostid id install join link -@{coreutils} += ln logname ls md5sum mkdir mkfifo mknod mktemp mv nice nl nohup nproc numfmt +@{coreutils} += ln locate logname ls md5sum mkdir mkfifo mknod mktemp mv nice nl nohup nproc numfmt @{coreutils} += od paste pathchk pinky pr printenv printf ptx pwd readlink realpath rm rmdir -@{coreutils} += runcon sed seq sha1sum sha224sum sha256sum sha384sum sha512sum shred shuf sleep +@{coreutils} += runcon sdiff sed seq sha1sum sha224sum sha256sum sha384sum sha512sum shred shuf sleep @{coreutils} += sort split stat stdbuf stty sum sync tac tail tee test timeout touch tr true -@{coreutils} += truncate tsort tty uname unexpand uniq unlink vdir wc who whoami xargs yes +@{coreutils} += truncate tsort tty uname unexpand uniq unlink updatedb vdir wc who whoami xargs yes # Browsers From 09aef5131eb9322b60a79976562c0c45e6822bbf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 18:59:51 +0100 Subject: [PATCH 0089/1455] fix(profile): gpg key generation. --- apparmor.d/groups/gpg/gpg | 2 ++ apparmor.d/groups/gpg/gpg-agent | 20 ++++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index b549f1477..a4f2a11ea 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -28,6 +28,8 @@ profile gpg @{exec_path} { @{bin}/gpgsm rPx, @{lib}/{,gnupg/}scdaemon rPx, + /usr/share/terminfo/** r, + /etc/inputrc r, owner @{HOME}/@{XDG_GPG_DIR}/ rw, diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index f7580a8aa..d97327969 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -24,37 +24,37 @@ profile gpg-agent @{exec_path} { /usr/share/gnupg/* r, owner @{HOME}/@{XDG_GPG_DIR}/ rw, - owner @{HOME}/@{XDG_GPG_DIR}/gpg-agent.conf r, + owner @{HOME}/@{XDG_GPG_DIR}/*.conf r, owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw, - owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key rw, + owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key{,.tmp} rw, owner @{HOME}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{HOME}/@{XDG_GPG_DIR}/sshcontrol r, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/ rw, - owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/gpg-agent.conf r, + owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/*.conf r, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw, - owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key rw, + owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key{,.tmp} rw, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/sshcontrol r, owner @{user_projects_dirs}/**/{.,}gnupg/ rw, - owner @{user_projects_dirs}/**/{.,}gnupg/gpg-agent.conf r, + owner @{user_projects_dirs}/**/{.,}gnupg/*.conf r, owner @{user_projects_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw, - owner @{user_projects_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key rw, + owner @{user_projects_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, owner @{user_projects_dirs}/**/{.,}gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{user_projects_dirs}/**/{.,}gnupg/sshcontrol r, owner @{run}/user/@{uid}/gnupg/ rw, - owner @{run}/user/@{uid}/gnupg/gpg-agent.conf r, + owner @{run}/user/@{uid}/gnupg/*.conf r, owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/ rw, - owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/@{hex}.key rw, + owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, owner @{run}/user/@{uid}/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{run}/user/@{uid}/gnupg/sshcontrol r, owner @{user_tmp_dirs}/**/{.,}gnupg/ rw, - owner @{user_tmp_dirs}/**/{.,}gnupg/gpg-agent.conf r, + owner @{user_tmp_dirs}/**/{.,}gnupg/*.conf r, owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw, - owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key rw, + owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, owner @{user_tmp_dirs}/**/{.,}gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{user_tmp_dirs}/**/{.,}gnupg/sshcontrol r, From bb1c4e053724f7f3035ec4e377dc3df40ed891ba Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 19:19:21 +0100 Subject: [PATCH 0090/1455] feat(profile): modernise the crontab profile. fix #428 --- apparmor.d/abstractions/app/editor | 9 ++++++--- apparmor.d/groups/cron/crontab | 10 ++++++++-- apparmor.d/profiles-a-f/flatpak | 2 ++ apparmor.d/profiles-a-f/flatpak-app | 5 +++-- 4 files changed, 19 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index f0972f3e7..023696e31 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -1,16 +1,19 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # Copyright (C) 2024 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only include + @{sh_path} rix, + @{bin}/nvim mrix, @{bin}/sensible-editor mr, @{bin}/vim{,.*} mrix, - @{sh_path} rix, @{bin}/which{,.debianutils} rix, - /usr/share/vim/{,**} r, + /usr/share/nvim/{,**} r, /usr/share/terminfo/** r, + /usr/share/vim/{,**} r, /etc/vimrc r, /etc/vim/{,**} r, @@ -19,11 +22,11 @@ owner @{HOME}/.viminf@{c}{,.tmp} rw, owner @{HOME}/.vimrc r, - # Vim swap file owner @{HOME}/ r, owner @{user_cache_dirs}/ r, owner @{user_cache_dirs}/vim/{,**} rw, owner @{user_config_dirs}/vim/{,**} r, + owner @{user_state_dirs}/nvim/{,**} rw, include if exists diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index 3490199a1..82d3c543f 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -10,9 +10,12 @@ include @{exec_path} = @{bin}/crontab profile crontab @{exec_path} { include + include include include + capability dac_read_search, + capability net_admin, capability setgid, capability setuid, @@ -23,15 +26,17 @@ profile crontab @{exec_path} { # When editing the crontab file @{bin}/sensible-editor rCx -> editor, @{bin}/vim.* rCx -> editor, + @{bin}/nvim rCx -> editor, /etc/cron.{allow,deny} r, /etc/pam.d/* r, /var/spool/cron/ r, /var/spool/cron/crontabs/ rw, + /var/spool/cron/user r, owner /var/spool/cron/crontabs/* rw, - owner @{tmp}/crontab.*/{,crontab} rw, + owner @{tmp}/crontab.@{rand6}/{,crontab} rw, profile editor { include @@ -42,7 +47,8 @@ profile crontab @{exec_path} { /etc/cron.{allow,deny} r, /tmp/ r, - owner @{tmp}/crontab.*/crontab rw, + owner @{tmp}/crontab.@{rand6}/crontab rw, + owner @{tmp}/crontab.@{rand6} rw, include if exists } diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index 8722612d1..f61879407 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -35,6 +35,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain ptrace (read) peer=flatpak-app, + signal send peer=flatpak-app, + @{exec_path} mr, @{bin}/bwrap rPx -> flatpak-app, diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app index 87e9b443d..58d4713bd 100644 --- a/apparmor.d/profiles-a-f/flatpak-app +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -44,8 +44,9 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { ptrace (read), ptrace trace peer=flatpak-app, - signal (receive) set=(int term) peer=flatpak-portal, - signal (receive) set=(int) peer=flatpak-session-helper, + signal receive peer=flatpak, + signal receive set=(int term) peer=flatpak-portal, + signal receive set=(int) peer=flatpak-session-helper, @{bin}/** rmix, @{lib}/** rmix, From ce26fa103b49f33df7682be757b184254f159ae1 Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 28 Aug 2024 18:00:11 +0200 Subject: [PATCH 0091/1455] permit read access --- apparmor.d/profiles-a-f/atool | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-a-f/atool b/apparmor.d/profiles-a-f/atool index 5568b9e15..a027f7a4f 100644 --- a/apparmor.d/profiles-a-f/atool +++ b/apparmor.d/profiles-a-f/atool @@ -11,6 +11,7 @@ profile atool @{exec_path} { include include include + include include @{exec_path} mr, From cecd0a6284c1fb220730eab813df5de86330d759 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Fri, 23 Aug 2024 22:53:56 +0800 Subject: [PATCH 0092/1455] initial support for ufw --- apparmor.d/profiles-s-z/sysctl | 2 ++ apparmor.d/profiles-s-z/ufw | 57 ++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 apparmor.d/profiles-s-z/ufw diff --git a/apparmor.d/profiles-s-z/sysctl b/apparmor.d/profiles-s-z/sysctl index 4e50430be..02964dd7d 100644 --- a/apparmor.d/profiles-s-z/sysctl +++ b/apparmor.d/profiles-s-z/sysctl @@ -30,6 +30,8 @@ profile sysctl @{exec_path} { deny network inet6 stream, deny network inet stream, + /etc/ufw/sysctl.conf r, # Add support for ufw + include if exists } diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw new file mode 100644 index 000000000..63352e655 --- /dev/null +++ b/apparmor.d/profiles-s-z/ufw @@ -0,0 +1,57 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 EricLin +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ufw +profile ufw @{exec_path} { + + include + + capability dac_read_search, + capability net_admin, + + network netlink raw, + network inet dgram, + network inet6 dgram, + + @{exec_path} mr, + + @{bin}/ r, + @{bin}/python3* ix, + @{bin}/cat ix, + @{bin}/xtables-nft-multi ix, + + @{lib}/ufw/ufw-init ix, + + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/net/ip_tables_names r, + + owner @{bin}/env r, + + /etc/ufw/{,**} rwk, + + /etc/default/ufw r, + + /run/ufw.lock wk, + + /etc/gai.conf r, + /etc/nsswitch.conf r, + /etc/passwd r, + /etc/services r, + + /var/tmp/* rw, + /tmp/* rw, + + /dev/pts/[0-9]* rw, + /dev/tty rw, + + include if exists + +} + +# vim:syntax=apparmor From d5ee5c51cba17bea2647e068e90f610e820e6aff Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Sat, 24 Aug 2024 19:35:21 +0800 Subject: [PATCH 0093/1455] Tighten the permissions of ufw --- apparmor.d/profiles-s-z/ufw | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 63352e655..add5865ef 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -1,5 +1,5 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2024 EricLin +# Copyright (C) 2024 EricLin # SPDX-License-Identifier: GPL-2.0-only abi , @@ -44,8 +44,10 @@ profile ufw @{exec_path} { /etc/passwd r, /etc/services r, - /var/tmp/* rw, - /tmp/* rw, + /var/tmp/@{rand8} rw, + /var/tmp/tmp* rw, + /tmp/@{rand8} rw, + /tmp/tmp* rw, /dev/pts/[0-9]* rw, /dev/tty rw, From 7716c8a191a86a2c67c86ae861b8600db5e3de06 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Tue, 27 Aug 2024 21:00:20 +0800 Subject: [PATCH 0094/1455] Rewrite the profile for ufw --- apparmor.d/profiles-s-z/ufw | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index add5865ef..55437c180 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -8,8 +8,9 @@ include @{exec_path} = @{bin}/ufw profile ufw @{exec_path} { - include + include + include capability dac_read_search, capability net_admin, @@ -21,34 +22,28 @@ profile ufw @{exec_path} { @{exec_path} mr, @{bin}/ r, - @{bin}/python3* ix, + @{bin}/env r, + @{bin}/python3.@{int} ix, @{bin}/cat ix, @{bin}/xtables-nft-multi ix, @{lib}/ufw/ufw-init ix, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/net/ip_tables_names r, - - owner @{bin}/env r, - /etc/ufw/{,**} rwk, /etc/default/ufw r, - /run/ufw.lock wk, - - /etc/gai.conf r, - /etc/nsswitch.conf r, - /etc/passwd r, - /etc/services r, + @{run}/ufw.lock rwk, /var/tmp/@{rand8} rw, /var/tmp/tmp* rw, /tmp/@{rand8} rw, /tmp/tmp* rw, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/net/ip_tables_names r, + /dev/pts/[0-9]* rw, /dev/tty rw, From 1f83ca358e22ee55ec2f7defe8dcfd6b4e815e62 Mon Sep 17 00:00:00 2001 From: EliasTheGrandMasterOfMistakes Date: Mon, 26 Aug 2024 17:22:55 -0300 Subject: [PATCH 0095/1455] gnome-shell: Integrate nm-openvpn-auth-dialog on gnome-shell VPNs that uses gnome authentication like ProtonVPN depends of gnome-shell acess nm-openvpn-auth-dialog Co-authored-by: Alexandre Pujol --- apparmor.d/groups/gnome/gnome-shell | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 0e68c90a9..c76b81abe 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -187,7 +187,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sh_path} rCx -> shell, @{lib}/gio-launch-desktop rCx -> open, @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, - + + # nm-openvpn-auth-dialog + @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, + @{user_share_dirs}/gnome-shell/extensions/*/** rPUx, /usr/share/gnome-shell/extensions/*/** rPUx, From 04898e20f96e94e014e8c9edae74831c12dfe8a0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 28 Aug 2024 19:48:01 +0100 Subject: [PATCH 0096/1455] fix: conflicting x modifiers. --- apparmor.d/groups/virt/cockpit-bridge | 1 - 1 file changed, 1 deletion(-) diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 0a6ae6246..3da2c19ea 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/cockpit-bridge profile cockpit-bridge @{exec_path} { include - include include include include From a1eaf58427d7485227edba2aaaad99e318824ec8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 Aug 2024 19:05:37 +0100 Subject: [PATCH 0097/1455] feat(profile): minor update. --- apparmor.d/groups/cron/crontab | 2 ++ apparmor.d/groups/gpg/scdaemon | 1 + apparmor.d/profiles-m-r/pinentry | 1 + 3 files changed, 4 insertions(+) diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index 82d3c543f..c5aaf5546 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -29,7 +29,9 @@ profile crontab @{exec_path} { @{bin}/nvim rCx -> editor, /etc/cron.{allow,deny} r, + /etc/environment r, /etc/pam.d/* r, + /etc/security/*.conf r, /var/spool/cron/ r, /var/spool/cron/crontabs/ rw, diff --git a/apparmor.d/groups/gpg/scdaemon b/apparmor.d/groups/gpg/scdaemon index eeb1a618e..92be0bdcc 100644 --- a/apparmor.d/groups/gpg/scdaemon +++ b/apparmor.d/groups/gpg/scdaemon @@ -20,6 +20,7 @@ profile scdaemon @{exec_path} { @{exec_path} mr, owner @{HOME}/@{XDG_GPG_DIR}/scdaemon.conf r, + owner @{HOME}/@{XDG_GPG_DIR}common.conf r, owner @{HOME}/@{XDG_GPG_DIR}/reader_@{int}.status rw, owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, diff --git a/apparmor.d/profiles-m-r/pinentry b/apparmor.d/profiles-m-r/pinentry index c30bc5def..c466f05aa 100644 --- a/apparmor.d/profiles-m-r/pinentry +++ b/apparmor.d/profiles-m-r/pinentry @@ -15,6 +15,7 @@ profile pinentry @{exec_path} { @{bin}/pinentry-* rPx, @{sh_path} rix, + @{bin}/ldd rix, /etc/pinentry/preexec r, From 21bef5a0420f3c26d0680fcdbfcb023f38fde820 Mon Sep 17 00:00:00 2001 From: odomingao Date: Thu, 22 Aug 2024 11:17:07 -0300 Subject: [PATCH 0098/1455] Create xdg-desktop-portal-hyprland --- .../freedesktop/xdg-desktop-portal-hyprland | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland new file mode 100644 index 000000000..460523d19 --- /dev/null +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland @@ -0,0 +1,40 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/xdg-desktop-portal-hyprland +profile xdg-desktop-portal-hyprland @{exec_path} { + include + include + include + include + include + include + include + include + + @{exec_path} mr, + + @{sh_path} ix, + @{bin}/hyprland-share-picker rix, + @{bin}/slurp rix, + + owner /tmp/hypr/ rw, + owner /tmp/hypr/\#@{int} rwkl, + owner /tmp/hypr/hyprland-share-picker.conf* rwkl, + + /sys/devices/virtual/dmi/id/bios_vendor r, + /sys/devices/virtual/dmi/id/board_vendor r, + /sys/devices/virtual/dmi/id/product_name r, + /sys/devices/virtual/dmi/id/sys_vendor r, + + owner @{PROC}/@{pid}/cmdline r, + + include if exists +} + +# vim:syntax=apparmor From 75fba4c6c77919cd688528d481b18a93411530ff Mon Sep 17 00:00:00 2001 From: odomingao Date: Thu, 22 Aug 2024 11:22:46 -0300 Subject: [PATCH 0099/1455] Update xdg-desktop-portal --- apparmor.d/groups/freedesktop/xdg-desktop-portal | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 59ef5a734..702b0088d 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -78,7 +78,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { /var/lib/gdm{,3}/greeter-dconf-defaults r, - @{user_config_dirs}/kioslaverc r, + owner @{user_config_dirs}/xdg-desktop-portal/* r, + @{user_config_dirs}/kioslaverc r, owner @{tmp}/icon* rw, From a224adc42e5582acc1bfbfe02b8962f1bb6a3a21 Mon Sep 17 00:00:00 2001 From: odomingao Date: Thu, 22 Aug 2024 21:37:26 -0300 Subject: [PATCH 0100/1455] Update xdg-desktop-portal-hyprland --- apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland index 460523d19..73e8e734a 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland @@ -9,11 +9,9 @@ include @{exec_path} = @{lib}/xdg-desktop-portal-hyprland profile xdg-desktop-portal-hyprland @{exec_path} { include - include include include include - include include include @@ -21,6 +19,7 @@ profile xdg-desktop-portal-hyprland @{exec_path} { @{sh_path} ix, @{bin}/hyprland-share-picker rix, + @{bin}/sleep rix, @{bin}/slurp rix, owner /tmp/hypr/ rw, From fe327207656467ff8ddac1b9ea2fac7f5cee9f77 Mon Sep 17 00:00:00 2001 From: Nishit Majithia Date: Fri, 30 Aug 2024 22:26:04 +0530 Subject: [PATCH 0101/1455] socat: add apparmor profile (#454) * socat: add apparmor profile Signed-off-by: Nishit Majithia * socat: update profile - Follow profile guideline - Change copyright texts - Update to use abi 3.0 - Use `ssl_certs` and `console` abstractions instead of explicit rules Signed-off-by: Nishit Majithia * socat: minor fix in the profile - Use @{bin} - Allow executable mapping and read for the binary Signed-off-by: Nishit Majithia --------- Signed-off-by: Nishit Majithia --- apparmor.d/groups/network/socat | 49 +++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 apparmor.d/groups/network/socat diff --git a/apparmor.d/groups/network/socat b/apparmor.d/groups/network/socat new file mode 100644 index 000000000..df5e874d1 --- /dev/null +++ b/apparmor.d/groups/network/socat @@ -0,0 +1,49 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Nishit Majithia (nishitm) +# SPDX-License-Identifier: GPL-2.0-only +# vim: ft=apparmor + +abi , + +include + +@{exec_path} = @{bin}/socat +profile socat @{exec_path} { + include + include + include + include + + capability dac_read_search, + capability dac_override, + capability net_raw, + capability net_admin, + capability sys_module, + capability sys_admin, + capability fsetid, + capability chown, + capability net_bind_service, + capability sys_resource, + + # Allow creation of network sockets and `socat` uses dccp for some + # fuctionalities that is why it is necessary to allow whole `network` + network, + + @{exec_path} mr, + + # Enale /dev/ptmx access for testsuite + # /dev/ptmx rw, + + # TUN/TAP device + /dev/net/tun rw, + + # Process-specific access + @{PROC}/@{pid}/fdinfo/@{int} rw, + @{PROC}/@{pid}/stat r, + + # For bi-directional communication between vms and host/hypervisor + /dev/vsock r, + + # Site-specific additions and overrides. See local/README for details. + include if exists +} From fb29e8ba74aa9712b5b06c20e935a7f4cd208b8c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 30 Aug 2024 20:38:30 +0100 Subject: [PATCH 0102/1455] doc: general update. --- README.md | 16 +-- docs/development/dbus.md | 8 ++ docs/development/guidelines.md | 19 ++- docs/development/index.md | 2 +- docs/development/install.md | 47 ++++--- docs/development/structure.md | 41 ++---- docs/enforce.md | 68 ++++++---- docs/full-system-policy.md | 62 +++++---- docs/index.md | 19 +-- docs/install.md | 227 +++++++++++++++++++++------------ docs/report.md | 40 ++++-- docs/usage.md | 4 +- docs/variables.md | 13 +- mkdocs.yml | 7 +- 14 files changed, 350 insertions(+), 223 deletions(-) diff --git a/README.md b/README.md index ae9899b70..7aed183da 100644 --- a/README.md +++ b/README.md @@ -27,15 +27,15 @@ - Target both desktops and servers - Support all distributions that support AppArmor: - * Arch Linux - * Ubuntu 22.04 - * Debian 12 - * OpenSUSE Tumbleweed + * [Arch Linux](https://apparmor.pujol.io/install#archlinux) + * [Ubuntu 24.04/22.04](https://apparmor.pujol.io/install#ubuntu) + * [Debian 12](https://apparmor.pujol.io/install#debian) + * [OpenSUSE Tumbleweed](https://apparmor.pujol.io/install#opensuse) - Support for all major desktop environments: - * Gnome - * KDE - * XFCE *(work in progress)* -- Fully tested (Work in progress) + * Gnome (GDM) + * KDE (SDDM) + * XFCE (Lightdm) *(work in progress)* +- Fully tested *(work in progress)* > This project is originally based on the work from [Morfikov][upstream] and aims to extend it to more Linux distributions and desktop environments. diff --git a/docs/development/dbus.md b/docs/development/dbus.md index 98b46501c..c8efda0c5 100644 --- a/docs/development/dbus.md +++ b/docs/development/dbus.md @@ -26,6 +26,14 @@ Access to common dbus interfaces is done using the abstractions under **[`abstra For more access, simply use the [`aa:dbus talk`](#dbus-directive) directive. +There is a trade of between security and maintenance to make: + +- `aa:dbus talk` will generate less issue as it give full talk access +- `abstractions/bus/*` will provide more restriction, and possibly more issue. + +Ideally, these rules should be automatically generated from either the dbus interface documentation or the program call. + + ## Dbus Directive We use a special [directive](directives.md) to generate more advanced dbus access. The directive format is on purpose very similar to the AppArmor dbus rule. diff --git a/docs/development/guidelines.md b/docs/development/guidelines.md index b359576aa..3d83fea5f 100644 --- a/docs/development/guidelines.md +++ b/docs/development/guidelines.md @@ -78,7 +78,7 @@ The file block should be sorted as follows: The dbus block should be sorted as follows: - The system bus should be sorted *before* the session bus -- The bind rules should be sorted *after* the send & receive rules +- The bind rules should be sorted *after* send & receive rules For DBus, try to determine peer's label when possible. E.g.: ``` @@ -115,6 +115,23 @@ If there is no predictable label it can be omitted. /var/lib/dbus/machine-id r, ``` +#### :material-numeric-5-circle: Limit the use of `deny` + +: The use of `deny` should be limited to the minimum: + + - In MAC policies, we only allow access ([Rule :material-numeric-1-circle:](index.md#rule-mandatory-access-control "Mandatory Access Control")) + - `deny` rules are enforced even in complain mode, + - If it works on your machine does not mean it will work on others ([Rule :material-numeric-4-circle:](index.md#rule-distribution-and-devices-agnostic "Distribution and devices agnostic")). + +#### :material-numeric-6-circle: Comments + +: Ensure you only have useful comments. E.g.: + ``` + # Config files for foo + owner @{user_config_dirs}/foo/{,**} r, + ``` + Does not help, and if generalized it would add a lot of complexity to any profiles. + ## Additional recommended documentation diff --git a/docs/development/index.md b/docs/development/index.md index c12226a7a..c68745e26 100644 --- a/docs/development/index.md +++ b/docs/development/index.md @@ -70,7 +70,7 @@ If you're looking to contribute to `apparmor.d` you can get started by going to Here is the bare minimum for the program `foo`: ``` sh # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023 You +# Copyright (C) 2024 You # SPDX-License-Identifier: GPL-2.0-only abi , diff --git a/docs/development/install.md b/docs/development/install.md index 74271c13c..6b1f47581 100644 --- a/docs/development/install.md +++ b/docs/development/install.md @@ -11,28 +11,39 @@ title: Installation See `debian/`, `PKGBUILD` and `dists/apparmor.d.spec`. -**:material-docker: Docker** +=== ":material-arch: Archlinux" -For any system with docker installed you can simply build the package with: -```sh -make package dist= -``` -Then you can install the package with `dpkg`, `pacman` or `rpm`. + ```sh + make pkg + ``` -**:material-arch: Arch Linux** -```sh -make pkg -``` +=== ":material-ubuntu: Ubuntu" -**:material-ubuntu: Ubuntu & :material-debian: Debian** -```sh -make dpkg -``` + ```sh + make dpkg + ``` -**:simple-suse: openSUSE** -```sh -make rpm -``` +=== ":material-debian: Debian" + + ```sh + make dpkg + ``` + +=== ":simple-suse: openSUSE" + + ```sh + make rpm + ``` + +=== ":material-docker: Docker" + + For any system with docker installed you can simply build the package with: + + ```sh + make package dist= + ``` + + Then you can install the package with `dpkg`, `pacman` or `rpm`. ## Profile flags diff --git a/docs/development/structure.md b/docs/development/structure.md index 0035b6c90..c6b82e29f 100644 --- a/docs/development/structure.md +++ b/docs/development/structure.md @@ -9,7 +9,7 @@ Description of common structure found across various AppArmor profiles Some programs should not be confined by themselves. For example, tools such as `ls`, `rm`, `diff` or `cat` do not have profiles in this project. Let's see why. -These are general tools that in a general context can legitimately access any file in the system. Therefore, the confinement of such tools by a global profile would at best be minimal at worst be a security theater. +These are general tools that in a general context can legitimately access any file in the system. Therefore, the confinement of such tools by a global profile would at best be minimal at worst be a security theatre. It gets even worse. Let's say, we write a profile for `cat`. Such a profile would need access to `/etc/`. We will add the following rule: ```sh @@ -76,20 +76,17 @@ You do not protect these programs. *Protect the usage you have of these programs [Toolbox]: https://containertoolbx.org/ +## Open Resources -## Abstractions +The standard way to allow opening resource in this project is to use one of the +child-open profile. Eg: `@{open_path} rPx -> child-open,` -This project and the apparmor-profiles official project provide a large selection of abstractions to be included in profiles. They should be used. +They are available in the [`children`][children] group. -For instance, to allow download directory access, instead of writing: -```sh -owner @{HOME}/@{XDG_DOWNLOAD_DIR}/{,**} rw, -``` - -You should write: -```sh -include -``` +* **`child-open`**: Instead of allowing the ability to run all software in `@{bin}/`, the purpose of this profile is to list all GUI programs that can open resources. Ultimately, only sandbox manager programs such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until this day, this profile will be a controlled mess. +* **`child-open-browsers`**: This version of child-open only allow to open browsers. +* **`child-open-help`**: This version of child-open only allow to open browsers and help programs. +* **`child-open-strict`**: This version of child-open only allow to open browsers & folders. ## Children profiles @@ -104,31 +101,11 @@ Usually, a child profile is in the [`children`][children] group. They have the f Here is an overview of the current children profile: -1. **`child-open`**: To open resources. Instead of allowing the ability to run all software in `@{bin}/`, the purpose of this profile is to list all GUI programs that can open resources. Ultimately, only sandbox manager programs such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until this day, this profile will be a controlled mess. - 2. **`child-pager`**: Simple access to pagers such as `pager`, `less` and `more`. This profile assumes the pager is reading its data from stdin, not from a file on disk. 3. **`child-systemctl`**: Common `systemctl` action. Do not use it too much as most of the time you will need more privilege than what this profile is giving you. -## Browsers - -Chromium based browsers share a similar structure. Therefore, they share the same abstraction: [`abstractions/chromium`][chromium] that includes most of the profile content. - -This abstraction requires the following variables defined in the profile header: -```sh -@{name} = chromium -@{domain} = org.chromium.Chromium -@{lib_dirs} = @{lib}/chromium -@{config_dirs} = @{user_config_dirs}/chromium -@{cache_dirs} = @{user_cache_dirs}/chromium -``` - -If your application requires chromium to run (like electron) use [`abstractions/chromium-common`][chromium-common] instead. - -[chromium]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/abstractions/chromium -[chromium-common]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/abstractions/chromium-common - ## Udev rules See the **[kernel docs][kernel]** to check the major block and char numbers used in `/run/udev/data/`. diff --git a/docs/enforce.md b/docs/enforce.md index 52241859e..692cbd1e3 100644 --- a/docs/enforce.md +++ b/docs/enforce.md @@ -4,37 +4,59 @@ title: Enforce Mode The default package configuration installs all profiles in *complain* mode. This is a safety measure to ensure you are not going to break your system on initial installation. Once you have tested it, and it works fine, you can easily switch to *enforce* mode. The profiles that are not considered stable are kept in complain mode, they can be tracked in the [`dists/flags`](https://github.com/roddhjav/apparmor.d/tree/main/dists/flags) directory. -!!! warning +!!! danger - - Please test in complain mode first and ensure your system boots! - - When reporting an issue, please ensure the affected profiles are in complain mode. + - You **must** test in complain mode first and ensure your system works as expected. + - You **must** regularly check AppArmor log with [`aa-log`](usage.md#apparmor-log) and [report](report.md) issues first. + - When reporting an issue, you **must** ensure the affected profiles are in complain mode. -#### :material-arch: Arch Linux +=== ":material-arch: Archlinux" -In `PKGBUILD`, replace `make` by `make enforce`: -```diff -- make DISTRIBUTION=arch -+ make enforce DISTRIBUTION=arch -``` + In the `PKGBUILD`, replace `make` by `make enforce`: -#### :material-ubuntu: Ubuntu & :material-debian: Debian + ```diff + - make DISTRIBUTION=arch + + make enforce DISTRIBUTION=arch + ``` -In `debian/rules`, add the following lines: + Then, build the package with: `make pkg` -```make -override_dh_auto_build: - make enforce -``` +=== ":material-ubuntu: Ubuntu" -#### :simple-suse: openSUSE + In `debian/rules`, add the following lines: -In `dists/apparmor.d.spec`, replace `%make_build` by `make enforce` -```diff -- %make_build -+ %make_build enforce -``` + ```make + override_dh_auto_build: + make enforce + ``` -#### Partial install + Then, build the package with: `make dpkg` -Use the `make enforce` command to build instead of `make` +=== ":material-debian: Debian" + + In `debian/rules`, add the following lines: + + ```make + override_dh_auto_build: + make enforce + ``` + + Then, build the package with: `make dpkg` + +=== ":simple-suse: openSUSE" + + In `dists/apparmor.d.spec`, replace `%make_build` by `%make_build enforce` + + ```diff + - %make_build + + %make_build enforce + ``` + + Then, build the package with: `make rpm` + +=== ":material-home: Partial Install" + + Use the `make enforce` command to build instead of `make` + +[aur]: https://aur.archlinux.org/packages/apparmor.d-git diff --git a/docs/full-system-policy.md b/docs/full-system-policy.md index 2b9f57454..d37cf3071 100644 --- a/docs/full-system-policy.md +++ b/docs/full-system-policy.md @@ -31,7 +31,7 @@ Particularly: - In FSP mode, all sandbox managers **must** have a profile. Then user sandboxed applications (flatpak, snap, etc) will work as expected. -## Install +## Installation This feature is only enabled when the project is built with `make full`. [Early policy](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorInSystemd#early-policy-loads) load **must** also be enabled. Once `apparmor.d` has been installed in FSP mode, it is required to reboot to apply the changes. @@ -43,35 +43,53 @@ cache-loc /etc/apparmor/earlypolicy/ Optimize=compress-fast ``` -**:material-arch: Arch Linux** +=== ":material-arch: Archlinux" -In `PKGBUILD`, replace `make` by `make full`: -```diff -- make -+ make full -``` + In `PKGBUILD`, replace `make` by `make full`: -**:material-ubuntu: Ubuntu & :material-debian: Debian** + ```diff + - make + + make full + ``` -In `debian/rules`, add the following lines: + Then, build the package with: `make pkg` -```make -override_dh_auto_build: - make full -``` +=== ":material-ubuntu: Ubuntu" -**:simple-suse: openSUSE** + In `debian/rules`, add the following lines: -In `dists/apparmor.d.spec`, replace `%make_build` by `make full` -```diff -- %make_build -+ %make_build full -``` + ```make + override_dh_auto_build: + make full + ``` -**Partial install** + Then, build the package with: `make dpkg` -Use the `make full` command to build instead of `make` +=== ":material-debian: Debian" + + In `debian/rules`, add the following lines: + ```make + override_dh_auto_build: + make full + ``` + + Then, build the package with: `make dpkg` + +=== ":simple-suse: openSUSE" + + In `dists/apparmor.d.spec`, replace `%make_build` by `%make_build full` + + ```diff + - %make_build + + %make_build full + ``` + + Then, build the package with: `make rpm` + +=== ":material-home: Partial Install" + + Use the `make full` command to build instead of `make` ## Structure @@ -113,7 +131,7 @@ To work as intended, userland services started by `systemd --user` **should** ha !!! info - To be allowed to run, additional root or user services may need to add extra rules inside the `usr/systemd.d` or `usr/systemd-user.d` directory. For example, when installing a new privileged service `foo` with [stacking](#no-new-privileges) you may need to add the following to `/etc/apparmor.d/usr/systemd.d/foo`: + To be allowed to run, additional root or user services may need to add extra rules inside the `usr/systemd.d` or `usr/systemd-user.d` directory. For example, when installing a new privileged service `foo` with [stacking](development/structure.md#no-new-privileges) you may need to add the following to `/etc/apparmor.d/usr/systemd.d/foo`: ``` @{lib}/foo rPx -> systemd//&foo, ``` diff --git a/docs/index.md b/docs/index.md index 3a9381ccd..b57bae7a3 100644 --- a/docs/index.md +++ b/docs/index.md @@ -2,13 +2,7 @@ title: AppArmor.d --- - + **Full set of AppArmor profiles** @@ -34,13 +28,14 @@ See the [Concepts](concepts.md)' page for more detail on the architecture. - Target both desktops and servers - Support for all distributions that support AppArmor: * [:material-arch: Arch Linux](install.md#archlinux) - * [:material-ubuntu: Ubuntu 22.04](install.md#ubuntu-debian) - * [:material-debian: Debian 12](install.md#ubuntu-debian) + * [:material-ubuntu: Ubuntu 24.04/22.04](install.md#ubuntu) + * [:material-debian: Debian 12](install.md#debian) * [:simple-suse: openSUSE Tumbleweed](install.md#opensuse) - Support for all major desktop environments: - - [x] :material-gnome: Gnome - - [ ] :simple-kde: KDE *(work in progress)* -- Fully tested (Work in progress) + - [x] :material-gnome: Gnome (GDM) + - [x] :simple-kde: KDE (SDDM) + - [ ] :simple-xfce: XFCE (Lightdm) *(work in progress)* +- Fully tested *(work in progress)* **Presentations** diff --git a/docs/install.md b/docs/install.md index c08072343..5afac9c77 100644 --- a/docs/install.md +++ b/docs/install.md @@ -2,15 +2,23 @@ title: Installation --- -!!! warning - - To prevent the risk of breaking your system, the default package configuration installs all profiles in complain mode. They can be enforced later. See the [Enforce Mode](enforce.md) page. - - After installation, you **must** regularly check AppArmor log with [`aa-log`](usage.md#apparmor-log). You can also configure [a desktop notification on denied actions](https://wiki.archlinux.org/title/AppArmor#Get_desktop_notification_on_DENIED_actions). +## Setup !!! danger - Do **not** expect this project to work correctly if your Desktop Environment and Display Manager are not supported. Your Desktop Environment or Display Manager might not load, and that would be a feature. + Do **not** expect this project to work correctly on your desktop if your Desktop Environment (DE) and Display Manager (DM) are not supported. Your DE/DM might not load, and that would be a **feature**. + +Due to the development stage of this project, the default package configuration installs all profiles in **complain** mode. The recommended installation workflow is as-follow: + +1. [Install](#installation) *apparmor.d* in the (default) complain mode. +1. Configure [apparmor settings](configuration.md#apparmor) as well as your [personal directories](configuration.md#personal-directories). +1. Ensure you have reloaded the profiles in the kernel: `sudo systemctl restart apparmor.service`. +1. Reboot your system. +1. You **must** check for any AppArmor logs with [`aa-log`](usage.md#apparmor-log). +1. [Report](https://apparmor.pujol.io/report/) any raised logs. +1. Use the profiles in complain mode for a while (a week), regularly check for new AppArmor logs. +1. Only if there are no logs raised for your daily usage, install it in [enforce mode](enforce.md). + ## Requirements @@ -22,105 +30,156 @@ An `AppArmor` supported Linux distribution is required. The default profiles and The following desktop environments are supported: - - [x] :material-gnome: Gnome - - [x] :simple-kde: KDE - - [ ] :simple-xfce: XFCE *(work in progress)* + - [x] :material-gnome: Gnome (GDM) + - [x] :simple-kde: KDE (SDDM) + - [ ] :simple-xfce: XFCE (Lightdm) *(work in progress)* **Build dependency** -* Go >= 1.18 - -## :material-arch: Arch Linux - -`apparmor.d-git` is available in the [Arch User Repository][aur]: -``` -yay -S apparmor.d-git # or your preferred AUR install method -``` - -Or without an AUR helper: -```sh -git clone https://aur.archlinux.org/apparmor.d-git.git -cd apparmor.d-git -makepkg -si -``` +* Go >= 1.21 -## :material-ubuntu: Ubuntu & :material-debian: Debian +## Installation -Build the package from sources: -```sh -sudo apt install apparmor-profiles build-essential config-package-dev debhelper golang-go rsync git -git clone https://github.com/roddhjav/apparmor.d.git -cd apparmor.d -dpkg-buildpackage -b -d --no-sign -sudo dpkg -i ../apparmor.d_*.deb -``` +=== ":material-arch: Archlinux" -!!! tip + `apparmor.d-git` is available in the [Arch User Repository][aur]: - If you have `devscripts` installed, you can use the one liner: ```sh - make dpkg + yay -S apparmor.d-git # or your preferred AUR install method ``` -!!! note + Or without an AUR helper: - Debian user may need golang from the backports repository to build: ```sh - echo 'deb http://deb.debian.org/debian bookworm-backports main contrib non-free' | sudo tee -a /etc/apt/sources.list - sudo apt update - sudo apt install -t bookworm-backports golang-go + git clone https://aur.archlinux.org/apparmor.d-git.git + cd apparmor.d-git + makepkg -si ``` -!!! warning +=== ":material-ubuntu: Ubuntu" - **Beware**: do not install a `.deb` made for Debian on Ubuntu, the packages are different. + Build the package from sources: - If your distribution is based on Ubuntu or Debian, you may want to manually set the target distribution by exporting `DISTRIBUTION=debian` if is Debian based, or `DISTRIBUTION=ubuntu` if it is Ubuntu based. - -## :simple-suse: openSUSE - -openSUSE users need to add [cboltz](https://en.opensuse.org/User:Cboltz) repo on OBS -```sh -zypper addrepo https://download.opensuse.org/repositories/home:cboltz/openSUSE_Factory/home:cboltz.repo -zypper refresh -zypper install apparmor.d -``` - - -## Partial install - -For test purposes, you can install specific profiles with the following commands. Abstractions, tunable, and most of the OS dependent post-processing is managed. - -```sh -make -sudo make profile-names... -``` - -!!! warning - - Partial installation is discouraged because profile dependencies are not fetched. To prevent some AppArmor issues, the dependencies are automatically switched to unconfined (`rPx` -> `rPUx`). The installation process warns on the missing profiles so that you can easily install them if desired. (PR is welcome see [#77](https://github.com/roddhjav/apparmor.d/issues/77)) - - For instance, `sudo make pass` gives: ```sh - Warning: profile dependencies fallback to unconfined. - @{bin}/wl-{copy,paste} rPx, - @{bin}/xclip rPx, - @{bin}/python3.@{int} rPx -> pass-import, # pass-import - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - '.build/apparmor.d/pass' -> '/etc/apparmor.d/pass' + sudo apt install apparmor-profiles build-essential config-package-dev debhelper golang-go rsync git + git clone https://github.com/roddhjav/apparmor.d.git + cd apparmor.d + dpkg-buildpackage -b -d --no-sign + sudo dpkg -i ../apparmor.d_*.deb ``` - So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired. + + !!! tip + + If you have `devscripts` installed, you can use the one liner: + + ```sh + make dpkg + ``` + + !!! warning + + **Beware**: do not install a `.deb` made for Debian on Ubuntu, the packages are different. + + If your distribution is based on Ubuntu, you may want to manually set the target distribution by exporting `DISTRIBUTION=ubuntu`. + +=== ":material-debian: Debian" + + Build the package from sources: + + ```sh + sudo apt install apparmor-profiles build-essential config-package-dev debhelper golang-go rsync git + git clone https://github.com/roddhjav/apparmor.d.git + cd apparmor.d + dpkg-buildpackage -b -d --no-sign + sudo dpkg -i ../apparmor.d_*.deb + ``` + + !!! tip + + If you have `devscripts` installed, you can use the one liner: + + ```sh + make dpkg + ``` + + !!! note + + You may need golang from the backports repository to build: + + ```sh + echo 'deb http://deb.debian.org/debian bookworm-backports main contrib non-free' | sudo tee -a /etc/apt/sources.list + sudo apt update + sudo apt install -t bookworm-backports golang-go + ``` + + !!! warning + + **Beware**: do not install a `.deb` made for Debian on Ubuntu, the packages are different. + + If your distribution is based on Debian, you may want to manually set the target distribution by exporting `DISTRIBUTION=debian`. + +=== ":simple-suse: openSUSE" + + openSUSE users need to add [cboltz](https://en.opensuse.org/User:Cboltz) repo on OBS: + + ```sh + zypper addrepo https://download.opensuse.org/repositories/home:cboltz/openSUSE_Factory/home:cboltz.repo + zypper refresh + zypper install apparmor.d + ``` + +=== ":material-home: Partial" + + For test purposes, you can install specific profiles with the following commands. Abstractions, tunable, and most of the OS dependent post-processing is managed. + + ```sh + make + sudo make profile-names... + ``` + + !!! warning + + Partial installation is discouraged because profile dependencies are not fetched. To prevent some AppArmor issues, the dependencies are automatically switched to unconfined (`rPx` -> `rPUx`). The installation process warns on the missing profiles so that you can easily install them if desired. (PR is welcome see [#77](https://github.com/roddhjav/apparmor.d/issues/77)) + + For instance, `sudo make pass` gives: + ```sh + Warning: profile dependencies fallback to unconfined. + @{bin}/wl-{copy,paste} rPx, + @{bin}/xclip rPx, + @{bin}/python3.@{int} rPx -> pass-import, # pass-import + @{bin}/pager rPx -> child-pager, + @{bin}/less rPx -> child-pager, + @{bin}/more rPx -> child-pager, + '.build/apparmor.d/pass' -> '/etc/apparmor.d/pass' + ``` + So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired. -## Uninstall +## Uninstallation -- :material-arch: Arch Linux `sudo pacman -R apparmor.d` -- :material-ubuntu: Ubuntu & :material-debian: Debian `sudo apt purge apparmor.d` -- :simple-suse: openSUSE `sudo zypper remove apparmor.d` +=== ":material-arch: Archlinux" + + ```sh + sudo pacman -R apparmor.d + ``` + +=== ":material-ubuntu: Ubuntu" + + ```sh + sudo apt purge apparmor.d + ``` + +=== ":material-debian: Debian" + + ```sh + sudo apt purge apparmor.d + ``` + +=== ":simple-suse: openSUSE" + + ```sh + sudo zypper remove apparmor.d + ``` [aur]: https://aur.archlinux.org/packages/apparmor.d-git -[repo]: https://repo.pujol.io/ -[keys]: https://repo.pujol.io/gpgkey diff --git a/docs/report.md b/docs/report.md index e13ac9e9f..e82d4e9e7 100644 --- a/docs/report.md +++ b/docs/report.md @@ -11,25 +11,39 @@ When creating [an issue on Github][newissue], please post a link to the [paste] aa-log -R ``` -If this command produce nothing, try: +??? question "No logs with `aa-log`?" + + If the log file is empty, check that Auditd is running: + + ```sh + sudo systemctl status auditd.service + ``` + + If Auditd is disabled aa-log will not have new results, you can enable Auditd with: + + ```sh + sudo systemctl enable auditd.service --now + ``` + +If this command produces nothing, use `-s` to provide all logs since boot time (provided that `journalctl` collected them): ```sh aa-log -s -R ``` -If the log file is empty, check that Auditd is running: +??? question "No logs with `aa-log -s`?" + + On certain distributions/configurations, AppArmor logs in journal could be taken over by *auditd* when it is installed. To overcome this, `systemd-journald-audit.socket` could be enabled: + + ```sh + sudo systemctl enable systemd-journald-audit.socket + ``` + +You can get older logs with: + ```sh -sudo systemctl status auditd.service +aa-log -R -f ``` - -If Auditd is disabled aa-log will not have new results, you can enable Auditd by doing the following command: -```sh -sudo systemctl enable auditd.service --now -``` - -You can get more logs with: - -1. `aa-log -R -s` that will provide all apparmor logs since boot time (if journalctl collect them) -2. `aa-log -R -f ` where `` is `1`, `2`, `3` and `4` (the rotated audit log file) +Where `` is `1`, `2`, `3` and `4` (the rotated audit log file). [newissue]: https://github.com/roddhjav/apparmor.d/issues/new [paste]: https://pastebin.com/ diff --git a/docs/usage.md b/docs/usage.md index 70eaaa292..9690733b1 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -76,9 +76,9 @@ ps (complain) user ps auxZ ## AppArmor Log -Ensure that `Auditd` is installed and running on your system in order to read AppArmor log from `/var/log/audit/audit.log`. Then you can see the log with the provided command `aa-log` allowing you to review AppArmor generated messages in a colorful way. +Ensure that `Auditd` is installed and running on your system in order to read AppArmor log from `/var/log/audit/audit.log`. Then you can see the log with the provided command `aa-log` allowing you to review AppArmor generated messages in a colourful way. -Other AppArmor userspace tools such as `aa-enforce`, `aa-complain`, and `aa-logprof` should work as expected. +Other AppArmor userspace tools such as `aa-enforce`, `aa-complain`, and `aa-logprof` should work as expected. You can also configure [a desktop notification on denied actions](https://wiki.archlinux.org/title/AppArmor#Get_desktop_notification_on_DENIED_actions). ### Basic use diff --git a/docs/variables.md b/docs/variables.md index a70358263..b45df411f 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -26,9 +26,10 @@ title: Variables References | Mail | `@{XDG_MAIL_DIR}` | `Mail .{m,M}ail` | | Sync | `@{XDG_SYNC_DIR}` | `Sync` | | Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | -| Vm | `@{XDG_VM_DIR}` | `.vm` -| Vm Shares | `@{XDG_VM_SHARES_DIR}` | `VM_Shares` +| Vm | `@{XDG_VM_DIR}` | `.vm` | +| Vm Shares | `@{XDG_VM_SHARES_DIR}` | `VM_Shares` | | Disk images | `@{XDG_IMG_DIR}` | `images` | +| Games Studio | `@{XDG_GAMESSTUDIO_DIR}` | `.unity3d` | ### Dotfiles @@ -56,7 +57,7 @@ title: Variables References | Lib | `@{user_lib_dirs}` | `@{HOME}/@{XDG_LIB_DIR}` | | Share | `@{user_share_dirs}` | ` @{HOME}/@{XDG_DATA_DIR}` | | State | `@{user_state_dirs}` | ` @{HOME}/@{XDG_STATE_DIR}` | -| Build | `@{user_build_dirs}` | `/tmp/` | +| Build | `@{user_build_dirs}` | `/tmp//build/` | | Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | | Tmp | `@{user_tmp_dirs}` | `@{run}/user/@{uid} /tmp/` | @@ -80,9 +81,9 @@ title: Variables References | Templates | `@{user_templates_dirs}` | `@{HOME}/@{XDG_TEMPLATES_DIR} @{MOUNTS}/@{XDG_TEMPLATES_DIR}` | | Torrents | `@{user_torrents_dirs}` | `@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}` | | Sync | `@{user_sync_dirs}` | `@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR}` | -| Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` -| Vm Shares | `@{user_vm_shares}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` -| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | +| Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` | +| Vm Shares | `@{user_vm_shares}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | +| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | ## System variables diff --git a/mkdocs.yml b/mkdocs.yml index d72fd86b7..67d8cc5a8 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -43,8 +43,10 @@ theme: - content.action.edit - content.code.annotate - content.code.copy + - content.tabs.link - content.tooltips - navigation.indexes + - navigation.instant - navigation.sections - navigation.tabs - navigation.top @@ -118,6 +120,9 @@ markdown_extensions: format: !!python/name:pymdownx.superfences.fence_code_format - pymdownx.tabbed: alternate_style: true + slugify: !!python/object/apply:pymdownx.slugs.slugify + kwds: + case: lower - pymdownx.tasklist: custom_checkbox: true @@ -130,13 +135,13 @@ nav: - install.md - configuration.md - usage.md + - report.md - Advanced: - variables.md - enforce.md - full-system-policy.md - Troubleshooting: - issues.md - - report.md - recovery.md - Development: - development/index.md From aa4f4de6dd0dbc5d46f095a988d3398bd326a743 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Sep 2024 15:17:43 +0100 Subject: [PATCH 0103/1455] feat(abs): update mesa shader cache paths. fix: #450 #451 --- apparmor.d/abstractions/mesa.d/complete | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index 976b6cc47..85c647b43 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -13,4 +13,11 @@ owner @{user_cache_dirs}/mesa_shader_cache/marker rw, + owner @{user_cache_dirs}/mesa_shader_cache_db/ w, + owner @{user_cache_dirs}/mesa_shader_cache_db/index rw, + owner @{user_cache_dirs}/mesa_shader_cache_db/marker rw, + owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/ rw, + owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.db rwk, + owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.idx rwk, + # vim:syntax=apparmor From 60e00f8c5352287face865d24fad584f8701b7ab Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Sep 2024 15:22:05 +0100 Subject: [PATCH 0104/1455] fix(profile): zramctl doesn't show algorithm, data, compression, total, streams, mountpoint fix #456 --- apparmor.d/groups/systemd/zramctl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apparmor.d/groups/systemd/zramctl b/apparmor.d/groups/systemd/zramctl index 0d1632924..289dc4f0f 100644 --- a/apparmor.d/groups/systemd/zramctl +++ b/apparmor.d/groups/systemd/zramctl @@ -14,7 +14,13 @@ profile zramctl @{exec_path} { @{exec_path} mr, @{sys}/devices/virtual/block/zram@{int}/ r, + @{sys}/devices/virtual/block/zram@{int}/comp_algorithm r, @{sys}/devices/virtual/block/zram@{int}/disksize r, + @{sys}/devices/virtual/block/zram@{int}/max_comp_streams r, + @{sys}/devices/virtual/block/zram@{int}/mm_stat r, + + @{PROC}/swaps r, + owner @{PROC}/@{pid}/mounts r, /dev/ r, /dev/zram@{int} rw, From 7e3c546e3dd311bb2a451a815a3d260c2cf2e906 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Sep 2024 15:25:43 +0100 Subject: [PATCH 0105/1455] fix(profile): xdg-mime mimetype path. fix #455 --- apparmor.d/groups/freedesktop/xdg-mime | 3 +++ apparmor.d/profiles-m-r/mimetype | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index c279c41ad..1a217a2b6 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -35,6 +35,7 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{bin}/gio rPx, @{bin}/kbuildsycoca5 rPx, @{bin}/ktraderclient5 rPUx, + @{bin}/vendor_perl/mimetype rPx, @{bin}/mimetype rPx, @{bin}/xprop rPx, @@ -47,6 +48,8 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/ r, + owner /tmp/wl-copy-buffer-@{rand6}/stdin r, + @{sys}/devices/platform/**/hwmon/hwmon@{int}/temp* r, @{sys}/devices/platform/**/hwmon/hwmon@{int}/fan* r, diff --git a/apparmor.d/profiles-m-r/mimetype b/apparmor.d/profiles-m-r/mimetype index da56703c3..d9e34f8b5 100644 --- a/apparmor.d/profiles-m-r/mimetype +++ b/apparmor.d/profiles-m-r/mimetype @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/mimetype +@{exec_path} = @{bin}/mimetype @{bin}/*_perl/mimetype profile mimetype @{exec_path} { include include From 265e3928c118ca9341d9ecc4d2a2f71bede52be4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Sep 2024 20:13:51 +0100 Subject: [PATCH 0106/1455] feat(profile): mesa: mesa_shader_cache_db is often passed as fd. --- apparmor.d/abstractions/mesa.d/complete | 1 + apparmor.d/groups/browsers/chromium-wrapper | 1 + apparmor.d/groups/freedesktop/xkbcomp | 1 + apparmor.d/groups/gnome/gnome-shell | 1 + apparmor.d/profiles-s-z/terminator | 1 + 5 files changed, 5 insertions(+) diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index 85c647b43..0e437190f 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -4,6 +4,7 @@ # Extra Mesa rules for desktop environments owner @{desktop_cache_dirs}/ w, + owner @{desktop_cache_dirs}/mesa_shader_cache_db/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/@{hex2}/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/@{hex2}/@{hex38} rw, diff --git a/apparmor.d/groups/browsers/chromium-wrapper b/apparmor.d/groups/browsers/chromium-wrapper index 0a5017727..4368d6b20 100644 --- a/apparmor.d/groups/browsers/chromium-wrapper +++ b/apparmor.d/groups/browsers/chromium-wrapper @@ -11,6 +11,7 @@ include profile chromium-wrapper @{exec_path} { include include + include @{exec_path} r, diff --git a/apparmor.d/groups/freedesktop/xkbcomp b/apparmor.d/groups/freedesktop/xkbcomp index ef719d673..c055b9be2 100644 --- a/apparmor.d/groups/freedesktop/xkbcomp +++ b/apparmor.d/groups/freedesktop/xkbcomp @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xkbcomp profile xkbcomp @{exec_path} flags=(attach_disconnected) { include + include include unix (send,receive) type=stream addr=none peer=(label=gnome-shell), diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index c76b81abe..d39c25b24 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -404,6 +404,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { profile open flags=(attach_disconnected,mediate_deleted,complain) { include + include network inet stream, network unix stream, diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index 3f9ba6e25..3d6470dbc 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -15,6 +15,7 @@ profile terminator @{exec_path} flags=(attach_disconnected) { include include include + include include include From b223e2eb8e9ba676c642a06833f577750cb0c496 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Sep 2024 20:36:23 +0100 Subject: [PATCH 0107/1455] feat(profile): general update. --- apparmor.d/groups/browsers/chromium-wrapper | 3 -- apparmor.d/groups/freedesktop/xdg-mime | 5 +-- apparmor.d/groups/network/socat | 34 ++++++++---------- apparmor.d/groups/ssh/ssh-agent | 5 +-- apparmor.d/groups/systemd/systemd-hostnamed | 2 +- apparmor.d/groups/virt/cockpit-bridge | 39 ++++++++++++++++----- apparmor.d/groups/virt/cockpit-session | 5 +-- apparmor.d/groups/virt/libvirtd | 8 ++--- apparmor.d/groups/virt/qemu-bridge-helper | 35 ++++++++++++++++++ apparmor.d/profiles-g-l/git | 3 -- apparmor.d/profiles-s-z/smartd | 2 -- apparmor.d/profiles-s-z/virt-manager | 8 ++--- dists/flags/main.flags | 2 +- 13 files changed, 98 insertions(+), 53 deletions(-) create mode 100644 apparmor.d/groups/virt/qemu-bridge-helper diff --git a/apparmor.d/groups/browsers/chromium-wrapper b/apparmor.d/groups/browsers/chromium-wrapper index 4368d6b20..9300e46e7 100644 --- a/apparmor.d/groups/browsers/chromium-wrapper +++ b/apparmor.d/groups/browsers/chromium-wrapper @@ -40,11 +40,8 @@ profile chromium-wrapper @{exec_path} { owner @{HOME}/.xsession-errors w, owner @{tmp}/chromiumargs.@{rand6} rw, - owner @{tmp}/tmp.*/ rw, - owner @{tmp}/tmp.*/** rwk, owner /dev/tty@{int} rw, - /dev/dri/card[0-9] rw, # Silencer deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index 1a217a2b6..28c1836c9 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -53,11 +53,11 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{sys}/devices/platform/**/hwmon/hwmon@{int}/temp* r, @{sys}/devices/platform/**/hwmon/hwmon@{int}/fan* r, + @{PROC}/version r, + /dev/dri/card@{int} rw, /dev/tty rw, - @{PROC}/version r, - # When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two # following root processes: # dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr @@ -82,6 +82,7 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{HOME}/.Xauthority r, owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, + include if exists } include if exists diff --git a/apparmor.d/groups/network/socat b/apparmor.d/groups/network/socat index df5e874d1..8ffa2f9bf 100644 --- a/apparmor.d/groups/network/socat +++ b/apparmor.d/groups/network/socat @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # Copyright (C) 2024 Nishit Majithia (nishitm) # SPDX-License-Identifier: GPL-2.0-only -# vim: ft=apparmor abi , @@ -10,19 +10,19 @@ include @{exec_path} = @{bin}/socat profile socat @{exec_path} { include + include include include - include - capability dac_read_search, - capability dac_override, - capability net_raw, - capability net_admin, - capability sys_module, - capability sys_admin, - capability fsetid, capability chown, + capability dac_override, + capability dac_read_search, + capability fsetid, + capability net_admin, capability net_bind_service, + capability net_raw, + capability sys_admin, + capability sys_module, capability sys_resource, # Allow creation of network sockets and `socat` uses dccp for some @@ -31,19 +31,13 @@ profile socat @{exec_path} { @{exec_path} mr, - # Enale /dev/ptmx access for testsuite - # /dev/ptmx rw, - - # TUN/TAP device - /dev/net/tun rw, - - # Process-specific access @{PROC}/@{pid}/fdinfo/@{int} rw, - @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/stat r, - # For bi-directional communication between vms and host/hypervisor - /dev/vsock r, + /dev/net/tun rw, + /dev/vsock r, # For bi-directional communication between vms and host/hypervisor - # Site-specific additions and overrides. See local/README for details. include if exists } + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/ssh/ssh-agent b/apparmor.d/groups/ssh/ssh-agent index ec82ea1bc..d6dc90447 100644 --- a/apparmor.d/groups/ssh/ssh-agent +++ b/apparmor.d/groups/ssh/ssh-agent @@ -12,8 +12,8 @@ profile ssh-agent @{exec_path} { include include - signal (receive) set=term peer=cockpit-bridge, - signal (receive) set=term peer=gnome-keyring-daemon, + signal receive set=term peer=cockpit-bridge, + signal receive set=term peer=gnome-keyring-daemon, @{exec_path} mr, @@ -34,6 +34,7 @@ profile ssh-agent @{exec_path} { owner @{run}/user/@{uid}/gcr/.ssh w, /dev/tty@{int} rw, + /dev/tty rw, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index 39fcd9886..52e6f0894 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-hostnamed -profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { +profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 3da2c19ea..a2b773499 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -22,33 +22,44 @@ profile cockpit-bridge @{exec_path} { network inet stream, network inet6 dgram, network inet6 stream, + network netlink raw, - ptrace (read), + ptrace read, - signal (send) set=term peer=cockpit-pcp, - signal (send) set=term peer=dbus-daemon, - signal (send) set=term peer=journalctl, - signal (send) set=term peer=ssh-agent, - signal (send) set=term peer=sudo, - signal (send) set=term peer=unconfined, + signal send set=term peer=cockpit-pcp, + signal send set=term peer=dbus-daemon, + signal send set=term peer=journalctl, + signal send set=term peer=ssh-agent, + signal send set=term peer=sudo, + signal send set=term peer=unconfined, @{exec_path} mr, @{bin}/cat ix, @{bin}/date ix, + @{bin}/find ix, + @{bin}/ip ix, + @{bin}/python3.@{int} ix, + @{bin}/test ix, + @{bin}/findmnt Px, @{bin}/journalctl Px, - @{bin}/python3.@{int} ix, + @{bin}/lastlog Px, + @{bin}/passwd Px, @{bin}/ssh-agent Px, @{bin}/sudo Px, # TODO: rCx -> privilieged ? or rix? + @{bin}/udevadm Cx -> udevadm, + @{bin}/virt-install PUx, # TODO: rPx @{lib}/cockpit/cockpit-pcp Px, @{lib}/cockpit/cockpit-ssh Px, + @{bin}/virsh rPUx, # The shell is not confined on purpose. @{bin}/@{shells} Ux, - /usr/share/cockpit/{,**} r, /usr/{,local/}share/ r, + /usr/share/cockpit/{,**} r, + /usr/share/iproute2/* r, /etc/cockpit/{,**} r, /etc/httpd/conf/mime.types r, @@ -59,6 +70,8 @@ profile cockpit-bridge @{exec_path} { /etc/shadow r, /etc/shells r, + / r, + owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw, owner @{user_share_dirs}/ r, @@ -66,6 +79,7 @@ profile cockpit-bridge @{exec_path} { @{run}/utmp r, @{sys}/class/hwmon/ r, + @{sys}/class/net/ r, @{sys}/devices/**/hwmon@{int}/ r, @{sys}/devices/**/hwmon@{int}/{name,temp*} r, @{sys}/fs/cgroup/ r, @@ -89,6 +103,13 @@ profile cockpit-bridge @{exec_path} { /dev/ptmx rw, + profile udevadm { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/virt/cockpit-session b/apparmor.d/groups/virt/cockpit-session index 74ddd9e70..fda673c6e 100644 --- a/apparmor.d/groups/virt/cockpit-session +++ b/apparmor.d/groups/virt/cockpit-session @@ -36,11 +36,12 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) { /etc/motd.d/ r, /etc/shells r, + @{run}/cockpit/active.motd r, + @{run}/cockpit/inactive.motd r, @{run}/faillock/@{user} rwk, + @{run}/motd.d/{,*} r, @{run}/systemd/sessions/*.ref rw, @{run}/utmp rwk, - @{run}/motd.d/{,*} r, - @{run}/cockpit/active.motd r, /var/log/btmp rw, /var/log/lastlog rw, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 3fbbfc51f..a755c1672 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -68,6 +68,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { ptrace (read,trace) peer=@{profile_name}, ptrace (read,trace) peer=dnsmasq, + ptrace (read,trace) peer=gnome-boxes, ptrace (read,trace) peer=libvirt-@{uuid}, ptrace (read,trace) peer=libvirt-dbus, ptrace (read,trace) peer=unconfined, @@ -93,15 +94,14 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{lib}/libvirt/libvirt_iohelper rix, @{lib}/libvirt/libvirt_parthelper rix, + @{lib}/{,qemu/}qemu-bridge-helper rPx, + @{lib}/{,qemu/}vhost-user-gpu rPUx, + @{lib}/{,qemu/}virtiofsd rux, # TODO: WIP @{lib}/udev/scsi_id rPUx, @{lib}/xen-*/bin/libxl-save-helper rPUx, @{lib}/xen-*/bin/pygrub rPUx, @{lib}/xen-common/bin/xen-toolstack rPUx, @{lib}/xen/bin/* rPUx, - /{usr/,}{lib,lib64,lib/qemu,libexec}/vhost-user-gpu rPUx, - /{usr/,}{lib,lib64,lib/qemu,libexec}/virtiofsd rux, # TODO: WIP - - /{usr/,}{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, @{bin}/dmidecode rPx, @{bin}/dnsmasq rPx, diff --git a/apparmor.d/groups/virt/qemu-bridge-helper b/apparmor.d/groups/virt/qemu-bridge-helper new file mode 100644 index 000000000..a814dd265 --- /dev/null +++ b/apparmor.d/groups/virt/qemu-bridge-helper @@ -0,0 +1,35 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/{,qemu/}qemu-bridge-helper +profile qemu-bridge-helper @{exec_path} { + include + + capability net_admin, + capability setpcap, + + network inet stream, + + unix (send, receive) type=stream addr=none peer=(label=libvirtd), + + signal receive set=term peer=libvirtd, + + @{exec_path} mr, + + /etc/qemu/bridge.conf r, + + @{sys}/devices/system/node/ r, + + owner @{PROC}/@{pids}/status r, + + /dev/net/tun rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 2c0eb2fac..47450b8e6 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -92,9 +92,6 @@ profile git @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/*/ rw, owner @{user_cache_dirs}/*/** rwkl -> @{user_cache_dirs}/*/**, - owner @{tmp}/** rwkl -> /tmp/**, - owner @{tmp}/**/bin/* rCx -> exec, - owner @{HOME}/.gitconfig* rw, owner @{HOME}/.netrc r, owner @{user_config_dirs}/git/{,*} rw, diff --git a/apparmor.d/profiles-s-z/smartd b/apparmor.d/profiles-s-z/smartd index bdac4d92f..9222fbbbd 100644 --- a/apparmor.d/profiles-s-z/smartd +++ b/apparmor.d/profiles-s-z/smartd @@ -39,8 +39,6 @@ profile smartd @{exec_path} { /var/lib/smartmontools/smartd.*.state{,~} rw, /var/lib/smartmontools/attrlog.*.csv rw, - /tmp/tmp.* rw, - @{run}/systemd/notify rw, @{sys}/class/scsi_host/ r, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index c1bd7fbde..fbfcaf7b9 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -61,15 +61,15 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { /etc/fstab r, /etc/libnl/classid r, - owner @{HOME}/ r, - owner @{user_cache_dirs}/virt-manager/{,**} rw, + # System VM images + /var/lib/libvirt/images/{,**} rw, # For disk images @{MOUNTS}/ r, @{user_img_dirs}/{,**} r, - # System VM images - /var/lib/libvirt/images/{,**} rw, + owner @{HOME}/ r, + owner @{user_cache_dirs}/virt-manager/{,**} rw, # User VM images owner @{user_share_dirs}/ r, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index f37e7f991..53782aa9c 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -279,6 +279,7 @@ plymouth-set-default-theme attach_disconnected,complain plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted qdbus complain +qemu-bridge-helper complain realmd complain remmina complain run-parts complain @@ -369,7 +370,6 @@ systemd-userwork attach_disconnected,complain systemsettings complain totem attach_disconnected,complain tracker-writeback complain -transmission complain udev-dmi-memory-id complain udisksctl complain udisksd attach_disconnected,complain From 7c560e1e8f1990469f4df799df1a3ddd8c13c27e Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 1 Sep 2024 18:01:19 -0300 Subject: [PATCH 0108/1455] Update chronyd (#458) apparmor="DENIED" operation="create" class="net" profile="chronyd" comm="chronyd" family="inet" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" --- apparmor.d/profiles-a-f/chronyd | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/profiles-a-f/chronyd b/apparmor.d/profiles-a-f/chronyd index 490afddb2..a7d265e29 100644 --- a/apparmor.d/profiles-a-f/chronyd +++ b/apparmor.d/profiles-a-f/chronyd @@ -29,6 +29,8 @@ profile chronyd @{exec_path} flags=(attach_disconnected) { network inet dgram, network inet6 dgram, + network inet stream, + network inet6 stream, network netlink raw, @{exec_path} mr, From 52d2cd63b972f29579015370eab4de748a41fbdc Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 1 Sep 2024 18:03:13 -0300 Subject: [PATCH 0109/1455] Create cemu (#459) --- apparmor.d/profiles-a-f/cemu | 51 ++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 apparmor.d/profiles-a-f/cemu diff --git a/apparmor.d/profiles-a-f/cemu b/apparmor.d/profiles-a-f/cemu new file mode 100644 index 000000000..44d4098da --- /dev/null +++ b/apparmor.d/profiles-a-f/cemu @@ -0,0 +1,51 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/cemu +profile cemu @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + /usr/share/Cemu/{,**} r, + + owner @{user_cache_dirs}/Cemu/{,**} rw, + owner @{user_config_dirs}/Cemu/{,**} rw, + owner @{user_share_dirs}/Cemu/{,**} rw, + + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/statm r, + + owner @{sys}/class/ r, + @{sys}/class/input/ r, + @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/abs r, + @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/ev r, + @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/key r, + @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/rel r, + + /dev/input/ r, + /dev/input/event@{int} rw, + /dev/input/js@{int} rw, + + include if exists +} + +# vim:syntax=apparmor From bf2025db09d3bf9a54b8ffbac641625bab0f4bd9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Sep 2024 22:09:00 +0100 Subject: [PATCH 0110/1455] feat(profile): gpg: ensure compatibility with torbrowser profile from upstream. see #407 --- apparmor.d/groups/gpg/gpg | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index a4f2a11ea..43cb9cadf 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -41,6 +41,10 @@ profile gpg @{exec_path} { owner @{user_projects_dirs}/**/gnupg/ rw, owner @{user_projects_dirs}/**/gnupg/** rwkl -> @{user_projects_dirs}/**/gnupg/**, + # TODO: For compatibility with torbrowser profile from upstream. + owner @{user_share_dirs}/torbrowser/gnupg_homedir/ rw, + owner @{user_share_dirs}/torbrowser/gnupg_homedir/** rwkl -> @{user_share_dirs}/torbrowser/gnupg_homedir/**, + #aa:only apt owner /etc/apt/keyrings/ rw, owner /etc/apt/keyrings/** rwkl -> /etc/apt/keyrings/**, From 3c066ea0876bd18c3aed8bc86bd87bd799fa54b3 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 1 Sep 2024 22:22:42 -0300 Subject: [PATCH 0111/1455] Update waybar --- apparmor.d/profiles-s-z/waybar | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index 8da427a64..127945081 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/waybar profile waybar @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -21,11 +22,15 @@ profile waybar @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/** rPUx, - @{user_bin_dirs}/** rPUx, - owner @{user_config_dirs}/waybar/{,**} r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner /dev/tty@{int} rw, include if exists From 26641f585c0db421e06c0d4fb6c1d335db7924fa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 2 Sep 2024 14:14:16 +0100 Subject: [PATCH 0112/1455] feat(profile): add gnome-boxes see #457 --- apparmor.d/groups/gnome/gnome-boxes | 94 +++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 95 insertions(+) create mode 100644 apparmor.d/groups/gnome/gnome-boxes diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes new file mode 100644 index 000000000..9d82ad369 --- /dev/null +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -0,0 +1,94 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/gnome-boxes +profile gnome-boxes @{exec_path} { + include + include + include + include + include + include + include + include + include + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + @{open_path} rPx -> child-open, + + @{bin}/virtqemud rPUx, + @{bin}/virsh rCx -> virsh, + + /usr/share/osinfo/{,**} r, + /usr/share/gnome-boxes/{,**} r, + /usr/share/hwdata/*.ids r, + + /etc/qemu/bridge.conf r, + + @{MOUNTS}/ r, + owner @{HOME}/ r, + + # For disk images + owner @{user_img_dirs}/{,**} rw, + owner @{user_vm_dirs}/{,**} rw, + + owner @{user_cache_dirs}/gnome-boxes/ rw, + owner @{user_cache_dirs}/gnome-boxes/** rwk, + owner @{user_cache_dirs}/libvirt/qemu/log/*.log r, + + owner @{user_config_dirs}/gnome-boxes/ rw, + owner @{user_config_dirs}/gnome-boxes/** rwk, + + owner @{tmp}/.goutputstream-@{rand6} rw, + owner @{tmp}/*.iso-@{rand6} rw, + owner @{tmp}/*.svg-@{rand6} rw, + + owner @{run}/user/@{uid}/libvirt/virtqemud.lock rwk, + + @{run}/mount/utab r, + + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-dbus*org.gnome.Boxes.slice/*/memory.* r, + + @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, + @{PROC}/zoneinfo r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, + + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, + + profile virsh { + include + include + + @{bin}/virsh mr, + @{bin}/pkttyagent r, + + owner @{run}/user/@{uid}/libvirt/ r, + owner @{run}/user/@{uid}/libvirt/virtqemud.lock rwk, + + @{sys}/devices/system/node/ r, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 53782aa9c..e051078a6 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -125,6 +125,7 @@ gdm-runtime-config complain gdm-session attach_disconnected,complain gdm-xsession complain gmenudbusmenuproxy complain +gnome-boxes complain gnome-browser-connector-host complain gnome-control-center attach_disconnected,complain gnome-control-center-goa-helper complain From a93400280e22763d8901f26cfdd1eae982c3badc Mon Sep 17 00:00:00 2001 From: EricLin0509 <143688917+EricLin0509@users.noreply.github.com> Date: Wed, 4 Sep 2024 01:29:03 +0800 Subject: [PATCH 0113/1455] Add support for wemeet (#462) * initial support for wemeet * Some small fixes --- apparmor.d/profiles-s-z/wemeet | 63 ++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 apparmor.d/profiles-s-z/wemeet diff --git a/apparmor.d/profiles-s-z/wemeet b/apparmor.d/profiles-s-z/wemeet new file mode 100644 index 000000000..e866b5e51 --- /dev/null +++ b/apparmor.d/profiles-s-z/wemeet @@ -0,0 +1,63 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 EricLin +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/wemeet +@{exec_path} += /opt/wemeet/bin/wemeetapp +@{exec_path} += /opt/wemeet/bin/QtWebEngineProcess +profile wemeet @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + include + include + + network netlink raw, + network netlink dgram, + network inet stream, + network inet dgram, + network inet6 dgram, + network inet6 stream, + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/basename rix, + @{bin}/bwrap rix, + @{bin}/id rix, + @{bin}/mkdir rix, + /opt/wemeet/bin/** rix, + + /etc/machine-id r, + /var/cache/ w, + + owner @{user_share_dirs}/wemeetapp/ rw, + owner @{user_share_dirs}/wemeetapp/** rwlk -> @{user_share_dirs}/wemeetapp/**, + + @{PROC}/ r, + @{PROC}/asound/ r, + @{PROC}/@{pid}/net/route r, + @{PROC}/@{pid}/net/wireless r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/statm r, + @{PROC}/sys/fs/inotify/max_user_watches r, + owner @{PROC}/@{pid}/cmdline r, + + /dev/ r, + /dev/tty rw, + /dev/shm/ r, + /dev/pts/@{int} rw, + + include if exists + +} + +# vim:syntax=apparmor From 35dcde9d90e4f9cfe218163b61bbfc9ff3c34944 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 5 Sep 2024 14:05:35 +0100 Subject: [PATCH 0114/1455] feat(tunable): add the new version variable. --- apparmor.d/groups/gnome/gio-launch-desktop | 2 +- apparmor.d/groups/gnome/gnome-session-binary | 6 +++--- apparmor.d/groups/gnome/gnome-shell | 8 ++++---- apparmor.d/groups/xfce/xfce-panel | 2 +- apparmor.d/profiles-a-f/exo-open | 4 ++-- apparmor.d/profiles-g-l/gsmartcontrol | 2 +- apparmor.d/profiles-g-l/gtk-youtube-viewer | 4 ++-- apparmor.d/profiles-g-l/jdownloader | 4 ++-- apparmor.d/profiles-m-r/orage | 2 +- apparmor.d/tunables/multiarch.d/paths | 2 +- apparmor.d/tunables/multiarch.d/system | 3 +++ docs/variables.md | 2 +- pkg/aa/apparmor.go | 3 +++ 13 files changed, 25 insertions(+), 19 deletions(-) diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 8e6d80f9e..639b7a144 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -14,7 +14,7 @@ include @{exec_path} = @{bin}/gio @{exec_path} += @{bin}/gio-launch-desktop @{lib}/gio-launch-desktop -@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop +@{exec_path} += @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 962897ea8..2f00b527a 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -59,8 +59,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { @{lib}/gnome-session-check-accelerated-gles-helper rix, @{lib}/gnome-session-failed rix, - @{lib}/gio-launch-desktop rCx -> open, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, + @{lib}/gio-launch-desktop rCx -> open, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, @@ -112,7 +112,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { @{bin}/env rix, @{sh_path} r, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr, @{lib}/gio-launch-desktop mr, @{lib}/** PUx, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index d39c25b24..256309abd 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -184,9 +184,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{lib}/mutter-x11-frames rPx, #aa:exec polkit-agent-helper - @{sh_path} rCx -> shell, - @{lib}/gio-launch-desktop rCx -> open, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, + @{sh_path} rCx -> shell, + @{lib}/gio-launch-desktop rCx -> open, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, # nm-openvpn-auth-dialog @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @@ -409,7 +409,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { network inet stream, network unix stream, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr, @{lib}/gio-launch-desktop mr, @{lib}/** PUx, diff --git a/apparmor.d/groups/xfce/xfce-panel b/apparmor.d/groups/xfce/xfce-panel index 44c9be032..44f237f4b 100644 --- a/apparmor.d/groups/xfce/xfce-panel +++ b/apparmor.d/groups/xfce/xfce-panel @@ -20,7 +20,7 @@ profile xfce-panel @{exec_path} { @{bin}/exo-open rix, @{bin}/xfce4-mime-helper rix, @{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0 rix, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rix, @{lib}/gio-launch-desktop rix, @{bin}/sudo rCx -> root, diff --git a/apparmor.d/profiles-a-f/exo-open b/apparmor.d/profiles-a-f/exo-open index 7d265e566..04d5f8b36 100644 --- a/apparmor.d/profiles-a-f/exo-open +++ b/apparmor.d/profiles-a-f/exo-open @@ -19,10 +19,10 @@ profile exo-open @{exec_path} { @{exec_path} mr, - @{lib}/@{multiarch}/xfce4/exo-[0-9]/exo-helper-[0-9] rPx, + @{lib}/@{multiarch}/xfce4/exo-@{version}/exo-helper-@{version} rPx, # It looks like gio-launch-desktop decides what app should be opened - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rPx, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-g-l/gsmartcontrol b/apparmor.d/profiles-g-l/gsmartcontrol index f6f6b300f..ec3dcff98 100644 --- a/apparmor.d/profiles-g-l/gsmartcontrol +++ b/apparmor.d/profiles-g-l/gsmartcontrol @@ -63,7 +63,7 @@ profile gsmartcontrol @{exec_path} { # The Help menu (and links in it) requires access to a web browser. Since gsmartcontrol is run as # root (even when used sudo or gsmartcontrol-root), the web browser will also be run as root and # hence this behavior should be blocked. - deny @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rx, + deny @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rx, profile dbus { diff --git a/apparmor.d/profiles-g-l/gtk-youtube-viewer b/apparmor.d/profiles-g-l/gtk-youtube-viewer index 96b114461..9d2bc322e 100644 --- a/apparmor.d/profiles-g-l/gtk-youtube-viewer +++ b/apparmor.d/profiles-g-l/gtk-youtube-viewer @@ -40,8 +40,8 @@ profile gtk-youtube-viewer @{exec_path} { @{lib}/firefox/firefox rPx, - @{bin}/xdg-open rCx -> open, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, + @{bin}/xdg-open rCx -> open, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, owner @{user_config_dirs}/youtube-viewer/{,*} rw, diff --git a/apparmor.d/profiles-g-l/jdownloader b/apparmor.d/profiles-g-l/jdownloader index 424074da4..9dc2ed226 100644 --- a/apparmor.d/profiles-g-l/jdownloader +++ b/apparmor.d/profiles-g-l/jdownloader @@ -95,7 +95,7 @@ profile jdownloader @{exec_path} { # To open a web browser for CAPTCHA @{bin}/xdg-open rCx -> open, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, profile open { @@ -103,7 +103,7 @@ profile jdownloader @{exec_path} { include @{bin}/xdg-open mr, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr, @{sh_path} rix, @{bin}/{m,g,}awk rix, diff --git a/apparmor.d/profiles-m-r/orage b/apparmor.d/profiles-m-r/orage index 571532b4f..39e960587 100644 --- a/apparmor.d/profiles-m-r/orage +++ b/apparmor.d/profiles-m-r/orage @@ -23,7 +23,7 @@ profile orage @{exec_path} { @{bin}/xdg-open rCx -> open, @{bin}/exo-open rCx -> open, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, owner @{user_config_dirs}/orage/ rw, owner @{user_config_dirs}/orage/* rw, diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 69ca70ef7..a98f28ae6 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -33,7 +33,7 @@ # Open @{open_path} = @{bin}/exo-open @{bin}/xdg-open @{bin}/gio @{bin}/kde-open @{open_path} += @{bin}/gio-launch-desktop @{lib}/gio-launch-desktop -@{open_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop +@{open_path} += @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop # File explorers @{file_explorers_path} = @{bin}/@{file_explorers_names} diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index aaebe5ed1..b2e1a3b0b 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -61,6 +61,9 @@ @{user}=[a-zA-Z_]{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},} @{group}=@{user} +# Semantic version +@{version}=@{int}{.@{int},}{.@{int},}{-@{rand},} + # Shortcut for PCI device @{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h} @{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h} diff --git a/docs/variables.md b/docs/variables.md index b45df411f..6104e5033 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -135,5 +135,5 @@ title: Variables References | Shells path | `@{shells_path}` | `@{bin}/@{shells}` | | Coreutils programs that should not have dedicated profile | `@{coreutils}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L46) | | Coreutils paths | `@{coreutils_path}` | `@{bin}/@{coreutils}` | -| Launcher paths | `@{open_path}` | `@{bin}/exo-open @{bin}/xdg-open @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop` +| Launcher paths | `@{open_path}` | `@{bin}/exo-open @{bin}/xdg-open @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop @{lib}/gio-launch-desktop` | All browser paths | `@{*_path}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L11) diff --git a/pkg/aa/apparmor.go b/pkg/aa/apparmor.go index 75c009c86..ad3915983 100644 --- a/pkg/aa/apparmor.go +++ b/pkg/aa/apparmor.go @@ -33,6 +33,7 @@ func DefaultTunables() *AppArmorProfileFile { return &AppArmorProfileFile{ Preamble: Rules{ &Variable{Name: "bin", Values: []string{"/{,usr/}{,s}bin"}, Define: true}, + &Variable{Name: "c", Values: []string{"[0-9a-zA-Z]"}, Define: true}, &Variable{Name: "etc_ro", Values: []string{"/{,usr/}etc/"}, Define: true}, &Variable{Name: "HOME", Values: []string{"/home/*"}, Define: true}, &Variable{Name: "int", Values: []string{"[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}"}, Define: true}, @@ -40,11 +41,13 @@ func DefaultTunables() *AppArmorProfileFile { &Variable{Name: "lib", Values: []string{"/{,usr/}lib{,exec,32,64}"}, Define: true}, &Variable{Name: "MOUNTS", Values: []string{"/media/*/", "/run/media/*/*/", "/mnt/*/"}, Define: true}, &Variable{Name: "multiarch", Values: []string{"*-linux-gnu*"}, Define: true}, + &Variable{Name: "rand", Values: []string{"@{c}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}"}, Define: true}, // Up to 10 characters &Variable{Name: "run", Values: []string{"/run/", "/var/run/"}, Define: true}, &Variable{Name: "uid", Values: []string{"{[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]}"}, Define: true}, &Variable{Name: "user_cache_dirs", Values: []string{"/home/*/.cache"}, Define: true}, &Variable{Name: "user_config_dirs", Values: []string{"/home/*/.config"}, Define: true}, &Variable{Name: "user_share_dirs", Values: []string{"/home/*/.local/share"}, Define: true}, + &Variable{Name: "version", Values: []string{"@{int}{.@{int},}{.@{int},}{-@{rand},}"}, Define: true}, }, } } From 4e17001ce2b2d4c27aadd45083c2fe48b284e855 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 5 Sep 2024 14:08:08 +0100 Subject: [PATCH 0115/1455] feat(tunable): add the new python_path & python_name variables. --- apparmor.d/tunables/multiarch.d/paths | 3 +++ apparmor.d/tunables/multiarch.d/programs | 3 +++ 2 files changed, 6 insertions(+) diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index a98f28ae6..35bf0c58f 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -13,6 +13,9 @@ # Coreutils programs that should not have dedicated profile @{coreutils_path} = @{bin}/@{coreutils} +# Python interpreters +@{python_path} = @{bin}/@{python_name} + # Browsers @{brave_path} = @{brave_lib_dirs}/@{brave_name} @{chrome_path} = @{opera_lib_dirs}/@{chrome_name} diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index e8c6b9022..9c0c4d305 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -25,6 +25,9 @@ @{coreutils} += sort split stat stdbuf stty sum sync tac tail tee test timeout touch tr true @{coreutils} += truncate tsort tty uname unexpand uniq unlink updatedb vdir wc who whoami xargs yes +# Python interpreters +@{python_name} = python{,3,3.[0-9],3.1[0-9]} + # Browsers @{brave_name} = brave{,-beta,-dev,-bin} From 6b191d9ada6e267e0337322de52e7938944ee85c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 5 Sep 2024 14:23:16 +0100 Subject: [PATCH 0116/1455] feat(profile): use @{int} on systemd/inhibit. --- apparmor.d/groups/apps/signal-desktop | 2 +- apparmor.d/groups/apt/apt | 2 +- apparmor.d/groups/apt/unattended-upgrade | 2 +- apparmor.d/groups/apt/unattended-upgrade-shutdown | 2 +- apparmor.d/groups/bus/dbus-system | 2 +- apparmor.d/groups/freedesktop/upowerd | 2 +- apparmor.d/groups/gnome/gnome-music | 2 +- apparmor.d/groups/gnome/gnome-session-binary | 2 +- apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/gnome/gnome-software | 2 +- apparmor.d/groups/gnome/gsd-media-keys | 2 +- apparmor.d/groups/gnome/gsd-power | 2 +- apparmor.d/groups/kde/kde-powerdevil | 2 +- apparmor.d/groups/kde/ksmserver | 2 +- apparmor.d/groups/kde/kwin_wayland | 2 +- apparmor.d/groups/network/ModemManager | 2 +- apparmor.d/groups/network/NetworkManager | 2 +- apparmor.d/groups/network/mullvad-gui | 2 +- apparmor.d/groups/systemd/systemd-inhibit | 2 +- apparmor.d/groups/systemd/systemd-logind | 2 +- apparmor.d/groups/ubuntu/update-manager | 2 +- apparmor.d/groups/virt/libvirtd | 2 +- apparmor.d/groups/virt/virtinterfaced | 2 +- apparmor.d/groups/virt/virtlogd | 2 +- apparmor.d/groups/virt/virtnetworkd | 2 +- apparmor.d/groups/virt/virtnodedevd | 2 +- apparmor.d/groups/virt/virtsecretd | 2 +- apparmor.d/groups/virt/virtstoraged | 2 +- apparmor.d/groups/xfce/xfce-power-manager | 2 +- apparmor.d/groups/xfce/xfce-screensaver | 2 +- apparmor.d/profiles-a-f/fprintd | 2 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-m-r/mission-control | 2 +- apparmor.d/profiles-m-r/nvtop | 2 +- apparmor.d/profiles-m-r/packagekitd | 2 +- apparmor.d/profiles-m-r/psi | 2 +- apparmor.d/profiles-m-r/psi-plus | 2 +- apparmor.d/profiles-s-z/udisksd | 2 +- 38 files changed, 38 insertions(+), 38 deletions(-) diff --git a/apparmor.d/groups/apps/signal-desktop b/apparmor.d/groups/apps/signal-desktop index 6c8525f48..912d95760 100644 --- a/apparmor.d/groups/apps/signal-desktop +++ b/apparmor.d/groups/apps/signal-desktop @@ -37,7 +37,7 @@ profile signal-desktop @{exec_path} { /var/lib/dbus/machine-id r, /etc/machine-id r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.high r, diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index dcc6303c8..38bd8f3eb 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -149,7 +149,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { /dev/ptmx rw, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, profile editor flags=(complain) { include diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index f5caa7b65..eaac10851 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -100,7 +100,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /var/log/apt/{term,history}.log w, /var/log/apt/eipp.log.xz w, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/unattended-upgrades.lock rwk, owner @{run}/unattended-upgrades.pid rw, owner @{run}/unattended-upgrades.progress rw, diff --git a/apparmor.d/groups/apt/unattended-upgrade-shutdown b/apparmor.d/groups/apt/unattended-upgrade-shutdown index 65f8a30d2..bd963a006 100644 --- a/apparmor.d/groups/apt/unattended-upgrade-shutdown +++ b/apparmor.d/groups/apt/unattended-upgrade-shutdown @@ -25,7 +25,7 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) { owner /var/log/unattended-upgrades/*.log* rw, owner @{run}/unattended-upgrades.lock rwk, - owner @{run}/systemd/inhibit/[0-9]*.ref rw, + owner @{run}/systemd/inhibit/@{int}.ref rw, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index e63d51eaa..f532bb29b 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -53,7 +53,7 @@ profile dbus-system flags=(attach_disconnected) { @{user_share_dirs}/icc/ r, @{user_share_dirs}/icc/edid-@{hex32}.icc r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/notify w, @{run}/systemd/sessions/*.ref rw, @{run}/systemd/users/@{int} r, diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index 92e6148b3..aa93e0267 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -40,7 +40,7 @@ profile upowerd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c116:@{int} r, # for ALSA - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/hid/devices/ r, @{sys}/class/input/ r, diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index 69273720e..710393390 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -45,7 +45,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/grilo-plugins/ rwk, owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw, owner /var/tmp/etilqs_@{hex15} rw, diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 2f00b527a..e08ae61d3 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -84,7 +84,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/gnome-session/ rw, owner @{user_config_dirs}/gnome-session/saved-session/ rw, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/sessions/* r, @{run}/systemd/sessions/*.ref rw, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 256309abd..6950304fc 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -307,7 +307,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{run}/systemd/seats/seat@{int} r, @{run}/systemd/sessions/ r, @{run}/systemd/sessions/* r, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/tags/seat/ r, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index f5652135a..290aa4454 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -108,7 +108,7 @@ profile gnome-software @{exec_path} { owner /dev/shm/flatpak-com.*/ rw, owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/sessions/@{int} r, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 9a799d444..6ed820866 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -96,7 +96,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/recently-used.xbel{,.*} rw, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/+sound:card@{int} r, # For sound card @{run}/udev/data/c13:@{int} r, # for /dev/input/* diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 2c21bc4fd..0f4b3cd3c 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -64,7 +64,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs @{run}/udev/data/+leds:* r, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/ r, @{sys}/class/ r, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 64371caaa..a37fea7a0 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -46,7 +46,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) owner @{user_config_dirs}/powermanagementprofilesrc.lock rwk, owner @{user_config_dirs}/powermanagementprofilesrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** owner @{run}/user/@{uid}kcrash_@{int} rw, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index 5f6c9ceb6..f768cad0c 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -69,7 +69,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/@{rand6} rw, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/user/@{uid}/KSMserver__[0-9] rw, /dev/tty r, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 7bed8beca..95abaa2a6 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -103,7 +103,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { owner @{user_share_dirs}/kscreen/* r, owner @{user_share_dirs}/kwin/scripts/{,**} r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/ r, @{sys}/class/ r, diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index fad5908b4..06e0c0fe5 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -34,7 +34,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx @{run}/udev/data/n@{int} r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/ r, @{sys}/bus/usb/devices/ r, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index e5e9b0785..f8612b4dc 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -122,7 +122,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{run}/NetworkManager/{,**} rw, @{run}/nm-*.pid rw, @{run}/nscd/db* rwl, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/users/@{uid} r, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index 7533b107c..48534d676 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -32,7 +32,7 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, /dev/tty rw, diff --git a/apparmor.d/groups/systemd/systemd-inhibit b/apparmor.d/groups/systemd/systemd-inhibit index 755cfe5ee..01b3e0bcd 100644 --- a/apparmor.d/groups/systemd/systemd-inhibit +++ b/apparmor.d/groups/systemd/systemd-inhibit @@ -18,7 +18,7 @@ profile systemd-inhibit @{exec_path} flags=(attach_disconnected) { @{bin}/cat rix, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 9a0a2c7d7..8db1923e5 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -96,7 +96,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{run}/systemd/inhibit/ rw, @{run}/systemd/inhibit/.#* rw, - @{run}/systemd/inhibit/[0-9]*{,.ref} rw, + @{run}/systemd/inhibit/@{int}{,.ref} rw, @{run}/systemd/journal/socket rw, @{run}/systemd/notify rw, @{run}/systemd/seats/ rw, diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 0ee70c39b..2811b16e3 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -70,7 +70,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/update-manager-core/{,**} rw, - @{run}/systemd/inhibit/*.ref w, + @{run}/systemd/inhibit/@{int}.ref rw, @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index a755c1672..4f8c76a81 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -157,7 +157,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{run}/libvirt/** rwk, @{run}/libvirtd.pid wk, @{run}/lock/LCK.._pts_@{int} rw, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/notify w, @{run}/utmp rk, diff --git a/apparmor.d/groups/virt/virtinterfaced b/apparmor.d/groups/virt/virtinterfaced index 96d135912..ccda93f6b 100644 --- a/apparmor.d/groups/virt/virtinterfaced +++ b/apparmor.d/groups/virt/virtinterfaced @@ -20,7 +20,7 @@ profile virtinterfaced @{exec_path} flags=(attach_disconnected) { @{lib}/gconv/gconv-modules rm, @{lib}/gconv/gconv-modules.d/{,*} r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/user/@{uid}/libvirt/common/system.token rwk, owner @{run}/user/@{uid}/libvirt/interface/ rw, owner @{run}/user/@{uid}/libvirt/interface/run/{,*} rwk, diff --git a/apparmor.d/groups/virt/virtlogd b/apparmor.d/groups/virt/virtlogd index b06ad67f1..0cb7202ee 100644 --- a/apparmor.d/groups/virt/virtlogd +++ b/apparmor.d/groups/virt/virtlogd @@ -30,7 +30,7 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) { @{run}/libvirt/common/system.token rwk, @{run}/libvirt/virtlogd-sock rw, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/virtlogd.pid rwk, @{sys}/devices/system/node/ r, diff --git a/apparmor.d/groups/virt/virtnetworkd b/apparmor.d/groups/virt/virtnetworkd index a2c02368b..fa4e0a5d5 100644 --- a/apparmor.d/groups/virt/virtnetworkd +++ b/apparmor.d/groups/virt/virtnetworkd @@ -25,7 +25,7 @@ profile virtnetworkd @{exec_path} flags=(attach_disconnected) { owner /var/lib/libvirt/dnsmasq/*.macs* rw, @{run}/libvirt/network/default.pid r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/utmp rk, owner @{run}/libvirt/common/system.token rwk, owner @{run}/libvirt/network/{,**} rwk, diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index a39c04504..38f84a8eb 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -33,7 +33,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { /etc/libvirt/virtnodedevd.conf r, /etc/mdevctl.d/{,**} r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/libvirt/common/system.token rwk, owner @{run}/libvirt/nodedev/ rw, owner @{run}/libvirt/nodedev/driver.pid wk, diff --git a/apparmor.d/groups/virt/virtsecretd b/apparmor.d/groups/virt/virtsecretd index cdded1152..f6c56ca10 100644 --- a/apparmor.d/groups/virt/virtsecretd +++ b/apparmor.d/groups/virt/virtsecretd @@ -20,7 +20,7 @@ profile virtsecretd @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/libvirt/secrets/ rw, owner @{user_config_dirs}/libvirt/secrets/run/{,*} rwk, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/user/@{uid}/libvirt/common/system.token rwk, owner @{run}/user/@{uid}/libvirt/secrets/ rw, owner @{run}/user/@{uid}/libvirt/secrets/run/{,*} rwk, diff --git a/apparmor.d/groups/virt/virtstoraged b/apparmor.d/groups/virt/virtstoraged index 7c6f7207b..7130edfa6 100644 --- a/apparmor.d/groups/virt/virtstoraged +++ b/apparmor.d/groups/virt/virtstoraged @@ -55,7 +55,7 @@ profile virtstoraged @{exec_path} flags=(attach_disconnected) { owner @{run}/libvirt/storage/{,**} rwk, owner @{run}/virtstoraged.pid rwk, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/utmp rwk, @{sys}/devices/system/node/ r, diff --git a/apparmor.d/groups/xfce/xfce-power-manager b/apparmor.d/groups/xfce/xfce-power-manager index d286280f0..f0654ac68 100644 --- a/apparmor.d/groups/xfce/xfce-power-manager +++ b/apparmor.d/groups/xfce/xfce-power-manager @@ -21,7 +21,7 @@ profile xfce-power-manager @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/stat r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/groups/xfce/xfce-screensaver b/apparmor.d/groups/xfce/xfce-screensaver index e441b84b8..aaa5f7fa4 100644 --- a/apparmor.d/groups/xfce/xfce-screensaver +++ b/apparmor.d/groups/xfce/xfce-screensaver @@ -25,7 +25,7 @@ profile xfce-screensaver @{exec_path} flags=(attach_disconnected) { /etc/xdg/menus/xfce4-screensavers.menu r, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/profiles-a-f/fprintd b/apparmor.d/profiles-a-f/fprintd index d856867a3..2c474b27b 100644 --- a/apparmor.d/profiles-a-f/fprintd +++ b/apparmor.d/profiles-a-f/fprintd @@ -28,7 +28,7 @@ profile fprintd @{exec_path} flags=(attach_disconnected) { /var/lib/fprint/{,**} rw, @{run}/systemd/journal/socket rw, - @{run}/systemd/inhibit/*.ref w, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/class/hidraw/ r, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 474ab630b..afb8bc367 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -98,7 +98,7 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) { @{run}/motd.d/@{int}-fwupd* rw, @{run}/motd.d/fwupd/{,**} rw, @{run}/mount/utab r, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/* r, @{PROC}/@{pids}/fd/ r, diff --git a/apparmor.d/profiles-m-r/mission-control b/apparmor.d/profiles-m-r/mission-control index 267fb9d1a..a6f1e5803 100644 --- a/apparmor.d/profiles-m-r/mission-control +++ b/apparmor.d/profiles-m-r/mission-control @@ -24,7 +24,7 @@ profile mission-control @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/profiles-m-r/nvtop b/apparmor.d/profiles-m-r/nvtop index 54c9c5959..a27a9d0f9 100644 --- a/apparmor.d/profiles-m-r/nvtop +++ b/apparmor.d/profiles-m-r/nvtop @@ -23,7 +23,7 @@ profile nvtop @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/nvtop/{,**} rw, - @{run}/systemd/inhibit/*.ref r, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/+drm:card@{int}-* r, # for screen outputs @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/c226:@{int} r, # For /dev/dri/card* diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index b61426196..7482cda65 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -93,7 +93,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { owner @{tmp}/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw, owner @{tmp}/packagekit* rw, - @{run}/systemd/inhibit/*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/systemd/users/@{uid} r, #aa:only opensuse diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index e764b69f8..30457cf04 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -59,7 +59,7 @@ profile psi @{exec_path} { owner @{tmp}/etilqs_@{hex16} rw, owner @{tmp}/Psi.* rwl -> /tmp/#@{int}, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index d9b1f7fd5..1427af278 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -59,7 +59,7 @@ profile psi-plus @{exec_path} { owner @{tmp}/etilqs_@{hex16} rw, owner @{tmp}/Psi+.* rwl -> /tmp/#@{int}, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 83561941c..76be97683 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -107,7 +107,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{run}/mount/utab{,.*} rwk, @{run}/udisks2/{,**} rw, @{run}/systemd/seats/seat@{int} r, - @{run}/systemd/inhibit/[0-9]*.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/cryptsetup/ r, @{run}/cryptsetup/L* rwk, From fde8ee6ec65095ec90c91e08e7d118aedc456176 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 6 Sep 2024 21:32:39 +0100 Subject: [PATCH 0117/1455] fix(profile): generic app need access to /var/cache/tmp/ fix #465 --- apparmor.d/abstractions/common/app | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index dc598cfa1..2798b5082 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -61,6 +61,7 @@ owner @{user_share_dirs}/** rwkl, owner @{user_games_dirs}/{,**} rm, + owner /var/cache/tmp/** rwk, owner @{tmp}/** rmwk, owner /dev/shm/** rwlk -> /dev/shm/**, From a1407243dd4f8f17a4d23acaa4cac21e77d6eb90 Mon Sep 17 00:00:00 2001 From: EricLin0509 <143688917+EricLin0509@users.noreply.github.com> Date: Sat, 7 Sep 2024 04:35:16 +0800 Subject: [PATCH 0118/1455] Update profile for ufw (#467) * Update profile for ufw * A small fix --- apparmor.d/profiles-s-z/ufw | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 55437c180..4340f12db 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -33,12 +33,12 @@ profile ufw @{exec_path} { /etc/default/ufw r, - @{run}/ufw.lock rwk, + owner @{run}/ufw.lock rwk, - /var/tmp/@{rand8} rw, - /var/tmp/tmp* rw, - /tmp/@{rand8} rw, - /tmp/tmp* rw, + owner /var/tmp/???????? rw, + owner /var/tmp/tmp???????? rw, + owner @{tmp}/???????? rw, + owner @{tmp}/tmp???????? rw, @{PROC}/@{pid}/stat r, @{PROC}/@{pid}/fd/ r, From ac2f085d8cb686c2f8d76678fdd70dc6113e1d0b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 6 Sep 2024 21:40:17 +0100 Subject: [PATCH 0119/1455] feat(abs): add support for keyfile in dconf. fix #460 --- apparmor.d/abstractions/dconf-write | 1 + apparmor.d/abstractions/dconf.d/complete | 7 +++++++ 2 files changed, 8 insertions(+) create mode 100644 apparmor.d/abstractions/dconf.d/complete diff --git a/apparmor.d/abstractions/dconf-write b/apparmor.d/abstractions/dconf-write index f25e1c3e6..41145e512 100644 --- a/apparmor.d/abstractions/dconf-write +++ b/apparmor.d/abstractions/dconf-write @@ -20,6 +20,7 @@ /etc/dconf/** r, owner @{user_config_dirs}/dconf/user r, + owner @{user_config_dirs}/glib-2.0/settings/keyfile rw, owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/user rw, diff --git a/apparmor.d/abstractions/dconf.d/complete b/apparmor.d/abstractions/dconf.d/complete new file mode 100644 index 000000000..108f6b8c7 --- /dev/null +++ b/apparmor.d/abstractions/dconf.d/complete @@ -0,0 +1,7 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + owner @{user_config_dirs}/glib-2.0/settings/keyfile r, + +# vim:syntax=apparmor From 512b42702b761552153e006c0cb80c47d37b0dba Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 21 Jul 2024 11:23:32 -0300 Subject: [PATCH 0120/1455] add hyprland profile --- apparmor.d/groups/hyprland/hyprland | 70 +++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 apparmor.d/groups/hyprland/hyprland diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland new file mode 100644 index 000000000..25ebbf28d --- /dev/null +++ b/apparmor.d/groups/hyprland/hyprland @@ -0,0 +1,70 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/Hyprland +profile hyprland @{exec_path} flags=(attach_disconnected) { + include + include + include + include + + capability sys_ptrace, + + ptrace read, + + network netlink raw, + + signal send, + + @{exec_path} mr, + + @{bin}/** rPUx, + @{user_bin_dirs}/** rPUx, + owner @{user_share_dirs}/hyprpm/** mr, + + /usr/share/hyprland/{,*} r, + /usr/share/libinput/{,*} r, + + owner @{user_cache_dirs}/hyprland/** w, + owner @{user_config_dirs}/hypr/hyprland.conf r, + + @{run}/systemd/sessions/@{int} r, + @{run}/udev/data/+acpi:* r, + @{run}/udev/data/+dmi:id r, + @{run}/udev/data/+drm:card@{int}-* r, + @{run}/udev/data/+input:input@{int} r, + @{run}/udev/data/+pci:* r, + @{run}/udev/data/+platform:pcspkr r, + @{run}/udev/data/+sound:card@{int} r, + @{run}/udev/data/+usb:* r, + @{run}/udev/data/c13:@{int} r, + @{run}/udev/data/c189:@{int} r, + @{run}/udev/data/c226:@{int} r, + owner @{run}/user/@{uid}/hypr/{,**} rw, + owner @{run}/user/@{uid}/.hyprpaper_* rw, + owner @{run}/user/@{uid}/.hyprpicker_* rw, + owner /tmp/.X@{int}-lock w, + owner /dev/shm/@{uuid} rw, + owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + + @{sys}/bus/ r, + @{sys}/class/input/ r, + @{sys}/devices/@{pci}/oot_vga r, + @{sys}/devices/**/uevent r, + + owner @{PROC}/@{pid}/environ r, + + /dev/input/event@{int} rw, + /dev/tty r, + owner /dev/tty@{int} rw, + + include if exists +} + +# vim:syntax=apparmor + From fe3d32df1f92ece9c5ee25cb78442830e87a104e Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 21 Jul 2024 16:10:46 -0300 Subject: [PATCH 0121/1455] Add access to gamescope --- apparmor.d/groups/hyprland/hyprland | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 25ebbf28d..2a41650b9 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -45,6 +45,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c13:@{int} r, @{run}/udev/data/c189:@{int} r, @{run}/udev/data/c226:@{int} r, + owner @{run}/user/@{uid}/gamescope-* rw, owner @{run}/user/@{uid}/hypr/{,**} rw, owner @{run}/user/@{uid}/.hyprpaper_* rw, owner @{run}/user/@{uid}/.hyprpicker_* rw, From c4482675ef503ab4301d50ef51696eaf3b75539b Mon Sep 17 00:00:00 2001 From: odomingao Date: Wed, 21 Aug 2024 09:10:01 -0300 Subject: [PATCH 0122/1455] Update hyprland --- apparmor.d/groups/hyprland/hyprland | 40 ++++++++++++++--------------- 1 file changed, 19 insertions(+), 21 deletions(-) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 2a41650b9..65759f682 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -9,9 +9,9 @@ include @{exec_path} = @{bin}/Hyprland profile hyprland @{exec_path} flags=(attach_disconnected) { include + include include include - include capability sys_ptrace, @@ -23,39 +23,37 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/** rPUx, @{user_bin_dirs}/** rPUx, owner @{user_share_dirs}/hyprpm/** mr, /usr/share/hyprland/{,*} r, /usr/share/libinput/{,*} r, - owner @{user_cache_dirs}/hyprland/** w, - owner @{user_config_dirs}/hypr/hyprland.conf r, + owner @{user_cache_dirs}/hyprland/{,**} rw, + owner @{user_config_dirs}/hypr/** r, - @{run}/systemd/sessions/@{int} r, - @{run}/udev/data/+acpi:* r, - @{run}/udev/data/+dmi:id r, - @{run}/udev/data/+drm:card@{int}-* r, - @{run}/udev/data/+input:input@{int} r, - @{run}/udev/data/+pci:* r, - @{run}/udev/data/+platform:pcspkr r, - @{run}/udev/data/+sound:card@{int} r, - @{run}/udev/data/+usb:* r, - @{run}/udev/data/c13:@{int} r, - @{run}/udev/data/c189:@{int} r, - @{run}/udev/data/c226:@{int} r, owner @{run}/user/@{uid}/gamescope-* rw, owner @{run}/user/@{uid}/hypr/{,**} rw, - owner @{run}/user/@{uid}/.hyprpaper_* rw, - owner @{run}/user/@{uid}/.hyprpicker_* rw, - owner /tmp/.X@{int}-lock w, - owner /dev/shm/@{uuid} rw, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + @{run}/systemd/sessions/@{int} r, + + @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+dmi:id r, # for motherboard info + @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs + @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) + @{run}/udev/data/+platform:* r, + @{run}/udev/data/+sound:card@{int} r, # for sound card + @{run}/udev/data/+usb* r, # for USB mouse and keyboard + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** + @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* + @{sys}/bus/ r, @{sys}/class/input/ r, - @{sys}/devices/@{pci}/oot_vga r, + @{sys}/devices/@{pci}/boot_vga r, @{sys}/devices/**/uevent r, owner @{PROC}/@{pid}/environ r, From 2e048156acafec8248fada2a97d3a807131c1c07 Mon Sep 17 00:00:00 2001 From: odomingao Date: Wed, 21 Aug 2024 09:13:29 -0300 Subject: [PATCH 0123/1455] Update wayland abstraction --- apparmor.d/abstractions/wayland.d/complete | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apparmor.d/abstractions/wayland.d/complete b/apparmor.d/abstractions/wayland.d/complete index 245b9238d..ee2cc73c9 100644 --- a/apparmor.d/abstractions/wayland.d/complete +++ b/apparmor.d/abstractions/wayland.d/complete @@ -6,10 +6,15 @@ owner @{user_share_dirs}/sddm/wayland-session.log w, + owner @{run}/user/@{uid}/.hyprpaper_* rw, + owner @{run}/user/@{uid}/.hyprpicker_* rw, owner @{run}/user/@{uid}/wayland-@{int}.lock rwk, owner @{run}/user/@{uid}/wayland-proxy-@{int} rw, + owner /tmp/.X@{int}-lock w, owner /dev/shm/sway* rw, owner /dev/shm/dunst-@{rand6} rw, + owner /dev/shm/@{uuid} rw, + owner /dev/shm/wlroots-@{rand6} rw, # vim:syntax=apparmor From fe86133f4986e000f17a4e68eb90d3446c3accd2 Mon Sep 17 00:00:00 2001 From: odomingao Date: Wed, 21 Aug 2024 09:48:59 -0300 Subject: [PATCH 0124/1455] Update wayland abstraction --- apparmor.d/abstractions/wayland.d/complete | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/wayland.d/complete b/apparmor.d/abstractions/wayland.d/complete index ee2cc73c9..0054a51d0 100644 --- a/apparmor.d/abstractions/wayland.d/complete +++ b/apparmor.d/abstractions/wayland.d/complete @@ -12,6 +12,7 @@ owner @{run}/user/@{uid}/wayland-proxy-@{int} rw, owner /tmp/.X@{int}-lock w, + owner /dev/shm/grim-@{rand6} rw, owner /dev/shm/sway* rw, owner /dev/shm/dunst-@{rand6} rw, owner /dev/shm/@{uuid} rw, From edfa690e2b0f007f24c1bc6ddd716544fb73f6dc Mon Sep 17 00:00:00 2001 From: odomingao Date: Sat, 31 Aug 2024 13:49:27 -0300 Subject: [PATCH 0125/1455] Update hyprland --- apparmor.d/groups/hyprland/hyprland | 1 - 1 file changed, 1 deletion(-) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 65759f682..40ee83296 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -23,7 +23,6 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{user_bin_dirs}/** rPUx, owner @{user_share_dirs}/hyprpm/** mr, /usr/share/hyprland/{,*} r, From f91fc287111d62555c7f4789195548078ad40747 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 6 Sep 2024 21:47:24 +0100 Subject: [PATCH 0126/1455] chore: minor guideline cosmetic. --- apparmor.d/abstractions/wayland.d/complete | 7 ++----- apparmor.d/groups/hyprland/hyprland | 13 +++++++------ 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/apparmor.d/abstractions/wayland.d/complete b/apparmor.d/abstractions/wayland.d/complete index 0054a51d0..f0c712634 100644 --- a/apparmor.d/abstractions/wayland.d/complete +++ b/apparmor.d/abstractions/wayland.d/complete @@ -6,16 +6,13 @@ owner @{user_share_dirs}/sddm/wayland-session.log w, - owner @{run}/user/@{uid}/.hyprpaper_* rw, - owner @{run}/user/@{uid}/.hyprpicker_* rw, owner @{run}/user/@{uid}/wayland-@{int}.lock rwk, owner @{run}/user/@{uid}/wayland-proxy-@{int} rw, - owner /tmp/.X@{int}-lock w, + owner /dev/shm/@{uuid} rw, + owner /dev/shm/dunst-@{rand6} rw, owner /dev/shm/grim-@{rand6} rw, owner /dev/shm/sway* rw, - owner /dev/shm/dunst-@{rand6} rw, - owner /dev/shm/@{uuid} rw, owner /dev/shm/wlroots-@{rand6} rw, # vim:syntax=apparmor diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 40ee83296..5fa0ce84b 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -15,23 +15,24 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { capability sys_ptrace, - ptrace read, - network netlink raw, signal send, - @{exec_path} mr, + ptrace read, - owner @{user_share_dirs}/hyprpm/** mr, + @{exec_path} mr, /usr/share/hyprland/{,*} r, /usr/share/libinput/{,*} r, owner @{user_cache_dirs}/hyprland/{,**} rw, owner @{user_config_dirs}/hypr/** r, + owner @{user_share_dirs}/hyprpm/** mr, owner @{run}/user/@{uid}/gamescope-* rw, + owner @{run}/user/@{uid}/.hyprpaper_* rw, + owner @{run}/user/@{uid}/.hyprpicker_* rw, owner @{run}/user/@{uid}/hypr/{,**} rw, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, @@ -57,8 +58,8 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/environ r, - /dev/input/event@{int} rw, - /dev/tty r, + /dev/input/event@{int} rw, + /dev/tty r, owner /dev/tty@{int} rw, include if exists From a8b1e4609542a23422bd0168a85f82bfb2464698 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 8 Sep 2024 12:21:56 +0100 Subject: [PATCH 0127/1455] feat(profile): add dmsetup fix #469 --- apparmor.d/profiles-a-f/dmsetup | 23 +++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 24 insertions(+) create mode 100644 apparmor.d/profiles-a-f/dmsetup diff --git a/apparmor.d/profiles-a-f/dmsetup b/apparmor.d/profiles-a-f/dmsetup new file mode 100644 index 000000000..305e03573 --- /dev/null +++ b/apparmor.d/profiles-a-f/dmsetup @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/dmsetup +profile dmsetup @{exec_path} { + include + include + + capability sys_admin, + + @{exec_path} mr, + + @{PROC}/devices r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index e051078a6..d26b951f7 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -90,6 +90,7 @@ ddcutil complain dino attach_disconnected,complain DiscoverNotifier complain dkms attach_disconnected,complain +dmsetup complain dockerd attach_disconnected,complain dolphin complain downloadhelper complain From 98042620f6ca9fd558ba888186131fb3baf6cab6 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sat, 7 Sep 2024 10:30:55 -0300 Subject: [PATCH 0128/1455] Update hyprlock --- apparmor.d/groups/hyprland/hyprlock | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/hyprland/hyprlock b/apparmor.d/groups/hyprland/hyprlock index 86cc79570..9459018ef 100644 --- a/apparmor.d/groups/hyprland/hyprlock +++ b/apparmor.d/groups/hyprland/hyprlock @@ -13,6 +13,7 @@ profile hyprlock @{exec_path} { include include include + include network netlink raw, From 7b04e288358b6d4ad6ce3b19a26e4fb4052f361a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 8 Sep 2024 12:36:35 +0100 Subject: [PATCH 0129/1455] feat(profile): remove transparent_hugepage rule already included in base. --- apparmor.d/groups/network/mullvad-daemon | 1 - apparmor.d/groups/network/tailscale | 2 -- apparmor.d/groups/network/tailscaled | 1 - apparmor.d/groups/ubuntu/apt-esm-json-hook | 2 -- apparmor.d/groups/ubuntu/ubuntu-report | 2 -- apparmor.d/groups/virt/cni-bandwidth | 2 -- apparmor.d/groups/virt/cni-bridge | 2 -- apparmor.d/groups/virt/cni-calico | 2 -- apparmor.d/groups/virt/cni-firewall | 2 -- apparmor.d/groups/virt/cni-flannel | 2 -- apparmor.d/groups/virt/cni-host-local | 2 -- apparmor.d/groups/virt/cni-loopback | 2 -- apparmor.d/groups/virt/cni-portmap | 2 -- apparmor.d/groups/virt/cni-tuning | 2 -- apparmor.d/groups/virt/containerd | 1 - apparmor.d/groups/virt/containerd-shim-runc-v2 | 1 - apparmor.d/groups/virt/docker-proxy | 2 -- apparmor.d/groups/virt/dockerd | 1 - apparmor.d/groups/virt/k3s | 1 - apparmor.d/profiles-a-f/aa-log | 2 -- apparmor.d/profiles-a-f/arduino-builder | 2 -- apparmor.d/profiles-a-f/browserpass | 2 -- apparmor.d/profiles-a-f/dnscrypt-proxy | 2 -- apparmor.d/profiles-g-l/hugo | 2 -- apparmor.d/profiles-s-z/sbctl | 2 -- apparmor.d/profiles-s-z/sing-box | 2 -- apparmor.d/profiles-s-z/snap | 1 - apparmor.d/profiles-s-z/snap-failure | 2 -- apparmor.d/profiles-s-z/snap-seccomp | 2 -- apparmor.d/profiles-s-z/snap-update-ns | 1 - apparmor.d/profiles-s-z/snapd | 1 - apparmor.d/profiles-s-z/snapd-aa-prompt-listener | 2 -- apparmor.d/profiles-s-z/snapd-apparmor | 2 -- apparmor.d/profiles-s-z/syncthing | 2 -- apparmor.d/profiles-s-z/zsysd | 2 -- 35 files changed, 61 deletions(-) diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index dcdb1738a..a57213481 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -55,7 +55,6 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/net_cls/ w, @{sys}/fs/cgroup/net_cls/mullvad-exclusions/ w, @{sys}/fs/cgroup/net_cls/mullvad-exclusions/net_cls.classid rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, owner @{tmp}/@{uuid} rw, owner @{tmp}/talpid-openvpn-@{uuid} rw, diff --git a/apparmor.d/groups/network/tailscale b/apparmor.d/groups/network/tailscale index 5c3b62211..37029973b 100644 --- a/apparmor.d/groups/network/tailscale +++ b/apparmor.d/groups/network/tailscale @@ -27,8 +27,6 @@ profile tailscale @{exec_path} { owner @{run}/tailscale/tailscaled.sock rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/ r, @{PROC}/@{pids}/stat r, @{PROC}/sys/net/core/somaxconn r, diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index 121697da6..dd3f253db 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -69,7 +69,6 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) { owner @{run}/tailscale/{,**} rw, @{sys}/devices/virtual/dmi/id/{bios_vendor,product_name} r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{PROC}/ r, @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/ubuntu/apt-esm-json-hook b/apparmor.d/groups/ubuntu/apt-esm-json-hook index 54c116677..4ce754d65 100644 --- a/apparmor.d/groups/ubuntu/apt-esm-json-hook +++ b/apparmor.d/groups/ubuntu/apt-esm-json-hook @@ -21,8 +21,6 @@ profile apt-esm-json-hook @{exec_path} { /var/lib/ubuntu-advantage/{,**} r, /var/lib/ubuntu-advantage/apt-esm/{,**} rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{run}/cloud-init/cloud-id-nocloud r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/ubuntu/ubuntu-report b/apparmor.d/groups/ubuntu/ubuntu-report index 5edc9ebd2..54e444532 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-report +++ b/apparmor.d/groups/ubuntu/ubuntu-report @@ -23,8 +23,6 @@ profile ubuntu-report @{exec_path} { owner @{user_cache_dirs}/ubuntu-report/{,*} r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-bandwidth b/apparmor.d/groups/virt/cni-bandwidth index 21914faf8..0159f603e 100644 --- a/apparmor.d/groups/virt/cni-bandwidth +++ b/apparmor.d/groups/virt/cni-bandwidth @@ -18,8 +18,6 @@ profile cni-bandwidth @{exec_path} { @{exec_path} mr, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-bridge b/apparmor.d/groups/virt/cni-bridge index 37de32ae0..70347fe59 100644 --- a/apparmor.d/groups/virt/cni-bridge +++ b/apparmor.d/groups/virt/cni-bridge @@ -12,8 +12,6 @@ profile cni-bridge @{exec_path} { @{exec_path} mr, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-calico b/apparmor.d/groups/virt/cni-calico index 7c39a7ad2..47d5590a2 100644 --- a/apparmor.d/groups/virt/cni-calico +++ b/apparmor.d/groups/virt/cni-calico @@ -41,8 +41,6 @@ profile cni-calico @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/net/ipv{4,6}/ip_forward rw, @{PROC}/sys/net/ipv{4,6}/{conf,neigh}/cali[0-9a-z]*/* rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-firewall b/apparmor.d/groups/virt/cni-firewall index 866b9dc96..028f5bd6f 100644 --- a/apparmor.d/groups/virt/cni-firewall +++ b/apparmor.d/groups/virt/cni-firewall @@ -12,8 +12,6 @@ profile cni-firewall @{exec_path} { @{exec_path} mr, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-flannel b/apparmor.d/groups/virt/cni-flannel index 05929a64c..ac473fbcb 100644 --- a/apparmor.d/groups/virt/cni-flannel +++ b/apparmor.d/groups/virt/cni-flannel @@ -12,8 +12,6 @@ profile cni-flannel @{exec_path} flags=(complain,attach_disconnected){ @{exec_path} mr, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-host-local b/apparmor.d/groups/virt/cni-host-local index bf555cfd8..50b8f315b 100644 --- a/apparmor.d/groups/virt/cni-host-local +++ b/apparmor.d/groups/virt/cni-host-local @@ -12,8 +12,6 @@ profile cni-host-local @{exec_path} flags=(complain,attach_disconnected){ @{exec_path} mr, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-loopback b/apparmor.d/groups/virt/cni-loopback index d05a303de..a7d24e306 100644 --- a/apparmor.d/groups/virt/cni-loopback +++ b/apparmor.d/groups/virt/cni-loopback @@ -22,8 +22,6 @@ profile cni-loopback @{exec_path} flags=(attach_disconnected) { @{run}/netns/ r, @{run}/netns/cni-@{uuid} rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-portmap b/apparmor.d/groups/virt/cni-portmap index db29f252c..bc4a00fa2 100644 --- a/apparmor.d/groups/virt/cni-portmap +++ b/apparmor.d/groups/virt/cni-portmap @@ -19,8 +19,6 @@ profile cni-portmap @{exec_path} { @{PROC}/sys/net/ipv{4,6}/conf/cali[0-9a-z]*/route_localnet rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-tuning b/apparmor.d/groups/virt/cni-tuning index ee7133b31..c0e3a3fd2 100644 --- a/apparmor.d/groups/virt/cni-tuning +++ b/apparmor.d/groups/virt/cni-tuning @@ -12,8 +12,6 @@ profile cni-tuning @{exec_path} { @{exec_path} mr, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/groups/virt/containerd b/apparmor.d/groups/virt/containerd index f85a3571c..9ae6596ee 100644 --- a/apparmor.d/groups/virt/containerd +++ b/apparmor.d/groups/virt/containerd @@ -92,7 +92,6 @@ profile containerd @{exec_path} flags=(attach_disconnected) { owner /var/tmp/** rwkl, @{sys}/fs/cgroup/kubepods/** r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/security/apparmor/profiles r, @{sys}/module/apparmor/parameters/enabled r, diff --git a/apparmor.d/groups/virt/containerd-shim-runc-v2 b/apparmor.d/groups/virt/containerd-shim-runc-v2 index c705c0cc8..428473f5d 100644 --- a/apparmor.d/groups/virt/containerd-shim-runc-v2 +++ b/apparmor.d/groups/virt/containerd-shim-runc-v2 @@ -49,7 +49,6 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/{,**} rw, @{sys}/fs/cgroup/kubepods/{,**} rw, @{sys}/kernel/mm/hugepages/ r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/mountinfo r, diff --git a/apparmor.d/groups/virt/docker-proxy b/apparmor.d/groups/virt/docker-proxy index d549168ee..4bb1d9497 100644 --- a/apparmor.d/groups/virt/docker-proxy +++ b/apparmor.d/groups/virt/docker-proxy @@ -20,8 +20,6 @@ profile docker-proxy @{exec_path} { @{exec_path} mr, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/sys/net/core/somaxconn r, include if exists diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index f552c5289..64bba083d 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -75,7 +75,6 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/cpuset.cpus.effective r, @{sys}/fs/cgroup/cpuset.mems.effective r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/security/apparmor/profiles r, @{sys}/module/apparmor/parameters/enabled r, diff --git a/apparmor.d/groups/virt/k3s b/apparmor.d/groups/virt/k3s index 5905d4895..e1cded61d 100644 --- a/apparmor.d/groups/virt/k3s +++ b/apparmor.d/groups/virt/k3s @@ -163,7 +163,6 @@ profile k3s @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/{,**/} r, @{sys}/kernel/mm/hugepages/ r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/mm/hugepages/hugepages-*/nr_hugepages r, @{sys}/kernel/security/apparmor/profiles r, diff --git a/apparmor.d/profiles-a-f/aa-log b/apparmor.d/profiles-a-f/aa-log index 6d1f690f6..74fbebcb1 100644 --- a/apparmor.d/profiles-a-f/aa-log +++ b/apparmor.d/profiles-a-f/aa-log @@ -27,8 +27,6 @@ profile aa-log @{exec_path} { /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/{,*} r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/sys/kernel/cap_last_cap r, /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-a-f/arduino-builder b/apparmor.d/profiles-a-f/arduino-builder index 23f8628e5..d35004e35 100644 --- a/apparmor.d/profiles-a-f/arduino-builder +++ b/apparmor.d/profiles-a-f/arduino-builder @@ -39,8 +39,6 @@ profile arduino-builder @{exec_path} { owner @{HOME}/Arduino/{,**} r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - /tmp/ r, owner @{tmp}/cc* rw, owner @{tmp}/untitled[0-9]*.tmp/{,**} rw, diff --git a/apparmor.d/profiles-a-f/browserpass b/apparmor.d/profiles-a-f/browserpass index cfc5d3b0b..f35e0c640 100644 --- a/apparmor.d/profiles-a-f/browserpass +++ b/apparmor.d/profiles-a-f/browserpass @@ -25,8 +25,6 @@ profile browserpass @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/mozilla/firefox/@{rand8}.*/safebrowsing-updating/google[0-9]/goog-phish-proto-@{int}.vlpset rw, owner @{tmp}/mozilla-temp-@{int} r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - owner @{PROC}/@{pid}/mountinfo r, # Inherit Silencer diff --git a/apparmor.d/profiles-a-f/dnscrypt-proxy b/apparmor.d/profiles-a-f/dnscrypt-proxy index 03d47e395..6727b8201 100644 --- a/apparmor.d/profiles-a-f/dnscrypt-proxy +++ b/apparmor.d/profiles-a-f/dnscrypt-proxy @@ -52,8 +52,6 @@ profile dnscrypt-proxy @{exec_path} { @{PROC}/sys/kernel/hostname r, @{PROC}/sys/net/core/somaxconn r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/profiles-g-l/hugo b/apparmor.d/profiles-g-l/hugo index fcb585020..9cf73dc49 100644 --- a/apparmor.d/profiles-g-l/hugo +++ b/apparmor.d/profiles-g-l/hugo @@ -40,8 +40,6 @@ profile hugo @{exec_path} { owner @{tmp}/hugo_cache/{,**} rwkl, owner @{tmp}/go-codehost-@{int} rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/sys/net/core/somaxconn r, include if exists diff --git a/apparmor.d/profiles-s-z/sbctl b/apparmor.d/profiles-s-z/sbctl index 938ecb638..57d8fb5e6 100644 --- a/apparmor.d/profiles-s-z/sbctl +++ b/apparmor.d/profiles-s-z/sbctl @@ -30,8 +30,6 @@ profile sbctl @{exec_path} { @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, @{sys}/firmware/efi/efivars/SetupMode-@{uuid} r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - /dev/pts/@{int} rw, # File Inherit diff --git a/apparmor.d/profiles-s-z/sing-box b/apparmor.d/profiles-s-z/sing-box index eb9866b53..221da9617 100644 --- a/apparmor.d/profiles-s-z/sing-box +++ b/apparmor.d/profiles-s-z/sing-box @@ -31,8 +31,6 @@ profile sing-box @{exec_path} { owner @{user_share_dirs}/certmagic/** rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - include if exists } diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/profiles-s-z/snap index f59fd9226..158744d0c 100644 --- a/apparmor.d/profiles-s-z/snap +++ b/apparmor.d/profiles-s-z/snap @@ -70,7 +70,6 @@ profile snap @{exec_path} { @{run}/mount/utab r, @{run}/snapd.socket rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/security/apparmor/features/{,**} r, @{PROC}/@{pids}/cgroup r, diff --git a/apparmor.d/profiles-s-z/snap-failure b/apparmor.d/profiles-s-z/snap-failure index df8fe47fb..61372b169 100644 --- a/apparmor.d/profiles-s-z/snap-failure +++ b/apparmor.d/profiles-s-z/snap-failure @@ -19,8 +19,6 @@ profile snap-failure @{exec_path} { /var/lib/snapd/sequence/snapd.json r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/cmdline r, profile systemctl { diff --git a/apparmor.d/profiles-s-z/snap-seccomp b/apparmor.d/profiles-s-z/snap-seccomp index 0da410bca..4c34746ed 100644 --- a/apparmor.d/profiles-s-z/snap-seccomp +++ b/apparmor.d/profiles-s-z/snap-seccomp @@ -20,8 +20,6 @@ profile snap-seccomp @{exec_path} { /var/lib/snapd/seccomp/bpf/{,**} rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - owner @{PROC}/@{pids}/mountinfo r, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/profiles-s-z/snap-update-ns b/apparmor.d/profiles-s-z/snap-update-ns index e9315f5c7..2092ab1c9 100644 --- a/apparmor.d/profiles-s-z/snap-update-ns +++ b/apparmor.d/profiles-s-z/snap-update-ns @@ -47,7 +47,6 @@ profile snap-update-ns @{exec_path} { @{sys}/fs/cgroup/{,**/} r, @{sys}/fs/cgroup/system.slice/snap.*.service/cgroup.freeze rw, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.freeze rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{PROC}/@{pids}/cgroup r, @{PROC}/cmdline r, diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index fa5ef1956..672ae2f7b 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -153,7 +153,6 @@ profile snapd @{exec_path} { @{sys}/fs/cgroup/user.slice/ r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r, @{sys}/kernel/kexec_loaded r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/security/apparmor/features/{,**} r, @{sys}/kernel/security/apparmor/profiles r, diff --git a/apparmor.d/profiles-s-z/snapd-aa-prompt-listener b/apparmor.d/profiles-s-z/snapd-aa-prompt-listener index 3e3045b80..6cc8801aa 100644 --- a/apparmor.d/profiles-s-z/snapd-aa-prompt-listener +++ b/apparmor.d/profiles-s-z/snapd-aa-prompt-listener @@ -16,8 +16,6 @@ profile snapd-aa-prompt-listener @{exec_path} { @{lib_dirs}/snapd/info r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/cmdline r, include if exists diff --git a/apparmor.d/profiles-s-z/snapd-apparmor b/apparmor.d/profiles-s-z/snapd-apparmor index 22a9c5faa..edd266c20 100644 --- a/apparmor.d/profiles-s-z/snapd-apparmor +++ b/apparmor.d/profiles-s-z/snapd-apparmor @@ -22,8 +22,6 @@ profile snapd-apparmor @{exec_path} { /var/lib/snapd/apparmor/profiles/ r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/cmdline r, include if exists diff --git a/apparmor.d/profiles-s-z/syncthing b/apparmor.d/profiles-s-z/syncthing index 50b04668b..b65a56145 100644 --- a/apparmor.d/profiles-s-z/syncthing +++ b/apparmor.d/profiles-s-z/syncthing @@ -36,8 +36,6 @@ profile syncthing @{exec_path} { /home/ r, @{user_sync_dirs}/{,**} rw, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - @{PROC}/@{pids}/net/route r, @{PROC}/sys/net/core/somaxconn r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-s-z/zsysd b/apparmor.d/profiles-s-z/zsysd index c325e216d..eabe2d62c 100644 --- a/apparmor.d/profiles-s-z/zsysd +++ b/apparmor.d/profiles-s-z/zsysd @@ -37,8 +37,6 @@ profile zsysd @{exec_path} flags=(complain) { @{PROC}/cmdline r, @{PROC}/sys/kernel/spl/hostid r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - /dev/pts/@{int} rw, /dev/zfs rw, From 54e013824e0599aea01fcdc57f5778931e4bc458 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 8 Sep 2024 12:38:54 +0100 Subject: [PATCH 0130/1455] feat(profile): update libreoffice. see #470 --- apparmor.d/profiles-g-l/libreoffice | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 2a7295f49..4b9812c55 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -15,6 +15,8 @@ profile libreoffice @{exec_path} { include include include + include + include include include include @@ -41,14 +43,14 @@ profile libreoffice @{exec_path} { @{open_path} rPx -> child-open-browsers, - @{bin}/gpgconf rPx, - @{bin}/gpgsm rPx, - @{bin}/gpg rPx, + @{bin}/gpg rPx, + @{bin}/gpgconf rPx, + @{bin}/gpgsm rPx, @{lib}/libreoffice/program/javaldx rix, @{lib}/libreoffice/program/oosplash rix, @{lib}/libreoffice/program/soffice.bin rix, - @{lib}/jvm/java*/bin/java rix, + @{lib}/jvm/java*/bin/java rix, @{lib}/jvm/java*/lib/** rm, @{lib}/libreoffice/{,**} rm, @@ -70,6 +72,10 @@ profile libreoffice @{exec_path} { owner @{user_config_dirs}/libreoffice/ rw, owner @{user_config_dirs}/libreoffice/** rwk, + owner @{user_config_dirs}/kcminputrc r, + owner @{user_config_dirs}/kdedefaults/kcminputrc r, + + owner @{tmp}/ r, owner @{tmp}/@{rand6} rwk, owner @{tmp}/*.tmp/{,**} rwk, owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} w, From 4f310b88024e009e2f7dd719840c28661e202f63 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 8 Sep 2024 12:41:49 +0100 Subject: [PATCH 0131/1455] feat(profile): update dolphin. fix #470 --- apparmor.d/groups/kde/dolphin | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 89e5685d9..b76cff2a0 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -82,6 +82,8 @@ profile dolphin @{exec_path} { owner @{user_cache_dirs}/ksplash/qmlcache/*.qmlc rwl -> @{user_cache_dirs}/dolphin/qmlcache/#@{int}, owner @{user_cache_dirs}/ksplash/qmlcache/*.qmlc.@{rand6} rwl -> @{user_cache_dirs}/dolphin/qmlcache/#@{int}, + owner @{user_state_dirs}/dolphinstaterc{,.*} rwlk -> @{user_state_dirs}/#@{int}, + @{run}/mount/utab r, owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, owner @{run}/user/@{uid}/#@{int} rw, From 2af1d06f183302037a10f62641b90ee644a65eaf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 8 Sep 2024 13:25:49 +0100 Subject: [PATCH 0132/1455] feat(tunable): add @{editor_path} & @{pager_path}. --- apparmor.d/groups/_full/default | 4 +--- apparmor.d/groups/apt/apt | 8 +++----- apparmor.d/groups/apt/apt-listchanges | 6 +++--- apparmor.d/groups/apt/aptitude | 11 +++++------ apparmor.d/groups/apt/dpkg | 5 +---- apparmor.d/groups/apt/dpkg-query | 4 +--- apparmor.d/groups/apt/reportbug | 4 +--- apparmor.d/groups/cron/crontab | 6 +----- apparmor.d/groups/network/nmcli | 4 +--- apparmor.d/groups/pacman/pacman | 5 +---- apparmor.d/groups/systemd/bootctl | 4 +--- apparmor.d/groups/systemd/busctl | 4 +--- apparmor.d/groups/systemd/coredumpctl | 4 +--- apparmor.d/groups/systemd/journalctl | 4 +--- apparmor.d/groups/systemd/localectl | 4 +--- apparmor.d/groups/systemd/loginctl | 4 +--- apparmor.d/groups/systemd/networkctl | 4 +--- apparmor.d/groups/systemd/systemd-analyze | 4 +--- apparmor.d/groups/systemd/systemd-cgls | 4 +--- apparmor.d/groups/systemd/systemd-cgtop | 4 +--- apparmor.d/groups/systemd/systemd-dissect | 4 +--- apparmor.d/groups/systemd/systemd-mount | 4 +--- apparmor.d/groups/systemd/systemd-udevd | 4 +--- apparmor.d/groups/systemd/userdbctl | 4 +--- apparmor.d/profiles-a-f/dmesg | 4 +--- apparmor.d/profiles-g-l/git | 10 +++------- apparmor.d/profiles-g-l/gpo | 4 +--- apparmor.d/profiles-m-r/mutt | 13 +++---------- apparmor.d/profiles-m-r/pass | 7 ++----- apparmor.d/profiles-s-z/task | 5 +---- apparmor.d/profiles-s-z/udisksctl | 4 +--- apparmor.d/profiles-s-z/vipw-vigr | 4 +--- apparmor.d/tunables/multiarch.d/paths | 10 ++++++++-- apparmor.d/tunables/multiarch.d/programs | 9 +++++++++ docs/install.md | 4 +--- 35 files changed, 63 insertions(+), 124 deletions(-) diff --git a/apparmor.d/groups/_full/default b/apparmor.d/groups/_full/default index 733d227cb..b6689cb1d 100644 --- a/apparmor.d/groups/_full/default +++ b/apparmor.d/groups/_full/default @@ -45,9 +45,7 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{coreutils_path} rix, @{shells_path} rix, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, # @{open_path} rPx -> child-open, diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 38bd8f3eb..9907ae02f 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -99,11 +99,10 @@ profile apt @{exec_path} flags=(attach_disconnected) { /usr/share/language-tools/language-options rPx, # For editing the sources.list file - @{bin}/sensible-editor rCx -> editor, - @{bin}/vim.* rCx -> editor, + @{editor_path} rCx -> editor, # For changelogs - @{bin}/sensible-pager rCx -> pager, + @{pager_path} rCx -> pager, #aa:only whonix @{lib}/uwt/uwtwrapper rix, @@ -168,8 +167,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{bin}/ r, @{sh_path} rix, - @{bin}/less rix, - @{bin}/sensible-pager mr, + @{pager_path} rmix, @{bin}/which{,.debianutils} rix, /root/ r, # For shell pwd diff --git a/apparmor.d/groups/apt/apt-listchanges b/apparmor.d/groups/apt/apt-listchanges index 8613f2280..fbabcd983 100644 --- a/apparmor.d/groups/apt/apt-listchanges +++ b/apparmor.d/groups/apt/apt-listchanges @@ -28,7 +28,7 @@ profile apt-listchanges @{exec_path} { # shared object file): ignored. @{bin}/dpkg-deb rpx, # - @{bin}/sensible-pager rCx -> pager, + @{pager_path} rCx -> pager, # Send results using email @{bin}/exim4 rPx, @@ -83,12 +83,11 @@ profile apt-listchanges @{exec_path} { capability dac_read_search, #capability sys_tty_config, - @{bin}/sensible-pager mr, + @{pager_path} mrix, @{bin}/ r, @{sh_path} rix, @{bin}/which{,.debianutils} rix, - @{bin}/less rix, owner @{HOME}/.less* rw, @@ -98,6 +97,7 @@ profile apt-listchanges @{exec_path} { /tmp/ r, owner @{tmp}/apt-listchanges-tmp*.txt r, + include if exists } include if exists diff --git a/apparmor.d/groups/apt/aptitude b/apparmor.d/groups/apt/aptitude index 12bd0efb1..7b36e4abe 100644 --- a/apparmor.d/groups/apt/aptitude +++ b/apparmor.d/groups/apt/aptitude @@ -105,7 +105,7 @@ profile aptitude @{exec_path} flags=(complain) { owner @{user_cache_dirs}/aptitude/ rw, owner @{user_cache_dirs}/aptitude/metadata-download{,-journal} rw, owner @{user_cache_dirs}/aptitude/metadata-download rwk, - @{bin}/sensible-pager rCx -> pager, + @{pager_path} rCx -> pager, # For aptitude-run-state-bundle owner @{tmp}/aptitudebug.*/ r, @@ -171,20 +171,19 @@ profile aptitude @{exec_path} flags=(complain) { include include - @{bin}/ r, - @{bin}/sensible-pager mr, - @{sh_path} rix, + @{bin}/ r, + @{editor_path} mrix, + @{sh_path} rix, @{bin}/which{,.debianutils} rix, - @{bin}/less rix, owner @{HOME}/.less* rw, - owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw, # For shell pwd /root/ r, + include if exists } include if exists diff --git a/apparmor.d/groups/apt/dpkg b/apparmor.d/groups/apt/dpkg index b8e577833..c22ba0ae5 100644 --- a/apparmor.d/groups/apt/dpkg +++ b/apparmor.d/groups/apt/dpkg @@ -34,10 +34,7 @@ profile dpkg @{exec_path} { @{lib}/needrestart/dpkg-status rPx, /usr/share/debian-security-support/check-support-status.hook rPx, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/diff rPx -> child-pager, + @{pager_path} rPx -> child-pager, # Package maintainer's scripts # Move it to a child profile once more transitions will be available diff --git a/apparmor.d/groups/apt/dpkg-query b/apparmor.d/groups/apt/dpkg-query index f8150cc37..9a5512c2c 100644 --- a/apparmor.d/groups/apt/dpkg-query +++ b/apparmor.d/groups/apt/dpkg-query @@ -16,9 +16,7 @@ profile dpkg-query @{exec_path} { @{sh_path} rix, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, + @{pager_path} rPx -> child-pager, /var/lib/dpkg/** r, diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index e7b8e1d29..1571298af 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -47,10 +47,8 @@ profile reportbug @{exec_path} { @{bin}/dlocate rPx, @{bin}/dpkg rPx -> child-dpkg, @{bin}/dpkg-query rpx, - @{bin}/less rPx -> child-pager, @{bin}/lsb_release rPx -> lsb_release, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, @{bin}/systemctl rCx -> systemctl, @{lib}/firefox/firefox rPUx, # App allowed to open /usr/share/bug/* rPUx, diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index c5aaf5546..2743173f8 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -22,11 +22,7 @@ profile crontab @{exec_path} { @{exec_path} mr, @{sh_path} rix, - - # When editing the crontab file - @{bin}/sensible-editor rCx -> editor, - @{bin}/vim.* rCx -> editor, - @{bin}/nvim rCx -> editor, + @{editor_path} rCx -> editor, /etc/cron.{allow,deny} r, /etc/environment r, diff --git a/apparmor.d/groups/network/nmcli b/apparmor.d/groups/network/nmcli index 2345d9d2c..6c9a13203 100644 --- a/apparmor.d/groups/network/nmcli +++ b/apparmor.d/groups/network/nmcli @@ -15,9 +15,7 @@ profile nmcli @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, owner @{HOME}/.nm-vpngate/*.ovpn r, owner @{HOME}/.cert/nm-openvpn/*.pem rw, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index ab08d1f18..6ab0802ba 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -196,10 +196,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { signal send set=cont peer=child-pager, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/diff rPx -> child-pager, + @{pager_path} rPx -> child-pager, /etc/machine-id r, diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index 2bd8c4c78..4a5d4d832 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -22,9 +22,7 @@ profile bootctl @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, /{boot,efi}/ r, /{boot,efi}/EFI/{,**} r, diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index baf89561d..64396608f 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -37,9 +37,7 @@ profile busctl @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/comm r, diff --git a/apparmor.d/groups/systemd/coredumpctl b/apparmor.d/groups/systemd/coredumpctl index 7c4149bee..b291c0493 100644 --- a/apparmor.d/groups/systemd/coredumpctl +++ b/apparmor.d/groups/systemd/coredumpctl @@ -22,9 +22,7 @@ profile coredumpctl @{exec_path} flags=(complain) { @{bin}/gdb rCx -> gdb, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, /var/lib/dbus/machine-id r, /etc/machine-id r, diff --git a/apparmor.d/groups/systemd/journalctl b/apparmor.d/groups/systemd/journalctl index 4b5f11810..79af65679 100644 --- a/apparmor.d/groups/systemd/journalctl +++ b/apparmor.d/groups/systemd/journalctl @@ -25,9 +25,7 @@ profile journalctl @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, /var/lib/dbus/machine-id r, /etc/machine-id r, diff --git a/apparmor.d/groups/systemd/localectl b/apparmor.d/groups/systemd/localectl index 46f67b325..3ab09cfca 100644 --- a/apparmor.d/groups/systemd/localectl +++ b/apparmor.d/groups/systemd/localectl @@ -15,9 +15,7 @@ profile localectl @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, /usr/share/kbd/keymaps/{,**} r, diff --git a/apparmor.d/groups/systemd/loginctl b/apparmor.d/groups/systemd/loginctl index 345957e3f..b5228f222 100644 --- a/apparmor.d/groups/systemd/loginctl +++ b/apparmor.d/groups/systemd/loginctl @@ -19,9 +19,7 @@ profile loginctl @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, include if exists } diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index 4c841e97d..ae188df5f 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -35,9 +35,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, /etc/udev/hwdb.bin r, /var/lib/dbus/machine-id r, diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze index deb22cbc1..0c3b38d64 100644 --- a/apparmor.d/groups/systemd/systemd-analyze +++ b/apparmor.d/groups/systemd/systemd-analyze @@ -28,9 +28,7 @@ profile systemd-analyze @{exec_path} { @{lib}/systemd/system-environment-generators/* rix, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, + @{pager_path} rPx -> child-pager, @{bin}/man rPx, /usr/ r, diff --git a/apparmor.d/groups/systemd/systemd-cgls b/apparmor.d/groups/systemd/systemd-cgls index ed7254339..e58fec015 100644 --- a/apparmor.d/groups/systemd/systemd-cgls +++ b/apparmor.d/groups/systemd/systemd-cgls @@ -14,9 +14,7 @@ profile systemd-cgls @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, @{sys}/fs/cgroup/{,**} r, diff --git a/apparmor.d/groups/systemd/systemd-cgtop b/apparmor.d/groups/systemd/systemd-cgtop index 9ae69cd69..cd0f1e416 100644 --- a/apparmor.d/groups/systemd/systemd-cgtop +++ b/apparmor.d/groups/systemd/systemd-cgtop @@ -14,9 +14,7 @@ profile systemd-cgtop @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, @{sys}/fs/cgroup/{,**} r, diff --git a/apparmor.d/groups/systemd/systemd-dissect b/apparmor.d/groups/systemd/systemd-dissect index 991a787d2..cd3ba97ca 100644 --- a/apparmor.d/groups/systemd/systemd-dissect +++ b/apparmor.d/groups/systemd/systemd-dissect @@ -25,9 +25,7 @@ profile systemd-dissect @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/fsck rPx, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, # Location of file system OS images @{user_build_dirs}/{,**} r, diff --git a/apparmor.d/groups/systemd/systemd-mount b/apparmor.d/groups/systemd/systemd-mount index 4db3dcacf..a86bf152d 100644 --- a/apparmor.d/groups/systemd/systemd-mount +++ b/apparmor.d/groups/systemd/systemd-mount @@ -13,9 +13,7 @@ profile systemd-mount @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, @{sys}/bus/ r, @{sys}/class/ r, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index fa096a35d..5c1709201 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -37,6 +37,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{sh_path} rix, @{coreutils_path} rix, + @{pager_path} rPx -> child-pager, @{bin}/*-print-pci-ids rix, @{bin}/alsactl rPUx, @{bin}/ddcutil rPx, @@ -44,16 +45,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{bin}/ethtool rix, @{bin}/issue-generator rPx, @{bin}/kmod rPx, - @{bin}/less rPx -> child-pager, @{bin}/logger rix, @{bin}/ls rix, @{bin}/lvm rPx, @{bin}/mknod rix, - @{bin}/more rPx -> child-pager, @{bin}/multipath rPx, @{bin}/nfsrahead rix, @{bin}/nvidia-modprobe rPx -> child-modprobe-nvidia, - @{bin}/pager rPx -> child-pager, @{bin}/perl rix, @{bin}/setfacl rix, @{bin}/sg_inq rix, diff --git a/apparmor.d/groups/systemd/userdbctl b/apparmor.d/groups/systemd/userdbctl index 159d1442a..279560e99 100644 --- a/apparmor.d/groups/systemd/userdbctl +++ b/apparmor.d/groups/systemd/userdbctl @@ -16,9 +16,7 @@ profile userdbctl @{exec_path} { @{exec_path} mr, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, /etc/shadow r, /etc/gshadow r, diff --git a/apparmor.d/profiles-a-f/dmesg b/apparmor.d/profiles-a-f/dmesg index 819cd234e..f2d0c7665 100644 --- a/apparmor.d/profiles-a-f/dmesg +++ b/apparmor.d/profiles-a-f/dmesg @@ -18,9 +18,7 @@ profile dmesg @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - @{bin}/pager rPx -> child-pager, + @{pager_path} rPx -> child-pager, /usr/share/terminfo/** r, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 47450b8e6..8a2ffb797 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -62,9 +62,7 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/wc rix, @{bin}/whoami rix, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, + @{pager_path} rPx -> child-pager, @{bin}/man rPx, @{bin}/meld rPUx, @@ -74,10 +72,8 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/gpg{,2} rCx -> gpg, @{bin}/ssh rCx -> ssh, - @{bin}/sensible-editor rCx -> editor, - @{bin}/vim rCx -> editor, - @{bin}/vim.* rCx -> editor, - + @{editor_path} rCx -> editor, + /usr/share/git{,-core}/{,**} r, /usr/share/libalternatives/{,**} r, /usr/share/terminfo/** r, diff --git a/apparmor.d/profiles-g-l/gpo b/apparmor.d/profiles-g-l/gpo index 97c89a433..411d078bd 100644 --- a/apparmor.d/profiles-g-l/gpo +++ b/apparmor.d/profiles-g-l/gpo @@ -27,9 +27,7 @@ profile gpo @{exec_path} { @{bin}/ r, @{sh_path} rix, @{bin}/uname rix, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, + @{pager_path} rPx -> child-pager, /etc/inputrc r, diff --git a/apparmor.d/profiles-m-r/mutt b/apparmor.d/profiles-m-r/mutt index 1ed63e68e..9d01e2269 100644 --- a/apparmor.d/profiles-m-r/mutt +++ b/apparmor.d/profiles-m-r/mutt @@ -37,13 +37,8 @@ profile mutt @{exec_path} { @{bin}/w3m rCx -> html-renderer, @{bin}/lynx rCx -> html-renderer, - @{bin}/vim rCx -> editor, - @{bin}/vim.* rCx -> editor, - @{bin}/sensible-editor rCx -> editor, - - @{bin}/less rCx -> pager, - @{bin}/more rCx -> pager, - @{bin}/pager rCx -> pager, + @{editor_path} rCx -> editor, + @{pager_path} rCx -> pager, @{bin}/gpg{2,} rCx -> gpg, @{bin}/gpgconf rCx -> gpg, @@ -118,9 +113,7 @@ profile mutt @{exec_path} { include include - @{bin}/less mr, - @{bin}/more mr, - @{bin}/pager mr, + @{pager_path} mr, /usr/share/terminfo/** r, /usr/share/file/misc/magic.mgc r, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 5bd851921..3796dfbc4 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -46,7 +46,7 @@ profile pass @{exec_path} { @{bin}/gpg{2,} rCx -> gpg, @{bin}/pkill rCx -> pkill, @{bin}/qdbus rCx -> qdbus, - @{bin}/vim{,.*} rCx -> editor, + @{editor_path} rCx -> editor, @{lib}/git{,-core}/git rCx -> git, @{bin}/wl-{copy,paste} rPx, @{bin}/xclip rPx, @@ -112,10 +112,7 @@ profile pass @{exec_path} { @{bin}/git* mrix, @{lib}/git{,-core}/git* mrix, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, - + @{pager_path} rPx -> child-pager, @{bin}/gpg{2,} rPx -> pass//gpg, /usr/share/git{,-core}/{,**} r, diff --git a/apparmor.d/profiles-s-z/task b/apparmor.d/profiles-s-z/task index bd7f276a8..87b9be2df 100644 --- a/apparmor.d/profiles-s-z/task +++ b/apparmor.d/profiles-s-z/task @@ -23,10 +23,7 @@ profile task @{exec_path} { @{exec_path} mr, @{sh_path} rix, - - @{bin}/vim rCx -> editor, - @{bin}/vim.* rCx -> editor, - @{bin}/sensible-editor rCx -> editor, + @{editor_path} rCx -> editor, /usr/share/{doc/,}task{warrior,}/** r, diff --git a/apparmor.d/profiles-s-z/udisksctl b/apparmor.d/profiles-s-z/udisksctl index a05cede9c..63e8b7c79 100644 --- a/apparmor.d/profiles-s-z/udisksctl +++ b/apparmor.d/profiles-s-z/udisksctl @@ -15,9 +15,7 @@ profile udisksctl @{exec_path} { @{sh_path} rix, - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, + @{pager_path} rPx -> child-pager, /dev/tty rw, diff --git a/apparmor.d/profiles-s-z/vipw-vigr b/apparmor.d/profiles-s-z/vipw-vigr index 835267c2d..5b42ab828 100644 --- a/apparmor.d/profiles-s-z/vipw-vigr +++ b/apparmor.d/profiles-s-z/vipw-vigr @@ -16,9 +16,7 @@ profile vipw-vigr @{exec_path} { @{exec_path} mr, @{sh_path} rix, - - @{bin}/sensible-editor rCx -> editor, - @{bin}/vim.* rCx -> editor, + @{editor_path} rCx -> editor, /etc/login.defs r, diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 35bf0c58f..83aec3ce3 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -34,10 +34,16 @@ @{emails_path} = @{thunderbird_path} @{bin}/@{emails_names} # Open -@{open_path} = @{bin}/exo-open @{bin}/xdg-open @{bin}/gio @{bin}/kde-open -@{open_path} += @{bin}/gio-launch-desktop @{lib}/gio-launch-desktop +@{open_path} = @{bin}/@{open_names} +@{open_path} += @{lib}/gio-launch-desktop @{open_path} += @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop +# Editor +@{editor_path} = @{bin}/@{editor_names} + +# Pager +@{pager_path} = @{bin}/@{pager_names} + # File explorers @{file_explorers_path} = @{bin}/@{file_explorers_names} diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 9c0c4d305..8dd2f237c 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -28,6 +28,15 @@ # Python interpreters @{python_name} = python{,3,3.[0-9],3.1[0-9]} +# Open +@{open_names} = exo-open xdg-open gio kde-open gio-launch-desktop + +# Editor +@{editor_names} = sensible-editor vim{,.*} nvim nano + +# Pager +@{pager_names} = sensible-pager pager less more + # Browsers @{brave_name} = brave{,-beta,-dev,-bin} diff --git a/docs/install.md b/docs/install.md index 5afac9c77..5d84331ce 100644 --- a/docs/install.md +++ b/docs/install.md @@ -148,9 +148,7 @@ The following desktop environments are supported: @{bin}/wl-{copy,paste} rPx, @{bin}/xclip rPx, @{bin}/python3.@{int} rPx -> pass-import, # pass-import - @{bin}/pager rPx -> child-pager, - @{bin}/less rPx -> child-pager, - @{bin}/more rPx -> child-pager, + @{pager_path} rPx -> child-pager, '.build/apparmor.d/pass' -> '/etc/apparmor.d/pass' ``` So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired. From d4e380ad46a7cb3c5f9b7d935bcd94b093124530 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 19:40:42 +0100 Subject: [PATCH 0133/1455] feat(profile): update & enable profiles in the apps group. see #471 --- .../{groups/apps => profiles-a-f}/calibre | 58 ++++++++++--------- .../{groups/apps => profiles-a-f}/discord | 14 +++-- .../discord-chrome-sandbox | 0 .../{groups/apps => profiles-a-f}/dropbox | 5 +- .../{groups/apps => profiles-a-f}/filezilla | 26 ++++++--- .../{groups/apps => profiles-a-f}/freetube | 6 +- .../freetube-chrome-sandbox | 0 .../apps => profiles-s-z}/signal-desktop | 29 ++++++---- .../signal-desktop-chrome-sandbox | 4 +- .../apps => profiles-s-z}/telegram-desktop | 26 +++++---- dists/flags/main.flags | 12 ++++ dists/ignore/main.ignore | 5 -- 12 files changed, 115 insertions(+), 70 deletions(-) rename apparmor.d/{groups/apps => profiles-a-f}/calibre (67%) rename apparmor.d/{groups/apps => profiles-a-f}/discord (73%) rename apparmor.d/{groups/apps => profiles-a-f}/discord-chrome-sandbox (100%) rename apparmor.d/{groups/apps => profiles-a-f}/dropbox (91%) rename apparmor.d/{groups/apps => profiles-a-f}/filezilla (75%) rename apparmor.d/{groups/apps => profiles-a-f}/freetube (80%) rename apparmor.d/{groups/apps => profiles-a-f}/freetube-chrome-sandbox (100%) rename apparmor.d/{groups/apps => profiles-s-z}/signal-desktop (50%) rename apparmor.d/{groups/apps => profiles-s-z}/signal-desktop-chrome-sandbox (85%) rename apparmor.d/{groups/apps => profiles-s-z}/telegram-desktop (66%) diff --git a/apparmor.d/groups/apps/calibre b/apparmor.d/profiles-a-f/calibre similarity index 67% rename from apparmor.d/groups/apps/calibre rename to apparmor.d/profiles-a-f/calibre index f1b3e9050..d58a8d042 100644 --- a/apparmor.d/groups/apps/calibre +++ b/apparmor.d/profiles-a-f/calibre @@ -7,23 +7,22 @@ abi , include -@{exec_path} = @{bin}/calibre{,-parallel,-debug,-server,-smtp,-complete,-customize} -@{exec_path} += @{bin}/calibredb -@{exec_path} += @{bin}/ebook{-viewer,-edit,-device,-meta,-polish,-convert} +@{exec_path} = @{bin}/calibre{,-*} @{bin}/calibredb @{bin}/ebook{,-*} @{exec_path} += @{bin}/fetch-ebook-metadata -@{exec_path} += @{bin}/lrs2lrf @{bin}/lrf2lrs @{bin}/lrfviewer -@{exec_path} += @{bin}/web2disk +@{exec_path} += @{bin}/lrs2lrf @{bin}/lrf2lrs @{bin}/lrfviewer @{bin}/web2disk profile calibre @{exec_path} { include include include include include - include + include + include include include include include + include include include include @@ -45,20 +44,19 @@ profile calibre @{exec_path} { unix (bind) type=stream addr="@calibre-*", @{exec_path} mrix, - @{bin}/python3.@{int} r, - @{bin}/ldconfig{,.real} rix, @{sh_path} rix, + @{python_path} rix, @{bin}/file rix, + @{bin}/ldconfig{,.real} rix, @{bin}/uname rix, - @{lib}/@{multiarch}/qt5/libexec/QtWebEngineProcess rix, + @{lib}/{,@{multiarch}/}qt{5,6}{,/libexec/}QtWebEngineProcess rix, @{bin}/pdftoppm rPUx, # (#FIXME#) @{bin}/pdfinfo rPUx, @{bin}/pdftohtml rPUx, - @{bin}/xdg-open rPx -> child-open, - @{bin}/xdg-mime rPx, + @{open_path} rPx -> child-open, /usr/share/calibre/{,**} r, @@ -79,16 +77,11 @@ profile calibre @{exec_path} { owner @{user_config_dirs}/calibre/** rwk, owner @{user_share_dirs}/calibre-ebook.com/ rw, - owner @{user_share_dirs}/calibre-ebook.com/calibre/ rw, - owner @{user_share_dirs}/calibre-ebook.com/calibre/** rwk, + owner @{user_share_dirs}/calibre-ebook.com/** rwk, - owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/calibre/ rw, owner @{user_cache_dirs}/calibre/** rwkl -> @{user_cache_dirs}/calibre/**, - owner @{user_cache_dirs}/gstreamer-@{int}/ rw, - owner @{user_cache_dirs}/gstreamer-@{int}/registry.*.bin{,.tmp@{rand6}} rw, - owner @{tmp}/calibre_*_tmp_*/{,**} rw, owner @{tmp}/calibre-*/{,**} rw, owner @{tmp}/@{int}-*/ rw, @@ -98,18 +91,31 @@ profile calibre @{exec_path} { @{sys}/devices/@{pci}/irq r, - @{PROC}/ r, - @{PROC}/@{pids}/net/route r, - @{PROC}/sys/fs/inotify/max_user_watches r, - @{PROC}/sys/kernel/yama/ptrace_scope r, - @{PROC}/vmstat r, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, + @{PROC}/ r, + @{PROC}/@{pids}/net/route r, + @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/sys/kernel/yama/ptrace_scope r, + @{PROC}/vmstat r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/comm r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/oom_{,score_}adj rw, + owner @{PROC}/@{pid}/stat{,m} r, owner @{PROC}/@{pid}/stat{,m} r, owner @{PROC}/@{pid}/comm r, - owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/stat{,m} r, + owner @{PROC}/@{pid}/comm r, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/status r, + owner @{PROC}/@{pid}/task/@{tid}/status r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + deny owner @{PROC}/@{pid}/cmdline r, + deny owner @{PROC}/@{pid}/oom_{,score_}adj rw, + deny @{PROC}/sys/kernel/random/boot_id r, + owner @{PROC}/@{pid}/task/@{tid}/status r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, deny owner @{PROC}/@{pid}/cmdline r, deny owner @{PROC}/@{pid}/oom_{,score_}adj rw, diff --git a/apparmor.d/groups/apps/discord b/apparmor.d/profiles-a-f/discord similarity index 73% rename from apparmor.d/groups/apps/discord rename to apparmor.d/profiles-a-f/discord index 3c70844c1..fc2aadd1c 100644 --- a/apparmor.d/groups/apps/discord +++ b/apparmor.d/profiles-a-f/discord @@ -16,6 +16,9 @@ include profile discord @{exec_path} { include include + include + include + include include include include @@ -28,23 +31,26 @@ profile discord @{exec_path} { @{exec_path} mrix, @{sh_path} rix, + @{bin}/lsb_release rPx -> lsb_release, @{lib_dirs}/chrome-sandbox rix, @{lib_dirs}/chrome_crashpad_handler rix, - @{open_path} rPx -> child-open-browsers, + @{open_path} rPx -> child-open-strict, - /var/lib/dbus/machine-id r, - /etc/machine-id r, + owner @{user_videos_dirs}/{,**} rwl, + owner @{user_pictures_dirs}/{,**} rwl, owner @{tmp}/net-export/ rw, owner @{tmp}/discord.sock rw, owner "@{tmp}/Discord Crashes/" rw, - owner @{config_dirs}/*/modules/** rm, + audit owner @{config_dirs}/*/modules/** rm, owner @{run}/user/@{uid}/discord-ipc-@{int} rw, + owner @{PROC}/@{pid}/task/@{tid}/comm r, + include if exists } diff --git a/apparmor.d/groups/apps/discord-chrome-sandbox b/apparmor.d/profiles-a-f/discord-chrome-sandbox similarity index 100% rename from apparmor.d/groups/apps/discord-chrome-sandbox rename to apparmor.d/profiles-a-f/discord-chrome-sandbox diff --git a/apparmor.d/groups/apps/dropbox b/apparmor.d/profiles-a-f/dropbox similarity index 91% rename from apparmor.d/groups/apps/dropbox rename to apparmor.d/profiles-a-f/dropbox index ddb62bf60..8aa054238 100644 --- a/apparmor.d/groups/apps/dropbox +++ b/apparmor.d/profiles-a-f/dropbox @@ -15,6 +15,9 @@ include @{exec_path} = @{bin}/dropbox profile dropbox @{exec_path} { include + include + include + include include include include @@ -35,7 +38,7 @@ profile dropbox @{exec_path} { @{bin}/{,@{multiarch}-}gcc-[0-9]* rix, @{bin}/{,@{multiarch}-}objdump rix, - @{bin}/xdg-open rCx -> child-open, + @{open_path} rPx -> child-open-strict, @{bin}/lsb_release rPx -> lsb_release, owner @{HOME}/ r, diff --git a/apparmor.d/groups/apps/filezilla b/apparmor.d/profiles-a-f/filezilla similarity index 75% rename from apparmor.d/groups/apps/filezilla rename to apparmor.d/profiles-a-f/filezilla index 29654c955..2ec1a542f 100644 --- a/apparmor.d/groups/apps/filezilla +++ b/apparmor.d/profiles-a-f/filezilla @@ -10,13 +10,23 @@ include @{exec_path} = @{bin}/filezilla profile filezilla @{exec_path} { include - include - include + include + include + include + include include - include - include + include + include + include include + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink dgram, + network netlink raw, + signal (send) set=(term, kill) peer=fzsftp, @{exec_path} mr, @@ -46,15 +56,15 @@ profile filezilla @{exec_path} { owner @{user_cache_dirs}/filezilla/ rw, owner @{user_cache_dirs}/filezilla/default_*.png rw, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - /tmp/ r, owner @{tmp}/fz[0-9]temp-@{int}/ rw, owner @{tmp}/fz[0-9]temp-@{int}/fz*-lockfile rwk, owner @{tmp}/fz[0-9]temp-@{int}/empty_file_* rw, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/groups/apps/freetube b/apparmor.d/profiles-a-f/freetube similarity index 80% rename from apparmor.d/groups/apps/freetube rename to apparmor.d/profiles-a-f/freetube index d59762cfd..a3d655d87 100644 --- a/apparmor.d/groups/apps/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -12,10 +12,12 @@ include @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} -@{exec_path} = @{lib_dirs}/@{name} +@{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name} profile freetube @{exec_path} { include include + include + include include include include @@ -27,6 +29,8 @@ profile freetube @{exec_path} { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=org.mpris.MediaPlayer2.freetube path=/org/mpris/MediaPlayer2 + @{exec_path} mrix, @{open_path} rPx -> child-open-strict, diff --git a/apparmor.d/groups/apps/freetube-chrome-sandbox b/apparmor.d/profiles-a-f/freetube-chrome-sandbox similarity index 100% rename from apparmor.d/groups/apps/freetube-chrome-sandbox rename to apparmor.d/profiles-a-f/freetube-chrome-sandbox diff --git a/apparmor.d/groups/apps/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop similarity index 50% rename from apparmor.d/groups/apps/signal-desktop rename to apparmor.d/profiles-s-z/signal-desktop index 912d95760..e50d95764 100644 --- a/apparmor.d/groups/apps/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -8,14 +8,17 @@ abi , include @{name} = signal-desktop{,-beta} -@{lib_dirs} = @{lib}/signal-desktop "/opt/Signal{, Beta}" -@{config_dirs} = "@{user_config_dirs}/Signal{, Beta}" +@{lib_dirs} = @{lib}/signal-desktop /opt/Signal{,?Beta} +@{config_dirs} = @{user_config_dirs}/Signal{,?Beta} @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{lib_dirs}/@{name} profile signal-desktop @{exec_path} { include include + include + include + include include include include @@ -28,24 +31,28 @@ profile signal-desktop @{exec_path} { @{exec_path} mrix, - @{bin}/getconf rix, - @{bin}/xdg-settings rPx, + @{bin}/basename rix, + @{bin}/getconf rix, + @{bin}/xdg-settings rix, + @{open_path} rPx -> child-open-strict, - @{lib_dirs}/chrome-sandbox rPx, + audit @{lib_dirs}/chrome-sandbox rPx, @{lib_dirs}/chrome_crashpad_handler rix, - /var/lib/dbus/machine-id r, - /etc/machine-id r, - @{run}/systemd/inhibit/@{int}.ref rw, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.high r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.max r, + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.high r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, @{PROC}/@{pid}/fd/ r, @{PROC}/vmstat r, + /dev/tty rw, + include if exists } diff --git a/apparmor.d/groups/apps/signal-desktop-chrome-sandbox b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox similarity index 85% rename from apparmor.d/groups/apps/signal-desktop-chrome-sandbox rename to apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox index 8a5083143..a5f4a7ef9 100644 --- a/apparmor.d/groups/apps/signal-desktop-chrome-sandbox +++ b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox @@ -7,8 +7,8 @@ abi , include -@{lib_dirs} = @{lib}/signal-desktop "/opt/Signal{, Beta}" -@{config_dirs} = "@{user_config_dirs}/Signal{, Beta}" +@{lib_dirs} = @{lib}/signal-desktop /opt/Signal{,?Beta} +@{config_dirs} = @{user_config_dirs}/Signal{,?Beta} @{exec_path} = @{lib_dirs}/chrome-sandbox profile signal-desktop-chrome-sandbox @{exec_path} { diff --git a/apparmor.d/groups/apps/telegram-desktop b/apparmor.d/profiles-s-z/telegram-desktop similarity index 66% rename from apparmor.d/groups/apps/telegram-desktop rename to apparmor.d/profiles-s-z/telegram-desktop index be043e150..416c97d72 100644 --- a/apparmor.d/groups/apps/telegram-desktop +++ b/apparmor.d/profiles-s-z/telegram-desktop @@ -11,14 +11,20 @@ include profile telegram-desktop @{exec_path} { include include - include + include + include + include include + include + include include include + include include include include include + include include network inet dgram, @@ -28,22 +34,18 @@ profile telegram-desktop @{exec_path} { network netlink dgram, network netlink raw, - @{exec_path} mrix, + @{exec_path} mr, - @{sh_path} rix, + @{sh_path} rix, + @{open_path} rPx -> child-open-strict, - @{open_path} rPx -> child-open, - - /usr/share/TelegramDesktop/{,**} r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, + owner @{user_share_dirs}/TelegramDesktop/ rw, + owner @{user_share_dirs}/TelegramDesktop/** rwlk -> @{user_share_dirs}/TelegramDesktop/**, owner @{user_config_dirs}/autostart/telegramdesktop.desktop rw, - owner @{tmp}/@{hex}-* rwk, - owner @{run}/user/@{uid}/@{hex}-* rwk, - owner /dev/shm/#@{int} rw, + owner @{tmp}/@{hex32}-?@{uuid}? rwk, + audit owner /dev/shm/#@{int} rw, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index d26b951f7..401681743 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -47,6 +47,7 @@ avahi-set-host-name complain baloo complain baloorunner complain busctl complain +calibre complain cc-remote-login-helper complain cctk complain child-modprobe-nvidia attach_disconnected,complain @@ -88,6 +89,8 @@ cups-pk-helper-mechanism complain cupsd attach_disconnected,complain ddcutil complain dino attach_disconnected,complain +discord complain +discord-chrome-sandbox complain DiscoverNotifier complain dkms attach_disconnected,complain dmsetup complain @@ -106,6 +109,7 @@ evolution-user-prompter complain fail2ban-client attach_disconnected,complain fail2ban-server attach_disconnected,complain fdisk complain +filezilla complain firewall-applet attach_disconnected,complain firewall-config complain firewalld attach_disconnected,complain @@ -119,6 +123,11 @@ flatpak-system-helper complain flatpak-validate-icon complain foliate attach_disconnected,complain fractal attach_disconnected,complain +freetube complain +freetube-chrome-sandbox complain +fstrim complain +freetube complain +freetube-chrome-sandbox complain fuse-overlayfs complain fusermount complain gdm-generate-config complain @@ -291,6 +300,8 @@ sddm attach_disconnected,mediate_deleted,complain sddm-greeter complain secure-time-sync attach_disconnected,complain sftp-server complain +signal-desktop attach_disconnected,complain +signal-desktop-chrome-sandbox complain sing-box complain slirp4netns attach_disconnected,complain snap complain @@ -370,6 +381,7 @@ systemd-udevd attach_disconnected,complain systemd-user-sessions complain systemd-userwork attach_disconnected,complain systemsettings complain +telegram-desktop complain totem attach_disconnected,complain tracker-writeback complain udev-dmi-memory-id complain diff --git a/dists/ignore/main.ignore b/dists/ignore/main.ignore index fe61aaf2f..917b117f1 100644 --- a/dists/ignore/main.ignore +++ b/dists/ignore/main.ignore @@ -5,11 +5,6 @@ # when built with 'make full' apparmor.d/groups/_full -# Apps that should be sandboxed -apparmor.d/groups/apps -code -code-wrapper - # Provided by other packages man From a99fbaa0beebe9b16e708de312034335ee73e6cb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 19:47:25 +0100 Subject: [PATCH 0134/1455] feat(profile): restic some well known path. --- apparmor.d/abstractions/common/chromium | 8 ++++---- apparmor.d/abstractions/common/electron | 2 +- apparmor.d/groups/apt/apt-cdrom | 12 ++++++------ apparmor.d/groups/freedesktop/cpupower | 2 +- apparmor.d/groups/freedesktop/xorg | 2 +- apparmor.d/groups/freedesktop/xrdb | 2 +- apparmor.d/groups/network/mullvad-gui | 2 +- apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/profiles-g-l/gtk-youtube-viewer | 2 +- 9 files changed, 17 insertions(+), 17 deletions(-) diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index 2e98c515a..28effd768 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -26,10 +26,10 @@ /var/tmp/ r, owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6}/{,**} rw, - owner @{tmp}/scoped_dir*/ rw, - owner @{tmp}/scoped_dir*/SingletonCookie w, - owner @{tmp}/scoped_dir*/SingletonSocket w, - owner @{tmp}/scoped_dir*/SS w, + owner @{tmp}/scoped_dir@{rand6}/ rw, + owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w, + owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w, + owner @{tmp}/scoped_dir@{rand6}/SS w, /dev/shm/ r, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 732129c26..5de098246 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -50,7 +50,7 @@ owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, - owner @{user_share_dirs}/.org.chromium.Chromium.* rw, + owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw, diff --git a/apparmor.d/groups/apt/apt-cdrom b/apparmor.d/groups/apt/apt-cdrom index a2268648b..dc3f9c216 100644 --- a/apparmor.d/groups/apt/apt-cdrom +++ b/apparmor.d/groups/apt/apt-cdrom @@ -33,11 +33,11 @@ profile apt-cdrom @{exec_path} flags=(complain) { # @{run}/udev/data/* r, # For cd-roms - /media/cdrom[0-9]/ r, - /media/cdrom[0-9]/**/ r, - /media/cdrom[0-9]/.disk/info r, - /media/cdrom[0-9]/dists/**/binary-*/Packages{,.gz} r, - /media/cdrom[0-9]/dists/**/i18n/Translation-en{,.gz} r, + /media/cdrom@{int}/ r, + /media/cdrom@{int}/**/ r, + /media/cdrom@{int}/.disk/info r, + /media/cdrom@{int}/dists/**/binary-*/Packages{,.gz} r, + /media/cdrom@{int}/dists/**/i18n/Translation-en{,.gz} r, # For pendrives @{MOUNTS}/ r, @@ -63,7 +63,7 @@ profile apt-cdrom @{exec_path} flags=(complain) { /etc/fstab r, - /media/cdrom[0-9]/ r, + /media/cdrom@{int}/ r, include if exists } diff --git a/apparmor.d/groups/freedesktop/cpupower b/apparmor.d/groups/freedesktop/cpupower index 0b1d0ead3..58d4f0e84 100644 --- a/apparmor.d/groups/freedesktop/cpupower +++ b/apparmor.d/groups/freedesktop/cpupower @@ -32,7 +32,7 @@ profile cpupower @{exec_path} { @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{min,max}_freq rw, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_setspeed rw, - @{sys}/devices/system/cpu/cpu@{int}/cpuidle/state[0-9]/disable rw, + @{sys}/devices/system/cpu/cpu@{int}/cpuidle/state@{int}/disable rw, @{sys}/devices/system/cpu/cpu@{int}/topology/{physical_package_id,core_id} r, diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 378c81119..878b85004 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -125,7 +125,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{PROC}/ioports r, @{PROC}/mtrr rw, - /dev/fb[0-9] rw, + /dev/fb@{int} rw, /dev/input/event@{int} rw, /dev/shm/#@{int} rw, /dev/shm/shmfd-* rw, diff --git a/apparmor.d/groups/freedesktop/xrdb b/apparmor.d/groups/freedesktop/xrdb index 9bd897bee..638f6ebee 100644 --- a/apparmor.d/groups/freedesktop/xrdb +++ b/apparmor.d/groups/freedesktop/xrdb @@ -19,7 +19,7 @@ profile xrdb @{exec_path} { @{bin}/{,*-}cpp-[0-9]* rix, @{sh_path} rix, @{bin}/cpp rix, - @{lib}/gcc/@{multiarch}/@{int}*/cc1 rix, + @{lib}/gcc/@{multiarch}/@{version}/cc1 rix, @{lib}/llvm-[0-9]*/bin/clang rix, /usr/include/stdc-predef.h r, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index 48534d676..91cfaab0f 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -6,7 +6,7 @@ abi , include -@{name} = Mullvad*VPN +@{name} = Mullvad?VPN @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 6ab0802ba..c1bd7fa37 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -123,7 +123,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r, owner /var/lib/pacman/{,**} rwl, - owner @{tmp}/alpm_*/{,**} rw, + owner @{tmp}/alpm_@{rand6}/{,**} rw, owner @{tmp}/checkup-db-@{int}/sync/{,*.db*} rw, owner @{tmp}/checkup-db-@{int}/db.lck rw, diff --git a/apparmor.d/profiles-g-l/gtk-youtube-viewer b/apparmor.d/profiles-g-l/gtk-youtube-viewer index 9d2bc322e..5f2e4fde7 100644 --- a/apparmor.d/profiles-g-l/gtk-youtube-viewer +++ b/apparmor.d/profiles-g-l/gtk-youtube-viewer @@ -98,7 +98,7 @@ profile gtk-youtube-viewer @{exec_path} { include @{bin}/xdg-open mr, - @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr, @{sh_path} rix, @{bin}/{m,g,}awk rix, From c7181ecadf7c5ce96c32ce497c591795f5abf931 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 19:57:49 +0100 Subject: [PATCH 0135/1455] feat(profile): general update. --- apparmor.d/abstractions/common/electron | 1 + apparmor.d/abstractions/common/game | 12 ++++-- apparmor.d/abstractions/qt5-shader-cache | 4 +- apparmor.d/groups/apt/apt-cdrom | 28 +++++++------- apparmor.d/groups/bus/dbus-session | 2 +- .../groups/children/child-modprobe-nvidia | 4 -- apparmor.d/groups/freedesktop/accounts-daemon | 19 +++++----- apparmor.d/groups/freedesktop/xdg-screensaver | 4 +- .../gnome/gnome-control-center-goa-helper | 17 +++++++-- apparmor.d/groups/gnome/gnome-weather | 2 + apparmor.d/groups/gnome/gsd-media-keys | 28 +------------- apparmor.d/groups/gpg/gpg | 37 +++++++++---------- apparmor.d/groups/pacman/arch-audit | 6 +-- apparmor.d/groups/pacman/pacman | 7 +--- apparmor.d/groups/ssh/ssh | 3 +- apparmor.d/groups/ssh/ssh-agent-launch | 2 +- apparmor.d/profiles-a-f/bluetoothd | 10 ----- apparmor.d/profiles-a-f/cemu | 12 +++--- apparmor.d/profiles-a-f/dkms | 2 +- apparmor.d/profiles-g-l/git | 10 +++-- apparmor.d/profiles-g-l/gitstatusd | 1 + apparmor.d/profiles-m-r/run-parts | 6 +++ apparmor.d/profiles-m-r/runuser | 23 +++--------- apparmor.d/profiles-s-z/speedtest | 7 ++-- .../spice-client-glib-usb-acl-helper | 4 +- apparmor.d/profiles-s-z/ss | 19 +++++----- apparmor.d/profiles-s-z/steam | 2 +- apparmor.d/profiles-s-z/steam-launch | 2 +- .../profiles-s-z/steam-runtime-steam-remote | 29 +++++++++++++++ apparmor.d/profiles-s-z/uname | 3 +- apparmor.d/profiles-s-z/vipw-vigr | 3 +- apparmor.d/profiles-s-z/who | 1 + 32 files changed, 152 insertions(+), 158 deletions(-) create mode 100644 apparmor.d/profiles-s-z/steam-runtime-steam-remote diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 5de098246..b39ccc853 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -61,6 +61,7 @@ owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w, owner @{tmp}/scoped_dir@{rand6}/SS w, + /dev/shm/ r, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, @{sys}/devices/system/cpu/kernel_max r, diff --git a/apparmor.d/abstractions/common/game b/apparmor.d/abstractions/common/game index a3619b164..609bb521d 100644 --- a/apparmor.d/abstractions/common/game +++ b/apparmor.d/abstractions/common/game @@ -3,9 +3,9 @@ # SPDX-License-Identifier: GPL-2.0-only # Core set of resources for any games on Linux. Runtimes such as sandboxing, -# wine, proton, game launchers should use this abstraction. +# wine, proton, game launchers should use this abstraction. -# This abstraction use the following tunables: +# This abstraction uses the following tunables: # - @{XDG_GAMESSTUDIO_DIR} for game studio and game engines specific directories # (Default: @{XDG_GAMESSTUDIO_DIR}="unity3d") # - @{user_games_dirs} for user specific game directories (eg: steam storage dir) @@ -38,7 +38,7 @@ owner @{user_games_dirs}/ r, owner @{user_games_dirs}/*/ r, - owner @{user_games_dirs}/*/{,**} rwkl, + owner @{user_games_dirs}/*/** rwlk, owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/ rw, owner @{user_config_dirs}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, @@ -50,11 +50,15 @@ owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/ rw, owner @{tmp}/@{XDG_GAMESSTUDIO_DIR}/** rwlk, owner @{tmp}/#@{int} rw, + owner @{tmp}/AsyncGPUReadbackPlugin_*.log w, owner @{tmp}/CASESENSITIVETEST@{hex32} rw, owner @{tmp}/crashes/ rw, owner @{tmp}/crashes/** rwk, owner @{tmp}/miles_image_@{rand6} mrw, - owner @{tmp}/runtime-info.txt.@{rand6} rw, + owner @{tmp}/runtime-info.txt.@{rand6} rw, + owner @{tmp}/tmp@{rand6}.tmp rw, + owner @{tmp}/tmp@{rand6}@{h}.tmp rw, + owner @{tmp}/tmp@{rand8}.tmp rw, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, owner /dev/shm/mono.@{int} rw, diff --git a/apparmor.d/abstractions/qt5-shader-cache b/apparmor.d/abstractions/qt5-shader-cache index 4ac0f7f1d..e43ca64e1 100644 --- a/apparmor.d/abstractions/qt5-shader-cache +++ b/apparmor.d/abstractions/qt5-shader-cache @@ -6,10 +6,10 @@ owner @{user_cache_dirs}/ w, owner @{user_cache_dirs}/qtshadercache/ rw, owner @{user_cache_dirs}/qtshadercache/#@{int} rw, - owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int}, + owner @{user_cache_dirs}/qtshadercache/@{hex} rwl, owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/ rw, owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int} rw, - owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex}* rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int}, + owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex}* rwl, include if exists diff --git a/apparmor.d/groups/apt/apt-cdrom b/apparmor.d/groups/apt/apt-cdrom index dc3f9c216..0f3bce398 100644 --- a/apparmor.d/groups/apt/apt-cdrom +++ b/apparmor.d/groups/apt/apt-cdrom @@ -18,19 +18,18 @@ profile apt-cdrom @{exec_path} flags=(complain) { @{exec_path} mr, @{bin}/dpkg rPx -> child-dpkg, - @{bin}/mount rCx -> mount, @{bin}/umount rCx -> umount, /etc/fstab r, - # Are all of these needed? (#FIXME#) - @{sys}/bus/ r, - @{sys}/bus/*/devices/ r, - @{sys}/class/ r, - @{sys}/class/*/ r, - @{sys}/devices/**/uevent r, - # @{run}/udev/data/* r, + /etc/apt/sources.list{,.new} rw, + /etc/apt/sources.list~ w, + + /var/lib/apt/lists/** rw, + + /var/lib/apt/cdroms.list{,.new} rw, + /var/lib/apt/cdroms.list~ w, # For cd-roms /media/cdrom@{int}/ r, @@ -46,16 +45,15 @@ profile apt-cdrom @{exec_path} flags=(complain) { @{MOUNTS}/dists/**/binary-*/Packages{,.gz} r, @{MOUNTS}/dists/**/i18n/Translation-en{,.gz} r, - /var/lib/apt/lists/** rw, + # Are all of these needed? (#FIXME#) + @{sys}/bus/ r, + @{sys}/bus/*/devices/ r, + @{sys}/class/ r, + @{sys}/class/*/ r, + @{sys}/devices/**/uevent r, owner @{PROC}/@{pid}/fd/ r, - /var/lib/apt/cdroms.list{,.new} rw, - /var/lib/apt/cdroms.list~ w, - - /etc/apt/sources.list{,.new} rw, - /etc/apt/sources.list~ w, - profile mount flags=(complain) { include diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index e5e382795..b06eaa510 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -64,7 +64,7 @@ profile dbus-session flags=(attach_disconnected) { @{sys}/kernel/security/apparmor/.access rw, @{sys}/kernel/security/apparmor/features/dbus/mask r, @{sys}/module/apparmor/parameters/enabled r, - + @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/attr/apparmor/current r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index fb91234b0..45b1ff120 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -62,13 +62,9 @@ profile child-modprobe-nvidia flags=(attach_disconnected) { include capability mknod, - # capability sys_module, /etc/nvidia/{current,legacy*,tesla*}/*.conf r, - # @{sys}/module/ipmi_devintf/initstate r, - # @{sys}/module/ipmi_msghandler/initstate r, - # @{sys}/module/{drm,nvidia}/initstate r, @{sys}/module/compression r, deny @{HOME}/.steam/** r, diff --git a/apparmor.d/groups/freedesktop/accounts-daemon b/apparmor.d/groups/freedesktop/accounts-daemon index 4f2e8b64c..1389b2ee6 100644 --- a/apparmor.d/groups/freedesktop/accounts-daemon +++ b/apparmor.d/groups/freedesktop/accounts-daemon @@ -21,7 +21,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) { capability sys_nice, capability sys_ptrace, - ptrace (read) peer=unconfined, + ptrace read peer=unconfined, #aa:dbus own bus=system name=org.freedesktop.Accounts @@ -58,24 +58,23 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) { /etc/shells r, /etc/sysconfig/displaymanager r, + /var/log/wtmp r, + owner /var/lib/AccountsService/ r, owner /var/lib/AccountsService/** rw, @{HOME}/ r, owner @{HOME}/.pam_environment r, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/loginuid rw, - @{PROC}/@{pids}/loginuid r, - @{PROC}/@{pids}/cmdline r, + owner @{tmp}/gnome-control-center-user-icon-@{rand6} rw, + + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/loginuid r, @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, - - # wtmp.d ? - /var/log/wtmp r, - - owner @{tmp}/gnome-control-center-user-icon-@{rand6} rw, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/loginuid rw, include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-screensaver b/apparmor.d/groups/freedesktop/xdg-screensaver index cee9898b5..bca69b9b1 100644 --- a/apparmor.d/groups/freedesktop/xdg-screensaver +++ b/apparmor.d/groups/freedesktop/xdg-screensaver @@ -32,14 +32,14 @@ profile xdg-screensaver @{exec_path} { @{bin}/xset rPx, @{bin}/hostname rix, - /dev/dri/card@{int} rw, - owner @{HOME}/ r, owner @{HOME}/.Xauthority r, owner @{tmp}/xauth-@{int}-_[0-9] r, owner @{run}/user/@{uid}/ r, + /dev/dri/card@{int} rw, + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-control-center-goa-helper b/apparmor.d/groups/gnome/gnome-control-center-goa-helper index 72f5867a4..a210cbd18 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-goa-helper +++ b/apparmor.d/groups/gnome/gnome-control-center-goa-helper @@ -39,7 +39,7 @@ profile gnome-control-center-goa-helper @{exec_path} { @{exec_path} mr, - @{bin}/bwrap rPUx, + @{bin}/bwrap rCx -> bwrap, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, @@ -48,9 +48,11 @@ profile gnome-control-center-goa-helper @{exec_path} { owner @{user_config_dirs}/goa-1.0/accounts.conf r, - owner @{user_cache_dirs}/gnome-control-center-goa-helper/{,**} rwl, + owner @{user_cache_dirs}/gnome-control-center-goa-helper/ rw, + owner @{user_cache_dirs}/gnome-control-center-goa-helper/** rwl, - owner @{user_share_dirs}/gnome-control-center-goa-helper/{,**} rwk, + owner @{user_share_dirs}/gnome-control-center-goa-helper/ rw, + owner @{user_share_dirs}/gnome-control-center-goa-helper/** rwk, owner @{user_share_dirs}/webkitgtk/{,**} rw, owner @{user_share_dirs}/webkitgtk/localstorage/{,**} rwk, @@ -63,6 +65,15 @@ profile gnome-control-center-goa-helper @{exec_path} { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, + profile bwrap flags=(attach_disconnected,complain) { + include + include + + @{bin}/bwrap mr, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-weather b/apparmor.d/groups/gnome/gnome-weather index b2851601c..a49fe97bd 100644 --- a/apparmor.d/groups/gnome/gnome-weather +++ b/apparmor.d/groups/gnome/gnome-weather @@ -33,6 +33,8 @@ profile gnome-weather @{exec_path} { owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/stat r, + deny owner @{user_share_dirs}/gvfs-metadata/* r, + include if exists } diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 6ed820866..dc6e8aeb7 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -31,38 +31,14 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { network netlink raw, #aa:dbus own bus=session name=org.gnome.SettingsDaemon.MediaKeys + #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Rfkill label=gsd-rfkill + #aa:dbus talk bus=session name=org.gnome.Shell label=gnome-shell dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=PowerOff peer=(name=:*, label=systemd-logind), - dbus send bus=session path=/org/gnome/Shell - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=:*, label=gnome-shell), - dbus send bus=session path=/org/gnome/Shell - interface=org.gnome.Shell - member={GrabAccelerators,UngrabAccelerators} - peer=(name=:*, label=gnome-shell), - dbus receive bus=session path=/org/gnome/Shell - interface=org.freedesktop.DBus.Properties - member={GetAll,PropertiesChanged} - peer=(name=:*, label=gnome-shell), - dbus receive bus=session path=/org/gnome/Shell - interface=org.gnome.Shell - member=AcceleratorActivated - peer=(name=:*, label=gnome-shell), - - dbus send bus=session path=/org/gnome/SettingsDaemon/Rfkill - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=:*, label=gsd-rfkill), - dbus receive bus=session path=/org/gnome/SettingsDaemon/Rfkill - interface=org.freedesktop.DBus.Properties - member=PropertiesChanged - peer=(name=:*, label=gsd-rfkill), - dbus send bus=session path=/ interface=org.freedesktop.DBus member=ListNames diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 43cb9cadf..a7aa93d2b 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -32,6 +32,23 @@ profile gpg @{exec_path} { /etc/inputrc r, + #aa:only pacman + /etc/pacman.d/gnupg/gpg.conf r, + /etc/pacman.d/gnupg/pubring.gpg r, + /etc/pacman.d/gnupg/trustdb.gpg r, + + #aa:only apt + owner /etc/apt/keyrings/ rw, + owner /etc/apt/keyrings/** rwkl -> /etc/apt/keyrings/**, + + owner /var/lib/*/{,.}gnupg/ rw, + owner /var/lib/*/{,.}gnupg/** rwkl -> /var/lib/*/{,.}gnupg/**, + + # TODO: Remove after zypper profile is created + #aa:only zypper + owner /var/tmp/zypp.@{rand6}/ rw, + owner /var/tmp/zypp.@{rand6}/** rwkl -> /var/tmp/zypp.@{rand6}/**, + owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, @@ -45,26 +62,6 @@ profile gpg @{exec_path} { owner @{user_share_dirs}/torbrowser/gnupg_homedir/ rw, owner @{user_share_dirs}/torbrowser/gnupg_homedir/** rwkl -> @{user_share_dirs}/torbrowser/gnupg_homedir/**, - #aa:only apt - owner /etc/apt/keyrings/ rw, - owner /etc/apt/keyrings/** rwkl -> /etc/apt/keyrings/**, - - #aa:only pacman - /etc/pacman.d/gnupg/gpg.conf r, - /etc/pacman.d/gnupg/pubring.gpg r, - /etc/pacman.d/gnupg/trustdb.gpg r, - - owner /var/lib/*/gnupg/ rw, - owner /var/lib/*/gnupg/** rwkl -> /var/lib/*/gnupg/**, - - owner /var/lib/*/.gnupg/ rw, - owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**, - - # TODO: Remove after zypper profile is created - #aa:only zypper - owner /var/tmp/zypp.@{rand6}/ rw, - owner /var/tmp/zypp.@{rand6}/** rwkl -> /var/tmp/zypp.@{rand6}/**, - #aa:exclude ubuntu owner @{tmp}/ostree-gpg-@{rand6}/ r, owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, diff --git a/apparmor.d/groups/pacman/arch-audit b/apparmor.d/groups/pacman/arch-audit index 7ef09601c..ba4987a31 100644 --- a/apparmor.d/groups/pacman/arch-audit +++ b/apparmor.d/groups/pacman/arch-audit @@ -28,12 +28,12 @@ profile arch-audit @{exec_path} { /var/lib/pacman/local/{,**} r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/mountinfo r, - @{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/mountinfo r, + /dev/pts/@{int} rw, include if exists diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index c1bd7fa37..957e521f4 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -46,7 +46,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/gpg{,2} rCx -> gpg, @{bin}/gpgconf rCx -> gpg, @{bin}/gpgsm rCx -> gpg, - + # Pacman hooks & install scripts @{sh_path} rix, @{coreutils_path} rix, @@ -64,7 +64,6 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/gdk-pixbuf-query-loaders rPx, @{bin}/getent rix, @{bin}/gettext rix, - @{bin}/ghc-pkg{,-*} rPx, @{bin}/gio-querymodules rPx, @{bin}/glib-compile-schemas rPx, @{bin}/groupadd rPx, @@ -118,9 +117,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { /var/** rwlk -> /var/**, # Read packages files - @{user_pkg_dirs}/ r, - @{user_pkg_dirs}/**/ r, - @{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r, + @{user_pkg_dirs}/{,**} r, owner /var/lib/pacman/{,**} rwl, owner @{tmp}/alpm_@{rand6}/{,**} rw, diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 1dac2be00..296074f5f 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -23,8 +23,7 @@ profile ssh @{exec_path} { @{exec_path} mrix, - @{bin}/{,b,d,rb}ash rix, - @{bin}/{c,k,tc,z}sh rix, + @{bin}/@{shells} rUx, @{etc_ro}/ssh/ssh_config r, @{etc_ro}/ssh/ssh_config.d/{,*} r, diff --git a/apparmor.d/groups/ssh/ssh-agent-launch b/apparmor.d/groups/ssh/ssh-agent-launch index 66e05b5ec..a243069c0 100644 --- a/apparmor.d/groups/ssh/ssh-agent-launch +++ b/apparmor.d/groups/ssh/ssh-agent-launch @@ -12,7 +12,7 @@ profile ssh-agent-launch @{exec_path} { @{exec_path} mr, - @{bin}/{,z,ba,da}sh rix, + @{sh_path} rix, @{bin}/dbus-update-activation-environment rCx -> dbus, @{bin}/getopt rix, @{bin}/grep rix, diff --git a/apparmor.d/profiles-a-f/bluetoothd b/apparmor.d/profiles-a-f/bluetoothd index 75934102b..66cc35860 100644 --- a/apparmor.d/profiles-a-f/bluetoothd +++ b/apparmor.d/profiles-a-f/bluetoothd @@ -35,16 +35,6 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) { member=GetManagedObjects peer=(name=:*, label=pulseaudio), - dbus send bus=system path=/MediaEndpoint/{A2DPSink,A2DPSource}/* - interface=org.bluez.MediaEndpoint1 - member=Release - peer=(name=:*, label=pulseaudio), - - dbus send bus=system path=/Profile/{HFPAGProfile,HSPHSProfile} - interface=org.bluez.MediaEndpoint1 - member=Release - peer=(name=:*, label=pulseaudio), - dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=InterfacesRemoved diff --git a/apparmor.d/profiles-a-f/cemu b/apparmor.d/profiles-a-f/cemu index 44d4098da..40920ebd0 100644 --- a/apparmor.d/profiles-a-f/cemu +++ b/apparmor.d/profiles-a-f/cemu @@ -29,18 +29,18 @@ profile cemu @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/Cemu/{,**} rw, owner @{user_share_dirs}/Cemu/{,**} rw, - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/fd r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/statm r, - - owner @{sys}/class/ r, + @{sys}/class/ r, @{sys}/class/input/ r, @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/abs r, @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/ev r, @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/key r, @{sys}/devices/@{pci}/usb@{int}/**/input@{int}/capabilities/rel r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/statm r, + /dev/input/ r, /dev/input/event@{int} rw, /dev/input/js@{int} rw, diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 6d836c63d..4ebe8e464 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -41,7 +41,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{bin}/update-secureboot-policy rPUx, @{bin}/zstd rix, - @{lib}/gcc/@{multiarch}/@{int}*/* rix, + @{lib}/gcc/@{multiarch}/@{version}/* rix, @{lib}/linux-kbuild-*/scripts/** rix, @{lib}/linux-kbuild-*/tools/objtool/objtool rix, @{lib}/llvm-[0-9]*/bin/clang rix, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 8a2ffb797..af7fbd4df 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -101,9 +101,11 @@ profile git @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature owner @{tmp}/git-commit-msg-.txt rw, # For android studio - deny @{user_share_dirs}/gvfs-metadata/* r, - deny /dev/shm/.org.chromium.Chromium* rw, deny owner @{code_config_dirs}/** rw, + deny owner @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_share_dirs}/zed/**/data.mdb rw, + deny /usr/share/nvidia/nvidia-application-profiles-* r, + deny /dev/shm/.org.chromium.Chromium* rw, profile gpg flags=(attach_disconnected) { include @@ -163,11 +165,11 @@ profile git @{exec_path} flags=(attach_disconnected) { profile editor flags=(attach_disconnected) { include include - + owner @{user_projects_dirs}/**/ r, owner @{user_projects_dirs}/**/.git/@{int} rw, owner @{user_projects_dirs}/**/.git/*MSG rw, - + # The git repository files owner @{user_build_dirs}/ r, owner @{user_build_dirs}/** rw, diff --git a/apparmor.d/profiles-g-l/gitstatusd b/apparmor.d/profiles-g-l/gitstatusd index da5566f9f..5dbce6ae3 100644 --- a/apparmor.d/profiles-g-l/gitstatusd +++ b/apparmor.d/profiles-g-l/gitstatusd @@ -22,6 +22,7 @@ profile gitstatusd @{exec_path} { deny capability dac_read_search, deny capability dac_override, deny owner @{HOME}/.*-store/{,**} r, + deny owner @{user_share_dirs}/zed/**/data.mdb rw, include if exists } diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index b37172246..81c52aa1f 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -4,6 +4,12 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only +# TODO: Rewrite this profile. Most of the rule should be confined directly by the calling profile +# Possible confinement depending of profile architecture: +# - As rix, +# - As rCx -> run-parts, +# - As rPx -> foo-run-parts, + abi , include diff --git a/apparmor.d/profiles-m-r/runuser b/apparmor.d/profiles-m-r/runuser index 97100f32a..5fc2d65c4 100644 --- a/apparmor.d/profiles-m-r/runuser +++ b/apparmor.d/profiles-m-r/runuser @@ -10,43 +10,30 @@ include @{exec_path} = @{bin}/runuser profile runuser @{exec_path} { include - include include + include include include - # To remove the following errors: - # runuser: cannot set user id: Operation not permitted capability setuid, - - # To remove the following errrors: - # runuser: cannot set groups: Operation not permitted capability setgid, - - # To write records to the kernel auditing log. capability audit_write, - - # Needed? (#FIXME#) capability sys_resource, network netlink raw, @{exec_path} mr, - # Shells to use - @{bin}/{,b,d,rb}ash rpux, - @{bin}/{c,k,tc,z}sh rpux, - - owner @{PROC}/@{pid}/loginuid r, - @{PROC}/1/limits r, + @{bin}/@{shells} rUx, @{etc_ro}/security/limits.d/ r, - /etc/default/runuser r, - # file_inherit owner @{tmp}/debian-security-support.postinst.*/output w, + @{PROC}/1/limits r, + owner @{PROC}/@{pid}/loginuid r, + include if exists } diff --git a/apparmor.d/profiles-s-z/speedtest b/apparmor.d/profiles-s-z/speedtest index 511f32a96..0fe00bc24 100644 --- a/apparmor.d/profiles-s-z/speedtest +++ b/apparmor.d/profiles-s-z/speedtest @@ -12,6 +12,7 @@ profile speedtest @{exec_path} { include include include + include network inet dgram, network inet6 dgram, @@ -26,12 +27,10 @@ profile speedtest @{exec_path} { @{bin}/file rix, @{bin}/uname rix, - owner @{PROC}/@{pid}/fd/ r, - - /usr/local/lib/python*/dist-packages/ r, - /etc/magic r, + owner @{PROC}/@{pid}/fd/ r, + include if exists } diff --git a/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper b/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper index 1847c93d7..87afa46eb 100644 --- a/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper +++ b/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper @@ -17,10 +17,8 @@ profile spice-client-glib-usb-acl-helper @{exec_path} { @{exec_path} mr, - @{lib}/gconv/gconv-modules r, - - owner @{PROC}/@{pid}/stat r, @{PROC}/sys/kernel/cap_last_cap r, + owner @{PROC}/@{pid}/stat r, include if exists } diff --git a/apparmor.d/profiles-s-z/ss b/apparmor.d/profiles-s-z/ss index 36f4c988d..7346ebd62 100644 --- a/apparmor.d/profiles-s-z/ss +++ b/apparmor.d/profiles-s-z/ss @@ -16,7 +16,7 @@ profile ss @{exec_path} { capability dac_read_search, capability sys_ptrace, - ptrace (read), # unconfined, TODO + ptrace read, network netlink raw, @@ -27,21 +27,20 @@ profile ss @{exec_path} { owner @{tmp}/*.ss rw, owner @{HOME}/*.ss rw, + @{sys}/fs/cgroup/{,**/} r, + @{PROC} r, - @{PROC}/sys/net/ipv{4,6}/ip_local_port_range r, + @{PROC}/@{pids}/attr/current r, @{PROC}/@{pids}/fd/ r, @{PROC}/@{pids}/stat r, - @{PROC}/@{pids}/attr/current r, - owner @{PROC}/@{pids}/net/sockstat r, - owner @{PROC}/@{pids}/net/snmp r, - owner @{PROC}/@{pids}/net/unix r, + @{PROC}/sys/net/ipv{4,6}/ip_local_port_range r, + owner @{PROC}/@{pids}/mounts r, owner @{PROC}/@{pids}/net/raw r, + owner @{PROC}/@{pids}/net/snmp r, + owner @{PROC}/@{pids}/net/sockstat r, owner @{PROC}/@{pids}/net/tcp r, owner @{PROC}/@{pids}/net/udp r, - - # [e]xtended - owner @{PROC}/@{pids}/mounts r, - @{sys}/fs/cgroup/{,**/} r, + owner @{PROC}/@{pids}/net/unix r, include if exists } diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 82deb0d65..d8e0a50c5 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -54,7 +54,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { ptrace read, ptrace trace peer=steam, - signal send peer=steam-game, + signal send peer=steam-game-{native,proton}, signal send peer=steam-launcher, signal send peer=steam//journalctl, signal send peer=steam//web, diff --git a/apparmor.d/profiles-s-z/steam-launch b/apparmor.d/profiles-s-z/steam-launch index 11c7b76b2..b1d820d86 100644 --- a/apparmor.d/profiles-s-z/steam-launch +++ b/apparmor.d/profiles-s-z/steam-launch @@ -34,7 +34,7 @@ profile steam-launch @{exec_path} { @{lib}/steam/bin_steam.sh rix, @{share_dirs}/steam.sh rPx, - @{runtime_dirs}/@{arch}/steam-runtime-steam-remote rPUx, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rPx, /usr/ r, /usr/local/ r, diff --git a/apparmor.d/profiles-s-z/steam-runtime-steam-remote b/apparmor.d/profiles-s-z/steam-runtime-steam-remote new file mode 100644 index 000000000..4f256ef2d --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-runtime-steam-remote @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ + +@{exec_path} = @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote +profile steam-runtime-steam-remote @{exec_path} flags=(complain) { + include + + @{exec_path} mr, + + @{runtime_dirs}/** rm, + + owner @{HOME}/.steam/steam.pipe rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/uname b/apparmor.d/profiles-s-z/uname index 4dd41a7bf..31508b640 100644 --- a/apparmor.d/profiles-s-z/uname +++ b/apparmor.d/profiles-s-z/uname @@ -17,7 +17,8 @@ profile uname @{exec_path} flags=(attach_disconnected) { /dev/tty@{int} rw, deny network, - deny @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_share_dirs}/zed/**/data.mdb rw, include if exists } diff --git a/apparmor.d/profiles-s-z/vipw-vigr b/apparmor.d/profiles-s-z/vipw-vigr index 5b42ab828..3705f0bab 100644 --- a/apparmor.d/profiles-s-z/vipw-vigr +++ b/apparmor.d/profiles-s-z/vipw-vigr @@ -35,7 +35,6 @@ profile vipw-vigr @{exec_path} { # modify the /etc/passwd or /etc/shadow password database. /etc/.pwd.lock rwk, - profile editor { include include @@ -43,6 +42,8 @@ profile vipw-vigr @{exec_path} { capability fsetid, /etc/{passwd,shadow,gshadow,group}.edit rw, + + include if exists } include if exists diff --git a/apparmor.d/profiles-s-z/who b/apparmor.d/profiles-s-z/who index bed53e7e6..54b4375b2 100644 --- a/apparmor.d/profiles-s-z/who +++ b/apparmor.d/profiles-s-z/who @@ -19,6 +19,7 @@ profile who @{exec_path} { @{exec_path} mr, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, + deny owner @{user_share_dirs}/zed/**/data.mdb rw, include if exists } From f31a68ca216bb33fa8b62648703aad29057b1e0d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 19:58:17 +0100 Subject: [PATCH 0136/1455] feat(profile): add gitg. --- apparmor.d/profiles-g-l/gitg | 44 ++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 apparmor.d/profiles-g-l/gitg diff --git a/apparmor.d/profiles-g-l/gitg b/apparmor.d/profiles-g-l/gitg new file mode 100644 index 000000000..3d6da038c --- /dev/null +++ b/apparmor.d/profiles-g-l/gitg @@ -0,0 +1,44 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/gitg +profile gitg @{exec_path} { + include + include + include + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + /usr/share/gitg/{,**} r, + + owner @{user_projects_dirs}/ rw, + owner @{user_projects_dirs}/** rwkl -> @{user_projects_dirs}/**, + owner @{user_projects_dirs}/**/.git/hooks/* rix, + + owner @{user_config_dirs}/git/{,*} rw, + + owner @{user_share_dirs}/gitg/{,**} rw, + + @{run}/mount/utab r, + + owner @{PROC}/@{pid}/mountinfo r, + + include if exists +} + +# vim:syntax=apparmor From 51d8c052f525eaea809116d12de2945a8242528b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 20:18:30 +0100 Subject: [PATCH 0137/1455] feat(profile): add makepkg This profile is large enough to support any userbased compilation. While giving protection as it only allows root access to use pacman. see #404, #420 #444, #466 --- apparmor.d/groups/pacman/makepkg | 75 ++++++++++++++++++++++++++++++++ apparmor.d/groups/pacman/pacman | 2 +- 2 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/groups/pacman/makepkg diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg new file mode 100644 index 000000000..6aa98d84d --- /dev/null +++ b/apparmor.d/groups/pacman/makepkg @@ -0,0 +1,75 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/makepkg +profile makepkg @{exec_path} { + include + include + + network inet stream, + network inet6 stream, + network inet dgram, + network inet6 dgram, + network netlink raw, + + file, + + @{bin}/gpg{,2} Cx -> gpg, + @{bin}/gpgconf Cx -> gpg, + @{bin}/gpgsm Cx -> gpg, + @{bin}/sudo Cx -> sudo, + + profile gpg { + include + include + + @{bin}/gpg{,2} mr, + @{bin}/gpgconf mr, + @{bin}/gpgsm mr, + + @{bin}/dirmngr rix, + @{bin}/gpg-agent rix, + @{bin}/gpg-connect-agent rix, + @{lib}/{,gnupg/}scdaemon rix, + + /etc/pacman.d/gnupg/ r, + /etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**, + + owner @{user_pkg_dirs}/{,**} rw, + + owner @{HOME}/@{XDG_GPG_DIR}/ rw, + owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/gnupg/ r, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw, + owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, + + owner @{PROC}/@{pid}/fd/ r, + + include if exists + } + + profile sudo { + include + include + + capability sys_ptrace, + + ptrace read, + + @{bin}/pacman Px, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 957e521f4..d90daf9ba 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -168,7 +168,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/gpg-connect-agent rix, /etc/pacman.d/gnupg/ rw, - /etc/pacman.d/gnupg/** rwkl, + /etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**, @{HOME}/@{XDG_GPG_DIR}/*.conf r, From f1dcefabb329777f0a1ed176ed118b2bb5c650c5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 20:38:42 +0100 Subject: [PATCH 0138/1455] feat(profile): add profile for yay. fix #420, #466 --- apparmor.d/groups/pacman/makepkg | 1 + apparmor.d/groups/pacman/pacman | 2 + apparmor.d/groups/pacman/yay | 104 +++++++++++++++++++++++++++++++ dists/flags/arch.flags | 1 + 4 files changed, 108 insertions(+) create mode 100644 apparmor.d/groups/pacman/yay diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 6aa98d84d..d62e509e9 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -52,6 +52,7 @@ profile makepkg @{exec_path} { owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists } diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index d90daf9ba..c1dbb002e 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -64,6 +64,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/gdk-pixbuf-query-loaders rPx, @{bin}/getent rix, @{bin}/gettext rix, + @{bin}/ghc-pkg-@{version} rix, @{bin}/gio-querymodules rPx, @{bin}/glib-compile-schemas rPx, @{bin}/groupadd rPx, @@ -99,6 +100,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/vercmp rix, @{bin}/xmlcatalog rix, @{lib}/systemd/systemd-* rPx, + @{lib}/ghc-@{version}/bin/ghc-pkg-@{version} rix, @{lib}/vlc/vlc-cache-gen rPx, /opt/Mullvad*/resources/mullvad-setup rPx, /usr/share/code-features/patch.py rPx, diff --git a/apparmor.d/groups/pacman/yay b/apparmor.d/groups/pacman/yay new file mode 100644 index 000000000..8f2804621 --- /dev/null +++ b/apparmor.d/groups/pacman/yay @@ -0,0 +1,104 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/yay +profile yay @{exec_path} { + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + @{editor_path} Cx -> editor, + @{bin}/git Cx -> git, + @{bin}/gpg{,2} Cx -> gpg, + @{bin}/makepkg Px, + @{bin}/pacman-conf Px, + @{bin}/sudo Cx -> sudo, + + /var/lib/pacman/** r, + + owner @{user_cache_dirs}/yay/ rw, + owner @{user_cache_dirs}/yay/** rwkl -> @{user_cache_dirs}/yay/**, + + owner @{user_config_dirs}/yay/{,**} rw, + + profile git { + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{bin}/git* mrix, + @{lib}/git{,-core}/git* mrix, + + @{pager_path} rPx -> child-pager, + @{bin}/gpg{2,} rPx -> yay//gpg, + + /usr/share/git{,-core}/{,**} r, + + owner @{HOME}/.gitconfig r, + owner @{user_cache_dirs}/yay/ rw, + owner @{user_cache_dirs}/yay/** rwlk -> @{user_cache_dirs}/yay/**, + owner @{user_config_dirs}/git/{,*} r, + + include if exists + } + + profile editor { + include + include + + owner @{user_cache_dirs}/yay/*/** rw, + + include if exists + } + + profile gpg { + include + include + + @{bin}/gpg{,2} mr, + @{bin}/gpg-agent rPx, + + owner @{HOME}/@{XDG_GPG_DIR}/ rw, + owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + + include if exists + } + + profile sudo { + include + include + + capability sys_ptrace, + + ptrace read peer=unconfined, + + @{bin}/pacman Px, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/arch.flags b/dists/flags/arch.flags index b94fae2c2..e65ae5520 100644 --- a/dists/flags/arch.flags +++ b/dists/flags/arch.flags @@ -13,3 +13,4 @@ pacman-hook-mkinitcpio attach_disconnected,complain pacman-hook-perl complain pacman-hook-systemd attach_disconnected,complain pacman-key complain +yay complain From f3f92297bc545e9eeab1a91dc44dd7b98ae3a9bc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 20:49:42 +0100 Subject: [PATCH 0139/1455] fix(profile): remove deprecated & never enabled profiles. --- apparmor.d/profiles-a-f/code | 105 --------------------------- apparmor.d/profiles-a-f/code-wrapper | 27 ------- 2 files changed, 132 deletions(-) delete mode 100644 apparmor.d/profiles-a-f/code delete mode 100644 apparmor.d/profiles-a-f/code-wrapper diff --git a/apparmor.d/profiles-a-f/code b/apparmor.d/profiles-a-f/code deleted file mode 100644 index 393598746..000000000 --- a/apparmor.d/profiles-a-f/code +++ /dev/null @@ -1,105 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{code_config_dirs} = @{user_config_dirs}/Code* @{HOME}/.vscode{,-oss} - -@{exec_path} = @{lib}/electron@{int}/electron -profile code flags=(attach_disconnected) { - include - include - include - include - include - include - include - include - - capability sys_ptrace, - - network inet stream, - network inet6 stream, - network inet dgram, - network inet6 dgram, - network netlink raw, - - signal (send), - - @{exec_path} mrix, - - @{lib}/code/node_modules.asar.unpacked/**.node rm, - - # Core tools - @{bin}/git rPx, - @{bin}/gpg{,2} rPx, - @{bin}/lsb_release rPx -> lsb_release, - @{bin}/rg rix, - @{open_path} rPx -> child-open, - - # The shell is not confined on purpose. - @{bin}/@{shells} rUx, - - # Confine some common tools - @{lib}/code/extensions/git/dist/askpass.sh rPx, - @{lib}/code/extensions/git/dist/git-editor.sh rPx, - - # Do NOT confine most of the extensions - @{bin}/[a-z0-9]* rPUx, - @{code_config_dirs}/extensions/** rPUx, - @{HOME}/.go/bin/* rPUx, - @{lib}/go/bin/* rPUx, - @{bin}/python3.@{int} rUx, - - /etc/shells r, - /etc/lsb-release r, - - owner @{HOME}/@{XDG_SSH_DIR}/config r, - - owner @{code_config_dirs}/** rwkl -> @{code_config_dirs}/**, - - owner @{user_projects_dirs}/ r, - owner @{user_projects_dirs}/** rwkl -> @{user_projects_dirs}/**, - - owner @{tmp}/@{uuid} rw, - owner @{tmp}/vscode-*/{,**} rw, - owner @{tmp}/vscode-ipc-@{uuid}.sock rw, - - owner @{run}/user/@{uid}/vscode-@{hex}-*-{shared,main}.sock rw, - owner @{run}/user/@{uid}/vscode-git-@{hex}.sock rw, - owner @{run}/user/@{uid}/git-graph-askpass-[a-zA-Z0-9]*.sock rw, - - @{run}/systemd/inhibit/*.ref rw, - - @{sys}/devices/system/cpu/present r, - @{sys}/devices/system/cpu/kernel_max r, - @{sys}/devices/virtual/tty/tty@{int}/active r, - - @{PROC}/ r, - @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/stat r, - @{PROC}/loadavg r, - @{PROC}/sys/fs/inotify/max_user_watches r, - @{PROC}/sys/kernel/yama/ptrace_scope r, - @{PROC}/version r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/comm w, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/oom_score_adj rw, - owner @{PROC}/@{pid}/statm r, - owner @{PROC}/@{pids}/clear_refs w, - owner @{PROC}/@{pids}/task/ r, - owner @{PROC}/@{pids}/task/@{tid}/status r, - - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/code-wrapper b/apparmor.d/profiles-a-f/code-wrapper deleted file mode 100644 index 707164b09..000000000 --- a/apparmor.d/profiles-a-f/code-wrapper +++ /dev/null @@ -1,27 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/code{,-oss} -profile code-wrapper @{exec_path} { - include - include - - @{exec_path} r, - - @{sh_path} rix, - @{lib}/electron@{int}/electron rPx -> code, - - owner @{user_config_dirs}/code-flags.conf r, - owner @{user_config_dirs}/electron@{int}-flags.conf r, - - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, - - include if exists -} - -# vim:syntax=apparmor From c2bc55dc465cd560861fbf773b47f0af6f746de3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 20:53:12 +0100 Subject: [PATCH 0140/1455] feat(profile): general update. --- apparmor.d/abstractions/app/editor | 1 + apparmor.d/abstractions/app/pgrep | 2 +- apparmor.d/abstractions/freedesktop.org.d/complete | 2 ++ apparmor.d/groups/gnome/gnome-shell | 1 - apparmor.d/profiles-a-f/aa-enforce | 2 +- 5 files changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index 023696e31..d6e346f36 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -4,6 +4,7 @@ # SPDX-License-Identifier: GPL-2.0-only include + include @{sh_path} rix, @{bin}/nvim mrix, diff --git a/apparmor.d/abstractions/app/pgrep b/apparmor.d/abstractions/app/pgrep index 4bab75387..aaf14d859 100644 --- a/apparmor.d/abstractions/app/pgrep +++ b/apparmor.d/abstractions/app/pgrep @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Minimal set of rules for pgrep. +# Minimal set of rules for pgrep/pkill. include diff --git a/apparmor.d/abstractions/freedesktop.org.d/complete b/apparmor.d/abstractions/freedesktop.org.d/complete index ed4f067a5..4724c694a 100644 --- a/apparmor.d/abstractions/freedesktop.org.d/complete +++ b/apparmor.d/abstractions/freedesktop.org.d/complete @@ -13,6 +13,8 @@ @{system_share_dirs}/ r, @{system_share_dirs}/mime/ r, + /opt/*/**.{desktop,png} r, + /etc/gnome/defaults.list r, /etc/xfce4/defaults.list r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 6950304fc..29ced8dd9 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -195,7 +195,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/share/gnome-shell/extensions/*/** rPUx, /opt/**/share/icons/{,**} r, - /opt/*/**/*.png r, /snap/*/@{uid}/**.png r, /usr/share/{,zoneinfo-}icu/{,**} r, /usr/share/**.{png,jpg,svg} r, diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index 2028e713f..84ba22fba 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/aa-enforce @{bin}/aa-complain +@{exec_path} = @{bin}/aa-enforce @{bin}/aa-complain @{bin}/aa-audit profile aa-enforce @{exec_path} { include include From f0faf4ba5294193dee05a2e3d648951fe282f3ad Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 9 Sep 2024 21:03:41 +0100 Subject: [PATCH 0141/1455] build: add signal-desktop to the overwritten list. --- dists/overwrite | 1 + 1 file changed, 1 insertion(+) diff --git a/dists/overwrite b/dists/overwrite index ec35b79cd..767c07312 100644 --- a/dists/overwrite +++ b/dists/overwrite @@ -16,6 +16,7 @@ msedge nautilus opera plasmashell +signal-desktop slirp4netns systemd-coredump thunderbird From d9ce0d287d04d498432a3879f6c6b289d575eba0 Mon Sep 17 00:00:00 2001 From: odomingao Date: Mon, 9 Sep 2024 23:33:28 -0300 Subject: [PATCH 0142/1455] Create earlyoom --- apparmor.d/profiles-a-f/earlyoom | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 apparmor.d/profiles-a-f/earlyoom diff --git a/apparmor.d/profiles-a-f/earlyoom b/apparmor.d/profiles-a-f/earlyoom new file mode 100644 index 000000000..6752cbae6 --- /dev/null +++ b/apparmor.d/profiles-a-f/earlyoom @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/earlyoom +profile earlyoom @{exec_path} { + include + + capability kill, + + @{exec_path} mr, + + @{PROC}/ r, + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/oom_adj r, + @{PROC}/@{pid}/oom_score r, + @{PROC}/@{pid}/oom_score_adj r, + @{PROC}/@{pid}/stat r, + + include if exists +} + +# vim:syntax=apparmor From 67c5181ba9de7467bc89c720d5c3b4d8c583439c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 17:38:05 +0100 Subject: [PATCH 0143/1455] fix(profile): set flags in sub profile of fwupd. --- apparmor.d/profiles-a-f/fwupd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index afb8bc367..d8fa6d355 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/{,fwupd/}fwupd -profile fwupd @{exec_path} flags=(complain,attach_disconnected) { +profile fwupd @{exec_path} flags=(attach_disconnected,complain) { include include include @@ -126,7 +126,7 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) { /dev/tpmrm@{int} rw, /dev/wmi/* r, - profile gpg flags=(complain) { + profile gpg flags=(attach_disconnected,complain) { include include From f3094cc741db28c2390991fcfa72c30d88eeb137 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:13:48 +0100 Subject: [PATCH 0144/1455] build: add the X option to the stack directive. --- docs/development/directives.md | 4 ++++ pkg/prebuild/builder/complain.go | 4 ++-- pkg/prebuild/builder/enforce.go | 4 ++-- pkg/prebuild/directive/exec.go | 4 ++++ pkg/prebuild/directive/stack.go | 18 ++++++++++++++++-- pkg/prebuild/prepare/flags.go | 4 ++-- 6 files changed, 30 insertions(+), 8 deletions(-) diff --git a/docs/development/directives.md b/docs/development/directives.md index 9cff8840e..291b0b74e 100644 --- a/docs/development/directives.md +++ b/docs/development/directives.md @@ -115,6 +115,10 @@ The `exec` directive is useful to allow executing transitions to a profile witho : List a profile **files** to stack at the end of the current profile. +**`[X]`** + +: If `X` is set, the directive will conserve the `x` file rules regardless of the transition. Not enabled by default as it may conflict with the parent profile. + **Example** diff --git a/pkg/prebuild/builder/complain.go b/pkg/prebuild/builder/complain.go index e0f9f26b5..68dcc9f48 100644 --- a/pkg/prebuild/builder/complain.go +++ b/pkg/prebuild/builder/complain.go @@ -14,7 +14,7 @@ import ( var ( regFlags = regexp.MustCompile(`flags=\(([^)]+)\)`) - regProfileHeader = regexp.MustCompile(` {`) + regProfileHeader = regexp.MustCompile(` {\n`) ) type Complain struct { @@ -40,7 +40,7 @@ func (b Complain) Apply(opt *Option, profile string) (string, error) { } } flags = append(flags, "complain") - strFlags := " flags=(" + strings.Join(flags, ",") + ") {" + strFlags := " flags=(" + strings.Join(flags, ",") + ") {\n" // Remove all flags definition, then set manifest' flags profile = regFlags.ReplaceAllLiteralString(profile, "") diff --git a/pkg/prebuild/builder/enforce.go b/pkg/prebuild/builder/enforce.go index bc25e03dc..d453da51b 100644 --- a/pkg/prebuild/builder/enforce.go +++ b/pkg/prebuild/builder/enforce.go @@ -36,9 +36,9 @@ func (b Enforce) Apply(opt *Option, profile string) (string, error) { return profile, nil } flags = slices.Delete(flags, idx, idx+1) - strFlags := "{" + strFlags := "{\n" if len(flags) >= 1 { - strFlags = " flags=(" + strings.Join(flags, ",") + ") {" + strFlags = " flags=(" + strings.Join(flags, ",") + ") {\n" } // Remove all flags definition, then set new flags diff --git a/pkg/prebuild/directive/exec.go b/pkg/prebuild/directive/exec.go index dd0d2ed0e..b77d80fa4 100644 --- a/pkg/prebuild/directive/exec.go +++ b/pkg/prebuild/directive/exec.go @@ -7,6 +7,7 @@ package directive import ( + "fmt" "slices" "strings" @@ -30,6 +31,9 @@ func init() { } func (d Exec) Apply(opt *Option, profileRaw string) (string, error) { + if len(opt.ArgList) == 0 { + return "", fmt.Errorf("No profile to exec") + } transition := "Px" transitions := []string{"P", "U", "p", "u", "PU", "pu"} t := opt.ArgList[0] diff --git a/pkg/prebuild/directive/stack.go b/pkg/prebuild/directive/stack.go index e0ab9d84e..a2079dfb9 100644 --- a/pkg/prebuild/directive/stack.go +++ b/pkg/prebuild/directive/stack.go @@ -7,6 +7,7 @@ package directive import ( "fmt" "regexp" + "slices" "strings" "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" @@ -19,7 +20,6 @@ var ( regCleanStakedRules = util.ToRegexRepl([]string{ `(?m)^.*include .*$`, ``, // Remove mandatory base abstraction `(?m)^.*@{exec_path}.*$`, ``, // Remove entry point - `(?m)^.*(|P|p)(|U|u)(|i)x,.*$`, ``, // Remove transition rules `(?m)^(?:[\t ]*(?:\r?\n))+`, ``, // Remove empty lines }) ) @@ -33,12 +33,26 @@ func init() { Base: cfg.Base{ Keyword: "stack", Msg: "Stack directive applied", - Help: Keyword + `stack profiles...`, + Help: Keyword + `stack [X] profiles...`, }, }) } func (s Stack) Apply(opt *Option, profile string) (string, error) { + if len(opt.ArgList) == 0 { + return "", fmt.Errorf("No profile to stack") + } + t := opt.ArgList[0] + if t != "X" { + regCleanStakedRules = slices.Insert(regCleanStakedRules, 0, + util.ToRegexRepl([]string{ + `(?m)^.*(|P|p)(|U|u)(|i)x,.*$`, ``, // Remove X transition rules + })..., + ) + } else { + delete(opt.ArgMap, t) + } + res := "" for name := range opt.ArgMap { stackedProfile := util.MustReadFile(cfg.RootApparmord.Join(name)) diff --git a/pkg/prebuild/prepare/flags.go b/pkg/prebuild/prepare/flags.go index cd6c2f54e..4ef41ef56 100644 --- a/pkg/prebuild/prepare/flags.go +++ b/pkg/prebuild/prepare/flags.go @@ -15,7 +15,7 @@ import ( var ( regFlags = regexp.MustCompile(`flags=\(([^)]+)\)`) - regProfileHeader = regexp.MustCompile(` {`) + regProfileHeader = regexp.MustCompile(` {\n`) ) type SetFlags struct { @@ -43,7 +43,7 @@ func (p SetFlags) Apply() ([]string, error) { // Overwrite profile flags if len(flags) > 0 { - flagsStr := " flags=(" + strings.Join(flags, ",") + ") {" + flagsStr := " flags=(" + strings.Join(flags, ",") + ") {\n" out, err := util.ReadFile(file) if err != nil { return res, err From 50b0e09a9ad141d391b9cbd3c632ec869cf9500d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:15:27 +0100 Subject: [PATCH 0145/1455] feat(profile): add fstrim. --- apparmor.d/profiles-a-f/fstrim | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 apparmor.d/profiles-a-f/fstrim diff --git a/apparmor.d/profiles-a-f/fstrim b/apparmor.d/profiles-a-f/fstrim new file mode 100644 index 000000000..e49108044 --- /dev/null +++ b/apparmor.d/profiles-a-f/fstrim @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/fstrim +profile fstrim @{exec_path} { + include + include + + capability dac_override, + capability sys_admin, + + @{exec_path} mr, + + /etc/fstab r, + + @{HOMEDIRS}/ r, + @{MOUNTDIRS}/ r, + @{MOUNTS}/ r, + / r, + /boot/ r, + /var/ r, + + include if exists +} + +# vim:syntax=apparmor From 49b8967bb2680b44ce1c8d7d5e2c3a5c088693d4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:20:41 +0100 Subject: [PATCH 0146/1455] feat(profile): improve the use of org.chromium.Chromium.@{rand6}. --- apparmor.d/groups/browsers/brave | 7 +------ apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/profiles-g-l/git | 2 +- 3 files changed, 3 insertions(+), 8 deletions(-) diff --git a/apparmor.d/groups/browsers/brave b/apparmor.d/groups/browsers/brave index a47652600..4d065dce4 100644 --- a/apparmor.d/groups/browsers/brave +++ b/apparmor.d/groups/browsers/brave @@ -8,7 +8,7 @@ abi , include @{name} = brave{,-beta,-dev,-bin} -@{domain} = com.brave.Brave +@{domain} = com.brave.Brave org.chromium.Chromium @{lib_dirs} = /opt/brave{-bin,.com}{,/@{name}} @{config_dirs} = @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev} @{cache_dirs} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev} @@ -43,11 +43,6 @@ profile brave @{exec_path} { owner @{tmp}/net-export/ rw, # For brave://net-export/ - owner @{tmp}/.org.chromium.Chromium.* rwk, - owner @{tmp}/.org.chromium.Chromium*/{,**} rw, - - owner /dev/shm/.org.chromium.Chromium.* rw, - # Silencer deny /etc/opt/chrome/ w, deny /dev/disk/by-uuid/ r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 29ced8dd9..b6420b348 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -294,7 +294,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw, owner @{run}/user/@{uid}/systemd/notify rw, - owner /dev/shm/.org.chromium.Chromium.* rw, + owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, /tmp/.X@{int}-lock rw, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index af7fbd4df..edacd92e1 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -105,7 +105,7 @@ profile git @{exec_path} flags=(attach_disconnected) { deny owner @{user_share_dirs}/gvfs-metadata/* r, deny owner @{user_share_dirs}/zed/**/data.mdb rw, deny /usr/share/nvidia/nvidia-application-profiles-* r, - deny /dev/shm/.org.chromium.Chromium* rw, + deny /dev/shm/.org.chromium.Chromium.@{rand6} rw, profile gpg flags=(attach_disconnected) { include From e4f963f30f69ce3ae82e51b7daf2cb99f07a7f71 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:38:59 +0100 Subject: [PATCH 0147/1455] feat(aa-log): add some util functions. --- pkg/util/slice.go | 81 ++++++++++++++++++++++++++++ pkg/util/slice_test.go | 120 +++++++++++++++++++++++++++++++++++++++++ pkg/util/tools.go | 34 ------------ pkg/util/tools_test.go | 68 ----------------------- 4 files changed, 201 insertions(+), 102 deletions(-) create mode 100644 pkg/util/slice.go create mode 100644 pkg/util/slice_test.go diff --git a/pkg/util/slice.go b/pkg/util/slice.go new file mode 100644 index 000000000..defd9703a --- /dev/null +++ b/pkg/util/slice.go @@ -0,0 +1,81 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2023-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package util + +// RemoveDuplicate filter out all duplicates from a slice. Also filter out empty element. +func RemoveDuplicate[T comparable](inlist []T) []T { + var empty T + list := []T{} + seen := map[T]bool{} + seen[empty] = true + for _, item := range inlist { + if _, ok := seen[item]; !ok { + seen[item] = true + list = append(list, item) + } + } + return list +} + +// Intersect returns the intersection between two collections. +// From https://github.com/samber/lo +func Intersect[T comparable](list1 []T, list2 []T) []T { + result := []T{} + seen := map[T]struct{}{} + + for _, elem := range list1 { + seen[elem] = struct{}{} + } + + for _, elem := range list2 { + if _, ok := seen[elem]; ok { + result = append(result, elem) + } + } + + return result +} + +// Flatten returns an array a single level deep. +// From https://github.com/samber/lo +func Flatten[T comparable](collection [][]T) []T { + totalLen := 0 + for i := range collection { + totalLen += len(collection[i]) + } + + result := make([]T, 0, totalLen) + for i := range collection { + result = append(result, collection[i]...) + } + + return result +} + +// Invert creates a map composed of the inverted keys and values. If map +// contains duplicate values, subsequent values overwrite property assignments +// of previous values. +// Play: https://go.dev/play/p/rFQ4rak6iA1 +func Invert[K comparable, V comparable](in map[K]V) map[V]K { + out := make(map[V]K, len(in)) + + for k := range in { + out[in[k]] = k + } + + return out +} + +func InvertFlatten[V comparable](in map[V][]V) map[V]V { + out := make(map[V]V, len(in)) + + for k := range in { + for _, v := range in[k] { + out[v] = k + } + } + + return out +} diff --git a/pkg/util/slice_test.go b/pkg/util/slice_test.go new file mode 100644 index 000000000..11f05a711 --- /dev/null +++ b/pkg/util/slice_test.go @@ -0,0 +1,120 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2023-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package util + +import ( + "reflect" + "testing" +) + +func TestRemoveDuplicate(t *testing.T) { + tests := []struct { + name string + inlist []string + want []string + }{ + { + name: "Duplicate", + inlist: []string{"foo", "bar", "foo", "bar", ""}, + want: []string{"foo", "bar"}, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := RemoveDuplicate(tt.inlist); !reflect.DeepEqual(got, tt.want) { + t.Errorf("RemoveDuplicate() = %v, want %v", got, tt.want) + } + }) + } +} + +func TestIntersect(t *testing.T) { + tests := []struct { + name string + list1 []int + list2 []int + want []int + }{ + { + name: "1", + list1: []int{0, 1, 2, 3, 4, 5}, + list2: []int{0, 2}, + want: []int{0, 2}, + }, + { + name: "2", + list1: []int{0, 1, 2, 3, 4, 5}, + list2: []int{0, 6}, + want: []int{0}, + }, + { + name: "3", + list1: []int{0, 1, 2, 3, 4, 5}, + list2: []int{-1, 6}, + want: []int{}, + }, + { + name: "4", + list1: []int{0, 6}, + list2: []int{0, 1, 2, 3, 4, 5}, + want: []int{0}, + }, + { + name: "5", + list1: []int{0, 6, 0}, + list2: []int{0, 1, 2, 3, 4, 5}, + want: []int{0}, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := Intersect(tt.list1, tt.list2); !reflect.DeepEqual(got, tt.want) { + t.Errorf("Intersect() = %v, want %v", got, tt.want) + } + }) + } +} + +func TestFlatten(t *testing.T) { + tests := []struct { + name string + input [][]int + want []int + }{ + { + name: "1", + input: [][]int{{0, 1}, {2, 3, 4, 5}}, + want: []int{0, 1, 2, 3, 4, 5}, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := Flatten(tt.input); !reflect.DeepEqual(got, tt.want) { + t.Errorf("Intersect() = %v, want %v", got, tt.want) + } + }) + } +} + +func TestInvert(t *testing.T) { + tests := []struct { + name string + input map[string]int + want map[int]string + }{ + { + name: "1", + input: map[string]int{"a": 1, "b": 2}, + want: map[int]string{1: "a", 2: "b"}, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := Invert(tt.input); !reflect.DeepEqual(got, tt.want) { + t.Errorf("Invert() = %v, want %v", got, tt.want) + } + }) + } +} diff --git a/pkg/util/tools.go b/pkg/util/tools.go index 30d5251d6..0d3372fcc 100644 --- a/pkg/util/tools.go +++ b/pkg/util/tools.go @@ -67,40 +67,6 @@ func DecodeHexInString(str string) string { return str } -// RemoveDuplicate filter out all duplicates from a slice. Also filter out empty element. -func RemoveDuplicate[T comparable](inlist []T) []T { - var empty T - list := []T{} - seen := map[T]bool{} - seen[empty] = true - for _, item := range inlist { - if _, ok := seen[item]; !ok { - seen[item] = true - list = append(list, item) - } - } - return list -} - -// Intersect returns the intersection between two collections. -// From https://github.com/samber/lo -func Intersect[T comparable](list1 []T, list2 []T) []T { - result := []T{} - seen := map[T]struct{}{} - - for _, elem := range list1 { - seen[elem] = struct{}{} - } - - for _, elem := range list2 { - if _, ok := seen[elem]; ok { - result = append(result, elem) - } - } - - return result -} - // CopyTo recursivelly copy all files from a source path to a destination path. func CopyTo(src *paths.Path, dst *paths.Path) error { files, err := src.ReadDirRecursiveFiltered(nil, diff --git a/pkg/util/tools_test.go b/pkg/util/tools_test.go index 4d5cade6a..df45d92b7 100644 --- a/pkg/util/tools_test.go +++ b/pkg/util/tools_test.go @@ -38,74 +38,6 @@ func TestDecodeHexInString(t *testing.T) { } } -func TestRemoveDuplicate(t *testing.T) { - tests := []struct { - name string - inlist []string - want []string - }{ - { - name: "Duplicate", - inlist: []string{"foo", "bar", "foo", "bar", ""}, - want: []string{"foo", "bar"}, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - if got := RemoveDuplicate(tt.inlist); !reflect.DeepEqual(got, tt.want) { - t.Errorf("RemoveDuplicate() = %v, want %v", got, tt.want) - } - }) - } -} - -func TestIntersect(t *testing.T) { - tests := []struct { - name string - list1 []int - list2 []int - want []int - }{ - { - name: "1", - list1: []int{0, 1, 2, 3, 4, 5}, - list2: []int{0, 2}, - want: []int{0, 2}, - }, - { - name: "2", - list1: []int{0, 1, 2, 3, 4, 5}, - list2: []int{0, 6}, - want: []int{0}, - }, - { - name: "3", - list1: []int{0, 1, 2, 3, 4, 5}, - list2: []int{-1, 6}, - want: []int{}, - }, - { - name: "4", - list1: []int{0, 6}, - list2: []int{0, 1, 2, 3, 4, 5}, - want: []int{0}, - }, - { - name: "5", - list1: []int{0, 6, 0}, - list2: []int{0, 1, 2, 3, 4, 5}, - want: []int{0}, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - if got := Intersect(tt.list1, tt.list2); !reflect.DeepEqual(got, tt.want) { - t.Errorf("Intersect() = %v, want %v", got, tt.want) - } - }) - } -} - func TestToRegexRepl(t *testing.T) { tests := []struct { name string From 3ad53a2bb087d99f25ba75b0396c94727a7e15ac Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:39:29 +0100 Subject: [PATCH 0148/1455] feat(profile): add aa-unconfined. --- apparmor.d/profiles-a-f/aa-unconfined | 44 +++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 apparmor.d/profiles-a-f/aa-unconfined diff --git a/apparmor.d/profiles-a-f/aa-unconfined b/apparmor.d/profiles-a-f/aa-unconfined new file mode 100644 index 000000000..a47fa60eb --- /dev/null +++ b/apparmor.d/profiles-a-f/aa-unconfined @@ -0,0 +1,44 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/aa-unconfined +profile aa-unconfined @{exec_path} flags=(attach_disconnected) { + include + include + include + + capability dac_read_search, + capability sys_ptrace, + + ptrace read, + + @{exec_path} mr, + + @{bin}/ r, + @{bin}/netstat Px, + @{bin}/ss Px, + + /usr/share/terminfo/** r, + + /etc/apparmor/logprof.conf r, + @{etc_ro}/inputrc r, + + owner @{tmp}/@{rand8} rw, + owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, + owner /var/tmp/@{rand8} rw, + + @{PROC}/ r, + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pids}/attr/apparmor/current r, + @{PROC}/@{pids}/attr/current r, + owner @{PROC}/@{pid}/mounts r, + + include if exists +} + +# vim:syntax=apparmor From 9cd1939ddc0c871ec9ca511e5e13003da2c49240 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:41:01 +0100 Subject: [PATCH 0149/1455] feat(abs): improve the app-launcher* abs. --- apparmor.d/abstractions/app-launcher-root | 4 ++-- apparmor.d/abstractions/app-launcher-user | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/apparmor.d/abstractions/app-launcher-root b/apparmor.d/abstractions/app-launcher-root index c31d328fb..2aaecbd21 100644 --- a/apparmor.d/abstractions/app-launcher-root +++ b/apparmor.d/abstractions/app-launcher-root @@ -3,8 +3,8 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - @{bin}/* PUx, - /usr/local/{s,}bin/* PUx, + @{bin}/** PUx, + /usr/local/{s,}bin/** PUx, @{bin}/ r, / r, diff --git a/apparmor.d/abstractions/app-launcher-user b/apparmor.d/abstractions/app-launcher-user index edf96b05a..04b20e84d 100644 --- a/apparmor.d/abstractions/app-launcher-user +++ b/apparmor.d/abstractions/app-launcher-user @@ -3,10 +3,10 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - @{bin}/* PUx, + @{bin}/** PUx, /opt/*/** PUx, - /usr/share/*/* PUx, - /usr/local/bin/* PUx, + /usr/share/** PUx, + /usr/local/bin/** PUx, @{brave_path} Px, @{chrome_path} Px, From 7f594d51b5f6eb1c911cdecf9b22783d690ea72f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:49:33 +0100 Subject: [PATCH 0150/1455] feat(tunable): add the new @{arch} variable. --- apparmor.d/profiles-s-z/steam | 1 - apparmor.d/profiles-s-z/steam-fossilize | 1 - apparmor.d/profiles-s-z/steam-game-native | 1 - apparmor.d/profiles-s-z/steam-game-proton | 1 - apparmor.d/profiles-s-z/steam-gameoverlayui | 1 - apparmor.d/profiles-s-z/steam-launch | 1 - apparmor.d/profiles-s-z/steam-launcher | 1 - apparmor.d/profiles-s-z/steam-runtime | 1 - apparmor.d/profiles-s-z/steam-runtime-steam-remote | 1 - apparmor.d/profiles-s-z/steamerrorreporter | 1 - apparmor.d/tunables/multiarch.d/system | 3 +++ pkg/aa/apparmor.go | 1 + 12 files changed, 4 insertions(+), 10 deletions(-) diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index d8e0a50c5..0828786d5 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -21,7 +21,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} diff --git a/apparmor.d/profiles-s-z/steam-fossilize b/apparmor.d/profiles-s-z/steam-fossilize index b33c90d8b..1786a5e40 100644 --- a/apparmor.d/profiles-s-z/steam-fossilize +++ b/apparmor.d/profiles-s-z/steam-fossilize @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steam-game-native b/apparmor.d/profiles-s-z/steam-game-native index 2817006f2..4246f7870 100644 --- a/apparmor.d/profiles-s-z/steam-game-native +++ b/apparmor.d/profiles-s-z/steam-game-native @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton index 95eec5abc..8f1939bd1 100644 --- a/apparmor.d/profiles-s-z/steam-game-proton +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui index d6680ac61..ae01bf5d3 100644 --- a/apparmor.d/profiles-s-z/steam-gameoverlayui +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steam-launch b/apparmor.d/profiles-s-z/steam-launch index b1d820d86..975e432a6 100644 --- a/apparmor.d/profiles-s-z/steam-launch +++ b/apparmor.d/profiles-s-z/steam-launch @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steam-launcher b/apparmor.d/profiles-s-z/steam-launcher index 45fa30245..2605c15f1 100644 --- a/apparmor.d/profiles-s-z/steam-launcher +++ b/apparmor.d/profiles-s-z/steam-launcher @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index 6fde5418f..add024de7 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steam-runtime-steam-remote b/apparmor.d/profiles-s-z/steam-runtime-steam-remote index 4f256ef2d..1a6dd4063 100644 --- a/apparmor.d/profiles-s-z/steam-runtime-steam-remote +++ b/apparmor.d/profiles-s-z/steam-runtime-steam-remote @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/profiles-s-z/steamerrorreporter b/apparmor.d/profiles-s-z/steamerrorreporter index 3e206e898..1d55e59af 100644 --- a/apparmor.d/profiles-s-z/steamerrorreporter +++ b/apparmor.d/profiles-s-z/steamerrorreporter @@ -6,7 +6,6 @@ abi , include -@{arch} = amd64 i386 @{runtime} = SteamLinuxRuntime_sniper @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index b2e1a3b0b..9684cba18 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -91,6 +91,9 @@ @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 +# Common architecture names +@{arch}=x86_64 amd64 i386 + # OpenSUSE does not have the same multiarch structure @{multiarch}+=*-suse-linux* #aa:only opensuse diff --git a/pkg/aa/apparmor.go b/pkg/aa/apparmor.go index ad3915983..a887d4b98 100644 --- a/pkg/aa/apparmor.go +++ b/pkg/aa/apparmor.go @@ -32,6 +32,7 @@ func NewAppArmorProfile() *AppArmorProfileFile { func DefaultTunables() *AppArmorProfileFile { return &AppArmorProfileFile{ Preamble: Rules{ + &Variable{Name: "arch", Values: []string{"x86_64", "amd64", "i386"}, Define: true}, &Variable{Name: "bin", Values: []string{"/{,usr/}{,s}bin"}, Define: true}, &Variable{Name: "c", Values: []string{"[0-9a-zA-Z]"}, Define: true}, &Variable{Name: "etc_ro", Values: []string{"/{,usr/}etc/"}, Define: true}, From 9ea9f1eeedb8a6f1fa9b337c404b4c19ab489e42 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Sep 2024 18:55:41 +0100 Subject: [PATCH 0151/1455] feat(tunable): add the new @{u8} and @{u16} variable. --- apparmor.d/tunables/multiarch.d/system | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 9684cba18..c6b22f9e0 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -14,6 +14,13 @@ # Integer up to 10 digits (0-9999999999) @{int}=[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],} +# Unsigned integer over 8 bits (0-255) +# 0 - 99 100 - 199 200 - 249 250 - 255 +@{u8}=[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5] + +# Unsigned integer over 16 bits (0-65535, 5 digits) +@{u16}=[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],} + # hexadecimal, alphanumeric up to 64 characters @{hex}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} @{rand}=@{c}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},} From c622f5de93deb9b9c7105f95aca74d958507dfc7 Mon Sep 17 00:00:00 2001 From: odomingao Date: Tue, 10 Sep 2024 20:15:39 -0300 Subject: [PATCH 0152/1455] Add support for controllers in game abstraction --- apparmor.d/abstractions/common/game | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/common/game b/apparmor.d/abstractions/common/game index 609bb521d..678327f09 100644 --- a/apparmor.d/abstractions/common/game +++ b/apparmor.d/abstractions/common/game @@ -108,6 +108,7 @@ /dev/hidraw@{int} rw, /dev/input/ r, /dev/input/event@{int} rw, + /dev/input/js@{int} rw, /dev/tty rw, /dev/uinput rw, From 6539b713fbc06c41349de5d1b67c5a93251a0b22 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Sep 2024 17:54:34 +0100 Subject: [PATCH 0153/1455] feat(profile): general update. --- .../polkit-mate-authentication-agent | 16 ++++------------ apparmor.d/groups/freedesktop/xdg-dbus-proxy | 2 +- .../groups/freedesktop/xdg-desktop-portal | 2 +- .../freedesktop/xdg-desktop-portal-hyprland | 9 +++++---- apparmor.d/groups/gpg/gpg-agent | 18 ++++++++++-------- .../groups/gvfs/gvfs-udisks2-volume-monitor | 1 - apparmor.d/groups/network/NetworkManager | 10 +++------- apparmor.d/groups/network/tailscaled | 15 +-------------- apparmor.d/groups/pacman/makepkg | 4 ++++ apparmor.d/groups/pacman/pacman | 6 ++++-- apparmor.d/profiles-a-f/aa-enforce | 4 ++-- apparmor.d/profiles-a-f/aa-notify | 2 +- apparmor.d/profiles-a-f/calibre | 15 +-------------- apparmor.d/profiles-a-f/filezilla | 4 +++- apparmor.d/profiles-a-f/freetube | 13 ++++--------- apparmor.d/profiles-g-l/git | 8 ++------ apparmor.d/profiles-s-z/signal-desktop | 6 ++++-- apparmor.d/profiles-s-z/telegram-desktop | 4 ++++ apparmor.d/profiles-s-z/udisksctl | 4 ++++ apparmor.d/profiles-s-z/waybar | 7 +++++++ apparmor.d/tunables/multiarch.d/programs | 2 +- 21 files changed, 66 insertions(+), 86 deletions(-) diff --git a/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent b/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent index 762882b74..3aa47de3c 100644 --- a/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent @@ -11,13 +11,9 @@ include profile polkit-mate-authentication-agent @{exec_path} { include include - include - include + include include - include - include - include - include + include include signal (send) set=(term, kill) peer=polkit-agent-helper, @@ -26,19 +22,15 @@ profile polkit-mate-authentication-agent @{exec_path} { @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx, - /usr/share/X11/xkb/** r, - /var/lib/dbus/machine-id r, /etc/machine-id r, - owner @{HOME}/.Xauthority r, - - owner /dev/tty@{int} rw, - @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, + owner /dev/tty@{int} rw, + include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index dea66efb8..51d9fdddb 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -23,7 +23,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Realtime - member=MakeThreadRealtimeWithPID + member=MakeThread* peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal), @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 702b0088d..5d908e67b 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -78,8 +78,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { /var/lib/gdm{,3}/greeter-dconf-defaults r, - owner @{user_config_dirs}/xdg-desktop-portal/* r, @{user_config_dirs}/kioslaverc r, + owner @{user_config_dirs}/xdg-desktop-portal/* r, owner @{tmp}/icon* rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland index 73e8e734a..05c12eaf3 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 odomingao +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -26,10 +27,10 @@ profile xdg-desktop-portal-hyprland @{exec_path} { owner /tmp/hypr/\#@{int} rwkl, owner /tmp/hypr/hyprland-share-picker.conf* rwkl, - /sys/devices/virtual/dmi/id/bios_vendor r, - /sys/devices/virtual/dmi/id/board_vendor r, - /sys/devices/virtual/dmi/id/product_name r, - /sys/devices/virtual/dmi/id/sys_vendor r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, owner @{PROC}/@{pid}/cmdline r, diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index d97327969..3d240828b 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -27,54 +27,56 @@ profile gpg-agent @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/*.conf r, owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw, owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key{,.tmp} rw, - owner @{HOME}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{HOME}/@{XDG_GPG_DIR}/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{HOME}/@{XDG_GPG_DIR}/sshcontrol r, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/ rw, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/*.conf r, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/@{hex}.key{,.tmp} rw, - owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{MOUNTS}/{,/*}/@{XDG_GPG_DIR}/sshcontrol r, owner @{user_projects_dirs}/**/{.,}gnupg/ rw, owner @{user_projects_dirs}/**/{.,}gnupg/*.conf r, owner @{user_projects_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw, owner @{user_projects_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, - owner @{user_projects_dirs}/**/{.,}gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{user_projects_dirs}/**/{.,}gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{user_projects_dirs}/**/{.,}gnupg/sshcontrol r, owner @{run}/user/@{uid}/gnupg/ rw, owner @{run}/user/@{uid}/gnupg/*.conf r, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/ rw, owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, - owner @{run}/user/@{uid}/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{run}/user/@{uid}/gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{run}/user/@{uid}/gnupg/sshcontrol r, owner @{user_tmp_dirs}/**/{.,}gnupg/ rw, owner @{user_tmp_dirs}/**/{.,}gnupg/*.conf r, owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw, owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, - owner @{user_tmp_dirs}/**/{.,}gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{user_tmp_dirs}/**/{.,}gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{user_tmp_dirs}/**/{.,}gnupg/sshcontrol r, #aa:only pacman owner /etc/pacman.d/gnupg/ rw, owner /etc/pacman.d/gnupg/private-keys-v1.d/ rw, owner /etc/pacman.d/gnupg/private-keys-v1.d/@{hex}.key rw, - owner /etc/pacman.d/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner /etc/pacman.d/gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner /etc/pacman.d/gnupg/sshcontrol r, owner /var/lib/*/.gnupg/ rw, owner /var/lib/*/.gnupg/private-keys-v1.d/ rw, owner /var/lib/*/.gnupg/private-keys-v1.d/@{hex}.key rw, - owner /var/lib/*/.gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner /var/lib/*/.gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner /var/lib/*/.gnupg/sshcontrol r, owner /var/lib/*/gnupg/ rw, owner /var/lib/*/gnupg/private-keys-v1.d/ rw, owner /var/lib/*/gnupg/private-keys-v1.d/@{hex}.key rw, - owner /var/lib/*/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner /var/lib/*/gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner /var/lib/*/gnupg/sshcontrol r, #aa:only zypper diff --git a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor index 8c8a1c069..477354574 100644 --- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor @@ -12,7 +12,6 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index f8612b4dc..7f9b5adf6 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -43,6 +43,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=system name=org.freedesktop.NetworkManager + #aa:dbus talk bus=system name=org.fedoraproject.FirewallD1 label=firewalld #aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher #aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved @@ -61,11 +62,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { member=GetManagedObjects peer=(name=:*, label=bluetoothd), - dbus send bus=system path=/org/fedoraproject/FirewallD1 - interface=org.fedoraproject.FirewallD1.zone - member={changeZoneOfInterface,removeInterface} - peer=(name=org.freedesktop.DBus, label=firewalld), - dbus send bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager member=InterfacesAdded @@ -134,13 +130,13 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/net/*/{,**} r, @{sys}/devices/@{pci}/usb@{int}/**/net/{,**} r, - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/fd/ r, @{PROC}/@{pids}/stat r, @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, @{PROC}/sys/net/** rw, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd/ r, /dev/rfkill rw, diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index dd3f253db..14d73b356 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -30,20 +30,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) { ptrace (read), - dbus send bus=system path=/org/freedesktop/resolve1 - interface=org.freedesktop.DBus.Peer - member=Ping - peer=(name=org.freedesktop.resolve1, label=systemd-resolved), - - dbus send bus=system path=/org/freedesktop/resolve1 - interface=org.freedesktop.DBus.Properties - member=Get - peer=(name=org.freedesktop.resolve1, label=systemd-resolved), - - dbus send bus=system path=/org/freedesktop/resolve1 - interface=org.freedesktop.resolve1.Manager - member={FlushCaches,SetLink*} - peer=(name=org.freedesktop.resolve1, label=systemd-resolved), + #aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved @{exec_path} mr, diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index d62e509e9..311135eae 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -11,6 +11,9 @@ profile makepkg @{exec_path} { include include + signal send set=winch peer=pacman, + signal send set=winch peer=pacman//systemctl, + network inet stream, network inet6 stream, network inet dgram, @@ -48,6 +51,7 @@ profile makepkg @{exec_path} { owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/gnupg/ r, owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw, owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index c1dbb002e..48778d6e4 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -37,9 +37,10 @@ profile pacman @{exec_path} flags=(attach_disconnected) { network netlink raw, network unix stream, - ptrace (read), + ptrace read, - signal (send) set=(usr1) peer=gvfsd, + signal send set=usr1 peer=gvfsd, + signal receive set=winch peer=makepkg//sudo, @{exec_path} mrix, @@ -194,6 +195,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { capability sys_resource, signal send set=cont peer=child-pager, + signal receive set=winch peer=makepkg//sudo, @{pager_path} rPx -> child-pager, diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index 84ba22fba..3a803756c 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -29,8 +29,8 @@ profile aa-enforce @{exec_path} { owner /snap/core@{int}/@{int}/etc/apparmor.d/{,**} rw, owner /var/lib/snapd/apparmor/{,**} rw, - /tmp/@{rand8} rw, - /tmp/apparmor-bugreport-@{rand8}.txt rw, + owner @{tmp}/@{rand8} rw, + owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, owner @{PROC}/@{pid}/fd r, diff --git a/apparmor.d/profiles-a-f/aa-notify b/apparmor.d/profiles-a-f/aa-notify index 7c65b9be2..f2ff96df4 100644 --- a/apparmor.d/profiles-a-f/aa-notify +++ b/apparmor.d/profiles-a-f/aa-notify @@ -35,7 +35,7 @@ profile aa-notify @{exec_path} { owner @{HOME}/.terminfo/@{int}/dumb r, owner @{tmp}/@{rand8} rw, - owner @{tmp}/apparmor-bugreport-*.txt rw, + owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, @{PROC}/ r, @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/profiles-a-f/calibre b/apparmor.d/profiles-a-f/calibre index d58a8d042..c00490a75 100644 --- a/apparmor.d/profiles-a-f/calibre +++ b/apparmor.d/profiles-a-f/calibre @@ -94,6 +94,7 @@ profile calibre @{exec_path} { @{PROC}/ r, @{PROC}/@{pids}/net/route r, @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/yama/ptrace_scope r, @{PROC}/vmstat r, owner @{PROC}/@{pid}/cmdline r, @@ -102,24 +103,10 @@ profile calibre @{exec_path} { owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_{,score_}adj rw, - owner @{PROC}/@{pid}/stat{,m} r, - owner @{PROC}/@{pid}/stat{,m} r, - owner @{PROC}/@{pid}/comm r, owner @{PROC}/@{pid}/stat{,m} r, - owner @{PROC}/@{pid}/comm r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner @{PROC}/@{pid}/task/@{tid}/status r, - owner @{PROC}/@{pid}/task/@{tid}/status r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - deny owner @{PROC}/@{pid}/cmdline r, - deny owner @{PROC}/@{pid}/oom_{,score_}adj rw, - deny @{PROC}/sys/kernel/random/boot_id r, owner @{PROC}/@{pid}/task/@{tid}/status r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - deny owner @{PROC}/@{pid}/cmdline r, - deny owner @{PROC}/@{pid}/oom_{,score_}adj rw, - deny @{PROC}/sys/kernel/random/boot_id r, owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-a-f/filezilla b/apparmor.d/profiles-a-f/filezilla index 2ec1a542f..8b3786eb5 100644 --- a/apparmor.d/profiles-a-f/filezilla +++ b/apparmor.d/profiles-a-f/filezilla @@ -13,6 +13,7 @@ profile filezilla @{exec_path} { include include include + include include include include @@ -27,7 +28,7 @@ profile filezilla @{exec_path} { network netlink dgram, network netlink raw, - signal (send) set=(term, kill) peer=fzsftp, + signal send set=(term, kill) peer=fzsftp, @{exec_path} mr, @@ -65,6 +66,7 @@ profile filezilla @{exec_path} { owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + /dev/tty rw, owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index a3d655d87..7d9a5f59e 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -7,7 +7,7 @@ abi , include -@{name} = {F,f}reetube{,-vue} +@{name} = {F,f}ree{T,t}ube{,-vue} @{lib_dirs} = @{lib}/@{name} /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} @@ -16,11 +16,11 @@ include profile freetube @{exec_path} { include include + include include include include include - include include network inet dgram, @@ -35,13 +35,8 @@ profile freetube @{exec_path} { @{open_path} rPx -> child-open-strict, - /etc/fstab r, - /etc/machine-id r, - /var/lib/dbus/machine-id r, - - owner @{run}/user/@{uid}/ r, - - owner /dev/tty@{int} rw, + #aa:stack X xdg-settings + @{bin}/xdg-settings rPx -> freetube//&xdg-settings, include if exists } diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index edacd92e1..30ce7e1e8 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -92,14 +92,9 @@ profile git @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.netrc r, owner @{user_config_dirs}/git/{,*} rw, - owner @{tmp}/git-difftool.*/ rw, # For diffs - owner @{tmp}/git-difftool.*/right/{,**} rw, - owner @{tmp}/git-difftool.*/left/{,**} rw, - owner @{tmp}/* rw, - owner @{tmp}/tmp*/ rw, # For TWRP-device-tree-generator - owner @{tmp}/tmp*/** rwkl -> /tmp/tmp*/**, owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature owner @{tmp}/git-commit-msg-.txt rw, # For android studio + owner @{tmp}/git-difftool.*/{,**} rw, # For diffs deny owner @{code_config_dirs}/** rw, deny owner @{user_share_dirs}/gvfs-metadata/* r, @@ -126,6 +121,7 @@ profile git @{exec_path} flags=(attach_disconnected) { profile ssh flags=(attach_disconnected) { include + include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index e50d95764..73474ce7f 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -31,11 +31,13 @@ profile signal-desktop @{exec_path} { @{exec_path} mrix, - @{bin}/basename rix, + # @{bin}/basename rix, @{bin}/getconf rix, - @{bin}/xdg-settings rix, @{open_path} rPx -> child-open-strict, + #aa:stack X xdg-settings + @{bin}/xdg-settings rPx -> signal-desktop//&xdg-settings, + audit @{lib_dirs}/chrome-sandbox rPx, @{lib_dirs}/chrome_crashpad_handler rix, diff --git a/apparmor.d/profiles-s-z/telegram-desktop b/apparmor.d/profiles-s-z/telegram-desktop index 416c97d72..a31d4c601 100644 --- a/apparmor.d/profiles-s-z/telegram-desktop +++ b/apparmor.d/profiles-s-z/telegram-desktop @@ -26,6 +26,7 @@ profile telegram-desktop @{exec_path} { include include include + include network inet dgram, network inet6 dgram, @@ -47,10 +48,13 @@ profile telegram-desktop @{exec_path} { owner @{tmp}/@{hex32}-?@{uuid}? rwk, audit owner /dev/shm/#@{int} rw, + @{sys}/kernel/mm/transparent_hugepage/enabled r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-s-z/udisksctl b/apparmor.d/profiles-s-z/udisksctl index 63e8b7c79..5e7320a63 100644 --- a/apparmor.d/profiles-s-z/udisksctl +++ b/apparmor.d/profiles-s-z/udisksctl @@ -10,6 +10,10 @@ include @{exec_path} = @{bin}/udisksctl profile udisksctl @{exec_path} { include + include + include + + #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index 127945081..3646a616d 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -22,15 +22,22 @@ profile waybar @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + /etc/machine-id r, + owner @{user_config_dirs}/waybar/{,**} r, @{sys}/devices/virtual/dmi/id/bios_vendor r, @{sys}/devices/virtual/dmi/id/board_vendor r, @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{sys}/devices/system/cpu/present r, + @{PROC}/@{pid}/net/dev r, + @{PROC}/spl/kstat/zfs/arcstats r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + /dev/rfkill r, + owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 8dd2f237c..5c18c1b28 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -71,7 +71,7 @@ @{file_explorers_names} = dolphin nautilus thunar # Text editors -@{text_editors_names} = code gedit mousepad gnome-text-editor +@{text_editors_names} = code gedit mousepad gnome-text-editor zeditor zedit zed-cli # Document viewers @{document_viewers_names} = evince okular *{F,f}oliate YACReader From eb9e0c13ae4578c78e751103a22e59037008b403 Mon Sep 17 00:00:00 2001 From: odomingao Date: Wed, 11 Sep 2024 13:24:51 -0300 Subject: [PATCH 0154/1455] Update hyprland profile with version 0.43 --- apparmor.d/groups/hyprland/hyprland | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 5fa0ce84b..8327c14cd 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -10,6 +10,7 @@ include profile hyprland @{exec_path} flags=(attach_disconnected) { include include + include include include From 04c2cabeb636dc98faa8a9aaae1d7f2ed9ea9138 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Sep 2024 19:40:01 +0100 Subject: [PATCH 0155/1455] feat(profile): remove linssid profile. --- apparmor.d/profiles-g-l/linssid | 113 -------------------------------- 1 file changed, 113 deletions(-) delete mode 100644 apparmor.d/profiles-g-l/linssid diff --git a/apparmor.d/profiles-g-l/linssid b/apparmor.d/profiles-g-l/linssid deleted file mode 100644 index 615f51b62..000000000 --- a/apparmor.d/profiles-g-l/linssid +++ /dev/null @@ -1,113 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2020-2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/linssid @{bin}/linssid-pkexec -profile linssid @{exec_path} { - include - include - include - include - include - include - include - include - include - include - - # For reading/saving config/log files when linssid is started via pkexec - #capability dac_read_search, - #capability dac_override, - - # Needed? - deny capability sys_admin, - deny capability sys_nice, - - @{exec_path} mr, - - @{sh_path} rix, - @{bin}/cat rix, - - # When linssid is run as root, it wants to exec dbus-launch, and hence it creates the two - # following root processes: - # dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr - # /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session - # - # Should this be allowed? Linssid works fine without this. - #@{bin}/dbus-launch rCx -> dbus, - #@{bin}/dbus-send rCx -> dbus, - deny @{bin}/dbus-launch rx, - deny @{bin}/dbus-send rx, - - @{bin}/iw rCx -> iw, - @{bin}/pkexec rPx, - - # For regular run as root user - owner @{HOME}/.linssid.prefs rw, - owner @{HOME}/LinSSID.datalog rw, - # For pkexec - #@{HOME}/.linssid.prefs rw, - #@{HOME}/LinSSID.datalog rw, - - /usr/share/linssid/{,*} r, - - /usr/share/hwdata/pnp.ids r, - - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/net/wireless r, - owner @{PROC}/@{pid}/cmdline r, - - owner @{tmp}/runtime-root/ rw, - owner @{tmp}/linssid_* rw, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - # For shell pwd - /root/ r, - - # file_inherit - owner /dev/tty@{int} rw, - - - profile iw { - include - - capability net_admin, - deny capability sys_module, - - network netlink raw, - - @{bin}/iw mr, - - # file_inherit - owner @{HOME}/.linssid.prefs rw, - owner @{HOME}/LinSSID.datalog rw, - owner @{tmp}/linssid_* rw, - owner /dev/dri/card@{int} rw, - - } - - profile dbus { - include - include - - @{bin}/dbus-launch mr, - @{bin}/dbus-send mr, - @{bin}/dbus-daemon rPUx, - - # for dbus-launch - owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, - - @{HOME}/.Xauthority r, - } - - include if exists -} - -# vim:syntax=apparmor From 64c2ee5fe9391a1ed35a4ab79bc08c2abf6ba0d4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Sep 2024 19:48:31 +0100 Subject: [PATCH 0156/1455] feat(abs): add app/bus Useful to confine dbus access in scripts. --- apparmor.d/abstractions/app/bus | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 apparmor.d/abstractions/app/bus diff --git a/apparmor.d/abstractions/app/bus b/apparmor.d/abstractions/app/bus new file mode 100644 index 000000000..d1d0d8cb7 --- /dev/null +++ b/apparmor.d/abstractions/app/bus @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Minimal set of rules for dbus-send/dbus-launch. + + include + + @{bin}/dbus-launch mix, + @{bin}/dbus-send mix, + + @{bin}/dbus-daemon Px -> dbus-session, + + owner @{HOME}/.dbus/session-bus/@{hex}-@{int} w, + + include if exists + +# vim:syntax=apparmor From 0fdf514418aa97c80afc9ec1c257f95c28fc0f82 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Sep 2024 19:50:50 +0100 Subject: [PATCH 0157/1455] feat(profile): update profile with dbus-send. --- apparmor.d/groups/apt/synaptic | 166 ++++++++------------------ apparmor.d/profiles-a-f/acpi-powerbtn | 18 ++- apparmor.d/profiles-a-f/dunstctl | 7 +- apparmor.d/profiles-g-l/gsmartcontrol | 76 ++++-------- apparmor.d/profiles-g-l/lxappearance | 48 ++------ 5 files changed, 96 insertions(+), 219 deletions(-) diff --git a/apparmor.d/groups/apt/synaptic b/apparmor.d/groups/apt/synaptic index fcfa2ef7c..2b8679c2a 100644 --- a/apparmor.d/groups/apt/synaptic +++ b/apparmor.d/groups/apt/synaptic @@ -10,176 +10,106 @@ include @{exec_path} = @{bin}/synaptic @{bin}/synaptic-pkexec profile synaptic @{exec_path} { include - include - include - include - include - include include + include + include include - # To remove the following errors: - # W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory - # (1: Operation not permitted) - # W: chmod 0700 of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory - # (1: Operation not permitted) - # W: chmod 0600 of file /var/lib/apt/lists/deb.debian.org_debian_dists_sid_InRelease failed - - # Item::QueueURI (1: Operation not permitted) - capability fowner, - - # To remove the following errors: - # W: chown to _apt:root of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory - # (1: Operation not permitted) - # W: chown to _apt:root of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory - # (1: Operation not permitted) capability chown, - - # To remove the following errors: - # E: setgroups 65534 failed - setgroups (1: Operation not permitted) - # E: setegid 65534 failed - setegid (1: Operation not permitted) - # E: seteuid 100 failed - seteuid (1: Operation not permitted) - # E: setgroups 0 failed - setgroups (1: Operation not permitted) - capability setuid, - capability setgid, - - # To remove the following errors: - # W: Problem unlinking the file /var/lib/apt/lists/partial/*_InRelease - - # PrepareFiles (13: Permission denied) - # E: Unable to read /var/lib/apt/lists/partial/ - open (13: Permission denied) - capability dac_read_search, - - # To remove the following errors: - # E: Failed to fetch https://**.deb rename failed, Permission denied - # (/var/cache/apt/archives/partial/*.deb -> /var/cache/apt/archives/*.deb). - # E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing? capability dac_override, - - # Needed? (##FIXME##) - capability kill, + capability dac_read_search, + capability fowner, capability fsetid, - deny capability net_admin, - deny capability sys_nice, + capability kill, + capability net_admin, + capability setgid, + capability setuid, + capability sys_nice, - signal (send) peer=apt-methods-*, + signal send peer=apt-methods-*, @{exec_path} mr, @{sh_path} rix, @{bin}/{,e,f}grep rix, - @{bin}/test rix, @{bin}/echo rix, - - # For update-apt-xapian-index - @{bin}/nice rix, @{bin}/ionice rix, + @{bin}/nice rix, + @{bin}/test rix, - # When synaptic is run as root, it wants to exec dbus-launch, and hence it creates the two - # following root processes: - # dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr - # /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session - # - # Should this be allowed? Synaptic works fine without this. - #@{bin}/dbus-launch rCx -> dbus, - #@{bin}/dbus-send rCx -> dbus, - deny @{bin}/dbus-launch rx, - deny @{bin}/dbus-send rx, - deny @{bin}/gdbus rx, - - @{bin}/ps rPx, - @{bin}/dpkg rPx, + @{bin}/adequate rPx, + @{bin}/appstreamcli rPx, @{bin}/apt-listbugs rPx, @{bin}/apt-listchanges rPx, @{bin}/apt-show-versions rPx, - @{bin}/dpkg-preconfigure rPx, + @{bin}/deborphan rPx, @{bin}/debtags rPx, + @{bin}/dpkg rPx, + @{bin}/dpkg-preconfigure rPx, @{bin}/localepurge rPx, - @{bin}/appstreamcli rPx, - @{bin}/adequate rPx, + @{bin}/lsb_release rPx -> lsb_release, + @{bin}/pkexec rPx, + @{bin}/ps rPx, + @{bin}/software-properties-gtk rPx, + @{bin}/tasksel rPx, + @{bin}/update-apt-xapian-index rPx, @{bin}/update-command-not-found rPx, /usr/share/command-not-found/cnf-update-db rPx, - @{bin}/update-apt-xapian-index rPx, - @{bin}/lsb_release rPx -> lsb_release, - @{bin}/deborphan rPx, - @{bin}/tasksel rPx, - @{bin}/pkexec rPx, - @{bin}/software-properties-gtk rPx, # Methods to use to download packages from the net @{lib}/apt/methods/* rPx, - /var/lib/apt/lists/** rw, - /var/lib/apt/lists/lock rwk, - /var/lib/apt/extended_states{,.*} rw, + /usr/share/synaptic/{,**} r, /etc/apt/apt.conf.d/99synaptic rw, + # For editing the sources.list file + /etc/apt/sources.list rwk, + /etc/apt/sources.list.d/ r, + /etc/apt/sources.list.d/*.list rw, + + /etc/fstab r, + /etc/machine-id r, + /var/lib/dbus/machine-id r, + /var/log/apt/eipp.log.xz w, /var/log/apt/{term,history}.log w, - # For editing the sources.list file - /etc/apt/sources.list.d/ r, - /etc/apt/sources.list.d/*.list rw, - /etc/apt/sources.list rwk, - - /var/lib/apt-xapian-index/index r, + /var/cache/apt/ r, + /var/cache/apt/** rwk, /var/cache/apt-xapian-index/index.[0-9]/*.glass r, /var/cache/apt-xapian-index/index.[0-9]/iamglass r, + /var/lib/apt-xapian-index/index r, /var/lib/dpkg/** r, /var/lib/dpkg/lock{,-frontend} rwk, + /var/lib/apt/lists/** rw, + /var/lib/apt/lists/lock rwk, + /var/lib/apt/extended_states{,.*} rw, - /var/lib/dbus/machine-id r, - /etc/machine-id r, + # For package building + @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, + + owner @{HOME}/.synaptic/ rw, + owner @{HOME}/.synaptic/** rwk, /tmp/ r, owner @{tmp}/apt-dpkg-install-*/ rw, owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w, - /var/cache/apt/ r, - /var/cache/apt/** rwk, - - /usr/share/synaptic/{,**} r, - owner @{HOME}/.synaptic/ rw, - owner @{HOME}/.synaptic/** rwk, @{run}/synaptic.socket w, - @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, - owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, - # To remove the following error: - # Internal Error: impossible to fork children. Synaptics is going to stop. Please report. - # errorcode: 2 - /dev/ptmx rw, - - /etc/fstab r, - - # Synaptic is a GUI app started by root, so without "owner" - @{HOME}/.Xauthority r, - - # For package building - @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, - - # file_inherit + /dev/ptmx rw, owner /dev/tty@{int} rw, + deny @{bin}/dbus-launch x, + deny @{bin}/dbus-send x, + deny @{bin}/gdbus x, deny @{user_share_dirs}/gvfs-metadata/{*,} r, - profile dbus { - include - include - - @{bin}/dbus-launch mr, - @{bin}/dbus-send mr, - @{bin}/dbus-daemon rPUx, - - # for dbus-launch - owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, - - @{HOME}/.Xauthority r, - } - include if exists } diff --git a/apparmor.d/profiles-a-f/acpi-powerbtn b/apparmor.d/profiles-a-f/acpi-powerbtn index 9372f46b4..519f7f868 100644 --- a/apparmor.d/profiles-a-f/acpi-powerbtn +++ b/apparmor.d/profiles-a-f/acpi-powerbtn @@ -11,9 +11,8 @@ profile acpi-powerbtn flags=(attach_disconnected) { /etc/acpi/powerbtn-acpi-support.sh r, - @{bin}/{ba,da,}sh rix, + @{sh_path} rix, @{bin}/{e,}grep rix, - @{bin}/dbus-send rix, @{bin}/killall5 rix, @{bin}/pgrep rix, @{bin}/pinky rix, @@ -21,10 +20,10 @@ profile acpi-powerbtn flags=(attach_disconnected) { @{bin}/shutdown rix, /etc/acpi/powerbtn.sh rix, - @{bin}/systemctl rCx -> systemctl, - @{bin}/ps rPx, - - @{bin}/fgconsole rCx -> fgconsole, + @{bin}/dbus-send Cx -> bus, + @{bin}/fgconsole Cx -> fgconsole, + @{bin}/ps Px, + @{bin}/systemctl Cx -> systemctl, /usr/share/acpi-support/** r, @@ -46,6 +45,13 @@ profile acpi-powerbtn flags=(attach_disconnected) { owner /dev/tty@{int} rw, } + profile bus flags=(complain) { + include + include + + include if exists + } + profile systemctl { include include diff --git a/apparmor.d/profiles-a-f/dunstctl b/apparmor.d/profiles-a-f/dunstctl index 42276c6c6..a00668556 100644 --- a/apparmor.d/profiles-a-f/dunstctl +++ b/apparmor.d/profiles-a-f/dunstctl @@ -13,12 +13,13 @@ profile dunstctl @{exec_path} { @{exec_path} mr, - @{bin}/dbus-send rCx -> dbus, + @{bin}/dbus-send Cx -> bus, - profile dbus { + profile bus { include + include - @{bin}/dbus-send mr, + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/gsmartcontrol b/apparmor.d/profiles-g-l/gsmartcontrol index ec3dcff98..9ce2b10dc 100644 --- a/apparmor.d/profiles-g-l/gsmartcontrol +++ b/apparmor.d/profiles-g-l/gsmartcontrol @@ -10,43 +10,31 @@ include @{exec_path} = @{bin}/gsmartcontrol profile gsmartcontrol @{exec_path} { include - include - include - include - include + include include capability dac_read_search, - - # Needed? - deny capability sys_nice, + capability sys_nice, @{exec_path} mr, - @{bin}/smartctl rPx, - @{bin}/xterm rCx -> terminal, + @{bin}/dbus-launch Cx -> bus, + @{bin}/dbus-send Cx -> bus, + @{bin}/smartctl Px, + @{bin}/xterm Cx -> terminal, - # When gsmartcontrol is run as root, it wants to exec dbus-launch, and hence it creates the two - # following root processes: - # dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr - # /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session - # - # Should this be allowed? Gsmartcontrol works fine without this. - #@{bin}/dbus-launch rCx -> dbus, - #@{bin}/dbus-send rCx -> dbus, - deny @{bin}/dbus-launch rx, - deny @{bin}/dbus-send rx, + /etc/fstab r, - owner @{user_config_dirs}/gsmartcontrol/ rw, - owner @{user_config_dirs}/gsmartcontrol/gsmartcontrol.conf rw, - - # As it's started as root - @{HOME}/.Xauthority r, + /var/lib/dbus/machine-id r, + /etc/machine-id r, # For saving SMART raport owner /root/ r, owner /root/**.txt w, + owner @{user_config_dirs}/gsmartcontrol/ rw, + owner @{user_config_dirs}/gsmartcontrol/** rw, + owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, @@ -55,57 +43,37 @@ profile gsmartcontrol @{exec_path} { owner @{PROC}/scsi/scsi r, owner @{PROC}/scsi/sg/devices r, - /etc/fstab r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - # The Help menu (and links in it) requires access to a web browser. Since gsmartcontrol is run as # root (even when used sudo or gsmartcontrol-root), the web browser will also be run as root and # hence this behavior should be blocked. - deny @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rx, + deny @{open_path} rx, - - profile dbus { + profile bus flags=(complain) { include - include + include - @{bin}/dbus-launch mr, - @{bin}/dbus-send mr, - @{bin}/dbus-daemon rPUx, - - # for dbus-launch - owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, - - @{HOME}/.Xauthority r, + include if exists } profile terminal { include include + include include - include + include - capability setuid, - capability setgid, capability fsetid, + capability setgid, + capability setuid, @{bin}/xterm mr, - - /usr/sbin/update-smart-drivedb rPx, - - owner @{HOME}/.Xauthority r, - - /etc/shells r, - - /etc/X11/app-defaults/XTerm-color r, - /etc/X11/app-defaults/XTerm r, - /etc/X11/cursors/*.theme r, + @{bin}/update-smart-drivedb rPx, /usr/include/X11/bitmaps/vlines2 r, /dev/ptmx rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/lxappearance b/apparmor.d/profiles-g-l/lxappearance index a400ef80c..c4ef29625 100644 --- a/apparmor.d/profiles-g-l/lxappearance +++ b/apparmor.d/profiles-g-l/lxappearance @@ -10,59 +10,31 @@ include @{exec_path} = @{bin}/lxappearance profile lxappearance @{exec_path} { include - include - include - include - include + include @{exec_path} mr, - # When lxappearance is run as root, it wants to exec dbus-launch, and hence it creates the two - # following root processes: - # dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr - # /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session - # - # Should this be allowed? Lxappearance works fine without this. - #@{bin}/dbus-launch rCx -> dbus, - #@{bin}/dbus-send rCx -> dbus, - deny @{bin}/dbus-launch rx, - deny @{bin}/dbus-send rx, + @{bin}/dbus-launch Cx -> bus, + @{bin}/dbus-send Cx -> bus, /usr/share/lxappearance/{,**} r, - owner @{HOME}/.themes/{,**} r, - owner @{HOME}/.icons/{,**} rw, - - owner @{HOME}/.gtkrc-2.0{,.*} rw, - owner @{user_config_dirs}/gtk-3.0/settings.ini{,.*} rw, - - /etc/X11/cursors/*.theme r, - - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - /etc/fstab r, /etc/machine-id r, /var/lib/dbus/machine-id r, - # file_inherit + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner /dev/tty@{int} rw, - - profile dbus { + profile bus { include - include + include - @{bin}/dbus-launch mr, - @{bin}/dbus-send mr, - @{bin}/dbus-daemon rPUx, - - # for dbus-launch - owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, - - @{HOME}/.Xauthority r, + include if exists } include if exists From e4a986096f87bcca5398747037de1e362ea60ae1 Mon Sep 17 00:00:00 2001 From: EricLin0509 <143688917+EricLin0509@users.noreply.github.com> Date: Thu, 12 Sep 2024 18:59:25 +0800 Subject: [PATCH 0158/1455] Add support for linuxqq (#474) --- apparmor.d/profiles-g-l/linuxqq | 58 +++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 apparmor.d/profiles-g-l/linuxqq diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq new file mode 100644 index 000000000..640458439 --- /dev/null +++ b/apparmor.d/profiles-g-l/linuxqq @@ -0,0 +1,58 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 EricLin +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{name} = QQ +@{lib_dirs} = /opt/QQ/ +@{config_dirs} = @{user_config_dirs}/@{name} +@{cache_dirs} = @{user_cache_dirs}/@{name} + +@{exec_path} = @{bin}/linuxqq +@{exec_path} += /opt/QQ/qq +profile linuxqq @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + + network netlink raw, + network netlink dgram, + network inet stream, + network inet dgram, + network inet6 dgram, + network inet6 stream, + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/find rix, + @{bin}/rm rix, + @{bin}/xdg-open rix, + @{bin}/grep rix, + /opt/QQ/qq ix, + /opt/QQ/chrome_crashpad_handler ix, + + @{lib_dirs}/resources/app/{,**} m, + + /etc/machine-id r, + + @{run}/systemd/inhibit/@{int}.ref rw, + @{run}/utmp r, + + owner @{PROC}/@{pid}/loginuid r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/cmdline r, + + /dev/tty rw, + /dev/pts/@{int} rw, + + include if exists +} + From fb93ac0df35346019181d96bee9624925e04fb84 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 12:12:29 +0100 Subject: [PATCH 0159/1455] fix(profile): improve linuxqq See #474 --- apparmor.d/profiles-g-l/linuxqq | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 640458439..6961d8cc7 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -11,16 +11,12 @@ include @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} -@{exec_path} = @{bin}/linuxqq -@{exec_path} += /opt/QQ/qq +@{exec_path} = @{bin}/linuxqq @{lib_dirs}/qq profile linuxqq @{exec_path} flags=(attach_disconnected) { include - include - include - include - include - include include + include + include network netlink raw, network netlink dgram, @@ -29,17 +25,13 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network inet6 stream, - @{exec_path} mr, + @{exec_path} mrix, - @{sh_path} r, - @{bin}/find rix, - @{bin}/rm rix, - @{bin}/xdg-open rix, + @{sh_path} r, @{bin}/grep rix, - /opt/QQ/qq ix, - /opt/QQ/chrome_crashpad_handler ix, - + @{lib_dirs}/chrome_crashpad_handler ix, @{lib_dirs}/resources/app/{,**} m, + @{open_path} rPx -> child-open-strict, /etc/machine-id r, @@ -48,7 +40,6 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/cmdline r, /dev/tty rw, /dev/pts/@{int} rw, From feb482edd92b126cba06a12713ba9a5d9ec33ab2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 12:18:05 +0100 Subject: [PATCH 0160/1455] fix(profile): crontab editor issues with cronie fix #479 --- apparmor.d/groups/cron/crontab | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index 2743173f8..1144b39c5 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -14,11 +14,15 @@ profile crontab @{exec_path} { include include + capability audit_write, + capability chown, capability dac_read_search, capability net_admin, capability setgid, capability setuid, + network netlink raw, + @{exec_path} mr, @{sh_path} rix, @@ -29,12 +33,12 @@ profile crontab @{exec_path} { /etc/pam.d/* r, /etc/security/*.conf r, - /var/spool/cron/ r, - /var/spool/cron/crontabs/ rw, - /var/spool/cron/user r, - owner /var/spool/cron/crontabs/* rw, + /var/spool/cron/ r, + /var/spool/cron/** rw, - owner @{tmp}/crontab.@{rand6}/{,crontab} rw, + owner @{user_cache_dirs}/crontab/crontab.bak rw, + + @{tmp}/crontab.@{rand6}/{,crontab} rwl, profile editor { include From aa6704bbac0cf3a1f9a728dfbe989245b1e99445 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:15:46 +0100 Subject: [PATCH 0161/1455] feat(profile): remove the unused freetube sandbox. --- .../profiles-a-f/freetube-chrome-sandbox | 35 ------------------- 1 file changed, 35 deletions(-) delete mode 100644 apparmor.d/profiles-a-f/freetube-chrome-sandbox diff --git a/apparmor.d/profiles-a-f/freetube-chrome-sandbox b/apparmor.d/profiles-a-f/freetube-chrome-sandbox deleted file mode 100644 index 5dc20400e..000000000 --- a/apparmor.d/profiles-a-f/freetube-chrome-sandbox +++ /dev/null @@ -1,35 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{name} = {F,f}reetube{,-vue} -@{lib_dirs} = @{lib}/@{name} /opt/@{name} - -@{exec_path} = @{lib_dirs}/chrome-sandbox -profile freetube-chrome-sandbox @{exec_path} { - include - include - - capability sys_admin, - capability setgid, - capability setuid, - capability sys_chroot, - - @{exec_path} mr, - - # Has to be lower "P" - @{lib_dirs}/@{name} rpx, - - @{PROC}/@{pids}/ r, - owner @{PROC}/@{pid}/oom_{,score_}adj r, - deny owner @{PROC}/@{pid}/oom_{,score_}adj w, - - include if exists -} - -# vim:syntax=apparmor From 18010b266d62ff52d1e45ebe6c959218772d63ac Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:17:37 +0100 Subject: [PATCH 0162/1455] feat(profile): firefox: update dbus & move stacked profile outside of the abs. --- apparmor.d/abstractions/app/firefox | 6 +++--- apparmor.d/groups/browsers/firefox | 8 ++++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index f1443a936..b3e78105e 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -17,6 +17,7 @@ include include include + include include include include @@ -46,6 +47,8 @@ signal (send) set=(term, kill) peer=@{profile_name}-*, + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + @{sh_path} rix, @{bin}/basename rix, @{bin}/dirname rix, @@ -54,11 +57,9 @@ @{lib_dirs}/{,**} r, @{lib_dirs}/*.so mr, @{lib_dirs}/crashreporter rPx, - @{lib_dirs}/glxtest rPx -> firefox//&firefox-glxtest, @{lib_dirs}/minidump-analyzer rPx, @{lib_dirs}/pingsender rPx, @{lib_dirs}/plugin-container rPx, - @{lib_dirs}/vaapitest rPx -> firefox//&firefox-vaapitest, # Desktop integration @{bin}/lsb_release rPx -> lsb_release, @@ -157,7 +158,6 @@ # Silencer deny dbus send bus=system path=/org/freedesktop/hostname1, deny /tmp/MozillaUpdateLock-* w, - deny owner @{HOME}/ r, deny owner @{HOME}/.* r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny @{run}/user/@{uid}/gnome-shell-disable-extensions w, diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 6d50db9dc..75c3c0f86 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -24,13 +24,17 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, + @{lib_dirs}/glxtest rPx -> firefox//&firefox-glxtest, + @{lib_dirs}/vaapitest rPx -> firefox//&firefox-vaapitest, + + @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemKWaylandPlugin.so mr, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr, @{lib}/mozilla/plugins/ r, - @{lib}/mozilla/plugins/libvlcplugin.so mr, + @{lib}/mozilla/plugins/*.so mr, # Desktop integration @{bin}/gnome-software rPx, - @{bin}/kreadconfig5 rix, + @{bin}/kreadconfig{,5} rPx, @{bin}/plasma-browser-integration-host rPx, @{bin}/update-mime-database rPx, @{lib}/gvfsd-metadata rPx, From 9e7c4c7ec8093757145febba71c1c63a642415f5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:18:30 +0100 Subject: [PATCH 0163/1455] feat(abs): mesa: update cache for desktop users. --- apparmor.d/abstractions/mesa.d/complete | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index 0e437190f..a8b9937bd 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -5,6 +5,7 @@ # Extra Mesa rules for desktop environments owner @{desktop_cache_dirs}/ w, owner @{desktop_cache_dirs}/mesa_shader_cache_db/ rw, + owner @{desktop_cache_dirs}/mesa_shader_cache_db/part@{int}/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/@{hex2}/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/@{hex2}/@{hex38} rw, From ab7f45bc3126f6d6a472e4eea79a356de46806ad Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:26:47 +0100 Subject: [PATCH 0164/1455] feat(profile): general update. --- apparmor.d/groups/bus/dbus-session | 6 ++--- apparmor.d/groups/gnome/gnome-control-center | 3 +++ apparmor.d/groups/gnome/gnome-shell | 9 +++---- apparmor.d/groups/gnome/nautilus | 6 +---- apparmor.d/groups/kde/kreadconfig | 2 +- apparmor.d/groups/kde/kwalletmanager | 1 - apparmor.d/groups/kde/plasma-discover | 2 +- apparmor.d/groups/network/wg | 7 +++++ apparmor.d/groups/network/wg-quick | 4 ++- apparmor.d/groups/pacman/makepkg | 2 ++ apparmor.d/profiles-a-f/e2fsck | 1 + apparmor.d/profiles-a-f/fdisk | 6 +---- .../profiles-a-f/flatpak-session-helper | 12 +++++---- apparmor.d/profiles-a-f/fwupdmgr | 23 ++++++---------- apparmor.d/profiles-g-l/git | 7 ++--- apparmor.d/profiles-g-l/hypnotix | 26 +----------------- apparmor.d/profiles-g-l/linuxqq | 1 - apparmor.d/profiles-m-r/mpv | 27 +------------------ apparmor.d/profiles-m-r/partprobe | 1 + apparmor.d/profiles-m-r/resize2fs | 1 + apparmor.d/profiles-s-z/YACReader | 2 -- apparmor.d/profiles-s-z/sfdisk | 8 +----- apparmor.d/profiles-s-z/steam | 1 - apparmor.d/profiles-s-z/steam-runtime | 2 +- apparmor.d/profiles-s-z/thunderbird | 3 +-- apparmor.d/profiles-s-z/udisksd | 1 + 26 files changed, 53 insertions(+), 111 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index b06eaa510..fa6305055 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -4,7 +4,7 @@ # Profile for session dbus, regardless of the dbus implementation used. # It does not specify an attachment path as it would be the same than -# "dbus-system". It is intended to be used only via "Px ->" or via +# "dbus-system". It is intended to be used only via "Px ->" or via # systemd drop-in AppArmorProfile= setting. abi , @@ -24,9 +24,7 @@ profile dbus-session flags=(attach_disconnected) { unix (send receive) type=stream addr=none peer=(label=gnome-shell, addr=none), - signal (receive) set=(term hup) peer=gdm-session-worker, - signal (receive) set=(term hup) peer=gdm-session, - signal (receive) set=(term hup) peer=gdm, + signal (receive) set=(term hup) peer=gdm{,-*}, signal (send) set=(term hup kill) peer=dbus-accessibility, signal (send) set=(term hup kill) peer=dconf-service, signal (send) set=(term hup kill) peer=xdg-*, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 7643844c5..1f3bb42d8 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -153,6 +153,9 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/temp* r, @{sys}/firmware/acpi/pm_profile r, + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw, @{PROC}/cmdline r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index b6420b348..d4ce1c504 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -181,16 +181,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/glib-compile-schemas rPx, @{bin}/ibus-daemon rPx, @{bin}/Xwayland rPx, + @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @{lib}/mutter-x11-frames rPx, #aa:exec polkit-agent-helper @{sh_path} rCx -> shell, @{lib}/gio-launch-desktop rCx -> open, @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, - - # nm-openvpn-auth-dialog - @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, - + @{user_share_dirs}/gnome-shell/extensions/*/** rPUx, /usr/share/gnome-shell/extensions/*/** rPUx, @@ -294,11 +292,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw, owner @{run}/user/@{uid}/systemd/notify rw, - owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + owner /dev/shm/.org.chromium.Chromium.@{rand6} r, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, /tmp/.X@{int}-lock rw, /tmp/dbus-@{rand8} rw, + owner @{tmp}/.org.chromium.Chromium.@{rand6} r, owner @{tmp}/@{rand6}.shell-extension.zip rw, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 66f9af691..f00b8d10f 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -33,17 +33,13 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + #aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus.Properties member={GetAll,ListActivatableNames} peer=(name=org.freedesktop.DBus, label=dbus-session), - dbus send bus=session path=/org/gtk/Notifications - interface=org.gtk.Notifications - member=AddNotification - peer=(name=org.gtk.Notifications, label=gnome-shell), - dbus (send, receive) bus=session path=/org/gtk/Application/CommandLine interface=org.gtk.private.CommandLine member=Print diff --git a/apparmor.d/groups/kde/kreadconfig b/apparmor.d/groups/kde/kreadconfig index 33cf23a9b..4dbe69f9d 100644 --- a/apparmor.d/groups/kde/kreadconfig +++ b/apparmor.d/groups/kde/kreadconfig @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/kreadconfig5 +@{exec_path} = @{bin}/kreadconfig{,5} profile kreadconfig @{exec_path} { include include diff --git a/apparmor.d/groups/kde/kwalletmanager b/apparmor.d/groups/kde/kwalletmanager index b1ca562cc..e26d09f13 100644 --- a/apparmor.d/groups/kde/kwalletmanager +++ b/apparmor.d/groups/kde/kwalletmanager @@ -45,7 +45,6 @@ profile kwalletmanager @{exec_path} { @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/cmdline r, - /dev/shm/ r, /dev/shm/#@{int} rw, include if exists diff --git a/apparmor.d/groups/kde/plasma-discover b/apparmor.d/groups/kde/plasma-discover index 542110454..d35e8dcd8 100644 --- a/apparmor.d/groups/kde/plasma-discover +++ b/apparmor.d/groups/kde/plasma-discover @@ -29,7 +29,7 @@ profile plasma-discover @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/kreadconfig5 rPx, + @{bin}/kreadconfig{,5} rPx, @{bin}/gpg rCx -> gpg, @{bin}/gpgconf rCx -> gpg, diff --git a/apparmor.d/groups/network/wg b/apparmor.d/groups/network/wg index 783fa41fe..2ddaee94c 100644 --- a/apparmor.d/groups/network/wg +++ b/apparmor.d/groups/network/wg @@ -11,11 +11,18 @@ profile wg @{exec_path} { include capability net_admin, + capability net_bind_service, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, network netlink raw, @{exec_path} mr, + /etc/wireguard/{,**} rw, + include if exists } diff --git a/apparmor.d/groups/network/wg-quick b/apparmor.d/groups/network/wg-quick index 1183a4a5b..89d89162a 100644 --- a/apparmor.d/groups/network/wg-quick +++ b/apparmor.d/groups/network/wg-quick @@ -10,6 +10,7 @@ include profile wg-quick @{exec_path} { include + capability dac_read_search, capability net_admin, network netlink raw, @@ -21,7 +22,8 @@ profile wg-quick @{exec_path} { @{bin}/ip rPx, @{bin}/nft rix, @{bin}/readlink rix, - @{bin}/resolvectl rPx, + @{bin}/resolvconf rPx, + @{bin}/resolvectl rPUx, @{bin}/sort rix, @{bin}/stat rix, @{bin}/sysctl rix, diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 311135eae..5ac446817 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -48,6 +48,8 @@ profile makepkg @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + owner @{tmp}/.git_vtag_tmp@{rand6} rw, + owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/gnupg/ r, owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, diff --git a/apparmor.d/profiles-a-f/e2fsck b/apparmor.d/profiles-a-f/e2fsck index 8ce1ed3c7..a02c8735e 100644 --- a/apparmor.d/profiles-a-f/e2fsck +++ b/apparmor.d/profiles-a-f/e2fsck @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/e2fsck @{bin}/fsck.ext2 @{bin}/fsck.ext3 @{bin}/fsck.ext4 profile e2fsck @{exec_path} { include + include include include diff --git a/apparmor.d/profiles-a-f/fdisk b/apparmor.d/profiles-a-f/fdisk index 815e3bc76..8e6ea58fa 100644 --- a/apparmor.d/profiles-a-f/fdisk +++ b/apparmor.d/profiles-a-f/fdisk @@ -10,14 +10,10 @@ include @{exec_path} = @{bin}/fdisk profile fdisk @{exec_path} { include + include include - # Needed to inform the system of newly created/removed partitions - # ioctl(3, BLKRRPART) = -1 EACCES (Permission denied) capability sys_admin, - - # To remove the following errors: - # kernel: device-mapper: core: fdisk: sending ioctl 5331 to DM device without required privilege. capability sys_rawio, @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/flatpak-session-helper b/apparmor.d/profiles-a-f/flatpak-session-helper index d27d0c24a..54b95b8e3 100644 --- a/apparmor.d/profiles-a-f/flatpak-session-helper +++ b/apparmor.d/profiles-a-f/flatpak-session-helper @@ -10,14 +10,14 @@ include profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { include include + include include include include - include - signal (send) set=(hup int) peer=user_unconfined, - signal (send) set=(int) peer=@{p_systemd}, - signal (send) set=(int) peer=flatpak-app, + signal send set=(hup int) peer=user_unconfined, + signal send set=(int) peer=@{p_systemd}, + signal send set=(int) peer=flatpak-app, #aa:dbus own bus=session name=org.freedesktop.Flatpak @@ -27,11 +27,13 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { @{bin}/dbus-monitor rPUx, @{bin}/env rix, @{bin}/flatpak rPx, - @{bin}/test rix, @{bin}/getent rix, @{bin}/p11-kit rix, @{bin}/pkexec rPx, # TODO: too wide, rCx. + @{bin}/printenv rix, @{bin}/ps rPx, + @{bin}/test rix, + @{bin}/touch rix, @{lib}/p11-kit/p11-kit-remote rix, @{lib}/p11-kit/p11-kit-server rix, /var/lib/flatpak/app/*/**/@{bin}/** rPx -> flatpak-app, diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 6064c0ff1..8f6885b46 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -8,17 +8,18 @@ abi , include @{exec_path} = @{bin}/fwupdmgr -profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) { +profile fwupdmgr @{exec_path} flags=(attach_disconnected) { include include include include + include include include capability sys_nice, - signal (send), + signal send, network inet stream, network inet6 stream, @@ -30,19 +31,16 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) { @{exec_path} mr, - @{bin}/dbus-launch rCx -> dbus, - @{bin}/pkttyagent rPx, - - /usr/share/glib-2.0/schemas/gschemas.compiled r, + @{bin}/dbus-launch Cx -> bus, + @{bin}/pkttyagent Px, /etc/machine-id r, owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc}.* rw, owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc} rw, - /var/lib/flatpak/exports/share/mime/mime.cache r, - owner @{user_cache_dirs}/ rw, @{user_cache_dirs}/dconf/user rw, + owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/fwupd/ rw, owner @{user_cache_dirs}/fwupd/lvfs-metadata.xml.gz{,.*} rw, @@ -53,14 +51,9 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) { /dev/i2c-@{int} rw, /dev/tty rw, - profile dbus { + profile bus flags=(attach_disconnected) { include - include - - @{bin}/dbus-launch mr, - - owner @{HOME}/.Xauthority r, - + include include if exists } diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 30ce7e1e8..032da7124 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -66,9 +66,9 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/man rPx, @{bin}/meld rPUx, - @{lib}/code/extensions/git/dist/askpass.sh rPx, - @{lib}/code/extensions/git/dist/git-editor.sh rPx, - /usr/share/aurpublish/*.hook rPx, + @{lib}/code/extensions/git/dist/askpass.sh rPx, + @{lib}/code/extensions/git/dist/git-editor.sh rPx, + /usr/share/aurpublish/*.hook rPx, @{bin}/gpg{,2} rCx -> gpg, @{bin}/ssh rCx -> ssh, @@ -98,6 +98,7 @@ profile git @{exec_path} flags=(attach_disconnected) { deny owner @{code_config_dirs}/** rw, deny owner @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_share_dirs}/vulkan/** r, deny owner @{user_share_dirs}/zed/**/data.mdb rw, deny /usr/share/nvidia/nvidia-application-profiles-* r, deny /dev/shm/.org.chromium.Chromium.@{rand6} rw, diff --git a/apparmor.d/profiles-g-l/hypnotix b/apparmor.d/profiles-g-l/hypnotix index 3a9a6131d..0a54528be 100644 --- a/apparmor.d/profiles-g-l/hypnotix +++ b/apparmor.d/profiles-g-l/hypnotix @@ -37,8 +37,7 @@ profile hypnotix @{exec_path} { @{bin}/ldconfig rix, @{bin}/mkdir rix, - @{bin}/xdg-screensaver rCx -> xdg-screensaver, - + @{bin}/xdg-screensaver rPx, @{bin}/youtube-dl rPUx, @{bin}/yt-dlp rPUx, @{lib}/firefox/firefox rPx, @@ -63,29 +62,6 @@ profile hypnotix @{exec_path} { # Silencer deny @{lib}/hypnotix/** w, - profile xdg-screensaver { - include - include - - @{bin}/xdg-screensaver mr, - - @{sh_path} rix, - @{bin}/mv rix, - @{bin}/{,e}grep rix, - @{bin}/sed rix, - @{bin}/which{,.debianutils} rix, - @{bin}/xset rix, - @{bin}/xautolock rix, - @{bin}/dbus-send rix, - - owner @{HOME}/.Xauthority r, - - # file_inherit - /dev/dri/card@{int} rw, - network inet stream, - network inet6 stream, - } - include if exists } diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 6961d8cc7..dcccd68c8 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -27,7 +27,6 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{sh_path} r, @{bin}/grep rix, @{lib_dirs}/chrome_crashpad_handler ix, @{lib_dirs}/resources/app/{,**} m, diff --git a/apparmor.d/profiles-m-r/mpv b/apparmor.d/profiles-m-r/mpv index 88a5078aa..da5e4715c 100644 --- a/apparmor.d/profiles-m-r/mpv +++ b/apparmor.d/profiles-m-r/mpv @@ -32,8 +32,7 @@ profile mpv @{exec_path} { @{exec_path} mr, - @{bin}/xdg-screensaver rCx -> xdg-screensaver, - + @{bin}/xdg-screensaver Px, @{bin}/youtube-dl rPx, @{bin}/yt-dlp rPx, @@ -81,30 +80,6 @@ profile mpv @{exec_path} { /dev/input/event@{int} r, owner /dev/tty@{int} rw, - profile xdg-screensaver { - include - include - - @{bin}/xdg-screensaver mr, - - @{sh_path} rix, - @{bin}/mv rix, - @{bin}/{,e}grep rix, - @{bin}/sed rix, - @{bin}/which{,.debianutils} rix, - @{bin}/xset rix, - @{bin}/xautolock rix, - @{bin}/dbus-send rix, - @{bin}/xscreensaver-command rix, - - owner @{HOME}/.Xauthority r, - - # file_inherit - /dev/dri/card@{int} rw, - network inet stream, - network inet6 stream, - } - include if exists } diff --git a/apparmor.d/profiles-m-r/partprobe b/apparmor.d/profiles-m-r/partprobe index 9e384c66c..0d0d82388 100644 --- a/apparmor.d/profiles-m-r/partprobe +++ b/apparmor.d/profiles-m-r/partprobe @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/partprobe profile partprobe @{exec_path} { include + include include capability sys_admin, diff --git a/apparmor.d/profiles-m-r/resize2fs b/apparmor.d/profiles-m-r/resize2fs index 114846812..698ec99fd 100644 --- a/apparmor.d/profiles-m-r/resize2fs +++ b/apparmor.d/profiles-m-r/resize2fs @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/resize2fs profile resize2fs @{exec_path} { include + include include include diff --git a/apparmor.d/profiles-s-z/YACReader b/apparmor.d/profiles-s-z/YACReader index ccbbb2494..3038df49a 100644 --- a/apparmor.d/profiles-s-z/YACReader +++ b/apparmor.d/profiles-s-z/YACReader @@ -37,8 +37,6 @@ profile YACReader @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/YACReader/YACReader/ rw, owner @{user_share_dirs}/YACReader/YACReader/** rwlk, - /dev/shm/ r, - owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/sfdisk b/apparmor.d/profiles-s-z/sfdisk index 5b75a27ef..c82aff776 100644 --- a/apparmor.d/profiles-s-z/sfdisk +++ b/apparmor.d/profiles-s-z/sfdisk @@ -10,15 +10,9 @@ include @{exec_path} = @{bin}/sfdisk profile sfdisk @{exec_path} { include + include include - # Needed to avoid the following error: - # ioctl(3, BLKRRPART) = -1 EACCES (Permission denied) - # - # Checking that no-one is using this disk right now ... FAILED - # This disk is currently in use - repartitioning is probably a bad idea. - # Umount all file systems, and swapoff all swap partitions on this disk. - # Use the --no-reread flag to suppress this check. capability sys_admin, @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 0828786d5..447ef9f16 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -327,7 +327,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, - /dev/shm/ r, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw, diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index add024de7..e0c6b146d 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -42,7 +42,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { @{app_dirs}/@{runtime}/pressure-vessel/@{bin}/pressure-vessel-* rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/** mr, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-capsule-capture-libs rix, - @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-platform rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-* rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-inspect-library rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rpx -> steam-game-proton, @{app_dirs}/@{runtime}/run rix, diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index d6553d990..3d580afe9 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -158,8 +158,7 @@ profile thunderbird @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/stat r, owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1 - /dev/shm/ r, - owner /dev/shm/org.chromium.* rw, + owner /dev/shm/org.chromium.@{rand6} rw, owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 76be97683..6f74c826e 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -119,6 +119,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{sys}/bus/ r, @{sys}/bus/pci/slots/ r, @{sys}/bus/pci/slots/@{int}/address r, + @{sys}/bus/scsi/devices/ r, @{sys}/class/ r, @{sys}/class/nvme-subsystem/ r, @{sys}/class/nvme/ r, From 7e63564c56e44c2b32d6cdcefbba31a5b3038e81 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:29:22 +0100 Subject: [PATCH 0165/1455] feat(profile): add speech-dispatcher. --- apparmor.d/profiles-s-z/speech-dispatcher | 34 +++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 35 insertions(+) create mode 100644 apparmor.d/profiles-s-z/speech-dispatcher diff --git a/apparmor.d/profiles-s-z/speech-dispatcher b/apparmor.d/profiles-s-z/speech-dispatcher new file mode 100644 index 000000000..7a597ed5d --- /dev/null +++ b/apparmor.d/profiles-s-z/speech-dispatcher @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/speech-dispatcher +profile speech-dispatcher @{exec_path} { + include + include + include + include + + network inet stream, + network inet6 stream, + + @{exec_path} mr, + + @{sh_path} ix, + @{lib}/speech-dispatcher/** r, + @{lib}/speech-dispatcher/speech-dispatcher-modules/* ix, + + /etc/machine-id r, + /etc/speech-dispatcher/{,**} r, + + owner @{run}/user/@{uid}/speech-dispatcher/ rw, + owner @{run}/user/@{uid}/speech-dispatcher/** rwk, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 401681743..88cb2d176 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -316,6 +316,7 @@ snapd complain snapd-apparmor complain snapd-core-fixup complain snapshot complain +speech-dispatcher complain ssservice complain startplasma complain startx attach_disconnected,complain From ecf4eaee14674bf49bd6063722056eb6b6d94f28 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:29:59 +0100 Subject: [PATCH 0166/1455] feat(profile): add superproductivity. --- apparmor.d/profiles-s-z/superproductivity | 37 +++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 38 insertions(+) create mode 100644 apparmor.d/profiles-s-z/superproductivity diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity new file mode 100644 index 000000000..f8295f311 --- /dev/null +++ b/apparmor.d/profiles-s-z/superproductivity @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{name} = super{p,P}roductivity +@{lib_dirs} = /opt/@{name} +@{config_dirs} = @{user_config_dirs}/@{name} +@{cache_dirs} = @{user_cache_dirs}/@{name} + +@{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name} +profile superproductivity @{exec_path} flags=(attach_disconnected) { + include + include + include + include + + network inet stream, + network inet6 stream, + network inet dgram, + network inet6 dgram, + network netlink raw, + + @{exec_path} mrix, + + @{bin}/speech-dispatcher rPx, + @{open_path} rPx -> child-open-strict, + + @{run}/systemd/inhibit/@{int}.ref rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 88cb2d176..f2091d4f5 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -331,6 +331,7 @@ steam-runtime attach_disconnected,complain steamerrorreporter attach_disconnected,complain strawberry attach_disconnected,mediate_deleted,complain sulogin complain +superproductivity attach_disconnected,complain switcherooctl complain swtpm complain swtpm_ioctl complain From 7b4db8fd41812f951379d6773910986b527228ba Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:54:20 +0100 Subject: [PATCH 0167/1455] feat(profile): add torbrowser The same profiles are now used for torbrowser on either it is running on whonix or not. --- .../groups/{whonix => browsers}/torbrowser | 17 +++- .../{whonix => browsers}/torbrowser-glxtest | 12 +-- .../groups/browsers/torbrowser-launcher | 93 +++++++++++++++++++ .../torbrowser-plugin-container | 4 +- apparmor.d/groups/browsers/torbrowser-start | 54 +++++++++++ apparmor.d/groups/browsers/torbrowser-tor | 51 ++++++++++ .../{whonix => browsers}/torbrowser-updater | 6 +- .../{whonix => browsers}/torbrowser-vaapitest | 12 +-- apparmor.d/groups/whonix/torbrowser-start | 51 ---------- apparmor.d/groups/whonix/torbrowser-wrapper | 34 +++---- 10 files changed, 241 insertions(+), 93 deletions(-) rename apparmor.d/groups/{whonix => browsers}/torbrowser (76%) rename apparmor.d/groups/{whonix => browsers}/torbrowser-glxtest (69%) create mode 100644 apparmor.d/groups/browsers/torbrowser-launcher rename apparmor.d/groups/{whonix => browsers}/torbrowser-plugin-container (79%) create mode 100644 apparmor.d/groups/browsers/torbrowser-start create mode 100644 apparmor.d/groups/browsers/torbrowser-tor rename apparmor.d/groups/{whonix => browsers}/torbrowser-updater (77%) rename apparmor.d/groups/{whonix => browsers}/torbrowser-vaapitest (63%) delete mode 100644 apparmor.d/groups/whonix/torbrowser-start diff --git a/apparmor.d/groups/whonix/torbrowser b/apparmor.d/groups/browsers/torbrowser similarity index 76% rename from apparmor.d/groups/whonix/torbrowser rename to apparmor.d/groups/browsers/torbrowser index 0ec13ed51..6b9b6dbab 100644 --- a/apparmor.d/groups/whonix/torbrowser +++ b/apparmor.d/groups/browsers/torbrowser @@ -7,9 +7,9 @@ abi , include @{name} = torbrowser "tor browser" -@{lib_dirs} = @{HOME}/.tb/tor-browser/Browser/ +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ @{data_dirs} = @{lib_dirs}/TorBrowser/Data/ -@{config_dirs} = @{data_dirs}/Browser/*.default/ +@{config_dirs} = @{data_dirs}/Browser/profile.default/ @{cache_dirs} = @{data_dirs}/Browser/Caches @{exec_path} = @{lib_dirs}/firefox{,.real} @@ -19,8 +19,14 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{lib_dirs}/abicheck rix, - @{lib_dirs}/updater rPx, + @{lib_dirs}/abicheck ix, + @{lib_dirs}/glxtest Px -> torbrowser//&torbrowser-glxtest, + @{lib_dirs}/updater Px, + @{lib_dirs}/vaapitest Px -> torbrowser//&torbrowser-vaapitest, + + #aa:exclude whonix + @{lib_dirs}/TorBrowser/Tor/PluggableTransports/** Px -> torbrowser-tor, + @{lib_dirs}/TorBrowser/Tor/tor Px -> torbrowser-tor, /usr/share/homepage/{,**} r, @@ -37,10 +43,10 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) { # Due to the nature of the browser, we silence much more than for Firefox. deny network inet dgram, # TOR does not work over UDP deny network inet6 dgram, + deny network inet6 stream, # TOR does not work over IPv6 deny dbus (send receive) bus=session path=/ca/desrt/dconf/Writer/user, deny @{bin}/lsb_release x, deny @{lib_dirs}/crashreporter x, - deny @{lib_dirs}/glxtest x, deny @{lib_dirs}/minidump-analyzer x, deny @{lib_dirs}/pingsender x, deny /usr/share/dconf/** r, @@ -56,6 +62,7 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) { deny /etc/passwd r, deny /etc/resolv.conf r, deny /var/lib/dbus/machine-id r, + deny owner @{HOME}/ r, deny owner @{user_config_dirs}/dconf/user r, deny owner @{user_config_dirs}/gtk-*/{,**} rw, deny owner @{run}/user/@{uid}/dconf/ rw, diff --git a/apparmor.d/groups/whonix/torbrowser-glxtest b/apparmor.d/groups/browsers/torbrowser-glxtest similarity index 69% rename from apparmor.d/groups/whonix/torbrowser-glxtest rename to apparmor.d/groups/browsers/torbrowser-glxtest index cbc009db1..54e1d5ad0 100644 --- a/apparmor.d/groups/whonix/torbrowser-glxtest +++ b/apparmor.d/groups/browsers/torbrowser-glxtest @@ -7,13 +7,13 @@ abi , include @{name} = torbrowser "tor browser" -@{lib_dirs} = @{HOME}/.tb/tor-browser/Browser/ +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ @{data_dirs} = @{lib_dirs}/TorBrowser/Data/ -@{config_dirs} = @{data_dirs}/Browser/*.default/ +@{config_dirs} = @{data_dirs}/Browser/profile.default/ @{cache_dirs} = @{data_dirs}/Browser/Caches @{exec_path} = @{lib_dirs}/glxtest -profile torbrowser-glxtest @{exec_path} { +profile torbrowser-glxtest @{exec_path} flags=(attach_disconnected) { include include include @@ -21,12 +21,10 @@ profile torbrowser-glxtest @{exec_path} { @{exec_path} mr, - owner @{config_dirs}/.parentlock rw, - - owner @{tmp}/@{name}/.parentlock rw, - owner @{PROC}/@{pid}/cmdline r, + deny @{config_dirs}/.parentlock rw, + include if exists } diff --git a/apparmor.d/groups/browsers/torbrowser-launcher b/apparmor.d/groups/browsers/torbrowser-launcher new file mode 100644 index 000000000..2d52cd2b4 --- /dev/null +++ b/apparmor.d/groups/browsers/torbrowser-launcher @@ -0,0 +1,93 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ + +@{exec_path} = @{bin}/torbrowser-launcher +profile torbrowser-launcher @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + + network netlink raw, + + @{exec_path} mrix, + + @{sh_path} rix, + @{bin}/file ix, + @{bin}/gpg{,2} Cx -> gpg, + @{bin}/gpgconf Cx -> gpg, + @{bin}/gpgsm Cx -> gpg, + @{bin}/grep ix, + @{bin}/sed ix, + @{bin}/tail ix, + + @{lib_dirs}/execdesktop ix, + @{lib_dirs}/start-tor-browser Px, # torbrowser-start + @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/start-tor-browser.desktop ix, + + /usr/share/file/** r, + /usr/share/torbrowser-launcher/{,**} r, + + owner @{user_cache_dirs}/torbrowser/{,**/} rw, + owner @{user_cache_dirs}/torbrowser/download/** rw, + owner @{user_cache_dirs}/torbrowser/torbrowser.gpg rw, + + owner @{user_config_dirs}/torbrowser/{,**/} rw, + owner @{user_config_dirs}/torbrowser/settings.json rw, + + owner @{user_share_dirs}/torbrowser/{,**} rw, + + owner @{PROC}/@{pid}/cmdline r, + + /dev/tty rw, + + profile gpg { + include + + @{bin}/gpg{,2} mr, + @{bin}/gpgconf mr, + @{bin}/gpgsm mr, + + @{bin}/gpg-agent ix, + @{lib}/{,gnupg/}scdaemon ix, + + owner @{HOME}/ r, + owner @{HOME}/@{XDG_GPG_DIR}/ r, + owner @{HOME}/@{XDG_GPG_DIR}/gpg.conf r, + owner @{HOME}/@{XDG_GPG_DIR}/gpgsm.conf r, + + owner @{user_share_dirs}/torbrowser/ r, + owner @{user_share_dirs}/torbrowser/gnupg_homedir/ rw, + owner @{user_share_dirs}/torbrowser/gnupg_homedir/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/gnupg/ r, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, + + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/whonix/torbrowser-plugin-container b/apparmor.d/groups/browsers/torbrowser-plugin-container similarity index 79% rename from apparmor.d/groups/whonix/torbrowser-plugin-container rename to apparmor.d/groups/browsers/torbrowser-plugin-container index 9fcb1bd3d..fa31652c5 100644 --- a/apparmor.d/groups/whonix/torbrowser-plugin-container +++ b/apparmor.d/groups/browsers/torbrowser-plugin-container @@ -8,9 +8,9 @@ abi , include @{name} = torbrowser "tor browser" -@{lib_dirs} = @{HOME}/.tb/tor-browser/Browser/ +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ @{data_dirs} = @{lib_dirs}/TorBrowser/Data/ -@{config_dirs} = @{data_dirs}/Browser/*.default/ +@{config_dirs} = @{data_dirs}/Browser/profile.default/ @{cache_dirs} = @{data_dirs}/Browser/Caches @{exec_path} = @{lib_dirs}/plugin-container diff --git a/apparmor.d/groups/browsers/torbrowser-start b/apparmor.d/groups/browsers/torbrowser-start new file mode 100644 index 000000000..8292f613a --- /dev/null +++ b/apparmor.d/groups/browsers/torbrowser-start @@ -0,0 +1,54 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ + +@{exec_path} = @{lib_dirs}/start-tor-browser +profile torbrowser-start @{exec_path} { + include + include + + @{exec_path} rm, + + @{sh_path} rix, + @{bin}/cp ix, + @{bin}/dirname ix, + @{bin}/env r, + @{bin}/expr ix, + @{bin}/file ix, + @{bin}/getconf ix, + @{bin}/grep ix, + @{bin}/id ix, + @{bin}/ln ix, + @{bin}/mkdir ix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/srm ix, + + @{lib_dirs}/abicheck ix, + @{lib_dirs}/firefox{,.real} Px -> torbrowser, + + /usr/share/file/** r, + + /etc/magic r, + + owner @{lib_dirs}/.config/ibus/{,**} rw, + owner @{lib_dirs}/.local/* rw, + owner @{lib_dirs}/sed@{rand6} rw, + owner @{lib_dirs}/TorBrowser/Tor/tor r, + + owner @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/sed@{rand6} rw, + owner @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/start-tor-browser.desktop rw, + + owner @{HOME}/.xsession-errors rw, + owner @{HOME}/.tb/tor-browser/* rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/browsers/torbrowser-tor b/apparmor.d/groups/browsers/torbrowser-tor new file mode 100644 index 000000000..7eaa85c5c --- /dev/null +++ b/apparmor.d/groups/browsers/torbrowser-tor @@ -0,0 +1,51 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ +@{data_dirs} = @{lib_dirs}/TorBrowser/Data/ + +@{exec_path} = @{lib_dirs}/TorBrowser/Tor/tor +profile torbrowser-tor @{exec_path} { + include + include + include + + network inet stream, + network netlink raw, + + @{exec_path} mr, + + @{lib_dirs}/{,**} r, + @{lib_dirs}/TorBrowser/Tor/*.so* m, + @{lib_dirs}/TorBrowser/Tor/PluggableTransports/** mix, + + owner @{data_dirs}/Tor/ rw, + owner @{data_dirs}/Tor/** rw, + owner @{data_dirs}/Tor/lock rwk, + + /tmp/onionshare/** rw, # OnionShare compatibility + + @{PROC}/sys/kernel/random/uuid r, + @{PROC}/sys/net/core/somaxconn r, + + deny /etc/group r, + deny /etc/host.conf r, + deny /etc/hosts r, + deny /etc/machine-id r, + deny /etc/mailcap r, + deny /etc/nsswitch.conf r, + deny /etc/os-release r, + deny /etc/passwd r, + deny /etc/resolv.conf r, + deny /etc/services r, + deny /var/lib/dbus/machine-id r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/whonix/torbrowser-updater b/apparmor.d/groups/browsers/torbrowser-updater similarity index 77% rename from apparmor.d/groups/whonix/torbrowser-updater rename to apparmor.d/groups/browsers/torbrowser-updater index 4f0e16823..3bc8e591d 100644 --- a/apparmor.d/groups/whonix/torbrowser-updater +++ b/apparmor.d/groups/browsers/torbrowser-updater @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{HOME}/.tb/tor-browser/Browser/ +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ @{exec_path} = @{lib_dirs}/updater profile torbrowser-updater @{exec_path} { @@ -16,14 +16,12 @@ profile torbrowser-updater @{exec_path} { @{exec_path} mr, @{lib_dirs}/*.so mr, - @{lib_dirs}/firefox{,.real} rPx, + @{lib_dirs}/firefox{,.real} Px, owner @{lib_dirs}/{,**} rw, owner @{tmp}/#@{int} rw, - deny owner @{lib_dirs}/Downloads/** rw, - include if exists } diff --git a/apparmor.d/groups/whonix/torbrowser-vaapitest b/apparmor.d/groups/browsers/torbrowser-vaapitest similarity index 63% rename from apparmor.d/groups/whonix/torbrowser-vaapitest rename to apparmor.d/groups/browsers/torbrowser-vaapitest index d29d1265a..7570d6ce4 100644 --- a/apparmor.d/groups/whonix/torbrowser-vaapitest +++ b/apparmor.d/groups/browsers/torbrowser-vaapitest @@ -7,13 +7,13 @@ abi , include @{name} = torbrowser "tor browser" -@{lib_dirs} = @{HOME}/.tb/tor-browser/Browser/ +@{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ @{data_dirs} = @{lib_dirs}/TorBrowser/Data/ -@{config_dirs} = @{data_dirs}/Browser/*.default/ +@{config_dirs} = @{data_dirs}/Browser/profile.default/ @{cache_dirs} = @{data_dirs}/Browser/Caches @{exec_path} = @{lib_dirs}/vaapitest -profile torbrowser-vaapitest @{exec_path} { +profile torbrowser-vaapitest @{exec_path} flags=(attach_disconnected) { include include @@ -21,11 +21,9 @@ profile torbrowser-vaapitest @{exec_path} { @{exec_path} mr, - owner @{tmp}/@{name}/.parentlock rw, - + deny @{lib_dirs}/{,browser/}omni.ja r, + deny @{cache_dirs}/profile.default/startupCache/* r, deny @{config_dirs}/.parentlock rw, - deny @{config_dirs}/startupCache/** r, - deny @{user_cache_dirs}/startupCache/* r, include if exists } diff --git a/apparmor.d/groups/whonix/torbrowser-start b/apparmor.d/groups/whonix/torbrowser-start deleted file mode 100644 index 266f8e349..000000000 --- a/apparmor.d/groups/whonix/torbrowser-start +++ /dev/null @@ -1,51 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{lib_dirs} = @{HOME}/.tb/tor-browser/Browser/ - -@{exec_path} = @{lib_dirs}/start-tor-browser -profile torbrowser-start @{exec_path} { - include - include - - @{exec_path} rm, - - @{sh_path} rix, - @{bin}/cp rix, - @{bin}/dirname rix, - @{bin}/env r, - @{bin}/expr rix, - @{bin}/file rix, - @{bin}/getconf rix, - @{bin}/grep rix, - @{bin}/id rix, - @{bin}/ln rix, - @{bin}/mkdir rix, - @{bin}/rm rix, - @{bin}/sed rix, - @{bin}/sh rix, - @{bin}/srm rix, - @{lib_dirs}/abicheck rix, - - @{lib_dirs}/firefox{,.real} rPx, - - /etc/magic r, - - owner @{lib_dirs}/.config/ibus/{,**} rw, - owner @{lib_dirs}/.local/* rw, - owner @{lib_dirs}/sed@{rand6} rw, - owner @{lib_dirs}/start-tor-browser.desktop rw, - owner @{lib_dirs}/TorBrowser/Tor/tor r, - - owner @{HOME}/.xsession-errors rw, - owner @{HOME}/.tb/tor-browser/* rw, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/whonix/torbrowser-wrapper b/apparmor.d/groups/whonix/torbrowser-wrapper index 5ae554b40..a659d00f0 100644 --- a/apparmor.d/groups/whonix/torbrowser-wrapper +++ b/apparmor.d/groups/whonix/torbrowser-wrapper @@ -17,24 +17,24 @@ profile torbrowser-wrapper @{exec_path} { @{exec_path} rm, @{sh_path} rix, - @{bin}/basename rix, - @{bin}/cp rix, - @{bin}/dirname rix, - @{bin}/grep rix, - @{bin}/id rix, - @{bin}/mkdir rix, - @{bin}/mktemp rix, - @{bin}/mount rix, - @{bin}/str_replace rix, - @{bin}/sudo rCx -> sudo, - @{bin}/systemctl rCx -> systemctl, - @{bin}/touch rix, - @{bin}/tty rix, - @{bin}/whoami rix, + @{bin}/basename ix, + @{bin}/cp ix, + @{bin}/dirname ix, + @{bin}/grep ix, + @{bin}/id ix, + @{bin}/mkdir ix, + @{bin}/mktemp ix, + @{bin}/mount ix, + @{bin}/str_replace ix, + @{bin}/sudo Cx -> sudo, + @{bin}/systemctl Cx -> systemctl, + @{bin}/touch ix, + @{bin}/tty ix, + @{bin}/whoami ix, - @{lib_dirs}/start-tor-browser rPx, - @{lib}/msgcollector/msgcollector rPx, - @{lib}/open-link-confirmation/open-link-confirmation rPx, + @{lib_dirs}/start-tor-browser Px, # torbrowser-start + @{lib}/msgcollector/msgcollector Px, + @{lib}/open-link-confirmation/open-link-confirmation Px, @{lib}/helper-scripts/* r, From ce51195ff435eaa87e34fcd43cd06a0c07c063de Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 22:56:57 +0100 Subject: [PATCH 0168/1455] feat(profile): add homebank. --- apparmor.d/profiles-g-l/homebank | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 apparmor.d/profiles-g-l/homebank diff --git a/apparmor.d/profiles-g-l/homebank b/apparmor.d/profiles-g-l/homebank new file mode 100644 index 000000000..4c0b0316a --- /dev/null +++ b/apparmor.d/profiles-g-l/homebank @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/homebank +profile homebank @{exec_path} { + include + include + include + + @{exec_path} mr, + + /usr/share/homebank/{,**} r, + + owner @{user_config_dirs}/homebank/{,**} rw, + + include if exists +} + +# vim:syntax=apparmor From 366d5f01c0ade4779a36c179eec08bf0675c419d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 12 Sep 2024 23:17:54 +0100 Subject: [PATCH 0169/1455] feat(profile): add session-desktop. --- apparmor.d/profiles-s-z/session-desktop | 47 +++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 apparmor.d/profiles-s-z/session-desktop diff --git a/apparmor.d/profiles-s-z/session-desktop b/apparmor.d/profiles-s-z/session-desktop new file mode 100644 index 000000000..72c704741 --- /dev/null +++ b/apparmor.d/profiles-s-z/session-desktop @@ -0,0 +1,47 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{name} = {S,s}ession +@{lib_dirs} = /opt/@{name} +@{config_dirs} = @{user_config_dirs}/@{name} +@{cache_dirs} = @{user_cache_dirs}/@{name} + +@{exec_path} = @{bin}/session-messenger-desktop @{lib_dirs}/session-desktop +profile session-desktop @{exec_path} { + include + include + include + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mrix, + + @{lib_dirs}/resources/app.asar.unpacked/ts/webworker/workers/node/**.node mr, + + @{open_path} rPx -> child-open-strict, + + deny / r, + deny @{HOME}/ r, + deny @{HOME}/.pki/{,**} rw, + deny @{user_share_dirs}/gvfs-metadata/* r, + deny @{user_cache_dirs}/thumbnails/** rw, + deny /etc/machine-id r, + deny /var/lib/dbus/machine-id r, + + include if exists +} + +# vim:syntax=apparmor From fadf1f886d7fe8926596b4d905e675daef25463d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 00:02:44 +0100 Subject: [PATCH 0170/1455] chore: kbuildsycoca5 -> kbuildsycoca --- apparmor.d/groups/kde/{kbuildsycoca5 => kbuildsycoca} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename apparmor.d/groups/kde/{kbuildsycoca5 => kbuildsycoca} (78%) diff --git a/apparmor.d/groups/kde/kbuildsycoca5 b/apparmor.d/groups/kde/kbuildsycoca similarity index 78% rename from apparmor.d/groups/kde/kbuildsycoca5 rename to apparmor.d/groups/kde/kbuildsycoca index 8d9fa0bca..005458b08 100644 --- a/apparmor.d/groups/kde/kbuildsycoca5 +++ b/apparmor.d/groups/kde/kbuildsycoca @@ -7,8 +7,8 @@ abi , include -@{exec_path} = @{bin}/kbuildsycoca5 -profile kbuildsycoca5 @{exec_path} flags=(attach_disconnected) { +@{exec_path} = @{bin}/kbuildsycoca{,5} +profile kbuildsycoca @{exec_path} flags=(attach_disconnected) { include include include @@ -20,7 +20,7 @@ profile kbuildsycoca5 @{exec_path} flags=(attach_disconnected) { /dev/tty r, - include if exists + include if exists } # vim:syntax=apparmor From 07928318d4c487b98c98b30866bd63c398e359dc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 00:06:46 +0100 Subject: [PATCH 0171/1455] feat(profile): add tomb. --- apparmor.d/profiles-s-z/tomb | 132 +++++++++++++++++++++++++++++++++++ 1 file changed, 132 insertions(+) create mode 100644 apparmor.d/profiles-s-z/tomb diff --git a/apparmor.d/profiles-s-z/tomb b/apparmor.d/profiles-s-z/tomb new file mode 100644 index 000000000..44a34595e --- /dev/null +++ b/apparmor.d/profiles-s-z/tomb @@ -0,0 +1,132 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/tomb +profile tomb @{exec_path} { + include + include + include + include + include + include + + capability chown, + capability fowner, + capability sys_ptrace, + capability sys_rawio, + + signal send set=cont peer=gpg, + + ptrace read peer=@{p_systemd_user}, + + @{exec_path} mr, + + @{bin}/{,e,f}grep rix, + @{bin}/awk rix, + @{bin}/basename rix, + @{bin}/cat rix, + @{bin}/chmod rix, + @{bin}/chown rix, + @{bin}/cp rix, + @{bin}/date rix, + @{bin}/dcfldd rix, + @{bin}/dd rix, + @{bin}/df rix, + @{bin}/dirname rix, + @{bin}/env rix, + @{bin}/file rix, + @{bin}/findmnt rix, + @{bin}/gawk rix, + @{bin}/getent rix, + @{bin}/gettext rix, + @{bin}/hostname rix, + @{bin}/id rix, + @{bin}/kill rix, + @{bin}/locate rix, + @{bin}/losetup rix, + @{bin}/ls rix, + @{bin}/lsof rix, + @{bin}/mkdir rix, + @{bin}/mktemp rix, + @{bin}/realpath rix, + @{bin}/recoll rix, + @{bin}/rm rix, + @{bin}/rmdir rix, + @{bin}/sha*sum rix, + @{bin}/shred rix, + @{bin}/sleep rix, + @{bin}/stat rix, + @{bin}/sudo rix, + @{bin}/touch rix, + @{bin}/tr rix, + @{bin}/zsh rix, + + @{bin}/btrfs rPx, + @{bin}/cryptsetup rPUx, + @{bin}/e2fsc rPUx, + @{bin}/fsck rPx, + @{bin}/gpg{,2} rPx, + @{bin}/lsblk rPx, + @{bin}/mkfs.* rPUx, + @{bin}/mount rPx, + @{bin}/pinentry rPx, + @{bin}/pinentry-* rPx, + @{bin}/qrencode rPx, + @{bin}/resize2fs rPx, + @{bin}/tomb-kdb-pbkdf2 rPUx, + @{bin}/tune2fs rPx, + @{bin}/umount rCx -> umount, + @{bin}/updatedb.mlocate rPx, + @{bin}/zramctl rPx, + + /usr/share/file/** r, + /usr/share/terminfo/** r, + + @{MOUNTDIRS}/ rw, + @{MOUNTS}/ rw, + @{MOUNTS}/** w, + @{MOUNTS}/**/ rw, + owner @{MOUNTS}/.{host,last,tty,uid,cleanexit} rw, + + # TODO: access to tomb files and key. + @{user_private_dirs}/**/*tomb* rw, + + /tmp/ r, + owner @{tmp}/@{int} rw, + owner @{tmp}/@{int}@{int} rw, + owner @{tmp}/zsh@{rand6} rw, + owner @{tmp}/zshm@{rand6} rw, + + @{sys}/devices/virtual/block/zram@{int}/backing_dev r, + + @{PROC}/swaps r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, + + /dev/loop-control rw, + /dev/loop@{int} rw, + + profile umount { + include + include + + capability sys_admin, + + umount @{MOUNTS}/{,*/}, + + @{bin}/umount mr, + + owner @{run}/mount/utab r, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor From 9609f0b617d1e8e7291ca8415085ccab96bdbcc4 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Fri, 13 Sep 2024 10:53:53 +0800 Subject: [PATCH 0172/1455] Update profile for sbctl --- apparmor.d/profiles-s-z/sbctl | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-s-z/sbctl b/apparmor.d/profiles-s-z/sbctl index 57d8fb5e6..db71eb7e0 100644 --- a/apparmor.d/profiles-s-z/sbctl +++ b/apparmor.d/profiles-s-z/sbctl @@ -18,6 +18,7 @@ profile sbctl @{exec_path} { @{bin}/lsblk rPx, /usr/share/secureboot/{,**} rw, + /var/lib/sbctl/{,**} rw, /{boot,efi}/{,**} r, /{boot,efi}/EFI/{,**} rw, From 1807f1dfe5891628732eb77428a40d2155f12eef Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 19:39:51 +0100 Subject: [PATCH 0173/1455] feat(tunable): add busmae variable for dbus unique name. --- .../bus/com.canonical.Unity.LauncherEntry | 4 +-- .../abstractions/bus/fi.w1.wpa_supplicant1 | 18 ++++++------ .../abstractions/bus/net.hadess.PowerProfiles | 2 +- .../bus/net.hadess.SwitcherooControl | 2 +- .../abstractions/bus/net.reactivated.Fprint | 2 +- apparmor.d/abstractions/bus/org.a11y | 4 +-- apparmor.d/abstractions/bus/org.bluez | 8 +++--- .../abstractions/bus/org.freedesktop.Accounts | 10 +++---- .../abstractions/bus/org.freedesktop.Avahi | 2 +- .../bus/org.freedesktop.ColorManager | 8 +++--- .../bus/org.freedesktop.FileManager1 | 4 +-- .../abstractions/bus/org.freedesktop.GeoClue2 | 10 +++---- .../bus/org.freedesktop.ModemManager1 | 4 +-- .../bus/org.freedesktop.NetworkManager | 28 +++++++++---------- .../bus/org.freedesktop.Notifications | 6 ++-- .../bus/org.freedesktop.PackageKit | 2 +- .../bus/org.freedesktop.PolicyKit1 | 8 +++--- .../bus/org.freedesktop.RealtimeKit1 | 4 +-- .../abstractions/bus/org.freedesktop.UDisks2 | 20 ++++++------- .../abstractions/bus/org.freedesktop.UPower | 12 ++++---- .../bus/org.freedesktop.background.Monitor | 4 +-- .../bus/org.freedesktop.hostname1 | 2 +- ...rg.freedesktop.impl.portal.PermissionStore | 4 +-- .../abstractions/bus/org.freedesktop.locale1 | 2 +- .../abstractions/bus/org.freedesktop.login1 | 10 +++---- .../bus/org.freedesktop.login1.Session | 14 +++++----- .../bus/org.freedesktop.portal.Desktop | 10 +++---- .../abstractions/bus/org.freedesktop.resolve1 | 2 +- .../abstractions/bus/org.freedesktop.secrets | 8 +++--- .../bus/org.freedesktop.systemd1-session | 4 +-- .../bus/org.freedesktop.timedate1 | 2 +- .../bus/org.gnome.ArchiveManager1 | 4 +-- .../abstractions/bus/org.gnome.DisplayManager | 2 +- .../bus/org.gnome.Mutter.DisplayConfig | 10 +++---- .../bus/org.gnome.Mutter.IdleMonitor | 6 ++-- .../bus/org.gnome.Nautilus.FileOperations2 | 6 ++-- .../abstractions/bus/org.gnome.ScreenSaver | 6 ++-- .../abstractions/bus/org.gnome.SessionManager | 18 ++++++------ .../bus/org.gnome.Shell.Introspect | 8 +++--- .../bus/org.gtk.Private.RemoteVolumeMonitor | 6 ++-- .../abstractions/bus/org.gtk.vfs.Daemon | 2 +- .../abstractions/bus/org.gtk.vfs.Metadata | 4 +-- .../abstractions/bus/org.gtk.vfs.MountTracker | 6 ++-- apparmor.d/tunables/multiarch.d/system | 3 ++ 44 files changed, 152 insertions(+), 149 deletions(-) diff --git a/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry b/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry index 3eceb53ab..7aa5e7f75 100644 --- a/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry +++ b/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry @@ -12,12 +12,12 @@ dbus receive bus=session path=/com/canonical/unity/launcherentry/@{int} interface=com.canonical.dbusmenu member={GetLayout,GetGroupProperties} - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus receive bus=session path=/com/canonical/unity/launcherentry/@{int} interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), include if exists diff --git a/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 b/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 index a8e3d52a5..458d99eef 100644 --- a/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 +++ b/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 @@ -5,47 +5,47 @@ dbus send bus=system path=/fi/w1/wpa_supplicant1 interface=org.freedesktop.DBus.Properties member={GetAll,PropertiesChanged} - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus send bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int} interface=org.freedesktop.DBus.Properties member={GetAll,Set} - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus send bus=system path=/fi/w1/wpa_supplicant1 interface=fi.w1.wpa_supplicant1.Interface member=CreateInterface - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus send bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int} interface=fi.w1.wpa_supplicant1.Interface member={AddNetwork,Disconnect,RemoveNetwork,Scan,SelectNetwork} - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus send bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int} interface=fi.w1.wpa_supplicant1.Interface.P2PDevice member=Cancel - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus receive bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager member=InterfacesRemoved - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus receive bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int} interface=fi.w1.wpa_supplicant1.Interface member={BSSAdded,BSSRemoved,NetworkAdded,NetworkRemoved,NetworkSelected,ScanDone,PropertiesChanged} - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus receive bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int} interface=org.freedesktop.DBus.Properties member={GetAll,PropertiesChanged} - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), dbus receive bus=system path=/fi/w1/wpa_supplicant1/Interfaces/@{int}/BSSs/@{int} interface=org.freedesktop.DBus.Properties member={GetAll,PropertiesChanged} - peer=(name=:*, label=wpa-supplicant), + peer=(name="@{busname}", label=wpa-supplicant), include if exists diff --git a/apparmor.d/abstractions/bus/net.hadess.PowerProfiles b/apparmor.d/abstractions/bus/net.hadess.PowerProfiles index b4032e033..1bee9da46 100644 --- a/apparmor.d/abstractions/bus/net.hadess.PowerProfiles +++ b/apparmor.d/abstractions/bus/net.hadess.PowerProfiles @@ -5,7 +5,7 @@ dbus send bus=system path=/net/hadess/PowerProfiles interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=power-profiles-daemon), + peer=(name="@{busname}", label=power-profiles-daemon), include if exists diff --git a/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl b/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl index 55e4f414d..84422b28e 100644 --- a/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl +++ b/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl @@ -5,7 +5,7 @@ dbus send bus=system path=/net/hadess/SwitcherooControl interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=switcheroo-control), + peer=(name="@{busname}", label=switcheroo-control), include if exists diff --git a/apparmor.d/abstractions/bus/net.reactivated.Fprint b/apparmor.d/abstractions/bus/net.reactivated.Fprint index 7e7b21565..ad16d10a2 100644 --- a/apparmor.d/abstractions/bus/net.reactivated.Fprint +++ b/apparmor.d/abstractions/bus/net.reactivated.Fprint @@ -5,7 +5,7 @@ dbus send bus=system path=/net/reactivated/Fprint/Manager interface=net.reactivated.Fprint.Manager member={GetDevices,GetDefaultDevice} - peer=(name=:*, label=fprintd), + peer=(name="@{busname}", label=fprintd), dbus send bus=system path=/net/reactivated/Fprint/Manager interface=net.reactivated.Fprint.Manager diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y index 5103361c9..deb517f1d 100644 --- a/apparmor.d/abstractions/bus/org.a11y +++ b/apparmor.d/abstractions/bus/org.a11y @@ -7,7 +7,7 @@ dbus receive bus=accessibility path=/org/a11y/atspi/registry interface=org.a11y.atspi.Registry member=EventListenerDeregistered - peer=(name=:*, label=at-spi2-registryd), + peer=(name="@{busname}", label=at-spi2-registryd), dbus send bus=accessibility path=/org/a11y/atspi/registry interface=org.a11y.atspi.Registry @@ -22,7 +22,7 @@ dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root interface=org.freedesktop.DBus.Properties member=Set - peer=(name=:*, label=at-spi2-registryd), + peer=(name="@{busname}", label=at-spi2-registryd), dbus send bus=accessibility path=/org/a11y/atspi/accessible/root interface=org.a11y.atspi.Socket diff --git a/apparmor.d/abstractions/bus/org.bluez b/apparmor.d/abstractions/bus/org.bluez index 7c86817f5..d6ed8922d 100644 --- a/apparmor.d/abstractions/bus/org.bluez +++ b/apparmor.d/abstractions/bus/org.bluez @@ -5,17 +5,17 @@ dbus receive bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=InterfacesRemoved - peer=(name="{:*,org.bluez}", label=bluetoothd), + peer=(name="{@{busname},org.bluez}", label=bluetoothd), dbus receive bus=system path=/org/bluez/hci@{int}{,/**} interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name="{:*,org.bluez}", label=bluetoothd), + peer=(name="{@{busname},org.bluez}", label=bluetoothd), dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name="{:*,org.bluez}", label=bluetoothd), + peer=(name="{@{busname},org.bluez}", label=bluetoothd), dbus send bus=system path=/org/bluez interface=org.bluez.AgentManager@{int} @@ -30,7 +30,7 @@ dbus send bus=system path=/org/bluez/hci@{int} interface=org.freedesktop.DBus.Properties member=Set - peer=(name="{:*,org.bluez}", label=bluetoothd), + peer=(name="{@{busname},org.bluez}", label=bluetoothd), dbus send bus=system path=/org/bluez/hci@{int} interface=org.bluez.BatteryProviderManager@{int} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Accounts b/apparmor.d/abstractions/bus/org.freedesktop.Accounts index 10a9e8fc0..946189fe5 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Accounts +++ b/apparmor.d/abstractions/bus/org.freedesktop.Accounts @@ -5,27 +5,27 @@ dbus send bus=system path=/org/freedesktop/Accounts interface=org.freedesktop.Accounts member={FindUserByName,ListCachedUsers} - peer=(name=:*, label=accounts-daemon), + peer=(name="@{busname}", label=accounts-daemon), dbus send bus=system path=/org/freedesktop/Accounts{,/User@{uid}} interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=accounts-daemon), + peer=(name="@{busname}", label=accounts-daemon), dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.Accounts.User member=*Changed - peer=(name=:*, label=accounts-daemon), + peer=(name="@{busname}", label=accounts-daemon), dbus receive bus=system path=/org/freedesktop/Accounts interface=org.freedesktop.Accounts member=UserAdded - peer=(name=:*, label=accounts-daemon), + peer=(name="@{busname}", label=accounts-daemon), dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.DBus.Properties member=*Changed - peer=(name=:*, label=accounts-daemon), + peer=(name="@{busname}", label=accounts-daemon), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Avahi b/apparmor.d/abstractions/bus/org.freedesktop.Avahi index 8b24700db..73ddaf14e 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Avahi +++ b/apparmor.d/abstractions/bus/org.freedesktop.Avahi @@ -20,7 +20,7 @@ dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} interface=org.freedesktop.Avahi.ServiceBrowser member={ItemNew,AllForNow,CacheExhausted} - peer=(name=:*, label=avahi-daemon), + peer=(name="@{busname}", label=avahi-daemon), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager index 3950b77aa..6f5c7acf3 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager @@ -5,22 +5,22 @@ dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member=GetDevices - peer=(name=:*, label=colord), + peer=(name="@{busname}", label=colord), dbus send bus=system path=/org/freedesktop/ColorManager{,/**} interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=colord), + peer=(name="@{busname}", label=colord), dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member=CreateDevice - peer=(name=:*, label=colord), + peer=(name="@{busname}", label=colord), dbus receive bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member={DeviceAdded,DeviceRemoved} - peer=(name=:*, label=colord), + peer=(name="@{busname}", label=colord), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 b/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 index b4e985b9e..36f5b405e 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 @@ -5,12 +5,12 @@ dbus send bus=session path=/org/freedesktop/FileManager1 interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=nautilus), + peer=(name="@{busname}", label=nautilus), dbus receive bus=session path=/org/freedesktop/FileManager1 interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=nautilus), + peer=(name="@{busname}", label=nautilus), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 index 836e99d94..af34b33fe 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 +++ b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 @@ -5,7 +5,7 @@ dbus send bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=geoclue), + peer=(name="@{busname}", label=geoclue), dbus send bus=system path=/org/freedesktop/GeoClue2/Agent interface=org.freedesktop.DBus.Properties @@ -15,22 +15,22 @@ dbus receive bus=system path=/org/freedesktop/GeoClue2/Agent interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=geoclue), + peer=(name="@{busname}", label=geoclue), dbus send bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=geoclue), + peer=(name="@{busname}", label=geoclue), dbus send bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.GeoClue2.Manager member=AddAgent - peer=(name=:*, label=geoclue), + peer=(name="@{busname}", label=geoclue), dbus receive bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=geoclue), + peer=(name="@{busname}", label=geoclue), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 b/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 index 217b588a4..84ce80b6e 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 @@ -10,12 +10,12 @@ dbus send bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name=:*, label=ModemManager), + peer=(name="@{busname}", label=ModemManager), dbus send bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=ModemManager), + peer=(name="@{busname}", label=ModemManager), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager index 0fa92d3cc..128f07fe5 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager @@ -5,72 +5,72 @@ dbus send bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.NetworkManager member={GetDevices,GetPermissions} - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager/Settings interface=org.freedesktop.NetworkManager.Settings member=ListConnections - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager/Settings/@{int} interface=org.freedesktop.NetworkManager.Settings.Connection member=GetSettings - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/@{int} interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager/Devices/@{int} interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus receive bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager member=InterfacesAdded - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus receive bus=system path=/org/freedesktop/NetworkManager{,/**} interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus receive bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.DBus.Properties member=CheckPermissions - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus receive bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.NetworkManager member=CheckPermissions - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus receive bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.NetworkManager member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged} - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus receive bus=system path=/org/freedesktop/NetworkManager/Settings/@{int} interface=org.freedesktop.NetworkManager.Settings.Connection member=Updated - peer=(name="{:*,org.freedesktop.NetworkManager}", label=NetworkManager), + peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Notifications b/apparmor.d/abstractions/bus/org.freedesktop.Notifications index 90ee1aefc..27e1e7137 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Notifications +++ b/apparmor.d/abstractions/bus/org.freedesktop.Notifications @@ -5,17 +5,17 @@ dbus send bus=session path=/org/freedesktop/Notifications interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gjs-console), + peer=(name="@{busname}", label=gjs-console), dbus send bus=session path=/org/freedesktop/Notifications interface=org.freedesktop.DBus.Properties member={GetCapabilities,GetServerInformation,Notify} - peer=(name=:*, label=gjs-console), + peer=(name="@{busname}", label=gjs-console), dbus receive bus=session path=/org/freedesktop/Notifications interface=org.freedesktop.DBus.Properties member={GetAll,NotificationClosed,CloseNotification} - peer=(name=:*, label=gjs-console), + peer=(name="@{busname}", label=gjs-console), dbus receive bus=session path=/org/freedesktop/Notifications interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/abstractions/bus/org.freedesktop.PackageKit b/apparmor.d/abstractions/bus/org.freedesktop.PackageKit index 7cdd9a3ce..1a6839b17 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.PackageKit +++ b/apparmor.d/abstractions/bus/org.freedesktop.PackageKit @@ -5,7 +5,7 @@ dbus send bus=system path=/org/freedesktop/PackageKit interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=packagekitd), + peer=(name="@{busname}", label=packagekitd), dbus send bus=system path=/org/freedesktop/PackageKit interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 index 3201e48ce..006dcee84 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 @@ -5,12 +5,12 @@ dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=Changed - peer=(name=:*, label=polkitd), + peer=(name="@{busname}", label=polkitd), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=polkitd), + peer=(name="@{busname}", label=polkitd), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority @@ -20,7 +20,7 @@ dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=CheckAuthorization - peer=(name=:*, label=polkitd), + peer=(name="@{busname}", label=polkitd), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=CheckAuthorization @@ -29,7 +29,7 @@ dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=polkitd), + peer=(name="@{busname}", label=polkitd), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 b/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 index 474c4c625..527c1e916 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 @@ -10,12 +10,12 @@ dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name=:*, label=rtkit-daemon), + peer=(name="@{busname}", label=rtkit-daemon), dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.RealtimeKit1 member=MakeThread* - peer=(name=:*, label=rtkit-daemon), + peer=(name="@{busname}", label=rtkit-daemon), dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.RealtimeKit1 diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 b/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 index 79b882e51..cd415f396 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 +++ b/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 @@ -5,52 +5,52 @@ dbus send bus=system path=/org/freedesktop/UDisks2 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus send bus=system path=/org/freedesktop/UDisks2/** interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus send bus=system path=/ interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus send bus=system path=/ interface=org.freedesktop.DBus.Properties member=Get - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus send bus=system path=/org/freedesktop/UDisks2/drives{,/*} interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus send bus=system path=/org/freedesktop/UDisks2/drives{,/*} interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus send bus=system path=/org/freedesktop/UDisks2/block_devices/* interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus receive bus=system path=/org/freedesktop/UDisks2 interface=org.freedesktop.DBus.ObjectManager member=InterfacesAdded - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus receive bus=system path=/org/freedesktop/UDisks2/jobs/@{int} interface=org.freedesktop.UDisks2.Job member=Completed - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), dbus receive bus=system path=/org/freedesktop/UDisks2/block_devices/* interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name="{:*,org.freedesktop.UDisks2}", label=udisksd), + peer=(name="{@{busname},org.freedesktop.UDisks2}", label=udisksd), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower b/apparmor.d/abstractions/bus/org.freedesktop.UPower index d8341d33c..247e2ddda 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower +++ b/apparmor.d/abstractions/bus/org.freedesktop.UPower @@ -5,12 +5,12 @@ dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower member=EnumerateDevices - peer=(name="{:*,org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), dbus send bus=system path=/org/freedesktop/UPower{,/**} interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="{:*,org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), dbus send bus=system path=/org/freedesktop/UPower{,/**} interface=org.freedesktop.DBus.Properties member={Get,GetAll} @@ -24,22 +24,22 @@ dbus send bus=system path=/org/freedesktop/UPower/devices/* interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="{:*,org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), dbus send bus=system path=/org/freedesktop/UPower/devices/* interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="{:*,org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), dbus receive bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower member=DeviceAdded - peer=(name="{:*,org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), dbus receive bus=system path=/org/freedesktop/UPower/devices/* interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name="{:*,org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor b/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor index 5f951381b..ff7d57989 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor +++ b/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor @@ -5,12 +5,12 @@ dbus send bus=session path=/org/freedesktop/background/monitor interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=xdg-desktop-portal), + peer=(name="@{busname}", label=xdg-desktop-portal), dbus receive bus=session path=/org/freedesktop/background/monitor interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=xdg-desktop-portal), + peer=(name="@{busname}", label=xdg-desktop-portal), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 index 54196d16b..51b0a5cec 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 @@ -5,7 +5,7 @@ dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="{:*,org.freedesktop.hostname1}", label=systemd-hostnamed), + peer=(name="{@{busname},org.freedesktop.hostname1}", label=systemd-hostnamed), dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore b/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore index 6b965a2f5..0fabcd310 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore +++ b/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore @@ -5,12 +5,12 @@ dbus send bus=session path=/org/freedesktop/impl/portal/PermissionStore interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=xdg-permission-store), + peer=(name="@{busname}", label=xdg-permission-store), dbus send bus=session path=/org/freedesktop/impl/portal/PermissionStore interface=org.freedesktop.impl.portal.PermissionStore member=Lookup - peer=(name=:*, label=xdg-permission-store), + peer=(name="@{busname}", label=xdg-permission-store), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.locale1 b/apparmor.d/abstractions/bus/org.freedesktop.locale1 index a2865c7c9..74e51b1d7 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.locale1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.locale1 @@ -5,7 +5,7 @@ dbus send bus=system path=/org/freedesktop/locale1 interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=systemd-localed), + peer=(name="@{busname}", label=systemd-localed), dbus send bus=system path=/org/freedesktop/locale1 interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.login1 b/apparmor.d/abstractions/bus/org.freedesktop.login1 index fdceceea4..595b81335 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.login1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.login1 @@ -5,27 +5,27 @@ dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus receive bus=system path=/org/freedesktop/login1 interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member={Inhibit,CanHibernate,CanHybridSleep,CanPowerOff,CanReboot,CanSuspend,CreateSession,GetSessionByPID} - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus receive bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member={SessionNew,SessionRemoved,UserNew,UserRemoved,PrepareFor*} - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.login1.Session diff --git a/apparmor.d/abstractions/bus/org.freedesktop.login1.Session b/apparmor.d/abstractions/bus/org.freedesktop.login1.Session index 24d5c1452..d5b62f739 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.login1.Session +++ b/apparmor.d/abstractions/bus/org.freedesktop.login1.Session @@ -5,37 +5,37 @@ dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=GetSession - peer=(name=:*, label=systemd-logind), + peer=(name="@{busname}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1{,session/*,seat/*} interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name=:*, label=systemd-logind), + peer=(name="@{busname}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.login1.Session member={ReleaseDevice,TakeControl,TakeDevice,SetBrightness,SetLockedHint,SetIdleHint} - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1/seat/* interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus receive bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=systemd-logind), + peer=(name="@{busname}", label=systemd-logind), dbus receive bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.login1.Session member={PauseDevice,Unlock} - peer=(name="{:*,org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop index a2a1a94a0..820b57ff7 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop +++ b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop @@ -5,27 +5,27 @@ dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.DBus.Properties member={Get,GetAll,Read} - peer=(name="{:*,org.freedesktop.portal.Desktop}", label=xdg-desktop-portal), + peer=(name="{@{busname},org.freedesktop.portal.Desktop}", label=xdg-desktop-portal), dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Settings member={Read,ReadAll} - peer=(name=:*, label=xdg-desktop-portal), + peer=(name="@{busname}", label=xdg-desktop-portal), dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Settings member=SettingChanged - peer=(name=:*, label=xdg-desktop-portal), + peer=(name="@{busname}", label=xdg-desktop-portal), dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name=:*, label=xdg-desktop-portal), + peer=(name="@{busname}", label=xdg-desktop-portal), dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.impl.portal.Settings member={Read,ReadAll} - peer=(name=:*, label=xdg-desktop-portal), + peer=(name="@{busname}", label=xdg-desktop-portal), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 index 3057282c9..7f5b6d1a4 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 @@ -5,7 +5,7 @@ dbus send bus=system path=/org/freedesktop/resolve1 interface=org.freedesktop.resolve1.Manager member={SetLink*,ResolveHostname} - peer=(name="{:*,org.freedesktop.resolve1}", label=systemd-resolved), + peer=(name="{@{busname},org.freedesktop.resolve1}", label=systemd-resolved), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.secrets b/apparmor.d/abstractions/bus/org.freedesktop.secrets index 01ecf0786..bb8014fc0 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.secrets +++ b/apparmor.d/abstractions/bus/org.freedesktop.secrets @@ -5,12 +5,12 @@ dbus send bus=session path=/org/freedesktop/secrets{,/**} interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gnome-keyring-daemon), + peer=(name="@{busname}", label=gnome-keyring-daemon), dbus send bus=session path=/org/freedesktop/secrets interface=org.freedesktop.Secret.Service member={OpenSession,GetSecrets,SearchItems,ReadAlias} - peer=(name=:*, label=gnome-keyring-daemon), + peer=(name="@{busname}", label=gnome-keyring-daemon), dbus send bus=session path=/org/freedesktop/secrets/aliases/default interface=org.freedesktop.Secret.Collection @@ -20,12 +20,12 @@ dbus receive bus=session path=/org/freedesktop/secrets/collection/login interface=org.freedesktop.Secret.Collection member=ItemCreated - peer=(name=:*, label=gnome-keyring-daemon), + peer=(name="@{busname}", label=gnome-keyring-daemon), dbus receive bus=session path=/org/freedesktop/secrets/collection/login interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gnome-keyring-daemon), + peer=(name="@{busname}", label=gnome-keyring-daemon), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session b/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session index c0e852662..8edda758c 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session +++ b/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session @@ -10,12 +10,12 @@ dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="{:*,org.freedesktop.systemd1}", label="@{p_systemd_user}"), + peer=(name="{@{busname},org.freedesktop.systemd1}", label="@{p_systemd_user}"), dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=GetUnit - peer=(name="{:*,org.freedesktop.systemd1}", label="@{p_systemd_user}"), + peer=(name="{@{busname},org.freedesktop.systemd1}", label="@{p_systemd_user}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.timedate1 b/apparmor.d/abstractions/bus/org.freedesktop.timedate1 index 883c5c165..32cc2f451 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.timedate1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.timedate1 @@ -16,7 +16,7 @@ dbus send bus=system path=/org/freedesktop/timedate1 interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=systemd-timedated), + peer=(name="@{busname}", label=systemd-timedated), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 b/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 index 9953ee8bf..078835c41 100644 --- a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 +++ b/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 @@ -5,12 +5,12 @@ dbus send bus=session path=/org/gnome/ArchiveManager1 interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=file-roller), + peer=(name="@{busname}", label=file-roller), dbus send bus=session path=/org/gnome/ArchiveManager1 interface=org.gnome.ArchiveManager1 member=GetSupportedTypes - peer=(name=:*, label=file-roller), + peer=(name="@{busname}", label=file-roller), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.DisplayManager b/apparmor.d/abstractions/bus/org.gnome.DisplayManager index 05945a253..0d76f2388 100644 --- a/apparmor.d/abstractions/bus/org.gnome.DisplayManager +++ b/apparmor.d/abstractions/bus/org.gnome.DisplayManager @@ -5,7 +5,7 @@ dbus send bus=system path=/org/gnome/DisplayManager/Manager interface=org.gnome.DisplayManager.Manager member=RegisterDisplay - peer=(name=:*, label=gdm), + peer=(name="@{busname}", label=gdm), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig b/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig index d701792a6..1449ff4ea 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig +++ b/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig @@ -5,27 +5,27 @@ dbus send bus=session path=/org/gnome/Mutter/DisplayConfig interface=org.gnome.Mutter.DisplayConfig member={GetResources,GetCrtcGamma} - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus send bus=session path=/org/gnome/Mutter/DisplayConfig interface=org.gnome.Mutter.DisplayConfig member=GetCurrentState - peer=(name="{:*,org.gnome.Mutter.DisplayConfig}", label=gnome-shell), + peer=(name="{@{busname},org.gnome.Mutter.DisplayConfig}", label=gnome-shell), dbus send bus=session path=/org/gnome/Mutter/DisplayConfig interface=org.freedesktop.DBus.Properties member={GetAll,PropertiesChanged} - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig interface=org.gnome.Mutter.DisplayConfig member=MonitorsChanged - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor index 7ada64f05..2726a7c54 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor +++ b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor @@ -5,17 +5,17 @@ dbus send bus=session path=/org/gnome/Mutter/IdleMonitor interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus send bus=session path=/org/gnome/Mutter/IdleMonitor/Core interface=org.gnome.Mutter.IdleMonitor member={AddIdleWatch,AddUserActiveWatch,RemoveWatch} - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus receive bus=session path=/org/gnome/Mutter/IdleMonitor/Core interface=org.gnome.Mutter.IdleMonitor member=WatchFired - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 b/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 index e547ab2c5..da9f7229f 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 +++ b/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 @@ -5,17 +5,17 @@ dbus send bus=session path=/org/gnome/Nautilus/FileOperations2 interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=nautilus), + peer=(name="@{busname}", label=nautilus), dbus send bus=session path=/org/gnome/Nautilus/FileOperations2 interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=nautilus), + peer=(name="@{busname}", label=nautilus), dbus receive bus=session path=/org/gnome/Nautilus/FileOperations2 interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=nautilus), + peer=(name="@{busname}", label=nautilus), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.ScreenSaver b/apparmor.d/abstractions/bus/org.gnome.ScreenSaver index 3e228ad1f..15eec0c69 100644 --- a/apparmor.d/abstractions/bus/org.gnome.ScreenSaver +++ b/apparmor.d/abstractions/bus/org.gnome.ScreenSaver @@ -5,17 +5,17 @@ dbus send bus=session path=/org/gnome/ScreenSaver interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gjs-console), + peer=(name="@{busname}", label=gjs-console), dbus send bus=session path=/org/gnome/ScreenSaver interface=org.gnome.ScreenSaver member=GetActive - peer=(name=:*, label=gjs-console), + peer=(name="@{busname}", label=gjs-console), dbus receive bus=session path=/org/gnome/ScreenSaver interface=org.gnome.ScreenSaver member={ActiveChanged,WakeUpScreen} - peer=(name=:*, label=gjs-console), + peer=(name="@{busname}", label=gjs-console), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.SessionManager b/apparmor.d/abstractions/bus/org.gnome.SessionManager index 4197fb4cf..19242d56a 100644 --- a/apparmor.d/abstractions/bus/org.gnome.SessionManager +++ b/apparmor.d/abstractions/bus/org.gnome.SessionManager @@ -7,7 +7,7 @@ dbus send bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={RegisterClient,IsSessionRunning} - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus send bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager @@ -17,42 +17,42 @@ dbus receive bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={ClientAdded,ClientRemoved,SessionRunning,InhibitorRemoved,InhibitorAdded} - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus send bus=session path=/org/gnome/SessionManager interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus receive bus=session path=/org/gnome/SessionManager interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus send bus=session path=/org/gnome/SessionManager/Client@{int} interface=org.gnome.SessionManager.ClientPrivate member=EndSessionResponse - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus receive bus=session path=/org/gnome/SessionManager/Client@{int} interface=org.gnome.SessionManager.ClientPrivate member={CancelEndSession,QueryEndSession,EndSession,Stop} - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus send bus=session path=/org/gnome/SessionManager/Client@{int} interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus receive bus=session path=/org/gnome/SessionManager/Client@{int} interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus receive bus=session path=/org/gnome/SessionManager/Presence interface=org.gnome.SessionManager.Presence member=StatusChanged - peer=(name=:*, label=gnome-session-binary), + peer=(name="@{busname}", label=gnome-session-binary), dbus send bus=session path=/org/gnome/SessionManager interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect b/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect index 72e4525bc..ed39a2533 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect +++ b/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect @@ -5,7 +5,7 @@ dbus send bus=session path=/org/gnome/Shell/Introspect interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus send bus=session path=/org/gnome/Shell/Introspect interface=org.freedesktop.DBus.Properties @@ -15,17 +15,17 @@ dbus send bus=session path=/org/gnome/Shell/Introspect interface=org.gnome.Shell.Introspect member=GetRunningApplications - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus receive bus=session path=/org/gnome/Shell/Introspect interface=org.gnome.Shell.Introspect member={RunningApplicationsChanged,WindowsChanged} - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), dbus receive bus=session path=/org/gnome/Shell/Introspect interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gnome-shell), + peer=(name="@{busname}", label=gnome-shell), include if exists diff --git a/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor b/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor index 73d958513..0ad921ed3 100644 --- a/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor +++ b/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor @@ -5,17 +5,17 @@ dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor member={List,IsSupported,VolumeChanged,VolumeMount,MountAdded} - peer=(name=:*, label=gvfs-*-volume-monitor), + peer=(name="@{busname}", label=gvfs-*-volume-monitor), dbus receive bus=session path=/org/gtk/Private/RemoteVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor member={MountAdded,MountChanged,VolumeChanged,VolumeRemoved} - peer=(name=:*, label=gvfs-*-volume-monitor), + peer=(name="@{busname}", label=gvfs-*-volume-monitor), dbus receive bus=session path=/org/gtk/Private/RemoteVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor member={VolumeAdded,DriveDisconnected,DriveConnected,DriveChanged} - peer=(name=:*, label=gvfs-*-volume-monitor), + peer=(name="@{busname}", label=gvfs-*-volume-monitor), include if exists diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon b/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon index 35cd640d6..3e0d95f18 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon @@ -5,7 +5,7 @@ dbus send bus=session path=/org/gtk/vfs/Daemon interface=org.gtk.vfs.Daemon member={GetConnection,ListMonitorImplementations,ListMountableInfo} - peer=(name=:*, label=gvfsd), + peer=(name="@{busname}", label=gvfsd), include if exists diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata b/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata index 33d3c1c36..e755faa6a 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata @@ -5,12 +5,12 @@ dbus send bus=session path=/org/gtk/vfs/metadata interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gvfsd-metadata), + peer=(name="@{busname}", label=gvfsd-metadata), dbus receive bus=session path=/org/gtk/vfs/metadata interface=org.gtk.vfs.Metadata member=AttributeChanged - peer=(name=:*, label=gvfsd-metadata), + peer=(name="@{busname}", label=gvfsd-metadata), include if exists diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker b/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker index 4d59f0afc..575401ee6 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker @@ -5,17 +5,17 @@ dbus send bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker member=ListMountableInfo - peer=(name=:*, label=gvfsd), + peer=(name="@{busname}", label=gvfsd), dbus send bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker member=ListMounts2 - peer=(name=:*, label=gvfsd), + peer=(name="@{busname}", label=gvfsd), dbus receive bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker member=Mounted - peer=(name=:*, label=gvfsd), + peer=(name="@{busname}", label=gvfsd), include if exists diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index c6b22f9e0..036fd1a70 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -98,6 +98,9 @@ @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 +# Dbus unique name +@{busname}=:1.@{u16} + # Common architecture names @{arch}=x86_64 amd64 i386 From 5474a5fa69e73566ff1ac5bec851bb6f549b876f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 19:40:17 +0100 Subject: [PATCH 0174/1455] feat(tunable): update the arch variable. --- apparmor.d/tunables/multiarch.d/system | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 036fd1a70..4fb8304cd 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -102,7 +102,7 @@ @{busname}=:1.@{u16} # Common architecture names -@{arch}=x86_64 amd64 i386 +@{arch}=x86_64 amd64 i386 i686 # OpenSUSE does not have the same multiarch structure @{multiarch}+=*-suse-linux* #aa:only opensuse From db064b651e86548fbfc366d94a816b8d7ab2eec2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 19:47:07 +0100 Subject: [PATCH 0175/1455] feat(profile): general update. --- apparmor.d/abstractions/app-open | 1 + apparmor.d/abstractions/app/chromium | 2 ++ apparmor.d/groups/_full/systemd | 6 +--- .../groups/gnome/evolution-user-prompter | 2 ++ apparmor.d/groups/gnome/gjs-console | 4 +-- .../groups/gnome/gnome-extension-gsconnect | 2 -- apparmor.d/groups/gnome/gnome-session-binary | 7 +---- apparmor.d/groups/gnome/gnome-software | 23 +++++++++++++-- apparmor.d/groups/gnome/gsd-power | 6 +--- apparmor.d/groups/whonix/msgdispatcher | 1 - apparmor.d/profiles-a-f/aa-enforce | 2 +- apparmor.d/profiles-m-r/minitube | 29 +------------------ apparmor.d/profiles-s-z/signal-desktop | 3 +- 13 files changed, 32 insertions(+), 56 deletions(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 8c4efc350..c47c7ca69 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -38,6 +38,7 @@ @{bin}/gnome-calculator rPUx, @{bin}/gnome-disk-image-mounter rPx, @{bin}/gnome-disks rPx, + @{bin}/gnome-software rPx, @{bin}/gwenview rPUx, @{bin}/kgx rPx, @{bin}/qbittorrent rPx, diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index e80a7e0f4..a392507b5 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -26,6 +26,8 @@ include include include + include + include include include include diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index aa1f1729d..d85d04e2f 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -155,13 +155,9 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{lib}/ r, / r, - /boot/ r, + /*/ r, /boot/efi/ r, - /efi/ r, - /snap/ r, /snap/*/@{int}/ r, - /tmp/ r, - /usr/ r, /var/cache/*/ r, /var/lib/*/ r, /var/tmp/ r, diff --git a/apparmor.d/groups/gnome/evolution-user-prompter b/apparmor.d/groups/gnome/evolution-user-prompter index 560f2bdb0..d9d2e6a55 100644 --- a/apparmor.d/groups/gnome/evolution-user-prompter +++ b/apparmor.d/groups/gnome/evolution-user-prompter @@ -10,6 +10,8 @@ include profile evolution-user-prompter @{exec_path} { include include + include + include #aa:dbus own bus=session name=org.gnome.evolution.dataserver.UserPrompter0 diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index e51ed5b8d..cf1ace48c 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -35,9 +35,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.Shell.Notifications #aa:dbus own bus=session name=org.gnome.Shell.Screencast - dbus send bus=session path=/org/gnome/Mutter/ScreenCast - interface=org.freedesktop.DBus.Properties - peer=(name=:*, label=gnome-shell), + #aa:dbus talk bus=session name=org.gnome.Mutter.ScreenCast label=gnome-shell dbus send bus=session path=/org/gnome/Shell interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 3083c73f9..58b528704 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -62,8 +62,6 @@ profile gnome-extension-gsconnect @{exec_path} { owner @{PROC}/@{pid}/status r, owner @{PROC}/@{pid}/task/@{tid}/stat r, - /dev/shm/ r, - include if exists } diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index e08ae61d3..795153fb1 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -14,7 +14,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -33,17 +32,13 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { signal (send) set=(term) peer=gsd-*, #aa:dbus own bus=session name=org.gnome.SessionManager + #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID,UpdateActivationEnvironment} peer=(name=org.freedesktop.DBus label=dbus-session), - dbus send bus=system path=/org/freedesktop/login1 - interface=org.freedesktop.login1.Manager - member={CanPowerOff,PowerOff,Reboot} - peer=(name=:*, label=systemd-logind), - dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager peer=(name=org.freedesktop.systemd1, label="@{p_systemd_user}"), diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 290aa4454..dbd07fe7d 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -75,8 +75,11 @@ profile gnome-software @{exec_path} { owner @{HOME}/.var/app/{,**} rw, + owner @{user_download_dirs}/*.flatpakref r, + owner @{user_cache_dirs}/flatpak/{,**} rwl, - owner @{user_cache_dirs}/gnome-software/{,**} rw, + owner @{user_cache_dirs}/gnome-software/ rw, + owner @{user_cache_dirs}/gnome-software/** rwlk -> @{user_cache_dirs}/gnome-software/**, owner @{user_config_dirs}/flatpak/{,**} r, owner @{user_config_dirs}/pulse/*.conf r, @@ -124,6 +127,8 @@ profile gnome-software @{exec_path} { /dev/fuse rw, + deny owner @{user_share_dirs}/gvfs-metadata/* r, + profile gpg { include @@ -131,14 +136,26 @@ profile gnome-software @{exec_path} { @{bin}/gpgconf mr, @{bin}/gpgsm mr, + @{bin}/gpg-agent rix, + @{bin}/gpg-connect-agent rix, + @{lib}/{,gnupg/}scdaemon rix, + @{HOME}/@{XDG_GPG_DIR}/*.conf r, @{tmp}/ r, owner @{tmp}/ostree-gpg-@{rand6}/ r, owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, - owner @{run}/user/@{uid}/gnupg/ w, - + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/gnupg/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw, + owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, + + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + include if exists } diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 0f4b3cd3c..9a197e5bf 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -20,7 +20,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -37,10 +36,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Power - dbus send bus=session path=/org/gnome/Mutter/DisplayConfig - interface=org.freedesktop.DBus.Properties - member=Set - peer=(name=:*, label=gnome-shell), + #aa:dbus talk bus=session name=org.gnome.Mutter.DisplayConfig label=gnome-shell dbus send bus=system path=/org/freedesktop/UPower/KbdBacklight interface=org.freedesktop.UPower.KbdBacklight diff --git a/apparmor.d/groups/whonix/msgdispatcher b/apparmor.d/groups/whonix/msgdispatcher index 02433106d..9f2871eef 100644 --- a/apparmor.d/groups/whonix/msgdispatcher +++ b/apparmor.d/groups/whonix/msgdispatcher @@ -39,7 +39,6 @@ profile msgdispatcher @{exec_path} { include include - @{bin}/sudo mr, @{lib}/msgcollector/* rPx, owner @{run}/msgcollector/user/msgdispatcher_x_* r, diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index 3a803756c..71823cb4c 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -32,7 +32,7 @@ profile aa-enforce @{exec_path} { owner @{tmp}/@{rand8} rw, owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, - owner @{PROC}/@{pid}/fd r, + @{PROC}/@{pid}/fd r, include if exists } diff --git a/apparmor.d/profiles-m-r/minitube b/apparmor.d/profiles-m-r/minitube index 4d4d26655..b349940ca 100644 --- a/apparmor.d/profiles-m-r/minitube +++ b/apparmor.d/profiles-m-r/minitube @@ -30,9 +30,7 @@ profile minitube @{exec_path} { @{exec_path} mr, - # Be able to turn off the screensaver while playing movies - @{bin}/xdg-screensaver rCx -> xdg-screensaver, - + @{bin}/xdg-screensaver rPx, @{open_path} rPx -> child-open, /usr/share/minitube/{,**} r, @@ -69,31 +67,6 @@ profile minitube @{exec_path} { /dev/shm/#@{int} rw, owner /dev/tty@{int} rw, - profile xdg-screensaver { - include - include - - @{bin}/xdg-screensaver mr, - - @{sh_path} rix, - @{bin}/mv rix, - @{bin}/{,e}grep rix, - @{bin}/sed rix, - @{bin}/which{,.debianutils} rix, - @{bin}/xset rix, - @{bin}/xautolock rix, - @{bin}/dbus-send rix, - - owner @{HOME}/.Xauthority r, - - # file_inherit - /dev/dri/card@{int} rw, - network inet stream, - network inet6 stream, - - include if exists - } - include if exists } diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index 73474ce7f..484f42dd9 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -31,9 +31,8 @@ profile signal-desktop @{exec_path} { @{exec_path} mrix, - # @{bin}/basename rix, @{bin}/getconf rix, - @{open_path} rPx -> child-open-strict, + @{open_path} rPx -> child-open-strict, #aa:stack X xdg-settings @{bin}/xdg-settings rPx -> signal-desktop//&xdg-settings, From 4ccf2156de7d6df6730dbe18a7ef203bd639dea5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 20:07:41 +0100 Subject: [PATCH 0176/1455] fix(abs): base: allow inherited mesa cache mesa 24.2 introduced a shader disk cache which is enabled by default, which opens quite a lot of fd. They are not closed and get inherited by child programs. Denying it can cause crash, so we are allowing it globally while the issue is beeing fixed in mesa. See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/11810 --- apparmor.d/abstractions/base.d/complete | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index e9761b843..f0b3efdaf 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -24,6 +24,12 @@ @{etc_rw}/localtime r, /etc/locale.conf r, + # mesa 24.2 introduced a shader disk cache which opens quite a lot of fd. + # They are not closed and get inherited by child programs. Denying it can cause + # crash, so we are allowing it globally while the issue is beeing fixed in mesa. + owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.db rw, + owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.idx rw, + @{sys}/devices/system/cpu/possible r, @{PROC}/sys/kernel/core_pattern r, From b03b9b05ebf5526c8565fee9d3a922ff5adf777d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 20:41:22 +0100 Subject: [PATCH 0177/1455] feat(profile): improve kde integration. see #484 --- apparmor.d/abstractions/app/chromium | 6 ++++ apparmor.d/groups/browsers/brave | 4 +-- apparmor.d/groups/freedesktop/xorg | 37 ++++++++++++----------- apparmor.d/groups/kde/baloo | 25 +++++++++++++++ apparmor.d/groups/kde/baloorunner | 6 ++++ apparmor.d/groups/kde/kde-powerdevil | 1 + apparmor.d/groups/kde/kscreenlocker_greet | 4 ++- apparmor.d/groups/kde/ksmserver | 1 + apparmor.d/groups/kde/kwin_wayland | 5 +++ apparmor.d/groups/kde/plasmashell | 6 ++++ apparmor.d/groups/kde/sddm-greeter | 5 +-- apparmor.d/groups/network/tailscaled | 7 +++-- 12 files changed, 81 insertions(+), 26 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index a392507b5..0066e5eec 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -137,6 +137,12 @@ owner @{cache_dirs}/{,**} rw, + owner @{user_config_dirs}/kcminputrc r, + owner @{user_config_dirs}/kdedefaults/kcminputrc r, + owner @{user_config_dirs}/kioslaverc r, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu r, + # For importing data (bookmarks, cookies, etc) from Firefox # owner @{HOME}/.mozilla/firefox/profiles.ini r, # owner @{HOME}/.mozilla/firefox/*/ r, diff --git a/apparmor.d/groups/browsers/brave b/apparmor.d/groups/browsers/brave index 4d065dce4..543548f98 100644 --- a/apparmor.d/groups/browsers/brave +++ b/apparmor.d/groups/browsers/brave @@ -34,9 +34,6 @@ profile brave @{exec_path} { /etc/opt/chrome/native-messaging-hosts/* r, owner @{user_config_dirs}/BraveSoftware/ rw, - owner @{user_config_dirs}/kioslaverc r, - owner @{user_config_dirs}/menus/applications-merged/ r, - owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu r, owner @{config_dirs}/WidevineCdm/libwidevinecdm.so mrw, owner @{cache_dirs}/BraveSoftware/ rw, @@ -44,6 +41,7 @@ profile brave @{exec_path} { owner @{tmp}/net-export/ rw, # For brave://net-export/ # Silencer + deny /etc/opt/ w, deny /etc/opt/chrome/ w, deny /dev/disk/by-uuid/ r, diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 878b85004..5797f27bf 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -87,6 +87,25 @@ profile xorg @{exec_path} flags=(attach_disconnected) { owner @{tmp}/server-* rwk, owner @{tmp}/serverauth.* r, + @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+dmi* r, # for motherboard info + @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs + @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+i2c:* r, + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) + @{run}/udev/data/+platform:* r, # for ? + @{run}/udev/data/+serio:* r, # for touchpad? + @{run}/udev/data/+sound:card@{int} r, # for sound card + @{run}/udev/data/+usb* r, # for USB mouse and keyboard + + @{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]* + @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx + @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** + @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* + @{sys}/bus/ r, @{sys}/bus/pci/devices/ r, @{sys}/class/ r, @@ -103,23 +122,6 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{sys}/devices/platform/ r, @{sys}/module/i915/{,**} r, - @{run}/udev/data/+acpi:* r, # for acpi - @{run}/udev/data/+dmi* r, # for motherboard info - @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard - @{run}/udev/data/+i2c:* r, - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, # for ? - @{run}/udev/data/+serio:* r, # for touchpad? - @{run}/udev/data/+usb* r, # for USB mouse and keyboard - @{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]* - @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx - @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features - @{run}/udev/data/c13:@{int} r, # for /dev/input/* - @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** - @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* - @{PROC}/@{pids}/cmdline r, @{PROC}/cmdline r, @{PROC}/ioports r, @@ -127,6 +129,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { /dev/fb@{int} rw, /dev/input/event@{int} rw, + /dev/input/mouse@{int} rw, /dev/shm/#@{int} rw, /dev/shm/shmfd-* rw, /dev/tty rw, diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index 3b5efe387..780348692 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -42,8 +42,33 @@ profile baloo @{exec_path} { owner @{user_share_dirs}/baloo/{,**} rwk, + @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+backlight:* r, + @{run}/udev/data/+bluetooth:* r, + @{run}/udev/data/+dmi:* r, # For motherboard info + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/+leds:* r, + @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) + @{run}/udev/data/+platform:* r, + @{run}/udev/data/+power_supply* r, + @{run}/udev/data/+rfkill:* r, + @{run}/udev/data/+sound:card@{int} r, # for sound card + + @{run}/udev/data/c1:@{int} r, # For RAM disk + @{run}/udev/data/c4:@{int} r, # For TTY devices + @{run}/udev/data/c7:@{int} r, # For Virtual console capture devices + @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features + @{run}/udev/data/c13:@{int} r, # For /dev/input/* + @{run}/udev/data/c29:@{int} r, # For /dev/fb[0-9]* + @{run}/udev/data/c89:@{int} r, # For I2C bus interface + @{run}/udev/data/c116:@{int} r, # For ALSA + @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* + @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{sys}/bus/ r, @{sys}/bus/*/devices/ r, + @{sys}/class/*/ r, + @{sys}/devices/**/uevent r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/kde/baloorunner b/apparmor.d/groups/kde/baloorunner index 1b5d79492..7faa752d6 100644 --- a/apparmor.d/groups/kde/baloorunner +++ b/apparmor.d/groups/kde/baloorunner @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}baloorunner profile baloorunner @{exec_path} { include + include include include include @@ -20,6 +21,11 @@ profile baloorunner @{exec_path} { /etc/xdg/baloofilerc r, + # Allow to search user files + owner @{HOME}/{,**} r, + owner @{MOUNTS}/{,**} r, + owner @{tmp}/*/{,**} r, + owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/baloofilerc r, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index a37fea7a0..b745dea62 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -59,6 +59,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{sys}/devices/ r, @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness r, @{sys}/devices/@{pci}/card@{int}/*/dpms r, + @{sys}/devices/@{pci}/drm/card@{int}/**/{,max_,actual_}brightness r, @{sys}/devices/@{pci}/drm/card@{int}/**/dev r, @{sys}/devices/@{pci}/drm/card@{int}/*/dpms r, @{sys}/devices/@{pci}/drm/card@{int}/*/edid r, diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index bd1666a06..0be47a752 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -73,7 +73,9 @@ profile kscreenlocker_greet @{exec_path} { owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kscreenlocker_greet/ w, owner @{user_cache_dirs}/kscreenlocker_greet/** rwlk, - owner @{user_cache_dirs}/ksvg-elements r, + owner @{user_cache_dirs}/ksvg-elements rw, + owner @{user_cache_dirs}/ksvg-elements.@{rand6} rwlk -> @{user_cache_dirs}/#@{int}, + owner @{user_cache_dirs}/ksvg-elements.lock rwlk, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, owner @{user_cache_dirs}/plasma-svgelements rw, owner @{user_cache_dirs}/plasma-svgelements-default_v* r, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index f768cad0c..65bf9036a 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -56,6 +56,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_config_dirs}/ksmserverrc.@{rand6} rwl, owner @{user_config_dirs}/ksmserverrc.lock rwk, owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_config_dirs}/session/*_[0-9]*_[0-9]*_[0-9]* rw, owner @{user_share_dirs}/kservices{5,6}/ r, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 95abaa2a6..c5451f4ae 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -89,6 +89,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { owner @{user_config_dirs}/kdedefaults/* r, owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk, owner @{user_config_dirs}/kglobalshortcutsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/khotkeysrc r, owner @{user_config_dirs}/klaunchrc r, owner @{user_config_dirs}/kscreenlockerrc r, owner @{user_config_dirs}/kwinoutputconfig.json rw, @@ -110,6 +111,10 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { @{sys}/class/drm/ r, @{sys}/class/input/ r, @{sys}/devices/**/uevent r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, @{run}/udev/data/+acpi:* r, # for ACPI @{run}/udev/data/+dmi:* r, # for motherboard info diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 06a816026..825a28ba0 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -151,6 +151,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_config_dirs}/plasma* rwlk, owner @{user_config_dirs}/trashrc r, + owner @{user_share_dirs}/*/sessions/ r, owner @{user_share_dirs}/#@{int} rw, owner @{user_share_dirs}/akonadi/search_db/{,**} r, owner @{user_share_dirs}/kactivitymanagerd/resources/database rwk, @@ -174,6 +175,11 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_share_dirs}/user-places.xbel{,*} rwl, owner @{user_share_dirs}/wallpapers/{,**} rw, + owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/plasmashellstaterc rw, + owner @{user_state_dirs}/plasmashellstaterc.lock rwk, + owner @{user_state_dirs}/plasmashellstaterc.@{rand6} rwl, + /tmp/.mount_nextcl@{rand6}/{,*} r, owner @{tmp}/#@{int} rw, diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index 4872716fc..441f2db25 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -29,12 +29,13 @@ profile sddm-greeter @{exec_path} { @{lib}/libheif/*.so* rm, /usr/share/desktop-base/*-theme/login/*.svg r, + /usr/share/endeavouros/backgrounds/** r, + /usr/share/hunspell/** r, /usr/share/plasma/desktoptheme/** r, /usr/share/sddm/{,**} r, + /usr/share/wallpapers/{,**} r, /usr/share/wayland-sessions/{,*.desktop} r, /usr/share/xsessions/{,*.desktop} r, - /usr/share/wallpapers/{,**} r, - /usr/share/hunspell/** r, /etc/fstab r, /etc/os-release r, diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index 14d73b356..b59c668b8 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -21,12 +21,13 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) { capability syslog, network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, network inet raw, + network inet stream, + network inet6 dgram, network inet6 raw, + network inet6 stream, network netlink raw, + network packet dgram, ptrace (read), From 09401567a46579ab795b866730d7d8e51c13f2fb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 13 Sep 2024 22:39:43 +0100 Subject: [PATCH 0178/1455] feat(profile): base the the thunderbird profile from firefox. --- apparmor.d/abstractions/app/firefox | 1 + apparmor.d/profiles-s-z/thunderbird | 149 +++-------------------- apparmor.d/tunables/multiarch.d/programs | 2 +- 3 files changed, 18 insertions(+), 134 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index b3e78105e..89ea1f747 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -28,6 +28,7 @@ include include include + include include include diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index 3d580afe9..28b0a4836 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -7,7 +7,7 @@ abi , include -@{name} = thunderbird{,.sh,-bin} +@{name} = thunderbird{,-bin} @{lib_dirs} = @{lib}/@{name} @{config_dirs} = @{HOME}/.@{name}/ @{cache_dirs} = @{user_cache_dirs}/@{name}/ @@ -15,60 +15,16 @@ include @{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name} profile thunderbird @{exec_path} { include - include - include - include - include - include - include - include - include - include - include - include - include - include - include - include - include - include - - # userns, - - capability sys_admin, # If kernel.unprivileged_userns_clone = 1 - capability sys_chroot, # If kernel.unprivileged_userns_clone = 1 - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - network netlink raw, - - ptrace peer=@{profile_name}, + include #aa:dbus own bus=session name=org.mozilla.thunderbird - dbus receive bus=system path=/org/freedesktop/login1 - interface=org.freedesktop.login1.Manager - member={UserAdded,UserRemoved} - peer=(name=:*, label=systemd-logind), - - dbus receive bus=system - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*, label=gnome-shell), - @{exec_path} mrix, - @{sh_path} rix, - @{bin}/which.debianutils rix, - - @{lib_dirs}/{,**} r, - @{lib_dirs}/*.so mr, - @{lib_dirs}/glxtest rPx, - @{lib_dirs}/thunderbird-wrapper-helper.sh rix, - @{lib_dirs}/vaapitest rPx, + @{lib_dirs}/glxtest rPx, + @{lib_dirs}/vaapitest rPx, + @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemKWaylandPlugin.so mr, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr, # GPG integration @@ -77,104 +33,31 @@ profile thunderbird @{exec_path} { @{bin}/gpgsm rPx, # Desktop integration - @{bin}/lsb_release rPx -> lsb_release, @{open_path} rPx -> child-open, - # Allowed apps to open - @{bin}/engrampa rPx, - @{bin}/geany rPx, - @{bin}/qpdfview rPx, - @{bin}/viewnior rPUx, - @{brave_path} rPx, - @{chrome_path} rPx, - @{firefox_path} rPx, - @{opera_path} rPx, - - /usr/share/@{name}/{,**} r, - /usr/share/gvfs/remote-volume-monitors/{,*} r, /usr/share/lightning/{,**} r, - /usr/share/mozilla/extensions/{,**} r, - /usr/share/xul-ext/kwallet5/* r, - /etc/@{name}/{,**} r, - /etc/fstab r, - /etc/mailcap r, - /etc/mime.types r, - /etc/timezone r, - /etc/xul-ext/kwallet5.js r, - - owner /var/mail/* rwk, - - owner @{HOME}/ r, - - owner @{user_config_dirs}/kwalletrc r, - owner @{user_config_dirs}/mimeapps.list.* rw, + owner /var/mail/** rwk, owner @{user_mail_dirs}/ rw, owner @{user_mail_dirs}/** rwl -> @{user_mail_dirs}/**, - owner @{config_dirs}/ rw, - owner @{user_config_dirs}/gtk-3.0/assets/* r, - owner @{config_dirs}/*/ rw, - owner @{config_dirs}/*/** rwk, - owner @{config_dirs}/installs.ini rw, - owner @{config_dirs}/profiles.ini rw, + owner @{user_config_dirs}/gtk-{3,4}.0/assets/*.svg r, + owner @{user_config_dirs}/ibus/bus/ r, + owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, + owner @{user_config_dirs}/kioslaverc r, + owner @{user_config_dirs}/mimeapps.list{,.@{rand6}} rw, - owner @{user_cache_dirs}/gtk-3.0/**/*.cache r, - - owner @{cache_dirs}/{,**} rw, - - /tmp/ r, - /var/tmp/ r, - owner @{tmp}/@{name}{,_*}/ rw, - owner @{tmp}/@{name}{,_*}/* rwk, - owner @{tmp}/* rw, - owner @{tmp}/mozilla_*/ rw, - owner @{tmp}/mozilla_*/* rw, owner @{tmp}/MozillaMailnews/ rw, owner @{tmp}/MozillaMailnews/*.msf rw, - owner @{tmp}/Temp-@{uuid}/ rw, - - @{run}/mount/utab r, - - @{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r, - @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, - - @{PROC}/@{pids}/net/arp r, - @{PROC}/@{pids}/net/route r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/environ r, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/gid_map w, # If kernel.unprivileged_userns_clone = 1 - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/setgroups w, # If kernel.unprivileged_userns_clone = 1 - owner @{PROC}/@{pid}/smaps r, - owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/statm r, - owner @{PROC}/@{pid}/task/ r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner @{PROC}/@{pid}/task/@{tid}/stat r, - owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1 - - owner /dev/shm/org.chromium.@{rand6} rw, - owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, - owner /dev/shm/wayland.mozilla.ipc.@{int} rw, - - /dev/tty rw, - - # file_inherit - owner /dev/tty@{int} rw, + owner @{tmp}/nsma rw, # Silencer - deny @{HOME}/.mozilla/** mrwkl, - deny @{config_dirs}/*.*/pepmda/ rw, - deny @{config_dirs}/*.*/pepmda/** rwklmx, + deny capability sys_ptrace, deny @{lib_dirs}/** w, - deny /dev/ r, - deny /dev/urandom w, - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, + deny @{lib_dirs}/crashreporter x, + deny @{lib_dirs}/minidump-analyzer x, + deny @{HOME}/.mozilla/** mrwkl, include if exists } diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 5c18c1b28..61d3713ae 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -62,7 +62,7 @@ # Emails -@{thunderbird_name} = thunderbird{,.sh,-bin} +@{thunderbird_name} = thunderbird{,-bin} @{thunderbird_lib_dirs} = @{lib}/@{thunderbird_name} @{emails_names} = evolution geary From 58783e06cb2fb482c520e36ffbcbe15cf7b1ecbe Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 14 Sep 2024 15:28:18 +0100 Subject: [PATCH 0179/1455] fix(profile): ufw can't determine iptables version fix #485 --- apparmor.d/profiles-s-z/ufw | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 4340f12db..6a9897d91 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 EricLin +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -9,6 +10,7 @@ include @{exec_path} = @{bin}/ufw profile ufw @{exec_path} { include + include include include @@ -22,16 +24,16 @@ profile ufw @{exec_path} { @{exec_path} mr, @{bin}/ r, + @{bin}/cat ix, @{bin}/env r, @{bin}/python3.@{int} ix, - @{bin}/cat ix, + @{bin}/xtables-legacy-multi ix, @{bin}/xtables-nft-multi ix, - @{lib}/ufw/ufw-init ix, - /etc/ufw/{,**} rwk, - /etc/default/ufw r, + /etc/ufw/ rw, + /etc/ufw/** rwk, owner @{run}/ufw.lock rwk, @@ -40,12 +42,9 @@ profile ufw @{exec_path} { owner @{tmp}/???????? rw, owner @{tmp}/tmp???????? rw, - @{PROC}/@{pid}/stat r, @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/net/ip_tables_names r, - - /dev/pts/[0-9]* rw, - /dev/tty rw, + @{PROC}/@{pid}/stat r, include if exists From 2805ed9dd9706247083b5f1b52ac83eed7fd9e9f Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Sun, 15 Sep 2024 11:30:32 +0800 Subject: [PATCH 0180/1455] Update profile for linuxqq --- apparmor.d/profiles-g-l/linuxqq | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index dcccd68c8..06811fbd4 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -27,6 +27,7 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, + @{sh_path} r, @{bin}/grep rix, @{lib_dirs}/chrome_crashpad_handler ix, @{lib_dirs}/resources/app/{,**} m, From 7858cae3300f46269e67d1f0d43fda678251b0d2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Sep 2024 13:36:29 +0100 Subject: [PATCH 0181/1455] feat(profile): torbrowser: do not give access to user dirs by default. - Remove read-only access to most user dirs. - Remove read-write access to download directories. fix #490 --- apparmor.d/abstractions/app/firefox | 2 -- apparmor.d/groups/browsers/firefox | 2 ++ apparmor.d/groups/browsers/firefox-glxtest | 2 +- apparmor.d/groups/browsers/torbrowser | 4 ++++ apparmor.d/profiles-s-z/thunderbird | 2 ++ 5 files changed, 9 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 89ea1f747..7eb223b09 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -29,8 +29,6 @@ include include include - include - include # userns, diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 75c3c0f86..ef8bf5842 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -16,6 +16,8 @@ include profile firefox @{exec_path} flags=(attach_disconnected) { include include + include + include signal (send) set=(term, kill) peer=keepassxc-proxy, diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest index 995f94f8f..02bbb92a6 100644 --- a/apparmor.d/groups/browsers/firefox-glxtest +++ b/apparmor.d/groups/browsers/firefox-glxtest @@ -6,7 +6,7 @@ abi , include -@{name} = firefox{,.sh,-esr,-bin} +@{name} = firefox{,-esr,-bin} @{lib_dirs} = @{lib}/@{name} /opt/@{name} @{config_dirs} = @{HOME}/.mozilla/ @{cache_dirs} = @{user_cache_dirs}/mozilla/ diff --git a/apparmor.d/groups/browsers/torbrowser b/apparmor.d/groups/browsers/torbrowser index 6b9b6dbab..c0c4a893e 100644 --- a/apparmor.d/groups/browsers/torbrowser +++ b/apparmor.d/groups/browsers/torbrowser @@ -17,6 +17,9 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) { include include + # Uncomment if you want to give the Tor Browser access to the common download directory. + # include + @{exec_path} mrix, @{lib_dirs}/abicheck ix, @@ -41,6 +44,7 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) { owner "@{tmp}/Tor Project*/**" rwk, # Due to the nature of the browser, we silence much more than for Firefox. + deny capability sys_ptrace, deny network inet dgram, # TOR does not work over UDP deny network inet6 dgram, deny network inet6 stream, # TOR does not work over IPv6 diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index 28b0a4836..dbf045333 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -16,6 +16,8 @@ include profile thunderbird @{exec_path} { include include + include + include #aa:dbus own bus=session name=org.mozilla.thunderbird From 516a1fd36d9192c7cb580a6be43f0e52988f87ae Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 17 Sep 2024 12:55:08 +0100 Subject: [PATCH 0182/1455] fix(profile): multiple minor fixes. fix #493 #480 --- apparmor.d/groups/children/child-pager | 2 ++ apparmor.d/groups/pacman/archlinux-keyring-wkd-sync | 2 +- .../groups/systemd/systemd-generator-user-environment | 2 ++ apparmor.d/groups/systemd/systemd-journald | 1 + apparmor.d/profiles-a-f/auditd | 1 + apparmor.d/profiles-g-l/login | 4 +++- apparmor.d/profiles-m-r/nft | 2 ++ apparmor.d/profiles-m-r/pidof | 1 + apparmor.d/profiles-m-r/resolvconf | 11 +++++++++++ 9 files changed, 24 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/children/child-pager b/apparmor.d/groups/children/child-pager index ebaf6724d..45ac2516a 100644 --- a/apparmor.d/groups/children/child-pager +++ b/apparmor.d/groups/children/child-pager @@ -37,6 +37,8 @@ profile child-pager { owner @{user_state_dirs}/ r, owner @{user_state_dirs}/lesshs* rw, + /dev/tty@{int} rw, + include if exists } diff --git a/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync b/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync index 708d2b585..dab6a2edd 100644 --- a/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync +++ b/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync @@ -30,7 +30,7 @@ profile archlinux-keyring-wkd-sync @{exec_path} { /etc/pacman.conf r, /etc/pacman.d/*-mirrorlist r, /etc/pacman.d/gnupg/ rw, - /etc/pacman.d/gnupg/** rwk -> /etc/pacman.d/gnupg/**, + /etc/pacman.d/gnupg/** rwlk -> /etc/pacman.d/gnupg/**, /etc/pacman.d/mirrorlist r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/systemd/systemd-generator-user-environment b/apparmor.d/groups/systemd/systemd-generator-user-environment index 1abceb364..420ef84a9 100644 --- a/apparmor.d/groups/systemd/systemd-generator-user-environment +++ b/apparmor.d/groups/systemd/systemd-generator-user-environment @@ -12,6 +12,8 @@ profile systemd-generator-user-environment @{exec_path} { include include + capability net_admin, + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index 3d1fdfa6d..6ac35cb68 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -49,6 +49,7 @@ profile systemd-journald @{exec_path} { @{run}/udev/data/+acpi:* r, @{run}/udev/data/+bluetooth:* r, @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+ieee80211:* r, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+mdio_bus:* r, @{run}/udev/data/+pci:* r, diff --git a/apparmor.d/profiles-a-f/auditd b/apparmor.d/profiles-a-f/auditd index 4e93a5d22..935a84c69 100644 --- a/apparmor.d/profiles-a-f/auditd +++ b/apparmor.d/profiles-a-f/auditd @@ -31,6 +31,7 @@ profile auditd @{exec_path} flags=(attach_disconnected) { owner @{run}/auditd.pid rwl, owner @{run}/auditd.state rw, + @{PROC}/@{pid}/ r, owner @{PROC}/@{pid}/attr/current r, owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/oom_score_adj rw, diff --git a/apparmor.d/profiles-g-l/login b/apparmor.d/profiles-g-l/login index c93553030..41fa293b4 100644 --- a/apparmor.d/profiles-g-l/login +++ b/apparmor.d/profiles-g-l/login @@ -54,13 +54,15 @@ profile login @{exec_path} flags=(attach_disconnected) { /etc/security/pam_env.conf r, /etc/shells r, + /var/lib/faillock/@{user} rwk, /var/log/btmp{,.@{int}} r, owner @{user_cache_dirs}/motd.legal-displayed rw, - @{run}/motd.d/{,*} r, + @{run}/credentials/getty@tty@{int}.service/ r, @{run}/dbus/system_bus_socket rw, @{run}/faillock/@{user} rwk, + @{run}/motd.d/{,*} r, @{run}/motd.dynamic{,.new} rw, @{run}/systemd/sessions/*.ref rw, diff --git a/apparmor.d/profiles-m-r/nft b/apparmor.d/profiles-m-r/nft index 1255ca401..3595bb4c5 100644 --- a/apparmor.d/profiles-m-r/nft +++ b/apparmor.d/profiles-m-r/nft @@ -20,6 +20,8 @@ profile nft @{exec_path} { @{exec_path} mr, + /usr/share/iproute2/{,**} r, + /etc/iproute2/** r, /etc/nftables.conf r, /etc/nftables/{,**} r, diff --git a/apparmor.d/profiles-m-r/pidof b/apparmor.d/profiles-m-r/pidof index e2ea46e57..a294705b0 100644 --- a/apparmor.d/profiles-m-r/pidof +++ b/apparmor.d/profiles-m-r/pidof @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/pidof profile pidof @{exec_path} { include + include capability sys_ptrace, diff --git a/apparmor.d/profiles-m-r/resolvconf b/apparmor.d/profiles-m-r/resolvconf index 6dfe82b6e..981af134f 100644 --- a/apparmor.d/profiles-m-r/resolvconf +++ b/apparmor.d/profiles-m-r/resolvconf @@ -22,6 +22,7 @@ profile resolvconf @{exec_path} { @{bin}/rm rix, @{bin}/run-parts rix, @{bin}/sed rix, + @{bin}/systemctl rCx -> systemctl, @{lib}/resolvconf/list-records rix, /usr/lib/resolvconf/{,**} r, @@ -35,6 +36,16 @@ profile resolvconf @{exec_path} { /dev/tty rw, + profile systemctl { + include + include + + capability net_admin, + capability sys_ptrace, + + include if exists + } + include if exists } From 6fd05f26af636f3651cee6e3512388906eb852c2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 17 Sep 2024 12:58:41 +0100 Subject: [PATCH 0183/1455] feat(login): allow disconnection from login fix #492 --- apparmor.d/abstractions/base.d/complete | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index f0b3efdaf..eef226aec 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -11,6 +11,7 @@ signal (receive) set=(cont,term,kill,stop) peer=systemd-shutdown, signal (receive) set=(cont,term) peer=@{p_systemd_user}, signal (receive) set=(cont,term) peer=@{p_systemd}, + signal (receive) set=(hup term) peer=login, signal (receive) set=(hup) peer=xinit, signal (receive) set=(term,kill) peer=gnome-shell, signal (receive) set=(term,kill) peer=gnome-system-monitor, From 02d8aaee7fa45f9b889c362be458a50a81518f22 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 16:59:44 +0100 Subject: [PATCH 0184/1455] feat(profile): improve integration with kde see #496 --- apparmor.d/abstractions/common/app | 7 ++- apparmor.d/abstractions/desktop | 3 ++ .../polkit-kde-authentication-agent | 1 + apparmor.d/groups/freedesktop/xdg-dbus-proxy | 1 + apparmor.d/groups/gnome/kgx | 2 + apparmor.d/groups/kde/dolphin | 8 +++- apparmor.d/groups/kde/drkonqi | 7 +++ apparmor.d/groups/kde/kde-powerdevil | 1 + apparmor.d/groups/kde/kioworker | 1 + apparmor.d/groups/kde/konsole | 8 ++++ apparmor.d/groups/kde/kscreenlocker_greet | 1 + apparmor.d/groups/kde/ksplashqml | 1 + apparmor.d/groups/kde/kwin_wayland | 2 + apparmor.d/groups/kde/plasmashell | 4 ++ apparmor.d/groups/kde/systemsettings | 44 ++++++++++++++++--- apparmor.d/groups/kde/xwaylandvideobridge | 2 + apparmor.d/groups/virt/virtnetworkd | 2 +- apparmor.d/groups/virt/virtnodedevd | 5 ++- apparmor.d/groups/virt/virtstoraged | 3 +- apparmor.d/profiles-a-f/aa-enforce | 1 + apparmor.d/profiles-a-f/flatpak-app | 1 + apparmor.d/profiles-g-l/keepassxc | 2 +- apparmor.d/profiles-g-l/libreoffice | 16 ++++++- apparmor.d/profiles-s-z/sudo | 1 + apparmor.d/profiles-s-z/xauth | 1 + 25 files changed, 108 insertions(+), 17 deletions(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 2798b5082..777518f3d 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -61,19 +61,24 @@ owner @{user_share_dirs}/** rwkl, owner @{user_games_dirs}/{,**} rm, - owner /var/cache/tmp/** rwk, + owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, owner @{tmp}/** rmwk, owner /dev/shm/** rwlk -> /dev/shm/**, @{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket. @{run}/host/{,**} r, @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket. + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/utmp rk, + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + @{sys}/ r, @{sys}/block/ r, @{sys}/bus/ r, @{sys}/bus/*/devices/ r, + @{sys}/bus/pci/slots/ r, + @{sys}/bus/pci/slots/@{int}/address r, @{sys}/class/*/ r, @{sys}/devices/** r, diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index befea8bcb..6ba381b05 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -36,10 +36,13 @@ @{lib}/kde{,3,4}/plugins/*/ r, @{lib}/kde{,3,4}/plugins/*/*.so mr, + /etc/xdg/kcminputrc r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, + owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kdedefaults/ r, + owner @{user_config_dirs}/kdedefaults/kcminputrc r, owner @{user_config_dirs}/kdedefaults/kdeglobals r, owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kdeglobals r, diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index f8a9700f5..3a04356f5 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -31,6 +31,7 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected, @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx, /etc/machine-id r, + /etc/xdg/plasmarc r, /var/lib/dbus/machine-id r, owner @{user_config_dirs}/breezerc r, diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index 51d9fdddb..6e5b5adb0 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -31,6 +31,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.var/app/*/.local/share/*/logs/* rw, owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, + @{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw, owner @{run}/flatpak/doc/** r, owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw, diff --git a/apparmor.d/groups/gnome/kgx b/apparmor.d/groups/gnome/kgx index e756831f2..b704e580b 100644 --- a/apparmor.d/groups/gnome/kgx +++ b/apparmor.d/groups/gnome/kgx @@ -25,9 +25,11 @@ profile kgx @{exec_path} { @{bin}/@{shells} rUx, # Some CLI program can be launched directly from Gnome Shell + @{bin}/btop rPUx, @{bin}/htop rPx, @{bin}/micro rPUx, @{bin}/nvtop rPx, + @{bin}/nvtop rPx, @{bin}/vim rUx, @{open_path} rPx -> child-open-help, diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index b76cff2a0..577cdd085 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -16,6 +16,7 @@ profile dolphin @{exec_path} { include include include + include include include include @@ -28,13 +29,17 @@ profile dolphin @{exec_path} { @{exec_path} mr, @{bin}/ldd rix, + @{bin}/lsb_release rPx -> lsb_release, + @{lib}/{,@{multiarch}/}utempter/utempter rPx, @{thunderbird_path} rPx, + #aa:exec kioworker /usr/share/kf5/kmoretools/{,**} r, /usr/share/kio/{,**} r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,**} r, + /usr/share/misc/termcap r, /etc/fstab r, /etc/machine-id r, @@ -84,9 +89,10 @@ profile dolphin @{exec_path} { owner @{user_state_dirs}/dolphinstaterc{,.*} rwlk -> @{user_state_dirs}/#@{int}, + @{run}/issue r, @{run}/mount/utab r, - owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, owner @{run}/user/@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, @{sys}/bus/ r, @{sys}/bus/*/devices/ r, diff --git a/apparmor.d/groups/kde/drkonqi b/apparmor.d/groups/kde/drkonqi index 602b087bb..78ca6d21b 100644 --- a/apparmor.d/groups/kde/drkonqi +++ b/apparmor.d/groups/kde/drkonqi @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}drkonqi profile drkonqi @{exec_path} { include + include include network inet stream, @@ -22,11 +23,17 @@ profile drkonqi @{exec_path} { @{exec_path} mr, + @{bin}/lsb_release rPx -> lsb_release, + /usr/share/drkonqi/{,**} r, /usr/share/knotifications{5,6}/*.notifyrc r, + owner @{user_cache_dirs}/drkonqi/ rw, + owner @{user_cache_dirs}/drkonqi/** rwlk -> @{user_cache_dirs}/drkonqi/**, owner @{user_cache_dirs}/kcrash-metadata/* w, + owner @{user_config_dirs}/drkonqirc r, + /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index b745dea62..32ad8cd86 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}org_kde_powerdevil profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) { include + include include include include diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 6dd771859..db135515b 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -91,6 +91,7 @@ profile kioworker @{exec_path} { @{run}/mount/utab r, owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/kio_*.socket rwl -> @{run}/user/@{uid}/#@{int}, + owner @{run}/user/@{uid}/kioworker*.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 359297e42..c6cfa9587 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -30,6 +30,14 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{lib}/libheif/** mr, @{lib}/{,@{multiarch}/}utempter/utempter rPx, + # Some CLI program can be launched directly from KDE + @{bin}/btop rPUx, + @{bin}/htop rPx, + @{bin}/micro rPUx, + @{bin}/nvtop rPx, + @{bin}/nvtop rPx, + @{bin}/vim rUx, + /usr/share/color-schemes/{,**} r, /usr/share/kf6/{,**} r, /usr/share/knotifications{5,6}/konsole.notifyrc r, diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index 0be47a752..74020b468 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -85,6 +85,7 @@ profile kscreenlocker_greet @{exec_path} { owner @{user_config_dirs}/kdedefaults/kscreenlockerrc r, owner @{user_config_dirs}/kdedefaults/plasmarc r, owner @{user_config_dirs}/kscreenlockerrc r, + owner @{user_config_dirs}/kscreenlockerrc.lock rwk, owner @{user_config_dirs}/ksmserverrc r, owner @{user_config_dirs}/plasmarc r, owner @{user_config_dirs}/plasmashellrc r, diff --git a/apparmor.d/groups/kde/ksplashqml b/apparmor.d/groups/kde/ksplashqml index 463aec245..97ecd5c22 100644 --- a/apparmor.d/groups/kde/ksplashqml +++ b/apparmor.d/groups/kde/ksplashqml @@ -22,6 +22,7 @@ profile ksplashqml @{exec_path} { /usr/share/plasma/** r, /etc/machine-id r, + /etc/xdg/plasmarc r, owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/ksplash/ rw, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index c5451f4ae..2393f9201 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -104,6 +104,8 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { owner @{user_share_dirs}/kscreen/* r, owner @{user_share_dirs}/kwin/scripts/{,**} r, + owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + @{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/ r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 825a28ba0..f3f37b6fd 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -59,6 +59,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { /opt/**/share/icons/{,**} r, /opt/*/**/*.desktop r, /opt/*/**/*.png r, + /usr/share/*/icons/{,**} r, /usr/share/akonadi/{,**} r, /usr/share/desktop-base/{,**} r, /usr/share/desktop-directories/kf5-*.directory r, @@ -93,6 +94,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{MOUNTS}/ r, @{HOME}/ r, + owner @{HOME}/.var/app/**.{png,jpg,svg} r, owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, owner @{user_pictures_dirs}/{,**} r, @@ -186,6 +188,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{run}/mount/utab r, @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/app/*/*.@{rand6} r, owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/kdesud_:@{int} w, owner @{run}/user/@{uid}/plasmashell@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, @@ -205,6 +208,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{sys}/devices/virtual/thermal/thermal_zone@{int}/hwmon@{int}/ r, @{PROC}/ r, + @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/stat r, @{PROC}/cmdline r, @{PROC}/diskstats r, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index ffcf93783..384c1da8b 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -9,7 +9,10 @@ include @{exec_path} = @{bin}/systemsettings profile systemsettings @{exec_path} { include + include include + include + include include include include @@ -22,7 +25,9 @@ profile systemsettings @{exec_path} { @{exec_path} mr, + @{sh_path} rix, @{bin}/cat rix, + @{bin}/eglinfo rPUx, @{bin}/kcminit rPx, @{bin}/lspci rPx, @{bin}/openssl rix, @@ -38,7 +43,8 @@ profile systemsettings @{exec_path} { /usr/share/kcmkeys/{,*.kksrc} r, /usr/share/kglobalaccel/* r, /usr/share/kinfocenter/{,**} r, - /usr/share/kinfocenter/{,**} r, + /usr/share/knotifications{5,6}/{,**} r, + /usr/share/solid/{,**} r, /usr/share/kpackage/{,**} r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,**} r, @@ -46,9 +52,9 @@ profile systemsettings @{exec_path} { /usr/share/kxmlgui5/systemsettings/systemsettingsui.rc r, /usr/share/plasma/{,**} r, /usr/share/sddm/themes/{,**} r, - /usr/share/sddm/themes/{,**} r, /usr/share/systemsettings/{,**} r, /usr/share/wallpapers/{,**} r, + /usr/share/thumbnailers/{,**} r, /etc/fstab r, /etc/machine-id r, @@ -56,10 +62,19 @@ profile systemsettings @{exec_path} { /etc/xdg/plasmanotifyrc r, /etc/xdg/ui/ui_standards.rc r, /var/lib/dbus/machine-id r, + /etc/xdg/* r, + + /var/cache/cracklib/cracklib_dict.* r, + /var/cache/samba/ rw, + /var/lib/AccountsService/icons/* r, + /var/lib/flatpak/repo/{,**} r, + + owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/kinfocenter/{,**} rwl, + owner @{user_cache_dirs}/kcrash-metadata/*.ini rw, + owner @{user_cache_dirs}/kinfocenter/{,**} rwlk, owner @{user_cache_dirs}/ksvg-elements rw, owner @{user_cache_dirs}/ksvg-elements.@{rand6} rwlk -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/ksvg-elements.lock rwlk, @@ -69,22 +84,24 @@ profile systemsettings @{exec_path} { owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**, owner @{user_config_dirs}/{P,p}lasma* r, + owner @{user_config_dirs}/*rc r, owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/device_automounter_kcmrc.lock rwk, + owner @{user_config_dirs}/emaildefaults r, owner @{user_config_dirs}/kactivitymanagerdrc r, owner @{user_config_dirs}/kde.org/{,**} rwlk, owner @{user_config_dirs}/kdedefaults/kscreenlockerrc r, owner @{user_config_dirs}/kdedefaults/plasmarc r, - owner @{user_config_dirs}/khotkeysrc r, owner @{user_config_dirs}/kinfocenterrc* rwlk, - owner @{user_config_dirs}/kscreenlockerrc r, - owner @{user_config_dirs}/kxkbrc r, + owner @{user_config_dirs}/libaccounts-glib/ rw, + owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk, owner @{user_config_dirs}/menus/ r, owner @{user_config_dirs}/menus/applications-merged/ r, - owner @{user_config_dirs}/plasmarc r, owner @{user_config_dirs}/session/ rw, owner @{user_config_dirs}/session/** rwlk, owner @{user_config_dirs}/systemsettingsrc.lock rwk, owner @{user_config_dirs}/systemsettingsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, + owner @{user_share_dirs}/baloo/index r, owner @{user_share_dirs}/kactivitymanagerd/resources/database rwk, owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk, @@ -98,12 +115,25 @@ profile systemsettings @{exec_path} { owner @{user_share_dirs}/systemsettings/** rwlk, owner @{user_share_dirs}/wallpapers/{,**} r, + owner @{run}/user/@{uid}/#@{int} rw, + + @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs + @{sys}/bus/ r, + @{sys}/bus/acpi/devices/ r, @{sys}/bus/cpu/devices/ r, @{sys}/class/ r, + @{sys}/firmware/acpi/pm_profile r, + @{PROC}/interrupts r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + /dev/ r, + /dev/bus/usb/ r, + /dev/input/ r, + /dev/rfkill r, /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/xwaylandvideobridge b/apparmor.d/groups/kde/xwaylandvideobridge index 0f6aeb48a..f5139eb13 100644 --- a/apparmor.d/groups/kde/xwaylandvideobridge +++ b/apparmor.d/groups/kde/xwaylandvideobridge @@ -20,6 +20,8 @@ profile xwaylandvideobridge @{exec_path} { owner @{user_cache_dirs}/xwaylandvideobridge/ rw, owner @{user_cache_dirs}/xwaylandvideobridge/** rwk, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + include if exists } diff --git a/apparmor.d/groups/virt/virtnetworkd b/apparmor.d/groups/virt/virtnetworkd index fa4e0a5d5..5be9abb71 100644 --- a/apparmor.d/groups/virt/virtnetworkd +++ b/apparmor.d/groups/virt/virtnetworkd @@ -20,7 +20,7 @@ profile virtnetworkd @{exec_path} flags=(attach_disconnected) { @{bin}/dnsmasq rPx, - /etc/libvirt/libvirt.conf r, + /etc/libvirt/*.conf r, owner /var/lib/libvirt/dnsmasq/*.macs* rw, diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index 38f84a8eb..7e2c76c92 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -29,8 +29,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { /usr/share/hwdata/*.ids r, /usr/share/pci.ids r, - /etc/libvirt/libvirt.conf r, - /etc/libvirt/virtnodedevd.conf r, + /etc/libvirt/*.conf r, /etc/mdevctl.d/{,**} r, @{run}/systemd/inhibit/@{int}.ref rw, @@ -64,6 +63,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c81:@{int} r, # For video4linux @{run}/udev/data/c89:@{int} r, # For I2C bus interface @{run}/udev/data/c90:@{int} r, # For RAM, ROM, Flash + @{run}/udev/data/c99:@{int} r, # For raw parallel ports /dev/parport* @{run}/udev/data/c116:@{int} r, # For ALSA @{run}/udev/data/c202:@{int} r, # CPU model-specific registers @{run}/udev/data/c203:@{int} r, # CPU CPUID information @@ -90,6 +90,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/stat r, owner @{PROC}/mtrr w, + owner @{PROC}/uptime r, include if exists } diff --git a/apparmor.d/groups/virt/virtstoraged b/apparmor.d/groups/virt/virtstoraged index 7130edfa6..3ef20199d 100644 --- a/apparmor.d/groups/virt/virtstoraged +++ b/apparmor.d/groups/virt/virtstoraged @@ -25,8 +25,7 @@ profile virtstoraged @{exec_path} flags=(attach_disconnected) { @{bin}/qemu-system* rUx, # TODO: Integration with virt-aa-helper @{bin}/qemu-img rUx, # TODO: Integration with virt-aa-helper - /etc/libvirt/**/ r, - /etc/libvirt/libvirt.conf r, + /etc/libvirt/{,**} r, # For disk images @{MOUNTS}/ r, diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index 71823cb4c..30c03508a 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -25,6 +25,7 @@ profile aa-enforce @{exec_path} { /etc/apparmor.d/{,**} rw, @{etc_ro}/inputrc r, + @{etc_ro}/inputrc.keys r, owner /snap/core@{int}/@{int}/etc/apparmor.d/{,**} rw, owner /var/lib/snapd/apparmor/{,**} rw, diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app index 58d4713bd..8f3a15fc6 100644 --- a/apparmor.d/profiles-a-f/flatpak-app +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -57,6 +57,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { /var/lib/flatpak/app/*/**/@{bin}/** rmix, /var/lib/flatpak/app/*/**/@{lib}/** rmix, + @{run}/flatpak/app/*/**so* rm, @{run}/parent/@{bin}/** rmix, @{run}/parent/@{lib}/** rmix, @{run}/parent/app/** rmix, diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index 4315fb6e5..0e236f945 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -58,7 +58,7 @@ profile keepassxc @{exec_path} { owner @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json rw, owner @{user_config_dirs}/chromium/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json rw, owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json rw, - owner @{user_config_dirs}/{,kdedefaults/}kdeglobals r, + owner @{user_config_dirs}/keepassxcrc r, # Database locations owner @{user_cache_dirs}/keepassxc/ rw, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 4b9812c55..60ea019aa 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -12,12 +12,14 @@ profile libreoffice @{exec_path} { include include include + include include include include include include include + include include include include @@ -59,21 +61,28 @@ profile libreoffice @{exec_path} { @{lib}/libreoffice/share/extensions/{,**/}__pycache__/ w, /usr/share/hyphen/{,**} r, + /usr/share/knotifications{5,6}/plasma_workspace.notifyrc r, /usr/share/libexttextcat/{,**} r, /usr/share/liblangtag/{,**} r, /usr/share/libreoffice/{,**} r, /usr/share/mythes/{,**} r, + /usr/share/thumbnailers/{,**} r, /etc/java-openjdk/{,**} r, /etc/libreoffice/{,**} r, /etc/paperspecs r, + /etc/xdg/* r, owner @{user_cache_dirs}/libreoffice/{,**} rw, owner @{user_config_dirs}/libreoffice/ rw, owner @{user_config_dirs}/libreoffice/** rwk, + owner @{user_config_dirs}/soffice.*.lock rwk, + owner @{user_config_dirs}/trashrc r, + owner @{user_config_dirs}/plasma_workspace.notifyrc r, + owner @{user_config_dirs}/kservicemenurc r, - owner @{user_config_dirs}/kcminputrc r, - owner @{user_config_dirs}/kdedefaults/kcminputrc r, + owner @{user_share_dirs}/#@{int} rw, + owner @{user_share_dirs}/user-places.xbel r, owner @{tmp}/ r, owner @{tmp}/@{rand6} rwk, @@ -83,6 +92,8 @@ profile libreoffice @{exec_path} { owner @{tmp}/hsperfdata_@{user}/ rw, owner @{tmp}/hsperfdata_@{user}/@{int} rwk, + owner @{run}/user/@{uid}/#@{int} rw, + @{sys}/devices/system/cpu/cpu@{int}/microcode/version r, @{sys}/devices/virtual/block/**/queue/rotational r, @{sys}/kernel/mm/hugepages/ r, @@ -95,6 +106,7 @@ profile libreoffice @{exec_path} { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/coredump_filter rw, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, /dev/tty rw, diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index 6f4e290d6..6f01bc8f0 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -46,6 +46,7 @@ profile sudo @{exec_path} flags=(attach_disconnected) { @{run}/ r, @{run}/systemd/sessions/* r, + @{run}/systemd/sessions/?@{int}.ref rw, include if exists } diff --git a/apparmor.d/profiles-s-z/xauth b/apparmor.d/profiles-s-z/xauth index ad57f8615..c5e741b8f 100644 --- a/apparmor.d/profiles-s-z/xauth +++ b/apparmor.d/profiles-s-z/xauth @@ -36,6 +36,7 @@ profile xauth @{exec_path} { owner @{tmp}/xauth_@{rand6} r, owner @{tmp}/xauth_@{rand6}-c w, owner @{tmp}/xauth_@{rand6}-l wl, + owner @{tmp}/xauth.@{rand10}-c w, owner @{run}/user/@{uid}/xauth_@{rand6} rw, owner @{run}/user/@{uid}/xauth_@{rand6}-c w, From 619aa709f1040e96a6212df5fc66b2b44428e1f8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 17:06:04 +0100 Subject: [PATCH 0185/1455] feat(abs): add iceauth to X-strict. --- apparmor.d/abstractions/X-strict | 1 + apparmor.d/abstractions/app/firefox | 1 - apparmor.d/groups/akonadi/akonadi_control | 2 -- apparmor.d/groups/freedesktop/polkit-kde-authentication-agent | 2 -- apparmor.d/groups/freedesktop/pulseaudio | 1 - apparmor.d/groups/kde/DiscoverNotifier | 2 -- apparmor.d/groups/kde/gmenudbusmenuproxy | 2 -- apparmor.d/groups/kde/kalendarac | 2 -- apparmor.d/groups/kde/konsole | 2 -- apparmor.d/groups/kde/kwalletd | 2 -- apparmor.d/groups/kde/okular | 1 - apparmor.d/groups/kde/plasmashell | 1 - apparmor.d/groups/kde/xembedsniproxy | 2 -- apparmor.d/groups/kde/xwaylandvideobridge | 2 -- 14 files changed, 1 insertion(+), 22 deletions(-) diff --git a/apparmor.d/abstractions/X-strict b/apparmor.d/abstractions/X-strict index 0998bbb44..6a29d1764 100644 --- a/apparmor.d/abstractions/X-strict +++ b/apparmor.d/abstractions/X-strict @@ -24,6 +24,7 @@ owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw, # Xwayland owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/ICEauthority r, owner @{run}/user/@{uid}/X11/Xauthority r, owner @{run}/user/@{uid}/xauth_@{rand6} rl -> @{run}/user/@{uid}/#@{int}, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 7eb223b09..55ff461aa 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -105,7 +105,6 @@ owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer w, @{run}/mount/utab r, diff --git a/apparmor.d/groups/akonadi/akonadi_control b/apparmor.d/groups/akonadi/akonadi_control index f21b968d2..f3b9a0811 100644 --- a/apparmor.d/groups/akonadi/akonadi_control +++ b/apparmor.d/groups/akonadi/akonadi_control @@ -30,8 +30,6 @@ profile akonadi_control @{exec_path} { owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk, owner @{user_share_dirs}/akonadi/{,**} rwl, - - owner @{run}/user/@{uid}/iceauth_@{rand6} r, /dev/tty r, diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index 3a04356f5..821468193 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -47,8 +47,6 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected, owner @{tmp}/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int}, # owner /tmp/xauth_@{rand6} r, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - /dev/shm/#@{int} rw, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 029d7d4ad..e4a563755 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -93,7 +93,6 @@ profile pulseaudio @{exec_path} { owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin r, owner @{run}/user/@{uid}/ rw, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/pulse/ rw, owner @{run}/user/@{uid}/pulse/** rwk, owner @{run}/user/@{uid}/systemd/notify rw, diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 227f4e062..8c0fc8d20 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -59,8 +59,6 @@ profile DiscoverNotifier @{exec_path} { owner @{tmp}/ostree-gpg-@{rand6}/pubring.gpg rw, owner @{tmp}/ostree-gpg-@{rand6}/trustdb.gpg rw, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - /dev/tty r, profile gpg { diff --git a/apparmor.d/groups/kde/gmenudbusmenuproxy b/apparmor.d/groups/kde/gmenudbusmenuproxy index d1e48f849..c1a63931e 100644 --- a/apparmor.d/groups/kde/gmenudbusmenuproxy +++ b/apparmor.d/groups/kde/gmenudbusmenuproxy @@ -25,8 +25,6 @@ profile gmenudbusmenuproxy @{exec_path} { owner @{user_config_dirs}/gtk-{2,3}.0/settings.ini{,.@{rand6}} rwl, owner @{user_config_dirs}/gtk-{2,3}.0/settings.ini.lock rwk, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - include if exists } diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index 471812c7c..e6a57f985 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -36,8 +36,6 @@ profile kalendarac @{exec_path} { owner @{user_config_dirs}/kalendaracrc.lock rwk, owner @{user_config_dirs}/kmail2rc r, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index c6cfa9587..28b5d2650 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -80,8 +80,6 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/#@{int} rw, owner @{tmp}/konsole.@{rand6} rw, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index 2b2545b33..5005dde31 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -43,8 +43,6 @@ profile kwalletd @{exec_path} { owner @{tmp}/kwalletd5.* rw, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index 775491bdd..40f9de33e 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -89,7 +89,6 @@ profile okular @{exec_path} { owner @{tmp}/messageviewer_attachment_@{rand6}/{,*} r, # files opened from KMail as mail attachment, owner @{run}/user/@{uid}/#@{int} rw, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/okular@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index f3f37b6fd..e583c26bc 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -189,7 +189,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/app/*/*.@{rand6} r, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, owner @{run}/user/@{uid}/kdesud_:@{int} w, owner @{run}/user/@{uid}/plasmashell@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index 57e32b960..a4474a64a 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -20,8 +20,6 @@ profile xembedsniproxy @{exec_path} { owner @{tmp}/xauth_@{rand6} r, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - @{run}/user/@{uid}/xauth_@{rand6} rl, include if exists diff --git a/apparmor.d/groups/kde/xwaylandvideobridge b/apparmor.d/groups/kde/xwaylandvideobridge index f5139eb13..0f6aeb48a 100644 --- a/apparmor.d/groups/kde/xwaylandvideobridge +++ b/apparmor.d/groups/kde/xwaylandvideobridge @@ -20,8 +20,6 @@ profile xwaylandvideobridge @{exec_path} { owner @{user_cache_dirs}/xwaylandvideobridge/ rw, owner @{user_cache_dirs}/xwaylandvideobridge/** rwk, - owner @{run}/user/@{uid}/iceauth_@{rand6} r, - include if exists } From cc139f1144699adee366f4a3dddc3f4c29f0f00d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 18:01:16 +0100 Subject: [PATCH 0186/1455] feat(abs): update kde abs with common access. --- apparmor.d/abstractions/app/chromium | 3 -- apparmor.d/abstractions/desktop | 15 ++++++- apparmor.d/abstractions/gnome-strict | 2 + apparmor.d/abstractions/kde-strict | 13 +++++- .../groups/akonadi/akonadi_akonotes_resource | 2 - .../groups/akonadi/akonadi_archivemail_agent | 2 - .../groups/akonadi/akonadi_birthdays_resource | 2 - .../groups/akonadi/akonadi_contacts_resource | 2 - apparmor.d/groups/akonadi/akonadi_control | 1 - .../akonadi/akonadi_followupreminder_agent | 2 - .../groups/akonadi/akonadi_ical_resource | 1 - .../groups/akonadi/akonadi_indexing_agent | 2 - .../groups/akonadi/akonadi_maildir_resource | 2 - .../akonadi/akonadi_maildispatcher_agent | 3 -- .../groups/akonadi/akonadi_mailfilter_agent | 2 - .../groups/akonadi/akonadi_mailmerge_agent | 2 - .../groups/akonadi/akonadi_migration_agent | 2 - .../akonadi/akonadi_newmailnotifier_agent | 3 -- apparmor.d/groups/akonadi/akonadi_notes_agent | 2 - .../groups/akonadi/akonadi_sendlater_agent | 2 - .../akonadi/akonadi_unifiedmailbox_agent | 2 - .../groups/browsers/firefox-kmozillahelper | 11 ----- .../display-manager/lightdm-gtk-greeter | 1 - .../polkit-kde-authentication-agent | 1 - .../groups/freedesktop/xdg-desktop-portal-kde | 4 -- apparmor.d/groups/gnome/gjs-console | 1 - apparmor.d/groups/gnome/gnome-boxes | 1 - apparmor.d/groups/gnome/gnome-characters | 1 - apparmor.d/groups/gnome/gnome-control-center | 1 - apparmor.d/groups/gnome/gnome-extensions-app | 1 - apparmor.d/groups/gnome/gnome-shell | 1 - apparmor.d/groups/gnome/gnome-terminal-server | 2 - apparmor.d/groups/gnome/nautilus | 1 - apparmor.d/groups/gnome/tracker-extract | 1 - apparmor.d/groups/gnome/tracker-miner | 1 - apparmor.d/groups/kde/DiscoverNotifier | 2 - apparmor.d/groups/kde/baloo | 2 - apparmor.d/groups/kde/baloorunner | 6 --- apparmor.d/groups/kde/drkonqi | 1 - apparmor.d/groups/kde/kaccess | 2 - apparmor.d/groups/kde/kactivitymanagerd | 5 --- apparmor.d/groups/kde/kalendarac | 3 -- apparmor.d/groups/kde/kbuildsycoca | 3 -- apparmor.d/groups/kde/kconf_update | 40 ++----------------- apparmor.d/groups/kde/kde-powerdevil | 2 - .../groups/kde/kde-systemd-start-condition | 5 +-- apparmor.d/groups/kde/kded | 8 ---- apparmor.d/groups/kde/kglobalacceld | 2 - apparmor.d/groups/kde/kiod | 2 - apparmor.d/groups/kde/kioworker | 2 - apparmor.d/groups/kde/konsole | 5 --- apparmor.d/groups/kde/kscreenlocker_greet | 1 - apparmor.d/groups/kde/ksmserver | 4 -- .../groups/kde/ksmserver-logout-greeter | 1 - apparmor.d/groups/kde/ksplashqml | 1 - apparmor.d/groups/kde/kwalletd | 2 - apparmor.d/groups/kde/kwalletmanager | 1 - apparmor.d/groups/kde/kwin_wayland | 7 ---- apparmor.d/groups/kde/kwin_x11 | 2 - apparmor.d/groups/kde/okular | 5 --- .../kde/plasma-browser-integration-host | 3 -- apparmor.d/groups/kde/plasma-discover | 2 - apparmor.d/groups/kde/plasma_session | 4 -- apparmor.d/groups/kde/plasmashell | 9 +---- apparmor.d/groups/kde/sddm | 1 - apparmor.d/groups/kde/sddm-greeter | 2 - apparmor.d/groups/kde/startplasma | 3 -- apparmor.d/groups/kde/systemsettings | 4 -- apparmor.d/profiles-g-l/keepassxc | 1 - apparmor.d/profiles-g-l/libreoffice | 2 - apparmor.d/profiles-m-r/pinentry-qt | 3 -- apparmor.d/profiles-m-r/psi | 2 - apparmor.d/profiles-m-r/psi-plus | 2 - apparmor.d/profiles-m-r/qbittorrent | 2 - apparmor.d/profiles-m-r/qt5ct | 3 -- apparmor.d/profiles-s-z/smplayer | 2 - apparmor.d/profiles-s-z/virt-manager | 1 - apparmor.d/profiles-s-z/vlc | 1 - 78 files changed, 32 insertions(+), 224 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 0066e5eec..3fa7005a6 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -129,7 +129,6 @@ owner @{user_config_dirs}/gtk-3.0/servers r, owner @{user_share_dirs}/.@{domain}.@{rand6} rw, owner @{user_cache_dirs}/gtk-3.0/**/*.cache r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{config_dirs}/ rw, owner @{config_dirs}/** rwk, @@ -137,8 +136,6 @@ owner @{cache_dirs}/{,**} rw, - owner @{user_config_dirs}/kcminputrc r, - owner @{user_config_dirs}/kdedefaults/kcminputrc r, owner @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu r, diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 6ba381b05..50244b3a7 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -22,13 +22,13 @@ peer=(name=:*, label=gnome-shell), /usr/{local/,}share/ r, - /usr/{local/,}share/glib-@{int}.@{int}/schemas/** r, + /usr/{local/,}share/glib-@{version}/schemas/** r, /usr/{local/,}share/gvfs/remote-volume-monitors/{,*} r, /etc/gnome/* r, /etc/xdg/{,*-}mimeapps.list r, - /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r, + /var/cache/gio-@{version}/gnome-mimeapps.list r, # else if @{DE} == kde @@ -36,10 +36,19 @@ @{lib}/kde{,3,4}/plugins/*/ r, @{lib}/kde{,3,4}/plugins/*/*.so mr, + /usr/share/knotifications{5,6}/*.notifyrc r, + + /etc/xdg/baloofilerc r, /etc/xdg/kcminputrc r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, + owner @{user_cache_dirs}/#@{int} rw, + owner @{user_cache_dirs}/icon-cache.kcache rw, + owner @{user_cache_dirs}/ksycoca{5,6}_??_* rwlk, + + owner @{user_config_dirs}/baloofilerc r, + owner @{user_config_dirs}/dolphinrc r, owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kdedefaults/ r, owner @{user_config_dirs}/kdedefaults/kcminputrc r, @@ -47,6 +56,7 @@ owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kwinrc r, + owner @{user_config_dirs}/trashrc r, # else if @{DE} == xfce @@ -57,6 +67,7 @@ # end + /usr/share/desktop-base/{,**} r, /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index e9a06e8aa..74df87344 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -13,6 +13,8 @@ member=Introspect peer=(name=:*, label=gnome-shell), + /usr/share/desktop-base/{,**} r, + /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, /usr/{local/,}share/ r, diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index c164bd434..f31a38617 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -12,10 +12,12 @@ @{lib}/kde{,3,4}/plugins/*/ r, @{lib}/kde{,3,4}/plugins/*/*.so mr, - /usr/share/hwdata/pnp.ids r, + /usr/share/desktop-base/{,**} r, + /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, - /usr/share/desktop-base/kf{5,6}-settings/kdeglobals r, + /usr/share/knotifications{5,6}/*.notifyrc r, + /etc/xdg/baloofilerc r, /etc/xdg/kcminputrc r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, @@ -25,6 +27,12 @@ owner @{user_config_dirs}/ rw, owner @{user_share_dirs}/ rw, + owner @{user_cache_dirs}/#@{int} rw, + owner @{user_cache_dirs}/icon-cache.kcache rw, + owner @{user_cache_dirs}/ksycoca{5,6}_??_* rwlk, + + owner @{user_config_dirs}/baloofilerc r, + owner @{user_config_dirs}/dolphinrc r, owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kdedefaults/ r, owner @{user_config_dirs}/kdedefaults/kcminputrc r, @@ -32,6 +40,7 @@ owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kwinrc r, + owner @{user_config_dirs}/trashrc r, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_akonotes_resource b/apparmor.d/groups/akonadi/akonadi_akonotes_resource index 086c29a40..0d9822088 100644 --- a/apparmor.d/groups/akonadi/akonadi_akonotes_resource +++ b/apparmor.d/groups/akonadi/akonadi_akonotes_resource @@ -15,8 +15,6 @@ profile akonadi_akonotes_resource @{exec_path} { @{exec_path} mr, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_akonotes_resource_[0-9]rc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_archivemail_agent b/apparmor.d/groups/akonadi/akonadi_archivemail_agent index aea424deb..13d45c38a 100644 --- a/apparmor.d/groups/akonadi/akonadi_archivemail_agent +++ b/apparmor.d/groups/akonadi/akonadi_archivemail_agent @@ -19,8 +19,6 @@ profile akonadi_archivemail_agent @{exec_path} { /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/akonadi_archivemail_agentrc r, owner @{user_config_dirs}/akonadi/ rw, diff --git a/apparmor.d/groups/akonadi/akonadi_birthdays_resource b/apparmor.d/groups/akonadi/akonadi_birthdays_resource index 70ff765b3..8fb383054 100644 --- a/apparmor.d/groups/akonadi/akonadi_birthdays_resource +++ b/apparmor.d/groups/akonadi/akonadi_birthdays_resource @@ -17,8 +17,6 @@ profile akonadi_birthdays_resource @{exec_path} { /usr/share/akonadi/plugins/{,**} r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_birthdays_resourcerc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_contacts_resource b/apparmor.d/groups/akonadi/akonadi_contacts_resource index c90d09a4a..733e4a85b 100644 --- a/apparmor.d/groups/akonadi/akonadi_contacts_resource +++ b/apparmor.d/groups/akonadi/akonadi_contacts_resource @@ -17,8 +17,6 @@ profile akonadi_contacts_resource @{exec_path} { /usr/share/akonadi/plugins/serializer/{,*.desktop} r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_contacts_resource_[0-9]rc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_control b/apparmor.d/groups/akonadi/akonadi_control index f3b9a0811..eba2bb4d9 100644 --- a/apparmor.d/groups/akonadi/akonadi_control +++ b/apparmor.d/groups/akonadi/akonadi_control @@ -22,7 +22,6 @@ profile akonadi_control @{exec_path} { /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/akonadi/{,**} rwl, owner @{user_config_dirs}/akonadi/ rw, diff --git a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent index 9af94de78..ba3b0227c 100644 --- a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent +++ b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent @@ -19,8 +19,6 @@ profile akonadi_followupreminder_agent @{exec_path} { @{exec_path} mr, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_followupreminder_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_ical_resource b/apparmor.d/groups/akonadi/akonadi_ical_resource index d8d87dcfb..5689a2d88 100644 --- a/apparmor.d/groups/akonadi/akonadi_ical_resource +++ b/apparmor.d/groups/akonadi/akonadi_ical_resource @@ -16,7 +16,6 @@ profile akonadi_ical_resource @{exec_path} { @{exec_path} mr, owner @{user_cache_dirs}/akonadi_ical_resource_[0-9]/{,*} rwl, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/akonadi_ical_resource_[0-9]rc rwl, owner @{user_config_dirs}/akonadi/ rw, diff --git a/apparmor.d/groups/akonadi/akonadi_indexing_agent b/apparmor.d/groups/akonadi/akonadi_indexing_agent index e2e60c67f..1f5096a82 100644 --- a/apparmor.d/groups/akonadi/akonadi_indexing_agent +++ b/apparmor.d/groups/akonadi/akonadi_indexing_agent @@ -22,8 +22,6 @@ profile akonadi_indexing_agent @{exec_path} { /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/akonadi_indexing_agentrc rw, owner @{user_config_dirs}/akonadi_indexing_agentrc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, diff --git a/apparmor.d/groups/akonadi/akonadi_maildir_resource b/apparmor.d/groups/akonadi/akonadi_maildir_resource index 7340d58a2..905fe7d68 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildir_resource +++ b/apparmor.d/groups/akonadi/akonadi_maildir_resource @@ -19,8 +19,6 @@ profile akonadi_maildir_resource @{exec_path} { owner @{user_mail_dirs}/{,**} rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_maildir_resource_[0-9]rc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent index e81a1c3e9..24b2dd695 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent +++ b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent @@ -24,12 +24,9 @@ profile akonadi_maildispatcher_agent @{exec_path} { @{exec_path} mr, /usr/share/akonadi/plugins/{,**} r, - /usr/share/knotifications{5,6}/akonadi_maildispatcher_agent.notifyrc r, /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_maildispatcher_agent.notifyrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent index 03fb464a4..9ca03ba33 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent @@ -22,8 +22,6 @@ profile akonadi_mailfilter_agent @{exec_path} { /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/agent_config_akonadi_mailfilter_agent r, owner @{user_config_dirs}/akonadi_*_resource_*rc r, diff --git a/apparmor.d/groups/akonadi/akonadi_mailmerge_agent b/apparmor.d/groups/akonadi/akonadi_mailmerge_agent index f10a8ea13..b6c8a34e0 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailmerge_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailmerge_agent @@ -20,8 +20,6 @@ profile akonadi_mailmerge_agent @{exec_path} { @{exec_path} mr, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_migration_agent b/apparmor.d/groups/akonadi/akonadi_migration_agent index 7200357f0..63e83d214 100644 --- a/apparmor.d/groups/akonadi/akonadi_migration_agent +++ b/apparmor.d/groups/akonadi/akonadi_migration_agent @@ -15,8 +15,6 @@ profile akonadi_migration_agent @{exec_path} { @{exec_path} mr, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi-migrationrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent b/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent index cb98b328a..b9e8debb2 100644 --- a/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent +++ b/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent @@ -16,12 +16,9 @@ profile akonadi_newmailnotifier_agent @{exec_path} { @{exec_path} mr, /usr/share/akonadi/plugins/serializer/{,*.desktop} r, - /usr/share/knotifications{5,6}/akonadi_newmailnotifier_agent.notifyrc r, /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/akonadi_newmailnotifier_agentrc r, owner @{user_config_dirs}/akonadi/ rw, diff --git a/apparmor.d/groups/akonadi/akonadi_notes_agent b/apparmor.d/groups/akonadi/akonadi_notes_agent index 791f90d06..97a3e8067 100644 --- a/apparmor.d/groups/akonadi/akonadi_notes_agent +++ b/apparmor.d/groups/akonadi/akonadi_notes_agent @@ -20,8 +20,6 @@ profile akonadi_notes_agent @{exec_path} { @{exec_path} mr, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_*_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_sendlater_agent b/apparmor.d/groups/akonadi/akonadi_sendlater_agent index 6062b4857..157d963fb 100644 --- a/apparmor.d/groups/akonadi/akonadi_sendlater_agent +++ b/apparmor.d/groups/akonadi/akonadi_sendlater_agent @@ -20,8 +20,6 @@ profile akonadi_sendlater_agent @{exec_path} { @{exec_path} mr, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/akonadi_sendlater_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, diff --git a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent index d8af9fa47..5a623c860 100644 --- a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent +++ b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent @@ -15,8 +15,6 @@ profile akonadi_unifiedmailbox_agent @{exec_path} { @{exec_path} mr, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner "@{user_config_dirs}/Unknown Organization/akonadi_unifiedmailbox_agent.conf_changes.dat" r, # see https://bugs.kde.org/show_bug.cgi?id=452565 owner @{user_config_dirs}/akonadi_unifiedmailbox_agentrc r, owner @{user_config_dirs}/akonadi/ rw, diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index d7162578b..2ad6e2263 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -25,27 +25,16 @@ profile firefox-kmozillahelper @{exec_path} { @{lib}/libheif/ r, @{lib}/libheif/*.so* rm, - /usr/share/hwdata/*.ids r, - /usr/share/icu/@{int}.@{int}/*.dat r, - /usr/share/knotifications{5,6}/*.notifyrc r, /usr/share/kservices{5,6}/{,**} r, - /etc/xdg/kdeglobals r, - /etc/xdg/kwinrc r, /etc/xdg/menus/ r, /etc/xdg/menus/applications-merged/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, - - owner @{user_config_dirs}/kdedefaults/kdeglobals r, - owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kmozillahelperrc r, owner @{user_config_dirs}/kmozillahelperrc.@{rand6} rwl, - owner @{user_config_dirs}/kwinrc r, owner @{user_config_dirs}/menus/ r, owner @{user_config_dirs}/menus/applications-merged/ r, diff --git a/apparmor.d/groups/display-manager/lightdm-gtk-greeter b/apparmor.d/groups/display-manager/lightdm-gtk-greeter index 60fab17a2..8cc278fc7 100644 --- a/apparmor.d/groups/display-manager/lightdm-gtk-greeter +++ b/apparmor.d/groups/display-manager/lightdm-gtk-greeter @@ -25,7 +25,6 @@ profile lightdm-gtk-greeter @{exec_path} { @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx, /usr/share/backgrounds/xfce/{,**} r, - /usr/share/desktop-base/{,**} r, /usr/share/lightdm/{,**} r, /usr/share/wayland-sessions/{,*.desktop} r, diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index 821468193..e67ccbf6a 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -37,7 +37,6 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected, owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/kdedefaults/plasmarc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/polkit-kde-authentication-agent-@{int}/ rw, owner @{user_cache_dirs}/polkit-kde-authentication-agent-@{int}/** rwk, owner link @{user_cache_dirs}/polkit-kde-authentication-agent-@{int}/** -> @{user_cache_dirs}/polkit-kde-authentication-agent-@{int}/**, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde index 3b6fa1112..ae2691cb0 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde @@ -27,10 +27,6 @@ profile xdg-desktop-portal-kde @{exec_path} { owner @{desktop_config_dirs}/user-dirs.dirs r, - owner @{user_cache_dirs}/*.kcache r, - - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/autostart/org.kde.*.desktop r, owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/xdg-desktop-portal-kderc{,.*} rwlk, diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index cf1ace48c..d84a3378f 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -60,7 +60,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, /usr/share/gnome-shell/{,**} r, - /usr/share/icu/@{int}.@{int}/*.dat r, /tmp/ r, /var/tmp/ r, diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes index 9d82ad369..46007489e 100644 --- a/apparmor.d/groups/gnome/gnome-boxes +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -37,7 +37,6 @@ profile gnome-boxes @{exec_path} { /usr/share/osinfo/{,**} r, /usr/share/gnome-boxes/{,**} r, - /usr/share/hwdata/*.ids r, /etc/qemu/bridge.conf r, diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 1d3285292..457bcfea2 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -23,7 +23,6 @@ profile gnome-characters @{exec_path} { @{open_path} rPx -> child-open-help, - /usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/org.gnome.Characters/{,**} r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 1f3bb42d8..535454199 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -78,7 +78,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { /snap/*/@{int}/**.png r, /usr/share/backgrounds/{,**} r, /usr/share/cups/data/testprint r, - /usr/share/desktop-base/**.{xml,png,svg} r, /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r, /usr/share/gnome-background-properties/{,**} r, /usr/share/gnome-bluetooth{-*,}/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-extensions-app b/apparmor.d/groups/gnome/gnome-extensions-app index ffa771be4..1b110f6e3 100644 --- a/apparmor.d/groups/gnome/gnome-extensions-app +++ b/apparmor.d/groups/gnome/gnome-extensions-app @@ -18,7 +18,6 @@ profile gnome-extensions-app @{exec_path} { @{bin}/gjs-console rix, /usr/share/gnome-shell/org.gnome.Extensions* r, - /usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/terminfo/** r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index d4ce1c504..87cc77d0e 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -200,7 +200,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/share/backgrounds/{,**} r, /usr/share/byobu/desktop/byobu* r, /usr/share/dconf/profile/gdm r, - /usr/share/desktop-base/** r, /usr/share/desktop-directories/{,*.directory} r, /usr/share/gdm/BuiltInSessions/{,*.desktop} r, /usr/share/gdm/greeter-dconf-defaults r, diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index db128da15..c5b1ec821 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -48,8 +48,6 @@ profile gnome-terminal-server @{exec_path} { @{open_path} rPx -> child-open, - /usr/share/icu/@{int}.@{int}/*.dat r, - /etc/shells r, owner @{user_config_dirs}/*xdg-terminals.list* rw, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index f00b8d10f..3e597c156 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -66,7 +66,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open, - /usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/nautilus/{,**} r, /usr/share/poppler/{,**} r, /usr/share/sounds/freedesktop/stereo/*.oga r, diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 858d216ac..7752d9dd3 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -39,7 +39,6 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter/applications/*.desktop r, - /usr/share/hwdata/*.ids r, /usr/share/ladspa/rdf/{,**} r, /usr/share/osinfo/{,**} r, /usr/share/poppler/{,**} r, diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index 9ebdd9fe8..f54f05731 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -47,7 +47,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter/applications/{,mimeinfo.cache,*.list} r, /usr/share/gvfs/remote-volume-monitors/{,*.monitor} r, - /usr/share/hwdata/*.ids r, /usr/share/ladspa/rdf/{,**} r, /usr/share/osinfo/{,**} r, /usr/share/poppler/{,**} r, diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 8c0fc8d20..5f293a9e1 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -31,7 +31,6 @@ profile DiscoverNotifier @{exec_path} { @{bin}/gpgconf rCx -> gpg, @{bin}/gpgsm rCx -> gpg, - /usr/share/knotifications{5,6}/{,**} r, /usr/share/metainfo/{,**} r, /etc/machine-id r, @@ -45,7 +44,6 @@ profile DiscoverNotifier @{exec_path} { owner @{user_cache_dirs}/appstream/ r, owner @{user_cache_dirs}/appstream/** rw, owner @{user_cache_dirs}/flatpak/{,**} rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/@{int} rw, owner @{user_config_dirs}/breezerc r, diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index 780348692..0b1ee4fa4 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -25,11 +25,9 @@ profile baloo @{exec_path} { @{lib}/{,kf6/}baloo_file_extractor rix, /usr/share/poppler/{,**} r, - /usr/share/desktop-base/kf5-settings/baloofilerc r, /etc/fstab r, /etc/machine-id r, - /etc/xdg/baloofilerc r, # Allow to search user files owner @{HOME}/{,**} r, diff --git a/apparmor.d/groups/kde/baloorunner b/apparmor.d/groups/kde/baloorunner index 7faa752d6..894c2cb7b 100644 --- a/apparmor.d/groups/kde/baloorunner +++ b/apparmor.d/groups/kde/baloorunner @@ -19,17 +19,11 @@ profile baloorunner @{exec_path} { @{bin}/* rPx, - /etc/xdg/baloofilerc r, - # Allow to search user files owner @{HOME}/{,**} r, owner @{MOUNTS}/{,**} r, owner @{tmp}/*/{,**} r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - - owner @{user_config_dirs}/baloofilerc r, - owner @{user_share_dirs}/baloo/{,**} rwk, /tmp/ r, diff --git a/apparmor.d/groups/kde/drkonqi b/apparmor.d/groups/kde/drkonqi index 78ca6d21b..d096c9ba8 100644 --- a/apparmor.d/groups/kde/drkonqi +++ b/apparmor.d/groups/kde/drkonqi @@ -26,7 +26,6 @@ profile drkonqi @{exec_path} { @{bin}/lsb_release rPx -> lsb_release, /usr/share/drkonqi/{,**} r, - /usr/share/knotifications{5,6}/*.notifyrc r, owner @{user_cache_dirs}/drkonqi/ rw, owner @{user_cache_dirs}/drkonqi/** rwlk -> @{user_cache_dirs}/drkonqi/**, diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index 7d6e4867e..e9ed1399d 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -22,8 +22,6 @@ profile kaccess @{exec_path} { /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/kaccessrc r, diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index b51d72a91..8fccca289 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -29,17 +29,12 @@ profile kactivitymanagerd @{exec_path} { owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, - owner @{user_config_dirs}/#@{int} rw, - owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/breezerc r, - owner @{user_config_dirs}/dolphinrc r, owner @{user_config_dirs}/kactivitymanagerdrc.lock rwk, owner @{user_config_dirs}/kactivitymanagerdrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/libreoffice/**.xcu r, owner @{user_config_dirs}/menus/{,**} r, - owner @{user_config_dirs}/trashrc r, owner @{user_share_dirs}/kactivitymanagerd/{,**} rwlk, owner @{user_share_dirs}/kservices{5,6}/{,**} r, diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index e6a57f985..97bdef983 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -20,12 +20,9 @@ profile kalendarac @{exec_path} { /usr/share/akonadi/firstrun/{,*} r, /usr/share/akonadi/plugins/serializer/{,*.desktop} r, - /usr/share/knotifications{5,6}/{,**} r, /etc/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/akonadi-firstrunrc r, owner @{user_config_dirs}/akonadi/akonadiconnectionrc r, diff --git a/apparmor.d/groups/kde/kbuildsycoca b/apparmor.d/groups/kde/kbuildsycoca index 005458b08..beb235536 100644 --- a/apparmor.d/groups/kde/kbuildsycoca +++ b/apparmor.d/groups/kde/kbuildsycoca @@ -15,9 +15,6 @@ profile kbuildsycoca @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - owner @{user_cache_dirs}/ksycoca{5,6}_* rw, - owner link @{user_cache_dirs}/ksycoca5_* -> @{user_cache_dirs}/#@{int}, - /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/kconf_update b/apparmor.d/groups/kde/kconf_update index 5d0914b52..ce11fb914 100644 --- a/apparmor.d/groups/kde/kconf_update +++ b/apparmor.d/groups/kde/kconf_update @@ -44,44 +44,10 @@ profile kconf_update @{exec_path} { /etc/machine-id r, /var/lib/dbus/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - - owner @{user_config_dirs}/akregatorrc.lock rwk, - owner @{user_config_dirs}/akregatorrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/dolphinrc.lock rwk, - owner @{user_config_dirs}/dolphinrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/*rc rwl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/*rc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/*rc.lock rwk, owner @{user_config_dirs}/gtk-{3,4}.0/* rwlk -> @{user_config_dirs}/gtk-{3,4}.0/**, - owner @{user_config_dirs}/kactivitymanagerd-statsrc rw, - owner @{user_config_dirs}/kateschemarc.lock rwk, - owner @{user_config_dirs}/kateschemarc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kcminputrc.lock rwk, - owner @{user_config_dirs}/kcminputrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kconf_updaterc.lock rwk, - owner @{user_config_dirs}/kconf_updaterc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk, - owner @{user_config_dirs}/kglobalshortcutsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/khotkeysrc.lock rwk, - owner @{user_config_dirs}/khotkeysrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kmixrc.lock rwk, - owner @{user_config_dirs}/kmixrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/konsolerc.lock rwk, - owner @{user_config_dirs}/konsolerc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/krunnerrc.lock rwk, - owner @{user_config_dirs}/krunnerrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/krunnerstaterc.lock rwk, - owner @{user_config_dirs}/krunnerstaterc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kscreenlockerrc.lock rwk, - owner @{user_config_dirs}/kscreenlockerrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/ksmserverrc.lock rwk, - owner @{user_config_dirs}/ksmserverrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kwinrc.lock rwk, - owner @{user_config_dirs}/kwinrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kwinrulesrc.lock rwk, - owner @{user_config_dirs}/kwinrulesrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kxkbrc.lock rwk, - owner @{user_config_dirs}/kxkbrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/plasma-org.kde.plasma.desktop-appletsrc rw, - owner @{user_config_dirs}/plasmashellrc r, owner @{user_config_dirs}/sed@{rand6} rw, owner @{user_config_dirs}/xsettingsd/xsettingsd.conf rw, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 32ad8cd86..3a24b3db8 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -30,8 +30,6 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{bin}/xargs rix, @{lib}/drkonqi rPx, - /usr/share/knotifications{5,6}/*.notifyrc r, - /etc/fstab r, /etc/machine-id r, diff --git a/apparmor.d/groups/kde/kde-systemd-start-condition b/apparmor.d/groups/kde/kde-systemd-start-condition index a913dba60..31367f47c 100644 --- a/apparmor.d/groups/kde/kde-systemd-start-condition +++ b/apparmor.d/groups/kde/kde-systemd-start-condition @@ -9,13 +9,10 @@ include @{exec_path} = @{bin}/kde-systemd-start-condition profile kde-systemd-start-condition @{exec_path} { include + include @{exec_path} mr, - /etc/xdg/baloofilerc r, - /usr/share/desktop-base/kf{5,6}-settings/baloofilerc r, - - owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/kalendaracrc r, owner @{user_config_dirs}/kgpgrc r, owner @{user_config_dirs}/kmixrc r, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 5620d7dee..f93144c5f 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -70,14 +70,11 @@ profile kded @{exec_path} { /usr/share/kded{5,6}/{,**} r, /usr/share/kf{5,6}/kcookiejar/* r, /usr/share/khotkeys/{,**} r, - /usr/share/knotifications{5,6}/{,**} r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,**} r, /etc/fstab r, /etc/xdg/accept-languages.codes r, - /etc/xdg/baloofilerc r, - /etc/xdg/kcminputrc r, /etc/xdg/kde* r, /etc/xdg/kioslaverc r, /etc/xdg/menus/{,**} r, @@ -91,21 +88,17 @@ profile kded @{exec_path} { owner @{HOME}/.gtkrc-2.0 rw, @{user_cache_dirs}/ksycoca{5,6}_* rwlk -> @{user_cache_dirs}/#@{int}, - owner @{user_cache_dirs}/#@{int} rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/plasmashell/ rw, owner @{user_cache_dirs}/plasmashell/** rwlk -> @{user_cache_dirs}/plasmashell/**, @{user_config_dirs}/kcookiejarrc.lock rwk, @{user_config_dirs}/kcookiejarrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/bluedevilglobalrc.lock rwk, owner @{user_config_dirs}/bluedevilglobalrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/gtk-{3,4}.0/{,**} rwl, owner @{user_config_dirs}/gtk-{3,4}.0/settings.ini.lock rk, owner @{user_config_dirs}/gtkrc{,*} rwlk, - owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kconf_updaterc rw, owner @{user_config_dirs}/kconf_updaterc.lock rwk, owner @{user_config_dirs}/kdebugrc r, @@ -128,7 +121,6 @@ profile kded @{exec_path} { owner @{user_config_dirs}/networkmanagement.notifyrc r, owner @{user_config_dirs}/plasma* r, owner @{user_config_dirs}/touchpadrc r, - owner @{user_config_dirs}/trashrc r, owner @{user_config_dirs}/Trolltech.conf.lock rwk, owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl, owner @{user_config_dirs}/xsettingsd/{,**} rw, diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index f71f9734c..4d2616e3e 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -21,8 +21,6 @@ profile kglobalacceld @{exec_path} { /etc/xdg/menus/ r, /etc/xdg/menus/applications-merged/ r, - owner @{user_cache_dirs}/ksycoca{5,6}_* rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk, owner @{user_config_dirs}/kglobalshortcutsrc* rwl, diff --git a/apparmor.d/groups/kde/kiod b/apparmor.d/groups/kde/kiod index 5b6c7184a..d83749455 100644 --- a/apparmor.d/groups/kde/kiod +++ b/apparmor.d/groups/kde/kiod @@ -22,8 +22,6 @@ profile kiod @{exec_path} { /usr/share/icons/breeze/index.theme r, /usr/share/mime/{,**} r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/ksslcertificatemanager rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/ksslcertificatemanager.lock rwk, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index db135515b..5bd01bb15 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -72,9 +72,7 @@ profile kioworker @{exec_path} { owner @{HOME}/@{XDG_DESKTOP_DIR}/.directory l -> @{HOME}/@{XDG_DESKTOP_DIR}/#@{int}, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kio_http/* rwl, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, owner @{user_config_dirs}/kio_httprc r, owner @{user_config_dirs}/menus/{,**} r, diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 28b5d2650..94bad21ba 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -40,8 +40,6 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/share/color-schemes/{,**} r, /usr/share/kf6/{,**} r, - /usr/share/knotifications{5,6}/konsole.notifyrc r, - /usr/share/knotifications{5,6}/plasma_workspace.notifyrc r, /usr/share/konsole/{,**} r, /usr/share/sounds/** r, @@ -52,9 +50,6 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{HOME}/@{XDG_SSH_DIR}/config r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, - owner @{user_config_dirs}/#@{int} rwl, owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/kbookmarkrc r, diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index 74020b468..b67fe50f1 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -70,7 +70,6 @@ profile kscreenlocker_greet @{exec_path} { owner @{user_pictures_dirs}/{,**} r, owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kscreenlocker_greet/ w, owner @{user_cache_dirs}/kscreenlocker_greet/** rwlk, owner @{user_cache_dirs}/ksvg-elements rw, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index 65bf9036a..f36d8f2f2 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -32,7 +32,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:exec kscreenlocker_greet /usr/share/color-schemes/{,**} r, - /usr/share/knotifications{5,6}/*.notifyrc r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes{5,6}/{,**} r, @@ -44,10 +43,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{HOME}/@{rand6} rw, owner @{HOME}/.Xauthority rw, - owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/fontconfig/*-le64.cache-* r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_* rwlk, owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/kdedefaults/kscreenlockerrc r, diff --git a/apparmor.d/groups/kde/ksmserver-logout-greeter b/apparmor.d/groups/kde/ksmserver-logout-greeter index 44d7f6e2a..55379861e 100644 --- a/apparmor.d/groups/kde/ksmserver-logout-greeter +++ b/apparmor.d/groups/kde/ksmserver-logout-greeter @@ -13,7 +13,6 @@ profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/kde/ksplashqml b/apparmor.d/groups/kde/ksplashqml index 97ecd5c22..8b878457b 100644 --- a/apparmor.d/groups/kde/ksplashqml +++ b/apparmor.d/groups/kde/ksplashqml @@ -24,7 +24,6 @@ profile ksplashqml @{exec_path} { /etc/machine-id r, /etc/xdg/plasmarc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/ksplash/ rw, owner @{user_cache_dirs}/ksplash/** rwlk -> @{user_cache_dirs}/ksplash/**, diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index 5005dde31..282f4231b 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -30,8 +30,6 @@ profile kwalletd @{exec_path} { /etc/machine-id r, /var/lib/dbus/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/kwalletrc r, diff --git a/apparmor.d/groups/kde/kwalletmanager b/apparmor.d/groups/kde/kwalletmanager index e26d09f13..a5c5ddfef 100644 --- a/apparmor.d/groups/kde/kwalletmanager +++ b/apparmor.d/groups/kde/kwalletmanager @@ -29,7 +29,6 @@ profile kwalletmanager @{exec_path} { /etc/xdg/ui/ui_standards.rc r, /var/lib/dbus/machine-id r, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/kwalletmanager5rc rw, owner @{user_config_dirs}/kwalletmanager5rc.* rwl -> @{user_config_dirs}/#@{int}, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 2393f9201..162f2cfc3 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -32,10 +32,8 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { #aa:exec kscreenlocker_greet /usr/share/color-schemes/*.colors r, - /usr/share/desktop-base/kf5-settings/{,**} r, /usr/share/desktop-directories/*.directory r, /usr/share/kglobalaccel/{,**} r, - /usr/share/knotifications{5,6}/ksmserver.notifyrc r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,*.desktop} r, /usr/share/kwin/{,**} r, @@ -71,11 +69,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { owner @{sddm_config_dirs}/kwinrc{,.@{rand6}} rwl -> @{sddm_config_dirs}/#@{int}, owner @{user_cache_dirs}/ r, - owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/ksvg-elements r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, - owner @{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/kwin/ rw, owner @{user_cache_dirs}/kwin/** rwkl -> @{user_cache_dirs}/kwin/**, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, @@ -85,7 +79,6 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { owner @{user_config_dirs}/#@{int} rwl, owner @{user_config_dirs}/breezerc r, - owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kdedefaults/* r, owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk, owner @{user_config_dirs}/kglobalshortcutsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index 8ee46455e..0454e70e1 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -36,8 +36,6 @@ profile kwin_x11 @{exec_path} { /etc/xdg/plasmarc r, owner @{user_cache_dirs}/ r, - owner @{user_cache_dirs}/#@{int} rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kcrash-metadata/*.ini rw, owner @{user_cache_dirs}/ksvg-elements r, owner @{user_cache_dirs}/kwin/{,**} rwl, diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index 40f9de33e..a27751eb4 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -41,7 +41,6 @@ profile okular @{exec_path} { /usr/share/poppler/{,**} r, /etc/fstab r, - /etc/xdg/baloofilerc r, /etc/xdg/dolphinrc r, /etc/xdg/menus/ r, /etc/xdg/menus/applications-merged/ r, @@ -49,7 +48,6 @@ profile okular @{exec_path} { / r, @{MOUNTS}/ r, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, owner @{user_cache_dirs}/okular/{,**} rw, owner @{user_config_dirs}/#@{int} rw, @@ -59,8 +57,6 @@ profile okular @{exec_path} { owner @{user_config_dirs}/okularrc rw, owner @{user_config_dirs}/okularrc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/okularrc.lock rwk, - owner @{user_config_dirs}/baloofilerc r, - owner @{user_config_dirs}/dolphinrc r, owner @{user_config_dirs}/okular-generator-popplerrc r, owner @{user_config_dirs}/KDE/*.conf r, owner @{user_config_dirs}/kioslaverc r, @@ -68,7 +64,6 @@ profile okular @{exec_path} { owner @{user_config_dirs}/kwalletrc r, owner @{user_config_dirs}/menus/ r, owner @{user_config_dirs}/menus/applications-merged/ r, - owner @{user_config_dirs}/trashrc r, owner @{user_share_dirs}/#@{int} rw, owner @{user_share_dirs}/kxmlgui{5,6}/okular/{,*} r, diff --git a/apparmor.d/groups/kde/plasma-browser-integration-host b/apparmor.d/groups/kde/plasma-browser-integration-host index 6270df2f7..bcf1af528 100644 --- a/apparmor.d/groups/kde/plasma-browser-integration-host +++ b/apparmor.d/groups/kde/plasma-browser-integration-host @@ -28,9 +28,6 @@ profile plasma-browser-integration-host @{exec_path} { /etc/xdg/menus/ r, /etc/xdg/taskmanagerrulesrc r, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, - owner @{user_config_dirs}/menus/ r, owner @{user_config_dirs}/menus/applications-merged/ r, diff --git a/apparmor.d/groups/kde/plasma-discover b/apparmor.d/groups/kde/plasma-discover index d35e8dcd8..e94fd036e 100644 --- a/apparmor.d/groups/kde/plasma-discover +++ b/apparmor.d/groups/kde/plasma-discover @@ -38,7 +38,6 @@ profile plasma-discover @{exec_path} { #aa:exec kio_http_cache_cleaner #aa:exec kioworker - /usr/share/knotifications{5,6}/plasma_workspace.notifyrc r, /usr/share/knsrcfiles/{,*} r, /usr/share/kservices{5,6}/{,*} r, /usr/share/kservicetypes5/{,*} r, @@ -65,7 +64,6 @@ profile plasma-discover @{exec_path} { owner @{user_cache_dirs}/appstream/*.xb rw, owner @{user_cache_dirs}/discover/{,**} rwlk, owner @{user_cache_dirs}/flatpak/system-cache/{,**} rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kio_http/ w, owner @{user_config_dirs}/ r, diff --git a/apparmor.d/groups/kde/plasma_session b/apparmor.d/groups/kde/plasma_session index 6082b579e..172c643c7 100644 --- a/apparmor.d/groups/kde/plasma_session +++ b/apparmor.d/groups/kde/plasma_session @@ -33,15 +33,11 @@ profile plasma_session @{exec_path} { #aa:exec polkit-kde-authentication-agent /usr/share/kservices{5,6}/{,**} r, - /usr/share/knotifications{5,6}/{,**} r, /etc/xdg/autostart/ r, /etc/xdg/autostart/*.desktop r, /etc/xdg/menus/ r, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, - - owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/kdedefaults/ksplashrc r, owner @{user_config_dirs}/plasma-welcomerc r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index e583c26bc..954431f86 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -61,11 +61,9 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { /opt/*/**/*.png r, /usr/share/*/icons/{,**} r, /usr/share/akonadi/{,**} r, - /usr/share/desktop-base/{,**} r, /usr/share/desktop-directories/kf5-*.directory r, /usr/share/kf{5,6}/{,**} r, /usr/share/kio/servicemenus/{,*.desktop} r, - /usr/share/knotifications{5,6}/*.notifyrc r, /usr/share/konsole/ r, /usr/share/krunner/{,**} r, /usr/share/kservices{5,6}/{,**} r, @@ -97,6 +95,8 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{HOME}/.var/app/**.{png,jpg,svg} r, owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, + owner @{user_games_dirs}/**.{png,jpg,svg} r, + owner @{user_music_dirs}/**.{png,jpg,svg} r, owner @{user_pictures_dirs}/{,**} r, owner @{user_templates_dirs}/ r, @@ -107,12 +107,10 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_cache_dirs}/appstream/*.xb rw, owner @{user_cache_dirs}/bookmarksrunner/ rw, owner @{user_cache_dirs}/bookmarksrunner/** rwkl -> @{user_cache_dirs}/bookmarksrunner/#@{int}, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kcrash-metadata/plasmashell.*.ini w, owner @{user_cache_dirs}/ksvg-elements rw, owner @{user_cache_dirs}/ksvg-elements.@{rand6} rwlk -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/ksvg-elements.lock rwlk, - owner @{user_cache_dirs}/ksycoca{5,6}_* rwlk -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/org.kde.dirmodel-qml.kcache rw, owner @{user_cache_dirs}/plasma_engine_potd/{,**} rw, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, @@ -132,9 +130,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_config_dirs}/akonadi/akonadi*rc r, owner @{user_config_dirs}/arkrc r, owner @{user_config_dirs}/baloofileinformationrc r, - owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/breezerc r, - owner @{user_config_dirs}/dolphinrc r, owner @{user_config_dirs}/eventviewsrc r, owner @{user_config_dirs}/kactivitymanagerd* rwkl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/kcookiejarrc r, @@ -151,7 +147,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_config_dirs}/menus/{,**} r, owner @{user_config_dirs}/networkmanagement.notifyrc r, owner @{user_config_dirs}/plasma* rwlk, - owner @{user_config_dirs}/trashrc r, owner @{user_share_dirs}/*/sessions/ r, owner @{user_share_dirs}/#@{int} rw, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 1b52954d6..5030d18f4 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -113,7 +113,6 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/share/sddm/scripts/Xsetup rix, /usr/share/sddm/scripts/Xstop rix, - /usr/share/desktop-base/softwaves-theme/login/*.svg r, /usr/share/plasma/desktoptheme/** r, /usr/share/sddm/faces/.*.icon r, /usr/share/sddm/themes/** r, diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index 441f2db25..6f33e233a 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -28,7 +28,6 @@ profile sddm-greeter @{exec_path} { @{lib}/libheif/ r, @{lib}/libheif/*.so* rm, - /usr/share/desktop-base/*-theme/login/*.svg r, /usr/share/endeavouros/backgrounds/** r, /usr/share/hunspell/** r, /usr/share/plasma/desktoptheme/** r, @@ -53,7 +52,6 @@ profile sddm-greeter @{exec_path} { @{HOME}/.face.icon r, owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, owner @{user_cache_dirs}/plasma-svgelements rw, owner @{user_cache_dirs}/plasma-svgelements.@{rand6} rw, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index 81b1a1243..e57639b6e 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -33,14 +33,12 @@ profile startplasma @{exec_path} { /usr/share/color-schemes/{,**} r, /usr/share/desktop-directories/{,**} r, - /usr/share/knotifications{5,6}/{,**} r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,**} r, /usr/share/plasma/{,**} r, /etc/locale.alias r, /etc/machine-id r, - /etc/xdg/kcminputrc r, /etc/xdg/menus/{,**} r, /etc/xdg/plasma-workspace/env/{,*} r, @@ -52,7 +50,6 @@ profile startplasma @{exec_path} { owner @{user_cache_dirs}/plasma-svgelements rw, owner @{user_config_dirs}/gtkrc{,*} rwlk, - owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kdedefaults/ rw, owner @{user_config_dirs}/kdedefaults/** rwkl -> @{user_config_dirs}/kdedefaults/**, owner @{user_config_dirs}/ksplashrc r, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index 384c1da8b..d0fec60fc 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -43,7 +43,6 @@ profile systemsettings @{exec_path} { /usr/share/kcmkeys/{,*.kksrc} r, /usr/share/kglobalaccel/* r, /usr/share/kinfocenter/{,**} r, - /usr/share/knotifications{5,6}/{,**} r, /usr/share/solid/{,**} r, /usr/share/kpackage/{,**} r, /usr/share/kservices{5,6}/{,**} r, @@ -71,14 +70,11 @@ profile systemsettings @{exec_path} { owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, - owner @{user_cache_dirs}/#@{int} rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/kcrash-metadata/*.ini rw, owner @{user_cache_dirs}/kinfocenter/{,**} rwlk, owner @{user_cache_dirs}/ksvg-elements rw, owner @{user_cache_dirs}/ksvg-elements.@{rand6} rwlk -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/ksvg-elements.lock rwlk, - owner @{user_cache_dirs}/ksycoca{5,6}_* r, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, owner @{user_cache_dirs}/systemsettings/ rw, owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**, diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index 0e236f945..96c9b6d25 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -38,7 +38,6 @@ profile keepassxc @{exec_path} { @{lib}/firefox/firefox rPx, @{open_path} rPx -> child-open, - /usr/share/hwdata/pnp.ids r, /usr/share/keepassxc/{,**} r, /etc/fstab r, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 60ea019aa..b4c07e38b 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -61,7 +61,6 @@ profile libreoffice @{exec_path} { @{lib}/libreoffice/share/extensions/{,**/}__pycache__/ w, /usr/share/hyphen/{,**} r, - /usr/share/knotifications{5,6}/plasma_workspace.notifyrc r, /usr/share/libexttextcat/{,**} r, /usr/share/liblangtag/{,**} r, /usr/share/libreoffice/{,**} r, @@ -77,7 +76,6 @@ profile libreoffice @{exec_path} { owner @{user_config_dirs}/libreoffice/ rw, owner @{user_config_dirs}/libreoffice/** rwk, owner @{user_config_dirs}/soffice.*.lock rwk, - owner @{user_config_dirs}/trashrc r, owner @{user_config_dirs}/plasma_workspace.notifyrc r, owner @{user_config_dirs}/kservicemenurc r, diff --git a/apparmor.d/profiles-m-r/pinentry-qt b/apparmor.d/profiles-m-r/pinentry-qt index 93dc4aded..97e84c7ec 100644 --- a/apparmor.d/profiles-m-r/pinentry-qt +++ b/apparmor.d/profiles-m-r/pinentry-qt @@ -22,9 +22,6 @@ profile pinentry-qt @{exec_path} { /etc/machine-id r, /var/lib/dbus/machine-id r, - owner @{user_cache_dirs}/#@{int} rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{tmp}/xauth_@{rand6} r, owner /dev/shm/#@{int} rw, diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index 30457cf04..762af3bfc 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -46,8 +46,6 @@ profile psi @{exec_path} { /var/lib/dbus/machine-id r, owner @{HOME}/ r, - owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/psi/{,**} rw, owner @{user_config_dirs}/autostart/psi.desktop rw, owner @{user_config_dirs}/psi/ rw, diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index 1427af278..076d96da7 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -46,8 +46,6 @@ profile psi-plus @{exec_path} { /var/lib/dbus/machine-id r, owner @{HOME}/ r, - owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/psi+/{,**} rw, owner @{user_config_dirs}/autostart/psi-plus.desktop rw, owner @{user_config_dirs}/psi+/ rw, diff --git a/apparmor.d/profiles-m-r/qbittorrent b/apparmor.d/profiles-m-r/qbittorrent index f9502cf75..7f79d3a06 100644 --- a/apparmor.d/profiles-m-r/qbittorrent +++ b/apparmor.d/profiles-m-r/qbittorrent @@ -85,8 +85,6 @@ profile qbittorrent @{exec_path} { /usr/share/GeoIP/GeoIP.dat r, /usr/share/gvfs/remote-volume-monitors/{,*} r, - owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/qBittorrent/{,**} rw, owner @{user_config_dirs}/qBittorrent/ rw, diff --git a/apparmor.d/profiles-m-r/qt5ct b/apparmor.d/profiles-m-r/qt5ct index 3052736b6..4026983ab 100644 --- a/apparmor.d/profiles-m-r/qt5ct +++ b/apparmor.d/profiles-m-r/qt5ct @@ -28,9 +28,6 @@ profile qt5ct @{exec_path} { owner @{user_config_dirs}/fontconfig/** rw, owner @{user_config_dirs}/fontconfig/fonts.conf.back rwl -> @{user_config_dirs}/fontconfig/#@{int}, - owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{PROC}/@{pid}/cmdline r, /dev/shm/#@{int} rw, diff --git a/apparmor.d/profiles-s-z/smplayer b/apparmor.d/profiles-s-z/smplayer index 28065ac24..0248d4218 100644 --- a/apparmor.d/profiles-s-z/smplayer +++ b/apparmor.d/profiles-s-z/smplayer @@ -53,8 +53,6 @@ profile smplayer @{exec_path} { owner @{user_config_dirs}/smplayer/ rw, owner @{user_config_dirs}/smplayer/* rwkl -> @{user_config_dirs}/smplayer/#@{int}, - owner @{user_cache_dirs}/#@{int} rw, - owner @{tmp}/qtsingleapp-smplay-* rw, owner @{tmp}/qtsingleapp-smplay-*-lockfile rwk, owner @{tmp}/smplayer_preview/ rw, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index fbfcaf7b9..310b94683 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -46,7 +46,6 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open, /usr/share/gtksourceview-4/{,**} r, - /usr/share/hwdata/*.ids r, /usr/share/ladspa/rdf/{,ladspa.rdfs} r, /usr/share/misc/*.ids r, /usr/share/osinfo/{,**} r, diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index b5ea8b272..508deaeac 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -56,7 +56,6 @@ profile vlc @{exec_path} { owner @{user_torrents_dirs}/{,**} rw, owner @{user_videos_dirs}/{,**} rw, - owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/vlc/ rw, owner @{user_cache_dirs}/vlc/{,**} rw, From 7a53fc3a99399c56c50c2761124a08153b0e0a08 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 18:10:27 +0100 Subject: [PATCH 0187/1455] feat(profile): general updtae. --- apparmor.d/abstractions/app/sudo | 1 - apparmor.d/abstractions/gstreamer | 7 +- apparmor.d/abstractions/vulkan-strict | 1 - apparmor.d/groups/browsers/torbrowser-start | 2 + apparmor.d/groups/bus/at-spi2-registryd | 20 +---- .../groups/freedesktop/xdg-desktop-portal | 20 ++--- .../freedesktop/xdg-desktop-portal-gnome | 32 +------- apparmor.d/groups/freedesktop/xdg-user-dir | 3 +- apparmor.d/groups/gpg/gpg-agent | 1 + apparmor.d/groups/gpg/scdaemon | 6 +- apparmor.d/groups/network/NetworkManager | 3 +- apparmor.d/groups/pacman/makepkg | 5 +- apparmor.d/groups/pacman/yay | 2 + apparmor.d/groups/systemd/systemd-udevd | 2 - apparmor.d/groups/virt/cni-xtables-nft | 36 --------- apparmor.d/groups/virt/cockpit-bridge | 27 ++++++- apparmor.d/groups/virt/cockpit-update-motd | 2 - apparmor.d/groups/virt/xtables | 43 +++++++++++ apparmor.d/profiles-a-f/aa-log | 2 - apparmor.d/profiles-a-f/convertall | 23 ++---- apparmor.d/profiles-m-r/pass | 76 +++++++++---------- .../signal-desktop-chrome-sandbox | 4 +- .../spice-client-glib-usb-acl-helper | 1 - apparmor.d/profiles-s-z/switcherooctl | 2 +- apparmor.d/profiles-s-z/tomb | 3 +- apparmor.d/profiles-s-z/udisksd | 7 +- apparmor.d/profiles-s-z/wpa-gui | 11 +-- 27 files changed, 158 insertions(+), 184 deletions(-) delete mode 100644 apparmor.d/groups/virt/cni-xtables-nft create mode 100644 apparmor.d/groups/virt/xtables diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index fdd348587..3fa454356 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -57,7 +57,6 @@ @{PROC}/@{pid}/limits r, @{PROC}/@{pid}/loginuid r, @{PROC}/@{pid}/stat r, - @{PROC}/sys/kernel/cap_last_cap r, @{PROC}/sys/kernel/ngroups_max r, @{PROC}/sys/kernel/seccomp/actions_avail r, diff --git a/apparmor.d/abstractions/gstreamer b/apparmor.d/abstractions/gstreamer index 60bac614e..4a5deb7c4 100644 --- a/apparmor.d/abstractions/gstreamer +++ b/apparmor.d/abstractions/gstreamer @@ -45,7 +45,12 @@ @{sys}/class/ r, @{sys}/class/drm/ r, @{sys}/class/video4linux/ r, - @{sys}/devices/@{pci}/{busnum,config,devnum,descriptors,speed,uevent} r, + @{sys}/devices/@{pci}/busnum r, + @{sys}/devices/@{pci}/config r, + @{sys}/devices/@{pci}/descriptors r, + @{sys}/devices/@{pci}/devnum r, + @{sys}/devices/@{pci}/speed r, + @{sys}/devices/@{pci}/uevent r, @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node@{int}/meminfo r, diff --git a/apparmor.d/abstractions/vulkan-strict b/apparmor.d/abstractions/vulkan-strict index fd86f1e81..5210a48e2 100644 --- a/apparmor.d/abstractions/vulkan-strict +++ b/apparmor.d/abstractions/vulkan-strict @@ -29,5 +29,4 @@ include if exists - # vim:syntax=apparmor diff --git a/apparmor.d/groups/browsers/torbrowser-start b/apparmor.d/groups/browsers/torbrowser-start index 8292f613a..e7072c856 100644 --- a/apparmor.d/groups/browsers/torbrowser-start +++ b/apparmor.d/groups/browsers/torbrowser-start @@ -42,6 +42,8 @@ profile torbrowser-start @{exec_path} { owner @{lib_dirs}/sed@{rand6} rw, owner @{lib_dirs}/TorBrowser/Tor/tor r, + owner @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/sed@{rand6} rw, + owner @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/start-tor-browser.desktop rw, owner @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/sed@{rand6} rw, owner @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/start-tor-browser.desktop rw, diff --git a/apparmor.d/groups/bus/at-spi2-registryd b/apparmor.d/groups/bus/at-spi2-registryd index 2b0ac0475..46b404f2b 100644 --- a/apparmor.d/groups/bus/at-spi2-registryd +++ b/apparmor.d/groups/bus/at-spi2-registryd @@ -17,24 +17,8 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term) peer=gdm, - #aa:dbus own bus=accessibility name=org.a11y.atspi.{R,r}egistry - dbus send bus=accessibility path=/org/a11y/atspi/accessible/root - interface=org.freedesktop.DBus.Properties - member=Set - peer=(name=:*), - dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root - interface=org.a11y.atspi.Socket - member=Embed - peer=(name=:*), - dbus receive bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller - interface=org.a11y.atspi.DeviceEventController - member={GetKeystrokeListeners,GetDeviceEventListeners} - peer=(name=:*), - - dbus send bus=session path=/org/a11y/bus - interface=org.a11y.Bus - member=GetAddress - peer=(name=org.a11y.Bus, label=dbus-accessibility), + #aa:dbus own bus=accessibility name=org.a11y.atspi + #aa:dbus talk bus=session name=org.a11y.{B,b}us label=dbus-accessibility dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 5d908e67b..d8929cfb1 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -20,6 +20,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { include include include + include include capability sys_ptrace, @@ -34,19 +35,9 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { member=MakeThread* peer=(name=:*), - dbus receive bus=system path=/org/freedesktop/NetworkManager - interface=org.freedesktop.NetworkManager - member=CheckPermissions - peer=(name=:*, label=NetworkManager), - #aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor - dbus send bus=session path=/org/freedesktop/portal/documents - interface=org.freedesktop.DBus.Properties - peer=(name=:*, label=xdg-document-portal), - dbus send bus=session path=/org/freedesktop/portal/documents - interface=org.freedesktop.portal.Documents - peer=(name=:*, label=xdg-document-portal), + #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus @@ -62,10 +53,9 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/nautilus rPx, - @{bin}/snap rPUx, - @{bin}/kreadconfig5 rPx, - @{lib}/xdg-desktop-portal-validate-icon rPUx, + @{bin}/kreadconfig{,5} rPx, + @{lib}/xdg-desktop-portal-validate-icon rPx, @{open_path} rPx -> child-open, / r, @@ -76,7 +66,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { /etc/sysconfig/proxy r, - /var/lib/gdm{,3}/greeter-dconf-defaults r, + @{GDM_HOME}/greeter-dconf-defaults r, @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/xdg-desktop-portal/* r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 588d4d393..586828ee0 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -13,7 +13,6 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -30,39 +29,16 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { signal (receive) set=(hup term) peer=gdm-session-worker, #aa:dbus own bus=session name=org.freedesktop.impl.portal.desktop.gnome - - dbus send bus=session path=/org/gnome/Shell/Screenshot - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=:*, label=gnome-shell), - - dbus send bus=session path=/org/freedesktop/portal/desktop - interface=org.freedesktop.impl.portal.Background - member=RunningApplicationsChanged - peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal), - - dbus receive bus=session path=/org/freedesktop/portal/desktop - interface=org.freedesktop.impl.portal.Background - member=GetAppState - peer=(name=:*, label=xdg-desktop-portal), - - dbus send bus=session path=/org/freedesktop/portal/desktop - interface=org.freedesktop.impl.portal.Settings - member=SettingChanged - peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal), - - dbus (send, receive) bus=session path=/org/gnome/Mutter/* - interface=org.gnome.Mutter.* - peer=(name=:*, label="{gnome-shell,gsd-xsettings}"), - dbus send bus=session path=/org/gnome/Mutter/* - interface=org.freedesktop.DBus.Properties - peer=(name=:*, label="{gnome-shell,gsd-xsettings}"), + #aa:dbus talk bus=session name=org.freedesktop.impl.portal path=/org/freedesktop/portal/desktop label=xdg-desktop-portal + #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell + #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell @{exec_path} mr, / r, @{bin}/ r, @{bin}/* r, + /opt/*/* r, /usr/share/dconf/profile/gdm r, /usr/share/thumbnailers/{,**} r, diff --git a/apparmor.d/groups/freedesktop/xdg-user-dir b/apparmor.d/groups/freedesktop/xdg-user-dir index 47184420b..7fcf6f3ec 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dir +++ b/apparmor.d/groups/freedesktop/xdg-user-dir @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/xdg-user-dir profile xdg-user-dir @{exec_path} flags=(attach_disconnected) { include + include include @{exec_path} mr, @@ -18,8 +19,6 @@ profile xdg-user-dir @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/user-dirs.dirs r, - /dev/tty rw, - # Silencer deny network inet stream, deny network inet6 stream, diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index 3d240828b..b7e00a45d 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -62,6 +62,7 @@ profile gpg-agent @{exec_path} { #aa:only pacman owner /etc/pacman.d/gnupg/ rw, + owner /etc/pacman.d/gnupg/*.conf r, owner /etc/pacman.d/gnupg/private-keys-v1.d/ rw, owner /etc/pacman.d/gnupg/private-keys-v1.d/@{hex}.key rw, owner /etc/pacman.d/gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, diff --git a/apparmor.d/groups/gpg/scdaemon b/apparmor.d/groups/gpg/scdaemon index 92be0bdcc..2160cbea9 100644 --- a/apparmor.d/groups/gpg/scdaemon +++ b/apparmor.d/groups/gpg/scdaemon @@ -19,12 +19,16 @@ profile scdaemon @{exec_path} { @{exec_path} mr, + #aa:only pacman + owner /etc/pacman.d/gnupg/scdaemon.conf r, + owner /etc/pacman.d/gnupg/S.scdaemon rw, + owner @{HOME}/@{XDG_GPG_DIR}/scdaemon.conf r, owner @{HOME}/@{XDG_GPG_DIR}common.conf r, owner @{HOME}/@{XDG_GPG_DIR}/reader_@{int}.status rw, owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, - owner @{run}/user/@{uid}/gnupg/d.*/S.scdaemon rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw, owner /var/tmp/zypp.*/PublicKey/S.scdaemon w, owner /var/tmp/zypp.*/zypp-general-kr*/S.scdaemon w, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 7f9b5adf6..50614a60a 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -90,9 +90,10 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @{lib}/{,NetworkManager/}nm-openvpn-service rPx, @{lib}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx, + /usr/share/netplan/netplan.script rPx, - /usr/share/netplan/netplan.script rPx, /usr/share/gvfs/remote-volume-monitors/{,*.monitor} r, + /usr/share/iproute2/{,**} r, / r, /etc/ r, diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 5ac446817..4ccb1088d 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -11,7 +11,7 @@ profile makepkg @{exec_path} { include include - signal send set=winch peer=pacman, + signal send set=winch peer=pacman, signal send set=winch peer=pacman//systemctl, network inet stream, @@ -48,7 +48,10 @@ profile makepkg @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + owner @{user_cache_dirs}/makepkg/src/*.asc r, + owner @{tmp}/.git_vtag_tmp@{rand6} rw, + owner @{tmp}/tmp.@{rand10} rw, owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/gnupg/ r, diff --git a/apparmor.d/groups/pacman/yay b/apparmor.d/groups/pacman/yay index 8f2804621..8f3dede75 100644 --- a/apparmor.d/groups/pacman/yay +++ b/apparmor.d/groups/pacman/yay @@ -67,6 +67,8 @@ profile yay @{exec_path} { include include + owner @{HOME}/**/ r, # For pwd + owner @{user_cache_dirs}/yay/*/** rw, include if exists diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 5c1709201..612fda9eb 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -123,8 +123,6 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { # / r, - @{PROC}/sys/kernel/cap_last_cap r, - include if exists } diff --git a/apparmor.d/groups/virt/cni-xtables-nft b/apparmor.d/groups/virt/cni-xtables-nft deleted file mode 100644 index d19f875bf..000000000 --- a/apparmor.d/groups/virt/cni-xtables-nft +++ /dev/null @@ -1,36 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2022 Jeroen Rijken -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/xtables-nft-multi -profile cni-xtables-nft { - include - include - include - - capability net_admin, - capability net_raw, - - network inet dgram, - network inet6 dgram, - network inet raw, - network inet6 raw, - network inet stream, - network inet6 stream, - network netlink raw, - - @{exec_path} mr, - @{bin}/xtables-legacy-multi mr, - - /etc/libnl/classid r, - /etc/iptables/{,**} rw, - /etc/nftables.conf rw, - - @{PROC}/@{pids}/net/ip_tables_names r, -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index a2b773499..1ae8c7109 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -26,11 +26,11 @@ profile cockpit-bridge @{exec_path} { ptrace read, + signal send set=term peer=cockpit-bridge//sudo, signal send set=term peer=cockpit-pcp, signal send set=term peer=dbus-daemon, signal send set=term peer=journalctl, signal send set=term peer=ssh-agent, - signal send set=term peer=sudo, signal send set=term peer=unconfined, @{exec_path} mr, @@ -41,24 +41,30 @@ profile cockpit-bridge @{exec_path} { @{bin}/ip ix, @{bin}/python3.@{int} ix, @{bin}/test ix, + @{bin}/file ix, + @{bin}/chage Px, + @{bin}/dmidecode Px, @{bin}/findmnt Px, @{bin}/journalctl Px, + @{bin}/last Px, @{bin}/lastlog Px, + @{bin}/lscpu Px, @{bin}/passwd Px, @{bin}/ssh-agent Px, - @{bin}/sudo Px, # TODO: rCx -> privilieged ? or rix? + @{bin}/sudo Cx -> sudo, @{bin}/udevadm Cx -> udevadm, + @{bin}/virsh rPUx, @{bin}/virt-install PUx, # TODO: rPx @{lib}/cockpit/cockpit-pcp Px, @{lib}/cockpit/cockpit-ssh Px, - @{bin}/virsh rPUx, # The shell is not confined on purpose. @{bin}/@{shells} Ux, /usr/{,local/}share/ r, /usr/share/cockpit/{,**} r, + /usr/share/file/** r, /usr/share/iproute2/* r, /etc/cockpit/{,**} r, @@ -70,7 +76,8 @@ profile cockpit-bridge @{exec_path} { /etc/shadow r, /etc/shells r, - / r, + / r, + @{HOME}/ r, owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw, owner @{user_share_dirs}/ r, @@ -103,6 +110,18 @@ profile cockpit-bridge @{exec_path} { /dev/ptmx rw, + profile sudo { + include + include + + signal (send receive) set=term peer=cockpit-bridge, + + @{bin}/cockpit-bridge Px, + @{lib}/cockpit/cockpit-askpass Px, + + include if exists + } + profile udevadm { include include diff --git a/apparmor.d/groups/virt/cockpit-update-motd b/apparmor.d/groups/virt/cockpit-update-motd index eaf340c6b..cf4bf5bb7 100644 --- a/apparmor.d/groups/virt/cockpit-update-motd +++ b/apparmor.d/groups/virt/cockpit-update-motd @@ -30,8 +30,6 @@ profile cockpit-update-motd @{exec_path} { capability net_admin, capability sys_ptrace, - @{PROC}/sys/kernel/cap_last_cap r, - include if exists } diff --git a/apparmor.d/groups/virt/xtables b/apparmor.d/groups/virt/xtables new file mode 100644 index 000000000..82eb1a733 --- /dev/null +++ b/apparmor.d/groups/virt/xtables @@ -0,0 +1,43 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Jeroen Rijken +# Copyright (C) 2022-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/xtables-nft-multi @{bin}/xtables-legacy-multi +profile xtables { + include + include + include + + capability net_admin, + capability net_raw, + + network inet dgram, + network inet6 dgram, + network inet raw, + network inet6 raw, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + /usr/share/iproute2/{,**} r, + + /etc/iproute2/{,**} r, + /etc/iptables/{,**} rw, + /etc/libnl/classid r, + /etc/nftables.conf rw, + + @{run}/xtables.lock rwk, + + @{PROC}/@{pids}/net/ip_tables_names r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/aa-log b/apparmor.d/profiles-a-f/aa-log index 74fbebcb1..bfd0b457e 100644 --- a/apparmor.d/profiles-a-f/aa-log +++ b/apparmor.d/profiles-a-f/aa-log @@ -27,8 +27,6 @@ profile aa-log @{exec_path} { /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/{,*} r, - @{PROC}/sys/kernel/cap_last_cap r, - /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/profiles-a-f/convertall b/apparmor.d/profiles-a-f/convertall index 28a393470..f3ce650e6 100644 --- a/apparmor.d/profiles-a-f/convertall +++ b/apparmor.d/profiles-a-f/convertall @@ -10,35 +10,28 @@ include @{exec_path} = @{bin}/convertall /usr/share/convertall/convertall.py profile convertall @{exec_path} { include - include - include - include + include include - include - include - include - include - include - include + include include + include + include @{exec_path} r, @{sh_path} rix, @{bin}/python3.@{int} rix, - owner @{HOME}/.convertall rw, - - deny owner @{PROC}/@{pid}/cmdline r, - /usr/share/convertall/{,**} r, /usr/share/doc/convertall/{,*} r, - /usr/share/hwdata/pnp.ids r, - /var/lib/dbus/machine-id r, /etc/machine-id r, + owner @{HOME}/.convertall rw, + + deny owner @{PROC}/@{pid}/cmdline r, + include if exists } diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 3796dfbc4..b3c963dde 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -15,47 +15,47 @@ profile pass @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/base64 rix, - @{bin}/basename rix, - @{bin}/cat rix, - @{bin}/cp rix, - @{bin}/diff rix, - @{bin}/dirname rix, - @{bin}/env rix, - @{bin}/find rix, - @{bin}/getopt rix, - @{bin}/grep rix, - @{bin}/head rix, - @{bin}/mkdir rix, - @{bin}/mktemp rix, - @{bin}/mv rix, - @{bin}/rm rix, - @{bin}/rmdir rix, - @{bin}/sed rix, - @{bin}/shred rix, - @{bin}/sleep rix, - @{bin}/sort rix, - @{bin}/tail rix, - @{bin}/touch rix, - @{bin}/tr rix, - @{bin}/tree rix, - @{bin}/tty rix, - @{bin}/which rix, + @{bin}/base64 ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/cp ix, + @{bin}/diff ix, + @{bin}/dirname ix, + @{bin}/env r, + @{bin}/find ix, + @{bin}/getopt ix, + @{bin}/grep ix, + @{bin}/head ix, + @{bin}/mkdir ix, + @{bin}/mktemp ix, + @{bin}/mv ix, + @{bin}/rm ix, + @{bin}/rmdir ix, + @{bin}/sed ix, + @{bin}/shred ix, + @{bin}/sleep ix, + @{bin}/sort ix, + @{bin}/tail ix, + @{bin}/touch ix, + @{bin}/tr ix, + @{bin}/tree ix, + @{bin}/tty ix, + @{bin}/which ix, - @{bin}/git rCx -> git, - @{bin}/gpg{2,} rCx -> gpg, - @{bin}/pkill rCx -> pkill, - @{bin}/qdbus rCx -> qdbus, - @{editor_path} rCx -> editor, - @{lib}/git{,-core}/git rCx -> git, - @{bin}/wl-{copy,paste} rPx, - @{bin}/xclip rPx, + @{bin}/git Cx -> git, + @{bin}/gpg{2,} Cx -> gpg, + @{bin}/pkill Cx -> pkill, + @{bin}/qdbus Cx -> qdbus, + @{bin}/wl-{copy,paste} Px, + @{bin}/xclip Px, + @{editor_path} Cx -> editor, + @{lib}/git{,-core}/git Cx -> git, # Pass extensions - @{bin}/oathtool rix, # pass-otp - @{bin}/python3.@{int} rPx -> pass-import, # pass-import, pass-audit - @{bin}/qrencode rPUx, # pass-otp - @{bin}/tomb rPUx, # pass-tomb + @{bin}/oathtool ix, # pass-otp + @{bin}/python3.@{int} Px -> pass-import, # pass-import, pass-audit + @{bin}/qrencode PUx, # pass-otp + @{bin}/tomb PUx, # pass-tomb /usr/share/terminfo/** r, diff --git a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox index a5f4a7ef9..0dc19e1af 100644 --- a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox +++ b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox @@ -7,8 +7,10 @@ abi , include +@{name} = signal-desktop{,-beta} @{lib_dirs} = @{lib}/signal-desktop /opt/Signal{,?Beta} @{config_dirs} = @{user_config_dirs}/Signal{,?Beta} +@{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{lib_dirs}/chrome-sandbox profile signal-desktop-chrome-sandbox @{exec_path} { @@ -19,7 +21,7 @@ profile signal-desktop-chrome-sandbox @{exec_path} { @{exec_path} mr, - @{lib_dirs}/signal-desktop{,-beta} rPx, + @{lib_dirs}/@{name} rPx, @{PROC}/@{pid}/ r, @{PROC}/@{pid}/oom_adj w, diff --git a/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper b/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper index 87afa46eb..aae606395 100644 --- a/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper +++ b/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper @@ -17,7 +17,6 @@ profile spice-client-glib-usb-acl-helper @{exec_path} { @{exec_path} mr, - @{PROC}/sys/kernel/cap_last_cap r, owner @{PROC}/@{pid}/stat r, include if exists diff --git a/apparmor.d/profiles-s-z/switcherooctl b/apparmor.d/profiles-s-z/switcherooctl index 9979c9246..1e9d50989 100644 --- a/apparmor.d/profiles-s-z/switcherooctl +++ b/apparmor.d/profiles-s-z/switcherooctl @@ -12,7 +12,7 @@ profile switcherooctl @{exec_path} { include include - #aa:dbus own bus=system name=net.hadess.SwitcherooControl + #aa:dbus talk bus=system name=net.hadess.SwitcherooControl label=switcheroo-control @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/tomb b/apparmor.d/profiles-s-z/tomb index 44a34595e..cc540ae93 100644 --- a/apparmor.d/profiles-s-z/tomb +++ b/apparmor.d/profiles-s-z/tomb @@ -115,9 +115,10 @@ profile tomb @{exec_path} { include include + capability dac_read_search, capability sys_admin, - umount @{MOUNTS}/{,*/}, + umount @{MOUNTS}/{,**/}, @{bin}/umount mr, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 6f74c826e..b835be9e7 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -11,8 +11,6 @@ include profile udisksd @{exec_path} flags=(attach_disconnected) { include include - include - include include include @@ -60,9 +58,11 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { umount @{run}/udisks2/temp-mount-*/, umount /media/cdrom@{int}/, - signal (receive) set=(int) peer=@{p_systemd}, + signal receive set=int peer=@{p_systemd}, #aa:dbus own bus=system name=org.freedesktop.UDisks2 + #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus @@ -88,6 +88,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{bin}/sgdisk rPx, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-escape rPx, + @{bin}/xfs_db rPUx, /etc/crypttab r, /etc/fstab r, diff --git a/apparmor.d/profiles-s-z/wpa-gui b/apparmor.d/profiles-s-z/wpa-gui index ceefecbf2..3a729a989 100644 --- a/apparmor.d/profiles-s-z/wpa-gui +++ b/apparmor.d/profiles-s-z/wpa-gui @@ -10,20 +10,13 @@ include @{exec_path} = @{bin}/wpa_gui profile wpa-gui @{exec_path} { include - include + include include - include - include - include - include + include include - include - include @{exec_path} mr, - /usr/share/hwdata/pnp.ids r, - owner @{tmp}/wpa_ctrl_@{pid}-[0-9] w, owner /dev/shm/#@{int} rw, From bdac1adf8fd0d4e259319fda3d25bdea4a6f39e8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 18:31:24 +0100 Subject: [PATCH 0188/1455] fix(aa-log): fix cleaning regex. fix #495 --- pkg/logs/logs.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index c1bcf81df..587e0b7b7 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -40,8 +40,8 @@ var ( `\x1d`, " ", // Remove basic rules from abstractions/base - `(?m)^.*/etc/[^/]+so.*$`, ``, - `(?m)^.*/usr/(lib|lib32|lib64|libexec)/[^/]+so.*$`, ``, + `(?m)^.*/etc/[^/]+\.so.*$`, ``, + `(?m)^.*/usr/(lib|lib32|lib64|libexec)/[^/]+\.so.*$`, ``, `(?m)^.*/usr/(lib|lib32|lib64|libexec)/locale/.*$`, ``, `(?m)^.*/usr/share/locale[^/]?/.*$`, ``, `(?m)^.*/usr/share/zoneinfo[^/]?/.*$`, ``, From 305fceb4139159e0beda2af573ce01773ea713a9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 21:10:04 +0100 Subject: [PATCH 0189/1455] feat(profile): add buildx support in dockerd. --- apparmor.d/groups/virt/dockerd | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 64bba083d..9e17f678b 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -32,15 +32,24 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, + mount /tmp/containerd-mount@{int}/, + mount /var/lib/docker/buildkit/**/, mount /var/lib/docker/overlay2/**/, + mount /var/lib/docker/tmp/buildkit-mount@{int}/, mount options=(rw, bind) -> /run/docker/netns/*, mount options=(rw, rbind) -> /var/lib/docker/tmp/docker-builder@{int}/, mount options=(rw, rprivate) -> /.pivot_root@{int}/, mount options=(rw, rslave) -> /, + remount /tmp/containerd-mount@{int10}/, + remount /var/lib/docker/tmp/buildkit-mount@{int10}/, + umount /.pivot_root@{int}/, umount /run/docker/netns/*, + umount /tmp/containerd-mount@{int}/, + umount /var/lib/docker/buildkit/**/, umount /var/lib/docker/overlay*/**/, + umount /var/lib/docker/tmp/buildkit-mount@{int}/, pivot_root oldroot=/var/lib/docker/overlay*/**/.pivot_root@{int}/ /var/lib/docker/overlay2/**/, pivot_root oldroot=/var/lib/docker/tmp/**/.pivot_root@{int}/ /var/lib/docker/tmp/**/, From ddd0388d7d5228b0d36fb05a808a8bc9699db63a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 23:18:31 +0100 Subject: [PATCH 0190/1455] feat(profile): add mkcert. --- apparmor.d/profiles-m-r/mkcert | 43 ++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 apparmor.d/profiles-m-r/mkcert diff --git a/apparmor.d/profiles-m-r/mkcert b/apparmor.d/profiles-m-r/mkcert new file mode 100644 index 000000000..0941ad343 --- /dev/null +++ b/apparmor.d/profiles-m-r/mkcert @@ -0,0 +1,43 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/mkcert +profile mkcert @{exec_path} { + include + include + include + include + include + + network netlink raw, + + @{exec_path} mr, + + @{bin}/certutil rix, + @{bin}/rm rix, + @{bin}/sudo rix, + @{bin}/tee rix, + @{bin}/trust rix, + @{bin}/update-ca-trust rPx, + + owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db{,-journal} rwk, + + owner @{HOME}/.pki/ rw, + owner @{HOME}/.pki/nssdb/ rw, + owner @{HOME}/.pki/nssdb/pkcs11.txt rw, + owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, + owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, + + owner @{user_share_dirs}/mkcert/{,**} rw, + + owner @{PROC}/@{pids}//cgroup r, + + include if exists +} + +# vim:syntax=apparmor From 0f4c37c39afefd9f395e12c75985fc31f63646c8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 23:31:48 +0100 Subject: [PATCH 0191/1455] feat(profile): add gimp. --- apparmor.d/profiles-g-l/gimp | 54 ++++++++++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 55 insertions(+) create mode 100644 apparmor.d/profiles-g-l/gimp diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp new file mode 100644 index 000000000..bfdc6d640 --- /dev/null +++ b/apparmor.d/profiles-g-l/gimp @@ -0,0 +1,54 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/gimp{,-*} +profile gimp @{exec_path} { + include + include + include + include + include + include + + #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + + @{exec_path} mr, + + @{lib}/gimp/*/plug-ins/** rix, + + @{open_path} rPx -> child-open-help, + + /usr/share/gimp/{,**} r, + /usr/share/mypaint-data/{,**} r, + /usr/share/xml/iso-codes/{,**} r, + + /etc/gimp/{,**} r, + + owner @{user_documents_dirs}/{,**} rw, + owner @{user_pictures_dirs}/{,**} rw, + owner @{user_work_dirs}/{,**} rw, + + owner @{user_cache_dirs}/babl/{,**} rw, + owner @{user_cache_dirs}/gegl-*/{,**} r, + owner @{user_cache_dirs}/gegl-*/{,**} r, + owner @{user_cache_dirs}/gimp/{,**} rw, + owner @{user_cache_dirs}/GIMP/{,**} rw, + + owner @{user_config_dirs}/gimp/{,**} rw, + owner @{user_config_dirs}/GIMP/{,**} rw, + + owner @{user_share_dirs}/gegl-*/{,**} r, + owner @{user_share_dirs}/GIMP/{,**} rw, + + owner @{tmp}/gimp/{,**} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index f2091d4f5..158f10791 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -134,6 +134,7 @@ gdm-generate-config complain gdm-runtime-config complain gdm-session attach_disconnected,complain gdm-xsession complain +gimp complain gmenudbusmenuproxy complain gnome-boxes complain gnome-browser-connector-host complain From 9be25c8498b62ac6432dca1736f6e9fbd3717fd5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 23:32:39 +0100 Subject: [PATCH 0192/1455] feat(profile): add baobab. --- apparmor.d/profiles-a-f/baobab | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 apparmor.d/profiles-a-f/baobab diff --git a/apparmor.d/profiles-a-f/baobab b/apparmor.d/profiles-a-f/baobab new file mode 100644 index 000000000..63a6ebd22 --- /dev/null +++ b/apparmor.d/profiles-a-f/baobab @@ -0,0 +1,27 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/baobab +profile baobab @{exec_path} { + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + + @{exec_path} mr, + + # As a directory tree analyzer it needs full access to the filesystem + / r, + /** r, + + deny /boot/{,**} r, + + include if exists +} \ No newline at end of file From e9a5edb33235837479c01b3fb949a6de5574bfb7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 18 Sep 2024 23:36:00 +0100 Subject: [PATCH 0193/1455] feat(profile): add firewall-applet. --- apparmor.d/profiles-a-f/firewall-applet | 28 ++++++++++++++++++++++++ apparmor.d/profiles-a-f/firewall-config | 29 +++++++++++++++++++++++++ 2 files changed, 57 insertions(+) create mode 100644 apparmor.d/profiles-a-f/firewall-applet create mode 100644 apparmor.d/profiles-a-f/firewall-config diff --git a/apparmor.d/profiles-a-f/firewall-applet b/apparmor.d/profiles-a-f/firewall-applet new file mode 100644 index 000000000..b3571e628 --- /dev/null +++ b/apparmor.d/profiles-a-f/firewall-applet @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/firewall-applet +profile firewall-applet @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + + @{exec_path} mr, + + @{bin}/ r, + @{bin}/python3.@{int} r, + + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mounts r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/firewall-config b/apparmor.d/profiles-a-f/firewall-config new file mode 100644 index 000000000..a752954e6 --- /dev/null +++ b/apparmor.d/profiles-a-f/firewall-config @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/firewall-config +profile firewall-config @{exec_path} { + include + include + include + include + + @{exec_path} mr, + + @{open_path} rPx -> child-open-help, + + /usr/share/firewalld/__pycache__/ rw, + + /usr/share/firewalld/{,**} r, + + owner @{PROC}/@{pid}/mounts r, + + include if exists +} + +# vim:syntax=apparmor From fa668af54a590e02a15df463d20d3cd90c1dac70 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Sep 2024 00:00:54 +0100 Subject: [PATCH 0194/1455] feat(profile): add some gnome profiles. --- apparmor.d/groups/gnome/gnome-font-viewer | 19 ++++++++++++++++ .../groups/gnome/gnome-user-share-webdav | 21 ++++++++++++++++++ apparmor.d/groups/gnome/tracker-xdg-portal | 22 +++++++++++++++++++ 3 files changed, 62 insertions(+) create mode 100644 apparmor.d/groups/gnome/gnome-font-viewer create mode 100644 apparmor.d/groups/gnome/gnome-user-share-webdav create mode 100644 apparmor.d/groups/gnome/tracker-xdg-portal diff --git a/apparmor.d/groups/gnome/gnome-font-viewer b/apparmor.d/groups/gnome/gnome-font-viewer new file mode 100644 index 000000000..2844be9b7 --- /dev/null +++ b/apparmor.d/groups/gnome/gnome-font-viewer @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/gnome-font-viewer +profile gnome-font-viewer @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-user-share-webdav b/apparmor.d/groups/gnome/gnome-user-share-webdav new file mode 100644 index 000000000..37e1ea496 --- /dev/null +++ b/apparmor.d/groups/gnome/gnome-user-share-webdav @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/gnome-user-share-webdav +profile gnome-user-share-webdav @{exec_path} { + include + include + + #aa:dbus own bus=session name=org.gnome.user-share.webdav + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/tracker-xdg-portal b/apparmor.d/groups/gnome/tracker-xdg-portal new file mode 100644 index 000000000..bf612104f --- /dev/null +++ b/apparmor.d/groups/gnome/tracker-xdg-portal @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/tracker-xdg-portal-3 +profile tracker-xdg-portal @{exec_path} flags=(complain) { + include + include + include + + #aa:dbus own bus=session name=org.freedesktop.portal.Tracker + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From 92b45f895cc71b013f5be8030bd5fac593d8d8c7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Sep 2024 00:16:07 +0100 Subject: [PATCH 0195/1455] feat(profile): add child-open-any. --- apparmor.d/groups/children/child-open-any | 42 +++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 apparmor.d/groups/children/child-open-any diff --git a/apparmor.d/groups/children/child-open-any b/apparmor.d/groups/children/child-open-any new file mode 100644 index 000000000..3fcfe4abe --- /dev/null +++ b/apparmor.d/groups/children/child-open-any @@ -0,0 +1,42 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# This profile is designed to be used in a child profile to limit what +# confined application can invoke via open helper. + +# This version of child-open allows to open any programs. + +abi , + +include + +profile child-open-any flags=(attach_disconnected) { + include + include + + @{open_path} mr, + + @{sh_path} r, + + @{bin}/** PUx, + @{lib}/** PUx, + @{user_bin_dirs}/** PUx, + /opt/*/** PUx, + /usr/local/bin/** PUx, + /usr/share/** PUx, + + @{bin}/ r, + @{user_bin_dirs}/ r, + / r, + /usr/ r, + /usr/local/bin/ r, + + /dev/tty rw, + + include if exists + include if exists +} + +# vim:syntax=apparmor + From 5def115a0eeaa1dbf65deecbdbfd35ae241b7542 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Sep 2024 00:20:13 +0100 Subject: [PATCH 0196/1455] build: enforce a few profiles. --- dists/flags/arch.flags | 13 ------------- dists/flags/main.flags | 9 --------- 2 files changed, 22 deletions(-) diff --git a/dists/flags/arch.flags b/dists/flags/arch.flags index e65ae5520..ba883e3c2 100644 --- a/dists/flags/arch.flags +++ b/dists/flags/arch.flags @@ -1,16 +1,3 @@ -archlinux-keyring-wkd-sync complain makepkg complain mkinitcpio attach_disconnected,complain pacman attach_disconnected,complain -pacman-conf attach_disconnected,complain -pacman-hook-dconf complain -pacman-hook-depmod complain -pacman-hook-dkms attach_disconnected,complain -pacman-hook-fontconfig complain -pacman-hook-gio complain -pacman-hook-gtk complain -pacman-hook-mkinitcpio attach_disconnected,complain -pacman-hook-perl complain -pacman-hook-systemd attach_disconnected,complain -pacman-key complain -yay complain diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 158f10791..8c28c7252 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -28,7 +28,6 @@ akonadi_newmailnotifier_agent complain akonadi_notes_agent complain akonadi_sendlater_agent complain akonadi_unifiedmailbox_agent complain -alacarte complain anacron complain appimagelauncherd complain apport attach_disconnected,complain @@ -123,11 +122,7 @@ flatpak-system-helper complain flatpak-validate-icon complain foliate attach_disconnected,complain fractal attach_disconnected,complain -freetube complain -freetube-chrome-sandbox complain fstrim complain -freetube complain -freetube-chrome-sandbox complain fuse-overlayfs complain fusermount complain gdm-generate-config complain @@ -264,7 +259,6 @@ networkd-dispatcher complain nm-online complain nm-openvpn-service-openvpn-helper complain nm-priv-helper complain -nmap complain nmcli complain nvidia-detector complain nvidia-persistenced complain @@ -273,8 +267,6 @@ okular complain ollama attach_disconnected,complain os-prober attach_disconnected,complain package-data-downloader complain -packagekitd attach_disconnected,complain -pacman-hook-dkms complain pam_kwallet_init complain pam-tmpdir-helper complain passim complain @@ -291,7 +283,6 @@ plymouth-set-default-theme attach_disconnected,complain plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted qdbus complain -qemu-bridge-helper complain realmd complain remmina complain run-parts complain From 7a3a1f7725d07cbd7d969bba2649f31d330d1e40 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Sep 2024 12:29:13 +0100 Subject: [PATCH 0197/1455] fix(profile): thunderbird: allow saving of draft. --- apparmor.d/profiles-s-z/thunderbird | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index dbf045333..208c581d8 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -52,6 +52,7 @@ profile thunderbird @{exec_path} { owner @{tmp}/MozillaMailnews/ rw, owner @{tmp}/MozillaMailnews/*.msf rw, + owner @{tmp}/nsemail.eml rw, owner @{tmp}/nsma rw, # Silencer From 96defe021c5bb238ef8f274db2fba7e3eefcbe56 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 20 Sep 2024 23:24:15 +0100 Subject: [PATCH 0198/1455] feat(abs): add the pkexec app abs. --- apparmor.d/abstractions/app/pkexec | 39 +++++++++++++++++++ apparmor.d/groups/apt/synaptic | 9 ++++- apparmor.d/groups/gnome/gnome-system-monitor | 3 +- apparmor.d/groups/ubuntu/apport-gtk | 9 ++++- apparmor.d/groups/ubuntu/update-notifier | 11 +++++- .../profiles-a-f/flatpak-session-helper | 9 ++++- apparmor.d/profiles-g-l/gsmartcontrol-root | 9 ++++- apparmor.d/profiles-m-r/pkexec | 32 ++------------- 8 files changed, 85 insertions(+), 36 deletions(-) create mode 100644 apparmor.d/abstractions/app/pkexec diff --git a/apparmor.d/abstractions/app/pkexec b/apparmor.d/abstractions/app/pkexec new file mode 100644 index 000000000..2c3669bcc --- /dev/null +++ b/apparmor.d/abstractions/app/pkexec @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Minimal set of rules for pkexec. + + include + include + include + include + include + + capability audit_write, + capability dac_override, + capability dac_read_search, + capability net_admin, + capability setgid, + capability setuid, + capability sys_resource, + + network netlink raw, # PAM + + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1.Authority label=polkitd + + @{bin}/pkexec mr, + + @{etc_ro}/environment r, + @{etc_ro}/security/limits.d/{,*} r, + /etc/shells r, + + owner @{PROC}/@{pid}/loginuid r, + + owner /dev/tty@{int} rw, + + deny @{user_share_dirs}/gvfs-metadata/* r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/synaptic b/apparmor.d/groups/apt/synaptic index 2b8679c2a..6edd79767 100644 --- a/apparmor.d/groups/apt/synaptic +++ b/apparmor.d/groups/apt/synaptic @@ -48,7 +48,7 @@ profile synaptic @{exec_path} { @{bin}/dpkg-preconfigure rPx, @{bin}/localepurge rPx, @{bin}/lsb_release rPx -> lsb_release, - @{bin}/pkexec rPx, + @{bin}/pkexec rCx -> pkexec, @{bin}/ps rPx, @{bin}/software-properties-gtk rPx, @{bin}/tasksel rPx, @@ -110,6 +110,13 @@ profile synaptic @{exec_path} { deny @{bin}/gdbus x, deny @{user_share_dirs}/gvfs-metadata/{*,} r, + profile pkexec { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 8e79bd015..4d0a5dd5d 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -82,8 +82,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { profile pkexec { include - - @{bin}/pkexec mr, + include include if exists } diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 0fd5fb7d9..dddb1f890 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -48,7 +48,7 @@ profile apport-gtk @{exec_path} { @{bin}/ldd rix, @{bin}/lsb_release rPx -> lsb_release, @{bin}/md5sum rix, - @{bin}/pkexec rPx, # TODO: rCx or something + @{bin}/pkexec rCx -> pkexec, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/uname rix, @@ -124,6 +124,13 @@ profile apport-gtk @{exec_path} { include if exists } + profile pkexec { + include + include + + include if exists + } + profile systemctl { include include diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 999502dbc..0487399fa 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -53,7 +53,7 @@ profile update-notifier @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/lsb_release rPx -> lsb_release, - @{bin}/pkexec rPx, # TODO: rCx or rix to run /usr/lib/update-notifier/package-system-locked + @{bin}/pkexec rCx -> pkexec, @{bin}/snap rPUx, @{bin}/software-properties-gtk rPx, @{bin}/systemctl rCx -> systemctl, @@ -85,6 +85,15 @@ profile update-notifier @{exec_path} { @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pid}/fd/ r, + profile pkexec { + include + include + + @{lib}/update-notifier/package-system-locked Px, + + include if exists + } + profile systemctl { include include diff --git a/apparmor.d/profiles-a-f/flatpak-session-helper b/apparmor.d/profiles-a-f/flatpak-session-helper index 54b95b8e3..5f02a2fac 100644 --- a/apparmor.d/profiles-a-f/flatpak-session-helper +++ b/apparmor.d/profiles-a-f/flatpak-session-helper @@ -29,7 +29,7 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { @{bin}/flatpak rPx, @{bin}/getent rix, @{bin}/p11-kit rix, - @{bin}/pkexec rPx, # TODO: too wide, rCx. + @{bin}/pkexec rCx -> pkexec, @{bin}/printenv rix, @{bin}/ps rPx, @{bin}/test rix, @@ -46,6 +46,13 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { /dev/ptmx rw, + profile pkexec { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-g-l/gsmartcontrol-root b/apparmor.d/profiles-g-l/gsmartcontrol-root index 01b7d22e1..565634e10 100644 --- a/apparmor.d/profiles-g-l/gsmartcontrol-root +++ b/apparmor.d/profiles-g-l/gsmartcontrol-root @@ -17,7 +17,14 @@ profile gsmartcontrol-root @{exec_path} { @{bin}/which{,.debianutils} rix, - @{bin}/pkexec rPx, + @{bin}/pkexec rCx -> pkexec, + + profile pkexec { + include + include + + include if exists + } include if exists } diff --git a/apparmor.d/profiles-m-r/pkexec b/apparmor.d/profiles-m-r/pkexec index 49c762df9..d3e47a350 100644 --- a/apparmor.d/profiles-m-r/pkexec +++ b/apparmor.d/profiles-m-r/pkexec @@ -8,31 +8,16 @@ abi , include @{exec_path} = @{bin}/pkexec -profile pkexec @{exec_path} { +profile pkexec @{exec_path} flags=(complain) { include - include - include - include - include - include + include - capability audit_write, - capability dac_read_search, - capability net_admin, - capability setgid, # gdbus - capability setuid, # gmain - capability sys_ptrace, - capability sys_resource, - audit deny capability sys_nice, - - network netlink raw, + audit capability sys_nice, signal (send) set=(term, kill) peer=polkit-agent-helper, ptrace (read), - #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1.Authority label=polkitd - @{exec_path} mr, @{bin}/* PUx, @@ -40,22 +25,11 @@ profile pkexec @{exec_path} { /opt/*/** PUx, /usr/share/** PUx, - @{etc_ro}/environment r, - @{etc_ro}/security/limits.d/{,*} r, /etc/default/locale r, - /etc/shells r, @{PROC}/@{pid}/fdinfo/@{int} r, @{PROC}/@{pids}/stat r, owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/loginuid r, - - # file_inherit - owner /dev/tty@{int} rw, - owner @{HOME}/.xsession-errors w, - - # Silencer - deny @{user_share_dirs}/gvfs-metadata/* r, include if exists } From 8979d84633cd189cbfee2ecf2ea4c0102b49b521 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 20 Sep 2024 23:30:09 +0100 Subject: [PATCH 0199/1455] feat(profile): remove rules already included in the base abs. --- apparmor.d/groups/apt/apt-overlay | 1 - apparmor.d/groups/cron/cron-apt | 3 --- apparmor.d/groups/freedesktop/colord | 1 - apparmor.d/groups/freedesktop/geoclue | 2 -- apparmor.d/groups/gnome/evolution-alarm-notify | 1 - apparmor.d/groups/gnome/gnome-control-center | 1 - apparmor.d/groups/gnome/gnome-shell | 1 - apparmor.d/groups/gnome/gnome-shell-calendar-server | 1 - apparmor.d/groups/grub/grub-multi-install | 1 - apparmor.d/groups/kde/konsole | 1 - apparmor.d/groups/kde/startplasma | 3 +-- apparmor.d/groups/network/openvpn | 2 +- apparmor.d/groups/pacman/aurpublish | 2 -- apparmor.d/groups/systemd/systemd-logind | 1 - apparmor.d/groups/systemd/systemd-oomd | 7 +++---- apparmor.d/groups/systemd/systemd-resolved | 7 +++---- apparmor.d/groups/systemd/systemd-sleep-grub2 | 2 -- apparmor.d/groups/systemd/systemd-timesyncd | 1 - apparmor.d/groups/virt/k3s | 1 - apparmor.d/profiles-a-f/auditd | 1 - apparmor.d/profiles-a-f/boltd | 1 - apparmor.d/profiles-a-f/cups-browsed | 1 - apparmor.d/profiles-s-z/spice-vdagentd | 1 - 23 files changed, 8 insertions(+), 35 deletions(-) diff --git a/apparmor.d/groups/apt/apt-overlay b/apparmor.d/groups/apt/apt-overlay index fb567a5ef..158e7c57b 100644 --- a/apparmor.d/groups/apt/apt-overlay +++ b/apparmor.d/groups/apt/apt-overlay @@ -22,7 +22,6 @@ profile apt-overlay @{exec_path} { owner @{bin}/env r, @{lib}/ruby/{,**} r, - @{lib}/locale/locale-archive r, @{lib}/ruby/gems/3.0.0/specifications/default/*.gemspec rwk, /usr/share/rubygems-integration/{,**} r, diff --git a/apparmor.d/groups/cron/cron-apt b/apparmor.d/groups/cron/cron-apt index 51057f47f..41c27ecc7 100644 --- a/apparmor.d/groups/cron/cron-apt +++ b/apparmor.d/groups/cron/cron-apt @@ -70,9 +70,6 @@ profile cron-apt @{exec_path} { /var/log/cron-apt/mail rw, /var/log/cron-apt/lastfullmessage rw, - # For the "ls" command - @{lib}/locale/locale-archive r, - # TMP /tmp/ r, owner @{tmp}/cron-apt.*/ rw, diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index 418864a6f..8ed35020a 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -52,7 +52,6 @@ profile colord @{exec_path} flags=(attach_disconnected) { @{desktop_share_dirs}/icc/edid-*.icc r, @{user_share_dirs}/icc/edid-*.icc r, - @{run}/systemd/journal/socket rw, @{run}/systemd/sessions/* r, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index e5d86092a..7e2a282ac 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -41,8 +41,6 @@ profile geoclue @{exec_path} flags=(attach_disconnected) { /var/lib/nscd/services r, /var/lib/dbus/machine-id r, - @{run}/systemd/journal/socket rw, - @{PROC}/@{pids}/cgroup r, @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, diff --git a/apparmor.d/groups/gnome/evolution-alarm-notify b/apparmor.d/groups/gnome/evolution-alarm-notify index a4c2c4a92..abae74d45 100644 --- a/apparmor.d/groups/gnome/evolution-alarm-notify +++ b/apparmor.d/groups/gnome/evolution-alarm-notify @@ -34,7 +34,6 @@ profile evolution-alarm-notify @{exec_path} { @{exec_path} mr, /usr/share/evolution-data-server/{,**} r, - /usr/share/{,zoneinfo-}icu/{,**} r, /etc/timezone r, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 535454199..aea86106a 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -165,7 +165,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/loginuid r, - owner @{PROC}/@{pid}/maps r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/statm r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 87cc77d0e..3ee2665e5 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -194,7 +194,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /opt/**/share/icons/{,**} r, /snap/*/@{uid}/**.png r, - /usr/share/{,zoneinfo-}icu/{,**} r, /usr/share/**.{png,jpg,svg} r, /usr/share/**/icons/{,**} r, /usr/share/backgrounds/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-shell-calendar-server b/apparmor.d/groups/gnome/gnome-shell-calendar-server index cc56eff59..371ed3e01 100644 --- a/apparmor.d/groups/gnome/gnome-shell-calendar-server +++ b/apparmor.d/groups/gnome/gnome-shell-calendar-server @@ -36,7 +36,6 @@ profile gnome-shell-calendar-server @{exec_path} { @{exec_path} mr, /usr/share/glib-2.0/schemas/gschemas.compiled r, - /usr/share/{,zoneinfo-}icu/{,**} r, /etc/sysconfig/clock r, /etc/timezone r, diff --git a/apparmor.d/groups/grub/grub-multi-install b/apparmor.d/groups/grub/grub-multi-install index 9cc94f9c1..9360173af 100644 --- a/apparmor.d/groups/grub/grub-multi-install +++ b/apparmor.d/groups/grub/grub-multi-install @@ -31,7 +31,6 @@ profile grub-multi-install @{exec_path} { /boot/grub/grub.cfg rw, - owner @{PROC}/@{pid}/maps r, owner @{PROC}/@{pid}/mounts r, /dev/disk/by-id/ r, diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 94bad21ba..164510ae7 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -35,7 +35,6 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/htop rPx, @{bin}/micro rPUx, @{bin}/nvtop rPx, - @{bin}/nvtop rPx, @{bin}/vim rUx, /usr/share/color-schemes/{,**} r, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index e57639b6e..c0cd5690c 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -73,8 +73,7 @@ profile startplasma @{exec_path} { owner @{run}/user/@{uid}/ r, - @{PROC}/sys/kernel/random/boot_id r, - owner @{PROC}/@{pid}/maps r, + @{PROC}/sys/kernel/random/boot_id r, /dev/tty r, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index 6bf8c168b..e94315846 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -59,7 +59,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { @{run}/NetworkManager/nm-openvpn-@{uuid} rw, @{run}/openvpn/*.{pid,status} rw, - @{run}/systemd/journal/dev-log rw, + @{run}/systemd/journal/dev-log r, @{bin}/ip rix, @{bin}/systemd-ask-password rPx, diff --git a/apparmor.d/groups/pacman/aurpublish b/apparmor.d/groups/pacman/aurpublish index 3f46e2fa6..cae1d7dca 100644 --- a/apparmor.d/groups/pacman/aurpublish +++ b/apparmor.d/groups/pacman/aurpublish @@ -57,8 +57,6 @@ profile aurpublish @{exec_path} { owner @{tmp}/tmp.@{rand10} rw, - owner @{PROC}/@{pid}/maps r, - /dev/tty rw, profile gpg { diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 8db1923e5..d1fa06e7c 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -97,7 +97,6 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{run}/systemd/inhibit/ rw, @{run}/systemd/inhibit/.#* rw, @{run}/systemd/inhibit/@{int}{,.ref} rw, - @{run}/systemd/journal/socket rw, @{run}/systemd/notify rw, @{run}/systemd/seats/ rw, @{run}/systemd/seats/.#seat* rw, diff --git a/apparmor.d/groups/systemd/systemd-oomd b/apparmor.d/groups/systemd/systemd-oomd index 9ebe87c49..21ef79495 100644 --- a/apparmor.d/groups/systemd/systemd-oomd +++ b/apparmor.d/groups/systemd/systemd-oomd @@ -24,10 +24,9 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) { /etc/systemd/oomd.conf r, /etc/systemd/oomd.conf.d/{,**} r, - @{run}/systemd/io.system.ManagedOOM rw, - @{run}/systemd/io.systemd.ManagedOOM rw, - @{run}/systemd/notify rw, - owner @{run}/systemd/journal/socket w, + @{run}/systemd/io.system.ManagedOOM rw, + @{run}/systemd/io.systemd.ManagedOOM rw, + @{run}/systemd/notify rw, @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/memory.* r, diff --git a/apparmor.d/groups/systemd/systemd-resolved b/apparmor.d/groups/systemd/systemd-resolved index 7b2e7ffa9..34597caa1 100644 --- a/apparmor.d/groups/systemd/systemd-resolved +++ b/apparmor.d/groups/systemd/systemd-resolved @@ -41,10 +41,9 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) { /etc/systemd/resolved.conf r, /etc/systemd/resolved.conf.d/{,*} r, - @{run}/systemd/netif/links/* r, - @{run}/systemd/notify rw, - @{run}/systemd/resolve/{,**} rw, - owner @{run}/systemd/journal/socket w, + @{run}/systemd/netif/links/* r, + @{run}/systemd/notify rw, + @{run}/systemd/resolve/{,**} rw, @{PROC}/@{pid}/cgroup r, @{PROC}/pressure/* r, diff --git a/apparmor.d/groups/systemd/systemd-sleep-grub2 b/apparmor.d/groups/systemd/systemd-sleep-grub2 index e7ae09355..9c718f7b0 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-grub2 +++ b/apparmor.d/groups/systemd/systemd-sleep-grub2 @@ -19,8 +19,6 @@ profile systemd-sleep-grub @{exec_path} { /etc/sysconfig/bootloader r, - @{PROC}/@{pid}/maps r, - /dev/tty rw, include if exists diff --git a/apparmor.d/groups/systemd/systemd-timesyncd b/apparmor.d/groups/systemd/systemd-timesyncd index 51fd6358e..4f0903d1f 100644 --- a/apparmor.d/groups/systemd/systemd-timesyncd +++ b/apparmor.d/groups/systemd/systemd-timesyncd @@ -38,7 +38,6 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) { @{run}/systemd/netif/state r, @{run}/systemd/notify rw, @{run}/systemd/timesyncd.conf.d/{,**} r, - owner @{run}/systemd/journal/socket w, owner @{run}/systemd/timesync/synchronized rw, @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/virt/k3s b/apparmor.d/groups/virt/k3s index e1cded61d..c2183c33b 100644 --- a/apparmor.d/groups/virt/k3s +++ b/apparmor.d/groups/virt/k3s @@ -130,7 +130,6 @@ profile k3s @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/net/ipv{4,6}/conf/default/* rw, @{PROC}/sys/net/bridge/bridge-nf-call-iptables r, @{PROC}/sys/net/netfilter/* rw, - @{PROC}/sys/vm/overcommit_memory rw, @{PROC}/sys/vm/panic_on_oom r, @{sys}/class/net/ r, diff --git a/apparmor.d/profiles-a-f/auditd b/apparmor.d/profiles-a-f/auditd index 935a84c69..8c1878604 100644 --- a/apparmor.d/profiles-a-f/auditd +++ b/apparmor.d/profiles-a-f/auditd @@ -27,7 +27,6 @@ profile auditd @{exec_path} flags=(attach_disconnected) { /var/log/audit/{,**} rw, - @{run}/systemd/journal/dev-log w, owner @{run}/auditd.pid rwl, owner @{run}/auditd.state rw, diff --git a/apparmor.d/profiles-a-f/boltd b/apparmor.d/profiles-a-f/boltd index 47c16d1cd..e5464290a 100644 --- a/apparmor.d/profiles-a-f/boltd +++ b/apparmor.d/profiles-a-f/boltd @@ -26,7 +26,6 @@ profile boltd @{exec_path} flags=(attach_disconnected) { owner @{run}/boltd/{,**} rw, @{run}/systemd/notify rw, - @{run}/systemd/journal/socket w, @{run}/udev/data/+thunderbolt:* r, @{sys}/bus/ r, diff --git a/apparmor.d/profiles-a-f/cups-browsed b/apparmor.d/profiles-a-f/cups-browsed index 2abffbe16..6b01087b9 100644 --- a/apparmor.d/profiles-a-f/cups-browsed +++ b/apparmor.d/profiles-a-f/cups-browsed @@ -39,7 +39,6 @@ profile cups-browsed @{exec_path} { @{exec_path} mr, /usr/share/cups/locale/{,**} r, - /usr/share/locale/{,**} r, /etc/cups/{,**} r, diff --git a/apparmor.d/profiles-s-z/spice-vdagentd b/apparmor.d/profiles-s-z/spice-vdagentd index e9a8b6330..70eca91fe 100644 --- a/apparmor.d/profiles-s-z/spice-vdagentd +++ b/apparmor.d/profiles-s-z/spice-vdagentd @@ -16,7 +16,6 @@ profile spice-vdagentd @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{run}/systemd/journal/dev-log w, @{run}/systemd/seats/seat@{int} r, @{run}/systemd/sessions/* r, @{run}/systemd/users/@{uid} r, From e15bdcc9ad71f88d935e77efe611ca57bbab75a8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 20 Sep 2024 23:34:03 +0100 Subject: [PATCH 0200/1455] feat(profile): firefox: handle nnp with keepassxc-proxy. --- apparmor.d/abstractions/app/firefox | 2 -- apparmor.d/groups/browsers/firefox | 7 ++++--- apparmor.d/profiles-g-l/keepassxc-proxy | 6 +++--- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 55ff461aa..66a517721 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -105,8 +105,6 @@ owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, - owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer w, - @{run}/mount/utab r, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index ef8bf5842..f35949078 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -19,7 +19,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) { include include - signal (send) set=(term, kill) peer=keepassxc-proxy, + signal send set=(term, kill) peer=firefox//&keepassxc-proxy, #aa:dbus own bus=session name=org.mozilla.firefox #aa:dbus own bus=session name=org.mpris.MediaPlayer2.firefox path=/org/mpris/MediaPlayer2 @@ -46,8 +46,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) { # Common extensions /opt/net.downloadhelper.coapp/bin/net.downloadhelper.coapp* rPx, @{bin}/browserpass rPx, - # As a temporary solution - see issue #128 - @{bin}/keepassxc-proxy rix, + @{bin}/keepassxc-proxy rPx -> firefox//&keepassxc-proxy, owner @{user_config_dirs}/gtk-{3,4}.0/assets/*.svg r, owner @{user_config_dirs}/ibus/bus/ r, @@ -72,6 +71,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) { owner @{tmp}/MozillaBackgroundTask-{@{hex15},@{hex16}}-removeDirectory/{**,} rw, owner @{tmp}/Mozillato-be-removed-cachePurge-{@{hex15},@{hex16}} rwk, + owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowsrServer w, + # Silencer deny @{lib_dirs}/** w, diff --git a/apparmor.d/profiles-g-l/keepassxc-proxy b/apparmor.d/profiles-g-l/keepassxc-proxy index 5e9736108..a193df0ee 100644 --- a/apparmor.d/profiles-g-l/keepassxc-proxy +++ b/apparmor.d/profiles-g-l/keepassxc-proxy @@ -12,14 +12,14 @@ profile keepassxc-proxy @{exec_path} { include include - signal (receive) set=(term, kill), - network inet dgram, network inet6 dgram, network inet stream, network inet6 stream, network netlink raw, + signal receive set=(term, kill) peer=firefox, + @{exec_path} mr, /usr/share/icons/*/index.theme r, @@ -32,7 +32,7 @@ profile keepassxc-proxy @{exec_path} { # file_inherit deny owner @{run}/user/@{uid}/.[a-zA-Z]*/{,s} rw, deny owner @{run}/user/@{uid}/kpxc_server rw, - deny /dev/shm/org.chromium.* rw, + deny /dev/shm/org.chromium.@{rand6} rw, deny owner /dev/shm/org.mozilla.ipc.@{int}.@{int} rw, deny owner @{HOME}/.mozilla/** rw, deny owner @{user_cache_dirs}/mozilla/** rw, From 8572a3ec074f87237653afafca0bc3a0327664de Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 13:16:46 +0100 Subject: [PATCH 0201/1455] doc: improve the directives page. --- docs/development/directives.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/development/directives.md b/docs/development/directives.md index 291b0b74e..7263b4910 100644 --- a/docs/development/directives.md +++ b/docs/development/directives.md @@ -63,7 +63,7 @@ The `only` and `exclude` directives can be used to filter individual rule or rul ## Exec -The `exec` directive is useful to allow executing transitions to a profile without having to manage the possible long list of profile attachments (it varies depending on the distribution). The directives parse and resolve the attachment variable (`@{exec_path}`) of the target profile and includes it in the current profile. +The `exec` directive is useful to allow executing transitions to a profile without having to manage the possible long list of profile attachments (it varies depending on the distribution). The directive parses and resolves the attachment variable (`@{exec_path}`) of the target profile and includes it in the current profile. **Format** @@ -103,7 +103,7 @@ The `exec` directive is useful to allow executing transitions to a profile witho ## Stack -[Stacked](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking) profiles can be hard to maintain. The *parent* profile needs to manage its own rules as well as always include the stacked profile rules. This directive automatically include the stacked profile rules into the parent profile. +[Stacked](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking) profiles can be hard to maintain. The *parent* profile needs to manage its own rules as well as always including access from the *child* profile. In most profile using stacking, the *child* profile is often naturally included in the *parent*. However, sometime the child profile is fully different. This directive automatically include the stacked profile rules into the parent profile. **Format** @@ -147,7 +147,6 @@ The `exec` directive is useful to allow executing transitions to a profile witho @{run}/systemd/io.system.ManagedOOM rw, @{run}/systemd/io.systemd.ManagedOOM rw, @{run}/systemd/notify rw, - owner @{run}/systemd/journal/socket w, @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/memory.pressure r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/memory.* r, From 064e9edec2f2baa442ec37f36712ffd5cf9bef72 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 13:18:03 +0100 Subject: [PATCH 0202/1455] fix(profile): ensure torbrowser-update can start torbrowser. --- apparmor.d/groups/browsers/torbrowser-updater | 2 +- apparmor.d/groups/browsers/torbrowser-vaapitest | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/browsers/torbrowser-updater b/apparmor.d/groups/browsers/torbrowser-updater index 3bc8e591d..5aaa82c2a 100644 --- a/apparmor.d/groups/browsers/torbrowser-updater +++ b/apparmor.d/groups/browsers/torbrowser-updater @@ -16,7 +16,7 @@ profile torbrowser-updater @{exec_path} { @{exec_path} mr, @{lib_dirs}/*.so mr, - @{lib_dirs}/firefox{,.real} Px, + @{lib_dirs}/firefox{,.real} Px -> torbrowser, owner @{lib_dirs}/{,**} rw, diff --git a/apparmor.d/groups/browsers/torbrowser-vaapitest b/apparmor.d/groups/browsers/torbrowser-vaapitest index 7570d6ce4..cf68f3ea7 100644 --- a/apparmor.d/groups/browsers/torbrowser-vaapitest +++ b/apparmor.d/groups/browsers/torbrowser-vaapitest @@ -24,6 +24,7 @@ profile torbrowser-vaapitest @{exec_path} flags=(attach_disconnected) { deny @{lib_dirs}/{,browser/}omni.ja r, deny @{cache_dirs}/profile.default/startupCache/* r, deny @{config_dirs}/.parentlock rw, + deny @{config_dirs}/extensions/*.xpi r, include if exists } From 89240929e9bc55a1b671766874a27af5251b369e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 13:19:35 +0100 Subject: [PATCH 0203/1455] feat(profile): thunderbird: allow to open attachment. --- apparmor.d/groups/gnome/gnome-calendar | 2 ++ apparmor.d/profiles-s-z/thunderbird | 1 + 2 files changed, 3 insertions(+) diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index c74292f4b..2db321baf 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -44,6 +44,8 @@ profile gnome-calendar @{exec_path} { /usr/share/evolution-data-server/{,**} r, /usr/share/libgweather/Locations.xml r, + owner @{tmp}/pid-@{pid}/*.ics r, + include if exists } diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index 208c581d8..a9490c6f7 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -54,6 +54,7 @@ profile thunderbird @{exec_path} { owner @{tmp}/MozillaMailnews/*.msf rw, owner @{tmp}/nsemail.eml rw, owner @{tmp}/nsma rw, + owner @{tmp}/pid-@{pid}/{,**} w, # Silencer deny capability sys_ptrace, From cc33e29af0987c32816383ec581bdde4700aa30d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 13:35:57 +0100 Subject: [PATCH 0204/1455] feat(profile): dbus: allow to talk with org.gtk.vfs for some profiles. --- apparmor.d/groups/gnome/gnome-shell | 8 +------- apparmor.d/groups/gnome/gnome-text-editor | 2 ++ apparmor.d/groups/gnome/loupe | 2 ++ apparmor.d/profiles-a-f/evince | 6 +----- 4 files changed, 6 insertions(+), 12 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 3ee2665e5..c72652065 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -34,9 +34,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include - include - include include include include @@ -93,6 +90,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console #aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-* + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" # System bus @@ -135,10 +133,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { member=Embed peer=(name=org.a11y.atspi.Registry), - dbus send bus=session path=/org/gtk/vfs/** - interface=org.gtk.vfs.* - peer=(name=:*, label=gvfsd*), - dbus send bus=session path=/org/ayatana/NotificationItem/* interface=org.freedesktop.DBus.Properties member={Get,GetAll} diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index 80ff8310d..8641e01bd 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -15,6 +15,8 @@ profile gnome-text-editor @{exec_path} { include include + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + @{exec_path} mr, owner @{user_share_dirs}/org.gnome.TextEditor/{,**} rw, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index 6d53ebf44..a90f8664f 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -19,6 +19,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) { signal (send) set=(kill) peer=loupe//bwrap, + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + @{exec_path} mr, @{bin}/bwrap rCx -> bwrap, diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index 73d73eb02..3ac55439a 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -31,11 +31,7 @@ profile evince @{exec_path} { #aa:dbus own bus=session name=org.gnome.evince #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label=gsd-media-keys - - dbus send bus=session path=/org/gtk/vfs/metadata - interface=org.gtk.vfs.Metadata - member={Set,GetTreeFromDevice} - peer=(name=:*, label=gvfsd-metadata), + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @{exec_path} rix, From 38a5799979e58a2cb4efe3b488dad761b775a461 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 14:35:25 +0100 Subject: [PATCH 0205/1455] fix(profile): transmission translation fix #503 --- apparmor.d/profiles-s-z/transmission | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission index 07aca1890..44f89d2b1 100644 --- a/apparmor.d/profiles-s-z/transmission +++ b/apparmor.d/profiles-s-z/transmission @@ -27,6 +27,8 @@ profile transmission @{exec_path} { @{open_path} rPx -> child-open, + /usr/share/transmission/{,**} r, + owner @{user_torrents_dirs}/ r, owner @{user_torrents_dirs}/** rw, From f2011688771d2983f9399d20aff522ec73cb86e8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 16:03:02 +0100 Subject: [PATCH 0206/1455] fix(profile): thunderbird: cpu.max and owner fix #504 --- apparmor.d/abstractions/app/firefox | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 66a517721..23a91593f 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -122,7 +122,7 @@ @{sys}/devices/power/events/energy-* r, @{sys}/devices/power/type r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, - owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/**/cpu.max r, @{PROC}/@{pid}/net/arp r, From c1d8958aedcaf1b662e9e6d6c32ac042b6e65753 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 16:07:55 +0100 Subject: [PATCH 0207/1455] fix(profile): missing rule in resolvconf. fix #502 --- apparmor.d/profiles-m-r/resolvconf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apparmor.d/profiles-m-r/resolvconf b/apparmor.d/profiles-m-r/resolvconf index 981af134f..caa13b97d 100644 --- a/apparmor.d/profiles-m-r/resolvconf +++ b/apparmor.d/profiles-m-r/resolvconf @@ -15,6 +15,7 @@ profile resolvconf @{exec_path} { @{sh_path} rix, @{bin}/cat rix, + @{bin}/cp rix, @{bin}/flock rix, @{bin}/mkdir rix, @{bin}/mv rix, @@ -27,10 +28,14 @@ profile resolvconf @{exec_path} { /usr/lib/resolvconf/{,**} r, + @{etc_rw}/resolv.conf.bak rw, @{etc_rw}/resolv.conf rw, + /etc/resolvconf.conf r, /etc/resolvconf/{,**} r, /etc/resolvconf/update.d/libc rix, + / r, + owner @{run}/resolvconf/{,**} rw, owner @{run}/resolvconf/run-lock wk, From 688f2651fdfa413bc58876aef00685ac6cdc25ee Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 22:14:30 +0100 Subject: [PATCH 0208/1455] feat(tunable): improve python name definition. --- apparmor.d/tunables/multiarch.d/programs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 61d3713ae..406336e49 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -26,7 +26,8 @@ @{coreutils} += truncate tsort tty uname unexpand uniq unlink updatedb vdir wc who whoami xargs yes # Python interpreters -@{python_name} = python{,3,3.[0-9],3.1[0-9]} +@{python_version} = 3 3.[0-9] 3.1[0-9] +@{python_name} = python python@{python_version} # Open @{open_names} = exo-open xdg-open gio kde-open gio-launch-desktop @@ -60,9 +61,9 @@ @{torbrowser_name} = torbrowser "tor browser" @{torbrowser_lib_dirs} = @{HOME}/.tb/tor-browser/Browser/ -# Emails +# Emails -@{thunderbird_name} = thunderbird{,-bin} +@{thunderbird_name} = thunderbird{,-bin} @{thunderbird_lib_dirs} = @{lib}/@{thunderbird_name} @{emails_names} = evolution geary From 7f657780e5fc0cbcaad6dc1ec79de4d361ea7dea Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Sep 2024 22:24:45 +0100 Subject: [PATCH 0209/1455] feat(tunable): add the word @{w} and digit @{d} variables. --- apparmor.d/tunables/multiarch.d/system | 33 +++++++++++++++++++++----- 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 4fb8304cd..d51ede6ca 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -11,22 +11,29 @@ # Single alphanumeric character @{c}=[0-9a-zA-Z] +# Word character. Matches any letter, digit or underscore. +@{w}=[a-zA-Z0-9_] + +# Any digit +@{d}=[0-9] + # Integer up to 10 digits (0-9999999999) -@{int}=[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],} +@{int}=@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},} # Unsigned integer over 8 bits (0-255) # 0 - 99 100 - 199 200 - 249 250 - 255 @{u8}=[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5] # Unsigned integer over 16 bits (0-65535, 5 digits) -@{u16}=[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],} +@{u16}=@{d}{@{d},}{@{d},}{@{d},}{@{d},} -# hexadecimal, alphanumeric up to 64 characters +# hexadecimal, alphanumeric and word up to 64 characters @{hex}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} @{rand}=@{c}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},} +@{word}=@{w}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} # Any x digits characters -@{int2}=[0-9][0-9] +@{int2}=@{d}@{d} @{int4}=@{int2}@{int2} @{int6}=@{int4}@{int2} @{int8}=@{int4}@{int4} @@ -42,6 +49,7 @@ @{hex8}=@{hex4}@{hex4} @{hex9}=@{hex8}@{h} @{hex10}=@{hex8}@{hex2} +@{hex12}=@{hex8}@{hex4} @{hex15}=@{hex8}@{hex4}@{hex2}@{h} @{hex16}=@{hex8}@{hex8} @{hex32}=@{hex16}@{hex16} @@ -55,17 +63,30 @@ @{rand8}=@{rand4}@{rand4} @{rand9}=@{rand8}@{c} @{rand10}=@{rand8}@{rand2} +@{rand12}=@{rand8}@{rand4} @{rand15}=@{rand8}@{rand4}@{rand2}@{c} @{rand16}=@{rand8}@{rand8} @{rand32}=@{rand16}@{rand16} @{rand64}=@{rand64}@{rand64} +# Any x word characters +@{word2}=@{w}@{w} +@{word4}=@{word2}@{word2} +@{word6}=@{word4}@{word2} +@{word8}=@{word4}@{word4} +@{word9}=@{word8}@{w} +@{word10}=@{word8}@{word2} +@{word12}=@{word8}@{word4} +@{word15}=@{word8}@{word4}@{word2}@{w} +@{word16}=@{word8}@{word8} +@{word32}=@{word16}@{word16} +@{word64}=@{word32}@{word32} + # Universally unique identifier @{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} # Username & group valid characters -@{u}=[a-zA-Z0-9_] -@{user}=[a-zA-Z_]{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},} +@{user}=[a-zA-Z_]{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} @{group}=@{user} # Semantic version From c085c8038b87a233f82445f2531f46a039efbf0d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 23 Sep 2024 13:57:32 +0100 Subject: [PATCH 0210/1455] feat(abs): add glfw. fix #508 --- apparmor.d/abstractions/glfw | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 apparmor.d/abstractions/glfw diff --git a/apparmor.d/abstractions/glfw b/apparmor.d/abstractions/glfw new file mode 100644 index 000000000..f52fb926d --- /dev/null +++ b/apparmor.d/abstractions/glfw @@ -0,0 +1,9 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + owner @{run}/user/@{uid}/glfw-shared-@{rand6} rw, + + include if exists + +# vim:syntax=apparmor From 62cb546afa8c29b740d6a0979b51bfb3c8f1cff7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 23 Sep 2024 14:59:44 +0100 Subject: [PATCH 0211/1455] feat(fps): improve systemd profiles. --- apparmor.d/groups/_full/bwrap-app | 1 - apparmor.d/groups/_full/systemd | 54 +++++++++++++------- apparmor.d/groups/_full/systemd-user | 53 ++++++++++--------- apparmor.d/groups/_full/systemd-user-service | 23 +++++++++ 4 files changed, 88 insertions(+), 43 deletions(-) create mode 100644 apparmor.d/groups/_full/systemd-user-service diff --git a/apparmor.d/groups/_full/bwrap-app b/apparmor.d/groups/_full/bwrap-app index bfe12e560..d0ddfaaad 100644 --- a/apparmor.d/groups/_full/bwrap-app +++ b/apparmor.d/groups/_full/bwrap-app @@ -11,7 +11,6 @@ include profile bwrap-app flags=(attach_disconnected,mediate_deleted) { include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index d85d04e2f..36c31e60e 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -107,7 +107,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { umount @{run}/systemd/unit-root/{,**}, pivot_root oldroot=@{run}/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/, - pivot_root oldroot=@{run}/systemd/unit-root/ @{run}/systemd/unit-root/, + pivot_root oldroot=@{run}/systemd/unit-root/ @{run}/systemd/unit-root/, change_profile, @@ -129,29 +129,37 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { member=GetConnectionUnixUser peer=(name=org.freedesktop.DBus, label=dbus-system), - @{bin}/systemctl rix, - @{bin}/mount rix, + @{bin}/** Px, + @{lib}/** Px, + /etc/cron.*/* Px, + /etc/init.d/* Px, + /usr/share/*/** Px, - @{lib}/systemd/systemd-executor rix, - @{lib}/systemd/systemd rpx -> systemd-user, + # Systemd internal service started and config handler (sandboxing, namespacing, cgroup, etc.) + @{lib}/systemd/systemd-executor ix, - @{bin}/ldconfig rPx -> systemd-service, - @{bin}/mandb rPx -> systemd-service, - @{bin}/savelog rPx -> systemd-service, - @{coreutils_path} rPx -> systemd-service, - @{sh_path} rPx -> systemd-service, + # Systemd user: systemd --user + @{lib}/systemd/systemd px -> systemd-user, - @{bin}/** Px, - @{lib}/** Px, - /etc/cron.*/* Px, - /etc/init.d/* Px, - /usr/share/*/** Px, + # Unit services using systemctl + @{bin}/systemctl Cx -> systemctl, + # Unit services + @{bin}/mount ix, + + # Shell based systemd unit services + @{bin}/ldconfig Px -> systemd-service, + @{bin}/mandb Px -> systemd-service, + @{bin}/savelog Px -> systemd-service, + @{coreutils_path} Px -> systemd-service, + @{sh_path} Px -> systemd-service, + + # Systemd profiles that need be stacked #aa:stack systemd-networkd systemd-oomd systemd-resolved systemd-timesyncd - @{lib}/systemd/systemd-networkd rPx -> systemd//&systemd-networkd, - @{lib}/systemd/systemd-oomd rPx -> systemd//&systemd-oomd, - @{lib}/systemd/systemd-resolved rPx -> systemd//&systemd-resolved, - @{lib}/systemd/systemd-timesyncd rPx -> systemd//&systemd-timesyncd, + @{lib}/systemd/systemd-networkd Px -> systemd//&systemd-networkd, + @{lib}/systemd/systemd-oomd Px -> systemd//&systemd-oomd, + @{lib}/systemd/systemd-resolved Px -> systemd//&systemd-resolved, + @{lib}/systemd/systemd-timesyncd Px -> systemd//&systemd-timesyncd, @{lib}/ r, / r, @@ -254,6 +262,14 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { owner /dev/shm/ rw, owner /dev/ttyS@{int} rwk, + profile systemctl { + include + include + + include if exists + include if exists + } + include if exists include if exists } diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index f88604124..7b6ef77fb 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -25,40 +25,47 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { network netlink raw, - signal (send) set=(term, cont, kill), - signal (receive) set=(hup) peer=@{p_systemd}, + signal send set=(term, cont, kill), + signal receive set=hup peer=@{p_systemd}, - ptrace (read) peer=@{p_systemd}, + ptrace read peer=@{p_systemd}, - unix (bind) type=stream addr=@@{hex16}/bus/systemd/bus-system, - unix (bind) type=stream addr=@@{hex16}/bus/systemd/bus-api-user, + unix bind type=stream addr=@@{hex16}/bus/systemd/bus-system, + unix bind type=stream addr=@@{hex16}/bus/systemd/bus-api-user, #aa:dbus own bus=session name=org.freedesktop.systemd1 @{exec_path} mr, - @{bin}/dbus-broker rpx -> dbus-session, - @{bin}/dbus-broker-launch rpx -> dbus-session, - @{bin}/dbus-daemon rpx -> dbus-session, - @{lib}/dbus-1.0/dbus-daemon-launch-helper rpx -> dbus-session, + @{bin}/** Px, + @{lib}/** Px, + /etc/cron.*/* Px, + /opt/*/** Px, + /usr/share/*/** Px, - @{bin}/systemctl rCx -> systemctl, - @{lib}/systemd/systemd-executor rix, - @{sh_path} rix, # Should be handled by default profile? - @{bin}/grep rix, - @{bin}/sleep rix, + # Systemd internal service started and config handler (sandboxing, namespacing, cgroup, etc.) + @{lib}/systemd/systemd-executor ix, - @{bin}/** Px, - @{lib}/** Px, - /opt/*/** Px, - /usr/share/*/** Px, + # Unit services using systemctl + @{bin}/systemctl Cx -> systemctl, + # Shell based ystemd unit services + @{coreutils_path} Px -> systemd-user-service, + @{sh_path} Px -> systemd-user-service, + + # Dbus needs to be started without environment scrubbing + @{bin}/dbus-broker px -> dbus-session, + @{bin}/dbus-broker-launch px -> dbus-session, + @{bin}/dbus-daemon px -> dbus-session, + @{lib}/dbus-1.0/dbus-daemon-launch-helper px -> dbus-session, + + # Audio profiles need to be stacked #aa:stack pipewire pipewire-media-session pipewire-pulse pulseaudio wireplumber - @{bin}/pipewire rPx -> systemd-user//&pipewire, - @{bin}/pipewire-media-session rPx -> systemd-user//&pipewire-media-session, - @{bin}/pipewire-pulse rPx -> systemd-user//&pipewire-pulse, - @{bin}/pulseaudio rPx -> systemd-user//&pulseaudio, - @{bin}/wireplumber rPx -> systemd-user//&wireplumber, + @{bin}/pipewire Px -> systemd-user//&pipewire, + @{bin}/pipewire-media-session Px -> systemd-user//&pipewire-media-session, + @{bin}/pipewire-pulse Px -> systemd-user//&pipewire-pulse, + @{bin}/pulseaudio Px -> systemd-user//&pulseaudio, + @{bin}/wireplumber Px -> systemd-user//&wireplumber, /usr/ r, /usr/share/defaults/**.conf r, diff --git a/apparmor.d/groups/_full/systemd-user-service b/apparmor.d/groups/_full/systemd-user-service new file mode 100644 index 000000000..0aaeba215 --- /dev/null +++ b/apparmor.d/groups/_full/systemd-user-service @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Profile for generic systemd unit services. Only used by tiny systemd services +# that start a shell or use context specific programs. + +# It does not specify an attachment path because it is intended to be used only +# via "Px -> systemd-user-service" exec transitions from the systemd-user profile. + +abi , + +include + +profile systemd-user-service flags=(complain) { + include + include + + include if exists + include if exists +} + +# vim:syntax=apparmor From 31cadd634fca16588d1cd92ee6809b80adfb4414 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 23 Sep 2024 15:11:50 +0100 Subject: [PATCH 0212/1455] feat(abs): improve some gnome profiles. --- apparmor.d/groups/gnome/gnome-control-center | 9 +++++---- apparmor.d/groups/gnome/gsd-datetime | 11 ++++++++++- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index aea86106a..154aff58c 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -72,7 +72,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { /usr/share/language-tools/language2locale rix, /usr/share/language-tools/language-options rPUx, - @{open_path} rPx -> child-open-browsers, + @{open_path} rPx -> child-open-any, /opt/**/share/icons/{,**} r, /snap/*/@{int}/**.png r, @@ -124,6 +124,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/gnome-remote-desktop/rdp-tls.{crt,key}{,.@{rand6}} rw, owner @{user_share_dirs}/icc/{,edid-*} r, + owner @{tmp}/@{hex12}@{h} rw, + owner @{tmp}/@{rand8} rw, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, @{run}/samba/ rw, @@ -160,6 +162,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{PROC}/cmdline r, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, @{PROC}/zoneinfo r, + @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, @@ -187,9 +190,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { profile pkexec { include - - @{bin}/pkexec mr, - + include include if exists } diff --git a/apparmor.d/groups/gnome/gsd-datetime b/apparmor.d/groups/gnome/gsd-datetime index d125cd13d..5c3b768fc 100644 --- a/apparmor.d/groups/gnome/gsd-datetime +++ b/apparmor.d/groups/gnome/gsd-datetime @@ -12,8 +12,15 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) { include include include + include - signal (receive) set=(term, hup) peer=gdm*, + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + signal receive set=(term, hup) peer=gdm*, #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Datetime @@ -34,6 +41,8 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/geocode-glib/* r, + @{run}/systemd/sessions/@{int} r, + @{run}/systemd/users/@{uid} r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/stat r, From 6723b43559ab5b52ebb0335062880283f136100b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 23 Sep 2024 15:12:24 +0100 Subject: [PATCH 0213/1455] feat(profile): improve systemsettings. --- apparmor.d/groups/kde/systemsettings | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index d0fec60fc..e1de05a11 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -112,6 +112,7 @@ profile systemsettings @{exec_path} { owner @{user_share_dirs}/wallpapers/{,**} r, owner @{run}/user/@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/systemsettings@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs From 117b54d16ccae75e8bfc672988de8575678ba7fa Mon Sep 17 00:00:00 2001 From: odomingao Date: Thu, 19 Sep 2024 13:58:46 -0300 Subject: [PATCH 0214/1455] Create gamemoded --- apparmor.d/profiles-g-l/gamemoded | 81 +++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100644 apparmor.d/profiles-g-l/gamemoded diff --git a/apparmor.d/profiles-g-l/gamemoded b/apparmor.d/profiles-g-l/gamemoded new file mode 100644 index 000000000..64b0e8f8f --- /dev/null +++ b/apparmor.d/profiles-g-l/gamemoded @@ -0,0 +1,81 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/gamemoded +profile gamemoded @{exec_path} flags=(attach_disconnected) { + include + + capability sys_ptrace, + + ptrace read, + + @{exec_path} mr, + + @{bin}/pkexec Cx -> pkexec, + @{lib}/gamemode/gpuclockctl Cx -> pkexec, + + /etc/gamemode.ini r, + + owner @{user_config_dirs}/ r, + + @{sys}/devices/@{pci}/vendor r, + @{sys}/devices/@{pci}/power_dpm_force_performance_level r, + @{sys}/devices/system/cpu/{,**} r, + @{sys}/devices/virtual/powercap/{,**} r, + + @{PROC}/sys/kernel/split_lock_mitigate r, + owner @{PROC}/@{pid}/ r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/environ r, + owner @{PROC}/@{pid}/fdinfo/ r, + owner @{PROC}/@{pid}/fdinfo/@{int} r, + owner @{PROC}/@{pid}/task/ r, + + profile pkexec { + include + include + include + + capability audit_write, + capability mknod, + capability setgid, + capability sys_ptrace, + + ptrace read peer=gamemoded, + + network netlink raw, + + @{bin}/pkexec mr, + + @{lib}/gamemode/{,**} r, + @{lib}/gamemode/cpugovctl ix, + @{lib}/gamemode/gpuclockctl ix, + @{lib}/gamemode/procsysctl ix, + + /etc/security/limits.d/ r, + /etc/security/limits.d/@{int}-gamemode.conf r, + /etc/shells r, + + @{sys}/devices/@{pci}/power_dpm_force_performance_level rw, + @{sys}/devices/@{pci}/vendor r, + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/cpu@{int}/cpufreq r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw, + + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/loginuid r, + @{PROC}/@{pid}/stat r, + @{PROC}/sys/kernel/split_lock_mitigate rw, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor From 18c2f3e8d7c0c0b749ccc0b4067b89ea1ac91eb9 Mon Sep 17 00:00:00 2001 From: odomingao Date: Fri, 20 Sep 2024 19:26:49 -0300 Subject: [PATCH 0215/1455] Update gamemoded --- apparmor.d/profiles-g-l/gamemoded | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/gamemoded b/apparmor.d/profiles-g-l/gamemoded index 64b0e8f8f..e17a9e537 100644 --- a/apparmor.d/profiles-g-l/gamemoded +++ b/apparmor.d/profiles-g-l/gamemoded @@ -36,7 +36,7 @@ profile gamemoded @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/task/ r, - profile pkexec { + profile pkexec flags=(attach_disconnected) { include include include From 8fa2058c55342964b3ad46f77f12da314da83a38 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sat, 21 Sep 2024 21:42:15 -0300 Subject: [PATCH 0216/1455] Small improvement to audio-client --- apparmor.d/abstractions/audio-client | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index ceacbae9c..7ed4d6b80 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -17,7 +17,7 @@ /etc/libao.conf r, /etc/openal/alsoft.conf r, /etc/pipewire/client{,-rt}.conf r, - /etc/pipewire/client.conf.d/{,**} r, + /etc/pipewire/client{,-rt}.conf.d/{,**} r, /etc/pulse/client.conf r, /etc/pulse/client.conf.d/{,**} r, /etc/wildmidi/wildmidi.cfg r, From 3a7e4c670583d4ff03520b8e696ad4071e96e214 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Sun, 22 Sep 2024 17:23:18 +0800 Subject: [PATCH 0217/1455] A Fix for xdg-permission-store --- apparmor.d/groups/freedesktop/xdg-permission-store | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/xdg-permission-store b/apparmor.d/groups/freedesktop/xdg-permission-store index f698111d4..fa139a9ec 100644 --- a/apparmor.d/groups/freedesktop/xdg-permission-store +++ b/apparmor.d/groups/freedesktop/xdg-permission-store @@ -41,7 +41,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/flatpak/db/ rw, owner @{user_share_dirs}/flatpak/db/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/flatpak/db/background rw, - owner @{user_share_dirs}/flatpak/db/devices r, + owner @{user_share_dirs}/flatpak/db/devices rw, owner @{user_share_dirs}/flatpak/db/documents rw, owner @{user_share_dirs}/flatpak/db/notifications rw, From c28d05f15fb32897dab3d2b0b09666c5c81a213d Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 22 Sep 2024 12:19:13 +0200 Subject: [PATCH 0218/1455] Update protonmail-bridge Because of the following requests: ``` owner "@{user_cache_dirs}/Proton AG/" w, owner @{user_cache_dirs}/protonmail/ w, owner @{user_config_dirs}/protonmail/ w, owner @{user_share_dirs}/protonmail/ w, ``` possibly during setup. --- apparmor.d/profiles-m-r/protonmail-bridge | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/profiles-m-r/protonmail-bridge b/apparmor.d/profiles-m-r/protonmail-bridge index 3d3878c3e..7e8dfe9d4 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge +++ b/apparmor.d/profiles-m-r/protonmail-bridge @@ -6,9 +6,9 @@ abi , include -@{config_dirs} = @{user_config_dirs}/protonmail/bridge-v3 -@{cache_dirs} = @{user_cache_dirs}/protonmail/bridge-v3 "@{user_cache_dirs}/Proton AG/Proton Mail Bridge" -@{share_dirs} = @{user_share_dirs}/protonmail/bridge-v3 +@{config_dirs} = @{user_config_dirs}/protonmail/{,bridge-v3} +@{cache_dirs} = @{user_cache_dirs}/protonmail/{,bridge-v3} "@{user_cache_dirs}/Proton AG/{,Proton Mail Bridge}" +@{share_dirs} = @{user_share_dirs}/protonmail/{,bridge-v3} @{exec_path} = @{lib}/protonmail/bridge/bridge-gui profile protonmail-bridge @{exec_path} { From 0d5a3405d8f5c3b4f43707cfbe1c5b166b6ef28f Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 22 Sep 2024 12:22:17 +0200 Subject: [PATCH 0219/1455] Update protonmail-bridge-core because of the following request: ``` /etc/ca-certificates/extracted/*.pem r, /etc/ssl/certs/{,**} r, ``` --- apparmor.d/profiles-m-r/protonmail-bridge-core | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index b7fd0c98a..89330c819 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -15,6 +15,7 @@ include profile protonmail-bridge-core @{exec_path} { include include + include network inet dgram, network inet6 dgram, From 4660b7d49ce9b9f15a229348fa171894d0d5d7f7 Mon Sep 17 00:00:00 2001 From: valoq Date: Sun, 15 Sep 2024 13:22:12 +0200 Subject: [PATCH 0220/1455] add ssh-sk-helper --- apparmor.d/groups/ssh/ssh | 2 ++ apparmor.d/groups/ssh/ssh-sk-helper | 26 ++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 apparmor.d/groups/ssh/ssh-sk-helper diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 296074f5f..a1046dbb5 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -25,6 +25,8 @@ profile ssh @{exec_path} { @{bin}/@{shells} rUx, + @{lib}/ssh/ssh-sk-helper rix -> ssh//null-@{lib}/ssh/ssh-sk-helper, + @{etc_ro}/ssh/ssh_config r, @{etc_ro}/ssh/ssh_config.d/{,*} r, @{etc_ro}/ssh/sshd_config r, diff --git a/apparmor.d/groups/ssh/ssh-sk-helper b/apparmor.d/groups/ssh/ssh-sk-helper new file mode 100644 index 000000000..915086e9c --- /dev/null +++ b/apparmor.d/groups/ssh/ssh-sk-helper @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +profile ssh//null-@{lib}/ssh/ssh-sk-helper { + / r, + + @{lib}/ssh/ssh-sk-helper r, + + /etc/ssl/openssl.cnf r, + + @{sys}/ r, + @{sys}/bus/ r, + @{sys}/class/ r, + @{sys}/class/hidraw/ r, + @{sys}/class/hidraw/hidraw@{int} r, + @{sys}/devices/ r, + @{sys}/devices/@{pci_bus}/ r, + @{sys}/devices/@{pci_bus}/{,**} r, + + /dev/hidraw@{int} rwk, + + include if exists +} + +# vim:syntax=apparmor From a854b631621bb62b760d282bf222a3930a111cd7 Mon Sep 17 00:00:00 2001 From: valoq Date: Sun, 15 Sep 2024 13:46:07 +0200 Subject: [PATCH 0221/1455] fix profiles --- apparmor.d/groups/ssh/ssh | 2 +- apparmor.d/groups/ssh/ssh-sk-helper | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index a1046dbb5..476bd3f26 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -25,7 +25,7 @@ profile ssh @{exec_path} { @{bin}/@{shells} rUx, - @{lib}/ssh/ssh-sk-helper rix -> ssh//null-@{lib}/ssh/ssh-sk-helper, + @{lib}/ssh/ssh-sk-helper rix -> ssh-sk-helper, @{etc_ro}/ssh/ssh_config r, @{etc_ro}/ssh/ssh_config.d/{,*} r, diff --git a/apparmor.d/groups/ssh/ssh-sk-helper b/apparmor.d/groups/ssh/ssh-sk-helper index 915086e9c..2013371b3 100644 --- a/apparmor.d/groups/ssh/ssh-sk-helper +++ b/apparmor.d/groups/ssh/ssh-sk-helper @@ -2,8 +2,9 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -profile ssh//null-@{lib}/ssh/ssh-sk-helper { - / r, +include + +profile ssh-sk-helper flags=(complain) { @{lib}/ssh/ssh-sk-helper r, From 69cc1031add7e61b5974daa9fdd32c28d6906c63 Mon Sep 17 00:00:00 2001 From: valoq Date: Fri, 20 Sep 2024 12:01:14 +0200 Subject: [PATCH 0222/1455] clean ssh sk helper --- apparmor.d/groups/ssh/ssh | 2 +- apparmor.d/groups/ssh/ssh-sk-helper | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 476bd3f26..5dce3ec80 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -25,7 +25,7 @@ profile ssh @{exec_path} { @{bin}/@{shells} rUx, - @{lib}/ssh/ssh-sk-helper rix -> ssh-sk-helper, + @{lib}/ssh/ssh-sk-helper rPx -> ssh-sk-helper, @{etc_ro}/ssh/ssh_config r, @{etc_ro}/ssh/ssh_config.d/{,*} r, diff --git a/apparmor.d/groups/ssh/ssh-sk-helper b/apparmor.d/groups/ssh/ssh-sk-helper index 2013371b3..defa9ac1b 100644 --- a/apparmor.d/groups/ssh/ssh-sk-helper +++ b/apparmor.d/groups/ssh/ssh-sk-helper @@ -4,20 +4,17 @@ include +@{exec_path} = @{lib}/ssh/ssh-sk-helper profile ssh-sk-helper flags=(complain) { + include - @{lib}/ssh/ssh-sk-helper r, - - /etc/ssl/openssl.cnf r, + @{exec_path} mr, @{sys}/ r, @{sys}/bus/ r, @{sys}/class/ r, @{sys}/class/hidraw/ r, @{sys}/class/hidraw/hidraw@{int} r, - @{sys}/devices/ r, - @{sys}/devices/@{pci_bus}/ r, - @{sys}/devices/@{pci_bus}/{,**} r, /dev/hidraw@{int} rwk, From 97676dcf711dfb43c402195a7e9ba6dd85facba6 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 22 Sep 2024 12:40:42 +0200 Subject: [PATCH 0223/1455] Update sudo Condensing requests like: @{sys}/fs/cgroup/{hostcritical,system,unevictable,user}.slice/*.service/cgroup.procs r, @{sys}/fs/cgroup/system.slice/system-getty.slice/getty@tty3.service/cgroup.procs r, @{sys}/fs/cgroup/user.slice/user-1000.slice/user@1000.service/cgroup.procs r, @{sys}/fs/cgroup/system.slice/system-getty.slice/getty@tty3.service/cgroup.procs r, @{sys}/fs/cgroup/user.slice/user-1000.slice/user@1000.service/cgroup.procs r, @{sys}/fs/cgroup/user.slice/user-968.slice/user@968.service/cgroup.procs r, --- apparmor.d/profiles-s-z/sudo | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index 6f01bc8f0..9574b98d1 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -48,6 +48,8 @@ profile sudo @{exec_path} flags=(attach_disconnected) { @{run}/systemd/sessions/* r, @{run}/systemd/sessions/?@{int}.ref rw, + @{sys}/fs/cgroup/*.slice{,/*.slice}/*.service/cgroup.procs r, + include if exists } From 0bf60c313f6d4a1fdc94342e4da547defbde71d2 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Mon, 23 Sep 2024 12:37:48 +0200 Subject: [PATCH 0224/1455] New profile: protonmail --- apparmor.d/profiles-m-r/protonmail | 45 ++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 apparmor.d/profiles-m-r/protonmail diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail new file mode 100644 index 000000000..2c69d8c08 --- /dev/null +++ b/apparmor.d/profiles-m-r/protonmail @@ -0,0 +1,45 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 curiosityseeker +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{name} = "Proton Mail" +@{lib_dirs} = /opt/@{name} +@{config_dirs} = @{user_config_dirs}/@{name} +@{cache_dirs} = @{user_cache_dirs}/@{name} + +@{exec_path} = "/opt/proton-mail/Proton Mail{, Beta}" +profile protonmail @{exec_path} flags=(complain) { + include + include + + network inet stream, + network inet dgram, + network inet6 dgram, + network netlink raw, + + ptrace read peer=xdg-settings, + + @{exec_path} mrix, + + /opt/proton-mail/** r, + /opt/proton-mail/*.so m, + /opt/proton-mail/libvulkan.so.1 m, + + @{bin}/xdg-settings Px, + @{open_path} rpx -> child-open, + + /etc/machine-id r, + + owner @{user_config_dirs}/ibus/bus/ r, + + @{sys}/devices/@{pci}/boot_vga r, + + owner @{tmp}/gtkprint_ppd_@{rand6} rw, + + include if exists + +} From 9400e5fd00039aa65b925055b9a5e6bef64bc0ef Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Mon, 23 Sep 2024 13:04:19 +0200 Subject: [PATCH 0225/1455] Update main.flags --- dists/flags/main.flags | 1 + 1 file changed, 1 insertion(+) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 8c28c7252..16c616404 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -283,6 +283,7 @@ plymouth-set-default-theme attach_disconnected,complain plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted qdbus complain +protonmail complain realmd complain remmina complain run-parts complain From 8cc986ab9241533cea96a312b9113eb08c0bd143 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Tue, 24 Sep 2024 11:58:03 +0200 Subject: [PATCH 0226/1455] Update protonmail --- apparmor.d/profiles-m-r/protonmail | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index 2c69d8c08..f6bc7e4b8 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -6,14 +6,16 @@ abi , include -@{name} = "Proton Mail" +@{name} = proton-mail "Proton Mail" @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} -@{exec_path} = "/opt/proton-mail/Proton Mail{, Beta}" +@{exec_path} = @{bin}/proton-mail /opt/proton-mail/Proton* profile protonmail @{exec_path} flags=(complain) { include + include + include include network inet stream, @@ -25,15 +27,9 @@ profile protonmail @{exec_path} flags=(complain) { @{exec_path} mrix, - /opt/proton-mail/** r, - /opt/proton-mail/*.so m, - /opt/proton-mail/libvulkan.so.1 m, - @{bin}/xdg-settings Px, @{open_path} rpx -> child-open, - /etc/machine-id r, - owner @{user_config_dirs}/ibus/bus/ r, @{sys}/devices/@{pci}/boot_vga r, From 67b1c301eda7af8a7e901649d00227d56debfab3 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 22 Sep 2024 13:12:04 -0300 Subject: [PATCH 0227/1455] Create vesktop --- apparmor.d/profiles-s-z/vesktop | 46 +++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 apparmor.d/profiles-s-z/vesktop diff --git a/apparmor.d/profiles-s-z/vesktop b/apparmor.d/profiles-s-z/vesktop new file mode 100644 index 000000000..ce420ea12 --- /dev/null +++ b/apparmor.d/profiles-s-z/vesktop @@ -0,0 +1,46 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , +include + +@{name} = vesktop +@{lib_dirs} = @{lib}/@{name} +@{config_dirs} = @{user_config_dirs}/@{name} +@{cache_dirs} = @{user_cache_dirs}/@{name} + +@{exec_path} = @{bin}/vesktop +profile vesktop @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + owner /tmp/.org.chromium.Chromium.@{rand6} mr, + owner @{run}/user/@{uid}/discord-ipc-@{int} rw, + + @{sys}/devices/@{pci}/usb@{int}/**/interface r, + + @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + owner /dev/ r, + + deny /dev/tty rw, + deny owner /dev/tty@{int} rw, + + include if exists +} + +# vim:syntax=apparmor From a0dab014019efad5ea48d35970a574714316a7f9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 24 Sep 2024 21:36:49 +0100 Subject: [PATCH 0228/1455] feat(profile): update multipath. fix #523 --- apparmor.d/profiles-m-r/multipath | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-m-r/multipath b/apparmor.d/profiles-m-r/multipath index 918e5a0c2..b79db6418 100644 --- a/apparmor.d/profiles-m-r/multipath +++ b/apparmor.d/profiles-m-r/multipath @@ -27,6 +27,7 @@ profile multipath @{exec_path} flags=(attach_disconnected) { @{sys}/bus/ r, @{sys}/class/ r, + @{sys}/module/*/parameters/multipath r, @{PROC}/devices r, @{PROC}/sys/fs/nr_open r, From 3a34a70181f4ec47e4199ca669a5e2883b70abda Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 24 Sep 2024 21:38:51 +0100 Subject: [PATCH 0229/1455] fix(profile): xfs support in udisksd fix #524 --- apparmor.d/profiles-s-z/udisksd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index b835be9e7..a0071a759 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -88,7 +88,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{bin}/sgdisk rPx, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-escape rPx, - @{bin}/xfs_db rPUx, + @{bin}/xfs_* rPUx, /etc/crypttab r, /etc/fstab r, From 6578b55829b9a84d9eba009a0e82561d989b83e3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 24 Sep 2024 21:44:49 +0100 Subject: [PATCH 0230/1455] fix(profile) Gimp thumbnails log fix #522 --- apparmor.d/profiles-g-l/gimp | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index bfdc6d640..fe69ad91c 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -13,6 +13,7 @@ profile gimp @{exec_path} { include include include + include include #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell From 24e0746efa5cc17f64fe1a09d3c6ab7f4836a616 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 24 Sep 2024 21:46:50 +0100 Subject: [PATCH 0231/1455] fix(profile): libreoffice: support any version of java. fix #520 --- apparmor.d/profiles-g-l/libreoffice | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index b4c07e38b..86efb49a2 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -67,7 +67,7 @@ profile libreoffice @{exec_path} { /usr/share/mythes/{,**} r, /usr/share/thumbnailers/{,**} r, - /etc/java-openjdk/{,**} r, + /etc/java{,@{version}}-openjdk/{,**} r, /etc/libreoffice/{,**} r, /etc/paperspecs r, /etc/xdg/* r, From 457953876aa08037fa631bf4f64dadd2c5bc8790 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 24 Sep 2024 21:49:56 +0100 Subject: [PATCH 0232/1455] feat(profile): improve systemd-dissect --- apparmor.d/groups/systemd/systemd-dissect | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/systemd/systemd-dissect b/apparmor.d/groups/systemd/systemd-dissect index cd3ba97ca..5dc785198 100644 --- a/apparmor.d/groups/systemd/systemd-dissect +++ b/apparmor.d/groups/systemd/systemd-dissect @@ -11,16 +11,22 @@ profile systemd-dissect @{exec_path} flags=(attach_disconnected) { include include include + include capability dac_read_search, capability sys_admin, capability sys_resource, - mount options=(rw, rslave) -> /, - mount options=(rw, nodev) -> /mnt/*/, - mount -> /tmp/dissect-@{rand6}/, + mount options=(rw rshared rslave) -> /, + mount options=(rw nodev) -> /mnt/*/, + mount -> /tmp/dissect-@{rand6}/, + mount options=(ro nodev) /dev/loop* -> @{run}/systemd/dissect-root/, - signal (send) set=(cont) peer=child-pager, + umount @{run}/systemd/dissect-root/, + + signal send set=cont peer=child-pager, + + ptrace read peer=unconfined, @{exec_path} mr, @@ -35,14 +41,19 @@ profile systemd-dissect @{exec_path} flags=(attach_disconnected) { owner @{tmp}/dissect-@{rand6}/{,**} rw, + @{run}/systemd/dissect-root/ rw, + @{run}/systemd/dissect-root/** rwlk, + @{sys}/devices/virtual/block/loop@{int}/{,**} r, @{sys}/kernel/uevent_seqnum r, - @{PROC}/@{pids}/cgroup r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/mountinfo r, /dev/btrfs-control rw, /dev/loop-control rwk, - /dev/loop* rwk, + /dev/loop* rwk, + /dev/mapper/control w, include if exists } From 69f9e8464f7ed74667d4541e4575ac83f8f02a60 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 00:14:02 +0100 Subject: [PATCH 0233/1455] feat(profile): update profiles for gnome 47. --- apparmor.d/abstractions/common/gnome | 1 + apparmor.d/abstractions/desktop | 8 +++----- apparmor.d/abstractions/gnome-strict | 6 ++---- apparmor.d/abstractions/kde-strict | 6 +----- apparmor.d/abstractions/vulkan-strict | 2 ++ apparmor.d/groups/freedesktop/xdg-desktop-portal | 6 +++++- apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome | 6 ++++-- apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk | 9 +++++++-- apparmor.d/groups/gnome/gnome-control-center | 2 ++ .../groups/gnome/gnome-control-center-print-renderer | 1 + apparmor.d/groups/gnome/gnome-shell | 2 ++ apparmor.d/groups/gnome/loupe | 1 + apparmor.d/groups/gnome/nautilus | 1 + apparmor.d/groups/gvfs/gvfsd | 2 ++ apparmor.d/profiles-a-f/appstreamcli | 1 + 15 files changed, 35 insertions(+), 19 deletions(-) diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index c93f9bc05..8fe4d97cd 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -23,6 +23,7 @@ owner @{user_share_dirs}/@{profile_name}/** rwlk, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 50244b3a7..ae585999b 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -13,6 +13,7 @@ include include include + include # if @{DE} == gnome @@ -30,6 +31,8 @@ /var/cache/gio-@{version}/gnome-mimeapps.list r, + owner @{user_share_dirs}/gnome-shell/session.gvdb rw, + # else if @{DE} == kde @{lib}/kde{,3,4}/*.so mr, @@ -71,11 +74,6 @@ /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, - owner @{HOME}/.local/ rw, - owner @{user_cache_dirs}/ rw, - owner @{user_config_dirs}/ rw, - owner @{user_share_dirs}/ rw, - include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 74df87344..833aaa59b 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -7,6 +7,7 @@ include include include + include dbus receive bus=session interface=org.freedesktop.DBus.Introspectable @@ -26,10 +27,7 @@ /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r, - owner @{HOME}/.local/ rw, - owner @{user_cache_dirs}/ rw, - owner @{user_config_dirs}/ rw, - owner @{user_share_dirs}/ rw, + owner @{user_share_dirs}/gnome-shell/session.gvdb rw, include if exists diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index f31a38617..11e897aba 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -7,6 +7,7 @@ include include include + include @{lib}/kde{,3,4}/*.so mr, @{lib}/kde{,3,4}/plugins/*/ r, @@ -22,11 +23,6 @@ /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, - owner @{HOME}/.local/ rw, - owner @{user_cache_dirs}/ rw, - owner @{user_config_dirs}/ rw, - owner @{user_share_dirs}/ rw, - owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/ksycoca{5,6}_??_* rwlk, diff --git a/apparmor.d/abstractions/vulkan-strict b/apparmor.d/abstractions/vulkan-strict index 5210a48e2..7dbb8f424 100644 --- a/apparmor.d/abstractions/vulkan-strict +++ b/apparmor.d/abstractions/vulkan-strict @@ -14,6 +14,8 @@ /etc/vulkan/icd.d/{,*.json} r, /etc/vulkan/implicit_layer.d/{,*.json} r, + owner @{user_cache_dirs}/gtk-4.0/vulkan-pipeline-cache/.goutputstream-@{rand6} rw, + owner @{user_cache_dirs}/gtk-4.0/vulkan-pipeline-cache/@{uuid}.@{int} rw, owner @{user_cache_dirs}/radv_builtin_shaders{32,64} r, # Vulkan radv shaders cache owner @{user_share_dirs}/vulkan/ rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index d8929cfb1..720d794b7 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -21,13 +21,16 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { include include include + include include capability sys_ptrace, network netlink raw, - ptrace (read), + ptrace read, + + signal receive set=term peer=gdm, #aa:dbus own bus=session name=org.freedesktop.portal.Desktop path=/org/freedesktop/portal/desktop interface={org.freedesktop.DBus.Properties,org.freedesktop{,.impl}.portal.{Settings,Background}} dbus receive bus=session path=/org/freedesktop/portal/desktop @@ -63,6 +66,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/xdg-desktop-portal/** r, + /usr/share/gdm/greeter-dconf-defaults r, /etc/sysconfig/proxy r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 586828ee0..02cf99b01 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -38,13 +38,15 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { / r, @{bin}/ r, @{bin}/* r, - /opt/*/* r, + /opt/** r, /usr/share/dconf/profile/gdm r, + /usr/share/gdm/greeter-dconf-defaults r, /usr/share/thumbnailers/{,**} r, - owner @{DESKTOP_HOME}/greeter-dconf-defaults r, + owner @{desktop_cache_dirs}/dconf/user r, owner @{desktop_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rw, + owner @{DESKTOP_HOME}/greeter-dconf-defaults r, owner @{HOME}/ r, owner @{HOME}/* r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index c21b955d0..9eaea73aa 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/xdg-desktop-portal-gtk -profile xdg-desktop-portal-gtk @{exec_path} { +profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include include include @@ -27,7 +27,8 @@ profile xdg-desktop-portal-gtk @{exec_path} { include include include - include + + signal receive set=term peer=gdm, unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/*", label=gnome-shell), @@ -53,10 +54,14 @@ profile xdg-desktop-portal-gtk @{exec_path} { @{exec_path} mr, + /usr/share/gdm/greeter-dconf-defaults r, + / r, owner /var/lib/xkb/server-@{int}.xkm rw, + owner @{gdm_config_dirs}/dconf/user r, + owner @{tmp}/runtime-*/xauth_@{rand6} r, @{run}/mount/utab r, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 154aff58c..b0006d774 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -103,6 +103,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { /var/cache/samba/ rw, /var/lib/AccountsService/icons/* r, + / r, + owner @{HOME}/.cat_installer/ca.pem r, owner @{HOME}/.cert/nm-openvpn/*.pem r, owner @{HOME}/.face r, diff --git a/apparmor.d/groups/gnome/gnome-control-center-print-renderer b/apparmor.d/groups/gnome/gnome-control-center-print-renderer index 22784f1d5..db68c40b5 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-print-renderer +++ b/apparmor.d/groups/gnome/gnome-control-center-print-renderer @@ -24,6 +24,7 @@ profile gnome-control-center-print-renderer @{exec_path} { / r, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index c72652065..c492cf3fd 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -409,6 +409,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/local/bin/** PUx, /usr/games/** PUx, + owner @{user_share_dirs}/gnome-shell/session.gvdb rw, + owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index a90f8664f..56c4a2c5d 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -40,6 +40,7 @@ profile loupe @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 3e597c156..f9be02d9d 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -110,6 +110,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/tty rw, diff --git a/apparmor.d/groups/gvfs/gvfsd b/apparmor.d/groups/gvfs/gvfsd index 710abbba1..c31c1038f 100644 --- a/apparmor.d/groups/gvfs/gvfsd +++ b/apparmor.d/groups/gvfs/gvfsd @@ -13,6 +13,8 @@ profile gvfsd @{exec_path} { include include + signal receive set=usr1 peer=pacman, + #aa:dbus own bus=session name=org.gtk.vfs.Daemon #aa:dbus own bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker diff --git a/apparmor.d/profiles-a-f/appstreamcli b/apparmor.d/profiles-a-f/appstreamcli index 6b6bad8d8..25f4ff40c 100644 --- a/apparmor.d/profiles-a-f/appstreamcli +++ b/apparmor.d/profiles-a-f/appstreamcli @@ -24,6 +24,7 @@ profile appstreamcli @{exec_path} flags=(complain) { /usr/share/app-info/{,**} r, /usr/share/appdata/ r, + /usr/share/gvfs/remote-volume-monitors/{,**} r, /usr/share/metainfo/ r, /usr/share/metainfo/*.{metainfo,appdata}.xml r, /usr/share/swcatalog/{,**} r, From 156cce5362ab7914c8bddd0ead505e9281c9bcab Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 00:48:42 +0100 Subject: [PATCH 0234/1455] feat(profile): restrict dbus in dbus even dbus-* profiles do not need access to the full bus. --- apparmor.d/groups/bus/dbus-accessibility | 3 +-- apparmor.d/groups/bus/dbus-session | 2 +- apparmor.d/groups/bus/dbus-system | 2 +- apparmor.d/tunables/multiarch.d/system | 2 +- 4 files changed, 4 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index 1c5f8cd30..0f43955e8 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -25,8 +25,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term hup kill) peer=dbus-session, signal (receive) set=(term hup kill) peer=gdm{,-session-worker}, - dbus bus=accessibility, - + #aa:dbus own bus=accessibility name=org.freedesktop.DBus #aa:dbus own bus=session name=org.a11y.{B,b}us dbus receive bus=session diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index fa6305055..99467d9f5 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -29,7 +29,7 @@ profile dbus-session flags=(attach_disconnected) { signal (send) set=(term hup kill) peer=dconf-service, signal (send) set=(term hup kill) peer=xdg-*, - dbus bus=session, + #aa:dbus own bus=session name=org.freedesktop.DBus @{exec_path} mrix, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index f532bb29b..d6c92bae1 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -32,7 +32,7 @@ profile dbus-system flags=(attach_disconnected) { ptrace (read) peer=@{p_systemd}, - dbus bus=system, + #aa:dbus own bus=system name=org.freedesktop.DBus @{exec_path} mrix, diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index d51ede6ca..95e42888c 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -120,7 +120,7 @@ @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 # Dbus unique name -@{busname}=:1.@{u16} +@{busname}=:1.@{u16} :not.active.yet # Common architecture names @{arch}=x86_64 amd64 i386 i686 From 90a8e44d208987a116f7185b5ee2aa1d17232bd3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 13:05:35 +0100 Subject: [PATCH 0235/1455] feat(tunable): add more system vars. --- apparmor.d/tunables/multiarch.d/system | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 95e42888c..40f56216d 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -5,17 +5,20 @@ # To allow extended personalisation without breaking everything. # All apparmor profiles should always use the variables defined here. -# Single hexadecimal character -@{h}=[0-9a-fA-F] +# Any digit +@{d}=[0-9] + +# Any letter +@{l}=[a-zA-Z] # Single alphanumeric character @{c}=[0-9a-zA-Z] -# Word character. Matches any letter, digit or underscore. +# Word character: matches any letter, digit or underscore. @{w}=[a-zA-Z0-9_] -# Any digit -@{d}=[0-9] +# Single hexadecimal character +@{h}=[0-9a-fA-F] # Integer up to 10 digits (0-9999999999) @{int}=@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},} @@ -37,7 +40,10 @@ @{int4}=@{int2}@{int2} @{int6}=@{int4}@{int2} @{int8}=@{int4}@{int4} +@{int9}=@{int8}@{d} @{int10}=@{int8}@{int2} +@{int12}=@{int8}@{int4} +@{int15}=@{int8}@{int4}@{int2}@{d} @{int16}=@{int8}@{int8} @{int32}=@{int16}@{int16} @{int64}=@{int32}@{int32} From 28b32f1ae381affe9164ccaa842c411fd08072e3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 14:00:29 +0100 Subject: [PATCH 0236/1455] feat(profile): restrict some access to @{PROC}/@{pid}. --- apparmor.d/abstractions/app/chromium | 16 ++++++++-------- apparmor.d/groups/bus/dbus-accessibility | 9 +++++---- apparmor.d/groups/gnome/gnome-session-binary | 3 ++- apparmor.d/groups/gnome/gnome-shell | 10 +++++----- apparmor.d/groups/gnome/gnome-software | 3 ++- apparmor.d/groups/gnome/gsd-datetime | 3 +++ apparmor.d/groups/gnome/gsd-sharing | 3 ++- .../groups/gnome/org.gnome.NautilusPreviewer | 3 ++- apparmor.d/profiles-a-f/alacarte | 1 + apparmor.d/profiles-m-r/protonmail-bridge-core | 2 +- 10 files changed, 31 insertions(+), 22 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 3fa7005a6..0aa8f5ef1 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -182,14 +182,15 @@ @{PROC}/ r, @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pids}/stat r, - @{PROC}/@{pids}/statm r, - @{PROC}/@{pids}/task/@{tid}/stat r, - @{PROC}/@{pids}/task/@{tid}/status r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/task/@{tid}/status r, @{PROC}/pressure/{memory,cpu,io} r, @{PROC}/sys/fs/inotify/max_user_watches r, @{PROC}/sys/kernel/yama/ptrace_scope r, @{PROC}/vmstat r, + owner @{PROC}/@{pid}/clear_refs w, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/environ r, owner @{PROC}/@{pid}/gid_map w, owner @{PROC}/@{pid}/limits r, owner @{PROC}/@{pid}/mem r, @@ -197,12 +198,11 @@ owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_{,score_}adj rw, owner @{PROC}/@{pid}/setgroups w, + owner @{PROC}/@{pid}/statm r, + owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{PROC}/@{pid}/task/@{tid}/stat r, owner @{PROC}/@{pid}/uid_map w, - owner @{PROC}/@{pids}/clear_refs w, - owner @{PROC}/@{pids}/cmdline r, - owner @{PROC}/@{pids}/environ r, - owner @{PROC}/@{pids}/task/ r, /dev/ r, /dev/hidraw@{int} rw, diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index 0f43955e8..bf6a680a2 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -64,12 +64,13 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { @{sys}/kernel/security/apparmor/features/dbus/mask r, @{sys}/module/apparmor/parameters/enabled r, - @{PROC}/@{pid}/attr/apparmor/current r, - @{PROC}/@{pid}/cgroup r, - @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pid}/oom_score_adj r, + @{PROC}/1/cgroup r, + owner @{PROC}/@{pid}/attr/apparmor/current r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/oom_score_adj r, owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 795153fb1..25be8038c 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -91,9 +91,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { @{sys}/devices/**/{vendor,device} r, - @{PROC}/@{pid}/cgroup r, + @{PROC}/1/cgroup r, @{PROC}/cmdline r, @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index c492cf3fd..db004062c 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -347,23 +347,23 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/cpu.max r, @{PROC}/ r, - @{PROC}/@{pid}/attr/current r, - @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/net/* r, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/task/@{tid}/stat r, - @{PROC}/@{pids}/cmdline r, @{PROC}/1/cgroup r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, @{PROC}/vmstat r, + owner @{PROC}/@{pid}/attr/current r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{pid}/cmdline r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{PROC}/@{pid}/task/@{tid}/stat r, /dev/input/event@{int} rw, /dev/media@{int} rw, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index dbd07fe7d..343205e12 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -117,10 +117,11 @@ profile gnome-software @{exec_path} { @{sys}/module/nvidia/version r, - @{PROC}/@{pid}/cgroup r, @{PROC}/@{pids}/mounts r, + @{PROC}/1/cgroup r, @{PROC}/sys/fs/pipe-max-size r, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/gnome/gsd-datetime b/apparmor.d/groups/gnome/gsd-datetime index 5c3b768fc..db829825b 100644 --- a/apparmor.d/groups/gnome/gsd-datetime +++ b/apparmor.d/groups/gnome/gsd-datetime @@ -43,6 +43,9 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) { @{run}/systemd/sessions/@{int} r, @{run}/systemd/users/@{uid} r, + + @{PROC}/1/cgroup r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/gnome/gsd-sharing b/apparmor.d/groups/gnome/gsd-sharing index 4ba613fb7..83a444c7d 100644 --- a/apparmor.d/groups/gnome/gsd-sharing +++ b/apparmor.d/groups/gnome/gsd-sharing @@ -41,7 +41,8 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) { @{run}/systemd/sessions/* r, @{run}/systemd/users/@{uid} r, - @{PROC}/@{pid}/cgroup r, + @{PROC}/1/cgroup r, + owner @{PROC}/@{pid}/cgroup r, owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index cc08462e8..15a9170cd 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -43,9 +43,10 @@ profile org.gnome.NautilusPreviewer @{exec_path} { @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.NautilusPreviewer.slice/*/memory.* r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r, + @{PROC}/1/cgroup r, @{PROC}/devices r, - @{PROC}/@{pid}/cgroup r, @{PROC}/zoneinfo r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/profiles-a-f/alacarte b/apparmor.d/profiles-a-f/alacarte index 80e64558a..e1e228618 100644 --- a/apparmor.d/profiles-a-f/alacarte +++ b/apparmor.d/profiles-a-f/alacarte @@ -30,6 +30,7 @@ profile alacarte @{exec_path} { owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mounts r, include if exists diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index 89330c819..d9f0facb5 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -44,8 +44,8 @@ profile protonmail-bridge-core @{exec_path} { owner /var/tmp/etilqs_@{hex16} rw, @{PROC}/ r, + @{PROC}/1/cgroup r, @{PROC}/sys/net/core/somaxconn r, - @{PROC}/@{pid}/cgroup r, deny @{bin}/pass x, deny owner @{user_password_store_dirs}/** r, From 8fb767a5f9cfebdabad7caa49d1308fb812706c6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 15:14:16 +0100 Subject: [PATCH 0237/1455] feat(abs): add user-data abstraction. Warning: experiemental, only for abi 4+, requires a prompting client. See: https://discourse.ubuntu.com/t/ubuntu-desktop-s-24-10-dev-cycle-part-5-introducing-permissions-prompting/47963 --- apparmor.d/abstractions/user-data | 49 +++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 apparmor.d/abstractions/user-data diff --git a/apparmor.d/abstractions/user-data b/apparmor.d/abstractions/user-data new file mode 100644 index 000000000..6406b3e84 --- /dev/null +++ b/apparmor.d/abstractions/user-data @@ -0,0 +1,49 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Gives access to non-hidden files in user's $HOME. +# Warning: experiemental, only for abi 4+, requires a prompting client. + + abi , + + # Allow accessing the GNOME crypto services prompt APIs as used by + # applications using libgcr (such as pinentry-gnome3) for secure pin + # entry to unlock GPG keys etc. See: + # https://developer.gnome.org/gcr/unstable/GcrPrompt.html + # https://developer.gnome.org/gcr/unstable/GcrSecretExchange.html + # https://github.com/snapcore/snapd/pull/7673#issuecomment-592229711 + dbus send bus=session path=/org/gnome/keyring/Prompter + interface=org.gnome.keyring.internal.Prompter + member={BeginPrompting,PerformPrompt,StopPrompting} + peer=(name="{@{busname}", label=pinentry-*), + dbus receive bus=session path=/org/gnome/keyring/Prompt/p@{int} + interface=org.gnome.keyring.internal.Prompter.Callback + member={PromptReady,PromptDone} + peer=(name="{@{busname}", label=pinentry-*), + + # Allow read access to toplevel $HOME & mounts for the user. + prompt owner @{HOME}/ r, + prompt owner @{MOUNTS}/ r, + + # Allow read/write access to all files in @{HOME}, except snap application + # data in @{HOME}/snap and toplevel hidden directories in @{HOME}. + prompt owner @{HOME}/[^s.]** rwlk, + prompt owner @{HOME}/s[^n]** rwlk, + prompt owner @{HOME}/sn[^a]** rwlk, + prompt owner @{HOME}/sna[^p]** rwlk, + prompt owner @{HOME}/snap[^/]** rwlk, + prompt owner @{HOME}/{s,sn,sna}{,/} rwlk, + + # Allow access to mounts (/mnt/*/, /media/*/, @{run}/media/@{user}/*/, gvfs) + # for non-hidden files owned by the user. + prompt owner @{MOUNTS}/[^.]** rwlk, + + # Disallow writes to the well-known directory included in + # the user's PATH on several distributions + audit deny @{HOME}/bin/{,**} wl, + audit deny @{HOME}/bin wl, + + include if exists + +# vim:syntax=apparmor From bbd06dcabd2d7f8cb901a55a5587e1d1128bd87b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 22:33:32 +0100 Subject: [PATCH 0238/1455] doc: add git-committers extension. --- mkdocs.yml | 3 +++ requirements.txt | 1 + 2 files changed, 4 insertions(+) diff --git a/mkdocs.yml b/mkdocs.yml index 67d8cc5a8..2db8677a1 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -69,6 +69,9 @@ plugins: fallback_to_build_date: true - minify: minify_html: true + - git-committers: + repository: roddhjav/apparmor.d + branch: main # Customization extra: diff --git a/requirements.txt b/requirements.txt index 8be8158d5..d30bccf19 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,5 @@ mkdocs +mkdocs-git-committers-plugin-2 mkdocs-git-revision-date-localized-plugin mkdocs-material mkdocs-minify-plugin From e3a5812bfbd374b5d7d3aa0771d76cf278e4c975 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 23:17:44 +0100 Subject: [PATCH 0239/1455] doc: add man page for aa-log. --- Makefile | 15 ++++-- dists/apparmor.d.spec | 2 + root/usr/share/man/man8/aa-log.8 | 79 ++++++++++++++++++++++++++++++ root/usr/share/man/man8/aa-log.md | 80 +++++++++++++++++++++++++++++++ 4 files changed, 173 insertions(+), 3 deletions(-) create mode 100644 root/usr/share/man/man8/aa-log.8 create mode 100644 root/usr/share/man/man8/aa-log.md diff --git a/Makefile b/Makefile index 85a4a7190..88febbb5e 100644 --- a/Makefile +++ b/Makefile @@ -9,7 +9,7 @@ PKGDEST := /tmp/pkg PKGNAME := apparmor.d P = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*))) -.PHONY: all build enforce full install local $(P) pkg dpkg rpm tests lint clean +.PHONY: all build enforce full install local $(P) pkg dpkg rpm tests lint man docs serve clean all: build @./${BUILD}/prebuild --complain @@ -24,7 +24,7 @@ enforce: build full: build @./${BUILD}/prebuild --complain --full -ROOT = $(shell find "${BUILD}/root" -type f -printf "%P\n") +ROOT = $(shell find "${BUILD}/root" -type f -not -name "*.md" -printf "%P\n") PROFILES = $(shell find "${BUILD}/apparmor.d" -type f -printf "%P\n") DISABLES = $(shell find "${BUILD}/apparmor.d" -type l -printf "%P\n") install: @@ -56,7 +56,7 @@ local: ABSTRACTIONS = $(shell find ${BUILD}/apparmor.d/abstractions/ -type f -printf "%P\n") TUNABLES = $(shell find ${BUILD}/apparmor.d/tunables/ -type f -printf "%P\n") $(P): - @[ -f ${BUILD}/aa-log ] || exit 0; install -Dm755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log + @install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log @for file in ${ABSTRACTIONS}; do \ install -Dm0644 "${BUILD}/apparmor.d/abstractions/$${file}" "${DESTDIR}/etc/apparmor.d/abstractions/$${file}"; \ done; @@ -99,6 +99,15 @@ lint: tests/packer/init/init.sh tests/packer/src/aa-update tests/packer/init/clean.sh \ debian/${PKGNAME}.postinst debian/${PKGNAME}.postrm +man: + pandoc -t man -s -o root/usr/share/man/man8/aa-log.8 root/usr/share/man/man8/aa-log.md + +docs: + ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=true mkdocs build --strict + +serve: + ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=false mkdocs serve + clean: @rm -rf \ debian/.debhelper debian/debhelper* debian/*.debhelper debian/${PKGNAME} \ diff --git a/dists/apparmor.d.spec b/dists/apparmor.d.spec index b00b12eca..339d88036 100644 --- a/dists/apparmor.d.spec +++ b/dists/apparmor.d.spec @@ -51,4 +51,6 @@ systemctl is-active -q apparmor && systemctl reload apparmor ||: %dir /usr/share/zsh/site-functions /usr/share/zsh/site-functions/_aa-log.zsh +%doc %{_mandir}/man8/aa-log.8.gz + %changelog diff --git a/root/usr/share/man/man8/aa-log.8 b/root/usr/share/man/man8/aa-log.8 new file mode 100644 index 000000000..42c9a3560 --- /dev/null +++ b/root/usr/share/man/man8/aa-log.8 @@ -0,0 +1,79 @@ +.\" Automatically generated by Pandoc 3.1.9 +.\" +.TH "aa-log" "8" "September 2024" "" "" +.SH NAME +aa-log \[em] Review AppArmor generated messages in a colorful way. +.SH SYNOPSIS +\f[B]aa-log\f[R] [\f[I]options\&...\f[R]] [\f[I]profile\f[R]] +.SH DESCRIPTION +Review AppArmor generated messages in a colourful way. +Support logs from \f[I]auditd\f[R], \f[I]systemd\f[R], \f[I]syslog\f[R] +as well as \f[I]dbus session\f[R] events. +.PP +It can be given an optional profile name to filter the output with. +.PP +It can be used to generate AppArmor rules from the logs and it therefore +an alternative to \f[CR]aa-logprof(8)\f[R]. +The generated rules should be manually reviewed and inserted into the +profile. +.PP +Default logs are read from \f[CR]/var/log/audit/audit.log\f[R]. +Other files in \f[CR]/var/log/audit/\f[R] can easily be checked: +\f[B]aa-log -f 1\f[R] parses \f[CR]audit.log.1\f[R] +.SH OPTIONS +\f[B]aa-log\f[R] [\f[I]options\&...\f[R]] [\f[I]profile\f[R]] +.TP +[\f[I]profile\f[R]] +Optional profile name to filter the output with. +.TP +\f[CR]--file\f[R], \f[CR]-f\f[R] +Set a logfile or a suffix to the default log file. +.TP +\f[CR]--systemd\f[R], \f[CR]-s\f[R] +Parse systemd logs from journalctl. +Provides all AppArmor logs since the last boot. +.TP +\f[CR]--rules\f[R], \f[CR]-r\f[R] +Convert the log into AppArmor rules. +.TP +\f[CR]--raw\f[R], \f[CR]-R\f[R] +Print the raw log without any formatting. +Useful for reporting logs. +.TP +\f[CR]--help\f[R], \f[CR]-h\f[R] +Print the program usage. +.SH USAGE +To read the AppArmor log from \f[CR]/var/log/audit/audit.log\f[R]: +.IP +.EX +aa-log +.EE +.PP +To optionally filter a given profile name: +\f[CR]aa-log \f[R] (your shell will autocomplete the +profile name): +.IP +.EX +$ aa-log dnsmasq +DENIED dnsmasq open /proc/sys/kernel/osrelease comm=dnsmasq requested_mask=r denied_mask=r +DENIED dnsmasq open /proc/1/environ comm=dnsmasq requested_mask=r denied_mask=r +DENIED dnsmasq open /proc/cmdline comm=dnsmasq requested_mask=r denied_mask=r +.EE +.PP +To generate AppArmor rule: +.IP +.EX +$ aa-log -r dnsmasq +profile dnsmasq { + \[at]{PROC}/\[at]{pid}/environ r, + \[at]{PROC}/cmdline r, + \[at]{PROC}/sys/kernel/osrelease r, +} +.EE +.SH SEE ALSO +\f[CR]aa-logprof(8)\f[R], \f[CR]apparmor(7)\f[R], +\f[CR]apparmor.d(5)\f[R], \f[CR]aa-genprof(1)\f[R], +\f[CR]aa-enforce(1)\f[R], \f[CR]aa-complain(1)\f[R], +\f[CR]aa-disable(1)\f[R], and https://apparmor.pujol.io. +.SH AUTHORS +aa-log was written by Alexandre Pujol (alexandre\[at]pujol.io). diff --git a/root/usr/share/man/man8/aa-log.md b/root/usr/share/man/man8/aa-log.md new file mode 100644 index 000000000..0b7fe8afa --- /dev/null +++ b/root/usr/share/man/man8/aa-log.md @@ -0,0 +1,80 @@ +% aa-log(8) +% aa-log was written by Alexandre Pujol (alexandre@pujol.io) +% September 2024 + +# NAME + +aa-log — Review AppArmor generated messages in a colorful way. + +# SYNOPSIS + +**aa-log** [*options…*] [*profile*] + +# DESCRIPTION + +Review AppArmor generated messages in a colourful way. Support logs from *auditd*, *systemd*, *syslog* as well as *dbus session* events. + +It can be given an optional profile name to filter the output with. + +It can be used to generate AppArmor rules from the logs and it therefore an alternative to `aa-logprof(8)`. The generated rules should be manually reviewed and inserted into the profile. + +Default logs are read from `/var/log/audit/audit.log`. Other files in `/var/log/audit/` can easily be checked: **aa-log -f 1** parses `audit.log.1` + +# OPTIONS + +**aa-log** [*options…*] [*profile*] + +[*profile*] + +: Optional profile name to filter the output with. + +`--file`, `-f` + +: Set a logfile or a suffix to the default log file. + +`--systemd`, `-s` + +: Parse systemd logs from journalctl. Provides all AppArmor logs since the last boot. + +`--rules`, `-r` + +: Convert the log into AppArmor rules. + +`--raw`, `-R` + +: Print the raw log without any formatting. Useful for reporting logs. + +`--help`, `-h` + +: Print the program usage. + + +# USAGE + +To read the AppArmor log from `/var/log/audit/audit.log`: +```sh +aa-log +``` + +To optionally filter a given profile name: `aa-log ` (your shell will autocomplete the profile name): +``` +$ aa-log dnsmasq +DENIED dnsmasq open /proc/sys/kernel/osrelease comm=dnsmasq requested_mask=r denied_mask=r +DENIED dnsmasq open /proc/1/environ comm=dnsmasq requested_mask=r denied_mask=r +DENIED dnsmasq open /proc/cmdline comm=dnsmasq requested_mask=r denied_mask=r +``` + +To generate AppArmor rule: +``` +$ aa-log -r dnsmasq +profile dnsmasq { + @{PROC}/@{pid}/environ r, + @{PROC}/cmdline r, + @{PROC}/sys/kernel/osrelease r, +} +``` + +# SEE ALSO + +`aa-logprof(8)`, `apparmor(7)`, `apparmor.d(5)`, `aa-genprof(1)`, `aa-enforce(1)`, `aa-complain(1)`, `aa-disable(1)`, and +https://apparmor.pujol.io. From 91fc3adb632105617527a791182243cee3b41033 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Sep 2024 23:19:54 +0100 Subject: [PATCH 0240/1455] docs: update known issues. --- docs/issues.md | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/docs/issues.md b/docs/issues.md index d9f28cfe6..1db3b195a 100644 --- a/docs/issues.md +++ b/docs/issues.md @@ -2,18 +2,19 @@ title: Known issues --- -Known bugs are tracked on the meta issue **[#75](https://github.com/roddhjav/apparmor.d/issues/74)**. +!!! info -!!! info + Known bugs are tracked on the meta issue **[#75](https://github.com/roddhjav/apparmor.d/issues/74)**. - Usually, a profile in complain mode cannot break the program it confines. - However, there are some **major exceptions**: +## Complain mode - * `deny` rules are enforced even in complain mode, - * `attach_disconnected` (and `mediate_deleted`) will break the program if they are required and missing in the profile, - * If AppArmor does not find the profile to transition `rPx`. +A profile in *complain* mode cannot break the program it confines. However, there are some **major exceptions**: -### Pacman "could not get current working directory" +1. `deny` rules are enforced even in *complain* mode, +2. `attach_disconnected` (and `mediate_deleted`) will break the program if they are required and missing in the profile, +3. If AppArmor does not find the profile to transition `rPx`. + +## Pacman "could not get current working directory" ```sh $ sudo pacman -Syu @@ -30,15 +31,3 @@ According to the Arch Linux guideline, on Arch Linux, packages cannot install fi This provides a basic protection against some packages (on the AUR) that may have rogue install script. [pacman]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/pacman/pacman - - -### Gnome can be very slow to start. - -[Gnome](https://github.com/roddhjav/apparmor.d/issues/80) can be slow to start. This is a known bug, help is very welcome. - -The complexity is that: - -- It works fine without AppArmor -- It works fine on most system (including test VM) -- It seems to be dbus related -- On archlinux, the dbus mediation is not enabled. So, there is nothing special to allow. From 779377ce4cbfac3a991be4f595131f96682fb345 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Thu, 26 Sep 2024 13:33:27 +0300 Subject: [PATCH 0241/1455] Get images from a scanner --- apparmor.d/profiles-g-l/gimp | 5 +++- apparmor.d/profiles-s-z/xsane-gimp | 38 ++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/profiles-s-z/xsane-gimp diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index fe69ad91c..040af8fac 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -16,6 +16,8 @@ profile gimp @{exec_path} { include include + signal (send) set=(term, kill) peer=xsane-gimp, + #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @@ -23,7 +25,8 @@ profile gimp @{exec_path} { @{lib}/gimp/*/plug-ins/** rix, - @{open_path} rPx -> child-open-help, + @{bin}/xsane-gimp rPx, + @{open_path} rPx -> child-open-help, /usr/share/gimp/{,**} r, /usr/share/mypaint-data/{,**} r, diff --git a/apparmor.d/profiles-s-z/xsane-gimp b/apparmor.d/profiles-s-z/xsane-gimp new file mode 100644 index 000000000..94312bff2 --- /dev/null +++ b/apparmor.d/profiles-s-z/xsane-gimp @@ -0,0 +1,38 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/xsane-gimp +profile xsane-gimp /{,usr/}{,s}bin/xsane-gimp { + include + include + include + + signal (receive) set=(term, kill) peer=gimp, + + network inet dgram, + network inet6 dgram, + network netlink raw, + + @{exec_path} mr, + @{system_share_dirs}/gimp/{,**} r, + @{system_share_dirs}/sane/xsane/{,**} r, + @{system_share_dirs}/snmp/mibs/{,**} r, # network + /etc/sane.d/{,**} r, + owner @{HOME}/.sane/{,**} rw, + owner @{tmp}/xsane-* rw, + @{sys}/devices/@{pci}/{model,type,vendor} r, + @{PROC}/sys/dev/parport/{,parport@{int}/{base-addr,irq}} r, + + # SCSI + @{sys}/bus/scsi/devices/ r, + @{PROC}/scsi/scsi r, + + include if exists +} + +# vim:syntax=apparmor From f70e17da33a5dc969a5716db189346022a4ea69f Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Thu, 26 Sep 2024 15:06:14 +0300 Subject: [PATCH 0242/1455] Changed the profile attachment to the variable --- apparmor.d/profiles-s-z/xsane-gimp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/xsane-gimp b/apparmor.d/profiles-s-z/xsane-gimp index 94312bff2..edbded62a 100644 --- a/apparmor.d/profiles-s-z/xsane-gimp +++ b/apparmor.d/profiles-s-z/xsane-gimp @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/xsane-gimp -profile xsane-gimp /{,usr/}{,s}bin/xsane-gimp { +profile xsane-gimp @{exec_path} { include include include From e16ade603a72c2de826ea0b39fc17aca8bcb469b Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Thu, 26 Sep 2024 15:07:48 +0300 Subject: [PATCH 0243/1455] Includes have been sorted alphabetically --- apparmor.d/profiles-s-z/xsane-gimp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/xsane-gimp b/apparmor.d/profiles-s-z/xsane-gimp index edbded62a..a18ce3152 100644 --- a/apparmor.d/profiles-s-z/xsane-gimp +++ b/apparmor.d/profiles-s-z/xsane-gimp @@ -9,8 +9,8 @@ include @{exec_path} = @{bin}/xsane-gimp profile xsane-gimp @{exec_path} { include - include include + include signal (receive) set=(term, kill) peer=gimp, From 03e974525e5991bbf7ce046d6145162e28de9b7d Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Thu, 26 Sep 2024 15:27:16 +0300 Subject: [PATCH 0244/1455] Narrowed the temporary file permission --- apparmor.d/profiles-s-z/xsane-gimp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/xsane-gimp b/apparmor.d/profiles-s-z/xsane-gimp index a18ce3152..1ae25a35e 100644 --- a/apparmor.d/profiles-s-z/xsane-gimp +++ b/apparmor.d/profiles-s-z/xsane-gimp @@ -24,7 +24,7 @@ profile xsane-gimp @{exec_path} { @{system_share_dirs}/snmp/mibs/{,**} r, # network /etc/sane.d/{,**} r, owner @{HOME}/.sane/{,**} rw, - owner @{tmp}/xsane-* rw, + owner @{tmp}/xsane-*-@{rand6} rw, @{sys}/devices/@{pci}/{model,type,vendor} r, @{PROC}/sys/dev/parport/{,parport@{int}/{base-addr,irq}} r, From 5d14ff8e5cd66379d7807470b16919c23efbe4b8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 20:20:20 +0100 Subject: [PATCH 0245/1455] ci: set token for git-committers --- .gitlab-ci.yml | 2 +- mkdocs.yml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index ffc9dded0..7737e2d3c 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -190,7 +190,7 @@ pages: GIT_DEPTH: 0 script: - pip install -r requirements.txt - - mkdocs build --strict --site-dir public + - mkdocs build --site-dir public artifacts: paths: - public diff --git a/mkdocs.yml b/mkdocs.yml index 2db8677a1..404905913 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -64,12 +64,13 @@ plugins: - offline: enabled: !ENV [MKDOCS_OFFLINE, true] - git-revision-date-localized: - enabled: !ENV [ENABLED_GIT_REVISION_DATE, True] + enabled: !ENV [ENABLED_GIT_REVISION_DATE, true] enable_creation_date: true fallback_to_build_date: true - minify: minify_html: true - git-committers: + token: !ENV [MKDOCS_GIT_COMMITTERS_APIKEY] repository: roddhjav/apparmor.d branch: main From fbb0d62aee272dc56d613f1dc24a7f58e2b2259b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 20:21:48 +0100 Subject: [PATCH 0246/1455] fix(profile): ensure sandboxed app ca write font cache. --- apparmor.d/abstractions/common/app | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 777518f3d..5c8ebd21f 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -20,7 +20,7 @@ include include include - include + include include include include From 3f13aa77bfd668f3f36b615b39a2598f451b6024 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 20:29:33 +0100 Subject: [PATCH 0247/1455] feat(profile): update some dbus rules. --- .../bus/org.freedesktop.NetworkManager | 14 ++------------ .../abstractions/bus/org.freedesktop.UPower | 2 +- apparmor.d/groups/bus/dbus-session | 2 +- apparmor.d/groups/gnome/gnome-shell | 8 ++------ apparmor.d/groups/gnome/nautilus | 5 ----- apparmor.d/groups/gnome/yelp | 4 ++++ apparmor.d/groups/gvfs/gvfsd-dnssd | 1 + apparmor.d/groups/ubuntu/update-manager | 1 + apparmor.d/groups/ubuntu/update-notifier | 19 +------------------ apparmor.d/profiles-a-f/atril | 8 +------- 10 files changed, 14 insertions(+), 50 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager index 128f07fe5..61f27fca5 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager @@ -7,9 +7,9 @@ member=GetManagedObjects peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), - dbus send bus=system path=/org/freedesktop/NetworkManager + dbus send bus=system path=/org/freedesktop/NetworkManager{,/**} interface=org.freedesktop.DBus.Properties - member=GetAll + member={Get,GetAll} peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager @@ -27,16 +27,6 @@ member=GetSettings peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), - dbus send bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/@{int} - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), - - dbus send bus=system path=/org/freedesktop/NetworkManager/Devices/@{int} - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), - dbus send bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.DBus.Introspectable member=Introspect diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower b/apparmor.d/abstractions/bus/org.freedesktop.UPower index 247e2ddda..148db02d7 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower +++ b/apparmor.d/abstractions/bus/org.freedesktop.UPower @@ -26,7 +26,7 @@ member={Get,GetAll} peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), - dbus send bus=system path=/org/freedesktop/UPower/devices/* + dbus send bus=system path=/org/freedesktop/UPower{,/**} interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index 99467d9f5..af961be6d 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -29,7 +29,7 @@ profile dbus-session flags=(attach_disconnected) { signal (send) set=(term hup kill) peer=dconf-service, signal (send) set=(term hup kill) peer=xdg-*, - #aa:dbus own bus=session name=org.freedesktop.DBus + #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/DBus} @{exec_path} mrix, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index db004062c..04f90e33a 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -73,8 +73,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus own bus=session name=org.gnome.Mutter #aa:dbus own bus=session name=org.gnome.Shell - #aa:dbus own bus=session name=com.canonical.Unity path=/com/canonical/{U,u}nity + #aa:dbus own bus=session name=com.canonical.{U,u}nity #aa:dbus own bus=session name=com.rastersoft.dingextension + #aa:dbus own bus=session name=org.ayatana.NotificationItem #aa:dbus own bus=session name=org.gtk.Actions path=/** #aa:dbus own bus=session name=org.gtk.MountOperationHandler #aa:dbus own bus=session name=org.gtk.Notifications @@ -133,11 +134,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { member=Embed peer=(name=org.a11y.atspi.Registry), - dbus send bus=session path=/org/ayatana/NotificationItem/* - interface=org.freedesktop.DBus.Properties - member={Get,GetAll} - peer=(name=:*, label=update-notifier), - dbus receive bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=JobRemoved diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index f9be02d9d..5704fa866 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -35,11 +35,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" #aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell - dbus send bus=session path=/org/freedesktop/DBus - interface=org.freedesktop.DBus.Properties - member={GetAll,ListActivatableNames} - peer=(name=org.freedesktop.DBus, label=dbus-session), - dbus (send, receive) bus=session path=/org/gtk/Application/CommandLine interface=org.gtk.private.CommandLine member=Print diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index 4da1fe736..fe9123e5b 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -9,10 +9,14 @@ include @{exec_path} = @{bin}/yelp @{bin}/gnome-help profile yelp @{exec_path} { include + include + include include network netlink raw, + #aa:dbus own bus=session name=org.gnome.Yelp + @{exec_path} mr, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, diff --git a/apparmor.d/groups/gvfs/gvfsd-dnssd b/apparmor.d/groups/gvfs/gvfsd-dnssd index b07cd070b..1bad8c349 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dnssd +++ b/apparmor.d/groups/gvfs/gvfsd-dnssd @@ -16,6 +16,7 @@ profile gvfsd-dnssd @{exec_path} { include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_dnssd + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker label=gvfsd dbus receive bus=session path=/org/gtk/vfs/Daemon interface=org.gtk.vfs.Daemon diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 2811b16e3..4a05ad8d7 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -19,6 +19,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 0487399fa..cb33f6046 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -25,24 +25,7 @@ profile update-notifier @{exec_path} { unix (bind) type=stream addr=@@{hex16}/bus/systemd/bus-api-user, #aa:dbus talk bus=system name=org.debian.apt label=apt - - dbus receive bus=session path=/org/ayatana/NotificationItem/software_update_available - interface=org.freedesktop.DBus.Properties - member={Get,GetAll} - peer=(name=:*, label=gnome-shell), - - dbus receive bus=session path=/org/ayatana/NotificationItem/livepatch{,/Menu} - interface=org.freedesktop.DBus.Properties - member=={Get,GetAll} - peer=(name=:*, label=gnome-shell), - dbus receive bus=session path=/org/ayatana/NotificationItem/livepatch/Menu - interface=com.canonical.dbusmenu - member={AboutToShow,GetGroupProperties,GetLayout} - peer=(name=:*, label=gnome-shell), - - dbus send bus=session path=/org/ayatana/NotificationItem/* - interface=org.kde.StatusNotifierItem - peer=(name=org.freedesktop.DBus, label=gnome-shell), + #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/atril b/apparmor.d/profiles-a-f/atril index 2163346cc..3b78d9c02 100644 --- a/apparmor.d/profiles-a-f/atril +++ b/apparmor.d/profiles-a-f/atril @@ -26,13 +26,7 @@ profile atril @{exec_path} { network netlink raw, - dbus send bus=session path=/org/mate/atril/{,**} - peer=(name=org.freedesktop.DBus, label=atrild), # all interfaces and members - - dbus send bus=session path=/org/mate/atril/Daemon - interface=org.mate.atril.Daemon - member={RegisterDocument,UnregisterDocument} - peer=(name=org.mate.atril.Daemon), # no peer's labels + #aa:dbus talk bus=session name=org.mate.atril.Daemon label=atrild @{exec_path} mr, From 549c6ba2f5402878ad28fa68d1809d7505ef3a02 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 20:34:12 +0100 Subject: [PATCH 0248/1455] feat(profile): ubuntu: improve integration with ubuntu. --- apparmor.d/groups/apt/apt-systemd-daily | 2 +- apparmor.d/groups/apt/dpkg-preconfigure | 1 + apparmor.d/groups/bus/ibus-x11 | 5 +++-- apparmor.d/groups/grub/grub-sort-version | 2 ++ .../groups/ubuntu/livepatch-notification | 9 +-------- apparmor.d/groups/ubuntu/pro | 20 ------------------- .../groups/ubuntu/software-properties-dbus | 6 +++--- .../ubuntu/ubuntu-advantage-notification | 7 +------ apparmor.d/groups/ubuntu/update-manager | 2 +- apparmor.d/groups/ubuntu/update-notifier | 7 +++++++ apparmor.d/profiles-a-f/fstrim | 1 + apparmor.d/profiles-g-l/gtk-query-immodules | 1 + apparmor.d/profiles-g-l/logrotate | 16 +++------------ apparmor.d/profiles-m-r/mkinitramfs | 10 +++++++--- apparmor.d/profiles-s-z/setvtrgb | 2 ++ apparmor.d/profiles-s-z/snap | 5 ++++- apparmor.d/profiles-s-z/snap-seccomp | 2 ++ apparmor.d/profiles-s-z/ufw | 8 ++++---- 18 files changed, 44 insertions(+), 62 deletions(-) delete mode 100644 apparmor.d/groups/ubuntu/pro diff --git a/apparmor.d/groups/apt/apt-systemd-daily b/apparmor.d/groups/apt/apt-systemd-daily index 7ebb4da0b..1acaa6aff 100644 --- a/apparmor.d/groups/apt/apt-systemd-daily +++ b/apparmor.d/groups/apt/apt-systemd-daily @@ -59,7 +59,7 @@ profile apt-systemd-daily @{exec_path} { /var/backups/ r, /var/backups/apt.extended_states rw, /var/backups/apt.extended_states.@{int} rw, - /var/backups/apt.extended_states.@{int}.gz w, + /var/backups/apt.extended_states.@{int}.gz rw, /var/cache/apt/ r, /var/cache/apt/archives/ r, diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index d57d3d42d..f94d95251 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -24,6 +24,7 @@ profile dpkg-preconfigure @{exec_path} { @{bin}/{,g,m}awk rix, @{bin}/cat rix, @{bin}/dialog rix, + @{bin}/expr rix, @{bin}/locale rix, @{bin}/sed rix, @{bin}/sort rix, diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index 44bb611fe..066adc056 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -17,14 +17,15 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) { include include - unix (connect, receive, send) type=stream peer=(label=ibus-daemon), - network inet stream, network inet6 stream, network inet dgram, network inet6 dgram, network netlink raw, + # unix (connect, receive, send) type=stream peer=(label=ibus-daemon), + unix (send receive connect) type=stream addr=none peer=(label=gnome-shell, addr=@/tmp/.X11-unix/X@{int}), + dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect diff --git a/apparmor.d/groups/grub/grub-sort-version b/apparmor.d/groups/grub/grub-sort-version index 7f830dc33..bea282862 100644 --- a/apparmor.d/groups/grub/grub-sort-version +++ b/apparmor.d/groups/grub/grub-sort-version @@ -10,6 +10,8 @@ include profile grub-sort-version @{exec_path} { include include + include + include include capability dac_read_search, diff --git a/apparmor.d/groups/ubuntu/livepatch-notification b/apparmor.d/groups/ubuntu/livepatch-notification index 14f21729f..66739c7bc 100644 --- a/apparmor.d/groups/ubuntu/livepatch-notification +++ b/apparmor.d/groups/ubuntu/livepatch-notification @@ -14,17 +14,10 @@ profile livepatch-notification @{exec_path} { include include include - include - include + include @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - /usr/share/icons/{,**} r, - /usr/share/X11/{,**} r, - - @{run}/user/@{uid}/gdm/Xauthority r, - include if exists } diff --git a/apparmor.d/groups/ubuntu/pro b/apparmor.d/groups/ubuntu/pro deleted file mode 100644 index c00b07587..000000000 --- a/apparmor.d/groups/ubuntu/pro +++ /dev/null @@ -1,20 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/pro -profile pro @{exec_path} { - include - include - include - - @{exec_path} mr, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index 2def932dc..32b4e27c3 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -39,9 +39,9 @@ profile software-properties-dbus @{exec_path} { /usr/share/distro-info/*.csv r, /usr/share/xml/iso-codes/{,**} r, - owner @{tmp}/???????? rw, # unconventional '_' tail - owner @{tmp}/tmp????????/ w, # change to 'c' - owner @{tmp}/tmp????????/apt.conf w, + owner @{tmp}/@{word8} rw, + owner @{tmp}/tmp@{word8}/ w, # change to 'c' + owner @{tmp}/tmp@{word8}/apt.conf w, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification index 2f539bac8..c9a48ed47 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification @@ -14,15 +14,10 @@ profile ubuntu-advantage-notification @{exec_path} { include include include - include - include + include @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - /usr/share/icons/{,**} r, - /usr/share/X11/xkb/{,**} r, - include if exists } diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 4a05ad8d7..2cf2f3e99 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/update-manager profile update-manager @{exec_path} flags=(attach_disconnected) { include - include include include include @@ -20,6 +19,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index cb33f6046..df73d4e40 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -72,8 +72,15 @@ profile update-notifier @{exec_path} { include include + capability sys_ptrace, + + ptrace read peer=update-notifier, + @{lib}/update-notifier/package-system-locked Px, + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/stat r, + include if exists } diff --git a/apparmor.d/profiles-a-f/fstrim b/apparmor.d/profiles-a-f/fstrim index e49108044..a4ba7fedb 100644 --- a/apparmor.d/profiles-a-f/fstrim +++ b/apparmor.d/profiles-a-f/fstrim @@ -23,6 +23,7 @@ profile fstrim @{exec_path} { @{MOUNTS}/ r, / r, /boot/ r, + /boot/efi/ r, /var/ r, include if exists diff --git a/apparmor.d/profiles-g-l/gtk-query-immodules b/apparmor.d/profiles-g-l/gtk-query-immodules index e67def6d2..a92092f8c 100644 --- a/apparmor.d/profiles-g-l/gtk-query-immodules +++ b/apparmor.d/profiles-g-l/gtk-query-immodules @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/gtk-query-immodules-{2,3}.0 profile gtk-query-immodules @{exec_path} { include + include capability dac_override, capability dac_read_search, diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate index 6004b8a35..9bfe64a72 100644 --- a/apparmor.d/profiles-g-l/logrotate +++ b/apparmor.d/profiles-g-l/logrotate @@ -50,19 +50,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected) { @{bin}/squid rPUx, @{bin}/pgrep rCx -> pgrep, - - # no new privs - #@{bin}/systemctl rCx -> systemctl, - @{bin}/systemctl rix, - @{bin}/runlevel rix, - include - ptrace (read), - capability sys_ptrace, - owner @{PROC}/@{pid}/stat r, - @{PROC}/1/environ r, - @{PROC}/1/sched r, - @{PROC}/cmdline r, - @{PROC}/sys/kernel/osrelease r, + @{bin}/systemctl rCx -> systemctl, /etc/ r, @{etc_ro}/logrotate.conf rk, @@ -92,6 +80,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_ptrace, + @{run}/utmp rk, + include if exists } diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 692d79184..b24bdbdf1 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -81,18 +81,22 @@ profile mkinitramfs @{exec_path} { /etc/modprobe.d/{,*.conf} r, /boot/ r, - owner /boot/initrd.img-*.new rw, owner /boot/config-* r, + owner /boot/initrd.img-*.new rw, /var/tmp/ r, + /var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.{order,builtin} rw, owner /var/tmp/mkinitramfs_*/ rw, owner /var/tmp/mkinitramfs_*/** rwl -> /var/tmp/mkinitramfs_*/**, - /var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.{order,builtin} rw, owner /var/tmp/mkinitramfs-* rw, - owner @{PROC}/@{pid}/fd/ r, + @{sys}/devices/platform/ r, + @{sys}/devices/platform/reg-dummy/{,**}/ r, + @{sys}/module/compression r, + @{PROC}/cmdline r, @{PROC}/modules r, + owner @{PROC}/@{pid}/fd/ r, profile ldd { include diff --git a/apparmor.d/profiles-s-z/setvtrgb b/apparmor.d/profiles-s-z/setvtrgb index 79398e82d..aef3b00fe 100644 --- a/apparmor.d/profiles-s-z/setvtrgb +++ b/apparmor.d/profiles-s-z/setvtrgb @@ -15,6 +15,8 @@ profile setvtrgb @{exec_path} { @{exec_path} mr, + /etc/console-setup/vtrgb r, + /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/profiles-s-z/snap index 158744d0c..e5e5bef97 100644 --- a/apparmor.d/profiles-s-z/snap +++ b/apparmor.d/profiles-s-z/snap @@ -104,7 +104,10 @@ profile snap @{exec_path} { profile systemctl { include include - + include + + network unix stream, + include if exists } diff --git a/apparmor.d/profiles-s-z/snap-seccomp b/apparmor.d/profiles-s-z/snap-seccomp index 4c34746ed..5018ff379 100644 --- a/apparmor.d/profiles-s-z/snap-seccomp +++ b/apparmor.d/profiles-s-z/snap-seccomp @@ -18,6 +18,8 @@ profile snap-seccomp @{exec_path} { @{exec_path} mr, + @{lib_dirs}/**.so* mr, + /var/lib/snapd/seccomp/bpf/{,**} rw, owner @{PROC}/@{pids}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 6a9897d91..525e543b9 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -37,10 +37,10 @@ profile ufw @{exec_path} { owner @{run}/ufw.lock rwk, - owner /var/tmp/???????? rw, - owner /var/tmp/tmp???????? rw, - owner @{tmp}/???????? rw, - owner @{tmp}/tmp???????? rw, + owner @{tmp}/@{word8} rw, + owner @{tmp}/tmp@{word8} rw, + owner /var/tmp/@{word8} rw, + owner /var/tmp/tmp@{word8} rw, @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/net/ip_tables_names r, From c6c4920598ea6d06c1f855eff76e6f261c946f10 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 20:36:14 +0100 Subject: [PATCH 0249/1455] feat(profile): newer gnome want to read /. --- apparmor.d/groups/gnome/gnome-system-monitor | 4 ++++ apparmor.d/profiles-a-f/fractal | 2 ++ 2 files changed, 6 insertions(+) diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 4d0a5dd5d..730ea1ffe 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -38,6 +38,8 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { /usr/share/gnome-system-monitor/{,**} r, /usr/share/firefox-esr/browser/chrome/icons/default/*.png r, + / r, + owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, owner @{run}/user/@{uid}/doc/ rw, @@ -76,6 +78,8 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { @{PROC}/diskstats r, @{PROC}/vmstat r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, /dev/tty rw, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index c7df958f7..54abde9d3 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -25,6 +25,8 @@ profile fractal @{exec_path} flags=(attach_disconnected) { /usr/share/xml/iso-codes/{,**} r, + / r, + owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, From 6f5604d59d9a31bae3dfec48762a3a8b8a4d6cea Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 22:05:47 +0100 Subject: [PATCH 0250/1455] build: cleanup base build interface. --- pkg/prebuild/cfg/core.go | 10 ++++++---- pkg/prebuild/cfg/core_test.go | 9 +++++---- pkg/prebuild/directive/dbus.go | 10 ++++++---- pkg/prebuild/directive/exec.go | 2 +- pkg/prebuild/directive/filter.go | 4 ++-- pkg/prebuild/directive/stack.go | 2 +- 6 files changed, 21 insertions(+), 16 deletions(-) diff --git a/pkg/prebuild/cfg/core.go b/pkg/prebuild/cfg/core.go index 692f130ad..56b91ed6f 100644 --- a/pkg/prebuild/cfg/core.go +++ b/pkg/prebuild/cfg/core.go @@ -9,20 +9,20 @@ import "fmt" type BaseInterface interface { Message() string Name() string - Usage() string + Usage() []string } type Base struct { Msg string Keyword string - Help string + Help []string } func (b Base) Name() string { return b.Keyword } -func (b Base) Usage() string { +func (b Base) Usage() []string { return b.Help } @@ -41,7 +41,9 @@ func Help[T BaseInterface](name string, tasks map[string]T) string { func Usage[T BaseInterface](name string, tasks map[string]T) string { res := fmt.Sprintf("%s\n", name) for _, t := range tasks { - res += fmt.Sprintf(" %s\n", t.Usage()) + for _, h := range t.Usage() { + res += fmt.Sprintf(" #aa:%s %s\n", t.Name(), h) + } } return res } diff --git a/pkg/prebuild/cfg/core_test.go b/pkg/prebuild/cfg/core_test.go index ff76f9466..7cde166a1 100644 --- a/pkg/prebuild/cfg/core_test.go +++ b/pkg/prebuild/cfg/core_test.go @@ -5,6 +5,7 @@ package cfg import ( + "slices" "strings" "testing" ) @@ -17,7 +18,7 @@ func TestBase_Helpers(t *testing.T) { }{ { name: "base", - b: Base{Keyword: "test", Help: "test", Msg: "test"}, + b: Base{Keyword: "test", Help: []string{"test"}, Msg: "test"}, want: "test", }, } @@ -26,7 +27,7 @@ func TestBase_Helpers(t *testing.T) { if got := tt.b.Name(); got != tt.want { t.Errorf("Base.Name() = %v, want %v", got, tt.want) } - if got := tt.b.Usage(); got != tt.want { + if got := tt.b.Usage(); !slices.Equal(got, []string{tt.want}) { t.Errorf("Base.Usage() = %v, want %v", got, tt.want) } if got := tt.b.Message(); got != tt.want { @@ -45,8 +46,8 @@ func TestHelp(t *testing.T) { { name: "one", tasks: map[string]Base{ - "one": {Keyword: "one", Help: "one", Msg: "one"}, - "two": {Keyword: "two", Help: "two", Msg: "two"}, + "one": {Keyword: "one", Help: []string{"one"}, Msg: "one"}, + "two": {Keyword: "two", Help: []string{"two"}, Msg: "two"}, }, want: `one`, }, diff --git a/pkg/prebuild/directive/dbus.go b/pkg/prebuild/directive/dbus.go index dc7ac16d3..98f5cd61c 100644 --- a/pkg/prebuild/directive/dbus.go +++ b/pkg/prebuild/directive/dbus.go @@ -35,10 +35,12 @@ func init() { Base: cfg.Base{ Keyword: "dbus", Msg: "Dbus directive applied", - Help: `#aa:dbus own bus= name= [interface=AARE] [path=AARE] - #aa:dbus talk bus= name= label= [interface=AARE] [path=AARE]`, - }, - }) + Help: []string{ + "own bus= name= [interface=AARE] [path=AARE]", + "talk bus= name= label= [interface=AARE] [path=AARE]", + }, + }}, + ) } func setInterfaces(rules map[string]string) []string { diff --git a/pkg/prebuild/directive/exec.go b/pkg/prebuild/directive/exec.go index b77d80fa4..64c97e9cd 100644 --- a/pkg/prebuild/directive/exec.go +++ b/pkg/prebuild/directive/exec.go @@ -25,7 +25,7 @@ func init() { Base: cfg.Base{ Keyword: "exec", Msg: "Exec directive applied", - Help: Keyword + `exec [P|U|p|u|PU|pu|] profiles...`, + Help: []string{"[P|U|p|u|PU|pu|] profiles..."}, }, }) } diff --git a/pkg/prebuild/directive/filter.go b/pkg/prebuild/directive/filter.go index 1c90fa760..39e6c0062 100644 --- a/pkg/prebuild/directive/filter.go +++ b/pkg/prebuild/directive/filter.go @@ -25,14 +25,14 @@ func init() { Base: cfg.Base{ Keyword: "only", Msg: "Only directive applied", - Help: Keyword + `only filters...`, + Help: []string{"filters..."}, }, }) RegisterDirective(&FilterExclude{ Base: cfg.Base{ Keyword: "exclude", Msg: "Exclude directive applied", - Help: Keyword + `exclude filters...`, + Help: []string{"filters..."}, }, }) } diff --git a/pkg/prebuild/directive/stack.go b/pkg/prebuild/directive/stack.go index a2079dfb9..c673a1701 100644 --- a/pkg/prebuild/directive/stack.go +++ b/pkg/prebuild/directive/stack.go @@ -33,7 +33,7 @@ func init() { Base: cfg.Base{ Keyword: "stack", Msg: "Stack directive applied", - Help: Keyword + `stack [X] profiles...`, + Help: []string{"[X] profiles..."}, }, }) } From 05a489e0214e1dbacc5a5c7220cbd79575379183 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 22:08:48 +0100 Subject: [PATCH 0251/1455] build: improve internal directive tool. --- pkg/prebuild/directive/core.go | 26 ++++++++++++++++++++++---- pkg/prebuild/directive/filter.go | 11 +---------- 2 files changed, 23 insertions(+), 14 deletions(-) diff --git a/pkg/prebuild/directive/core.go b/pkg/prebuild/directive/core.go index d14dd4861..b81ae3cc7 100644 --- a/pkg/prebuild/directive/core.go +++ b/pkg/prebuild/directive/core.go @@ -61,11 +61,29 @@ func NewOption(file *paths.Path, match []string) *Option { } } -// Clean the selected directive from profile. +// Clean removes selected directive line from input string. // Useful to remove directive text applied on some condition only -func (o *Option) Clean(profile string) string { - reg := regexp.MustCompile(`\s*` + Keyword + o.Name + ` .*$`) - return strings.Replace(profile, o.Raw, reg.ReplaceAllString(o.Raw, ""), 1) +func (o *Option) Clean(input string) string { + return strings.Replace(input, o.Raw, o.cleanKeyword(o.Raw), 1) +} + +// cleanKeyword removes the dirextive keywork (#aa:...) from the input string +func (o *Option) cleanKeyword(input string) string { + reg := regexp.MustCompile(`\s*` + Keyword + o.Name + `( .*)?$`) + return reg.ReplaceAllString(input, "") +} + +// Check if the directive is inline or if it is a paragraph +func (o *Option) IsInline() bool { + inline := true + tmp := strings.Split(o.Raw, Keyword) + if len(tmp) >= 1 { + left := strings.TrimSpace(tmp[0]) + if len(left) == 0 { + inline = false + } + } + return inline } func RegisterDirective(d Directive) { diff --git a/pkg/prebuild/directive/filter.go b/pkg/prebuild/directive/filter.go index 39e6c0062..1aa2e1c76 100644 --- a/pkg/prebuild/directive/filter.go +++ b/pkg/prebuild/directive/filter.go @@ -49,16 +49,7 @@ func filter(only bool, opt *Option, profile string) (string, error) { return opt.Clean(profile), nil } - inline := true - tmp := strings.Split(opt.Raw, Keyword) - if len(tmp) >= 1 { - left := strings.TrimSpace(tmp[0]) - if len(left) == 0 { - inline = false - } - } - - if inline { + if opt.IsInline() { profile = strings.Replace(profile, opt.Raw, "", -1) } else { regRemoveParagraph := regexp.MustCompile(`(?s)` + opt.Raw + `\n.*?\n\n`) From fbdf9cea64aa60230c9fbb6545cba97abda5e14f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 22:09:49 +0100 Subject: [PATCH 0252/1455] build: support directive without argument. --- pkg/prebuild/directive/core.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/prebuild/directive/core.go b/pkg/prebuild/directive/core.go index b81ae3cc7..0e791730f 100644 --- a/pkg/prebuild/directive/core.go +++ b/pkg/prebuild/directive/core.go @@ -20,7 +20,7 @@ var ( // Build the profiles with the following directive applied Directives = map[string]Directive{} - regDirective = regexp.MustCompile(`(?m).*` + Keyword + `([a-z]*) (.*)`) + regDirective = regexp.MustCompile(`(?m).*` + Keyword + `([a-z]*)( .*)?`) ) // Main directive interface From 83bc7d3adeb6507747eeebdd87037d50b5955696 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 22:15:46 +0100 Subject: [PATCH 0253/1455] feat(aa-log): minor improvment in rule generation & formatting. --- pkg/aa/base.go | 2 +- pkg/aa/file.go | 21 +++++++++++++++++++++ pkg/aa/mount.go | 8 ++++---- pkg/aa/parse.go | 16 +++++++++++----- pkg/aa/profile.go | 38 ++++++++++++++++++++++---------------- pkg/aa/rules.go | 40 +++++++++++++++++++++++++++++++++++----- pkg/aa/template.go | 6 +++--- 7 files changed, 97 insertions(+), 34 deletions(-) diff --git a/pkg/aa/base.go b/pkg/aa/base.go index 967466520..609525111 100644 --- a/pkg/aa/base.go +++ b/pkg/aa/base.go @@ -9,8 +9,8 @@ import ( ) type Base struct { - IsLineRule bool Comment string + IsLineRule bool NoNewPrivs bool FileInherit bool Optional bool diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 50b23bae9..549ff66de 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -118,6 +118,21 @@ func (r *File) String() string { } func (r *File) Validate() error { + if !isAARE(r.Path) { + return fmt.Errorf("'%s' is not a valid AARE", r.Path) + } + for _, v := range r.Access { + if v == "" { + continue + } + if !slices.Contains(requirements[r.Kind()]["access"], v) || + !slices.Contains(requirements[r.Kind()]["transition"], v) { + return fmt.Errorf("invalid mode '%s'", v) + } + } + if r.Target != "" && !isAARE(r.Target) { + return fmt.Errorf("'%s' is not a valid AARE", r.Target) + } return nil } @@ -260,6 +275,12 @@ func (r *Link) String() string { } func (r *Link) Validate() error { + if !isAARE(r.Path) { + return fmt.Errorf("'%s' is not a valid AARE", r.Path) + } + if !isAARE(r.Target) { + return fmt.Errorf("'%s' is not a valid AARE", r.Target) + } return nil } diff --git a/pkg/aa/mount.go b/pkg/aa/mount.go index 914efc2ff..ad83801c6 100644 --- a/pkg/aa/mount.go +++ b/pkg/aa/mount.go @@ -17,10 +17,10 @@ const ( func init() { requirements[MOUNT] = requirement{ "flags": { - "acl", "async", "atime", "ro", "rw", "bind", "rbind", "dev", - "diratime", "dirsync", "exec", "iversion", "loud", "mand", "move", - "noacl", "noatime", "nodev", "nodiratime", "noexec", "noiversion", - "nomand", "norelatime", "nosuid", "nouser", "private", "relatime", + "ro", "rw", "acl", "async", "atime", "bind", "dev", "diratime", + "dirsync", "exec", "iversion", "loud", "mand", "move", "noacl", + "noatime", "nodev", "nodiratime", "noexec", "noiversion", "nomand", + "norelatime", "nosuid", "nouser", "private", "rbind", "relatime", "remount", "rprivate", "rshared", "rslave", "runbindable", "shared", "silent", "slave", "strictatime", "suid", "sync", "unbindable", "user", "verbose", diff --git a/pkg/aa/parse.go b/pkg/aa/parse.go index 88808a375..b7fb52835 100644 --- a/pkg/aa/parse.go +++ b/pkg/aa/parse.go @@ -495,9 +495,15 @@ func (r rule) String() string { } func isAARE(str string) bool { - return strings.HasPrefix(str, "@") || - strings.HasPrefix(str, "/") || - strings.HasPrefix(str, "\"") + if len(str) < 1 { + return false + } + switch str[0] { + case '@', '/', '"': + return true + default: + return false + } } // Convert a slice of internal rules to a slice of ApparmorRule. @@ -652,8 +658,8 @@ done: } // Parse apparmor profile rules by paragraphs -func ParseRules(input string) ([]Rules, []string, error) { - paragraphRules := []Rules{} +func ParseRules(input string) (ParaRules, []string, error) { + paragraphRules := ParaRules{} paragraphs := []string{} for _, match := range regParagraph.FindAllStringSubmatch(input, -1) { diff --git a/pkg/aa/profile.go b/pkg/aa/profile.go index ec5068971..30e8b106f 100644 --- a/pkg/aa/profile.go +++ b/pkg/aa/profile.go @@ -139,16 +139,18 @@ func (p *Profile) GetAttachments() string { var ( newLogMap = map[string]func(log map[string]string) Rule{ + // class "rlimits": newRlimitFromLog, - "cap": newCapabilityFromLog, - "io_uring": newIOUringFromLog, - "signal": newSignalFromLog, - "ptrace": newPtraceFromLog, "namespace": newUsernsFromLog, - "unix": newUnixFromLog, - "dbus": newDbusFromLog, + "cap": newCapabilityFromLog, + "net": newNetworkFromLog, "posix_mqueue": newMqueueFromLog, "sysv_mqueue": newMqueueFromLog, + "signal": newSignalFromLog, + "ptrace": newPtraceFromLog, + "unix": newUnixFromLog, + "io_uring": newIOUringFromLog, + "dbus": newDbusFromLog, "mount": func(log map[string]string) Rule { if strings.Contains(log["flags"], "remount") { return newRemountFromLog(log) @@ -156,7 +158,6 @@ var ( newRule := newLogMountMap[log["operation"]] return newRule(log) }, - "net": newNetworkFromLog, "file": func(log map[string]string) Rule { if log["operation"] == "change_onexec" { return newChangeProfileFromLog(log) @@ -164,14 +165,19 @@ var ( return newFileFromLog(log) } }, - "exec": newFileFromLog, - "getattr": newFileFromLog, - "mkdir": newFileFromLog, - "mknod": newFileFromLog, - "open": newFileFromLog, - "rename_src": newFileFromLog, - "truncate": newFileFromLog, - "unlink": newFileFromLog, + // operation + "capable": newCapabilityFromLog, + "chmod": newFileFromLog, + "exec": newFileFromLog, + "getattr": newFileFromLog, + "link": newFileFromLog, + "mkdir": newFileFromLog, + "mknod": newFileFromLog, + "open": newFileFromLog, + "rename_dest": newFileFromLog, + "rename_src": newFileFromLog, + "truncate": newFileFromLog, + "unlink": newFileFromLog, } newLogMountMap = map[string]func(log map[string]string) Rule{ "mount": newMountFromLog, @@ -213,7 +219,7 @@ func (p *Profile) AddRule(log map[string]string) { case strings.Contains(log["operation"], "dbus"): p.Rules = append(p.Rules, newDbusFromLog(log)) default: - fmt.Printf("unknown log type: %s", log["operation"]) + fmt.Printf("unknown log type: %s\n", log["operation"]) } } } diff --git a/pkg/aa/rules.go b/pkg/aa/rules.go index 637412278..8e8ed5d95 100644 --- a/pkg/aa/rules.go +++ b/pkg/aa/rules.go @@ -94,7 +94,7 @@ func (r Rules) Delete(i int) Rules { } func (r Rules) DeleteKind(kind Kind) Rules { - res := make(Rules, 0) + res := make(Rules, 0, len(r)) for _, rule := range r { if rule == nil { continue @@ -106,8 +106,8 @@ func (r Rules) DeleteKind(kind Kind) Rules { return res } -func (r Rules) Filter(filter Kind) Rules { - res := make(Rules, 0) +func (r Rules) FilterOut(filter Kind) Rules { + res := make(Rules, 0, len(r)) for _, rule := range r { if rule == nil { continue @@ -119,8 +119,21 @@ func (r Rules) Filter(filter Kind) Rules { return res } +func (r Rules) Filter(filter Kind) Rules { + res := make(Rules, 0, len(r)) + for _, rule := range r { + if rule == nil { + continue + } + if rule.Kind() == filter { + res = append(res, rule) + } + } + return res +} + func (r Rules) GetVariables() []*Variable { - res := make([]*Variable, 0) + res := make([]*Variable, 0, len(r)) for _, rule := range r { switch rule := rule.(type) { case *Variable: @@ -131,7 +144,7 @@ func (r Rules) GetVariables() []*Variable { } func (r Rules) GetIncludes() []*Include { - res := make([]*Include, 0) + res := make([]*Include, 0, len(r)) for _, rule := range r { switch rule := rule.(type) { case *Include: @@ -247,3 +260,20 @@ func (r Rules) Format() Rules { r.setPaddings(paddingsIndex, paddingsMaxLen) return r } + +// ParaRules is a slice of Rules grouped by paragraph +type ParaRules []Rules + +func (r ParaRules) Flatten() Rules { + totalLen := 0 + for i := range r { + totalLen += len(r[i]) + } + + res := make(Rules, 0, totalLen) + for i := range r { + res = append(res, r[i]...) + } + + return res +} diff --git a/pkg/aa/template.go b/pkg/aa/template.go index 18f07bc2e..92c10b46e 100644 --- a/pkg/aa/template.go +++ b/pkg/aa/template.go @@ -138,7 +138,7 @@ var ( // The order AARE should be sorted stringAlphabet = []byte( - "!\"#$%&'*(){}[]+,-./:;<=>?@\\^_`|~0123456789abcdefghijklmnopqrstuvwxyz", + "!\"#$%&'*(){}[]@+,-./:;<=>?\\^_`|~0123456789abcdefghijklmnopqrstuvwxyz", ) stringWeights = generateWeights(stringAlphabet) @@ -232,11 +232,11 @@ func cjoin(i any) string { } } -func kindOf(i any) string { +func kindOf(i Rule) string { if i == nil { return "" } - return i.(Rule).Kind().String() + return i.Kind().String() } func setindent(i string) string { From 00d6a664eb11eedf8bee418174cd85dad4bd2cc4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 22:25:24 +0100 Subject: [PATCH 0254/1455] feat(aa-log): improve logs cleaning and varible resolution. --- cmd/aa-log/main.go | 4 ++-- cmd/aa/main.go | 11 +++++----- pkg/logs/loggers_test.go | 6 +++--- pkg/logs/logs.go | 46 +++++++++++++++++++++++----------------- pkg/logs/logs_test.go | 12 +++++------ 5 files changed, 44 insertions(+), 35 deletions(-) diff --git a/cmd/aa-log/main.go b/cmd/aa-log/main.go index 184e6d118..f7c484fd7 100644 --- a/cmd/aa-log/main.go +++ b/cmd/aa-log/main.go @@ -17,7 +17,7 @@ import ( const usage = `aa-log [-h] [--systemd] [--file file] [--rules | --raw] [profile] - Review AppArmor generated messages in a colorful way. Supports logs from + Review AppArmor generated messages in a colorful way. It supports logs from auditd, systemd, syslog as well as dbus session events. It can be given an optional profile name to filter the output with. @@ -64,7 +64,7 @@ func aaLog(logger string, path string, profile string) error { return nil } - aaLogs := logs.NewApparmorLogs(file, profile) + aaLogs := logs.New(file, profile) if rules { profiles := aaLogs.ParseToProfiles() for _, p := range profiles { diff --git a/cmd/aa/main.go b/cmd/aa/main.go index ec64e8cfd..d5bc10d59 100644 --- a/cmd/aa/main.go +++ b/cmd/aa/main.go @@ -76,10 +76,10 @@ func getIndentationLevel(input string) int { return level } -func parse(kind kind, profile string) ([]aa.Rules, []string, error) { +func parse(kind kind, profile string) (aa.ParaRules, []string, error) { var raw string paragraphs := []string{} - rulesByParagraph := []aa.Rules{} + rulesByParagraph := aa.ParaRules{} switch kind { case isTunable, isProfile: @@ -110,9 +110,6 @@ func formatFile(kind kind, profile string) (string, error) { return "", err } for idx, rules := range rulesByParagraph { - if err := rules.Validate(); err != nil { - return "", err - } aa.IndentationLevel = getIndentationLevel(paragraphs[idx]) rules = rules.Merge().Sort().Format() profile = strings.Replace(profile, paragraphs[idx], rules.String()+"\n", -1) @@ -202,8 +199,12 @@ func main() { logging.Fatal("%s", err.Error()) } err = aaFormat(files) + case tree: err = aaTree() + + default: + flag.Usage() } if err != nil { diff --git a/pkg/logs/loggers_test.go b/pkg/logs/loggers_test.go index 15fa1fbc8..d1a485344 100644 --- a/pkg/logs/loggers_test.go +++ b/pkg/logs/loggers_test.go @@ -30,7 +30,7 @@ func TestGetJournalctlLogs(t *testing.T) { "apparmor": "ALLOWED", "label": "gsd-xsettings", "operation": "dbus_method_call", - "name": ":*", + "name": "@{busname}", "mask": "receive", "bus": "session", "path": "/org/gtk/Settings", @@ -50,8 +50,8 @@ func TestGetJournalctlLogs(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { reader, _ := GetJournalctlLogs(tt.path, tt.useFile) - if got := NewApparmorLogs(reader, tt.name); !reflect.DeepEqual(got, tt.want) { - t.Errorf("NewApparmorLogs() = %v, want %v", got, tt.want) + if got := New(reader, tt.name); !reflect.DeepEqual(got, tt.want) { + t.Errorf("New() = %v, want %v", got, tt.want) } }) } diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index 587e0b7b7..67197e53c 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -28,11 +28,14 @@ const ( boldYellow = "\033[1;33m" ) +const ( + h = `[0-9a-fA-F]` + d = `[0-9]` +) + var ( quoted bool isAppArmorLogTemplate = regexp.MustCompile(`apparmor=("DENIED"|"ALLOWED"|"AUDIT")`) - _hex = `[0-9a-fA-F]` - _int = `[0-9]` regCleanLogs = util.ToRegexRepl([]string{ // Clean apparmor log file `.*apparmor="`, `apparmor="`, @@ -61,40 +64,45 @@ var ( `/home/[^/]+/`, `@{HOME}/`, // Resolve system variables - `/usr/(lib|lib32|lib64|libexec)`, `@{lib}`, + `/usr/lib(32|64|exec)`, `@{lib}`, + `/usr/lib`, `@{lib}`, `/usr/(bin|sbin)`, `@{bin}`, - `x86_64-pc-linux-gnu[^/]?`, `@{multiarch}`, + `(x86_64|amd64|i386|i686)`, `@{arch}`, + `@{arch}-*linux-gnu[^/]?`, `@{multiarch}`, `/usr/etc/`, `@{etc_ro}/`, `/var/run/`, `@{run}/`, `/run/`, `@{run}/`, `user/[0-9]*/`, `user/@{uid}/`, `/tmp/user/@{uid}/`, `@{tmp}/`, `/proc/`, `@{PROC}/`, + `@{PROC}/1/`, `@{PROC}/one/`, // Go does not support lookahead assertions like (?!1\b)d+, so we have to use a workaround `@{PROC}/[0-9]*/`, `@{PROC}/@{pid}/`, + `@{PROC}/one/`, `@{PROC}/1/`, `@{PROC}/@{pid}/task/[0-9]*/`, `@{PROC}/@{pid}/task/@{tid}/`, `/sys/`, `@{sys}/`, `@{PROC}@{sys}/`, `@{PROC}/sys/`, - `pci` + strings.Repeat(_hex, 4) + `:` + strings.Repeat(_hex, 2), `@{pci_bus}`, + `pci` + strings.Repeat(h, 4) + `:` + strings.Repeat(h, 2), `@{pci_bus}`, `@{pci_bus}/[0-9a-f:*./]*`, `@{pci}/`, `1000`, `@{uid}`, // Some system glob - `:1.[0-9]*`, `:*`, // dbus peer name + `:not.active.yet`, `@{busname}`, // dbus unique bus name + `:1.[0-9]*`, `@{busname}`, // dbus unique bus name `@{bin}/(|ba|da)sh`, `@{sh_path}`, // collect all shell `@{lib}/modules/[^/]+\/`, `@{lib}/modules/*/`, // strip kernel version numbers from kernel module accesses // int, hex, uuid - strings.Repeat(_hex, 8) + `[-_]` + strings.Repeat(_hex, 4) + `[-_]` + strings.Repeat(_hex, 4) + `[-_]` + strings.Repeat(_hex, 4) + `[-_]` + strings.Repeat(_hex, 12), `@{uuid}`, - strings.Repeat(_int, 64), `@{int64}`, - strings.Repeat(_hex, 64), `@{hex64}`, - strings.Repeat(_hex, 38), `@{hex38}`, - strings.Repeat(_int, 32), `@{int32}`, - strings.Repeat(_hex, 32), `@{hex32}`, - strings.Repeat(_int, 16), `@{int16}`, - strings.Repeat(_hex, 16), `@{hex16}`, - strings.Repeat(_int, 10), `@{int10}`, - strings.Repeat(_int, 8), `@{int8}`, - strings.Repeat(_int, 6), `@{int6}`, + strings.Repeat(h, 8) + `[-_]` + strings.Repeat(h, 4) + `[-_]` + strings.Repeat(h, 4) + `[-_]` + strings.Repeat(h, 4) + `[-_]` + strings.Repeat(h, 12), `@{uuid}`, + strings.Repeat(d, 64), `@{int64}`, + strings.Repeat(h, 64), `@{hex64}`, + strings.Repeat(h, 38), `@{hex38}`, + strings.Repeat(d, 32), `@{int32}`, + strings.Repeat(h, 32), `@{hex32}`, + strings.Repeat(d, 16), `@{int16}`, + strings.Repeat(h, 16), `@{hex16}`, + strings.Repeat(d, 10), `@{int10}`, + strings.Repeat(d, 8), `@{int8}`, + strings.Repeat(d, 6), `@{int6}`, }) ) @@ -117,8 +125,8 @@ func toQuote(str string) string { return str } -// NewApparmorLogs return a new ApparmorLogs list of map from a log file -func NewApparmorLogs(file io.Reader, profile string) AppArmorLogs { +// New returns a new ApparmorLogs list of map from a log file +func New(file io.Reader, profile string) AppArmorLogs { logs := GetApparmorLogs(file, profile) // Parse log into ApparmorLog struct diff --git a/pkg/logs/logs_test.go b/pkg/logs/logs_test.go index cc4b93ed9..c70909dcb 100644 --- a/pkg/logs/logs_test.go +++ b/pkg/logs/logs_test.go @@ -174,14 +174,14 @@ func TestAppArmorEvents(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { file := strings.NewReader(tt.event) - if got := NewApparmorLogs(file, ""); !reflect.DeepEqual(got, tt.want) { - t.Errorf("NewApparmorLogs() = %v, want %v", got, tt.want) + if got := New(file, ""); !reflect.DeepEqual(got, tt.want) { + t.Errorf("New() = %v, want %v", got, tt.want) } }) } } -func TestNewApparmorLogs(t *testing.T) { +func TestNew(t *testing.T) { tests := []struct { name string path string @@ -208,7 +208,7 @@ func TestNewApparmorLogs(t *testing.T) { "apparmor": "DENIED", "profile": "dnsmasq", "operation": "open", - "name": "@{PROC}/@{pid}/environ", + "name": "@{PROC}/1/environ", "comm": "dnsmasq", "requested_mask": "r", "denied_mask": "r", @@ -251,8 +251,8 @@ func TestNewApparmorLogs(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { file, _ := os.Open(tt.path) - if got := NewApparmorLogs(file, tt.name); !reflect.DeepEqual(got, tt.want) { - t.Errorf("NewApparmorLogs() = %v, want %v", got, tt.want) + if got := New(file, tt.name); !reflect.DeepEqual(got, tt.want) { + t.Errorf("New() = %v, want %v", got, tt.want) } }) } From e1f665aec1e02897d75665c87ebaec0e9d9aaae9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 26 Sep 2024 22:53:02 +0100 Subject: [PATCH 0255/1455] fix(go): updated function name. --- tests/integration/suite.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/integration/suite.go b/tests/integration/suite.go index abb08cfdf..26ef24994 100644 --- a/tests/integration/suite.go +++ b/tests/integration/suite.go @@ -101,7 +101,7 @@ func (t *TestSuite) ReadSettings(path *paths.Path) error { // Results returns a sum up of the apparmor logs raised by the scenarios func (t *TestSuite) Results() string { file, _ := logs.GetAuditLogs(logs.LogFiles[0]) - aaLogs := logs.NewApparmorLogs(file, "") + aaLogs := logs.New(file, "") return aaLogs.String() } From a8c18f9b9418ac42922eee1e31b1e3c9f791c1dc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 27 Sep 2024 12:20:48 +0100 Subject: [PATCH 0256/1455] test(aa-log): update tests to the last changes. --- pkg/aa/file.go | 8 +++++- pkg/aa/parse.go | 10 ++++---- pkg/aa/parse_test.go | 12 ++++----- pkg/aa/rule_test.go | 61 +++++++++++++++++++++++--------------------- 4 files changed, 50 insertions(+), 41 deletions(-) diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 549ff66de..14ade6997 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -118,14 +118,20 @@ func (r *File) String() string { } func (r *File) Validate() error { + if r.Path == "" && r.Target == "" && len(r.Access) == 0 { + return nil // rule: `file` or `owner file` + } if !isAARE(r.Path) { return fmt.Errorf("'%s' is not a valid AARE", r.Path) } + if len(r.Access) == 0 { + return fmt.Errorf("missing file access") + } for _, v := range r.Access { if v == "" { continue } - if !slices.Contains(requirements[r.Kind()]["access"], v) || + if !slices.Contains(requirements[r.Kind()]["access"], v) && !slices.Contains(requirements[r.Kind()]["transition"], v) { return fmt.Errorf("invalid mode '%s'", v) } diff --git a/pkg/aa/parse.go b/pkg/aa/parse.go index b7fb52835..ef8a7acd9 100644 --- a/pkg/aa/parse.go +++ b/pkg/aa/parse.go @@ -187,11 +187,11 @@ func parseParagraph(input string) (Rules, error) { } res = append(res, rrr...) - for _, r := range res { - if r.Constraint() == PreambleRule { - return nil, fmt.Errorf("Rule not allowed in block: %s", r) - } - } + // for _, r := range res { + // if r.Constraint() == PreambleRule { + // return nil, fmt.Errorf("Rule not allowed in block: %s", r) + // } + // } return res, nil } diff --git a/pkg/aa/parse_test.go b/pkg/aa/parse_test.go index 9cc011f38..8b54487ff 100644 --- a/pkg/aa/parse_test.go +++ b/pkg/aa/parse_test.go @@ -843,7 +843,7 @@ var ( raw string apparmor *AppArmorProfileFile wParseErr bool - wRules []Rules + wRules ParaRules wParseRulesErr bool }{ { @@ -851,7 +851,7 @@ var ( raw: "", apparmor: &AppArmorProfileFile{}, wParseErr: false, - wRules: []Rules{}, + wRules: ParaRules{}, wParseRulesErr: false, }, { @@ -875,7 +875,7 @@ var ( }, }, wParseErr: false, - wRules: []Rules{}, + wRules: ParaRules{}, wParseRulesErr: false, }, { @@ -914,7 +914,7 @@ var ( }, }, wParseErr: false, - wRules: []Rules{}, + wRules: ParaRules{}, wParseRulesErr: false, }, { @@ -943,7 +943,7 @@ var ( }, }, wParseErr: false, - wRules: []Rules{ + wRules: ParaRules{ { &Include{IsMagic: true, Path: "abstractions/base"}, &Include{IsMagic: true, Path: "abstractions/nameservice-strict"}, @@ -1050,7 +1050,7 @@ var ( }, }, wParseErr: false, - wRules: []Rules{ + wRules: ParaRules{ { &Include{IsMagic: true, Path: "abstractions/base"}, &Include{IsMagic: true, Path: "abstractions/nameservice-strict"}, diff --git a/pkg/aa/rule_test.go b/pkg/aa/rule_test.go index 77e05e320..ee50532a9 100644 --- a/pkg/aa/rule_test.go +++ b/pkg/aa/rule_test.go @@ -124,7 +124,7 @@ var ( wString: "include if exists ", }, { - name: "include/abs", + name: "include-abs", rule: &Include{Path: "/usr/share/apparmor.d/", IsMagic: false}, other: &Include{Path: "/usr/share/apparmor.d/", IsMagic: true}, wCompare: -1, @@ -190,7 +190,7 @@ var ( wString: "capability net_admin,", }, { - name: "capability/multi", + name: "capability-multi", rule: &Capability{Names: []string{"dac_override", "dac_read_search"}}, other: capability2, wCompare: -15, @@ -198,7 +198,7 @@ var ( wString: "capability dac_override dac_read_search,", }, { - name: "capability/all", + name: "capability-all", rule: &Capability{}, other: capability2, wCompare: -1, @@ -222,7 +222,7 @@ var ( log: mount1Log, rule: mount1, other: mount2, - wCompare: 38, + wCompare: 37, wMerge: false, wString: "mount fstype=overlay overlay -> /var/lib/docker/overlay2/opaque-bug-check1209538631/merged/, # failed perms check", }, @@ -250,7 +250,7 @@ var ( log: pivotroot1Log, rule: pivotroot1, other: pivotroot2, - wCompare: 7, + wCompare: -5, wMerge: false, wString: "pivot_root oldroot=@{run}/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/,", }, @@ -307,7 +307,7 @@ var ( wString: "signal receive set=kill peer=firefox//&firejail-default,", }, { - name: "ptrace/xdg-document-portal", + name: "ptrace-xdg-document-portal", fromLog: newPtraceFromLog, log: ptrace1Log, rule: ptrace1, @@ -317,7 +317,7 @@ var ( wString: "ptrace read peer=nautilus,", }, { - name: "ptrace/snap-update-ns.firefox", + name: "ptrace-snap-update-ns.firefox", fromLog: newPtraceFromLog, log: ptrace2Log, rule: ptrace2, @@ -355,7 +355,7 @@ var ( wString: "dbus bind bus=session name=org.gnome.evolution.dataserver.Sources5,", }, { - name: "dbus/bind", + name: "dbus-bind", rule: &Dbus{Access: []string{"bind"}, Bus: "session", Name: "org.gnome.*"}, other: dbus2, wCompare: -39, @@ -381,31 +381,33 @@ var ( wString: "/usr/share/poppler/cMap/Identity-H r,", }, { - name: "file/empty", + name: "file-all", rule: &File{}, other: &File{}, wCompare: 0, wMerge: true, - wString: " ,", + wString: " ,", // FIXME: }, { - name: "file/equal", - rule: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, - other: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, - wCompare: 0, - wMerge: true, - wString: "/usr/share/poppler/cMap/Identity-H ,", + name: "file-equal", + rule: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, + other: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, + wValidErr: true, + wCompare: 0, + wMerge: true, + wString: "/usr/share/poppler/cMap/Identity-H ,", }, { - name: "file/owner", - rule: &File{Path: "/usr/share/poppler/cMap/Identity-H", Owner: true}, - other: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, - wCompare: 1, - wMerge: false, - wString: "owner /usr/share/poppler/cMap/Identity-H ,", + name: "file-owner", + rule: &File{Path: "/usr/share/poppler/cMap/Identity-H", Owner: true}, + other: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, + wCompare: 1, + wValidErr: true, + wMerge: false, + wString: "owner /usr/share/poppler/cMap/Identity-H ,", }, { - name: "file/access", + name: "file-access", rule: &File{Path: "/usr/share/poppler/cMap/Identity-H", Access: []string{"r"}}, other: &File{Path: "/usr/share/poppler/cMap/Identity-H", Access: []string{"w"}}, wCompare: -5, @@ -413,12 +415,13 @@ var ( wString: "/usr/share/poppler/cMap/Identity-H r,", }, { - name: "file/close", - rule: &File{Path: "/usr/share/poppler/cMap/"}, - other: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, - wCompare: -10, - wMerge: false, - wString: "/usr/share/poppler/cMap/ ,", + name: "file-close", + rule: &File{Path: "/usr/share/poppler/cMap/"}, + other: &File{Path: "/usr/share/poppler/cMap/Identity-H"}, + wCompare: -10, + wValidErr: true, + wMerge: false, + wString: "/usr/share/poppler/cMap/ ,", }, { name: "link1", From 63888f07a754b66e5558f43967b0e125f7b5bb55 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 27 Sep 2024 14:39:01 +0100 Subject: [PATCH 0257/1455] fix(profile): flatpak app range. fix #519 --- apparmor.d/abstractions/common/app | 10 +++++----- apparmor.d/profiles-a-f/flatpak-app | 2 -- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 5c8ebd21f..7b6a5fdda 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -54,12 +54,12 @@ @{MOUNTDIRS}/ r, @{MOUNTS}/ r, @{MOUNTS}/** rwl, + owner @{HOME}/ r, owner @{HOME}/.var/app/** rmix, - owner @{HOME}/{,**} rwlk, - owner @{run}/user/@{uid}/{,**} rw, - owner @{user_config_dirs}/** rwkl, - owner @{user_share_dirs}/** rwkl, - owner @{user_games_dirs}/{,**} rm, + owner @{HOME}/** rwlk -> @{HOME}/**, + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, + owner @{user_games_dirs}/** rm, owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, owner @{tmp}/** rmwk, diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app index 8f3a15fc6..71ec660d8 100644 --- a/apparmor.d/profiles-a-f/flatpak-app +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -92,8 +92,6 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { owner @{run}/flatpak/doc/** rw, owner @{run}/ld-so-cache-dir/* rw, owner @{run}/user/ r, - owner @{run}/user/@{uid}/*.kioworker.socket r, - owner @{run}/user/@{uid}/#@{int} rwl, include if exists include if exists From 21e8456383c03ade4229888775a576216785da1c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 17:29:49 +0100 Subject: [PATCH 0258/1455] feat(abs): general improvment. --- apparmor.d/abstractions/app-open | 4 +- apparmor.d/abstractions/app/kmod | 8 +++- apparmor.d/abstractions/app/sudo | 1 - apparmor.d/abstractions/base.d/complete | 2 - apparmor.d/abstractions/common/electron | 3 ++ apparmor.d/abstractions/common/gnome | 1 + apparmor.d/abstractions/deny-sensitive-home | 52 +++++++++++++-------- apparmor.d/abstractions/mesa.d/complete | 4 ++ apparmor.d/abstractions/python.d/complete | 11 +++-- 9 files changed, 56 insertions(+), 30 deletions(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index c47c7ca69..70f89d866 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -11,8 +11,8 @@ # Sandbox managers @{bin}/bwrap rPUx, @{bin}/firejail rPUx, - @{bin}/flatpak rPUx, - @{bin}/snap rPUx, + @{bin}/flatpak rPx, + @{bin}/snap rPx, # Labeled programs @{archive_viewers_path} rPUx, diff --git a/apparmor.d/abstractions/app/kmod b/apparmor.d/abstractions/app/kmod index ae6b1cd78..ae10dbbfc 100644 --- a/apparmor.d/abstractions/app/kmod +++ b/apparmor.d/abstractions/app/kmod @@ -4,7 +4,13 @@ include - @{bin}/kmod mr, + @{bin}/depmod mr, + @{bin}/insmod mr, + @{bin}/kmod mr, + @{bin}/lsmod mr, + @{bin}/modinfo mr, + @{bin}/modprobe mr, + @{bin}/rmmod mr, @{lib}/modprobe.d/ r, @{lib}/modprobe.d/*.conf r, diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 3fa454356..b10c66c68 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -57,7 +57,6 @@ @{PROC}/@{pid}/limits r, @{PROC}/@{pid}/loginuid r, @{PROC}/@{pid}/stat r, - @{PROC}/sys/kernel/ngroups_max r, @{PROC}/sys/kernel/seccomp/actions_avail r, /dev/ r, diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index eef226aec..3e10a94f5 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -20,8 +20,6 @@ ptrace (readby) peer=systemd-coredump, - /usr/share/locale/ r, - @{etc_rw}/localtime r, /etc/locale.conf r, diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index b39ccc853..9cf480718 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -50,6 +50,7 @@ owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, + owner @{user_config_dirs}/electron-flags.conf r, owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, @@ -87,6 +88,8 @@ owner @{PROC}/@{pid}/task/@{tid}/status r, owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1 + deny @{user_share_dirs}/gvfs-metadata/* r, + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index 8fe4d97cd..ced9cb1b1 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -5,6 +5,7 @@ # Minimal set of rules for all gnome based UI application. include + include include include include diff --git a/apparmor.d/abstractions/deny-sensitive-home b/apparmor.d/abstractions/deny-sensitive-home index d8e1fdfb8..1f1047cec 100644 --- a/apparmor.d/abstractions/deny-sensitive-home +++ b/apparmor.d/abstractions/deny-sensitive-home @@ -11,42 +11,56 @@ # The only legitimate use in this project is for file browser and search engine. - deny @{HOME}/.*.bak mrwkl, - deny @{HOME}/.*.swp mrwkl, - deny @{HOME}/.*~ mrwkl, - deny @{HOME}/.*~1~ mrwkl, + # User defined private directories + deny @{HOMEDIRS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk, + deny @{MOUNTS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk, + deny @{user_private_dirs}/{,**} mrxwlk, + + # Files with secret paswords and tokens deny @{HOME}/.*age*{,/{,**}} mrwkl, deny @{HOME}/.*aws*{,/{,**}} mrwkl, deny @{HOME}/.*cert*{,/{,**}} mrwkl, - deny @{HOME}/.*history mrwkl, deny @{HOME}/.*key*{,/{,**}} mrwkl, deny @{HOME}/.*pass*{,/{,**}} mrwkl, deny @{HOME}/.*pki*{,/{,**}} mrwkl, deny @{HOME}/.*private*{,/{,**}} mrwkl, deny @{HOME}/.*secret*{,/{,**}} mrwkl, deny @{HOME}/.*yubi*{,/{,**}} mrwkl, - deny @{HOME}/.fetchmail* mrwkl, - deny @{HOME}/.lesshst* mrwkl, - deny @{HOME}/.mozilla/{,**} mrwkl, - deny @{HOME}/.mutt* mrwkl, - deny @{HOME}/.thunderbird/{,**} mrwkl, - deny @{HOME}/.viminfo* mrwkl, - deny @{HOME}/.wget-hsts mrwkl, + deny @{HOME}/.aws/{,**} mrwkl, + deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl, deny @{HOME}/@{XDG_GPG_DIR}/{,**} mrwkl, deny @{HOME}/@{XDG_SSH_DIR}/{,**} mrwkl, + deny @{run}/user/@{uid}/keyring** mrwkl, deny @{user_config_dirs}/*-store/{,**} mrwkl, - deny @{user_config_dirs}/chromium/{,**} mrwkl, deny @{user_password_store_dirs}/{,**} mrwkl, deny @{user_share_dirs}/kwalletd/{,**} mrwkl, - # User defined private directories - deny @{user_private_dirs}/{,**} mrxwlk, - deny @{HOMEDIRS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk, - deny @{MOUNTS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk, + # Privacy violations + deny @{HOME}/.*.bak mrwkl, + deny @{HOME}/.*.swp mrwkl, + deny @{HOME}/.*~ mrwkl, + deny @{HOME}/.*~1~ mrwkl, + deny @{HOME}/.*history mrwkl, + deny @{HOME}/.evolution/{,**} mrwkl, + deny @{HOME}/.fetchmail* mrwkl, + deny @{HOME}/.gnome2_private/{,**} mrwkl, + deny @{HOME}/.gnome2/keyrings/{,**} mrwkl, + deny @{HOME}/.lesshst* mrwkl, + deny @{HOME}/.mozilla/{,**} mrwkl, + deny @{HOME}/.mutt** mrwkl, + deny @{HOME}/.thunderbird/{,**} mrwkl, + deny @{HOME}/.viminfo* mrwkl, + deny @{HOME}/.wget-hsts mrwkl, + deny @{user_config_dirs}/chromium/{,**} mrwkl, + deny @{user_config_dirs}/evolution/{,**} mrwkl, # Deny executable mapping in writable space as allowed in abstractions/fonts - deny @{HOME}/.{,cache/}fontconfig/ rw, - deny @{HOME}/.{,cache/}fontconfig/** mrwl, + deny @{HOME}/.{,cache/}fontconfig/ rw, + deny @{HOME}/.{,cache/}fontconfig/** mrwl, + + # special attention to (potentially) executable files + deny @{HOME}/bin wl, + deny @{HOME}/bin/{,**} wl, include if exists diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index a8b9937bd..8ac3ad7f3 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -5,7 +5,11 @@ # Extra Mesa rules for desktop environments owner @{desktop_cache_dirs}/ w, owner @{desktop_cache_dirs}/mesa_shader_cache_db/ rw, + owner @{desktop_cache_dirs}/mesa_shader_cache_db/index rw, + owner @{desktop_cache_dirs}/mesa_shader_cache_db/marker rw, owner @{desktop_cache_dirs}/mesa_shader_cache_db/part@{int}/ rw, + owner @{desktop_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.db rwk, + owner @{desktop_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.idx rwk, owner @{desktop_cache_dirs}/mesa_shader_cache/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/@{hex2}/ rw, owner @{desktop_cache_dirs}/mesa_shader_cache/@{hex2}/@{hex38} rw, diff --git a/apparmor.d/abstractions/python.d/complete b/apparmor.d/abstractions/python.d/complete index e6eea6744..9f8d13eb5 100644 --- a/apparmor.d/abstractions/python.d/complete +++ b/apparmor.d/abstractions/python.d/complete @@ -4,11 +4,12 @@ # SPDX-License-Identifier: GPL-2.0-only @{bin}/ r, - @{bin}/python{2.[4-7],3,3.[0-9],3.1[0-9]} r, + @{python_path} r, - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so} mr, - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r, - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r, - owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r, + owner @{user_lib_dirs}/@{python_name}/ r, + owner @{user_lib_dirs}/@{python_name}/**.{egg,py,pyi,pth} r, + owner @{user_lib_dirs}/@{python_name}/**.{pyc,so} mr, + owner @{user_lib_dirs}/@{python_name}/{site,dist}-packages/ r, + owner @{user_lib_dirs}/@{python_name}/{site,dist}-packages/**/ r, # vim:syntax=apparmor From 8730c09b96620e60e14e5554ea5094974ef0c65b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 17:43:54 +0100 Subject: [PATCH 0259/1455] feat(profile): general update. --- apparmor.d/groups/browsers/firefox-glxtest | 2 + apparmor.d/groups/browsers/firefox-vaapitest | 1 + apparmor.d/groups/bus/ibus-portal | 1 + apparmor.d/groups/bus/ibus-x11 | 1 + apparmor.d/groups/children/child-open-strict | 4 +- apparmor.d/groups/children/child-pager | 2 +- apparmor.d/groups/freedesktop/cpupower | 1 - .../freedesktop/xdg-desktop-portal-gnome | 1 + apparmor.d/groups/freedesktop/xorg | 9 ++++- apparmor.d/groups/gnome/gdm-generate-config | 9 +---- apparmor.d/groups/gnome/gio-launch-desktop | 2 + apparmor.d/groups/gnome/gnome-clocks | 2 + apparmor.d/groups/gnome/gnome-shell | 10 +++-- apparmor.d/groups/gnome/yelp | 1 + apparmor.d/groups/pacman/makepkg | 9 +++-- .../pacman/pacman-hook-gtk4-querymodules | 1 + apparmor.d/groups/pacman/pacman-key | 5 ++- apparmor.d/groups/pacman/reflector | 3 +- apparmor.d/groups/ssh/ssh-agent | 4 +- apparmor.d/groups/systemd/systemd-sleep | 1 - .../groups/virt/cockpit-certificate-helper | 18 ++++----- apparmor.d/groups/virt/containerd | 5 +-- apparmor.d/groups/virt/dockerd | 37 +++++++++++-------- apparmor.d/profiles-a-f/aa-enforce | 2 +- apparmor.d/profiles-a-f/aa-log | 2 + apparmor.d/profiles-a-f/aa-notify | 10 +++-- apparmor.d/profiles-a-f/chronyd | 3 +- apparmor.d/profiles-a-f/discord | 11 ++++-- apparmor.d/profiles-a-f/element-desktop | 4 +- apparmor.d/profiles-a-f/file-roller | 2 + apparmor.d/profiles-a-f/flatpak | 2 +- .../profiles-a-f/flatpak-session-helper | 2 + apparmor.d/profiles-a-f/foliate | 3 ++ apparmor.d/profiles-g-l/gajim | 14 ++++--- apparmor.d/profiles-g-l/gio-querymodules | 1 + apparmor.d/profiles-g-l/keepassxc | 3 +- apparmor.d/profiles-m-r/ntfs-3g | 19 +++++----- apparmor.d/profiles-m-r/pass | 8 ++-- apparmor.d/profiles-m-r/passwd | 2 +- apparmor.d/profiles-m-r/protonmail | 3 +- apparmor.d/profiles-m-r/rpi-imager | 22 +++-------- .../signal-desktop-chrome-sandbox | 1 - apparmor.d/profiles-s-z/snapd | 2 + apparmor.d/profiles-s-z/steam | 12 ++---- apparmor.d/profiles-s-z/steam-game-proton | 1 + apparmor.d/profiles-s-z/steam-runtime | 4 +- .../profiles-s-z/steam-runtime-steam-remote | 2 +- 47 files changed, 146 insertions(+), 118 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest index 02bbb92a6..7a63d82e8 100644 --- a/apparmor.d/groups/browsers/firefox-glxtest +++ b/apparmor.d/groups/browsers/firefox-glxtest @@ -29,6 +29,8 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cmdline r, + deny @{user_share_dirs}/gnome-shell/session.gvdb rw, + include if exists } diff --git a/apparmor.d/groups/browsers/firefox-vaapitest b/apparmor.d/groups/browsers/firefox-vaapitest index 785a7f547..603b7a5d6 100644 --- a/apparmor.d/groups/browsers/firefox-vaapitest +++ b/apparmor.d/groups/browsers/firefox-vaapitest @@ -25,6 +25,7 @@ profile firefox-vaapitest @{exec_path} flags=(attach_disconnected) { deny @{config_dirs}/firefox/*/.parentlock rw, deny @{config_dirs}/firefox/*/startupCache/** r, deny @{user_cache_dirs}/mozilla/firefox/*/startupCache/* r, + deny @{user_share_dirs}/gnome-shell/session.gvdb rw, include if exists } diff --git a/apparmor.d/groups/bus/ibus-portal b/apparmor.d/groups/bus/ibus-portal index 9c779eb72..ea3d7a7a6 100644 --- a/apparmor.d/groups/bus/ibus-portal +++ b/apparmor.d/groups/bus/ibus-portal @@ -28,6 +28,7 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + owner @{desktop_cache_dirs}/ibus/dbus-@{rand8} rw, owner @{desktop_config_dirs}/ibus/bus/ r, owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index 066adc056..fbb924969 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -33,6 +33,7 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + owner @{desktop_cache_dirs}/ibus/dbus-@{rand8} rw, owner @{desktop_config_dirs}/ibus/bus/ r, owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, diff --git a/apparmor.d/groups/children/child-open-strict b/apparmor.d/groups/children/child-open-strict index cea3dc5e0..f5d0d8ca0 100644 --- a/apparmor.d/groups/children/child-open-strict +++ b/apparmor.d/groups/children/child-open-strict @@ -15,8 +15,8 @@ profile child-open-strict { include include - @{browsers_path} rPx, - @{file_explorers_path} rPx, + @{browsers_path} Px, + @{file_explorers_path} Px, include if exists include if exists diff --git a/apparmor.d/groups/children/child-pager b/apparmor.d/groups/children/child-pager index 45ac2516a..504a3fb03 100644 --- a/apparmor.d/groups/children/child-pager +++ b/apparmor.d/groups/children/child-pager @@ -14,7 +14,7 @@ abi , include @{exec_path} = @{bin}/pager @{bin}/less @{bin}/more -profile child-pager { +profile child-pager flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/freedesktop/cpupower b/apparmor.d/groups/freedesktop/cpupower index 58d4f0e84..2022a208c 100644 --- a/apparmor.d/groups/freedesktop/cpupower +++ b/apparmor.d/groups/freedesktop/cpupower @@ -40,7 +40,6 @@ profile cpupower @{exec_path} { /dev/cpu/@{int}/msr r, - profile kmod { include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 02cf99b01..8184ffbdf 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -11,6 +11,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 5797f27bf..6be9e2126 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -49,7 +49,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/xkbcomp rPx, - @{bin}/pkexec rPx, + @{bin}/pkexec rCx -> pkexec, @{lib}/xorg/ r, @{lib}/xorg/modules/ r, @@ -136,6 +136,13 @@ profile xorg @{exec_path} flags=(attach_disconnected) { /dev/tty@{int} rw, /dev/vga_arbiter rw, # Graphic card modules + profile pkexec { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index db1c43d84..d9e121c41 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -23,7 +23,7 @@ profile gdm-generate-config @{exec_path} { @{sh_path} rix, @{bin}/dconf rix, @{bin}/install rix, - @{bin}/pgrep rCx -> pgrep, + @{bin}/pgrep rix, @{bin}/pkill rix, @{bin}/setpriv rix, @{bin}/setsid rix, @@ -46,13 +46,6 @@ profile gdm-generate-config @{exec_path} { @{PROC}/@{pid}/stat r, @{PROC}/uptime r, - profile pgrep { - include - include - - include if exists - } - include if exists } diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 639b7a144..4e9539968 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -23,6 +23,8 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { include include include + include + include @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-clocks b/apparmor.d/groups/gnome/gnome-clocks index 5ebd08e5a..d8f77070b 100644 --- a/apparmor.d/groups/gnome/gnome-clocks +++ b/apparmor.d/groups/gnome/gnome-clocks @@ -13,6 +13,8 @@ profile gnome-clocks @{exec_path} { include include include + include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 04f90e33a..0fd0d1e83 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -163,6 +163,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { member=Introspect peer=(name=org.freedesktop.DBus, label=dbus-session), + dbus send bus=session path=/org/gnome/*/SearchProvider + interface=org.gnome.Shell.SearchProvider2 + peer=(name=@{busname}), + @{exec_path} mr, @{bin}/unzip rix, @@ -280,7 +284,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw, owner @{run}/user/@{uid}/systemd/notify rw, - owner /dev/shm/.org.chromium.Chromium.@{rand6} r, + owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, owner /dev/shm/wayland.mozilla.ipc.@{int} rw, /tmp/.X@{int}-lock rw, @@ -343,6 +347,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/cpu.max r, @{PROC}/ r, + @{PROC}/@{pid}/attr/current r, + @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/net/* r, @{PROC}/1/cgroup r, @@ -350,8 +356,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{PROC}/sys/kernel/osrelease r, @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, @{PROC}/vmstat r, - owner @{PROC}/@{pid}/attr/current r, - owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index fe9123e5b..e10c0cc22 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/yelp @{bin}/gnome-help profile yelp @{exec_path} { include + include include include include diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 4ccb1088d..2c72da3b0 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -11,15 +11,15 @@ profile makepkg @{exec_path} { include include - signal send set=winch peer=pacman, - signal send set=winch peer=pacman//systemctl, - network inet stream, network inet6 stream, network inet dgram, network inet6 dgram, network netlink raw, + signal send set=winch peer=pacman, + signal send set=winch peer=pacman//systemctl, + file, @{bin}/gpg{,2} Cx -> gpg, @@ -74,6 +74,9 @@ profile makepkg @{exec_path} { ptrace read, + signal send set=winch peer=pacman, + signal send set=winch peer=pacman//systemctl, + @{bin}/pacman Px, include if exists diff --git a/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules b/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules index aae81662b..54a002506 100644 --- a/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules +++ b/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules @@ -9,6 +9,7 @@ include @{exec_path} = /usr/share/libalpm/scripts/gtk4-querymodules profile pacman-hook-gtk4-querymodules @{exec_path} { include + include capability dac_read_search, diff --git a/apparmor.d/groups/pacman/pacman-key b/apparmor.d/groups/pacman/pacman-key index 0375c7863..a8fb360cd 100644 --- a/apparmor.d/groups/pacman/pacman-key +++ b/apparmor.d/groups/pacman/pacman-key @@ -65,9 +65,10 @@ profile pacman-key @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat rw, - /dev/pts/@{int} rw, - /dev/tty@{int} rw, + /dev/pts/@{int} rw, + /dev/tty@{int} rw, + include if exists } include if exists diff --git a/apparmor.d/groups/pacman/reflector b/apparmor.d/groups/pacman/reflector index 7b277fb3e..135a5bdf3 100644 --- a/apparmor.d/groups/pacman/reflector +++ b/apparmor.d/groups/pacman/reflector @@ -29,9 +29,10 @@ profile reflector @{exec_path} flags=(attach_disconnected) { /etc/xdg/reflector/reflector.conf r, /etc/pacman.d/mirrorlist rw, - owner @{user_cache_dirs}/mirrorstatus.json rw, /var/cache/reflector/mirrorstatus.json rw, + owner @{user_cache_dirs}/mirrorstatus.json r, + @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, diff --git a/apparmor.d/groups/ssh/ssh-agent b/apparmor.d/groups/ssh/ssh-agent index d6dc90447..174efb5a4 100644 --- a/apparmor.d/groups/ssh/ssh-agent +++ b/apparmor.d/groups/ssh/ssh-agent @@ -25,8 +25,8 @@ profile ssh-agent @{exec_path} { owner @{HOME}/.xsession-errors w, owner @{user_projects_dirs}/**/ssh/{,*} r, - owner @{tmp}/ssh-*/ rw, - owner @{tmp}/ssh-*/agent.* rw, + owner @{tmp}/ssh-@{rand12}/ rw, + owner @{tmp}/ssh-@{rand12}/agent.@{int} rw, owner @{run}/user/@{uid}/keyring/.ssh rw, owner @{run}/user/@{uid}/openssh_agent rw, diff --git a/apparmor.d/groups/systemd/systemd-sleep b/apparmor.d/groups/systemd/systemd-sleep index a17c13631..a683e3a78 100644 --- a/apparmor.d/groups/systemd/systemd-sleep +++ b/apparmor.d/groups/systemd/systemd-sleep @@ -31,7 +31,6 @@ profile systemd-sleep @{exec_path} { @{sys}/power/state rw, - include if exists } diff --git a/apparmor.d/groups/virt/cockpit-certificate-helper b/apparmor.d/groups/virt/cockpit-certificate-helper index 042c9cdad..01d23171b 100644 --- a/apparmor.d/groups/virt/cockpit-certificate-helper +++ b/apparmor.d/groups/virt/cockpit-certificate-helper @@ -13,15 +13,15 @@ profile cockpit-certificate-helper @{exec_path} { @{exec_path} mr, - @{sh_path} rix, - @{bin}/chmod rix, - @{bin}/id rix, - @{bin}/mkdir rix, - @{bin}/mv rix, - @{bin}/openssl rix, - @{bin}/rm rix, - @{bin}/sscg rix, - @{bin}/tr rix, + @{sh_path} rix, + @{bin}/chmod rix, + @{bin}/id rix, + @{bin}/mkdir rix, + @{bin}/mv rix, + @{bin}/openssl rix, + @{bin}/rm rix, + @{bin}/sscg rix, + @{bin}/tr rix, /etc/machine-id r, /etc/cockpit/ws-certs.d/* w, diff --git a/apparmor.d/groups/virt/containerd b/apparmor.d/groups/virt/containerd index 9ae6596ee..182240228 100644 --- a/apparmor.d/groups/virt/containerd +++ b/apparmor.d/groups/virt/containerd @@ -47,7 +47,7 @@ profile containerd @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/apparmor_parser rPx, - @{bin}/containerd-shim-runc-v2 rPUx, + @{bin}/containerd-shim-runc-v2 rPx, @{bin}/kmod rPx, @{bin}/unpigz rPUx, /{usr/,}{local/,}{s,}bin/zfs rPx, @@ -71,8 +71,7 @@ profile containerd @{exec_path} flags=(attach_disconnected) { /var/lib/cni/results/cni-loopback-@{uuid}-lo wl, /var/lib/cni/results/cni-loopback-[0-9a-z]*-lo wl, /var/lib/cni/results/k8s-pod-network-[0-9a-z]*-eth0 wl, - /var/lib/containerd/{,**} rwk, - /var/lib/containerd/tmpmounts/containerd-mount@{int}/** l, + /var/lib/containerd/{,**} rwlk, /var/lib/docker/containerd/{,**} rwk, /var/lib/kubelet/seccomp/{,**} r, /var/lib/security-profiles-operator/{,**} r, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 9e17f678b..def1d76b2 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -27,19 +27,22 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { capability sys_ptrace, network inet dgram, - network inet6 dgram, network inet stream, + network inet6 dgram, network inet6 stream, network netlink raw, - mount /tmp/containerd-mount@{int}/, - mount /var/lib/docker/buildkit/**/, - mount /var/lib/docker/overlay2/**/, - mount /var/lib/docker/tmp/buildkit-mount@{int}/, - mount options=(rw, bind) -> /run/docker/netns/*, - mount options=(rw, rbind) -> /var/lib/docker/tmp/docker-builder@{int}/, - mount options=(rw, rprivate) -> /.pivot_root@{int}/, - mount options=(rw, rslave) -> /, + mount /tmp/containerd-mount@{int}/, + mount /var/lib/docker/buildkit/**/, + mount /var/lib/docker/overlay2/**/, + mount /var/lib/docker/tmp/buildkit-mount@{int}/, + mount fstype=overlay overlay -> /var/lib/docker/rootfs/overlayfs/@{hex64}/, + mount options=(rw bind) -> /run/docker/netns/*, + mount options=(rw rbind) -> /var/lib/docker/tmp/docker-builder@{int}/, + mount options=(rw rbind) /var/lib/docker/volumes/**/- -> /var/lib/docker/rootfs/overlayfs/**/, + mount options=(rw rprivate) -> /.pivot_root@{int}/, + mount options=(rw rprivate) -> /var/lib/docker/rootfs/overlayfs/@{hex64}/var/lib/buildkit/, + mount options=(rw rslave) -> /, remount /tmp/containerd-mount@{int10}/, remount /var/lib/docker/tmp/buildkit-mount@{int10}/, @@ -48,18 +51,20 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { umount /run/docker/netns/*, umount /tmp/containerd-mount@{int}/, umount /var/lib/docker/buildkit/**/, + umount /var/lib/docker/rootfs/**/, umount /var/lib/docker/overlay*/**/, umount /var/lib/docker/tmp/buildkit-mount@{int}/, - pivot_root oldroot=/var/lib/docker/overlay*/**/.pivot_root@{int}/ /var/lib/docker/overlay2/**/, - pivot_root oldroot=/var/lib/docker/tmp/**/.pivot_root@{int}/ /var/lib/docker/tmp/**/, + pivot_root oldroot=/var/lib/docker/overlay*/**/.pivot_root@{int}/ /var/lib/docker/overlay2/**/, + pivot_root oldroot=/var/lib/docker/rootfs/overlayfs/@{hex64}/.pivot_root@{int}/ /var/lib/docker/rootfs/overlayfs/@{hex64}/, + pivot_root oldroot=/var/lib/docker/tmp/**/.pivot_root@{int}/ /var/lib/docker/tmp/**/, - ptrace (read) peer=docker-*, - ptrace (read) peer=unconfined, + ptrace read peer=docker-*, + ptrace read peer=unconfined, - signal (send) set=int peer=docker-proxy, - signal (send) set=kill peer=docker-*, - signal (send) set=term peer=containerd, + signal send set=int peer=docker-proxy, + signal send set=kill peer=docker-*, + signal send set=term peer=containerd, @{exec_path} mrix, diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index 30c03508a..5f00f8386 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -33,7 +33,7 @@ profile aa-enforce @{exec_path} { owner @{tmp}/@{rand8} rw, owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, - @{PROC}/@{pid}/fd r, + @{PROC}/@{pid}/fd/ r, include if exists } diff --git a/apparmor.d/profiles-a-f/aa-log b/apparmor.d/profiles-a-f/aa-log index bfd0b457e..8ad4d1a24 100644 --- a/apparmor.d/profiles-a-f/aa-log +++ b/apparmor.d/profiles-a-f/aa-log @@ -27,6 +27,8 @@ profile aa-log @{exec_path} { /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/{,*} r, + @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, + /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/profiles-a-f/aa-notify b/apparmor.d/profiles-a-f/aa-notify index f2ff96df4..95d24c9e9 100644 --- a/apparmor.d/profiles-a-f/aa-notify +++ b/apparmor.d/profiles-a-f/aa-notify @@ -18,17 +18,19 @@ profile aa-notify @{exec_path} { capability setuid, capability sys_ptrace, - ptrace (read), + ptrace read, @{exec_path} mr, @{bin}/ r, - /etc/apparmor/*.conf r, - /etc/inputrc r, - /usr/etc/inputrc.keys r, /usr/share/terminfo/** r, + @{etc_ro}/inputrc r, + @{etc_ro}/inputrc.keys r, + /etc/apparmor.d/{,**} r, + /etc/apparmor/*.conf r, + /var/log/audit/audit.log r, owner @{HOME}/.inputrc r, diff --git a/apparmor.d/profiles-a-f/chronyd b/apparmor.d/profiles-a-f/chronyd index a7d265e29..79fbf8d80 100644 --- a/apparmor.d/profiles-a-f/chronyd +++ b/apparmor.d/profiles-a-f/chronyd @@ -36,7 +36,8 @@ profile chronyd @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, /etc/adjtime r, - /etc/chrony.* r, + /etc/chrony.conf r, + /etc/chrony.keys r, /etc/chrony.d/{,*} r, /etc/chrony/{,**} r, diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index fc2aadd1c..3ff222b4a 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -38,14 +38,17 @@ profile discord @{exec_path} { @{open_path} rPx -> child-open-strict, + /etc/lsb-release r, + owner @{user_videos_dirs}/{,**} rwl, owner @{user_pictures_dirs}/{,**} rwl, - owner @{tmp}/net-export/ rw, - owner @{tmp}/discord.sock rw, - owner "@{tmp}/Discord Crashes/" rw, + owner @{config_dirs}/@{version}/modules/** m, - audit owner @{config_dirs}/*/modules/** rm, + owner "@{tmp}/Discord Crashes/" rw, + owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw, + owner @{tmp}/discord.sock rw, + owner @{tmp}/net-export/ rw, owner @{run}/user/@{uid}/discord-ipc-@{int} rw, diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index b3cd7e34b..e7d46f1f5 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -32,7 +32,9 @@ profile element-desktop @{exec_path} { @{sh_path} r, @{open_path} rPx -> child-open-strict, - @{bin}/xdg-settings rPx, + + #aa:stack X xdg-settings + @{bin}/xdg-settings rPx -> element-desktop//&xdg-settings, /usr/share/webapps/element/{,**} r, diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index e82f0d372..8f81ad522 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -38,6 +38,8 @@ profile file-roller @{exec_path} { @{bin}/zstd rix, @{lib}/p7zip/7z rix, + / r, + @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index f61879407..d89f8c524 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -95,7 +95,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain /dev/tty rw, /dev/tty@{int} rw, - deny @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_share_dirs}/gvfs-metadata/* r, profile gpg { include diff --git a/apparmor.d/profiles-a-f/flatpak-session-helper b/apparmor.d/profiles-a-f/flatpak-session-helper index 5f02a2fac..1706f4b21 100644 --- a/apparmor.d/profiles-a-f/flatpak-session-helper +++ b/apparmor.d/profiles-a-f/flatpak-session-helper @@ -39,6 +39,8 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { /var/lib/flatpak/app/*/**/@{bin}/** rPx -> flatpak-app, /var/lib/flatpak/app/*/**/@{lib}/** rPx -> flatpak-app, + owner @{user_config_dirs}/mimeapps.list w, + owner @{run}/user/@{uid}/.flatpak-helper/{,**} rw, owner @{run}/user/@{uid}/.flatpak-helper/pkcs11-flatpak-@{int} rw, diff --git a/apparmor.d/profiles-a-f/foliate b/apparmor.d/profiles-a-f/foliate index 8498285d1..3592893e9 100644 --- a/apparmor.d/profiles-a-f/foliate +++ b/apparmor.d/profiles-a-f/foliate @@ -24,11 +24,14 @@ profile foliate @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=com.github.johnfactotum.Foliate + @{exec_path} mr, @{bin}/bwrap rix, @{bin}/gjs-console rix, @{bin}/xdg-dbus-proxy rix, + @{bin}/speech-dispatcher rPx, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix, diff --git a/apparmor.d/profiles-g-l/gajim b/apparmor.d/profiles-g-l/gajim index 5888743ef..033f082f2 100644 --- a/apparmor.d/profiles-g-l/gajim +++ b/apparmor.d/profiles-g-l/gajim @@ -100,15 +100,16 @@ profile gajim @{exec_path} { @{bin}/{,@{multiarch}-}ld.bfd rix, @{lib}/gcc/@{multiarch}/@{int}/collect2 rix, - owner @{tmp}/cc* rw, - owner @{tmp}/tmp* rw, + /etc/debian_version r, /media/ccache/*/** rw, + owner @{tmp}/cc* rw, + owner @{tmp}/tmp* rw, + owner @{run}/user/@{uid}/ccache-tmp/ rw, - /etc/debian_version r, - + include if exists } profile gpg { @@ -121,8 +122,8 @@ profile gajim @{exec_path} { @{bin}/gpg-agent rix, @{lib}/{,gnupg/}scdaemon rix, - owner @{run}/user/@{uid}/gnupg/d.*/ rw, - owner @{run}/user/@{uid}/gnupg/d.*/S.gpg-agent{,.extra,.browser,.ssh} w, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.extra,.browser,.ssh} w, owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, @@ -134,6 +135,7 @@ profile gajim @{exec_path} { @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/task/@{tid}/comm rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/gio-querymodules b/apparmor.d/profiles-g-l/gio-querymodules index 3520ec06e..3f4ef7fed 100644 --- a/apparmor.d/profiles-g-l/gio-querymodules +++ b/apparmor.d/profiles-g-l/gio-querymodules @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/gio-querymodules profile gio-querymodules @{exec_path} flags=(attach_disconnected) { include + include capability dac_read_search, capability mknod, diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index 96c9b6d25..c494e16d5 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -18,7 +18,6 @@ profile keepassxc @{exec_path} { include include include - include include include include @@ -93,7 +92,7 @@ profile keepassxc @{exec_path} { /dev/shm/#@{int} rw, /dev/tty rw, - /dev/urandom rw, + /dev/urandom w, owner /dev/tty@{int} rw, # Silencer diff --git a/apparmor.d/profiles-m-r/ntfs-3g b/apparmor.d/profiles-m-r/ntfs-3g index a7a580c41..bc2cb7ef3 100644 --- a/apparmor.d/profiles-m-r/ntfs-3g +++ b/apparmor.d/profiles-m-r/ntfs-3g @@ -22,15 +22,6 @@ profile ntfs-3g @{exec_path} flags=(attach_disconnected) { capability setuid, capability sys_admin, - @{exec_path} mr, - - @{bin}/kmod rPx, # To load the fuse kernel module - - # Mount points - @{MOUNTDIRS}/ r, - @{MOUNTS}/ r, - @{MOUNTS}/*/ r, - # Allow to mount ntfs disks only under the /media/, /run/media, and /mnt/ dirs mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTDIRS}, mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/, @@ -47,12 +38,22 @@ profile ntfs-3g @{exec_path} flags=(attach_disconnected) { umount @{MOUNTS}/, umount @{MOUNTS}/*/, + @{exec_path} mr, + + @{bin}/kmod rPx, # To load the fuse kernel module + + # Mount points + @{MOUNTDIRS}/ r, + @{MOUNTS}/ r, + @{MOUNTS}/*/ r, + @{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/task/@{tid}/status r, @{PROC}/swaps r, owner @{PROC}/@{pid}/mounts r, /dev/fuse rw, + /dev/tty@{int} rw, include if exists } diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index b3c963dde..a5a46ac48 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -60,7 +60,7 @@ profile pass @{exec_path} { /usr/share/terminfo/** r, owner @{user_password_store_dirs}/{,**} rw, - owner /dev/shm/pass.*/{,*} rw, + owner /dev/shm/pass.@{rand}/{,*} rw, @{sys}/devices/system/node/ r, @@ -90,7 +90,7 @@ profile pass @{exec_path} { owner @{user_password_store_dirs}/{,**/} r, - owner /dev/shm/pass.*/{,*} rw, + owner /dev/shm/pass.@{rand}/{,*} rw, deny owner @{HOME}/ r, @@ -124,7 +124,7 @@ profile pass @{exec_path} { owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**, owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature - owner /dev/shm/pass.*/.git_vtag_tmp@{rand6} rw, + owner /dev/shm/pass.@{rand}/.git_vtag_tmp@{rand6} rw, include if exists } @@ -144,7 +144,7 @@ profile pass @{exec_path} { owner @{user_password_store_dirs}/ rw, owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**, - owner /dev/shm/pass.*/{,*} rw, + owner /dev/shm/pass.@{rand}/* rw, owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature owner /dev/pts/@{int} rw, diff --git a/apparmor.d/profiles-m-r/passwd b/apparmor.d/profiles-m-r/passwd index f37f5651d..b0e326b2d 100644 --- a/apparmor.d/profiles-m-r/passwd +++ b/apparmor.d/profiles-m-r/passwd @@ -21,7 +21,7 @@ profile passwd @{exec_path} { capability net_admin, capability setuid, - signal (receive) set=(term, kill) peer=gnome-control-center, + signal receive set=(term kill) peer=gnome-control-center, network netlink raw, diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index f6bc7e4b8..e34722fb9 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # Copyright (C) 2024 curiosityseeker # SPDX-License-Identifier: GPL-2.0-only @@ -28,7 +29,7 @@ profile protonmail @{exec_path} flags=(complain) { @{exec_path} mrix, @{bin}/xdg-settings Px, - @{open_path} rpx -> child-open, + @{open_path} Px -> child-open, owner @{user_config_dirs}/ibus/bus/ r, diff --git a/apparmor.d/profiles-m-r/rpi-imager b/apparmor.d/profiles-m-r/rpi-imager index 641217f56..b341bb736 100644 --- a/apparmor.d/profiles-m-r/rpi-imager +++ b/apparmor.d/profiles-m-r/rpi-imager @@ -8,24 +8,17 @@ abi , include @{exec_path} = @{bin}/rpi-imager -profile rpi-imager @{exec_path} { +profile rpi-imager @{exec_path} flags=(complain) { include include + include include - include - include include - include - include - include - include + include include - include - include include include include - include #capability sys_admin, # deny capability sys_nice, @@ -42,18 +35,15 @@ profile rpi-imager @{exec_path} { @{bin}/lsblk rPx, /etc/fstab r, - /etc/X11/cursors/*.theme r, - /usr/share/hwdata/pnp.ids r, - /usr/share/X11/xkb/{,**} r, /etc/machine-id r, /var/lib/dbus/machine-id r, owner "@{user_cache_dirs}/Raspberry Pi/" rw, owner "@{user_cache_dirs}/Raspberry Pi/**" rwl -> "@{user_cache_dirs}/Raspberry Pi/**", - owner "@{user_config_dirs}/Raspberry Pi/{,**}" rw, - owner @{user_cache_dirs}/ rw, - owner @{user_config_dirs}/QtProject.conf r, + + owner "@{user_config_dirs}/Raspberry Pi/" rw, + owner "@{user_config_dirs}/Raspberry Pi/**" rwlk -> "@{user_config_dirs}/Raspberry Pi/**", owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox index 0dc19e1af..10e1de4b3 100644 --- a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox +++ b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox @@ -30,5 +30,4 @@ profile signal-desktop-chrome-sandbox @{exec_path} { include if exists } - # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index 672ae2f7b..ae061b032 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -28,6 +28,7 @@ profile snapd @{exec_path} { capability dac_read_search, capability fowner, capability fsetid, + capability mac_admin, capability net_admin, capability setgid, capability setuid, @@ -153,6 +154,7 @@ profile snapd @{exec_path} { @{sys}/fs/cgroup/user.slice/ r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r, @{sys}/kernel/kexec_loaded r, + @{sys}/kernel/security/apparmor/.notify r, @{sys}/kernel/security/apparmor/features/{,**} r, @{sys}/kernel/security/apparmor/profiles r, diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 447ef9f16..b1dd83471 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -247,6 +247,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include include @@ -254,6 +255,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include + capability dac_override, capability dac_read_search, capability sys_chroot, @@ -304,12 +306,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner /var/cache/ldconfig/aux-cache* rw, owner /var/pressure-vessel/ldso/* rw, - owner @{HOME}/.pki/ rw, - owner @{HOME}/.pki/nssdb/ rw, - owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, - owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, - owner @{HOME}/.pki/nssdb/pkcs11.txt rw, - owner @{lib_dirs}/.cef-* wk, owner @{share_dirs}/{,**} r, @@ -320,14 +316,12 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{tmp}/ r, owner @{tmp}/#@{int} rw, - owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, owner @{tmp}/dumps/ rw, owner @{tmp}/dumps/** rwk, owner @{tmp}/pressure-vessel-*-@{rand6}/ rw, owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, - owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw, owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, @@ -389,7 +383,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{share_dirs}/ r, - @{PROC}/@{pid}/cgroup r, + @{PROC}/1/cgroup r, include if exists } diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton index 8f1939bd1..0facb49ac 100644 --- a/apparmor.d/profiles-s-z/steam-game-proton +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -19,6 +19,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected) { include include + capability dac_override, capability dac_read_search, network inet dgram, diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index e0c6b146d..b1fca8df4 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -41,9 +41,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { @{app_dirs}/@{runtime}/*entry-point rmix, @{app_dirs}/@{runtime}/pressure-vessel/@{bin}/pressure-vessel-* rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/** mr, - @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-capsule-capture-libs rix, - @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-* rix, - @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-inspect-library rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rpx -> steam-game-proton, @{app_dirs}/@{runtime}/run rix, @{bin}/bwrap rpx -> steam-game-proton, diff --git a/apparmor.d/profiles-s-z/steam-runtime-steam-remote b/apparmor.d/profiles-s-z/steam-runtime-steam-remote index 1a6dd4063..c962f61ee 100644 --- a/apparmor.d/profiles-s-z/steam-runtime-steam-remote +++ b/apparmor.d/profiles-s-z/steam-runtime-steam-remote @@ -18,7 +18,7 @@ profile steam-runtime-steam-remote @{exec_path} flags=(complain) { @{exec_path} mr, - @{runtime_dirs}/** rm, + @{runtime_dirs}/** mr, owner @{HOME}/.steam/steam.pipe rw, From 08a6f8fb0b024f30f1dde5525b7213618a9a4790 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 17:49:43 +0100 Subject: [PATCH 0260/1455] tests(packer): enable apparmor debug in tests image. --- tests/boxes.yml | 6 +++++- tests/packer/init/archlinux-gnome.user-data.yml | 2 +- tests/packer/init/archlinux-kde.user-data.yml | 2 +- tests/packer/init/archlinux-server.user-data.yml | 2 +- tests/packer/init/init.sh | 10 ++++++++-- tests/packer/init/opensuse-kde.user-data.yml | 6 ++++-- 6 files changed, 20 insertions(+), 8 deletions(-) diff --git a/tests/boxes.yml b/tests/boxes.yml index 9846342c5..edda41096 100644 --- a/tests/boxes.yml +++ b/tests/boxes.yml @@ -2,7 +2,7 @@ defaults: uefi: true - ram: '6144' + ram: '4096' cpu: '6' boxes: @@ -14,6 +14,10 @@ boxes: box: aa-archlinux-kde uefi: false + - name: arch-xfce + box: aa-archlinux-xfce + uefi: false + - name: arch-server box: aa-archlinux-server uefi: false diff --git a/tests/packer/init/archlinux-gnome.user-data.yml b/tests/packer/init/archlinux-gnome.user-data.yml index 855bc58ea..c65dfc4dd 100644 --- a/tests/packer/init/archlinux-gnome.user-data.yml +++ b/tests/packer/init/archlinux-gnome.user-data.yml @@ -77,7 +77,7 @@ write_files: - path: /etc/default/grub append: true content: | - GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf" + GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor.debug=1" # Set some bash aliases - path: /etc/skel/.bashrc diff --git a/tests/packer/init/archlinux-kde.user-data.yml b/tests/packer/init/archlinux-kde.user-data.yml index a85ca16d4..97e8ffa7b 100644 --- a/tests/packer/init/archlinux-kde.user-data.yml +++ b/tests/packer/init/archlinux-kde.user-data.yml @@ -79,7 +79,7 @@ write_files: - path: /etc/default/grub append: true content: | - GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf" + GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor.debug=1" # Set some bash aliases - path: /etc/skel/.bashrc diff --git a/tests/packer/init/archlinux-server.user-data.yml b/tests/packer/init/archlinux-server.user-data.yml index 034cd22d6..93fd254a5 100644 --- a/tests/packer/init/archlinux-server.user-data.yml +++ b/tests/packer/init/archlinux-server.user-data.yml @@ -56,7 +56,7 @@ write_files: - path: /etc/default/grub append: true content: | - GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf" + GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor.debug=1" # Set some bash aliases - path: /etc/skel/.bashrc diff --git a/tests/packer/init/init.sh b/tests/packer/init/init.sh index 6a80b1993..df300c0c4 100644 --- a/tests/packer/init/init.sh +++ b/tests/packer/init/init.sh @@ -24,8 +24,13 @@ main() { install -Dm0755 $SRC/aa-log-clean /usr/bin/aa-log-clean cat $SRC/parser.conf >>/etc/apparmor/parser.conf chown -R "$SUDO_USER:$SUDO_USER" "/home/$SUDO_USER/.config/" + case "$DISTRIBUTION" in - arch) pacman --noconfirm -U $SRC/*.pkg.tar.zst ;; + arch) + pacman --noconfirm -U $SRC/*.pkg.tar.zst + systemctl start apparmor.service + ;; + debian | ubuntu) apt-get update -y apt-get install -y apparmor-profiles build-essential config-package-dev \ @@ -34,8 +39,9 @@ main() { ;; opensuse*) + mv "/home/$SUDO_USER/.bash_aliases" "/home/$SUDO_USER/.alias" zypper install -y bash-completion git go htop make rsync vim - sudo rpm -i $SRC/*.rpm + rpm -i $SRC/*.rpm ;; esac diff --git a/tests/packer/init/opensuse-kde.user-data.yml b/tests/packer/init/opensuse-kde.user-data.yml index 6c1c7cfff..b54bb458e 100644 --- a/tests/packer/init/opensuse-kde.user-data.yml +++ b/tests/packer/init/opensuse-kde.user-data.yml @@ -19,12 +19,14 @@ package_update: true package_upgrade: true package_reboot_if_required: false packages: + - apparmor-profiles - bash-completion + - distribution-release - git - - go + - golang-packaging - htop - make - - rsync + - rpmbuild - vim write_files: From cee1e9a3f2dd85578457a408d52ed773ecc08952 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 18:09:52 +0100 Subject: [PATCH 0261/1455] fix(profile): nnp in strawberry. fix #538 --- apparmor.d/profiles-s-z/strawberry | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index 484a4069d..acba17f78 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -37,7 +37,7 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{exec_path} mr, - @{bin}/strawberry-tagreader rPx, + @{bin}/strawberry-tagreader rPx -> strawberry//&strawberry-tagreader, @{open_path} rPx -> child-open-help, From 7033a13bc2ec697f81704a20ac90992e6efef4c0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 18:15:51 +0100 Subject: [PATCH 0262/1455] fix(profile): update ufw. fix #537 --- apparmor.d/profiles-s-z/ufw | 15 ++++++++++++--- dists/flags/main.flags | 1 + 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 525e543b9..685eed20a 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -16,10 +16,16 @@ profile ufw @{exec_path} { capability dac_read_search, capability net_admin, + capability net_raw, + capability sys_ptrace, - network netlink raw, network inet dgram, + network inet raw, network inet6 dgram, + network inet6 raw, + network netlink raw, + + ptrace read, @{exec_path} mr, @@ -27,14 +33,16 @@ profile ufw @{exec_path} { @{bin}/cat ix, @{bin}/env r, @{bin}/python3.@{int} ix, + @{bin}/sysctl ix, @{bin}/xtables-legacy-multi ix, @{bin}/xtables-nft-multi ix, @{lib}/ufw/ufw-init ix, - /etc/default/ufw r, + /etc/default/ufw rw, /etc/ufw/ rw, /etc/ufw/** rwk, + @{run}/xtables.lock rwk, owner @{run}/ufw.lock rwk, owner @{tmp}/@{word8} rw, @@ -45,9 +53,10 @@ profile ufw @{exec_path} { @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/net/ip_tables_names r, @{PROC}/@{pid}/stat r, + @{PROC}/sys/net/ipv{4,6}/** rw, + @{PROC}/sys/kernel/modprobe r, include if exists - } # vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 16c616404..e1c8a057a 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -382,6 +382,7 @@ tracker-writeback complain udev-dmi-memory-id complain udisksctl complain udisksd attach_disconnected,complain +ufw complain update-grub complain update-secureboot-policy complain userdbctl complain From b96362d915ae05fe467a686d756a1bc6d82df394 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 18:30:13 +0100 Subject: [PATCH 0263/1455] fix(profile): add mkinitcpio to create UKI. fix #535 --- apparmor.d/groups/pacman/mkinitcpio | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index b83ea2d3c..0598b5d64 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -24,6 +24,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{coreutils_path} rix, + @{bin}/{m,g,}awk rix, @{bin}/bsdtar rix, @{bin}/fc-match rix, @{bin}/findmnt rPx, @@ -34,6 +35,8 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { @{bin}/ldconfig rix, @{bin}/ldd rix, @{bin}/loadkeys rix, + @{bin}/objcopy rix, + @{bin}/objdump rix, @{bin}/tput rix, @{bin}/xz rix, @{bin}/zcat rix, @@ -45,8 +48,10 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { @{bin}/modprobe rPx, @{bin}/plymouth rPx, @{bin}/plymouth-set-default-theme rPx, + @{bin}/sbctl rPx, @{lib}/initcpio/busybox rix, + @{lib}/initcpio/post/** rix, @{lib}/ld-*.so* rix, /etc/fstab r, @@ -82,15 +87,22 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { /boot/initramfs-*.img* rw, /boot/vmlinuz-* r, - # Temp files - owner @{run}/initramfs/{,**} rw, - owner @{run}/mkinitcpio.@{rand6}/{,**} rwl, + /usr/share/systemd/bootctl/** r, + + /etc/kernel/** r, + + /tmp/mkinitcpio.@{rand6} rw, + /tmp/mkinitcpio.@{rand6}.tmp rw, owner @{tmp}/mkinitcpio.@{rand6} rw, owner @{tmp}/mkinitcpio.@{rand6}/{,**} rwl, + owner @{run}/initcpio-tmp/mkinitcpio.@{rand6}/{,**} rwl, + owner @{run}/initramfs/{,**} rw, + owner @{run}/mkinitcpio.@{rand6}/{,**} rwl, @{sys}/class/block/ r, @{sys}/devices/{,**} r, + @{sys}/firmware/efi/fw_platform_size r, owner @{PROC}/@{pid}/mountinfo r, From bd0f3448cbbc35f35a47dc44d6aaf0c0aceb8bd4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 18:32:39 +0100 Subject: [PATCH 0264/1455] fix(profile): whereis: allow search in /opt. fix #532 --- apparmor.d/profiles-s-z/whereis | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-s-z/whereis b/apparmor.d/profiles-s-z/whereis index e7bc743a5..4a1293c0a 100644 --- a/apparmor.d/profiles-s-z/whereis +++ b/apparmor.d/profiles-s-z/whereis @@ -27,8 +27,8 @@ profile whereis @{exec_path} { /usr/src/{**,} r, /opt/ r, - /opt/cni/bin/ r, - /opt/containerd/bin/ r, + /opt/**/bin/ r, + /opt/**/lib/ r, @{etc_ro}/ r, From e7620c7517e169fda95d0fc38380b7a1a2928398 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 18:34:45 +0100 Subject: [PATCH 0265/1455] fix(profile): child-pager: needs file magic fix #533 --- apparmor.d/groups/children/child-pager | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/children/child-pager b/apparmor.d/groups/children/child-pager index 504a3fb03..7170009ae 100644 --- a/apparmor.d/groups/children/child-pager +++ b/apparmor.d/groups/children/child-pager @@ -27,6 +27,7 @@ profile child-pager flags=(attach_disconnected) { @{exec_path} mr, @{system_share_dirs}/terminfo/{,**} r, + /usr/share/file/misc/** r, @{HOME}/.lesshst r, From e6b1763bbcc3d6517c28f6a7864dfee2d971cf53 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 18:35:52 +0100 Subject: [PATCH 0266/1455] fix(profile): nethogs fix 530 --- apparmor.d/profiles-m-r/nethogs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/profiles-m-r/nethogs b/apparmor.d/profiles-m-r/nethogs index e39e64621..fbdaecaac 100644 --- a/apparmor.d/profiles-m-r/nethogs +++ b/apparmor.d/profiles-m-r/nethogs @@ -24,6 +24,8 @@ profile nethogs @{exec_path} { @{exec_path} mr, + /usr/share/terminfo/** r, + @{PROC}/ r, @{PROC}/@{pids}/fd/ r, @{PROC}/@{pids}/cmdline r, From 30999904e7ac2b2ee8a2c14a4249228441a4d079 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 19:19:16 +0100 Subject: [PATCH 0267/1455] fix(profile): various fixes fix #528 #527 #518 #517 --- apparmor.d/groups/freedesktop/upowerd | 1 + apparmor.d/groups/freedesktop/xwayland | 1 + apparmor.d/profiles-g-l/libreoffice | 5 +++-- apparmor.d/profiles-m-r/mpv | 4 ++++ 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index aa93e0267..a6032976d 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -34,6 +34,7 @@ profile upowerd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, + @{run}/udev/data/+serio:* r, # for serial mice @{run}/udev/data/+power_supply* r, @{run}/udev/data/+sound:card@{int} r, # for sound card @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland index a4f98c096..9b61e7dea 100644 --- a/apparmor.d/groups/freedesktop/xwayland +++ b/apparmor.d/groups/freedesktop/xwayland @@ -11,6 +11,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) { include include include + include include signal (receive) set=(term hup) peer=gdm*, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 86efb49a2..1271b8c1a 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -97,8 +97,9 @@ profile libreoffice @{exec_path} { @{sys}/kernel/mm/hugepages/ r, @{sys}/kernel/mm/transparent_hugepage/enabled r, @{sys}/kernel/mm/transparent_hugepage/shmem_enabled r, - owner @{sys}/fs/cgroup/user.slice/user-@{int}.slice/user@@{int}.service/app.slice/**/memory.max r, - owner @{sys}/fs/cgroup/user.slice/user-@{int}.slice/user@@{int}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/{cpu,memory}.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/**/memory.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r, @{PROC}/cgroups r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-m-r/mpv b/apparmor.d/profiles-m-r/mpv index da5e4715c..d5e6371c3 100644 --- a/apparmor.d/profiles-m-r/mpv +++ b/apparmor.d/profiles-m-r/mpv @@ -76,6 +76,10 @@ profile mpv @{exec_path} { @{sys}/devices/**/input/**/uevent r, @{sys}/devices/**/sound/**/capabilities/* r, @{sys}/devices/**/sound/**/uevent r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, /dev/input/event@{int} r, owner /dev/tty@{int} rw, From 460ac12bfbf444051906b787309fb844d7be2cc8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 20:11:03 +0100 Subject: [PATCH 0268/1455] feat(profile): dbus: Dbus can receive any user files --- apparmor.d/groups/bus/dbus-session | 6 +++++- apparmor.d/groups/bus/dbus-system | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index af961be6d..1aa90f2c4 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -18,6 +18,7 @@ profile dbus-session flags=(attach_disconnected) { include include include + include include network unix stream, @@ -29,7 +30,7 @@ profile dbus-session flags=(attach_disconnected) { signal (send) set=(term hup kill) peer=dconf-service, signal (send) set=(term hup kill) peer=xdg-*, - #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/DBus} + #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/{d,D}Bus} @{exec_path} mrix, @@ -49,6 +50,9 @@ profile dbus-session flags=(attach_disconnected) { /etc/machine-id r, /var/lib/dbus/machine-id r, + # Dbus can receive any user files + owner @{HOME}/** r, + owner @{HOME}/.var/app/*/**/.ref rw, owner @{HOME}/.var/app/*/**/logs/* rw, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index d6c92bae1..74853231a 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -15,8 +15,9 @@ include @{exec_path} += @{bin}/dbus-daemon @{lib}/dbus-1{,.0}/dbus-daemon-launch-helper profile dbus-system flags=(attach_disconnected) { include - include include + include + include include capability audit_write, @@ -53,6 +54,9 @@ profile dbus-system flags=(attach_disconnected) { @{user_share_dirs}/icc/ r, @{user_share_dirs}/icc/edid-@{hex32}.icc r, + # Dbus can receive any user files + @{HOME}/** r, + @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/notify w, @{run}/systemd/sessions/*.ref rw, From af50944fb5fc933301936420c015f85e3fd79b5f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 20:17:13 +0100 Subject: [PATCH 0269/1455] feat(profile): general update. --- apparmor.d/groups/gnome/nautilus | 9 ++++++--- apparmor.d/groups/gpg/gpg-connect-agent | 4 ++-- apparmor.d/groups/gvfs/gvfsd-fuse | 2 ++ apparmor.d/groups/pacman/pacman-hook-mkinitcpio | 5 +++-- apparmor.d/groups/ubuntu/apport-gtk | 10 +++++----- apparmor.d/profiles-a-f/dkms | 1 + apparmor.d/profiles-a-f/element-desktop | 2 +- apparmor.d/profiles-a-f/freetube | 2 +- apparmor.d/profiles-g-l/kernel-install | 1 + apparmor.d/profiles-s-z/speech-dispatcher | 1 + 10 files changed, 23 insertions(+), 14 deletions(-) diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 5704fa866..d7736d7a8 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -80,9 +80,12 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { @{MOUNTDIRS}/ r, @{MOUNTS}/ r, @{MOUNTS}/** rw, - owner @{HOME}/{,**} rw, - owner @{run}/user/@{uid}/{,**} rw, - owner @{tmp}/{,**} rw, + owner @{HOME}/ r, + owner @{HOME}/** rw, + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/** rw, + owner @{tmp}/ r, + owner @{tmp}/** rw, # Silence non user's data deny /boot/{,**} r, diff --git a/apparmor.d/groups/gpg/gpg-connect-agent b/apparmor.d/groups/gpg/gpg-connect-agent index 1e257cfc0..9bf2bf897 100644 --- a/apparmor.d/groups/gpg/gpg-connect-agent +++ b/apparmor.d/groups/gpg/gpg-connect-agent @@ -18,8 +18,6 @@ profile gpg-connect-agent @{exec_path} { /etc/inputrc r, - owner @{PROC}/@{pid}/fd/ r, - owner @{run}/user/@{uid}/gnupg/ w, owner @{run}/user/@{uid}/gnupg/d.*/ rw, @@ -27,6 +25,8 @@ profile gpg-connect-agent @{exec_path} { owner @{tmp}/tmp.*/.#lk0x@{hex}.*.@{pid}x rwl -> /tmp/*/.#lk0x@{hex}.*.@{pid}, owner @{tmp}/tmp.*/gnupg_spawn_agent_sentinel.lock rwl -> /tmp/*/.#lk0x@{hex}.*.@{pid}, + owner @{PROC}/@{pid}/fd/ r, + include if exists } diff --git a/apparmor.d/groups/gvfs/gvfsd-fuse b/apparmor.d/groups/gvfs/gvfsd-fuse index 9cd6b77ca..b49ad1d90 100644 --- a/apparmor.d/groups/gvfs/gvfsd-fuse +++ b/apparmor.d/groups/gvfs/gvfsd-fuse @@ -14,6 +14,8 @@ profile gvfsd-fuse @{exec_path} { include include + capability sys_admin, + mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/gvfs/, unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse//fusermount), diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio index a182b23ca..178cee539 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio @@ -37,9 +37,10 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) { / r, /boot/ r, - /boot/vmlinuz-* rw, - /boot/initramfs-*.img rw, + /boot/efi/boot/boot*.efi rw, /boot/initramfs-*-fallback.img rw, + /boot/initramfs-*.img rw, + /boot/vmlinuz-* rw, /dev/tty rw, owner /dev/pts/@{int} rw, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index dddb1f890..f8d2c9973 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -79,12 +79,12 @@ profile apport-gtk @{exec_path} { /var/crash/ rw, owner /var/crash/*.@{uid}.{crash,upload} rw, - @{run}/snapd.socket rw, + @{run}/snapd.socket rw, - /tmp/[a-z0-9]* rw, - /tmp/apport_core_* rw, - /tmp/launchpadlib.cache.[a-z0-9]*/ rw, - /tmp/tmp[a-z0-9]*/{,**} rw, + owner @{tmp}/@{rand8} rw, + owner @{tmp}/apport_core_@{rand8} rw, + owner @{tmp}/launchpadlib.cache.@{rand8}/ rw, + owner @{tmp}/tmp@{rand8}/{,**} rw, @{PROC}/ r, @{PROC}/@{pids}/cmdline r, diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 4ebe8e464..bfd287741 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -27,6 +27,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{coreutils_path} rix, @{bin}/as rix, + @{bin}/bc rix, @{bin}/gcc rix, @{bin}/getconf rix, @{bin}/kmod rCx -> kmod, diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index e7d46f1f5..a792b7341 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -12,7 +12,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{bin}/element-desktop -profile element-desktop @{exec_path} { +profile element-desktop @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index 7d9a5f59e..a400bf9d9 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -13,7 +13,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name} -profile freetube @{exec_path} { +profile freetube @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/profiles-g-l/kernel-install b/apparmor.d/profiles-g-l/kernel-install index 808528ce7..69096fe45 100644 --- a/apparmor.d/profiles-g-l/kernel-install +++ b/apparmor.d/profiles-g-l/kernel-install @@ -25,6 +25,7 @@ profile kernel-install @{exec_path} { @{bin}/chmod rix, @{bin}/basename rix, + @{pager_path} rPx -> child-pager, @{bin}/kmod rCx -> kmod, @{lib}/kernel/install.d/ r, diff --git a/apparmor.d/profiles-s-z/speech-dispatcher b/apparmor.d/profiles-s-z/speech-dispatcher index 7a597ed5d..e2c00e2af 100644 --- a/apparmor.d/profiles-s-z/speech-dispatcher +++ b/apparmor.d/profiles-s-z/speech-dispatcher @@ -10,6 +10,7 @@ include profile speech-dispatcher @{exec_path} { include include + include include include From b7434eb91ba19ef74bb79a3d190126af3ad0d0c3 Mon Sep 17 00:00:00 2001 From: odomingao Date: Thu, 26 Sep 2024 12:28:28 -0300 Subject: [PATCH 0270/1455] Create pokemmo --- apparmor.d/profiles-m-r/pokemmo | 100 ++++++++++++++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 apparmor.d/profiles-m-r/pokemmo diff --git a/apparmor.d/profiles-m-r/pokemmo b/apparmor.d/profiles-m-r/pokemmo new file mode 100644 index 000000000..9219df10c --- /dev/null +++ b/apparmor.d/profiles-m-r/pokemmo @@ -0,0 +1,100 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pokemmo-launcher +profile pokemmo @{exec_path} flags=(attach_disconnected) { + include + include + include # Installer + include + include # Installer + include + include + include + include # Installer + include + + # The installer is a GTK app and requires a few extra abstractions + # GTK/QT/fonts abstractions are unused by the game itself and can + # be removed if this profile is later split into stacked profiles + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + @{coreutils_path} ix, + @{sh_path} ix, + + @{bin}/java ix, + @{bin}/perl ix, + @{bin}/python ix, + @{bin}/python@{int} ix, + @{bin}/python@{int}.@{int} ix, + @{bin}/which ix, + @{lib}/jvm/java-@{int}-openjdk/bin/java ix, + + # Installer + @{bin}/openssl ix, + @{bin}/ps ix, + @{bin}/wget ix, + @{bin}/zenity ix, + @{lib}/jvm/java-@{int}-openjdk/lib/jspawnhelper ix, + + /etc/lsb-release r, # Installer + /etc/java-openjdk/** r, + /etc/timezone r, + /etc/wgetrc r, # Installer + + # Installer + owner @{HOME}/ r, + owner @{HOME}/.java/fonts/** rw, + owner @{HOME}/.wget-hsts rwk, + + owner @{user_config_dirs}/pokemmo/{,**} rw, + owner @{user_share_dirs}/pokemmo/{,**} rw, + + owner /tmp/hsperfdata_user/ rw, + owner /tmp/hsperfdata_user/@{int} rwk, + owner /tmp/libgdxuser/{,**} rw, + owner /tmp/libgdxuser/**/*.so mrw, + owner /tmp/lwjgl_user/{,**} rw, + owner /tmp/lwjgl_user/**/*.so mrwk, + + @{sys}/devices/system/cpu/cpu@{int}/microcode/version r, + + @{PROC}/@{pid}/net/if_inet6 r, + @{PROC}/cgroups r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/coredump_filter rw, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + # Installer + @{PROC}/ r, + @{PROC}/uptime r, + @{PROC}/sys/kernel/pid_max r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/environ r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/stat r, + + /dev/input/ r, + /dev/input/event@{int} rw, + /dev/input/js@{int} rw, + + /dev/tty rw, + owner /dev/tty@{int} rw, + + include if exists +} + +# vim:syntax=apparmor From 89e39fc501d833e073d33e5b1c664e663e2bf765 Mon Sep 17 00:00:00 2001 From: odomingao Date: Thu, 26 Sep 2024 12:42:00 -0300 Subject: [PATCH 0271/1455] Update hyprland --- apparmor.d/groups/hyprland/hyprland | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 8327c14cd..44bed0cdd 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -12,6 +12,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { include include include + include include capability sys_ptrace, From 507727caa3afa6d8f69ee777c29fad4523540f98 Mon Sep 17 00:00:00 2001 From: odomingao Date: Thu, 26 Sep 2024 13:39:32 -0300 Subject: [PATCH 0272/1455] Update pokemmo --- apparmor.d/profiles-m-r/pokemmo | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/apparmor.d/profiles-m-r/pokemmo b/apparmor.d/profiles-m-r/pokemmo index 9219df10c..a6c1e83f7 100644 --- a/apparmor.d/profiles-m-r/pokemmo +++ b/apparmor.d/profiles-m-r/pokemmo @@ -32,13 +32,11 @@ profile pokemmo @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{coreutils_path} ix, + @{python_path} ix, @{sh_path} ix, @{bin}/java ix, @{bin}/perl ix, - @{bin}/python ix, - @{bin}/python@{int} ix, - @{bin}/python@{int}.@{int} ix, @{bin}/which ix, @{lib}/jvm/java-@{int}-openjdk/bin/java ix, From 3ebaf5bb2928994fe550e59b3a78f4651390b5a7 Mon Sep 17 00:00:00 2001 From: EricLin0509 <143688917+EricLin0509@users.noreply.github.com> Date: Wed, 2 Oct 2024 04:12:35 +0800 Subject: [PATCH 0273/1455] Add support for wechat-universal (#540) * Add support for wechat-universal * A small fix --- apparmor.d/profiles-s-z/wechat-universal | 58 ++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 apparmor.d/profiles-s-z/wechat-universal diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal new file mode 100644 index 000000000..e684e157f --- /dev/null +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -0,0 +1,58 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 EricLin +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{name} = wechat-universal +@{lib_dirs} = /opt/wechat-universal/ +@{config_dirs} = @{user_config_dirs}/@{name} +@{cache_dirs} = @{user_cache_dirs}/@{name} + +@{exec_path} = @{bin}/wechat-universal @{lib_dirs}/wechat +profile wechat-universal @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + + network netlink raw, + network netlink dgram, + network inet stream, + network inet dgram, + network inet6 dgram, + network inet6 stream, + + @{exec_path} mrix, + + @{sh_path} rix, + @{lib}/wechat-universal/common.sh ix, + @{bin}/sed ix, + @{bin}/ln ix, + @{bin}/mkdir ix, + @{bin}/lsblk Px, + @{bin}/bwrap rix, + @{bin}/xdg-user-dir rix, + @{lib_dirs}/crashpad_handler ix, + @{open_path} rPx -> child-open-strict, + + /etc/lsb-release r, + + owner @{HOME}/@{XDG_DOCUMENTS_DIR}/WeChat_Data/{,**} rwk, + owner @{HOME}/.xwechat/{,**} rwk, + owner @{HOME}/.sys1og.conf rw, + + @{run}/systemd/inhibit/@{int}.ref rw, + @{run}/utmp r, + + @{PROC}/@{pid}/net/route r, + + /dev/tty rw, + /dev/pts/@{int} rw, + + include if exists +} From ba186647cd14981e8f31b8954cb9db4dff7f7a34 Mon Sep 17 00:00:00 2001 From: valoq Date: Tue, 1 Oct 2024 13:39:44 +0200 Subject: [PATCH 0274/1455] add missing read permissions --- apparmor.d/profiles-a-f/ffmpegthumbnailer | 1 + apparmor.d/profiles-m-r/odt2txt | 1 + apparmor.d/profiles-m-r/pdftotext | 1 + 3 files changed, 3 insertions(+) diff --git a/apparmor.d/profiles-a-f/ffmpegthumbnailer b/apparmor.d/profiles-a-f/ffmpegthumbnailer index 5c0d7e2f8..04ecf16cc 100644 --- a/apparmor.d/profiles-a-f/ffmpegthumbnailer +++ b/apparmor.d/profiles-a-f/ffmpegthumbnailer @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/ffmpegthumbnailer profile ffmpegthumbnailer @{exec_path} { include + include include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/odt2txt b/apparmor.d/profiles-m-r/odt2txt index 0636f6ee8..a2ed448e2 100644 --- a/apparmor.d/profiles-m-r/odt2txt +++ b/apparmor.d/profiles-m-r/odt2txt @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/odt2txt profile odt2txt @{exec_path} { include + include include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/pdftotext b/apparmor.d/profiles-m-r/pdftotext index c122cbdcb..417375a79 100644 --- a/apparmor.d/profiles-m-r/pdftotext +++ b/apparmor.d/profiles-m-r/pdftotext @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/pdftotext profile pdftotext @{exec_path} { include + include include @{exec_path} mr, From 86719377a87369adb5aacff7bd7a665dd0fa1f4d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 22:26:58 +0100 Subject: [PATCH 0275/1455] docs: update variable reference page. --- docs/variables.md | 121 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 94 insertions(+), 27 deletions(-) diff --git a/docs/variables.md b/docs/variables.md index 6104e5033..b413e61f2 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -6,8 +6,10 @@ title: Variables References ### User directories +
+ | Description | Name | Default Value(s) | -|-------------|:----:|---------------| +|-------------|------|------------------| | Desktop | `@{XDG_DESKTOP_DIR}` | `Desktop` | | Documents | `@{XDG_DOCUMENTS_DIR}` | `Documents` | | Downloads | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | @@ -31,10 +33,14 @@ title: Variables References | Disk images | `@{XDG_IMG_DIR}` | `images` | | Games Studio | `@{XDG_GAMESSTUDIO_DIR}` | `.unity3d` | +
+ ### Dotfiles +
+ | Description | Name | Default Value(s) | -|-------------|:----:|---------------| +|-------------|------|------------------| | Cache | ` @{XDG_CACHE_DIR}` | `.cache` | | Config | `@{XDG_CONFIG_DIR}` | `.config` | | Data | `@{XDG_DATA_DIR}` | `.local/share` | @@ -45,26 +51,33 @@ title: Variables References | SSH | `@{XDG_SSH_DIR}` | `.ssh` | | Private | `@{XDG_PRIVATE_DIR}` | `.{p,P}rivate {p,P}rivate` | | Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` | -| Mail | `@{XDG_MAIL_DIR}` | `Mail .{m,M}ail` | + +
### Full configuration path +
+ | Description | Name | Default Value(s) | -|-------------|:----:|---------------| +|-------------|------|------------------| | Cache | `@{user_cache_dirs}` | `@{HOME}/@{XDG_CACHE_DIR}` | | Config | `@{user_config_dirs}` | `@{HOME}/@{XDG_CONFIG_DIR}` | | Bin | `@{user_bin_dirs}` | `@{HOME}/@{XDG_BIN_DIR}` | | Lib | `@{user_lib_dirs}` | `@{HOME}/@{XDG_LIB_DIR}` | | Share | `@{user_share_dirs}` | ` @{HOME}/@{XDG_DATA_DIR}` | | State | `@{user_state_dirs}` | ` @{HOME}/@{XDG_STATE_DIR}` | -| Build | `@{user_build_dirs}` | `/tmp//build/` | +| Build | `@{user_build_dirs}` | `/tmp/build/` | | Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | | Tmp | `@{user_tmp_dirs}` | `@{run}/user/@{uid} /tmp/` | +
+ ### Full user path +
+ | Description | Name | Default Value(s) | -|-------------|:----:|---------------| +|-------------|------|------------------| | Documents | `@{user_documents_dirs}` | `@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR}` | | Downloads | `@{user_download_dirs}` | `@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR}` | | Music | `@{user_music_dirs}` | `@{HOME}/@{XDG_MUSIC_DIR} @{MOUNTS}/@{XDG_MUSIC_DIR}` | @@ -85,39 +98,77 @@ title: Variables References | Vm Shares | `@{user_vm_shares}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | | Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | +
+ ## System variables -!!! warning +!!! danger Do not modify these variables unless you know what you are doing -**Helper variables** +#### Base variables + +
| Description | Name | Default Value(s) | -|-------------|:----:|---------------| -| Integer (up to 10 digits) | `@{int}` | `[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}` | -| Any 6, 8 or 10 characters | `@{rand6}`, `@{rand8}`, `@{rand10}` | | -| Hexadecimal | `@{h}*@{h}` | | -| Universally unique identifier | `@{uuid}` | | -| Current Process id | `@{pid}` | `[0-9]*` | -| Processes ids | `@{pids}` | `[0-9]*` | -| User id | `@{uid}` | `[0-9]*` | -| Thread id | `@{tid}` | `[0-9]*` | -| Single hexadecimal character | `@{h}` | `[0-9a-fA-F]` | +|-------------|------|------------------| +| Any digit | `@{d}` | `[0-9]` | +| Any letter | `@{l}` | `[a-zA-Z]` | | Single alphanumeric character | `@{c}` | `[0-9a-zA-Z]` | -| PCI Devices | `@{pci}` | `@{pci_bus}/**/` | -| PCI Bus | `@{pci_bus}` | `pci@{h}@{h}@{h}@{h}:@{h}@{h}` | -| PCI Id | `@{pci_id}` | `@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h}` | +| Word character: matches any letter, digit or underscore. | `@{w}` | `[0-9a-zA-Z_]` | +| Single hexadecimal character | `@{h}` | `[0-9a-fA-F]` | +| Integer up to 10 digits (0-9999999999) | `@{int}` | `@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}` | +| Unsigned integer over 8 bits (0-255) | `@{u8}` | `[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5]` | +| Unsigned integer over 16 bits (0-65535, 5 digits) | `@{u16}` | `@{d}{@{d},}{@{d},}{@{d},}{@{d},}` | +| Hexadecimal up to 64 characters | `@{hex}` | | +| Alphanumeric up to 64 characters | `@{rand}` | | +| Word up to 64 characters | `@{word}` | | -**System Paths** +
+ +#### Basic variables of a given length + +
+ +| Description | Name | +|-------------|------| +| Any x digits characters | `@{int2}` `@{int4}` `@{int6}` `@{int8}` `@{int9}` `@{int10}` `@{int12}` `@{int15}` `@{int16}` `@{int32}` `@{int64}` | +| Any x hexadecimal characters | `@{hex2}` `@{hex4}` `@{hex6}` `@{hex8}` `@{hex9}` `@{hex10}` `@{hex12}` `@{hex15}` `@{hex16}` `@{hex32}` `@{hex38}` `@{hex64}` | +| Any x alphanumeric characters | `@{rand2}` `@{rand4}` `@{rand6}` `@{rand8}` `@{rand9}` `@{rand10}` `@{rand12}` `@{rand15}` `@{rand16}` `@{rand32}` `@{rand64}` | +| Any x word characters | `@{word2}` `@{word4}` `@{word6}` `@{word8}` `@{word9}` `@{word10}` `@{word12}` `@{word15}` `@{word16}` `@{word32}` `@{word64}` | + +
+ +#### System Variables + +
| Description | Name | Default Value(s) | -|-------------|:----:|---------------| +|-------------|------|------------------| +| Common architecture names | `@{arch}` | `x86_64 amd64 i386 i686` | +| Dbus unique name | `@{busname}` | `:1.@{u16} :not.active.yet` | +| Universally unique identifier | `@{uuid}` | `@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}` | +| Username valid characters | `@{user}` | `[a-zA-Z_]{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}` | +| Group valid characters | `@{group}` | `@{user}` | +| Semantic version | `@{version}` | `@{int}{.@{int},}{.@{int},}{-@{rand},}` | +| Current Process Id | `@{pid}` | `{[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]}` | +| Processes Ids | `@{pids}` | `@{pid}` | +| Thread Id | `@{tid}` | `@{pid}` | +| User Id (equivalent to `@{int}`) | `@{uid}` | `{[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]}` | + +
+ +#### System Paths + +
+ +| Description | Name | Default Value(s) | +|-------------|------|------------------| | Root Home | `@{HOMEDIRS}` | `/home/` | | Home directories | `@{HOME}` | `@{HOMEDIRS}/*/ /root/` | -| Root Mountpoints | `@{MOUNTDIRS}` | `/media/ @{run}/media/ /mnt/` | -| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` | +| Root Mountpoints | `@{MOUNTDIRS}` | `/media/ @{run}/media/@{user}/ /mnt/` | +| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/ @{run}/user/@{uid}/gvfs/` | | Bin | `@{bin}` | `/{usr/,}{s,}bin` | | Lib | `@{lib}` | `/{usr/,}lib{,exec,32,64}` | | multi-arch library | `@{multiarch}` | `*-linux-gnu*` | @@ -127,13 +178,29 @@ title: Variables References | System wide share | `@{system_share_dirs}` | `/{usr,usr/local,var/lib/@{flatpak_exports_root}}/share` | | Flatpak export | `@{flatpak_exports_root}` | `{flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}` | -**Program paths** +
+ +#### System Internal | Description | Name | Default Value(s) | -|-------------|:----:|---------------| +|-------------|------|------------------| +| PCI Devices | `@{pci}` | `@{pci_bus}/**/` | +| PCI Bus | `@{pci_bus}` | `pci@{h}@{h}@{h}@{h}:@{h}@{h}` | +| PCI Id | `@{pci_id}` | `@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h}` | +| HCI devices | `@{hci_id}` | `dev_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}` | +| Udev data dynamic assignment ranges (234 to 254 then 384 to 511) | `@{dynamic}` | `23[4-9] 24[0-9] 25[0-4] 38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1]` | + +#### Program paths + +
+ +| Description | Name | Default Value(s) | +|-------------|------|------------------| | All the shells | `@{shells}` | `sh zsh bash dash fish rbash ksh tcsh csh` | | Shells path | `@{shells_path}` | `@{bin}/@{shells}` | | Coreutils programs that should not have dedicated profile | `@{coreutils}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L46) | | Coreutils paths | `@{coreutils_path}` | `@{bin}/@{coreutils}` | | Launcher paths | `@{open_path}` | `@{bin}/exo-open @{bin}/xdg-open @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop @{lib}/gio-launch-desktop` | All browser paths | `@{*_path}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L11) + +
From b51576139b3ed3125aaa3ea4d737a77baac0f00e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 22:53:30 +0100 Subject: [PATCH 0276/1455] docs: rewrite the configuration section. --- docs/abbreviations.md | 3 + docs/configuration.md | 235 ++++++++++++++++++++++++++++++------------ docs/index.md | 11 +- docs/install.md | 31 ++++-- docs/usage.md | 3 +- mkdocs.yml | 5 +- 6 files changed, 203 insertions(+), 85 deletions(-) create mode 100644 docs/abbreviations.md diff --git a/docs/abbreviations.md b/docs/abbreviations.md new file mode 100644 index 000000000..f99a4f70c --- /dev/null +++ b/docs/abbreviations.md @@ -0,0 +1,3 @@ + +*[MAC]: Mandatory Access Control +*[AppArmor tunables]: AppArmor global variables diff --git a/docs/configuration.md b/docs/configuration.md index e784dcb82..f2f1d3722 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -2,107 +2,206 @@ title: Configuration --- -## AppArmor - -As there are a lot of rules, it is recommended to enable caching AppArmor profiles. In `/etc/apparmor/parser.conf`, add `write-cache` and `Optimize=compress-fast`. - -```sh -echo 'write-cache' | sudo tee -a /etc/apparmor/parser.conf -echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf -``` - -!!! info - - See [Speed up AppArmor Start] on the Arch Wiki for more information: - [Speed up AppArmor Start]: https://wiki.archlinux.org/title/AppArmor#Speed-up_AppArmor_start_by_caching_profiles - - -## Personal directories +This project is designed in such a way that it is easy to personalize it to fit any system. +It is mostly done by setting personalized XDG like directories in AppArmor tunables. More advanced configuration can be done by adding your own rules in local profile addition. !!! danger - You need to ensure that all personal directories you are using are well-defined XDG directory. You may need to edit these variables to your own settings. + You need to ensure that all personal directories you are using are well-defined XDG directory. You may need to edit these variables to your own settings. -This project is designed in such a way that it is easy to personalize the directories your programs have access by defining a few variables. + This part is vital to ensure that the profiles are correctly configured for your system. It will lead to breakage if not done correctly. -The profiles heavily use the (largely extended) XDG directory variables defined in the **[Variables Reference](variables.md)** page. -??? note "XDG variables overview" +## Personalize Apparmor - See **[Variables Reference](variables.md)** page for more. +### Tunables - | Description | Name | Value | - |-------------|:----:|---------| - | Desktop | `@{XDG_DESKTOP_DIR}` | `Desktop` | - | Download | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | - | Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` | - | Public | `@{XDG_PUBLICSHARE_DIR}` | `Public` | - | Documents | `@{XDG_DOCUMENTS_DIR}` | `Documents` | - | Music | `@{XDG_MUSIC_DIR}` | `Music` | - | Pictures | `@{XDG_PICTURES_DIR}` | `Pictures` | - | Videos | `@{XDG_VIDEOS_DIR}` | `Videos` | - | Books | `@{XDG_BOOKS_DIR}` | `Books` | - | Projects | `@{XDG_PROJECTS_DIR}` | `Projects` | - | Screenshots | `@{XDG_SCREENSHOTS_DIR}` | `@{XDG_PICTURES_DIR}/Screenshots` | - | Sync | `@{XDG_SYNC_DIR}` | `Sync` | - | Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | - | Vm | `@{XDG_VM_DIR}` | `.vm` - | Wallpapers | `@{XDG_WALLPAPERS_DIR}` | `@{XDG_PICTURES_DIR}/Wallpapers` | +The profiles heavily use the **largely extended** [XDG directory variables](#xdg-variables). All the variables are list you can append with your own values. -You can personalize these values. +1. First create the directory `/etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d.d`: + ```sh + sudo mkdir -p /etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d.d + ``` +2. Then create a `local` addition file in it where you define your own personal directories. *Example:* + ```sh + @{XDG_VIDEOS_DIR}+="Films" + @{XDG_MUSIC_DIR}+="Musique" + @{XDG_PICTURES_DIR}+="Images" + @{XDG_BOOKS_DIR}+="BD" "Comics" + @{XDG_PROJECTS_DIR}+="Git" "Papers" + ``` +3. Then restart the AppArmor service to reload the profiles in the kernel: + ```sh + sudo systemctl restart apparmor.service + ``` -First create the directory `/etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d.d`: -``` -sudo mkdir /etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d.d -``` -Then create a `local` addition file in it where you define your own personal -directories. Example: -```sh -@{XDG_VIDEOS_DIR}+="Films" -@{XDG_MUSIC_DIR}+="Musique" -@{XDG_PICTURES_DIR}+="Images" -@{XDG_BOOKS_DIR}+="BD" "Comics" -@{XDG_PROJECTS_DIR}+="Git" "Papers" -``` +### Profile Additions -Then restart the AppArmor service to reload the profiles in the kernel: -```sh -sudo systemctl restart apparmor.service -``` +You can extend any profile with your own rules by creating a file in the `/etc/apparmor.d/local/` directory with the name of the profile you want to personalize. -**Examples** +**Example** + +By default, `nautilus` (and any file browser) only allows access to user files. Thus, your cannot browse system files such as `/etc/`, `/srv/`, `/var/`. You can change this behaviour by creating a local profile addition file for `nautilus`: + +1. Create the file `/etc/apparmor.d/local/nautilus` and add the following rules in it: + ```sh + /** r, + ``` + You call also restrict this to specific directories: + ```sh + /etc/** r, + /srv/** r, + /var/** r, + ``` +2. Then restart the AppArmor service to reload the profiles in the kernel: + ```sh + sudo systemctl restart apparmor.service + ``` + +### XDG variables + +Please ensure that all personal directories you are using are well-defined XDG directory defined below. If not, personalize the [variables](#tunables) to your own settings. + +??? quote "**User directories**" + +
+ + | Description | Name | Default Value(s) | + |-------------|------|---------------| + | Desktop | `@{XDG_DESKTOP_DIR}` | `Desktop` | + | Documents | `@{XDG_DOCUMENTS_DIR}` | `Documents` | + | Downloads | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | + | Music | `@{XDG_MUSIC_DIR}` | `Music` | + | Pictures | `@{XDG_PICTURES_DIR}` | `Pictures` | + | Videos | `@{XDG_VIDEOS_DIR}` | `Videos` | + | Screenshots | `@{XDG_SCREENSHOTS_DIR}` | `@{XDG_PICTURES_DIR}/Screenshots` | + | Wallpapers | `@{XDG_WALLPAPERS_DIR}` | `@{XDG_PICTURES_DIR}/Wallpapers` | + | Books | `@{XDG_BOOKS_DIR}` | `Books` | + | Games | `@{XDG_GAMES_DIR}` | `.games` | + | Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` | + | Public | `@{XDG_PUBLICSHARE_DIR}` | `Public` | + | Projects | `@{XDG_PROJECTS_DIR}` | `Projects` | + | Private | `@{XDG_PRIVATE_DIR}` | `.{p,P}rivate {p,P}rivate` | + | Work | `@{XDG_WORK_DIR}` | `Work` | + | Mail | `@{XDG_MAIL_DIR}` | `Mail .{m,M}ail` | + | Sync | `@{XDG_SYNC_DIR}` | `Sync` | + | Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | + | Vm | `@{XDG_VM_DIR}` | `.vm` | + | Vm Shares | `@{XDG_VM_SHARES_DIR}` | `VM_Shares` | + | Disk images | `@{XDG_IMG_DIR}` | `images` | + | Games Studio | `@{XDG_GAMESSTUDIO_DIR}` | `.unity3d` | + +
+ +??? quote "**Dotfiles**" + +
+ + | Description | Name | Default Value(s) | + |-------------|------|------------------| + | Cache | ` @{XDG_CACHE_DIR}` | `.cache` | + | Config | `@{XDG_CONFIG_DIR}` | `.config` | + | Data | `@{XDG_DATA_DIR}` | `.local/share` | + | State | `@{XDG_STATE_DIR}` | `.local/state` | + | Bin | `@{XDG_BIN_DIR}` | `.local/bin` | + | Lib | `@{XDG_LIB_DIR}` | `.local/lib` | + | GPG | `@{XDG_GPG_DIR}` | `.gnupg` | + | SSH | `@{XDG_SSH_DIR}` | `.ssh` | + | Private | `@{XDG_PRIVATE_DIR}` | `.{p,P}rivate {p,P}rivate` | + | Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` | + +
+ +??? quote "**Full configuration path**" + +
+ + | Description | Name | Default Value(s) | + |-------------|:----:|---------------| + | Cache | `@{user_cache_dirs}` | `@{HOME}/@{XDG_CACHE_DIR}` | + | Config | `@{user_config_dirs}` | `@{HOME}/@{XDG_CONFIG_DIR}` | + | Bin | `@{user_bin_dirs}` | `@{HOME}/@{XDG_BIN_DIR}` | + | Lib | `@{user_lib_dirs}` | `@{HOME}/@{XDG_LIB_DIR}` | + | Share | `@{user_share_dirs}` | ` @{HOME}/@{XDG_DATA_DIR}` | + | State | `@{user_state_dirs}` | ` @{HOME}/@{XDG_STATE_DIR}` | + | Build | `@{user_build_dirs}` | `/tmp/build/` | + | Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | + +
+ +??? quote "**Full user path**" + +
+ + | Description | Name | Default Value(s) | + |-------------|:----:|---------------| + | Documents | `@{user_documents_dirs}` | `@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR}` | + | Downloads | `@{user_download_dirs}` | `@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR}` | + | Music | `@{user_music_dirs}` | `@{HOME}/@{XDG_MUSIC_DIR} @{MOUNTS}/@{XDG_MUSIC_DIR}` | + | Pictures | `@{user_pictures_dirs}` | `@{HOME}/@{XDG_PICTURES_DIR} @{MOUNTS}/@{XDG_PICTURES_DIR}` | + | Videos | `@{user_videos_dirs}` | `@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR}` | + | Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` | + | Games | `@{user_games_dirs}` | `@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR}` | + | Private | `@{user_private_dirs}` | `@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR}` | + | Passwords | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | + | Work | `@{user_work_dirs}` | `@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR}` | + | Mail | `@{user_mail_dirs}` | `@{HOME}/@{XDG_MAIL_DIR} @{MOUNTS}/@{XDG_MAIL_DIR}` | + | Projects | `@{user_projects_dirs}` | `@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR}` | + | Public | `@{user_publicshare_dirs}` | `@{HOME}/@{XDG_PUBLICSHARE_DIR} @{MOUNTS}/@{XDG_PUBLICSHARE_DIR}` | + | Templates | `@{user_templates_dirs}` | `@{HOME}/@{XDG_TEMPLATES_DIR} @{MOUNTS}/@{XDG_TEMPLATES_DIR}` | + | Torrents | `@{user_torrents_dirs}` | `@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}` | + | Sync | `@{user_sync_dirs}` | `@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR}` | + | Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` | + | Vm Shares | `@{user_vm_shares}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | + | Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | + +
+ +System variables can also be personalized, they are defined in the **[Variables Reference](variables.md)** page. + + +## Program Personalization + +### Examples + +All profiles use the variables defined above. Therefore, you can personalize them by setting your own values in `/etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d.d/local`. - For git support, you may want to add your `GO_PATH` in the `XDG_PROJECTS_DIR`: ```sh @{XDG_PROJECTS_DIR}+="go" ``` + - If you use Keepass, personalize `XDG_PASSWORD_STORE_DIR` with your password directory. Eg: ```sh @{XDG_PASSWORD_STORE_DIR}+="@{HOME}/.keepass/" ``` + - Add pacman integration with your AUR helper. Eg for `yay`: ```sh @{user_pkg_dirs}+=@{user_cache_dirs}/yay/ ``` -## Local profile extensions +### Mountpoints -You can extend any profile with your own rules by creating a file in the `/etc/apparmor.d/local/` directory with the name of your profile. For example, to extend the `foo` profile, create a file `/etc/apparmor.d/local/foo` and add your rules in it. +Common mountpoints are defined in the `@{MOUNTS}` variable. If you mount a disk on a different location, you can add it to the `@{MOUNTS}` variable. **Example** -- `child-open`, a profile that allows other program to open resources (URL, picture, books...) with some predefined GUI application. To allow it to open URLs with Firefox, create the file `/etc/apparmor.d/local/child-open` with: - ```sh - @{bin}/firefox rPx, - ``` +If you mount a disk on `/ssd/`, add the following to `/etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d.d/local`: +```sh +@{MOUNT}+=/ssd/ +``` -!!! note + -!!! info +### File browsers - `rPx` allows transition to the Firefox profile. Use `rPUx` to allow transition to an unconfined state if you do not have the profile for a given program. +All supported file browsers (`nautilus`, `dolphin`, `thunar`) are configured to only access user files. If you want to allow access to system files, you can create a local profile addition file for the file browser you are using. +### Games -Then, reload the AppArmor rules with `sudo systemctl restart AppArmor`. +In order to not allow access to user data, game profiles use the `@{XDG_GAMESSTUDIO_DIR}` variable. It may needs to be expanded with other game studio directory. The default is `@{XDG_GAMESSTUDIO_DIR}="unity3d"`. + +The `@{XDG_GAMES_DIR}` variable is used to define the game directory such as steam storage directory. If your steam storage is on another drive/mountpoint, you should personalize `@{user_games_dirs}` instead. diff --git a/docs/index.md b/docs/index.md index b57bae7a3..8f5696074 100644 --- a/docs/index.md +++ b/docs/index.md @@ -8,12 +8,11 @@ title: AppArmor.d !!! danger "Help Wanted" - This project is still in its early development. Help is very welcome; - see [Development](development/index.md) + This project is still in its early development. Help is very welcome; see [Development](development/index.md) **AppArmor.d** is a set of over 1500 AppArmor profiles whose aim is to confine most Linux based applications and processes. -**Purpose** +### Purpose - Confine all root processes such as all `systemd` tools, `bluetooth`, `dbus`, `polkit`, `NetworkManager`, `OpenVPN`, `GDM`, `rtkit`, `colord` - Confine all Desktop environments @@ -23,7 +22,7 @@ title: AppArmor.d See the [Concepts](concepts.md)' page for more detail on the architecture. -**Goals** +### Goals - Target both desktops and servers - Support for all distributions that support AppArmor: @@ -37,13 +36,13 @@ See the [Concepts](concepts.md)' page for more detail on the architecture. - [ ] :simple-xfce: XFCE (Lightdm) *(work in progress)* - Fully tested *(work in progress)* -**Presentations** +### Presentations Building the largest set of AppArmor profiles: - [Linux Security Summit North America (LSS-NA 2023)](https://events.linuxfoundation.org/linux-security-summit-north-america/) *([Slide](https://lssna2023.sched.com/event/1K7bI/building-the-largest-working-set-of-apparmor-profiles-alexandre-pujol-the-collaboratory-tudublin), [Video](https://www.youtube.com/watch?v=OzyalrOzxE8))* - [Ubuntu Summit 2023](https://events.canonical.com/event/31/) *([Slide](https://events.canonical.com/event/31/contributions/209/), [Video](https://www.youtube.com/watch?v=GK1J0TlxnFI))* -**Chat** +### Chat A development chat is available on https://matrix.to/#/#apparmor.d:matrix.org diff --git a/docs/install.md b/docs/install.md index 5d84331ce..91b0b4ae6 100644 --- a/docs/install.md +++ b/docs/install.md @@ -10,13 +10,13 @@ title: Installation Due to the development stage of this project, the default package configuration installs all profiles in **complain** mode. The recommended installation workflow is as-follow: -1. [Install](#installation) *apparmor.d* in the (default) complain mode. -1. Configure [apparmor settings](configuration.md#apparmor) as well as your [personal directories](configuration.md#personal-directories). -1. Ensure you have reloaded the profiles in the kernel: `sudo systemctl restart apparmor.service`. +1. **[Configure AppArmor](#configure-apparmor)** AppArmor for *apparmor.d*. +1. **[Install](#installation)** *apparmor.d* in the (default) complain mode. +1. **[Configure your personal directories](configuration.md)**. 1. Reboot your system. 1. You **must** check for any AppArmor logs with [`aa-log`](usage.md#apparmor-log). -1. [Report](https://apparmor.pujol.io/report/) any raised logs. -1. Use the profiles in complain mode for a while (a week), regularly check for new AppArmor logs. +1. **[Report](https://apparmor.pujol.io/report/)** any raised logs. +1. Use the profiles in *complain* mode for a while (a week), regularly check for new AppArmor logs. 1. Only if there are no logs raised for your daily usage, install it in [enforce mode](enforce.md). @@ -30,15 +30,25 @@ An `AppArmor` supported Linux distribution is required. The default profiles and The following desktop environments are supported: - - [x] :material-gnome: Gnome (GDM) - - [x] :simple-kde: KDE (SDDM) - - [ ] :simple-xfce: XFCE (Lightdm) *(work in progress)* +- [x] :material-gnome: Gnome (GDM) +- [x] :simple-kde: KDE (SDDM) +- [ ] :simple-xfce: XFCE (Lightdm) *(work in progress)* **Build dependency** * Go >= 1.21 +## Configure AppArmor + +As there are a lot of rules (~80k lines), it is recommended to enable fast caching compression of AppArmor profiles. In `/etc/apparmor/parser.conf`, add `write-cache` and `Optimize=compress-fast`: + +```sh +echo 'write-cache' | sudo tee -a /etc/apparmor/parser.conf +echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf +``` + + ## Installation === ":material-arch: Archlinux" @@ -115,7 +125,7 @@ The following desktop environments are supported: !!! warning - **Beware**: do not install a `.deb` made for Debian on Ubuntu, the packages are different. + **Beware**: do not install a `.deb` made for Ubuntu on Debian, the packages are different. If your distribution is based on Debian, you may want to manually set the target distribution by exporting `DISTRIBUTION=debian`. @@ -154,6 +164,9 @@ The following desktop environments are supported: So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired. +[Next: Configure your personal directories](configuration.md){ .md-button .md-button--primary } + + ## Uninstallation === ":material-arch: Archlinux" diff --git a/docs/usage.md b/docs/usage.md index 9690733b1..e73439efc 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -24,9 +24,10 @@ apparmor module is loaded. ... 30 processes are in complain mode. ... +0 processes are in prompt mode. +0 processes are in kill mode. 0 processes are unconfined but have a profile defined. 0 processes are in mixed mode. -0 processes are in kill mode. ``` You can also list the current processes alongside with their security profile with: diff --git a/mkdocs.yml b/mkdocs.yml index 404905913..689785a31 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -70,6 +70,7 @@ plugins: - minify: minify_html: true - git-committers: + enabled: !ENV [ENABLED_GIT_REVISION_DATE, true] token: !ENV [MKDOCS_GIT_COMMITTERS_APIKEY] repository: roddhjav/apparmor.d branch: main @@ -116,7 +117,9 @@ markdown_extensions: user: squidfunk repo: mkdocs-material - pymdownx.smartsymbols - - pymdownx.snippets + - pymdownx.snippets: + auto_append: + - docs/abbreviations.md - pymdownx.superfences: custom_fences: - name: mermaid From baad12a75422c7a1a758dd9d0820bc906cf3369c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 1 Oct 2024 23:00:37 +0100 Subject: [PATCH 0277/1455] docs: update abstraction page. --- docs/development/abstractions.md | 95 ++++++++++++++++++++++++++++++++ docs/development/dbus.md | 2 +- 2 files changed, 96 insertions(+), 1 deletion(-) diff --git a/docs/development/abstractions.md b/docs/development/abstractions.md index 1e075e66c..5c6694684 100644 --- a/docs/development/abstractions.md +++ b/docs/development/abstractions.md @@ -43,9 +43,67 @@ A full set of rules for all chromium based browsers. It works as a *function* an If your application requires chromium to run use [`common/chromium`](#commonchromium) or [`common/electron`](#commonelectron) instead. +### **`app/firefox`** + +Similar to `app/chromium` but for Firefox based browsers (and thunderbird). It requires the same *arguments* as `app/chromium`: + + +## Context helper + +These are context helper to be used for in sub profile, they aim at providing a minimal set of rules for a given program. The calling profile only needs to add rules dependant of its use case. + +### **`app/editor`** + +A minimal set of rules for profiles including terminal editor. It is intended to be used in profiles or sub-profiles that need to edit file using the user editor of choice. The following editors are supported: + +- neo vim +- vim +- nano + +```sh + @{editor_path} rCx -> editor, + + profile editor { + include + include + + include if exists _editor> + } +``` + +### **`app/kmod`** + +A minimal set of rules for profiles that need to load kernel modules. It is intended to be used in profiles or sub-profiles that need to load kernel modules for a very specific action: + +```sh + @{bin}/modprobe rCx -> kmod, + + profile kmod { + include + include + + include if exists _kmod> + } +``` + +### **`app/open`** + +Set of rules for `child-open-*` profiles. It should usually not be used directly in a profile. ### **`app/pgrep`** + Minimal set of rules for pgrep/pkill. It is intended to be used in profiles or sub-profiles that need to use `pgrep` or `pkill` for a very specific action: + + ```sh + @{bin}/pgrep rCx -> pgrep, + + profile pgrep { + include + include + + include if exists _pgrep> + } + ``` ### **`app/sudo`** @@ -61,6 +119,22 @@ A minimal set of rules for profiles including internal `sudo`. Interactive sudo } ``` + +### **`app/pkexec`** + +A minimal set of rules for profiles including internal `pkexec`. Like `app/sudo`, it should be used in profiles or sub-profiles that need to elevate their privileges using `pkexec` for a very specific action: + +```sh + @{bin}/pkexec rCx -> pkexec, + + profile pkexec { + include + include + + include if exists _pkexec> + } +``` + ### **`app/systemctl`** An alternative solution for [child-systemctl](structure.md#children-profiles), when the child profile provides too much/not enough access. This abstraction should be used by a sub profile as follows: @@ -75,6 +149,20 @@ An alternative solution for [child-systemctl](structure.md#children-profiles), w } ``` +### **`app/udevadm`** + +A minimal set of rules for profiles including internal `udevadm` as read-only. It is intended to be used in profiles or sub-profiles that need to use `udevadm` for a very specific action: + +```sh + @{bin}/udevadm rCx -> udevadm, + + profile udevadm { + include + include + + include if exists _udevadm> + } +``` ## Common Dependencies @@ -207,6 +295,9 @@ Common rules for interactive shell using bash. Common rules for interactive shell using zsh. +### **`fish`** + +Common rules for interactive shell using fish. ## System @@ -222,6 +313,10 @@ Use this abstraction instead of upstream `abstractions/nameservice` as upstream Instead of allowing the run of all software under `@{bin}` or `@{lib}` the purpose of this abstraction is to list all GUI program that can open resources. Ultimately, only sandbox manager program such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until this day, this profile will be a controlled mess. +### **`app-launcher-root`** + +### **`app-launcher-user`** + ## Devices diff --git a/docs/development/dbus.md b/docs/development/dbus.md index c8efda0c5..38e931b88 100644 --- a/docs/development/dbus.md +++ b/docs/development/dbus.md @@ -28,7 +28,7 @@ For more access, simply use the [`aa:dbus talk`](#dbus-directive) directive. There is a trade of between security and maintenance to make: -- `aa:dbus talk` will generate less issue as it give full talk access +- `aa:dbus talk` will generate less issue as it gives full talk access - `abstractions/bus/*` will provide more restriction, and possibly more issue. Ideally, these rules should be automatically generated from either the dbus interface documentation or the program call. From 9112c6466dc22968620662e4c6e1220abdf34afb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 01:08:06 +0100 Subject: [PATCH 0278/1455] docs: add development workflow. --- docs/abbreviations.md | 2 + docs/configuration.md | 8 +- docs/development/abstractions.md | 3 +- docs/development/guidelines.md | 13 +- docs/development/index.md | 74 +++------- docs/development/install.md | 66 --------- docs/development/integration.md | 4 +- docs/development/internal.md | 203 ++++++++++++++++++++++++++++ docs/development/recommendations.md | 78 +++++++++++ docs/development/structure.md | 133 ------------------ docs/development/workflow.md | 195 ++++++++++++++++++++++++++ docs/full-system-policy.md | 2 +- mkdocs.yml | 8 +- 13 files changed, 514 insertions(+), 275 deletions(-) delete mode 100644 docs/development/install.md create mode 100644 docs/development/internal.md create mode 100644 docs/development/recommendations.md delete mode 100644 docs/development/structure.md create mode 100644 docs/development/workflow.md diff --git a/docs/abbreviations.md b/docs/abbreviations.md index f99a4f70c..32f567afe 100644 --- a/docs/abbreviations.md +++ b/docs/abbreviations.md @@ -1,3 +1,5 @@ *[MAC]: Mandatory Access Control +*[W^X]: Write XOR Execute +*[FSP]: Full System Policy *[AppArmor tunables]: AppArmor global variables diff --git a/docs/configuration.md b/docs/configuration.md index f2f1d3722..e3fbba5ea 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -181,9 +181,9 @@ All profiles use the variables defined above. Therefore, you can personalize the @{user_pkg_dirs}+=@{user_cache_dirs}/yay/ ``` -### Mountpoints +### Mount points -Common mountpoints are defined in the `@{MOUNTS}` variable. If you mount a disk on a different location, you can add it to the `@{MOUNTS}` variable. +Common mount points are defined in the `@{MOUNTS}` variable. If you mount a disk on a different location, you can add it to the `@{MOUNTS}` variable. **Example** @@ -202,6 +202,6 @@ All supported file browsers (`nautilus`, `dolphin`, `thunar`) are configured to ### Games -In order to not allow access to user data, game profiles use the `@{XDG_GAMESSTUDIO_DIR}` variable. It may needs to be expanded with other game studio directory. The default is `@{XDG_GAMESSTUDIO_DIR}="unity3d"`. +In order to not allow access to user data, game profiles use the `@{XDG_GAMESSTUDIO_DIR}` variable. It may need to be expanded with other game studio directory. The default is `@{XDG_GAMESSTUDIO_DIR}="unity3d"`. -The `@{XDG_GAMES_DIR}` variable is used to define the game directory such as steam storage directory. If your steam storage is on another drive/mountpoint, you should personalize `@{user_games_dirs}` instead. +The `@{XDG_GAMES_DIR}` variable is used to define the game directory such as steam storage directory. If your steam storage is on another drive, you should personalize `@{user_games_dirs}` instead. diff --git a/docs/development/abstractions.md b/docs/development/abstractions.md index 5c6694684..9390945f8 100644 --- a/docs/development/abstractions.md +++ b/docs/development/abstractions.md @@ -137,7 +137,8 @@ A minimal set of rules for profiles including internal `pkexec`. Like `app/sudo` ### **`app/systemctl`** -An alternative solution for [child-systemctl](structure.md#children-profiles), when the child profile provides too much/not enough access. This abstraction should be used by a sub profile as follows: +An alternative solution for [child-systemctl](internal.md#children-profiles), when the child profile provides too much/not enough access. This abstraction should be used by a sub profile as follows: + ```sh @{bin}/systemctl rCx -> systemctl, diff --git a/docs/development/guidelines.md b/docs/development/guidelines.md index 3d83fea5f..f207e58a2 100644 --- a/docs/development/guidelines.md +++ b/docs/development/guidelines.md @@ -11,7 +11,7 @@ The logic behind it is that if a rule is present in a profile, it should only be For example, if a program needs to run executable binaries then the rules allowing it can only be in a specific rule block (just after the `@{exec_path} mr,` rule). It is therefore easy to ensure some profile features such as: * A profile has access to a given resource -* A profile enforces a strict [write xor execute] (W^X) policy. +* A profile enforces a strict [write xor execute](https://en.wikipedia.org/wiki/W%5EX) (W^X) policy. It also improves compatibilities and makes personalization easier thanks to the use of more variables. @@ -132,14 +132,3 @@ If there is no predictable label it can be omitted. ``` Does not help, and if generalized it would add a lot of complexity to any profiles. - -## Additional recommended documentation - -* [The AppArmor Core Policy Reference](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference) -* [The openSUSE Documentation](https://doc.opensuse.org/documentation/leap/security/html/book-security/part-apparmor.html) -* https://documentation.suse.com/sles/12-SP5/html/SLES-all/cha-apparmor-intro.html -* [The AppArmor.d man page](https://man.archlinux.org/man/apparmor.d.5) -* [F**k AppArmor](https://presentations.nordisch.org/apparmor/#/) -* [A Brief Tour of Linux Security Modules](https://www.starlab.io/blog/a-brief-tour-of-linux-security-modules) - -[write xor execute]: https://en.wikipedia.org/wiki/W%5EX diff --git a/docs/development/index.md b/docs/development/index.md index c68745e26..2e12a466b 100644 --- a/docs/development/index.md +++ b/docs/development/index.md @@ -4,31 +4,38 @@ title: Development If you're looking to contribute to `apparmor.d` you can get started by going to the project [GitHub repository](https://github.com/roddhjav/apparmor.d/)! All contributions are welcome no matter how small. In this page you will find all the useful information needed to contribute to the apparmor.d project. -??? info "How to contribute pull requests" +??? info "How to contribute pull requests?" 1. If you don't have git on your machine, [install it](https://help.github.com/articles/set-up-git/). - 2. Fork this repo by clicking on the fork button on the top of the [project GitHub][project] page. - 3. Clone the forked repository and go to the directory: + 1. Fork this repo by clicking on the fork button on the top of the [project GitHub](https://github.com/roddhjav/apparmor.d) page. + 1. [Generate a new SSH key]( https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) and add it to your GitHub account. + 1. Clone the forked repository and go to the directory: ```sh - git clone https://github.com/your-github-username/apparmor.d.git + git clone git@github.com:your-github-username/apparmor.d.git cd apparmor.d ``` - 4. Create a branch: + 1. Create a branch: ``` git checkout -b my_contribution ``` - 5. Make the changes and commit: + 1. Make the changes and commit: ``` git add git commit -m "A message to sum up my contribution" ``` - 6. Push changes to GitHub: + 1. Push changes to GitHub: ``` git push origin my_contribution ``` - 7. Submit your changes for review: If you go to your repository on GitHub, + 1. Submit your changes for review: If you go to your repository on GitHub, you'll see a Compare & pull request button, fill and submit the pull request. +
+ +- :material-arrow-right:   **[See the workflow to write profiles](workflow.md)** + +
+ ## Project rules @@ -55,48 +62,11 @@ If you're looking to contribute to `apparmor.d` you can get started by going to your devices or for your use case. -## Add a profile +## Additional recommended documentation -!!! danger "Warning" - - Following the [profile guidelines](guidelines.md) is **mandatory** for all new profiles. - - -1. To add a new profile `foo`, add the file `foo` in [`apparmor.d/profile-a-f`][profiles-a-f]. - If your profile is part of a large group of profiles, it can also go in - [`apparmor.d/groups`][groups]. - -2. Write the profile content, the rules depend on the confined program, - Here is the bare minimum for the program `foo`: -``` sh -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2024 You -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/foo -profile foo @{exec_path} { - include - - @{exec_path} mr, - - include if exists -} - -# vim:syntax=apparmor -``` - - -3. You can automatically set the `complain` flag on your profile by editing the file [`dists/flags/main.flags`][flags] and add a new line with: `foo complain` - -4. Build & install for your distribution. - - -[project]: https://github.com/roddhjav/apparmor.d - -[flags]: https://github.com/roddhjav/apparmor.d/blob/main/dists/flags/main.flags -[profiles-a-f]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/profiles-a-f -[groups]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups +* [The AppArmor Core Policy Reference](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference) +* [The openSUSE Documentation](https://doc.opensuse.org/documentation/leap/security/html/book-security/part-apparmor.html) +* https://documentation.suse.com/sles/12-SP5/html/SLES-all/cha-apparmor-intro.html +* [The AppArmor.d man page](https://man.archlinux.org/man/apparmor.d.5) +* [F**k AppArmor](https://presentations.nordisch.org/apparmor/#/) +* [A Brief Tour of Linux Security Modules](https://www.starlab.io/blog/a-brief-tour-of-linux-security-modules) diff --git a/docs/development/install.md b/docs/development/install.md deleted file mode 100644 index 6b1f47581..000000000 --- a/docs/development/install.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Installation ---- - -## Development Install - -!!! warning - - Do **not** install this project *"manually"* (with `make`, `sudo make install`). The distribution specific packages are intended to be used in development as they include additional rule to ensure compatibility with upstream. You have been warned! - - See `debian/`, `PKGBUILD` and `dists/apparmor.d.spec`. - - -=== ":material-arch: Archlinux" - - ```sh - make pkg - ``` - -=== ":material-ubuntu: Ubuntu" - - ```sh - make dpkg - ``` - -=== ":material-debian: Debian" - - ```sh - make dpkg - ``` - -=== ":simple-suse: openSUSE" - - ```sh - make rpm - ``` - -=== ":material-docker: Docker" - - For any system with docker installed you can simply build the package with: - - ```sh - make package dist= - ``` - - Then you can install the package with `dpkg`, `pacman` or `rpm`. - - -## Profile flags - -Flags for all profiles in this project are tracked under the [`dists/flags`](https://github.com/roddhjav/apparmor.d/tree/main/dists/flags) directory. It is used for profile that are not considered stable. Files in this directory should respect the following format: ` `, flags should be comma separated. - -For instance, to move `adb` in complain mode, edit **[`dists/flags/main.flags`](https://github.com/roddhjav/apparmor.d/blob/main/dists/flags/main.flags)** and add the following line: -```sh -adb complain -``` - -Beware, flags defined in this file overwrite flags in the profile. So you may need to add other flags. Example for `gnome-shell`: -```sh -gnome-shell attach_disconnected,mediate_deleted,complain -``` - - -## Ignore profiles - -It can be handy to not install a profile for a given distribution. Profiles and directories to ignore are tracked under the [`dists/ignore`](https://github.com/roddhjav/apparmor.d/tree/main/dists/ignore) directory. Files in this directory should respect the following format: ``. One ignore by line. It can be a profile name or a directory to ignore (relative to the project root). diff --git a/docs/development/integration.md b/docs/development/integration.md index f829fb69f..1e5878aa0 100644 --- a/docs/development/integration.md +++ b/docs/development/integration.md @@ -74,7 +74,7 @@ All the images come pre-configured with the latest version of `apparmor.d` insta **Usage** -On all images, `aa-update` can be used to rebuild and install the latest version of the profiles. `p`, `pf`, and `pu` are two preconfigured aliases of `ps` that show the security status of processes. `htop` is also configured to show this status. +On all images, `aa-update` can be used to rebuild and install the latest version of the profiles. `p`, `pf`, and `pu` are two pre-configured aliases of `ps` that show the security status of processes. `htop` is also configured to show this status. ## Tests @@ -118,7 +118,7 @@ Start the tests and collect the results **Tests manifest** -A basic set of test is generated on initialisation. More tests can be manually written in yaml file. They must have the following structure: +A basic set of test is generated on initialization. More tests can be manually written in yaml file. They must have the following structure: ```yaml - name: acpi diff --git a/docs/development/internal.md b/docs/development/internal.md new file mode 100644 index 000000000..c7dc4af14 --- /dev/null +++ b/docs/development/internal.md @@ -0,0 +1,203 @@ +--- +title: Internal +--- + +## Profile Context + +These are context helper to be used for in sub profile, they aim at providing a minimal set of rules for a given program. The calling profile only needs to add rules dependant of its use case. + +See [abstractions/app](abstractions.md#context-helper) for more information. + + +## Open Resources + +The standard way to allow opening resources such as URL, pictures, video, in this project is to use one of the `child-open` profile available in the [`children`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/children) group. + +**Example:** +```sh +@{open_path} rPx -> child-open, +``` + + +### Manual + +Directly using any of the following: + +- `@{bin}/* PUx,` +- `include ` +- `include ` + +Allow every installed program to be started from the current program with or without profile. This is a very permissive rule and should be avoided if possible. They are however legitimately needed for program launcher. + +### **`child-open`** + +Instead of allowing the ability to run all software in `@{bin}/`, the purpose of this profile is to list all GUI programs that can open resources. Ultimately, only sandbox manager programs such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until this day, this profile will be a controlled mess. + +??? quote "[children/child-open](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/children/child-open)" + + ``` aa + # Sandbox managers + @{bin}/bwrap rPUx, + @{bin}/firejail rPUx, + @{bin}/flatpak rPx, + @{bin}/snap rPx, + + # Labeled programs + @{archive_viewers_path} rPUx, + @{browsers_path} rPx, + @{document_viewers_path} rPUx, + @{emails_path} rPUx, + @{file_explorers_path} rPx, + @{help_path} rPx, + @{image_viewers_path} rPUx, + @{offices_path} rPUx, + @{text_editors_path} rPUx, + + # Others + @{bin}/blueman-tray rPx, + @{bin}/discord{,-ptb} rPx, + @{bin}/draw.io rPUx, + @{bin}/dropbox rPx, + @{bin}/element-desktop rPx, + @{bin}/extension-manager rPx, + @{bin}/filezilla rPx, + @{bin}/flameshot rPx, + @{bin}/gimp* rPUx, + @{bin}/gnome-calculator rPUx, + @{bin}/gnome-disk-image-mounter rPx, + @{bin}/gnome-disks rPx, + @{bin}/gnome-software rPx, + @{bin}/gwenview rPUx, + @{bin}/kgx rPx, + @{bin}/qbittorrent rPx, + @{bin}/qpdfview rPx, + @{bin}/smplayer rPx, + @{bin}/steam-runtime rPUx, + @{bin}/telegram-desktop rPx, + @{bin}/transmission-gtk rPx, + @{bin}/viewnior rPUx, + @{bin}/vlc rPUx, + @{bin}/xbrlapi rPx, + + # Backup + @{lib}/deja-dup/deja-dup-monitor rPx, + + @{browsers_path} rPx, + @{help_path} rPx, + ``` + +### **`child-open-browsers`** + + This version of child-open only allow to open browsers. + +??? quote "[children/child-open-browsers](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/children/child-open-browsers)" + + ``` aa + @{browsers_path} rPx, + ``` + +### **`child-open-help`** + +This version of child-open only allow to open browsers and help programs. + +??? quote "[children/child-open-help](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/children/child-open-help)" + + ``` aa + @{browsers_path} rPx, + @{help_path} rPx, + ``` + +### **`child-open-strict`** + +This version of child-open only allow to open browsers & folders: + +??? quote "[children/child-open-strict](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/children/child-open-strict)" + + ``` aa + @{browsers_path} Px, + @{file_explorers_path} Px, + ``` + + +!!! warning + + Although needed to not break a program, wrongly used these profiles can lead to confinment escape. + + +## Children profiles + +Usually, a child profile is in the [`children`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/children) group. They have the following note: + +!!! quote + + Note: This profile does not specify an attachment path because it is intended to be used only via `"Px -> child-open"` exec transitions from other profiles. + + + +### **`child-modprove-nvidia`** + +Used internally by the `nvidia` abstraction. + +### **`child-pager`** + +Simple access to pagers such as `pager`, `less` and `more`. This profile assumes the pager is reading its data from stdin, not from a file on disk. Supported pagers are: `sensible-pager`, `pager`, `less`, and `more`. +It can be as follows in a profile: +``` + @{pager_path} rPx -> child-pager, +``` + +### **`child-systemctl`** + +Common `systemctl` action. Do not use it too much as most of the time you will need more privilege than what this profile is giving you. + +It is recommended to transition [in a subprofile](abstractions.md#appsystemctl) everything that is not generic and that may require some access (so restart, enable...), while `child-systemctl` can handle the more basic tasks. + + +## User Confinement [:material-police-badge-outline:{ .pg-red }](../full-system-policy.md "Only for Full System Policy (FSP)") + +!!! warning "TODO" + + +## No New Privileges + +[**No New Privileges**](https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html) is a flag preventing a newly started program to get more privileges than its parent process. This is a **good thing** for security. And it is commonly used in systemd unit files (when possible). This flag also prevents transitions to other profiles because it could be less restrictive than the parent profile (no `Px` or `Ux` allowed). + +The possible solutions are: + +* The easiest (and unfortunately less secure) workaround is to ensure the programs do not run with no new privileges flag by disabling `NoNewPrivileges` in the systemd unit (or any other [options implying it](https://man.archlinux.org/man/core/systemd/systemd.exec.5.en#SECURITY)). +* Inherit the current confinement (`ix`) +* [Stacking](#stacking) + +## Stacking + +[Stacking](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking) of two or more profile is the strict intersection them. It is a way to ensure that a profile never becomes more permissive than the intersection of all profiles in the stack. It provides several abilities to the policy author: + +- It can be used to ensure that confinement never becomes more permissive. +- To reduce the permissions of a generic profile on a specific task. +- To provide both system level and container and user level policy (when combined with policy namespaces). + +!!! note "" + + [apparmor.d/groups/browsers/chromium](https://github.com/roddhjav/apparmor.d/blob/b51576139b3ed3125aaa3ea4d737a77baac0f00e/apparmor.d/groups/browsers/chromium#L25) + ``` aa linenums="23" + profile chromium @{exec_path} { + ... + @{lib_dirs}/chrome_crashpad_handler rPx -> chromium//&chromium-crashpad-handler, + ... + } + ``` + +## Udev rules + +See the **[kernel docs](https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt)** to check the major block and char numbers used in `/run/udev/data/`. + +Special care must be given as sometimes udev numbers are allocated dynamically by the kernel. Therefore, the full range must be allowed: + +!!! note "" + + [apparmor.d/groups/virt/libvirtd](https://github.com/roddhjav/apparmor.d/blob/b2af7a631a2b8aca7d6bdc8f7ff4fdd5ec94220e/apparmor.d/groups/virt/libvirtd#L188) + ``` aa linenums="179" + @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + ``` diff --git a/docs/development/recommendations.md b/docs/development/recommendations.md new file mode 100644 index 000000000..bbe41bc4e --- /dev/null +++ b/docs/development/recommendations.md @@ -0,0 +1,78 @@ +--- +title: Recommendations +--- + +## Renaming of profiles + +For security reason, once loaded into the kernel, a profile cannot get fully removed. Therefore, by renaming a profile, you create a second profile with the same attachment. AppArmor will not be able to determine witch one to use leading to breakage. + +A reboot is required to fully remove the profile from the kernel. + + +## Programs to not confine + +Some programs should not be confined by themselves. For example, tools such as `ls`, `rm`, `diff` or `cat` do not have profiles in this project. Let's see why. + +These are general tools that in a general context can legitimately access any file in the system. Therefore, the confinement of such tools by a global profile would at best be minimal at worst be a security theatre. + +It gets even worse. Let's say, we write a profile for `cat`. Such a profile would need access to `/etc/`. We will add the following rule: +```sh + /etc/{,**} rw, +``` + +However, as `/etc` can contain sensitive files, we now want to explicitly prevent access to these sensitive files. Problems: + +1. How do we know the exhaustive list of *sensitive files* in `/etc`? +2. How do we ensure access to these sensitive files is not required? +3. This breaks the principle of mandatory access control. + See the [first rule of this project](index.md#project-rules) which is to only allow + what is required. Here we allow everything and blacklist some paths. + +It creates even more issues when we want to use this profile in other profiles. Let's take the example of `diff`. Using this rule: `@{bin}/diff rPx,` this will restrict access to the very generic and not very confined `diff` profile. Whereas most of the time, we want to restrict `diff` to some specific file in our profile: + +* In `dpkg`, an internal child profile (`rCx -> diff`), allows `diff` to only access etc config files: + +!!! note "" + + [apparmor.d/apparmor.d/groups/apt/dpkg](https://github.com/roddhjav/apparmor.d/blob/accf5538bdfc1598f1cc1588a7118252884df50c/apparmor.d/groups/apt/dpkg#L123) + ``` aa linenums="123" + profile diff { + include + include + + @{bin}/ r, + @{bin}/pager mr, + @{bin}/less mr, + @{bin}/more mr, + @{bin}/diff mr, + + owner @{HOME}/.lesshs* rw, + + # Diff changed config files + /etc/** r, + + # For shell pwd + /root/ r, + + } + ``` + +* As it is a dependency of pass, `diff` inherits the `pass' profile and has the same access as the pass profile, so it will be allowed to diff password files because more than a generic `diff`, it is a `diff` "version" for the pass password manager: + +!!! note "" + + [apparmor.d/apparmor.d/profiles-m-r/pass](https://github.com/roddhjav/apparmor.d/blob/accf5538bdfc1598f1cc1588a7118252884df50c/apparmor.d/profiles-m-r/pass#L20 + ) + ``` aa linenums="20" + @{bin}/diff rix, + ``` + +**What if I still want to protect these programs?** + +You do not protect these programs. *Protect the usage you have of these programs*. In practice, it means that you should put your terminal in a sandbox managed environment with a sandboxing tool such as Toolbox. + +!!! example "To sum up" + + 1. Do not create a profile for programs such as: `rm`, `ls`, `diff`, `cd`, `cat` + 2. Do not create a profile for the shell: `bash`, `sh`, `dash`, `zsh` + 3. Use [Toolbox](https://containertoolbx.org/) diff --git a/docs/development/structure.md b/docs/development/structure.md deleted file mode 100644 index c6b82e29f..000000000 --- a/docs/development/structure.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Structure ---- - -Description of common structure found across various AppArmor profiles - - -## Programs to not confine - -Some programs should not be confined by themselves. For example, tools such as `ls`, `rm`, `diff` or `cat` do not have profiles in this project. Let's see why. - -These are general tools that in a general context can legitimately access any file in the system. Therefore, the confinement of such tools by a global profile would at best be minimal at worst be a security theatre. - -It gets even worse. Let's say, we write a profile for `cat`. Such a profile would need access to `/etc/`. We will add the following rule: -```sh - /etc/{,**} rw, -``` - -However, as `/etc` can contain sensitive files, we now want to explicitly prevent access to these sensitive files. Problems: - -1. How do we know the exhaustive list of *sensitive files* in `/etc`? -2. How do we ensure access to these sensitive files is not required? -3. This breaks the principle of mandatory access control. - See the [first rule of this project](index.md#project-rules) which is to only allow - what is required. Here we allow everything and blacklist some paths. - -It creates even more issues when we want to use this profile in other profiles. Let's take the example of `diff`. Using this rule: `@{bin}/diff rPx,` this will restrict access to the very generic and not very confined `diff` profile. Whereas most of the time, we want to restrict `diff` to some specific file in our profile: - -* In `dpkg`, an internal child profile (`rCx -> diff`), allows `diff` to only access etc config files: - -!!! note "" - - [apparmor.d/apparmor.d/groups/apt/dpkg](https://github.com/roddhjav/apparmor.d/blob/accf5538bdfc1598f1cc1588a7118252884df50c/apparmor.d/groups/apt/dpkg#L123) - ``` aa linenums="123" - profile diff { - include - include - - @{bin}/ r, - @{bin}/pager mr, - @{bin}/less mr, - @{bin}/more mr, - @{bin}/diff mr, - - owner @{HOME}/.lesshs* rw, - - # Diff changed config files - /etc/** r, - - # For shell pwd - /root/ r, - - } - ``` - -* As it is a dependency of pass, `diff` inherits the `pass' profile and has the same access as the pass profile, so it will be allowed to diff password files because more than a generic `diff`, it is a `diff` "version" for the pass password manager: - -!!! note "" - - [apparmor.d/apparmor.d/profiles-m-r/pass](https://github.com/roddhjav/apparmor.d/blob/accf5538bdfc1598f1cc1588a7118252884df50c/apparmor.d/profiles-m-r/pass#L20 - ) - ``` aa linenums="20" - @{bin}/diff rix, - ``` - -**What if I still want to protect these programs?** - -You do not protect these programs. *Protect the usage you have of these programs*. In practice, it means that you should put your terminal in a sandbox managed environment with a sandboxing tool such as Toolbox. - -!!! example "To sum up" - - 1. Do not create a profile for programs such as: `rm`, `ls`, `diff`, `cd`, `cat` - 2. Do not create a profile for the shell: `bash`, `sh`, `dash`, `zsh` - 3. Use [Toolbox]. - -[Toolbox]: https://containertoolbx.org/ - - -## Open Resources - -The standard way to allow opening resource in this project is to use one of the -child-open profile. Eg: `@{open_path} rPx -> child-open,` - -They are available in the [`children`][children] group. - -* **`child-open`**: Instead of allowing the ability to run all software in `@{bin}/`, the purpose of this profile is to list all GUI programs that can open resources. Ultimately, only sandbox manager programs such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until this day, this profile will be a controlled mess. -* **`child-open-browsers`**: This version of child-open only allow to open browsers. -* **`child-open-help`**: This version of child-open only allow to open browsers and help programs. -* **`child-open-strict`**: This version of child-open only allow to open browsers & folders. - - -## Children profiles - -Usually, a child profile is in the [`children`][children] group. They have the following note: - -!!! quote - - Note: This profile does not specify an attachment path because it is intended to be used only via `"Px -> child-open"` exec transitions from other profiles. - -[children]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/children - -Here is an overview of the current children profile: - -2. **`child-pager`**: Simple access to pagers such as `pager`, `less` and `more`. This profile assumes the pager is reading its data from stdin, not from a file on disk. - -3. **`child-systemctl`**: Common `systemctl` action. Do not use it too much as most of the time you will need more privilege than what this profile is giving you. - - -## Udev rules - -See the **[kernel docs][kernel]** to check the major block and char numbers used in `/run/udev/data/`. - -Special care must be given as sometimes udev numbers are allocated dynamically by the kernel. Therefore, the full range must be allowed: - -!!! note "" - - [apparmor.d/groups/virt/libvirtd](https://github.com/roddhjav/apparmor.d/blob/b2af7a631a2b8aca7d6bdc8f7ff4fdd5ec94220e/apparmor.d/groups/virt/libvirtd#L188) - ``` aa linenums="179" - @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - ``` - -[kernel]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt - - -## No New Privileges - -[**No New Privileges**](https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html) is a flag preventing a newly started program to get more privileges than its parent process. This is a **good thing** for security. And it is commonly used in systemd unit files (when possible). This flag also prevents transitions to other profiles because it could be less restrictive than the parent profile (no `Px` or `Ux` allowed). - -The possible solutions are: - -* The easiest (and unfortunately less secure) workaround is to ensure the programs do not run with no new privileges flag by disabling `NoNewPrivileges` in the systemd unit (or any other [options implying it](https://man.archlinux.org/man/core/systemd/systemd.exec.5.en#SECURITY)). -* Inherit the current confinement (`ix`) -* [Stacking](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking) diff --git a/docs/development/workflow.md b/docs/development/workflow.md new file mode 100644 index 000000000..7455d97c7 --- /dev/null +++ b/docs/development/workflow.md @@ -0,0 +1,195 @@ +--- +title: Workflow +--- + +**Workflow to write profiles** + +
+ +- :material-file-document:   **[Write a blanck profile](#add-a-blank-profile)** + +
+
+ +- :material-download:   **[Install the profile](#individual-profile)** + +
+
+ +- :material-test-tube:   **[Profile the program](#program-profiling)** + +
+
+ +- :octicons-law-16:   **[Respect the profile guidelines](guidelines.md)** + +
+ + +## Add a blank profile + +1. To add a new profile `foo`, add the file `foo` in [`apparmor.d/profile-a-f`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/profiles-a-f). + If your profile is part of a large group of profiles, it can also go in + [`apparmor.d/groups`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups). + +2. Write the profile content, the rules depend on the confined program, + Here is the bare minimum for the program `foo`: +``` sh +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 You +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/foo +profile foo @{exec_path} { + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor +``` + +## Development Install + +It is not recommended installing the full project *"manually"* (with `make`, `sudo make install`). The distribution specific packages are intended to be used in development as they include additional rule to ensure compatibility with upstream (see `debian/`, `PKGBUILD` and `dists/apparmor.d.spec`). + +Instead, install an individual profile or the development package, the following way. + +### Development package + +=== ":material-arch: Archlinux" + + ```sh + make pkg + ``` + +=== ":material-ubuntu: Ubuntu" + + ```sh + make dpkg + ``` + +=== ":material-debian: Debian" + + ```sh + make dpkg + ``` + +=== ":simple-suse: openSUSE" + + ```sh + make rpm + ``` + +=== ":material-docker: Docker" + + For any system with docker installed you can simply build the package with: + + ```sh + make package dist= + ``` + + Then you can install the package with `dpkg`, `pacman` or `rpm`. + +### Individual profile + +**Format** + +```sh +make dev name= +``` + +**Exampe** + +: Testing the profile `pass` + + ``` + make dev name=pass + ``` + + This: + + - Prebuild the `pass` profile in complain mode to `.build`, + - Install the profile to `/etc/apparmor.d/` + - Load the profile by restarting the AppArmor service. + + +More advanced development, like editing the abstractions or working over multiple profiles at the same time requires installing the full development package. + +For this individual profile installation to work, the full package needs to be installed, regardless of the installation method ([dev](#development-package) or [stable](../install.md)). + +## Program Profiling + +### Workflow + +To discover the access needed by a program, you can use the following tools: + +1. Star the program in *complain* mode, let it initialize itself, then close it. + +1. Run **[`aa-log -r`](../usage.md#apparmor-log)**. It will: + - Convert the logs to AppArmor rules. + - Detect if flags such as `attach_disconnected` are needed. + - Convert all common paths to **[variables](../variables.md)**. + +1. From `aa-log` output, you can: + - Copy the rules to the profile. + - Replace some rules with **[abstractions](abstractions.md)** as 80% of the rules should already be covered by an abstraction. + +1. Then, [update the profile](#individual-profile) and start the program again. Use the program as you would normally do, but also try to run all the features of the program, e.g.: open the help, settings, etc. + +1. Run **[`aa-log`](../usage.md#apparmor-log)**. Stop the program as long as you get over 100 new rules. Add the rules to the profile. + +After 2 or 3 iterations, you should have a working profile. + +### Recommendations + +
+ +- :material-function:   **[Use the abstractions](abstractions.md)** +- :simple-files:   **[Learn how to open resources](internal.md#open-resources)** +- :fontawesome-solid-bus-simple:   **[Learn how Dbus rules are handled](dbus.md)** +- :material-sign-direction:   **[Learn about directives `#aa:`](directives.md)** +- :octicons-law-16:   **[Follow the profile guidelines](guidelines.md)** +- :octicons-light-bulb-16:   **[See other recommendations](recommendations.md)** + +
+ +!!! danger "Warning" + + Following the [profile guidelines](guidelines.md) is **mandatory** for all profiles. PRs that do not follow the guidelines will not get merged. + +### Tools + +* **[aa-notify](https://wiki.archlinux.org/title/AppArmor#Get_desktop_notification_on_DENIED_actions)** is a tool that will allow you to get notified on every apparmor log. + +* **[aa-logprof](https://man.archlinux.org/man/aa-logprof.8)** is another tool that will help you to generate a profile from logs. However, the logs generated by `aa-logprof` need to be rewritten to comply with the profile [guidelines](guidelines.md). + +* **[aa-complain](https://man.archlinux.org/man/aa-complain.8), aa-enforce** are tools to quickly change the mode of a profile. + + +## Development Settings + +### Profile flags + +Flags for all profiles in this project are tracked under the [`dists/flags`](https://github.com/roddhjav/apparmor.d/tree/main/dists/flags) directory. It is used for profile that are not considered stable. Files in this directory should respect the following format: ` `, flags should be comma separated. + +For instance, to move `adb` in *complain* mode, edit **[`dists/flags/main.flags`](https://github.com/roddhjav/apparmor.d/blob/main/dists/flags/main.flags)** and add the following line: +```sh +adb complain +``` + +Beware, flags defined in this file overwrite flags in the profile. So you may need to add other flags. Example for `gnome-shell`: +```sh +gnome-shell attach_disconnected,mediate_deleted,complain +``` + + +### Ignore profiles + +It can be handy to not install a profile for a given distribution. Profiles and directories to ignore are tracked under the [`dists/ignore`](https://github.com/roddhjav/apparmor.d/tree/main/dists/ignore) directory. Files in this directory should respect the following format: ``. One ignore by line. It can be a profile name or a directory to ignore (relative to the project root). diff --git a/docs/full-system-policy.md b/docs/full-system-policy.md index d37cf3071..80da55c2a 100644 --- a/docs/full-system-policy.md +++ b/docs/full-system-policy.md @@ -131,7 +131,7 @@ To work as intended, userland services started by `systemd --user` **should** ha !!! info - To be allowed to run, additional root or user services may need to add extra rules inside the `usr/systemd.d` or `usr/systemd-user.d` directory. For example, when installing a new privileged service `foo` with [stacking](development/structure.md#no-new-privileges) you may need to add the following to `/etc/apparmor.d/usr/systemd.d/foo`: + To be allowed to run, additional root or user services may need to add extra rules inside the `usr/systemd.d` or `usr/systemd-user.d` directory. For example, when installing a new privileged service `foo` with [stacking](development/internal.md#no-new-privileges) you may need to add the following to `/etc/apparmor.d/usr/systemd.d/foo`: ``` @{lib}/foo rPx -> systemd//&foo, ``` diff --git a/mkdocs.yml b/mkdocs.yml index 689785a31..9390b3dde 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -152,14 +152,14 @@ nav: - recovery.md - Development: - development/index.md - - Architecture: - - development/install.md + - Profiles: + - development/workflow.md - development/guidelines.md - - development/structure.md - - Profile: - development/abstractions.md + - development/internal.md - development/directives.md - development/dbus.md + - development/recommendations.md - Tests: - development/tests.md - development/integration.md From 28a2892be0beea82a23101e246981f5526a18ada Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 01:19:25 +0100 Subject: [PATCH 0279/1455] docs: add badge colors. --- docs/assets/stylesheets/extra.css | 51 ++++++++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/docs/assets/stylesheets/extra.css b/docs/assets/stylesheets/extra.css index 3b0fc1db6..8691707db 100644 --- a/docs/assets/stylesheets/extra.css +++ b/docs/assets/stylesheets/extra.css @@ -4,9 +4,58 @@ --md-footer-fg-color--lighter: #b6b6b6; --md-footer-bg-color: transparent; --md-footer-bg-color--dark: transparent; + --pg-purple: #603aa0; + --pg-red: #c0322f; + --pg-orange: #ac2f09; + --pg-teal: #04756a; + --pg-brown: #8d6e62; + --pg-blue: #0e66ae; + --pg-green: #2e7e31; + --pg-blue-gray: #546d78; } [data-md-color-scheme=slate] { --md-footer-bg-color: transparent; --md-footer-bg-color--dark: var(--md-default-bg-color--darkest); -} \ No newline at end of file + --pg-purple: #af94de; + --pg-red: #ff6c6a; + --pg-orange: #e97b5a; + --pg-teal: #8dc6c1; + --pg-brown: #4b1d0b; + --pg-blue: #74b9f1; + --pg-green: #72cd75; + --pg-blue-gray: #9ab2bc; +} + +/* Badge colors */ +.pg-purple { + color: var(--pg-purple); +} + +.pg-red { + color: var(--pg-red); +} + +.pg-orange { + color: var(--pg-orange); +} + +.pg-teal { + color: var(--pg-teal); +} + +.pg-brown { + color: var(--pg-brown); +} + +.pg-blue { + color: var(--pg-blue); +} + +.pg-green { + color: var(--pg-green); +} + +.pg-blue-gray { + color: var(--pg-blue-gray); +} From 239ae171193c9b4951badb39417768536841a880 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 13:46:30 +0100 Subject: [PATCH 0280/1455] feat(profile): modernize some profiles. --- apparmor.d/groups/bus/ibus-portal | 7 +--- apparmor.d/groups/freedesktop/xdg-email | 2 ++ .../groups/freedesktop/xdg-icon-resource | 1 + apparmor.d/groups/freedesktop/xdg-screensaver | 1 + .../gnome-control-center-search-provider | 5 +-- apparmor.d/groups/gnome/seahorse | 5 +-- apparmor.d/groups/kde/systemsettings | 9 ++++-- apparmor.d/groups/ubuntu/cron-ubuntu-fan | 2 +- .../groups/ubuntu/software-properties-gtk | 32 ++++--------------- .../groups/ubuntu/subiquity-console-conf | 2 +- .../ubuntu/ubuntu-advantage-desktop-daemon | 13 ++------ apparmor.d/groups/virt/dockerd | 1 + apparmor.d/profiles-m-r/qbittorrent | 2 +- apparmor.d/profiles-m-r/repo | 2 +- apparmor.d/profiles-s-z/wireplumber | 2 +- 15 files changed, 28 insertions(+), 58 deletions(-) diff --git a/apparmor.d/groups/bus/ibus-portal b/apparmor.d/groups/bus/ibus-portal index ea3d7a7a6..c902e20d0 100644 --- a/apparmor.d/groups/bus/ibus-portal +++ b/apparmor.d/groups/bus/ibus-portal @@ -14,18 +14,13 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term, hup) peer=gdm*, - dbus bind bus=session name=org.freedesktop.portal.IBus, + #aa:dbus own bus=session name=org.freedesktop.portal.IBus dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(name=:*, label=gnome-shell), - dbus receive bus=session path=/org/freedesktop/IBus - interface=org.freedesktop.DBus.Peer - member=Ping - peer=(name=:*, label=ibus-daemon), - @{exec_path} mr, owner @{desktop_cache_dirs}/ibus/dbus-@{rand8} rw, diff --git a/apparmor.d/groups/freedesktop/xdg-email b/apparmor.d/groups/freedesktop/xdg-email index da457a0fe..fa8abd38f 100644 --- a/apparmor.d/groups/freedesktop/xdg-email +++ b/apparmor.d/groups/freedesktop/xdg-email @@ -10,6 +10,8 @@ include @{exec_path} = @{bin}/xdg-email profile xdg-email @{exec_path} flags=(complain) { include + include + include @{exec_path} r, diff --git a/apparmor.d/groups/freedesktop/xdg-icon-resource b/apparmor.d/groups/freedesktop/xdg-icon-resource index 9ece71574..66cd5435f 100644 --- a/apparmor.d/groups/freedesktop/xdg-icon-resource +++ b/apparmor.d/groups/freedesktop/xdg-icon-resource @@ -12,6 +12,7 @@ profile xdg-icon-resource @{exec_path} flags=(attach_disconnected) { include include include + include @{exec_path} r, diff --git a/apparmor.d/groups/freedesktop/xdg-screensaver b/apparmor.d/groups/freedesktop/xdg-screensaver index bca69b9b1..792c6b859 100644 --- a/apparmor.d/groups/freedesktop/xdg-screensaver +++ b/apparmor.d/groups/freedesktop/xdg-screensaver @@ -11,6 +11,7 @@ include profile xdg-screensaver @{exec_path} { include include + include @{exec_path} r, diff --git a/apparmor.d/groups/gnome/gnome-control-center-search-provider b/apparmor.d/groups/gnome/gnome-control-center-search-provider index b584a8c1a..53ced47f0 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-search-provider +++ b/apparmor.d/groups/gnome/gnome-control-center-search-provider @@ -14,10 +14,7 @@ profile gnome-control-center-search-provider @{exec_path} { include include - dbus bind bus=session name=org.gnome.Settings.SearchProvider, - dbus receive bus=session path=/org/gnome/Settings/SearchProvider - interface=org.gnome.Shell.SearchProvider2 - peer=(name=:*, label=gnome-shell), + #aa:dbus own bus=session name=org.gnome.Settings.SearchProvider @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index ba23af8a4..cb41a046d 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -21,10 +21,7 @@ profile seahorse @{exec_path} { include include - dbus bind bus=session name=org.gnome.seahorse.Application, - dbus receive bus=session path=/org/gnome/seahorse/Application - interface=org.gnome.Shell.SearchProvider2 - peer=(name=:*), + #aa:dbus own bus=session name=org.gnome.seahorse.Application @{exec_path} mr, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index e1de05a11..c17a34e59 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -84,7 +84,6 @@ profile systemsettings @{exec_path} { owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/device_automounter_kcmrc.lock rwk, owner @{user_config_dirs}/emaildefaults r, - owner @{user_config_dirs}/kactivitymanagerdrc r, owner @{user_config_dirs}/kde.org/{,**} rwlk, owner @{user_config_dirs}/kdedefaults/kscreenlockerrc r, owner @{user_config_dirs}/kdedefaults/plasmarc r, @@ -111,6 +110,11 @@ profile systemsettings @{exec_path} { owner @{user_share_dirs}/systemsettings/** rwlk, owner @{user_share_dirs}/wallpapers/{,**} r, + owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/systemsettingsstaterc rw, + owner @{user_state_dirs}/systemsettingsstaterc.@{rand6} rwlk, + owner @{user_state_dirs}/systemsettingsstaterc.lock rwlk, + owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/systemsettings@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, @@ -123,9 +127,10 @@ profile systemsettings @{exec_path} { @{sys}/firmware/acpi/pm_profile r, @{PROC}/interrupts r, - owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, /dev/ r, /dev/bus/usb/ r, diff --git a/apparmor.d/groups/ubuntu/cron-ubuntu-fan b/apparmor.d/groups/ubuntu/cron-ubuntu-fan index c66587969..aaf3b9f33 100644 --- a/apparmor.d/groups/ubuntu/cron-ubuntu-fan +++ b/apparmor.d/groups/ubuntu/cron-ubuntu-fan @@ -14,7 +14,7 @@ profile cron-ubuntu-fan @{exec_path} { @{exec_path} mr, - @{bin}/{,da,ba}sh rix, + @{sh_path} rix, @{bin}/fanctl rix, @{bin}/flock rix, @{bin}/grep rix, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 9db3ec332..6d7dc732f 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -20,35 +20,15 @@ profile software-properties-gtk @{exec_path} { include include - dbus bind bus=session name=com.ubuntu.SoftwareProperties, - dbus (send, receive) bus=system path=/com/ubuntu/SoftwareProperties - interface={com.ubuntu.SoftwareProperties,org.gtk.{Application,Actions}} - peer=(name="{:*,com.ubuntu.SoftwareProperties}", label=software-properties-gtk), - dbus send bus=system path=/ - interface=com.ubuntu.SoftwareProperties - peer=(name=:*, label=software-properties-dbus), - - dbus send bus=system path=/ - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*), - - dbus send bus=system path=/ - interface=org.freedesktop.DBus.ObjectManager - member=GetManagedObjects - peer=(name=:*, label=ubuntu-advantage-desktop-daemon), - - dbus send bus=system path=/com/canonical/UbuntuAdvantage/Manager - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*, label=ubuntu-advantage-desktop-daemon), + #aa:dbus own bus=session name=com.ubuntu.SoftwareProperties + #aa:dbus talk bus=system name=com.canonical.UbuntuAdvantage label=ubuntu-advantage-desktop-daemon @{exec_path} mr, @{bin}/ r, + @{sh_path} rix, @{bin}/python3.@{int} r, - @{bin}/{,da,ba}sh rix, @{bin}/aplay rPx, @{bin}/apt-key rPx, @{bin}/dpkg rPx -> child-dpkg, @@ -73,9 +53,9 @@ profile software-properties-gtk @{exec_path} { /var/crash/*software-properties-gtk.@{uid}.crash rw, /var/lib/ubuntu-advantage/status.json r, - owner @{tmp}/???????? rw, - owner @{tmp}/tmp????????/ rw, # change to 'c' - owner @{tmp}/tmp????????/apt.conf rw, + owner @{tmp}/@{word8} rw, + owner @{tmp}/tmp@{word8}/ rw, + owner @{tmp}/tmp@{word8}/apt.conf rw, owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index 08886b640..7113dac5e 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -22,7 +22,7 @@ profile subiquity-console-conf @{exec_path} { @{exec_path} mr, - @{bin}/{,da,ba}sh rix, + @{sh_path} rix, @{bin}/cat rix, @{bin}/grep rix, @{bin}/ip rix, diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon b/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon index 2e35697c0..ddb689b53 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon @@ -14,17 +14,8 @@ profile ubuntu-advantage-desktop-daemon @{exec_path} flags=(attach_disconnected) capability sys_nice, - dbus bind bus=system name=com.canonical.UbuntuAdvantage, - - dbus receive bus=system path=/ - interface=org.freedesktop.DBus.ObjectManager - member=GetManagedObjects - peer=(name=:*, label=software-properties-gtk), - - dbus receive bus=system - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*, label=software-properties-gtk), + #aa:dbus own bus=system name=com.canonical.UbuntuAdvantage + #aa:dbus talk bus=system name=com.ubuntu.SoftwareProperties label=software-properties-gtk @{exec_path} mr, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index def1d76b2..78503c7be 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -60,6 +60,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { pivot_root oldroot=/var/lib/docker/tmp/**/.pivot_root@{int}/ /var/lib/docker/tmp/**/, ptrace read peer=docker-*, + ptrace read peer=runc, ptrace read peer=unconfined, signal send set=int peer=docker-proxy, diff --git a/apparmor.d/profiles-m-r/qbittorrent b/apparmor.d/profiles-m-r/qbittorrent index 7f79d3a06..3e7c28e24 100644 --- a/apparmor.d/profiles-m-r/qbittorrent +++ b/apparmor.d/profiles-m-r/qbittorrent @@ -135,7 +135,7 @@ profile qbittorrent @{exec_path} { owner @{user_torrents_dirs}/** r, - owner /dev/shm/sem.mp-???????? rwl -> /dev/shm/@{int}, # unconventional '_' tail + owner /dev/shm/sem.mp-@{word8} rwl -> /dev/shm/@{int}, owner /dev/shm/* rw, owner @{tmp}/@{int} rw, diff --git a/apparmor.d/profiles-m-r/repo b/apparmor.d/profiles-m-r/repo index 6f3ba2417..5f491cd5e 100644 --- a/apparmor.d/profiles-m-r/repo +++ b/apparmor.d/profiles-m-r/repo @@ -51,7 +51,7 @@ profile repo @{exec_path} { owner @{tmp}/ssh-*/ rw, owner /dev/shm/* rw, - owner /dev/shm/sem.mp-???????? rwl -> /dev/shm/*, # unconventional '_' tail + owner /dev/shm/sem.mp-@{word8} rwl -> /dev/shm/*, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-s-z/wireplumber b/apparmor.d/profiles-s-z/wireplumber index 6b8bca6c0..eadb669cd 100644 --- a/apparmor.d/profiles-s-z/wireplumber +++ b/apparmor.d/profiles-s-z/wireplumber @@ -24,7 +24,7 @@ profile wireplumber @{exec_path} { network bluetooth stream, network netlink raw, - dbus bind bus=session name=org.freedesktop.ReserveDevice1.Audio0, + #aa:dbus own bus=session name=org.freedesktop.ReserveDevice1.Audio0 dbus receive bus=session interface=org.freedesktop.DBus.Introspectable From a5df9dc61ef3c752cfb0650875a922c65a4480d4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 13:53:36 +0100 Subject: [PATCH 0281/1455] docs: add Labelled programs section. --- docs/development/internal.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/development/internal.md b/docs/development/internal.md index c7dc4af14..58d66058f 100644 --- a/docs/development/internal.md +++ b/docs/development/internal.md @@ -42,7 +42,7 @@ Instead of allowing the ability to run all software in `@{bin}/`, the purpose of @{bin}/flatpak rPx, @{bin}/snap rPx, - # Labeled programs + # Labelled programs @{archive_viewers_path} rPUx, @{browsers_path} rPx, @{document_viewers_path} rPUx, @@ -81,9 +81,6 @@ Instead of allowing the ability to run all software in `@{bin}/`, the purpose of # Backup @{lib}/deja-dup/deja-dup-monitor rPx, - - @{browsers_path} rPx, - @{help_path} rPx, ``` ### **`child-open-browsers`** @@ -155,6 +152,12 @@ Common `systemctl` action. Do not use it too much as most of the time you will n It is recommended to transition [in a subprofile](abstractions.md#appsystemctl) everything that is not generic and that may require some access (so restart, enable...), while `child-systemctl` can handle the more basic tasks. +## Labelled programs + +All common programs are tracked and labelled in the [`apparmor.d/tunables/multiarch.d/programs`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/programs) and +[`apparmor.d/tunables/multiarch.d/paths`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/paths) files. They can be used in a `child-open` profile or directly in a profile. They are useful to allow opening resources using a kind of program (browsers, image viewer, text editor...), instead of allowing a given program path. + + ## User Confinement [:material-police-badge-outline:{ .pg-red }](../full-system-policy.md "Only for Full System Policy (FSP)") !!! warning "TODO" From 5ed4df691608d7570c2f4bf8f0a52bc278b24d29 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 14:04:08 +0100 Subject: [PATCH 0282/1455] feat(profile): update all profile to abi 4.0 by default. --- apparmor.d/groups/_full/bwrap | 2 +- apparmor.d/groups/_full/bwrap-app | 2 +- apparmor.d/groups/_full/default | 2 +- apparmor.d/groups/_full/default-sudo | 2 +- apparmor.d/groups/_full/systemd | 2 +- apparmor.d/groups/_full/systemd-service | 2 +- apparmor.d/groups/_full/systemd-user | 2 +- apparmor.d/groups/_full/systemd-user-service | 2 +- apparmor.d/groups/akonadi/akonadi_akonotes_resource | 2 +- apparmor.d/groups/akonadi/akonadi_archivemail_agent | 2 +- apparmor.d/groups/akonadi/akonadi_birthdays_resource | 2 +- apparmor.d/groups/akonadi/akonadi_contacts_resource | 2 +- apparmor.d/groups/akonadi/akonadi_control | 2 +- apparmor.d/groups/akonadi/akonadi_followupreminder_agent | 2 +- apparmor.d/groups/akonadi/akonadi_ical_resource | 2 +- apparmor.d/groups/akonadi/akonadi_indexing_agent | 2 +- apparmor.d/groups/akonadi/akonadi_maildir_resource | 2 +- apparmor.d/groups/akonadi/akonadi_maildispatcher_agent | 2 +- apparmor.d/groups/akonadi/akonadi_mailfilter_agent | 2 +- apparmor.d/groups/akonadi/akonadi_mailmerge_agent | 2 +- apparmor.d/groups/akonadi/akonadi_migration_agent | 2 +- apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent | 2 +- apparmor.d/groups/akonadi/akonadi_notes_agent | 2 +- apparmor.d/groups/akonadi/akonadi_sendlater_agent | 2 +- apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent | 2 +- apparmor.d/groups/apt/apt | 2 +- apparmor.d/groups/apt/apt-cache | 2 +- apparmor.d/groups/apt/apt-cdrom | 2 +- apparmor.d/groups/apt/apt-config | 2 +- apparmor.d/groups/apt/apt-extracttemplates | 2 +- apparmor.d/groups/apt/apt-file | 2 +- apparmor.d/groups/apt/apt-forktracer | 2 +- apparmor.d/groups/apt/apt-ftparchive | 2 +- apparmor.d/groups/apt/apt-helper | 2 +- apparmor.d/groups/apt/apt-key | 2 +- apparmor.d/groups/apt/apt-listbugs | 2 +- apparmor.d/groups/apt/apt-listbugs-aptcleanup | 2 +- apparmor.d/groups/apt/apt-listbugs-migratepins | 2 +- apparmor.d/groups/apt/apt-listbugs-prefclean | 2 +- apparmor.d/groups/apt/apt-listchanges | 2 +- apparmor.d/groups/apt/apt-mark | 2 +- apparmor.d/groups/apt/apt-methods-cdrom | 2 +- apparmor.d/groups/apt/apt-methods-copy | 2 +- apparmor.d/groups/apt/apt-methods-file | 2 +- apparmor.d/groups/apt/apt-methods-ftp | 2 +- apparmor.d/groups/apt/apt-methods-gpgv | 2 +- apparmor.d/groups/apt/apt-methods-http | 2 +- apparmor.d/groups/apt/apt-methods-mirror | 2 +- apparmor.d/groups/apt/apt-methods-rred | 2 +- apparmor.d/groups/apt/apt-methods-rsh | 2 +- apparmor.d/groups/apt/apt-methods-store | 2 +- apparmor.d/groups/apt/apt-overlay | 2 +- apparmor.d/groups/apt/apt-show-versions | 2 +- apparmor.d/groups/apt/apt-sortpkgs | 2 +- apparmor.d/groups/apt/apt-systemd-daily | 2 +- apparmor.d/groups/apt/aptitude | 2 +- apparmor.d/groups/apt/aptitude-changelog-parser | 2 +- apparmor.d/groups/apt/aptitude-create-state-bundle | 2 +- apparmor.d/groups/apt/aptitude-run-state-bundle | 2 +- apparmor.d/groups/apt/command-not-found | 2 +- apparmor.d/groups/apt/debconf-apt-progress | 2 +- apparmor.d/groups/apt/debconf-show | 2 +- apparmor.d/groups/apt/deborphan | 2 +- apparmor.d/groups/apt/debsecan | 2 +- apparmor.d/groups/apt/debsign | 2 +- apparmor.d/groups/apt/debsums | 2 +- apparmor.d/groups/apt/debtags | 2 +- apparmor.d/groups/apt/dpkg | 2 +- apparmor.d/groups/apt/dpkg-architecture | 2 +- apparmor.d/groups/apt/dpkg-buildflags | 2 +- apparmor.d/groups/apt/dpkg-checkbuilddeps | 2 +- apparmor.d/groups/apt/dpkg-deb | 2 +- apparmor.d/groups/apt/dpkg-divert | 2 +- apparmor.d/groups/apt/dpkg-genbuildinfo | 2 +- apparmor.d/groups/apt/dpkg-genchanges | 2 +- apparmor.d/groups/apt/dpkg-preconfigure | 2 +- apparmor.d/groups/apt/dpkg-query | 2 +- apparmor.d/groups/apt/dpkg-split | 2 +- apparmor.d/groups/apt/dpkg-trigger | 2 +- apparmor.d/groups/apt/dpkg-vendor | 2 +- apparmor.d/groups/apt/querybts | 2 +- apparmor.d/groups/apt/reportbug | 2 +- apparmor.d/groups/apt/synaptic | 2 +- apparmor.d/groups/apt/unattended-upgrade | 2 +- apparmor.d/groups/apt/unattended-upgrade-shutdown | 2 +- apparmor.d/groups/apt/update-apt-xapian-index | 2 +- apparmor.d/groups/avahi/avahi-autoipd | 2 +- apparmor.d/groups/avahi/avahi-browse | 2 +- apparmor.d/groups/avahi/avahi-publish | 2 +- apparmor.d/groups/avahi/avahi-resolve | 2 +- apparmor.d/groups/avahi/avahi-set-host-name | 2 +- apparmor.d/groups/browsers/brave | 2 +- apparmor.d/groups/browsers/brave-crashpad-handler | 2 +- apparmor.d/groups/browsers/brave-sandbox | 2 +- apparmor.d/groups/browsers/brave-wrapper | 2 +- apparmor.d/groups/browsers/chrome | 2 +- apparmor.d/groups/browsers/chrome-crashpad-handler | 2 +- apparmor.d/groups/browsers/chrome-sandbox | 2 +- apparmor.d/groups/browsers/chrome-wrapper | 2 +- apparmor.d/groups/browsers/chromium | 2 +- apparmor.d/groups/browsers/chromium-crashpad-handler | 2 +- apparmor.d/groups/browsers/chromium-sandbox | 2 +- apparmor.d/groups/browsers/chromium-wrapper | 2 +- apparmor.d/groups/browsers/ephy-profile-migrator | 2 +- apparmor.d/groups/browsers/epiphany | 2 +- apparmor.d/groups/browsers/firefox | 2 +- apparmor.d/groups/browsers/firefox-crashreporter | 2 +- apparmor.d/groups/browsers/firefox-glxtest | 2 +- apparmor.d/groups/browsers/firefox-kmozillahelper | 2 +- apparmor.d/groups/browsers/firefox-minidump-analyzer | 2 +- apparmor.d/groups/browsers/firefox-pingsender | 2 +- apparmor.d/groups/browsers/firefox-plugin-container | 2 +- apparmor.d/groups/browsers/firefox-vaapitest | 2 +- apparmor.d/groups/browsers/msedge | 2 +- apparmor.d/groups/browsers/msedge-crashpad-handler | 2 +- apparmor.d/groups/browsers/msedge-sandbox | 2 +- apparmor.d/groups/browsers/msedge-wrapper | 2 +- apparmor.d/groups/browsers/opera | 2 +- apparmor.d/groups/browsers/opera-crashreporter | 2 +- apparmor.d/groups/browsers/opera-sandbox | 2 +- apparmor.d/groups/browsers/torbrowser | 2 +- apparmor.d/groups/browsers/torbrowser-glxtest | 2 +- apparmor.d/groups/browsers/torbrowser-launcher | 2 +- apparmor.d/groups/browsers/torbrowser-plugin-container | 2 +- apparmor.d/groups/browsers/torbrowser-start | 2 +- apparmor.d/groups/browsers/torbrowser-tor | 2 +- apparmor.d/groups/browsers/torbrowser-updater | 2 +- apparmor.d/groups/browsers/torbrowser-vaapitest | 2 +- apparmor.d/groups/bus/at-spi2-registryd | 2 +- apparmor.d/groups/bus/dbus-accessibility | 2 +- apparmor.d/groups/bus/dbus-session | 2 +- apparmor.d/groups/bus/dbus-system | 2 +- apparmor.d/groups/bus/ibus-daemon | 2 +- apparmor.d/groups/bus/ibus-dconf | 2 +- apparmor.d/groups/bus/ibus-engine-simple | 2 +- apparmor.d/groups/bus/ibus-engine-table | 2 +- apparmor.d/groups/bus/ibus-extension-gtk3 | 2 +- apparmor.d/groups/bus/ibus-memconf | 2 +- apparmor.d/groups/bus/ibus-portal | 2 +- apparmor.d/groups/bus/ibus-x11 | 2 +- apparmor.d/groups/children/child-dpkg | 2 +- apparmor.d/groups/children/child-dpkg-divert | 2 +- apparmor.d/groups/children/child-modprobe-nvidia | 2 +- apparmor.d/groups/children/child-open | 2 +- apparmor.d/groups/children/child-open-any | 2 +- apparmor.d/groups/children/child-open-browsers | 2 +- apparmor.d/groups/children/child-open-help | 2 +- apparmor.d/groups/children/child-open-strict | 2 +- apparmor.d/groups/children/child-pager | 2 +- apparmor.d/groups/children/child-systemctl | 2 +- apparmor.d/groups/children/user_confined | 2 +- apparmor.d/groups/children/user_default | 2 +- apparmor.d/groups/children/user_unconfined | 2 +- apparmor.d/groups/cron/cron | 2 +- apparmor.d/groups/cron/cron-anacron | 2 +- apparmor.d/groups/cron/cron-apport | 2 +- apparmor.d/groups/cron/cron-apt | 2 +- apparmor.d/groups/cron/cron-apt-compat | 2 +- apparmor.d/groups/cron/cron-apt-listbugs | 2 +- apparmor.d/groups/cron/cron-apt-show-versions | 2 +- apparmor.d/groups/cron/cron-apt-xapian-index | 2 +- apparmor.d/groups/cron/cron-aptitude | 2 +- apparmor.d/groups/cron/cron-cracklib | 2 +- apparmor.d/groups/cron/cron-debsums | 2 +- apparmor.d/groups/cron/cron-debtags | 2 +- apparmor.d/groups/cron/cron-dlocate | 2 +- apparmor.d/groups/cron/cron-etckeeper | 2 +- apparmor.d/groups/cron/cron-exim4-base | 2 +- apparmor.d/groups/cron/cron-ipset-autoban-save | 2 +- apparmor.d/groups/cron/cron-logrotate | 2 +- apparmor.d/groups/cron/cron-man-db | 2 +- apparmor.d/groups/cron/cron-mlocate | 2 +- apparmor.d/groups/cron/cron-ntp | 2 +- apparmor.d/groups/cron/cron-plocate | 2 +- apparmor.d/groups/cron/cron-popularity-contest | 2 +- apparmor.d/groups/cron/cron-sysstat | 2 +- apparmor.d/groups/cron/crontab | 2 +- apparmor.d/groups/display-manager/lightdm | 2 +- apparmor.d/groups/display-manager/lightdm-gtk-greeter | 2 +- apparmor.d/groups/display-manager/lightdm-xsession | 2 +- apparmor.d/groups/display-manager/x11-xsession | 2 +- apparmor.d/groups/display-manager/xdm-xsession | 2 +- apparmor.d/groups/freedesktop/accounts-daemon | 2 +- apparmor.d/groups/freedesktop/colord | 2 +- apparmor.d/groups/freedesktop/colord-session | 2 +- apparmor.d/groups/freedesktop/cpupower | 2 +- apparmor.d/groups/freedesktop/dconf | 2 +- apparmor.d/groups/freedesktop/dconf-editor | 2 +- apparmor.d/groups/freedesktop/dconf-service | 2 +- apparmor.d/groups/freedesktop/desktop-file-install | 2 +- apparmor.d/groups/freedesktop/fc-cache | 2 +- apparmor.d/groups/freedesktop/fc-list | 2 +- apparmor.d/groups/freedesktop/geoclue | 2 +- apparmor.d/groups/freedesktop/iio-sensor-proxy | 2 +- apparmor.d/groups/freedesktop/pipewire | 2 +- apparmor.d/groups/freedesktop/pipewire-media-session | 2 +- apparmor.d/groups/freedesktop/pipewire-pulse | 2 +- apparmor.d/groups/freedesktop/plymouth | 2 +- apparmor.d/groups/freedesktop/plymouth-set-default-theme | 2 +- apparmor.d/groups/freedesktop/plymouthd | 2 +- apparmor.d/groups/freedesktop/polkit-agent-helper | 2 +- apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent | 2 +- apparmor.d/groups/freedesktop/polkit-kde-authentication-agent | 2 +- apparmor.d/groups/freedesktop/polkit-mate-authentication-agent | 2 +- apparmor.d/groups/freedesktop/polkitd | 2 +- apparmor.d/groups/freedesktop/pulseaudio | 2 +- apparmor.d/groups/freedesktop/update-desktop-database | 2 +- apparmor.d/groups/freedesktop/update-mime-database | 2 +- apparmor.d/groups/freedesktop/upower | 2 +- apparmor.d/groups/freedesktop/upowerd | 2 +- apparmor.d/groups/freedesktop/xdg-dbus-proxy | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-icon | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-menu | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal-kde | 2 +- .../groups/freedesktop/xdg-desktop-portal-rewrite-launchers | 2 +- apparmor.d/groups/freedesktop/xdg-document-portal | 2 +- apparmor.d/groups/freedesktop/xdg-email | 2 +- apparmor.d/groups/freedesktop/xdg-icon-resource | 2 +- apparmor.d/groups/freedesktop/xdg-mime | 2 +- apparmor.d/groups/freedesktop/xdg-open | 2 +- apparmor.d/groups/freedesktop/xdg-permission-store | 2 +- apparmor.d/groups/freedesktop/xdg-screensaver | 2 +- apparmor.d/groups/freedesktop/xdg-settings | 2 +- apparmor.d/groups/freedesktop/xdg-user-dir | 2 +- apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update | 2 +- apparmor.d/groups/freedesktop/xdg-user-dirs-update | 2 +- apparmor.d/groups/freedesktop/xhost | 2 +- apparmor.d/groups/freedesktop/xkbcomp | 2 +- apparmor.d/groups/freedesktop/xorg | 2 +- apparmor.d/groups/freedesktop/xprop | 2 +- apparmor.d/groups/freedesktop/xrandr | 2 +- apparmor.d/groups/freedesktop/xrdb | 2 +- apparmor.d/groups/freedesktop/xset | 2 +- apparmor.d/groups/freedesktop/xsetroot | 2 +- apparmor.d/groups/freedesktop/xwayland | 2 +- apparmor.d/groups/gnome/chrome-gnome-shell | 2 +- apparmor.d/groups/gnome/deja-dup-monitor | 2 +- apparmor.d/groups/gnome/epiphany-search-provider | 2 +- apparmor.d/groups/gnome/epiphany-webapp-provider | 2 +- apparmor.d/groups/gnome/evolution-addressbook-factory | 2 +- apparmor.d/groups/gnome/evolution-alarm-notify | 2 +- apparmor.d/groups/gnome/evolution-calendar-factory | 2 +- apparmor.d/groups/gnome/evolution-source-registry | 2 +- apparmor.d/groups/gnome/evolution-user-prompter | 2 +- apparmor.d/groups/gnome/gcr-prompter | 2 +- apparmor.d/groups/gnome/gcr-ssh-agent | 2 +- apparmor.d/groups/gnome/gdm | 2 +- apparmor.d/groups/gnome/gdm-generate-config | 2 +- apparmor.d/groups/gnome/gdm-prime-defaut | 2 +- apparmor.d/groups/gnome/gdm-runtime-config | 2 +- apparmor.d/groups/gnome/gdm-session | 2 +- apparmor.d/groups/gnome/gdm-session-worker | 2 +- apparmor.d/groups/gnome/gdm-xsession | 2 +- apparmor.d/groups/gnome/gio-launch-desktop | 2 +- apparmor.d/groups/gnome/gjs-console | 2 +- apparmor.d/groups/gnome/gkbd-keyboard-display | 2 +- apparmor.d/groups/gnome/gnome-boxes | 2 +- apparmor.d/groups/gnome/gnome-browser-connector-host | 2 +- apparmor.d/groups/gnome/gnome-calculator | 2 +- apparmor.d/groups/gnome/gnome-calculator-search-provider | 2 +- apparmor.d/groups/gnome/gnome-calendar | 2 +- apparmor.d/groups/gnome/gnome-characters | 2 +- apparmor.d/groups/gnome/gnome-characters-backgroudservice | 2 +- apparmor.d/groups/gnome/gnome-clocks | 2 +- apparmor.d/groups/gnome/gnome-contacts | 2 +- apparmor.d/groups/gnome/gnome-contacts-search-provider | 2 +- apparmor.d/groups/gnome/gnome-control-center | 2 +- apparmor.d/groups/gnome/gnome-control-center-goa-helper | 2 +- apparmor.d/groups/gnome/gnome-control-center-print-renderer | 2 +- apparmor.d/groups/gnome/gnome-control-center-search-provider | 2 +- apparmor.d/groups/gnome/gnome-desktop-thumbnailers | 2 +- apparmor.d/groups/gnome/gnome-disk-image-mounter | 2 +- apparmor.d/groups/gnome/gnome-disks | 2 +- apparmor.d/groups/gnome/gnome-extension-ding | 2 +- apparmor.d/groups/gnome/gnome-extension-gsconnect | 2 +- apparmor.d/groups/gnome/gnome-extension-manager | 2 +- apparmor.d/groups/gnome/gnome-extensions-app | 2 +- apparmor.d/groups/gnome/gnome-firmware | 2 +- apparmor.d/groups/gnome/gnome-font-viewer | 2 +- apparmor.d/groups/gnome/gnome-initial-setup | 2 +- apparmor.d/groups/gnome/gnome-keyring-daemon | 2 +- apparmor.d/groups/gnome/gnome-logs | 2 +- apparmor.d/groups/gnome/gnome-maps | 2 +- apparmor.d/groups/gnome/gnome-music | 2 +- apparmor.d/groups/gnome/gnome-photos-thumbnailer | 2 +- apparmor.d/groups/gnome/gnome-recipes | 2 +- apparmor.d/groups/gnome/gnome-remote-desktop-daemon | 2 +- apparmor.d/groups/gnome/gnome-session | 2 +- apparmor.d/groups/gnome/gnome-session-binary | 2 +- apparmor.d/groups/gnome/gnome-session-ctl | 2 +- apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/gnome/gnome-shell-calendar-server | 2 +- apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer | 2 +- apparmor.d/groups/gnome/gnome-shell-overrides-migration | 2 +- apparmor.d/groups/gnome/gnome-software | 2 +- apparmor.d/groups/gnome/gnome-system-monitor | 2 +- apparmor.d/groups/gnome/gnome-terminal-server | 2 +- apparmor.d/groups/gnome/gnome-text-editor | 2 +- apparmor.d/groups/gnome/gnome-tour | 2 +- apparmor.d/groups/gnome/gnome-tweaks | 2 +- apparmor.d/groups/gnome/gnome-user-share-webdav | 2 +- apparmor.d/groups/gnome/gnome-weather | 2 +- apparmor.d/groups/gnome/goa-daemon | 2 +- apparmor.d/groups/gnome/goa-identity-service | 2 +- apparmor.d/groups/gnome/gsd-a11y-settings | 2 +- apparmor.d/groups/gnome/gsd-color | 2 +- apparmor.d/groups/gnome/gsd-datetime | 2 +- apparmor.d/groups/gnome/gsd-disk-utility-notify | 2 +- apparmor.d/groups/gnome/gsd-housekeeping | 2 +- apparmor.d/groups/gnome/gsd-keyboard | 2 +- apparmor.d/groups/gnome/gsd-media-keys | 2 +- apparmor.d/groups/gnome/gsd-power | 2 +- apparmor.d/groups/gnome/gsd-print-notifications | 2 +- apparmor.d/groups/gnome/gsd-printer | 2 +- apparmor.d/groups/gnome/gsd-rfkill | 2 +- apparmor.d/groups/gnome/gsd-screensaver-proxy | 2 +- apparmor.d/groups/gnome/gsd-sharing | 2 +- apparmor.d/groups/gnome/gsd-smartcard | 2 +- apparmor.d/groups/gnome/gsd-sound | 2 +- apparmor.d/groups/gnome/gsd-usb-protection | 2 +- apparmor.d/groups/gnome/gsd-wacom | 2 +- apparmor.d/groups/gnome/gsd-wwan | 2 +- apparmor.d/groups/gnome/gsd-xsettings | 2 +- apparmor.d/groups/gnome/kgx | 2 +- apparmor.d/groups/gnome/loupe | 2 +- apparmor.d/groups/gnome/mutter-x11-frames | 2 +- apparmor.d/groups/gnome/nautilus | 2 +- apparmor.d/groups/gnome/org.gnome.NautilusPreviewer | 2 +- apparmor.d/groups/gnome/seahorse | 2 +- apparmor.d/groups/gnome/session-migration | 2 +- apparmor.d/groups/gnome/tracker-extract | 2 +- apparmor.d/groups/gnome/tracker-miner | 2 +- apparmor.d/groups/gnome/tracker-writeback | 2 +- apparmor.d/groups/gnome/tracker-xdg-portal | 2 +- apparmor.d/groups/gnome/yelp | 2 +- apparmor.d/groups/gpg/dirmngr | 2 +- apparmor.d/groups/gpg/gpg | 2 +- apparmor.d/groups/gpg/gpg-agent | 2 +- apparmor.d/groups/gpg/gpg-connect-agent | 2 +- apparmor.d/groups/gpg/gpgconf | 2 +- apparmor.d/groups/gpg/gpgsm | 2 +- apparmor.d/groups/gpg/keyboxd | 2 +- apparmor.d/groups/gpg/scdaemon | 2 +- apparmor.d/groups/grub/grub-bios-setup | 2 +- apparmor.d/groups/grub/grub-check-signatures | 2 +- apparmor.d/groups/grub/grub-editenv | 2 +- apparmor.d/groups/grub/grub-file | 2 +- apparmor.d/groups/grub/grub-fstest | 2 +- apparmor.d/groups/grub/grub-glue-efi | 2 +- apparmor.d/groups/grub/grub-install | 2 +- apparmor.d/groups/grub/grub-kbdcomp | 2 +- apparmor.d/groups/grub/grub-macbless | 2 +- apparmor.d/groups/grub/grub-menulst2cfg | 2 +- apparmor.d/groups/grub/grub-mkconfig | 2 +- apparmor.d/groups/grub/grub-mkdevicemap | 2 +- apparmor.d/groups/grub/grub-mkfont | 2 +- apparmor.d/groups/grub/grub-mkimage | 2 +- apparmor.d/groups/grub/grub-mklayout | 2 +- apparmor.d/groups/grub/grub-mknetdir | 2 +- apparmor.d/groups/grub/grub-mkpasswd-pbkdf2 | 2 +- apparmor.d/groups/grub/grub-mkrelpath | 2 +- apparmor.d/groups/grub/grub-mkrescue | 2 +- apparmor.d/groups/grub/grub-mkstandalone | 2 +- apparmor.d/groups/grub/grub-mount | 2 +- apparmor.d/groups/grub/grub-multi-install | 2 +- apparmor.d/groups/grub/grub-ntldr-img | 2 +- apparmor.d/groups/grub/grub-probe | 2 +- apparmor.d/groups/grub/grub-reboot | 2 +- apparmor.d/groups/grub/grub-render-label | 2 +- apparmor.d/groups/grub/grub-script-check | 2 +- apparmor.d/groups/grub/grub-set-default | 2 +- apparmor.d/groups/grub/grub-sort-version | 2 +- apparmor.d/groups/grub/grub-syslinux2cfg | 2 +- apparmor.d/groups/grub/update-grub | 2 +- apparmor.d/groups/gvfs/gvfs-afc-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-goa-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfsd | 2 +- apparmor.d/groups/gvfs/gvfsd-admin | 2 +- apparmor.d/groups/gvfs/gvfsd-afc | 2 +- apparmor.d/groups/gvfs/gvfsd-afp | 2 +- apparmor.d/groups/gvfs/gvfsd-afp-browse | 2 +- apparmor.d/groups/gvfs/gvfsd-archive | 2 +- apparmor.d/groups/gvfs/gvfsd-burn | 2 +- apparmor.d/groups/gvfs/gvfsd-cdda | 2 +- apparmor.d/groups/gvfs/gvfsd-computer | 2 +- apparmor.d/groups/gvfs/gvfsd-dav | 2 +- apparmor.d/groups/gvfs/gvfsd-dnssd | 2 +- apparmor.d/groups/gvfs/gvfsd-ftp | 2 +- apparmor.d/groups/gvfs/gvfsd-fuse | 2 +- apparmor.d/groups/gvfs/gvfsd-google | 2 +- apparmor.d/groups/gvfs/gvfsd-gphoto2 | 2 +- apparmor.d/groups/gvfs/gvfsd-http | 2 +- apparmor.d/groups/gvfs/gvfsd-localtest | 2 +- apparmor.d/groups/gvfs/gvfsd-metadata | 2 +- apparmor.d/groups/gvfs/gvfsd-mtp | 2 +- apparmor.d/groups/gvfs/gvfsd-network | 2 +- apparmor.d/groups/gvfs/gvfsd-nfs | 2 +- apparmor.d/groups/gvfs/gvfsd-recent | 2 +- apparmor.d/groups/gvfs/gvfsd-sftp | 2 +- apparmor.d/groups/gvfs/gvfsd-smb | 2 +- apparmor.d/groups/gvfs/gvfsd-smb-browse | 2 +- apparmor.d/groups/gvfs/gvfsd-trash | 2 +- apparmor.d/groups/gvfs/gvfsd-wsdd | 2 +- apparmor.d/groups/hyprland/hyprctl | 2 +- apparmor.d/groups/hyprland/hyprland | 2 +- apparmor.d/groups/hyprland/hyprlock | 2 +- apparmor.d/groups/hyprland/hyprpaper | 2 +- apparmor.d/groups/hyprland/hyprpicker | 2 +- apparmor.d/groups/hyprland/hyprpm | 2 +- apparmor.d/groups/kde/DiscoverNotifier | 2 +- apparmor.d/groups/kde/baloo | 2 +- apparmor.d/groups/kde/baloorunner | 2 +- apparmor.d/groups/kde/dolphin | 2 +- apparmor.d/groups/kde/drkonqi | 2 +- apparmor.d/groups/kde/drkonqi-coredump-cleanup | 2 +- apparmor.d/groups/kde/drkonqi-coredump-processor | 2 +- apparmor.d/groups/kde/gmenudbusmenuproxy | 2 +- apparmor.d/groups/kde/kaccess | 2 +- apparmor.d/groups/kde/kactivitymanagerd | 2 +- apparmor.d/groups/kde/kalendarac | 2 +- apparmor.d/groups/kde/kauth-backlighthelper | 2 +- apparmor.d/groups/kde/kauth-chargethresholdhelper | 2 +- apparmor.d/groups/kde/kauth-discretegpuhelper | 2 +- apparmor.d/groups/kde/kauth-fontinst | 2 +- apparmor.d/groups/kde/kauth-kded-smart-helper | 2 +- apparmor.d/groups/kde/kauth-kinfocenter-dmidecode-helper | 2 +- apparmor.d/groups/kde/kbuildsycoca | 2 +- apparmor.d/groups/kde/kcminit | 2 +- apparmor.d/groups/kde/kconf_update | 2 +- apparmor.d/groups/kde/kde-powerdevil | 2 +- apparmor.d/groups/kde/kde-systemd-start-condition | 2 +- apparmor.d/groups/kde/kded | 2 +- apparmor.d/groups/kde/kglobalacceld | 2 +- apparmor.d/groups/kde/kio_http_cache_cleaner | 2 +- apparmor.d/groups/kde/kiod | 2 +- apparmor.d/groups/kde/kioworker | 2 +- apparmor.d/groups/kde/konsole | 2 +- apparmor.d/groups/kde/kreadconfig | 2 +- apparmor.d/groups/kde/kscreen_backend_launcher | 2 +- apparmor.d/groups/kde/kscreen_osd_service | 2 +- apparmor.d/groups/kde/kscreenlocker_greet | 2 +- apparmor.d/groups/kde/ksmserver | 2 +- apparmor.d/groups/kde/ksmserver-logout-greeter | 2 +- apparmor.d/groups/kde/ksplashqml | 2 +- apparmor.d/groups/kde/kstart | 2 +- apparmor.d/groups/kde/kwalletd | 2 +- apparmor.d/groups/kde/kwalletmanager | 2 +- apparmor.d/groups/kde/kwin_wayland | 2 +- apparmor.d/groups/kde/kwin_wayland_wrapper | 2 +- apparmor.d/groups/kde/kwin_x11 | 2 +- apparmor.d/groups/kde/okular | 2 +- apparmor.d/groups/kde/pam_kwallet_init | 2 +- apparmor.d/groups/kde/plasma-browser-integration-host | 2 +- apparmor.d/groups/kde/plasma-discover | 2 +- apparmor.d/groups/kde/plasma-emojier | 2 +- apparmor.d/groups/kde/plasma_session | 2 +- apparmor.d/groups/kde/plasma_waitforname | 2 +- apparmor.d/groups/kde/plasmashell | 2 +- apparmor.d/groups/kde/sddm | 2 +- apparmor.d/groups/kde/sddm-greeter | 2 +- apparmor.d/groups/kde/sddm-xsession | 2 +- apparmor.d/groups/kde/startplasma | 2 +- apparmor.d/groups/kde/systemsettings | 2 +- apparmor.d/groups/kde/utempter | 2 +- apparmor.d/groups/kde/wayland-session | 2 +- apparmor.d/groups/kde/xembedsniproxy | 2 +- apparmor.d/groups/kde/xsettingsd | 2 +- apparmor.d/groups/kde/xwaylandvideobridge | 2 +- apparmor.d/groups/network/ModemManager | 2 +- apparmor.d/groups/network/NetworkManager | 2 +- apparmor.d/groups/network/dhcpcd | 2 +- apparmor.d/groups/network/iwctl | 2 +- apparmor.d/groups/network/iwd | 2 +- apparmor.d/groups/network/mullvad-daemon | 2 +- apparmor.d/groups/network/mullvad-gui | 2 +- apparmor.d/groups/network/netplan.script | 2 +- apparmor.d/groups/network/networkd-dispatcher | 2 +- apparmor.d/groups/network/nm-daemon-helper | 2 +- apparmor.d/groups/network/nm-dhcp-helper | 2 +- apparmor.d/groups/network/nm-dispatcher | 2 +- apparmor.d/groups/network/nm-iface-helper | 2 +- apparmor.d/groups/network/nm-initrd-generator | 2 +- apparmor.d/groups/network/nm-online | 2 +- apparmor.d/groups/network/nm-openvpn-auth-dialog | 2 +- apparmor.d/groups/network/nm-openvpn-service | 2 +- apparmor.d/groups/network/nm-openvpn-service-openvpn-helper | 2 +- apparmor.d/groups/network/nm-priv-helper | 2 +- apparmor.d/groups/network/nmcli | 2 +- apparmor.d/groups/network/openvpn | 2 +- apparmor.d/groups/network/rpcbind | 2 +- apparmor.d/groups/network/socat | 2 +- apparmor.d/groups/network/tailscale | 2 +- apparmor.d/groups/network/tailscaled | 2 +- apparmor.d/groups/network/wg | 2 +- apparmor.d/groups/network/wg-quick | 2 +- apparmor.d/groups/pacman/arch-audit | 2 +- apparmor.d/groups/pacman/archlinux-java | 2 +- apparmor.d/groups/pacman/archlinux-keyring-wkd-sync | 2 +- apparmor.d/groups/pacman/aurpublish | 2 +- apparmor.d/groups/pacman/makepkg | 2 +- apparmor.d/groups/pacman/mkinitcpio | 2 +- apparmor.d/groups/pacman/paccache | 2 +- apparmor.d/groups/pacman/pacdiff | 2 +- apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/groups/pacman/pacman-conf | 2 +- apparmor.d/groups/pacman/pacman-hook-code | 2 +- apparmor.d/groups/pacman/pacman-hook-dconf | 2 +- apparmor.d/groups/pacman/pacman-hook-depmod | 2 +- apparmor.d/groups/pacman/pacman-hook-dkms | 2 +- apparmor.d/groups/pacman/pacman-hook-fontconfig | 2 +- apparmor.d/groups/pacman/pacman-hook-gio | 2 +- apparmor.d/groups/pacman/pacman-hook-gtk | 2 +- apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules | 2 +- apparmor.d/groups/pacman/pacman-hook-mkinitcpio | 2 +- apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove | 2 +- apparmor.d/groups/pacman/pacman-hook-perl | 2 +- apparmor.d/groups/pacman/pacman-hook-systemd | 2 +- apparmor.d/groups/pacman/pacman-key | 2 +- apparmor.d/groups/pacman/reflector | 2 +- apparmor.d/groups/pacman/yay | 2 +- apparmor.d/groups/ssh/sftp-server | 2 +- apparmor.d/groups/ssh/ssh | 2 +- apparmor.d/groups/ssh/ssh-agent | 2 +- apparmor.d/groups/ssh/ssh-agent-launch | 2 +- apparmor.d/groups/ssh/ssh-keygen | 2 +- apparmor.d/groups/ssh/sshd | 2 +- apparmor.d/groups/ssh/sshfs | 2 +- apparmor.d/groups/systemd/bootctl | 2 +- apparmor.d/groups/systemd/busctl | 2 +- apparmor.d/groups/systemd/coredumpctl | 2 +- apparmor.d/groups/systemd/hostnamectl | 2 +- apparmor.d/groups/systemd/journalctl | 2 +- apparmor.d/groups/systemd/localectl | 2 +- apparmor.d/groups/systemd/loginctl | 2 +- apparmor.d/groups/systemd/networkctl | 2 +- apparmor.d/groups/systemd/systemd-ac-power | 2 +- apparmor.d/groups/systemd/systemd-analyze | 2 +- apparmor.d/groups/systemd/systemd-ask-password | 2 +- apparmor.d/groups/systemd/systemd-backlight | 2 +- apparmor.d/groups/systemd/systemd-binfmt | 2 +- apparmor.d/groups/systemd/systemd-cat | 2 +- apparmor.d/groups/systemd/systemd-cgls | 2 +- apparmor.d/groups/systemd/systemd-cgtop | 2 +- apparmor.d/groups/systemd/systemd-coredump | 2 +- apparmor.d/groups/systemd/systemd-cryptsetup | 2 +- apparmor.d/groups/systemd/systemd-delta | 2 +- apparmor.d/groups/systemd/systemd-detect-virt | 2 +- apparmor.d/groups/systemd/systemd-dissect | 2 +- apparmor.d/groups/systemd/systemd-escape | 2 +- apparmor.d/groups/systemd/systemd-fsck | 2 +- apparmor.d/groups/systemd/systemd-fsckd | 2 +- apparmor.d/groups/systemd/systemd-generator-bless-boot | 2 +- apparmor.d/groups/systemd/systemd-generator-cloud-init | 2 +- apparmor.d/groups/systemd/systemd-generator-cryptsetup | 2 +- apparmor.d/groups/systemd/systemd-generator-debug | 2 +- apparmor.d/groups/systemd/systemd-generator-ds-identify | 2 +- apparmor.d/groups/systemd/systemd-generator-environment-arch | 2 +- apparmor.d/groups/systemd/systemd-generator-environment-flatpak | 2 +- apparmor.d/groups/systemd/systemd-generator-fstab | 2 +- apparmor.d/groups/systemd/systemd-generator-getty | 2 +- apparmor.d/groups/systemd/systemd-generator-gpt-auto | 2 +- apparmor.d/groups/systemd/systemd-generator-hibernate-resume | 2 +- apparmor.d/groups/systemd/systemd-generator-integritysetup | 2 +- apparmor.d/groups/systemd/systemd-generator-ostree | 2 +- apparmor.d/groups/systemd/systemd-generator-run | 2 +- apparmor.d/groups/systemd/systemd-generator-system-update | 2 +- apparmor.d/groups/systemd/systemd-generator-user-autostart | 2 +- apparmor.d/groups/systemd/systemd-generator-user-environment | 2 +- apparmor.d/groups/systemd/systemd-generator-veritysetup | 2 +- apparmor.d/groups/systemd/systemd-homed | 2 +- apparmor.d/groups/systemd/systemd-homework | 2 +- apparmor.d/groups/systemd/systemd-hostnamed | 2 +- apparmor.d/groups/systemd/systemd-hwdb | 2 +- apparmor.d/groups/systemd/systemd-id128 | 2 +- apparmor.d/groups/systemd/systemd-inhibit | 2 +- apparmor.d/groups/systemd/systemd-journald | 2 +- apparmor.d/groups/systemd/systemd-localed | 2 +- apparmor.d/groups/systemd/systemd-logind | 2 +- apparmor.d/groups/systemd/systemd-machine-id-setup | 2 +- apparmor.d/groups/systemd/systemd-machined | 2 +- apparmor.d/groups/systemd/systemd-makefs | 2 +- apparmor.d/groups/systemd/systemd-modules-load | 2 +- apparmor.d/groups/systemd/systemd-mount | 2 +- apparmor.d/groups/systemd/systemd-network-generator | 2 +- apparmor.d/groups/systemd/systemd-networkd | 2 +- apparmor.d/groups/systemd/systemd-networkd-wait-online | 2 +- apparmor.d/groups/systemd/systemd-notify | 2 +- apparmor.d/groups/systemd/systemd-oomd | 2 +- apparmor.d/groups/systemd/systemd-path | 2 +- apparmor.d/groups/systemd/systemd-portabled | 2 +- apparmor.d/groups/systemd/systemd-random-seed | 2 +- apparmor.d/groups/systemd/systemd-remount-fs | 2 +- apparmor.d/groups/systemd/systemd-resolve | 2 +- apparmor.d/groups/systemd/systemd-resolved | 2 +- apparmor.d/groups/systemd/systemd-rfkill | 2 +- apparmor.d/groups/systemd/systemd-shutdown | 2 +- apparmor.d/groups/systemd/systemd-sleep | 2 +- apparmor.d/groups/systemd/systemd-sleep-grub2 | 2 +- apparmor.d/groups/systemd/systemd-sleep-hdparm | 2 +- apparmor.d/groups/systemd/systemd-sleep-nvidia | 2 +- apparmor.d/groups/systemd/systemd-sleep-sysstat | 2 +- apparmor.d/groups/systemd/systemd-sleep-tlp | 2 +- apparmor.d/groups/systemd/systemd-sleep-upgrades | 2 +- apparmor.d/groups/systemd/systemd-socket-proxyd | 2 +- apparmor.d/groups/systemd/systemd-sulogin-shell | 2 +- apparmor.d/groups/systemd/systemd-sysctl | 2 +- apparmor.d/groups/systemd/systemd-sysusers | 2 +- apparmor.d/groups/systemd/systemd-timedated | 2 +- apparmor.d/groups/systemd/systemd-timesyncd | 2 +- apparmor.d/groups/systemd/systemd-tmpfiles | 2 +- apparmor.d/groups/systemd/systemd-tty-ask-password-agent | 2 +- apparmor.d/groups/systemd/systemd-udevd | 2 +- apparmor.d/groups/systemd/systemd-update-done | 2 +- apparmor.d/groups/systemd/systemd-update-utmp | 2 +- apparmor.d/groups/systemd/systemd-user-runtime-dir | 2 +- apparmor.d/groups/systemd/systemd-user-sessions | 2 +- apparmor.d/groups/systemd/systemd-userdbd | 2 +- apparmor.d/groups/systemd/systemd-userwork | 2 +- apparmor.d/groups/systemd/systemd-vconsole-setup | 2 +- apparmor.d/groups/systemd/userdbctl | 2 +- apparmor.d/groups/systemd/zram-generator | 2 +- apparmor.d/groups/systemd/zramctl | 2 +- apparmor.d/groups/ubuntu/apport | 2 +- apparmor.d/groups/ubuntu/apport-checkreports | 2 +- apparmor.d/groups/ubuntu/apport-gtk | 2 +- apparmor.d/groups/ubuntu/apt-esm-hook | 2 +- apparmor.d/groups/ubuntu/apt-esm-json-hook | 2 +- apparmor.d/groups/ubuntu/check-new-release-gtk | 2 +- apparmor.d/groups/ubuntu/cron-ubuntu-fan | 2 +- apparmor.d/groups/ubuntu/do-release-upgrade | 2 +- apparmor.d/groups/ubuntu/hwe-support-status | 2 +- apparmor.d/groups/ubuntu/list-oem-metapackages | 2 +- apparmor.d/groups/ubuntu/livepatch-notification | 2 +- apparmor.d/groups/ubuntu/notify-reboot-required | 2 +- apparmor.d/groups/ubuntu/notify-updates-outdated | 2 +- apparmor.d/groups/ubuntu/package-data-downloader | 2 +- apparmor.d/groups/ubuntu/package-system-locked | 2 +- apparmor.d/groups/ubuntu/release-upgrade-motd | 2 +- apparmor.d/groups/ubuntu/software-properties-dbus | 2 +- apparmor.d/groups/ubuntu/software-properties-gtk | 2 +- apparmor.d/groups/ubuntu/subiquity-console-conf | 2 +- apparmor.d/groups/ubuntu/ubuntu-advantage | 2 +- apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon | 2 +- apparmor.d/groups/ubuntu/ubuntu-advantage-notification | 2 +- apparmor.d/groups/ubuntu/ubuntu-distro-info | 2 +- apparmor.d/groups/ubuntu/ubuntu-report | 2 +- apparmor.d/groups/ubuntu/update-manager | 2 +- apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot | 2 +- apparmor.d/groups/ubuntu/update-motd-updates-available | 2 +- apparmor.d/groups/ubuntu/update-notifier | 2 +- apparmor.d/groups/virt/cni-bandwidth | 2 +- apparmor.d/groups/virt/cni-bridge | 2 +- apparmor.d/groups/virt/cni-calico | 2 +- apparmor.d/groups/virt/cni-firewall | 2 +- apparmor.d/groups/virt/cni-flannel | 2 +- apparmor.d/groups/virt/cni-host-local | 2 +- apparmor.d/groups/virt/cni-loopback | 2 +- apparmor.d/groups/virt/cni-portmap | 2 +- apparmor.d/groups/virt/cni-tuning | 2 +- apparmor.d/groups/virt/cockpit-askpass | 2 +- apparmor.d/groups/virt/cockpit-bridge | 2 +- apparmor.d/groups/virt/cockpit-certificate-ensure | 2 +- apparmor.d/groups/virt/cockpit-certificate-helper | 2 +- apparmor.d/groups/virt/cockpit-desktop | 2 +- apparmor.d/groups/virt/cockpit-pcp | 2 +- apparmor.d/groups/virt/cockpit-session | 2 +- apparmor.d/groups/virt/cockpit-ssh | 2 +- apparmor.d/groups/virt/cockpit-tls | 2 +- apparmor.d/groups/virt/cockpit-update-motd | 2 +- apparmor.d/groups/virt/cockpit-ws | 2 +- apparmor.d/groups/virt/cockpit-wsinstance-factory | 2 +- apparmor.d/groups/virt/containerd | 2 +- apparmor.d/groups/virt/containerd-shim-runc-v2 | 2 +- apparmor.d/groups/virt/docker-proxy | 2 +- apparmor.d/groups/virt/dockerd | 2 +- apparmor.d/groups/virt/k3s | 2 +- apparmor.d/groups/virt/kubernetes-pause | 2 +- apparmor.d/groups/virt/libvirt-dbus | 2 +- apparmor.d/groups/virt/libvirtd | 2 +- apparmor.d/groups/virt/qemu-bridge-helper | 2 +- apparmor.d/groups/virt/virt-aa-helper | 2 +- apparmor.d/groups/virt/virtinterfaced | 2 +- apparmor.d/groups/virt/virtiofsd | 2 +- apparmor.d/groups/virt/virtlockd | 2 +- apparmor.d/groups/virt/virtlogd | 2 +- apparmor.d/groups/virt/virtnetworkd | 2 +- apparmor.d/groups/virt/virtnodedevd | 2 +- apparmor.d/groups/virt/virtsecretd | 2 +- apparmor.d/groups/virt/virtstoraged | 2 +- apparmor.d/groups/virt/xtables | 2 +- apparmor.d/groups/whonix/anondate | 2 +- apparmor.d/groups/whonix/msgcollector | 2 +- apparmor.d/groups/whonix/msgcollector-br-add | 2 +- apparmor.d/groups/whonix/msgcollector-generic-gui-message | 2 +- apparmor.d/groups/whonix/msgcollector-striphtml | 2 +- apparmor.d/groups/whonix/msgdispatcher | 2 +- apparmor.d/groups/whonix/msgdispatcher-autostart | 2 +- apparmor.d/groups/whonix/msgdispatcher-delete | 2 +- apparmor.d/groups/whonix/msgdispatcher-dispatch | 2 +- apparmor.d/groups/whonix/open-link-confirmation | 2 +- apparmor.d/groups/whonix/pam-abort-on-locked-password | 2 +- apparmor.d/groups/whonix/pam-info | 2 +- apparmor.d/groups/whonix/pam_faillock_not_if_x | 2 +- apparmor.d/groups/whonix/rads | 2 +- apparmor.d/groups/whonix/sdwdate | 2 +- apparmor.d/groups/whonix/sdwdate-clock-jump | 2 +- apparmor.d/groups/whonix/sdwdate-gui | 2 +- apparmor.d/groups/whonix/sdwdate-start | 2 +- apparmor.d/groups/whonix/sdwdate-wrapper | 2 +- apparmor.d/groups/whonix/sensible-browser | 2 +- apparmor.d/groups/whonix/systemcheck-canary | 2 +- apparmor.d/groups/whonix/timesanitycheck | 2 +- apparmor.d/groups/whonix/tor-bootstrap-check | 2 +- apparmor.d/groups/whonix/tor-consensus-valid-after | 2 +- apparmor.d/groups/whonix/torbrowser-updater-permission-fix | 2 +- apparmor.d/groups/whonix/torbrowser-wrapper | 2 +- apparmor.d/groups/whonix/whonix-firewall-edit | 2 +- apparmor.d/groups/whonix/whonix-firewall-restarter | 2 +- apparmor.d/groups/whonix/whonix-firewalld | 2 +- apparmor.d/groups/xfce/mousepad | 2 +- apparmor.d/groups/xfce/ristretto | 2 +- apparmor.d/groups/xfce/startxfce | 2 +- apparmor.d/groups/xfce/thunar | 2 +- apparmor.d/groups/xfce/thunar-volman | 2 +- apparmor.d/groups/xfce/tumblerd | 2 +- apparmor.d/groups/xfce/xfce-about | 2 +- apparmor.d/groups/xfce/xfce-appfinder | 2 +- apparmor.d/groups/xfce/xfce-clipman-settings | 2 +- apparmor.d/groups/xfce/xfce-dict | 2 +- apparmor.d/groups/xfce/xfce-mime-helper | 2 +- apparmor.d/groups/xfce/xfce-notifyd | 2 +- apparmor.d/groups/xfce/xfce-panel | 2 +- apparmor.d/groups/xfce/xfce-power-manager | 2 +- apparmor.d/groups/xfce/xfce-screensaver | 2 +- apparmor.d/groups/xfce/xfce-sensors | 2 +- apparmor.d/groups/xfce/xfce-session | 2 +- apparmor.d/groups/xfce/xfce-terminal | 2 +- apparmor.d/groups/xfce/xfconfd | 2 +- apparmor.d/groups/xfce/xfdesktop | 2 +- apparmor.d/groups/xfce/xfpm-power-backlight-helper | 2 +- apparmor.d/groups/xfce/xfsettingsd | 2 +- apparmor.d/groups/xfce/xfwm | 2 +- apparmor.d/profiles-a-f/aa-enabled | 2 +- apparmor.d/profiles-a-f/aa-enforce | 2 +- apparmor.d/profiles-a-f/aa-log | 2 +- apparmor.d/profiles-a-f/aa-notify | 2 +- apparmor.d/profiles-a-f/aa-status | 2 +- apparmor.d/profiles-a-f/aa-teardown | 2 +- apparmor.d/profiles-a-f/aa-unconfined | 2 +- apparmor.d/profiles-a-f/abook | 2 +- apparmor.d/profiles-a-f/acpi | 2 +- apparmor.d/profiles-a-f/acpi-powerbtn | 2 +- apparmor.d/profiles-a-f/acpid | 2 +- apparmor.d/profiles-a-f/adb | 2 +- apparmor.d/profiles-a-f/adduser | 2 +- apparmor.d/profiles-a-f/adequate | 2 +- apparmor.d/profiles-a-f/agetty | 2 +- apparmor.d/profiles-a-f/alacarte | 2 +- apparmor.d/profiles-a-f/alsactl | 2 +- apparmor.d/profiles-a-f/amixer | 2 +- apparmor.d/profiles-a-f/anacron | 2 +- apparmor.d/profiles-a-f/anyremote | 2 +- apparmor.d/profiles-a-f/aplay | 2 +- apparmor.d/profiles-a-f/apparmor.systemd | 2 +- apparmor.d/profiles-a-f/apparmor_parser | 2 +- apparmor.d/profiles-a-f/appstreamcli | 2 +- apparmor.d/profiles-a-f/arandr | 2 +- apparmor.d/profiles-a-f/archivemount | 2 +- apparmor.d/profiles-a-f/arduino | 2 +- apparmor.d/profiles-a-f/arduino-builder | 2 +- apparmor.d/profiles-a-f/arduino-ctags | 2 +- apparmor.d/profiles-a-f/aspell | 2 +- apparmor.d/profiles-a-f/aspell-autobuildhash | 2 +- apparmor.d/profiles-a-f/at | 2 +- apparmor.d/profiles-a-f/atd | 2 +- apparmor.d/profiles-a-f/atftpd | 2 +- apparmor.d/profiles-a-f/atool | 2 +- apparmor.d/profiles-a-f/atril | 2 +- apparmor.d/profiles-a-f/atrild | 2 +- apparmor.d/profiles-a-f/auditctl | 2 +- apparmor.d/profiles-a-f/auditd | 2 +- apparmor.d/profiles-a-f/augenrules | 2 +- apparmor.d/profiles-a-f/badblocks | 2 +- apparmor.d/profiles-a-f/baobab | 2 +- apparmor.d/profiles-a-f/biosdecode | 2 +- apparmor.d/profiles-a-f/birdtray | 2 +- apparmor.d/profiles-a-f/blkdeactivate | 2 +- apparmor.d/profiles-a-f/blkid | 2 +- apparmor.d/profiles-a-f/blockdev | 2 +- apparmor.d/profiles-a-f/blueman | 2 +- apparmor.d/profiles-a-f/blueman-mechanism | 2 +- apparmor.d/profiles-a-f/blueman-rfcomm-watcher | 2 +- apparmor.d/profiles-a-f/bluemoon | 2 +- apparmor.d/profiles-a-f/bluetoothctl | 2 +- apparmor.d/profiles-a-f/bluetoothd | 2 +- apparmor.d/profiles-a-f/bmon | 2 +- apparmor.d/profiles-a-f/boltd | 2 +- apparmor.d/profiles-a-f/borg | 2 +- apparmor.d/profiles-a-f/browserpass | 2 +- apparmor.d/profiles-a-f/btop | 2 +- apparmor.d/profiles-a-f/btrfs | 2 +- apparmor.d/profiles-a-f/btrfs-convert | 2 +- apparmor.d/profiles-a-f/btrfs-find-root | 2 +- apparmor.d/profiles-a-f/btrfs-image | 2 +- apparmor.d/profiles-a-f/btrfs-map-logical | 2 +- apparmor.d/profiles-a-f/btrfs-select-super | 2 +- apparmor.d/profiles-a-f/btrfstune | 2 +- apparmor.d/profiles-a-f/calibre | 2 +- apparmor.d/profiles-a-f/cawbird | 2 +- apparmor.d/profiles-a-f/cc-remote-login-helper | 2 +- apparmor.d/profiles-a-f/cctk | 2 +- apparmor.d/profiles-a-f/ccze | 2 +- apparmor.d/profiles-a-f/cemu | 2 +- apparmor.d/profiles-a-f/cert-sync | 2 +- apparmor.d/profiles-a-f/cfdisk | 2 +- apparmor.d/profiles-a-f/cgdisk | 2 +- apparmor.d/profiles-a-f/cgrulesengd | 2 +- apparmor.d/profiles-a-f/chage | 2 +- apparmor.d/profiles-a-f/changestool | 2 +- apparmor.d/profiles-a-f/check-bios-nx | 2 +- apparmor.d/profiles-a-f/check-support-status | 2 +- apparmor.d/profiles-a-f/check-support-status-hook | 2 +- apparmor.d/profiles-a-f/chfn | 2 +- apparmor.d/profiles-a-f/chronyd | 2 +- apparmor.d/profiles-a-f/chsh | 2 +- apparmor.d/profiles-a-f/claws-mail | 2 +- apparmor.d/profiles-a-f/cmus | 2 +- apparmor.d/profiles-a-f/code-extension-git-askpass | 2 +- apparmor.d/profiles-a-f/code-extension-git-editor | 2 +- apparmor.d/profiles-a-f/compton | 2 +- apparmor.d/profiles-a-f/conky | 2 +- apparmor.d/profiles-a-f/console-setup | 2 +- apparmor.d/profiles-a-f/convertall | 2 +- apparmor.d/profiles-a-f/cppw-cpgr | 2 +- apparmor.d/profiles-a-f/cpuid | 2 +- apparmor.d/profiles-a-f/cracklib-packer | 2 +- apparmor.d/profiles-a-f/crda | 2 +- apparmor.d/profiles-a-f/cups-backend-beh | 2 +- apparmor.d/profiles-a-f/cups-backend-bluetooth | 2 +- apparmor.d/profiles-a-f/cups-backend-brf | 2 +- apparmor.d/profiles-a-f/cups-backend-dnssd | 2 +- apparmor.d/profiles-a-f/cups-backend-hp | 2 +- apparmor.d/profiles-a-f/cups-backend-implicitclass | 2 +- apparmor.d/profiles-a-f/cups-backend-ipp | 2 +- apparmor.d/profiles-a-f/cups-backend-lpd | 2 +- apparmor.d/profiles-a-f/cups-backend-mdns | 2 +- apparmor.d/profiles-a-f/cups-backend-parallel | 2 +- apparmor.d/profiles-a-f/cups-backend-pdf | 2 +- apparmor.d/profiles-a-f/cups-backend-serial | 2 +- apparmor.d/profiles-a-f/cups-backend-snmp | 2 +- apparmor.d/profiles-a-f/cups-backend-socket | 2 +- apparmor.d/profiles-a-f/cups-backend-usb | 2 +- apparmor.d/profiles-a-f/cups-browsed | 2 +- apparmor.d/profiles-a-f/cups-notifier-dbus | 2 +- apparmor.d/profiles-a-f/cups-notifier-mailto | 2 +- apparmor.d/profiles-a-f/cups-notifier-rss | 2 +- apparmor.d/profiles-a-f/cups-pk-helper-mechanism | 2 +- apparmor.d/profiles-a-f/czkawka-cli | 2 +- apparmor.d/profiles-a-f/czkawka-gui | 2 +- apparmor.d/profiles-a-f/ddclient | 2 +- apparmor.d/profiles-a-f/ddcutil | 2 +- apparmor.d/profiles-a-f/deltachat-desktop | 2 +- apparmor.d/profiles-a-f/deluser | 2 +- apparmor.d/profiles-a-f/df | 2 +- apparmor.d/profiles-a-f/dfc | 2 +- apparmor.d/profiles-a-f/dhclient | 2 +- apparmor.d/profiles-a-f/dhclient-script | 2 +- apparmor.d/profiles-a-f/dig | 2 +- apparmor.d/profiles-a-f/dino | 2 +- apparmor.d/profiles-a-f/discord | 2 +- apparmor.d/profiles-a-f/discord-chrome-sandbox | 2 +- apparmor.d/profiles-a-f/dkms | 2 +- apparmor.d/profiles-a-f/dkms-autoinstaller | 2 +- apparmor.d/profiles-a-f/dleyna-renderer-service | 2 +- apparmor.d/profiles-a-f/dleyna-server-service | 2 +- apparmor.d/profiles-a-f/dlocate | 2 +- apparmor.d/profiles-a-f/dmcrypt-get-device | 2 +- apparmor.d/profiles-a-f/dmesg | 2 +- apparmor.d/profiles-a-f/dmeventd | 2 +- apparmor.d/profiles-a-f/dmidecode | 2 +- apparmor.d/profiles-a-f/dmsetup | 2 +- apparmor.d/profiles-a-f/dnscrypt-proxy | 2 +- apparmor.d/profiles-a-f/downloadhelper | 2 +- apparmor.d/profiles-a-f/dring | 2 +- apparmor.d/profiles-a-f/dropbox | 2 +- apparmor.d/profiles-a-f/dumpcap | 2 +- apparmor.d/profiles-a-f/dumpe2fs | 2 +- apparmor.d/profiles-a-f/dunst | 2 +- apparmor.d/profiles-a-f/dunstctl | 2 +- apparmor.d/profiles-a-f/dunstify | 2 +- apparmor.d/profiles-a-f/e2fsck | 2 +- apparmor.d/profiles-a-f/e2image | 2 +- apparmor.d/profiles-a-f/e2scrub_all | 2 +- apparmor.d/profiles-a-f/earlyoom | 2 +- apparmor.d/profiles-a-f/edid-decode | 2 +- apparmor.d/profiles-a-f/eject | 2 +- apparmor.d/profiles-a-f/element-desktop | 2 +- apparmor.d/profiles-a-f/elinks | 2 +- apparmor.d/profiles-a-f/engrampa | 2 +- apparmor.d/profiles-a-f/etckeeper | 2 +- apparmor.d/profiles-a-f/evince | 2 +- apparmor.d/profiles-a-f/evince-previewer | 2 +- apparmor.d/profiles-a-f/evince-thumbnailer | 2 +- apparmor.d/profiles-a-f/execute-dcut | 2 +- apparmor.d/profiles-a-f/execute-dput | 2 +- apparmor.d/profiles-a-f/exiftool | 2 +- apparmor.d/profiles-a-f/exim4 | 2 +- apparmor.d/profiles-a-f/exo-compose-mail | 2 +- apparmor.d/profiles-a-f/exo-helper | 2 +- apparmor.d/profiles-a-f/exo-open | 2 +- apparmor.d/profiles-a-f/f3brew | 2 +- apparmor.d/profiles-a-f/f3fix | 2 +- apparmor.d/profiles-a-f/f3probe | 2 +- apparmor.d/profiles-a-f/f3read | 2 +- apparmor.d/profiles-a-f/f3write | 2 +- apparmor.d/profiles-a-f/fail2ban-client | 2 +- apparmor.d/profiles-a-f/fail2ban-server | 2 +- apparmor.d/profiles-a-f/fatlabel | 2 +- apparmor.d/profiles-a-f/fatresize | 2 +- apparmor.d/profiles-a-f/fdisk | 2 +- apparmor.d/profiles-a-f/ffmpeg | 2 +- apparmor.d/profiles-a-f/ffmpegthumbnailer | 2 +- apparmor.d/profiles-a-f/ffplay | 2 +- apparmor.d/profiles-a-f/ffprobe | 2 +- apparmor.d/profiles-a-f/file-roller | 2 +- apparmor.d/profiles-a-f/filecap | 2 +- apparmor.d/profiles-a-f/filezilla | 2 +- apparmor.d/profiles-a-f/findmnt | 2 +- apparmor.d/profiles-a-f/firecfg | 2 +- apparmor.d/profiles-a-f/firewall-applet | 2 +- apparmor.d/profiles-a-f/firewall-config | 2 +- apparmor.d/profiles-a-f/firewalld | 2 +- apparmor.d/profiles-a-f/flameshot | 2 +- apparmor.d/profiles-a-f/flatpak | 2 +- apparmor.d/profiles-a-f/flatpak-app | 2 +- apparmor.d/profiles-a-f/flatpak-oci-authenticator | 2 +- apparmor.d/profiles-a-f/flatpak-portal | 2 +- apparmor.d/profiles-a-f/flatpak-session-helper | 2 +- apparmor.d/profiles-a-f/flatpak-system-helper | 2 +- apparmor.d/profiles-a-f/flatpak-validate-icon | 2 +- apparmor.d/profiles-a-f/foliate | 2 +- apparmor.d/profiles-a-f/font-manager | 2 +- apparmor.d/profiles-a-f/fping | 2 +- apparmor.d/profiles-a-f/fprintd | 2 +- apparmor.d/profiles-a-f/fractal | 2 +- apparmor.d/profiles-a-f/freefall | 2 +- apparmor.d/profiles-a-f/freetube | 2 +- apparmor.d/profiles-a-f/fritzing | 2 +- apparmor.d/profiles-a-f/frontend | 2 +- apparmor.d/profiles-a-f/fsck | 2 +- apparmor.d/profiles-a-f/fsck.btrfs | 2 +- apparmor.d/profiles-a-f/fsck.fat | 2 +- apparmor.d/profiles-a-f/fstrim | 2 +- apparmor.d/profiles-a-f/fuse-overlayfs | 2 +- apparmor.d/profiles-a-f/fuseiso | 2 +- apparmor.d/profiles-a-f/fusermount | 2 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-a-f/fwupdmgr | 2 +- apparmor.d/profiles-g-l/gajim | 2 +- apparmor.d/profiles-g-l/gamemoded | 2 +- apparmor.d/profiles-g-l/ganyremote | 2 +- apparmor.d/profiles-g-l/gconfd | 2 +- apparmor.d/profiles-g-l/gdisk | 2 +- apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders | 2 +- apparmor.d/profiles-g-l/ghc-pkg | 2 +- apparmor.d/profiles-g-l/gimp | 2 +- apparmor.d/profiles-g-l/gio-querymodules | 2 +- apparmor.d/profiles-g-l/git | 2 +- apparmor.d/profiles-g-l/gitg | 2 +- apparmor.d/profiles-g-l/gitstatusd | 2 +- apparmor.d/profiles-g-l/glib-compile-resources | 2 +- apparmor.d/profiles-g-l/glib-compile-schemas | 2 +- apparmor.d/profiles-g-l/glib-pacrunner | 2 +- apparmor.d/profiles-g-l/globaltime | 2 +- apparmor.d/profiles-g-l/glxgears | 2 +- apparmor.d/profiles-g-l/glxinfo | 2 +- apparmor.d/profiles-g-l/gpa | 2 +- apparmor.d/profiles-g-l/gparted | 2 +- apparmor.d/profiles-g-l/gpartedbin | 2 +- apparmor.d/profiles-g-l/gpasswd | 2 +- apparmor.d/profiles-g-l/gping | 2 +- apparmor.d/profiles-g-l/gpo | 2 +- apparmor.d/profiles-g-l/gpodder | 2 +- apparmor.d/profiles-g-l/gpodder-migrate2tres | 2 +- apparmor.d/profiles-g-l/gpu-manager | 2 +- apparmor.d/profiles-g-l/groupadd | 2 +- apparmor.d/profiles-g-l/groupdel | 2 +- apparmor.d/profiles-g-l/groupmod | 2 +- apparmor.d/profiles-g-l/groups | 2 +- apparmor.d/profiles-g-l/grpck | 2 +- apparmor.d/profiles-g-l/gsettings | 2 +- apparmor.d/profiles-g-l/gsimplecal | 2 +- apparmor.d/profiles-g-l/gsmartcontrol | 2 +- apparmor.d/profiles-g-l/gsmartcontrol-root | 2 +- apparmor.d/profiles-g-l/gssproxy | 2 +- apparmor.d/profiles-g-l/gtk-query-immodules | 2 +- apparmor.d/profiles-g-l/gtk-update-icon-cache | 2 +- apparmor.d/profiles-g-l/gtk-youtube-viewer | 2 +- apparmor.d/profiles-g-l/hardinfo | 2 +- apparmor.d/profiles-g-l/haveged | 2 +- apparmor.d/profiles-g-l/hbbr | 2 +- apparmor.d/profiles-g-l/hbbs | 2 +- apparmor.d/profiles-g-l/hciconfig | 2 +- apparmor.d/profiles-g-l/hddtemp | 2 +- apparmor.d/profiles-g-l/hdparm | 2 +- apparmor.d/profiles-g-l/hexchat | 2 +- apparmor.d/profiles-g-l/highlight | 2 +- apparmor.d/profiles-g-l/homebank | 2 +- apparmor.d/profiles-g-l/host | 2 +- apparmor.d/profiles-g-l/hostname | 2 +- apparmor.d/profiles-g-l/htop | 2 +- apparmor.d/profiles-g-l/hugeadm | 2 +- apparmor.d/profiles-g-l/hugo | 2 +- apparmor.d/profiles-g-l/hw-probe | 2 +- apparmor.d/profiles-g-l/hwinfo | 2 +- apparmor.d/profiles-g-l/hypnotix | 2 +- apparmor.d/profiles-g-l/i2cdetect | 2 +- apparmor.d/profiles-g-l/i3lock | 2 +- apparmor.d/profiles-g-l/i3lock-fancy | 2 +- apparmor.d/profiles-g-l/iceauth | 2 +- apparmor.d/profiles-g-l/id | 2 +- apparmor.d/profiles-g-l/ifconfig | 2 +- apparmor.d/profiles-g-l/ifup | 2 +- apparmor.d/profiles-g-l/im-launch | 2 +- apparmor.d/profiles-g-l/img2txt | 2 +- apparmor.d/profiles-g-l/imv-wayland | 2 +- apparmor.d/profiles-g-l/initd-kexec | 2 +- apparmor.d/profiles-g-l/initd-kexec-load | 2 +- apparmor.d/profiles-g-l/initd-kmod | 2 +- apparmor.d/profiles-g-l/install-catalog | 2 +- apparmor.d/profiles-g-l/install-info | 2 +- apparmor.d/profiles-g-l/install-printerdriver | 2 +- apparmor.d/profiles-g-l/inxi | 2 +- apparmor.d/profiles-g-l/ioping | 2 +- apparmor.d/profiles-g-l/iotop | 2 +- apparmor.d/profiles-g-l/ip | 2 +- apparmor.d/profiles-g-l/ipcalc | 2 +- apparmor.d/profiles-g-l/irqbalance | 2 +- apparmor.d/profiles-g-l/issue-generator | 2 +- apparmor.d/profiles-g-l/iw | 2 +- apparmor.d/profiles-g-l/iwconfig | 2 +- apparmor.d/profiles-g-l/iwlist | 2 +- apparmor.d/profiles-g-l/jackdbus | 2 +- apparmor.d/profiles-g-l/jami-gnome | 2 +- apparmor.d/profiles-g-l/jdownloader | 2 +- apparmor.d/profiles-g-l/jekyll | 2 +- apparmor.d/profiles-g-l/jgmenu | 2 +- apparmor.d/profiles-g-l/jitterentropy-rngd | 2 +- apparmor.d/profiles-g-l/jmtpfs | 2 +- apparmor.d/profiles-g-l/kanyremote | 2 +- apparmor.d/profiles-g-l/kcheckpass | 2 +- apparmor.d/profiles-g-l/kconfig-hardened-check | 2 +- apparmor.d/profiles-g-l/keepassxc | 2 +- apparmor.d/profiles-g-l/keepassxc-cli | 2 +- apparmor.d/profiles-g-l/keepassxc-proxy | 2 +- apparmor.d/profiles-g-l/kernel-install | 2 +- apparmor.d/profiles-g-l/kerneloops | 2 +- apparmor.d/profiles-g-l/kerneloops-applet | 2 +- apparmor.d/profiles-g-l/kexec | 2 +- apparmor.d/profiles-g-l/kmod | 2 +- apparmor.d/profiles-g-l/kodi | 2 +- apparmor.d/profiles-g-l/kodi-xrandr | 2 +- apparmor.d/profiles-g-l/kvm-ok | 2 +- apparmor.d/profiles-g-l/labwc | 2 +- apparmor.d/profiles-g-l/landscape-sysinfo | 2 +- apparmor.d/profiles-g-l/landscape-sysinfo.wrapper | 2 +- apparmor.d/profiles-g-l/language-validate | 2 +- apparmor.d/profiles-g-l/last | 2 +- apparmor.d/profiles-g-l/lastlog | 2 +- apparmor.d/profiles-g-l/libreoffice | 2 +- apparmor.d/profiles-g-l/light | 2 +- apparmor.d/profiles-g-l/light-locker | 2 +- apparmor.d/profiles-g-l/light-locker-command | 2 +- apparmor.d/profiles-g-l/lightworks | 2 +- apparmor.d/profiles-g-l/lightworks-ntcardvt | 2 +- apparmor.d/profiles-g-l/linux-check-removal | 2 +- apparmor.d/profiles-g-l/linux-version | 2 +- apparmor.d/profiles-g-l/linuxqq | 2 +- apparmor.d/profiles-g-l/locale-gen | 2 +- apparmor.d/profiles-g-l/localepurge | 2 +- apparmor.d/profiles-g-l/login | 2 +- apparmor.d/profiles-g-l/logrotate | 2 +- apparmor.d/profiles-g-l/losetup | 2 +- apparmor.d/profiles-g-l/low-memory-monitor | 2 +- apparmor.d/profiles-g-l/lsblk | 2 +- apparmor.d/profiles-g-l/lscpu | 2 +- apparmor.d/profiles-g-l/lsinitramfs | 2 +- apparmor.d/profiles-g-l/lspci | 2 +- apparmor.d/profiles-g-l/lsusb | 2 +- apparmor.d/profiles-g-l/lvm | 2 +- apparmor.d/profiles-g-l/lvmconfig | 2 +- apparmor.d/profiles-g-l/lvmdump | 2 +- apparmor.d/profiles-g-l/lvmpolld | 2 +- apparmor.d/profiles-g-l/lxappearance | 2 +- apparmor.d/profiles-g-l/lynx | 2 +- apparmor.d/profiles-m-r/macchanger | 2 +- apparmor.d/profiles-m-r/man | 2 +- apparmor.d/profiles-m-r/mandb | 2 +- apparmor.d/profiles-m-r/mate-notification-daemon | 2 +- apparmor.d/profiles-m-r/mdevctl | 2 +- apparmor.d/profiles-m-r/mediainfo | 2 +- apparmor.d/profiles-m-r/mediainfo-gui | 2 +- apparmor.d/profiles-m-r/megasync | 2 +- apparmor.d/profiles-m-r/memtester | 2 +- apparmor.d/profiles-m-r/merkaartor | 2 +- apparmor.d/profiles-m-r/metadata-cleaner | 2 +- apparmor.d/profiles-m-r/mimetype | 2 +- apparmor.d/profiles-m-r/minitube | 2 +- apparmor.d/profiles-m-r/mission-control | 2 +- apparmor.d/profiles-m-r/mkcert | 2 +- apparmor.d/profiles-m-r/mke2fs | 2 +- apparmor.d/profiles-m-r/mkfs-btrfs | 2 +- apparmor.d/profiles-m-r/mkfs-fat | 2 +- apparmor.d/profiles-m-r/mkinitramfs | 2 +- apparmor.d/profiles-m-r/mkntfs | 2 +- apparmor.d/profiles-m-r/mkswap | 2 +- apparmor.d/profiles-m-r/mkvmerge | 2 +- apparmor.d/profiles-m-r/mkvtoolnix-gui | 2 +- apparmor.d/profiles-m-r/mlocate | 2 +- apparmor.d/profiles-m-r/modprobed-db | 2 +- apparmor.d/profiles-m-r/molly-guard | 2 +- apparmor.d/profiles-m-r/monitorix | 2 +- apparmor.d/profiles-m-r/mono-sgen | 2 +- apparmor.d/profiles-m-r/mount | 2 +- apparmor.d/profiles-m-r/mount-cifs | 2 +- apparmor.d/profiles-m-r/mount-nfs | 2 +- apparmor.d/profiles-m-r/mount-zfs | 2 +- apparmor.d/profiles-m-r/mpd | 2 +- apparmor.d/profiles-m-r/mpsyt | 2 +- apparmor.d/profiles-m-r/mpv | 2 +- apparmor.d/profiles-m-r/mtools | 2 +- apparmor.d/profiles-m-r/mtr | 2 +- apparmor.d/profiles-m-r/mtr-packet | 2 +- apparmor.d/profiles-m-r/mullvad-setup | 2 +- apparmor.d/profiles-m-r/multipath | 2 +- apparmor.d/profiles-m-r/multipathd | 2 +- apparmor.d/profiles-m-r/mumble | 2 +- apparmor.d/profiles-m-r/mumble-overlay | 2 +- apparmor.d/profiles-m-r/mutt | 2 +- apparmor.d/profiles-m-r/needrestart | 2 +- apparmor.d/profiles-m-r/needrestart-apt-pinvoke | 2 +- apparmor.d/profiles-m-r/needrestart-dpkg-status | 2 +- apparmor.d/profiles-m-r/needrestart-iucode-scan-versions | 2 +- apparmor.d/profiles-m-r/nemo | 2 +- apparmor.d/profiles-m-r/netcap | 2 +- apparmor.d/profiles-m-r/nethogs | 2 +- apparmor.d/profiles-m-r/netstat | 2 +- apparmor.d/profiles-m-r/newgidmap | 2 +- apparmor.d/profiles-m-r/newgrp | 2 +- apparmor.d/profiles-m-r/newuidmap | 2 +- apparmor.d/profiles-m-r/nfsdcld | 2 +- apparmor.d/profiles-m-r/nft | 2 +- apparmor.d/profiles-m-r/nmap | 2 +- apparmor.d/profiles-m-r/nologin | 2 +- apparmor.d/profiles-m-r/nslookup | 2 +- apparmor.d/profiles-m-r/ntfs-3g | 2 +- apparmor.d/profiles-m-r/ntfs-3g-probe | 2 +- apparmor.d/profiles-m-r/ntfscat | 2 +- apparmor.d/profiles-m-r/ntfsclone | 2 +- apparmor.d/profiles-m-r/ntfscluster | 2 +- apparmor.d/profiles-m-r/ntfscmp | 2 +- apparmor.d/profiles-m-r/ntfscp | 2 +- apparmor.d/profiles-m-r/ntfsdecrypt | 2 +- apparmor.d/profiles-m-r/ntfsfallocate | 2 +- apparmor.d/profiles-m-r/ntfsfix | 2 +- apparmor.d/profiles-m-r/ntfsinfo | 2 +- apparmor.d/profiles-m-r/ntfslabel | 2 +- apparmor.d/profiles-m-r/ntfsls | 2 +- apparmor.d/profiles-m-r/ntfsmove | 2 +- apparmor.d/profiles-m-r/ntfsrecover | 2 +- apparmor.d/profiles-m-r/ntfsresize | 2 +- apparmor.d/profiles-m-r/ntfssecaudit | 2 +- apparmor.d/profiles-m-r/ntfstruncate | 2 +- apparmor.d/profiles-m-r/ntfsundelete | 2 +- apparmor.d/profiles-m-r/ntfsusermap | 2 +- apparmor.d/profiles-m-r/ntfswipe | 2 +- apparmor.d/profiles-m-r/nullmailer-send | 2 +- apparmor.d/profiles-m-r/numlockx | 2 +- apparmor.d/profiles-m-r/nvidia-detector | 2 +- apparmor.d/profiles-m-r/nvidia-persistenced | 2 +- apparmor.d/profiles-m-r/nvidia-settings | 2 +- apparmor.d/profiles-m-r/nvidia-smi | 2 +- apparmor.d/profiles-m-r/nvtop | 2 +- apparmor.d/profiles-m-r/obamenu | 2 +- apparmor.d/profiles-m-r/obconf | 2 +- apparmor.d/profiles-m-r/obex-folder-listing | 2 +- apparmor.d/profiles-m-r/obexautofs | 2 +- apparmor.d/profiles-m-r/obexctl | 2 +- apparmor.d/profiles-m-r/obexd | 2 +- apparmor.d/profiles-m-r/obexfs | 2 +- apparmor.d/profiles-m-r/obexpush-atd | 2 +- apparmor.d/profiles-m-r/obexpushd | 2 +- apparmor.d/profiles-m-r/obxprop | 2 +- apparmor.d/profiles-m-r/odt2txt | 2 +- apparmor.d/profiles-m-r/ollama | 2 +- apparmor.d/profiles-m-r/on-ac-power | 2 +- apparmor.d/profiles-m-r/onefetch | 2 +- apparmor.d/profiles-m-r/openbox | 2 +- apparmor.d/profiles-m-r/openbox-session | 2 +- apparmor.d/profiles-m-r/orage | 2 +- apparmor.d/profiles-m-r/os-prober | 2 +- apparmor.d/profiles-m-r/ouch | 2 +- apparmor.d/profiles-m-r/packagekitd | 2 +- apparmor.d/profiles-m-r/pacmd | 2 +- apparmor.d/profiles-m-r/pactl | 2 +- apparmor.d/profiles-m-r/pagesize | 2 +- apparmor.d/profiles-m-r/pam-auth-update | 2 +- apparmor.d/profiles-m-r/pam-tmpdir-helper | 2 +- apparmor.d/profiles-m-r/parted | 2 +- apparmor.d/profiles-m-r/partprobe | 2 +- apparmor.d/profiles-m-r/pass | 2 +- apparmor.d/profiles-m-r/pass-import | 2 +- apparmor.d/profiles-m-r/passimd | 2 +- apparmor.d/profiles-m-r/passwd | 2 +- apparmor.d/profiles-m-r/pavucontrol | 2 +- apparmor.d/profiles-m-r/pcb-gtk | 2 +- apparmor.d/profiles-m-r/pcscd | 2 +- apparmor.d/profiles-m-r/pdftotext | 2 +- apparmor.d/profiles-m-r/picom | 2 +- apparmor.d/profiles-m-r/pidof | 2 +- apparmor.d/profiles-m-r/pinentry | 2 +- apparmor.d/profiles-m-r/pinentry-curses | 2 +- apparmor.d/profiles-m-r/pinentry-gnome3 | 2 +- apparmor.d/profiles-m-r/pinentry-gtk-2 | 2 +- apparmor.d/profiles-m-r/pinentry-kwallet | 2 +- apparmor.d/profiles-m-r/pinentry-qt | 2 +- apparmor.d/profiles-m-r/pkcs11-register | 2 +- apparmor.d/profiles-m-r/pkexec | 2 +- apparmor.d/profiles-m-r/pkttyagent | 2 +- apparmor.d/profiles-m-r/plank | 2 +- apparmor.d/profiles-m-r/plocate | 2 +- apparmor.d/profiles-m-r/plocate-build | 2 +- apparmor.d/profiles-m-r/pokemmo | 2 +- apparmor.d/profiles-m-r/popularity-contest | 2 +- apparmor.d/profiles-m-r/power-profiles-daemon | 2 +- apparmor.d/profiles-m-r/protonmail | 2 +- apparmor.d/profiles-m-r/protonmail-bridge | 2 +- apparmor.d/profiles-m-r/protonmail-bridge-core | 2 +- apparmor.d/profiles-m-r/ps | 2 +- apparmor.d/profiles-m-r/ps-mem | 2 +- apparmor.d/profiles-m-r/pscap | 2 +- apparmor.d/profiles-m-r/psi | 2 +- apparmor.d/profiles-m-r/psi-plus | 2 +- apparmor.d/profiles-m-r/pstree | 2 +- apparmor.d/profiles-m-r/pulseeffects | 2 +- apparmor.d/profiles-m-r/pwck | 2 +- apparmor.d/profiles-m-r/qbittorrent | 2 +- apparmor.d/profiles-m-r/qbittorrent-nox | 2 +- apparmor.d/profiles-m-r/qdbus | 2 +- apparmor.d/profiles-m-r/qemu-ga | 2 +- apparmor.d/profiles-m-r/qnapi | 2 +- apparmor.d/profiles-m-r/qpdfview | 2 +- apparmor.d/profiles-m-r/qt5ct | 2 +- apparmor.d/profiles-m-r/qtchooser | 2 +- apparmor.d/profiles-m-r/qtox | 2 +- apparmor.d/profiles-m-r/quiterss | 2 +- apparmor.d/profiles-m-r/rdmsr | 2 +- apparmor.d/profiles-m-r/remmina | 2 +- apparmor.d/profiles-m-r/repo | 2 +- apparmor.d/profiles-m-r/reprepro | 2 +- apparmor.d/profiles-m-r/resize2fs | 2 +- apparmor.d/profiles-m-r/resolvconf | 2 +- apparmor.d/profiles-m-r/rfkill | 2 +- apparmor.d/profiles-m-r/rngd | 2 +- apparmor.d/profiles-m-r/rpi-imager | 2 +- apparmor.d/profiles-m-r/rredtool | 2 +- apparmor.d/profiles-m-r/rsyslogd | 2 +- apparmor.d/profiles-m-r/rtkit-daemon | 2 +- apparmor.d/profiles-m-r/rtkitctl | 2 +- apparmor.d/profiles-m-r/run-parts | 2 +- apparmor.d/profiles-m-r/runuser | 2 +- apparmor.d/profiles-m-r/rustdesk | 2 +- apparmor.d/profiles-m-r/rustdesk-utils | 2 +- apparmor.d/profiles-s-z/YACReader | 2 +- apparmor.d/profiles-s-z/YACReaderLibrary | 2 +- apparmor.d/profiles-s-z/s3fs | 2 +- apparmor.d/profiles-s-z/sanoid | 2 +- apparmor.d/profiles-s-z/sbctl | 2 +- apparmor.d/profiles-s-z/scrcpy | 2 +- apparmor.d/profiles-s-z/scrot | 2 +- apparmor.d/profiles-s-z/sdcv | 2 +- apparmor.d/profiles-s-z/secure-time-sync | 2 +- apparmor.d/profiles-s-z/sensors | 2 +- apparmor.d/profiles-s-z/sensors-detect | 2 +- apparmor.d/profiles-s-z/session-desktop | 2 +- apparmor.d/profiles-s-z/setpci | 2 +- apparmor.d/profiles-s-z/setvtrgb | 2 +- apparmor.d/profiles-s-z/sfdisk | 2 +- apparmor.d/profiles-s-z/sgdisk | 2 +- apparmor.d/profiles-s-z/signal-desktop | 2 +- apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox | 2 +- apparmor.d/profiles-s-z/sing-box | 2 +- apparmor.d/profiles-s-z/slirp4netns | 2 +- apparmor.d/profiles-s-z/smartctl | 2 +- apparmor.d/profiles-s-z/smartd | 2 +- apparmor.d/profiles-s-z/smbspool | 2 +- apparmor.d/profiles-s-z/smplayer | 2 +- apparmor.d/profiles-s-z/smtube | 2 +- apparmor.d/profiles-s-z/snap | 2 +- apparmor.d/profiles-s-z/snap-bootstrap | 2 +- apparmor.d/profiles-s-z/snap-device-helper | 2 +- apparmor.d/profiles-s-z/snap-discard-ns | 2 +- apparmor.d/profiles-s-z/snap-failure | 2 +- apparmor.d/profiles-s-z/snap-repair | 2 +- apparmor.d/profiles-s-z/snap-seccomp | 2 +- apparmor.d/profiles-s-z/snap-update-ns | 2 +- apparmor.d/profiles-s-z/snapd | 2 +- apparmor.d/profiles-s-z/snapd-aa-prompt-listener | 2 +- apparmor.d/profiles-s-z/snapd-aa-prompt-ui | 2 +- apparmor.d/profiles-s-z/snapd-apparmor | 2 +- apparmor.d/profiles-s-z/snapd-core-fixup | 2 +- apparmor.d/profiles-s-z/snapshot | 2 +- apparmor.d/profiles-s-z/spacefm-auth | 2 +- apparmor.d/profiles-s-z/spectre-meltdown-checker | 2 +- apparmor.d/profiles-s-z/speech-dispatcher | 2 +- apparmor.d/profiles-s-z/speedtest | 2 +- apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper | 2 +- apparmor.d/profiles-s-z/spice-vdagent | 2 +- apparmor.d/profiles-s-z/spice-vdagentd | 2 +- apparmor.d/profiles-s-z/spotify | 2 +- apparmor.d/profiles-s-z/ss | 2 +- apparmor.d/profiles-s-z/sslocal | 2 +- apparmor.d/profiles-s-z/ssmanager | 2 +- apparmor.d/profiles-s-z/ssserver | 2 +- apparmor.d/profiles-s-z/ssservice | 2 +- apparmor.d/profiles-s-z/ssurl | 2 +- apparmor.d/profiles-s-z/start-pulseaudio-x11 | 2 +- apparmor.d/profiles-s-z/startx | 2 +- apparmor.d/profiles-s-z/steam | 2 +- apparmor.d/profiles-s-z/steam-fossilize | 2 +- apparmor.d/profiles-s-z/steam-game-native | 2 +- apparmor.d/profiles-s-z/steam-game-proton | 2 +- apparmor.d/profiles-s-z/steam-gameoverlayui | 2 +- apparmor.d/profiles-s-z/steam-launch | 2 +- apparmor.d/profiles-s-z/steam-launcher | 2 +- apparmor.d/profiles-s-z/steam-runtime | 2 +- apparmor.d/profiles-s-z/steam-runtime-steam-remote | 2 +- apparmor.d/profiles-s-z/steamerrorreporter | 2 +- apparmor.d/profiles-s-z/strawberry | 2 +- apparmor.d/profiles-s-z/strawberry-tagreader | 2 +- apparmor.d/profiles-s-z/su | 2 +- apparmor.d/profiles-s-z/sudo | 2 +- apparmor.d/profiles-s-z/sulogin | 2 +- apparmor.d/profiles-s-z/superproductivity | 2 +- apparmor.d/profiles-s-z/swaplabel | 2 +- apparmor.d/profiles-s-z/swapon | 2 +- apparmor.d/profiles-s-z/switcheroo-control | 2 +- apparmor.d/profiles-s-z/switcherooctl | 2 +- apparmor.d/profiles-s-z/swtpm | 2 +- apparmor.d/profiles-s-z/swtpm_ioctl | 2 +- apparmor.d/profiles-s-z/swtpm_localca | 2 +- apparmor.d/profiles-s-z/swtpm_setup | 2 +- apparmor.d/profiles-s-z/sync | 2 +- apparmor.d/profiles-s-z/syncoid | 2 +- apparmor.d/profiles-s-z/syncthing | 2 +- apparmor.d/profiles-s-z/sysctl | 2 +- apparmor.d/profiles-s-z/system-config-printer | 2 +- apparmor.d/profiles-s-z/system-config-printer-applet | 2 +- apparmor.d/profiles-s-z/task | 2 +- apparmor.d/profiles-s-z/tasksel | 2 +- apparmor.d/profiles-s-z/taskwarrior-tui | 2 +- apparmor.d/profiles-s-z/telegram-desktop | 2 +- apparmor.d/profiles-s-z/terminator | 2 +- apparmor.d/profiles-s-z/tftp | 2 +- apparmor.d/profiles-s-z/thermald | 2 +- apparmor.d/profiles-s-z/thinkfan | 2 +- apparmor.d/profiles-s-z/thunderbird | 2 +- apparmor.d/profiles-s-z/thunderbird-glxtest | 2 +- apparmor.d/profiles-s-z/thunderbird-vaapitest | 2 +- apparmor.d/profiles-s-z/tint2 | 2 +- apparmor.d/profiles-s-z/tint2conf | 2 +- apparmor.d/profiles-s-z/tomb | 2 +- apparmor.d/profiles-s-z/top | 2 +- apparmor.d/profiles-s-z/torify | 2 +- apparmor.d/profiles-s-z/torsocks | 2 +- apparmor.d/profiles-s-z/totem | 2 +- apparmor.d/profiles-s-z/tpacpi-bat | 2 +- apparmor.d/profiles-s-z/transmission | 2 +- apparmor.d/profiles-s-z/tune2fs | 2 +- apparmor.d/profiles-s-z/udev-dmi-memory-id | 2 +- apparmor.d/profiles-s-z/udiskie | 2 +- apparmor.d/profiles-s-z/udiskie-info | 2 +- apparmor.d/profiles-s-z/udiskie-mount | 2 +- apparmor.d/profiles-s-z/udiskie-umount | 2 +- apparmor.d/profiles-s-z/udisksctl | 2 +- apparmor.d/profiles-s-z/udisksd | 2 +- apparmor.d/profiles-s-z/ufw | 2 +- apparmor.d/profiles-s-z/umount | 2 +- apparmor.d/profiles-s-z/umount.udisks2 | 2 +- apparmor.d/profiles-s-z/uname | 2 +- apparmor.d/profiles-s-z/unhide-linux | 2 +- apparmor.d/profiles-s-z/unhide-posix | 2 +- apparmor.d/profiles-s-z/unhide-rb | 2 +- apparmor.d/profiles-s-z/unhide-tcp | 2 +- apparmor.d/profiles-s-z/unix-chkpwd | 2 +- apparmor.d/profiles-s-z/unmkinitramfs | 2 +- apparmor.d/profiles-s-z/update-alternatives | 2 +- apparmor.d/profiles-s-z/update-ca-certificates | 2 +- apparmor.d/profiles-s-z/update-ca-trust | 2 +- apparmor.d/profiles-s-z/update-command-not-found | 2 +- apparmor.d/profiles-s-z/update-cracklib | 2 +- apparmor.d/profiles-s-z/update-dlocatedb | 2 +- apparmor.d/profiles-s-z/update-initramfs | 2 +- apparmor.d/profiles-s-z/update-pciids | 2 +- apparmor.d/profiles-s-z/update-secureboot-policy | 2 +- apparmor.d/profiles-s-z/update-smart-drivedb | 2 +- apparmor.d/profiles-s-z/updatedb-mlocate | 2 +- apparmor.d/profiles-s-z/updatedb.plocate | 2 +- apparmor.d/profiles-s-z/uptime | 2 +- apparmor.d/profiles-s-z/uptimed | 2 +- apparmor.d/profiles-s-z/usb-devices | 2 +- apparmor.d/profiles-s-z/usbguard | 2 +- apparmor.d/profiles-s-z/usbguard-applet-qt | 2 +- apparmor.d/profiles-s-z/usbguard-daemon | 2 +- apparmor.d/profiles-s-z/usbguard-dbus | 2 +- apparmor.d/profiles-s-z/usbguard-notifier | 2 +- apparmor.d/profiles-s-z/useradd | 2 +- apparmor.d/profiles-s-z/userdel | 2 +- apparmor.d/profiles-s-z/usermod | 2 +- apparmor.d/profiles-s-z/users | 2 +- apparmor.d/profiles-s-z/utmpdump | 2 +- apparmor.d/profiles-s-z/utox | 2 +- apparmor.d/profiles-s-z/uuidd | 2 +- apparmor.d/profiles-s-z/uuidgen | 2 +- apparmor.d/profiles-s-z/uupdate | 2 +- apparmor.d/profiles-s-z/vcsi | 2 +- apparmor.d/profiles-s-z/veracrypt | 2 +- apparmor.d/profiles-s-z/vesktop | 2 +- apparmor.d/profiles-s-z/vidcutter | 2 +- apparmor.d/profiles-s-z/vipw-vigr | 2 +- apparmor.d/profiles-s-z/virt-manager | 2 +- apparmor.d/profiles-s-z/vlc | 2 +- apparmor.d/profiles-s-z/vlc-cache-gen | 2 +- apparmor.d/profiles-s-z/vnstat | 2 +- apparmor.d/profiles-s-z/vnstatd | 2 +- apparmor.d/profiles-s-z/volumeicon | 2 +- apparmor.d/profiles-s-z/vsftpd | 2 +- apparmor.d/profiles-s-z/w | 2 +- apparmor.d/profiles-s-z/w3m | 2 +- apparmor.d/profiles-s-z/wavemon | 2 +- apparmor.d/profiles-s-z/waybar | 2 +- apparmor.d/profiles-s-z/wechat-universal | 2 +- apparmor.d/profiles-s-z/wemeet | 2 +- apparmor.d/profiles-s-z/whatis | 2 +- apparmor.d/profiles-s-z/whdd | 2 +- apparmor.d/profiles-s-z/whereis | 2 +- apparmor.d/profiles-s-z/which | 2 +- apparmor.d/profiles-s-z/whiptail | 2 +- apparmor.d/profiles-s-z/who | 2 +- apparmor.d/profiles-s-z/whoami | 2 +- apparmor.d/profiles-s-z/wireplumber | 2 +- apparmor.d/profiles-s-z/wireshark | 2 +- apparmor.d/profiles-s-z/wl-copy | 2 +- apparmor.d/profiles-s-z/wmctrl | 2 +- apparmor.d/profiles-s-z/wpa-action | 2 +- apparmor.d/profiles-s-z/wpa-cli | 2 +- apparmor.d/profiles-s-z/wpa-gui | 2 +- apparmor.d/profiles-s-z/wpa-supplicant | 2 +- apparmor.d/profiles-s-z/wrmsr | 2 +- apparmor.d/profiles-s-z/wsdd | 2 +- apparmor.d/profiles-s-z/xarchiver | 2 +- apparmor.d/profiles-s-z/xauth | 2 +- apparmor.d/profiles-s-z/xautolock | 2 +- apparmor.d/profiles-s-z/xbacklight | 2 +- apparmor.d/profiles-s-z/xbrlapi | 2 +- apparmor.d/profiles-s-z/xclip | 2 +- apparmor.d/profiles-s-z/xdpyinfo | 2 +- apparmor.d/profiles-s-z/xinit | 2 +- apparmor.d/profiles-s-z/xinput | 2 +- apparmor.d/profiles-s-z/xsane-gimp | 2 +- apparmor.d/profiles-s-z/xsel | 2 +- apparmor.d/profiles-s-z/youtube-dl | 2 +- apparmor.d/profiles-s-z/youtube-viewer | 2 +- apparmor.d/profiles-s-z/yt-dlp | 2 +- apparmor.d/profiles-s-z/ytdl | 2 +- apparmor.d/profiles-s-z/zathura | 2 +- apparmor.d/profiles-s-z/zed | 2 +- apparmor.d/profiles-s-z/zenmap | 2 +- apparmor.d/profiles-s-z/zfs | 2 +- apparmor.d/profiles-s-z/zpool | 2 +- apparmor.d/profiles-s-z/zsys-system-autosnapshot | 2 +- apparmor.d/profiles-s-z/zsysd | 2 +- dists/ubuntu/abstractions/trash | 2 +- docs/development/workflow.md | 2 +- 1491 files changed, 1491 insertions(+), 1491 deletions(-) diff --git a/apparmor.d/groups/_full/bwrap b/apparmor.d/groups/_full/bwrap index e9ad60683..0a4b9efdf 100644 --- a/apparmor.d/groups/_full/bwrap +++ b/apparmor.d/groups/_full/bwrap @@ -4,7 +4,7 @@ # Default profile for bwrap. -abi , +abi , include diff --git a/apparmor.d/groups/_full/bwrap-app b/apparmor.d/groups/_full/bwrap-app index d0ddfaaad..b6d45478a 100644 --- a/apparmor.d/groups/_full/bwrap-app +++ b/apparmor.d/groups/_full/bwrap-app @@ -4,7 +4,7 @@ # Default profile for user sandboxed application -abi , +abi , include diff --git a/apparmor.d/groups/_full/default b/apparmor.d/groups/_full/default index b6689cb1d..d3fd26682 100644 --- a/apparmor.d/groups/_full/default +++ b/apparmor.d/groups/_full/default @@ -4,7 +4,7 @@ # Default profile for unconfined programs -abi , +abi , include diff --git a/apparmor.d/groups/_full/default-sudo b/apparmor.d/groups/_full/default-sudo index 36cebc626..609191970 100644 --- a/apparmor.d/groups/_full/default-sudo +++ b/apparmor.d/groups/_full/default-sudo @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index 36c31e60e..7538b9ed3 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -11,7 +11,7 @@ # Distributions and other programs can add rules in the usr/systemd.d directory -abi , +abi , include diff --git a/apparmor.d/groups/_full/systemd-service b/apparmor.d/groups/_full/systemd-service index 3a72cfe7e..e6c4a4b7b 100644 --- a/apparmor.d/groups/_full/systemd-service +++ b/apparmor.d/groups/_full/systemd-service @@ -8,7 +8,7 @@ # It does not specify an attachment path because it is intended to be used only # via "Px -> systemd-service" exec transitions from the systemd profile. -abi , +abi , include diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index 7b6ef77fb..71b9048a4 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -11,7 +11,7 @@ # Distributions and other programs can add rules in the usr/systemd-user.d directory -abi , +abi , include diff --git a/apparmor.d/groups/_full/systemd-user-service b/apparmor.d/groups/_full/systemd-user-service index 0aaeba215..d65846f82 100644 --- a/apparmor.d/groups/_full/systemd-user-service +++ b/apparmor.d/groups/_full/systemd-user-service @@ -8,7 +8,7 @@ # It does not specify an attachment path because it is intended to be used only # via "Px -> systemd-user-service" exec transitions from the systemd-user profile. -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_akonotes_resource b/apparmor.d/groups/akonadi/akonadi_akonotes_resource index 0d9822088..f0145d670 100644 --- a/apparmor.d/groups/akonadi/akonadi_akonotes_resource +++ b/apparmor.d/groups/akonadi/akonadi_akonotes_resource @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_archivemail_agent b/apparmor.d/groups/akonadi/akonadi_archivemail_agent index 13d45c38a..ed72aa21b 100644 --- a/apparmor.d/groups/akonadi/akonadi_archivemail_agent +++ b/apparmor.d/groups/akonadi/akonadi_archivemail_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_birthdays_resource b/apparmor.d/groups/akonadi/akonadi_birthdays_resource index 8fb383054..d3bf2074c 100644 --- a/apparmor.d/groups/akonadi/akonadi_birthdays_resource +++ b/apparmor.d/groups/akonadi/akonadi_birthdays_resource @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_contacts_resource b/apparmor.d/groups/akonadi/akonadi_contacts_resource index 733e4a85b..c3e5dc716 100644 --- a/apparmor.d/groups/akonadi/akonadi_contacts_resource +++ b/apparmor.d/groups/akonadi/akonadi_contacts_resource @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_control b/apparmor.d/groups/akonadi/akonadi_control index eba2bb4d9..945cc82b9 100644 --- a/apparmor.d/groups/akonadi/akonadi_control +++ b/apparmor.d/groups/akonadi/akonadi_control @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent index ba3b0227c..e85bdcba3 100644 --- a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent +++ b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_ical_resource b/apparmor.d/groups/akonadi/akonadi_ical_resource index 5689a2d88..465eebd33 100644 --- a/apparmor.d/groups/akonadi/akonadi_ical_resource +++ b/apparmor.d/groups/akonadi/akonadi_ical_resource @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_indexing_agent b/apparmor.d/groups/akonadi/akonadi_indexing_agent index 1f5096a82..32a332793 100644 --- a/apparmor.d/groups/akonadi/akonadi_indexing_agent +++ b/apparmor.d/groups/akonadi/akonadi_indexing_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_maildir_resource b/apparmor.d/groups/akonadi/akonadi_maildir_resource index 905fe7d68..fc518e4f7 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildir_resource +++ b/apparmor.d/groups/akonadi/akonadi_maildir_resource @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent index 24b2dd695..c353ea819 100644 --- a/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent +++ b/apparmor.d/groups/akonadi/akonadi_maildispatcher_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent index 9ca03ba33..37612c9ca 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_mailmerge_agent b/apparmor.d/groups/akonadi/akonadi_mailmerge_agent index b6c8a34e0..2083318e7 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailmerge_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailmerge_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_migration_agent b/apparmor.d/groups/akonadi/akonadi_migration_agent index 63e83d214..b3541299a 100644 --- a/apparmor.d/groups/akonadi/akonadi_migration_agent +++ b/apparmor.d/groups/akonadi/akonadi_migration_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent b/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent index b9e8debb2..28ce1123c 100644 --- a/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent +++ b/apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_notes_agent b/apparmor.d/groups/akonadi/akonadi_notes_agent index 97a3e8067..8e8665e40 100644 --- a/apparmor.d/groups/akonadi/akonadi_notes_agent +++ b/apparmor.d/groups/akonadi/akonadi_notes_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_sendlater_agent b/apparmor.d/groups/akonadi/akonadi_sendlater_agent index 157d963fb..2053bf298 100644 --- a/apparmor.d/groups/akonadi/akonadi_sendlater_agent +++ b/apparmor.d/groups/akonadi/akonadi_sendlater_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent index 5a623c860..4e0e5820a 100644 --- a/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent +++ b/apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 9907ae02f..5b362f123 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-cache b/apparmor.d/groups/apt/apt-cache index 0c11fbfb2..1251fe449 100644 --- a/apparmor.d/groups/apt/apt-cache +++ b/apparmor.d/groups/apt/apt-cache @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-cdrom b/apparmor.d/groups/apt/apt-cdrom index 0f3bce398..a99b964c7 100644 --- a/apparmor.d/groups/apt/apt-cdrom +++ b/apparmor.d/groups/apt/apt-cdrom @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-config b/apparmor.d/groups/apt/apt-config index 48a540043..505a4b037 100644 --- a/apparmor.d/groups/apt/apt-config +++ b/apparmor.d/groups/apt/apt-config @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-extracttemplates b/apparmor.d/groups/apt/apt-extracttemplates index f958d2575..2e41b10bf 100644 --- a/apparmor.d/groups/apt/apt-extracttemplates +++ b/apparmor.d/groups/apt/apt-extracttemplates @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-file b/apparmor.d/groups/apt/apt-file index bc6e523b4..7ee51cfed 100644 --- a/apparmor.d/groups/apt/apt-file +++ b/apparmor.d/groups/apt/apt-file @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-forktracer b/apparmor.d/groups/apt/apt-forktracer index ea687173f..2fbb5d95b 100644 --- a/apparmor.d/groups/apt/apt-forktracer +++ b/apparmor.d/groups/apt/apt-forktracer @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-ftparchive b/apparmor.d/groups/apt/apt-ftparchive index 4b8e45799..f7e9b4651 100644 --- a/apparmor.d/groups/apt/apt-ftparchive +++ b/apparmor.d/groups/apt/apt-ftparchive @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-helper b/apparmor.d/groups/apt/apt-helper index d6d4b5d7b..f02c01819 100644 --- a/apparmor.d/groups/apt/apt-helper +++ b/apparmor.d/groups/apt/apt-helper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-key b/apparmor.d/groups/apt/apt-key index 2d0f6a664..25a53282d 100644 --- a/apparmor.d/groups/apt/apt-key +++ b/apparmor.d/groups/apt/apt-key @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-listbugs b/apparmor.d/groups/apt/apt-listbugs index a04bd459a..403573a9d 100644 --- a/apparmor.d/groups/apt/apt-listbugs +++ b/apparmor.d/groups/apt/apt-listbugs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-listbugs-aptcleanup b/apparmor.d/groups/apt/apt-listbugs-aptcleanup index 3500ead6c..ccf56a603 100644 --- a/apparmor.d/groups/apt/apt-listbugs-aptcleanup +++ b/apparmor.d/groups/apt/apt-listbugs-aptcleanup @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-listbugs-migratepins b/apparmor.d/groups/apt/apt-listbugs-migratepins index f8eca9dfb..6a261aab9 100644 --- a/apparmor.d/groups/apt/apt-listbugs-migratepins +++ b/apparmor.d/groups/apt/apt-listbugs-migratepins @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-listbugs-prefclean b/apparmor.d/groups/apt/apt-listbugs-prefclean index 461edace9..4e0fea86f 100644 --- a/apparmor.d/groups/apt/apt-listbugs-prefclean +++ b/apparmor.d/groups/apt/apt-listbugs-prefclean @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-listchanges b/apparmor.d/groups/apt/apt-listchanges index fbabcd983..89cf63067 100644 --- a/apparmor.d/groups/apt/apt-listchanges +++ b/apparmor.d/groups/apt/apt-listchanges @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-mark b/apparmor.d/groups/apt/apt-mark index f76159e78..4af469c30 100644 --- a/apparmor.d/groups/apt/apt-mark +++ b/apparmor.d/groups/apt/apt-mark @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-cdrom b/apparmor.d/groups/apt/apt-methods-cdrom index 222f7540c..9cf47e758 100644 --- a/apparmor.d/groups/apt/apt-methods-cdrom +++ b/apparmor.d/groups/apt/apt-methods-cdrom @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-copy b/apparmor.d/groups/apt/apt-methods-copy index 2cd44be7b..6d906bf80 100644 --- a/apparmor.d/groups/apt/apt-methods-copy +++ b/apparmor.d/groups/apt/apt-methods-copy @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-file b/apparmor.d/groups/apt/apt-methods-file index ef49d144f..6d3e9d408 100644 --- a/apparmor.d/groups/apt/apt-methods-file +++ b/apparmor.d/groups/apt/apt-methods-file @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-ftp b/apparmor.d/groups/apt/apt-methods-ftp index d57cc71f2..47c679ea1 100644 --- a/apparmor.d/groups/apt/apt-methods-ftp +++ b/apparmor.d/groups/apt/apt-methods-ftp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-gpgv b/apparmor.d/groups/apt/apt-methods-gpgv index e2a7ed2b7..4b2a15773 100644 --- a/apparmor.d/groups/apt/apt-methods-gpgv +++ b/apparmor.d/groups/apt/apt-methods-gpgv @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-http b/apparmor.d/groups/apt/apt-methods-http index 72b39e719..0638120ba 100644 --- a/apparmor.d/groups/apt/apt-methods-http +++ b/apparmor.d/groups/apt/apt-methods-http @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-mirror b/apparmor.d/groups/apt/apt-methods-mirror index 31656857f..5acecd67a 100644 --- a/apparmor.d/groups/apt/apt-methods-mirror +++ b/apparmor.d/groups/apt/apt-methods-mirror @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-rred b/apparmor.d/groups/apt/apt-methods-rred index e5dc4d609..85da35efc 100644 --- a/apparmor.d/groups/apt/apt-methods-rred +++ b/apparmor.d/groups/apt/apt-methods-rred @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-rsh b/apparmor.d/groups/apt/apt-methods-rsh index bf51e32f7..95d70b31f 100644 --- a/apparmor.d/groups/apt/apt-methods-rsh +++ b/apparmor.d/groups/apt/apt-methods-rsh @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-methods-store b/apparmor.d/groups/apt/apt-methods-store index a3d2ce33a..4c414f07c 100644 --- a/apparmor.d/groups/apt/apt-methods-store +++ b/apparmor.d/groups/apt/apt-methods-store @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-overlay b/apparmor.d/groups/apt/apt-overlay index 158e7c57b..4ba9e57d7 100644 --- a/apparmor.d/groups/apt/apt-overlay +++ b/apparmor.d/groups/apt/apt-overlay @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-show-versions b/apparmor.d/groups/apt/apt-show-versions index b060e0a12..7885afca4 100644 --- a/apparmor.d/groups/apt/apt-show-versions +++ b/apparmor.d/groups/apt/apt-show-versions @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-sortpkgs b/apparmor.d/groups/apt/apt-sortpkgs index 56162c9d2..af5ec2ef0 100644 --- a/apparmor.d/groups/apt/apt-sortpkgs +++ b/apparmor.d/groups/apt/apt-sortpkgs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/apt-systemd-daily b/apparmor.d/groups/apt/apt-systemd-daily index 1acaa6aff..04907876e 100644 --- a/apparmor.d/groups/apt/apt-systemd-daily +++ b/apparmor.d/groups/apt/apt-systemd-daily @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/aptitude b/apparmor.d/groups/apt/aptitude index 7b36e4abe..972123a06 100644 --- a/apparmor.d/groups/apt/aptitude +++ b/apparmor.d/groups/apt/aptitude @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/aptitude-changelog-parser b/apparmor.d/groups/apt/aptitude-changelog-parser index 039de3095..91a47110a 100644 --- a/apparmor.d/groups/apt/aptitude-changelog-parser +++ b/apparmor.d/groups/apt/aptitude-changelog-parser @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/aptitude-create-state-bundle b/apparmor.d/groups/apt/aptitude-create-state-bundle index a81c3dafb..c700e325f 100644 --- a/apparmor.d/groups/apt/aptitude-create-state-bundle +++ b/apparmor.d/groups/apt/aptitude-create-state-bundle @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/aptitude-run-state-bundle b/apparmor.d/groups/apt/aptitude-run-state-bundle index 9119e243c..fa3a45315 100644 --- a/apparmor.d/groups/apt/aptitude-run-state-bundle +++ b/apparmor.d/groups/apt/aptitude-run-state-bundle @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/command-not-found b/apparmor.d/groups/apt/command-not-found index 00818d011..e6c0fdee6 100644 --- a/apparmor.d/groups/apt/command-not-found +++ b/apparmor.d/groups/apt/command-not-found @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/debconf-apt-progress b/apparmor.d/groups/apt/debconf-apt-progress index 31b55a24e..7b80201df 100644 --- a/apparmor.d/groups/apt/debconf-apt-progress +++ b/apparmor.d/groups/apt/debconf-apt-progress @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/debconf-show b/apparmor.d/groups/apt/debconf-show index 709e76f1f..b00cecd1b 100644 --- a/apparmor.d/groups/apt/debconf-show +++ b/apparmor.d/groups/apt/debconf-show @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/deborphan b/apparmor.d/groups/apt/deborphan index 76068b32d..236069e99 100644 --- a/apparmor.d/groups/apt/deborphan +++ b/apparmor.d/groups/apt/deborphan @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/debsecan b/apparmor.d/groups/apt/debsecan index ab391f72e..ee29b4923 100644 --- a/apparmor.d/groups/apt/debsecan +++ b/apparmor.d/groups/apt/debsecan @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/debsign b/apparmor.d/groups/apt/debsign index 7ed318aa7..b2f72f6cd 100644 --- a/apparmor.d/groups/apt/debsign +++ b/apparmor.d/groups/apt/debsign @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/debsums b/apparmor.d/groups/apt/debsums index ee371bee8..01e9ac152 100644 --- a/apparmor.d/groups/apt/debsums +++ b/apparmor.d/groups/apt/debsums @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/debtags b/apparmor.d/groups/apt/debtags index dff64bed3..8bda4efff 100644 --- a/apparmor.d/groups/apt/debtags +++ b/apparmor.d/groups/apt/debtags @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg b/apparmor.d/groups/apt/dpkg index c22ba0ae5..dd87414bf 100644 --- a/apparmor.d/groups/apt/dpkg +++ b/apparmor.d/groups/apt/dpkg @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-architecture b/apparmor.d/groups/apt/dpkg-architecture index ce6dfe8d5..e5ccb2f89 100644 --- a/apparmor.d/groups/apt/dpkg-architecture +++ b/apparmor.d/groups/apt/dpkg-architecture @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-buildflags b/apparmor.d/groups/apt/dpkg-buildflags index 39271db07..e7558acdf 100644 --- a/apparmor.d/groups/apt/dpkg-buildflags +++ b/apparmor.d/groups/apt/dpkg-buildflags @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-checkbuilddeps b/apparmor.d/groups/apt/dpkg-checkbuilddeps index 8c2ff03cf..e7542aadd 100644 --- a/apparmor.d/groups/apt/dpkg-checkbuilddeps +++ b/apparmor.d/groups/apt/dpkg-checkbuilddeps @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-deb b/apparmor.d/groups/apt/dpkg-deb index 6f9c2600b..4fedbcd5f 100644 --- a/apparmor.d/groups/apt/dpkg-deb +++ b/apparmor.d/groups/apt/dpkg-deb @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-divert b/apparmor.d/groups/apt/dpkg-divert index a770662a7..6712b8b7c 100644 --- a/apparmor.d/groups/apt/dpkg-divert +++ b/apparmor.d/groups/apt/dpkg-divert @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-genbuildinfo b/apparmor.d/groups/apt/dpkg-genbuildinfo index 47d7f6ece..4e22ecf19 100644 --- a/apparmor.d/groups/apt/dpkg-genbuildinfo +++ b/apparmor.d/groups/apt/dpkg-genbuildinfo @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-genchanges b/apparmor.d/groups/apt/dpkg-genchanges index 27991261c..73be1b913 100644 --- a/apparmor.d/groups/apt/dpkg-genchanges +++ b/apparmor.d/groups/apt/dpkg-genchanges @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index f94d95251..cf957ab4f 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-query b/apparmor.d/groups/apt/dpkg-query index 9a5512c2c..e0f4dbcdf 100644 --- a/apparmor.d/groups/apt/dpkg-query +++ b/apparmor.d/groups/apt/dpkg-query @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-split b/apparmor.d/groups/apt/dpkg-split index 551b84c03..e307e9867 100644 --- a/apparmor.d/groups/apt/dpkg-split +++ b/apparmor.d/groups/apt/dpkg-split @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-trigger b/apparmor.d/groups/apt/dpkg-trigger index 3aa674d0b..547123cf2 100644 --- a/apparmor.d/groups/apt/dpkg-trigger +++ b/apparmor.d/groups/apt/dpkg-trigger @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/dpkg-vendor b/apparmor.d/groups/apt/dpkg-vendor index 5a786e815..aee717257 100644 --- a/apparmor.d/groups/apt/dpkg-vendor +++ b/apparmor.d/groups/apt/dpkg-vendor @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/querybts b/apparmor.d/groups/apt/querybts index ba91e898a..da7c45275 100644 --- a/apparmor.d/groups/apt/querybts +++ b/apparmor.d/groups/apt/querybts @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index 1571298af..dfc578117 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/synaptic b/apparmor.d/groups/apt/synaptic index 6edd79767..4189c7170 100644 --- a/apparmor.d/groups/apt/synaptic +++ b/apparmor.d/groups/apt/synaptic @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index eaac10851..c528fb984 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/unattended-upgrade-shutdown b/apparmor.d/groups/apt/unattended-upgrade-shutdown index bd963a006..673775006 100644 --- a/apparmor.d/groups/apt/unattended-upgrade-shutdown +++ b/apparmor.d/groups/apt/unattended-upgrade-shutdown @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/apt/update-apt-xapian-index b/apparmor.d/groups/apt/update-apt-xapian-index index 80b5d0fab..15af33d88 100644 --- a/apparmor.d/groups/apt/update-apt-xapian-index +++ b/apparmor.d/groups/apt/update-apt-xapian-index @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/avahi/avahi-autoipd b/apparmor.d/groups/avahi/avahi-autoipd index 8d18f1a75..a6e724214 100644 --- a/apparmor.d/groups/avahi/avahi-autoipd +++ b/apparmor.d/groups/avahi/avahi-autoipd @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/avahi/avahi-browse b/apparmor.d/groups/avahi/avahi-browse index 3c7bfdf05..f04637ae3 100644 --- a/apparmor.d/groups/avahi/avahi-browse +++ b/apparmor.d/groups/avahi/avahi-browse @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/avahi/avahi-publish b/apparmor.d/groups/avahi/avahi-publish index 92f02d6d5..490303443 100644 --- a/apparmor.d/groups/avahi/avahi-publish +++ b/apparmor.d/groups/avahi/avahi-publish @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/avahi/avahi-resolve b/apparmor.d/groups/avahi/avahi-resolve index 459bc57da..ff2cae183 100644 --- a/apparmor.d/groups/avahi/avahi-resolve +++ b/apparmor.d/groups/avahi/avahi-resolve @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/avahi/avahi-set-host-name b/apparmor.d/groups/avahi/avahi-set-host-name index de986c7bc..dd9eaba6c 100644 --- a/apparmor.d/groups/avahi/avahi-set-host-name +++ b/apparmor.d/groups/avahi/avahi-set-host-name @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/brave b/apparmor.d/groups/browsers/brave index 543548f98..cc3d18b58 100644 --- a/apparmor.d/groups/browsers/brave +++ b/apparmor.d/groups/browsers/brave @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/brave-crashpad-handler b/apparmor.d/groups/browsers/brave-crashpad-handler index 2bfe2ff94..ae90c734e 100644 --- a/apparmor.d/groups/browsers/brave-crashpad-handler +++ b/apparmor.d/groups/browsers/brave-crashpad-handler @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/brave-sandbox b/apparmor.d/groups/browsers/brave-sandbox index 7928b1385..8ab3dd522 100644 --- a/apparmor.d/groups/browsers/brave-sandbox +++ b/apparmor.d/groups/browsers/brave-sandbox @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/brave-wrapper b/apparmor.d/groups/browsers/brave-wrapper index f1127d860..b4f70689c 100644 --- a/apparmor.d/groups/browsers/brave-wrapper +++ b/apparmor.d/groups/browsers/brave-wrapper @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chrome b/apparmor.d/groups/browsers/chrome index 93413c25c..5b4738408 100644 --- a/apparmor.d/groups/browsers/chrome +++ b/apparmor.d/groups/browsers/chrome @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chrome-crashpad-handler b/apparmor.d/groups/browsers/chrome-crashpad-handler index 67c0d0e8d..ea3d7d64a 100644 --- a/apparmor.d/groups/browsers/chrome-crashpad-handler +++ b/apparmor.d/groups/browsers/chrome-crashpad-handler @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chrome-sandbox b/apparmor.d/groups/browsers/chrome-sandbox index 709f57bc8..eceec9f89 100644 --- a/apparmor.d/groups/browsers/chrome-sandbox +++ b/apparmor.d/groups/browsers/chrome-sandbox @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chrome-wrapper b/apparmor.d/groups/browsers/chrome-wrapper index 8e9e1ba5d..709eb79a1 100644 --- a/apparmor.d/groups/browsers/chrome-wrapper +++ b/apparmor.d/groups/browsers/chrome-wrapper @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chromium b/apparmor.d/groups/browsers/chromium index eb0d87f4f..04fa2c756 100644 --- a/apparmor.d/groups/browsers/chromium +++ b/apparmor.d/groups/browsers/chromium @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chromium-crashpad-handler b/apparmor.d/groups/browsers/chromium-crashpad-handler index 2bac71620..8d6ab2461 100644 --- a/apparmor.d/groups/browsers/chromium-crashpad-handler +++ b/apparmor.d/groups/browsers/chromium-crashpad-handler @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chromium-sandbox b/apparmor.d/groups/browsers/chromium-sandbox index b07828e3b..98ebf5b62 100644 --- a/apparmor.d/groups/browsers/chromium-sandbox +++ b/apparmor.d/groups/browsers/chromium-sandbox @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/chromium-wrapper b/apparmor.d/groups/browsers/chromium-wrapper index 9300e46e7..40a775dba 100644 --- a/apparmor.d/groups/browsers/chromium-wrapper +++ b/apparmor.d/groups/browsers/chromium-wrapper @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/ephy-profile-migrator b/apparmor.d/groups/browsers/ephy-profile-migrator index ec343816d..e6f8902dd 100644 --- a/apparmor.d/groups/browsers/ephy-profile-migrator +++ b/apparmor.d/groups/browsers/ephy-profile-migrator @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany index be42cb9a0..54eeb79e3 100644 --- a/apparmor.d/groups/browsers/epiphany +++ b/apparmor.d/groups/browsers/epiphany @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index f35949078..27eb0d54d 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox-crashreporter b/apparmor.d/groups/browsers/firefox-crashreporter index 5223486d0..1c418eef4 100644 --- a/apparmor.d/groups/browsers/firefox-crashreporter +++ b/apparmor.d/groups/browsers/firefox-crashreporter @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest index 7a63d82e8..ad4fbb1ff 100644 --- a/apparmor.d/groups/browsers/firefox-glxtest +++ b/apparmor.d/groups/browsers/firefox-glxtest @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index 2ad6e2263..efcad72f8 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox-minidump-analyzer b/apparmor.d/groups/browsers/firefox-minidump-analyzer index 08cfc081a..6e13ee872 100644 --- a/apparmor.d/groups/browsers/firefox-minidump-analyzer +++ b/apparmor.d/groups/browsers/firefox-minidump-analyzer @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox-pingsender b/apparmor.d/groups/browsers/firefox-pingsender index 94dacaf2c..4c86af87a 100644 --- a/apparmor.d/groups/browsers/firefox-pingsender +++ b/apparmor.d/groups/browsers/firefox-pingsender @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox-plugin-container b/apparmor.d/groups/browsers/firefox-plugin-container index c7a11b75b..b326d14b4 100644 --- a/apparmor.d/groups/browsers/firefox-plugin-container +++ b/apparmor.d/groups/browsers/firefox-plugin-container @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/firefox-vaapitest b/apparmor.d/groups/browsers/firefox-vaapitest index 603b7a5d6..36069d36f 100644 --- a/apparmor.d/groups/browsers/firefox-vaapitest +++ b/apparmor.d/groups/browsers/firefox-vaapitest @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/msedge b/apparmor.d/groups/browsers/msedge index 41f8bb3cc..fbe4288a3 100644 --- a/apparmor.d/groups/browsers/msedge +++ b/apparmor.d/groups/browsers/msedge @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Jose Maldonado # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/msedge-crashpad-handler b/apparmor.d/groups/browsers/msedge-crashpad-handler index 9ac6cec22..67e8212ff 100644 --- a/apparmor.d/groups/browsers/msedge-crashpad-handler +++ b/apparmor.d/groups/browsers/msedge-crashpad-handler @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Jose Maldonado # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/msedge-sandbox b/apparmor.d/groups/browsers/msedge-sandbox index 6424e7bd0..2d4dcdd3e 100644 --- a/apparmor.d/groups/browsers/msedge-sandbox +++ b/apparmor.d/groups/browsers/msedge-sandbox @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Jose Maldonado # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/msedge-wrapper b/apparmor.d/groups/browsers/msedge-wrapper index 5fbb9b8f2..8268db2e1 100644 --- a/apparmor.d/groups/browsers/msedge-wrapper +++ b/apparmor.d/groups/browsers/msedge-wrapper @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Jose Maldonado # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/opera b/apparmor.d/groups/browsers/opera index 33ce558d3..54cc05481 100644 --- a/apparmor.d/groups/browsers/opera +++ b/apparmor.d/groups/browsers/opera @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/opera-crashreporter b/apparmor.d/groups/browsers/opera-crashreporter index 7b7d6b8d5..01661215a 100644 --- a/apparmor.d/groups/browsers/opera-crashreporter +++ b/apparmor.d/groups/browsers/opera-crashreporter @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/opera-sandbox b/apparmor.d/groups/browsers/opera-sandbox index 4dc591aa3..bebe0a902 100644 --- a/apparmor.d/groups/browsers/opera-sandbox +++ b/apparmor.d/groups/browsers/opera-sandbox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser b/apparmor.d/groups/browsers/torbrowser index c0c4a893e..8d8336d6d 100644 --- a/apparmor.d/groups/browsers/torbrowser +++ b/apparmor.d/groups/browsers/torbrowser @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser-glxtest b/apparmor.d/groups/browsers/torbrowser-glxtest index 54e1d5ad0..ab5eee07f 100644 --- a/apparmor.d/groups/browsers/torbrowser-glxtest +++ b/apparmor.d/groups/browsers/torbrowser-glxtest @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser-launcher b/apparmor.d/groups/browsers/torbrowser-launcher index 2d52cd2b4..343d3e0d0 100644 --- a/apparmor.d/groups/browsers/torbrowser-launcher +++ b/apparmor.d/groups/browsers/torbrowser-launcher @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser-plugin-container b/apparmor.d/groups/browsers/torbrowser-plugin-container index fa31652c5..88abc411c 100644 --- a/apparmor.d/groups/browsers/torbrowser-plugin-container +++ b/apparmor.d/groups/browsers/torbrowser-plugin-container @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser-start b/apparmor.d/groups/browsers/torbrowser-start index e7072c856..58bb31ac8 100644 --- a/apparmor.d/groups/browsers/torbrowser-start +++ b/apparmor.d/groups/browsers/torbrowser-start @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser-tor b/apparmor.d/groups/browsers/torbrowser-tor index 7eaa85c5c..73a111206 100644 --- a/apparmor.d/groups/browsers/torbrowser-tor +++ b/apparmor.d/groups/browsers/torbrowser-tor @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser-updater b/apparmor.d/groups/browsers/torbrowser-updater index 5aaa82c2a..a5c1e7cc3 100644 --- a/apparmor.d/groups/browsers/torbrowser-updater +++ b/apparmor.d/groups/browsers/torbrowser-updater @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/browsers/torbrowser-vaapitest b/apparmor.d/groups/browsers/torbrowser-vaapitest index cf68f3ea7..37ea80f91 100644 --- a/apparmor.d/groups/browsers/torbrowser-vaapitest +++ b/apparmor.d/groups/browsers/torbrowser-vaapitest @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/at-spi2-registryd b/apparmor.d/groups/bus/at-spi2-registryd index 46b404f2b..6c4bf4c69 100644 --- a/apparmor.d/groups/bus/at-spi2-registryd +++ b/apparmor.d/groups/bus/at-spi2-registryd @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index bf6a680a2..054af7202 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index 1aa90f2c4..ecec3cb49 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -7,7 +7,7 @@ # "dbus-system". It is intended to be used only via "Px ->" or via # systemd drop-in AppArmorProfile= setting. -abi , +abi , include diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index 74853231a..ed2f931cd 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -7,7 +7,7 @@ # "dbus-session". It is intended to be used only via "Px ->" or via # systemd drop-in AppArmorProfile= setting. -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-daemon b/apparmor.d/groups/bus/ibus-daemon index 52707ff63..dca91e5f2 100644 --- a/apparmor.d/groups/bus/ibus-daemon +++ b/apparmor.d/groups/bus/ibus-daemon @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-dconf b/apparmor.d/groups/bus/ibus-dconf index f45474e45..8746e3795 100644 --- a/apparmor.d/groups/bus/ibus-dconf +++ b/apparmor.d/groups/bus/ibus-dconf @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-engine-simple b/apparmor.d/groups/bus/ibus-engine-simple index 250ffafbd..ab3b2b2fd 100644 --- a/apparmor.d/groups/bus/ibus-engine-simple +++ b/apparmor.d/groups/bus/ibus-engine-simple @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-engine-table b/apparmor.d/groups/bus/ibus-engine-table index ea39af4be..5182b0dca 100644 --- a/apparmor.d/groups/bus/ibus-engine-table +++ b/apparmor.d/groups/bus/ibus-engine-table @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-extension-gtk3 b/apparmor.d/groups/bus/ibus-extension-gtk3 index 27b7613d5..34d881a8a 100644 --- a/apparmor.d/groups/bus/ibus-extension-gtk3 +++ b/apparmor.d/groups/bus/ibus-extension-gtk3 @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-memconf b/apparmor.d/groups/bus/ibus-memconf index 66fef2950..7e7299bc1 100644 --- a/apparmor.d/groups/bus/ibus-memconf +++ b/apparmor.d/groups/bus/ibus-memconf @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-portal b/apparmor.d/groups/bus/ibus-portal index c902e20d0..5d96f359e 100644 --- a/apparmor.d/groups/bus/ibus-portal +++ b/apparmor.d/groups/bus/ibus-portal @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index fbb924969..1096594aa 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/children/child-dpkg b/apparmor.d/groups/children/child-dpkg index a90f2a85b..24df581f9 100644 --- a/apparmor.d/groups/children/child-dpkg +++ b/apparmor.d/groups/children/child-dpkg @@ -9,7 +9,7 @@ # is invoked from other confined applications, but not when it is used # in regular (unconfined) shell scripts or run directly by the user. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-dpkg-divert b/apparmor.d/groups/children/child-dpkg-divert index 227b92249..6ea41a9e8 100644 --- a/apparmor.d/groups/children/child-dpkg-divert +++ b/apparmor.d/groups/children/child-dpkg-divert @@ -9,7 +9,7 @@ # it is invoked from other confined applications, but not when it is used # in regular (unconfined) shell scripts or run directly by the user. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index 45b1ff120..b3b0db7ff 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -12,7 +12,7 @@ # intended to be used only via "Px -> child-modprobe-nvidia" exec transitions # from other profiles. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-open b/apparmor.d/groups/children/child-open index 9b34f319e..6804326aa 100644 --- a/apparmor.d/groups/children/child-open +++ b/apparmor.d/groups/children/child-open @@ -15,7 +15,7 @@ # intended to be used only via "Px -> child-open" exec transitions # from other profiles. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-open-any b/apparmor.d/groups/children/child-open-any index 3fcfe4abe..58847a3e3 100644 --- a/apparmor.d/groups/children/child-open-any +++ b/apparmor.d/groups/children/child-open-any @@ -7,7 +7,7 @@ # This version of child-open allows to open any programs. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-open-browsers b/apparmor.d/groups/children/child-open-browsers index e3da8f38d..6873ea2fc 100644 --- a/apparmor.d/groups/children/child-open-browsers +++ b/apparmor.d/groups/children/child-open-browsers @@ -11,7 +11,7 @@ # intended to be used only via "Px -> child-open-browsers" exec transitions # from other profiles. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-open-help b/apparmor.d/groups/children/child-open-help index 23f9beade..d70cd920a 100644 --- a/apparmor.d/groups/children/child-open-help +++ b/apparmor.d/groups/children/child-open-help @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/children/child-open-strict b/apparmor.d/groups/children/child-open-strict index f5d0d8ca0..98bbdcdb9 100644 --- a/apparmor.d/groups/children/child-open-strict +++ b/apparmor.d/groups/children/child-open-strict @@ -7,7 +7,7 @@ # This version of child-open only allow to open browsers & folders. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-pager b/apparmor.d/groups/children/child-pager index 7170009ae..4f9edd9ea 100644 --- a/apparmor.d/groups/children/child-pager +++ b/apparmor.d/groups/children/child-pager @@ -9,7 +9,7 @@ # is invoked from other confined applications, but not when it is used # in regular (unconfined) shell scripts or run directly by the user. -abi , +abi , include diff --git a/apparmor.d/groups/children/child-systemctl b/apparmor.d/groups/children/child-systemctl index d9657a627..6dd9afd4a 100644 --- a/apparmor.d/groups/children/child-systemctl +++ b/apparmor.d/groups/children/child-systemctl @@ -9,7 +9,7 @@ # it is invoked from other confined applications, but not when it is # used in regular (unconfined) shell scripts or run directly by the user. -abi , +abi , include diff --git a/apparmor.d/groups/children/user_confined b/apparmor.d/groups/children/user_confined index 1d07d7c16..c4d3c9fed 100644 --- a/apparmor.d/groups/children/user_confined +++ b/apparmor.d/groups/children/user_confined @@ -5,7 +5,7 @@ # Allow confined users to read, write, lock and link to their own files # anywhere, and execute from some places. -abi , +abi , include diff --git a/apparmor.d/groups/children/user_default b/apparmor.d/groups/children/user_default index 4b010d22c..2853a8deb 100644 --- a/apparmor.d/groups/children/user_default +++ b/apparmor.d/groups/children/user_default @@ -6,7 +6,7 @@ # but only write to files in their home directory. Only allow limited execution # of files. -abi , +abi , include diff --git a/apparmor.d/groups/children/user_unconfined b/apparmor.d/groups/children/user_unconfined index ea40d67bf..f6e4e835e 100644 --- a/apparmor.d/groups/children/user_unconfined +++ b/apparmor.d/groups/children/user_unconfined @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 3636138c0..61dce67db 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-anacron b/apparmor.d/groups/cron/cron-anacron index ccce517a9..15d1b9737 100644 --- a/apparmor.d/groups/cron/cron-anacron +++ b/apparmor.d/groups/cron/cron-anacron @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-apport b/apparmor.d/groups/cron/cron-apport index e521016cb..61aeaf881 100644 --- a/apparmor.d/groups/cron/cron-apport +++ b/apparmor.d/groups/cron/cron-apport @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-apt b/apparmor.d/groups/cron/cron-apt index 41c27ecc7..29294fa53 100644 --- a/apparmor.d/groups/cron/cron-apt +++ b/apparmor.d/groups/cron/cron-apt @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-apt-compat b/apparmor.d/groups/cron/cron-apt-compat index 5c0c8054a..2aaa6b142 100644 --- a/apparmor.d/groups/cron/cron-apt-compat +++ b/apparmor.d/groups/cron/cron-apt-compat @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-apt-listbugs b/apparmor.d/groups/cron/cron-apt-listbugs index 6415e66b1..f2623dbf4 100644 --- a/apparmor.d/groups/cron/cron-apt-listbugs +++ b/apparmor.d/groups/cron/cron-apt-listbugs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-apt-show-versions b/apparmor.d/groups/cron/cron-apt-show-versions index 460a98d7e..213ed194f 100644 --- a/apparmor.d/groups/cron/cron-apt-show-versions +++ b/apparmor.d/groups/cron/cron-apt-show-versions @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-apt-xapian-index b/apparmor.d/groups/cron/cron-apt-xapian-index index 335576536..2c3f90a9a 100644 --- a/apparmor.d/groups/cron/cron-apt-xapian-index +++ b/apparmor.d/groups/cron/cron-apt-xapian-index @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-aptitude b/apparmor.d/groups/cron/cron-aptitude index 5769edadf..76657dc94 100644 --- a/apparmor.d/groups/cron/cron-aptitude +++ b/apparmor.d/groups/cron/cron-aptitude @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-cracklib b/apparmor.d/groups/cron/cron-cracklib index 5bc3aed32..8a87bd2af 100644 --- a/apparmor.d/groups/cron/cron-cracklib +++ b/apparmor.d/groups/cron/cron-cracklib @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-debsums b/apparmor.d/groups/cron/cron-debsums index 6ca80c582..33e785ee0 100644 --- a/apparmor.d/groups/cron/cron-debsums +++ b/apparmor.d/groups/cron/cron-debsums @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-debtags b/apparmor.d/groups/cron/cron-debtags index ce32b715e..3e6c182a7 100644 --- a/apparmor.d/groups/cron/cron-debtags +++ b/apparmor.d/groups/cron/cron-debtags @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-dlocate b/apparmor.d/groups/cron/cron-dlocate index fa4b03f8d..9599b6b4d 100644 --- a/apparmor.d/groups/cron/cron-dlocate +++ b/apparmor.d/groups/cron/cron-dlocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-etckeeper b/apparmor.d/groups/cron/cron-etckeeper index 36e105eb6..28a845cfe 100644 --- a/apparmor.d/groups/cron/cron-etckeeper +++ b/apparmor.d/groups/cron/cron-etckeeper @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-exim4-base b/apparmor.d/groups/cron/cron-exim4-base index 8fdfb9126..42f2f0823 100644 --- a/apparmor.d/groups/cron/cron-exim4-base +++ b/apparmor.d/groups/cron/cron-exim4-base @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-ipset-autoban-save b/apparmor.d/groups/cron/cron-ipset-autoban-save index 6f569d364..601368446 100644 --- a/apparmor.d/groups/cron/cron-ipset-autoban-save +++ b/apparmor.d/groups/cron/cron-ipset-autoban-save @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-logrotate b/apparmor.d/groups/cron/cron-logrotate index 723ffe0d8..abe3542f6 100644 --- a/apparmor.d/groups/cron/cron-logrotate +++ b/apparmor.d/groups/cron/cron-logrotate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-man-db b/apparmor.d/groups/cron/cron-man-db index 941f2ef11..8629f7be2 100644 --- a/apparmor.d/groups/cron/cron-man-db +++ b/apparmor.d/groups/cron/cron-man-db @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-mlocate b/apparmor.d/groups/cron/cron-mlocate index 9ee08974a..852e85141 100644 --- a/apparmor.d/groups/cron/cron-mlocate +++ b/apparmor.d/groups/cron/cron-mlocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-ntp b/apparmor.d/groups/cron/cron-ntp index ebc53dcf2..17ab7f745 100644 --- a/apparmor.d/groups/cron/cron-ntp +++ b/apparmor.d/groups/cron/cron-ntp @@ -2,7 +2,7 @@ # Copyright (C) 2024 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-plocate b/apparmor.d/groups/cron/cron-plocate index bae69e971..7080658c3 100644 --- a/apparmor.d/groups/cron/cron-plocate +++ b/apparmor.d/groups/cron/cron-plocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-popularity-contest b/apparmor.d/groups/cron/cron-popularity-contest index 3d25fecff..a1247a0b9 100644 --- a/apparmor.d/groups/cron/cron-popularity-contest +++ b/apparmor.d/groups/cron/cron-popularity-contest @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/cron-sysstat b/apparmor.d/groups/cron/cron-sysstat index 064ebc792..4ca22b6a1 100644 --- a/apparmor.d/groups/cron/cron-sysstat +++ b/apparmor.d/groups/cron/cron-sysstat @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index 1144b39c5..bfd4158ad 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/display-manager/lightdm b/apparmor.d/groups/display-manager/lightdm index 3c66936d0..04accbbf0 100644 --- a/apparmor.d/groups/display-manager/lightdm +++ b/apparmor.d/groups/display-manager/lightdm @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/display-manager/lightdm-gtk-greeter b/apparmor.d/groups/display-manager/lightdm-gtk-greeter index 8cc278fc7..e0f5f02f2 100644 --- a/apparmor.d/groups/display-manager/lightdm-gtk-greeter +++ b/apparmor.d/groups/display-manager/lightdm-gtk-greeter @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/display-manager/lightdm-xsession b/apparmor.d/groups/display-manager/lightdm-xsession index 14df741df..69a49eecf 100644 --- a/apparmor.d/groups/display-manager/lightdm-xsession +++ b/apparmor.d/groups/display-manager/lightdm-xsession @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/display-manager/x11-xsession b/apparmor.d/groups/display-manager/x11-xsession index 6d95290c8..d2f005264 100644 --- a/apparmor.d/groups/display-manager/x11-xsession +++ b/apparmor.d/groups/display-manager/x11-xsession @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index 346f0e5b1..687e0e920 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/accounts-daemon b/apparmor.d/groups/freedesktop/accounts-daemon index 1389b2ee6..539a2a57d 100644 --- a/apparmor.d/groups/freedesktop/accounts-daemon +++ b/apparmor.d/groups/freedesktop/accounts-daemon @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index 8ed35020a..f3ab4fedb 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/colord-session b/apparmor.d/groups/freedesktop/colord-session index e61063bda..16c109970 100644 --- a/apparmor.d/groups/freedesktop/colord-session +++ b/apparmor.d/groups/freedesktop/colord-session @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/cpupower b/apparmor.d/groups/freedesktop/cpupower index 2022a208c..b9811b1a6 100644 --- a/apparmor.d/groups/freedesktop/cpupower +++ b/apparmor.d/groups/freedesktop/cpupower @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/dconf b/apparmor.d/groups/freedesktop/dconf index 6abd28da3..be4972f04 100644 --- a/apparmor.d/groups/freedesktop/dconf +++ b/apparmor.d/groups/freedesktop/dconf @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/dconf-editor b/apparmor.d/groups/freedesktop/dconf-editor index 00d6553ec..3fdbb8b65 100644 --- a/apparmor.d/groups/freedesktop/dconf-editor +++ b/apparmor.d/groups/freedesktop/dconf-editor @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/dconf-service b/apparmor.d/groups/freedesktop/dconf-service index 120ff3920..ccebcad74 100644 --- a/apparmor.d/groups/freedesktop/dconf-service +++ b/apparmor.d/groups/freedesktop/dconf-service @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/desktop-file-install b/apparmor.d/groups/freedesktop/desktop-file-install index 269a6b39a..aa9ccae1b 100644 --- a/apparmor.d/groups/freedesktop/desktop-file-install +++ b/apparmor.d/groups/freedesktop/desktop-file-install @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/fc-cache b/apparmor.d/groups/freedesktop/fc-cache index 3fbd77be0..c74ad2958 100644 --- a/apparmor.d/groups/freedesktop/fc-cache +++ b/apparmor.d/groups/freedesktop/fc-cache @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/fc-list b/apparmor.d/groups/freedesktop/fc-list index cd31a79de..3f2fb4e02 100644 --- a/apparmor.d/groups/freedesktop/fc-list +++ b/apparmor.d/groups/freedesktop/fc-list @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index 7e2a282ac..ec1633a9e 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/iio-sensor-proxy b/apparmor.d/groups/freedesktop/iio-sensor-proxy index c8ab6b2b8..d7122bdbb 100644 --- a/apparmor.d/groups/freedesktop/iio-sensor-proxy +++ b/apparmor.d/groups/freedesktop/iio-sensor-proxy @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index bdadeabe3..cf98a133e 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/pipewire-media-session b/apparmor.d/groups/freedesktop/pipewire-media-session index f316df3b0..212898a84 100644 --- a/apparmor.d/groups/freedesktop/pipewire-media-session +++ b/apparmor.d/groups/freedesktop/pipewire-media-session @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/pipewire-pulse b/apparmor.d/groups/freedesktop/pipewire-pulse index a0026b4e1..b5644440f 100644 --- a/apparmor.d/groups/freedesktop/pipewire-pulse +++ b/apparmor.d/groups/freedesktop/pipewire-pulse @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/plymouth b/apparmor.d/groups/freedesktop/plymouth index 278c09aea..327eca3e5 100644 --- a/apparmor.d/groups/freedesktop/plymouth +++ b/apparmor.d/groups/freedesktop/plymouth @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/plymouth-set-default-theme b/apparmor.d/groups/freedesktop/plymouth-set-default-theme index e5440d614..bd5a34dcd 100644 --- a/apparmor.d/groups/freedesktop/plymouth-set-default-theme +++ b/apparmor.d/groups/freedesktop/plymouth-set-default-theme @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/plymouthd b/apparmor.d/groups/freedesktop/plymouthd index 815375f20..8e5933073 100644 --- a/apparmor.d/groups/freedesktop/plymouthd +++ b/apparmor.d/groups/freedesktop/plymouthd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/polkit-agent-helper b/apparmor.d/groups/freedesktop/polkit-agent-helper index d6265589f..bb6e457ff 100644 --- a/apparmor.d/groups/freedesktop/polkit-agent-helper +++ b/apparmor.d/groups/freedesktop/polkit-agent-helper @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent b/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent index 71709ed4f..94bc7ece6 100644 --- a/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index e67ccbf6a..7ca73cd63 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent b/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent index 3aa47de3c..0dfea7525 100644 --- a/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-mate-authentication-agent @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/polkitd b/apparmor.d/groups/freedesktop/polkitd index 2533b1982..089e61744 100644 --- a/apparmor.d/groups/freedesktop/polkitd +++ b/apparmor.d/groups/freedesktop/polkitd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index e4a563755..804020b7b 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -4,7 +4,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/update-desktop-database b/apparmor.d/groups/freedesktop/update-desktop-database index e070bff2f..19aa4079a 100644 --- a/apparmor.d/groups/freedesktop/update-desktop-database +++ b/apparmor.d/groups/freedesktop/update-desktop-database @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/update-mime-database b/apparmor.d/groups/freedesktop/update-mime-database index 778af218c..9efd9cccc 100644 --- a/apparmor.d/groups/freedesktop/update-mime-database +++ b/apparmor.d/groups/freedesktop/update-mime-database @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/upower b/apparmor.d/groups/freedesktop/upower index 0428aebfc..1cb7c9583 100644 --- a/apparmor.d/groups/freedesktop/upower +++ b/apparmor.d/groups/freedesktop/upower @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index a6032976d..e9b6f5c05 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index 6e5b5adb0..6ebc28929 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-icon b/apparmor.d/groups/freedesktop/xdg-desktop-icon index 7379369e1..0b0953f6e 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-icon +++ b/apparmor.d/groups/freedesktop/xdg-desktop-icon @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-menu b/apparmor.d/groups/freedesktop/xdg-desktop-menu index 4204c51d1..147d4c090 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-menu +++ b/apparmor.d/groups/freedesktop/xdg-desktop-menu @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 720d794b7..00cb35b62 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 8184ffbdf..9cbf81bc6 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index 9eaea73aa..0daa77899 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland index 05c12eaf3..876825ee4 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-hyprland @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde index ae2691cb0..309248e18 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers b/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers index a76f73b36..62adb343b 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index 2735c8633..611e1ab9c 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-email b/apparmor.d/groups/freedesktop/xdg-email index fa8abd38f..d7228b653 100644 --- a/apparmor.d/groups/freedesktop/xdg-email +++ b/apparmor.d/groups/freedesktop/xdg-email @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-icon-resource b/apparmor.d/groups/freedesktop/xdg-icon-resource index 66cd5435f..bda6621d3 100644 --- a/apparmor.d/groups/freedesktop/xdg-icon-resource +++ b/apparmor.d/groups/freedesktop/xdg-icon-resource @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index 28c1836c9..c31ff0064 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -5,7 +5,7 @@ # TODO: This profile needs to be rewritten and integrated with the xdg-open profiles. -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index e7ee7dc8c..096132af5 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-permission-store b/apparmor.d/groups/freedesktop/xdg-permission-store index fa139a9ec..057c64208 100644 --- a/apparmor.d/groups/freedesktop/xdg-permission-store +++ b/apparmor.d/groups/freedesktop/xdg-permission-store @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-screensaver b/apparmor.d/groups/freedesktop/xdg-screensaver index 792c6b859..784c63364 100644 --- a/apparmor.d/groups/freedesktop/xdg-screensaver +++ b/apparmor.d/groups/freedesktop/xdg-screensaver @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index a4d611712..38ae2c1b5 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-user-dir b/apparmor.d/groups/freedesktop/xdg-user-dir index 7fcf6f3ec..f963a21b9 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dir +++ b/apparmor.d/groups/freedesktop/xdg-user-dir @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update index 01a289533..8892bd1ce 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-update index 4730ca091..7177703a9 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-update @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xhost b/apparmor.d/groups/freedesktop/xhost index 26b1bc598..6032179e4 100644 --- a/apparmor.d/groups/freedesktop/xhost +++ b/apparmor.d/groups/freedesktop/xhost @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xkbcomp b/apparmor.d/groups/freedesktop/xkbcomp index c055b9be2..941cc8f92 100644 --- a/apparmor.d/groups/freedesktop/xkbcomp +++ b/apparmor.d/groups/freedesktop/xkbcomp @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 6be9e2126..dce42dc85 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xprop b/apparmor.d/groups/freedesktop/xprop index aaa19b998..99959fc73 100644 --- a/apparmor.d/groups/freedesktop/xprop +++ b/apparmor.d/groups/freedesktop/xprop @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xrandr b/apparmor.d/groups/freedesktop/xrandr index 99e07a121..fc1935c4b 100644 --- a/apparmor.d/groups/freedesktop/xrandr +++ b/apparmor.d/groups/freedesktop/xrandr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xrdb b/apparmor.d/groups/freedesktop/xrdb index 638f6ebee..55d069815 100644 --- a/apparmor.d/groups/freedesktop/xrdb +++ b/apparmor.d/groups/freedesktop/xrdb @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xset b/apparmor.d/groups/freedesktop/xset index ff09d2b1a..20dc2b1fb 100644 --- a/apparmor.d/groups/freedesktop/xset +++ b/apparmor.d/groups/freedesktop/xset @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xsetroot b/apparmor.d/groups/freedesktop/xsetroot index db5d0a7aa..bc1291ef4 100644 --- a/apparmor.d/groups/freedesktop/xsetroot +++ b/apparmor.d/groups/freedesktop/xsetroot @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland index 9b61e7dea..c2710eb83 100644 --- a/apparmor.d/groups/freedesktop/xwayland +++ b/apparmor.d/groups/freedesktop/xwayland @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/chrome-gnome-shell b/apparmor.d/groups/gnome/chrome-gnome-shell index 9063afc57..8c6372ba5 100644 --- a/apparmor.d/groups/gnome/chrome-gnome-shell +++ b/apparmor.d/groups/gnome/chrome-gnome-shell @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor index 444fc581f..cc6645590 100644 --- a/apparmor.d/groups/gnome/deja-dup-monitor +++ b/apparmor.d/groups/gnome/deja-dup-monitor @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/epiphany-search-provider b/apparmor.d/groups/gnome/epiphany-search-provider index ca1213df9..88ec63ea7 100644 --- a/apparmor.d/groups/gnome/epiphany-search-provider +++ b/apparmor.d/groups/gnome/epiphany-search-provider @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/epiphany-webapp-provider b/apparmor.d/groups/gnome/epiphany-webapp-provider index 7dda86245..c161a5a0c 100644 --- a/apparmor.d/groups/gnome/epiphany-webapp-provider +++ b/apparmor.d/groups/gnome/epiphany-webapp-provider @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index de7c3c299..c6494c95f 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/evolution-alarm-notify b/apparmor.d/groups/gnome/evolution-alarm-notify index abae74d45..ce8f799bb 100644 --- a/apparmor.d/groups/gnome/evolution-alarm-notify +++ b/apparmor.d/groups/gnome/evolution-alarm-notify @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/evolution-calendar-factory b/apparmor.d/groups/gnome/evolution-calendar-factory index d1ec45ac4..f856a06d2 100644 --- a/apparmor.d/groups/gnome/evolution-calendar-factory +++ b/apparmor.d/groups/gnome/evolution-calendar-factory @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/evolution-source-registry b/apparmor.d/groups/gnome/evolution-source-registry index 7c97acc2e..379ea5bef 100644 --- a/apparmor.d/groups/gnome/evolution-source-registry +++ b/apparmor.d/groups/gnome/evolution-source-registry @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/evolution-user-prompter b/apparmor.d/groups/gnome/evolution-user-prompter index d9d2e6a55..d1c095abf 100644 --- a/apparmor.d/groups/gnome/evolution-user-prompter +++ b/apparmor.d/groups/gnome/evolution-user-prompter @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gcr-prompter b/apparmor.d/groups/gnome/gcr-prompter index 7ecb4fb84..a1e323c87 100644 --- a/apparmor.d/groups/gnome/gcr-prompter +++ b/apparmor.d/groups/gnome/gcr-prompter @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gcr-ssh-agent b/apparmor.d/groups/gnome/gcr-ssh-agent index a6f0f22fd..24e94d9cb 100644 --- a/apparmor.d/groups/gnome/gcr-ssh-agent +++ b/apparmor.d/groups/gnome/gcr-ssh-agent @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gdm b/apparmor.d/groups/gnome/gdm index 2817f668e..b0f5e81a5 100644 --- a/apparmor.d/groups/gnome/gdm +++ b/apparmor.d/groups/gnome/gdm @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index d9e121c41..dc11e8169 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gdm-prime-defaut b/apparmor.d/groups/gnome/gdm-prime-defaut index 5e4e02b6f..b5b111604 100644 --- a/apparmor.d/groups/gnome/gdm-prime-defaut +++ b/apparmor.d/groups/gnome/gdm-prime-defaut @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gdm-runtime-config b/apparmor.d/groups/gnome/gdm-runtime-config index 26ce14234..558f3677c 100644 --- a/apparmor.d/groups/gnome/gdm-runtime-config +++ b/apparmor.d/groups/gnome/gdm-runtime-config @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gdm-session b/apparmor.d/groups/gnome/gdm-session index da99a23db..4e3440656 100644 --- a/apparmor.d/groups/gnome/gdm-session +++ b/apparmor.d/groups/gnome/gdm-session @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index f50e30311..8f6770ec1 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession index a48958b40..2cdae783d 100644 --- a/apparmor.d/groups/gnome/gdm-xsession +++ b/apparmor.d/groups/gnome/gdm-xsession @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 4e9539968..4b395eb82 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -8,7 +8,7 @@ # - Direct access should only be needed is some special context and it should not # require access to that much resources. -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index d84a3378f..613be32d3 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -7,7 +7,7 @@ # confined under this profile. The resulting profile is quite broad. # This architecture needs to be rethinked. -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gkbd-keyboard-display b/apparmor.d/groups/gnome/gkbd-keyboard-display index 7b9fc07cd..18b11e9be 100644 --- a/apparmor.d/groups/gnome/gkbd-keyboard-display +++ b/apparmor.d/groups/gnome/gkbd-keyboard-display @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes index 46007489e..f44f42e63 100644 --- a/apparmor.d/groups/gnome/gnome-boxes +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-browser-connector-host b/apparmor.d/groups/gnome/gnome-browser-connector-host index 09ac8dbad..d31811152 100644 --- a/apparmor.d/groups/gnome/gnome-browser-connector-host +++ b/apparmor.d/groups/gnome/gnome-browser-connector-host @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-calculator b/apparmor.d/groups/gnome/gnome-calculator index 2ac0e4ca7..17fcdc4f6 100644 --- a/apparmor.d/groups/gnome/gnome-calculator +++ b/apparmor.d/groups/gnome/gnome-calculator @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-calculator-search-provider b/apparmor.d/groups/gnome/gnome-calculator-search-provider index a0a5f7e6f..2eaacdefb 100644 --- a/apparmor.d/groups/gnome/gnome-calculator-search-provider +++ b/apparmor.d/groups/gnome/gnome-calculator-search-provider @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index 2db321baf..16cfa77c8 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 457bcfea2..730feb31c 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-characters-backgroudservice b/apparmor.d/groups/gnome/gnome-characters-backgroudservice index 6e975a7dd..4b70cdfa6 100644 --- a/apparmor.d/groups/gnome/gnome-characters-backgroudservice +++ b/apparmor.d/groups/gnome/gnome-characters-backgroudservice @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-clocks b/apparmor.d/groups/gnome/gnome-clocks index d8f77070b..da42a2ef7 100644 --- a/apparmor.d/groups/gnome/gnome-clocks +++ b/apparmor.d/groups/gnome/gnome-clocks @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-contacts b/apparmor.d/groups/gnome/gnome-contacts index fc96424a9..66651f3a2 100644 --- a/apparmor.d/groups/gnome/gnome-contacts +++ b/apparmor.d/groups/gnome/gnome-contacts @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-contacts-search-provider b/apparmor.d/groups/gnome/gnome-contacts-search-provider index a0a74f62e..0abc39acd 100644 --- a/apparmor.d/groups/gnome/gnome-contacts-search-provider +++ b/apparmor.d/groups/gnome/gnome-contacts-search-provider @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index b0006d774..310b7a981 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-control-center-goa-helper b/apparmor.d/groups/gnome/gnome-control-center-goa-helper index a210cbd18..4695c87d4 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-goa-helper +++ b/apparmor.d/groups/gnome/gnome-control-center-goa-helper @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-control-center-print-renderer b/apparmor.d/groups/gnome/gnome-control-center-print-renderer index db68c40b5..59679deb8 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-print-renderer +++ b/apparmor.d/groups/gnome/gnome-control-center-print-renderer @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-control-center-search-provider b/apparmor.d/groups/gnome/gnome-control-center-search-provider index 53ced47f0..3dfd1bf03 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-search-provider +++ b/apparmor.d/groups/gnome/gnome-control-center-search-provider @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-desktop-thumbnailers b/apparmor.d/groups/gnome/gnome-desktop-thumbnailers index bb1f5012a..436d82443 100644 --- a/apparmor.d/groups/gnome/gnome-desktop-thumbnailers +++ b/apparmor.d/groups/gnome/gnome-desktop-thumbnailers @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-disk-image-mounter b/apparmor.d/groups/gnome/gnome-disk-image-mounter index fe743f186..379a887b3 100644 --- a/apparmor.d/groups/gnome/gnome-disk-image-mounter +++ b/apparmor.d/groups/gnome/gnome-disk-image-mounter @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-disks b/apparmor.d/groups/gnome/gnome-disks index 575668029..4d5301262 100644 --- a/apparmor.d/groups/gnome/gnome-disks +++ b/apparmor.d/groups/gnome/gnome-disks @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index 1cef7f074..7c9a80777 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 58b528704..4c4b00c5d 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-extension-manager b/apparmor.d/groups/gnome/gnome-extension-manager index d3ed3794b..942d7b404 100644 --- a/apparmor.d/groups/gnome/gnome-extension-manager +++ b/apparmor.d/groups/gnome/gnome-extension-manager @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-extensions-app b/apparmor.d/groups/gnome/gnome-extensions-app index 1b110f6e3..29899f8f1 100644 --- a/apparmor.d/groups/gnome/gnome-extensions-app +++ b/apparmor.d/groups/gnome/gnome-extensions-app @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-firmware b/apparmor.d/groups/gnome/gnome-firmware index 307fc06e3..7d33b3103 100644 --- a/apparmor.d/groups/gnome/gnome-firmware +++ b/apparmor.d/groups/gnome/gnome-firmware @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-font-viewer b/apparmor.d/groups/gnome/gnome-font-viewer index 2844be9b7..2e16f9f41 100644 --- a/apparmor.d/groups/gnome/gnome-font-viewer +++ b/apparmor.d/groups/gnome/gnome-font-viewer @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index c3904d836..d27ccb8bb 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index 5d945b641..905c16b89 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-logs b/apparmor.d/groups/gnome/gnome-logs index ab0a6144f..ae81fc825 100644 --- a/apparmor.d/groups/gnome/gnome-logs +++ b/apparmor.d/groups/gnome/gnome-logs @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-maps b/apparmor.d/groups/gnome/gnome-maps index 36f93215f..1f2faafbb 100644 --- a/apparmor.d/groups/gnome/gnome-maps +++ b/apparmor.d/groups/gnome/gnome-maps @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index 710393390..a40c25fd8 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-photos-thumbnailer b/apparmor.d/groups/gnome/gnome-photos-thumbnailer index 410953e49..0182e9dad 100644 --- a/apparmor.d/groups/gnome/gnome-photos-thumbnailer +++ b/apparmor.d/groups/gnome/gnome-photos-thumbnailer @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-recipes b/apparmor.d/groups/gnome/gnome-recipes index c2e11a805..5ebd788c0 100644 --- a/apparmor.d/groups/gnome/gnome-recipes +++ b/apparmor.d/groups/gnome/gnome-recipes @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon index 46d21977c..19e448b1b 100644 --- a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon +++ b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index 171a93338..597a47c12 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 25be8038c..0825d418f 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-session-ctl b/apparmor.d/groups/gnome/gnome-session-ctl index 220a9cac3..04c4ce628 100644 --- a/apparmor.d/groups/gnome/gnome-session-ctl +++ b/apparmor.d/groups/gnome/gnome-session-ctl @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 0fd0d1e83..b83de9bf4 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-shell-calendar-server b/apparmor.d/groups/gnome/gnome-shell-calendar-server index 371ed3e01..357104e57 100644 --- a/apparmor.d/groups/gnome/gnome-shell-calendar-server +++ b/apparmor.d/groups/gnome/gnome-shell-calendar-server @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer b/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer index f0e9bf398..51d5b43cf 100644 --- a/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer +++ b/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-shell-overrides-migration b/apparmor.d/groups/gnome/gnome-shell-overrides-migration index d041df4de..8d5cc4d1d 100644 --- a/apparmor.d/groups/gnome/gnome-shell-overrides-migration +++ b/apparmor.d/groups/gnome/gnome-shell-overrides-migration @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 343205e12..da5ed232f 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 730ea1ffe..92cbd369e 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index c5b1ec821..d96c20c36 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index 8641e01bd..efbb55f35 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-tour b/apparmor.d/groups/gnome/gnome-tour index fc6605232..1dcb2af68 100644 --- a/apparmor.d/groups/gnome/gnome-tour +++ b/apparmor.d/groups/gnome/gnome-tour @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-tweaks b/apparmor.d/groups/gnome/gnome-tweaks index 01518446b..d21e23824 100644 --- a/apparmor.d/groups/gnome/gnome-tweaks +++ b/apparmor.d/groups/gnome/gnome-tweaks @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-user-share-webdav b/apparmor.d/groups/gnome/gnome-user-share-webdav index 37e1ea496..d54d7476a 100644 --- a/apparmor.d/groups/gnome/gnome-user-share-webdav +++ b/apparmor.d/groups/gnome/gnome-user-share-webdav @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gnome-weather b/apparmor.d/groups/gnome/gnome-weather index a49fe97bd..11e75cb2a 100644 --- a/apparmor.d/groups/gnome/gnome-weather +++ b/apparmor.d/groups/gnome/gnome-weather @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/goa-daemon b/apparmor.d/groups/gnome/goa-daemon index 968bf154a..8176d6c7c 100644 --- a/apparmor.d/groups/gnome/goa-daemon +++ b/apparmor.d/groups/gnome/goa-daemon @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/goa-identity-service b/apparmor.d/groups/gnome/goa-identity-service index cf62b5f50..3992811c2 100644 --- a/apparmor.d/groups/gnome/goa-identity-service +++ b/apparmor.d/groups/gnome/goa-identity-service @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-a11y-settings b/apparmor.d/groups/gnome/gsd-a11y-settings index f9d3804c7..86ca1bbf2 100644 --- a/apparmor.d/groups/gnome/gsd-a11y-settings +++ b/apparmor.d/groups/gnome/gsd-a11y-settings @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 8d77f6cb2..3f4895dbd 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-datetime b/apparmor.d/groups/gnome/gsd-datetime index db829825b..b7a3e4bcb 100644 --- a/apparmor.d/groups/gnome/gsd-datetime +++ b/apparmor.d/groups/gnome/gsd-datetime @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-disk-utility-notify b/apparmor.d/groups/gnome/gsd-disk-utility-notify index d1e65865f..55e6b3736 100644 --- a/apparmor.d/groups/gnome/gsd-disk-utility-notify +++ b/apparmor.d/groups/gnome/gsd-disk-utility-notify @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index 7194b7a2b..f7d0f51ad 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-keyboard b/apparmor.d/groups/gnome/gsd-keyboard index d621a43ae..baac36f87 100644 --- a/apparmor.d/groups/gnome/gsd-keyboard +++ b/apparmor.d/groups/gnome/gsd-keyboard @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index dc6e8aeb7..6fee16f5c 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 9a197e5bf..452d18afd 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index b684c0c7c..bb047e917 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-printer b/apparmor.d/groups/gnome/gsd-printer index 9db9abb09..4c485e172 100644 --- a/apparmor.d/groups/gnome/gsd-printer +++ b/apparmor.d/groups/gnome/gsd-printer @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-rfkill b/apparmor.d/groups/gnome/gsd-rfkill index 456361e88..c7eb53e60 100644 --- a/apparmor.d/groups/gnome/gsd-rfkill +++ b/apparmor.d/groups/gnome/gsd-rfkill @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-screensaver-proxy b/apparmor.d/groups/gnome/gsd-screensaver-proxy index e0d3dc1b0..8115ca01b 100644 --- a/apparmor.d/groups/gnome/gsd-screensaver-proxy +++ b/apparmor.d/groups/gnome/gsd-screensaver-proxy @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-sharing b/apparmor.d/groups/gnome/gsd-sharing index 83a444c7d..a2fdf107a 100644 --- a/apparmor.d/groups/gnome/gsd-sharing +++ b/apparmor.d/groups/gnome/gsd-sharing @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index 0f04ae120..9cda7f5d3 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-sound b/apparmor.d/groups/gnome/gsd-sound index ea063aeda..ae4844956 100644 --- a/apparmor.d/groups/gnome/gsd-sound +++ b/apparmor.d/groups/gnome/gsd-sound @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-usb-protection b/apparmor.d/groups/gnome/gsd-usb-protection index 4db37cb0a..2359c9f39 100644 --- a/apparmor.d/groups/gnome/gsd-usb-protection +++ b/apparmor.d/groups/gnome/gsd-usb-protection @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-wacom b/apparmor.d/groups/gnome/gsd-wacom index 9b6e13fdb..ff0dc419c 100644 --- a/apparmor.d/groups/gnome/gsd-wacom +++ b/apparmor.d/groups/gnome/gsd-wacom @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-wwan b/apparmor.d/groups/gnome/gsd-wwan index 9c8852055..ab2b2b089 100644 --- a/apparmor.d/groups/gnome/gsd-wwan +++ b/apparmor.d/groups/gnome/gsd-wwan @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index 4b489c259..51bcf2e10 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/kgx b/apparmor.d/groups/gnome/kgx index b704e580b..66a278036 100644 --- a/apparmor.d/groups/gnome/kgx +++ b/apparmor.d/groups/gnome/kgx @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index 56c4a2c5d..fb7bef34a 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index 0a208c6ad..183e6cf4a 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index d7736d7a8..ccaf5d6f7 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index 15a9170cd..2d06a9ab3 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index cb41a046d..921f6aa30 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/session-migration b/apparmor.d/groups/gnome/session-migration index 41c9b28af..d519dca6e 100644 --- a/apparmor.d/groups/gnome/session-migration +++ b/apparmor.d/groups/gnome/session-migration @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 7752d9dd3..a8dc13b19 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index f54f05731..e58f9b982 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/tracker-writeback b/apparmor.d/groups/gnome/tracker-writeback index 426b1be60..a5346b463 100644 --- a/apparmor.d/groups/gnome/tracker-writeback +++ b/apparmor.d/groups/gnome/tracker-writeback @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/tracker-xdg-portal b/apparmor.d/groups/gnome/tracker-xdg-portal index bf612104f..20ed6bdce 100644 --- a/apparmor.d/groups/gnome/tracker-xdg-portal +++ b/apparmor.d/groups/gnome/tracker-xdg-portal @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index e10c0cc22..71d8f7504 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/dirmngr b/apparmor.d/groups/gpg/dirmngr index a0c131bcd..167e8757c 100644 --- a/apparmor.d/groups/gpg/dirmngr +++ b/apparmor.d/groups/gpg/dirmngr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index a7aa93d2b..247c6e4ac 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index b7e00a45d..17e360d09 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/gpg-connect-agent b/apparmor.d/groups/gpg/gpg-connect-agent index 9bf2bf897..d6c88c4fd 100644 --- a/apparmor.d/groups/gpg/gpg-connect-agent +++ b/apparmor.d/groups/gpg/gpg-connect-agent @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/gpgconf b/apparmor.d/groups/gpg/gpgconf index 9537c60c6..61c6cf8de 100644 --- a/apparmor.d/groups/gpg/gpgconf +++ b/apparmor.d/groups/gpg/gpgconf @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/gpgsm b/apparmor.d/groups/gpg/gpgsm index 5bfa3fdf4..364c05f73 100644 --- a/apparmor.d/groups/gpg/gpgsm +++ b/apparmor.d/groups/gpg/gpgsm @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/keyboxd b/apparmor.d/groups/gpg/keyboxd index bf77509fd..cb0046fd6 100644 --- a/apparmor.d/groups/gpg/keyboxd +++ b/apparmor.d/groups/gpg/keyboxd @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gpg/scdaemon b/apparmor.d/groups/gpg/scdaemon index 2160cbea9..e88f34d4b 100644 --- a/apparmor.d/groups/gpg/scdaemon +++ b/apparmor.d/groups/gpg/scdaemon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-bios-setup b/apparmor.d/groups/grub/grub-bios-setup index 44602a4ee..b0d606701 100644 --- a/apparmor.d/groups/grub/grub-bios-setup +++ b/apparmor.d/groups/grub/grub-bios-setup @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-check-signatures b/apparmor.d/groups/grub/grub-check-signatures index 1ab754daf..1a1110091 100644 --- a/apparmor.d/groups/grub/grub-check-signatures +++ b/apparmor.d/groups/grub/grub-check-signatures @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-editenv b/apparmor.d/groups/grub/grub-editenv index 414f12909..6bdc7362a 100644 --- a/apparmor.d/groups/grub/grub-editenv +++ b/apparmor.d/groups/grub/grub-editenv @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-file b/apparmor.d/groups/grub/grub-file index 0c43d739d..6551bd553 100644 --- a/apparmor.d/groups/grub/grub-file +++ b/apparmor.d/groups/grub/grub-file @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-fstest b/apparmor.d/groups/grub/grub-fstest index c8f4d48a8..3819fe890 100644 --- a/apparmor.d/groups/grub/grub-fstest +++ b/apparmor.d/groups/grub/grub-fstest @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-glue-efi b/apparmor.d/groups/grub/grub-glue-efi index 0c2d91173..f72664388 100644 --- a/apparmor.d/groups/grub/grub-glue-efi +++ b/apparmor.d/groups/grub/grub-glue-efi @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-install b/apparmor.d/groups/grub/grub-install index 7902bf02d..83e30cbf6 100644 --- a/apparmor.d/groups/grub/grub-install +++ b/apparmor.d/groups/grub/grub-install @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-kbdcomp b/apparmor.d/groups/grub/grub-kbdcomp index 7c49e93ec..0334bf2f5 100644 --- a/apparmor.d/groups/grub/grub-kbdcomp +++ b/apparmor.d/groups/grub/grub-kbdcomp @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-macbless b/apparmor.d/groups/grub/grub-macbless index 8f73e3807..c2571ea73 100644 --- a/apparmor.d/groups/grub/grub-macbless +++ b/apparmor.d/groups/grub/grub-macbless @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-menulst2cfg b/apparmor.d/groups/grub/grub-menulst2cfg index 826de1e1d..cd2d0121d 100644 --- a/apparmor.d/groups/grub/grub-menulst2cfg +++ b/apparmor.d/groups/grub/grub-menulst2cfg @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index cd9c825f6..2a60d69c5 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkdevicemap b/apparmor.d/groups/grub/grub-mkdevicemap index 0af9aab2d..533f9780b 100644 --- a/apparmor.d/groups/grub/grub-mkdevicemap +++ b/apparmor.d/groups/grub/grub-mkdevicemap @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkfont b/apparmor.d/groups/grub/grub-mkfont index 52d719b38..a1e4b1eff 100644 --- a/apparmor.d/groups/grub/grub-mkfont +++ b/apparmor.d/groups/grub/grub-mkfont @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkimage b/apparmor.d/groups/grub/grub-mkimage index ac5fef3b4..54f8dcc80 100644 --- a/apparmor.d/groups/grub/grub-mkimage +++ b/apparmor.d/groups/grub/grub-mkimage @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mklayout b/apparmor.d/groups/grub/grub-mklayout index 616627f35..11263914b 100644 --- a/apparmor.d/groups/grub/grub-mklayout +++ b/apparmor.d/groups/grub/grub-mklayout @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mknetdir b/apparmor.d/groups/grub/grub-mknetdir index 9bb011422..10aaa77d4 100644 --- a/apparmor.d/groups/grub/grub-mknetdir +++ b/apparmor.d/groups/grub/grub-mknetdir @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkpasswd-pbkdf2 b/apparmor.d/groups/grub/grub-mkpasswd-pbkdf2 index 58b7da49b..45cefcedf 100644 --- a/apparmor.d/groups/grub/grub-mkpasswd-pbkdf2 +++ b/apparmor.d/groups/grub/grub-mkpasswd-pbkdf2 @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkrelpath b/apparmor.d/groups/grub/grub-mkrelpath index 22e0b754a..a60a6aaba 100644 --- a/apparmor.d/groups/grub/grub-mkrelpath +++ b/apparmor.d/groups/grub/grub-mkrelpath @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkrescue b/apparmor.d/groups/grub/grub-mkrescue index 4eee01abf..dfd9ce031 100644 --- a/apparmor.d/groups/grub/grub-mkrescue +++ b/apparmor.d/groups/grub/grub-mkrescue @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mkstandalone b/apparmor.d/groups/grub/grub-mkstandalone index c891fd4bf..8cce05fb9 100644 --- a/apparmor.d/groups/grub/grub-mkstandalone +++ b/apparmor.d/groups/grub/grub-mkstandalone @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-mount b/apparmor.d/groups/grub/grub-mount index a21f427e8..e660069bd 100644 --- a/apparmor.d/groups/grub/grub-mount +++ b/apparmor.d/groups/grub/grub-mount @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-multi-install b/apparmor.d/groups/grub/grub-multi-install index 9360173af..94c4c7e2b 100644 --- a/apparmor.d/groups/grub/grub-multi-install +++ b/apparmor.d/groups/grub/grub-multi-install @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-ntldr-img b/apparmor.d/groups/grub/grub-ntldr-img index 885384b6d..676b16f1b 100644 --- a/apparmor.d/groups/grub/grub-ntldr-img +++ b/apparmor.d/groups/grub/grub-ntldr-img @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-probe b/apparmor.d/groups/grub/grub-probe index d0ef6b78b..80d517deb 100644 --- a/apparmor.d/groups/grub/grub-probe +++ b/apparmor.d/groups/grub/grub-probe @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-reboot b/apparmor.d/groups/grub/grub-reboot index 236a46241..7d94a22af 100644 --- a/apparmor.d/groups/grub/grub-reboot +++ b/apparmor.d/groups/grub/grub-reboot @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-render-label b/apparmor.d/groups/grub/grub-render-label index 005823ffa..5d7c4cfe0 100644 --- a/apparmor.d/groups/grub/grub-render-label +++ b/apparmor.d/groups/grub/grub-render-label @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-script-check b/apparmor.d/groups/grub/grub-script-check index 9cb595834..93b344cf8 100644 --- a/apparmor.d/groups/grub/grub-script-check +++ b/apparmor.d/groups/grub/grub-script-check @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-set-default b/apparmor.d/groups/grub/grub-set-default index 729ff11d9..11c78024b 100644 --- a/apparmor.d/groups/grub/grub-set-default +++ b/apparmor.d/groups/grub/grub-set-default @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-sort-version b/apparmor.d/groups/grub/grub-sort-version index bea282862..5e65fe835 100644 --- a/apparmor.d/groups/grub/grub-sort-version +++ b/apparmor.d/groups/grub/grub-sort-version @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/grub-syslinux2cfg b/apparmor.d/groups/grub/grub-syslinux2cfg index 581ab262b..584e33268 100644 --- a/apparmor.d/groups/grub/grub-syslinux2cfg +++ b/apparmor.d/groups/grub/grub-syslinux2cfg @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/grub/update-grub b/apparmor.d/groups/grub/update-grub index e74f72349..03df05295 100644 --- a/apparmor.d/groups/grub/update-grub +++ b/apparmor.d/groups/grub/update-grub @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor index 0b35916b0..a681f2626 100644 --- a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor index 66681c8af..1e65e2183 100644 --- a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor index 5b21c3a6b..a8d7ffb35 100644 --- a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor index dfdf41113..d71b71523 100644 --- a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor index 477354574..ccbe15fd1 100644 --- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd b/apparmor.d/groups/gvfs/gvfsd index c31c1038f..c5c4dc3c1 100644 --- a/apparmor.d/groups/gvfs/gvfsd +++ b/apparmor.d/groups/gvfs/gvfsd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-admin b/apparmor.d/groups/gvfs/gvfsd-admin index 34e4cdfd6..7a1584d48 100644 --- a/apparmor.d/groups/gvfs/gvfsd-admin +++ b/apparmor.d/groups/gvfs/gvfsd-admin @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-afc b/apparmor.d/groups/gvfs/gvfsd-afc index 6054f50b8..68d4b689e 100644 --- a/apparmor.d/groups/gvfs/gvfsd-afc +++ b/apparmor.d/groups/gvfs/gvfsd-afc @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-afp b/apparmor.d/groups/gvfs/gvfsd-afp index 1ea7c14b8..eeaaec059 100644 --- a/apparmor.d/groups/gvfs/gvfsd-afp +++ b/apparmor.d/groups/gvfs/gvfsd-afp @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-afp-browse b/apparmor.d/groups/gvfs/gvfsd-afp-browse index 8baf49101..48680f12f 100644 --- a/apparmor.d/groups/gvfs/gvfsd-afp-browse +++ b/apparmor.d/groups/gvfs/gvfsd-afp-browse @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-archive b/apparmor.d/groups/gvfs/gvfsd-archive index 4c860fe45..918841320 100644 --- a/apparmor.d/groups/gvfs/gvfsd-archive +++ b/apparmor.d/groups/gvfs/gvfsd-archive @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-burn b/apparmor.d/groups/gvfs/gvfsd-burn index 4063141d4..b70fa7110 100644 --- a/apparmor.d/groups/gvfs/gvfsd-burn +++ b/apparmor.d/groups/gvfs/gvfsd-burn @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-cdda b/apparmor.d/groups/gvfs/gvfsd-cdda index dc69cea53..0648f5dc0 100644 --- a/apparmor.d/groups/gvfs/gvfsd-cdda +++ b/apparmor.d/groups/gvfs/gvfsd-cdda @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-computer b/apparmor.d/groups/gvfs/gvfsd-computer index b1479d780..e756c8440 100644 --- a/apparmor.d/groups/gvfs/gvfsd-computer +++ b/apparmor.d/groups/gvfs/gvfsd-computer @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-dav b/apparmor.d/groups/gvfs/gvfsd-dav index bb86dd7db..77e1a2f6f 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dav +++ b/apparmor.d/groups/gvfs/gvfsd-dav @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-dnssd b/apparmor.d/groups/gvfs/gvfsd-dnssd index 1bad8c349..2f3b8d8f2 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dnssd +++ b/apparmor.d/groups/gvfs/gvfsd-dnssd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-ftp b/apparmor.d/groups/gvfs/gvfsd-ftp index 47b58d639..5b7c833a5 100644 --- a/apparmor.d/groups/gvfs/gvfsd-ftp +++ b/apparmor.d/groups/gvfs/gvfsd-ftp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-fuse b/apparmor.d/groups/gvfs/gvfsd-fuse index b49ad1d90..375040ec3 100644 --- a/apparmor.d/groups/gvfs/gvfsd-fuse +++ b/apparmor.d/groups/gvfs/gvfsd-fuse @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-google b/apparmor.d/groups/gvfs/gvfsd-google index b6aa722e7..eb80f3a7a 100644 --- a/apparmor.d/groups/gvfs/gvfsd-google +++ b/apparmor.d/groups/gvfs/gvfsd-google @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-gphoto2 b/apparmor.d/groups/gvfs/gvfsd-gphoto2 index 731bdd204..688f03c27 100644 --- a/apparmor.d/groups/gvfs/gvfsd-gphoto2 +++ b/apparmor.d/groups/gvfs/gvfsd-gphoto2 @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-http b/apparmor.d/groups/gvfs/gvfsd-http index a2d02063c..2fe0a1e2b 100644 --- a/apparmor.d/groups/gvfs/gvfsd-http +++ b/apparmor.d/groups/gvfs/gvfsd-http @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-localtest b/apparmor.d/groups/gvfs/gvfsd-localtest index da0a21386..5ffbabb40 100644 --- a/apparmor.d/groups/gvfs/gvfsd-localtest +++ b/apparmor.d/groups/gvfs/gvfsd-localtest @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-metadata b/apparmor.d/groups/gvfs/gvfsd-metadata index 6237715a8..902bbf40e 100644 --- a/apparmor.d/groups/gvfs/gvfsd-metadata +++ b/apparmor.d/groups/gvfs/gvfsd-metadata @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-mtp b/apparmor.d/groups/gvfs/gvfsd-mtp index a5a4c8ce2..3c747b8b3 100644 --- a/apparmor.d/groups/gvfs/gvfsd-mtp +++ b/apparmor.d/groups/gvfs/gvfsd-mtp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-network b/apparmor.d/groups/gvfs/gvfsd-network index 8fc843290..87851fc16 100644 --- a/apparmor.d/groups/gvfs/gvfsd-network +++ b/apparmor.d/groups/gvfs/gvfsd-network @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-nfs b/apparmor.d/groups/gvfs/gvfsd-nfs index 0a2ab4d1c..575d9de39 100644 --- a/apparmor.d/groups/gvfs/gvfsd-nfs +++ b/apparmor.d/groups/gvfs/gvfsd-nfs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-recent b/apparmor.d/groups/gvfs/gvfsd-recent index 9509d3184..38819e872 100644 --- a/apparmor.d/groups/gvfs/gvfsd-recent +++ b/apparmor.d/groups/gvfs/gvfsd-recent @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-sftp b/apparmor.d/groups/gvfs/gvfsd-sftp index 05c8a2bbf..cabee57c2 100644 --- a/apparmor.d/groups/gvfs/gvfsd-sftp +++ b/apparmor.d/groups/gvfs/gvfsd-sftp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-smb b/apparmor.d/groups/gvfs/gvfsd-smb index 4eb770986..24891e9c3 100644 --- a/apparmor.d/groups/gvfs/gvfsd-smb +++ b/apparmor.d/groups/gvfs/gvfsd-smb @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-smb-browse b/apparmor.d/groups/gvfs/gvfsd-smb-browse index 3882e6f1c..f285a3c15 100644 --- a/apparmor.d/groups/gvfs/gvfsd-smb-browse +++ b/apparmor.d/groups/gvfs/gvfsd-smb-browse @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-trash b/apparmor.d/groups/gvfs/gvfsd-trash index d65edb691..683d271a8 100644 --- a/apparmor.d/groups/gvfs/gvfsd-trash +++ b/apparmor.d/groups/gvfs/gvfsd-trash @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/gvfs/gvfsd-wsdd b/apparmor.d/groups/gvfs/gvfsd-wsdd index b2ff47c91..f971b5f6a 100644 --- a/apparmor.d/groups/gvfs/gvfsd-wsdd +++ b/apparmor.d/groups/gvfs/gvfsd-wsdd @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/hyprland/hyprctl b/apparmor.d/groups/hyprland/hyprctl index f7d41d484..96440098e 100644 --- a/apparmor.d/groups/hyprland/hyprctl +++ b/apparmor.d/groups/hyprland/hyprctl @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 44bed0cdd..136ebabb0 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/hyprland/hyprlock b/apparmor.d/groups/hyprland/hyprlock index 9459018ef..b17c0c66a 100644 --- a/apparmor.d/groups/hyprland/hyprlock +++ b/apparmor.d/groups/hyprland/hyprlock @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/hyprland/hyprpaper b/apparmor.d/groups/hyprland/hyprpaper index 1005ee8f1..3cb8dca92 100644 --- a/apparmor.d/groups/hyprland/hyprpaper +++ b/apparmor.d/groups/hyprland/hyprpaper @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/hyprland/hyprpicker b/apparmor.d/groups/hyprland/hyprpicker index 77edc07dc..38eccd297 100644 --- a/apparmor.d/groups/hyprland/hyprpicker +++ b/apparmor.d/groups/hyprland/hyprpicker @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/hyprland/hyprpm b/apparmor.d/groups/hyprland/hyprpm index 5f5ce4c66..3a5878808 100644 --- a/apparmor.d/groups/hyprland/hyprpm +++ b/apparmor.d/groups/hyprland/hyprpm @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 5f293a9e1..197f90f88 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index 0b1ee4fa4..aa67ba5f5 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/baloorunner b/apparmor.d/groups/kde/baloorunner index 894c2cb7b..e3fca1f8f 100644 --- a/apparmor.d/groups/kde/baloorunner +++ b/apparmor.d/groups/kde/baloorunner @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 577cdd085..8465da560 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/drkonqi b/apparmor.d/groups/kde/drkonqi index d096c9ba8..961c18cfe 100644 --- a/apparmor.d/groups/kde/drkonqi +++ b/apparmor.d/groups/kde/drkonqi @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/drkonqi-coredump-cleanup b/apparmor.d/groups/kde/drkonqi-coredump-cleanup index fe2fd0566..c74276b95 100644 --- a/apparmor.d/groups/kde/drkonqi-coredump-cleanup +++ b/apparmor.d/groups/kde/drkonqi-coredump-cleanup @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/drkonqi-coredump-processor b/apparmor.d/groups/kde/drkonqi-coredump-processor index f014b671b..e07a6c1d4 100644 --- a/apparmor.d/groups/kde/drkonqi-coredump-processor +++ b/apparmor.d/groups/kde/drkonqi-coredump-processor @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/gmenudbusmenuproxy b/apparmor.d/groups/kde/gmenudbusmenuproxy index c1a63931e..1d85b3a6b 100644 --- a/apparmor.d/groups/kde/gmenudbusmenuproxy +++ b/apparmor.d/groups/kde/gmenudbusmenuproxy @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index e9ed1399d..42c1400ef 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index 8fccca289..fdc0730c4 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index 97bdef983..661090bc1 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kauth-backlighthelper b/apparmor.d/groups/kde/kauth-backlighthelper index 9b42d9a10..61308e83b 100644 --- a/apparmor.d/groups/kde/kauth-backlighthelper +++ b/apparmor.d/groups/kde/kauth-backlighthelper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kauth-chargethresholdhelper b/apparmor.d/groups/kde/kauth-chargethresholdhelper index 29dfe216b..44a6d0239 100644 --- a/apparmor.d/groups/kde/kauth-chargethresholdhelper +++ b/apparmor.d/groups/kde/kauth-chargethresholdhelper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kauth-discretegpuhelper b/apparmor.d/groups/kde/kauth-discretegpuhelper index 98e6614b8..f03dfb007 100644 --- a/apparmor.d/groups/kde/kauth-discretegpuhelper +++ b/apparmor.d/groups/kde/kauth-discretegpuhelper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kauth-fontinst b/apparmor.d/groups/kde/kauth-fontinst index 3a9c21b7b..d05975eac 100644 --- a/apparmor.d/groups/kde/kauth-fontinst +++ b/apparmor.d/groups/kde/kauth-fontinst @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kauth-kded-smart-helper b/apparmor.d/groups/kde/kauth-kded-smart-helper index fa1345d74..6483fe39f 100644 --- a/apparmor.d/groups/kde/kauth-kded-smart-helper +++ b/apparmor.d/groups/kde/kauth-kded-smart-helper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kauth-kinfocenter-dmidecode-helper b/apparmor.d/groups/kde/kauth-kinfocenter-dmidecode-helper index a172c3404..5ae1f5f12 100644 --- a/apparmor.d/groups/kde/kauth-kinfocenter-dmidecode-helper +++ b/apparmor.d/groups/kde/kauth-kinfocenter-dmidecode-helper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kbuildsycoca b/apparmor.d/groups/kde/kbuildsycoca index beb235536..db3aed9dc 100644 --- a/apparmor.d/groups/kde/kbuildsycoca +++ b/apparmor.d/groups/kde/kbuildsycoca @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kcminit b/apparmor.d/groups/kde/kcminit index 95fdd6e63..93378bf76 100644 --- a/apparmor.d/groups/kde/kcminit +++ b/apparmor.d/groups/kde/kcminit @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kconf_update b/apparmor.d/groups/kde/kconf_update index ce11fb914..d699f9d59 100644 --- a/apparmor.d/groups/kde/kconf_update +++ b/apparmor.d/groups/kde/kconf_update @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 3a24b3db8..5af21ae75 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kde-systemd-start-condition b/apparmor.d/groups/kde/kde-systemd-start-condition index 31367f47c..efec3a8a6 100644 --- a/apparmor.d/groups/kde/kde-systemd-start-condition +++ b/apparmor.d/groups/kde/kde-systemd-start-condition @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index f93144c5f..c14ba7e98 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index 4d2616e3e..9da19046d 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kio_http_cache_cleaner b/apparmor.d/groups/kde/kio_http_cache_cleaner index fa3f494c7..dc1b28dcc 100644 --- a/apparmor.d/groups/kde/kio_http_cache_cleaner +++ b/apparmor.d/groups/kde/kio_http_cache_cleaner @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kiod b/apparmor.d/groups/kde/kiod index d83749455..f6a7ba95a 100644 --- a/apparmor.d/groups/kde/kiod +++ b/apparmor.d/groups/kde/kiod @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 5bd01bb15..37dd3eeae 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 164510ae7..17ed13f27 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kreadconfig b/apparmor.d/groups/kde/kreadconfig index 4dbe69f9d..8ad9c4b5b 100644 --- a/apparmor.d/groups/kde/kreadconfig +++ b/apparmor.d/groups/kde/kreadconfig @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kscreen_backend_launcher b/apparmor.d/groups/kde/kscreen_backend_launcher index 94890bacc..5e09b0cbe 100644 --- a/apparmor.d/groups/kde/kscreen_backend_launcher +++ b/apparmor.d/groups/kde/kscreen_backend_launcher @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kscreen_osd_service b/apparmor.d/groups/kde/kscreen_osd_service index cafd59a67..8bff3306f 100644 --- a/apparmor.d/groups/kde/kscreen_osd_service +++ b/apparmor.d/groups/kde/kscreen_osd_service @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index b67fe50f1..79e2b4c59 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index f36d8f2f2..3f95292f6 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/ksmserver-logout-greeter b/apparmor.d/groups/kde/ksmserver-logout-greeter index 55379861e..01fe51783 100644 --- a/apparmor.d/groups/kde/ksmserver-logout-greeter +++ b/apparmor.d/groups/kde/ksmserver-logout-greeter @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/ksplashqml b/apparmor.d/groups/kde/ksplashqml index 8b878457b..be59fe842 100644 --- a/apparmor.d/groups/kde/ksplashqml +++ b/apparmor.d/groups/kde/ksplashqml @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kstart b/apparmor.d/groups/kde/kstart index 6aefc1d43..fa0f88f75 100644 --- a/apparmor.d/groups/kde/kstart +++ b/apparmor.d/groups/kde/kstart @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index 282f4231b..c4e25e9ff 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kwalletmanager b/apparmor.d/groups/kde/kwalletmanager index a5c5ddfef..dc64cbb9e 100644 --- a/apparmor.d/groups/kde/kwalletmanager +++ b/apparmor.d/groups/kde/kwalletmanager @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 162f2cfc3..0bd53e3a6 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kwin_wayland_wrapper b/apparmor.d/groups/kde/kwin_wayland_wrapper index f28106373..1a7573d77 100644 --- a/apparmor.d/groups/kde/kwin_wayland_wrapper +++ b/apparmor.d/groups/kde/kwin_wayland_wrapper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index 0454e70e1..e05e443ff 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index a27751eb4..f7f168364 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/pam_kwallet_init b/apparmor.d/groups/kde/pam_kwallet_init index b84407863..764917a1f 100644 --- a/apparmor.d/groups/kde/pam_kwallet_init +++ b/apparmor.d/groups/kde/pam_kwallet_init @@ -2,7 +2,7 @@ # Copyright (C) 2023 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/plasma-browser-integration-host b/apparmor.d/groups/kde/plasma-browser-integration-host index bcf1af528..dce3545f7 100644 --- a/apparmor.d/groups/kde/plasma-browser-integration-host +++ b/apparmor.d/groups/kde/plasma-browser-integration-host @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/plasma-discover b/apparmor.d/groups/kde/plasma-discover index e94fd036e..1247d0fdf 100644 --- a/apparmor.d/groups/kde/plasma-discover +++ b/apparmor.d/groups/kde/plasma-discover @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/plasma-emojier b/apparmor.d/groups/kde/plasma-emojier index 3862706a9..ba00660fc 100644 --- a/apparmor.d/groups/kde/plasma-emojier +++ b/apparmor.d/groups/kde/plasma-emojier @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/plasma_session b/apparmor.d/groups/kde/plasma_session index 172c643c7..1fbeda384 100644 --- a/apparmor.d/groups/kde/plasma_session +++ b/apparmor.d/groups/kde/plasma_session @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/plasma_waitforname b/apparmor.d/groups/kde/plasma_waitforname index 432c49ac3..a509135af 100644 --- a/apparmor.d/groups/kde/plasma_waitforname +++ b/apparmor.d/groups/kde/plasma_waitforname @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 954431f86..89e0dfeae 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 5030d18f4..7f48fbec0 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index 6f33e233a..54284f03a 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession index 3e566b458..b5cceee95 100644 --- a/apparmor.d/groups/kde/sddm-xsession +++ b/apparmor.d/groups/kde/sddm-xsession @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index c0cd5690c..e78464253 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index c17a34e59..e68d248b6 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/utempter b/apparmor.d/groups/kde/utempter index 1ff12062f..309b9c444 100644 --- a/apparmor.d/groups/kde/utempter +++ b/apparmor.d/groups/kde/utempter @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/wayland-session b/apparmor.d/groups/kde/wayland-session index b9e7cf4fc..124cf2fda 100644 --- a/apparmor.d/groups/kde/wayland-session +++ b/apparmor.d/groups/kde/wayland-session @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index a4474a64a..dc6b215f2 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/xsettingsd b/apparmor.d/groups/kde/xsettingsd index 7e422a3d0..7cebbb43c 100644 --- a/apparmor.d/groups/kde/xsettingsd +++ b/apparmor.d/groups/kde/xsettingsd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/kde/xwaylandvideobridge b/apparmor.d/groups/kde/xwaylandvideobridge index 0f6aeb48a..889018a13 100644 --- a/apparmor.d/groups/kde/xwaylandvideobridge +++ b/apparmor.d/groups/kde/xwaylandvideobridge @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index 06e0c0fe5..9a780107b 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 50614a60a..ff317ec94 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/dhcpcd b/apparmor.d/groups/network/dhcpcd index 79b7283eb..6d4ea3f7e 100644 --- a/apparmor.d/groups/network/dhcpcd +++ b/apparmor.d/groups/network/dhcpcd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/iwctl b/apparmor.d/groups/network/iwctl index 3ccafc80a..0b5bd090e 100644 --- a/apparmor.d/groups/network/iwctl +++ b/apparmor.d/groups/network/iwctl @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/iwd b/apparmor.d/groups/network/iwd index a80a4c37a..c6dda71ad 100644 --- a/apparmor.d/groups/network/iwd +++ b/apparmor.d/groups/network/iwd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index a57213481..fd43bc33b 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index 91cfaab0f..b5346964c 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/netplan.script b/apparmor.d/groups/network/netplan.script index c9cc3fff7..53297493e 100644 --- a/apparmor.d/groups/network/netplan.script +++ b/apparmor.d/groups/network/netplan.script @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/networkd-dispatcher b/apparmor.d/groups/network/networkd-dispatcher index 361cf8d3b..de8f9ccb0 100644 --- a/apparmor.d/groups/network/networkd-dispatcher +++ b/apparmor.d/groups/network/networkd-dispatcher @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-daemon-helper b/apparmor.d/groups/network/nm-daemon-helper index f8d262a44..7d16292f2 100644 --- a/apparmor.d/groups/network/nm-daemon-helper +++ b/apparmor.d/groups/network/nm-daemon-helper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-dhcp-helper b/apparmor.d/groups/network/nm-dhcp-helper index 434dce19f..5e93bdbf5 100644 --- a/apparmor.d/groups/network/nm-dhcp-helper +++ b/apparmor.d/groups/network/nm-dhcp-helper @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-dispatcher b/apparmor.d/groups/network/nm-dispatcher index 1a82fdbf5..40984f7fa 100644 --- a/apparmor.d/groups/network/nm-dispatcher +++ b/apparmor.d/groups/network/nm-dispatcher @@ -4,7 +4,7 @@ # TODO: rethink how the scripts should be managed -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-iface-helper b/apparmor.d/groups/network/nm-iface-helper index 36fa1ca30..c74379698 100644 --- a/apparmor.d/groups/network/nm-iface-helper +++ b/apparmor.d/groups/network/nm-iface-helper @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-initrd-generator b/apparmor.d/groups/network/nm-initrd-generator index 095347370..611587547 100644 --- a/apparmor.d/groups/network/nm-initrd-generator +++ b/apparmor.d/groups/network/nm-initrd-generator @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-online b/apparmor.d/groups/network/nm-online index 159b890d1..144fd84cb 100644 --- a/apparmor.d/groups/network/nm-online +++ b/apparmor.d/groups/network/nm-online @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-openvpn-auth-dialog b/apparmor.d/groups/network/nm-openvpn-auth-dialog index 854614345..87e3e4f40 100644 --- a/apparmor.d/groups/network/nm-openvpn-auth-dialog +++ b/apparmor.d/groups/network/nm-openvpn-auth-dialog @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-openvpn-service b/apparmor.d/groups/network/nm-openvpn-service index d65aa8f1a..675c14679 100644 --- a/apparmor.d/groups/network/nm-openvpn-service +++ b/apparmor.d/groups/network/nm-openvpn-service @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-openvpn-service-openvpn-helper b/apparmor.d/groups/network/nm-openvpn-service-openvpn-helper index 130067a76..b2f4ca0e3 100644 --- a/apparmor.d/groups/network/nm-openvpn-service-openvpn-helper +++ b/apparmor.d/groups/network/nm-openvpn-service-openvpn-helper @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nm-priv-helper b/apparmor.d/groups/network/nm-priv-helper index e07c9f685..13a283c52 100644 --- a/apparmor.d/groups/network/nm-priv-helper +++ b/apparmor.d/groups/network/nm-priv-helper @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/nmcli b/apparmor.d/groups/network/nmcli index 6c9a13203..a964ab958 100644 --- a/apparmor.d/groups/network/nmcli +++ b/apparmor.d/groups/network/nmcli @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index e94315846..3e6a1cb55 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -18,7 +18,7 @@ # If a user wants to type user/pass interactively, systemd-ask-password is # invoked for that. -abi , +abi , include diff --git a/apparmor.d/groups/network/rpcbind b/apparmor.d/groups/network/rpcbind index 049605f97..f9dcac8d1 100644 --- a/apparmor.d/groups/network/rpcbind +++ b/apparmor.d/groups/network/rpcbind @@ -2,7 +2,7 @@ # Copyright (C) 2023 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/socat b/apparmor.d/groups/network/socat index 8ffa2f9bf..25f975d25 100644 --- a/apparmor.d/groups/network/socat +++ b/apparmor.d/groups/network/socat @@ -3,7 +3,7 @@ # Copyright (C) 2024 Nishit Majithia (nishitm) # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/tailscale b/apparmor.d/groups/network/tailscale index 37029973b..4e5bba684 100644 --- a/apparmor.d/groups/network/tailscale +++ b/apparmor.d/groups/network/tailscale @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index b59c668b8..7bab28a22 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/wg b/apparmor.d/groups/network/wg index 2ddaee94c..781a52f7a 100644 --- a/apparmor.d/groups/network/wg +++ b/apparmor.d/groups/network/wg @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/network/wg-quick b/apparmor.d/groups/network/wg-quick index 89d89162a..c7ea6b1bd 100644 --- a/apparmor.d/groups/network/wg-quick +++ b/apparmor.d/groups/network/wg-quick @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/arch-audit b/apparmor.d/groups/pacman/arch-audit index ba4987a31..b8c622c6e 100644 --- a/apparmor.d/groups/pacman/arch-audit +++ b/apparmor.d/groups/pacman/arch-audit @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/archlinux-java b/apparmor.d/groups/pacman/archlinux-java index 5a78db048..e6728a606 100644 --- a/apparmor.d/groups/pacman/archlinux-java +++ b/apparmor.d/groups/pacman/archlinux-java @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync b/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync index dab6a2edd..014073443 100644 --- a/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync +++ b/apparmor.d/groups/pacman/archlinux-keyring-wkd-sync @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/aurpublish b/apparmor.d/groups/pacman/aurpublish index cae1d7dca..82f935dcb 100644 --- a/apparmor.d/groups/pacman/aurpublish +++ b/apparmor.d/groups/pacman/aurpublish @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 2c72da3b0..12ead7ce8 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index 0598b5d64..a9902e54b 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/paccache b/apparmor.d/groups/pacman/paccache index 3089b2f3e..f537afdb3 100644 --- a/apparmor.d/groups/pacman/paccache +++ b/apparmor.d/groups/pacman/paccache @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacdiff b/apparmor.d/groups/pacman/pacdiff index 417e48504..e2a0f2609 100644 --- a/apparmor.d/groups/pacman/pacdiff +++ b/apparmor.d/groups/pacman/pacdiff @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 48778d6e4..1c7015b1f 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-conf b/apparmor.d/groups/pacman/pacman-conf index ebf99cbff..b57ab746d 100644 --- a/apparmor.d/groups/pacman/pacman-conf +++ b/apparmor.d/groups/pacman/pacman-conf @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-code b/apparmor.d/groups/pacman/pacman-hook-code index 39389f42f..3a6bbd7fe 100644 --- a/apparmor.d/groups/pacman/pacman-hook-code +++ b/apparmor.d/groups/pacman/pacman-hook-code @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-dconf b/apparmor.d/groups/pacman/pacman-hook-dconf index 91e3b367d..b5a330d75 100644 --- a/apparmor.d/groups/pacman/pacman-hook-dconf +++ b/apparmor.d/groups/pacman/pacman-hook-dconf @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-depmod b/apparmor.d/groups/pacman/pacman-hook-depmod index c54523d86..45336a100 100644 --- a/apparmor.d/groups/pacman/pacman-hook-depmod +++ b/apparmor.d/groups/pacman/pacman-hook-depmod @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-dkms b/apparmor.d/groups/pacman/pacman-hook-dkms index fd449cd10..a039db414 100644 --- a/apparmor.d/groups/pacman/pacman-hook-dkms +++ b/apparmor.d/groups/pacman/pacman-hook-dkms @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-fontconfig b/apparmor.d/groups/pacman/pacman-hook-fontconfig index 8068d83dc..de0d33e16 100644 --- a/apparmor.d/groups/pacman/pacman-hook-fontconfig +++ b/apparmor.d/groups/pacman/pacman-hook-fontconfig @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-gio b/apparmor.d/groups/pacman/pacman-hook-gio index dcbfe6e28..5aa612a3c 100644 --- a/apparmor.d/groups/pacman/pacman-hook-gio +++ b/apparmor.d/groups/pacman/pacman-hook-gio @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-gtk b/apparmor.d/groups/pacman/pacman-hook-gtk index d75527d79..ce7b931ca 100644 --- a/apparmor.d/groups/pacman/pacman-hook-gtk +++ b/apparmor.d/groups/pacman/pacman-hook-gtk @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules b/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules index 54a002506..a0be0e39b 100644 --- a/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules +++ b/apparmor.d/groups/pacman/pacman-hook-gtk4-querymodules @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio index 178cee539..09529cbb0 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove index 8d26de0b4..7c0006153 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-perl b/apparmor.d/groups/pacman/pacman-hook-perl index 894ba266c..1254f97e2 100644 --- a/apparmor.d/groups/pacman/pacman-hook-perl +++ b/apparmor.d/groups/pacman/pacman-hook-perl @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-hook-systemd b/apparmor.d/groups/pacman/pacman-hook-systemd index f704f5ddb..3a4bd0eb3 100644 --- a/apparmor.d/groups/pacman/pacman-hook-systemd +++ b/apparmor.d/groups/pacman/pacman-hook-systemd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/pacman-key b/apparmor.d/groups/pacman/pacman-key index a8fb360cd..728bd84d2 100644 --- a/apparmor.d/groups/pacman/pacman-key +++ b/apparmor.d/groups/pacman/pacman-key @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/reflector b/apparmor.d/groups/pacman/reflector index 135a5bdf3..588c39ccc 100644 --- a/apparmor.d/groups/pacman/reflector +++ b/apparmor.d/groups/pacman/reflector @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/pacman/yay b/apparmor.d/groups/pacman/yay index 8f3dede75..32ac11d7e 100644 --- a/apparmor.d/groups/pacman/yay +++ b/apparmor.d/groups/pacman/yay @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ssh/sftp-server b/apparmor.d/groups/ssh/sftp-server index 672d9b5e5..3deddb092 100644 --- a/apparmor.d/groups/ssh/sftp-server +++ b/apparmor.d/groups/ssh/sftp-server @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 5dce3ec80..69f594f7a 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ssh/ssh-agent b/apparmor.d/groups/ssh/ssh-agent index 174efb5a4..72d6618e6 100644 --- a/apparmor.d/groups/ssh/ssh-agent +++ b/apparmor.d/groups/ssh/ssh-agent @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ssh/ssh-agent-launch b/apparmor.d/groups/ssh/ssh-agent-launch index a243069c0..34b1ea1dc 100644 --- a/apparmor.d/groups/ssh/ssh-agent-launch +++ b/apparmor.d/groups/ssh/ssh-agent-launch @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index f31ac1195..af43fb046 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 3746c4261..29cc38432 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -11,7 +11,7 @@ # If you want real protection disallow SSH access. -abi , +abi , include diff --git a/apparmor.d/groups/ssh/sshfs b/apparmor.d/groups/ssh/sshfs index 7623cd87a..a367b0f7a 100644 --- a/apparmor.d/groups/ssh/sshfs +++ b/apparmor.d/groups/ssh/sshfs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index 4a5d4d832..c59284e72 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index 64396608f..d251e9b26 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/coredumpctl b/apparmor.d/groups/systemd/coredumpctl index b291c0493..89a19fa11 100644 --- a/apparmor.d/groups/systemd/coredumpctl +++ b/apparmor.d/groups/systemd/coredumpctl @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/hostnamectl b/apparmor.d/groups/systemd/hostnamectl index 47e7f531e..65e6ed11f 100644 --- a/apparmor.d/groups/systemd/hostnamectl +++ b/apparmor.d/groups/systemd/hostnamectl @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/journalctl b/apparmor.d/groups/systemd/journalctl index 79af65679..6020f60fa 100644 --- a/apparmor.d/groups/systemd/journalctl +++ b/apparmor.d/groups/systemd/journalctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/localectl b/apparmor.d/groups/systemd/localectl index 3ab09cfca..2cac865a4 100644 --- a/apparmor.d/groups/systemd/localectl +++ b/apparmor.d/groups/systemd/localectl @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/loginctl b/apparmor.d/groups/systemd/loginctl index b5228f222..681d1438e 100644 --- a/apparmor.d/groups/systemd/loginctl +++ b/apparmor.d/groups/systemd/loginctl @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index ae188df5f..dee55195d 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-ac-power b/apparmor.d/groups/systemd/systemd-ac-power index 44cbad98c..1353547f0 100644 --- a/apparmor.d/groups/systemd/systemd-ac-power +++ b/apparmor.d/groups/systemd/systemd-ac-power @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze index 0c3b38d64..09d432b2f 100644 --- a/apparmor.d/groups/systemd/systemd-analyze +++ b/apparmor.d/groups/systemd/systemd-analyze @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-ask-password b/apparmor.d/groups/systemd/systemd-ask-password index 9a5e04306..6eec2ee6b 100644 --- a/apparmor.d/groups/systemd/systemd-ask-password +++ b/apparmor.d/groups/systemd/systemd-ask-password @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-backlight b/apparmor.d/groups/systemd/systemd-backlight index 066dbf33e..f67cb301c 100644 --- a/apparmor.d/groups/systemd/systemd-backlight +++ b/apparmor.d/groups/systemd/systemd-backlight @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-binfmt b/apparmor.d/groups/systemd/systemd-binfmt index 8fae04706..d34bbe4cb 100644 --- a/apparmor.d/groups/systemd/systemd-binfmt +++ b/apparmor.d/groups/systemd/systemd-binfmt @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-cat b/apparmor.d/groups/systemd/systemd-cat index 0ccfd68c0..967d776d2 100644 --- a/apparmor.d/groups/systemd/systemd-cat +++ b/apparmor.d/groups/systemd/systemd-cat @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-cgls b/apparmor.d/groups/systemd/systemd-cgls index e58fec015..d0ded5ee7 100644 --- a/apparmor.d/groups/systemd/systemd-cgls +++ b/apparmor.d/groups/systemd/systemd-cgls @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-cgtop b/apparmor.d/groups/systemd/systemd-cgtop index cd0f1e416..90ecc99f8 100644 --- a/apparmor.d/groups/systemd/systemd-cgtop +++ b/apparmor.d/groups/systemd/systemd-cgtop @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 1902c6799..8c90be6f6 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-cryptsetup b/apparmor.d/groups/systemd/systemd-cryptsetup index 6ca3e3237..5e4b33a12 100644 --- a/apparmor.d/groups/systemd/systemd-cryptsetup +++ b/apparmor.d/groups/systemd/systemd-cryptsetup @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-delta b/apparmor.d/groups/systemd/systemd-delta index 9ac4e8239..7cf546a56 100644 --- a/apparmor.d/groups/systemd/systemd-delta +++ b/apparmor.d/groups/systemd/systemd-delta @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-detect-virt b/apparmor.d/groups/systemd/systemd-detect-virt index 63e97171c..35f4afbc4 100644 --- a/apparmor.d/groups/systemd/systemd-detect-virt +++ b/apparmor.d/groups/systemd/systemd-detect-virt @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-dissect b/apparmor.d/groups/systemd/systemd-dissect index 5dc785198..b81b100db 100644 --- a/apparmor.d/groups/systemd/systemd-dissect +++ b/apparmor.d/groups/systemd/systemd-dissect @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-escape b/apparmor.d/groups/systemd/systemd-escape index c292c1d96..0a38bf0fb 100644 --- a/apparmor.d/groups/systemd/systemd-escape +++ b/apparmor.d/groups/systemd/systemd-escape @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-fsck b/apparmor.d/groups/systemd/systemd-fsck index 2d6326d71..a7290dc48 100644 --- a/apparmor.d/groups/systemd/systemd-fsck +++ b/apparmor.d/groups/systemd/systemd-fsck @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-fsckd b/apparmor.d/groups/systemd/systemd-fsckd index 9fc59bfe0..33a433a09 100644 --- a/apparmor.d/groups/systemd/systemd-fsckd +++ b/apparmor.d/groups/systemd/systemd-fsckd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-bless-boot b/apparmor.d/groups/systemd/systemd-generator-bless-boot index e09b01d5a..32e2aac65 100644 --- a/apparmor.d/groups/systemd/systemd-generator-bless-boot +++ b/apparmor.d/groups/systemd/systemd-generator-bless-boot @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-cloud-init b/apparmor.d/groups/systemd/systemd-generator-cloud-init index d57de673b..2737a94f4 100644 --- a/apparmor.d/groups/systemd/systemd-generator-cloud-init +++ b/apparmor.d/groups/systemd/systemd-generator-cloud-init @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-cryptsetup b/apparmor.d/groups/systemd/systemd-generator-cryptsetup index e29178fbd..1979dba1d 100644 --- a/apparmor.d/groups/systemd/systemd-generator-cryptsetup +++ b/apparmor.d/groups/systemd/systemd-generator-cryptsetup @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-debug b/apparmor.d/groups/systemd/systemd-generator-debug index 2d83cc0ba..4ce9d2974 100644 --- a/apparmor.d/groups/systemd/systemd-generator-debug +++ b/apparmor.d/groups/systemd/systemd-generator-debug @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-ds-identify b/apparmor.d/groups/systemd/systemd-generator-ds-identify index b88d2387f..6b42e55ed 100644 --- a/apparmor.d/groups/systemd/systemd-generator-ds-identify +++ b/apparmor.d/groups/systemd/systemd-generator-ds-identify @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-environment-arch b/apparmor.d/groups/systemd/systemd-generator-environment-arch index 6311ad9c4..738144547 100644 --- a/apparmor.d/groups/systemd/systemd-generator-environment-arch +++ b/apparmor.d/groups/systemd/systemd-generator-environment-arch @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-environment-flatpak b/apparmor.d/groups/systemd/systemd-generator-environment-flatpak index e03b70cca..a4ba2afe1 100644 --- a/apparmor.d/groups/systemd/systemd-generator-environment-flatpak +++ b/apparmor.d/groups/systemd/systemd-generator-environment-flatpak @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-fstab b/apparmor.d/groups/systemd/systemd-generator-fstab index a15100300..55736d142 100644 --- a/apparmor.d/groups/systemd/systemd-generator-fstab +++ b/apparmor.d/groups/systemd/systemd-generator-fstab @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-getty b/apparmor.d/groups/systemd/systemd-generator-getty index 92b5a4ffa..0eadabec8 100644 --- a/apparmor.d/groups/systemd/systemd-generator-getty +++ b/apparmor.d/groups/systemd/systemd-generator-getty @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-gpt-auto b/apparmor.d/groups/systemd/systemd-generator-gpt-auto index 613380b43..0d6c09c6b 100644 --- a/apparmor.d/groups/systemd/systemd-generator-gpt-auto +++ b/apparmor.d/groups/systemd/systemd-generator-gpt-auto @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-hibernate-resume b/apparmor.d/groups/systemd/systemd-generator-hibernate-resume index dbfee2fcd..7c5e9ec80 100644 --- a/apparmor.d/groups/systemd/systemd-generator-hibernate-resume +++ b/apparmor.d/groups/systemd/systemd-generator-hibernate-resume @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-integritysetup b/apparmor.d/groups/systemd/systemd-generator-integritysetup index 9eb46a451..72ef28061 100644 --- a/apparmor.d/groups/systemd/systemd-generator-integritysetup +++ b/apparmor.d/groups/systemd/systemd-generator-integritysetup @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-ostree b/apparmor.d/groups/systemd/systemd-generator-ostree index c38e3690b..f50544f81 100644 --- a/apparmor.d/groups/systemd/systemd-generator-ostree +++ b/apparmor.d/groups/systemd/systemd-generator-ostree @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-run b/apparmor.d/groups/systemd/systemd-generator-run index 272073edc..39c8b0fd6 100644 --- a/apparmor.d/groups/systemd/systemd-generator-run +++ b/apparmor.d/groups/systemd/systemd-generator-run @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-system-update b/apparmor.d/groups/systemd/systemd-generator-system-update index f9d09d634..557e4ab6e 100644 --- a/apparmor.d/groups/systemd/systemd-generator-system-update +++ b/apparmor.d/groups/systemd/systemd-generator-system-update @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-user-autostart b/apparmor.d/groups/systemd/systemd-generator-user-autostart index 8ca09d56b..c42548ef5 100644 --- a/apparmor.d/groups/systemd/systemd-generator-user-autostart +++ b/apparmor.d/groups/systemd/systemd-generator-user-autostart @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-user-environment b/apparmor.d/groups/systemd/systemd-generator-user-environment index 420ef84a9..db128405f 100644 --- a/apparmor.d/groups/systemd/systemd-generator-user-environment +++ b/apparmor.d/groups/systemd/systemd-generator-user-environment @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-generator-veritysetup b/apparmor.d/groups/systemd/systemd-generator-veritysetup index a0084a26b..97776312f 100644 --- a/apparmor.d/groups/systemd/systemd-generator-veritysetup +++ b/apparmor.d/groups/systemd/systemd-generator-veritysetup @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-homed b/apparmor.d/groups/systemd/systemd-homed index 2fae7144d..5fe748abd 100644 --- a/apparmor.d/groups/systemd/systemd-homed +++ b/apparmor.d/groups/systemd/systemd-homed @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-homework b/apparmor.d/groups/systemd/systemd-homework index 8dc8a825d..f0fe98a16 100644 --- a/apparmor.d/groups/systemd/systemd-homework +++ b/apparmor.d/groups/systemd/systemd-homework @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index 52e6f0894..04cbbaf5e 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-hwdb b/apparmor.d/groups/systemd/systemd-hwdb index 4ee18fb34..5664cde02 100644 --- a/apparmor.d/groups/systemd/systemd-hwdb +++ b/apparmor.d/groups/systemd/systemd-hwdb @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-id128 b/apparmor.d/groups/systemd/systemd-id128 index afa516e39..f0944db26 100644 --- a/apparmor.d/groups/systemd/systemd-id128 +++ b/apparmor.d/groups/systemd/systemd-id128 @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-inhibit b/apparmor.d/groups/systemd/systemd-inhibit index 01b3e0bcd..2051a5b19 100644 --- a/apparmor.d/groups/systemd/systemd-inhibit +++ b/apparmor.d/groups/systemd/systemd-inhibit @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index 6ac35cb68..a50ed62e3 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index c149f37ee..48318da8f 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index d1fa06e7c..f4628c019 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -3,7 +3,7 @@ # Copyright (C) 2024 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-machine-id-setup b/apparmor.d/groups/systemd/systemd-machine-id-setup index 26e5e5980..105f72e46 100644 --- a/apparmor.d/groups/systemd/systemd-machine-id-setup +++ b/apparmor.d/groups/systemd/systemd-machine-id-setup @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-machined b/apparmor.d/groups/systemd/systemd-machined index cb0eab79b..3a111f7f3 100644 --- a/apparmor.d/groups/systemd/systemd-machined +++ b/apparmor.d/groups/systemd/systemd-machined @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-makefs b/apparmor.d/groups/systemd/systemd-makefs index 05ec6dc34..8556e51d7 100644 --- a/apparmor.d/groups/systemd/systemd-makefs +++ b/apparmor.d/groups/systemd/systemd-makefs @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-modules-load b/apparmor.d/groups/systemd/systemd-modules-load index 4ecbd0acb..abb437f83 100644 --- a/apparmor.d/groups/systemd/systemd-modules-load +++ b/apparmor.d/groups/systemd/systemd-modules-load @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-mount b/apparmor.d/groups/systemd/systemd-mount index a86bf152d..b78de3312 100644 --- a/apparmor.d/groups/systemd/systemd-mount +++ b/apparmor.d/groups/systemd/systemd-mount @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-network-generator b/apparmor.d/groups/systemd/systemd-network-generator index cce35fae6..c65980901 100644 --- a/apparmor.d/groups/systemd/systemd-network-generator +++ b/apparmor.d/groups/systemd/systemd-network-generator @@ -2,7 +2,7 @@ # Copyright (C) 2021 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 18f1e6ab2..b4d137940 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-networkd-wait-online b/apparmor.d/groups/systemd/systemd-networkd-wait-online index 8e9ec3438..0d5e40730 100644 --- a/apparmor.d/groups/systemd/systemd-networkd-wait-online +++ b/apparmor.d/groups/systemd/systemd-networkd-wait-online @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-notify b/apparmor.d/groups/systemd/systemd-notify index 7be0e88ed..aafb0d74c 100644 --- a/apparmor.d/groups/systemd/systemd-notify +++ b/apparmor.d/groups/systemd/systemd-notify @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-oomd b/apparmor.d/groups/systemd/systemd-oomd index 21ef79495..e5dce916c 100644 --- a/apparmor.d/groups/systemd/systemd-oomd +++ b/apparmor.d/groups/systemd/systemd-oomd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-path b/apparmor.d/groups/systemd/systemd-path index 7ab73f52e..747527776 100644 --- a/apparmor.d/groups/systemd/systemd-path +++ b/apparmor.d/groups/systemd/systemd-path @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-portabled b/apparmor.d/groups/systemd/systemd-portabled index a54c5d8db..bee3df8df 100644 --- a/apparmor.d/groups/systemd/systemd-portabled +++ b/apparmor.d/groups/systemd/systemd-portabled @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-random-seed b/apparmor.d/groups/systemd/systemd-random-seed index e9753150c..be33d39cd 100644 --- a/apparmor.d/groups/systemd/systemd-random-seed +++ b/apparmor.d/groups/systemd/systemd-random-seed @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-remount-fs b/apparmor.d/groups/systemd/systemd-remount-fs index 44ab5cfaf..8c63a1d5a 100644 --- a/apparmor.d/groups/systemd/systemd-remount-fs +++ b/apparmor.d/groups/systemd/systemd-remount-fs @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-resolve b/apparmor.d/groups/systemd/systemd-resolve index cfb0732dc..f716aa3af 100644 --- a/apparmor.d/groups/systemd/systemd-resolve +++ b/apparmor.d/groups/systemd/systemd-resolve @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-resolved b/apparmor.d/groups/systemd/systemd-resolved index 34597caa1..ff5a98134 100644 --- a/apparmor.d/groups/systemd/systemd-resolved +++ b/apparmor.d/groups/systemd/systemd-resolved @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-3.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-rfkill b/apparmor.d/groups/systemd/systemd-rfkill index 1ff164b86..ff9e2d540 100644 --- a/apparmor.d/groups/systemd/systemd-rfkill +++ b/apparmor.d/groups/systemd/systemd-rfkill @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-shutdown b/apparmor.d/groups/systemd/systemd-shutdown index 02abda424..e9887c0cb 100644 --- a/apparmor.d/groups/systemd/systemd-shutdown +++ b/apparmor.d/groups/systemd/systemd-shutdown @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sleep b/apparmor.d/groups/systemd/systemd-sleep index a683e3a78..34916ecc6 100644 --- a/apparmor.d/groups/systemd/systemd-sleep +++ b/apparmor.d/groups/systemd/systemd-sleep @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sleep-grub2 b/apparmor.d/groups/systemd/systemd-sleep-grub2 index 9c718f7b0..b2b42bf44 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-grub2 +++ b/apparmor.d/groups/systemd/systemd-sleep-grub2 @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sleep-hdparm b/apparmor.d/groups/systemd/systemd-sleep-hdparm index 9a282e7f8..71008c96d 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-hdparm +++ b/apparmor.d/groups/systemd/systemd-sleep-hdparm @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sleep-nvidia b/apparmor.d/groups/systemd/systemd-sleep-nvidia index 4ff89f5a7..4ebb4851f 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-nvidia +++ b/apparmor.d/groups/systemd/systemd-sleep-nvidia @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sleep-sysstat b/apparmor.d/groups/systemd/systemd-sleep-sysstat index d854cd7f7..94e2e8daf 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-sysstat +++ b/apparmor.d/groups/systemd/systemd-sleep-sysstat @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sleep-tlp b/apparmor.d/groups/systemd/systemd-sleep-tlp index 03fb69356..60a28d4af 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-tlp +++ b/apparmor.d/groups/systemd/systemd-sleep-tlp @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sleep-upgrades b/apparmor.d/groups/systemd/systemd-sleep-upgrades index 9d1758e25..4f2cce637 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-upgrades +++ b/apparmor.d/groups/systemd/systemd-sleep-upgrades @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-socket-proxyd b/apparmor.d/groups/systemd/systemd-socket-proxyd index 0a9c75aa3..7290e6d0c 100644 --- a/apparmor.d/groups/systemd/systemd-socket-proxyd +++ b/apparmor.d/groups/systemd/systemd-socket-proxyd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sulogin-shell b/apparmor.d/groups/systemd/systemd-sulogin-shell index bb0f082b9..094366391 100644 --- a/apparmor.d/groups/systemd/systemd-sulogin-shell +++ b/apparmor.d/groups/systemd/systemd-sulogin-shell @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sysctl b/apparmor.d/groups/systemd/systemd-sysctl index f209745fc..454105011 100644 --- a/apparmor.d/groups/systemd/systemd-sysctl +++ b/apparmor.d/groups/systemd/systemd-sysctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-sysusers b/apparmor.d/groups/systemd/systemd-sysusers index 18ef93df0..d6b1cb266 100644 --- a/apparmor.d/groups/systemd/systemd-sysusers +++ b/apparmor.d/groups/systemd/systemd-sysusers @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-timedated b/apparmor.d/groups/systemd/systemd-timedated index 4d9ae9ce1..e2b6caaa7 100644 --- a/apparmor.d/groups/systemd/systemd-timedated +++ b/apparmor.d/groups/systemd/systemd-timedated @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-timesyncd b/apparmor.d/groups/systemd/systemd-timesyncd index 4f0903d1f..de544c9d7 100644 --- a/apparmor.d/groups/systemd/systemd-timesyncd +++ b/apparmor.d/groups/systemd/systemd-timesyncd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-tmpfiles b/apparmor.d/groups/systemd/systemd-tmpfiles index 595ccf7da..f591ef9f7 100644 --- a/apparmor.d/groups/systemd/systemd-tmpfiles +++ b/apparmor.d/groups/systemd/systemd-tmpfiles @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index f1da3f8a6..6083fc233 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 612fda9eb..dae5ae67e 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-update-done b/apparmor.d/groups/systemd/systemd-update-done index 046bc3e65..c17be7ab2 100644 --- a/apparmor.d/groups/systemd/systemd-update-done +++ b/apparmor.d/groups/systemd/systemd-update-done @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-update-utmp b/apparmor.d/groups/systemd/systemd-update-utmp index 60227f08a..8703709c4 100644 --- a/apparmor.d/groups/systemd/systemd-update-utmp +++ b/apparmor.d/groups/systemd/systemd-update-utmp @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-user-runtime-dir b/apparmor.d/groups/systemd/systemd-user-runtime-dir index cd70cc8bd..84dfb27ee 100644 --- a/apparmor.d/groups/systemd/systemd-user-runtime-dir +++ b/apparmor.d/groups/systemd/systemd-user-runtime-dir @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-user-sessions b/apparmor.d/groups/systemd/systemd-user-sessions index 25e5befef..6f16b2f19 100644 --- a/apparmor.d/groups/systemd/systemd-user-sessions +++ b/apparmor.d/groups/systemd/systemd-user-sessions @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-userdbd b/apparmor.d/groups/systemd/systemd-userdbd index f591faf3d..a38e455f3 100644 --- a/apparmor.d/groups/systemd/systemd-userdbd +++ b/apparmor.d/groups/systemd/systemd-userdbd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-userwork b/apparmor.d/groups/systemd/systemd-userwork index c7e4b6292..29641fd74 100644 --- a/apparmor.d/groups/systemd/systemd-userwork +++ b/apparmor.d/groups/systemd/systemd-userwork @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/systemd-vconsole-setup b/apparmor.d/groups/systemd/systemd-vconsole-setup index 000bd6957..5f28050c1 100644 --- a/apparmor.d/groups/systemd/systemd-vconsole-setup +++ b/apparmor.d/groups/systemd/systemd-vconsole-setup @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/userdbctl b/apparmor.d/groups/systemd/userdbctl index 279560e99..db1a3dda8 100644 --- a/apparmor.d/groups/systemd/userdbctl +++ b/apparmor.d/groups/systemd/userdbctl @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/zram-generator b/apparmor.d/groups/systemd/zram-generator index 2e8c20737..f6406811d 100644 --- a/apparmor.d/groups/systemd/zram-generator +++ b/apparmor.d/groups/systemd/zram-generator @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/systemd/zramctl b/apparmor.d/groups/systemd/zramctl index 289dc4f0f..9dbf23243 100644 --- a/apparmor.d/groups/systemd/zramctl +++ b/apparmor.d/groups/systemd/zramctl @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index bc03772b6..ed39c7583 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/apport-checkreports b/apparmor.d/groups/ubuntu/apport-checkreports index dec9a5d7d..665b3eaca 100644 --- a/apparmor.d/groups/ubuntu/apport-checkreports +++ b/apparmor.d/groups/ubuntu/apport-checkreports @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index f8d2c9973..25d136722 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/apt-esm-hook b/apparmor.d/groups/ubuntu/apt-esm-hook index c200de4d5..a04fc771d 100644 --- a/apparmor.d/groups/ubuntu/apt-esm-hook +++ b/apparmor.d/groups/ubuntu/apt-esm-hook @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/apt-esm-json-hook b/apparmor.d/groups/ubuntu/apt-esm-json-hook index 4ce754d65..60569edd2 100644 --- a/apparmor.d/groups/ubuntu/apt-esm-json-hook +++ b/apparmor.d/groups/ubuntu/apt-esm-json-hook @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index a6db303e5..b2fe83f6b 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/cron-ubuntu-fan b/apparmor.d/groups/ubuntu/cron-ubuntu-fan index aaf3b9f33..c5c31edd3 100644 --- a/apparmor.d/groups/ubuntu/cron-ubuntu-fan +++ b/apparmor.d/groups/ubuntu/cron-ubuntu-fan @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/do-release-upgrade b/apparmor.d/groups/ubuntu/do-release-upgrade index 4ee62b2e0..86c211f24 100644 --- a/apparmor.d/groups/ubuntu/do-release-upgrade +++ b/apparmor.d/groups/ubuntu/do-release-upgrade @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/hwe-support-status b/apparmor.d/groups/ubuntu/hwe-support-status index 0752e6358..3b4280e33 100644 --- a/apparmor.d/groups/ubuntu/hwe-support-status +++ b/apparmor.d/groups/ubuntu/hwe-support-status @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/list-oem-metapackages b/apparmor.d/groups/ubuntu/list-oem-metapackages index 93059dc34..0023b48cb 100644 --- a/apparmor.d/groups/ubuntu/list-oem-metapackages +++ b/apparmor.d/groups/ubuntu/list-oem-metapackages @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/livepatch-notification b/apparmor.d/groups/ubuntu/livepatch-notification index 66739c7bc..4d5ecb46a 100644 --- a/apparmor.d/groups/ubuntu/livepatch-notification +++ b/apparmor.d/groups/ubuntu/livepatch-notification @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/notify-reboot-required b/apparmor.d/groups/ubuntu/notify-reboot-required index 0c7d008e8..ee9e22e21 100644 --- a/apparmor.d/groups/ubuntu/notify-reboot-required +++ b/apparmor.d/groups/ubuntu/notify-reboot-required @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/notify-updates-outdated b/apparmor.d/groups/ubuntu/notify-updates-outdated index 39ce41c73..a42b3ba1c 100644 --- a/apparmor.d/groups/ubuntu/notify-updates-outdated +++ b/apparmor.d/groups/ubuntu/notify-updates-outdated @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/package-data-downloader b/apparmor.d/groups/ubuntu/package-data-downloader index bba0add83..0e6641977 100644 --- a/apparmor.d/groups/ubuntu/package-data-downloader +++ b/apparmor.d/groups/ubuntu/package-data-downloader @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/package-system-locked b/apparmor.d/groups/ubuntu/package-system-locked index 6876687e2..f4e040975 100644 --- a/apparmor.d/groups/ubuntu/package-system-locked +++ b/apparmor.d/groups/ubuntu/package-system-locked @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/release-upgrade-motd b/apparmor.d/groups/ubuntu/release-upgrade-motd index 3130f196e..08a54df0a 100644 --- a/apparmor.d/groups/ubuntu/release-upgrade-motd +++ b/apparmor.d/groups/ubuntu/release-upgrade-motd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index 32b4e27c3..93fd9ffcc 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 6d7dc732f..4715f570c 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index 7113dac5e..1b04bd383 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index bb5f81b82..92b9deef7 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon b/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon index ddb689b53..5265a2df3 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification index c9a48ed47..bf3d4c6c0 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/ubuntu-distro-info b/apparmor.d/groups/ubuntu/ubuntu-distro-info index a444aada3..6806a4e27 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-distro-info +++ b/apparmor.d/groups/ubuntu/ubuntu-distro-info @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/ubuntu-report b/apparmor.d/groups/ubuntu/ubuntu-report index 54e444532..19273f449 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-report +++ b/apparmor.d/groups/ubuntu/ubuntu-report @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 2cf2f3e99..8fb717323 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot index b0e62994f..7fb3a2b29 100644 --- a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot +++ b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/update-motd-updates-available b/apparmor.d/groups/ubuntu/update-motd-updates-available index bf1acfb1b..b0101504c 100644 --- a/apparmor.d/groups/ubuntu/update-motd-updates-available +++ b/apparmor.d/groups/ubuntu/update-motd-updates-available @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index df73d4e40..c75c3f83e 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-bandwidth b/apparmor.d/groups/virt/cni-bandwidth index 0159f603e..a27f41fc0 100644 --- a/apparmor.d/groups/virt/cni-bandwidth +++ b/apparmor.d/groups/virt/cni-bandwidth @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-bridge b/apparmor.d/groups/virt/cni-bridge index 70347fe59..1e27d04a3 100644 --- a/apparmor.d/groups/virt/cni-bridge +++ b/apparmor.d/groups/virt/cni-bridge @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-calico b/apparmor.d/groups/virt/cni-calico index 47d5590a2..878a09119 100644 --- a/apparmor.d/groups/virt/cni-calico +++ b/apparmor.d/groups/virt/cni-calico @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-firewall b/apparmor.d/groups/virt/cni-firewall index 028f5bd6f..d5171e8dc 100644 --- a/apparmor.d/groups/virt/cni-firewall +++ b/apparmor.d/groups/virt/cni-firewall @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-flannel b/apparmor.d/groups/virt/cni-flannel index ac473fbcb..6bdccec8c 100644 --- a/apparmor.d/groups/virt/cni-flannel +++ b/apparmor.d/groups/virt/cni-flannel @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-host-local b/apparmor.d/groups/virt/cni-host-local index 50b8f315b..5f645ce3f 100644 --- a/apparmor.d/groups/virt/cni-host-local +++ b/apparmor.d/groups/virt/cni-host-local @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-loopback b/apparmor.d/groups/virt/cni-loopback index a7d24e306..30e2800ce 100644 --- a/apparmor.d/groups/virt/cni-loopback +++ b/apparmor.d/groups/virt/cni-loopback @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-portmap b/apparmor.d/groups/virt/cni-portmap index bc4a00fa2..bd0206c4c 100644 --- a/apparmor.d/groups/virt/cni-portmap +++ b/apparmor.d/groups/virt/cni-portmap @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cni-tuning b/apparmor.d/groups/virt/cni-tuning index c0e3a3fd2..c6cc1f1dc 100644 --- a/apparmor.d/groups/virt/cni-tuning +++ b/apparmor.d/groups/virt/cni-tuning @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-askpass b/apparmor.d/groups/virt/cockpit-askpass index daa5cf009..b46a415ac 100644 --- a/apparmor.d/groups/virt/cockpit-askpass +++ b/apparmor.d/groups/virt/cockpit-askpass @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 1ae8c7109..7487c8e70 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-certificate-ensure b/apparmor.d/groups/virt/cockpit-certificate-ensure index 0ef40f4ba..7429b0021 100644 --- a/apparmor.d/groups/virt/cockpit-certificate-ensure +++ b/apparmor.d/groups/virt/cockpit-certificate-ensure @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-certificate-helper b/apparmor.d/groups/virt/cockpit-certificate-helper index 01d23171b..ac9dd5f6f 100644 --- a/apparmor.d/groups/virt/cockpit-certificate-helper +++ b/apparmor.d/groups/virt/cockpit-certificate-helper @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-desktop b/apparmor.d/groups/virt/cockpit-desktop index d8e7f81de..c2a7455ce 100644 --- a/apparmor.d/groups/virt/cockpit-desktop +++ b/apparmor.d/groups/virt/cockpit-desktop @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-pcp b/apparmor.d/groups/virt/cockpit-pcp index c1afe3fbf..8008fe360 100644 --- a/apparmor.d/groups/virt/cockpit-pcp +++ b/apparmor.d/groups/virt/cockpit-pcp @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-session b/apparmor.d/groups/virt/cockpit-session index fda673c6e..67ecd800e 100644 --- a/apparmor.d/groups/virt/cockpit-session +++ b/apparmor.d/groups/virt/cockpit-session @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-ssh b/apparmor.d/groups/virt/cockpit-ssh index 2903d9eb9..e81eb492f 100644 --- a/apparmor.d/groups/virt/cockpit-ssh +++ b/apparmor.d/groups/virt/cockpit-ssh @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-tls b/apparmor.d/groups/virt/cockpit-tls index f83ac2c7b..0037b132c 100644 --- a/apparmor.d/groups/virt/cockpit-tls +++ b/apparmor.d/groups/virt/cockpit-tls @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-update-motd b/apparmor.d/groups/virt/cockpit-update-motd index cf4bf5bb7..c1a39a895 100644 --- a/apparmor.d/groups/virt/cockpit-update-motd +++ b/apparmor.d/groups/virt/cockpit-update-motd @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-ws b/apparmor.d/groups/virt/cockpit-ws index 589765f35..c78f63a63 100644 --- a/apparmor.d/groups/virt/cockpit-ws +++ b/apparmor.d/groups/virt/cockpit-ws @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/cockpit-wsinstance-factory b/apparmor.d/groups/virt/cockpit-wsinstance-factory index 61e7e8fa1..b14a1e36f 100644 --- a/apparmor.d/groups/virt/cockpit-wsinstance-factory +++ b/apparmor.d/groups/virt/cockpit-wsinstance-factory @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/containerd b/apparmor.d/groups/virt/containerd index 182240228..627515640 100644 --- a/apparmor.d/groups/virt/containerd +++ b/apparmor.d/groups/virt/containerd @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/containerd-shim-runc-v2 b/apparmor.d/groups/virt/containerd-shim-runc-v2 index 428473f5d..bff45ca39 100644 --- a/apparmor.d/groups/virt/containerd-shim-runc-v2 +++ b/apparmor.d/groups/virt/containerd-shim-runc-v2 @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/docker-proxy b/apparmor.d/groups/virt/docker-proxy index 4bb1d9497..2861514aa 100644 --- a/apparmor.d/groups/virt/docker-proxy +++ b/apparmor.d/groups/virt/docker-proxy @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 78503c7be..3342c0d58 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/k3s b/apparmor.d/groups/virt/k3s index c2183c33b..96e50ba35 100644 --- a/apparmor.d/groups/virt/k3s +++ b/apparmor.d/groups/virt/k3s @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/kubernetes-pause b/apparmor.d/groups/virt/kubernetes-pause index 8172d00fc..c762515a4 100644 --- a/apparmor.d/groups/virt/kubernetes-pause +++ b/apparmor.d/groups/virt/kubernetes-pause @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/libvirt-dbus b/apparmor.d/groups/virt/libvirt-dbus index 75c7d853b..44d24f1ae 100644 --- a/apparmor.d/groups/virt/libvirt-dbus +++ b/apparmor.d/groups/virt/libvirt-dbus @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 4f8c76a81..f6519a619 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -10,7 +10,7 @@ # Warning: Such a profile is limited as it gives access to a lot of resources. -abi , +abi , include diff --git a/apparmor.d/groups/virt/qemu-bridge-helper b/apparmor.d/groups/virt/qemu-bridge-helper index a814dd265..e462eeca1 100644 --- a/apparmor.d/groups/virt/qemu-bridge-helper +++ b/apparmor.d/groups/virt/qemu-bridge-helper @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virt-aa-helper b/apparmor.d/groups/virt/virt-aa-helper index abbef1f88..74a93737b 100644 --- a/apparmor.d/groups/virt/virt-aa-helper +++ b/apparmor.d/groups/virt/virt-aa-helper @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtinterfaced b/apparmor.d/groups/virt/virtinterfaced index ccda93f6b..8ef827a10 100644 --- a/apparmor.d/groups/virt/virtinterfaced +++ b/apparmor.d/groups/virt/virtinterfaced @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtiofsd b/apparmor.d/groups/virt/virtiofsd index 50efd188b..7389119b8 100644 --- a/apparmor.d/groups/virt/virtiofsd +++ b/apparmor.d/groups/virt/virtiofsd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtlockd b/apparmor.d/groups/virt/virtlockd index 44c5e20ef..ea9336cef 100644 --- a/apparmor.d/groups/virt/virtlockd +++ b/apparmor.d/groups/virt/virtlockd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtlogd b/apparmor.d/groups/virt/virtlogd index 0cb7202ee..095084ef4 100644 --- a/apparmor.d/groups/virt/virtlogd +++ b/apparmor.d/groups/virt/virtlogd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtnetworkd b/apparmor.d/groups/virt/virtnetworkd index 5be9abb71..2ed2a73fd 100644 --- a/apparmor.d/groups/virt/virtnetworkd +++ b/apparmor.d/groups/virt/virtnetworkd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index 7e2c76c92..c0498c6cc 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtsecretd b/apparmor.d/groups/virt/virtsecretd index f6c56ca10..58e228d50 100644 --- a/apparmor.d/groups/virt/virtsecretd +++ b/apparmor.d/groups/virt/virtsecretd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/virt/virtstoraged b/apparmor.d/groups/virt/virtstoraged index 3ef20199d..847140a50 100644 --- a/apparmor.d/groups/virt/virtstoraged +++ b/apparmor.d/groups/virt/virtstoraged @@ -4,7 +4,7 @@ # TODO: Similar with virtqemud. Could be merged? -abi , +abi , include diff --git a/apparmor.d/groups/virt/xtables b/apparmor.d/groups/virt/xtables index 82eb1a733..71f75b642 100644 --- a/apparmor.d/groups/virt/xtables +++ b/apparmor.d/groups/virt/xtables @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/anondate b/apparmor.d/groups/whonix/anondate index cb263922c..d39517569 100644 --- a/apparmor.d/groups/whonix/anondate +++ b/apparmor.d/groups/whonix/anondate @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgcollector b/apparmor.d/groups/whonix/msgcollector index 0c3038d1e..05b07ec47 100644 --- a/apparmor.d/groups/whonix/msgcollector +++ b/apparmor.d/groups/whonix/msgcollector @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgcollector-br-add b/apparmor.d/groups/whonix/msgcollector-br-add index be5b7dd69..587094df6 100644 --- a/apparmor.d/groups/whonix/msgcollector-br-add +++ b/apparmor.d/groups/whonix/msgcollector-br-add @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgcollector-generic-gui-message b/apparmor.d/groups/whonix/msgcollector-generic-gui-message index 8b52e2db7..46b7847ff 100644 --- a/apparmor.d/groups/whonix/msgcollector-generic-gui-message +++ b/apparmor.d/groups/whonix/msgcollector-generic-gui-message @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgcollector-striphtml b/apparmor.d/groups/whonix/msgcollector-striphtml index 1e4e3d9ab..8cf1dec71 100644 --- a/apparmor.d/groups/whonix/msgcollector-striphtml +++ b/apparmor.d/groups/whonix/msgcollector-striphtml @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgdispatcher b/apparmor.d/groups/whonix/msgdispatcher index 9f2871eef..fd1a9f034 100644 --- a/apparmor.d/groups/whonix/msgdispatcher +++ b/apparmor.d/groups/whonix/msgdispatcher @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgdispatcher-autostart b/apparmor.d/groups/whonix/msgdispatcher-autostart index c4dae811e..d292e3850 100644 --- a/apparmor.d/groups/whonix/msgdispatcher-autostart +++ b/apparmor.d/groups/whonix/msgdispatcher-autostart @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgdispatcher-delete b/apparmor.d/groups/whonix/msgdispatcher-delete index cf69e77c8..2a5839e0c 100644 --- a/apparmor.d/groups/whonix/msgdispatcher-delete +++ b/apparmor.d/groups/whonix/msgdispatcher-delete @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/msgdispatcher-dispatch b/apparmor.d/groups/whonix/msgdispatcher-dispatch index f42280e1a..0adfe2797 100644 --- a/apparmor.d/groups/whonix/msgdispatcher-dispatch +++ b/apparmor.d/groups/whonix/msgdispatcher-dispatch @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/open-link-confirmation b/apparmor.d/groups/whonix/open-link-confirmation index e74d2f26a..a6f7ec440 100644 --- a/apparmor.d/groups/whonix/open-link-confirmation +++ b/apparmor.d/groups/whonix/open-link-confirmation @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/pam-abort-on-locked-password b/apparmor.d/groups/whonix/pam-abort-on-locked-password index 79cb70d28..99ac5616d 100644 --- a/apparmor.d/groups/whonix/pam-abort-on-locked-password +++ b/apparmor.d/groups/whonix/pam-abort-on-locked-password @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/pam-info b/apparmor.d/groups/whonix/pam-info index d54cab832..51053ccee 100644 --- a/apparmor.d/groups/whonix/pam-info +++ b/apparmor.d/groups/whonix/pam-info @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/pam_faillock_not_if_x b/apparmor.d/groups/whonix/pam_faillock_not_if_x index c0d05d8a7..1934be8d5 100644 --- a/apparmor.d/groups/whonix/pam_faillock_not_if_x +++ b/apparmor.d/groups/whonix/pam_faillock_not_if_x @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/rads b/apparmor.d/groups/whonix/rads index fdacd13d4..e76570b34 100644 --- a/apparmor.d/groups/whonix/rads +++ b/apparmor.d/groups/whonix/rads @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/sdwdate b/apparmor.d/groups/whonix/sdwdate index 21b457aca..d34f8087c 100644 --- a/apparmor.d/groups/whonix/sdwdate +++ b/apparmor.d/groups/whonix/sdwdate @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/sdwdate-clock-jump b/apparmor.d/groups/whonix/sdwdate-clock-jump index f70da1977..02b0e866b 100644 --- a/apparmor.d/groups/whonix/sdwdate-clock-jump +++ b/apparmor.d/groups/whonix/sdwdate-clock-jump @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/sdwdate-gui b/apparmor.d/groups/whonix/sdwdate-gui index 642b14b46..23c0a6df4 100644 --- a/apparmor.d/groups/whonix/sdwdate-gui +++ b/apparmor.d/groups/whonix/sdwdate-gui @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/sdwdate-start b/apparmor.d/groups/whonix/sdwdate-start index 0b952ce19..113f7504c 100644 --- a/apparmor.d/groups/whonix/sdwdate-start +++ b/apparmor.d/groups/whonix/sdwdate-start @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/sdwdate-wrapper b/apparmor.d/groups/whonix/sdwdate-wrapper index fe8390da9..19713faba 100644 --- a/apparmor.d/groups/whonix/sdwdate-wrapper +++ b/apparmor.d/groups/whonix/sdwdate-wrapper @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/sensible-browser b/apparmor.d/groups/whonix/sensible-browser index 48e2f0f08..1a6f4e26a 100644 --- a/apparmor.d/groups/whonix/sensible-browser +++ b/apparmor.d/groups/whonix/sensible-browser @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/systemcheck-canary b/apparmor.d/groups/whonix/systemcheck-canary index d46c227fb..2a38680bd 100644 --- a/apparmor.d/groups/whonix/systemcheck-canary +++ b/apparmor.d/groups/whonix/systemcheck-canary @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/timesanitycheck b/apparmor.d/groups/whonix/timesanitycheck index 3ca78981a..73f643099 100644 --- a/apparmor.d/groups/whonix/timesanitycheck +++ b/apparmor.d/groups/whonix/timesanitycheck @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/tor-bootstrap-check b/apparmor.d/groups/whonix/tor-bootstrap-check index 0795b0b35..8a5d8f537 100644 --- a/apparmor.d/groups/whonix/tor-bootstrap-check +++ b/apparmor.d/groups/whonix/tor-bootstrap-check @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/tor-consensus-valid-after b/apparmor.d/groups/whonix/tor-consensus-valid-after index d6656afe5..f7d806ef1 100644 --- a/apparmor.d/groups/whonix/tor-consensus-valid-after +++ b/apparmor.d/groups/whonix/tor-consensus-valid-after @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/torbrowser-updater-permission-fix b/apparmor.d/groups/whonix/torbrowser-updater-permission-fix index 39ec37ae3..90aaca321 100644 --- a/apparmor.d/groups/whonix/torbrowser-updater-permission-fix +++ b/apparmor.d/groups/whonix/torbrowser-updater-permission-fix @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/torbrowser-wrapper b/apparmor.d/groups/whonix/torbrowser-wrapper index a659d00f0..ccdfe2ed4 100644 --- a/apparmor.d/groups/whonix/torbrowser-wrapper +++ b/apparmor.d/groups/whonix/torbrowser-wrapper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/whonix-firewall-edit b/apparmor.d/groups/whonix/whonix-firewall-edit index aeea9cf05..28c1d01b4 100644 --- a/apparmor.d/groups/whonix/whonix-firewall-edit +++ b/apparmor.d/groups/whonix/whonix-firewall-edit @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/whonix-firewall-restarter b/apparmor.d/groups/whonix/whonix-firewall-restarter index 87a3713d4..a818e46a6 100644 --- a/apparmor.d/groups/whonix/whonix-firewall-restarter +++ b/apparmor.d/groups/whonix/whonix-firewall-restarter @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/whonix/whonix-firewalld b/apparmor.d/groups/whonix/whonix-firewalld index 53b1dba81..f0f8f5d46 100644 --- a/apparmor.d/groups/whonix/whonix-firewalld +++ b/apparmor.d/groups/whonix/whonix-firewalld @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/mousepad b/apparmor.d/groups/xfce/mousepad index 1bcd283fa..d8bc79b95 100644 --- a/apparmor.d/groups/xfce/mousepad +++ b/apparmor.d/groups/xfce/mousepad @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/ristretto b/apparmor.d/groups/xfce/ristretto index d9151ca80..2aae3f0d3 100644 --- a/apparmor.d/groups/xfce/ristretto +++ b/apparmor.d/groups/xfce/ristretto @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/startxfce b/apparmor.d/groups/xfce/startxfce index 7d8a0165f..84abf8ced 100644 --- a/apparmor.d/groups/xfce/startxfce +++ b/apparmor.d/groups/xfce/startxfce @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/thunar b/apparmor.d/groups/xfce/thunar index c16365f74..d8f04d49c 100644 --- a/apparmor.d/groups/xfce/thunar +++ b/apparmor.d/groups/xfce/thunar @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/thunar-volman b/apparmor.d/groups/xfce/thunar-volman index c49f71458..350255834 100644 --- a/apparmor.d/groups/xfce/thunar-volman +++ b/apparmor.d/groups/xfce/thunar-volman @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/tumblerd b/apparmor.d/groups/xfce/tumblerd index f85e6d4cb..99971abb8 100644 --- a/apparmor.d/groups/xfce/tumblerd +++ b/apparmor.d/groups/xfce/tumblerd @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-about b/apparmor.d/groups/xfce/xfce-about index 701e98773..0dae6e060 100644 --- a/apparmor.d/groups/xfce/xfce-about +++ b/apparmor.d/groups/xfce/xfce-about @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-appfinder b/apparmor.d/groups/xfce/xfce-appfinder index c0753acd8..4b574ce5e 100644 --- a/apparmor.d/groups/xfce/xfce-appfinder +++ b/apparmor.d/groups/xfce/xfce-appfinder @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-clipman-settings b/apparmor.d/groups/xfce/xfce-clipman-settings index 499980f17..248d60b7e 100644 --- a/apparmor.d/groups/xfce/xfce-clipman-settings +++ b/apparmor.d/groups/xfce/xfce-clipman-settings @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-dict b/apparmor.d/groups/xfce/xfce-dict index 423c09b4e..4b34a3d0b 100644 --- a/apparmor.d/groups/xfce/xfce-dict +++ b/apparmor.d/groups/xfce/xfce-dict @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-mime-helper b/apparmor.d/groups/xfce/xfce-mime-helper index 7851cd74e..b1708e58b 100644 --- a/apparmor.d/groups/xfce/xfce-mime-helper +++ b/apparmor.d/groups/xfce/xfce-mime-helper @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-notifyd b/apparmor.d/groups/xfce/xfce-notifyd index 06d2b1df3..f5c80e07c 100644 --- a/apparmor.d/groups/xfce/xfce-notifyd +++ b/apparmor.d/groups/xfce/xfce-notifyd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-panel b/apparmor.d/groups/xfce/xfce-panel index 44f237f4b..3c91e7893 100644 --- a/apparmor.d/groups/xfce/xfce-panel +++ b/apparmor.d/groups/xfce/xfce-panel @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-power-manager b/apparmor.d/groups/xfce/xfce-power-manager index f0654ac68..ff78b6f16 100644 --- a/apparmor.d/groups/xfce/xfce-power-manager +++ b/apparmor.d/groups/xfce/xfce-power-manager @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-screensaver b/apparmor.d/groups/xfce/xfce-screensaver index aaa5f7fa4..ce0a76612 100644 --- a/apparmor.d/groups/xfce/xfce-screensaver +++ b/apparmor.d/groups/xfce/xfce-screensaver @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-sensors b/apparmor.d/groups/xfce/xfce-sensors index ae72f8dbc..e7ee1080b 100644 --- a/apparmor.d/groups/xfce/xfce-sensors +++ b/apparmor.d/groups/xfce/xfce-sensors @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-session b/apparmor.d/groups/xfce/xfce-session index b19c11b3b..17007122e 100644 --- a/apparmor.d/groups/xfce/xfce-session +++ b/apparmor.d/groups/xfce/xfce-session @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfce-terminal b/apparmor.d/groups/xfce/xfce-terminal index 88a042dad..342ffd3b4 100644 --- a/apparmor.d/groups/xfce/xfce-terminal +++ b/apparmor.d/groups/xfce/xfce-terminal @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfconfd b/apparmor.d/groups/xfce/xfconfd index 345851278..0ab17ac5c 100644 --- a/apparmor.d/groups/xfce/xfconfd +++ b/apparmor.d/groups/xfce/xfconfd @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfdesktop b/apparmor.d/groups/xfce/xfdesktop index c01a057e7..d19e3de63 100644 --- a/apparmor.d/groups/xfce/xfdesktop +++ b/apparmor.d/groups/xfce/xfdesktop @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfpm-power-backlight-helper b/apparmor.d/groups/xfce/xfpm-power-backlight-helper index 5f71150e1..236028f2e 100644 --- a/apparmor.d/groups/xfce/xfpm-power-backlight-helper +++ b/apparmor.d/groups/xfce/xfpm-power-backlight-helper @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfsettingsd b/apparmor.d/groups/xfce/xfsettingsd index ec46f5448..3eec3377f 100644 --- a/apparmor.d/groups/xfce/xfsettingsd +++ b/apparmor.d/groups/xfce/xfsettingsd @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/groups/xfce/xfwm b/apparmor.d/groups/xfce/xfwm index 27bb23bfd..d7af2ccb9 100644 --- a/apparmor.d/groups/xfce/xfwm +++ b/apparmor.d/groups/xfce/xfwm @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aa-enabled b/apparmor.d/profiles-a-f/aa-enabled index d5ebe0c10..fe350b2f6 100644 --- a/apparmor.d/profiles-a-f/aa-enabled +++ b/apparmor.d/profiles-a-f/aa-enabled @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index 5f00f8386..a5b18eb4e 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aa-log b/apparmor.d/profiles-a-f/aa-log index 8ad4d1a24..39c42d435 100644 --- a/apparmor.d/profiles-a-f/aa-log +++ b/apparmor.d/profiles-a-f/aa-log @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aa-notify b/apparmor.d/profiles-a-f/aa-notify index 95d24c9e9..7e901509f 100644 --- a/apparmor.d/profiles-a-f/aa-notify +++ b/apparmor.d/profiles-a-f/aa-notify @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aa-status b/apparmor.d/profiles-a-f/aa-status index 5d5840f6f..a48dc693c 100644 --- a/apparmor.d/profiles-a-f/aa-status +++ b/apparmor.d/profiles-a-f/aa-status @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aa-teardown b/apparmor.d/profiles-a-f/aa-teardown index 263c7b9af..b625ad8c6 100644 --- a/apparmor.d/profiles-a-f/aa-teardown +++ b/apparmor.d/profiles-a-f/aa-teardown @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aa-unconfined b/apparmor.d/profiles-a-f/aa-unconfined index a47fa60eb..08c401270 100644 --- a/apparmor.d/profiles-a-f/aa-unconfined +++ b/apparmor.d/profiles-a-f/aa-unconfined @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/abook b/apparmor.d/profiles-a-f/abook index f4252aeee..380faac53 100644 --- a/apparmor.d/profiles-a-f/abook +++ b/apparmor.d/profiles-a-f/abook @@ -2,7 +2,7 @@ # Copyright (C) 2024 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/acpi b/apparmor.d/profiles-a-f/acpi index 4f6132c25..2914180e6 100644 --- a/apparmor.d/profiles-a-f/acpi +++ b/apparmor.d/profiles-a-f/acpi @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/acpi-powerbtn b/apparmor.d/profiles-a-f/acpi-powerbtn index 519f7f868..2a87bdb85 100644 --- a/apparmor.d/profiles-a-f/acpi-powerbtn +++ b/apparmor.d/profiles-a-f/acpi-powerbtn @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/acpid b/apparmor.d/profiles-a-f/acpid index 10600e3d7..7c1a7d4ba 100644 --- a/apparmor.d/profiles-a-f/acpid +++ b/apparmor.d/profiles-a-f/acpid @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/adb b/apparmor.d/profiles-a-f/adb index 52e2621fe..3affe4e7a 100644 --- a/apparmor.d/profiles-a-f/adb +++ b/apparmor.d/profiles-a-f/adb @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/adduser b/apparmor.d/profiles-a-f/adduser index 350f070b0..9103b25b3 100644 --- a/apparmor.d/profiles-a-f/adduser +++ b/apparmor.d/profiles-a-f/adduser @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/adequate b/apparmor.d/profiles-a-f/adequate index fe3e7565f..404a09840 100644 --- a/apparmor.d/profiles-a-f/adequate +++ b/apparmor.d/profiles-a-f/adequate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/profiles-a-f/agetty index 3db817006..9e6db414e 100644 --- a/apparmor.d/profiles-a-f/agetty +++ b/apparmor.d/profiles-a-f/agetty @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/alacarte b/apparmor.d/profiles-a-f/alacarte index e1e228618..7ebb3b629 100644 --- a/apparmor.d/profiles-a-f/alacarte +++ b/apparmor.d/profiles-a-f/alacarte @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/alsactl b/apparmor.d/profiles-a-f/alsactl index bde626660..b881e27e1 100644 --- a/apparmor.d/profiles-a-f/alsactl +++ b/apparmor.d/profiles-a-f/alsactl @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/amixer b/apparmor.d/profiles-a-f/amixer index 8a625b547..85989a7bf 100644 --- a/apparmor.d/profiles-a-f/amixer +++ b/apparmor.d/profiles-a-f/amixer @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/anacron b/apparmor.d/profiles-a-f/anacron index 8893f1d70..06c50aee3 100644 --- a/apparmor.d/profiles-a-f/anacron +++ b/apparmor.d/profiles-a-f/anacron @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/anyremote b/apparmor.d/profiles-a-f/anyremote index 4953ab293..2ad4791d7 100644 --- a/apparmor.d/profiles-a-f/anyremote +++ b/apparmor.d/profiles-a-f/anyremote @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aplay b/apparmor.d/profiles-a-f/aplay index 0bb417ae2..fb4f2cb85 100644 --- a/apparmor.d/profiles-a-f/aplay +++ b/apparmor.d/profiles-a-f/aplay @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/apparmor.systemd b/apparmor.d/profiles-a-f/apparmor.systemd index a6d517b2a..75394f5de 100644 --- a/apparmor.d/profiles-a-f/apparmor.systemd +++ b/apparmor.d/profiles-a-f/apparmor.systemd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/apparmor_parser b/apparmor.d/profiles-a-f/apparmor_parser index 82acd0d0f..bb4fe0739 100644 --- a/apparmor.d/profiles-a-f/apparmor_parser +++ b/apparmor.d/profiles-a-f/apparmor_parser @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/appstreamcli b/apparmor.d/profiles-a-f/appstreamcli index 25f4ff40c..72ee1e9dc 100644 --- a/apparmor.d/profiles-a-f/appstreamcli +++ b/apparmor.d/profiles-a-f/appstreamcli @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/arandr b/apparmor.d/profiles-a-f/arandr index 6baddcf18..e260321e6 100644 --- a/apparmor.d/profiles-a-f/arandr +++ b/apparmor.d/profiles-a-f/arandr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/archivemount b/apparmor.d/profiles-a-f/archivemount index 03836a9dc..6489139d9 100644 --- a/apparmor.d/profiles-a-f/archivemount +++ b/apparmor.d/profiles-a-f/archivemount @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/arduino b/apparmor.d/profiles-a-f/arduino index 47d784212..0304dbc6c 100644 --- a/apparmor.d/profiles-a-f/arduino +++ b/apparmor.d/profiles-a-f/arduino @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/arduino-builder b/apparmor.d/profiles-a-f/arduino-builder index d35004e35..2ef7e37fa 100644 --- a/apparmor.d/profiles-a-f/arduino-builder +++ b/apparmor.d/profiles-a-f/arduino-builder @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/arduino-ctags b/apparmor.d/profiles-a-f/arduino-ctags index 0c3849643..d85a6f3a8 100644 --- a/apparmor.d/profiles-a-f/arduino-ctags +++ b/apparmor.d/profiles-a-f/arduino-ctags @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aspell b/apparmor.d/profiles-a-f/aspell index c5bd8d4f4..16b5b6f6d 100644 --- a/apparmor.d/profiles-a-f/aspell +++ b/apparmor.d/profiles-a-f/aspell @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/aspell-autobuildhash b/apparmor.d/profiles-a-f/aspell-autobuildhash index 078fa0139..9920fb2b3 100644 --- a/apparmor.d/profiles-a-f/aspell-autobuildhash +++ b/apparmor.d/profiles-a-f/aspell-autobuildhash @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/at b/apparmor.d/profiles-a-f/at index 2da487b9c..0c309ad72 100644 --- a/apparmor.d/profiles-a-f/at +++ b/apparmor.d/profiles-a-f/at @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/atd b/apparmor.d/profiles-a-f/atd index b1b54f0fa..f8d39c8f5 100644 --- a/apparmor.d/profiles-a-f/atd +++ b/apparmor.d/profiles-a-f/atd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/atftpd b/apparmor.d/profiles-a-f/atftpd index 02a0a018b..dc7f2bf36 100644 --- a/apparmor.d/profiles-a-f/atftpd +++ b/apparmor.d/profiles-a-f/atftpd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/atool b/apparmor.d/profiles-a-f/atool index a027f7a4f..99cb0fed6 100644 --- a/apparmor.d/profiles-a-f/atool +++ b/apparmor.d/profiles-a-f/atool @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/atril b/apparmor.d/profiles-a-f/atril index 3b78d9c02..284c35911 100644 --- a/apparmor.d/profiles-a-f/atril +++ b/apparmor.d/profiles-a-f/atril @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/atrild b/apparmor.d/profiles-a-f/atrild index c44686d5a..f66f25936 100644 --- a/apparmor.d/profiles-a-f/atrild +++ b/apparmor.d/profiles-a-f/atrild @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/auditctl b/apparmor.d/profiles-a-f/auditctl index daaee243f..d6881f3e7 100644 --- a/apparmor.d/profiles-a-f/auditctl +++ b/apparmor.d/profiles-a-f/auditctl @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/auditd b/apparmor.d/profiles-a-f/auditd index 8c1878604..92afa1d08 100644 --- a/apparmor.d/profiles-a-f/auditd +++ b/apparmor.d/profiles-a-f/auditd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/augenrules b/apparmor.d/profiles-a-f/augenrules index 5f192e8cc..7a515c1ba 100644 --- a/apparmor.d/profiles-a-f/augenrules +++ b/apparmor.d/profiles-a-f/augenrules @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/badblocks b/apparmor.d/profiles-a-f/badblocks index 48b4cc8af..e0f686b90 100644 --- a/apparmor.d/profiles-a-f/badblocks +++ b/apparmor.d/profiles-a-f/badblocks @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/baobab b/apparmor.d/profiles-a-f/baobab index 63a6ebd22..92977471b 100644 --- a/apparmor.d/profiles-a-f/baobab +++ b/apparmor.d/profiles-a-f/baobab @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/biosdecode b/apparmor.d/profiles-a-f/biosdecode index caf8a50d2..8010b380a 100644 --- a/apparmor.d/profiles-a-f/biosdecode +++ b/apparmor.d/profiles-a-f/biosdecode @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/birdtray b/apparmor.d/profiles-a-f/birdtray index b6314e942..c63a8de7c 100644 --- a/apparmor.d/profiles-a-f/birdtray +++ b/apparmor.d/profiles-a-f/birdtray @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/blkdeactivate b/apparmor.d/profiles-a-f/blkdeactivate index f9db3e96f..ad575351f 100644 --- a/apparmor.d/profiles-a-f/blkdeactivate +++ b/apparmor.d/profiles-a-f/blkdeactivate @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/blkid b/apparmor.d/profiles-a-f/blkid index ad8134064..282081330 100644 --- a/apparmor.d/profiles-a-f/blkid +++ b/apparmor.d/profiles-a-f/blkid @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/blockdev b/apparmor.d/profiles-a-f/blockdev index 1b6cc77cb..88059a4c5 100644 --- a/apparmor.d/profiles-a-f/blockdev +++ b/apparmor.d/profiles-a-f/blockdev @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/blueman b/apparmor.d/profiles-a-f/blueman index 9ac1c2c2b..08a553c1d 100644 --- a/apparmor.d/profiles-a-f/blueman +++ b/apparmor.d/profiles-a-f/blueman @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/blueman-mechanism b/apparmor.d/profiles-a-f/blueman-mechanism index 152520fad..aae5d53cd 100644 --- a/apparmor.d/profiles-a-f/blueman-mechanism +++ b/apparmor.d/profiles-a-f/blueman-mechanism @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/blueman-rfcomm-watcher b/apparmor.d/profiles-a-f/blueman-rfcomm-watcher index a8753ac8f..516f14bdd 100644 --- a/apparmor.d/profiles-a-f/blueman-rfcomm-watcher +++ b/apparmor.d/profiles-a-f/blueman-rfcomm-watcher @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/bluemoon b/apparmor.d/profiles-a-f/bluemoon index 06f4040f8..88cb70621 100644 --- a/apparmor.d/profiles-a-f/bluemoon +++ b/apparmor.d/profiles-a-f/bluemoon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/bluetoothctl b/apparmor.d/profiles-a-f/bluetoothctl index 603998f2c..01565b4ff 100644 --- a/apparmor.d/profiles-a-f/bluetoothctl +++ b/apparmor.d/profiles-a-f/bluetoothctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/bluetoothd b/apparmor.d/profiles-a-f/bluetoothd index 66cc35860..ee7efdcfd 100644 --- a/apparmor.d/profiles-a-f/bluetoothd +++ b/apparmor.d/profiles-a-f/bluetoothd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/bmon b/apparmor.d/profiles-a-f/bmon index 77feb3210..d29d9fde7 100644 --- a/apparmor.d/profiles-a-f/bmon +++ b/apparmor.d/profiles-a-f/bmon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/boltd b/apparmor.d/profiles-a-f/boltd index e5464290a..b70b72088 100644 --- a/apparmor.d/profiles-a-f/boltd +++ b/apparmor.d/profiles-a-f/boltd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/borg b/apparmor.d/profiles-a-f/borg index 6a8eff043..15c6b71c9 100644 --- a/apparmor.d/profiles-a-f/borg +++ b/apparmor.d/profiles-a-f/borg @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/browserpass b/apparmor.d/profiles-a-f/browserpass index f35e0c640..86da0e6a7 100644 --- a/apparmor.d/profiles-a-f/browserpass +++ b/apparmor.d/profiles-a-f/browserpass @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btop b/apparmor.d/profiles-a-f/btop index b6c3556ec..bab483dde 100644 --- a/apparmor.d/profiles-a-f/btop +++ b/apparmor.d/profiles-a-f/btop @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btrfs b/apparmor.d/profiles-a-f/btrfs index 41e6fff57..cdf5eb0df 100644 --- a/apparmor.d/profiles-a-f/btrfs +++ b/apparmor.d/profiles-a-f/btrfs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btrfs-convert b/apparmor.d/profiles-a-f/btrfs-convert index 8b443cf6e..2dccbf1fd 100644 --- a/apparmor.d/profiles-a-f/btrfs-convert +++ b/apparmor.d/profiles-a-f/btrfs-convert @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btrfs-find-root b/apparmor.d/profiles-a-f/btrfs-find-root index 03c2d47bd..eef4b6823 100644 --- a/apparmor.d/profiles-a-f/btrfs-find-root +++ b/apparmor.d/profiles-a-f/btrfs-find-root @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btrfs-image b/apparmor.d/profiles-a-f/btrfs-image index c1508bb09..6f18ac095 100644 --- a/apparmor.d/profiles-a-f/btrfs-image +++ b/apparmor.d/profiles-a-f/btrfs-image @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btrfs-map-logical b/apparmor.d/profiles-a-f/btrfs-map-logical index 12d2b09d6..f871bc946 100644 --- a/apparmor.d/profiles-a-f/btrfs-map-logical +++ b/apparmor.d/profiles-a-f/btrfs-map-logical @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btrfs-select-super b/apparmor.d/profiles-a-f/btrfs-select-super index f083363cf..0019aa906 100644 --- a/apparmor.d/profiles-a-f/btrfs-select-super +++ b/apparmor.d/profiles-a-f/btrfs-select-super @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/btrfstune b/apparmor.d/profiles-a-f/btrfstune index cd8f7adfe..f8fa4a047 100644 --- a/apparmor.d/profiles-a-f/btrfstune +++ b/apparmor.d/profiles-a-f/btrfstune @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/calibre b/apparmor.d/profiles-a-f/calibre index c00490a75..6d71ed28d 100644 --- a/apparmor.d/profiles-a-f/calibre +++ b/apparmor.d/profiles-a-f/calibre @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cawbird b/apparmor.d/profiles-a-f/cawbird index ee3bab550..ab2ac687c 100644 --- a/apparmor.d/profiles-a-f/cawbird +++ b/apparmor.d/profiles-a-f/cawbird @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cc-remote-login-helper b/apparmor.d/profiles-a-f/cc-remote-login-helper index bc12ec50b..cefc60f6d 100644 --- a/apparmor.d/profiles-a-f/cc-remote-login-helper +++ b/apparmor.d/profiles-a-f/cc-remote-login-helper @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cctk b/apparmor.d/profiles-a-f/cctk index 3795d9836..40c5199b3 100644 --- a/apparmor.d/profiles-a-f/cctk +++ b/apparmor.d/profiles-a-f/cctk @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/ccze b/apparmor.d/profiles-a-f/ccze index e51310b63..338f71a78 100644 --- a/apparmor.d/profiles-a-f/ccze +++ b/apparmor.d/profiles-a-f/ccze @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cemu b/apparmor.d/profiles-a-f/cemu index 40920ebd0..1201f2476 100644 --- a/apparmor.d/profiles-a-f/cemu +++ b/apparmor.d/profiles-a-f/cemu @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cert-sync b/apparmor.d/profiles-a-f/cert-sync index e2770bda1..fa70c395f 100644 --- a/apparmor.d/profiles-a-f/cert-sync +++ b/apparmor.d/profiles-a-f/cert-sync @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cfdisk b/apparmor.d/profiles-a-f/cfdisk index 7559b5c84..9cacb9324 100644 --- a/apparmor.d/profiles-a-f/cfdisk +++ b/apparmor.d/profiles-a-f/cfdisk @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cgdisk b/apparmor.d/profiles-a-f/cgdisk index f19e70c26..0f91c1e85 100644 --- a/apparmor.d/profiles-a-f/cgdisk +++ b/apparmor.d/profiles-a-f/cgdisk @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cgrulesengd b/apparmor.d/profiles-a-f/cgrulesengd index 6c51eead1..08b1d83b5 100644 --- a/apparmor.d/profiles-a-f/cgrulesengd +++ b/apparmor.d/profiles-a-f/cgrulesengd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/chage b/apparmor.d/profiles-a-f/chage index 3eaa0efb9..a89e204a8 100644 --- a/apparmor.d/profiles-a-f/chage +++ b/apparmor.d/profiles-a-f/chage @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/changestool b/apparmor.d/profiles-a-f/changestool index 9dd650d51..6ff8ed55d 100644 --- a/apparmor.d/profiles-a-f/changestool +++ b/apparmor.d/profiles-a-f/changestool @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/check-bios-nx b/apparmor.d/profiles-a-f/check-bios-nx index 877677bca..775e3f640 100644 --- a/apparmor.d/profiles-a-f/check-bios-nx +++ b/apparmor.d/profiles-a-f/check-bios-nx @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/check-support-status b/apparmor.d/profiles-a-f/check-support-status index bdd9719d3..1a1d4bfd6 100644 --- a/apparmor.d/profiles-a-f/check-support-status +++ b/apparmor.d/profiles-a-f/check-support-status @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/check-support-status-hook b/apparmor.d/profiles-a-f/check-support-status-hook index e0c312423..b77bcfd6d 100644 --- a/apparmor.d/profiles-a-f/check-support-status-hook +++ b/apparmor.d/profiles-a-f/check-support-status-hook @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/chfn b/apparmor.d/profiles-a-f/chfn index 162a08b84..7201d1a7a 100644 --- a/apparmor.d/profiles-a-f/chfn +++ b/apparmor.d/profiles-a-f/chfn @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/chronyd b/apparmor.d/profiles-a-f/chronyd index 79fbf8d80..155d82f07 100644 --- a/apparmor.d/profiles-a-f/chronyd +++ b/apparmor.d/profiles-a-f/chronyd @@ -4,7 +4,7 @@ # Based on https://salsa.debian.org/debian/chrony/-/blob/debian/latest/debian/usr.sbin.chronyd -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/chsh b/apparmor.d/profiles-a-f/chsh index ffcdb5bdf..61885ed4e 100644 --- a/apparmor.d/profiles-a-f/chsh +++ b/apparmor.d/profiles-a-f/chsh @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/claws-mail b/apparmor.d/profiles-a-f/claws-mail index 4de4543a4..82387d044 100644 --- a/apparmor.d/profiles-a-f/claws-mail +++ b/apparmor.d/profiles-a-f/claws-mail @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cmus b/apparmor.d/profiles-a-f/cmus index b667d81f0..1cff2fb63 100644 --- a/apparmor.d/profiles-a-f/cmus +++ b/apparmor.d/profiles-a-f/cmus @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/code-extension-git-askpass b/apparmor.d/profiles-a-f/code-extension-git-askpass index 6954ca966..5a31889b9 100644 --- a/apparmor.d/profiles-a-f/code-extension-git-askpass +++ b/apparmor.d/profiles-a-f/code-extension-git-askpass @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/code-extension-git-editor b/apparmor.d/profiles-a-f/code-extension-git-editor index 104e01281..8e56ac3aa 100644 --- a/apparmor.d/profiles-a-f/code-extension-git-editor +++ b/apparmor.d/profiles-a-f/code-extension-git-editor @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/compton b/apparmor.d/profiles-a-f/compton index b27228807..a6c7d193f 100644 --- a/apparmor.d/profiles-a-f/compton +++ b/apparmor.d/profiles-a-f/compton @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/conky b/apparmor.d/profiles-a-f/conky index 1e1b10abc..9116a116e 100644 --- a/apparmor.d/profiles-a-f/conky +++ b/apparmor.d/profiles-a-f/conky @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/console-setup b/apparmor.d/profiles-a-f/console-setup index d7b41ff20..d3aaddf7f 100644 --- a/apparmor.d/profiles-a-f/console-setup +++ b/apparmor.d/profiles-a-f/console-setup @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/convertall b/apparmor.d/profiles-a-f/convertall index f3ce650e6..8c38f85a3 100644 --- a/apparmor.d/profiles-a-f/convertall +++ b/apparmor.d/profiles-a-f/convertall @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cppw-cpgr b/apparmor.d/profiles-a-f/cppw-cpgr index 9e0aa0ad1..a5b7d8302 100644 --- a/apparmor.d/profiles-a-f/cppw-cpgr +++ b/apparmor.d/profiles-a-f/cppw-cpgr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cpuid b/apparmor.d/profiles-a-f/cpuid index 8df6f750e..c374d4685 100644 --- a/apparmor.d/profiles-a-f/cpuid +++ b/apparmor.d/profiles-a-f/cpuid @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cracklib-packer b/apparmor.d/profiles-a-f/cracklib-packer index d29bfbbee..cc183f527 100644 --- a/apparmor.d/profiles-a-f/cracklib-packer +++ b/apparmor.d/profiles-a-f/cracklib-packer @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/crda b/apparmor.d/profiles-a-f/crda index 96fb4c706..50d34bad4 100644 --- a/apparmor.d/profiles-a-f/crda +++ b/apparmor.d/profiles-a-f/crda @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-beh b/apparmor.d/profiles-a-f/cups-backend-beh index 5945ac6ea..e2dbc1b51 100644 --- a/apparmor.d/profiles-a-f/cups-backend-beh +++ b/apparmor.d/profiles-a-f/cups-backend-beh @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-bluetooth b/apparmor.d/profiles-a-f/cups-backend-bluetooth index ba606c7ef..ada4926ce 100644 --- a/apparmor.d/profiles-a-f/cups-backend-bluetooth +++ b/apparmor.d/profiles-a-f/cups-backend-bluetooth @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-brf b/apparmor.d/profiles-a-f/cups-backend-brf index 2ea66ba05..27e98efc3 100644 --- a/apparmor.d/profiles-a-f/cups-backend-brf +++ b/apparmor.d/profiles-a-f/cups-backend-brf @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-dnssd b/apparmor.d/profiles-a-f/cups-backend-dnssd index 0bb1a34d1..f45b99216 100644 --- a/apparmor.d/profiles-a-f/cups-backend-dnssd +++ b/apparmor.d/profiles-a-f/cups-backend-dnssd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-hp b/apparmor.d/profiles-a-f/cups-backend-hp index f82ce7e0a..636121553 100644 --- a/apparmor.d/profiles-a-f/cups-backend-hp +++ b/apparmor.d/profiles-a-f/cups-backend-hp @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-implicitclass b/apparmor.d/profiles-a-f/cups-backend-implicitclass index 6a50ec237..ba85c62fa 100644 --- a/apparmor.d/profiles-a-f/cups-backend-implicitclass +++ b/apparmor.d/profiles-a-f/cups-backend-implicitclass @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-ipp b/apparmor.d/profiles-a-f/cups-backend-ipp index 706e1a5ae..b473ecaa3 100644 --- a/apparmor.d/profiles-a-f/cups-backend-ipp +++ b/apparmor.d/profiles-a-f/cups-backend-ipp @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-lpd b/apparmor.d/profiles-a-f/cups-backend-lpd index 077a913a0..af2901be0 100644 --- a/apparmor.d/profiles-a-f/cups-backend-lpd +++ b/apparmor.d/profiles-a-f/cups-backend-lpd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-mdns b/apparmor.d/profiles-a-f/cups-backend-mdns index a520e9a19..0b9cce0da 100644 --- a/apparmor.d/profiles-a-f/cups-backend-mdns +++ b/apparmor.d/profiles-a-f/cups-backend-mdns @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-parallel b/apparmor.d/profiles-a-f/cups-backend-parallel index fe2e752ef..a985e5042 100644 --- a/apparmor.d/profiles-a-f/cups-backend-parallel +++ b/apparmor.d/profiles-a-f/cups-backend-parallel @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-pdf b/apparmor.d/profiles-a-f/cups-backend-pdf index efbb2a85d..b6e6d59ad 100644 --- a/apparmor.d/profiles-a-f/cups-backend-pdf +++ b/apparmor.d/profiles-a-f/cups-backend-pdf @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-serial b/apparmor.d/profiles-a-f/cups-backend-serial index e2ec19bce..3959a091d 100644 --- a/apparmor.d/profiles-a-f/cups-backend-serial +++ b/apparmor.d/profiles-a-f/cups-backend-serial @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-snmp b/apparmor.d/profiles-a-f/cups-backend-snmp index 1532db04b..35f0392de 100644 --- a/apparmor.d/profiles-a-f/cups-backend-snmp +++ b/apparmor.d/profiles-a-f/cups-backend-snmp @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-socket b/apparmor.d/profiles-a-f/cups-backend-socket index 338d2e2e6..3efcf183b 100644 --- a/apparmor.d/profiles-a-f/cups-backend-socket +++ b/apparmor.d/profiles-a-f/cups-backend-socket @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-backend-usb b/apparmor.d/profiles-a-f/cups-backend-usb index e647939f4..fa21e0204 100644 --- a/apparmor.d/profiles-a-f/cups-backend-usb +++ b/apparmor.d/profiles-a-f/cups-backend-usb @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-browsed b/apparmor.d/profiles-a-f/cups-browsed index 6b01087b9..41d22ed9b 100644 --- a/apparmor.d/profiles-a-f/cups-browsed +++ b/apparmor.d/profiles-a-f/cups-browsed @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-notifier-dbus b/apparmor.d/profiles-a-f/cups-notifier-dbus index 9632ca91d..e22b2f6a4 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-dbus +++ b/apparmor.d/profiles-a-f/cups-notifier-dbus @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-notifier-mailto b/apparmor.d/profiles-a-f/cups-notifier-mailto index aad9f73c3..0df4984d4 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-mailto +++ b/apparmor.d/profiles-a-f/cups-notifier-mailto @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-notifier-rss b/apparmor.d/profiles-a-f/cups-notifier-rss index 86dfecc9e..129cb8d6f 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-rss +++ b/apparmor.d/profiles-a-f/cups-notifier-rss @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/cups-pk-helper-mechanism b/apparmor.d/profiles-a-f/cups-pk-helper-mechanism index 7c67e3e6a..89d55c2f1 100644 --- a/apparmor.d/profiles-a-f/cups-pk-helper-mechanism +++ b/apparmor.d/profiles-a-f/cups-pk-helper-mechanism @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/czkawka-cli b/apparmor.d/profiles-a-f/czkawka-cli index 6ad4c553b..ddbc8b59b 100644 --- a/apparmor.d/profiles-a-f/czkawka-cli +++ b/apparmor.d/profiles-a-f/czkawka-cli @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/czkawka-gui b/apparmor.d/profiles-a-f/czkawka-gui index 68a30c769..30dc56b29 100644 --- a/apparmor.d/profiles-a-f/czkawka-gui +++ b/apparmor.d/profiles-a-f/czkawka-gui @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/ddclient b/apparmor.d/profiles-a-f/ddclient index 000e61013..c16629d6d 100644 --- a/apparmor.d/profiles-a-f/ddclient +++ b/apparmor.d/profiles-a-f/ddclient @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/ddcutil b/apparmor.d/profiles-a-f/ddcutil index ee12dcd5d..c752dcbb8 100644 --- a/apparmor.d/profiles-a-f/ddcutil +++ b/apparmor.d/profiles-a-f/ddcutil @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/deltachat-desktop b/apparmor.d/profiles-a-f/deltachat-desktop index eaf12a933..b3afbfc09 100644 --- a/apparmor.d/profiles-a-f/deltachat-desktop +++ b/apparmor.d/profiles-a-f/deltachat-desktop @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/deluser b/apparmor.d/profiles-a-f/deluser index 67e52b376..540079175 100644 --- a/apparmor.d/profiles-a-f/deluser +++ b/apparmor.d/profiles-a-f/deluser @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/df b/apparmor.d/profiles-a-f/df index 18b3687e1..1a823e4db 100644 --- a/apparmor.d/profiles-a-f/df +++ b/apparmor.d/profiles-a-f/df @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dfc b/apparmor.d/profiles-a-f/dfc index b4ccf6743..d23028a47 100644 --- a/apparmor.d/profiles-a-f/dfc +++ b/apparmor.d/profiles-a-f/dfc @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dhclient b/apparmor.d/profiles-a-f/dhclient index 20e45b87f..30d68f6e5 100644 --- a/apparmor.d/profiles-a-f/dhclient +++ b/apparmor.d/profiles-a-f/dhclient @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script index 4261a8be7..1552ee0e4 100644 --- a/apparmor.d/profiles-a-f/dhclient-script +++ b/apparmor.d/profiles-a-f/dhclient-script @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dig b/apparmor.d/profiles-a-f/dig index 87b80e3da..3e95a05dd 100644 --- a/apparmor.d/profiles-a-f/dig +++ b/apparmor.d/profiles-a-f/dig @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dino b/apparmor.d/profiles-a-f/dino index dad921850..e2ee5e9b2 100644 --- a/apparmor.d/profiles-a-f/dino +++ b/apparmor.d/profiles-a-f/dino @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index 3ff222b4a..74d1ce740 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/discord-chrome-sandbox b/apparmor.d/profiles-a-f/discord-chrome-sandbox index d30a2a57f..4cfefd651 100644 --- a/apparmor.d/profiles-a-f/discord-chrome-sandbox +++ b/apparmor.d/profiles-a-f/discord-chrome-sandbox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index bfd287741..5e8a3ea0c 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -4,7 +4,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dkms-autoinstaller b/apparmor.d/profiles-a-f/dkms-autoinstaller index f266791a1..00f1d8117 100644 --- a/apparmor.d/profiles-a-f/dkms-autoinstaller +++ b/apparmor.d/profiles-a-f/dkms-autoinstaller @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dleyna-renderer-service b/apparmor.d/profiles-a-f/dleyna-renderer-service index d56098048..139dfaeaf 100644 --- a/apparmor.d/profiles-a-f/dleyna-renderer-service +++ b/apparmor.d/profiles-a-f/dleyna-renderer-service @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dleyna-server-service b/apparmor.d/profiles-a-f/dleyna-server-service index f41d250f6..552abeadc 100644 --- a/apparmor.d/profiles-a-f/dleyna-server-service +++ b/apparmor.d/profiles-a-f/dleyna-server-service @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dlocate b/apparmor.d/profiles-a-f/dlocate index e17a72c84..ff042c321 100644 --- a/apparmor.d/profiles-a-f/dlocate +++ b/apparmor.d/profiles-a-f/dlocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dmcrypt-get-device b/apparmor.d/profiles-a-f/dmcrypt-get-device index 2fa3fc6a9..7d5b8062a 100644 --- a/apparmor.d/profiles-a-f/dmcrypt-get-device +++ b/apparmor.d/profiles-a-f/dmcrypt-get-device @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dmesg b/apparmor.d/profiles-a-f/dmesg index f2d0c7665..68fa13298 100644 --- a/apparmor.d/profiles-a-f/dmesg +++ b/apparmor.d/profiles-a-f/dmesg @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dmeventd b/apparmor.d/profiles-a-f/dmeventd index 2d904eec0..0484cf99d 100644 --- a/apparmor.d/profiles-a-f/dmeventd +++ b/apparmor.d/profiles-a-f/dmeventd @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dmidecode b/apparmor.d/profiles-a-f/dmidecode index 061bc40ac..aba455535 100644 --- a/apparmor.d/profiles-a-f/dmidecode +++ b/apparmor.d/profiles-a-f/dmidecode @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dmsetup b/apparmor.d/profiles-a-f/dmsetup index 305e03573..d532bb8cf 100644 --- a/apparmor.d/profiles-a-f/dmsetup +++ b/apparmor.d/profiles-a-f/dmsetup @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dnscrypt-proxy b/apparmor.d/profiles-a-f/dnscrypt-proxy index 6727b8201..08dad1bd2 100644 --- a/apparmor.d/profiles-a-f/dnscrypt-proxy +++ b/apparmor.d/profiles-a-f/dnscrypt-proxy @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/downloadhelper b/apparmor.d/profiles-a-f/downloadhelper index 05b4085b3..bb54ca251 100644 --- a/apparmor.d/profiles-a-f/downloadhelper +++ b/apparmor.d/profiles-a-f/downloadhelper @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dring b/apparmor.d/profiles-a-f/dring index 8d0045030..32a914268 100644 --- a/apparmor.d/profiles-a-f/dring +++ b/apparmor.d/profiles-a-f/dring @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dropbox b/apparmor.d/profiles-a-f/dropbox index 8aa054238..065fe92c5 100644 --- a/apparmor.d/profiles-a-f/dropbox +++ b/apparmor.d/profiles-a-f/dropbox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dumpcap b/apparmor.d/profiles-a-f/dumpcap index e03ad1742..634aebd02 100644 --- a/apparmor.d/profiles-a-f/dumpcap +++ b/apparmor.d/profiles-a-f/dumpcap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dumpe2fs b/apparmor.d/profiles-a-f/dumpe2fs index 725f725c5..eb3d4d61a 100644 --- a/apparmor.d/profiles-a-f/dumpe2fs +++ b/apparmor.d/profiles-a-f/dumpe2fs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dunst b/apparmor.d/profiles-a-f/dunst index 220652247..e73e3370c 100644 --- a/apparmor.d/profiles-a-f/dunst +++ b/apparmor.d/profiles-a-f/dunst @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dunstctl b/apparmor.d/profiles-a-f/dunstctl index a00668556..45ec6886c 100644 --- a/apparmor.d/profiles-a-f/dunstctl +++ b/apparmor.d/profiles-a-f/dunstctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/dunstify b/apparmor.d/profiles-a-f/dunstify index 42a8be4ad..c62e87f66 100644 --- a/apparmor.d/profiles-a-f/dunstify +++ b/apparmor.d/profiles-a-f/dunstify @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/e2fsck b/apparmor.d/profiles-a-f/e2fsck index a02c8735e..be5d26b9f 100644 --- a/apparmor.d/profiles-a-f/e2fsck +++ b/apparmor.d/profiles-a-f/e2fsck @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/e2image b/apparmor.d/profiles-a-f/e2image index ccb4cc5a4..b099f1ccf 100644 --- a/apparmor.d/profiles-a-f/e2image +++ b/apparmor.d/profiles-a-f/e2image @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/e2scrub_all b/apparmor.d/profiles-a-f/e2scrub_all index de648cac2..25fab12c7 100644 --- a/apparmor.d/profiles-a-f/e2scrub_all +++ b/apparmor.d/profiles-a-f/e2scrub_all @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/earlyoom b/apparmor.d/profiles-a-f/earlyoom index 6752cbae6..01484cdc6 100644 --- a/apparmor.d/profiles-a-f/earlyoom +++ b/apparmor.d/profiles-a-f/earlyoom @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/edid-decode b/apparmor.d/profiles-a-f/edid-decode index 8925e5e2d..f15d6db6c 100644 --- a/apparmor.d/profiles-a-f/edid-decode +++ b/apparmor.d/profiles-a-f/edid-decode @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/eject b/apparmor.d/profiles-a-f/eject index bd467c2be..84168322a 100644 --- a/apparmor.d/profiles-a-f/eject +++ b/apparmor.d/profiles-a-f/eject @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index a792b7341..e4a9bef28 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/elinks b/apparmor.d/profiles-a-f/elinks index 1909ab896..f833c303d 100644 --- a/apparmor.d/profiles-a-f/elinks +++ b/apparmor.d/profiles-a-f/elinks @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/engrampa b/apparmor.d/profiles-a-f/engrampa index 86077c89b..c302ff400 100644 --- a/apparmor.d/profiles-a-f/engrampa +++ b/apparmor.d/profiles-a-f/engrampa @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/etckeeper b/apparmor.d/profiles-a-f/etckeeper index 6f10293c7..d42b07dee 100644 --- a/apparmor.d/profiles-a-f/etckeeper +++ b/apparmor.d/profiles-a-f/etckeeper @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index 3ac55439a..2638ad0e3 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/evince-previewer b/apparmor.d/profiles-a-f/evince-previewer index 7a2b939a6..1597c35af 100644 --- a/apparmor.d/profiles-a-f/evince-previewer +++ b/apparmor.d/profiles-a-f/evince-previewer @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/evince-thumbnailer b/apparmor.d/profiles-a-f/evince-thumbnailer index d4e63c924..95fdba512 100644 --- a/apparmor.d/profiles-a-f/evince-thumbnailer +++ b/apparmor.d/profiles-a-f/evince-thumbnailer @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/execute-dcut b/apparmor.d/profiles-a-f/execute-dcut index 9f03de7fc..41d2324f6 100644 --- a/apparmor.d/profiles-a-f/execute-dcut +++ b/apparmor.d/profiles-a-f/execute-dcut @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/execute-dput b/apparmor.d/profiles-a-f/execute-dput index 10edc6164..915213dac 100644 --- a/apparmor.d/profiles-a-f/execute-dput +++ b/apparmor.d/profiles-a-f/execute-dput @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/exiftool b/apparmor.d/profiles-a-f/exiftool index 9db5d83ea..fecb1af22 100644 --- a/apparmor.d/profiles-a-f/exiftool +++ b/apparmor.d/profiles-a-f/exiftool @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/exim4 b/apparmor.d/profiles-a-f/exim4 index 3dae4cae6..98364f0f1 100644 --- a/apparmor.d/profiles-a-f/exim4 +++ b/apparmor.d/profiles-a-f/exim4 @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/exo-compose-mail b/apparmor.d/profiles-a-f/exo-compose-mail index 990c67b85..3e1f92742 100644 --- a/apparmor.d/profiles-a-f/exo-compose-mail +++ b/apparmor.d/profiles-a-f/exo-compose-mail @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/exo-helper b/apparmor.d/profiles-a-f/exo-helper index af38a5fa3..b9d7652ee 100644 --- a/apparmor.d/profiles-a-f/exo-helper +++ b/apparmor.d/profiles-a-f/exo-helper @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/exo-open b/apparmor.d/profiles-a-f/exo-open index 04d5f8b36..2c5e86e30 100644 --- a/apparmor.d/profiles-a-f/exo-open +++ b/apparmor.d/profiles-a-f/exo-open @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/f3brew b/apparmor.d/profiles-a-f/f3brew index 8572f369c..312512010 100644 --- a/apparmor.d/profiles-a-f/f3brew +++ b/apparmor.d/profiles-a-f/f3brew @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/f3fix b/apparmor.d/profiles-a-f/f3fix index a5d327e72..4d743fbb7 100644 --- a/apparmor.d/profiles-a-f/f3fix +++ b/apparmor.d/profiles-a-f/f3fix @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/f3probe b/apparmor.d/profiles-a-f/f3probe index c7843c91f..d935075eb 100644 --- a/apparmor.d/profiles-a-f/f3probe +++ b/apparmor.d/profiles-a-f/f3probe @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/f3read b/apparmor.d/profiles-a-f/f3read index a25e7e0cc..93058cfa9 100644 --- a/apparmor.d/profiles-a-f/f3read +++ b/apparmor.d/profiles-a-f/f3read @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/f3write b/apparmor.d/profiles-a-f/f3write index 25282dff8..25c56778d 100644 --- a/apparmor.d/profiles-a-f/f3write +++ b/apparmor.d/profiles-a-f/f3write @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fail2ban-client b/apparmor.d/profiles-a-f/fail2ban-client index 23fd61125..7fae1218c 100644 --- a/apparmor.d/profiles-a-f/fail2ban-client +++ b/apparmor.d/profiles-a-f/fail2ban-client @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fail2ban-server b/apparmor.d/profiles-a-f/fail2ban-server index 2706c8e43..e858c2d8e 100644 --- a/apparmor.d/profiles-a-f/fail2ban-server +++ b/apparmor.d/profiles-a-f/fail2ban-server @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fatlabel b/apparmor.d/profiles-a-f/fatlabel index df95d83c0..c7ac0d399 100644 --- a/apparmor.d/profiles-a-f/fatlabel +++ b/apparmor.d/profiles-a-f/fatlabel @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fatresize b/apparmor.d/profiles-a-f/fatresize index b94e0e49c..e299a109b 100644 --- a/apparmor.d/profiles-a-f/fatresize +++ b/apparmor.d/profiles-a-f/fatresize @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fdisk b/apparmor.d/profiles-a-f/fdisk index 8e6ea58fa..e6a7aeebf 100644 --- a/apparmor.d/profiles-a-f/fdisk +++ b/apparmor.d/profiles-a-f/fdisk @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/ffmpeg b/apparmor.d/profiles-a-f/ffmpeg index 864becf32..6e47ec8cb 100644 --- a/apparmor.d/profiles-a-f/ffmpeg +++ b/apparmor.d/profiles-a-f/ffmpeg @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/ffmpegthumbnailer b/apparmor.d/profiles-a-f/ffmpegthumbnailer index 04ecf16cc..acc33199c 100644 --- a/apparmor.d/profiles-a-f/ffmpegthumbnailer +++ b/apparmor.d/profiles-a-f/ffmpegthumbnailer @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/ffplay b/apparmor.d/profiles-a-f/ffplay index 0615d1042..6d3e1972d 100644 --- a/apparmor.d/profiles-a-f/ffplay +++ b/apparmor.d/profiles-a-f/ffplay @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/ffprobe b/apparmor.d/profiles-a-f/ffprobe index f5448d7ef..793361489 100644 --- a/apparmor.d/profiles-a-f/ffprobe +++ b/apparmor.d/profiles-a-f/ffprobe @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index 8f81ad522..57eb19aef 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/filecap b/apparmor.d/profiles-a-f/filecap index afad4070c..6729ebb91 100644 --- a/apparmor.d/profiles-a-f/filecap +++ b/apparmor.d/profiles-a-f/filecap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/filezilla b/apparmor.d/profiles-a-f/filezilla index 8b3786eb5..be734ed50 100644 --- a/apparmor.d/profiles-a-f/filezilla +++ b/apparmor.d/profiles-a-f/filezilla @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/findmnt b/apparmor.d/profiles-a-f/findmnt index 7fb7c9e1b..bcffc5b89 100644 --- a/apparmor.d/profiles-a-f/findmnt +++ b/apparmor.d/profiles-a-f/findmnt @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/firecfg b/apparmor.d/profiles-a-f/firecfg index c470d068a..a3aba8af1 100644 --- a/apparmor.d/profiles-a-f/firecfg +++ b/apparmor.d/profiles-a-f/firecfg @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/firewall-applet b/apparmor.d/profiles-a-f/firewall-applet index b3571e628..17fca1462 100644 --- a/apparmor.d/profiles-a-f/firewall-applet +++ b/apparmor.d/profiles-a-f/firewall-applet @@ -2,7 +2,7 @@ # Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/firewall-config b/apparmor.d/profiles-a-f/firewall-config index a752954e6..760a75200 100644 --- a/apparmor.d/profiles-a-f/firewall-config +++ b/apparmor.d/profiles-a-f/firewall-config @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/profiles-a-f/firewalld index e450c78cd..142b25cde 100644 --- a/apparmor.d/profiles-a-f/firewalld +++ b/apparmor.d/profiles-a-f/firewalld @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flameshot b/apparmor.d/profiles-a-f/flameshot index 877e42912..f0d042ba8 100644 --- a/apparmor.d/profiles-a-f/flameshot +++ b/apparmor.d/profiles-a-f/flameshot @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index d89f8c524..05873c4e2 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app index 71ec660d8..d91b9ac53 100644 --- a/apparmor.d/profiles-a-f/flatpak-app +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -18,7 +18,7 @@ # This this only defence in depth. # 3. The main purpose of this profile is to ensure all processes are confined. -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flatpak-oci-authenticator b/apparmor.d/profiles-a-f/flatpak-oci-authenticator index 9b379b55d..be6c7b320 100644 --- a/apparmor.d/profiles-a-f/flatpak-oci-authenticator +++ b/apparmor.d/profiles-a-f/flatpak-oci-authenticator @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flatpak-portal b/apparmor.d/profiles-a-f/flatpak-portal index 570a3ea8c..3f3d1e28e 100644 --- a/apparmor.d/profiles-a-f/flatpak-portal +++ b/apparmor.d/profiles-a-f/flatpak-portal @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flatpak-session-helper b/apparmor.d/profiles-a-f/flatpak-session-helper index 1706f4b21..7144a237a 100644 --- a/apparmor.d/profiles-a-f/flatpak-session-helper +++ b/apparmor.d/profiles-a-f/flatpak-session-helper @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flatpak-system-helper b/apparmor.d/profiles-a-f/flatpak-system-helper index a2141b111..2268de064 100644 --- a/apparmor.d/profiles-a-f/flatpak-system-helper +++ b/apparmor.d/profiles-a-f/flatpak-system-helper @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/flatpak-validate-icon b/apparmor.d/profiles-a-f/flatpak-validate-icon index 7669bb1e6..41701a5ff 100644 --- a/apparmor.d/profiles-a-f/flatpak-validate-icon +++ b/apparmor.d/profiles-a-f/flatpak-validate-icon @@ -2,7 +2,7 @@ # Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/foliate b/apparmor.d/profiles-a-f/foliate index 3592893e9..0474684e7 100644 --- a/apparmor.d/profiles-a-f/foliate +++ b/apparmor.d/profiles-a-f/foliate @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/font-manager b/apparmor.d/profiles-a-f/font-manager index 6d7096ad7..81c53aafd 100644 --- a/apparmor.d/profiles-a-f/font-manager +++ b/apparmor.d/profiles-a-f/font-manager @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fping b/apparmor.d/profiles-a-f/fping index 5d30e4522..ee6213cb5 100644 --- a/apparmor.d/profiles-a-f/fping +++ b/apparmor.d/profiles-a-f/fping @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fprintd b/apparmor.d/profiles-a-f/fprintd index 2c474b27b..9a0d4058a 100644 --- a/apparmor.d/profiles-a-f/fprintd +++ b/apparmor.d/profiles-a-f/fprintd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 54abde9d3..20eaa34af 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/freefall b/apparmor.d/profiles-a-f/freefall index 0499beb0a..7af1ef8c9 100644 --- a/apparmor.d/profiles-a-f/freefall +++ b/apparmor.d/profiles-a-f/freefall @@ -2,7 +2,7 @@ # Copyright (C) 2021 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index a400bf9d9..333c9f368 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fritzing b/apparmor.d/profiles-a-f/fritzing index 3e3dde2e9..18b990bbc 100644 --- a/apparmor.d/profiles-a-f/fritzing +++ b/apparmor.d/profiles-a-f/fritzing @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/frontend b/apparmor.d/profiles-a-f/frontend index eb90c18d6..51bfc3610 100644 --- a/apparmor.d/profiles-a-f/frontend +++ b/apparmor.d/profiles-a-f/frontend @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fsck b/apparmor.d/profiles-a-f/fsck index d04b32e96..5d0588026 100644 --- a/apparmor.d/profiles-a-f/fsck +++ b/apparmor.d/profiles-a-f/fsck @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fsck.btrfs b/apparmor.d/profiles-a-f/fsck.btrfs index 470b5a3d3..f8ac9419d 100644 --- a/apparmor.d/profiles-a-f/fsck.btrfs +++ b/apparmor.d/profiles-a-f/fsck.btrfs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fsck.fat b/apparmor.d/profiles-a-f/fsck.fat index c188574ee..fd944532f 100644 --- a/apparmor.d/profiles-a-f/fsck.fat +++ b/apparmor.d/profiles-a-f/fsck.fat @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fstrim b/apparmor.d/profiles-a-f/fstrim index a4ba7fedb..a55337659 100644 --- a/apparmor.d/profiles-a-f/fstrim +++ b/apparmor.d/profiles-a-f/fstrim @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fuse-overlayfs b/apparmor.d/profiles-a-f/fuse-overlayfs index 643371c60..da61184a3 100644 --- a/apparmor.d/profiles-a-f/fuse-overlayfs +++ b/apparmor.d/profiles-a-f/fuse-overlayfs @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fuseiso b/apparmor.d/profiles-a-f/fuseiso index e4d6cfd99..330a8b07e 100644 --- a/apparmor.d/profiles-a-f/fuseiso +++ b/apparmor.d/profiles-a-f/fuseiso @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fusermount b/apparmor.d/profiles-a-f/fusermount index 4695c2d3b..2bad1d773 100644 --- a/apparmor.d/profiles-a-f/fusermount +++ b/apparmor.d/profiles-a-f/fusermount @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index d8fa6d355..7c1f2024a 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 8f6885b46..382822fab 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gajim b/apparmor.d/profiles-g-l/gajim index 033f082f2..1de493892 100644 --- a/apparmor.d/profiles-g-l/gajim +++ b/apparmor.d/profiles-g-l/gajim @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gamemoded b/apparmor.d/profiles-g-l/gamemoded index e17a9e537..af1f34005 100644 --- a/apparmor.d/profiles-g-l/gamemoded +++ b/apparmor.d/profiles-g-l/gamemoded @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/ganyremote b/apparmor.d/profiles-g-l/ganyremote index 7db7a5cb8..e9f4d4e30 100644 --- a/apparmor.d/profiles-g-l/ganyremote +++ b/apparmor.d/profiles-g-l/ganyremote @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gconfd b/apparmor.d/profiles-g-l/gconfd index 5dffe8a0c..7ceee1022 100644 --- a/apparmor.d/profiles-g-l/gconfd +++ b/apparmor.d/profiles-g-l/gconfd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gdisk b/apparmor.d/profiles-g-l/gdisk index 8c3662ba1..1357b03b6 100644 --- a/apparmor.d/profiles-g-l/gdisk +++ b/apparmor.d/profiles-g-l/gdisk @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders b/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders index a01425bb9..b64c34a4b 100644 --- a/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders +++ b/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/ghc-pkg b/apparmor.d/profiles-g-l/ghc-pkg index 8fdffbf87..df6613042 100644 --- a/apparmor.d/profiles-g-l/ghc-pkg +++ b/apparmor.d/profiles-g-l/ghc-pkg @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index 040af8fac..a9be29bec 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gio-querymodules b/apparmor.d/profiles-g-l/gio-querymodules index 3f4ef7fed..494fef0ab 100644 --- a/apparmor.d/profiles-g-l/gio-querymodules +++ b/apparmor.d/profiles-g-l/gio-querymodules @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 032da7124..71bace3c3 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gitg b/apparmor.d/profiles-g-l/gitg index 3d6da038c..ff5e12444 100644 --- a/apparmor.d/profiles-g-l/gitg +++ b/apparmor.d/profiles-g-l/gitg @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gitstatusd b/apparmor.d/profiles-g-l/gitstatusd index 5dbce6ae3..e5cbf1959 100644 --- a/apparmor.d/profiles-g-l/gitstatusd +++ b/apparmor.d/profiles-g-l/gitstatusd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/glib-compile-resources b/apparmor.d/profiles-g-l/glib-compile-resources index 45e787840..f52aa33d7 100644 --- a/apparmor.d/profiles-g-l/glib-compile-resources +++ b/apparmor.d/profiles-g-l/glib-compile-resources @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/glib-compile-schemas b/apparmor.d/profiles-g-l/glib-compile-schemas index 5463405f9..fcabd84c3 100644 --- a/apparmor.d/profiles-g-l/glib-compile-schemas +++ b/apparmor.d/profiles-g-l/glib-compile-schemas @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/glib-pacrunner b/apparmor.d/profiles-g-l/glib-pacrunner index e3dfec88c..bf7c7c53a 100644 --- a/apparmor.d/profiles-g-l/glib-pacrunner +++ b/apparmor.d/profiles-g-l/glib-pacrunner @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/globaltime b/apparmor.d/profiles-g-l/globaltime index 566f58ee3..7f349b650 100644 --- a/apparmor.d/profiles-g-l/globaltime +++ b/apparmor.d/profiles-g-l/globaltime @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/glxgears b/apparmor.d/profiles-g-l/glxgears index 9ad458720..1e27790df 100644 --- a/apparmor.d/profiles-g-l/glxgears +++ b/apparmor.d/profiles-g-l/glxgears @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/glxinfo b/apparmor.d/profiles-g-l/glxinfo index 7defbaf80..eea7b6050 100644 --- a/apparmor.d/profiles-g-l/glxinfo +++ b/apparmor.d/profiles-g-l/glxinfo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gpa b/apparmor.d/profiles-g-l/gpa index 9ed18534e..8a9c42443 100644 --- a/apparmor.d/profiles-g-l/gpa +++ b/apparmor.d/profiles-g-l/gpa @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gparted b/apparmor.d/profiles-g-l/gparted index f225b5c06..dd7d3bff3 100644 --- a/apparmor.d/profiles-g-l/gparted +++ b/apparmor.d/profiles-g-l/gparted @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gpartedbin b/apparmor.d/profiles-g-l/gpartedbin index b60e386bb..e6f32d27c 100644 --- a/apparmor.d/profiles-g-l/gpartedbin +++ b/apparmor.d/profiles-g-l/gpartedbin @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gpasswd b/apparmor.d/profiles-g-l/gpasswd index 11c1e9767..8afdff8db 100644 --- a/apparmor.d/profiles-g-l/gpasswd +++ b/apparmor.d/profiles-g-l/gpasswd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gping b/apparmor.d/profiles-g-l/gping index 956a1781f..34a9401a4 100644 --- a/apparmor.d/profiles-g-l/gping +++ b/apparmor.d/profiles-g-l/gping @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gpo b/apparmor.d/profiles-g-l/gpo index 411d078bd..4088f51fb 100644 --- a/apparmor.d/profiles-g-l/gpo +++ b/apparmor.d/profiles-g-l/gpo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gpodder b/apparmor.d/profiles-g-l/gpodder index 10b8492e9..ec1adabe4 100644 --- a/apparmor.d/profiles-g-l/gpodder +++ b/apparmor.d/profiles-g-l/gpodder @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gpodder-migrate2tres b/apparmor.d/profiles-g-l/gpodder-migrate2tres index f8e2c73f4..11896a26c 100644 --- a/apparmor.d/profiles-g-l/gpodder-migrate2tres +++ b/apparmor.d/profiles-g-l/gpodder-migrate2tres @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gpu-manager b/apparmor.d/profiles-g-l/gpu-manager index 4444662fc..8cc49acdf 100644 --- a/apparmor.d/profiles-g-l/gpu-manager +++ b/apparmor.d/profiles-g-l/gpu-manager @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/groupadd b/apparmor.d/profiles-g-l/groupadd index 4c6e80c59..9450974a1 100644 --- a/apparmor.d/profiles-g-l/groupadd +++ b/apparmor.d/profiles-g-l/groupadd @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/groupdel b/apparmor.d/profiles-g-l/groupdel index a28fb72f7..99b7fddaa 100644 --- a/apparmor.d/profiles-g-l/groupdel +++ b/apparmor.d/profiles-g-l/groupdel @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/groupmod b/apparmor.d/profiles-g-l/groupmod index a37273af6..4b9b0446a 100644 --- a/apparmor.d/profiles-g-l/groupmod +++ b/apparmor.d/profiles-g-l/groupmod @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/groups b/apparmor.d/profiles-g-l/groups index 4c0f07d87..916a73b22 100644 --- a/apparmor.d/profiles-g-l/groups +++ b/apparmor.d/profiles-g-l/groups @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/grpck b/apparmor.d/profiles-g-l/grpck index 3e42f90c7..5fad8960c 100644 --- a/apparmor.d/profiles-g-l/grpck +++ b/apparmor.d/profiles-g-l/grpck @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gsettings b/apparmor.d/profiles-g-l/gsettings index cd7ce37ce..4ac891769 100644 --- a/apparmor.d/profiles-g-l/gsettings +++ b/apparmor.d/profiles-g-l/gsettings @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gsimplecal b/apparmor.d/profiles-g-l/gsimplecal index ba7ba4da4..b0b743359 100644 --- a/apparmor.d/profiles-g-l/gsimplecal +++ b/apparmor.d/profiles-g-l/gsimplecal @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gsmartcontrol b/apparmor.d/profiles-g-l/gsmartcontrol index 9ce2b10dc..5d04e33fb 100644 --- a/apparmor.d/profiles-g-l/gsmartcontrol +++ b/apparmor.d/profiles-g-l/gsmartcontrol @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gsmartcontrol-root b/apparmor.d/profiles-g-l/gsmartcontrol-root index 565634e10..10c1f445b 100644 --- a/apparmor.d/profiles-g-l/gsmartcontrol-root +++ b/apparmor.d/profiles-g-l/gsmartcontrol-root @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gssproxy b/apparmor.d/profiles-g-l/gssproxy index 6a16d1dc7..8fa3da0d7 100644 --- a/apparmor.d/profiles-g-l/gssproxy +++ b/apparmor.d/profiles-g-l/gssproxy @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gtk-query-immodules b/apparmor.d/profiles-g-l/gtk-query-immodules index a92092f8c..46aece91a 100644 --- a/apparmor.d/profiles-g-l/gtk-query-immodules +++ b/apparmor.d/profiles-g-l/gtk-query-immodules @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gtk-update-icon-cache b/apparmor.d/profiles-g-l/gtk-update-icon-cache index a91dc3069..b1a6779ae 100644 --- a/apparmor.d/profiles-g-l/gtk-update-icon-cache +++ b/apparmor.d/profiles-g-l/gtk-update-icon-cache @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gtk-youtube-viewer b/apparmor.d/profiles-g-l/gtk-youtube-viewer index 5f2e4fde7..18c3bd445 100644 --- a/apparmor.d/profiles-g-l/gtk-youtube-viewer +++ b/apparmor.d/profiles-g-l/gtk-youtube-viewer @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hardinfo b/apparmor.d/profiles-g-l/hardinfo index 9cadb774a..79c77f3a7 100644 --- a/apparmor.d/profiles-g-l/hardinfo +++ b/apparmor.d/profiles-g-l/hardinfo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/haveged b/apparmor.d/profiles-g-l/haveged index ff3870880..e61b4404b 100644 --- a/apparmor.d/profiles-g-l/haveged +++ b/apparmor.d/profiles-g-l/haveged @@ -5,7 +5,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-3.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hbbr b/apparmor.d/profiles-g-l/hbbr index 78c15672b..5257195f8 100644 --- a/apparmor.d/profiles-g-l/hbbr +++ b/apparmor.d/profiles-g-l/hbbr @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hbbs b/apparmor.d/profiles-g-l/hbbs index 69ac0cc8c..fd8aa3e74 100644 --- a/apparmor.d/profiles-g-l/hbbs +++ b/apparmor.d/profiles-g-l/hbbs @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hciconfig b/apparmor.d/profiles-g-l/hciconfig index eb0319c5f..1bf4c02f8 100644 --- a/apparmor.d/profiles-g-l/hciconfig +++ b/apparmor.d/profiles-g-l/hciconfig @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hddtemp b/apparmor.d/profiles-g-l/hddtemp index e0be907a6..e96a45237 100644 --- a/apparmor.d/profiles-g-l/hddtemp +++ b/apparmor.d/profiles-g-l/hddtemp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hdparm b/apparmor.d/profiles-g-l/hdparm index f29bc1c20..606540bb9 100644 --- a/apparmor.d/profiles-g-l/hdparm +++ b/apparmor.d/profiles-g-l/hdparm @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hexchat b/apparmor.d/profiles-g-l/hexchat index aaa550dfc..064e850c2 100644 --- a/apparmor.d/profiles-g-l/hexchat +++ b/apparmor.d/profiles-g-l/hexchat @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/highlight b/apparmor.d/profiles-g-l/highlight index fb90c4475..bd375b520 100644 --- a/apparmor.d/profiles-g-l/highlight +++ b/apparmor.d/profiles-g-l/highlight @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/homebank b/apparmor.d/profiles-g-l/homebank index 4c0b0316a..cb459919f 100644 --- a/apparmor.d/profiles-g-l/homebank +++ b/apparmor.d/profiles-g-l/homebank @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/host b/apparmor.d/profiles-g-l/host index 5894c85a0..cb9f8d2d9 100644 --- a/apparmor.d/profiles-g-l/host +++ b/apparmor.d/profiles-g-l/host @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hostname b/apparmor.d/profiles-g-l/hostname index efda5b4a8..326d156ef 100644 --- a/apparmor.d/profiles-g-l/hostname +++ b/apparmor.d/profiles-g-l/hostname @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/htop b/apparmor.d/profiles-g-l/htop index 7e8faecfa..08b58ebd2 100644 --- a/apparmor.d/profiles-g-l/htop +++ b/apparmor.d/profiles-g-l/htop @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hugeadm b/apparmor.d/profiles-g-l/hugeadm index 731483cf6..95bc7037b 100644 --- a/apparmor.d/profiles-g-l/hugeadm +++ b/apparmor.d/profiles-g-l/hugeadm @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hugo b/apparmor.d/profiles-g-l/hugo index 9cf73dc49..6bb737ca0 100644 --- a/apparmor.d/profiles-g-l/hugo +++ b/apparmor.d/profiles-g-l/hugo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hw-probe b/apparmor.d/profiles-g-l/hw-probe index 7c6b87b6c..7c960482a 100644 --- a/apparmor.d/profiles-g-l/hw-probe +++ b/apparmor.d/profiles-g-l/hw-probe @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hwinfo b/apparmor.d/profiles-g-l/hwinfo index f7953e346..e7bf2937c 100644 --- a/apparmor.d/profiles-g-l/hwinfo +++ b/apparmor.d/profiles-g-l/hwinfo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/hypnotix b/apparmor.d/profiles-g-l/hypnotix index 0a54528be..be18726a0 100644 --- a/apparmor.d/profiles-g-l/hypnotix +++ b/apparmor.d/profiles-g-l/hypnotix @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/i2cdetect b/apparmor.d/profiles-g-l/i2cdetect index f045b489d..5ce4da0bb 100644 --- a/apparmor.d/profiles-g-l/i2cdetect +++ b/apparmor.d/profiles-g-l/i2cdetect @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/i3lock b/apparmor.d/profiles-g-l/i3lock index d2fbdff2c..ea72704c1 100644 --- a/apparmor.d/profiles-g-l/i3lock +++ b/apparmor.d/profiles-g-l/i3lock @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/i3lock-fancy b/apparmor.d/profiles-g-l/i3lock-fancy index fce4ff7d4..242c43de5 100644 --- a/apparmor.d/profiles-g-l/i3lock-fancy +++ b/apparmor.d/profiles-g-l/i3lock-fancy @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/iceauth b/apparmor.d/profiles-g-l/iceauth index 66111ff55..b3dbef04f 100644 --- a/apparmor.d/profiles-g-l/iceauth +++ b/apparmor.d/profiles-g-l/iceauth @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/id b/apparmor.d/profiles-g-l/id index 6ba6001b6..933e5d712 100644 --- a/apparmor.d/profiles-g-l/id +++ b/apparmor.d/profiles-g-l/id @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/ifconfig b/apparmor.d/profiles-g-l/ifconfig index 8dd7eaac0..5bebad691 100644 --- a/apparmor.d/profiles-g-l/ifconfig +++ b/apparmor.d/profiles-g-l/ifconfig @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/ifup b/apparmor.d/profiles-g-l/ifup index 4788daeb6..7df4e5ea6 100644 --- a/apparmor.d/profiles-g-l/ifup +++ b/apparmor.d/profiles-g-l/ifup @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/im-launch b/apparmor.d/profiles-g-l/im-launch index 5520e990c..c5c4aa276 100644 --- a/apparmor.d/profiles-g-l/im-launch +++ b/apparmor.d/profiles-g-l/im-launch @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/img2txt b/apparmor.d/profiles-g-l/img2txt index 41d77339b..5529ded9b 100644 --- a/apparmor.d/profiles-g-l/img2txt +++ b/apparmor.d/profiles-g-l/img2txt @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/imv-wayland b/apparmor.d/profiles-g-l/imv-wayland index 72eaecc9c..d83945934 100644 --- a/apparmor.d/profiles-g-l/imv-wayland +++ b/apparmor.d/profiles-g-l/imv-wayland @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/initd-kexec b/apparmor.d/profiles-g-l/initd-kexec index f17356fcc..272679ede 100644 --- a/apparmor.d/profiles-g-l/initd-kexec +++ b/apparmor.d/profiles-g-l/initd-kexec @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/initd-kexec-load b/apparmor.d/profiles-g-l/initd-kexec-load index d36584ec9..eb5b6ead1 100644 --- a/apparmor.d/profiles-g-l/initd-kexec-load +++ b/apparmor.d/profiles-g-l/initd-kexec-load @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/initd-kmod b/apparmor.d/profiles-g-l/initd-kmod index f8f975211..a73ddb8bf 100644 --- a/apparmor.d/profiles-g-l/initd-kmod +++ b/apparmor.d/profiles-g-l/initd-kmod @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/install-catalog b/apparmor.d/profiles-g-l/install-catalog index 370cbf154..b1a56c41d 100644 --- a/apparmor.d/profiles-g-l/install-catalog +++ b/apparmor.d/profiles-g-l/install-catalog @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/install-info b/apparmor.d/profiles-g-l/install-info index 54e40386f..f155339b1 100644 --- a/apparmor.d/profiles-g-l/install-info +++ b/apparmor.d/profiles-g-l/install-info @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/install-printerdriver b/apparmor.d/profiles-g-l/install-printerdriver index ddbf2e31c..8ea351857 100644 --- a/apparmor.d/profiles-g-l/install-printerdriver +++ b/apparmor.d/profiles-g-l/install-printerdriver @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/inxi b/apparmor.d/profiles-g-l/inxi index 0dbe03687..97bd3bfed 100644 --- a/apparmor.d/profiles-g-l/inxi +++ b/apparmor.d/profiles-g-l/inxi @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/ioping b/apparmor.d/profiles-g-l/ioping index 497e5cb1c..1ff3615f1 100644 --- a/apparmor.d/profiles-g-l/ioping +++ b/apparmor.d/profiles-g-l/ioping @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/iotop b/apparmor.d/profiles-g-l/iotop index be2738443..c53b4656d 100644 --- a/apparmor.d/profiles-g-l/iotop +++ b/apparmor.d/profiles-g-l/iotop @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/ip b/apparmor.d/profiles-g-l/ip index 7fee79abc..1c870d94e 100644 --- a/apparmor.d/profiles-g-l/ip +++ b/apparmor.d/profiles-g-l/ip @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/ipcalc b/apparmor.d/profiles-g-l/ipcalc index dd750b8c9..ff7f1c799 100644 --- a/apparmor.d/profiles-g-l/ipcalc +++ b/apparmor.d/profiles-g-l/ipcalc @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/irqbalance b/apparmor.d/profiles-g-l/irqbalance index 2226e6dd2..fec2d7c93 100644 --- a/apparmor.d/profiles-g-l/irqbalance +++ b/apparmor.d/profiles-g-l/irqbalance @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index 60f5f22ee..d358f080b 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/iw b/apparmor.d/profiles-g-l/iw index 3b62c32ba..8639b8aad 100644 --- a/apparmor.d/profiles-g-l/iw +++ b/apparmor.d/profiles-g-l/iw @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/iwconfig b/apparmor.d/profiles-g-l/iwconfig index 62bc16041..962b4ab23 100644 --- a/apparmor.d/profiles-g-l/iwconfig +++ b/apparmor.d/profiles-g-l/iwconfig @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/iwlist b/apparmor.d/profiles-g-l/iwlist index ef2a280e0..298c94688 100644 --- a/apparmor.d/profiles-g-l/iwlist +++ b/apparmor.d/profiles-g-l/iwlist @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/jackdbus b/apparmor.d/profiles-g-l/jackdbus index ed1094a17..8326a3e40 100644 --- a/apparmor.d/profiles-g-l/jackdbus +++ b/apparmor.d/profiles-g-l/jackdbus @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/jami-gnome b/apparmor.d/profiles-g-l/jami-gnome index 9d22933fc..3a1e504a8 100644 --- a/apparmor.d/profiles-g-l/jami-gnome +++ b/apparmor.d/profiles-g-l/jami-gnome @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/jdownloader b/apparmor.d/profiles-g-l/jdownloader index 9dc2ed226..1220e9bbd 100644 --- a/apparmor.d/profiles-g-l/jdownloader +++ b/apparmor.d/profiles-g-l/jdownloader @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/jekyll b/apparmor.d/profiles-g-l/jekyll index 667b9304f..d3444fea5 100644 --- a/apparmor.d/profiles-g-l/jekyll +++ b/apparmor.d/profiles-g-l/jekyll @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/jgmenu b/apparmor.d/profiles-g-l/jgmenu index 6c7f3c1ff..044eda493 100644 --- a/apparmor.d/profiles-g-l/jgmenu +++ b/apparmor.d/profiles-g-l/jgmenu @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/jitterentropy-rngd b/apparmor.d/profiles-g-l/jitterentropy-rngd index 5b96e0c58..49d5c6c57 100644 --- a/apparmor.d/profiles-g-l/jitterentropy-rngd +++ b/apparmor.d/profiles-g-l/jitterentropy-rngd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/jmtpfs b/apparmor.d/profiles-g-l/jmtpfs index 77127171c..57ab39a75 100644 --- a/apparmor.d/profiles-g-l/jmtpfs +++ b/apparmor.d/profiles-g-l/jmtpfs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kanyremote b/apparmor.d/profiles-g-l/kanyremote index fef624841..0e27fa5ae 100644 --- a/apparmor.d/profiles-g-l/kanyremote +++ b/apparmor.d/profiles-g-l/kanyremote @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kcheckpass b/apparmor.d/profiles-g-l/kcheckpass index 9dddbe470..33bd9c641 100644 --- a/apparmor.d/profiles-g-l/kcheckpass +++ b/apparmor.d/profiles-g-l/kcheckpass @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kconfig-hardened-check b/apparmor.d/profiles-g-l/kconfig-hardened-check index 6858f1b45..743da77a1 100644 --- a/apparmor.d/profiles-g-l/kconfig-hardened-check +++ b/apparmor.d/profiles-g-l/kconfig-hardened-check @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index c494e16d5..f48113b02 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/keepassxc-cli b/apparmor.d/profiles-g-l/keepassxc-cli index b1d6e0e86..c8e189f4e 100644 --- a/apparmor.d/profiles-g-l/keepassxc-cli +++ b/apparmor.d/profiles-g-l/keepassxc-cli @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/keepassxc-proxy b/apparmor.d/profiles-g-l/keepassxc-proxy index a193df0ee..24a30c56c 100644 --- a/apparmor.d/profiles-g-l/keepassxc-proxy +++ b/apparmor.d/profiles-g-l/keepassxc-proxy @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kernel-install b/apparmor.d/profiles-g-l/kernel-install index 69096fe45..07c058124 100644 --- a/apparmor.d/profiles-g-l/kernel-install +++ b/apparmor.d/profiles-g-l/kernel-install @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kerneloops b/apparmor.d/profiles-g-l/kerneloops index f3c7e3b37..815fa4e38 100644 --- a/apparmor.d/profiles-g-l/kerneloops +++ b/apparmor.d/profiles-g-l/kerneloops @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kerneloops-applet b/apparmor.d/profiles-g-l/kerneloops-applet index e6860c5b9..8f5e66cbc 100644 --- a/apparmor.d/profiles-g-l/kerneloops-applet +++ b/apparmor.d/profiles-g-l/kerneloops-applet @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kexec b/apparmor.d/profiles-g-l/kexec index dc027eae6..102b75d83 100644 --- a/apparmor.d/profiles-g-l/kexec +++ b/apparmor.d/profiles-g-l/kexec @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index ac03c2501..08fc10c22 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kodi b/apparmor.d/profiles-g-l/kodi index 3d8800cc7..fc6a6ede5 100644 --- a/apparmor.d/profiles-g-l/kodi +++ b/apparmor.d/profiles-g-l/kodi @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kodi-xrandr b/apparmor.d/profiles-g-l/kodi-xrandr index 932b869b8..450600d78 100644 --- a/apparmor.d/profiles-g-l/kodi-xrandr +++ b/apparmor.d/profiles-g-l/kodi-xrandr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/kvm-ok b/apparmor.d/profiles-g-l/kvm-ok index 22e087146..eb3d1cc80 100644 --- a/apparmor.d/profiles-g-l/kvm-ok +++ b/apparmor.d/profiles-g-l/kvm-ok @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/labwc b/apparmor.d/profiles-g-l/labwc index 8fa7552af..93234bf52 100644 --- a/apparmor.d/profiles-g-l/labwc +++ b/apparmor.d/profiles-g-l/labwc @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo b/apparmor.d/profiles-g-l/landscape-sysinfo index a9df8a2b3..52252882d 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo +++ b/apparmor.d/profiles-g-l/landscape-sysinfo @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper index e33195eb1..e765a5dc6 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper +++ b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/language-validate b/apparmor.d/profiles-g-l/language-validate index e77d997c5..bf999b79e 100644 --- a/apparmor.d/profiles-g-l/language-validate +++ b/apparmor.d/profiles-g-l/language-validate @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/last b/apparmor.d/profiles-g-l/last index fd0c403a4..ee40f81af 100644 --- a/apparmor.d/profiles-g-l/last +++ b/apparmor.d/profiles-g-l/last @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lastlog b/apparmor.d/profiles-g-l/lastlog index 3df955097..392aba362 100644 --- a/apparmor.d/profiles-g-l/lastlog +++ b/apparmor.d/profiles-g-l/lastlog @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 1271b8c1a..2198ad925 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/light b/apparmor.d/profiles-g-l/light index 379f32ac8..6ce5f2f57 100644 --- a/apparmor.d/profiles-g-l/light +++ b/apparmor.d/profiles-g-l/light @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/light-locker b/apparmor.d/profiles-g-l/light-locker index 8e8732c19..8d2fcdcc8 100644 --- a/apparmor.d/profiles-g-l/light-locker +++ b/apparmor.d/profiles-g-l/light-locker @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/light-locker-command b/apparmor.d/profiles-g-l/light-locker-command index 21daa1853..78e9983b3 100644 --- a/apparmor.d/profiles-g-l/light-locker-command +++ b/apparmor.d/profiles-g-l/light-locker-command @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lightworks b/apparmor.d/profiles-g-l/lightworks index f2e6c74cf..6462a0b6c 100644 --- a/apparmor.d/profiles-g-l/lightworks +++ b/apparmor.d/profiles-g-l/lightworks @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lightworks-ntcardvt b/apparmor.d/profiles-g-l/lightworks-ntcardvt index b4dc21398..941798245 100644 --- a/apparmor.d/profiles-g-l/lightworks-ntcardvt +++ b/apparmor.d/profiles-g-l/lightworks-ntcardvt @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/linux-check-removal b/apparmor.d/profiles-g-l/linux-check-removal index 41813c1a1..9854fd554 100644 --- a/apparmor.d/profiles-g-l/linux-check-removal +++ b/apparmor.d/profiles-g-l/linux-check-removal @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/linux-version b/apparmor.d/profiles-g-l/linux-version index 998c48780..1a8ffbb0d 100644 --- a/apparmor.d/profiles-g-l/linux-version +++ b/apparmor.d/profiles-g-l/linux-version @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 06811fbd4..9efceaa7a 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -2,7 +2,7 @@ # Copyright (C) 2024 EricLin # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/locale-gen b/apparmor.d/profiles-g-l/locale-gen index 093074d1b..b9254171a 100644 --- a/apparmor.d/profiles-g-l/locale-gen +++ b/apparmor.d/profiles-g-l/locale-gen @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/localepurge b/apparmor.d/profiles-g-l/localepurge index 30018bf00..f6781f4b1 100644 --- a/apparmor.d/profiles-g-l/localepurge +++ b/apparmor.d/profiles-g-l/localepurge @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/login b/apparmor.d/profiles-g-l/login index 41fa293b4..cbaac35b7 100644 --- a/apparmor.d/profiles-g-l/login +++ b/apparmor.d/profiles-g-l/login @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate index 9bfe64a72..f98457155 100644 --- a/apparmor.d/profiles-g-l/logrotate +++ b/apparmor.d/profiles-g-l/logrotate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/losetup b/apparmor.d/profiles-g-l/losetup index fb8b448d1..fd2472dce 100644 --- a/apparmor.d/profiles-g-l/losetup +++ b/apparmor.d/profiles-g-l/losetup @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/low-memory-monitor b/apparmor.d/profiles-g-l/low-memory-monitor index 4471dbd2e..e2baa4a26 100644 --- a/apparmor.d/profiles-g-l/low-memory-monitor +++ b/apparmor.d/profiles-g-l/low-memory-monitor @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lsblk b/apparmor.d/profiles-g-l/lsblk index 56aad52b8..147e1ba24 100644 --- a/apparmor.d/profiles-g-l/lsblk +++ b/apparmor.d/profiles-g-l/lsblk @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lscpu b/apparmor.d/profiles-g-l/lscpu index 804e67632..caa2b5628 100644 --- a/apparmor.d/profiles-g-l/lscpu +++ b/apparmor.d/profiles-g-l/lscpu @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lsinitramfs b/apparmor.d/profiles-g-l/lsinitramfs index e5b6ff750..2e3a20ad0 100644 --- a/apparmor.d/profiles-g-l/lsinitramfs +++ b/apparmor.d/profiles-g-l/lsinitramfs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lspci b/apparmor.d/profiles-g-l/lspci index 656597c1c..0f3abf1dc 100644 --- a/apparmor.d/profiles-g-l/lspci +++ b/apparmor.d/profiles-g-l/lspci @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lsusb b/apparmor.d/profiles-g-l/lsusb index 22e8a7cd2..b628b3668 100644 --- a/apparmor.d/profiles-g-l/lsusb +++ b/apparmor.d/profiles-g-l/lsusb @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lvm b/apparmor.d/profiles-g-l/lvm index 0bd6ef2e8..e579d7a91 100644 --- a/apparmor.d/profiles-g-l/lvm +++ b/apparmor.d/profiles-g-l/lvm @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lvmconfig b/apparmor.d/profiles-g-l/lvmconfig index f38bd6780..5e5a0d1dd 100644 --- a/apparmor.d/profiles-g-l/lvmconfig +++ b/apparmor.d/profiles-g-l/lvmconfig @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lvmdump b/apparmor.d/profiles-g-l/lvmdump index 9dbe000f7..6a443fc57 100644 --- a/apparmor.d/profiles-g-l/lvmdump +++ b/apparmor.d/profiles-g-l/lvmdump @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lvmpolld b/apparmor.d/profiles-g-l/lvmpolld index 7a4bc90b3..fdc3bad3f 100644 --- a/apparmor.d/profiles-g-l/lvmpolld +++ b/apparmor.d/profiles-g-l/lvmpolld @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lxappearance b/apparmor.d/profiles-g-l/lxappearance index c4ef29625..a7c3a2177 100644 --- a/apparmor.d/profiles-g-l/lxappearance +++ b/apparmor.d/profiles-g-l/lxappearance @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/lynx b/apparmor.d/profiles-g-l/lynx index 143472569..a1f4ced89 100644 --- a/apparmor.d/profiles-g-l/lynx +++ b/apparmor.d/profiles-g-l/lynx @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/macchanger b/apparmor.d/profiles-m-r/macchanger index 8f4efc921..c3e0c0556 100644 --- a/apparmor.d/profiles-m-r/macchanger +++ b/apparmor.d/profiles-m-r/macchanger @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/man b/apparmor.d/profiles-m-r/man index aa0195853..c60325742 100644 --- a/apparmor.d/profiles-m-r/man +++ b/apparmor.d/profiles-m-r/man @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mandb b/apparmor.d/profiles-m-r/mandb index beeba50e8..e1404aba0 100644 --- a/apparmor.d/profiles-m-r/mandb +++ b/apparmor.d/profiles-m-r/mandb @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mate-notification-daemon b/apparmor.d/profiles-m-r/mate-notification-daemon index 871434151..19b0c7fba 100644 --- a/apparmor.d/profiles-m-r/mate-notification-daemon +++ b/apparmor.d/profiles-m-r/mate-notification-daemon @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mdevctl b/apparmor.d/profiles-m-r/mdevctl index a2631c768..f1b5034e6 100644 --- a/apparmor.d/profiles-m-r/mdevctl +++ b/apparmor.d/profiles-m-r/mdevctl @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mediainfo b/apparmor.d/profiles-m-r/mediainfo index bb7c2d59b..c3333b860 100644 --- a/apparmor.d/profiles-m-r/mediainfo +++ b/apparmor.d/profiles-m-r/mediainfo @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mediainfo-gui b/apparmor.d/profiles-m-r/mediainfo-gui index 4648d4ddf..1d18d5187 100644 --- a/apparmor.d/profiles-m-r/mediainfo-gui +++ b/apparmor.d/profiles-m-r/mediainfo-gui @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/megasync b/apparmor.d/profiles-m-r/megasync index 236041778..3796c2b75 100644 --- a/apparmor.d/profiles-m-r/megasync +++ b/apparmor.d/profiles-m-r/megasync @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/memtester b/apparmor.d/profiles-m-r/memtester index 506892f0e..aeb26d004 100644 --- a/apparmor.d/profiles-m-r/memtester +++ b/apparmor.d/profiles-m-r/memtester @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/merkaartor b/apparmor.d/profiles-m-r/merkaartor index 739d18e2f..e43460210 100644 --- a/apparmor.d/profiles-m-r/merkaartor +++ b/apparmor.d/profiles-m-r/merkaartor @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/metadata-cleaner b/apparmor.d/profiles-m-r/metadata-cleaner index 142ccb78a..87a26b0f3 100644 --- a/apparmor.d/profiles-m-r/metadata-cleaner +++ b/apparmor.d/profiles-m-r/metadata-cleaner @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mimetype b/apparmor.d/profiles-m-r/mimetype index d9e34f8b5..d6823da9b 100644 --- a/apparmor.d/profiles-m-r/mimetype +++ b/apparmor.d/profiles-m-r/mimetype @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/minitube b/apparmor.d/profiles-m-r/minitube index b349940ca..ce8380261 100644 --- a/apparmor.d/profiles-m-r/minitube +++ b/apparmor.d/profiles-m-r/minitube @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mission-control b/apparmor.d/profiles-m-r/mission-control index a6f1e5803..a908feb57 100644 --- a/apparmor.d/profiles-m-r/mission-control +++ b/apparmor.d/profiles-m-r/mission-control @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkcert b/apparmor.d/profiles-m-r/mkcert index 0941ad343..3ae643e1d 100644 --- a/apparmor.d/profiles-m-r/mkcert +++ b/apparmor.d/profiles-m-r/mkcert @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mke2fs b/apparmor.d/profiles-m-r/mke2fs index 038de3c73..acf88197f 100644 --- a/apparmor.d/profiles-m-r/mke2fs +++ b/apparmor.d/profiles-m-r/mke2fs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkfs-btrfs b/apparmor.d/profiles-m-r/mkfs-btrfs index 237fc8006..1e6c95838 100644 --- a/apparmor.d/profiles-m-r/mkfs-btrfs +++ b/apparmor.d/profiles-m-r/mkfs-btrfs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkfs-fat b/apparmor.d/profiles-m-r/mkfs-fat index d7f7a1cc9..1aba124ae 100644 --- a/apparmor.d/profiles-m-r/mkfs-fat +++ b/apparmor.d/profiles-m-r/mkfs-fat @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index b24bdbdf1..3b02d97c2 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -4,7 +4,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkntfs b/apparmor.d/profiles-m-r/mkntfs index ccfa5f4ed..5141c5385 100644 --- a/apparmor.d/profiles-m-r/mkntfs +++ b/apparmor.d/profiles-m-r/mkntfs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkswap b/apparmor.d/profiles-m-r/mkswap index 4c732c2c6..4a818cd58 100644 --- a/apparmor.d/profiles-m-r/mkswap +++ b/apparmor.d/profiles-m-r/mkswap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkvmerge b/apparmor.d/profiles-m-r/mkvmerge index 22251b87e..a13a22e7ed 100644 --- a/apparmor.d/profiles-m-r/mkvmerge +++ b/apparmor.d/profiles-m-r/mkvmerge @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mkvtoolnix-gui b/apparmor.d/profiles-m-r/mkvtoolnix-gui index 595a24666..835e1a391 100644 --- a/apparmor.d/profiles-m-r/mkvtoolnix-gui +++ b/apparmor.d/profiles-m-r/mkvtoolnix-gui @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mlocate b/apparmor.d/profiles-m-r/mlocate index 08fdee129..f54b2f047 100644 --- a/apparmor.d/profiles-m-r/mlocate +++ b/apparmor.d/profiles-m-r/mlocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/modprobed-db b/apparmor.d/profiles-m-r/modprobed-db index 3798332ea..cd2ddc0e6 100644 --- a/apparmor.d/profiles-m-r/modprobed-db +++ b/apparmor.d/profiles-m-r/modprobed-db @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/molly-guard b/apparmor.d/profiles-m-r/molly-guard index d75a5092b..df1806311 100644 --- a/apparmor.d/profiles-m-r/molly-guard +++ b/apparmor.d/profiles-m-r/molly-guard @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/monitorix b/apparmor.d/profiles-m-r/monitorix index 38cbecd71..e847db872 100644 --- a/apparmor.d/profiles-m-r/monitorix +++ b/apparmor.d/profiles-m-r/monitorix @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mono-sgen b/apparmor.d/profiles-m-r/mono-sgen index e010a83d7..bdaafd9c8 100644 --- a/apparmor.d/profiles-m-r/mono-sgen +++ b/apparmor.d/profiles-m-r/mono-sgen @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mount b/apparmor.d/profiles-m-r/mount index 09b682c6b..f8616cd88 100644 --- a/apparmor.d/profiles-m-r/mount +++ b/apparmor.d/profiles-m-r/mount @@ -4,7 +4,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mount-cifs b/apparmor.d/profiles-m-r/mount-cifs index bbadcc7e0..78651ba23 100644 --- a/apparmor.d/profiles-m-r/mount-cifs +++ b/apparmor.d/profiles-m-r/mount-cifs @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mount-nfs b/apparmor.d/profiles-m-r/mount-nfs index 698f350ce..3fafd269a 100644 --- a/apparmor.d/profiles-m-r/mount-nfs +++ b/apparmor.d/profiles-m-r/mount-nfs @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mount-zfs b/apparmor.d/profiles-m-r/mount-zfs index bc47f0a30..552f96b05 100644 --- a/apparmor.d/profiles-m-r/mount-zfs +++ b/apparmor.d/profiles-m-r/mount-zfs @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mpd b/apparmor.d/profiles-m-r/mpd index 14a6c4acf..89b66253a 100644 --- a/apparmor.d/profiles-m-r/mpd +++ b/apparmor.d/profiles-m-r/mpd @@ -4,7 +4,7 @@ # Copyright (C) 2023 Jose Maldonado # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mpsyt b/apparmor.d/profiles-m-r/mpsyt index 46f239fce..9a138ff50 100644 --- a/apparmor.d/profiles-m-r/mpsyt +++ b/apparmor.d/profiles-m-r/mpsyt @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mpv b/apparmor.d/profiles-m-r/mpv index d5e6371c3..3d044049e 100644 --- a/apparmor.d/profiles-m-r/mpv +++ b/apparmor.d/profiles-m-r/mpv @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mtools b/apparmor.d/profiles-m-r/mtools index 75c95fffd..5fea49231 100644 --- a/apparmor.d/profiles-m-r/mtools +++ b/apparmor.d/profiles-m-r/mtools @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mtr b/apparmor.d/profiles-m-r/mtr index 5b341d8f5..4ff851662 100644 --- a/apparmor.d/profiles-m-r/mtr +++ b/apparmor.d/profiles-m-r/mtr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mtr-packet b/apparmor.d/profiles-m-r/mtr-packet index 4bf15b7d5..d771c58ec 100644 --- a/apparmor.d/profiles-m-r/mtr-packet +++ b/apparmor.d/profiles-m-r/mtr-packet @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mullvad-setup b/apparmor.d/profiles-m-r/mullvad-setup index 46e10927b..77ac07045 100644 --- a/apparmor.d/profiles-m-r/mullvad-setup +++ b/apparmor.d/profiles-m-r/mullvad-setup @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/multipath b/apparmor.d/profiles-m-r/multipath index b79db6418..409834fbc 100644 --- a/apparmor.d/profiles-m-r/multipath +++ b/apparmor.d/profiles-m-r/multipath @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/multipathd b/apparmor.d/profiles-m-r/multipathd index 510fb3417..14bb16caf 100644 --- a/apparmor.d/profiles-m-r/multipathd +++ b/apparmor.d/profiles-m-r/multipathd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mumble b/apparmor.d/profiles-m-r/mumble index 879d2b9bf..48ed42d84 100644 --- a/apparmor.d/profiles-m-r/mumble +++ b/apparmor.d/profiles-m-r/mumble @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mumble-overlay b/apparmor.d/profiles-m-r/mumble-overlay index 61b287329..8d17ef3d6 100644 --- a/apparmor.d/profiles-m-r/mumble-overlay +++ b/apparmor.d/profiles-m-r/mumble-overlay @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/mutt b/apparmor.d/profiles-m-r/mutt index 9d01e2269..4e218a8a0 100644 --- a/apparmor.d/profiles-m-r/mutt +++ b/apparmor.d/profiles-m-r/mutt @@ -2,7 +2,7 @@ # Copyright (C) 2023 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index e3222d2ff..1f32df8c3 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/needrestart-apt-pinvoke b/apparmor.d/profiles-m-r/needrestart-apt-pinvoke index 805f69678..0a9e1dc33 100644 --- a/apparmor.d/profiles-m-r/needrestart-apt-pinvoke +++ b/apparmor.d/profiles-m-r/needrestart-apt-pinvoke @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/needrestart-dpkg-status b/apparmor.d/profiles-m-r/needrestart-dpkg-status index fff97e67c..3d54f896d 100644 --- a/apparmor.d/profiles-m-r/needrestart-dpkg-status +++ b/apparmor.d/profiles-m-r/needrestart-dpkg-status @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions index 37dd180c3..b60b5f488 100644 --- a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions +++ b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nemo b/apparmor.d/profiles-m-r/nemo index a51854414..e3edb99c3 100644 --- a/apparmor.d/profiles-m-r/nemo +++ b/apparmor.d/profiles-m-r/nemo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/netcap b/apparmor.d/profiles-m-r/netcap index d1e5a2852..a73dbffe4 100644 --- a/apparmor.d/profiles-m-r/netcap +++ b/apparmor.d/profiles-m-r/netcap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nethogs b/apparmor.d/profiles-m-r/nethogs index fbdaecaac..c1a9f611a 100644 --- a/apparmor.d/profiles-m-r/nethogs +++ b/apparmor.d/profiles-m-r/nethogs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/netstat b/apparmor.d/profiles-m-r/netstat index 039109ea2..e19884997 100644 --- a/apparmor.d/profiles-m-r/netstat +++ b/apparmor.d/profiles-m-r/netstat @@ -5,7 +5,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/newgidmap b/apparmor.d/profiles-m-r/newgidmap index 9398350e1..4a7196fc2 100644 --- a/apparmor.d/profiles-m-r/newgidmap +++ b/apparmor.d/profiles-m-r/newgidmap @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/newgrp b/apparmor.d/profiles-m-r/newgrp index 1878b9b5e..ebd15d4b6 100644 --- a/apparmor.d/profiles-m-r/newgrp +++ b/apparmor.d/profiles-m-r/newgrp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/newuidmap b/apparmor.d/profiles-m-r/newuidmap index eeba22557..549eb06ef 100644 --- a/apparmor.d/profiles-m-r/newuidmap +++ b/apparmor.d/profiles-m-r/newuidmap @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nfsdcld b/apparmor.d/profiles-m-r/nfsdcld index a02e226c6..be122a3cb 100644 --- a/apparmor.d/profiles-m-r/nfsdcld +++ b/apparmor.d/profiles-m-r/nfsdcld @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nft b/apparmor.d/profiles-m-r/nft index 3595bb4c5..292b22043 100644 --- a/apparmor.d/profiles-m-r/nft +++ b/apparmor.d/profiles-m-r/nft @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nmap b/apparmor.d/profiles-m-r/nmap index 0eb1eceba..348c3ac0e 100644 --- a/apparmor.d/profiles-m-r/nmap +++ b/apparmor.d/profiles-m-r/nmap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nologin b/apparmor.d/profiles-m-r/nologin index fad964b64..3ee32cf34 100644 --- a/apparmor.d/profiles-m-r/nologin +++ b/apparmor.d/profiles-m-r/nologin @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nslookup b/apparmor.d/profiles-m-r/nslookup index 9ee225d9d..41435f2f0 100644 --- a/apparmor.d/profiles-m-r/nslookup +++ b/apparmor.d/profiles-m-r/nslookup @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfs-3g b/apparmor.d/profiles-m-r/ntfs-3g index bc2cb7ef3..d94d7a0f2 100644 --- a/apparmor.d/profiles-m-r/ntfs-3g +++ b/apparmor.d/profiles-m-r/ntfs-3g @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfs-3g-probe b/apparmor.d/profiles-m-r/ntfs-3g-probe index ef870e0f0..73ba17229 100644 --- a/apparmor.d/profiles-m-r/ntfs-3g-probe +++ b/apparmor.d/profiles-m-r/ntfs-3g-probe @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfscat b/apparmor.d/profiles-m-r/ntfscat index 069a597e9..c1d14927b 100644 --- a/apparmor.d/profiles-m-r/ntfscat +++ b/apparmor.d/profiles-m-r/ntfscat @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsclone b/apparmor.d/profiles-m-r/ntfsclone index 06fe65684..c239e81af 100644 --- a/apparmor.d/profiles-m-r/ntfsclone +++ b/apparmor.d/profiles-m-r/ntfsclone @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfscluster b/apparmor.d/profiles-m-r/ntfscluster index 62aff85c8..80fdf01ce 100644 --- a/apparmor.d/profiles-m-r/ntfscluster +++ b/apparmor.d/profiles-m-r/ntfscluster @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfscmp b/apparmor.d/profiles-m-r/ntfscmp index c5ecddc5f..db9a723d4 100644 --- a/apparmor.d/profiles-m-r/ntfscmp +++ b/apparmor.d/profiles-m-r/ntfscmp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfscp b/apparmor.d/profiles-m-r/ntfscp index 3beeb2b7a..2e36046ba 100644 --- a/apparmor.d/profiles-m-r/ntfscp +++ b/apparmor.d/profiles-m-r/ntfscp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsdecrypt b/apparmor.d/profiles-m-r/ntfsdecrypt index e7ffe3188..63f771ed3 100644 --- a/apparmor.d/profiles-m-r/ntfsdecrypt +++ b/apparmor.d/profiles-m-r/ntfsdecrypt @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsfallocate b/apparmor.d/profiles-m-r/ntfsfallocate index 670092820..80654cb7a 100644 --- a/apparmor.d/profiles-m-r/ntfsfallocate +++ b/apparmor.d/profiles-m-r/ntfsfallocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsfix b/apparmor.d/profiles-m-r/ntfsfix index 179b3b7a9..e840ed6c5 100644 --- a/apparmor.d/profiles-m-r/ntfsfix +++ b/apparmor.d/profiles-m-r/ntfsfix @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsinfo b/apparmor.d/profiles-m-r/ntfsinfo index 3156e7004..08b5bea43 100644 --- a/apparmor.d/profiles-m-r/ntfsinfo +++ b/apparmor.d/profiles-m-r/ntfsinfo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfslabel b/apparmor.d/profiles-m-r/ntfslabel index 6eee15ef8..471aefaa1 100644 --- a/apparmor.d/profiles-m-r/ntfslabel +++ b/apparmor.d/profiles-m-r/ntfslabel @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsls b/apparmor.d/profiles-m-r/ntfsls index 56c2c28de..3badd08b2 100644 --- a/apparmor.d/profiles-m-r/ntfsls +++ b/apparmor.d/profiles-m-r/ntfsls @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsmove b/apparmor.d/profiles-m-r/ntfsmove index 876113c98..4c7ade080 100644 --- a/apparmor.d/profiles-m-r/ntfsmove +++ b/apparmor.d/profiles-m-r/ntfsmove @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsrecover b/apparmor.d/profiles-m-r/ntfsrecover index 43de112c1..fff3e1b52 100644 --- a/apparmor.d/profiles-m-r/ntfsrecover +++ b/apparmor.d/profiles-m-r/ntfsrecover @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsresize b/apparmor.d/profiles-m-r/ntfsresize index e0e8f58d2..5c7d5c835 100644 --- a/apparmor.d/profiles-m-r/ntfsresize +++ b/apparmor.d/profiles-m-r/ntfsresize @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfssecaudit b/apparmor.d/profiles-m-r/ntfssecaudit index ee38f60a0..a323a898d 100644 --- a/apparmor.d/profiles-m-r/ntfssecaudit +++ b/apparmor.d/profiles-m-r/ntfssecaudit @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfstruncate b/apparmor.d/profiles-m-r/ntfstruncate index c9dec413a..7f245ee07 100644 --- a/apparmor.d/profiles-m-r/ntfstruncate +++ b/apparmor.d/profiles-m-r/ntfstruncate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsundelete b/apparmor.d/profiles-m-r/ntfsundelete index a01876961..4d96d1dbd 100644 --- a/apparmor.d/profiles-m-r/ntfsundelete +++ b/apparmor.d/profiles-m-r/ntfsundelete @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfsusermap b/apparmor.d/profiles-m-r/ntfsusermap index acc6e8bbc..0cdfb9f71 100644 --- a/apparmor.d/profiles-m-r/ntfsusermap +++ b/apparmor.d/profiles-m-r/ntfsusermap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ntfswipe b/apparmor.d/profiles-m-r/ntfswipe index 1471e1d27..9b64136bd 100644 --- a/apparmor.d/profiles-m-r/ntfswipe +++ b/apparmor.d/profiles-m-r/ntfswipe @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nullmailer-send b/apparmor.d/profiles-m-r/nullmailer-send index e27e15429..6f7b8f225 100644 --- a/apparmor.d/profiles-m-r/nullmailer-send +++ b/apparmor.d/profiles-m-r/nullmailer-send @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/numlockx b/apparmor.d/profiles-m-r/numlockx index 25903ed8b..5c88ec846 100644 --- a/apparmor.d/profiles-m-r/numlockx +++ b/apparmor.d/profiles-m-r/numlockx @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nvidia-detector b/apparmor.d/profiles-m-r/nvidia-detector index b0465ef85..d438b598d 100644 --- a/apparmor.d/profiles-m-r/nvidia-detector +++ b/apparmor.d/profiles-m-r/nvidia-detector @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nvidia-persistenced b/apparmor.d/profiles-m-r/nvidia-persistenced index 33dac3dba..9f44c8f13 100644 --- a/apparmor.d/profiles-m-r/nvidia-persistenced +++ b/apparmor.d/profiles-m-r/nvidia-persistenced @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nvidia-settings b/apparmor.d/profiles-m-r/nvidia-settings index 87271a03d..9e5944bff 100644 --- a/apparmor.d/profiles-m-r/nvidia-settings +++ b/apparmor.d/profiles-m-r/nvidia-settings @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nvidia-smi b/apparmor.d/profiles-m-r/nvidia-smi index 571ab3311..143808f76 100644 --- a/apparmor.d/profiles-m-r/nvidia-smi +++ b/apparmor.d/profiles-m-r/nvidia-smi @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/nvtop b/apparmor.d/profiles-m-r/nvtop index a27a9d0f9..aed19fa5f 100644 --- a/apparmor.d/profiles-m-r/nvtop +++ b/apparmor.d/profiles-m-r/nvtop @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obamenu b/apparmor.d/profiles-m-r/obamenu index 070ac10af..b0c4d88c6 100644 --- a/apparmor.d/profiles-m-r/obamenu +++ b/apparmor.d/profiles-m-r/obamenu @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obconf b/apparmor.d/profiles-m-r/obconf index 37e94369e..7b11aaac5 100644 --- a/apparmor.d/profiles-m-r/obconf +++ b/apparmor.d/profiles-m-r/obconf @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obex-folder-listing b/apparmor.d/profiles-m-r/obex-folder-listing index 7aa4070c5..ebbd8ae50 100644 --- a/apparmor.d/profiles-m-r/obex-folder-listing +++ b/apparmor.d/profiles-m-r/obex-folder-listing @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obexautofs b/apparmor.d/profiles-m-r/obexautofs index 972829890..e50fadddf 100644 --- a/apparmor.d/profiles-m-r/obexautofs +++ b/apparmor.d/profiles-m-r/obexautofs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obexctl b/apparmor.d/profiles-m-r/obexctl index d87243b75..5cd5853d5 100644 --- a/apparmor.d/profiles-m-r/obexctl +++ b/apparmor.d/profiles-m-r/obexctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obexd b/apparmor.d/profiles-m-r/obexd index 9043489eb..3da9b4f5d 100644 --- a/apparmor.d/profiles-m-r/obexd +++ b/apparmor.d/profiles-m-r/obexd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obexfs b/apparmor.d/profiles-m-r/obexfs index 4a746ecf1..07eb4a20d 100644 --- a/apparmor.d/profiles-m-r/obexfs +++ b/apparmor.d/profiles-m-r/obexfs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obexpush-atd b/apparmor.d/profiles-m-r/obexpush-atd index 17b0a2d37..2645ec678 100644 --- a/apparmor.d/profiles-m-r/obexpush-atd +++ b/apparmor.d/profiles-m-r/obexpush-atd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obexpushd b/apparmor.d/profiles-m-r/obexpushd index 33a922f41..44b938401 100644 --- a/apparmor.d/profiles-m-r/obexpushd +++ b/apparmor.d/profiles-m-r/obexpushd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/obxprop b/apparmor.d/profiles-m-r/obxprop index 724f83de7..b0f1c7c27 100644 --- a/apparmor.d/profiles-m-r/obxprop +++ b/apparmor.d/profiles-m-r/obxprop @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/odt2txt b/apparmor.d/profiles-m-r/odt2txt index a2ed448e2..065e953f3 100644 --- a/apparmor.d/profiles-m-r/odt2txt +++ b/apparmor.d/profiles-m-r/odt2txt @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ollama b/apparmor.d/profiles-m-r/ollama index e7ff1db50..7b5521802 100644 --- a/apparmor.d/profiles-m-r/ollama +++ b/apparmor.d/profiles-m-r/ollama @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/on-ac-power b/apparmor.d/profiles-m-r/on-ac-power index d9b5a412e..c92d4d849 100644 --- a/apparmor.d/profiles-m-r/on-ac-power +++ b/apparmor.d/profiles-m-r/on-ac-power @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/onefetch b/apparmor.d/profiles-m-r/onefetch index 84a68634c..ded4a204a 100644 --- a/apparmor.d/profiles-m-r/onefetch +++ b/apparmor.d/profiles-m-r/onefetch @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/openbox b/apparmor.d/profiles-m-r/openbox index ac0831f05..d136ee08f 100644 --- a/apparmor.d/profiles-m-r/openbox +++ b/apparmor.d/profiles-m-r/openbox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/openbox-session b/apparmor.d/profiles-m-r/openbox-session index 61666f756..5313ed948 100644 --- a/apparmor.d/profiles-m-r/openbox-session +++ b/apparmor.d/profiles-m-r/openbox-session @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/orage b/apparmor.d/profiles-m-r/orage index 39e960587..39d9a35dd 100644 --- a/apparmor.d/profiles-m-r/orage +++ b/apparmor.d/profiles-m-r/orage @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/os-prober b/apparmor.d/profiles-m-r/os-prober index c9c9ea2df..c058003ff 100644 --- a/apparmor.d/profiles-m-r/os-prober +++ b/apparmor.d/profiles-m-r/os-prober @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ouch b/apparmor.d/profiles-m-r/ouch index efd796d19..fb71c8ece 100644 --- a/apparmor.d/profiles-m-r/ouch +++ b/apparmor.d/profiles-m-r/ouch @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index 7482cda65..267ce1dbe 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pacmd b/apparmor.d/profiles-m-r/pacmd index 752c3edd7..8512c1c67 100644 --- a/apparmor.d/profiles-m-r/pacmd +++ b/apparmor.d/profiles-m-r/pacmd @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pactl b/apparmor.d/profiles-m-r/pactl index 2f8092a02..1e89ef3f2 100644 --- a/apparmor.d/profiles-m-r/pactl +++ b/apparmor.d/profiles-m-r/pactl @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pagesize b/apparmor.d/profiles-m-r/pagesize index f6615a71e..0ec7c31f6 100644 --- a/apparmor.d/profiles-m-r/pagesize +++ b/apparmor.d/profiles-m-r/pagesize @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pam-auth-update b/apparmor.d/profiles-m-r/pam-auth-update index 3d805f24c..e9da3686d 100644 --- a/apparmor.d/profiles-m-r/pam-auth-update +++ b/apparmor.d/profiles-m-r/pam-auth-update @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pam-tmpdir-helper b/apparmor.d/profiles-m-r/pam-tmpdir-helper index 5c86a1b27..510c2abad 100644 --- a/apparmor.d/profiles-m-r/pam-tmpdir-helper +++ b/apparmor.d/profiles-m-r/pam-tmpdir-helper @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/parted b/apparmor.d/profiles-m-r/parted index 9408674f8..4a98dbae8 100644 --- a/apparmor.d/profiles-m-r/parted +++ b/apparmor.d/profiles-m-r/parted @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/partprobe b/apparmor.d/profiles-m-r/partprobe index 0d0d82388..6a0a6c9cf 100644 --- a/apparmor.d/profiles-m-r/partprobe +++ b/apparmor.d/profiles-m-r/partprobe @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index a5a46ac48..0736f98c4 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pass-import b/apparmor.d/profiles-m-r/pass-import index 655804ccc..bb2bc9107 100644 --- a/apparmor.d/profiles-m-r/pass-import +++ b/apparmor.d/profiles-m-r/pass-import @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/passimd b/apparmor.d/profiles-m-r/passimd index 8afbac8e5..4e64e5fb9 100644 --- a/apparmor.d/profiles-m-r/passimd +++ b/apparmor.d/profiles-m-r/passimd @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/passwd b/apparmor.d/profiles-m-r/passwd index b0e326b2d..9d81c0bea 100644 --- a/apparmor.d/profiles-m-r/passwd +++ b/apparmor.d/profiles-m-r/passwd @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pavucontrol b/apparmor.d/profiles-m-r/pavucontrol index de3782b09..596cbacbd 100644 --- a/apparmor.d/profiles-m-r/pavucontrol +++ b/apparmor.d/profiles-m-r/pavucontrol @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pcb-gtk b/apparmor.d/profiles-m-r/pcb-gtk index 99ad50a64..e736299fa 100644 --- a/apparmor.d/profiles-m-r/pcb-gtk +++ b/apparmor.d/profiles-m-r/pcb-gtk @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pcscd b/apparmor.d/profiles-m-r/pcscd index 200319c6c..984b566cf 100644 --- a/apparmor.d/profiles-m-r/pcscd +++ b/apparmor.d/profiles-m-r/pcscd @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pdftotext b/apparmor.d/profiles-m-r/pdftotext index 417375a79..0394687f7 100644 --- a/apparmor.d/profiles-m-r/pdftotext +++ b/apparmor.d/profiles-m-r/pdftotext @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/picom b/apparmor.d/profiles-m-r/picom index 124d5c9c3..7d423f148 100644 --- a/apparmor.d/profiles-m-r/picom +++ b/apparmor.d/profiles-m-r/picom @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pidof b/apparmor.d/profiles-m-r/pidof index a294705b0..2a7b63038 100644 --- a/apparmor.d/profiles-m-r/pidof +++ b/apparmor.d/profiles-m-r/pidof @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pinentry b/apparmor.d/profiles-m-r/pinentry index c466f05aa..b69fcecaf 100644 --- a/apparmor.d/profiles-m-r/pinentry +++ b/apparmor.d/profiles-m-r/pinentry @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pinentry-curses b/apparmor.d/profiles-m-r/pinentry-curses index 1fd585f47..a3ec65c45 100644 --- a/apparmor.d/profiles-m-r/pinentry-curses +++ b/apparmor.d/profiles-m-r/pinentry-curses @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pinentry-gnome3 b/apparmor.d/profiles-m-r/pinentry-gnome3 index d6fc0abb0..f332ef21f 100644 --- a/apparmor.d/profiles-m-r/pinentry-gnome3 +++ b/apparmor.d/profiles-m-r/pinentry-gnome3 @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pinentry-gtk-2 b/apparmor.d/profiles-m-r/pinentry-gtk-2 index efad3a6f1..49e9ac307 100644 --- a/apparmor.d/profiles-m-r/pinentry-gtk-2 +++ b/apparmor.d/profiles-m-r/pinentry-gtk-2 @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pinentry-kwallet b/apparmor.d/profiles-m-r/pinentry-kwallet index c9dc12ba1..adff98c53 100644 --- a/apparmor.d/profiles-m-r/pinentry-kwallet +++ b/apparmor.d/profiles-m-r/pinentry-kwallet @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pinentry-qt b/apparmor.d/profiles-m-r/pinentry-qt index 97e84c7ec..3c5ec0a94 100644 --- a/apparmor.d/profiles-m-r/pinentry-qt +++ b/apparmor.d/profiles-m-r/pinentry-qt @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pkcs11-register b/apparmor.d/profiles-m-r/pkcs11-register index c8238688e..989f6ec8b 100644 --- a/apparmor.d/profiles-m-r/pkcs11-register +++ b/apparmor.d/profiles-m-r/pkcs11-register @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pkexec b/apparmor.d/profiles-m-r/pkexec index d3e47a350..ce1ea9dcd 100644 --- a/apparmor.d/profiles-m-r/pkexec +++ b/apparmor.d/profiles-m-r/pkexec @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pkttyagent b/apparmor.d/profiles-m-r/pkttyagent index 68c85487b..de0eeef33 100644 --- a/apparmor.d/profiles-m-r/pkttyagent +++ b/apparmor.d/profiles-m-r/pkttyagent @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/plank b/apparmor.d/profiles-m-r/plank index 77bad6788..9619326f2 100644 --- a/apparmor.d/profiles-m-r/plank +++ b/apparmor.d/profiles-m-r/plank @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/plocate b/apparmor.d/profiles-m-r/plocate index e66d0c14c..3877f89cd 100644 --- a/apparmor.d/profiles-m-r/plocate +++ b/apparmor.d/profiles-m-r/plocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/plocate-build b/apparmor.d/profiles-m-r/plocate-build index 5e81be8a3..afc322958 100644 --- a/apparmor.d/profiles-m-r/plocate-build +++ b/apparmor.d/profiles-m-r/plocate-build @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pokemmo b/apparmor.d/profiles-m-r/pokemmo index a6c1e83f7..111b157c5 100644 --- a/apparmor.d/profiles-m-r/pokemmo +++ b/apparmor.d/profiles-m-r/pokemmo @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/popularity-contest b/apparmor.d/profiles-m-r/popularity-contest index a4b93d5b5..166404dfa 100644 --- a/apparmor.d/profiles-m-r/popularity-contest +++ b/apparmor.d/profiles-m-r/popularity-contest @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index 8f85f3c03..d409ced7b 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index e34722fb9..b4d806a9f 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -3,7 +3,7 @@ # Copyright (C) 2024 curiosityseeker # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/protonmail-bridge b/apparmor.d/profiles-m-r/protonmail-bridge index 7e8dfe9d4..fc8092ef9 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge +++ b/apparmor.d/profiles-m-r/protonmail-bridge @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index d9f0facb5..81f27c40e 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -7,7 +7,7 @@ # deny @{bin}/pass x, # deny owner @{user_password_store_dirs}/** r, -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ps b/apparmor.d/profiles-m-r/ps index bdcd6cee2..1d9ae50cb 100644 --- a/apparmor.d/profiles-m-r/ps +++ b/apparmor.d/profiles-m-r/ps @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/ps-mem b/apparmor.d/profiles-m-r/ps-mem index f34992ccb..da5753161 100644 --- a/apparmor.d/profiles-m-r/ps-mem +++ b/apparmor.d/profiles-m-r/ps-mem @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pscap b/apparmor.d/profiles-m-r/pscap index 8a88b26a4..f4bc2b76e 100644 --- a/apparmor.d/profiles-m-r/pscap +++ b/apparmor.d/profiles-m-r/pscap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index 762af3bfc..ed6544c3f 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index 076d96da7..c7f310ac8 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pstree b/apparmor.d/profiles-m-r/pstree index a2630d212..bd2265e32 100644 --- a/apparmor.d/profiles-m-r/pstree +++ b/apparmor.d/profiles-m-r/pstree @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pulseeffects b/apparmor.d/profiles-m-r/pulseeffects index 0ef899263..e57e221dd 100644 --- a/apparmor.d/profiles-m-r/pulseeffects +++ b/apparmor.d/profiles-m-r/pulseeffects @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/pwck b/apparmor.d/profiles-m-r/pwck index af459593a..0c9e1ac0a 100644 --- a/apparmor.d/profiles-m-r/pwck +++ b/apparmor.d/profiles-m-r/pwck @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qbittorrent b/apparmor.d/profiles-m-r/qbittorrent index 3e7c28e24..97c81ebd4 100644 --- a/apparmor.d/profiles-m-r/qbittorrent +++ b/apparmor.d/profiles-m-r/qbittorrent @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qbittorrent-nox b/apparmor.d/profiles-m-r/qbittorrent-nox index 87bc84d51..81cf43011 100644 --- a/apparmor.d/profiles-m-r/qbittorrent-nox +++ b/apparmor.d/profiles-m-r/qbittorrent-nox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qdbus b/apparmor.d/profiles-m-r/qdbus index f8e028b88..fa67bad97 100644 --- a/apparmor.d/profiles-m-r/qdbus +++ b/apparmor.d/profiles-m-r/qdbus @@ -2,7 +2,7 @@ # Copyright (C) 2023 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index ac94727c3..5bf8fceb8 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qnapi b/apparmor.d/profiles-m-r/qnapi index e72a6a5c6..d02ff9426 100644 --- a/apparmor.d/profiles-m-r/qnapi +++ b/apparmor.d/profiles-m-r/qnapi @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qpdfview b/apparmor.d/profiles-m-r/qpdfview index e1ff13a92..f743e95b3 100644 --- a/apparmor.d/profiles-m-r/qpdfview +++ b/apparmor.d/profiles-m-r/qpdfview @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qt5ct b/apparmor.d/profiles-m-r/qt5ct index 4026983ab..880476b14 100644 --- a/apparmor.d/profiles-m-r/qt5ct +++ b/apparmor.d/profiles-m-r/qt5ct @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qtchooser b/apparmor.d/profiles-m-r/qtchooser index 2202d8c5f..a2485b41d 100644 --- a/apparmor.d/profiles-m-r/qtchooser +++ b/apparmor.d/profiles-m-r/qtchooser @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/qtox b/apparmor.d/profiles-m-r/qtox index e97bcc2ec..4b0d9b79c 100644 --- a/apparmor.d/profiles-m-r/qtox +++ b/apparmor.d/profiles-m-r/qtox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/quiterss b/apparmor.d/profiles-m-r/quiterss index 1154ff337..05de0d490 100644 --- a/apparmor.d/profiles-m-r/quiterss +++ b/apparmor.d/profiles-m-r/quiterss @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rdmsr b/apparmor.d/profiles-m-r/rdmsr index c3a4a8a22..47dd9beab 100644 --- a/apparmor.d/profiles-m-r/rdmsr +++ b/apparmor.d/profiles-m-r/rdmsr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index dcee35f62..9e2414b5e 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/repo b/apparmor.d/profiles-m-r/repo index 5f491cd5e..a1fd7b3b3 100644 --- a/apparmor.d/profiles-m-r/repo +++ b/apparmor.d/profiles-m-r/repo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/reprepro b/apparmor.d/profiles-m-r/reprepro index 4ef5e6b42..7710953b8 100644 --- a/apparmor.d/profiles-m-r/reprepro +++ b/apparmor.d/profiles-m-r/reprepro @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/resize2fs b/apparmor.d/profiles-m-r/resize2fs index 698ec99fd..7b28a1d22 100644 --- a/apparmor.d/profiles-m-r/resize2fs +++ b/apparmor.d/profiles-m-r/resize2fs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/resolvconf b/apparmor.d/profiles-m-r/resolvconf index caa13b97d..6601b8169 100644 --- a/apparmor.d/profiles-m-r/resolvconf +++ b/apparmor.d/profiles-m-r/resolvconf @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rfkill b/apparmor.d/profiles-m-r/rfkill index f64dd20ba..041a03e07 100644 --- a/apparmor.d/profiles-m-r/rfkill +++ b/apparmor.d/profiles-m-r/rfkill @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rngd b/apparmor.d/profiles-m-r/rngd index 0f65d8f71..8ae73c5d0 100644 --- a/apparmor.d/profiles-m-r/rngd +++ b/apparmor.d/profiles-m-r/rngd @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rpi-imager b/apparmor.d/profiles-m-r/rpi-imager index b341bb736..7b48d57b1 100644 --- a/apparmor.d/profiles-m-r/rpi-imager +++ b/apparmor.d/profiles-m-r/rpi-imager @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rredtool b/apparmor.d/profiles-m-r/rredtool index d8024b279..97e96d652 100644 --- a/apparmor.d/profiles-m-r/rredtool +++ b/apparmor.d/profiles-m-r/rredtool @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rsyslogd b/apparmor.d/profiles-m-r/rsyslogd index 423e7e41a..b4ae4b211 100644 --- a/apparmor.d/profiles-m-r/rsyslogd +++ b/apparmor.d/profiles-m-r/rsyslogd @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rtkit-daemon b/apparmor.d/profiles-m-r/rtkit-daemon index 21e715579..ddb62cb5f 100644 --- a/apparmor.d/profiles-m-r/rtkit-daemon +++ b/apparmor.d/profiles-m-r/rtkit-daemon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rtkitctl b/apparmor.d/profiles-m-r/rtkitctl index d855c0a35..9417c93b1 100644 --- a/apparmor.d/profiles-m-r/rtkitctl +++ b/apparmor.d/profiles-m-r/rtkitctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 81c52aa1f..1347ca211 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -10,7 +10,7 @@ # - As rCx -> run-parts, # - As rPx -> foo-run-parts, -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/runuser b/apparmor.d/profiles-m-r/runuser index 5fc2d65c4..9931c07fb 100644 --- a/apparmor.d/profiles-m-r/runuser +++ b/apparmor.d/profiles-m-r/runuser @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rustdesk b/apparmor.d/profiles-m-r/rustdesk index 956aaeaa4..7733730a6 100644 --- a/apparmor.d/profiles-m-r/rustdesk +++ b/apparmor.d/profiles-m-r/rustdesk @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-m-r/rustdesk-utils b/apparmor.d/profiles-m-r/rustdesk-utils index 0707f9c8f..d52e2b709 100644 --- a/apparmor.d/profiles-m-r/rustdesk-utils +++ b/apparmor.d/profiles-m-r/rustdesk-utils @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/YACReader b/apparmor.d/profiles-s-z/YACReader index 3038df49a..de55bf829 100644 --- a/apparmor.d/profiles-s-z/YACReader +++ b/apparmor.d/profiles-s-z/YACReader @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/YACReaderLibrary b/apparmor.d/profiles-s-z/YACReaderLibrary index 19bf0e9c2..38336fbc7 100644 --- a/apparmor.d/profiles-s-z/YACReaderLibrary +++ b/apparmor.d/profiles-s-z/YACReaderLibrary @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/s3fs b/apparmor.d/profiles-s-z/s3fs index d614330d2..985f124de 100644 --- a/apparmor.d/profiles-s-z/s3fs +++ b/apparmor.d/profiles-s-z/s3fs @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sanoid b/apparmor.d/profiles-s-z/sanoid index 755efba9b..e9a8f8818 100644 --- a/apparmor.d/profiles-s-z/sanoid +++ b/apparmor.d/profiles-s-z/sanoid @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sbctl b/apparmor.d/profiles-s-z/sbctl index db71eb7e0..4c5d62597 100644 --- a/apparmor.d/profiles-s-z/sbctl +++ b/apparmor.d/profiles-s-z/sbctl @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/scrcpy b/apparmor.d/profiles-s-z/scrcpy index f1af86477..3d33e8a3e 100644 --- a/apparmor.d/profiles-s-z/scrcpy +++ b/apparmor.d/profiles-s-z/scrcpy @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/scrot b/apparmor.d/profiles-s-z/scrot index 377bb7962..9573da520 100644 --- a/apparmor.d/profiles-s-z/scrot +++ b/apparmor.d/profiles-s-z/scrot @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sdcv b/apparmor.d/profiles-s-z/sdcv index cfc6c1b3c..4f6b26e39 100644 --- a/apparmor.d/profiles-s-z/sdcv +++ b/apparmor.d/profiles-s-z/sdcv @@ -3,7 +3,7 @@ # Copyright (C) 2023 Andy Ramos # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/secure-time-sync b/apparmor.d/profiles-s-z/secure-time-sync index 3ded8b7ae..51016373d 100644 --- a/apparmor.d/profiles-s-z/secure-time-sync +++ b/apparmor.d/profiles-s-z/secure-time-sync @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sensors b/apparmor.d/profiles-s-z/sensors index 618332bce..fd839099e 100644 --- a/apparmor.d/profiles-s-z/sensors +++ b/apparmor.d/profiles-s-z/sensors @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sensors-detect b/apparmor.d/profiles-s-z/sensors-detect index 18e4c135f..ea81f6593 100644 --- a/apparmor.d/profiles-s-z/sensors-detect +++ b/apparmor.d/profiles-s-z/sensors-detect @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/session-desktop b/apparmor.d/profiles-s-z/session-desktop index 72c704741..d088bb0b1 100644 --- a/apparmor.d/profiles-s-z/session-desktop +++ b/apparmor.d/profiles-s-z/session-desktop @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/setpci b/apparmor.d/profiles-s-z/setpci index 25fe43065..72c9b8a93 100644 --- a/apparmor.d/profiles-s-z/setpci +++ b/apparmor.d/profiles-s-z/setpci @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/setvtrgb b/apparmor.d/profiles-s-z/setvtrgb index aef3b00fe..6c9a3fe62 100644 --- a/apparmor.d/profiles-s-z/setvtrgb +++ b/apparmor.d/profiles-s-z/setvtrgb @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sfdisk b/apparmor.d/profiles-s-z/sfdisk index c82aff776..0009d52cb 100644 --- a/apparmor.d/profiles-s-z/sfdisk +++ b/apparmor.d/profiles-s-z/sfdisk @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sgdisk b/apparmor.d/profiles-s-z/sgdisk index 00a8c7a56..ecc6abcdb 100644 --- a/apparmor.d/profiles-s-z/sgdisk +++ b/apparmor.d/profiles-s-z/sgdisk @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index 484f42dd9..972f111f4 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox index 10e1de4b3..b9efca35a 100644 --- a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox +++ b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sing-box b/apparmor.d/profiles-s-z/sing-box index 221da9617..9f395735e 100644 --- a/apparmor.d/profiles-s-z/sing-box +++ b/apparmor.d/profiles-s-z/sing-box @@ -4,7 +4,7 @@ # https://github.com/SagerNet/sing-box -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/slirp4netns b/apparmor.d/profiles-s-z/slirp4netns index 0ec43cc9b..e2d3b6b1f 100644 --- a/apparmor.d/profiles-s-z/slirp4netns +++ b/apparmor.d/profiles-s-z/slirp4netns @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/smartctl b/apparmor.d/profiles-s-z/smartctl index 6487e82e3..4af40c8ab 100644 --- a/apparmor.d/profiles-s-z/smartctl +++ b/apparmor.d/profiles-s-z/smartctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/smartd b/apparmor.d/profiles-s-z/smartd index 9222fbbbd..d0f9c28fd 100644 --- a/apparmor.d/profiles-s-z/smartd +++ b/apparmor.d/profiles-s-z/smartd @@ -4,7 +4,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/smbspool b/apparmor.d/profiles-s-z/smbspool index 010226342..a0d9600ad 100644 --- a/apparmor.d/profiles-s-z/smbspool +++ b/apparmor.d/profiles-s-z/smbspool @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/smplayer b/apparmor.d/profiles-s-z/smplayer index 0248d4218..858c73637 100644 --- a/apparmor.d/profiles-s-z/smplayer +++ b/apparmor.d/profiles-s-z/smplayer @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/smtube b/apparmor.d/profiles-s-z/smtube index af761d43c..bbb404c8f 100644 --- a/apparmor.d/profiles-s-z/smtube +++ b/apparmor.d/profiles-s-z/smtube @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/profiles-s-z/snap index e5e5bef97..912ab1a8b 100644 --- a/apparmor.d/profiles-s-z/snap +++ b/apparmor.d/profiles-s-z/snap @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap-bootstrap b/apparmor.d/profiles-s-z/snap-bootstrap index 71a4ad8f2..95cc306fc 100644 --- a/apparmor.d/profiles-s-z/snap-bootstrap +++ b/apparmor.d/profiles-s-z/snap-bootstrap @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap-device-helper b/apparmor.d/profiles-s-z/snap-device-helper index ec342d4e2..5a9fded35 100644 --- a/apparmor.d/profiles-s-z/snap-device-helper +++ b/apparmor.d/profiles-s-z/snap-device-helper @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap-discard-ns b/apparmor.d/profiles-s-z/snap-discard-ns index ab90529b7..f1f6f9d67 100644 --- a/apparmor.d/profiles-s-z/snap-discard-ns +++ b/apparmor.d/profiles-s-z/snap-discard-ns @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap-failure b/apparmor.d/profiles-s-z/snap-failure index 61372b169..e9bef6d4e 100644 --- a/apparmor.d/profiles-s-z/snap-failure +++ b/apparmor.d/profiles-s-z/snap-failure @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap-repair b/apparmor.d/profiles-s-z/snap-repair index d5f282ffa..fe9be759a 100644 --- a/apparmor.d/profiles-s-z/snap-repair +++ b/apparmor.d/profiles-s-z/snap-repair @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap-seccomp b/apparmor.d/profiles-s-z/snap-seccomp index 5018ff379..235ef2080 100644 --- a/apparmor.d/profiles-s-z/snap-seccomp +++ b/apparmor.d/profiles-s-z/snap-seccomp @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snap-update-ns b/apparmor.d/profiles-s-z/snap-update-ns index 2092ab1c9..3021a1ad7 100644 --- a/apparmor.d/profiles-s-z/snap-update-ns +++ b/apparmor.d/profiles-s-z/snap-update-ns @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index ae061b032..e6ded0956 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snapd-aa-prompt-listener b/apparmor.d/profiles-s-z/snapd-aa-prompt-listener index 6cc8801aa..5620fc975 100644 --- a/apparmor.d/profiles-s-z/snapd-aa-prompt-listener +++ b/apparmor.d/profiles-s-z/snapd-aa-prompt-listener @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snapd-aa-prompt-ui b/apparmor.d/profiles-s-z/snapd-aa-prompt-ui index d7b9b3713..14354cfb9 100644 --- a/apparmor.d/profiles-s-z/snapd-aa-prompt-ui +++ b/apparmor.d/profiles-s-z/snapd-aa-prompt-ui @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snapd-apparmor b/apparmor.d/profiles-s-z/snapd-apparmor index edd266c20..e7a3b4946 100644 --- a/apparmor.d/profiles-s-z/snapd-apparmor +++ b/apparmor.d/profiles-s-z/snapd-apparmor @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snapd-core-fixup b/apparmor.d/profiles-s-z/snapd-core-fixup index fffbc4468..0e33aaea0 100644 --- a/apparmor.d/profiles-s-z/snapd-core-fixup +++ b/apparmor.d/profiles-s-z/snapd-core-fixup @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/snapshot b/apparmor.d/profiles-s-z/snapshot index 5afff36e6..e7d84b0b3 100644 --- a/apparmor.d/profiles-s-z/snapshot +++ b/apparmor.d/profiles-s-z/snapshot @@ -3,7 +3,7 @@ # SPDX-License-Identifier: GPL-2.0-only # vim:syntax=apparmor -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/spacefm-auth b/apparmor.d/profiles-s-z/spacefm-auth index 754908eac..60111288f 100644 --- a/apparmor.d/profiles-s-z/spacefm-auth +++ b/apparmor.d/profiles-s-z/spacefm-auth @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/spectre-meltdown-checker b/apparmor.d/profiles-s-z/spectre-meltdown-checker index 33c02ce44..e70a5c499 100644 --- a/apparmor.d/profiles-s-z/spectre-meltdown-checker +++ b/apparmor.d/profiles-s-z/spectre-meltdown-checker @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/speech-dispatcher b/apparmor.d/profiles-s-z/speech-dispatcher index e2c00e2af..13ed65c09 100644 --- a/apparmor.d/profiles-s-z/speech-dispatcher +++ b/apparmor.d/profiles-s-z/speech-dispatcher @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/speedtest b/apparmor.d/profiles-s-z/speedtest index 0fe00bc24..f31818354 100644 --- a/apparmor.d/profiles-s-z/speedtest +++ b/apparmor.d/profiles-s-z/speedtest @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper b/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper index aae606395..58da03738 100644 --- a/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper +++ b/apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index 93be9c783..f0731fd64 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/spice-vdagentd b/apparmor.d/profiles-s-z/spice-vdagentd index 70eca91fe..bebfbe419 100644 --- a/apparmor.d/profiles-s-z/spice-vdagentd +++ b/apparmor.d/profiles-s-z/spice-vdagentd @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index ef939ef07..4bc0cb4be 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ss b/apparmor.d/profiles-s-z/ss index 7346ebd62..3b55547be 100644 --- a/apparmor.d/profiles-s-z/ss +++ b/apparmor.d/profiles-s-z/ss @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sslocal b/apparmor.d/profiles-s-z/sslocal index beff6a1e9..0c46e5581 100644 --- a/apparmor.d/profiles-s-z/sslocal +++ b/apparmor.d/profiles-s-z/sslocal @@ -4,7 +4,7 @@ # shadowsocks-rust only: # https://github.com/shadowsocks/shadowsocks-rust -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ssmanager b/apparmor.d/profiles-s-z/ssmanager index 7a89ea8bd..7e6fb0906 100644 --- a/apparmor.d/profiles-s-z/ssmanager +++ b/apparmor.d/profiles-s-z/ssmanager @@ -4,7 +4,7 @@ # shadowsocks-rust only: # https://github.com/shadowsocks/shadowsocks-rust -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ssserver b/apparmor.d/profiles-s-z/ssserver index 51dc62837..c71fc1ea7 100644 --- a/apparmor.d/profiles-s-z/ssserver +++ b/apparmor.d/profiles-s-z/ssserver @@ -4,7 +4,7 @@ # shadowsocks-rust only: # https://github.com/shadowsocks/shadowsocks-rust -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ssservice b/apparmor.d/profiles-s-z/ssservice index 1c62764b2..5157bba63 100644 --- a/apparmor.d/profiles-s-z/ssservice +++ b/apparmor.d/profiles-s-z/ssservice @@ -4,7 +4,7 @@ # shadowsocks-rust only: # https://github.com/shadowsocks/shadowsocks-rust -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ssurl b/apparmor.d/profiles-s-z/ssurl index e1c7b9068..a066a9df6 100644 --- a/apparmor.d/profiles-s-z/ssurl +++ b/apparmor.d/profiles-s-z/ssurl @@ -4,7 +4,7 @@ # shadowsocks-rust only: # https://github.com/shadowsocks/shadowsocks-rust -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/start-pulseaudio-x11 b/apparmor.d/profiles-s-z/start-pulseaudio-x11 index 616b66963..85ec45d5c 100644 --- a/apparmor.d/profiles-s-z/start-pulseaudio-x11 +++ b/apparmor.d/profiles-s-z/start-pulseaudio-x11 @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/startx b/apparmor.d/profiles-s-z/startx index 26cf4027f..34f6d4724 100644 --- a/apparmor.d/profiles-s-z/startx +++ b/apparmor.d/profiles-s-z/startx @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index b1dd83471..3ad53cf0a 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -17,7 +17,7 @@ # ├── steam-gameoverlayui # Steam game overlay # └── steamerrorreporter # Error reporter -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-fossilize b/apparmor.d/profiles-s-z/steam-fossilize index 1786a5e40..e3e7f87e2 100644 --- a/apparmor.d/profiles-s-z/steam-fossilize +++ b/apparmor.d/profiles-s-z/steam-fossilize @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-game-native b/apparmor.d/profiles-s-z/steam-game-native index 4246f7870..ca80801d7 100644 --- a/apparmor.d/profiles-s-z/steam-game-native +++ b/apparmor.d/profiles-s-z/steam-game-native @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton index 0facb49ac..bad85a84b 100644 --- a/apparmor.d/profiles-s-z/steam-game-proton +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui index ae01bf5d3..0cd837135 100644 --- a/apparmor.d/profiles-s-z/steam-gameoverlayui +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-launch b/apparmor.d/profiles-s-z/steam-launch index 975e432a6..977248c96 100644 --- a/apparmor.d/profiles-s-z/steam-launch +++ b/apparmor.d/profiles-s-z/steam-launch @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-launcher b/apparmor.d/profiles-s-z/steam-launcher index 2605c15f1..12138e360 100644 --- a/apparmor.d/profiles-s-z/steam-launcher +++ b/apparmor.d/profiles-s-z/steam-launcher @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index b1fca8df4..abf84d3c0 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steam-runtime-steam-remote b/apparmor.d/profiles-s-z/steam-runtime-steam-remote index c962f61ee..b3a36eac4 100644 --- a/apparmor.d/profiles-s-z/steam-runtime-steam-remote +++ b/apparmor.d/profiles-s-z/steam-runtime-steam-remote @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/steamerrorreporter b/apparmor.d/profiles-s-z/steamerrorreporter index 1d55e59af..8214a1fb9 100644 --- a/apparmor.d/profiles-s-z/steamerrorreporter +++ b/apparmor.d/profiles-s-z/steamerrorreporter @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index acba17f78..6a337a66b 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/strawberry-tagreader b/apparmor.d/profiles-s-z/strawberry-tagreader index 0e1aced4f..8de73c57c 100644 --- a/apparmor.d/profiles-s-z/strawberry-tagreader +++ b/apparmor.d/profiles-s-z/strawberry-tagreader @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/su b/apparmor.d/profiles-s-z/su index d292cab8b..02a212150 100644 --- a/apparmor.d/profiles-s-z/su +++ b/apparmor.d/profiles-s-z/su @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index 9574b98d1..49df90aa3 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sulogin b/apparmor.d/profiles-s-z/sulogin index 3793df043..556808aeb 100644 --- a/apparmor.d/profiles-s-z/sulogin +++ b/apparmor.d/profiles-s-z/sulogin @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index f8295f311..91ceef33d 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/swaplabel b/apparmor.d/profiles-s-z/swaplabel index 03d2fe8d0..05dc5783a 100644 --- a/apparmor.d/profiles-s-z/swaplabel +++ b/apparmor.d/profiles-s-z/swaplabel @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/swapon b/apparmor.d/profiles-s-z/swapon index 31ee2e93a..83d2c6a3b 100644 --- a/apparmor.d/profiles-s-z/swapon +++ b/apparmor.d/profiles-s-z/swapon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/switcheroo-control b/apparmor.d/profiles-s-z/switcheroo-control index 4cfa8ba96..b2df1a346 100644 --- a/apparmor.d/profiles-s-z/switcheroo-control +++ b/apparmor.d/profiles-s-z/switcheroo-control @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/switcherooctl b/apparmor.d/profiles-s-z/switcherooctl index 1e9d50989..538931554 100644 --- a/apparmor.d/profiles-s-z/switcherooctl +++ b/apparmor.d/profiles-s-z/switcherooctl @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/swtpm b/apparmor.d/profiles-s-z/swtpm index 4f6d1b38c..783e58237 100644 --- a/apparmor.d/profiles-s-z/swtpm +++ b/apparmor.d/profiles-s-z/swtpm @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/swtpm_ioctl b/apparmor.d/profiles-s-z/swtpm_ioctl index c77810624..f1e41aa6e 100644 --- a/apparmor.d/profiles-s-z/swtpm_ioctl +++ b/apparmor.d/profiles-s-z/swtpm_ioctl @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/swtpm_localca b/apparmor.d/profiles-s-z/swtpm_localca index a9749c91f..dbe202581 100644 --- a/apparmor.d/profiles-s-z/swtpm_localca +++ b/apparmor.d/profiles-s-z/swtpm_localca @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/swtpm_setup b/apparmor.d/profiles-s-z/swtpm_setup index f4b01f0e0..08ee1532e 100644 --- a/apparmor.d/profiles-s-z/swtpm_setup +++ b/apparmor.d/profiles-s-z/swtpm_setup @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sync b/apparmor.d/profiles-s-z/sync index 6bdb55732..3b18ad36e 100644 --- a/apparmor.d/profiles-s-z/sync +++ b/apparmor.d/profiles-s-z/sync @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/syncoid b/apparmor.d/profiles-s-z/syncoid index ba3e774e6..821a3fd63 100644 --- a/apparmor.d/profiles-s-z/syncoid +++ b/apparmor.d/profiles-s-z/syncoid @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/syncthing b/apparmor.d/profiles-s-z/syncthing index b65a56145..f668f5a00 100644 --- a/apparmor.d/profiles-s-z/syncthing +++ b/apparmor.d/profiles-s-z/syncthing @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/sysctl b/apparmor.d/profiles-s-z/sysctl index 02964dd7d..6dd12a023 100644 --- a/apparmor.d/profiles-s-z/sysctl +++ b/apparmor.d/profiles-s-z/sysctl @@ -4,7 +4,7 @@ # TODO: Rethink this profile. Should not be called by another profile. -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/system-config-printer b/apparmor.d/profiles-s-z/system-config-printer index f929adcae..4db5c6f92 100644 --- a/apparmor.d/profiles-s-z/system-config-printer +++ b/apparmor.d/profiles-s-z/system-config-printer @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/system-config-printer-applet b/apparmor.d/profiles-s-z/system-config-printer-applet index 0112b152a..0197e3c3b 100644 --- a/apparmor.d/profiles-s-z/system-config-printer-applet +++ b/apparmor.d/profiles-s-z/system-config-printer-applet @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/task b/apparmor.d/profiles-s-z/task index 87b9be2df..598e59341 100644 --- a/apparmor.d/profiles-s-z/task +++ b/apparmor.d/profiles-s-z/task @@ -2,7 +2,7 @@ # Copyright (C) 2024 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/tasksel b/apparmor.d/profiles-s-z/tasksel index b96200dea..9073591f5 100644 --- a/apparmor.d/profiles-s-z/tasksel +++ b/apparmor.d/profiles-s-z/tasksel @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/taskwarrior-tui b/apparmor.d/profiles-s-z/taskwarrior-tui index f125c993d..8a02b8d04 100644 --- a/apparmor.d/profiles-s-z/taskwarrior-tui +++ b/apparmor.d/profiles-s-z/taskwarrior-tui @@ -2,7 +2,7 @@ # Copyright (C) 2024 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/telegram-desktop b/apparmor.d/profiles-s-z/telegram-desktop index a31d4c601..d967f4229 100644 --- a/apparmor.d/profiles-s-z/telegram-desktop +++ b/apparmor.d/profiles-s-z/telegram-desktop @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index 3d6470dbc..e72588420 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/tftp b/apparmor.d/profiles-s-z/tftp index fb848cb1c..33f6fe6dc 100644 --- a/apparmor.d/profiles-s-z/tftp +++ b/apparmor.d/profiles-s-z/tftp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/thermald b/apparmor.d/profiles-s-z/thermald index abea43b61..6bff0f1d8 100644 --- a/apparmor.d/profiles-s-z/thermald +++ b/apparmor.d/profiles-s-z/thermald @@ -4,7 +4,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/thinkfan b/apparmor.d/profiles-s-z/thinkfan index 56a39736e..ddf7e1ff2 100644 --- a/apparmor.d/profiles-s-z/thinkfan +++ b/apparmor.d/profiles-s-z/thinkfan @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index a9490c6f7..e5404615c 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/thunderbird-glxtest b/apparmor.d/profiles-s-z/thunderbird-glxtest index 17fda9d56..a742a41fb 100644 --- a/apparmor.d/profiles-s-z/thunderbird-glxtest +++ b/apparmor.d/profiles-s-z/thunderbird-glxtest @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/thunderbird-vaapitest b/apparmor.d/profiles-s-z/thunderbird-vaapitest index a401173f1..c93d14bd7 100644 --- a/apparmor.d/profiles-s-z/thunderbird-vaapitest +++ b/apparmor.d/profiles-s-z/thunderbird-vaapitest @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/tint2 b/apparmor.d/profiles-s-z/tint2 index 2e44d0fab..8b6f0dc45 100644 --- a/apparmor.d/profiles-s-z/tint2 +++ b/apparmor.d/profiles-s-z/tint2 @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/tint2conf b/apparmor.d/profiles-s-z/tint2conf index 776b843a3..737bc90f8 100644 --- a/apparmor.d/profiles-s-z/tint2conf +++ b/apparmor.d/profiles-s-z/tint2conf @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/tomb b/apparmor.d/profiles-s-z/tomb index cc540ae93..0b35cff02 100644 --- a/apparmor.d/profiles-s-z/tomb +++ b/apparmor.d/profiles-s-z/tomb @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/top b/apparmor.d/profiles-s-z/top index 418accd3c..6a5d272a3 100644 --- a/apparmor.d/profiles-s-z/top +++ b/apparmor.d/profiles-s-z/top @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/torify b/apparmor.d/profiles-s-z/torify index fcc4c9b98..c4cb88902 100644 --- a/apparmor.d/profiles-s-z/torify +++ b/apparmor.d/profiles-s-z/torify @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/torsocks b/apparmor.d/profiles-s-z/torsocks index 8d75133da..c7c914387 100644 --- a/apparmor.d/profiles-s-z/torsocks +++ b/apparmor.d/profiles-s-z/torsocks @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index ef11ad786..7a7dd709e 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/tpacpi-bat b/apparmor.d/profiles-s-z/tpacpi-bat index 673f46e32..ee4de1e45 100644 --- a/apparmor.d/profiles-s-z/tpacpi-bat +++ b/apparmor.d/profiles-s-z/tpacpi-bat @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission index 44f89d2b1..ff3373a2c 100644 --- a/apparmor.d/profiles-s-z/transmission +++ b/apparmor.d/profiles-s-z/transmission @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/tune2fs b/apparmor.d/profiles-s-z/tune2fs index d9a8c5409..6f0fdad94 100644 --- a/apparmor.d/profiles-s-z/tune2fs +++ b/apparmor.d/profiles-s-z/tune2fs @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/udev-dmi-memory-id b/apparmor.d/profiles-s-z/udev-dmi-memory-id index ab6a2de77..a26c4a263 100644 --- a/apparmor.d/profiles-s-z/udev-dmi-memory-id +++ b/apparmor.d/profiles-s-z/udev-dmi-memory-id @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/udiskie b/apparmor.d/profiles-s-z/udiskie index 505017bcd..6105c7dae 100644 --- a/apparmor.d/profiles-s-z/udiskie +++ b/apparmor.d/profiles-s-z/udiskie @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/udiskie-info b/apparmor.d/profiles-s-z/udiskie-info index aa359ef56..855c5b54c 100644 --- a/apparmor.d/profiles-s-z/udiskie-info +++ b/apparmor.d/profiles-s-z/udiskie-info @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/udiskie-mount b/apparmor.d/profiles-s-z/udiskie-mount index 7e72e9713..a57a6091f 100644 --- a/apparmor.d/profiles-s-z/udiskie-mount +++ b/apparmor.d/profiles-s-z/udiskie-mount @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/udiskie-umount b/apparmor.d/profiles-s-z/udiskie-umount index 8dc30eb9a..8fe075f94 100644 --- a/apparmor.d/profiles-s-z/udiskie-umount +++ b/apparmor.d/profiles-s-z/udiskie-umount @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/udisksctl b/apparmor.d/profiles-s-z/udisksctl index 5e7320a63..6ae685723 100644 --- a/apparmor.d/profiles-s-z/udisksctl +++ b/apparmor.d/profiles-s-z/udisksctl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index a0071a759..af2eec34e 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 685eed20a..1c34b8579 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/umount b/apparmor.d/profiles-s-z/umount index e066dff89..66fae00bb 100644 --- a/apparmor.d/profiles-s-z/umount +++ b/apparmor.d/profiles-s-z/umount @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/umount.udisks2 b/apparmor.d/profiles-s-z/umount.udisks2 index 2a6f7747d..4e842c7fb 100644 --- a/apparmor.d/profiles-s-z/umount.udisks2 +++ b/apparmor.d/profiles-s-z/umount.udisks2 @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/uname b/apparmor.d/profiles-s-z/uname index 31508b640..7c5cb0cb1 100644 --- a/apparmor.d/profiles-s-z/uname +++ b/apparmor.d/profiles-s-z/uname @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/unhide-linux b/apparmor.d/profiles-s-z/unhide-linux index d03561452..0d543513c 100644 --- a/apparmor.d/profiles-s-z/unhide-linux +++ b/apparmor.d/profiles-s-z/unhide-linux @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/unhide-posix b/apparmor.d/profiles-s-z/unhide-posix index 1277e299c..730d1aaa6 100644 --- a/apparmor.d/profiles-s-z/unhide-posix +++ b/apparmor.d/profiles-s-z/unhide-posix @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/unhide-rb b/apparmor.d/profiles-s-z/unhide-rb index e503f639a..ecc19849a 100644 --- a/apparmor.d/profiles-s-z/unhide-rb +++ b/apparmor.d/profiles-s-z/unhide-rb @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/unhide-tcp b/apparmor.d/profiles-s-z/unhide-tcp index bb54d19b1..c4b30b884 100644 --- a/apparmor.d/profiles-s-z/unhide-tcp +++ b/apparmor.d/profiles-s-z/unhide-tcp @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/unix-chkpwd b/apparmor.d/profiles-s-z/unix-chkpwd index c24da3bab..85b99b8ab 100644 --- a/apparmor.d/profiles-s-z/unix-chkpwd +++ b/apparmor.d/profiles-s-z/unix-chkpwd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/unmkinitramfs b/apparmor.d/profiles-s-z/unmkinitramfs index d5d1cb953..6b5607ed1 100644 --- a/apparmor.d/profiles-s-z/unmkinitramfs +++ b/apparmor.d/profiles-s-z/unmkinitramfs @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-alternatives b/apparmor.d/profiles-s-z/update-alternatives index dfe7725d8..a83e985d7 100644 --- a/apparmor.d/profiles-s-z/update-alternatives +++ b/apparmor.d/profiles-s-z/update-alternatives @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-ca-certificates b/apparmor.d/profiles-s-z/update-ca-certificates index f08383fba..b87f60ec4 100644 --- a/apparmor.d/profiles-s-z/update-ca-certificates +++ b/apparmor.d/profiles-s-z/update-ca-certificates @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-ca-trust b/apparmor.d/profiles-s-z/update-ca-trust index 8b69cd1f4..c0f220919 100644 --- a/apparmor.d/profiles-s-z/update-ca-trust +++ b/apparmor.d/profiles-s-z/update-ca-trust @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-command-not-found b/apparmor.d/profiles-s-z/update-command-not-found index 56c215402..f1bf99bf8 100644 --- a/apparmor.d/profiles-s-z/update-command-not-found +++ b/apparmor.d/profiles-s-z/update-command-not-found @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-cracklib b/apparmor.d/profiles-s-z/update-cracklib index 6b4192903..9bef23a77 100644 --- a/apparmor.d/profiles-s-z/update-cracklib +++ b/apparmor.d/profiles-s-z/update-cracklib @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-dlocatedb b/apparmor.d/profiles-s-z/update-dlocatedb index 08687c6c8..c0f3a9cb0 100644 --- a/apparmor.d/profiles-s-z/update-dlocatedb +++ b/apparmor.d/profiles-s-z/update-dlocatedb @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-initramfs b/apparmor.d/profiles-s-z/update-initramfs index fc62d99f2..6948f2812 100644 --- a/apparmor.d/profiles-s-z/update-initramfs +++ b/apparmor.d/profiles-s-z/update-initramfs @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-pciids b/apparmor.d/profiles-s-z/update-pciids index 233ed60be..5f5b39ec8 100644 --- a/apparmor.d/profiles-s-z/update-pciids +++ b/apparmor.d/profiles-s-z/update-pciids @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-secureboot-policy b/apparmor.d/profiles-s-z/update-secureboot-policy index 8431fd1e6..e5ffca44f 100644 --- a/apparmor.d/profiles-s-z/update-secureboot-policy +++ b/apparmor.d/profiles-s-z/update-secureboot-policy @@ -3,7 +3,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/update-smart-drivedb b/apparmor.d/profiles-s-z/update-smart-drivedb index 7140bbd5b..2dcd3cc9e 100644 --- a/apparmor.d/profiles-s-z/update-smart-drivedb +++ b/apparmor.d/profiles-s-z/update-smart-drivedb @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/updatedb-mlocate b/apparmor.d/profiles-s-z/updatedb-mlocate index 9e470d878..7a951b7e7 100644 --- a/apparmor.d/profiles-s-z/updatedb-mlocate +++ b/apparmor.d/profiles-s-z/updatedb-mlocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/updatedb.plocate b/apparmor.d/profiles-s-z/updatedb.plocate index 67ea546fd..60aa760d4 100644 --- a/apparmor.d/profiles-s-z/updatedb.plocate +++ b/apparmor.d/profiles-s-z/updatedb.plocate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/uptime b/apparmor.d/profiles-s-z/uptime index 1b28a07da..904ebe415 100644 --- a/apparmor.d/profiles-s-z/uptime +++ b/apparmor.d/profiles-s-z/uptime @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/uptimed b/apparmor.d/profiles-s-z/uptimed index a850d7771..7e978c1dd 100644 --- a/apparmor.d/profiles-s-z/uptimed +++ b/apparmor.d/profiles-s-z/uptimed @@ -2,7 +2,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/usb-devices b/apparmor.d/profiles-s-z/usb-devices index 94e6526ab..c67b78faf 100644 --- a/apparmor.d/profiles-s-z/usb-devices +++ b/apparmor.d/profiles-s-z/usb-devices @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/usbguard b/apparmor.d/profiles-s-z/usbguard index deb5ef46d..798352c89 100644 --- a/apparmor.d/profiles-s-z/usbguard +++ b/apparmor.d/profiles-s-z/usbguard @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/usbguard-applet-qt b/apparmor.d/profiles-s-z/usbguard-applet-qt index bc004b86f..a76398dd9 100644 --- a/apparmor.d/profiles-s-z/usbguard-applet-qt +++ b/apparmor.d/profiles-s-z/usbguard-applet-qt @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/usbguard-daemon b/apparmor.d/profiles-s-z/usbguard-daemon index 674da7ad4..1fb97459d 100644 --- a/apparmor.d/profiles-s-z/usbguard-daemon +++ b/apparmor.d/profiles-s-z/usbguard-daemon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/usbguard-dbus b/apparmor.d/profiles-s-z/usbguard-dbus index b02524d55..d406d5262 100644 --- a/apparmor.d/profiles-s-z/usbguard-dbus +++ b/apparmor.d/profiles-s-z/usbguard-dbus @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/usbguard-notifier b/apparmor.d/profiles-s-z/usbguard-notifier index 48f88d0aa..963fcb2e8 100644 --- a/apparmor.d/profiles-s-z/usbguard-notifier +++ b/apparmor.d/profiles-s-z/usbguard-notifier @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/useradd b/apparmor.d/profiles-s-z/useradd index a6094867a..42ab87607 100644 --- a/apparmor.d/profiles-s-z/useradd +++ b/apparmor.d/profiles-s-z/useradd @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/userdel b/apparmor.d/profiles-s-z/userdel index 6b95a4848..05df64874 100644 --- a/apparmor.d/profiles-s-z/userdel +++ b/apparmor.d/profiles-s-z/userdel @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/usermod b/apparmor.d/profiles-s-z/usermod index cfcdc6bdc..c0f8f0e45 100644 --- a/apparmor.d/profiles-s-z/usermod +++ b/apparmor.d/profiles-s-z/usermod @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/users b/apparmor.d/profiles-s-z/users index fbad304bf..67d7a83e7 100644 --- a/apparmor.d/profiles-s-z/users +++ b/apparmor.d/profiles-s-z/users @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/utmpdump b/apparmor.d/profiles-s-z/utmpdump index 054bb69ce..363524355 100644 --- a/apparmor.d/profiles-s-z/utmpdump +++ b/apparmor.d/profiles-s-z/utmpdump @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/utox b/apparmor.d/profiles-s-z/utox index e5642c263..483fef619 100644 --- a/apparmor.d/profiles-s-z/utox +++ b/apparmor.d/profiles-s-z/utox @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/uuidd b/apparmor.d/profiles-s-z/uuidd index c98d8175f..69f28da32 100644 --- a/apparmor.d/profiles-s-z/uuidd +++ b/apparmor.d/profiles-s-z/uuidd @@ -2,7 +2,7 @@ # Copyright (C) 2023 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/uuidgen b/apparmor.d/profiles-s-z/uuidgen index b00ed1f26..56e8abef9 100644 --- a/apparmor.d/profiles-s-z/uuidgen +++ b/apparmor.d/profiles-s-z/uuidgen @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/uupdate b/apparmor.d/profiles-s-z/uupdate index f49441ebf..2d429135f 100644 --- a/apparmor.d/profiles-s-z/uupdate +++ b/apparmor.d/profiles-s-z/uupdate @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vcsi b/apparmor.d/profiles-s-z/vcsi index 37422840c..25f4a979f 100644 --- a/apparmor.d/profiles-s-z/vcsi +++ b/apparmor.d/profiles-s-z/vcsi @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/veracrypt b/apparmor.d/profiles-s-z/veracrypt index 148d28957..6612846cd 100644 --- a/apparmor.d/profiles-s-z/veracrypt +++ b/apparmor.d/profiles-s-z/veracrypt @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vesktop b/apparmor.d/profiles-s-z/vesktop index ce420ea12..bcbb30883 100644 --- a/apparmor.d/profiles-s-z/vesktop +++ b/apparmor.d/profiles-s-z/vesktop @@ -2,7 +2,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include @{name} = vesktop diff --git a/apparmor.d/profiles-s-z/vidcutter b/apparmor.d/profiles-s-z/vidcutter index 226a0dd98..283eab051 100644 --- a/apparmor.d/profiles-s-z/vidcutter +++ b/apparmor.d/profiles-s-z/vidcutter @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vipw-vigr b/apparmor.d/profiles-s-z/vipw-vigr index 3705f0bab..50ada1d64 100644 --- a/apparmor.d/profiles-s-z/vipw-vigr +++ b/apparmor.d/profiles-s-z/vipw-vigr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index 310b94683..bce236989 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index 508deaeac..fabde247b 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vlc-cache-gen b/apparmor.d/profiles-s-z/vlc-cache-gen index b464f1712..1c089b0f8 100644 --- a/apparmor.d/profiles-s-z/vlc-cache-gen +++ b/apparmor.d/profiles-s-z/vlc-cache-gen @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vnstat b/apparmor.d/profiles-s-z/vnstat index 25bdcfb1b..b780eb8d1 100644 --- a/apparmor.d/profiles-s-z/vnstat +++ b/apparmor.d/profiles-s-z/vnstat @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vnstatd b/apparmor.d/profiles-s-z/vnstatd index c37c8b6d7..1270ecf42 100644 --- a/apparmor.d/profiles-s-z/vnstatd +++ b/apparmor.d/profiles-s-z/vnstatd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/volumeicon b/apparmor.d/profiles-s-z/volumeicon index c58381d7d..e354c3cbd 100644 --- a/apparmor.d/profiles-s-z/volumeicon +++ b/apparmor.d/profiles-s-z/volumeicon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/vsftpd b/apparmor.d/profiles-s-z/vsftpd index aa45b805e..2b6af3561 100644 --- a/apparmor.d/profiles-s-z/vsftpd +++ b/apparmor.d/profiles-s-z/vsftpd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/w b/apparmor.d/profiles-s-z/w index a3fc8c9e3..3745015c1 100644 --- a/apparmor.d/profiles-s-z/w +++ b/apparmor.d/profiles-s-z/w @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/w3m b/apparmor.d/profiles-s-z/w3m index b4601147a..1a0e33418 100644 --- a/apparmor.d/profiles-s-z/w3m +++ b/apparmor.d/profiles-s-z/w3m @@ -3,7 +3,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wavemon b/apparmor.d/profiles-s-z/wavemon index 9ec082580..6c2fee4df 100644 --- a/apparmor.d/profiles-s-z/wavemon +++ b/apparmor.d/profiles-s-z/wavemon @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index 3646a616d..8499a1ad6 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -3,7 +3,7 @@ # Copyright (C) 2024 odomingao # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index e684e157f..493a940af 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -2,7 +2,7 @@ # Copyright (C) 2024 EricLin # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wemeet b/apparmor.d/profiles-s-z/wemeet index e866b5e51..39862913c 100644 --- a/apparmor.d/profiles-s-z/wemeet +++ b/apparmor.d/profiles-s-z/wemeet @@ -2,7 +2,7 @@ # Copyright (C) 2024 EricLin # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/whatis b/apparmor.d/profiles-s-z/whatis index e99900304..43fa8ff09 100644 --- a/apparmor.d/profiles-s-z/whatis +++ b/apparmor.d/profiles-s-z/whatis @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/whdd b/apparmor.d/profiles-s-z/whdd index e5e111b8b..cc4ae2959 100644 --- a/apparmor.d/profiles-s-z/whdd +++ b/apparmor.d/profiles-s-z/whdd @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/whereis b/apparmor.d/profiles-s-z/whereis index 4a1293c0a..32d4ffa51 100644 --- a/apparmor.d/profiles-s-z/whereis +++ b/apparmor.d/profiles-s-z/whereis @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/which b/apparmor.d/profiles-s-z/which index 32d0945e1..855db3f4b 100644 --- a/apparmor.d/profiles-s-z/which +++ b/apparmor.d/profiles-s-z/which @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/whiptail b/apparmor.d/profiles-s-z/whiptail index f2339717a..a7b98ebee 100644 --- a/apparmor.d/profiles-s-z/whiptail +++ b/apparmor.d/profiles-s-z/whiptail @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/who b/apparmor.d/profiles-s-z/who index 54b4375b2..3da07f89d 100644 --- a/apparmor.d/profiles-s-z/who +++ b/apparmor.d/profiles-s-z/who @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/whoami b/apparmor.d/profiles-s-z/whoami index 3072d7da0..3fc9e26b4 100644 --- a/apparmor.d/profiles-s-z/whoami +++ b/apparmor.d/profiles-s-z/whoami @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wireplumber b/apparmor.d/profiles-s-z/wireplumber index eadb669cd..87b4e27ca 100644 --- a/apparmor.d/profiles-s-z/wireplumber +++ b/apparmor.d/profiles-s-z/wireplumber @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wireshark b/apparmor.d/profiles-s-z/wireshark index ed8fd0efa..c29543d6b 100644 --- a/apparmor.d/profiles-s-z/wireshark +++ b/apparmor.d/profiles-s-z/wireshark @@ -4,7 +4,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wl-copy b/apparmor.d/profiles-s-z/wl-copy index a71e4cbd9..1b4ae7501 100644 --- a/apparmor.d/profiles-s-z/wl-copy +++ b/apparmor.d/profiles-s-z/wl-copy @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wmctrl b/apparmor.d/profiles-s-z/wmctrl index 47a17669d..51feb0071 100644 --- a/apparmor.d/profiles-s-z/wmctrl +++ b/apparmor.d/profiles-s-z/wmctrl @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wpa-action b/apparmor.d/profiles-s-z/wpa-action index 3495849e7..136caa781 100644 --- a/apparmor.d/profiles-s-z/wpa-action +++ b/apparmor.d/profiles-s-z/wpa-action @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wpa-cli b/apparmor.d/profiles-s-z/wpa-cli index 5edd2f177..c9987fa01 100644 --- a/apparmor.d/profiles-s-z/wpa-cli +++ b/apparmor.d/profiles-s-z/wpa-cli @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wpa-gui b/apparmor.d/profiles-s-z/wpa-gui index 3a729a989..fd10713cc 100644 --- a/apparmor.d/profiles-s-z/wpa-gui +++ b/apparmor.d/profiles-s-z/wpa-gui @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wpa-supplicant b/apparmor.d/profiles-s-z/wpa-supplicant index f3da61258..23f77f840 100644 --- a/apparmor.d/profiles-s-z/wpa-supplicant +++ b/apparmor.d/profiles-s-z/wpa-supplicant @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wrmsr b/apparmor.d/profiles-s-z/wrmsr index 1ee5bd806..7de522fc8 100644 --- a/apparmor.d/profiles-s-z/wrmsr +++ b/apparmor.d/profiles-s-z/wrmsr @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd index 56a852d11..22713e3bf 100644 --- a/apparmor.d/profiles-s-z/wsdd +++ b/apparmor.d/profiles-s-z/wsdd @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xarchiver b/apparmor.d/profiles-s-z/xarchiver index a5ec89fd9..514ea5c36 100644 --- a/apparmor.d/profiles-s-z/xarchiver +++ b/apparmor.d/profiles-s-z/xarchiver @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xauth b/apparmor.d/profiles-s-z/xauth index c5e741b8f..e1a4199db 100644 --- a/apparmor.d/profiles-s-z/xauth +++ b/apparmor.d/profiles-s-z/xauth @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xautolock b/apparmor.d/profiles-s-z/xautolock index 89de67bd1..cb9426583 100644 --- a/apparmor.d/profiles-s-z/xautolock +++ b/apparmor.d/profiles-s-z/xautolock @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xbacklight b/apparmor.d/profiles-s-z/xbacklight index 19eb4a9f3..b2be0446b 100644 --- a/apparmor.d/profiles-s-z/xbacklight +++ b/apparmor.d/profiles-s-z/xbacklight @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xbrlapi b/apparmor.d/profiles-s-z/xbrlapi index dc30114bd..35006d46b 100644 --- a/apparmor.d/profiles-s-z/xbrlapi +++ b/apparmor.d/profiles-s-z/xbrlapi @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xclip b/apparmor.d/profiles-s-z/xclip index 9f82aff64..cdb68ed70 100644 --- a/apparmor.d/profiles-s-z/xclip +++ b/apparmor.d/profiles-s-z/xclip @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xdpyinfo b/apparmor.d/profiles-s-z/xdpyinfo index 902905d09..169851550 100644 --- a/apparmor.d/profiles-s-z/xdpyinfo +++ b/apparmor.d/profiles-s-z/xdpyinfo @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xinit b/apparmor.d/profiles-s-z/xinit index 521a182ba..0801ac188 100644 --- a/apparmor.d/profiles-s-z/xinit +++ b/apparmor.d/profiles-s-z/xinit @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xinput b/apparmor.d/profiles-s-z/xinput index 18eab6a78..c88210cca 100644 --- a/apparmor.d/profiles-s-z/xinput +++ b/apparmor.d/profiles-s-z/xinput @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xsane-gimp b/apparmor.d/profiles-s-z/xsane-gimp index 1ae25a35e..41ac0b973 100644 --- a/apparmor.d/profiles-s-z/xsane-gimp +++ b/apparmor.d/profiles-s-z/xsane-gimp @@ -2,7 +2,7 @@ # Copyright (C) 2024 Roman Beslik # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/xsel b/apparmor.d/profiles-s-z/xsel index 5f97c83f3..05b93fed9 100644 --- a/apparmor.d/profiles-s-z/xsel +++ b/apparmor.d/profiles-s-z/xsel @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/youtube-dl b/apparmor.d/profiles-s-z/youtube-dl index 85da6bfe0..781e24768 100644 --- a/apparmor.d/profiles-s-z/youtube-dl +++ b/apparmor.d/profiles-s-z/youtube-dl @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/youtube-viewer b/apparmor.d/profiles-s-z/youtube-viewer index 1c405e8fe..ac8e8f215 100644 --- a/apparmor.d/profiles-s-z/youtube-viewer +++ b/apparmor.d/profiles-s-z/youtube-viewer @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/yt-dlp b/apparmor.d/profiles-s-z/yt-dlp index c71b87efd..551a8edf4 100644 --- a/apparmor.d/profiles-s-z/yt-dlp +++ b/apparmor.d/profiles-s-z/yt-dlp @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ytdl b/apparmor.d/profiles-s-z/ytdl index 230e15f80..81ccfc284 100644 --- a/apparmor.d/profiles-s-z/ytdl +++ b/apparmor.d/profiles-s-z/ytdl @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/zathura b/apparmor.d/profiles-s-z/zathura index d45ad5f1e..5d0d1a745 100644 --- a/apparmor.d/profiles-s-z/zathura +++ b/apparmor.d/profiles-s-z/zathura @@ -2,7 +2,7 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/zed b/apparmor.d/profiles-s-z/zed index c966ce839..048f2410c 100644 --- a/apparmor.d/profiles-s-z/zed +++ b/apparmor.d/profiles-s-z/zed @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/zenmap b/apparmor.d/profiles-s-z/zenmap index bc4090be8..59a8d772e 100644 --- a/apparmor.d/profiles-s-z/zenmap +++ b/apparmor.d/profiles-s-z/zenmap @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/zfs b/apparmor.d/profiles-s-z/zfs index 9538b9c13..9ba71f45b 100644 --- a/apparmor.d/profiles-s-z/zfs +++ b/apparmor.d/profiles-s-z/zfs @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/zpool b/apparmor.d/profiles-s-z/zpool index 7d12cf3b7..2cb997fd7 100644 --- a/apparmor.d/profiles-s-z/zpool +++ b/apparmor.d/profiles-s-z/zpool @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/zsys-system-autosnapshot b/apparmor.d/profiles-s-z/zsys-system-autosnapshot index 653690898..cbf48ba4f 100644 --- a/apparmor.d/profiles-s-z/zsys-system-autosnapshot +++ b/apparmor.d/profiles-s-z/zsys-system-autosnapshot @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/zsysd b/apparmor.d/profiles-s-z/zsysd index eabe2d62c..30a17a6ad 100644 --- a/apparmor.d/profiles-s-z/zsysd +++ b/apparmor.d/profiles-s-z/zsysd @@ -2,7 +2,7 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/dists/ubuntu/abstractions/trash b/dists/ubuntu/abstractions/trash index aab16b92c..d9ad01221 100644 --- a/dists/ubuntu/abstractions/trash +++ b/dists/ubuntu/abstractions/trash @@ -1,4 +1,4 @@ -abi , +abi , # requires diff --git a/docs/development/workflow.md b/docs/development/workflow.md index 7455d97c7..a1631e3d8 100644 --- a/docs/development/workflow.md +++ b/docs/development/workflow.md @@ -39,7 +39,7 @@ title: Workflow # Copyright (C) 2024 You # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include From d6b7bef89ea833cc86835899699c68322d8098f6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 14:19:26 +0100 Subject: [PATCH 0283/1455] feat(profile): enable abi 4 rules by default. --- apparmor.d/abstractions/app/chromium | 2 +- apparmor.d/abstractions/app/firefox | 2 +- apparmor.d/abstractions/common/bwrap | 2 +- apparmor.d/abstractions/common/chromium | 2 +- apparmor.d/abstractions/common/electron | 2 +- apparmor.d/groups/gnome/nautilus | 2 +- apparmor.d/groups/kde/plasmashell | 2 +- apparmor.d/groups/systemd/systemd-coredump | 2 +- apparmor.d/groups/systemd/systemd-logind | 2 +- apparmor.d/groups/ubuntu/package-system-locked | 2 +- apparmor.d/groups/virt/virtiofsd | 2 +- apparmor.d/profiles-a-f/flatpak | 2 +- apparmor.d/profiles-g-l/lvm | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 0aa8f5ef1..81d37113d 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -43,7 +43,7 @@ include include - # userns, + userns, capability setgid, capability setuid, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 23a91593f..c94ef8476 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -30,7 +30,7 @@ include include - # userns, + userns, capability sys_admin, # If kernel.unprivileged_userns_clone = 1 capability sys_chroot, # If kernel.unprivileged_userns_clone = 1 diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index a73626bb1..711117f6d 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -7,7 +7,7 @@ # - the flag: attach_disconnected # - bwrap execution: '@{bin}/bwrap rix,' - # userns, + userns, capability net_admin, capability setpcap, diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index 28effd768..cad07669a 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -6,7 +6,7 @@ # This abstraction is for chromium based application. Chromium based browsers # need to use abstractions/chromium instead. - # userns, + userns, capability setgid, # If kernel.unprivileged_userns_clone = 1 capability setuid, # If kernel.unprivileged_userns_clone = 1 diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 9cf480718..da792131d 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -18,7 +18,7 @@ include include - # userns, + userns, capability setgid, # If kernel.unprivileged_userns_clone = 1 capability setuid, # If kernel.unprivileged_userns_clone = 1 diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index ccaf5d6f7..e4990a3e3 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -26,7 +26,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { include include - # mqueue r type=posix /, + mqueue r type=posix /, #aa:dbus own bus=session name=org.gnome.Nautilus interface=org.gtk.{Application,Actions} #aa:dbus own bus=session name=org.freedesktop.FileManager1 diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 89e0dfeae..a7bde918e 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -28,7 +28,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { include include - # userns, + userns, capability sys_ptrace, diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 8c90be6f6..2e841dc51 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -13,7 +13,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted include include - # userns, + userns, capability dac_override, capability dac_read_search, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index f4628c019..53dd0acf8 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -27,7 +27,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { network netlink raw, - # mqueue r type=posix /, + mqueue r type=posix /, unix (bind) type=stream addr=@@{hex16}/bus/systemd-logind/system, diff --git a/apparmor.d/groups/ubuntu/package-system-locked b/apparmor.d/groups/ubuntu/package-system-locked index f4e040975..7398fc404 100644 --- a/apparmor.d/groups/ubuntu/package-system-locked +++ b/apparmor.d/groups/ubuntu/package-system-locked @@ -17,7 +17,7 @@ profile package-system-locked @{exec_path} flags=(attach_disconnected) { network inet dgram, network inet6 dgram, - # mqueue r type=posix /, + mqueue r type=posix /, ptrace (read), diff --git a/apparmor.d/groups/virt/virtiofsd b/apparmor.d/groups/virt/virtiofsd index 7389119b8..905e2c170 100644 --- a/apparmor.d/groups/virt/virtiofsd +++ b/apparmor.d/groups/virt/virtiofsd @@ -10,7 +10,7 @@ include profile virtiofsd @{exec_path} { include - # userns, + userns, capability chown, capability dac_override, diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index 05873c4e2..b38a03537 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -18,7 +18,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain include include - # userns, + userns, capability dac_override, capability dac_read_search, diff --git a/apparmor.d/profiles-g-l/lvm b/apparmor.d/profiles-g-l/lvm index e579d7a91..cff4ce186 100644 --- a/apparmor.d/profiles-g-l/lvm +++ b/apparmor.d/profiles-g-l/lvm @@ -23,7 +23,7 @@ profile lvm @{exec_path} flags=(attach_disconnected) { ptrace (read), - # mqueue r type=posix /, + mqueue r type=posix /, @{exec_path} rm, From 59ac54e2fcb069c39242306f206f6aaeb3c665a9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 16:22:46 +0100 Subject: [PATCH 0284/1455] build: reorganise build: abi4, fallback, prebuild cli - ABI4 by default, fallback to abi 3. - aa-prebuild cli that can be used by other project shipping profiles. - --file option to cli to only build one dev profile. - add abi version filter to only & exclude directives. --- cmd/prebuild/main.go | 120 +++++------- cmd/prebuild/main_test.go | 61 ++---- docs/development/directives.md | 1 + pkg/prebuild/builder/abi.go | 14 +- pkg/prebuild/builder/complain.go | 6 +- pkg/prebuild/builder/core.go | 4 +- pkg/prebuild/builder/core_test.go | 16 +- pkg/prebuild/builder/dev.go | 6 +- pkg/prebuild/builder/enforce.go | 6 +- pkg/prebuild/builder/fsp.go | 6 +- pkg/prebuild/builder/userspace.go | 10 +- pkg/prebuild/cli/cli.go | 181 ++++++++++++++++++ .../{prebuild_test.go => cli/cli_test.go} | 29 ++- pkg/prebuild/{cfg => }/core.go | 12 +- pkg/prebuild/{cfg => }/core_test.go | 5 +- pkg/prebuild/directive/core.go | 14 +- pkg/prebuild/directive/dbus.go | 6 +- pkg/prebuild/directive/exec.go | 8 +- pkg/prebuild/directive/exec_test.go | 4 +- pkg/prebuild/directive/filter.go | 17 +- pkg/prebuild/directive/filter_test.go | 10 +- pkg/prebuild/directive/stack.go | 8 +- pkg/prebuild/directive/stack_test.go | 4 +- pkg/prebuild/{cfg => }/directories.go | 10 +- pkg/prebuild/{cfg => }/files.go | 35 +--- pkg/prebuild/{cfg => }/files_test.go | 2 +- pkg/prebuild/{cfg => }/os.go | 2 +- pkg/prebuild/{cfg => }/os_test.go | 2 +- pkg/prebuild/prebuild.go | 117 ----------- pkg/prebuild/prepare/configure.go | 71 +++++-- pkg/prebuild/prepare/core.go | 4 +- pkg/prebuild/prepare/core_test.go | 14 +- pkg/prebuild/prepare/flags.go | 14 +- pkg/prebuild/prepare/fsp.go | 14 +- pkg/prebuild/prepare/ignore.go | 16 +- pkg/prebuild/prepare/merge.go | 12 +- pkg/prebuild/prepare/synchronise.go | 30 ++- pkg/prebuild/prepare/systemd.go | 14 +- tests/cmd/main.go | 8 +- 39 files changed, 473 insertions(+), 440 deletions(-) create mode 100644 pkg/prebuild/cli/cli.go rename pkg/prebuild/{prebuild_test.go => cli/cli_test.go} (79%) rename pkg/prebuild/{cfg => }/core.go (73%) rename pkg/prebuild/{cfg => }/core_test.go (90%) rename pkg/prebuild/{cfg => }/directories.go (83%) rename pkg/prebuild/{cfg => }/files.go (63%) rename pkg/prebuild/{cfg => }/files_test.go (99%) rename pkg/prebuild/{cfg => }/os.go (99%) rename pkg/prebuild/{cfg => }/os_test.go (99%) delete mode 100644 pkg/prebuild/prebuild.go diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index d909cc818..6b2b2422f 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -5,92 +5,66 @@ package main import ( - "flag" - "fmt" - "os" + "slices" - "github.com/roddhjav/apparmor.d/pkg/logging" "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" - "github.com/roddhjav/apparmor.d/pkg/prebuild/directive" + "github.com/roddhjav/apparmor.d/pkg/prebuild/cli" "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" ) -const usage = `prebuild [-h] [--full] [--complain | --enforce] - - Prebuild apparmor.d profiles for a given distribution and apply - internal built-in directives. - -Options: - -h, --help Show this help message and exit. - -f, --full Set AppArmor for full system policy. - -c, --complain Set complain flag on all profiles. - -e, --enforce Set enforce flag on all profiles. - --abi4 Convert the profiles to Apparmor abi/4.0. - -` - -var ( - help bool - full bool - complain bool - enforce bool - abi4 bool -) - func init() { - flag.BoolVar(&help, "h", false, "Show this help message and exit.") - flag.BoolVar(&help, "help", false, "Show this help message and exit.") - flag.BoolVar(&full, "f", false, "Set AppArmor for full system policy.") - flag.BoolVar(&full, "full", false, "Set AppArmor for full system policy.") - flag.BoolVar(&complain, "c", false, "Set complain flag on all profiles.") - flag.BoolVar(&complain, "complain", false, "Set complain flag on all profiles.") - flag.BoolVar(&enforce, "e", false, "Set enforce flag on all profiles.") - flag.BoolVar(&enforce, "enforce", false, "Set enforce flag on all profiles.") - flag.BoolVar(&abi4, "abi4", false, "Convert the profiles to Apparmor abi/4.0.") -} + // Define the tasks applied by default + prepare.Register( + "synchronise", + "ignore", + "merge", + "configure", + "setflags", + "systemd-default", + ) -func aaPrebuild() error { - logging.Step("Building apparmor.d profiles for %s.", cfg.Distribution) + // Build tasks applied by default + builder.Register( + "userspace", // Resolve variable in the userspace profile + "dev", // Temporary fix for #74, #80 & #235 + ) - if full { - prepare.Register("fsp") - builder.Register("fsp") - } else { - prepare.Register("systemd-early") + // Compatibility with AppArmor 3 + switch prebuild.Distribution { + case "arch": + prebuild.ABI = 3 + + case "ubuntu": + if !slices.Contains([]string{"noble"}, prebuild.Release["VERSION_CODENAME"]) { + prebuild.ABI = 3 + } + + case "debian": + prebuild.ABI = 3 + + case "whonix": + prebuild.ABI = 3 + + // Hide rewrittem Whonix profiles + prebuild.Hide += `/etc/apparmor.d/abstractions/base.d/kicksecure + /etc/apparmor.d/home.tor-browser.firefox + /etc/apparmor.d/tunables/homsanitycheck + /etc/apparmor.d/usr.bin.url_e.d/anondist + /etc/apparmor.d/tunables/home.d/live-mode + /etc/apparmor.d/tunables/home.d/qubes-whonix-anondist + /etc/apparmor.d/usr.bin.hexchat + /etc/apparmor.d/usr.bin.sdwdate + /etc/apparmor.d/usr.bin.systemcheck + /etc/apparmor.d/usr.bin.timeto_unixtime + /etc/apparmor.d/whonix-firewall + ` } - - if complain { - builder.Register("complain") - } else if enforce { - builder.Register("enforce") - } - - if abi4 { + if prebuild.ABI == 3 { builder.Register("abi3") } - - if err := prebuild.Prepare(); err != nil { - return err - } - return prebuild.Build() } func main() { - flag.Usage = func() { - fmt.Printf("%s%s\n%s\n%s", usage, - cfg.Help("Prepare", prepare.Tasks), - cfg.Help("Build", builder.Builders), - cfg.Usage("Directives", directive.Directives), - ) - } - flag.Parse() - if help { - flag.Usage() - os.Exit(0) - } - if err := aaPrebuild(); err != nil { - logging.Fatal("%s", err.Error()) - } + cli.Prebuild() } diff --git a/cmd/prebuild/main_test.go b/cmd/prebuild/main_test.go index 8e80c3ab3..d3c28f025 100644 --- a/cmd/prebuild/main_test.go +++ b/cmd/prebuild/main_test.go @@ -9,9 +9,7 @@ import ( "os/exec" "testing" - "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" - "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) func chdirGitRoot() { @@ -26,64 +24,33 @@ func chdirGitRoot() { } } -func Test_AAPrebuild(t *testing.T) { +func Test_main(t *testing.T) { tests := []struct { - name string - wantErr bool - full bool - complain bool - dist string + name string + dist string }{ { - name: "Build for Archlinux", - wantErr: false, - full: false, - complain: true, - dist: "arch", + name: "Build for Archlinux", + dist: "arch", }, { - name: "Build for Ubuntu", - wantErr: false, - full: true, - complain: false, - dist: "ubuntu", + name: "Build for Ubuntu", + dist: "ubuntu", }, { - name: "Build for Debian", - wantErr: false, - full: true, - complain: false, - dist: "debian", + name: "Build for Debian", + dist: "debian", }, { - name: "Build for OpenSUSE Tumbleweed", - wantErr: false, - full: true, - complain: true, - dist: "opensuse", + name: "Build for OpenSUSE Tumbleweed", + dist: "opensuse", }, - // { - // name: "Build for Fedora", - // wantErr: true, - // full: false, - // complain: false, - // dist: "fedora", - // }, } chdirGitRoot() for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - cfg.Distribution = tt.dist - if tt.full { - prepare.Register("fsp") - builder.Register("fsp") - } - if tt.complain { - builder.Register("complain") - } - if err := aaPrebuild(); (err != nil) != tt.wantErr { - t.Errorf("aaPrebuild() error = %v, wantErr %v", err, tt.wantErr) - } + prebuild.Distribution = tt.dist + main() }) } } diff --git a/docs/development/directives.md b/docs/development/directives.md index 7263b4910..8897f9519 100644 --- a/docs/development/directives.md +++ b/docs/development/directives.md @@ -40,6 +40,7 @@ The `only` and `exclude` directives can be used to filter individual rule or rul - A supported target distribution: `arch`, `debian`, `ubuntu`, `opensuse`, `whonix`. - A supported distribution family: `apt`, `pacman`, `zypper`. + - A supported ABI: `abi3`, `abi4`. **Example** diff --git a/pkg/prebuild/builder/abi.go b/pkg/prebuild/builder/abi.go index 72b3943d3..4e74a5411 100644 --- a/pkg/prebuild/builder/abi.go +++ b/pkg/prebuild/builder/abi.go @@ -5,25 +5,25 @@ package builder import ( - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) var ( - regAbi4To3 = util.ToRegexRepl([]string{ // Currently Abi3 -> Abi4 - `abi/3.0`, `abi/4.0`, - `# userns,`, `userns,`, - `# mqueue`, `mqueue`, + regAbi4To3 = util.ToRegexRepl([]string{ + `abi/4.0`, `abi/3.0`, + `userns,`, `# userns,`, + `mqueue`, `# mqueue`, }) ) type ABI3 struct { - cfg.Base + prebuild.Base } func init() { RegisterBuilder(&ABI3{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "abi3", Msg: "Convert all profiles from abi 4.0 to abi 3.0", }, diff --git a/pkg/prebuild/builder/complain.go b/pkg/prebuild/builder/complain.go index 68dcc9f48..dbd9b3478 100644 --- a/pkg/prebuild/builder/complain.go +++ b/pkg/prebuild/builder/complain.go @@ -9,7 +9,7 @@ import ( "slices" "strings" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) var ( @@ -18,12 +18,12 @@ var ( ) type Complain struct { - cfg.Base + prebuild.Base } func init() { RegisterBuilder(&Complain{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "complain", Msg: "Set complain flag on all profiles", }, diff --git a/pkg/prebuild/builder/core.go b/pkg/prebuild/builder/core.go index 64046721f..b45075e15 100644 --- a/pkg/prebuild/builder/core.go +++ b/pkg/prebuild/builder/core.go @@ -8,7 +8,7 @@ import ( "fmt" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) var ( @@ -21,7 +21,7 @@ var ( // Main directive interface type Builder interface { - cfg.BaseInterface + prebuild.BaseInterface Apply(opt *Option, profile string) (string, error) } diff --git a/pkg/prebuild/builder/core_test.go b/pkg/prebuild/builder/core_test.go index 597832b91..5a1a39da0 100644 --- a/pkg/prebuild/builder/core_test.go +++ b/pkg/prebuild/builder/core_test.go @@ -8,7 +8,7 @@ import ( "slices" "testing" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) func TestBuilder_Apply(t *testing.T) { @@ -23,17 +23,17 @@ func TestBuilder_Apply(t *testing.T) { name: "abi3", b: Builders["abi3"], profile: ` - abi , - profile test { - # userns, - # mqueue r type=posix /, - }`, - want: ` abi , profile test { userns, mqueue r type=posix /, }`, + want: ` + abi , + profile test { + # userns, + # mqueue r type=posix /, + }`, }, { name: "complain-1", @@ -234,7 +234,7 @@ func TestBuilder_Apply(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - opt := &Option{File: cfg.RootApparmord.Join(tt.name)} + opt := &Option{File: prebuild.RootApparmord.Join(tt.name)} got, err := tt.b.Apply(opt, tt.profile) if (err != nil) != tt.wantErr { t.Errorf("Builder.Apply() error = %v, wantErr %v", err, tt.wantErr) diff --git a/pkg/prebuild/builder/dev.go b/pkg/prebuild/builder/dev.go index f8ebdff02..19fbe409d 100644 --- a/pkg/prebuild/builder/dev.go +++ b/pkg/prebuild/builder/dev.go @@ -5,7 +5,7 @@ package builder import ( - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) @@ -19,12 +19,12 @@ var ( ) type Dev struct { - cfg.Base + prebuild.Base } func init() { RegisterBuilder(&Dev{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "dev", Msg: "Apply test development changes", }, diff --git a/pkg/prebuild/builder/enforce.go b/pkg/prebuild/builder/enforce.go index d453da51b..a7ce90a7a 100644 --- a/pkg/prebuild/builder/enforce.go +++ b/pkg/prebuild/builder/enforce.go @@ -8,16 +8,16 @@ import ( "slices" "strings" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) type Enforce struct { - cfg.Base + prebuild.Base } func init() { RegisterBuilder(&Enforce{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "enforce", Msg: "All profiles have been enforced", }, diff --git a/pkg/prebuild/builder/fsp.go b/pkg/prebuild/builder/fsp.go index 003f79525..ed2285de5 100644 --- a/pkg/prebuild/builder/fsp.go +++ b/pkg/prebuild/builder/fsp.go @@ -5,7 +5,7 @@ package builder import ( - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) @@ -16,12 +16,12 @@ var ( ) type FullSystemPolicy struct { - cfg.Base + prebuild.Base } func init() { RegisterBuilder(&FullSystemPolicy{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "fsp", Msg: "Prevent unconfined transitions in profile rules", }, diff --git a/pkg/prebuild/builder/userspace.go b/pkg/prebuild/builder/userspace.go index 8a7df0bc9..be5886cbd 100644 --- a/pkg/prebuild/builder/userspace.go +++ b/pkg/prebuild/builder/userspace.go @@ -10,7 +10,7 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/aa" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) const tokATTACHMENT = "@{exec_path}" @@ -20,12 +20,12 @@ var ( ) type Userspace struct { - cfg.Base + prebuild.Base } func init() { RegisterBuilder(&Userspace{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "userspace", Msg: "Bypass userspace tools restriction", }, @@ -33,10 +33,10 @@ func init() { } func (b Userspace) Apply(opt *Option, profile string) (string, error) { - if ok, _ := opt.File.IsInsideDir(cfg.RootApparmord.Join("abstractions")); ok { + if ok, _ := opt.File.IsInsideDir(prebuild.RootApparmord.Join("abstractions")); ok { return profile, nil } - if ok, _ := opt.File.IsInsideDir(cfg.RootApparmord.Join("tunables")); ok { + if ok, _ := opt.File.IsInsideDir(prebuild.RootApparmord.Join("tunables")); ok { return profile, nil } diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go new file mode 100644 index 000000000..6fd0a36f5 --- /dev/null +++ b/pkg/prebuild/cli/cli.go @@ -0,0 +1,181 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2023-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package cli + +import ( + "flag" + "fmt" + "strings" + + "github.com/roddhjav/apparmor.d/pkg/logging" + "github.com/roddhjav/apparmor.d/pkg/paths" + "github.com/roddhjav/apparmor.d/pkg/prebuild" + "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" + "github.com/roddhjav/apparmor.d/pkg/prebuild/directive" + "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" + "github.com/roddhjav/apparmor.d/pkg/util" +) + +const ( + nilABI uint = 0 + usage = `aa-prebuild [-h] [--complain | --enforce] [--full] [--abi 3|4] + + Prebuild apparmor.d profiles for a given distribution and apply + internal built-in directives. + +Options: + -h, --help Show this help message and exit. + -c, --complain Set complain flag on all profiles. + -e, --enforce Set enforce flag on all profiles. + -a, --abi ABI Target apparmor ABI. + -f, --full Set AppArmor for full system policy. + -F, --file Only prebuild a given file. +` +) + +var ( + help bool + complain bool + enforce bool + full bool + abi uint + file string +) + +func init() { + flag.BoolVar(&help, "h", false, "Show this help message and exit.") + flag.BoolVar(&help, "help", false, "Show this help message and exit.") + flag.BoolVar(&full, "f", false, "Set AppArmor for full system policy.") + flag.BoolVar(&full, "full", false, "Set AppArmor for full system policy.") + flag.BoolVar(&complain, "c", false, "Set complain flag on all profiles.") + flag.BoolVar(&complain, "complain", false, "Set complain flag on all profiles.") + flag.BoolVar(&enforce, "e", false, "Set enforce flag on all profiles.") + flag.BoolVar(&enforce, "enforce", false, "Set enforce flag on all profiles.") + flag.UintVar(&abi, "a", nilABI, "Target apparmor ABI.") + flag.UintVar(&abi, "abi", nilABI, "Target apparmor ABI.") + flag.StringVar(&file, "F", "", "Only prebuild a given file.") + flag.StringVar(&file, "file", "", "Only prebuild a given file.") +} + +func Prebuild() { + flag.Usage = func() { + fmt.Printf("%s%s\n%s\n%s", usage, + prebuild.Help("Prepare", prepare.Tasks), + prebuild.Help("Build", builder.Builders), + directive.Usage(), + ) + } + flag.Parse() + if help { + flag.Usage() + return + } + logging.Step("Building apparmor.d profiles for %s.", prebuild.Distribution) + + if full { + prepare.Register("fsp") + builder.Register("fsp") + } else { + prepare.Register("systemd-early") + } + + if complain { + builder.Register("complain") + } else if enforce { + builder.Register("enforce") + } + + switch abi { + case 3: + prebuild.ABI = 3 + builder.Register("abi3") + case 4: + prebuild.ABI = 4 + for i, b := range builder.Builds { + if b.Name() == "abi3" { + builder.Builds = append(builder.Builds[:i], builder.Builds[i+1:]...) + break + } + } + case nilABI: + default: + logging.Fatal("ABI %d not supported", abi) + } + + if file != "" { + sync, _ := prepare.Tasks["synchronise"].(*prepare.Synchronise) + sync.Path = file + configure, _ := prepare.Tasks["configure"].(*prepare.Configure) + configure.OneFile = true + } + + if err := Prepare(); err != nil { + logging.Fatal("%s", err.Error()) + } + if err := Build(); err != nil { + logging.Fatal("%s", err.Error()) + } +} + +func Prepare() error { + for _, task := range prepare.Prepares { + msg, err := task.Apply() + if err != nil { + return err + } + if file != "" && task.Name() == "setflags" { + continue + } + logging.Success("%s", task.Message()) + logging.Indent = " " + for _, line := range msg { + if strings.Contains(line, "not found") { + logging.Warning("%s", line) + } else { + logging.Bullet("%s", line) + } + } + logging.Indent = "" + } + return nil +} + +func Build() error { + files, _ := prebuild.RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories()) + for _, file := range files { + if !file.Exist() { + continue + } + profile, err := util.ReadFile(file) + if err != nil { + return err + } + profile, err = builder.Run(file, profile) + if err != nil { + return err + } + profile, err = directive.Run(file, profile) + if err != nil { + return err + } + if err := file.WriteFile([]byte(profile)); err != nil { + return err + } + } + + logging.Success("Build tasks:") + logging.Indent = " " + for _, task := range builder.Builds { + logging.Bullet("%s", task.Message()) + } + logging.Indent = "" + logging.Success("Directives processed:") + logging.Indent = " " + for _, dir := range directive.Directives { + logging.Bullet("%s%s", directive.Keyword, dir.Name()) + } + logging.Indent = "" + return nil +} diff --git a/pkg/prebuild/prebuild_test.go b/pkg/prebuild/cli/cli_test.go similarity index 79% rename from pkg/prebuild/prebuild_test.go rename to pkg/prebuild/cli/cli_test.go index db709c315..782d81756 100644 --- a/pkg/prebuild/prebuild_test.go +++ b/pkg/prebuild/cli/cli_test.go @@ -2,7 +2,7 @@ // Copyright (C) 2023-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package prebuild +package cli import ( "os" @@ -10,15 +10,15 @@ import ( "testing" "github.com/roddhjav/apparmor.d/pkg/paths" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" ) func setTestBuildDirectories(name string) { testRoot := paths.New("/tmp/tests") - cfg.Root = testRoot.Join(name) - cfg.RootApparmord = cfg.Root.Join("apparmor.d") + prebuild.Root = testRoot.Join(name) + prebuild.RootApparmord = prebuild.Root.Join("apparmor.d") } func chdirGitRoot() { @@ -33,7 +33,7 @@ func chdirGitRoot() { } } -func Test_PreBuild(t *testing.T) { +func Test_Prebuild(t *testing.T) { tests := []struct { name string wantErr bool @@ -79,17 +79,26 @@ func Test_PreBuild(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { setTestBuildDirectories(tt.name) - cfg.Distribution = tt.dist - if tt.full { + prebuild.Distribution = tt.dist + prepare.Prepares = []prepare.Task{} + prepare.Register( + "synchronise", "ignore", "merge", + "configure", "setflags", "systemd-default", + ) + + if full { prepare.Register("fsp") builder.Register("fsp") + } else { + prepare.Register("systemd-early") } - if tt.complain { + + if complain { builder.Register("complain") - } - if tt.enforce { + } else if enforce { builder.Register("enforce") } + if err := Prepare(); (err != nil) != tt.wantErr { t.Errorf("Prepare() error = %v, wantErr %v", err, tt.wantErr) } diff --git a/pkg/prebuild/cfg/core.go b/pkg/prebuild/core.go similarity index 73% rename from pkg/prebuild/cfg/core.go rename to pkg/prebuild/core.go index 56b91ed6f..8c2410d10 100644 --- a/pkg/prebuild/cfg/core.go +++ b/pkg/prebuild/core.go @@ -2,7 +2,7 @@ // Copyright (C) 2021-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package cfg +package prebuild import "fmt" @@ -37,13 +37,3 @@ func Help[T BaseInterface](name string, tasks map[string]T) string { } return res } - -func Usage[T BaseInterface](name string, tasks map[string]T) string { - res := fmt.Sprintf("%s\n", name) - for _, t := range tasks { - for _, h := range t.Usage() { - res += fmt.Sprintf(" #aa:%s %s\n", t.Name(), h) - } - } - return res -} diff --git a/pkg/prebuild/cfg/core_test.go b/pkg/prebuild/core_test.go similarity index 90% rename from pkg/prebuild/cfg/core_test.go rename to pkg/prebuild/core_test.go index 7cde166a1..5abf0a9c1 100644 --- a/pkg/prebuild/cfg/core_test.go +++ b/pkg/prebuild/core_test.go @@ -2,7 +2,7 @@ // Copyright (C) 2021-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package cfg +package prebuild import ( "slices" @@ -57,9 +57,6 @@ func TestHelp(t *testing.T) { if got := Help(tt.name, tt.tasks); !strings.Contains(got, tt.want) { t.Errorf("Help() = %v, want %v", got, tt.want) } - if got := Usage(tt.name, tt.tasks); !strings.Contains(got, tt.want) { - t.Errorf("Usage() = %v, want %v", got, tt.want) - } }) } } diff --git a/pkg/prebuild/directive/core.go b/pkg/prebuild/directive/core.go index 0e791730f..2568cb098 100644 --- a/pkg/prebuild/directive/core.go +++ b/pkg/prebuild/directive/core.go @@ -10,7 +10,7 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) var ( @@ -25,10 +25,20 @@ var ( // Main directive interface type Directive interface { - cfg.BaseInterface + prebuild.BaseInterface Apply(opt *Option, profile string) (string, error) } +func Usage() string { + res := fmt.Sprintf("Directive:\n") + for _, d := range Directives { + for _, h := range d.Usage() { + res += fmt.Sprintf(" %s%s %s\n", Keyword, d.Name(), h) + } + } + return res +} + // Directive options type Option struct { Name string diff --git a/pkg/prebuild/directive/dbus.go b/pkg/prebuild/directive/dbus.go index 98f5cd61c..a1135d675 100644 --- a/pkg/prebuild/directive/dbus.go +++ b/pkg/prebuild/directive/dbus.go @@ -18,7 +18,7 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/aa" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) var defaultInterfaces = []string{ @@ -27,12 +27,12 @@ var defaultInterfaces = []string{ } type Dbus struct { - cfg.Base + prebuild.Base } func init() { RegisterDirective(&Dbus{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "dbus", Msg: "Dbus directive applied", Help: []string{ diff --git a/pkg/prebuild/directive/exec.go b/pkg/prebuild/directive/exec.go index 64c97e9cd..c856b7268 100644 --- a/pkg/prebuild/directive/exec.go +++ b/pkg/prebuild/directive/exec.go @@ -12,17 +12,17 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/aa" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) type Exec struct { - cfg.Base + prebuild.Base } func init() { RegisterDirective(&Exec{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "exec", Msg: "Exec directive applied", Help: []string{"[P|U|p|u|PU|pu|] profiles..."}, @@ -44,7 +44,7 @@ func (d Exec) Apply(opt *Option, profileRaw string) (string, error) { rules := aa.Rules{} for name := range opt.ArgMap { - profiletoTransition := util.MustReadFile(cfg.RootApparmord.Join(name)) + profiletoTransition := util.MustReadFile(prebuild.RootApparmord.Join(name)) dstProfile := aa.DefaultTunables() if _, err := dstProfile.Parse(profiletoTransition); err != nil { return "", err diff --git a/pkg/prebuild/directive/exec_test.go b/pkg/prebuild/directive/exec_test.go index c6d4e32a7..5581d7f2b 100644 --- a/pkg/prebuild/directive/exec_test.go +++ b/pkg/prebuild/directive/exec_test.go @@ -8,7 +8,7 @@ import ( "testing" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) func TestExec_Apply(t *testing.T) { @@ -51,7 +51,7 @@ func TestExec_Apply(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - cfg.RootApparmord = tt.rootApparmord + prebuild.RootApparmord = tt.rootApparmord got, err := Directives["exec"].Apply(tt.opt, tt.profile) if (err != nil) != tt.wantErr { t.Errorf("Exec.Apply() error = %v, wantErr %v", err, tt.wantErr) diff --git a/pkg/prebuild/directive/filter.go b/pkg/prebuild/directive/filter.go index 1aa2e1c76..2fe46e6f2 100644 --- a/pkg/prebuild/directive/filter.go +++ b/pkg/prebuild/directive/filter.go @@ -5,31 +5,32 @@ package directive import ( + "fmt" "regexp" "slices" "strings" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) type FilterOnly struct { - cfg.Base + prebuild.Base } type FilterExclude struct { - cfg.Base + prebuild.Base } func init() { RegisterDirective(&FilterOnly{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "only", Msg: "Only directive applied", Help: []string{"filters..."}, }, }) RegisterDirective(&FilterExclude{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "exclude", Msg: "Exclude directive applied", Help: []string{"filters..."}, @@ -38,7 +39,11 @@ func init() { } func filterRuleForUs(opt *Option) bool { - return slices.Contains(opt.ArgList, cfg.Distribution) || slices.Contains(opt.ArgList, cfg.Family) + abiStr := fmt.Sprintf("abi%d", prebuild.ABI) + if slices.Contains(opt.ArgList, abiStr) { + return true + } + return slices.Contains(opt.ArgList, prebuild.Distribution) || slices.Contains(opt.ArgList, prebuild.Family) } func filter(only bool, opt *Option, profile string) (string, error) { diff --git a/pkg/prebuild/directive/filter_test.go b/pkg/prebuild/directive/filter_test.go index 465ba50a5..ebbd5ef5c 100644 --- a/pkg/prebuild/directive/filter_test.go +++ b/pkg/prebuild/directive/filter_test.go @@ -7,7 +7,7 @@ package directive import ( "testing" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) func TestFilterOnly_Apply(t *testing.T) { @@ -78,8 +78,8 @@ func TestFilterOnly_Apply(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - cfg.Distribution = tt.dist - cfg.Family = tt.family + prebuild.Distribution = tt.dist + prebuild.Family = tt.family got, err := Directives["only"].Apply(tt.opt, tt.profile) if (err != nil) != tt.wantErr { t.Errorf("FilterOnly.Apply() error = %v, wantErr %v", err, tt.wantErr) @@ -133,8 +133,8 @@ func TestFilterExclude_Apply(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - cfg.Distribution = tt.dist - cfg.Family = tt.family + prebuild.Distribution = tt.dist + prebuild.Family = tt.family got, err := Directives["exclude"].Apply(tt.opt, tt.profile) if (err != nil) != tt.wantErr { t.Errorf("FilterExclude.Apply() error = %v, wantErr %v", err, tt.wantErr) diff --git a/pkg/prebuild/directive/stack.go b/pkg/prebuild/directive/stack.go index c673a1701..707405362 100644 --- a/pkg/prebuild/directive/stack.go +++ b/pkg/prebuild/directive/stack.go @@ -10,7 +10,7 @@ import ( "slices" "strings" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) @@ -25,12 +25,12 @@ var ( ) type Stack struct { - cfg.Base + prebuild.Base } func init() { RegisterDirective(&Stack{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "stack", Msg: "Stack directive applied", Help: []string{"[X] profiles..."}, @@ -55,7 +55,7 @@ func (s Stack) Apply(opt *Option, profile string) (string, error) { res := "" for name := range opt.ArgMap { - stackedProfile := util.MustReadFile(cfg.RootApparmord.Join(name)) + stackedProfile := util.MustReadFile(prebuild.RootApparmord.Join(name)) m := regRules.FindStringSubmatch(stackedProfile) if len(m) < 2 { return "", fmt.Errorf("No profile found in %s", name) diff --git a/pkg/prebuild/directive/stack_test.go b/pkg/prebuild/directive/stack_test.go index ef603aae6..8f99d6f7a 100644 --- a/pkg/prebuild/directive/stack_test.go +++ b/pkg/prebuild/directive/stack_test.go @@ -8,7 +8,7 @@ import ( "testing" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) func TestStack_Apply(t *testing.T) { @@ -68,7 +68,7 @@ profile parent @{exec_path} { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - cfg.RootApparmord = tt.rootApparmord + prebuild.RootApparmord = tt.rootApparmord got, err := Directives["stack"].Apply(tt.opt, tt.profile) if (err != nil) != tt.wantErr { t.Errorf("Stack.Apply() error = %v, wantErr %v", err, tt.wantErr) diff --git a/pkg/prebuild/cfg/directories.go b/pkg/prebuild/directories.go similarity index 83% rename from pkg/prebuild/cfg/directories.go rename to pkg/prebuild/directories.go index 282aa1ad8..6fbde10be 100644 --- a/pkg/prebuild/cfg/directories.go +++ b/pkg/prebuild/directories.go @@ -2,11 +2,14 @@ // Copyright (C) 2021-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package cfg +package prebuild import "github.com/roddhjav/apparmor.d/pkg/paths" var ( + // AppArmor ABI version + ABI uint = 0 + // Root is the root directory for the build Root *paths.Path = paths.New(".build") @@ -28,11 +31,6 @@ var ( // DebianDir is the directory where the debian specific files are stored DebianDir *paths.Path = paths.New("debian") - // AppArmor 4.0 contains several profiles that allow userns and are otherwise - // unconfined. Overwriter disables upstream profile in favor of (better) apparmor.d - // counterpart - Overwrite Overwriter = false - // DebianHide is the path to the debian/apparmor.d.hide file DebianHide = DebianHider{path: DebianDir.Join("apparmor.d.hide")} diff --git a/pkg/prebuild/cfg/files.go b/pkg/prebuild/files.go similarity index 63% rename from pkg/prebuild/cfg/files.go rename to pkg/prebuild/files.go index 6f81d25bc..d275c916d 100644 --- a/pkg/prebuild/cfg/files.go +++ b/pkg/prebuild/files.go @@ -2,11 +2,9 @@ // Copyright (C) 2021-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package cfg +package prebuild import ( - "fmt" - "os" "strings" "github.com/roddhjav/apparmor.d/pkg/paths" @@ -54,37 +52,6 @@ func (i Ignorer) Read(name string) []string { return util.MustReadFileAsLines(path) } -type Overwriter bool - -// Overwrite upstream profile: disable upstream & rename ours -func (o Overwriter) Apply() error { - const ext = ".apparmor.d" - disableDir := RootApparmord.Join("disable") - if err := disableDir.Mkdir(); err != nil { - return err - } - - path := DistDir.Join("overwrite") - if !path.Exist() { - return fmt.Errorf("%s not found", path) - } - for _, name := range util.MustReadFileAsLines(path) { - origin := RootApparmord.Join(name) - dest := RootApparmord.Join(name + ext) - if err := origin.Rename(dest); err != nil { - return err - } - originRel, err := origin.RelFrom(dest) - if err != nil { - return err - } - if err := os.Symlink(originRel.String(), disableDir.Join(name).String()); err != nil { - return err - } - } - return nil -} - type DebianHider struct { path *paths.Path } diff --git a/pkg/prebuild/cfg/files_test.go b/pkg/prebuild/files_test.go similarity index 99% rename from pkg/prebuild/cfg/files_test.go rename to pkg/prebuild/files_test.go index b4ce13a1c..24d621fd6 100644 --- a/pkg/prebuild/cfg/files_test.go +++ b/pkg/prebuild/files_test.go @@ -2,7 +2,7 @@ // Copyright (C) 2021-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package cfg +package prebuild import ( "reflect" diff --git a/pkg/prebuild/cfg/os.go b/pkg/prebuild/os.go similarity index 99% rename from pkg/prebuild/cfg/os.go rename to pkg/prebuild/os.go index b742a3988..352f4e185 100644 --- a/pkg/prebuild/cfg/os.go +++ b/pkg/prebuild/os.go @@ -2,7 +2,7 @@ // Copyright (C) 2021-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package cfg +package prebuild import ( "os" diff --git a/pkg/prebuild/cfg/os_test.go b/pkg/prebuild/os_test.go similarity index 99% rename from pkg/prebuild/cfg/os_test.go rename to pkg/prebuild/os_test.go index 44aef1074..8f9bd338f 100644 --- a/pkg/prebuild/cfg/os_test.go +++ b/pkg/prebuild/os_test.go @@ -2,7 +2,7 @@ // Copyright (C) 2021-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package cfg +package prebuild import ( "reflect" diff --git a/pkg/prebuild/prebuild.go b/pkg/prebuild/prebuild.go deleted file mode 100644 index 30bf5c2e6..000000000 --- a/pkg/prebuild/prebuild.go +++ /dev/null @@ -1,117 +0,0 @@ -// apparmor.d - Full set of apparmor profiles -// Copyright (C) 2023-2024 Alexandre Pujol -// SPDX-License-Identifier: GPL-2.0-only - -package prebuild - -import ( - "strings" - - "github.com/roddhjav/apparmor.d/pkg/logging" - "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" - "github.com/roddhjav/apparmor.d/pkg/prebuild/directive" - "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" - "github.com/roddhjav/apparmor.d/pkg/util" -) - -func init() { - // Define the tasks applied by default - prepare.Register( - "synchronise", - "ignore", - "merge", - "configure", - "setflags", - "systemd-default", - ) - - // Build tasks applied by default - builder.Register("userspace") - builder.Register("dev") - - switch cfg.Distribution { - case "opensuse": - builder.Register("abi3") - cfg.Overwrite = true - - case "ubuntu": - if cfg.Release["VERSION_CODENAME"] == "noble" { - builder.Register("abi3") - cfg.Overwrite = true - } - - case "whonix": - cfg.Hide += `/etc/apparmor.d/abstractions/base.d/kicksecure -/etc/apparmor.d/home.tor-browser.firefox -/etc/apparmor.d/tunables/homsanitycheck -/etc/apparmor.d/usr.bin.url_e.d/anondist -/etc/apparmor.d/tunables/home.d/live-mode -/etc/apparmor.d/tunables/home.d/qubes-whonix-anondist -/etc/apparmor.d/usr.bin.hexchat -/etc/apparmor.d/usr.bin.sdwdate -/etc/apparmor.d/usr.bin.systemcheck -/etc/apparmor.d/usr.bin.timeto_unixtime -/etc/apparmor.d/whonix-firewall -` - } -} - -func Prepare() error { - for _, task := range prepare.Prepares { - msg, err := task.Apply() - if err != nil { - return err - } - logging.Success("%s", task.Message()) - logging.Indent = " " - for _, line := range msg { - if strings.Contains(line, "not found") { - logging.Warning("%s", line) - } else { - logging.Bullet("%s", line) - } - } - logging.Indent = "" - } - return nil -} - -func Build() error { - files, _ := cfg.RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories()) - for _, file := range files { - if !file.Exist() { - continue - } - profile, err := util.ReadFile(file) - if err != nil { - return err - } - profile, err = builder.Run(file, profile) - if err != nil { - return err - } - profile, err = directive.Run(file, profile) - if err != nil { - return err - } - if err := file.WriteFile([]byte(profile)); err != nil { - return err - } - } - - logging.Success("Build tasks:") - logging.Indent = " " - for _, task := range builder.Builds { - logging.Bullet("%s", task.Message()) - } - logging.Indent = "" - logging.Success("Directives processed:") - logging.Indent = " " - for _, dir := range directive.Directives { - logging.Bullet("%s%s", directive.Keyword, dir.Name()) - } - logging.Indent = "" - return nil -} diff --git a/pkg/prebuild/prepare/configure.go b/pkg/prebuild/prepare/configure.go index df4daaeb1..6be35d3dd 100644 --- a/pkg/prebuild/prepare/configure.go +++ b/pkg/prebuild/prepare/configure.go @@ -6,62 +6,95 @@ package prepare import ( "fmt" + "os" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) type Configure struct { - cfg.Base + prebuild.Base + OneFile bool } func init() { RegisterTask(&Configure{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "configure", Msg: "Set distribution specificities", }, + OneFile: false, }) } func (p Configure) Apply() ([]string, error) { res := []string{} - switch cfg.Distribution { - case "arch", "opensuse": - if cfg.Overwrite { - if err := cfg.Overwrite.Apply(); err != nil { - return res, err - } + + if prebuild.ABI == 4 { + if err := OverwriteUpstreamProfile(p.OneFile); err != nil { + return res, err } + } + switch prebuild.Distribution { + case "arch", "opensuse": case "ubuntu": - if err := cfg.DebianHide.Init(); err != nil { + if err := prebuild.DebianHide.Init(); err != nil { return res, err } - if cfg.Overwrite { - if err := cfg.Overwrite.Apply(); err != nil { - return res, err - } - } else { - if err := util.CopyTo(cfg.DistDir.Join("ubuntu"), cfg.RootApparmord); err != nil { + if prebuild.ABI == 3 { + if err := util.CopyTo(prebuild.DistDir.Join("ubuntu"), prebuild.RootApparmord); err != nil { return res, err } } case "debian", "whonix": - if err := cfg.DebianHide.Init(); err != nil { + if err := prebuild.DebianHide.Init(); err != nil { return res, err } // Copy Debian specific abstractions - if err := util.CopyTo(cfg.DistDir.Join("ubuntu"), cfg.RootApparmord); err != nil { + if err := util.CopyTo(prebuild.DistDir.Join("ubuntu"), prebuild.RootApparmord); err != nil { return res, err } default: - return []string{}, fmt.Errorf("%s is not a supported distribution", cfg.Distribution) + return []string{}, fmt.Errorf("%s is not a supported distribution", prebuild.Distribution) } return res, nil } + +// Overwrite upstream profile: disable upstream & rename ours +func OverwriteUpstreamProfile(oneFile bool) error { + const ext = ".apparmor.d" + disableDir := prebuild.RootApparmord.Join("disable") + if err := disableDir.Mkdir(); err != nil { + return err + } + + path := prebuild.DistDir.Join("overwrite") + if !path.Exist() { + return fmt.Errorf("%s not found", path) + } + for _, name := range util.MustReadFileAsLines(path) { + origin := prebuild.RootApparmord.Join(name) + dest := prebuild.RootApparmord.Join(name + ext) + if !dest.Exist() && oneFile { + continue + } + if err := origin.Rename(dest); err != nil { + + return err + } + originRel, err := origin.RelFrom(dest) + if err != nil { + return err + } + if err := os.Symlink(originRel.String(), disableDir.Join(name).String()); err != nil { + return err + } + } + return nil +} diff --git a/pkg/prebuild/prepare/core.go b/pkg/prebuild/prepare/core.go index 3daf19d8b..d96e21043 100644 --- a/pkg/prebuild/prepare/core.go +++ b/pkg/prebuild/prepare/core.go @@ -7,7 +7,7 @@ package prepare import ( "fmt" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) var ( @@ -20,7 +20,7 @@ var ( // Main directive interface type Task interface { - cfg.BaseInterface + prebuild.BaseInterface Apply() ([]string, error) } diff --git a/pkg/prebuild/prepare/core_test.go b/pkg/prebuild/prepare/core_test.go index 34071ff30..3c35e3e8f 100644 --- a/pkg/prebuild/prepare/core_test.go +++ b/pkg/prebuild/prepare/core_test.go @@ -11,7 +11,7 @@ import ( "testing" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) func chdirGitRoot() { @@ -39,7 +39,7 @@ func TestTask_Apply(t *testing.T) { name: "synchronise", task: Tasks["synchronise"], wantErr: false, - wantFiles: paths.PathList{cfg.RootApparmord.Join("/groups/_full/systemd")}, + wantFiles: paths.PathList{prebuild.RootApparmord.Join("/groups/_full/systemd")}, }, { name: "ignore", @@ -51,7 +51,7 @@ func TestTask_Apply(t *testing.T) { name: "merge", task: Tasks["merge"], wantErr: false, - wantFiles: paths.PathList{cfg.RootApparmord.Join("aa-log")}, + wantFiles: paths.PathList{prebuild.RootApparmord.Join("aa-log")}, }, { name: "configure", @@ -68,23 +68,23 @@ func TestTask_Apply(t *testing.T) { name: "systemd-default", task: Tasks["systemd-default"], wantErr: false, - wantFiles: paths.PathList{cfg.Root.Join("systemd/system/dbus.service")}, + wantFiles: paths.PathList{prebuild.Root.Join("systemd/system/dbus.service")}, }, { name: "systemd-early", task: Tasks["systemd-early"], wantErr: false, - wantFiles: paths.PathList{cfg.Root.Join("systemd/system/pcscd.service")}, + wantFiles: paths.PathList{prebuild.Root.Join("systemd/system/pcscd.service")}, }, { name: "fsp", task: Tasks["fsp"], wantErr: false, - wantFiles: paths.PathList{cfg.RootApparmord.Join("systemd")}, + wantFiles: paths.PathList{prebuild.RootApparmord.Join("systemd")}, }, } chdirGitRoot() - _ = cfg.Root.RemoveAll() + _ = prebuild.Root.RemoveAll() for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { got, err := tt.task.Apply() diff --git a/pkg/prebuild/prepare/flags.go b/pkg/prebuild/prepare/flags.go index 4ef41ef56..23998d4d0 100644 --- a/pkg/prebuild/prepare/flags.go +++ b/pkg/prebuild/prepare/flags.go @@ -9,7 +9,7 @@ import ( "regexp" "strings" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) @@ -19,12 +19,12 @@ var ( ) type SetFlags struct { - cfg.Base + prebuild.Base } func init() { RegisterTask(&SetFlags{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "setflags", Msg: "Set flags on some profiles", }, @@ -33,9 +33,9 @@ func init() { func (p SetFlags) Apply() ([]string, error) { res := []string{} - for _, name := range []string{"main", cfg.Distribution} { - for profile, flags := range cfg.Flags.Read(name) { - file := cfg.RootApparmord.Join(profile) + for _, name := range []string{"main", prebuild.Distribution} { + for profile, flags := range prebuild.Flags.Read(name) { + file := prebuild.RootApparmord.Join(profile) if !file.Exist() { res = append(res, fmt.Sprintf("Profile %s not found, ignoring", profile)) continue @@ -57,7 +57,7 @@ func (p SetFlags) Apply() ([]string, error) { } } } - res = append(res, cfg.FlagDir.Join(name+".flags").String()) + res = append(res, prebuild.FlagDir.Join(name+".flags").String()) } return res, nil } diff --git a/pkg/prebuild/prepare/fsp.go b/pkg/prebuild/prepare/fsp.go index ac3e05045..af57ed9d7 100644 --- a/pkg/prebuild/prepare/fsp.go +++ b/pkg/prebuild/prepare/fsp.go @@ -8,17 +8,17 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) type FullSystemPolicy struct { - cfg.Base + prebuild.Base } func init() { RegisterTask(&FullSystemPolicy{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "fsp", Msg: "Configure AppArmor for full system policy", }, @@ -29,12 +29,12 @@ func (p FullSystemPolicy) Apply() ([]string, error) { res := []string{} // Install full system policy profiles - if err := util.CopyTo(paths.New("apparmor.d/groups/_full/"), cfg.Root.Join("apparmor.d")); err != nil { + if err := util.CopyTo(paths.New("apparmor.d/groups/_full/"), prebuild.Root.Join("apparmor.d")); err != nil { return res, err } // Set systemd profile name - path := cfg.RootApparmord.Join("tunables/multiarch.d/system") + path := prebuild.RootApparmord.Join("tunables/multiarch.d/system") out, err := util.ReadFile(path) if err != nil { return res, err @@ -46,7 +46,7 @@ func (p FullSystemPolicy) Apply() ([]string, error) { } // Fix conflicting x modifiers in abstractions - FIXME: Temporary solution - path = cfg.RootApparmord.Join("abstractions/gstreamer") + path = prebuild.RootApparmord.Join("abstractions/gstreamer") out, err = util.ReadFile(path) if err != nil { return res, err @@ -58,5 +58,5 @@ func (p FullSystemPolicy) Apply() ([]string, error) { } // Set systemd unit drop-in files - return res, util.CopyTo(cfg.SystemdDir.Join("full"), cfg.Root.Join("systemd")) + return res, util.CopyTo(prebuild.SystemdDir.Join("full"), prebuild.Root.Join("systemd")) } diff --git a/pkg/prebuild/prepare/ignore.go b/pkg/prebuild/prepare/ignore.go index 92a1498a7..2aece5174 100644 --- a/pkg/prebuild/prepare/ignore.go +++ b/pkg/prebuild/prepare/ignore.go @@ -6,16 +6,16 @@ package prepare import ( "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) type Ignore struct { - cfg.Base + prebuild.Base } func init() { RegisterTask(&Ignore{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "ignore", Msg: "Ignore profiles and files from:", }, @@ -24,11 +24,11 @@ func init() { func (p Ignore) Apply() ([]string, error) { res := []string{} - for _, name := range []string{"main", cfg.Distribution} { - for _, ignore := range cfg.Ignore.Read(name) { - profile := cfg.Root.Join(ignore) + for _, name := range []string{"main", prebuild.Distribution} { + for _, ignore := range prebuild.Ignore.Read(name) { + profile := prebuild.Root.Join(ignore) if profile.NotExist() { - files, err := cfg.RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterNames(ignore)) + files, err := prebuild.RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterNames(ignore)) if err != nil { return res, err } @@ -43,7 +43,7 @@ func (p Ignore) Apply() ([]string, error) { } } } - res = append(res, cfg.IgnoreDir.Join(name+".ignore").String()) + res = append(res, prebuild.IgnoreDir.Join(name+".ignore").String()) } return res, nil } diff --git a/pkg/prebuild/prepare/merge.go b/pkg/prebuild/prepare/merge.go index 86a2ceade..75945b812 100644 --- a/pkg/prebuild/prepare/merge.go +++ b/pkg/prebuild/prepare/merge.go @@ -9,16 +9,16 @@ import ( "path/filepath" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" ) type Merge struct { - cfg.Base + prebuild.Base } func init() { RegisterTask(&Merge{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "merge", Msg: "Merge all profiles into a unified apparmor.d directory", }, @@ -35,18 +35,18 @@ func (p Merge) Apply() ([]string, error) { idx := 0 for idx < len(dirToMerge)-1 { dirMoved, dirRemoved := dirToMerge[idx], dirToMerge[idx+1] - files, err := filepath.Glob(cfg.RootApparmord.Join(dirMoved).String()) + files, err := filepath.Glob(prebuild.RootApparmord.Join(dirMoved).String()) if err != nil { return res, err } for _, file := range files { - err := os.Rename(file, cfg.RootApparmord.Join(filepath.Base(file)).String()) + err := os.Rename(file, prebuild.RootApparmord.Join(filepath.Base(file)).String()) if err != nil { return res, err } } - files, err = filepath.Glob(cfg.RootApparmord.Join(dirRemoved).String()) + files, err = filepath.Glob(prebuild.RootApparmord.Join(dirRemoved).String()) if err != nil { return []string{}, err } diff --git a/pkg/prebuild/prepare/synchronise.go b/pkg/prebuild/prepare/synchronise.go index e2b5dacd6..741c015c4 100644 --- a/pkg/prebuild/prepare/synchronise.go +++ b/pkg/prebuild/prepare/synchronise.go @@ -6,35 +6,53 @@ package prepare import ( "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) type Synchronise struct { - cfg.Base + prebuild.Base + Path string } func init() { RegisterTask(&Synchronise{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "synchronise", Msg: "Initialize a new clean apparmor.d build directory", }, + Path: "", }) } func (p Synchronise) Apply() ([]string, error) { res := []string{} - dirs := paths.PathList{cfg.RootApparmord, cfg.Root.Join("root"), cfg.Root.Join("systemd")} + dirs := paths.PathList{prebuild.RootApparmord, prebuild.Root.Join("root"), prebuild.Root.Join("systemd")} for _, dir := range dirs { if err := dir.RemoveAll(); err != nil { return res, err } } - for _, name := range []string{"apparmor.d", "root"} { - if err := util.CopyTo(paths.New(name), cfg.Root.Join(name)); err != nil { + if p.Path == "" { + for _, name := range []string{"apparmor.d", "root"} { + if err := util.CopyTo(paths.New(name), prebuild.Root.Join(name)); err != nil { + return res, err + } + } + } else { + file := paths.New(p.Path) + destination, err := file.RelFrom(paths.New("apparmor.d")) + if err != nil { return res, err } + destination = prebuild.RootApparmord.JoinPath(destination) + if err := destination.Parent().MkdirAll(); err != nil { + return res, err + } + if err := file.CopyTo(destination); err != nil { + return res, err + } + res = append(res, destination.String()) } return res, nil } diff --git a/pkg/prebuild/prepare/systemd.go b/pkg/prebuild/prepare/systemd.go index 5681783ce..cee952854 100644 --- a/pkg/prebuild/prepare/systemd.go +++ b/pkg/prebuild/prepare/systemd.go @@ -5,27 +5,27 @@ package prepare import ( - "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" ) type SystemdDefault struct { - cfg.Base + prebuild.Base } type SystemdEarly struct { - cfg.Base + prebuild.Base } func init() { RegisterTask(&SystemdDefault{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "systemd-default", Msg: "Configure systemd unit drop in files to a profile for some units", }, }) RegisterTask(&SystemdEarly{ - Base: cfg.Base{ + Base: prebuild.Base{ Keyword: "systemd-early", Msg: "Configure systemd unit drop in files to ensure some service start after apparmor", }, @@ -33,9 +33,9 @@ func init() { } func (p SystemdDefault) Apply() ([]string, error) { - return []string{}, util.CopyTo(cfg.SystemdDir.Join("default"), cfg.Root.Join("systemd")) + return []string{}, util.CopyTo(prebuild.SystemdDir.Join("default"), prebuild.Root.Join("systemd")) } func (p SystemdEarly) Apply() ([]string, error) { - return []string{}, util.CopyTo(cfg.SystemdDir.Join("early"), cfg.Root.Join("systemd")) + return []string{}, util.CopyTo(prebuild.SystemdDir.Join("early"), prebuild.Root.Join("systemd")) } diff --git a/tests/cmd/main.go b/tests/cmd/main.go index 057994f86..b549aab34 100644 --- a/tests/cmd/main.go +++ b/tests/cmd/main.go @@ -14,7 +14,7 @@ import ( "github.com/roddhjav/apparmor.d/pkg/aa" "github.com/roddhjav/apparmor.d/pkg/logging" "github.com/roddhjav/apparmor.d/pkg/paths" - bcfg "github.com/roddhjav/apparmor.d/pkg/prebuild/cfg" + "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/tests/integration" ) @@ -28,8 +28,8 @@ Options: -r, --run Run a predefined list of tests. -l, --list List the configured tests. -f, --file FILE Set a tests file. Default: tests/tests.yml - -d, --deps Install tests dependencies. - -D, --dryrun Do not do the action, list it. + -d, --deps Install tests dependencies. + -D, --dryrun Do not do the action, list it. ` @@ -123,7 +123,7 @@ func testDeps(dryRun bool) error { } deps := tSuite.GetDependencies() - switch bcfg.Distribution { + switch prebuild.Distribution { case "arch": arg := []string{"pacman", "-Sy", "--noconfirm"} arg = append(arg, deps...) From 344ccf30031baef3320f28e8c12fd97da15393c2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 16:44:15 +0100 Subject: [PATCH 0285/1455] build: set default ABI to abi4. --- cmd/prebuild/main.go | 4 ++++ pkg/prebuild/cli/cli.go | 2 +- pkg/prebuild/directive/core.go | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 6b2b2422f..629b37ed3 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -13,7 +13,11 @@ import ( "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" ) +// Cli arguments have priority over the settings entered here func init() { + // Define the default ABI + prebuild.ABI = 4 + // Define the tasks applied by default prepare.Register( "synchronise", diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 6fd0a36f5..b82d918a7 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -72,7 +72,6 @@ func Prebuild() { flag.Usage() return } - logging.Step("Building apparmor.d profiles for %s.", prebuild.Distribution) if full { prepare.Register("fsp") @@ -111,6 +110,7 @@ func Prebuild() { configure.OneFile = true } + logging.Step("Building apparmor.d profiles for %s on ABI%d.", prebuild.Distribution, prebuild.ABI) if err := Prepare(); err != nil { logging.Fatal("%s", err.Error()) } diff --git a/pkg/prebuild/directive/core.go b/pkg/prebuild/directive/core.go index 2568cb098..aadf9294e 100644 --- a/pkg/prebuild/directive/core.go +++ b/pkg/prebuild/directive/core.go @@ -30,7 +30,7 @@ type Directive interface { } func Usage() string { - res := fmt.Sprintf("Directive:\n") + res := "Directive:\n" for _, d := range Directives { for _, h := range d.Usage() { res += fmt.Sprintf(" %s%s %s\n", Keyword, d.Name(), h) From 8ddaa136ba10de63f38aa2b606f738319ef53813 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 16:50:54 +0100 Subject: [PATCH 0286/1455] fix(test): update unit test result to abi 4. --- pkg/aa/apparmor_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/aa/apparmor_test.go b/pkg/aa/apparmor_test.go index d7a22b5bb..19cfd5a42 100644 --- a/pkg/aa/apparmor_test.go +++ b/pkg/aa/apparmor_test.go @@ -208,7 +208,7 @@ func TestAppArmorProfileFile_Integration(t *testing.T) { &Comment{Base: Base{Comment: " Copyright (C) 2021-2024 Alexandre Pujol ", IsLineRule: true}}, &Comment{Base: Base{Comment: " SPDX-License-Identifier: GPL-2.0-only", IsLineRule: true}}, nil, - &Abi{IsMagic: true, Path: "abi/3.0"}, + &Abi{IsMagic: true, Path: "abi/4.0"}, &Include{IsMagic: true, Path: "tunables/global"}, &Variable{ Name: "exec_path", Define: true, From c5505dee8bf0b25e0b36cea48e39a79f1797d081 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 19:24:12 +0100 Subject: [PATCH 0287/1455] fix(build): abi 4 to abi 3 conversion. --- pkg/prebuild/builder/abi.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/prebuild/builder/abi.go b/pkg/prebuild/builder/abi.go index 4e74a5411..818edbb76 100644 --- a/pkg/prebuild/builder/abi.go +++ b/pkg/prebuild/builder/abi.go @@ -12,8 +12,8 @@ import ( var ( regAbi4To3 = util.ToRegexRepl([]string{ `abi/4.0`, `abi/3.0`, - `userns,`, `# userns,`, - `mqueue`, `# mqueue`, + ` userns,`, ` # userns,`, + ` mqueue`, ` # mqueue`, }) ) From 7ba556b15ce69a1f6e0e4e166760e91cea0d5a4d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 19:49:21 +0100 Subject: [PATCH 0288/1455] build: add make dev name=. --- Makefile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 88febbb5e..8057a171e 100644 --- a/Makefile +++ b/Makefile @@ -9,7 +9,7 @@ PKGDEST := /tmp/pkg PKGNAME := apparmor.d P = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*))) -.PHONY: all build enforce full install local $(P) pkg dpkg rpm tests lint man docs serve clean +.PHONY: all build enforce full install local $(P) dev package pkg dpkg rpm tests lint man docs serve clean all: build @./${BUILD}/prebuild --complain @@ -71,6 +71,12 @@ $(P): done; @systemctl restart apparmor || systemctl status apparmor +name ?= +dev: + @go run ./cmd/prebuild --complain --file $(shell find apparmor.d -iname ${name}) + @sudo install -Dm644 ${BUILD}/${name} /etc/apparmor.d/${name} + @sudo systemctl restart apparmor || systemctl status apparmor + dist ?= archlinux package: @bash dists/docker.sh ${dist} From 3f98e86e24fa8a5f6ad6b64010c53bd2716b1cfa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 20:48:36 +0100 Subject: [PATCH 0289/1455] fix(aa-log): too much cleaning in pci path. see #505 --- pkg/logs/logs.go | 2 +- pkg/logs/logs_test.go | 20 ++++++++++++++++++++ tests/testdata/logs/audit.log | 1 + 3 files changed, 22 insertions(+), 1 deletion(-) diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index 67197e53c..49d680108 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -82,7 +82,7 @@ var ( `/sys/`, `@{sys}/`, `@{PROC}@{sys}/`, `@{PROC}/sys/`, `pci` + strings.Repeat(h, 4) + `:` + strings.Repeat(h, 2), `@{pci_bus}`, - `@{pci_bus}/[0-9a-f:*./]*`, `@{pci}/`, + `@{pci_bus}/[0-9a-f:*./]*/`, `@{pci}/`, `1000`, `@{uid}`, // Some system glob diff --git a/pkg/logs/logs_test.go b/pkg/logs/logs_test.go index c70909dcb..0b14ba990 100644 --- a/pkg/logs/logs_test.go +++ b/pkg/logs/logs_test.go @@ -247,6 +247,26 @@ func TestNew(t *testing.T) { path: filepath.Join(testdata, "audit.log"), want: refPowerProfiles, }, + { + name: "signal-desktop", + path: filepath.Join(testdata, "audit.log"), + want: AppArmorLogs{ + { + "apparmor": "ALLOWED", + "profile": "signal-desktop", + "operation": "open", + "class": "file", + "name": "@{sys}/devices/@{pci}/boot_vga", + "comm": "signal-desktop", + "requested_mask": "r", + "denied_mask": "r", + "fsuid": "1000", + "ouid": "0", + "FSUID": "user", + "OUID": "root", + }, + }, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/tests/testdata/logs/audit.log b/tests/testdata/logs/audit.log index 0680d2a7a..ed897ea6c 100644 --- a/tests/testdata/logs/audit.log +++ b/tests/testdata/logs/audit.log @@ -53,4 +53,5 @@ profile="sddm-greeter" operation="setsockopt" class="net" comm="sddm-greeter" f type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" profile="xorg" pid=16195 comm="Xorg.bin" capability=17 capname="sys_rawio" type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="getattr" class="file" profile="pacman//null-/usr/share/code-features/patch.py" name="/etc/ld.so.preload" pid=18817 comm="patch.py" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root" type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" info="optional: no audit" error=-1 profile="pacman" comm="killall" capability=19 capname="sys_ptrace" +apparmor="ALLOWED" operation="open" class="file" profile="signal-desktop" name="/sys/devices/pci0000:00/0000:00:02.0/boot_vga" comm="signal-desktop" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="user" OUID="root" From 14a5d8deaef0aa068127cc0ddd8f04e0b85966f5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 21:06:45 +0100 Subject: [PATCH 0290/1455] fix(aa-log): ensure we also split quote in log value fix #229 --- pkg/logs/logs.go | 7 ++++++- pkg/logs/logs_test.go | 21 +++++++++++++++++++++ tests/testdata/logs/audit.log | 1 + 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index 49d680108..01c4fcbb4 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -138,7 +138,12 @@ func New(file io.Reader, profile string) AppArmorLogs { aa := make(AppArmorLog) for _, item := range tmp { - kv := strings.Split(item, "=") + kv := strings.FieldsFunc(item, func(r rune) bool { + if r == '"' { + quoted = !quoted + } + return !quoted && r == '=' + }) if len(kv) >= 2 { key, value := kv[0], kv[1] if slices.Contains(toClean, key) { diff --git a/pkg/logs/logs_test.go b/pkg/logs/logs_test.go index 0b14ba990..6ddd5ac9e 100644 --- a/pkg/logs/logs_test.go +++ b/pkg/logs/logs_test.go @@ -267,6 +267,27 @@ func TestNew(t *testing.T) { }, }, }, + { + name: "startplasma", + path: filepath.Join(testdata, "audit.log"), + want: AppArmorLogs{ + { + "apparmor": "ALLOWED", + "operation": "link", + "class": "file", + "profile": "startplasma", + "name": "@{user_cache_dirs}/ksycoca5_de_LQ6f0J2qZg4vOKgw2NbXuW7iuVU=.isNSBz", + "target": "@{user_cache_dirs}/#@{int}", + "comm": "startplasma-way", + "denied_mask": "k", + "requested_mask": "k", + "fsuid": "1000", + "ouid": "1000", + "FSUID": "user", + "OUID": "user", + }, + }, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/tests/testdata/logs/audit.log b/tests/testdata/logs/audit.log index ed897ea6c..11b8770d2 100644 --- a/tests/testdata/logs/audit.log +++ b/tests/testdata/logs/audit.log @@ -54,4 +54,5 @@ type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="getattr" class="file" profile="pacman//null-/usr/share/code-features/patch.py" name="/etc/ld.so.preload" pid=18817 comm="patch.py" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root" type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" info="optional: no audit" error=-1 profile="pacman" comm="killall" capability=19 capname="sys_ptrace" apparmor="ALLOWED" operation="open" class="file" profile="signal-desktop" name="/sys/devices/pci0000:00/0000:00:02.0/boot_vga" comm="signal-desktop" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="user" OUID="root" +apparmor="ALLOWED" operation="link" class="file" profile="startplasma" name="@{user_cache_dirs}/ksycoca5_de_LQ6f0J2qZg4vOKgw2NbXuW7iuVU=.isNSBz" comm="startplasma-way" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000 target="@{user_cache_dirs}/#@{int}" FSUID="user" OUID="user" From 35b305f04376cd17eeb8e71873e3dcaf0c4d4aa0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Oct 2024 21:25:01 +0100 Subject: [PATCH 0291/1455] fix(build): fix path in make dev. --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 8057a171e..e8929aec8 100644 --- a/Makefile +++ b/Makefile @@ -74,7 +74,7 @@ $(P): name ?= dev: @go run ./cmd/prebuild --complain --file $(shell find apparmor.d -iname ${name}) - @sudo install -Dm644 ${BUILD}/${name} /etc/apparmor.d/${name} + @sudo install -Dm644 ${BUILD}/apparmor.d/${name} /etc/apparmor.d/${name} @sudo systemctl restart apparmor || systemctl status apparmor dist ?= archlinux From 896254c2ec69f61d564303f3995e769ffb1c029d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 3 Oct 2024 11:47:58 +0100 Subject: [PATCH 0292/1455] feat(profile): rewrite all xdg script profiles. --- .../groups/freedesktop/xdg-desktop-icon | 32 +++++- .../groups/freedesktop/xdg-desktop-menu | 58 +++++----- .../groups/freedesktop/xdg-document-portal | 2 +- apparmor.d/groups/freedesktop/xdg-email | 47 +++++--- .../groups/freedesktop/xdg-icon-resource | 53 ++++++---- apparmor.d/groups/freedesktop/xdg-mime | 100 +++++++----------- apparmor.d/groups/freedesktop/xdg-open | 58 ++++------ apparmor.d/groups/freedesktop/xdg-screensaver | 55 ++++++---- apparmor.d/groups/freedesktop/xdg-settings | 73 ++++++------- 9 files changed, 255 insertions(+), 223 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-icon b/apparmor.d/groups/freedesktop/xdg-desktop-icon index 0b0953f6e..0d8512b5c 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-icon +++ b/apparmor.d/groups/freedesktop/xdg-desktop-icon @@ -9,8 +9,38 @@ include @{exec_path} = @{bin}/xdg-desktop-icon profile xdg-desktop-icon @{exec_path} { include + include - @{exec_path} mr, + @{exec_path} r, + + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/chmod ix, + @{bin}/cp ix, + @{bin}/cut ix, + @{bin}/mkdir ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/tr ix, + @{bin}/umask ix, + @{bin}/uname ix, + + # To get DE information + @{bin}/kde{,4}-config ix, + + @{bin}/dbus-send Cx -> bus, + @{bin}/xprop Px, + + profile bus flags=(complain) { + include + include + include + include if exists + } include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-menu b/apparmor.d/groups/freedesktop/xdg-desktop-menu index 147d4c090..f86fbedc8 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-menu +++ b/apparmor.d/groups/freedesktop/xdg-desktop-menu @@ -10,37 +10,47 @@ include @{exec_path} = @{bin}/xdg-desktop-menu profile xdg-desktop-menu @{exec_path} flags=(complain) { include - include include + include + include @{exec_path} r, - @{sh_path} rix, - @{bin}/mkdir rix, - @{bin}/sed rix, - @{bin}/cut rix, - @{bin}/basename rix, - @{bin}/rm rix, - @{bin}/cp rix, - @{bin}/cat rix, - @{bin}/touch rix, - @{bin}/{m,g,}awk rix, - @{bin}/whoami rix, - @{bin}/mv rix, - @{bin}/{,e}grep rix, - @{bin}/readlink rix, + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/chmod ix, + @{bin}/cp ix, + @{bin}/cut ix, + @{bin}/dirname ix, + @{bin}/ln ix, + @{bin}/mkdir ix, + @{bin}/mktemp ix, + @{bin}/mv ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/touch ix, + @{bin}/tr ix, + @{bin}/umask ix, + @{bin}/uname ix, - @{bin}/update-desktop-database rPx, + # To get DE information + @{bin}/kde{,4}-config ix, - owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu rw, - owner @{user_share_dirs}/applications/chrome-*.desktop rw, - owner @{HOME}/.gnome/apps/chrome-*.desktop rw, + @{bin}/dbus-send Cx -> bus, + @{bin}/update-desktop-database Px, + @{bin}/xprop Px, - /usr/share/applications/*.desktop rw, - /usr/share/*/*.desktop r, - - /usr/share/applications/defaults.list r, - /usr/share/applications/defaults.list.new w, + profile bus flags=(complain) { + include + include + include + include if exists + } include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index 611e1ab9c..f93a4f2b0 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -59,7 +59,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { /dev/fuse rw, owner /dev/tty@{int} rw, - profile fusermount { + profile fusermount flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/freedesktop/xdg-email b/apparmor.d/groups/freedesktop/xdg-email index d7228b653..cf580ceac 100644 --- a/apparmor.d/groups/freedesktop/xdg-email +++ b/apparmor.d/groups/freedesktop/xdg-email @@ -15,22 +15,39 @@ profile xdg-email @{exec_path} flags=(complain) { @{exec_path} r, - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/{m,g,}awk rix, - @{bin}/basename rix, - @{bin}/cut rix, - @{bin}/echo rix, - @{bin}/gio rPx, - @{bin}/kreadconfig5 rPx, - @{bin}/readlink rix, - @{bin}/sed rix, - @{bin}/tail rix, - @{bin}/which{,.debianutils} rix, - @{bin}/xdg-mime rPx, - @{thunderbird_path} rPx, + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/cut ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/sed ix, + @{bin}/tail ix, + @{bin}/tr ix, + @{bin}/uname ix, - owner /dev/tty@{int} rw, + # To get DE information + @{bin}/kde{,4}-config ix, + @{bin}/gconftool{,-2} ix, + @{bin}/qtxdg-mat ix, + + @{bin}/dbus-send Cx -> bus, + @{bin}/gdbus Cx -> bus, + @{bin}/kreadconfig{,5} Px, + @{bin}/xdg-mime Px, + @{bin}/xprop Px, + @{open_path} Px -> child-open-email, + @{thunderbird_path} Px, + + profile bus flags=(complain) { + include + include + include + + include if exists + } include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-icon-resource b/apparmor.d/groups/freedesktop/xdg-icon-resource index bda6621d3..4f29d38a0 100644 --- a/apparmor.d/groups/freedesktop/xdg-icon-resource +++ b/apparmor.d/groups/freedesktop/xdg-icon-resource @@ -11,36 +11,43 @@ include profile xdg-icon-resource @{exec_path} flags=(attach_disconnected) { include include - include include @{exec_path} r, - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/whoami rix, - @{bin}/sed rix, - @{bin}/basename rix, - @{bin}/mkdir rix, - @{bin}/cp rix, - @{bin}/rm rix, - @{bin}/readlink rix, - @{bin}/touch rix, + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/cp ix, + @{bin}/cut ix, + @{bin}/dirname ix, + @{bin}/ln ix, + @{bin}/mkdir ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/touch ix, + @{bin}/tr ix, + @{bin}/umask ix, + @{bin}/uname ix, + @{bin}/whoami ix, - @{bin}/gtk{,4}-update-icon-cache rPx, + # To get DE information + @{bin}/kde{,4}-config ix, - /usr/share/**/icons/**.png r, - /usr/share/icons/**.png rw, - /usr/share/icons/*/.xdg-icon-resource-dummy rw, - /usr/share/terminfo/** r, + @{bin}/dbus-send Cx -> bus, + @{bin}/gtk{,4}-update-icon-cache Px, + @{bin}/xprop Px, - owner @{tmp}/.com.google.Chrome.*/chrome-*.png r, - - owner @{user_share_dirs}/icons/**/apps/chrome-*.png rw, - owner @{user_share_dirs}/icons/**/.xdg-icon-resource-dummy rw, - /opt/**/*.png r, - - deny @{user_share_dirs}/gvfs-metadata/* r, + profile bus flags=(complain) { + include + include + include + include if exists + } include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index c31ff0064..e2486f9fd 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -3,8 +3,6 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# TODO: This profile needs to be rewritten and integrated with the xdg-open profiles. - abi , include @@ -16,73 +14,51 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{exec_path} r, - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/{m,g,}awk rix, - @{bin}/basename rix, - @{bin}/cat rix, - @{bin}/cut rix, - @{bin}/file rix, - @{bin}/head rix, - @{bin}/mv rix, - @{bin}/readlink rix, - @{bin}/realpath rix, - @{bin}/sed rix, - @{bin}/tr rix, - @{bin}/uname rix, - @{bin}/which{,.debianutils} rix, + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/cut ix, + @{bin}/file ix, + @{bin}/head ix, + @{bin}/mkdir ix, + @{bin}/mv ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/touch ix, + @{bin}/tr ix, + @{bin}/umask ix, + @{bin}/uname ix, - @{bin}/gio rPx, - @{bin}/kbuildsycoca5 rPx, - @{bin}/ktraderclient5 rPUx, - @{bin}/vendor_perl/mimetype rPx, - @{bin}/mimetype rPx, - @{bin}/xprop rPx, + # To query DE information + @{bin}/gio ix, + @{bin}/gnomevfs-info ix, + @{bin}/gvfs-info ix, + @{bin}/kde{,4}-config ix, + @{bin}/kfile ix, + @{bin}/kmimetypefinder{,5} ix, + @{bin}/ktraderclient{,5} ix, + @{bin}/qtpaths ix, + @{bin}/qtxdg-mat ix, - /usr/share/file/misc/** r, - /usr/share/terminfo/** r, + @{bin}/dbus-send Cx -> bus, + @{bin}/kbuildsycoca{,5} Px, + @{bin}/mimetype Px, + @{bin}/vendor_perl/mimetype Px, + @{bin}/xprop Px, - owner @{HOME}/** r, - owner @{HOME}/.Xauthority r, - owner @{user_config_dirs}/mimeapps.list{,.new} rw, + owner @{tmp}/wl-copy-buffer-@{rand6}/stdin r, - owner @{run}/user/@{uid}/ r, - - owner /tmp/wl-copy-buffer-@{rand6}/stdin r, - - @{sys}/devices/platform/**/hwmon/hwmon@{int}/temp* r, - @{sys}/devices/platform/**/hwmon/hwmon@{int}/fan* r, - - @{PROC}/version r, - - /dev/dri/card@{int} rw, /dev/tty rw, - # When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two - # following root processes: - # dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr - # /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session - # - # Should this be allowed? Xdg-mime works fine without this. - #@{bin}/dbus-launch rCx -> dbus, - #@{bin}/dbus-send rCx -> dbus, - deny @{bin}/dbus-launch rx, - deny @{bin}/dbus-send rx, - - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, - - profile dbus { + profile bus flags=(complain) { include - include - - @{bin}/dbus-launch mr, - @{bin}/dbus-send mr, - @{bin}/dbus-daemon rPx, - - @{HOME}/.Xauthority r, - owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, - - include if exists + include + include + include if exists } include if exists diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index 096132af5..8e90bc423 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -10,51 +10,37 @@ include @{exec_path} = @{bin}/xdg-open profile xdg-open @{exec_path} flags=(attach_disconnected) { include - include include + include @{exec_path} r, - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/sed rix, - @{bin}/cut rix, - @{bin}/which{,.debianutils} rix, - @{bin}/cat rix, - @{bin}/uname rix, + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/cut ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/sed ix, + @{bin}/tr ix, + @{bin}/uname ix, - @{bin}/xprop rPx, - @{bin}/xdg-mime rPx, + # To get DE information + @{bin}/kde{,4}-config ix, - @{bin}/exo-open rPx, - @{bin}/gio rPx, - #@{bin}/kde-open5 rPUx, - @{bin}/ktraderclient5 rPUx, + @{bin}/dbus-send Cx -> bus, + @{bin}/gdbus Cx -> bus, + @{bin}/xprop Px, + @{bin}/xdg-mime Px, + @{open_path} Px -> child-open-any, - @{bin}/dbus-launch rCx -> dbus, - @{bin}/dbus-send rCx -> dbus, - - /** r, - owner /** rw, - - # freedesktop.org-strict - owner @{user_share_dirs}/applications/ r, - /usr/share/applications/*.desktop r, - - /dev/tty rw, - - profile dbus { + profile bus { include - include + include + include - @{bin}/dbus-launch mr, - @{bin}/dbus-send mr, - @{bin}/dbus-daemon rPx, - - # for dbus-launch - owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, - - @{HOME}/.Xauthority r, + include if exists } include if exists diff --git a/apparmor.d/groups/freedesktop/xdg-screensaver b/apparmor.d/groups/freedesktop/xdg-screensaver index 784c63364..c142d137d 100644 --- a/apparmor.d/groups/freedesktop/xdg-screensaver +++ b/apparmor.d/groups/freedesktop/xdg-screensaver @@ -8,38 +8,49 @@ abi , include @{exec_path} = @{bin}/xdg-screensaver -profile xdg-screensaver @{exec_path} { +profile xdg-screensaver @{exec_path} flags=(complain) { include include include @{exec_path} r, - @{bin}/ r, + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/cut ix, + @{bin}/dirname ix, + @{bin}/kill ix, + @{bin}/ln ix, + @{bin}/lockfile ix, + @{bin}/mktemp ix, + @{bin}/mv ix, + @{bin}/perl ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/uname ix, + @{bin}/xautolock ix, - @{sh_path} rix, - @{bin}/mv rix, - @{bin}/{,e}grep rix, - @{bin}/sed rix, - @{bin}/which{,.debianutils} rix, - @{bin}/cat rix, - @{bin}/uname rix, + @{bin}/dbus-send Cx -> bus, + @{bin}/xprop Px, + @{bin}/xset Px, + @{bin}/ps Px, + @{bin}/hostname Px, - @{bin}/xautolock rix, - @{bin}/dbus-send rix, + profile bus flags=(complain) { + include + include + include - @{bin}/xprop rPx, - @{bin}/xdg-mime rPx, - @{bin}/xset rPx, - @{bin}/hostname rix, + #aa:dbus talk bus=session name=org.freedesktop.ScreenSaver label=gsd-screensaver-proxy + #aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console - owner @{HOME}/ r, - owner @{HOME}/.Xauthority r, - owner @{tmp}/xauth-@{int}-_[0-9] r, - - owner @{run}/user/@{uid}/ r, - - /dev/dri/card@{int} rw, + include if exists + } include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index 38ae2c1b5..f64b879f6 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -15,53 +15,48 @@ profile xdg-settings @{exec_path} { @{exec_path} r, - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/basename rix, - @{bin}/cat rix, - @{bin}/cut rix, - @{bin}/mktemp rix, - @{bin}/mv rix, - @{bin}/readlink rix, - @{bin}/realpath rix, - @{bin}/sed rix, - @{bin}/sort rix, - @{bin}/uname rix, - @{bin}/wc rix, - @{bin}/which{,.debianutils} rix, + @{sh_path} rix, + @{bin}/{,e}grep rix, + @{bin}/basename rix, + @{bin}/cat ix, + @{bin}/cut rix, + @{bin}/head ix, + @{bin}/mkdir ix, + @{bin}/mktemp ix, + @{bin}/mv ix, + @{bin}/readlink ix, + @{bin}/realpath rix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/sort ix, + @{bin}/touch ix, + @{bin}/tr ix, + @{bin}/uname ix, + @{bin}/wc ix, - @{bin}/dbus-launch rCx -> dbus, - @{bin}/dbus-send rCx -> dbus, - @{bin}/kreadconfig5 rPx, - @{bin}/xdg-mime rPx, - @{bin}/xprop rPx, + # To set/get DE information + @{bin}/gconftool{,-2} ix, + @{bin}/kde{,4}-config ix, + @{bin}/kwriteconfig{,5,6} ix, + @{bin}/qtxdg-mat ix, - /usr/share/terminfo/** r, + @{bin}/dbus-send Cx -> bus, + @{bin}/kreadconfig{,5} Px, + @{bin}/xdg-mime Px, + @{bin}/xprop Px, - /etc/xdg/xfce4/helpers.rc r, - /etc/machine-id r, - /var/lib/dbus/machine-id r, + owner @{user_config_dirs}/xfce4/helpers.rc{,.@{rand6}} rw, - owner @{HOME}/ r, - owner @{HOME}/.Xauthority r, + @{PROC}/version r, - owner @{user_config_dirs}/xfce4/helpers.rc{,.*} rw, + owner /dev/pts/@{int} rw, - owner @{run}/user/@{uid}/ r, - - owner @{PROC}/@{pid}/fd/ r, - - profile dbus { + profile bus flags=(complain) { include - include + include + include - @{bin}/dbus-launch mr, - @{bin}/dbus-send mr, - @{bin}/dbus-daemon rPx, - - owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w, - - include if exists + include if exists } include if exists From de21ff07a677959d9ed6f0349efafdbe28ce4403 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 3 Oct 2024 11:55:33 +0100 Subject: [PATCH 0293/1455] build: move upstream overwrite to its own build tasks. It allow us to controll when we want to do it and either or not it should be enabled. --- cmd/prebuild/main.go | 1 + pkg/prebuild/cli/cli.go | 4 +- pkg/prebuild/prepare/configure.go | 41 ------------------- pkg/prebuild/prepare/core_test.go | 6 +++ pkg/prebuild/prepare/overwrite.go | 67 +++++++++++++++++++++++++++++++ 5 files changed, 76 insertions(+), 43 deletions(-) create mode 100644 pkg/prebuild/prepare/overwrite.go diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 629b37ed3..51bbca854 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -25,6 +25,7 @@ func init() { "merge", "configure", "setflags", + "overwrite", "systemd-default", ) diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index b82d918a7..e629b46c5 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -106,8 +106,8 @@ func Prebuild() { if file != "" { sync, _ := prepare.Tasks["synchronise"].(*prepare.Synchronise) sync.Path = file - configure, _ := prepare.Tasks["configure"].(*prepare.Configure) - configure.OneFile = true + overwrite, _ := prepare.Tasks["overwrite"].(*prepare.Overwrite) + overwrite.OneFile = true } logging.Step("Building apparmor.d profiles for %s on ABI%d.", prebuild.Distribution, prebuild.ABI) diff --git a/pkg/prebuild/prepare/configure.go b/pkg/prebuild/prepare/configure.go index 6be35d3dd..9a423060f 100644 --- a/pkg/prebuild/prepare/configure.go +++ b/pkg/prebuild/prepare/configure.go @@ -6,7 +6,6 @@ package prepare import ( "fmt" - "os" "github.com/roddhjav/apparmor.d/pkg/prebuild" "github.com/roddhjav/apparmor.d/pkg/util" @@ -14,7 +13,6 @@ import ( type Configure struct { prebuild.Base - OneFile bool } func init() { @@ -23,18 +21,12 @@ func init() { Keyword: "configure", Msg: "Set distribution specificities", }, - OneFile: false, }) } func (p Configure) Apply() ([]string, error) { res := []string{} - if prebuild.ABI == 4 { - if err := OverwriteUpstreamProfile(p.OneFile); err != nil { - return res, err - } - } switch prebuild.Distribution { case "arch", "opensuse": @@ -65,36 +57,3 @@ func (p Configure) Apply() ([]string, error) { } return res, nil } - -// Overwrite upstream profile: disable upstream & rename ours -func OverwriteUpstreamProfile(oneFile bool) error { - const ext = ".apparmor.d" - disableDir := prebuild.RootApparmord.Join("disable") - if err := disableDir.Mkdir(); err != nil { - return err - } - - path := prebuild.DistDir.Join("overwrite") - if !path.Exist() { - return fmt.Errorf("%s not found", path) - } - for _, name := range util.MustReadFileAsLines(path) { - origin := prebuild.RootApparmord.Join(name) - dest := prebuild.RootApparmord.Join(name + ext) - if !dest.Exist() && oneFile { - continue - } - if err := origin.Rename(dest); err != nil { - - return err - } - originRel, err := origin.RelFrom(dest) - if err != nil { - return err - } - if err := os.Symlink(originRel.String(), disableDir.Join(name).String()); err != nil { - return err - } - } - return nil -} diff --git a/pkg/prebuild/prepare/core_test.go b/pkg/prebuild/prepare/core_test.go index 3c35e3e8f..ea18d2cd8 100644 --- a/pkg/prebuild/prepare/core_test.go +++ b/pkg/prebuild/prepare/core_test.go @@ -64,6 +64,12 @@ func TestTask_Apply(t *testing.T) { wantErr: false, want: "dists/flags/main.flags", }, + { + name: "overwrite", + task: Tasks["overwrite"], + wantErr: false, + wantFiles: paths.PathList{prebuild.RootApparmord.Join("flatpak.apparmor.d")}, + }, { name: "systemd-default", task: Tasks["systemd-default"], diff --git a/pkg/prebuild/prepare/overwrite.go b/pkg/prebuild/prepare/overwrite.go new file mode 100644 index 000000000..209e8dc81 --- /dev/null +++ b/pkg/prebuild/prepare/overwrite.go @@ -0,0 +1,67 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2021-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package prepare + +import ( + "fmt" + "os" + + "github.com/roddhjav/apparmor.d/pkg/prebuild" + "github.com/roddhjav/apparmor.d/pkg/util" +) + +const ext = ".apparmor.d" + +type Overwrite struct { + prebuild.Base + OneFile bool +} + +func init() { + RegisterTask(&Overwrite{ + Base: prebuild.Base{ + Keyword: "overwrite", + Msg: "Overwrite dummy upstream profiles", + }, + OneFile: false, + }) +} + +func (p Overwrite) Apply() ([]string, error) { + res := []string{} + if prebuild.ABI == 3 { + return res, nil + } + + disableDir := prebuild.RootApparmord.Join("disable") + if err := disableDir.Mkdir(); err != nil { + return res, err + } + + path := prebuild.DistDir.Join("overwrite") + if !path.Exist() { + return res, fmt.Errorf("%s not found", path) + } + for _, name := range util.MustReadFileAsLines(path) { + origin := prebuild.RootApparmord.Join(name) + dest := prebuild.RootApparmord.Join(name + ext) + if !dest.Exist() && p.OneFile { + continue + } + if err := origin.Rename(dest); err != nil { + + return res, err + } + originRel, err := origin.RelFrom(dest) + if err != nil { + return res, err + } + if err := os.Symlink(originRel.String(), disableDir.Join(name).String()); err != nil { + return res, err + } + } + + return res, nil +} From cc5416f57a098b8f459db85415148d4022065dd6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 3 Oct 2024 11:58:25 +0100 Subject: [PATCH 0294/1455] build: cleanup flags manifest & enforce a few profiles. --- dists/flags/arch.flags | 1 + dists/flags/debian.flags | 1 + dists/flags/main.flags | 23 ++--------------------- dists/flags/ubuntu.flags | 4 ++++ dists/flags/whonix.flags | 4 ++++ 5 files changed, 12 insertions(+), 21 deletions(-) diff --git a/dists/flags/arch.flags b/dists/flags/arch.flags index ba883e3c2..8910bb280 100644 --- a/dists/flags/arch.flags +++ b/dists/flags/arch.flags @@ -1,3 +1,4 @@ +aurpublish complain makepkg complain mkinitcpio attach_disconnected,complain pacman attach_disconnected,complain diff --git a/dists/flags/debian.flags b/dists/flags/debian.flags index b659675b6..5e29c0153 100644 --- a/dists/flags/debian.flags +++ b/dists/flags/debian.flags @@ -1,3 +1,4 @@ +apt-helper complain dhclient complain dhclient-script complain dpkg complain diff --git a/dists/flags/main.flags b/dists/flags/main.flags index e1c8a057a..f2c938a19 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -10,7 +10,8 @@ systemd-service attach_disconnected,complain systemd-user attach_disconnected,mediate_deleted,complain aa-load complain -acpid attach_disconnected,complain +aa-logprof attach_disconnected,complain +aa-notify complain akonadi_akonotes_resource complain akonadi_archivemail_agent complain akonadi_birthdays_resource complain @@ -30,11 +31,8 @@ akonadi_sendlater_agent complain akonadi_unifiedmailbox_agent complain anacron complain appimagelauncherd complain -apport attach_disconnected,complain -apt-helper complain at complain atd complain -atril-previewer complain auditctl attach_disconnected,complain auditd attach_disconnected,complain augenrules attach_disconnected,complain @@ -51,8 +49,6 @@ cc-remote-login-helper complain cctk complain child-modprobe-nvidia attach_disconnected,complain child-open attach_disconnected,complain -child-open-any attach_disconnected,complain -child-open-browsers attach_disconnected,complain chronyd attach_disconnected,complain cockpit-askpass complain cockpit-bridge complain @@ -64,7 +60,6 @@ cockpit-ssh complain cockpit-tls attach_disconnected,complain cockpit-ws complain cockpit-wsinstance-factory complain -ctop complain cups-backend-beh complain cups-backend-bluetooth complain cups-backend-brf complain @@ -96,7 +91,6 @@ dmsetup complain dockerd attach_disconnected,complain dolphin complain downloadhelper complain -dpkg-genbuildinfo complain drkonqi complain drkonqi-coredump-cleanup complain drkonqi-coredump-processor complain @@ -120,8 +114,6 @@ flatpak-portal attach_disconnected,complain flatpak-session-helper attach_disconnected,complain flatpak-system-helper complain flatpak-validate-icon complain -foliate attach_disconnected,complain -fractal attach_disconnected,complain fstrim complain fuse-overlayfs complain fusermount complain @@ -131,7 +123,6 @@ gdm-session attach_disconnected,complain gdm-xsession complain gimp complain gmenudbusmenuproxy complain -gnome-boxes complain gnome-browser-connector-host complain gnome-control-center attach_disconnected,complain gnome-control-center-goa-helper complain @@ -143,11 +134,9 @@ gnome-initial-setup complain gnome-music attach_disconnected,complain gnome-photos-thumbnailer complain gnome-remote-desktop-daemon complain -gnome-session complain gnome-software complain gnome-system-monitor attach_disconnected,complain gnome-terminal-server complain -gnome-text-editor complain gnome-tweaks complain grub-bios-setup complain grub-editenv complain @@ -216,7 +205,6 @@ kgx complain kio_http_cache_cleaner complain kiod complain kioworker complain -kmod attach_disconnected,complain konsole attach_disconnected,mediate_deleted,complain kscreen_backend_launcher complain kscreen_osd_service complain @@ -262,11 +250,8 @@ nm-priv-helper complain nmcli complain nvidia-detector complain nvidia-persistenced complain -nvidia-smi complain -okular complain ollama attach_disconnected,complain os-prober attach_disconnected,complain -package-data-downloader complain pam_kwallet_init complain pam-tmpdir-helper complain passim complain @@ -283,7 +268,6 @@ plymouth-set-default-theme attach_disconnected,complain plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted qdbus complain -protonmail complain realmd complain remmina complain run-parts complain @@ -324,8 +308,6 @@ steam-runtime attach_disconnected,complain steamerrorreporter attach_disconnected,complain strawberry attach_disconnected,mediate_deleted,complain sulogin complain -superproductivity attach_disconnected,complain -switcherooctl complain swtpm complain swtpm_ioctl complain swtpm_localca complain @@ -337,7 +319,6 @@ systemd-binfmt attach_disconnected,complain systemd-bsod complain systemd-cgls complain systemd-cgtop complain -systemd-coredump attach_disconnected,mediate_deleted,complain systemd-cryptsetup complain systemd-dissect attach_disconnected,complain systemd-escape complain diff --git a/dists/flags/ubuntu.flags b/dists/flags/ubuntu.flags index c491729dc..30e21282d 100644 --- a/dists/flags/ubuntu.flags +++ b/dists/flags/ubuntu.flags @@ -1,13 +1,17 @@ +apport attach_disconnected,complain apport-checkreports complain apport-gtk complain apt-esm-hook complain apt-esm-json-hook complain +apt-helper complain check-new-release-gtk complain do-release-upgrade complain +dpkg-genbuildinfo complain hwe-support-status complain list-oem-metapackages complain livepatch-notification complain notify-reboot-required complain +package-data-downloader complain package-system-locked attach_disconnected,complain pro complain release-upgrade-motd complain diff --git a/dists/flags/whonix.flags b/dists/flags/whonix.flags index bbb744355..dc984d690 100644 --- a/dists/flags/whonix.flags +++ b/dists/flags/whonix.flags @@ -1,4 +1,6 @@ anondate complain +apt-helper complain +dpkg-genbuildinfo complain msgcollector complain msgcollector-br-add complain msgcollector-generic-gui-message complain @@ -28,8 +30,10 @@ torbrowser-plugin-container complain torbrowser-start complain torbrowser-updater complain torbrowser-updater-permission-fix complain +torbrowser-updater-permission-fix complain torbrowser-vaapitest complain torbrowser-wrapper complain +torbrowser-wrapper complain whonix-firewall-edit complain whonix-firewall-restarter complain whonix-firewalld complain From 9b5754631259bd42fd0901671b2125a7e6035155 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 3 Oct 2024 13:09:20 +0100 Subject: [PATCH 0295/1455] chore(fsp): add note of current profile stage. --- apparmor.d/groups/_full/systemd | 11 +++++++++++ apparmor.d/groups/_full/systemd-user | 2 ++ 2 files changed, 13 insertions(+) diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index 7538b9ed3..9e1737a2a 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -11,6 +11,17 @@ # Distributions and other programs can add rules in the usr/systemd.d directory +# TODO: rework this to get a controlled environment: (cf security model) +# - No global allow anymore: in high security environments, we must manage the list +# of program/service that can be started by systemd and ensure that they are all +# listed and confined. Programs not listed will not be able to start. +# - Outside common systemd service, the list may have to be automatically +# generated at install time, in `/etc/apparmor.d/usr/systemd.d/exec` +# - Stop disabling nnp flags in systemd dropin files. +# - Each systemd services in `systemd-service` (when the service is more complex than foo.service -> Exec=/usr/bin/foo) +# need they own profile, profile name configured as a dropin unit file. +# - When this is done: the fallback profile as root will not be needed. + abi , include diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index 71b9048a4..32228f21b 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -11,6 +11,8 @@ # Distributions and other programs can add rules in the usr/systemd-user.d directory +# TODO: rework this to get a controlled environment. cf comments in systemd profile. + abi , include From 2ef038e8d9c7c6678cb4dd1d79953f3025f4d672 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 3 Oct 2024 13:28:40 +0100 Subject: [PATCH 0296/1455] feat(profile): minor abi specific changes. --- apparmor.d/abstractions/authentication.d/complete | 2 +- apparmor.d/profiles-s-z/slirp4netns | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/authentication.d/complete b/apparmor.d/abstractions/authentication.d/complete index 738166dba..ef54e6e78 100644 --- a/apparmor.d/abstractions/authentication.d/complete +++ b/apparmor.d/abstractions/authentication.d/complete @@ -4,7 +4,7 @@ @{bin}/pam-tmpdir-helper rPx, - #aa:exclude ubuntu opensuse + #aa:only abi3 @{bin}/unix_chkpwd rPx, #aa:only whonix diff --git a/apparmor.d/profiles-s-z/slirp4netns b/apparmor.d/profiles-s-z/slirp4netns index e2d3b6b1f..ed4dd8d5e 100644 --- a/apparmor.d/profiles-s-z/slirp4netns +++ b/apparmor.d/profiles-s-z/slirp4netns @@ -10,7 +10,7 @@ include profile slirp4netns @{exec_path} flags=(attach_disconnected) { include - # userns, + userns, capability net_admin, capability setpcap, From 7b73adceeb1b6a570af96c9126d735adcef78b03 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 4 Oct 2024 14:31:54 +0100 Subject: [PATCH 0297/1455] feat(abs): common/gnome: remove open_path from the abs, add bus accessibility. --- apparmor.d/abstractions/common/gnome | 16 +++++++++++----- apparmor.d/groups/browsers/epiphany | 4 ++-- apparmor.d/groups/gnome/gnome-calculator | 2 ++ apparmor.d/groups/gnome/gnome-calendar | 3 +-- apparmor.d/groups/gnome/gnome-clocks | 3 +-- apparmor.d/groups/gnome/gnome-contacts | 3 +-- apparmor.d/groups/gnome/gnome-extensions-app | 1 + apparmor.d/groups/gnome/gnome-firmware | 1 + apparmor.d/groups/gnome/gnome-font-viewer | 1 + apparmor.d/groups/gnome/gnome-logs | 1 + apparmor.d/groups/gnome/gnome-maps | 2 ++ apparmor.d/groups/gnome/gnome-music | 3 +++ apparmor.d/groups/gnome/gnome-recipes | 1 + apparmor.d/groups/gnome/gnome-text-editor | 2 ++ apparmor.d/groups/gnome/gnome-tour | 1 + apparmor.d/groups/gnome/gnome-weather | 1 + apparmor.d/groups/gnome/yelp | 5 ++--- apparmor.d/profiles-a-f/baobab | 2 ++ apparmor.d/profiles-a-f/file-roller | 6 ++---- apparmor.d/profiles-a-f/foliate | 2 +- apparmor.d/profiles-a-f/fractal | 10 ++-------- apparmor.d/profiles-s-z/snapshot | 4 ++-- apparmor.d/profiles-s-z/totem | 4 +--- 23 files changed, 44 insertions(+), 34 deletions(-) diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index ced9cb1b1..653221e1d 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -4,24 +4,30 @@ # Minimal set of rules for all gnome based UI application. + include include include include include include - @{open_path} rPx -> child-open-help, - /usr/share/@{profile_name}/{,**} r, + / r, + owner @{user_cache_dirs}/@{profile_name}/ rw, - owner @{user_cache_dirs}/@{profile_name}/** rwlk, + owner @{user_cache_dirs}/@{profile_name}/** rwlk -> @{user_cache_dirs}/@{profile_name}/**, owner @{user_config_dirs}/@{profile_name}/ rw, - owner @{user_config_dirs}/@{profile_name}/** rwlk, + owner @{user_config_dirs}/@{profile_name}/** rwlk -> @{user_config_dirs}/@{profile_name}/**, owner @{user_share_dirs}/@{profile_name}/ rw, - owner @{user_share_dirs}/@{profile_name}/** rwlk, + owner @{user_share_dirs}/@{profile_name}/** rwlk -> @{user_share_dirs}/@{profile_name}/**, + + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany index 54eeb79e3..a64850f1a 100644 --- a/apparmor.d/groups/browsers/epiphany +++ b/apparmor.d/groups/browsers/epiphany @@ -10,7 +10,6 @@ include profile epiphany @{exec_path} flags=(attach_disconnected) { include include - include include include include @@ -33,6 +32,8 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{open_path} rPx -> child-open, + @{bin}/bwrap rix, @{bin}/xdg-dbus-proxy rix, @{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix, @@ -64,7 +65,6 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { @{PROC}/zoneinfo r, owner @{PROC}/@{pid}/smaps r, owner @{PROC}/@{pid}/statm r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/gnome/gnome-calculator b/apparmor.d/groups/gnome/gnome-calculator index 17fcdc4f6..2e553d9f4 100644 --- a/apparmor.d/groups/gnome/gnome-calculator +++ b/apparmor.d/groups/gnome/gnome-calculator @@ -21,6 +21,8 @@ profile gnome-calculator @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open-help, + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index 16cfa77c8..741be7709 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/gnome-calendar profile gnome-calendar @{exec_path} { include - include include - include include include include @@ -40,6 +38,7 @@ profile gnome-calendar @{exec_path} { peer=(name=:*, label=evolution-source-registry), @{exec_path} mr, + @{open_path} rPx -> child-open-help, /usr/share/evolution-data-server/{,**} r, /usr/share/libgweather/Locations.xml r, diff --git a/apparmor.d/groups/gnome/gnome-clocks b/apparmor.d/groups/gnome/gnome-clocks index da42a2ef7..fd6ded04f 100644 --- a/apparmor.d/groups/gnome/gnome-clocks +++ b/apparmor.d/groups/gnome/gnome-clocks @@ -10,9 +10,7 @@ include profile gnome-clocks @{exec_path} { include include - include include - include include include include @@ -24,6 +22,7 @@ profile gnome-clocks @{exec_path} { #aa:dbus own bus=session name=org.gnome.clocks @{exec_path} mr, + @{open_path} rPx -> child-open-help, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-contacts b/apparmor.d/groups/gnome/gnome-contacts index 66651f3a2..b6474cf55 100644 --- a/apparmor.d/groups/gnome/gnome-contacts +++ b/apparmor.d/groups/gnome/gnome-contacts @@ -9,8 +9,6 @@ include @{exec_path} = @{bin}/gnome-contacts profile gnome-contacts @{exec_path} { include - include - include include include include @@ -26,6 +24,7 @@ profile gnome-contacts @{exec_path} { #aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon @{exec_path} mr, + @{open_path} rPx -> child-open-help, owner @{user_cache_dirs}/evolution/addressbook/{,**} r, owner @{user_share_dirs}/folks/relationships.ini r, diff --git a/apparmor.d/groups/gnome/gnome-extensions-app b/apparmor.d/groups/gnome/gnome-extensions-app index 29899f8f1..f1e229b59 100644 --- a/apparmor.d/groups/gnome/gnome-extensions-app +++ b/apparmor.d/groups/gnome/gnome-extensions-app @@ -16,6 +16,7 @@ profile gnome-extensions-app @{exec_path} { @{sh_path} rix, @{bin}/gjs-console rix, + @{open_path} rPx -> child-open-help, /usr/share/gnome-shell/org.gnome.Extensions* r, /usr/share/terminfo/** r, diff --git a/apparmor.d/groups/gnome/gnome-firmware b/apparmor.d/groups/gnome/gnome-firmware index 7d33b3103..af44afbec 100644 --- a/apparmor.d/groups/gnome/gnome-firmware +++ b/apparmor.d/groups/gnome/gnome-firmware @@ -24,6 +24,7 @@ profile gnome-firmware @{exec_path} { #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind @{exec_path} mr, + @{open_path} rPx -> child-open-help, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-font-viewer b/apparmor.d/groups/gnome/gnome-font-viewer index 2e16f9f41..0895bd7f0 100644 --- a/apparmor.d/groups/gnome/gnome-font-viewer +++ b/apparmor.d/groups/gnome/gnome-font-viewer @@ -12,6 +12,7 @@ profile gnome-font-viewer @{exec_path} { include @{exec_path} mr, + @{open_path} rPx -> child-open-help, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-logs b/apparmor.d/groups/gnome/gnome-logs index ae81fc825..5e3ab03bd 100644 --- a/apparmor.d/groups/gnome/gnome-logs +++ b/apparmor.d/groups/gnome/gnome-logs @@ -13,6 +13,7 @@ profile gnome-logs @{exec_path} { include @{exec_path} mr, + @{open_path} rPx -> child-open-help, /etc/machine-id r, diff --git a/apparmor.d/groups/gnome/gnome-maps b/apparmor.d/groups/gnome/gnome-maps index 1f2faafbb..294d6229a 100644 --- a/apparmor.d/groups/gnome/gnome-maps +++ b/apparmor.d/groups/gnome/gnome-maps @@ -22,6 +22,8 @@ profile gnome-maps @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open-help, + audit @{bin}/gjs-console rix, owner @{user_pictures_dirs}/** rw, diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index a40c25fd8..834e67037 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -28,6 +28,9 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.freedesktop.Tracker3.Writeback label=tracker-writeback @{exec_path} mr, + + @{open_path} rPx -> child-open-help, + @{bin}/ r, @{bin}/env r, @{bin}/python3.@{int} rix, diff --git a/apparmor.d/groups/gnome/gnome-recipes b/apparmor.d/groups/gnome/gnome-recipes index 5ebd788c0..900259447 100644 --- a/apparmor.d/groups/gnome/gnome-recipes +++ b/apparmor.d/groups/gnome/gnome-recipes @@ -24,6 +24,7 @@ profile gnome-recipes @{exec_path} { @{exec_path} mr, @{bin}/tar rix, + @{open_path} rPx -> child-open-help, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index efbb55f35..22823753b 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -19,6 +19,8 @@ profile gnome-text-editor @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open-help, + owner @{user_share_dirs}/org.gnome.TextEditor/{,**} rw, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/gnome/gnome-tour b/apparmor.d/groups/gnome/gnome-tour index 1dcb2af68..8ae95f4a0 100644 --- a/apparmor.d/groups/gnome/gnome-tour +++ b/apparmor.d/groups/gnome/gnome-tour @@ -13,6 +13,7 @@ profile gnome-tour @{exec_path} { include @{exec_path} mr, + @{open_path} rPx -> child-open-help, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-weather b/apparmor.d/groups/gnome/gnome-weather index 11e75cb2a..c73ff0a19 100644 --- a/apparmor.d/groups/gnome/gnome-weather +++ b/apparmor.d/groups/gnome/gnome-weather @@ -23,6 +23,7 @@ profile gnome-weather @{exec_path} { @{exec_path} mr, @{bin}/gjs-console rix, + @{open_path} rPx -> child-open-help, /usr/share/org.gnome.Weather/{,**} r, diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index 71d8f7504..d9b709f99 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -10,8 +10,6 @@ include profile yelp @{exec_path} { include include - include - include include network netlink raw, @@ -19,6 +17,7 @@ profile yelp @{exec_path} { #aa:dbus own bus=session name=org.gnome.Yelp @{exec_path} mr, + @{open_path} rPx -> child-open-help, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix, @@ -32,7 +31,7 @@ profile yelp @{exec_path} { @{sys}/devices/virtual/dmi/id/chassis_type r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-yelp-*.scope/memory.* r, - owner @{sys}/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/*.slice/*/memory.* r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*.slice/*/memory.* r, @{PROC}/zoneinfo r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-a-f/baobab b/apparmor.d/profiles-a-f/baobab index 92977471b..e66d8d66a 100644 --- a/apparmor.d/profiles-a-f/baobab +++ b/apparmor.d/profiles-a-f/baobab @@ -17,6 +17,8 @@ profile baobab @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open-help, + # As a directory tree analyzer it needs full access to the filesystem / r, /** r, diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index 57eb19aef..1ea3b8e73 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -9,8 +9,6 @@ include @{exec_path} = @{bin}/file-roller profile file-roller @{exec_path} { include - include - include include include include @@ -23,6 +21,8 @@ profile file-roller @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open-help, + # Archivers @{bin}/7z rix, @{bin}/7zz rix, @@ -38,8 +38,6 @@ profile file-roller @{exec_path} { @{bin}/zstd rix, @{lib}/p7zip/7z rix, - / r, - @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-a-f/foliate b/apparmor.d/profiles-a-f/foliate index 0474684e7..b1c485408 100644 --- a/apparmor.d/profiles-a-f/foliate +++ b/apparmor.d/profiles-a-f/foliate @@ -32,6 +32,7 @@ profile foliate @{exec_path} flags=(attach_disconnected) { @{bin}/gjs-console rix, @{bin}/xdg-dbus-proxy rix, @{bin}/speech-dispatcher rPx, + @{open_path} rPx -> child-open-help, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix, @@ -65,7 +66,6 @@ profile foliate @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/smaps r, owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/statm r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat r, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 20eaa34af..637cc0970 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -23,23 +23,17 @@ profile fractal @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /usr/share/xml/iso-codes/{,**} r, + @{open_path} rPx -> child-open-help, - / r, + /usr/share/xml/iso-codes/{,**} r, owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, - @{sys}/fs/cgroup/user.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, - owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, - @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/ r, diff --git a/apparmor.d/profiles-s-z/snapshot b/apparmor.d/profiles-s-z/snapshot index e7d84b0b3..9c5d5b9d6 100644 --- a/apparmor.d/profiles-s-z/snapshot +++ b/apparmor.d/profiles-s-z/snapshot @@ -17,11 +17,11 @@ profile snapshot @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open-help, + owner @{user_pictures_dirs}/Camera/{,**} rw, owner @{user_videos_dirs}/Camera/{,**} rw, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - include if exists } diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index 7a7dd709e..a71a80c06 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -10,8 +10,6 @@ include profile totem @{exec_path} flags=(attach_disconnected) { include include - include - include include include include @@ -30,6 +28,7 @@ profile totem @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/bwrap rCx -> bwrap, + @{open_path} rPx -> child-open-help, /usr/share/xml/iso-codes/{,**} r, /usr/share/grilo-plugins/{,**} r, @@ -56,7 +55,6 @@ profile totem @{exec_path} flags=(attach_disconnected) { @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/task/@{tid}/comm w, deny @{user_share_dirs}/gvfs-metadata/* r, From 18a71512a9519585216f6fec11b4b7371630990f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 4 Oct 2024 14:42:11 +0100 Subject: [PATCH 0298/1455] feat(tunable): add u32 & u64. - Reorganize the file - @{u32} == @{uid} --- apparmor.d/tunables/multiarch.d/system | 80 ++++++++++++++++---------- 1 file changed, 50 insertions(+), 30 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 40f56216d..2dd715567 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -2,8 +2,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# To allow extended personalisation without breaking everything. -# All apparmor profiles should always use the variables defined here. +# Base variables +# -------------- # Any digit @{d}=[0-9] @@ -23,18 +23,23 @@ # Integer up to 10 digits (0-9999999999) @{int}=@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},} -# Unsigned integer over 8 bits (0-255) -# 0 - 99 100 - 199 200 - 249 250 - 255 -@{u8}=[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5] - -# Unsigned integer over 16 bits (0-65535, 5 digits) -@{u16}=@{d}{@{d},}{@{d},}{@{d},}{@{d},} - # hexadecimal, alphanumeric and word up to 64 characters @{hex}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} @{rand}=@{c}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},} @{word}=@{w}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} +# Unsigned integer over 8 bits (0...255) +@{u8}=[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5] + +# Unsigned integer over 16 bits (0...65,535 5 digits) +@{u16}={@{d},[1-9]@{d},[1-9][@{d}@{d},[1-9]@{d}@{d}@{d},[1-6]@{d}@{d}@{d}@{d}} + +# Unsigned integer over 32 bits (0...4,294,967,295 10 digits) +@{u32}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-4]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} + +# Unsigned integer over 64 bits (0...18,446,744,073,709,551,615 20 digits). +@{u64}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},1@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} + # Any x digits characters @{int2}=@{d}@{d} @{int4}=@{int2}@{int2} @@ -88,23 +93,9 @@ @{word32}=@{word16}@{word16} @{word64}=@{word32}@{word32} -# Universally unique identifier -@{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} -# Username & group valid characters -@{user}=[a-zA-Z_]{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} -@{group}=@{user} - -# Semantic version -@{version}=@{int}{.@{int},}{.@{int},}{-@{rand},} - -# Shortcut for PCI device -@{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h} -@{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h} -@{pci}=@{pci_bus}/**/ - -# hci devices -@{hci_id}=dev_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c} +# System Paths +# ------------ # @{MOUNTDIRS} is a space-separated list of where user mount directories # are stored, for programs that must enumerate all mount directories on a @@ -121,17 +112,46 @@ # Common places for temporary files @{tmp}=/tmp/ /tmp/user/@{uid}/ -# Udev data dynamic assignment ranges -@{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 -@{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 -# Dbus unique name -@{busname}=:1.@{u16} :not.active.yet +# System Variables +# ---------------- # Common architecture names @{arch}=x86_64 amd64 i386 i686 +# Dbus unique name +@{busname}=:1.@{u16} :not.active.yet + +# Universally unique identifier +@{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} + +# Username & group valid characters +@{user}=[a-zA-Z_]{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} +@{group}=@{user} + +# Semantic version +@{version}=@{int}{.@{int},}{.@{int},}{-@{rand},} + # OpenSUSE does not have the same multiarch structure @{multiarch}+=*-suse-linux* #aa:only opensuse + +# System Internal +# --------------- + +# Shortcut for PCI device +@{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h} +@{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h} +@{pci}=@{pci_bus}/**/ + +# hci devices +@{hci_id}=dev_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c} + +# Udev data dynamic assignment ranges +@{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 +@{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 + +# Container path given to attach_disconnected.path=@{ct}@{profile_name} +@{ct}=/ct- + # vim:syntax=apparmor From 4b5f7f2b5238fc65815a74efdecc8c81fc473fb3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 4 Oct 2024 16:14:40 +0100 Subject: [PATCH 0299/1455] chore: document build the enabled task. --- cmd/prebuild/main.go | 19 ++++++++----------- pkg/prebuild/cli/cli.go | 20 +++++--------------- pkg/prebuild/prepare/merge.go | 2 +- 3 files changed, 14 insertions(+), 27 deletions(-) diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 51bbca854..25e422cfd 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -20,18 +20,18 @@ func init() { // Define the tasks applied by default prepare.Register( - "synchronise", - "ignore", - "merge", - "configure", - "setflags", - "overwrite", - "systemd-default", + "synchronise", // Initialize a new clean apparmor.d build directory + "ignore", // Ignore profiles and files from dist/ignore + "merge", // Merge profiles (from group/, profiles-*-*/) to a unified apparmor.d directory + "configure", // Set distribution specificities + "setflags", // Set flags as definied in dist/flags + "overwrite", // Overwrite dummy upstream profiles + "systemd-default", // Set systemd unit drop in files for dbus profiles ) // Build tasks applied by default builder.Register( - "userspace", // Resolve variable in the userspace profile + "userspace", // Resolve variable in the userspace profile "dev", // Temporary fix for #74, #80 & #235 ) @@ -65,9 +65,6 @@ func init() { /etc/apparmor.d/whonix-firewall ` } - if prebuild.ABI == 3 { - builder.Register("abi3") - } } func main() { diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index e629b46c5..da19c1171 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -86,21 +86,11 @@ func Prebuild() { builder.Register("enforce") } - switch abi { - case 3: - prebuild.ABI = 3 - builder.Register("abi3") - case 4: - prebuild.ABI = 4 - for i, b := range builder.Builds { - if b.Name() == "abi3" { - builder.Builds = append(builder.Builds[:i], builder.Builds[i+1:]...) - break - } - } - case nilABI: - default: - logging.Fatal("ABI %d not supported", abi) + if abi != nilABI { + prebuild.ABI = abi + } + if prebuild.ABI == 3 { + builder.Register("abi3") // Convert all profiles from abi 4.0 to abi 3.0 } if file != "" { diff --git a/pkg/prebuild/prepare/merge.go b/pkg/prebuild/prepare/merge.go index 75945b812..d2c720003 100644 --- a/pkg/prebuild/prepare/merge.go +++ b/pkg/prebuild/prepare/merge.go @@ -20,7 +20,7 @@ func init() { RegisterTask(&Merge{ Base: prebuild.Base{ Keyword: "merge", - Msg: "Merge all profiles into a unified apparmor.d directory", + Msg: "Merge profiles (from group/, profiles-*-*/) to a unified apparmor.d directory", }, }) } From 7757038a4f463f464da290e01a0b3e05ede3482d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 5 Oct 2024 23:03:41 +0100 Subject: [PATCH 0300/1455] build: update path helpers --- pkg/paths/process.go | 5 ++-- .../{process_others.go => process_linux.go} | 28 ++++++++++++++++++- 2 files changed, 30 insertions(+), 3 deletions(-) rename pkg/paths/{process_others.go => process_linux.go} (69%) diff --git a/pkg/paths/process.go b/pkg/paths/process.go index 4c8692866..ebfe71343 100644 --- a/pkg/paths/process.go +++ b/pkg/paths/process.go @@ -55,7 +55,8 @@ func NewProcess(extraEnv []string, args ...string) (*Process, error) { cmd: exec.Command(args[0], args[1:]...), } p.cmd.Env = append(os.Environ(), extraEnv...) - p.TellCommandNotToSpawnShell() + tellCommandNotToSpawnShell(p.cmd) // windows specific + tellCommandToStartOnNewProcessGroup(p.cmd) // linux specific // This is required because some tools detects if the program is running // from terminal by looking at the stdin/out bindings. @@ -146,7 +147,7 @@ func (p *Process) Signal(sig os.Signal) error { // actually exited. This only kills the Process itself, not any other processes it may // have started. func (p *Process) Kill() error { - return p.cmd.Process.Kill() + return kill(p.cmd) } // SetDir sets the working directory of the command. If Dir is the empty string, Run diff --git a/pkg/paths/process_others.go b/pkg/paths/process_linux.go similarity index 69% rename from pkg/paths/process_others.go rename to pkg/paths/process_linux.go index 39bd3e161..5735a85c3 100644 --- a/pkg/paths/process_others.go +++ b/pkg/paths/process_linux.go @@ -31,8 +31,34 @@ package paths -import "os/exec" +import ( + "os/exec" + "syscall" +) func tellCommandNotToSpawnShell(_ *exec.Cmd) { // no op } + +func tellCommandToStartOnNewProcessGroup(oscmd *exec.Cmd) { + // https://groups.google.com/g/golang-nuts/c/XoQ3RhFBJl8 + + // Start the process in a new process group. + // This is needed to kill the process and its children + // if we need to kill the process. + if oscmd.SysProcAttr == nil { + oscmd.SysProcAttr = &syscall.SysProcAttr{} + } + oscmd.SysProcAttr.Setpgid = true +} + +func kill(oscmd *exec.Cmd) error { + // https://groups.google.com/g/golang-nuts/c/XoQ3RhFBJl8 + + // Kill the process group + pgid, err := syscall.Getpgid(oscmd.Process.Pid) + if err != nil { + return err + } + return syscall.Kill(-pgid, syscall.SIGKILL) +} From 36f620dab18c82237d1b624e0525ef60b712cca7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 15:39:21 +0100 Subject: [PATCH 0301/1455] tests: add 'make check' for common issues in Apparmor profiles. --- .gitlab-ci.yml | 2 +- Makefile | 19 ++++++------ tests/check.sh | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 90 insertions(+), 9 deletions(-) create mode 100644 tests/check.sh diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 7737e2d3c..40f212768 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -23,7 +23,7 @@ bash: image: koalaman/shellcheck-alpine script: - shellcheck --shell=bash - PKGBUILD dists/build.sh dists/docker.sh + PKGBUILD dists/build.sh dists/docker.sh tests/check.sh tests/packer/init/init.sh tests/packer/src/aa-update tests/packer/init/clean.sh golangci-lint: diff --git a/Makefile b/Makefile index e8929aec8..9b25bb5ec 100644 --- a/Makefile +++ b/Makefile @@ -4,12 +4,12 @@ # SPDX-License-Identifier: GPL-2.0-only DESTDIR ?= / -BUILD := .build -PKGDEST := /tmp/pkg +BUILD ?= .build +PKGDEST ?= /tmp/pkg PKGNAME := apparmor.d P = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*))) -.PHONY: all build enforce full install local $(P) dev package pkg dpkg rpm tests lint man docs serve clean +.PHONY: all build enforce full install local $(P) dev package pkg dpkg rpm tests lint check manual docs serve clean all: build @./${BUILD}/prebuild --complain @@ -101,18 +101,21 @@ lint: @golangci-lint run @make --directory=tests lint @shellcheck --shell=bash \ - PKGBUILD dists/build.sh dists/docker.sh \ + PKGBUILD dists/build.sh dists/docker.sh tests/check.sh \ tests/packer/init/init.sh tests/packer/src/aa-update tests/packer/init/clean.sh \ debian/${PKGNAME}.postinst debian/${PKGNAME}.postrm -man: - pandoc -t man -s -o root/usr/share/man/man8/aa-log.8 root/usr/share/man/man8/aa-log.md +check: + @bash tests/check.sh + +manual: + @pandoc -t man -s -o root/usr/share/man/man8/aa-log.8 root/usr/share/man/man8/aa-log.md docs: - ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=true mkdocs build --strict + @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=true mkdocs build --strict serve: - ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=false mkdocs serve + @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=false mkdocs serve clean: @rm -rf \ diff --git a/tests/check.sh b/tests/check.sh new file mode 100644 index 000000000..5704ebfba --- /dev/null +++ b/tests/check.sh @@ -0,0 +1,78 @@ +#!/usr/bin/env bash +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Usage: make check +# shellcheck disable=SC2044 + +set -eu -o pipefail + +readonly APPARMORD="apparmor.d" + +check_profiles() { + echo "⋅ Checking if all profiles contain:" + echo " - 'abi ,'" + echo " - 'profile *profile_name* {'" + echo " - 'include if exists '" + echo " - include if exists local for subprofiles" + directories=("$APPARMORD/groups/*" "$APPARMORD/profiles-*-*") + # shellcheck disable=SC2068 + for dir in ${directories[@]}; do + for file in $(find "$dir" -maxdepth 1 -type f); do + case "$file" in */README.md) continue ;; esac + name="$(basename "$file")" + name="${name/.apparmor.d/}" + include="include if exists " + if ! grep -q "^ *${include}$" "$file"; then + echo "$name does not contain '$include'" + exit 1 + fi + if ! grep -q "^ *abi ," "$file"; then + echo "$name does not contain 'abi ,'" + exit 1 + fi + if ! grep -q "^profile $name" "$file"; then + echo "$name does not contain 'profile $name'" + exit 1 + fi + mapfile -t subrofiles < <(grep "^ *profile*" "$file" | awk '{print $2}') + for subprofile in "${subrofiles[@]}"; do + include="include if exists " + if ! grep -q "^ *${include}$" "$file"; then + echo "$name: $name//$subprofile does not contain '$include'" + exit 1 + fi + done + done + done +} + +check_abstractions() { + echo "⋅ Checking if all abstractions contain:" + echo " - 'abi ,'" + echo " - 'include if exists '" + directories=( + "$APPARMORD/abstractions/" "$APPARMORD/abstractions/app/" + "$APPARMORD/abstractions/bus/" "$APPARMORD/abstractions/common/" + ) + for dir in "${directories[@]}"; do + for file in $(find "$dir" -maxdepth 1 -type f); do + name="$(basename "$file")" + root="${dir/${APPARMORD}\/abstractions\//}" + include="include if exists " + if ! grep -q "^ *${include}$" "$file"; then + echo "$file does not contain '$include'" + exit 1 + fi + # if ! grep -q "^ *abi ," "$file"; then + # echo "$file does not contain 'abi ,'" + # exit 1 + # fi + done + done + +} + +check_profiles +check_abstractions From 105a9b4def4582b7025f09d00136d13517f8e061 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 15:46:07 +0100 Subject: [PATCH 0302/1455] feat(profile): cleanup and remove open subprofile when it is useless. --- apparmor.d/groups/apt/querybts | 35 +------- apparmor.d/profiles-a-f/arduino | 27 +------ apparmor.d/profiles-a-f/cawbird | 36 ++------- apparmor.d/profiles-a-f/czkawka-gui | 28 +------ apparmor.d/profiles-a-f/deltachat-desktop | 87 ++++++-------------- apparmor.d/profiles-a-f/deluser | 17 ++-- apparmor.d/profiles-g-l/gtk-youtube-viewer | 28 +------ apparmor.d/profiles-g-l/hardinfo | 94 ++++++++-------------- apparmor.d/profiles-m-r/mediainfo-gui | 24 +----- apparmor.d/profiles-m-r/orage | 36 +-------- apparmor.d/profiles-m-r/quiterss | 80 +++++------------- apparmor.d/profiles-s-z/smtube | 29 +------ apparmor.d/profiles-s-z/udiskie | 32 +------- apparmor.d/profiles-s-z/xarchiver | 40 +-------- 14 files changed, 111 insertions(+), 482 deletions(-) diff --git a/apparmor.d/groups/apt/querybts b/apparmor.d/groups/apt/querybts index da7c45275..5c46246a2 100644 --- a/apparmor.d/groups/apt/querybts +++ b/apparmor.d/groups/apt/querybts @@ -33,7 +33,7 @@ profile querybts @{exec_path} { @{bin}/stty rix, @{bin}/ldconfig rix, - @{bin}/xdg-open rCx -> open, + @{open_path} rPx -> child-open-browsers, @{bin}/dpkg rPx -> child-dpkg, @@ -46,41 +46,14 @@ profile querybts @{exec_path} { /etc/dpkg/origins/ r, /etc/dpkg/origins/debian r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/fd/ r, - /etc/fstab r, /var/lib/dbus/machine-id r, /etc/machine-id r, - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/fd/ r, include if exists } diff --git a/apparmor.d/profiles-a-f/arduino b/apparmor.d/profiles-a-f/arduino index 0304dbc6c..cfac12d42 100644 --- a/apparmor.d/profiles-a-f/arduino +++ b/apparmor.d/profiles-a-f/arduino @@ -39,7 +39,7 @@ profile arduino @{exec_path} { @{bin}/chmod rix, @{bin}/avrdude rix, - @{bin}/xdg-open rCx -> open, + @{open_path} rCx -> child-open, @{bin}/dpkg-architecture rPx, @{bin}/arduino-builder rPx, @@ -109,31 +109,6 @@ profile arduino @{exec_path} { # Silencer deny /usr/share/arduino/** w, - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - @{bin}/spacefm rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-a-f/cawbird b/apparmor.d/profiles-a-f/cawbird index ab2ac687c..0d8c6a000 100644 --- a/apparmor.d/profiles-a-f/cawbird +++ b/apparmor.d/profiles-a-f/cawbird @@ -31,8 +31,12 @@ profile cawbird @{exec_path} { @{sh_path} rix, - @{bin}/xdg-open rCx -> open, - @{bin}/exo-open rCx -> open, + @{open_path} rPx -> child-open, + + /usr/share/xml/iso-codes/{,**} r, + + /var/lib/dbus/machine-id r, + /etc/machine-id r, owner @{user_config_dirs}/cawbird/ rw, owner @{user_config_dirs}/cawbird/** rwk, @@ -40,36 +44,8 @@ profile cawbird @{exec_path} { owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/cawbird-* rw, - /usr/share/xml/iso-codes/{,**} r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - owner @{PROC}/@{pid}/fd/ r, - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-a-f/czkawka-gui b/apparmor.d/profiles-a-f/czkawka-gui index 30dc56b29..d7bb93f41 100644 --- a/apparmor.d/profiles-a-f/czkawka-gui +++ b/apparmor.d/profiles-a-f/czkawka-gui @@ -18,7 +18,7 @@ profile czkawka-gui @{exec_path} { @{exec_path} mr, - @{bin}/xdg-open rCx -> open, + @{open_path} rPx -> child-open, # Dirs to scan for duplicates #owner @{HOME}/** rw, @@ -38,32 +38,6 @@ profile czkawka-gui @{exec_path} { @{sys}/fs/cgroup/{,**} r, - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - #@{lib}/firefox/firefox rPx, - @{bin}/smplayer rPx, - @{bin}/geany rPx, - @{bin}/viewnior rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-a-f/deltachat-desktop b/apparmor.d/profiles-a-f/deltachat-desktop index b3afbfc09..4f60099a9 100644 --- a/apparmor.d/profiles-a-f/deltachat-desktop +++ b/apparmor.d/profiles-a-f/deltachat-desktop @@ -7,13 +7,9 @@ abi , include -@{DCD_LIBDIR} = @{lib}/deltachat-desktop -@{DCD_LIBDIR} += @{lib}/deltachat -@{DCD_LIBDIR} += /opt/DeltaChat/ +@{lib_dirs} = @{lib}/deltachat-desktop @{lib}/deltachat /opt/DeltaChat/ -@{exec_path} = /usr/bin/deltachat-desktop -@{exec_path} += /opt/DeltaChat/deltachat-desktop -#@{exec_path} += @{DCD_LIBDIR}/deltachat-desktop +@{exec_path} = @{bin}/deltachat-desktop @{lib_dirs}/deltachat-desktop profile deltachat-desktop @{exec_path} { include include @@ -35,15 +31,18 @@ profile deltachat-desktop @{exec_path} { @{exec_path} mrix, - @{DCD_LIBDIR}/ r, - @{DCD_LIBDIR}/** r, - @{DCD_LIBDIR}/libffmpeg.so mr, - @{DCD_LIBDIR}/{swiftshader/,}libGLESv2.so mr, - @{DCD_LIBDIR}/{swiftshader/,}libEGL.so mr, - @{DCD_LIBDIR}/resources/app.asar.unpacked/node_modules/**.node mr, - @{DCD_LIBDIR}/resources/app.asar.unpacked/node_modules/**.so mr, - @{DCD_LIBDIR}/resources/app.asar.unpacked/node_modules/**.so.[0-9]* mr, - @{DCD_LIBDIR}/chrome-sandbox rPx, + @{lib_dirs}/ r, + @{lib_dirs}/** r, + @{lib_dirs}/libffmpeg.so mr, + @{lib_dirs}/{swiftshader/,}libGLESv2.so mr, + @{lib_dirs}/{swiftshader/,}libEGL.so mr, + @{lib_dirs}/resources/app.asar.unpacked/node_modules/**.node mr, + @{lib_dirs}/resources/app.asar.unpacked/node_modules/**.so mr, + @{lib_dirs}/resources/app.asar.unpacked/node_modules/**.so.[0-9]* mr, + @{lib_dirs}/chrome-sandbox rPx, + + @{bin}/xdg-settings rPx, + @{open_path} rPx -> child-open-browsers, owner @{user_config_dirs}/DeltaChat/ rw, owner @{user_config_dirs}/DeltaChat/** rwk, @@ -53,58 +52,24 @@ profile deltachat-desktop @{exec_path} { owner @{tmp}/@{hex}/db.sqlite rwk, owner @{tmp}/@{hex}/db.sqlite-journal rw, - @{PROC}/ r, - owner @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pids}/task/ r, - @{PROC}/@{pids}/task/@{tid}/status r, - @{PROC}/@{pids}/stat r, - owner @{PROC}/@{pids}/statm r, - deny owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pids}/oom_{,score_}adj r, - deny owner @{PROC}/@{pids}/oom_{,score_}adj w, - owner @{PROC}/@{pid}/cgroup r, - @{PROC}/sys/kernel/yama/ptrace_scope r, - @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/ r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/task/ r, + @{PROC}/@{pid}/task/@{tid}/status r, + @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/sys/kernel/yama/ptrace_scope r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/oom_{,score_}adj rw, + owner @{PROC}/@{pid}/statm r, - /dev/ r, + /dev/ r, # (#FIXME#) deny @{sys}/bus/pci/devices/ r, - deny @{sys}/devices/virtual/tty/tty@{int}/active r, - # no new privs - @{bin}/xdg-settings rPx, - - @{bin}/xdg-open rCx -> open, - - # Allowed apps to open - @{lib}/firefox/firefox rPx, - - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-a-f/deluser b/apparmor.d/profiles-a-f/deluser index 540079175..eac7429bf 100644 --- a/apparmor.d/profiles-a-f/deluser +++ b/apparmor.d/profiles-a-f/deluser @@ -14,24 +14,18 @@ profile deluser @{exec_path} { include include - # The deluser command is issued as root and its task is to delete regular user accounts. It - # optionally can remove user files (via --remove-home or --remove-all-files) or create a backup. - # Because of that, the deluser command needs the following CAPs to be able to do so. capability dac_read_search, capability dac_override, @{exec_path} r, @{bin}/perl r, - @{sh_path} rix, - - @{bin}/userdel rPx, + @{sh_path} rix, + @{bin}/crontab rPx, + @{bin}/gpasswd rPx, @{bin}/groupdel rPx, - @{bin}/gpasswd rPx, - - @{bin}/crontab rPx, - - @{bin}/mount rCx -> mount, + @{bin}/mount rCx -> mount, + @{bin}/userdel rPx, /etc/adduser.conf r, /etc/deluser.conf r, @@ -45,7 +39,6 @@ profile deluser @{exec_path} { / r, /** rw, - profile mount { include diff --git a/apparmor.d/profiles-g-l/gtk-youtube-viewer b/apparmor.d/profiles-g-l/gtk-youtube-viewer index 18c3bd445..029e542ee 100644 --- a/apparmor.d/profiles-g-l/gtk-youtube-viewer +++ b/apparmor.d/profiles-g-l/gtk-youtube-viewer @@ -40,8 +40,7 @@ profile gtk-youtube-viewer @{exec_path} { @{lib}/firefox/firefox rPx, - @{bin}/xdg-open rCx -> open, - @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, + @{open_path} rPx -> child-open, owner @{user_config_dirs}/youtube-viewer/{,*} rw, @@ -91,30 +90,7 @@ profile gtk-youtube-viewer @{exec_path} { # file_inherit owner @{HOME}/.xsession-errors w, - } - - profile open { - include - include - - @{bin}/xdg-open mr, - @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/hardinfo b/apparmor.d/profiles-g-l/hardinfo index 79c77f3a7..f91887297 100644 --- a/apparmor.d/profiles-g-l/hardinfo +++ b/apparmor.d/profiles-g-l/hardinfo @@ -12,9 +12,7 @@ profile hardinfo @{exec_path} { include include include - include - include - include + include include include include @@ -49,7 +47,7 @@ profile hardinfo @{exec_path} { @{lib}/@{multiarch}/valgrind/memcheck-*-linux rix, @{bin}/lsb_release rPx -> lsb_release, - @{bin}/xdg-open rCx -> open, + @{open_path} rPx -> child-open, @{bin}/ccache rCx -> ccache, @{bin}/kmod rCx -> kmod, @@ -62,8 +60,22 @@ profile hardinfo @{exec_path} { @{lib}/jvm/java-[0-9]*-openjdk-amd64/bin/javac rCx -> javac, + /usr/share/gdb/python/ r, + /usr/share/gdb/python/** r, /usr/share/hardinfo/{,**} r, + /etc/fstab r, + /etc/exports r, + /etc/samba/smb.conf r, + + /etc/gdb/gdbinit.d/ r, + + /var/log/wtmp r, + + owner @{HOME}/.hardinfo/ rw, + + owner @{tmp}/#@{int} rw, + @{sys}/class/power_supply/ r, @{sys}/class/thermal/ r, @{sys}/bus/i2c/drivers/eeprom/ r, @@ -78,48 +90,27 @@ profile hardinfo @{exec_path} { @{sys}/devices/@{pci}/hwmon/hwmon@{int}/temp* r, @{sys}/devices/**/power_supply/** r, - @{PROC}/@{pid}/net/wireless r, - @{PROC}/@{pid}/net/dev r, @{PROC}/@{pid}/net/arp r, + @{PROC}/@{pid}/net/dev r, + @{PROC}/@{pid}/net/route r, + @{PROC}/@{pid}/net/wireless r, + @{PROC}/@{pids}/loginuid r, + @{PROC}/asound/cards r, + @{PROC}/bus/input/devices r, + @{PROC}/dma r, + @{PROC}/iomem r, + @{PROC}/ioports r, + @{PROC}/loadavg r, + @{PROC}/scsi/scsi r, + @{PROC}/sys/kernel/random/entropy_avail r, + @{PROC}/uptime r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, - @{PROC}/@{pids}/loginuid r, - @{PROC}/uptime r, - @{PROC}/loadavg r, - @{PROC}/ioports r, - @{PROC}/iomem r, - @{PROC}/dma r, - @{PROC}/asound/cards r, - @{PROC}/scsi/scsi r, - @{PROC}/bus/input/devices r, - @{PROC}/sys/kernel/random/entropy_avail r, - @{PROC}/@{pids}/net/route r, - /etc/fstab r, - /etc/exports r, - /etc/samba/smb.conf r, - - /etc/gdb/gdbinit.d/ r, - - /usr/share/gdb/python/ r, - /usr/share/gdb/python/** r, - - /var/log/wtmp r, - - owner @{HOME}/.hardinfo/ rw, - - owner @{tmp}/#@{int} rw, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # Silencer - deny /usr/share/gdb/python/** w, - - # file_inherit owner /dev/tty@{int} rw, + deny /usr/share/gdb/python/** w, profile ccache { include @@ -134,6 +125,7 @@ profile hardinfo @{exec_path} { /etc/debian_version r, + include if exists } profile javac { @@ -157,29 +149,7 @@ profile hardinfo @{exec_path} { owner @{tmp}/hsperfdata_@{user}/ rw, owner @{tmp}/hsperfdata_@{user}/@{pid} rw, - } - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - + include if exists } profile kmod { diff --git a/apparmor.d/profiles-m-r/mediainfo-gui b/apparmor.d/profiles-m-r/mediainfo-gui index 1d18d5187..5a723d002 100644 --- a/apparmor.d/profiles-m-r/mediainfo-gui +++ b/apparmor.d/profiles-m-r/mediainfo-gui @@ -19,29 +19,7 @@ profile mediainfo-gui @{exec_path} { @{exec_path} mr, - @{bin}/xdg-open rCx -> open, - - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - @{lib}/firefox/firefox rPx, - - owner @{HOME}/ r, - owner @{run}/user/@{uid}/ r, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } + @{open_path} rPx -> child-open-browsers, include if exists } diff --git a/apparmor.d/profiles-m-r/orage b/apparmor.d/profiles-m-r/orage index 39d9a35dd..f87c0fa92 100644 --- a/apparmor.d/profiles-m-r/orage +++ b/apparmor.d/profiles-m-r/orage @@ -21,9 +21,9 @@ profile orage @{exec_path} { @{bin}/globaltime rPx, - @{bin}/xdg-open rCx -> open, - @{bin}/exo-open rCx -> open, - @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, + @{open_path} rPx -> child-open, + + /etc/fstab r, owner @{user_config_dirs}/orage/ rw, owner @{user_config_dirs}/orage/* rw, @@ -35,38 +35,8 @@ profile orage @{exec_path} { owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, - /etc/fstab r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit owner /dev/tty@{int} rw, - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-m-r/quiterss b/apparmor.d/profiles-m-r/quiterss index 05de0d490..89395f8b5 100644 --- a/apparmor.d/profiles-m-r/quiterss +++ b/apparmor.d/profiles-m-r/quiterss @@ -10,22 +10,16 @@ include @{exec_path} = @{bin}/quiterss profile quiterss @{exec_path} { include - include - include - include - include - include - include - include - include - include - include - include - include - include - include - include include + include + include + include + include + include + include + include + include + include network inet dgram, network inet6 dgram, @@ -36,9 +30,14 @@ profile quiterss @{exec_path} { @{exec_path} mr, - @{bin}/xdg-open rCx -> open, + @{open_path} rPx -> child-open, /usr/share/quiterss/** r, + + /etc/fstab r, + /etc/machine-id r, + /var/lib/dbus/machine-id r, + owner @{user_config_dirs}/QuiteRss/ rw, owner @{user_config_dirs}/QuiteRss/** rwkl -> @{user_config_dirs}/QuiteRss/**, owner @{user_share_dirs}/QuiteRss/ rw, @@ -46,55 +45,20 @@ profile quiterss @{exec_path} { owner @{user_cache_dirs}/QuiteRss/ rw, owner @{user_cache_dirs}/QuiteRss/** rwl -> @{user_cache_dirs}/QuiteRss/**, - owner @{PROC}/@{pid}/fd/ r, - deny @{PROC}/sys/kernel/random/boot_id r, - deny owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - - /etc/fstab r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - /usr/share/hwdata/pnp.ids r, - - /dev/shm/#@{int} rw, - owner @{tmp}/qtsingleapp-quiter-@{int}-@{int} rw, owner @{tmp}/qtsingleapp-quiter-@{int}-@{int}-lockfile rwk, owner /var/tmp/etilqs_@{hex16} rw, - # Allowed apps to open - @{lib}/firefox/firefox rPUx, + @{PROC}/sys/kernel/random/boot_id r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + + /dev/shm/#@{int} rw, - # file_inherit owner /dev/tty@{int} rw, - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-s-z/smtube b/apparmor.d/profiles-s-z/smtube index bbb404c8f..c318328b6 100644 --- a/apparmor.d/profiles-s-z/smtube +++ b/apparmor.d/profiles-s-z/smtube @@ -68,38 +68,11 @@ profile smtube @{exec_path} { @{bin}/youtube-dl rPUx, @{bin}/yt-dlp rPUx, - @{bin}/xdg-open rCx -> open, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, + @{open_path} rPx -> child-open, # file_inherit owner /dev/tty@{int} rw, - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-s-z/udiskie b/apparmor.d/profiles-s-z/udiskie index 6105c7dae..014955032 100644 --- a/apparmor.d/profiles-s-z/udiskie +++ b/apparmor.d/profiles-s-z/udiskie @@ -26,7 +26,9 @@ profile udiskie @{exec_path} { @{bin}/python3.@{int} r, @{bin}/ r, - @{bin}/xdg-open rCx -> open, + @{open_path} rPx -> child-open, + + /etc/fstab r, owner @{user_config_dirs}/udiskie/ r, owner @{user_config_dirs}/udiskie/config.yml r, @@ -35,37 +37,9 @@ profile udiskie @{exec_path} { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mountinfo r, - /etc/fstab r, - - # Allowed apps to open - @{bin}/spacefm rPx, - # Silencer deny @{lib}/** w, - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{bin}/spacefm rPx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } diff --git a/apparmor.d/profiles-s-z/xarchiver b/apparmor.d/profiles-s-z/xarchiver index 514ea5c36..9f87e3b9d 100644 --- a/apparmor.d/profiles-s-z/xarchiver +++ b/apparmor.d/profiles-s-z/xarchiver @@ -42,7 +42,9 @@ profile xarchiver @{exec_path} { # For deb packages @{bin}/{,@{multiarch}-}ar rix, - @{bin}/xdg-open rCx -> open, + @{path_open} rPx -> child-open, + + /etc/fstab r, owner @{user_config_dirs}/xarchiver/ rw, owner @{user_config_dirs}/xarchiver/xarchiverrc{,.*} rw, @@ -58,46 +60,12 @@ profile xarchiver @{exec_path} { /tmp/ r, owner @{tmp}/** rw, - owner @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/fd/ r, - /etc/fstab r, - - # Allowed apps to open - @{bin}/engrampa rPUx, - @{bin}/geany rPUx, - @{bin}/viewnior rPUx, - - # file_inherit owner /dev/tty@{int} rw, - - profile open { - include - include - - @{bin}/xdg-open mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{bin}/engrampa rPUx, - @{bin}/geany rPUx, - @{bin}/viewnior rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - include if exists } From 7ccaab823425208639ba1bbd89c550349668bcdf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 15:57:47 +0100 Subject: [PATCH 0303/1455] chore(profile): add abi and local include when missing. --- apparmor.d/groups/apt/apt-key | 2 +- apparmor.d/groups/apt/debconf-apt-progress | 1 + apparmor.d/groups/apt/dpkg-architecture | 1 + apparmor.d/groups/cron/cron | 2 +- apparmor.d/groups/cron/cron-apt-listbugs | 1 + apparmor.d/groups/cron/cron-debsums | 1 + apparmor.d/groups/cron/cron-popularity-contest | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-icon | 2 +- apparmor.d/groups/gnome/gdm-prime-defaut | 2 +- apparmor.d/groups/network/openvpn | 2 ++ apparmor.d/groups/pacman/yay | 2 +- apparmor.d/groups/ssh/ssh-sk-helper | 2 ++ apparmor.d/groups/systemd/journalctl | 2 +- apparmor.d/groups/systemd/systemd-resolved | 2 +- .../{systemd-sleep-grub2 => systemd-sleep-grub} | 0 apparmor.d/groups/ubuntu/subiquity-console-conf | 1 + apparmor.d/groups/ubuntu/ubuntu-advantage | 1 + apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot | 1 + apparmor.d/groups/virt/libvirtd | 2 ++ apparmor.d/groups/whonix/whonix-firewalld | 4 ++-- apparmor.d/groups/xfce/xfce-panel | 2 +- apparmor.d/profiles-a-f/acpi-powerbtn | 2 ++ apparmor.d/profiles-a-f/adequate | 3 +++ apparmor.d/profiles-a-f/anacron | 2 +- apparmor.d/profiles-a-f/archivemount | 2 +- apparmor.d/profiles-a-f/aspell-autobuildhash | 1 + apparmor.d/profiles-a-f/changestool | 1 + apparmor.d/profiles-a-f/check-support-status | 2 +- apparmor.d/profiles-a-f/check-support-status-hook | 4 ++++ apparmor.d/profiles-a-f/chpasswd | 2 ++ apparmor.d/profiles-a-f/claws-mail | 1 + apparmor.d/profiles-a-f/conky | 1 + apparmor.d/profiles-a-f/cupsd | 2 ++ apparmor.d/profiles-a-f/deluser | 1 + apparmor.d/profiles-a-f/dhclient-script | 1 + apparmor.d/profiles-a-f/dlocate | 2 +- apparmor.d/profiles-a-f/etckeeper | 1 + apparmor.d/profiles-a-f/execute-dput | 1 + apparmor.d/profiles-a-f/frontend | 1 + apparmor.d/profiles-a-f/fuseiso | 1 + apparmor.d/profiles-a-f/fwupdmgr | 2 +- apparmor.d/profiles-g-l/gpartedbin | 2 +- apparmor.d/profiles-g-l/i3lock-fancy | 1 + apparmor.d/profiles-g-l/ifup | 1 + apparmor.d/profiles-g-l/{imv-wayland => imv} | 2 +- apparmor.d/profiles-g-l/initd-kexec-load | 2 ++ apparmor.d/profiles-g-l/jmtpfs | 1 + apparmor.d/profiles-g-l/linux-check-removal | 1 + apparmor.d/profiles-m-r/murmurd | 2 ++ apparmor.d/profiles-m-r/obexfs | 1 + apparmor.d/profiles-m-r/pam-auth-update | 1 + apparmor.d/profiles-m-r/reprepro | 2 +- apparmor.d/profiles-m-r/run-parts | 3 +++ apparmor.d/profiles-s-z/sensors-detect | 2 +- apparmor.d/profiles-s-z/tasksel | 3 ++- apparmor.d/profiles-s-z/update-dlocatedb | 1 + apparmor.d/profiles-s-z/update-pciids | 1 + apparmor.d/profiles-s-z/update-smart-drivedb | 2 ++ apparmor.d/profiles-s-z/uupdate | 2 +- apparmor.d/profiles-s-z/yadifad | 2 ++ apparmor.d/profiles-s-z/youtube-viewer | 12 ++++++------ 61 files changed, 84 insertions(+), 28 deletions(-) rename apparmor.d/groups/systemd/{systemd-sleep-grub2 => systemd-sleep-grub} (100%) rename apparmor.d/profiles-g-l/{imv-wayland => imv} (94%) diff --git a/apparmor.d/groups/apt/apt-key b/apparmor.d/groups/apt/apt-key index 25a53282d..f73df39d1 100644 --- a/apparmor.d/groups/apt/apt-key +++ b/apparmor.d/groups/apt/apt-key @@ -102,7 +102,7 @@ profile apt-key @{exec_path} { owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - include if exists + include if exists } include if exists diff --git a/apparmor.d/groups/apt/debconf-apt-progress b/apparmor.d/groups/apt/debconf-apt-progress index 7b80201df..4ddcca5ca 100644 --- a/apparmor.d/groups/apt/debconf-apt-progress +++ b/apparmor.d/groups/apt/debconf-apt-progress @@ -46,6 +46,7 @@ profile debconf-apt-progress @{exec_path} flags=(complain) { /etc/shadow r, + include if exists } include if exists diff --git a/apparmor.d/groups/apt/dpkg-architecture b/apparmor.d/groups/apt/dpkg-architecture index e5ccb2f89..a58257271 100644 --- a/apparmor.d/groups/apt/dpkg-architecture +++ b/apparmor.d/groups/apt/dpkg-architecture @@ -45,6 +45,7 @@ profile dpkg-architecture @{exec_path} { /etc/debian_version r, + include if exists } include if exists diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 61dce67db..7db10924c 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -74,7 +74,7 @@ profile cron @{exec_path} flags=(attach_disconnected) { owner @{tmp}/#@{int} rw, - include if exists + include if exists } include if exists diff --git a/apparmor.d/groups/cron/cron-apt-listbugs b/apparmor.d/groups/cron/cron-apt-listbugs index f2623dbf4..1b3f40d87 100644 --- a/apparmor.d/groups/cron/cron-apt-listbugs +++ b/apparmor.d/groups/cron/cron-apt-listbugs @@ -33,6 +33,7 @@ profile cron-apt-listbugs @{exec_path} { /var/spool/apt-listbugs/lastprefclean rw, + include if exists } include if exists diff --git a/apparmor.d/groups/cron/cron-debsums b/apparmor.d/groups/cron/cron-debsums index 33e785ee0..5a7adf141 100644 --- a/apparmor.d/groups/cron/cron-debsums +++ b/apparmor.d/groups/cron/cron-debsums @@ -43,6 +43,7 @@ profile cron-debsums @{exec_path} { owner @{PROC}/@{pid}/fd/3 rw, + include if exists } include if exists diff --git a/apparmor.d/groups/cron/cron-popularity-contest b/apparmor.d/groups/cron/cron-popularity-contest index a1247a0b9..dd50a7494 100644 --- a/apparmor.d/groups/cron/cron-popularity-contest +++ b/apparmor.d/groups/cron/cron-popularity-contest @@ -152,7 +152,7 @@ profile cron-popularity-contest @{exec_path} { owner @{tmp}/#@{int} rw, # file_inherit - include if exists + include if exists } include if exists diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-icon b/apparmor.d/groups/freedesktop/xdg-desktop-icon index 0d8512b5c..ba699bdbd 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-icon +++ b/apparmor.d/groups/freedesktop/xdg-desktop-icon @@ -39,7 +39,7 @@ profile xdg-desktop-icon @{exec_path} { include include include - include if exists + include if exists } include if exists diff --git a/apparmor.d/groups/gnome/gdm-prime-defaut b/apparmor.d/groups/gnome/gdm-prime-defaut index b5b111604..189e166f2 100644 --- a/apparmor.d/groups/gnome/gdm-prime-defaut +++ b/apparmor.d/groups/gnome/gdm-prime-defaut @@ -7,7 +7,7 @@ abi , include @{exec_path} = /etc/gdm{3,}/{Init,Prime}/Default -profile gdm-defaut @{exec_path} flags=(complain) { +profile gdm-prime-defaut @{exec_path} flags=(complain) { include @{exec_path} mr, diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index 3e6a1cb55..532c65f78 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -90,6 +90,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { /etc/iproute2/rt_tables r, /etc/iproute2/rt_tables.d/ r, + include if exists } profile force-user-traffic-via-vpn { @@ -121,6 +122,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { owner @{PROC}/sys/net/ipv{4,}/route/flush w, + include if exists } include if exists diff --git a/apparmor.d/groups/pacman/yay b/apparmor.d/groups/pacman/yay index 32ac11d7e..c737d4caa 100644 --- a/apparmor.d/groups/pacman/yay +++ b/apparmor.d/groups/pacman/yay @@ -60,7 +60,7 @@ profile yay @{exec_path} { owner @{user_cache_dirs}/yay/** rwlk -> @{user_cache_dirs}/yay/**, owner @{user_config_dirs}/git/{,*} r, - include if exists + include if exists } profile editor { diff --git a/apparmor.d/groups/ssh/ssh-sk-helper b/apparmor.d/groups/ssh/ssh-sk-helper index defa9ac1b..d913e2a2d 100644 --- a/apparmor.d/groups/ssh/ssh-sk-helper +++ b/apparmor.d/groups/ssh/ssh-sk-helper @@ -2,6 +2,8 @@ # Copyright (C) 2024 valoq # SPDX-License-Identifier: GPL-2.0-only +abi , + include @{exec_path} = @{lib}/ssh/ssh-sk-helper diff --git a/apparmor.d/groups/systemd/journalctl b/apparmor.d/groups/systemd/journalctl index 6020f60fa..3c5595345 100644 --- a/apparmor.d/groups/systemd/journalctl +++ b/apparmor.d/groups/systemd/journalctl @@ -55,7 +55,7 @@ profile journalctl @{exec_path} flags=(attach_disconnected) { deny network inet stream, deny network inet6 stream, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd/systemd-resolved b/apparmor.d/groups/systemd/systemd-resolved index ff5a98134..9b6bfdd94 100644 --- a/apparmor.d/groups/systemd/systemd-resolved +++ b/apparmor.d/groups/systemd/systemd-resolved @@ -50,7 +50,7 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/kernel/hostname r, @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd/systemd-sleep-grub2 b/apparmor.d/groups/systemd/systemd-sleep-grub similarity index 100% rename from apparmor.d/groups/systemd/systemd-sleep-grub2 rename to apparmor.d/groups/systemd/systemd-sleep-grub diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index 1b04bd383..58323b8ff 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -109,6 +109,7 @@ profile subiquity-console-conf @{exec_path} { /var/lib/dbus/machine-id r, /etc/machine-id r, + include if exists } include if exists diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index 92b9deef7..abbde2455 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -87,6 +87,7 @@ profile ubuntu-advantage @{exec_path} { /dev/kmsg w, + include if exists } include if exists diff --git a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot index 7fb3a2b29..86ac61f41 100644 --- a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot +++ b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot @@ -45,6 +45,7 @@ profile update-motd-fsck-at-reboot @{exec_path} { /dev/tty@{int} rw, + include if exists } include if exists diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index f6519a619..e1aa55d57 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -290,6 +290,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pids}/status r, /dev/net/tun rw, + + include if exists } include if exists diff --git a/apparmor.d/groups/whonix/whonix-firewalld b/apparmor.d/groups/whonix/whonix-firewalld index f0f8f5d46..01e1cb418 100644 --- a/apparmor.d/groups/whonix/whonix-firewalld +++ b/apparmor.d/groups/whonix/whonix-firewalld @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/whonix_firewall @{lib}/whonix-firewall/reloadfirewall -profile whonix-firewall @{exec_path} { +profile whonix-firewalld @{exec_path} { include include include @@ -45,7 +45,7 @@ profile whonix-firewall @{exec_path} { owner @{run}/updatesproxycheck/{,**} rw, owner @{run}/whonix_firewall/{,**} rw, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/groups/xfce/xfce-panel b/apparmor.d/groups/xfce/xfce-panel index 3c91e7893..7b192ffc5 100644 --- a/apparmor.d/groups/xfce/xfce-panel +++ b/apparmor.d/groups/xfce/xfce-panel @@ -48,7 +48,7 @@ profile xfce-panel @{exec_path} { @{bin}/lsblk rPx, - include if exists + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/acpi-powerbtn b/apparmor.d/profiles-a-f/acpi-powerbtn index 2a87bdb85..c25d94526 100644 --- a/apparmor.d/profiles-a-f/acpi-powerbtn +++ b/apparmor.d/profiles-a-f/acpi-powerbtn @@ -43,6 +43,8 @@ profile acpi-powerbtn flags=(attach_disconnected) { /dev/tty rw, owner /dev/tty@{int} rw, + + include if exists } profile bus flags=(complain) { diff --git a/apparmor.d/profiles-a-f/adequate b/apparmor.d/profiles-a-f/adequate index 404a09840..6f2e1d5c7 100644 --- a/apparmor.d/profiles-a-f/adequate +++ b/apparmor.d/profiles-a-f/adequate @@ -64,6 +64,7 @@ profile adequate @{exec_path} flags=(complain) { @{lib}/@{multiarch}/ld-*.so rix, @{lib}{,x}32/ld-*.so rix, + include if exists } profile frontend flags=(complain) { @@ -98,6 +99,7 @@ profile adequate @{exec_path} flags=(complain) { /etc/shadow r, + include if exists } profile pkg-config flags=(complain) { @@ -105,6 +107,7 @@ profile adequate @{exec_path} flags=(complain) { @{bin}/pkg-config mr, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/anacron b/apparmor.d/profiles-a-f/anacron index 06c50aee3..3e7c9d092 100644 --- a/apparmor.d/profiles-a-f/anacron +++ b/apparmor.d/profiles-a-f/anacron @@ -39,7 +39,7 @@ profile anacron @{exec_path} { owner @{tmp}/#@{int} rw, owner @{tmp}/file@{rand6} rw, - include if exists + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/archivemount b/apparmor.d/profiles-a-f/archivemount index 6489139d9..64f25e181 100644 --- a/apparmor.d/profiles-a-f/archivemount +++ b/apparmor.d/profiles-a-f/archivemount @@ -29,7 +29,6 @@ profile archivemount @{exec_path} { /dev/fuse rw, - profile fusermount { include include @@ -52,6 +51,7 @@ profile archivemount @{exec_path} { @{PROC}/@{pid}/mounts r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/aspell-autobuildhash b/apparmor.d/profiles-a-f/aspell-autobuildhash index 9920fb2b3..769f15cf0 100644 --- a/apparmor.d/profiles-a-f/aspell-autobuildhash +++ b/apparmor.d/profiles-a-f/aspell-autobuildhash @@ -69,6 +69,7 @@ profile aspell-autobuildhash @{exec_path} flags=(complain) { owner @{PROC}/@{pid}/mounts r, @{HOME}/.Xauthority r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/changestool b/apparmor.d/profiles-a-f/changestool index 6ff8ed55d..c73243041 100644 --- a/apparmor.d/profiles-a-f/changestool +++ b/apparmor.d/profiles-a-f/changestool @@ -33,6 +33,7 @@ profile changestool @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/ r, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/check-support-status b/apparmor.d/profiles-a-f/check-support-status index 1a1d4bfd6..313fa6c54 100644 --- a/apparmor.d/profiles-a-f/check-support-status +++ b/apparmor.d/profiles-a-f/check-support-status @@ -65,7 +65,6 @@ profile check-support-status @{exec_path} { /usr/share/debian-security-support/ r, /usr/share/debian-security-support/* r, - profile debconf-escape { include include @@ -75,6 +74,7 @@ profile check-support-status @{exec_path} { owner @{tmp}/debian-security-support.postinst.*/output r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/check-support-status-hook b/apparmor.d/profiles-a-f/check-support-status-hook index b77bcfd6d..5eb0eda0f 100644 --- a/apparmor.d/profiles-a-f/check-support-status-hook +++ b/apparmor.d/profiles-a-f/check-support-status-hook @@ -58,6 +58,7 @@ profile check-support-status-hook @{exec_path} { /tmp/ r, owner @{tmp}/debian-security-support.postinst.*/output r, + include if exists } profile frontend { @@ -90,6 +91,7 @@ profile check-support-status-hook @{exec_path} { owner @{PROC}/@{pid}/mounts r, @{HOME}/.Xauthority r, + include if exists } profile runuser { @@ -124,6 +126,8 @@ profile check-support-status-hook @{exec_path} { /tmp/ r, owner @{tmp}/debian-security-support.postinst.*/output w, + + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/chpasswd b/apparmor.d/profiles-a-f/chpasswd index 1fd84f53c..fb8438cc1 100644 --- a/apparmor.d/profiles-a-f/chpasswd +++ b/apparmor.d/profiles-a-f/chpasswd @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +abi , + include @{exec_path} = @{bin}/chpasswd diff --git a/apparmor.d/profiles-a-f/claws-mail b/apparmor.d/profiles-a-f/claws-mail index 82387d044..7c5486c50 100644 --- a/apparmor.d/profiles-a-f/claws-mail +++ b/apparmor.d/profiles-a-f/claws-mail @@ -66,6 +66,7 @@ profile claws-mail @{exec_path} flags=(complain) { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/conky b/apparmor.d/profiles-a-f/conky index 9116a116e..3c059abcf 100644 --- a/apparmor.d/profiles-a-f/conky +++ b/apparmor.d/profiles-a-f/conky @@ -200,6 +200,7 @@ profile conky @{exec_path} { deny @{PROC}/@{pid}/net/route r, deny @{sys}/devices/**/hwmon/**/temp*_input r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/cupsd b/apparmor.d/profiles-a-f/cupsd index 9511c7495..ac9984746 100644 --- a/apparmor.d/profiles-a-f/cupsd +++ b/apparmor.d/profiles-a-f/cupsd @@ -2,6 +2,8 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +abi , + include @{exec_path} = @{bin}/cupsd diff --git a/apparmor.d/profiles-a-f/deluser b/apparmor.d/profiles-a-f/deluser index eac7429bf..1f2e86579 100644 --- a/apparmor.d/profiles-a-f/deluser +++ b/apparmor.d/profiles-a-f/deluser @@ -48,6 +48,7 @@ profile deluser @{exec_path} { @{sys}/devices/virtual/block/**/name r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script index 1552ee0e4..b650498cf 100644 --- a/apparmor.d/profiles-a-f/dhclient-script +++ b/apparmor.d/profiles-a-f/dhclient-script @@ -77,6 +77,7 @@ profile dhclient-script @{exec_path} { # file_inherit owner /var/lib/dhcp/dhclient.leases r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/dlocate b/apparmor.d/profiles-a-f/dlocate index ff042c321..9f78af639 100644 --- a/apparmor.d/profiles-a-f/dlocate +++ b/apparmor.d/profiles-a-f/dlocate @@ -49,7 +49,6 @@ profile dlocate @{exec_path} { / r, - profile md5sum { include @@ -59,6 +58,7 @@ profile dlocate @{exec_path} { /boot/** r, /usr/** r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/etckeeper b/apparmor.d/profiles-a-f/etckeeper index d42b07dee..023d13b47 100644 --- a/apparmor.d/profiles-a-f/etckeeper +++ b/apparmor.d/profiles-a-f/etckeeper @@ -73,6 +73,7 @@ profile etckeeper @{exec_path} { owner @{PROC}/@{pid}/fd/ r, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/execute-dput b/apparmor.d/profiles-a-f/execute-dput index 915213dac..0decde05c 100644 --- a/apparmor.d/profiles-a-f/execute-dput +++ b/apparmor.d/profiles-a-f/execute-dput @@ -46,6 +46,7 @@ profile execute-dput @{exec_path} flags=(complain) { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/frontend b/apparmor.d/profiles-a-f/frontend index 51bfc3610..ac8a6a5a8 100644 --- a/apparmor.d/profiles-a-f/frontend +++ b/apparmor.d/profiles-a-f/frontend @@ -121,6 +121,7 @@ profile frontend @{exec_path} flags=(complain) { /tmp/ r, owner @{tmp}/** rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/fuseiso b/apparmor.d/profiles-a-f/fuseiso index 330a8b07e..ed2bcc936 100644 --- a/apparmor.d/profiles-a-f/fuseiso +++ b/apparmor.d/profiles-a-f/fuseiso @@ -58,6 +58,7 @@ profile fuseiso @{exec_path} { /dev/fuse rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 382822fab..1ec9fe657 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -54,7 +54,7 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected) { profile bus flags=(attach_disconnected) { include include - include if exists + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/gpartedbin b/apparmor.d/profiles-g-l/gpartedbin index e6f32d27c..6cc77b9bc 100644 --- a/apparmor.d/profiles-g-l/gpartedbin +++ b/apparmor.d/profiles-g-l/gpartedbin @@ -94,7 +94,7 @@ profile gpartedbin @{exec_path} { @{bin}/mount mr, - include if exists + include if exists } profile umount { diff --git a/apparmor.d/profiles-g-l/i3lock-fancy b/apparmor.d/profiles-g-l/i3lock-fancy index 242c43de5..78c5081d6 100644 --- a/apparmor.d/profiles-g-l/i3lock-fancy +++ b/apparmor.d/profiles-g-l/i3lock-fancy @@ -67,6 +67,7 @@ profile i3lock-fancy @{exec_path} { # file_inherit owner /dev/tty@{int} rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/ifup b/apparmor.d/profiles-g-l/ifup index 7df4e5ea6..c800267c7 100644 --- a/apparmor.d/profiles-g-l/ifup +++ b/apparmor.d/profiles-g-l/ifup @@ -92,6 +92,7 @@ profile ifup @{exec_path} { /etc/network/if-up.d/openvpn rPUx, /etc/network/if-up.d/wpasupplicant rPUx, + include if exists } profile kmod { diff --git a/apparmor.d/profiles-g-l/imv-wayland b/apparmor.d/profiles-g-l/imv similarity index 94% rename from apparmor.d/profiles-g-l/imv-wayland rename to apparmor.d/profiles-g-l/imv index d83945934..f75e4c957 100644 --- a/apparmor.d/profiles-g-l/imv-wayland +++ b/apparmor.d/profiles-g-l/imv @@ -25,7 +25,7 @@ profile imv @{exec_path} { owner @{run}/user/@{uid}/imv-*.sock w, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/initd-kexec-load b/apparmor.d/profiles-g-l/initd-kexec-load index eb5b6ead1..1b27d1a4e 100644 --- a/apparmor.d/profiles-g-l/initd-kexec-load +++ b/apparmor.d/profiles-g-l/initd-kexec-load @@ -48,6 +48,7 @@ profile initd-kexec-load @{exec_path} { /etc/default/kexec.d/ r, + include if exists } profile systemctl { @@ -74,6 +75,7 @@ profile initd-kexec-load @{exec_path} { owner @{run}/systemd/ask-password/ rw, owner @{run}/systemd/ask-password-block/* rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/jmtpfs b/apparmor.d/profiles-g-l/jmtpfs index 57ab39a75..eb51b1239 100644 --- a/apparmor.d/profiles-g-l/jmtpfs +++ b/apparmor.d/profiles-g-l/jmtpfs @@ -58,6 +58,7 @@ profile jmtpfs @{exec_path} { @{PROC}/@{pid}/mounts r, + include if exists } include if exists diff --git a/apparmor.d/profiles-g-l/linux-check-removal b/apparmor.d/profiles-g-l/linux-check-removal index 9854fd554..a0c184032 100644 --- a/apparmor.d/profiles-g-l/linux-check-removal +++ b/apparmor.d/profiles-g-l/linux-check-removal @@ -46,6 +46,7 @@ profile linux-check-removal @{exec_path} flags=(complain) { owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, /usr/share/debconf/templates/adequate.templates r, + include if exists } include if exists diff --git a/apparmor.d/profiles-m-r/murmurd b/apparmor.d/profiles-m-r/murmurd index aca74e562..9d7663ebb 100644 --- a/apparmor.d/profiles-m-r/murmurd +++ b/apparmor.d/profiles-m-r/murmurd @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +abi , + include @{exec_path} = @{bin}/murmurd diff --git a/apparmor.d/profiles-m-r/obexfs b/apparmor.d/profiles-m-r/obexfs index 07eb4a20d..5a9d0dfbf 100644 --- a/apparmor.d/profiles-m-r/obexfs +++ b/apparmor.d/profiles-m-r/obexfs @@ -48,6 +48,7 @@ profile obexfs @{exec_path} { @{PROC}/@{pid}/mounts r, + include if exists } include if exists diff --git a/apparmor.d/profiles-m-r/pam-auth-update b/apparmor.d/profiles-m-r/pam-auth-update index e9da3686d..e2846f8e6 100644 --- a/apparmor.d/profiles-m-r/pam-auth-update +++ b/apparmor.d/profiles-m-r/pam-auth-update @@ -60,6 +60,7 @@ profile pam-auth-update @{exec_path} flags=(complain) { /etc/shadow r, + include if exists } include if exists diff --git a/apparmor.d/profiles-m-r/reprepro b/apparmor.d/profiles-m-r/reprepro index 7710953b8..866b7cbfa 100644 --- a/apparmor.d/profiles-m-r/reprepro +++ b/apparmor.d/profiles-m-r/reprepro @@ -55,7 +55,6 @@ profile reprepro @{exec_path} { owner @{user_build_dirs}/pbuilder/result/*.deb r, owner @{user_build_dirs}/pbuilder/result/*.tar.* r, - profile gpg { include @@ -66,6 +65,7 @@ profile reprepro @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, + include if exists } include if exists diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 1347ca211..69e8c4d0d 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -191,6 +191,8 @@ profile run-parts @{exec_path} { @{PROC}/@{pids}/mounts r, /dev/tty@{int} rw, + + include if exists } profile kernel { @@ -248,6 +250,7 @@ profile run-parts @{exec_path} { @{PROC}/devices r, @{PROC}/cmdline r, + include if exists } include if exists diff --git a/apparmor.d/profiles-s-z/sensors-detect b/apparmor.d/profiles-s-z/sensors-detect index ea81f6593..b781ae1d0 100644 --- a/apparmor.d/profiles-s-z/sensors-detect +++ b/apparmor.d/profiles-s-z/sensors-detect @@ -50,7 +50,7 @@ profile sensors-detect @{exec_path} { include include - include if exists + include if exists } profile systemctl { diff --git a/apparmor.d/profiles-s-z/tasksel b/apparmor.d/profiles-s-z/tasksel index 9073591f5..bc2779d51 100644 --- a/apparmor.d/profiles-s-z/tasksel +++ b/apparmor.d/profiles-s-z/tasksel @@ -40,13 +40,13 @@ profile tasksel @{exec_path} flags=(complain) { owner @{tmp}/file* w, - profile tasksel-tests flags=(complain) { include @{lib}/tasksel/tests/* r, @{sh_path} rix, + include if exists } profile frontend flags=(complain) { @@ -76,6 +76,7 @@ profile tasksel @{exec_path} flags=(complain) { /etc/shadow r, + include if exists } include if exists diff --git a/apparmor.d/profiles-s-z/update-dlocatedb b/apparmor.d/profiles-s-z/update-dlocatedb index c0f3a9cb0..c0e64f0f9 100644 --- a/apparmor.d/profiles-s-z/update-dlocatedb +++ b/apparmor.d/profiles-s-z/update-dlocatedb @@ -58,6 +58,7 @@ profile update-dlocatedb @{exec_path} { @{bin}/gzip rix, /var/lib/dlocate/dlocatedb.gz rw, + include if exists } include if exists diff --git a/apparmor.d/profiles-s-z/update-pciids b/apparmor.d/profiles-s-z/update-pciids index 5f5b39ec8..3d07f75d9 100644 --- a/apparmor.d/profiles-s-z/update-pciids +++ b/apparmor.d/profiles-s-z/update-pciids @@ -62,6 +62,7 @@ profile update-pciids @{exec_path} { /usr/share/misc/pci.ids.new w, /usr/share/misc/pci.ids.gz.new w, + include if exists } include if exists diff --git a/apparmor.d/profiles-s-z/update-smart-drivedb b/apparmor.d/profiles-s-z/update-smart-drivedb index 2dcd3cc9e..2ce61cebf 100644 --- a/apparmor.d/profiles-s-z/update-smart-drivedb +++ b/apparmor.d/profiles-s-z/update-smart-drivedb @@ -58,6 +58,7 @@ profile update-smart-drivedb @{exec_path} { owner /var/lib/smartmontools/drivedb/.gnupg.@{int}.tmp/ rw, owner /var/lib/smartmontools/drivedb/.gnupg.@{int}.tmp/** rwkl -> /var/lib/smartmontools/drivedb/.gnupg.@{int}.tmp/**, + include if exists } profile browse { @@ -88,6 +89,7 @@ profile update-smart-drivedb @{exec_path} { /var/lib/smartmontools/drivedb/drivedb.h.new{,.raw.asc} w, + include if exists } include if exists diff --git a/apparmor.d/profiles-s-z/uupdate b/apparmor.d/profiles-s-z/uupdate index 2d429135f..8858a80f1 100644 --- a/apparmor.d/profiles-s-z/uupdate +++ b/apparmor.d/profiles-s-z/uupdate @@ -50,7 +50,7 @@ profile uupdate @{exec_path} flags=(complain) { # For package building owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/yadifad b/apparmor.d/profiles-s-z/yadifad index bb896bd8c..15599fa72 100644 --- a/apparmor.d/profiles-s-z/yadifad +++ b/apparmor.d/profiles-s-z/yadifad @@ -2,6 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +abi , + include @{exec_path} = @{bin}/yadifad diff --git a/apparmor.d/profiles-s-z/youtube-viewer b/apparmor.d/profiles-s-z/youtube-viewer index ac8e8f215..46b0c6c06 100644 --- a/apparmor.d/profiles-s-z/youtube-viewer +++ b/apparmor.d/profiles-s-z/youtube-viewer @@ -32,12 +32,6 @@ profile youtube-viewer @{exec_path} { @{bin}/wget rCx -> wget, - owner @{user_config_dirs}/youtube-viewer/{,*} rw, - owner @{user_cache_dirs}/youtube-viewer/{,*} rw, - owner @{HOME}/Downloads/youtube-viewer/{,*} rw, - - /etc/inputrc r, - # Players @{bin}/mpv rPUx, @{bin}/vlc rPUx, @@ -45,6 +39,11 @@ profile youtube-viewer @{exec_path} { @{bin}/ffmpeg rPUx, + /etc/inputrc r, + + owner @{user_config_dirs}/youtube-viewer/{,*} rw, + owner @{user_cache_dirs}/youtube-viewer/{,*} rw, + owner @{HOME}/Downloads/youtube-viewer/{,*} rw, profile wget { include @@ -62,6 +61,7 @@ profile youtube-viewer @{exec_path} { owner @{HOME}/.wget-hsts r, owner @{HOME}/wget-log{,.@{int}} rw, + include if exists } include if exists From afb1831fc32c2d9bd536536c882ad241a604c85e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 15:58:53 +0100 Subject: [PATCH 0304/1455] chore(profile): remove jdownloader Note: this profile was for a locally installed program. --- apparmor.d/profiles-g-l/jdownloader | 128 ---------------------------- 1 file changed, 128 deletions(-) delete mode 100644 apparmor.d/profiles-g-l/jdownloader diff --git a/apparmor.d/profiles-g-l/jdownloader b/apparmor.d/profiles-g-l/jdownloader deleted file mode 100644 index 1220e9bbd..000000000 --- a/apparmor.d/profiles-g-l/jdownloader +++ /dev/null @@ -1,128 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2018-2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{JD_INSTALLDIR} = /home/*/jd2 - -@{exec_path} = @{JD_INSTALLDIR}/*JDownloader* -profile jdownloader @{exec_path} { - include - include - include - include - include - include - include - - @{exec_path} rix, - - @{bin}/basename rix, - @{bin}/dirname rix, - @{bin}/expr rix, - @{bin}/cut rix, - @{bin}/ls rix, - @{bin}/{,e}grep rix, - @{bin}/find rix, - @{bin}/sed rix, - @{bin}/chmod rix, - - @{bin}/ffmpeg rPx, - - # These are needed when the above tools are in some nonstandard locations - #@{bin}/which{,.debianutils} rix, - #/usr/ r, - #/usr/local/ r, - #@{bin}/ r, - #@{lib}/ r, - - deny /opt/ r, - - owner @{HOME}/ r, - owner @{JD_INSTALLDIR}/ rw, - owner @{JD_INSTALLDIR}/** rwk, - owner @{JD_INSTALLDIR}/jre/bin/java rix, - owner @{JD_INSTALLDIR}/jre/lib/*/jli/libjli.so mrw, - owner @{JD_INSTALLDIR}/jre/lib/*/server/libjvm.so mrw, - owner @{JD_INSTALLDIR}/jre/lib/*/*.so mrw, - owner @{JD_INSTALLDIR}/tmp/jna/jna@{int}.tmp mrw, - owner @{JD_INSTALLDIR}/tmp/7zip/SevenZipJBinding-*/lib7-Zip-JBinding.so mrw, - - owner @{HOME}/.oracle_jre_usage/@{hex}.timestamp rw, - owner @{HOME}/.java/.userPrefs/.user.lock.* rwk, - owner @{HOME}/.java/.userPrefs/com/install4j/installations/prefs.xml rw, - owner @{HOME}/.java/fonts/@{int}/ rw, - owner @{HOME}/.java/fonts/@{int}/fcinfo*.tmp rw, - owner @{HOME}/.java/fonts/@{int}/fcinfo-*.properties rw, - - owner @{HOME}/.install4j rw, - - owner @{tmp}/hsperfdata_@{user}/ rw, - owner @{tmp}/hsperfdata_@{user}/@{pid} rw, - # If the @{JD_INSTALLDIR}/tmp/ dir can't be accessed, the /tmp/ dir will be used instead - owner @{tmp}/SevenZipJBinding-*/ rw, - owner @{tmp}/SevenZipJBinding-*/lib7-Zip-JBinding.so mrw, - # For auto updates - owner @{tmp}/lastChanceSrc@{int}lch rw, - owner @{tmp}/lastChanceDst@{int}.jar rw, - owner @{tmp}/i4j_log_jd2_@{int}.log rw, - owner @{tmp}/install4jError@{int}.log rw, - - owner @{HOME}/.Xauthority r, - - # What's this for? - deny owner @{HOME}/.mozilla/firefox/ r, - deny owner @{HOME}/.mozilla/firefox/*.*/prefs.js r, - - owner @{PROC}/@{pid}/fd/ r, - deny @{PROC}/@{pid}/net/ipv6_route r, - deny @{PROC}/@{pid}/net/if_inet6 r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - deny owner @{PROC}/@{pid}/cmdline r, - deny @{PROC}/asound/version r, - - # For Reconnect -> Share Settings/Get Route - #@{bin}/netstat rix, - #@{bin}/route rix, - #@{bin}/ping rix, - #@{bin}/ip rix, - #@{PROC}/@{pid}/net/route r, - - # To open a web browser for CAPTCHA - @{bin}/xdg-open rCx -> open, - @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, - - - profile open { - include - include - - @{bin}/xdg-open mr, - @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mr, - - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/readlink rix, - @{bin}/basename rix, - - owner @{HOME}/ r, - - owner @{run}/user/@{uid}/ r, - - # Allowed apps to open - @{lib}/firefox/firefox rPUx, - - # file_inherit - owner @{HOME}/.xsession-errors w, - - } - - include if exists -} - -# vim:syntax=apparmor From 1e28428574fdbecd0ec0375ba3490ce355f6dd07 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 16:19:11 +0100 Subject: [PATCH 0305/1455] ci: run on ubuntu 24.04 & enable make check. --- .github/workflows/main.yml | 12 +++++++----- .gitlab-ci.yml | 5 +++++ apparmor.d/profiles-s-z/xarchiver | 2 +- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 8a57149d5..b3fc6b999 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -8,17 +8,16 @@ jobs: strategy: matrix: os: - # - ubuntu-24.04 + - ubuntu-24.04 - ubuntu-22.04 mode: - default - full-system-policy steps: - - name: Check out repository code uses: actions/checkout@v4 - - name: Install Build dependencies + - name: Install Build dependencies run: | sudo apt-get update -q sudo apt-get install -y \ @@ -39,12 +38,15 @@ jobs: run: sudo dpkg --install ../apparmor.d_*_amd64.deb || true - name: Reload AppArmor - run: | + run: | sudo systemctl restart apparmor.service || true sudo systemctl status apparmor.service - name: Ensure compatibility with some AppArmor userspace tools - run: sudo aa-enforce /etc/apparmor.d/aa-notify + run: + if [[ ${{ matrix.os }} != ubuntu-24.04 ]]; then + sudo aa-enforce /etc/apparmor.d/aa-notify + fi - name: Show AppArmor log and rules run: | diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 40f212768..2aed9b551 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -63,6 +63,11 @@ tests: - go test $(go list ./pkg/... | grep -v /pkg/paths) -v -cover -coverprofile=coverage.out - go tool cover -func=coverage.out +check: + stage: lint + image: registry.gitlab.com/roddhjav/builders/archlinux + script: + - make check # Package Build # ------------- diff --git a/apparmor.d/profiles-s-z/xarchiver b/apparmor.d/profiles-s-z/xarchiver index 9f87e3b9d..003770008 100644 --- a/apparmor.d/profiles-s-z/xarchiver +++ b/apparmor.d/profiles-s-z/xarchiver @@ -42,7 +42,7 @@ profile xarchiver @{exec_path} { # For deb packages @{bin}/{,@{multiarch}-}ar rix, - @{path_open} rPx -> child-open, + @{open_path} rPx -> child-open, /etc/fstab r, From 0e96b3b66f78383fe87aa4ff45c508050ca4191a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 17:44:23 +0100 Subject: [PATCH 0306/1455] build: cleanup flag manifest. --- dists/flags/main.flags | 12 ------------ dists/flags/ubuntu.flags | 1 - 2 files changed, 13 deletions(-) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index f2c938a19..ac4547850 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -9,8 +9,6 @@ systemd attach_disconnected,mediate_deleted,complain systemd-service attach_disconnected,complain systemd-user attach_disconnected,mediate_deleted,complain -aa-load complain -aa-logprof attach_disconnected,complain aa-notify complain akonadi_akonotes_resource complain akonadi_archivemail_agent complain @@ -30,7 +28,6 @@ akonadi_notes_agent complain akonadi_sendlater_agent complain akonadi_unifiedmailbox_agent complain anacron complain -appimagelauncherd complain at complain atd complain auditctl attach_disconnected,complain @@ -49,7 +46,6 @@ cc-remote-login-helper complain cctk complain child-modprobe-nvidia attach_disconnected,complain child-open attach_disconnected,complain -chronyd attach_disconnected,complain cockpit-askpass complain cockpit-bridge complain cockpit-certificate-ensure attach_disconnected,complain @@ -179,7 +175,6 @@ hyprpm complain ibus-engine-table complain ibus-memconf attach_disconnected,complain im-launch complain -init-exim4 complain install-info complain iwctl complain iwd complain @@ -240,7 +235,6 @@ ModemManager attach_disconnected,complain mount attach_disconnected,complain multipath attach_disconnected,complain multipathd complain -netplan complain netplan.script attach_disconnected,complain networkctl attach_disconnected,complain networkd-dispatcher complain @@ -254,7 +248,6 @@ ollama attach_disconnected,complain os-prober attach_disconnected,complain pam_kwallet_init complain pam-tmpdir-helper complain -passim complain passimd attach_disconnected,complain pidof complain pkttyagent complain @@ -268,7 +261,6 @@ plymouth-set-default-theme attach_disconnected,complain plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted qdbus complain -realmd complain remmina complain run-parts complain runuser complain @@ -314,15 +306,12 @@ swtpm_localca complain swtpm_setup complain systemd-analyze complain systemd-ask-password complain -systemd-battery-check complain systemd-binfmt attach_disconnected,complain -systemd-bsod complain systemd-cgls complain systemd-cgtop complain systemd-cryptsetup complain systemd-dissect attach_disconnected,complain systemd-escape complain -systemd-firstboot complain systemd-generator-bless-boot attach_disconnected,complain systemd-generator-cloud-init attach_disconnected,complain systemd-generator-cryptsetup attach_disconnected,complain @@ -346,7 +335,6 @@ systemd-homework complain systemd-inhibit attach_disconnected,complain systemd-mount complain systemd-network-generator complain -systemd-pcrphase complain systemd-portabled complain systemd-remount-fs complain systemd-resolve complain diff --git a/dists/flags/ubuntu.flags b/dists/flags/ubuntu.flags index 30e21282d..a6d6bcc85 100644 --- a/dists/flags/ubuntu.flags +++ b/dists/flags/ubuntu.flags @@ -13,7 +13,6 @@ livepatch-notification complain notify-reboot-required complain package-data-downloader complain package-system-locked attach_disconnected,complain -pro complain release-upgrade-motd complain software-properties-gtk complain ubuntu-advantage complain From 52b3a1dfd4930c8ddb2971efa833f89c9702a4d4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 17:44:46 +0100 Subject: [PATCH 0307/1455] fix(ci): github workflows. --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index b3fc6b999..ddc95834a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -43,7 +43,7 @@ jobs: sudo systemctl status apparmor.service - name: Ensure compatibility with some AppArmor userspace tools - run: + run: | if [[ ${{ matrix.os }} != ubuntu-24.04 ]]; then sudo aa-enforce /etc/apparmor.d/aa-notify fi From effd4ef267f4bcf533912b007f5294506a31ea2b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 17:51:30 +0100 Subject: [PATCH 0308/1455] ci: move check job stage. --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 2aed9b551..1acf9151f 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -64,7 +64,7 @@ tests: - go tool cover -func=coverage.out check: - stage: lint + stage: test image: registry.gitlab.com/roddhjav/builders/archlinux script: - make check From 856c425dd549d0336ed3c706ff84aa0c1a3b01bf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 20:15:13 +0100 Subject: [PATCH 0309/1455] chore(build): minor cosmetic. --- pkg/prebuild/cli/cli.go | 2 +- pkg/prebuild/cli/cli_test.go | 2 +- pkg/prebuild/directories.go | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index da19c1171..329729e94 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -61,7 +61,7 @@ func init() { func Prebuild() { flag.Usage = func() { - fmt.Printf("%s%s\n%s\n%s", usage, + fmt.Printf("%s\n%s\n%s\n%s", usage, prebuild.Help("Prepare", prepare.Tasks), prebuild.Help("Build", builder.Builders), directive.Usage(), diff --git a/pkg/prebuild/cli/cli_test.go b/pkg/prebuild/cli/cli_test.go index 782d81756..dab310020 100644 --- a/pkg/prebuild/cli/cli_test.go +++ b/pkg/prebuild/cli/cli_test.go @@ -78,7 +78,7 @@ func Test_Prebuild(t *testing.T) { chdirGitRoot() for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - setTestBuildDirectories(tt.name) + setTestBuildDirectories(tt.dist) prebuild.Distribution = tt.dist prepare.Prepares = []prepare.Task{} prepare.Register( diff --git a/pkg/prebuild/directories.go b/pkg/prebuild/directories.go index 6fbde10be..cd5958b72 100644 --- a/pkg/prebuild/directories.go +++ b/pkg/prebuild/directories.go @@ -10,10 +10,10 @@ var ( // AppArmor ABI version ABI uint = 0 - // Root is the root directory for the build + // Root is the root directory for the build (default: .build) Root *paths.Path = paths.New(".build") - // RootApparmord is the final built apparmor.d directory + // RootApparmord is the final built apparmor.d directory (default: .build/apparmor.d) RootApparmord *paths.Path = Root.Join("apparmor.d") // DistDir is the directory where the distribution specific files are stored From 29a164259867a853dc0ced6be2d07b042d026b15 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 20:17:19 +0100 Subject: [PATCH 0310/1455] feat(aa-log): unify the isOwner function across features. --- pkg/aa/file.go | 6 +++--- pkg/logs/logs.go | 5 ++--- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/pkg/aa/file.go b/pkg/aa/file.go index 14ade6997..36c7101a4 100644 --- a/pkg/aa/file.go +++ b/pkg/aa/file.go @@ -29,7 +29,7 @@ func init() { } } -func isOwner(log map[string]string) bool { +func IsOwner(log map[string]string) bool { fsuid, hasFsUID := log["fsuid"] ouid, hasOuUID := log["ouid"] isDbus := strings.Contains(log["operation"], "dbus") @@ -98,7 +98,7 @@ func newFileFromLog(log map[string]string) Rule { return &File{ Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), - Owner: isOwner(log), + Owner: IsOwner(log), Path: log["name"], Access: accesses, Target: log["target"], @@ -262,7 +262,7 @@ func newLinkFromLog(log map[string]string) Rule { return &Link{ Base: newBaseFromLog(log), Qualifier: newQualifierFromLog(log), - Owner: isOwner(log), + Owner: IsOwner(log), Path: log["name"], Target: log["target"], } diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index 01c4fcbb4..246394604 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -200,12 +200,11 @@ func (aaLogs AppArmorLogs) String() string { for _, log := range aaLogs { seen := map[string]bool{"apparmor": true} res.WriteString(state[log["apparmor"]]) - fsuid := log["fsuid"] - ouid := log["ouid"] + owner := aa.IsOwner(log) for _, key := range keys { if item, present := log[key]; present { - if key == "name" && fsuid == ouid && !strings.Contains(log["operation"], "dbus") { + if key == "name" && owner { res.WriteString(template[key] + " owner" + reset) } if temp, present := template[key]; present { From 01a1af6c1bc5da2d12740c0d1e76f8268f2aa2aa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 20:19:09 +0100 Subject: [PATCH 0311/1455] feat(systemd): ensure dbus service are started after apparmor. --- systemd/default/system/dbus-broker.service | 3 +++ systemd/default/system/dbus.service | 3 +++ 2 files changed, 6 insertions(+) diff --git a/systemd/default/system/dbus-broker.service b/systemd/default/system/dbus-broker.service index 8d3ed8b73..899828b40 100644 --- a/systemd/default/system/dbus-broker.service +++ b/systemd/default/system/dbus-broker.service @@ -1,2 +1,5 @@ +[Unit] +After=apparmor.service + [Service] AppArmorProfile=dbus-system diff --git a/systemd/default/system/dbus.service b/systemd/default/system/dbus.service index 8d3ed8b73..899828b40 100644 --- a/systemd/default/system/dbus.service +++ b/systemd/default/system/dbus.service @@ -1,2 +1,5 @@ +[Unit] +After=apparmor.service + [Service] AppArmorProfile=dbus-system From 6b0b49824444c7647bd05679d78feb6aff2a6a26 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 20:43:18 +0100 Subject: [PATCH 0312/1455] feat(profile): small profiles update. --- apparmor.d/abstractions/gnome-strict | 2 ++ apparmor.d/groups/cron/cron-debsums | 14 ++++------ apparmor.d/groups/gnome/gio-launch-desktop | 1 - apparmor.d/groups/gnome/gnome-characters | 1 + .../groups/gnome/gnome-extension-manager | 1 + apparmor.d/groups/gnome/gnome-software | 1 + apparmor.d/groups/systemd/systemd-dissect | 7 +++-- apparmor.d/groups/virt/dockerd | 28 ++++++++++++++----- apparmor.d/profiles-m-r/mandb | 2 +- apparmor.d/profiles-m-r/metadata-cleaner | 12 ++++---- apparmor.d/profiles-m-r/power-profiles-daemon | 4 +-- apparmor.d/profiles-m-r/remmina | 16 +++++------ apparmor.d/profiles-s-z/totem | 7 ++++- 13 files changed, 57 insertions(+), 39 deletions(-) diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 833aaa59b..ed3f2f4c0 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -27,6 +27,8 @@ /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r, + / r, + owner @{user_share_dirs}/gnome-shell/session.gvdb rw, include if exists diff --git a/apparmor.d/groups/cron/cron-debsums b/apparmor.d/groups/cron/cron-debsums index 5a7adf141..46a3bbe07 100644 --- a/apparmor.d/groups/cron/cron-debsums +++ b/apparmor.d/groups/cron/cron-debsums @@ -14,15 +14,13 @@ profile cron-debsums @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/true rix, + @{bin}/{,e}grep rix, + @{bin}/debsums rPx, + @{bin}/ionice rix, @{bin}/logger rix, @{bin}/sed rix, - @{bin}/{,e}grep rix, - - @{bin}/ionice rix, - - @{bin}/debsums rPx, @{bin}/tee rCx -> tee, + @{bin}/true rix, /etc/ r, /etc/default/debsums r, @@ -31,17 +29,15 @@ profile cron-debsums @{exec_path} { # For shell pwd / r, - profile tee { include include - # Needed to write to /proc/self/fd/3 capability dac_override, @{bin}/tee mr, - owner @{PROC}/@{pid}/fd/3 rw, + owner @{PROC}/@{pid}/fd/@{int} rw, include if exists } diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 4b395eb82..12473b491 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -43,7 +43,6 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { /dev/dri/card@{int} rw, - deny @{user_share_dirs}/gvfs-metadata/{,*} r, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 730feb31c..9ae8a7b8a 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -24,6 +24,7 @@ profile gnome-characters @{exec_path} { @{open_path} rPx -> child-open-help, /usr/share/org.gnome.Characters/{,**} r, + /usr/share/xml/iso-codes/{,**} r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/gnome/gnome-extension-manager b/apparmor.d/groups/gnome/gnome-extension-manager index 942d7b404..3b23d4ffc 100644 --- a/apparmor.d/groups/gnome/gnome-extension-manager +++ b/apparmor.d/groups/gnome/gnome-extension-manager @@ -32,6 +32,7 @@ profile gnome-extension-manager @{exec_path} { @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, # Silencer deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index da5ed232f..4726881e6 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -125,6 +125,7 @@ profile gnome-software @{exec_path} { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/fuse rw, diff --git a/apparmor.d/groups/systemd/systemd-dissect b/apparmor.d/groups/systemd/systemd-dissect index b81b100db..7dc10fd46 100644 --- a/apparmor.d/groups/systemd/systemd-dissect +++ b/apparmor.d/groups/systemd/systemd-dissect @@ -17,10 +17,11 @@ profile systemd-dissect @{exec_path} flags=(attach_disconnected) { capability sys_admin, capability sys_resource, - mount options=(rw rshared rslave) -> /, - mount options=(rw nodev) -> /mnt/*/, mount -> /tmp/dissect-@{rand6}/, - mount options=(ro nodev) /dev/loop* -> @{run}/systemd/dissect-root/, + mount fstype=tmpfs options=(rw nodev) rootfs -> @{run}/systemd/dissect-root/, + mount options=(ro nodev) /dev/loop* -> @{run}/systemd/dissect-root/{,**/}, + mount options=(rw nodev) -> /mnt/*/, + mount options=(rw rshared rslave) -> /, umount @{run}/systemd/dissect-root/, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 3342c0d58..91d7baf3e 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -83,10 +83,20 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { # TODO: should be in a sub profile started with pivot_root, not supported yet. /{,**} rwl, + /etc/docker/{,**} r, + + / r, + + owner @{lib}/containerd/** w, owner @{lib}/docker/overlay2/*/work/{,**} rw, + owner /var/lib/containerd/** w, owner /var/lib/docker/{,**} rwk, owner /var/lib/docker/tmp/qemu-check@{int}/check rix, + owner @{run}/docker/ rw, + owner @{run}/docker/** rwlk, + owner @{run}/docker.pid rw, + @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/cpuset.cpus.effective r, @{sys}/fs/cgroup/cpuset.mems.effective r, @@ -101,16 +111,20 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/kernel/threads-max r, @{PROC}/sys/net/bridge/bridge-nf-call-ip*tables r, @{PROC}/sys/net/core/somaxconn r, - @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} rw, + @{PROC}/sys/net/ipv{4,6}/conf/*/disable_ipv{4,6} rw, @{PROC}/sys/net/ipv{4,6}/conf/docker@{int}/accept_ra rw, @{PROC}/sys/net/ipv{4,6}/ip_forward rw, @{PROC}/sys/net/ipv{4,6}/ip_local_port_range r, - owner @{PROC}/@{pids}/attr/current r, - owner @{PROC}/@{pids}/cgroup r, - owner @{PROC}/@{pids}/fd/ r, - owner @{PROC}/@{pids}/mountinfo r, - owner @{PROC}/@{pids}/net/ip_tables_names r, - owner @{PROC}/@{pids}/uid_map r, + owner @{PROC}/@{pid}/attr/current r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/net/ip_tables_names r, + owner @{PROC}/@{pid}/task/@{tid}/mountinfo r, + owner @{PROC}/@{pid}/uid_map r, + + /dev/ r, + /dev/**/ r, include if exists } diff --git a/apparmor.d/profiles-m-r/mandb b/apparmor.d/profiles-m-r/mandb index e1404aba0..4826337d0 100644 --- a/apparmor.d/profiles-m-r/mandb +++ b/apparmor.d/profiles-m-r/mandb @@ -30,7 +30,7 @@ profile mandb @{exec_path} flags=(complain) { /usr/{,share/}man/{,**} r, /usr/local/{,share/}man/{,**} r, - /usr/share/**/man/man@{int}/*.@{int}.gz r, + /usr/share/**/man/man@{u8}/*.@{int}.gz r, owner @{user_share_dirs}/man/** rwk, diff --git a/apparmor.d/profiles-m-r/metadata-cleaner b/apparmor.d/profiles-m-r/metadata-cleaner index 87a26b0f3..0de151536 100644 --- a/apparmor.d/profiles-m-r/metadata-cleaner +++ b/apparmor.d/profiles-m-r/metadata-cleaner @@ -10,7 +10,7 @@ include profile metadata-cleaner @{exec_path} flags=(attach_disconnected) { include include - include + include include include include @@ -31,17 +31,17 @@ profile metadata-cleaner @{exec_path} flags=(attach_disconnected) { /etc/httpd/conf/mime.types r, /etc/mime.types r, - owner @{tmp}/@{hex64}.png r, - owner @{tmp}/@{hex64}.png w, + owner @{tmp}/@{hex64}.* rw, owner @{tmp}/@{rand8} rw, - owner @{tmp}/tmp@{rand4}_*/{,**} rw, - owner @{tmp}/tmp@{rand8}/{,**} rw, + owner @{tmp}/tmp@{word8} rw, + owner @{tmp}/tmp@{word8}/{,**} rw, @{run}/mount/utab r, owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, deny owner @{user_share_dirs}/gvfs-metadata/* r, deny owner @{user_cache_dirs}/thumbnails/** r, diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index d409ced7b..b39682804 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -34,10 +34,8 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { @{sys}/bus/platform/devices/ r, @{sys}/class/ r, @{sys}/class/power_supply/ r, - @{sys}/devices/@{pci}/uevent r, @{sys}/devices/**/power_supply/*/scope r, - @{sys}/devices/**/power_supply/*/uevent r, - @{sys}/devices/platform/**/uevent r, + @{sys}/devices/**/uevent r, @{sys}/devices/system/cpu/*_pstate/{no_turbo,turbo_pct} r, @{sys}/devices/system/cpu/*_pstate/status r, @{sys}/devices/system/cpu/cpu@{int}/power/energy_perf_bias rw, diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index 9e2414b5e..f59880046 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -9,30 +9,31 @@ include @{exec_path} = @{bin}/remmina profile remmina @{exec_path} { include + include include include include include + include include + include include include include include - include - include + include include include include - include + include network inet stream, network inet6 stream, network netlink raw, #aa:dbus own bus=session name=org.remmina.Remmina - - dbus (send, receive) bus=session path=/org/ayatana/NotificationItem/remmina_icon{,/**} - peer=(name="{:*,org.freedesktop.DBus}"), # all interfaces and members + #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @{exec_path} r, @@ -42,14 +43,13 @@ profile remmina @{exec_path} { /etc/timezone r, /etc/ssh/ssh_config r, /etc/ssh/ssh_config.d/{,*} r, - /etc/gtk-3.0/settings.ini r, owner @{HOME}/@{XDG_SSH_DIR}/{,*} r, + owner @{user_cache_dirs}/org.remmina.Remmina/{,**} rw, owner @{user_cache_dirs}/remmina/{,**} rw, owner @{user_config_dirs}/autostart/remmina-applet.desktop r, owner @{user_config_dirs}/freerdp/known_hosts2 rwk, - owner @{user_config_dirs}/gtk-3.0/bookmarks r, owner @{user_config_dirs}/remmina/{,**} rw, owner @{user_share_dirs}/remmina/{,**} rw, diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index a71a80c06..6883e48f2 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -63,6 +63,7 @@ profile totem @{exec_path} flags=(attach_disconnected) { include include include + include include capability dac_override, @@ -70,9 +71,13 @@ profile totem @{exec_path} flags=(attach_disconnected) { @{bin}/bwrap mr, @{bin}/totem-video-thumbnailer rix, + /usr/share/ladspa/rdf/{,*} r, + + owner @{user_cache_dirs}/gnome-desktop-thumbnailer/{,**} rw, + owner @{tmp}/flatpak-seccomp-@{rand6} rw, owner @{tmp}/gnome-desktop-file-to-thumbnail.* rw, - owner @{user_cache_dirs}/gnome-desktop-thumbnailer/{,**} rw, + owner @{tmp}/gnome-desktop-thumbnailer-@{rand6}/{,**} rw, @{PROC}/sys/vm/mmap_min_addr r, owner @{PROC}/@{pid}/task/@{tid}/comm w, From 3324c0dc3be9e46bb645117fc4bf8179b3bfd6e3 Mon Sep 17 00:00:00 2001 From: beroal Date: Sun, 6 Oct 2024 22:44:31 +0300 Subject: [PATCH 0313/1455] `xeyes` (#544) * xeyes * Changed the profile attachment to the variable * ABI 4 --- apparmor.d/profiles-s-z/xeyes | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 apparmor.d/profiles-s-z/xeyes diff --git a/apparmor.d/profiles-s-z/xeyes b/apparmor.d/profiles-s-z/xeyes new file mode 100644 index 000000000..c602e7fce --- /dev/null +++ b/apparmor.d/profiles-s-z/xeyes @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022-2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/xeyes +profile xeyes @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From ce3813133f8a20f68aa9ac4f32ed421a95bde485 Mon Sep 17 00:00:00 2001 From: beroal Date: Sun, 6 Oct 2024 22:45:17 +0300 Subject: [PATCH 0314/1455] the desktop version of the Briar secure messager (#545) * the desktop version of the Briar secure messager --- apparmor.d/profiles-a-f/briar-desktop | 95 +++++++++++++++++++++++ apparmor.d/profiles-a-f/briar-desktop-tor | 65 ++++++++++++++++ 2 files changed, 160 insertions(+) create mode 100644 apparmor.d/profiles-a-f/briar-desktop create mode 100644 apparmor.d/profiles-a-f/briar-desktop-tor diff --git a/apparmor.d/profiles-a-f/briar-desktop b/apparmor.d/profiles-a-f/briar-desktop new file mode 100644 index 000000000..a0b57a38b --- /dev/null +++ b/apparmor.d/profiles-a-f/briar-desktop @@ -0,0 +1,95 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/briar-desktop +profile briar-desktop @{exec_path} { + include + include + include + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + + ptrace read peer=briar-desktop-tor, + ptrace read peer=@{profile_name}//jspawnhelper, + + @{exec_path} mr, + + @{lib}/jvm/java*/bin/java rix, + @{lib}/jvm/java*/lib/** rm, + @{lib}/jvm/java*/lib/jspawnhelper Cx -> jspawnhelper, + @{sh_path} mr, + + @{system_share_dirs}/java/briar-desktop.jar r, + + /etc/java*/{,**} r, + + owner @{HOME}/.briar/desktop/{,**} rw, + owner @{HOME}/.briar/desktop/db/db.mv.db k, + + owner @{HOME}/.java/{,.userPrefs/{,org/}} w, + owner @{HOME}/.java/.userPrefs/.user.lock.@{user} wk, + owner @{HOME}/.java/.userPrefs/.userRootModFile.@{user} rw, + owner @{HOME}/.java/.userPrefs/{,org/}prefs.{xml,tmp} rw, + owner @{HOME}/.java/.userPrefs/org/briarproject/{,**} rw, + + owner @{HOME}/.skiko/ w, + owner @{HOME}/.skiko/@{hex64}/{,libskiko-*.so,skiko[0-9]*} mrw, + + owner @{user_pictures_dirs}/{,**} r, + + owner @{user_cache_dirs}/JNA/{,**} mrw, + + owner @{tmp}/hsperfdata_@{user}/ rw, + owner @{tmp}/hsperfdata_@{user}/@{pid} rwk, + owner @{tmp}/imageio@{u64}.tmp rw, + owner @{tmp}/jna@{u64}.tmp mrw, + + @{sys}/devices/system/cpu/cpu@{int}/microcode/version r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/{cpu,memory}.max r, + @{sys}/kernel/mm/{hugepages/,transparent_hugepage/enabled} r, + + @{PROC}/cgroups r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/coredump_filter rw, + owner @{PROC}/@{pid}/mountinfo r, + @{PROC}/@{pid}/net/if_inet6 r, + owner @{PROC}/@{pid}/stat r, + + /dev/tty rw, + /dev/urandom rw, + + deny @{HOME}/ r, + + include if exists + + profile jspawnhelper flags=(attach_disconnected) { + include + + @{bin}/ldconfig ix, + owner @{HOME}/.briar/desktop/tor/tor Px -> briar-desktop-tor, + + @{system_share_dirs}/java/briar-desktop.jar r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/stat r, + + deny owner @{HOME}/.briar/desktop/db/db.mv.db rw, # file_inherit + deny network inet6 stream, # file_inherit + + include if exists + } +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/briar-desktop-tor b/apparmor.d/profiles-a-f/briar-desktop-tor new file mode 100644 index 000000000..e78420e34 --- /dev/null +++ b/apparmor.d/profiles-a-f/briar-desktop-tor @@ -0,0 +1,65 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +profile briar-desktop-tor { + include + + network inet stream, + network inet6 stream, + network netlink raw, + + signal send set=term peer=briar-desktop-tor//obfs4proxy, + signal send set=term peer=briar-desktop-tor//snowflake, + + owner @{HOME}/.briar/desktop/tor/.tor/{,**} rw, + owner @{HOME}/.briar/desktop/tor/.tor/lock k, + owner @{HOME}/.briar/desktop/tor/obfs4proxy Cx -> obfs4proxy, + owner @{HOME}/.briar/desktop/tor/snowflake Cx -> snowflake, + owner @{HOME}/.briar/desktop/tor/tor r, + owner @{HOME}/.briar/desktop/tor/torrc r, + + @{PROC}/sys/kernel/random/uuid r, + + include if exists + + profile obfs4proxy { + include + + network inet stream, + network inet6 stream, + + signal receive set=term peer=briar-desktop-tor, + + owner @{HOME}/.briar/desktop/tor/.tor/pt_state/ w, + owner @{HOME}/.briar/desktop/tor/obfs4proxy mr, + @{PROC}/sys/net/core/somaxconn r, + + include if exists + } + + profile snowflake { + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + signal receive set=term peer=briar-desktop-tor, + + owner @{HOME}/.briar/desktop/tor/snowflake mr, + @{PROC}/sys/net/core/somaxconn r, + + include if exists + } +} + +# vim:syntax=apparmor From a5cafe26ea8e664bffa606e37708dcd56f594e9b Mon Sep 17 00:00:00 2001 From: beroal Date: Sun, 6 Oct 2024 22:46:12 +0300 Subject: [PATCH 0315/1455] aMule, a file sharing program; not all executables (#546) * aMule, a file sharing program; not all executables * ABI 4; document directories; amule//shell was deleted --- apparmor.d/abstractions/app-open | 1 + apparmor.d/profiles-a-f/alc | 21 +++++++++++++++++ apparmor.d/profiles-a-f/alcc | 20 ++++++++++++++++ apparmor.d/profiles-a-f/amule | 39 ++++++++++++++++++++++++++++++++ apparmor.d/profiles-a-f/cas | 25 ++++++++++++++++++++ apparmor.d/profiles-a-f/ed2k | 22 ++++++++++++++++++ apparmor.d/profiles-a-f/fileview | 26 +++++++++++++++++++++ 7 files changed, 154 insertions(+) create mode 100644 apparmor.d/profiles-a-f/alc create mode 100644 apparmor.d/profiles-a-f/alcc create mode 100644 apparmor.d/profiles-a-f/amule create mode 100644 apparmor.d/profiles-a-f/cas create mode 100644 apparmor.d/profiles-a-f/ed2k create mode 100644 apparmor.d/profiles-a-f/fileview diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 70f89d866..f0fd32206 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -26,6 +26,7 @@ @{text_editors_path} rPUx, # Others + @{bin}/amule rPx, @{bin}/blueman-tray rPx, @{bin}/discord{,-ptb} rPx, @{bin}/draw.io rPUx, diff --git a/apparmor.d/profiles-a-f/alc b/apparmor.d/profiles-a-f/alc new file mode 100644 index 000000000..232f83860 --- /dev/null +++ b/apparmor.d/profiles-a-f/alc @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/alc +profile alc @{exec_path} { + include + include + include + + @{exec_path} mr, + @{user_torrents_dirs}/{,**} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/alcc b/apparmor.d/profiles-a-f/alcc new file mode 100644 index 000000000..c1e7d0602 --- /dev/null +++ b/apparmor.d/profiles-a-f/alcc @@ -0,0 +1,20 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/alcc +profile alcc @{exec_path} { + include + include + + @{exec_path} mr, + @{user_torrents_dirs}/{,**} r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/amule b/apparmor.d/profiles-a-f/amule new file mode 100644 index 000000000..b54e62022 --- /dev/null +++ b/apparmor.d/profiles-a-f/amule @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/amule +profile amule @{exec_path} { + include + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + + # Previewing files isn't allowed + # because aMule opens viewers directly instead of via `xdg-open`. + # If aMule uses `xdg-open` in your time, + # uncomment the following line to allow previewing files. + # @{open_path} rPx -> child-open, + + @{exec_path} mr, + @{bin}/uname rPx, + @{sh_path} rix, + @{system_share_dirs}/amule/{,**} r, + owner @{HOME}/.aMule/{,**} rwk, + @{user_torrents_dirs}/{,**} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/cas b/apparmor.d/profiles-a-f/cas new file mode 100644 index 000000000..d843801ba --- /dev/null +++ b/apparmor.d/profiles-a-f/cas @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/cas +profile cas @{exec_path} { + include + include + + @{exec_path} mr, + + @{system_share_dirs}/cas/{,**} r, + + owner @{HOME}/.aMule/aMule-online-sign.html w, + owner @{HOME}/.aMule/amulesig.dat r, + owner @{HOME}/.aMule/casrc rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/ed2k b/apparmor.d/profiles-a-f/ed2k new file mode 100644 index 000000000..f92e3b74d --- /dev/null +++ b/apparmor.d/profiles-a-f/ed2k @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ed2k +profile ed2k @{exec_path} { + include + include + + @{exec_path} mr, + + owner @{HOME}/.aMule/ED2KLinks w, + owner @{HOME}/.aMule/ED2KLinks_lock wk, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/fileview b/apparmor.d/profiles-a-f/fileview new file mode 100644 index 000000000..9237f2a98 --- /dev/null +++ b/apparmor.d/profiles-a-f/fileview @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/fileview +profile fileview @{exec_path} { + include + include + + @{exec_path} mr, + + # This program parses aMule internal data files like "server.met". + # The paths to these files are given as arguments. + # The following directories are those that users likely want to read. + # However, this program is usable without the permissions below. + owner @{HOME}/.aMule/{,**} r, + @{user_torrents_dirs}/{,**} r, + + include if exists +} + +# vim:syntax=apparmor From 03b777340d4b17957c7533d20bc3f8fca5a6dff8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Oct 2024 22:01:39 +0100 Subject: [PATCH 0316/1455] tests(packer): update & cleanup tests images. --- tests/Makefile | 2 +- tests/packer/archlinux.pkr.hcl | 80 +------------ tests/packer/builds.pkr.hcl | 30 +++-- tests/packer/debian.pkr.hcl | 86 +------------- .../packer/init/archlinux-xfce.user-data.yml | 92 +++++++++++++++ .../packer/init/opensuse-gnome.user-data.yml | 43 +++++++ ...ata.yml => ubuntu22-desktop.user-data.yml} | 0 ...ata.yml => ubuntu24-desktop.user-data.yml} | 20 ++-- ...data.yml => ubuntu24-server.user-data.yml} | 0 tests/packer/opensuse.pkr.hcl | 19 ++-- tests/packer/ubuntu.pkr.hcl | 106 +++--------------- tests/packer/variables.pkr.hcl | 16 +-- 12 files changed, 202 insertions(+), 292 deletions(-) create mode 100644 tests/packer/init/archlinux-xfce.user-data.yml create mode 100644 tests/packer/init/opensuse-gnome.user-data.yml rename tests/packer/init/{ubuntu-desktop.user-data.yml => ubuntu22-desktop.user-data.yml} (100%) rename tests/packer/init/{ubuntu-desktop24.user-data.yml => ubuntu24-desktop.user-data.yml} (76%) rename tests/packer/init/{ubuntu-server.user-data.yml => ubuntu24-server.user-data.yml} (100%) diff --git a/tests/Makefile b/tests/Makefile index de4a15f78..8bf5f6182 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -21,7 +21,7 @@ $(BASE): @make --directory=../ package dist=${@} @packer build -force -var version=${VERSION} \ -var disk_size=${disk} -var flavor="${flavor}" \ - -only=qemu.${@}-${flavor} packer/ + -only=qemu.${@} packer/ lint: @packer fmt --check packer/ diff --git a/tests/packer/archlinux.pkr.hcl b/tests/packer/archlinux.pkr.hcl index c445b632a..41a2627d5 100644 --- a/tests/packer/archlinux.pkr.hcl +++ b/tests/packer/archlinux.pkr.hcl @@ -2,43 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -source "qemu" "archlinux-server" { - disk_image = true - iso_url = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2" - iso_checksum = "file:https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256" - iso_target_path = "${var.iso_dir}/archlinux-cloudimg-amd64.img" - cpu_model = "host" - cpus = 6 - memory = 4096 - disk_size = "10G" - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = var.output - vm_name = "${var.prefix}${source.name}.qcow2" - boot_wait = "10s" - shutdown_command = "echo ${var.password} | sudo -S shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} - -source "qemu" "archlinux-gnome" { +source "qemu" "archlinux" { disk_image = true iso_url = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2" iso_checksum = "file:https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256" @@ -57,54 +21,18 @@ source "qemu" "archlinux-gnome" { disk_detect_zeroes = "unmap" disk_discard = "unmap" output_directory = var.output - vm_name = "${var.prefix}${source.name}.qcow2" + vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" boot_wait = "10s" shutdown_command = "echo ${var.password} | sudo -S shutdown -hP now" cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", + "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} - -source "qemu" "archlinux-kde" { - disk_image = true - iso_url = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2" - iso_checksum = "file:https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256" - iso_target_path = "${var.iso_dir}/archlinux-cloudimg-amd64.img" - cpu_model = "host" - cpus = 6 - memory = 4096 - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = var.output - vm_name = "${var.prefix}${source.name}.qcow2" - boot_wait = "10s" - shutdown_command = "echo ${var.password} | sudo -S shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" + hostname = "${var.prefix}${source.name}-${var.flavor}" } ) } diff --git a/tests/packer/builds.pkr.hcl b/tests/packer/builds.pkr.hcl index c37e768ac..33288e6b5 100644 --- a/tests/packer/builds.pkr.hcl +++ b/tests/packer/builds.pkr.hcl @@ -4,18 +4,12 @@ build { sources = [ - "source.qemu.archlinux-gnome", - "source.qemu.archlinux-kde", - "source.qemu.archlinux-server", - "source.qemu.debian-gnome", - "source.qemu.debian-kde", - "source.qemu.debian-server", - "source.qemu.opensuse-gnome", - "source.qemu.opensuse-kde", - "source.qemu.ubuntu-desktop", - "source.qemu.ubuntu-desktop24", - "source.qemu.ubuntu-server", - "source.qemu.ubuntu-server24", + "source.qemu.archlinux", + "source.qemu.debian", + "source.qemu.fedora", + "source.qemu.opensuse", + "source.qemu.ubuntu22", + "source.qemu.ubuntu24", ] # Upload local files @@ -25,26 +19,28 @@ build { } provisioner "file" { - only = ["qemu.archlinux-gnome", "qemu.archlinux-kde", "qemu.archlinux-server"] + only = ["qemu.archlinux"] destination = "/tmp/src/" - sources = ["${path.cwd}/../apparmor.d-${var.version}-1-x86_64.pkg.tar.zst"] + sources = [ + "${path.cwd}/../apparmor.d-${var.version}-1-x86_64.pkg.tar.zst", + ] } provisioner "file" { - only = ["qemu.opensuse-*"] + only = ["qemu.opensuse"] destination = "/tmp/src/" sources = ["${path.cwd}/../apparmor.d-${var.version}-1.x86_64.rpm"] } provisioner "file" { - only = ["qemu.debian-server", "qemu.debian-gnome", "qemu.debian-kde", "qemu.ubuntu-server", "qemu.ubuntu-server24", "qemu.ubuntu-desktop", "qemu.ubuntu-desktop24"] + only = ["qemu.debian", "qemu.ubuntu22", "qemu.ubuntu24"] destination = "/tmp/src/" sources = ["${path.cwd}/../apparmor.d_${var.version}-1_amd64.deb"] } # Wait for cloud-init to finish provisioner "shell" { - except = ["qemu.opensuse-*"] + except = ["qemu.opensuse"] execute_command = "echo '${var.password}' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'" inline = [ "while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for Cloud-Init...'; sleep 20; done", diff --git a/tests/packer/debian.pkr.hcl b/tests/packer/debian.pkr.hcl index 38f33116f..7fd176b6e 100644 --- a/tests/packer/debian.pkr.hcl +++ b/tests/packer/debian.pkr.hcl @@ -2,14 +2,14 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -source "qemu" "debian-server" { +source "qemu" "debian" { disk_image = true iso_url = "https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/debian-${var.release.debian.version}-genericcloud-amd64.qcow2" iso_checksum = "file:https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/SHA512SUMS" iso_target_path = "${var.iso_dir}/debian-cloudimg-amd64.img" cpu_model = "host" - cpus = 4 - memory = 2048 + cpus = 6 + memory = 4096 disk_size = var.disk_size accelerator = "kvm" headless = true @@ -20,89 +20,15 @@ source "qemu" "debian-server" { disk_compression = true disk_detect_zeroes = "unmap" disk_discard = "unmap" - output_directory = "${var.output}/" - vm_name = "${var.prefix}${source.name}.qcow2" + output_directory = var.output + vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" boot_wait = "10s" firmware = var.firmware shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} - -source "qemu" "debian-gnome" { - disk_image = true - iso_url = "https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/debian-${var.release.debian.version}-genericcloud-amd64.qcow2" - iso_checksum = "file:https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/SHA512SUMS" - iso_target_path = "${var.iso_dir}/debian-cloudimg-amd64.img" - cpu_model = "host" - cpus = 4 - memory = 2048 - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = "${var.output}/" - vm_name = "${var.prefix}${source.name}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} - -source "qemu" "debian-kde" { - disk_image = true - iso_url = "https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/debian-${var.release.debian.version}-genericcloud-amd64.qcow2" - iso_checksum = "file:https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/SHA512SUMS" - iso_target_path = "${var.iso_dir}/debian-cloudimg-amd64.img" - cpu_model = "host" - cpus = 4 - memory = 2048 - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = "${var.output}/" - vm_name = "${var.prefix}${source.name}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", + "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" diff --git a/tests/packer/init/archlinux-xfce.user-data.yml b/tests/packer/init/archlinux-xfce.user-data.yml new file mode 100644 index 000000000..1cc18f556 --- /dev/null +++ b/tests/packer/init/archlinux-xfce.user-data.yml @@ -0,0 +1,92 @@ +#cloud-config + +hostname: ${hostname} +locale: en_IE +keyboard: + layout: ie + +ssh_pwauth: true +users: + - name: ${username} + plain_text_passwd: ${password} + shell: /bin/bash + ssh_authorized_keys: + - ${ssh_key} + lock_passwd: false + sudo: ALL=(ALL) NOPASSWD:ALL + +package_update: true +package_upgrade: true +package_reboot_if_required: false +packages: + # Install core packages + - apparmor + - base-devel + - firewalld + - qemu-guest-agent + - rng-tools + - spice-vdagent + + # Install usefull core packages + - bash-completion + - git + - htop + - man + - pass + - python-notify2 + - vim + - wget + + # Install basic services + - networkmanager + - cups + - cups-pdf + - system-config-printer + + # Install Graphical Interface + - xfce4 + - xfce4-goodies + - lightdm + - lightdm-gtk-greeter + + # Install Applications + - firefox + - chromium + - terminator + +runcmd: + # Regenerate grub.cfg + - grub-mkconfig -o /boot/grub/grub.cfg + + # Remove swapfile + - swapoff -a + - rm -rf /swap/ + - sed -e "/swap/d" -i /etc/fstab + + # Enable core services + - systemctl enable apparmor + - systemctl enable auditd + - systemctl enable lightdm.service + - systemctl enable NetworkManager + - systemctl enable rngd + - systemctl enable avahi-daemon + - systemctl enable systemd-timesyncd.service + +write_files: + # Enable AppArmor in kernel parameters + - path: /etc/default/grub + append: true + content: | + GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf" + + # Set some bash aliases + - path: /etc/skel/.bashrc + append: true + content: | + [[ -f ~/.bash_aliases ]] && source ~/.bash_aliases + + # Setup shared directory + - path: /etc/fstab + append: true + content: | + 0a31bc478ef8e2461a4b1cc10a24cc4 /home/user/Projects/apparmor.d virtiofs defaults 0 1 diff --git a/tests/packer/init/opensuse-gnome.user-data.yml b/tests/packer/init/opensuse-gnome.user-data.yml new file mode 100644 index 000000000..b54bb458e --- /dev/null +++ b/tests/packer/init/opensuse-gnome.user-data.yml @@ -0,0 +1,43 @@ +#cloud-config + +hostname: ${hostname} +locale: en_IE +keyboard: + layout: ie + +ssh_pwauth: true +users: + - name: ${username} + plain_text_passwd: ${password} + shell: /bin/bash + ssh_authorized_keys: + - ${ssh_key} + lock_passwd: false + sudo: ALL=(ALL) NOPASSWD:ALL + +package_update: true +package_upgrade: true +package_reboot_if_required: false +packages: + - apparmor-profiles + - bash-completion + - distribution-release + - git + - golang-packaging + - htop + - make + - rpmbuild + - vim + +write_files: + # Set some bash aliases + - path: /home/${username}/.bashrc + append: true + content: | + [[ -f ~/.bash_aliases ]] && source ~/.bash_aliases + + # Setup shared directory + - path: /etc/fstab + append: true + content: | + 0a31bc478ef8e2461a4b1cc10a24cc4 /home/user/Projects/apparmor.d virtiofs defaults 0 1 diff --git a/tests/packer/init/ubuntu-desktop.user-data.yml b/tests/packer/init/ubuntu22-desktop.user-data.yml similarity index 100% rename from tests/packer/init/ubuntu-desktop.user-data.yml rename to tests/packer/init/ubuntu22-desktop.user-data.yml diff --git a/tests/packer/init/ubuntu-desktop24.user-data.yml b/tests/packer/init/ubuntu24-desktop.user-data.yml similarity index 76% rename from tests/packer/init/ubuntu-desktop24.user-data.yml rename to tests/packer/init/ubuntu24-desktop.user-data.yml index 30a82279a..3c3807e29 100644 --- a/tests/packer/init/ubuntu-desktop24.user-data.yml +++ b/tests/packer/init/ubuntu24-desktop.user-data.yml @@ -2,6 +2,8 @@ # Based on https://github.com/canonical/autoinstall-desktop +# https://github.com/canonical/ubuntu-desktop-provision/blob/main/README.md + hostname: ${hostname} locale: en_IE keyboard: @@ -22,7 +24,7 @@ package_upgrade: true package_reboot_if_required: false packages: - ubuntu-desktop - - linux-generic-hwe-22.04 + - linux-generic-hwe-24.04 - qemu-guest-agent - spice-vdagent - terminator @@ -49,14 +51,14 @@ runcmd: # Remove other packages present by default in Ubuntu Server but not # normally present in Ubuntu Desktop. - - >- - apt-get -y purge - ubuntu-server ubuntu-server-minimal netplan.io cloud-init - binutils byobu curl dmeventd finalrd gawk - kpartx mdadm ncurses-term needrestart open-iscsi - sg3-utils ssh-import-id sssd thin-provisioning-tools tmux - sosreport screen open-vm-tools motd-news-config lxd-agent-loader - landscape-common fonts-ubuntu-console ethtool + # - >- + # apt-get -y purge + # ubuntu-server ubuntu-server-minimal netplan.io cloud-init + # binutils byobu curl dmeventd finalrd gawk + # kpartx mdadm ncurses-term needrestart open-iscsi + # sg3-utils ssh-import-id sssd thin-provisioning-tools tmux + # sosreport screen open-vm-tools motd-news-config lxd-agent-loader + # landscape-common fonts-ubuntu-console ethtool # Finally, remove things only installed as dependencies of other things # we have already removed. diff --git a/tests/packer/init/ubuntu-server.user-data.yml b/tests/packer/init/ubuntu24-server.user-data.yml similarity index 100% rename from tests/packer/init/ubuntu-server.user-data.yml rename to tests/packer/init/ubuntu24-server.user-data.yml diff --git a/tests/packer/opensuse.pkr.hcl b/tests/packer/opensuse.pkr.hcl index de9bafacb..49ba09f70 100644 --- a/tests/packer/opensuse.pkr.hcl +++ b/tests/packer/opensuse.pkr.hcl @@ -3,16 +3,13 @@ # SPDX-License-Identifier: GPL-2.0-only # TODO: Fully automate the creation of the base image -# To save some dev time, 'base_opensuse_kde' is manually created from the opensuse iso with: -# - KDE -# - username/password defined in the variables -# - cloud-init installed and enabled -source "qemu" "opensuse-kde" { +source "qemu" "opensuse" { disk_image = true - iso_url = "${var.iso_dir}/base_opensuse_kde.qcow2" - iso_checksum = "sha256:62a174725bdf26981d15969e53461b89359f7763450cbfd3e258d4035731279b" - iso_target_path = "${var.iso_dir}/base_opensuse_kde.qcow2" + iso_url = "${var.base_dir}/base-tumbleweed-gnome.qcow2" + iso_checksum = "sha256:223ed62160ef4f1a4f21b69c574f552a07eee6ef66cf66eef2b49c5a7c4864f4" + iso_target_path = "${var.base_dir}/base-tumbleweed-gnome.qcow2" + cpu_model = "host" cpus = 6 memory = 4096 disk_size = var.disk_size @@ -25,15 +22,15 @@ source "qemu" "opensuse-kde" { disk_compression = true disk_detect_zeroes = "unmap" disk_discard = "unmap" - output_directory = "${var.iso_dir}/packer/" - vm_name = "${var.prefix}${source.name}.qcow2" + output_directory = var.output + vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" boot_wait = "10s" firmware = var.firmware shutdown_command = "echo ${var.password} | sudo shutdown -hP now" cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", + "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" diff --git a/tests/packer/ubuntu.pkr.hcl b/tests/packer/ubuntu.pkr.hcl index 344a8bf43..052b460da 100644 --- a/tests/packer/ubuntu.pkr.hcl +++ b/tests/packer/ubuntu.pkr.hcl @@ -2,14 +2,14 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -source "qemu" "ubuntu-server" { +source "qemu" "ubuntu22" { disk_image = true - iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu.codename}/current/${var.release.ubuntu.codename}-server-cloudimg-amd64.img" - iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu-cloudimg-amd64.img" + iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu22.codename}/current/${var.release.ubuntu22.codename}-server-cloudimg-amd64.img" + iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu22.codename}/current/SHA256SUMS" + iso_target_path = "${var.iso_dir}/ubuntu22-cloudimg-amd64.img" cpu_model = "host" - cpus = 4 - memory = 2048 + cpus = 6 + memory = 4096 disk_size = var.disk_size accelerator = "kvm" headless = true @@ -20,15 +20,15 @@ source "qemu" "ubuntu-server" { disk_compression = true disk_detect_zeroes = "unmap" disk_discard = "unmap" - output_directory = "${var.output}/" - vm_name = "${var.prefix}${source.name}.qcow2" + output_directory = var.output + vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" boot_wait = "10s" firmware = var.firmware shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", + "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" @@ -39,14 +39,14 @@ source "qemu" "ubuntu-server" { } } -source "qemu" "ubuntu-server24" { +source "qemu" "ubuntu24" { disk_image = true iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/${var.release.ubuntu24.codename}-server-cloudimg-amd64.img" iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu24.codename}-cloudimg-amd64.img" + iso_target_path = "${var.iso_dir}/ubuntu24-cloudimg-amd64.img" cpu_model = "host" - cpus = 4 - memory = 2048 + cpus = 6 + memory = 4096 disk_size = var.disk_size accelerator = "kvm" headless = true @@ -57,89 +57,15 @@ source "qemu" "ubuntu-server24" { disk_compression = true disk_detect_zeroes = "unmap" disk_discard = "unmap" - output_directory = "${var.output}/" - vm_name = "${var.prefix}${source.name}.qcow2" + output_directory = var.output + vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" boot_wait = "10s" firmware = var.firmware shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/ubuntu-server.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} - -source "qemu" "ubuntu-desktop" { - disk_image = true - iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu.codename}/current/${var.release.ubuntu.codename}-server-cloudimg-amd64.img" - iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu-cloudimg-amd64.img" - cpu_model = "host" - cpus = 6 - memory = 4096 - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "10000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = "${var.output}/" - vm_name = "${var.prefix}${source.name}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} - -source "qemu" "ubuntu-desktop24" { - disk_image = true - iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/${var.release.ubuntu24.codename}-server-cloudimg-amd64.img" - iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu24.codename}-cloudimg-amd64.img" - cpu_model = "host" - cpus = 6 - memory = 4096 - disk_size = var.disk_size - accelerator = "kvm" - headless = false - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "10000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = "${var.output}/" - vm_name = "${var.prefix}${source.name}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}.user-data.yml", + "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" diff --git a/tests/packer/variables.pkr.hcl b/tests/packer/variables.pkr.hcl index 5a1cc17e8..c9ca4b62c 100644 --- a/tests/packer/variables.pkr.hcl +++ b/tests/packer/variables.pkr.hcl @@ -22,12 +22,6 @@ variable "ssh_publickey" { default = "~/.ssh/id_ed25519.pub" } -variable "ssh_privatekey" { - description = "Path to the ssh private key" - type = string - default = "~/.ssh/id_ed25519" -} - variable "disk_size" { description = "Disk size of the VM to build" type = string @@ -49,7 +43,7 @@ variable "base_dir" { variable "firmware" { description = "Path to the UEFI firmware" type = string - default = "/usr/share/edk2-ovmf/x64/OVMF_CODE.fd" + default = "/usr/share/edk2/x64/OVMF_CODE.fd" } variable "output" { @@ -83,7 +77,7 @@ variable "release" { version = string })) default = { - "ubuntu" : { + "ubuntu22" : { codename = "jammy", version = "22.04.2", }, @@ -99,5 +93,11 @@ variable "release" { codename = "tumbleweed", version = "", } + "fedora" : { + codename = "40", + version = "1.14", + } } } + +} From 31af7586394c1d849e9d4a7dc580ab9c89e7b92e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Oct 2024 12:16:42 +0100 Subject: [PATCH 0317/1455] fix(test): packer hcl & uefi path --- tests/Vagrantfile | 2 +- tests/packer/variables.pkr.hcl | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/tests/Vagrantfile b/tests/Vagrantfile index fce3a3f0d..4bdaac985 100644 --- a/tests/Vagrantfile +++ b/tests/Vagrantfile @@ -53,7 +53,7 @@ Vagrant.configure("2") do |config| libvirt.redirdev :type => "spicevmc" end if instance.fetch('uefi', default['uefi']) - libvirt.loader = '/usr/share/edk2-ovmf/x64/OVMF_CODE.fd' + libvirt.loader = '/usr/share/edk2/x64/OVMF_CODE.fd' end end diff --git a/tests/packer/variables.pkr.hcl b/tests/packer/variables.pkr.hcl index c9ca4b62c..a37c89bf0 100644 --- a/tests/packer/variables.pkr.hcl +++ b/tests/packer/variables.pkr.hcl @@ -99,5 +99,3 @@ variable "release" { } } } - -} From 4f861158cf94510fc6a26b1704fd54ea98f8437f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Oct 2024 14:05:40 +0100 Subject: [PATCH 0318/1455] build: unify locally build package output directory. --- .gitlab-ci.yml | 2 +- Makefile | 3 +-- dists/build.sh | 2 +- dists/docker.sh | 10 ++++++---- tests/packer/builds.pkr.hcl | 6 +++--- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 1acf9151f..a24ac7975 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -4,7 +4,7 @@ include: - template: Security/SAST.gitlab-ci.yml variables: - PKGDEST: $CI_PROJECT_DIR/packages + PKGDEST: $CI_PROJECT_DIR/.pkg PACKAGER: 'Alexandre Pujol ' stages: diff --git a/Makefile b/Makefile index 9b25bb5ec..8ee380abd 100644 --- a/Makefile +++ b/Makefile @@ -120,5 +120,4 @@ serve: clean: @rm -rf \ debian/.debhelper debian/debhelper* debian/*.debhelper debian/${PKGNAME} \ - ${PKGNAME}-*.pkg.tar.zst.sig ${PKGNAME}-*.pkg.tar.zst coverage.out \ - ${PKGNAME}_*.* ${PKGNAME}-*.rpm ${BUILD} + .pkg/${PKGNAME}* ${BUILD} coverage.out diff --git a/dists/build.sh b/dists/build.sh index a566291bd..08d43a49a 100644 --- a/dists/build.sh +++ b/dists/build.sh @@ -8,7 +8,7 @@ set -eu -o pipefail readonly COMMAND="$1" -readonly OUTPUT="${PKGDEST:-$PWD}" +readonly OUTPUT=".pkg" readonly PKGNAME=apparmor.d VERSION="0.$(git rev-list --count HEAD)" readonly VERSION diff --git a/dists/docker.sh b/dists/docker.sh index 500918c5f..e0cb64431 100644 --- a/dists/docker.sh +++ b/dists/docker.sh @@ -12,6 +12,7 @@ readonly PREFIX="builder-" readonly PKGNAME=apparmor.d readonly VOLUME=/tmp/build readonly BUILDIR=/home/build/tmp +readonly OUTPUT=".pkg" readonly COMMAND="$1" VERSION="0.$(git rev-list --count HEAD)" PACKAGER="$(git config user.name) <$(git config user.email)>" @@ -62,7 +63,7 @@ build_in_docker_makepkg() { fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh pkg - mv "$VOLUME/$PKGNAME"-*.pkg.* . + mv "$VOLUME/$PKGNAME"-*.pkg.* "$OUTPUT" } build_in_docker_dpkg() { @@ -85,7 +86,7 @@ build_in_docker_dpkg() { fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh dpkg - mv "$VOLUME/$PKGNAME/${PKGNAME}_${VERSION}-1"_*.* . + mv "$VOLUME/$PKGNAME/${PKGNAME}_${VERSION}-1"_*.* "$OUTPUT" } build_in_docker_rpm() { @@ -104,14 +105,14 @@ build_in_docker_rpm() { fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh rpm - mv "$VOLUME/$PKGNAME/$PKGNAME-$VERSION-"*.rpm . + mv "$VOLUME/$PKGNAME/$PKGNAME-$VERSION-"*.rpm "$OUTPUT" } main() { case "$COMMAND" in archlinux) # build_in_docker_makepkg "$COMMAND" - PKGDEST=. makepkg -Cf + PKGDEST="$OUTPUT" makepkg -Cf ;; debian | ubuntu | whonix) @@ -128,4 +129,5 @@ main() { esac } +mkdir -p "$OUTPUT" main "$@" diff --git a/tests/packer/builds.pkr.hcl b/tests/packer/builds.pkr.hcl index 33288e6b5..c658a8bfd 100644 --- a/tests/packer/builds.pkr.hcl +++ b/tests/packer/builds.pkr.hcl @@ -22,7 +22,7 @@ build { only = ["qemu.archlinux"] destination = "/tmp/src/" sources = [ - "${path.cwd}/../apparmor.d-${var.version}-1-x86_64.pkg.tar.zst", + "${path.cwd}/../.pkg/apparmor.d-${var.version}-1-x86_64.pkg.tar.zst", ] } @@ -61,12 +61,12 @@ build { } post-processor "vagrant" { - output = "${var.base_dir}/packer_${var.prefix}${source.name}.box" + output = "${var.base_dir}/packer_${var.prefix}${source.name}-${var.flavor}.box" } post-processor "shell-local" { inline = [ - "vagrant box add --force --name ${var.prefix}${source.name} ${var.base_dir}/packer_${var.prefix}${source.name}.box" + "vagrant box add --force --name ${var.prefix}${source.name}-${var.flavor} ${var.base_dir}/packer_${var.prefix}${source.name}-${var.flavor}.box" ] } From 146bda8f454c4777e967ef41ff05eec1fe496933 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Oct 2024 21:41:44 +0100 Subject: [PATCH 0319/1455] test(packer): as base image for the cosmic DE. --- tests/boxes.yml | 4 + .../init/archlinux-cosmic.user-data.yml | 90 +++++++++++++++++++ tests/packer/init/init.sh | 20 ++--- 3 files changed, 104 insertions(+), 10 deletions(-) create mode 100644 tests/packer/init/archlinux-cosmic.user-data.yml diff --git a/tests/boxes.yml b/tests/boxes.yml index edda41096..ef037e07f 100644 --- a/tests/boxes.yml +++ b/tests/boxes.yml @@ -18,6 +18,10 @@ boxes: box: aa-archlinux-xfce uefi: false + - name: arch-cosmic + box: aa-archlinux-cosmic + uefi: false + - name: arch-server box: aa-archlinux-server uefi: false diff --git a/tests/packer/init/archlinux-cosmic.user-data.yml b/tests/packer/init/archlinux-cosmic.user-data.yml new file mode 100644 index 000000000..442c32470 --- /dev/null +++ b/tests/packer/init/archlinux-cosmic.user-data.yml @@ -0,0 +1,90 @@ +#cloud-config + +hostname: ${hostname} +locale: en_IE +keyboard: + layout: ie + +ssh_pwauth: true +users: + - name: ${username} + plain_text_passwd: ${password} + shell: /bin/bash + ssh_authorized_keys: + - ${ssh_key} + lock_passwd: false + sudo: ALL=(ALL) NOPASSWD:ALL + +package_update: true +package_upgrade: true +package_reboot_if_required: false +packages: + # Install core packages + - apparmor + - audit + - base-devel + - firewalld + - qemu-guest-agent + - rng-tools + - spice-vdagent + + # Install usefull core packages + - bash-completion + - git + - htop + - man + - pass + - python-notify2 + - vim + - wget + + # Install basic services + - networkmanager + - cups + - cups-pdf + - system-config-printer + + # Install Graphical Interface + - cosmic + + # Install Applications + - firefox + - chromium + - terminator + +runcmd: + # Regenerate grub.cfg + - grub-mkconfig -o /boot/grub/grub.cfg + + # Remove swapfile + - swapoff -a + - rm -rf /swap/ + - sed -e "/swap/d" -i /etc/fstab + + # Enable core services + - systemctl enable apparmor + - systemctl enable auditd + - systemctl enable cosmic-greeter + - systemctl enable NetworkManager + - systemctl enable rngd + - systemctl enable avahi-daemon + - systemctl enable systemd-timesyncd.service + +write_files: + # Enable AppArmor in kernel parameters + - path: /etc/default/grub + append: true + content: | + GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT lsm=landlock,lockdown,yama,integrity,apparmor,bpf apparmor.debug=1" + + # Set some bash aliases + - path: /etc/skel/.bashrc + append: true + content: | + [[ -f ~/.bash_aliases ]] && source ~/.bash_aliases + + # Setup shared directory + - path: /etc/fstab + append: true + content: | + 0a31bc478ef8e2461a4b1cc10a24cc4 /home/user/Projects/apparmor.d virtiofs defaults 0 1 diff --git a/tests/packer/init/init.sh b/tests/packer/init/init.sh index df300c0c4..495d2f2a5 100644 --- a/tests/packer/init/init.sh +++ b/tests/packer/init/init.sh @@ -15,16 +15,6 @@ readonly SRC=/tmp/src readonly DISTRIBUTION main() { - install -dm0750 -o "$SUDO_USER" -g "$SUDO_USER" "/home/$SUDO_USER/Projects/" "/home/$SUDO_USER/Projects/apparmor.d" "/home/$SUDO_USER/.config/" - install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/.bash_aliases "/home/$SUDO_USER/.bash_aliases" - install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/monitors.xml "/home/$SUDO_USER/.config/monitors.xml" - install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/htoprc "/home/$SUDO_USER/.config/htop/htoprc" - install -Dm0644 $SRC/site.local /etc/apparmor.d/tunables/multiarch.d/site.local - install -Dm0755 $SRC/aa-update /usr/bin/aa-update - install -Dm0755 $SRC/aa-log-clean /usr/bin/aa-log-clean - cat $SRC/parser.conf >>/etc/apparmor/parser.conf - chown -R "$SUDO_USER:$SUDO_USER" "/home/$SUDO_USER/.config/" - case "$DISTRIBUTION" in arch) pacman --noconfirm -U $SRC/*.pkg.tar.zst @@ -45,6 +35,16 @@ main() { ;; esac + + install -dm0750 -o "$SUDO_USER" -g "$SUDO_USER" "/home/$SUDO_USER/Projects/" "/home/$SUDO_USER/Projects/apparmor.d" "/home/$SUDO_USER/.config/" + install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/.bash_aliases "/home/$SUDO_USER/.bash_aliases" + install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/monitors.xml "/home/$SUDO_USER/.config/monitors.xml" + install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/htoprc "/home/$SUDO_USER/.config/htop/htoprc" + install -Dm0644 $SRC/site.local /etc/apparmor.d/tunables/multiarch.d/site.local + install -Dm0755 $SRC/aa-update /usr/bin/aa-update + install -Dm0755 $SRC/aa-log-clean /usr/bin/aa-log-clean + cat $SRC/parser.conf >>/etc/apparmor/parser.conf + chown -R "$SUDO_USER:$SUDO_USER" "/home/$SUDO_USER/.config/" } main "$@" From cc47d8d55783c823b46fd7bfdc17f247d8580476 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 8 Oct 2024 21:24:29 +0100 Subject: [PATCH 0320/1455] doc: minor improvment of dev doc. --- docs/development/dbus.md | 5 +---- docs/development/directives.md | 3 +-- docs/development/index.md | 4 ++-- 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/docs/development/dbus.md b/docs/development/dbus.md index 38e931b88..e4133e5d1 100644 --- a/docs/development/dbus.md +++ b/docs/development/dbus.md @@ -29,10 +29,7 @@ For more access, simply use the [`aa:dbus talk`](#dbus-directive) directive. There is a trade of between security and maintenance to make: - `aa:dbus talk` will generate less issue as it gives full talk access -- `abstractions/bus/*` will provide more restriction, and possibly more issue. - -Ideally, these rules should be automatically generated from either the dbus interface documentation or the program call. - +- `abstractions/bus/*` will provide more restriction, and possibly more issue. In the future, these rules will be automatically generated from the interface documentation. ## Dbus Directive diff --git a/docs/development/directives.md b/docs/development/directives.md index 8897f9519..53c7e7dcd 100644 --- a/docs/development/directives.md +++ b/docs/development/directives.md @@ -118,8 +118,7 @@ The `exec` directive is useful to allow executing transitions to a profile witho **`[X]`** -: If `X` is set, the directive will conserve the `x` file rules regardless of the transition. Not enabled by default as it may conflict with the parent profile. - +: If `X` is set, the directive will conserve the `x` file rules regardless of the transition. It is not enabled by default as it may conflict with the parent profile. Indeed, automatically adding `Px` and `ix` transition in a profile is a very effective way to have conflict between transitions as you can automatically add rule already present in the profile but with another transition (you would then get the AppArmor error: `profile has merged rule with conflicting x modifiers`). **Example** diff --git a/docs/development/index.md b/docs/development/index.md index 2e12a466b..f44d86aee 100644 --- a/docs/development/index.md +++ b/docs/development/index.md @@ -62,11 +62,11 @@ If you're looking to contribute to `apparmor.d` you can get started by going to your devices or for your use case. -## Additional recommended documentation +## Recommended documentation * [The AppArmor Core Policy Reference](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference) * [The openSUSE Documentation](https://doc.opensuse.org/documentation/leap/security/html/book-security/part-apparmor.html) -* https://documentation.suse.com/sles/12-SP5/html/SLES-all/cha-apparmor-intro.html +* [SUSE Documentation](https://documentation.suse.com/sles/12-SP5/html/SLES-all/cha-apparmor-intro.html) * [The AppArmor.d man page](https://man.archlinux.org/man/apparmor.d.5) * [F**k AppArmor](https://presentations.nordisch.org/apparmor/#/) * [A Brief Tour of Linux Security Modules](https://www.starlab.io/blog/a-brief-tour-of-linux-security-modules) From 28706b2a78d82dc3efe912a8c7b2b8155253fca8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 8 Oct 2024 22:53:52 +0100 Subject: [PATCH 0321/1455] doc: initial preparation for re-attached path. --- apparmor.d/tunables/multiarch.d/system | 6 ++++-- docs/development/internal.md | 12 ++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 2dd715567..2218a3dd6 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -151,7 +151,9 @@ @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 -# Container path given to attach_disconnected.path=@{ct}@{profile_name} -@{ct}=/ct- +#aa:only abi3 +# Attachment path for attach_disconnected.path flag. +# Automatically generated and set in profile preamble on ABI4. Disabled on ABI3. +@{att}=/ # vim:syntax=apparmor diff --git a/docs/development/internal.md b/docs/development/internal.md index 58d66058f..459f1ad71 100644 --- a/docs/development/internal.md +++ b/docs/development/internal.md @@ -157,6 +157,18 @@ It is recommended to transition [in a subprofile](abstractions.md#appsystemctl) All common programs are tracked and labelled in the [`apparmor.d/tunables/multiarch.d/programs`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/programs) and [`apparmor.d/tunables/multiarch.d/paths`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/paths) files. They can be used in a `child-open` profile or directly in a profile. They are useful to allow opening resources using a kind of program (browsers, image viewer, text editor...), instead of allowing a given program path. +## Re-attached path + +The flag `attach_disconnect` control how disconnected paths are handled. It determines if pathnames resolved to be outside the namespace are attached to the root (ie. have the `/` character prepended). +It is a security issue as it allows disconnected paths to alias to other files that exist in the file name. Therefore, it is only provided to work around problems that can arise with sandboxed programs. + +AppAmor 4.0 provides the `attach_disconnect.path` flag allowing to reattach this path to a prefix that is not `/`. When used it provide an important security improvement from AppArmor 3.0. + +**`apparmor.d`** uses `attach_disconnect.path` by **default and automatically** on all profiles with the `attach_disconnect` flag. The attached path is set to `@{att}` a new dynamically generated variable set at build time in the preamble of all profile to be: + +- `@{att}=/att/` for profile with `attach_disconnect` flag. +- `@{att}=/` for other profiles + ## User Confinement [:material-police-badge-outline:{ .pg-red }](../full-system-policy.md "Only for Full System Policy (FSP)") From 630e785787437d2f1935e115ecba90c782912f1b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 8 Oct 2024 22:59:50 +0100 Subject: [PATCH 0322/1455] feat(tunable): remove @{user_tmp_dirs} as it refers to different kind of temp folder. --- apparmor.d/groups/gpg/gpg-agent | 12 ++++++------ apparmor.d/tunables/home.d/apparmor.d | 1 - docs/variables.md | 1 - 3 files changed, 6 insertions(+), 8 deletions(-) diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index 17e360d09..75bb7583f 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -53,12 +53,12 @@ profile gpg-agent @{exec_path} { owner @{run}/user/@{uid}/gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{run}/user/@{uid}/gnupg/sshcontrol r, - owner @{user_tmp_dirs}/**/{.,}gnupg/ rw, - owner @{user_tmp_dirs}/**/{.,}gnupg/*.conf r, - owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw, - owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, - owner @{user_tmp_dirs}/**/{.,}gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, - owner @{user_tmp_dirs}/**/{.,}gnupg/sshcontrol r, + owner @{tmp}/**/{.,}gnupg/ rw, + owner @{tmp}/**/{.,}gnupg/*.conf r, + owner @{tmp}/**/{.,}gnupg/private-keys-v1.d/ rw, + owner @{tmp}/**/{.,}gnupg/private-keys-v1.d/@{hex}.key{,.tmp} rw, + owner @{tmp}/**/{.,}gnupg/{,d.@{rand}/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner @{tmp}/**/{.,}gnupg/sshcontrol r, #aa:only pacman owner /etc/pacman.d/gnupg/ rw, diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index c23a8d956..f1be9acbe 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -52,7 +52,6 @@ # User build directories and output @{user_build_dirs}="/tmp/build/" @{user_pkg_dirs}="/tmp/pkg/" -@{user_tmp_dirs}=@{run}/user/@{uid} /tmp/ @{user_img_dirs}=@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR} # Other user directories diff --git a/docs/variables.md b/docs/variables.md index b413e61f2..ef2533c0f 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -68,7 +68,6 @@ title: Variables References | State | `@{user_state_dirs}` | ` @{HOME}/@{XDG_STATE_DIR}` | | Build | `@{user_build_dirs}` | `/tmp/build/` | | Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | -| Tmp | `@{user_tmp_dirs}` | `@{run}/user/@{uid} /tmp/` | From 94703681d98e2df45f7ace037ff135eb287a8984 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 8 Oct 2024 23:44:13 +0100 Subject: [PATCH 0323/1455] build: build tasks: dev -> hotfix. --- cmd/prebuild/main.go | 2 +- pkg/prebuild/builder/{dev.go => hotfix.go} | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) rename pkg/prebuild/builder/{dev.go => hotfix.go} (60%) diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 25e422cfd..2002999a6 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -32,7 +32,7 @@ func init() { // Build tasks applied by default builder.Register( "userspace", // Resolve variable in the userspace profile - "dev", // Temporary fix for #74, #80 & #235 + "hotfix", // Temporary fix for #74, #80 & #235 ) // Compatibility with AppArmor 3 diff --git a/pkg/prebuild/builder/dev.go b/pkg/prebuild/builder/hotfix.go similarity index 60% rename from pkg/prebuild/builder/dev.go rename to pkg/prebuild/builder/hotfix.go index 19fbe409d..f7e6143b1 100644 --- a/pkg/prebuild/builder/dev.go +++ b/pkg/prebuild/builder/hotfix.go @@ -10,7 +10,7 @@ import ( ) var ( - regDev = util.ToRegexRepl([]string{ + regHotfix = util.ToRegexRepl([]string{ `Cx`, `cx`, `PUx`, `pux`, `Px`, `px`, @@ -18,19 +18,19 @@ var ( }) ) -type Dev struct { +type Hotfix struct { prebuild.Base } func init() { - RegisterBuilder(&Dev{ + RegisterBuilder(&Hotfix{ Base: prebuild.Base{ - Keyword: "dev", - Msg: "Apply test development changes", + Keyword: "hotfix", + Msg: "Temporary fix for #74, #80 & #235", }, }) } -func (b Dev) Apply(opt *Option, profile string) (string, error) { - return regDev.Replace(profile), nil +func (b Hotfix) Apply(opt *Option, profile string) (string, error) { + return regHotfix.Replace(profile), nil } From 6afcfa85ec30a917bf698dd5c567af26fa60659f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 13:31:57 +0100 Subject: [PATCH 0324/1455] fix(ci): ensure output build directory exist. --- Makefile | 2 +- dists/build.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 8ee380abd..9c8ae3eae 100644 --- a/Makefile +++ b/Makefile @@ -5,7 +5,7 @@ DESTDIR ?= / BUILD ?= .build -PKGDEST ?= /tmp/pkg +PKGDEST ?= ${PWD}/.pkg PKGNAME := apparmor.d P = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*))) diff --git a/dists/build.sh b/dists/build.sh index 08d43a49a..523bf8ca4 100644 --- a/dists/build.sh +++ b/dists/build.sh @@ -8,7 +8,7 @@ set -eu -o pipefail readonly COMMAND="$1" -readonly OUTPUT=".pkg" +readonly OUTPUT="$PWD/.pkg" readonly PKGNAME=apparmor.d VERSION="0.$(git rev-list --count HEAD)" readonly VERSION From e17b682e51f361aab58d98f4bfd63a8aba536756 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 13:56:27 +0100 Subject: [PATCH 0325/1455] feat(profile): minor profile improvments. --- apparmor.d/groups/systemd/systemd-inhibit | 2 ++ apparmor.d/groups/systemd/systemd-network-generator | 2 ++ apparmor.d/groups/virt/dockerd | 2 +- apparmor.d/profiles-a-f/alsactl | 3 +++ apparmor.d/profiles-m-r/mission-control | 1 + apparmor.d/profiles-m-r/packagekitd | 1 + apparmor.d/tunables/multiarch.d/profiles | 2 +- 7 files changed, 11 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/systemd/systemd-inhibit b/apparmor.d/groups/systemd/systemd-inhibit index 2051a5b19..9938015d3 100644 --- a/apparmor.d/groups/systemd/systemd-inhibit +++ b/apparmor.d/groups/systemd/systemd-inhibit @@ -14,6 +14,8 @@ profile systemd-inhibit @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_resource, + signal receive set=term peer=packagekitd, + @{exec_path} mr, @{bin}/cat rix, diff --git a/apparmor.d/groups/systemd/systemd-network-generator b/apparmor.d/groups/systemd/systemd-network-generator index c65980901..e22d89629 100644 --- a/apparmor.d/groups/systemd/systemd-network-generator +++ b/apparmor.d/groups/systemd/systemd-network-generator @@ -17,6 +17,8 @@ profile systemd-network-generator @{exec_path} { owner @{run}/systemd/network/{,**} rw, + @{run}/credentials/systemd-network-generator.service/ r, + include if exists } diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 91d7baf3e..6b1616e94 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -89,7 +89,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { owner @{lib}/containerd/** w, owner @{lib}/docker/overlay2/*/work/{,**} rw, - owner /var/lib/containerd/** w, + owner /var/lib/containerd/** rw, owner /var/lib/docker/{,**} rwk, owner /var/lib/docker/tmp/qemu-check@{int}/check rix, diff --git a/apparmor.d/profiles-a-f/alsactl b/apparmor.d/profiles-a-f/alsactl index b881e27e1..b2b97a62a 100644 --- a/apparmor.d/profiles-a-f/alsactl +++ b/apparmor.d/profiles-a-f/alsactl @@ -22,6 +22,9 @@ profile alsactl @{exec_path} { @{run}/lock/card@{int}.lock rwk, owner @{run}/alsa/{,**} rw, + @{sys}/devices/@{pci}/subsystem_device r, + @{sys}/devices/@{pci}/subsystem_vendor r, + include if exists } diff --git a/apparmor.d/profiles-m-r/mission-control b/apparmor.d/profiles-m-r/mission-control index a908feb57..efe44ebc2 100644 --- a/apparmor.d/profiles-m-r/mission-control +++ b/apparmor.d/profiles-m-r/mission-control @@ -23,6 +23,7 @@ profile mission-control @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/telepathy/mission-control/*.cfg* rw, owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk, + owner @{user_cache_dirs}/.mc_connections rw, @{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index 267ce1dbe..3eb16caad 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -36,6 +36,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { network netlink raw, signal send set=int peer=apt-methods-*, + signal send set=term peer=systemd-inhibit, #aa:dbus own bus=system name=org.freedesktop.PackageKit diff --git a/apparmor.d/tunables/multiarch.d/profiles b/apparmor.d/tunables/multiarch.d/profiles index dd9386b09..a24cefc01 100644 --- a/apparmor.d/tunables/multiarch.d/profiles +++ b/apparmor.d/tunables/multiarch.d/profiles @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Define some variables for some commonly used profile. They may be used in +# Define some variables for some commonly used profile. They may be used in # other profiles peer label. # All variables that refer to a profile name should be prefixed with `p_` From 68127c385998dbd72b62a201a5a6bbeb69174a4b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 14:03:54 +0100 Subject: [PATCH 0326/1455] build: allow to run prebuild outside of this project. --- cmd/prebuild/main.go | 2 +- pkg/prebuild/builder/userspace.go | 2 +- pkg/prebuild/cli/cli.go | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 2002999a6..91f77e2e0 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -31,7 +31,7 @@ func init() { // Build tasks applied by default builder.Register( - "userspace", // Resolve variable in the userspace profile + "userspace", // Resolve variable in profile attachments "hotfix", // Temporary fix for #74, #80 & #235 ) diff --git a/pkg/prebuild/builder/userspace.go b/pkg/prebuild/builder/userspace.go index be5886cbd..d62cad522 100644 --- a/pkg/prebuild/builder/userspace.go +++ b/pkg/prebuild/builder/userspace.go @@ -27,7 +27,7 @@ func init() { RegisterBuilder(&Userspace{ Base: prebuild.Base{ Keyword: "userspace", - Msg: "Bypass userspace tools restriction", + Msg: "Resolve variable in profile attachments", }, }) } diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 329729e94..7c91d8281 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -73,10 +73,10 @@ func Prebuild() { return } - if full { + if full && paths.New("apparmor.d/groups/_full").Exist() { prepare.Register("fsp") builder.Register("fsp") - } else { + } else if prebuild.SystemdDir.Exist() { prepare.Register("systemd-early") } From c923cc7ccffb9c49c3b54adaf2918092631247e9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 21:37:26 +0100 Subject: [PATCH 0327/1455] feat(abs): use nss-systemd in nameservice-strict. --- apparmor.d/abstractions/nameservice-strict | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-) diff --git a/apparmor.d/abstractions/nameservice-strict b/apparmor.d/abstractions/nameservice-strict index b1d474717..0cac5a1a2 100644 --- a/apparmor.d/abstractions/nameservice-strict +++ b/apparmor.d/abstractions/nameservice-strict @@ -6,6 +6,8 @@ # Many programs wish to perform nameservice-like operations, such as looking up # users by name or id, groups by name or id, hosts by name or IP, etc. + include + @{etc_ro}/default/nss r, @{etc_ro}/gai.conf r, @{etc_ro}/group r, @@ -31,23 +33,6 @@ @{run}/systemd/resolve/resolv.conf r, @{run}/systemd/resolve/stub-resolv.conf r, - # NSS records from systemd-userdbd.service - # - # Allow User/Group lookups via common VarLink socket APIs. Applications need - # to either consult all of them or the io.systemd.Multiplexer frontend. - # - # https://systemd.io/USER_GROUP_API/ - # https://systemd.io/USER_RECORD/ - # https://www.freedesktop.org/software/systemd/man/nss-systemd.html - # - @{run}/systemd/userdb/ r, - @{run}/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users - @{run}/systemd/userdb/io.systemd.Home rw, # systemd-home dirs - @{run}/systemd/userdb/io.systemd.Machine rw, # systemd-machined - @{run}/systemd/userdb/io.systemd.Multiplexer rw, - @{run}/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS - @{PROC}/sys/kernel/random/boot_id r, - - include if exists + include if exists # vim:syntax=apparmor From fc43400c268cef7db07f01d97eb860343f17bd76 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 22:19:01 +0100 Subject: [PATCH 0328/1455] feat(abs): add abi reference to all abstractions. --- apparmor.d/abstractions/X-strict | 3 +++ apparmor.d/abstractions/app-launcher-root | 2 ++ apparmor.d/abstractions/app-launcher-user | 2 ++ apparmor.d/abstractions/app-open | 2 ++ apparmor.d/abstractions/app/bus | 2 ++ apparmor.d/abstractions/app/chromium | 2 ++ apparmor.d/abstractions/app/editor | 2 ++ apparmor.d/abstractions/app/firefox | 2 ++ apparmor.d/abstractions/app/kmod | 2 ++ apparmor.d/abstractions/app/open | 2 ++ apparmor.d/abstractions/app/pgrep | 2 ++ apparmor.d/abstractions/app/pkexec | 2 ++ apparmor.d/abstractions/app/sudo | 2 ++ apparmor.d/abstractions/app/systemctl | 2 ++ apparmor.d/abstractions/app/udevadm | 2 ++ apparmor.d/abstractions/audio-client | 2 ++ apparmor.d/abstractions/audio-server | 2 ++ apparmor.d/abstractions/bash-strict | 2 ++ apparmor.d/abstractions/bus-accessibility | 2 ++ apparmor.d/abstractions/bus-session | 2 ++ apparmor.d/abstractions/bus-system | 2 ++ apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry | 2 ++ apparmor.d/abstractions/bus/com.canonical.dbusmenu | 2 ++ apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 | 2 ++ apparmor.d/abstractions/bus/net.hadess.PowerProfiles | 2 ++ apparmor.d/abstractions/bus/net.hadess.SwitcherooControl | 2 ++ apparmor.d/abstractions/bus/net.reactivated.Fprint | 2 ++ apparmor.d/abstractions/bus/org.a11y | 2 ++ apparmor.d/abstractions/bus/org.bluez | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.Accounts | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.Avahi | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.ColorManager | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.FileManager1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.NetworkManager | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.Notifications | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.PackageKit | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver | 2 ++ .../abstractions/bus/org.freedesktop.Tracker3.Miner.Files | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.UDisks2 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.UPower | 2 ++ .../abstractions/bus/org.freedesktop.background.Monitor | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.hostname1 | 2 ++ .../bus/org.freedesktop.impl.portal.PermissionStore | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.locale1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.login1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.login1.Session | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.network1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.resolve1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.secrets | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.systemd1 | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.systemd1-session | 2 ++ apparmor.d/abstractions/bus/org.freedesktop.timedate1 | 2 ++ apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 | 2 ++ apparmor.d/abstractions/bus/org.gnome.DisplayManager | 2 ++ apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig | 2 ++ apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor | 2 ++ .../abstractions/bus/org.gnome.Nautilus.FileOperations2 | 2 ++ apparmor.d/abstractions/bus/org.gnome.ScreenSaver | 2 ++ apparmor.d/abstractions/bus/org.gnome.SessionManager | 2 ++ apparmor.d/abstractions/bus/org.gnome.Shell.Introspect | 2 ++ .../abstractions/bus/org.gtk.Private.RemoteVolumeMonitor | 2 ++ apparmor.d/abstractions/bus/org.gtk.vfs.Daemon | 2 ++ apparmor.d/abstractions/bus/org.gtk.vfs.Metadata | 2 ++ apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker | 2 ++ apparmor.d/abstractions/bus/org.kde.StatusNotifierItem | 1 + apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher | 2 ++ apparmor.d/abstractions/bus/org.kde.kwalletd | 2 ++ apparmor.d/abstractions/common/app | 2 ++ apparmor.d/abstractions/common/apt | 2 ++ apparmor.d/abstractions/common/bwrap | 2 ++ apparmor.d/abstractions/common/chromium | 2 ++ apparmor.d/abstractions/common/electron | 2 ++ apparmor.d/abstractions/common/game | 2 ++ apparmor.d/abstractions/common/gnome | 2 ++ apparmor.d/abstractions/common/steam-game | 2 ++ apparmor.d/abstractions/common/systemd | 2 ++ apparmor.d/abstractions/dconf-write | 2 ++ apparmor.d/abstractions/deny-sensitive-home | 2 ++ apparmor.d/abstractions/desktop | 2 ++ apparmor.d/abstractions/devices-usb | 2 ++ apparmor.d/abstractions/disks-read | 2 ++ apparmor.d/abstractions/disks-write | 2 ++ apparmor.d/abstractions/dri | 2 ++ apparmor.d/abstractions/fish | 2 ++ apparmor.d/abstractions/fontconfig-cache-read | 2 ++ apparmor.d/abstractions/fontconfig-cache-write | 2 ++ apparmor.d/abstractions/glfw | 2 ++ apparmor.d/abstractions/gnome-strict | 2 ++ apparmor.d/abstractions/graphics | 2 ++ apparmor.d/abstractions/graphics-full | 2 ++ apparmor.d/abstractions/gstreamer | 2 ++ apparmor.d/abstractions/kde-strict | 2 ++ apparmor.d/abstractions/nameservice-strict | 4 +++- apparmor.d/abstractions/nvidia-strict | 2 ++ apparmor.d/abstractions/qt5-shader-cache | 2 ++ apparmor.d/abstractions/shells | 2 ++ apparmor.d/abstractions/thumbnails-cache-read | 2 ++ apparmor.d/abstractions/thumbnails-cache-write | 2 ++ apparmor.d/abstractions/trash-strict | 2 ++ apparmor.d/abstractions/uim | 2 ++ apparmor.d/abstractions/user-download-strict | 2 ++ apparmor.d/abstractions/user-read | 2 ++ apparmor.d/abstractions/user-read-strict | 2 ++ apparmor.d/abstractions/user-write-strict | 2 ++ apparmor.d/abstractions/vulkan-strict | 2 ++ apparmor.d/abstractions/xfce | 2 ++ apparmor.d/abstractions/zsh | 2 ++ 112 files changed, 225 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/X-strict b/apparmor.d/abstractions/X-strict index 6a29d1764..4c506da69 100644 --- a/apparmor.d/abstractions/X-strict +++ b/apparmor.d/abstractions/X-strict @@ -2,6 +2,9 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + + # The unix socket to use to connect to the display unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"), unix (connect, receive, send) type=stream peer=(addr="@/tmp/.ICE-unix/[0-9]*"), diff --git a/apparmor.d/abstractions/app-launcher-root b/apparmor.d/abstractions/app-launcher-root index 2aaecbd21..5d2f74363 100644 --- a/apparmor.d/abstractions/app-launcher-root +++ b/apparmor.d/abstractions/app-launcher-root @@ -3,6 +3,8 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + @{bin}/** PUx, /usr/local/{s,}bin/** PUx, diff --git a/apparmor.d/abstractions/app-launcher-user b/apparmor.d/abstractions/app-launcher-user index 04b20e84d..800de5106 100644 --- a/apparmor.d/abstractions/app-launcher-user +++ b/apparmor.d/abstractions/app-launcher-user @@ -3,6 +3,8 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + @{bin}/** PUx, /opt/*/** PUx, /usr/share/** PUx, diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index f0fd32206..900fdc3c8 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -8,6 +8,8 @@ # Ultimately, only sandbox manager such as like bwrap, snap, flatpak, firejail # should be present here. Until this day, this profile will be a controlled mess. + abi , + # Sandbox managers @{bin}/bwrap rPUx, @{bin}/firejail rPUx, diff --git a/apparmor.d/abstractions/app/bus b/apparmor.d/abstractions/app/bus index d1d0d8cb7..d1bd606a6 100644 --- a/apparmor.d/abstractions/app/bus +++ b/apparmor.d/abstractions/app/bus @@ -4,6 +4,8 @@ # Minimal set of rules for dbus-send/dbus-launch. + abi , + include @{bin}/dbus-launch mix, diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 81d37113d..6bf3f26ed 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -16,6 +16,8 @@ # or abstractions/common/electron instead. # + abi , + include include include diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index d6e346f36..9daec6ad1 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -3,6 +3,8 @@ # Copyright (C) 2024 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only + abi , + include include diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index c94ef8476..2f9c93937 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -12,6 +12,8 @@ # @{cache_dirs} = @{user_cache_dirs}/mozilla/ # + abi , + include include include diff --git a/apparmor.d/abstractions/app/kmod b/apparmor.d/abstractions/app/kmod index ae10dbbfc..ad02acc54 100644 --- a/apparmor.d/abstractions/app/kmod +++ b/apparmor.d/abstractions/app/kmod @@ -2,6 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include @{bin}/depmod mr, diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index f21a2a7de..9ae49c4bd 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -4,6 +4,8 @@ # Full set of rules for child-open-* profiles. + abi , + include @{open_path} mrix, diff --git a/apparmor.d/abstractions/app/pgrep b/apparmor.d/abstractions/app/pgrep index aaf14d859..13ebcd390 100644 --- a/apparmor.d/abstractions/app/pgrep +++ b/apparmor.d/abstractions/app/pgrep @@ -4,6 +4,8 @@ # Minimal set of rules for pgrep/pkill. + abi , + include capability sys_ptrace, diff --git a/apparmor.d/abstractions/app/pkexec b/apparmor.d/abstractions/app/pkexec index 2c3669bcc..5b9197957 100644 --- a/apparmor.d/abstractions/app/pkexec +++ b/apparmor.d/abstractions/app/pkexec @@ -4,6 +4,8 @@ # Minimal set of rules for pkexec. + abi , + include include include diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index b10c66c68..0149cc883 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -4,6 +4,8 @@ # Minimal set of rules for sudo. Interactive sudo need more rules. + abi , + include include include diff --git a/apparmor.d/abstractions/app/systemctl b/apparmor.d/abstractions/app/systemctl index 62b4aafdf..9f0da659b 100644 --- a/apparmor.d/abstractions/app/systemctl +++ b/apparmor.d/abstractions/app/systemctl @@ -2,6 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include include diff --git a/apparmor.d/abstractions/app/udevadm b/apparmor.d/abstractions/app/udevadm index 72fb4c61b..cba83e1ff 100644 --- a/apparmor.d/abstractions/app/udevadm +++ b/apparmor.d/abstractions/app/udevadm @@ -2,6 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + ptrace read peer=@{p_systemd}, @{bin}/udevadm mr, diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index 7ed4d6b80..45028f488 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -5,6 +5,8 @@ # Most programs do not need access to audio devices, audio-client only includes # configuration files to be used by client applications. + abi , + /usr/share/alsa/{,**} r, /usr/share/openal/hrtf/{,**} r, /usr/share/pipewire/client-rt.conf r, diff --git a/apparmor.d/abstractions/audio-server b/apparmor.d/abstractions/audio-server index ef69d2d54..97850305b 100644 --- a/apparmor.d/abstractions/audio-server +++ b/apparmor.d/abstractions/audio-server @@ -5,6 +5,8 @@ # Provide access to audio devices. It should only be used by audio servers that # need direct access to them. + abi , + include @{run}/udev/data/+sound:card@{int} r, # for sound card diff --git a/apparmor.d/abstractions/bash-strict b/apparmor.d/abstractions/bash-strict index 832f2add6..9ea35f8c2 100644 --- a/apparmor.d/abstractions/bash-strict +++ b/apparmor.d/abstractions/bash-strict @@ -5,6 +5,8 @@ # This abstraction is only required when an interactive shell is started. # Classic shell scripts do not need it. + abi , + /usr/share/bash-completion/{,**} r, /usr/share/terminfo/{,**} r, diff --git a/apparmor.d/abstractions/bus-accessibility b/apparmor.d/abstractions/bus-accessibility index f032f842b..ee0a16b99 100644 --- a/apparmor.d/abstractions/bus-accessibility +++ b/apparmor.d/abstractions/bus-accessibility @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=accessibility path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} diff --git a/apparmor.d/abstractions/bus-session b/apparmor.d/abstractions/bus-session index d5ca957e8..811787bad 100644 --- a/apparmor.d/abstractions/bus-session +++ b/apparmor.d/abstractions/bus-session @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + unix (bind, listen) type=stream addr="@/tmp/dbus-*", unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-*", unix (connect, send, receive, accept) type=stream peer=(addr="@/tmp/dbus-*"), diff --git a/apparmor.d/abstractions/bus-system b/apparmor.d/abstractions/bus-system index 0148d0711..0bfe96818 100644 --- a/apparmor.d/abstractions/bus-system +++ b/apparmor.d/abstractions/bus-system @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} diff --git a/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry b/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry index 7aa5e7f75..9363bb757 100644 --- a/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry +++ b/apparmor.d/abstractions/bus/com.canonical.Unity.LauncherEntry @@ -4,6 +4,8 @@ # Access required for connecting to/communicating with the Unity Launcher + abi , + dbus send bus=session path=/com/canonical/unity/launcherentry/@{int} interface=com.canonical.Unity.LauncherEntry member=Update diff --git a/apparmor.d/abstractions/bus/com.canonical.dbusmenu b/apparmor.d/abstractions/bus/com.canonical.dbusmenu index 290a86de8..c5f74a6de 100644 --- a/apparmor.d/abstractions/bus/com.canonical.dbusmenu +++ b/apparmor.d/abstractions/bus/com.canonical.dbusmenu @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include if exists diff --git a/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 b/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 index 458d99eef..4b7d6c89d 100644 --- a/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 +++ b/apparmor.d/abstractions/bus/fi.w1.wpa_supplicant1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/fi/w1/wpa_supplicant1 interface=org.freedesktop.DBus.Properties member={GetAll,PropertiesChanged} diff --git a/apparmor.d/abstractions/bus/net.hadess.PowerProfiles b/apparmor.d/abstractions/bus/net.hadess.PowerProfiles index 1bee9da46..4da873247 100644 --- a/apparmor.d/abstractions/bus/net.hadess.PowerProfiles +++ b/apparmor.d/abstractions/bus/net.hadess.PowerProfiles @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/net/hadess/PowerProfiles interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl b/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl index 84422b28e..7f68d2d06 100644 --- a/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl +++ b/apparmor.d/abstractions/bus/net.hadess.SwitcherooControl @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/net/hadess/SwitcherooControl interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/net.reactivated.Fprint b/apparmor.d/abstractions/bus/net.reactivated.Fprint index ad16d10a2..41735f1be 100644 --- a/apparmor.d/abstractions/bus/net.reactivated.Fprint +++ b/apparmor.d/abstractions/bus/net.reactivated.Fprint @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/net/reactivated/Fprint/Manager interface=net.reactivated.Fprint.Manager member={GetDevices,GetDefaultDevice} diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y index deb517f1d..357c06473 100644 --- a/apparmor.d/abstractions/bus/org.a11y +++ b/apparmor.d/abstractions/bus/org.a11y @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + # Accessibility bus dbus receive bus=accessibility path=/org/a11y/atspi/registry diff --git a/apparmor.d/abstractions/bus/org.bluez b/apparmor.d/abstractions/bus/org.bluez index d6ed8922d..7b709ab9b 100644 --- a/apparmor.d/abstractions/bus/org.bluez +++ b/apparmor.d/abstractions/bus/org.bluez @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus receive bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=InterfacesRemoved diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Accounts b/apparmor.d/abstractions/bus/org.freedesktop.Accounts index 946189fe5..f2048c80e 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Accounts +++ b/apparmor.d/abstractions/bus/org.freedesktop.Accounts @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/Accounts interface=org.freedesktop.Accounts member={FindUserByName,ListCachedUsers} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Avahi b/apparmor.d/abstractions/bus/org.freedesktop.Avahi index 73ddaf14e..ccf5b30a9 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Avahi +++ b/apparmor.d/abstractions/bus/org.freedesktop.Avahi @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/ interface=org.freedesktop.DBus.Peer member=Ping diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager index 6f5c7acf3..205557ad5 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member=GetDevices diff --git a/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 b/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 index 36f5b405e..101e493ab 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/FileManager1 interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 index af34b33fe..ddbf4d1de 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 +++ b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 b/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 index 84ce80b6e..5c514d54c 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects diff --git a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager index 61f27fca5..af2b6d2b9 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Notifications b/apparmor.d/abstractions/bus/org.freedesktop.Notifications index 27e1e7137..eee09ffad 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Notifications +++ b/apparmor.d/abstractions/bus/org.freedesktop.Notifications @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/Notifications interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.PackageKit b/apparmor.d/abstractions/bus/org.freedesktop.PackageKit index 1a6839b17..b65bc1ef5 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.PackageKit +++ b/apparmor.d/abstractions/bus/org.freedesktop.PackageKit @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/PackageKit interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 index 006dcee84..ab9e373ab 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=Changed diff --git a/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 b/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 index 527c1e916..ff2906932 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.DBus.Properties member=Get diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver b/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver index 842057a1d..43ed93af6 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver +++ b/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/ScreenSaver interface=org.freedesktop.ScreenSaver member={Inhibit,UnInhibit} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Tracker3.Miner.Files b/apparmor.d/abstractions/bus/org.freedesktop.Tracker3.Miner.Files index 567740a35..48fa7e394 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Tracker3.Miner.Files +++ b/apparmor.d/abstractions/bus/org.freedesktop.Tracker3.Miner.Files @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint interface=org.freedesktop.DBus.Peer member=Ping diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 b/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 index cd415f396..30abb2199 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 +++ b/apparmor.d/abstractions/bus/org.freedesktop.UDisks2 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/UDisks2 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower b/apparmor.d/abstractions/bus/org.freedesktop.UPower index 148db02d7..369448079 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower +++ b/apparmor.d/abstractions/bus/org.freedesktop.UPower @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower member=EnumerateDevices diff --git a/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor b/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor index ff7d57989..f6019eedb 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor +++ b/apparmor.d/abstractions/bus/org.freedesktop.background.Monitor @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/background/monitor interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 index 51b0a5cec..8957c4cdd 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore b/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore index 0fabcd310..c4e4a5fbf 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore +++ b/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/impl/portal/PermissionStore interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.locale1 b/apparmor.d/abstractions/bus/org.freedesktop.locale1 index 74e51b1d7..50218ced3 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.locale1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.locale1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/locale1 interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.login1 b/apparmor.d/abstractions/bus/org.freedesktop.login1 index 595b81335..77271fe23 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.login1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.login1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.login1.Session b/apparmor.d/abstractions/bus/org.freedesktop.login1.Session index d5b62f739..4affc3d22 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.login1.Session +++ b/apparmor.d/abstractions/bus/org.freedesktop.login1.Session @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=GetSession diff --git a/apparmor.d/abstractions/bus/org.freedesktop.network1 b/apparmor.d/abstractions/bus/org.freedesktop.network1 index 268a21dea..56460a52b 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.network1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.network1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/network1 interface=org.freedesktop.DBus.Properties member=Get diff --git a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop index 820b57ff7..1561491cc 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop +++ b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.DBus.Properties member={Get,GetAll,Read} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 index 7f5b6d1a4..7714a871b 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/resolve1 interface=org.freedesktop.resolve1.Manager member={SetLink*,ResolveHostname} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.secrets b/apparmor.d/abstractions/bus/org.freedesktop.secrets index bb8014fc0..0b169a04e 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.secrets +++ b/apparmor.d/abstractions/bus/org.freedesktop.secrets @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/secrets{,/**} interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 index 49e4b014d..115aefd78 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session b/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session index 8edda758c..97db8023f 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session +++ b/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.DBus.Properties member={Get,GetAll} diff --git a/apparmor.d/abstractions/bus/org.freedesktop.timedate1 b/apparmor.d/abstractions/bus/org.freedesktop.timedate1 index 32cc2f451..443d35eed 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.timedate1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.timedate1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/freedesktop/timedate1 interface=org.freedesktop.DBus.Properties member=Get diff --git a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 b/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 index 078835c41..120330ac1 100644 --- a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 +++ b/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gnome/ArchiveManager1 interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.gnome.DisplayManager b/apparmor.d/abstractions/bus/org.gnome.DisplayManager index 0d76f2388..107868836 100644 --- a/apparmor.d/abstractions/bus/org.gnome.DisplayManager +++ b/apparmor.d/abstractions/bus/org.gnome.DisplayManager @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=system path=/org/gnome/DisplayManager/Manager interface=org.gnome.DisplayManager.Manager member=RegisterDisplay diff --git a/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig b/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig index 1449ff4ea..605e90311 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig +++ b/apparmor.d/abstractions/bus/org.gnome.Mutter.DisplayConfig @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gnome/Mutter/DisplayConfig interface=org.gnome.Mutter.DisplayConfig member={GetResources,GetCrtcGamma} diff --git a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor index 2726a7c54..68769f2c9 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor +++ b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gnome/Mutter/IdleMonitor interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects diff --git a/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 b/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 index da9f7229f..185937e70 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 +++ b/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gnome/Nautilus/FileOperations2 interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.gnome.ScreenSaver b/apparmor.d/abstractions/bus/org.gnome.ScreenSaver index 15eec0c69..ba13aa7d2 100644 --- a/apparmor.d/abstractions/bus/org.gnome.ScreenSaver +++ b/apparmor.d/abstractions/bus/org.gnome.ScreenSaver @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gnome/ScreenSaver interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.gnome.SessionManager b/apparmor.d/abstractions/bus/org.gnome.SessionManager index 19242d56a..c683eddac 100644 --- a/apparmor.d/abstractions/bus/org.gnome.SessionManager +++ b/apparmor.d/abstractions/bus/org.gnome.SessionManager @@ -4,6 +4,8 @@ # FIXME: Too large, restrict it. + abi , + dbus send bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={RegisterClient,IsSessionRunning} diff --git a/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect b/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect index ed39a2533..efe53af62 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect +++ b/apparmor.d/abstractions/bus/org.gnome.Shell.Introspect @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gnome/Shell/Introspect interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor b/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor index 0ad921ed3..9060c8c15 100644 --- a/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor +++ b/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor member={List,IsSupported,VolumeChanged,VolumeMount,MountAdded} diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon b/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon index 3e0d95f18..e813f5c4f 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gtk/vfs/Daemon interface=org.gtk.vfs.Daemon member={GetConnection,ListMonitorImplementations,ListMountableInfo} diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata b/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata index e755faa6a..80daa4927 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gtk/vfs/metadata interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker b/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker index 575401ee6..1c80ca6ea 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker member=ListMountableInfo diff --git a/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem b/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem index 4fca40e84..43947d52a 100644 --- a/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem +++ b/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem @@ -2,6 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , include if exists diff --git a/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher b/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher index 67ac1fb6d..5217a50f5 100644 --- a/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher +++ b/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + dbus send bus=session path=/StatusNotifierWatcher interface=org.freedesktop.DBus.Properties member=Get diff --git a/apparmor.d/abstractions/bus/org.kde.kwalletd b/apparmor.d/abstractions/bus/org.kde.kwalletd index c0d2ecba2..1ae5a1ace 100644 --- a/apparmor.d/abstractions/bus/org.kde.kwalletd +++ b/apparmor.d/abstractions/bus/org.kde.kwalletd @@ -2,6 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 7b6a5fdda..392ea2c5f 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -9,6 +9,8 @@ # applications (bwrap) that have no way to restrict access depending on the # application being confined. + abi , + include include include diff --git a/apparmor.d/abstractions/common/apt b/apparmor.d/abstractions/common/apt index 77c5a0b7e..5dd8b26bc 100644 --- a/apparmor.d/abstractions/common/apt +++ b/apparmor.d/abstractions/common/apt @@ -3,6 +3,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + /usr/share/dpkg/cputable r, /usr/share/dpkg/tupletable r, diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index 711117f6d..7f337aff3 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -7,6 +7,8 @@ # - the flag: attach_disconnected # - bwrap execution: '@{bin}/bwrap rix,' + abi , + userns, capability net_admin, diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index cad07669a..9fba7b8bb 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -6,6 +6,8 @@ # This abstraction is for chromium based application. Chromium based browsers # need to use abstractions/chromium instead. + abi , + userns, capability setgid, # If kernel.unprivileged_userns_clone = 1 diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index da792131d..7bfae1ffa 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -12,6 +12,8 @@ # @{cache_dirs} = @{user_cache_dirs}/@{name} # + abi , + include include include diff --git a/apparmor.d/abstractions/common/game b/apparmor.d/abstractions/common/game index 678327f09..3b4a982f1 100644 --- a/apparmor.d/abstractions/common/game +++ b/apparmor.d/abstractions/common/game @@ -10,6 +10,8 @@ # (Default: @{XDG_GAMESSTUDIO_DIR}="unity3d") # - @{user_games_dirs} for user specific game directories (eg: steam storage dir) + abi , + include include include diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index 653221e1d..ccb5de8b3 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -4,6 +4,8 @@ # Minimal set of rules for all gnome based UI application. + abi , + include include include diff --git a/apparmor.d/abstractions/common/steam-game b/apparmor.d/abstractions/common/steam-game index 4bd211f27..b3c66e035 100644 --- a/apparmor.d/abstractions/common/steam-game +++ b/apparmor.d/abstractions/common/steam-game @@ -2,6 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include @{lib_dirs}/ r, diff --git a/apparmor.d/abstractions/common/systemd b/apparmor.d/abstractions/common/systemd index 34e9be9d7..df138bf6c 100644 --- a/apparmor.d/abstractions/common/systemd +++ b/apparmor.d/abstractions/common/systemd @@ -3,6 +3,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + ptrace read peer=@{p_systemd}, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, diff --git a/apparmor.d/abstractions/dconf-write b/apparmor.d/abstractions/dconf-write index 41145e512..b83a585e2 100644 --- a/apparmor.d/abstractions/dconf-write +++ b/apparmor.d/abstractions/dconf-write @@ -5,6 +5,8 @@ # Permissions for querying dconf settings with write access; use the dconf # abstraction first, and dconf-write only for specific application's profile. + abi , + dbus send bus=session path=/ca/desrt/dconf/Writer/user interface=ca.desrt.dconf.Writer member=Change diff --git a/apparmor.d/abstractions/deny-sensitive-home b/apparmor.d/abstractions/deny-sensitive-home index 1f1047cec..4291762a4 100644 --- a/apparmor.d/abstractions/deny-sensitive-home +++ b/apparmor.d/abstractions/deny-sensitive-home @@ -11,6 +11,8 @@ # The only legitimate use in this project is for file browser and search engine. + abi , + # User defined private directories deny @{HOMEDIRS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk, deny @{MOUNTS}/**/@{XDG_PRIVATE_DIR}/{,**} mrxwlk, diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index ae585999b..a9a3665d2 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -7,6 +7,8 @@ # When supported in apparmor, condition will be used in this abstraction to filter # resources specific for supported DE. + abi , + include include include diff --git a/apparmor.d/abstractions/devices-usb b/apparmor.d/abstractions/devices-usb index 5a2a8b742..1a85a0100 100644 --- a/apparmor.d/abstractions/devices-usb +++ b/apparmor.d/abstractions/devices-usb @@ -3,6 +3,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + /dev/ r, /dev/bus/usb/ r, /dev/bus/usb/@{int}/ r, diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 10beb258d..10cf0c90b 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -5,6 +5,8 @@ # The /sys/ entries probably should be tightened + abi , + /dev/ r, /dev/block/ r, /dev/disk/{,*/} r, diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index 361b60d82..bd34a6f42 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -5,6 +5,8 @@ # The /sys/ entries probably should be tightened + abi , + /dev/ r, /dev/block/ r, /dev/disk/{,*/} r, diff --git a/apparmor.d/abstractions/dri b/apparmor.d/abstractions/dri index a1eb1cd41..af634ff91 100644 --- a/apparmor.d/abstractions/dri +++ b/apparmor.d/abstractions/dri @@ -6,6 +6,8 @@ # Linux graphics stack which allows unprivileged user-space programs to issue # commands to graphics hardware without conflicting with other programs. + abi , + @{lib}/dri/** mr, @{lib}/@{multiarch}/dri/** mr, @{lib}/fglrx/dri/** mr, diff --git a/apparmor.d/abstractions/fish b/apparmor.d/abstractions/fish index fe3cab891..2ae6ab93d 100644 --- a/apparmor.d/abstractions/fish +++ b/apparmor.d/abstractions/fish @@ -5,6 +5,8 @@ # This abstraction is only required when an interactive shell is started. # Classic shell scripts do not need it. + abi , + /usr/share/fish/{,**} r, /etc/fish/{,**} r, diff --git a/apparmor.d/abstractions/fontconfig-cache-read b/apparmor.d/abstractions/fontconfig-cache-read index 216075648..306787378 100644 --- a/apparmor.d/abstractions/fontconfig-cache-read +++ b/apparmor.d/abstractions/fontconfig-cache-read @@ -9,6 +9,8 @@ # fontconfig cache if some cache files are missing, so if this behavior is desirable, you can use # the "fontconfig-cache-write" abstraction. + abi , + owner @{user_cache_dirs}/fontconfig/ r, deny @{user_cache_dirs}/fontconfig/ w, deny @{user_cache_dirs}/fontconfig/** w, diff --git a/apparmor.d/abstractions/fontconfig-cache-write b/apparmor.d/abstractions/fontconfig-cache-write index 19fa7c53a..922a15a6a 100644 --- a/apparmor.d/abstractions/fontconfig-cache-write +++ b/apparmor.d/abstractions/fontconfig-cache-write @@ -3,6 +3,8 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + owner @{user_cache_dirs}/fontconfig/ rw, owner @{user_cache_dirs}/fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} rw, owner @{user_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rwk, diff --git a/apparmor.d/abstractions/glfw b/apparmor.d/abstractions/glfw index f52fb926d..5dbda197d 100644 --- a/apparmor.d/abstractions/glfw +++ b/apparmor.d/abstractions/glfw @@ -2,6 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + owner @{run}/user/@{uid}/glfw-shared-@{rand6} rw, include if exists diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index ed3f2f4c0..27d648247 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -2,6 +2,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include include include diff --git a/apparmor.d/abstractions/graphics b/apparmor.d/abstractions/graphics index 9b7954f0d..101fe1b45 100644 --- a/apparmor.d/abstractions/graphics +++ b/apparmor.d/abstractions/graphics @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include include include diff --git a/apparmor.d/abstractions/graphics-full b/apparmor.d/abstractions/graphics-full index fe2d2001c..1f2b0ffd2 100644 --- a/apparmor.d/abstractions/graphics-full +++ b/apparmor.d/abstractions/graphics-full @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/abstractions/gstreamer b/apparmor.d/abstractions/gstreamer index 4a5deb7c4..b9f1cbadd 100644 --- a/apparmor.d/abstractions/gstreamer +++ b/apparmor.d/abstractions/gstreamer @@ -3,6 +3,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + @{lib}/@{multiarch}/libproxy/*/modules/*.so mr, @{lib}/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr, @{lib}/frei0r-@{int}/*.so mr, diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 11e897aba..490cf48a1 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include include include diff --git a/apparmor.d/abstractions/nameservice-strict b/apparmor.d/abstractions/nameservice-strict index 0cac5a1a2..5f49a63d9 100644 --- a/apparmor.d/abstractions/nameservice-strict +++ b/apparmor.d/abstractions/nameservice-strict @@ -6,6 +6,8 @@ # Many programs wish to perform nameservice-like operations, such as looking up # users by name or id, groups by name or id, hosts by name or IP, etc. + abi , + include @{etc_ro}/default/nss r, @@ -33,6 +35,6 @@ @{run}/systemd/resolve/resolv.conf r, @{run}/systemd/resolve/stub-resolv.conf r, - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/nvidia-strict b/apparmor.d/abstractions/nvidia-strict index 6521c9840..6069ddd9a 100644 --- a/apparmor.d/abstractions/nvidia-strict +++ b/apparmor.d/abstractions/nvidia-strict @@ -2,6 +2,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + @{bin}/nvidia-modprobe Px -> child-modprobe-nvidia, /usr/share/nvidia/nvidia-application-profiles-* r, diff --git a/apparmor.d/abstractions/qt5-shader-cache b/apparmor.d/abstractions/qt5-shader-cache index e43ca64e1..d40aa3766 100644 --- a/apparmor.d/abstractions/qt5-shader-cache +++ b/apparmor.d/abstractions/qt5-shader-cache @@ -3,6 +3,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + owner @{user_cache_dirs}/ w, owner @{user_cache_dirs}/qtshadercache/ rw, owner @{user_cache_dirs}/qtshadercache/#@{int} rw, diff --git a/apparmor.d/abstractions/shells b/apparmor.d/abstractions/shells index b269f2335..35d3a580a 100644 --- a/apparmor.d/abstractions/shells +++ b/apparmor.d/abstractions/shells @@ -5,6 +5,8 @@ # This abstraction is only required when an interactive shell is started. # Classic shell scripts do not need it. + abi , + include include include diff --git a/apparmor.d/abstractions/thumbnails-cache-read b/apparmor.d/abstractions/thumbnails-cache-read index dc164c6ba..adb80dd4d 100644 --- a/apparmor.d/abstractions/thumbnails-cache-read +++ b/apparmor.d/abstractions/thumbnails-cache-read @@ -3,6 +3,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + owner @{user_cache_dirs}/thumbnails/ r, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/ r, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/ r, diff --git a/apparmor.d/abstractions/thumbnails-cache-write b/apparmor.d/abstractions/thumbnails-cache-write index 01de0407e..5a31de221 100644 --- a/apparmor.d/abstractions/thumbnails-cache-write +++ b/apparmor.d/abstractions/thumbnails-cache-write @@ -3,6 +3,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + owner @{user_cache_dirs}/thumbnails/ rw, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/ rw, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/ rw, diff --git a/apparmor.d/abstractions/trash-strict b/apparmor.d/abstractions/trash-strict index 1f4202818..a2b024d3e 100644 --- a/apparmor.d/abstractions/trash-strict +++ b/apparmor.d/abstractions/trash-strict @@ -9,6 +9,8 @@ # There is no 'owner' rule on expunged folders because some internally sandboxed # app (using bwrap) run on a different private user. + abi , + owner @{user_config_dirs}/#@{int} rwk, owner @{user_config_dirs}/trashrc rw, owner @{user_config_dirs}/trashrc.* rwl, diff --git a/apparmor.d/abstractions/uim b/apparmor.d/abstractions/uim index 03ae9e3e8..88d75ec15 100644 --- a/apparmor.d/abstractions/uim +++ b/apparmor.d/abstractions/uim @@ -3,6 +3,8 @@ # Copyright (C) 2024 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only + abi , + /usr/share/uim/* r, /var/lib/uim/* r, diff --git a/apparmor.d/abstractions/user-download-strict b/apparmor.d/abstractions/user-download-strict index 3feed5cd8..ab0e05f0a 100644 --- a/apparmor.d/abstractions/user-download-strict +++ b/apparmor.d/abstractions/user-download-strict @@ -3,6 +3,8 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + owner @{HOME}/@{XDG_DESKTOP_DIR}/ w, owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ w, diff --git a/apparmor.d/abstractions/user-read b/apparmor.d/abstractions/user-read index 4187ab9e2..bd350186b 100644 --- a/apparmor.d/abstractions/user-read +++ b/apparmor.d/abstractions/user-read @@ -4,6 +4,8 @@ # Warning: This abstraction gives unrestricted read access on all non hidden user directories. + abi , + owner @{HOME}/ r, owner @{MOUNTS}/ r, diff --git a/apparmor.d/abstractions/user-read-strict b/apparmor.d/abstractions/user-read-strict index 5211b0345..f7eb186b5 100644 --- a/apparmor.d/abstractions/user-read-strict +++ b/apparmor.d/abstractions/user-read-strict @@ -5,6 +5,8 @@ # This abstraction gives read access on all defined user directories. It should # only be used if access to **ALL** folders is required. + abi , + owner @{HOME}/ r, owner @{MOUNTS}/ r, diff --git a/apparmor.d/abstractions/user-write-strict b/apparmor.d/abstractions/user-write-strict index 223fc660a..026825b27 100644 --- a/apparmor.d/abstractions/user-write-strict +++ b/apparmor.d/abstractions/user-write-strict @@ -5,6 +5,8 @@ # This abstraction gives write only access on all defined user directories. It should # only be used if access to **ALL** folders is required. + abi , + owner @{HOME}/ r, owner @{MOUNTS}/ r, diff --git a/apparmor.d/abstractions/vulkan-strict b/apparmor.d/abstractions/vulkan-strict index 7dbb8f424..edb258288 100644 --- a/apparmor.d/abstractions/vulkan-strict +++ b/apparmor.d/abstractions/vulkan-strict @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + /usr/share/egl/egl_external_platform.d/{,*.json} r, /usr/share/glvnd/egl_vendor.d/{,*.json} r, /usr/share/libdrm/*.ids r, diff --git a/apparmor.d/abstractions/xfce b/apparmor.d/abstractions/xfce index 067de9148..0d510a3fe 100644 --- a/apparmor.d/abstractions/xfce +++ b/apparmor.d/abstractions/xfce @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + abi , + include include include diff --git a/apparmor.d/abstractions/zsh b/apparmor.d/abstractions/zsh index 15711713c..a22895c91 100644 --- a/apparmor.d/abstractions/zsh +++ b/apparmor.d/abstractions/zsh @@ -6,6 +6,8 @@ # This abstraction is only required when an interactive shell is started. # Classic shell scripts do not need it. + abi , + @{lib}/@{multiarch}/zsh/@{int}/zsh/*.so mr, /usr/share/zsh/{,**} r, From 55857738025124039b5b60de3082a7b443244351 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 22:21:52 +0100 Subject: [PATCH 0329/1455] chore(profile): add missing vim:syntax=apparmor in some profiles. --- apparmor.d/profiles-a-f/cmus | 2 ++ apparmor.d/profiles-g-l/linuxqq | 1 + apparmor.d/profiles-m-r/ouch | 2 ++ apparmor.d/profiles-m-r/protonmail | 2 ++ apparmor.d/profiles-s-z/wechat-universal | 2 ++ 5 files changed, 9 insertions(+) diff --git a/apparmor.d/profiles-a-f/cmus b/apparmor.d/profiles-a-f/cmus index 1cff2fb63..a7cd77658 100644 --- a/apparmor.d/profiles-a-f/cmus +++ b/apparmor.d/profiles-a-f/cmus @@ -29,3 +29,5 @@ profile cmus @{exec_path} { include if exists } + +# vim:syntax=apparmor \ No newline at end of file diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 9efceaa7a..497595e39 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -47,3 +47,4 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { include if exists } +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/ouch b/apparmor.d/profiles-m-r/ouch index fb71c8ece..6e8596dd2 100644 --- a/apparmor.d/profiles-m-r/ouch +++ b/apparmor.d/profiles-m-r/ouch @@ -24,3 +24,5 @@ profile ouch @{exec_path} { include if exists } + +# vim:syntax=apparmor \ No newline at end of file diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index b4d806a9f..de7a2158a 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -40,3 +40,5 @@ profile protonmail @{exec_path} flags=(complain) { include if exists } + +# vim:syntax=apparmor \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index 493a940af..1b2fe62db 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -56,3 +56,5 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) { include if exists } + +# vim:syntax=apparmor \ No newline at end of file From 75f2c0c7b80f9b12314ce9b7cdc4efea4be59c05 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 22:26:11 +0100 Subject: [PATCH 0330/1455] tests: ensure vim syntax and abi are set on all profile/abs. --- tests/check.sh | 51 +++++++++++++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 17 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 5704ebfba..a46d38e30 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -10,12 +10,38 @@ set -eu -o pipefail readonly APPARMORD="apparmor.d" +_ensure_include() { + local file="$1" + local include="$2" + if ! grep -q "^ *${include}$" "$file"; then + echo "$file does not contain '$include'" + exit 1 + fi +} + +_ensure_abi() { + local file="$1" + if ! grep -q "^ *abi ," "$file"; then + echo "$file does not contain 'abi ,'" + exit 1 + fi +} + +_ensure_vim() { + local file="$1" + if ! grep -q "^# vim:syntax=apparmor" "$file"; then + echo "$file does not contain '# vim:syntax=apparmor'" + exit 1 + fi +} + check_profiles() { echo "⋅ Checking if all profiles contain:" echo " - 'abi ,'" - echo " - 'profile *profile_name* {'" + echo " - 'profile '" echo " - 'include if exists '" echo " - include if exists local for subprofiles" + echo " - vim:syntax=apparmor" directories=("$APPARMORD/groups/*" "$APPARMORD/profiles-*-*") # shellcheck disable=SC2068 for dir in ${directories[@]}; do @@ -24,14 +50,9 @@ check_profiles() { name="$(basename "$file")" name="${name/.apparmor.d/}" include="include if exists " - if ! grep -q "^ *${include}$" "$file"; then - echo "$name does not contain '$include'" - exit 1 - fi - if ! grep -q "^ *abi ," "$file"; then - echo "$name does not contain 'abi ,'" - exit 1 - fi + _ensure_include "$file" "$include" + _ensure_abi "$file" + _ensure_vim "$file" if ! grep -q "^profile $name" "$file"; then echo "$name does not contain 'profile $name'" exit 1 @@ -52,6 +73,7 @@ check_abstractions() { echo "⋅ Checking if all abstractions contain:" echo " - 'abi ,'" echo " - 'include if exists '" + echo " - vim:syntax=apparmor" directories=( "$APPARMORD/abstractions/" "$APPARMORD/abstractions/app/" "$APPARMORD/abstractions/bus/" "$APPARMORD/abstractions/common/" @@ -61,14 +83,9 @@ check_abstractions() { name="$(basename "$file")" root="${dir/${APPARMORD}\/abstractions\//}" include="include if exists " - if ! grep -q "^ *${include}$" "$file"; then - echo "$file does not contain '$include'" - exit 1 - fi - # if ! grep -q "^ *abi ," "$file"; then - # echo "$file does not contain 'abi ,'" - # exit 1 - # fi + _ensure_include "$file" "$include" + _ensure_abi "$file" + _ensure_vim "$file" done done From 5bf8c6ef0fca9a58a830b9c574ad5d602e3cbc11 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 9 Oct 2024 22:38:22 +0100 Subject: [PATCH 0331/1455] fix: add vim syntaxt some profiles. --- apparmor.d/profiles-a-f/baobab | 4 +++- apparmor.d/profiles-a-f/cmus | 2 +- apparmor.d/profiles-m-r/ouch | 2 +- apparmor.d/profiles-m-r/protonmail | 2 +- apparmor.d/profiles-s-z/wechat-universal | 2 +- 5 files changed, 7 insertions(+), 5 deletions(-) diff --git a/apparmor.d/profiles-a-f/baobab b/apparmor.d/profiles-a-f/baobab index e66d8d66a..1f9f14dc1 100644 --- a/apparmor.d/profiles-a-f/baobab +++ b/apparmor.d/profiles-a-f/baobab @@ -26,4 +26,6 @@ profile baobab @{exec_path} { deny /boot/{,**} r, include if exists -} \ No newline at end of file +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/cmus b/apparmor.d/profiles-a-f/cmus index a7cd77658..c3916890f 100644 --- a/apparmor.d/profiles-a-f/cmus +++ b/apparmor.d/profiles-a-f/cmus @@ -30,4 +30,4 @@ profile cmus @{exec_path} { include if exists } -# vim:syntax=apparmor \ No newline at end of file +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/ouch b/apparmor.d/profiles-m-r/ouch index 6e8596dd2..d0b75aae7 100644 --- a/apparmor.d/profiles-m-r/ouch +++ b/apparmor.d/profiles-m-r/ouch @@ -25,4 +25,4 @@ profile ouch @{exec_path} { include if exists } -# vim:syntax=apparmor \ No newline at end of file +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index de7a2158a..c6d309a94 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -41,4 +41,4 @@ profile protonmail @{exec_path} flags=(complain) { } -# vim:syntax=apparmor \ No newline at end of file +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index 1b2fe62db..55d4a555d 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -57,4 +57,4 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) { include if exists } -# vim:syntax=apparmor \ No newline at end of file +# vim:syntax=apparmor From 61a27bc336c79ad171da6a5dc6b0414a326e6fe6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 11 Oct 2024 14:13:17 +0100 Subject: [PATCH 0332/1455] feat(profile): initial integration with attached path. The feature is not yet enabled. See https://apparmor.pujol.io/development/internal/#re-attached-path --- apparmor.d/abstractions/attached/base | 14 ++++++++++++++ apparmor.d/abstractions/attached/consoles | 13 +++++++++++++ apparmor.d/abstractions/common/app | 3 ++- apparmor.d/abstractions/common/bwrap | 13 +++++++------ apparmor.d/groups/apt/apt | 4 ++-- apparmor.d/groups/apt/unattended-upgrade | 2 +- .../groups/apt/unattended-upgrade-shutdown | 2 +- apparmor.d/groups/browsers/epiphany | 2 +- apparmor.d/groups/bus/at-spi2-registryd | 3 +-- apparmor.d/groups/bus/dbus-accessibility | 3 +-- apparmor.d/groups/bus/dbus-system | 16 ++++++++-------- apparmor.d/groups/children/child-modprobe-nvidia | 2 -- apparmor.d/groups/freedesktop/colord | 4 ++-- apparmor.d/groups/freedesktop/pipewire | 5 +++-- apparmor.d/groups/freedesktop/pipewire-pulse | 4 ++-- apparmor.d/groups/freedesktop/upowerd | 2 +- apparmor.d/groups/freedesktop/xdg-dbus-proxy | 4 ++-- apparmor.d/groups/freedesktop/xdg-desktop-portal | 5 +++-- .../groups/freedesktop/xdg-desktop-portal-gnome | 3 +-- .../groups/freedesktop/xdg-document-portal | 8 ++++---- .../groups/freedesktop/xdg-permission-store | 3 +-- apparmor.d/groups/freedesktop/xkbcomp | 2 +- apparmor.d/groups/freedesktop/xwayland | 2 +- apparmor.d/groups/gnome/gdm-session-worker | 2 +- apparmor.d/groups/gnome/gjs-console | 2 +- apparmor.d/groups/gnome/gnome-keyring-daemon | 1 + apparmor.d/groups/gnome/gnome-music | 2 +- apparmor.d/groups/gnome/gnome-session-binary | 7 ++++--- apparmor.d/groups/gnome/gnome-shell | 15 +++++++++------ apparmor.d/groups/gnome/gnome-software | 2 +- apparmor.d/groups/gnome/gsd-a11y-settings | 3 +-- apparmor.d/groups/gnome/gsd-color | 3 +-- apparmor.d/groups/gnome/gsd-datetime | 3 +-- apparmor.d/groups/gnome/gsd-housekeeping | 3 +-- apparmor.d/groups/gnome/gsd-keyboard | 3 +-- apparmor.d/groups/gnome/gsd-media-keys | 5 ++--- apparmor.d/groups/gnome/gsd-power | 5 ++--- apparmor.d/groups/gnome/gsd-print-notifications | 3 +-- apparmor.d/groups/gnome/gsd-printer | 3 +-- apparmor.d/groups/gnome/gsd-rfkill | 3 +-- apparmor.d/groups/gnome/gsd-screensaver-proxy | 3 +-- apparmor.d/groups/gnome/gsd-sharing | 3 +-- apparmor.d/groups/gnome/gsd-smartcard | 3 +-- apparmor.d/groups/gnome/gsd-sound | 3 +-- apparmor.d/groups/gnome/gsd-wacom | 3 +-- apparmor.d/groups/gnome/mutter-x11-frames | 3 +-- apparmor.d/groups/kde/kde-powerdevil | 2 +- apparmor.d/groups/kde/ksmserver | 2 +- apparmor.d/groups/kde/kwin_wayland | 2 +- apparmor.d/groups/network/ModemManager | 2 +- apparmor.d/groups/network/NetworkManager | 6 ++++-- apparmor.d/groups/network/mullvad-gui | 2 +- apparmor.d/groups/ssh/sshd | 3 ++- apparmor.d/groups/systemd/systemd-inhibit | 2 +- apparmor.d/groups/systemd/systemd-networkd | 4 ++-- apparmor.d/groups/ubuntu/update-manager | 2 +- apparmor.d/groups/virt/dockerd | 4 ++-- apparmor.d/groups/virt/libvirtd | 3 ++- apparmor.d/groups/virt/virtinterfaced | 2 +- apparmor.d/groups/virt/virtlogd | 3 ++- apparmor.d/groups/virt/virtnetworkd | 3 ++- apparmor.d/groups/virt/virtnodedevd | 3 ++- apparmor.d/groups/virt/virtsecretd | 3 ++- apparmor.d/groups/virt/virtstoraged | 3 ++- apparmor.d/groups/xfce/xfce-power-manager | 2 +- apparmor.d/groups/xfce/xfce-screensaver | 2 +- apparmor.d/profiles-a-f/flatpak-portal | 4 ++-- apparmor.d/profiles-a-f/foliate | 2 +- apparmor.d/profiles-a-f/fprintd | 3 ++- apparmor.d/profiles-a-f/fwupd | 3 ++- apparmor.d/profiles-g-l/linuxqq | 2 +- apparmor.d/profiles-m-r/mission-control | 2 +- apparmor.d/profiles-m-r/nvtop | 3 ++- apparmor.d/profiles-m-r/packagekitd | 3 ++- apparmor.d/profiles-m-r/psi | 2 +- apparmor.d/profiles-m-r/psi-plus | 2 +- apparmor.d/profiles-s-z/signal-desktop | 2 +- apparmor.d/profiles-s-z/spice-vdagent | 3 +-- apparmor.d/profiles-s-z/steam | 2 +- apparmor.d/profiles-s-z/superproductivity | 2 +- apparmor.d/profiles-s-z/udisksd | 3 ++- apparmor.d/profiles-s-z/uname | 2 +- apparmor.d/profiles-s-z/wechat-universal | 2 +- apparmor.d/profiles-s-z/xbrlapi | 3 +-- apparmor.d/tunables/multiarch.d/system | 1 - 85 files changed, 164 insertions(+), 139 deletions(-) create mode 100644 apparmor.d/abstractions/attached/base create mode 100644 apparmor.d/abstractions/attached/consoles diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base new file mode 100644 index 000000000..65c163317 --- /dev/null +++ b/apparmor.d/abstractions/attached/base @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no + + # Do not use it manually, it is automatically included in profiles when it is required. + + abi , + + @{att}/apparmor/.null rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/attached/consoles b/apparmor.d/abstractions/attached/consoles new file mode 100644 index 000000000..6959bc407 --- /dev/null +++ b/apparmor.d/abstractions/attached/consoles @@ -0,0 +1,13 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no + + abi , + + owner @{att}/dev/pts/@{int} rw, + owner @{att}/dev/tty@{int} rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 392ea2c5f..4cb47c9d2 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -67,10 +67,11 @@ owner @{tmp}/** rmwk, owner /dev/shm/** rwlk -> /dev/shm/**, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket. @{run}/host/{,**} r, @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket. - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/utmp rk, @{run}/udev/data/c13:@{int} r, # for /dev/input/* diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index 7f337aff3..3a2b0c591 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -44,15 +44,16 @@ owner /tmp/newroot/ w, owner /tmp/oldroot/ w, + @{att}/@{PROC}/sys/user/max_user_namespaces rw, + owner @{att}/@{PROC}/@{pid}/cgroup r, + owner @{att}/@{PROC}/@{pid}/gid_map rw, + owner @{att}/@{PROC}/@{pid}/mountinfo r, + owner @{att}/@{PROC}/@{pid}/setgroups rw, + owner @{att}/@{PROC}/@{pid}/uid_map rw, + @{PROC}/sys/kernel/overflowgid r, @{PROC}/sys/kernel/overflowuid r, - @{PROC}/sys/user/max_user_namespaces rw, - owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/gid_map rw, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/setgroups rw, - owner @{PROC}/@{pid}/uid_map rw, include if exists diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 5b362f123..19f187cc3 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -141,6 +141,8 @@ profile apt @{exec_path} flags=(attach_disconnected) { owner @{tmp}/apt.conf.* rw, owner @{tmp}/apt.data.* rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pid}/fd/ r, @@ -148,8 +150,6 @@ profile apt @{exec_path} flags=(attach_disconnected) { /dev/ptmx rw, - @{run}/systemd/inhibit/@{int}.ref rw, - profile editor flags=(complain) { include include diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index c528fb984..e4f6b61ea 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -100,7 +100,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /var/log/apt/{term,history}.log w, /var/log/apt/eipp.log.xz w, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/unattended-upgrades.lock rwk, owner @{run}/unattended-upgrades.pid rw, owner @{run}/unattended-upgrades.progress rw, diff --git a/apparmor.d/groups/apt/unattended-upgrade-shutdown b/apparmor.d/groups/apt/unattended-upgrade-shutdown index 673775006..cd35bb5ae 100644 --- a/apparmor.d/groups/apt/unattended-upgrade-shutdown +++ b/apparmor.d/groups/apt/unattended-upgrade-shutdown @@ -24,8 +24,8 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) { owner /var/log/unattended-upgrades/*.log* rw, + owner @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/unattended-upgrades.lock rwk, - owner @{run}/systemd/inhibit/@{int}.ref rw, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany index a64850f1a..dd01a36a8 100644 --- a/apparmor.d/groups/browsers/epiphany +++ b/apparmor.d/groups/browsers/epiphany @@ -39,7 +39,7 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { @{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix, owner /bindfile@{rand6} rw, - owner /.flatpak-info r, + owner @{att}/.flatpak-info r, owner @{user_config_dirs}/glib-2.0/ w, owner @{user_config_dirs}/glib-2.0/settings/ w, diff --git a/apparmor.d/groups/bus/at-spi2-registryd b/apparmor.d/groups/bus/at-spi2-registryd index 6c4bf4c69..8ead7a4e0 100644 --- a/apparmor.d/groups/bus/at-spi2-registryd +++ b/apparmor.d/groups/bus/at-spi2-registryd @@ -10,6 +10,7 @@ include @{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi2-registryd profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -27,8 +28,6 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index 054af7202..1a4b83e2e 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -72,8 +73,6 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_score_adj r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index ed2f931cd..3b8a1e143 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -49,17 +49,17 @@ profile dbus-system flags=(attach_disconnected) { /etc/machine-id r, /var/lib/dbus/machine-id r, - @{desktop_share_dirs}/icc/ r, - @{desktop_share_dirs}/icc/edid-@{hex32}.icc r, - @{user_share_dirs}/icc/ r, - @{user_share_dirs}/icc/edid-@{hex32}.icc r, + @{att}/@{desktop_share_dirs}/icc/ r, + @{att}/@{desktop_share_dirs}/icc/edid-@{hex32}.icc r, + @{att}/@{user_share_dirs}/icc/ r, + @{att}/@{user_share_dirs}/icc/edid-@{hex32}.icc r, # Dbus can receive any user files @{HOME}/** r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw, @{run}/systemd/notify w, - @{run}/systemd/sessions/*.ref rw, @{run}/systemd/users/@{int} r, @{sys}/kernel/security/apparmor/.access rw, @@ -77,8 +77,8 @@ profile dbus-system flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_score_adj rw, - /dev/dri/card@{int} rw, - /dev/input/event@{int} rw, + @{att}/dev/dri/card@{int} rw, + @{att}/dev/input/event@{int} rw, include if exists } diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index b3b0db7ff..15b9c2d9d 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -53,8 +53,6 @@ profile child-modprobe-nvidia flags=(attach_disconnected) { owner /dev/nvidia-caps/ w, owner /dev/nvidia-caps/nvidia-cap@{int} w, - /dev/tty@{int} rw, - deny @{HOME}/.steam/** r, profile kmod { diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index f3ab4fedb..ffdfe08a0 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -49,8 +49,8 @@ profile colord @{exec_path} flags=(attach_disconnected) { owner /var/lib/snmp/mibs/{iana,ietf}/ r, owner /var/lib/snmp/mibs/{iana,ietf}/[A-Z]* r, - @{desktop_share_dirs}/icc/edid-*.icc r, - @{user_share_dirs}/icc/edid-*.icc r, + @{att}/@{desktop_share_dirs}/icc/edid-*.icc r, + @{att}/@{user_share_dirs}/icc/edid-*.icc r, @{run}/systemd/sessions/* r, diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index cf98a133e..f6f4c12aa 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -44,8 +44,9 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { /etc/pipewire/{,**} r, - / r, - /.flatpak-info r, + / r, + @{att}/ r, + owner @{att}/.flatpak-info r, owner @{user_config_dirs}/pipewire/{,**} r, diff --git a/apparmor.d/groups/freedesktop/pipewire-pulse b/apparmor.d/groups/freedesktop/pipewire-pulse index b5644440f..530fa97db 100644 --- a/apparmor.d/groups/freedesktop/pipewire-pulse +++ b/apparmor.d/groups/freedesktop/pipewire-pulse @@ -28,8 +28,8 @@ profile pipewire-pulse @{exec_path} flags=(attach_disconnected) { /var/lib/dbus/machine-id r, /etc/machine-id r, - / r, - /.flatpak-info r, + @{att}/ r, + owner @{att}/.flatpak-info r, owner @{run}/user/@{uid}/pulse/pid w, owner @{tmp}/librnnoise-@{int}.so rm, diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index e9b6f5c05..f832d285e 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -41,7 +41,7 @@ profile upowerd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c116:@{int} r, # for ALSA - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/hid/devices/ r, @{sys}/class/input/ r, diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index 6ebc28929..e51f21e1e 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/xdg-dbus-proxy profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -16,7 +17,6 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { include include include - include include network unix stream, @@ -31,7 +31,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.var/app/*/.local/share/*/logs/* rw, owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw, owner @{run}/flatpak/doc/** r, owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 00cb35b62..eb450ee4e 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -10,6 +10,7 @@ include profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { include include + include include include include @@ -61,8 +62,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { @{lib}/xdg-desktop-portal-validate-icon rPx, @{open_path} rPx -> child-open, - / r, - /.flatpak-info r, + / r, + @{att}/.flatpak-info r, /usr/share/dconf/profile/gdm r, /usr/share/xdg-desktop-portal/** r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 9cbf81bc6..944bbc205 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/xdg-desktop-portal-gnome profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -65,8 +66,6 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/task/@{tid}/ r, owner @{PROC}/@{pid}/task/@{tid}/status r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index f93a4f2b0..e9f63dc57 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/xdg-document-portal profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -39,8 +40,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { @{bin}/flatpak rPUx, @{bin}/fusermount{,3} rCx -> fusermount, - / r, - owner /.flatpak-info r, + owner @{att}/ r, + owner @{att}/.flatpak-info r, owner @{HOME}/ r, owner @{HOME}/*/{,**} rw, @@ -57,7 +58,6 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/fd/ r, /dev/fuse rw, - owner /dev/tty@{int} rw, profile fusermount flags=(attach_disconnected) { include @@ -83,7 +83,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/mounts r, /dev/fuse rw, - owner /dev/tty@{int} rw, + @{att}/dev/tty@{int} rw, include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-permission-store b/apparmor.d/groups/freedesktop/xdg-permission-store index 057c64208..298bc059d 100644 --- a/apparmor.d/groups/freedesktop/xdg-permission-store +++ b/apparmor.d/groups/freedesktop/xdg-permission-store @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/xdg-permission-store profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { include + include include include @@ -45,8 +46,6 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/flatpak/db/documents rw, owner @{user_share_dirs}/flatpak/db/notifications rw, - /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/freedesktop/xkbcomp b/apparmor.d/groups/freedesktop/xkbcomp index 941cc8f92..9ebecf6f7 100644 --- a/apparmor.d/groups/freedesktop/xkbcomp +++ b/apparmor.d/groups/freedesktop/xkbcomp @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xkbcomp profile xkbcomp @{exec_path} flags=(attach_disconnected) { include + include include include @@ -37,7 +38,6 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) { /dev/dri/card@{int} rw, /dev/fb@{int} rw, /dev/tty rw, - /dev/tty@{int} rw, deny /dev/input/event@{int} rw, deny /var/log/Xorg.@{int}.log w, diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland index c2710eb83..05fb5a6fa 100644 --- a/apparmor.d/groups/freedesktop/xwayland +++ b/apparmor.d/groups/freedesktop/xwayland @@ -36,7 +36,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/cmdline r, - /dev/tty@{int} rw, + @{att}/dev/tty@{int} rw, /dev/tty rw, include if exists diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 8f6770ec1..731d15768 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -114,13 +114,13 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { owner @{run}/gdm{3,}/dbus/ w, owner @{run}/gdm{3,}/dbus/dbus-@{rand8} w, + @{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw, @{run}/cockpit/active.motd r, @{run}/faillock/@{user} rwk, @{run}/fscrypt/ rw, @{run}/fscrypt/@{uid}.count rwk, @{run}/motd.d/{,*} r, @{run}/systemd/sessions/* r, - @{run}/systemd/sessions/*.ref rw, @{run}/systemd/users/@{uid} r, @{run}/utmp rwk, diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index 613be32d3..20d5e48d5 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -14,6 +14,7 @@ include @{exec_path} = @{bin}/gjs-console profile gjs-console @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -85,7 +86,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { /dev/ r, /dev/tty rw, - /dev/tty@{int} rw, include if exists } diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index 905c16b89..d0b84c1be 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/gnome-keyring-daemon profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index 834e67037..82be211fc 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -48,7 +48,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/grilo-plugins/ rwk, owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw, owner /var/tmp/etilqs_@{hex15} rw, diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 0825d418f..995dbab6a 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -79,9 +79,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/gnome-session/ rw, owner @{user_config_dirs}/gnome-session/saved-session/ rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw, + @{run}/systemd/sessions/* r, - @{run}/systemd/sessions/*.ref rw, @{run}/systemd/users/@{uid} r, owner @{run}/user/@{uid}/gnome-session-leader-fifo rw, owner @{run}/user/@{uid}/ICEauthority rw, @@ -104,6 +105,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { profile open flags=(attach_disconnected) { include + include include @{bin}/env rix, @@ -119,7 +121,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { /usr/games/** PUx, /dev/tty rw, - /dev/tty@{int} rw, include if exists include if exists diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index b83de9bf4..227edc404 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -207,8 +207,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/share/xml/iso-codes/{,**} r, @{system_share_dirs}/gnome-shell/{,**} r, - / r, - /.flatpak-info r, /etc/fstab r, /etc/timezone r, /etc/tpm2-tss/*.json r, @@ -220,6 +218,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /var/lib/flatpak/app/**/gnome-shell/{,**} r, /var/lib/flatpak/appstream/**/icons/** r, + owner @{att}/ r, + owner @{att}/.flatpak-info r, + owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_cache_dirs}/ w, owner @{gdm_cache_dirs}/event-sound-cache.tdb.@{hex32}.@{multiarch} rwk, @@ -293,11 +294,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/@{rand6}.shell-extension.zip rw, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/systemd/users/@{uid} r, @{run}/systemd/seats/seat@{int} r, @{run}/systemd/sessions/ r, @{run}/systemd/sessions/* r, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/tags/seat/ r, @@ -365,9 +367,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat r, - /dev/input/event@{int} rw, - /dev/media@{int} rw, - /dev/tty@{int} rw, + /dev/media@{int} rw, + /dev/tty@{int} rw, + @{att}/dev/dri/card@{int} rw, + @{att}/dev/input/event@{int} rw, profile shell flags=(attach_disconnected,mediate_deleted) { include diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 4726881e6..cddcb730b 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -111,7 +111,7 @@ profile gnome-software @{exec_path} { owner /dev/shm/flatpak-com.*/ rw, owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/sessions/@{int} r, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/groups/gnome/gsd-a11y-settings b/apparmor.d/groups/gnome/gsd-a11y-settings index 86ca1bbf2..cfbaa6269 100644 --- a/apparmor.d/groups/gnome/gsd-a11y-settings +++ b/apparmor.d/groups/gnome/gsd-a11y-settings @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-a11y-settings profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -31,8 +32,6 @@ profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) { @{gdm_config_dirs}/dconf/user r, @{GDM_HOME}/greeter-dconf-defaults r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 3f4895dbd..6ff47dcd1 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-color profile gsd-color @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -49,8 +50,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/icc/ rw, owner @{user_share_dirs}/icc/edid-*.icc rw, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-datetime b/apparmor.d/groups/gnome/gsd-datetime index b7a3e4bcb..984f7c189 100644 --- a/apparmor.d/groups/gnome/gsd-datetime +++ b/apparmor.d/groups/gnome/gsd-datetime @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-datetime profile gsd-datetime @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -49,8 +50,6 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/stat r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index f7d0f51ad..288c29af8 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -10,6 +10,7 @@ include profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { include include + include include include include @@ -46,8 +47,6 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pids}/cgroup r, owner @{PROC}/@{pids}/mountinfo r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-keyboard b/apparmor.d/groups/gnome/gsd-keyboard index baac36f87..87560b6f9 100644 --- a/apparmor.d/groups/gnome/gsd-keyboard +++ b/apparmor.d/groups/gnome/gsd-keyboard @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-keyboard profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -39,8 +40,6 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/.gsd-keyboard.settings-ported* rw, owner @{user_share_dirs}/gnome-settings-daemon/{,input-sources*} rw, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 6fee16f5c..3c2ef3dac 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-media-keys profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -72,7 +73,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/recently-used.xbel{,.*} rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/+sound:card@{int} r, # For sound card @{run}/udev/data/c13:@{int} r, # for /dev/input/* @@ -86,8 +87,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 452d18afd..97b31d6c5 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-power profile gsd-power @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -60,7 +61,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs @{run}/udev/data/+leds:* r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/ r, @{sys}/class/ r, @@ -83,8 +84,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/kernel/osrelease r, owner @{PROC}/@{pid}/cgroup r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index bb047e917..2c8319bd8 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-print-notifications profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -38,8 +39,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-printer b/apparmor.d/groups/gnome/gsd-printer index 4c485e172..9e67c8c72 100644 --- a/apparmor.d/groups/gnome/gsd-printer +++ b/apparmor.d/groups/gnome/gsd-printer @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-printer profile gsd-printer @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -29,8 +30,6 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-rfkill b/apparmor.d/groups/gnome/gsd-rfkill index c7eb53e60..1fd4157ec 100644 --- a/apparmor.d/groups/gnome/gsd-rfkill +++ b/apparmor.d/groups/gnome/gsd-rfkill @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-rfkill profile gsd-rfkill @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -33,8 +34,6 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features - owner /dev/tty@{int} rw, - /dev/rfkill rw, include if exists diff --git a/apparmor.d/groups/gnome/gsd-screensaver-proxy b/apparmor.d/groups/gnome/gsd-screensaver-proxy index 8115ca01b..1ac54d0fe 100644 --- a/apparmor.d/groups/gnome/gsd-screensaver-proxy +++ b/apparmor.d/groups/gnome/gsd-screensaver-proxy @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-screensaver-proxy profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) { include + include include include @@ -24,8 +25,6 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-sharing b/apparmor.d/groups/gnome/gsd-sharing index a2fdf107a..871e10abc 100644 --- a/apparmor.d/groups/gnome/gsd-sharing +++ b/apparmor.d/groups/gnome/gsd-sharing @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-sharing profile gsd-sharing @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -44,8 +45,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) { @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index 9cda7f5d3..f93f0313b 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-smartcard profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -42,8 +43,6 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3{,.lock} rwk, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-sound b/apparmor.d/groups/gnome/gsd-sound index ae4844956..8c5e7891a 100644 --- a/apparmor.d/groups/gnome/gsd-sound +++ b/apparmor.d/groups/gnome/gsd-sound @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-sound profile gsd-sound @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -36,8 +37,6 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/sounds/ rw, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/gsd-wacom b/apparmor.d/groups/gnome/gsd-wacom index ff0dc419c..f9c4ffb33 100644 --- a/apparmor.d/groups/gnome/gsd-wacom +++ b/apparmor.d/groups/gnome/gsd-wacom @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gsd-wacom profile gsd-wacom @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -32,8 +33,6 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) { owner @{gdm_config_dirs}/dconf/user r, owner @{GDM_HOME}/greeter-dconf-defaults r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index 183e6cf4a..4fe3bc066 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/mutter-x11-frames profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -33,8 +34,6 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cmdline r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 5af21ae75..d37b53ddd 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -45,7 +45,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) owner @{user_config_dirs}/powermanagementprofilesrc.lock rwk, owner @{user_config_dirs}/powermanagementprofilesrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** owner @{run}/user/@{uid}kcrash_@{int} rw, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index 3f95292f6..61cd67246 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -66,7 +66,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/@{rand6} rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/user/@{uid}/KSMserver__[0-9] rw, /dev/tty r, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 0bd53e3a6..9922eff98 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -99,7 +99,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/ r, @{sys}/class/ r, diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index 9a780107b..8ac535f16 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -34,7 +34,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx @{run}/udev/data/n@{int} r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{sys}/bus/ r, @{sys}/bus/usb/devices/ r, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index ff317ec94..e20ea48b3 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -95,7 +95,8 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { /usr/share/gvfs/remote-volume-monitors/{,*.monitor} r, /usr/share/iproute2/{,**} r, - / r, + @{att}/ r, + /etc/ r, /etc/iproute2/* r, /etc/machine-id r, @@ -115,11 +116,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{sys}/class/net/rfkill/ r, @{sys}/class/rfkill/ r, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/network/ifstate r, @{run}/NetworkManager/{,**} rw, @{run}/nm-*.pid rw, @{run}/nscd/db* rwl, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/users/@{uid} r, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index b5346964c..e1c55c7e1 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -32,7 +32,7 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, /dev/tty rw, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 29cc38432..2f704fb37 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -97,12 +97,13 @@ profile sshd @{exec_path} flags=(attach_disconnected) { owner @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r, owner @{user_cache_dirs}/{,motd*} rw, + @{att}/@{run}/systemd/sessions/@{int}.ref rw, + @{run}/faillock/@{user} rwk, @{run}/motd.d/{,*} r, @{run}/motd.dynamic rw, @{run}/motd.dynamic.new rw, @{run}/systemd/notify w, - @{run}/systemd/sessions/*.ref rw, owner @{run}/sshd{,.init}.pid wl, @{sys}/fs/cgroup/*/user/*/@{int}/ rw, diff --git a/apparmor.d/groups/systemd/systemd-inhibit b/apparmor.d/groups/systemd/systemd-inhibit index 9938015d3..2be38e6ba 100644 --- a/apparmor.d/groups/systemd/systemd-inhibit +++ b/apparmor.d/groups/systemd/systemd-inhibit @@ -20,7 +20,7 @@ profile systemd-inhibit @{exec_path} flags=(attach_disconnected) { @{bin}/cat rix, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index b4d137940..f38564ae1 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -50,9 +50,9 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { /etc/networkd-dispatcher/carrier.d/{,*} r, - / r, + @{att}/ r, - owner /var/lib/systemd/network/ r, + owner @{att}/var/lib/systemd/network/ r, @{run}/systemd/network/ r, @{run}/systemd/network/*.network r, diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 8fb717323..119ac517c 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -71,7 +71,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/update-manager-core/{,**} rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 6b1616e94..cfbd2d7b9 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -85,9 +85,9 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { /etc/docker/{,**} r, - / r, + @{att}/ r, - owner @{lib}/containerd/** w, + owner @{att}/@{lib}/containerd/** rw, owner @{lib}/docker/overlay2/*/work/{,**} rw, owner /var/lib/containerd/** rw, owner /var/lib/docker/{,**} rwk, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index e1aa55d57..db6d5d377 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -153,11 +153,12 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{user_vm_dirs}/{,**} rwk, @{user_publicshare_dirs}/{,**} rwk, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/libvirt/ rw, @{run}/libvirt/** rwk, @{run}/libvirtd.pid wk, @{run}/lock/LCK.._pts_@{int} rw, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/systemd/notify w, @{run}/utmp rk, diff --git a/apparmor.d/groups/virt/virtinterfaced b/apparmor.d/groups/virt/virtinterfaced index 8ef827a10..4737dd806 100644 --- a/apparmor.d/groups/virt/virtinterfaced +++ b/apparmor.d/groups/virt/virtinterfaced @@ -20,7 +20,7 @@ profile virtinterfaced @{exec_path} flags=(attach_disconnected) { @{lib}/gconv/gconv-modules rm, @{lib}/gconv/gconv-modules.d/{,*} r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/user/@{uid}/libvirt/common/system.token rwk, owner @{run}/user/@{uid}/libvirt/interface/ rw, owner @{run}/user/@{uid}/libvirt/interface/run/{,*} rwk, diff --git a/apparmor.d/groups/virt/virtlogd b/apparmor.d/groups/virt/virtlogd index 095084ef4..44bf06ba0 100644 --- a/apparmor.d/groups/virt/virtlogd +++ b/apparmor.d/groups/virt/virtlogd @@ -28,9 +28,10 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/libvirt/virtlogd.pid rwk, owner @{run}/user/@{uid}/libvirt/virtlogd* w, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/libvirt/common/system.token rwk, @{run}/libvirt/virtlogd-sock rw, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/virtlogd.pid rwk, @{sys}/devices/system/node/ r, diff --git a/apparmor.d/groups/virt/virtnetworkd b/apparmor.d/groups/virt/virtnetworkd index 2ed2a73fd..42e13ef64 100644 --- a/apparmor.d/groups/virt/virtnetworkd +++ b/apparmor.d/groups/virt/virtnetworkd @@ -24,8 +24,9 @@ profile virtnetworkd @{exec_path} flags=(attach_disconnected) { owner /var/lib/libvirt/dnsmasq/*.macs* rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/libvirt/network/default.pid r, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/utmp rk, owner @{run}/libvirt/common/system.token rwk, owner @{run}/libvirt/network/{,**} rwk, diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index c0498c6cc..0b48d63fd 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -32,7 +32,8 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { /etc/libvirt/*.conf r, /etc/mdevctl.d/{,**} r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + owner @{run}/libvirt/common/system.token rwk, owner @{run}/libvirt/nodedev/ rw, owner @{run}/libvirt/nodedev/driver.pid wk, diff --git a/apparmor.d/groups/virt/virtsecretd b/apparmor.d/groups/virt/virtsecretd index 58e228d50..9b3e7dda4 100644 --- a/apparmor.d/groups/virt/virtsecretd +++ b/apparmor.d/groups/virt/virtsecretd @@ -20,7 +20,8 @@ profile virtsecretd @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/libvirt/secrets/ rw, owner @{user_config_dirs}/libvirt/secrets/run/{,*} rwk, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + owner @{run}/user/@{uid}/libvirt/common/system.token rwk, owner @{run}/user/@{uid}/libvirt/secrets/ rw, owner @{run}/user/@{uid}/libvirt/secrets/run/{,*} rwk, diff --git a/apparmor.d/groups/virt/virtstoraged b/apparmor.d/groups/virt/virtstoraged index 847140a50..00565fcf5 100644 --- a/apparmor.d/groups/virt/virtstoraged +++ b/apparmor.d/groups/virt/virtstoraged @@ -54,7 +54,8 @@ profile virtstoraged @{exec_path} flags=(attach_disconnected) { owner @{run}/libvirt/storage/{,**} rwk, owner @{run}/virtstoraged.pid rwk, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/utmp rwk, @{sys}/devices/system/node/ r, diff --git a/apparmor.d/groups/xfce/xfce-power-manager b/apparmor.d/groups/xfce/xfce-power-manager index ff78b6f16..1c2a0263d 100644 --- a/apparmor.d/groups/xfce/xfce-power-manager +++ b/apparmor.d/groups/xfce/xfce-power-manager @@ -21,7 +21,7 @@ profile xfce-power-manager @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/stat r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/groups/xfce/xfce-screensaver b/apparmor.d/groups/xfce/xfce-screensaver index ce0a76612..e486ac6d9 100644 --- a/apparmor.d/groups/xfce/xfce-screensaver +++ b/apparmor.d/groups/xfce/xfce-screensaver @@ -25,7 +25,7 @@ profile xfce-screensaver @{exec_path} flags=(attach_disconnected) { /etc/xdg/menus/xfce4-screensavers.menu r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/profiles-a-f/flatpak-portal b/apparmor.d/profiles-a-f/flatpak-portal index 3f3d1e28e..8a8d2b901 100644 --- a/apparmor.d/profiles-a-f/flatpak-portal +++ b/apparmor.d/profiles-a-f/flatpak-portal @@ -31,8 +31,8 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { /var/lib/flatpak/exports/share/mime/mime.cache r, - / r, - /.flatpak-info r, + owner @{att}/ r, + owner @{att}/.flatpak-info r, owner @{HOME}/.var/app/*/**/.ref rw, owner @{HOME}/.var/app/*/**/logs/* rw, diff --git a/apparmor.d/profiles-a-f/foliate b/apparmor.d/profiles-a-f/foliate index b1c485408..422652084 100644 --- a/apparmor.d/profiles-a-f/foliate +++ b/apparmor.d/profiles-a-f/foliate @@ -40,7 +40,7 @@ profile foliate @{exec_path} flags=(attach_disconnected) { /usr/share/com.github.johnfactotum.Foliate/{,**} r, owner /bindfile@{rand6} rw, - owner /.flatpak-info r, + owner @{att}/.flatpak-info r, owner @{user_books_dirs}/{,**} r, owner @{user_torrents_dirs}/{,**} r, diff --git a/apparmor.d/profiles-a-f/fprintd b/apparmor.d/profiles-a-f/fprintd index 9a0d4058a..b3034dfef 100644 --- a/apparmor.d/profiles-a-f/fprintd +++ b/apparmor.d/profiles-a-f/fprintd @@ -27,8 +27,9 @@ profile fprintd @{exec_path} flags=(attach_disconnected) { /var/lib/fprint/{,**} rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/systemd/journal/socket rw, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/class/hidraw/ r, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 7c1f2024a..9ac0e21e6 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -94,11 +94,12 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{sys}/kernel/security/tpm[0-9]/binary_bios_measurements r, @{sys}/power/mem_sleep r, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/motd.d/ r, @{run}/motd.d/@{int}-fwupd* rw, @{run}/motd.d/fwupd/{,**} rw, @{run}/mount/utab r, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/* r, @{PROC}/@{pids}/fd/ r, diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 497595e39..c4bf64d75 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -35,7 +35,7 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { /etc/machine-id r, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/utmp r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/profiles-m-r/mission-control b/apparmor.d/profiles-m-r/mission-control index efe44ebc2..b8e79c0dc 100644 --- a/apparmor.d/profiles-m-r/mission-control +++ b/apparmor.d/profiles-m-r/mission-control @@ -25,7 +25,7 @@ profile mission-control @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk, owner @{user_cache_dirs}/.mc_connections rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/profiles-m-r/nvtop b/apparmor.d/profiles-m-r/nvtop index aed19fa5f..88a164c00 100644 --- a/apparmor.d/profiles-m-r/nvtop +++ b/apparmor.d/profiles-m-r/nvtop @@ -23,7 +23,8 @@ profile nvtop @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/nvtop/{,**} rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/udev/data/+drm:card@{int}-* r, # for screen outputs @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/c226:@{int} r, # For /dev/dri/card* diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index 3eb16caad..b97c5e9a8 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -94,7 +94,8 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { owner @{tmp}/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw, owner @{tmp}/packagekit* rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + owner @{run}/systemd/users/@{uid} r, #aa:only opensuse diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index ed6544c3f..33435fa8d 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -57,7 +57,7 @@ profile psi @{exec_path} { owner @{tmp}/etilqs_@{hex16} rw, owner @{tmp}/Psi.* rwl -> /tmp/#@{int}, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index c7f310ac8..32c05e55b 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -57,7 +57,7 @@ profile psi-plus @{exec_path} { owner @{tmp}/etilqs_@{hex16} rw, owner @{tmp}/Psi+.* rwl -> /tmp/#@{int}, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index 972f111f4..b905e8f3a 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -40,7 +40,7 @@ profile signal-desktop @{exec_path} { audit @{lib_dirs}/chrome-sandbox rPx, @{lib_dirs}/chrome_crashpad_handler rix, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index f0731fd64..79204827f 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/spice-vdagent profile spice-vdagent @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -46,8 +47,6 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pids}/task/@{tid}/comm rw, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 3ad53cf0a..e864663bb 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -174,12 +174,12 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/steam@{rand6}/{,**} rw, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, + owner @{att}/dev/shm/ValveIPCSHM_@{uid} rw, owner /dev/shm/fossilize-*-@{int}-@{int} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw, owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex8} rw, owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, - owner /dev/shm/ValveIPCSHM_@{uid} rw, owner @{run}/user/@{uid}/ r, diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index 91ceef33d..c0b940478 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -29,7 +29,7 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) { @{bin}/speech-dispatcher rPx, @{open_path} rPx -> child-open-strict, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, include if exists } diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index af2eec34e..b89d9c72f 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -104,11 +104,12 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{MOUNTS}/ rw, @{MOUNTS}/*/ rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/ r, @{run}/mount/utab{,.*} rwk, @{run}/udisks2/{,**} rw, @{run}/systemd/seats/seat@{int} r, - @{run}/systemd/inhibit/@{int}.ref rw, @{run}/cryptsetup/ r, @{run}/cryptsetup/L* rwk, diff --git a/apparmor.d/profiles-s-z/uname b/apparmor.d/profiles-s-z/uname index 7c5cb0cb1..45a864c23 100644 --- a/apparmor.d/profiles-s-z/uname +++ b/apparmor.d/profiles-s-z/uname @@ -14,7 +14,7 @@ profile uname @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /dev/tty@{int} rw, + @{att}/dev/tty@{int} rw, deny network, deny owner @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index 55d4a555d..f29df13d0 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -46,7 +46,7 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.xwechat/{,**} rwk, owner @{HOME}/.sys1og.conf rw, - @{run}/systemd/inhibit/@{int}.ref rw, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/utmp r, @{PROC}/@{pid}/net/route r, diff --git a/apparmor.d/profiles-s-z/xbrlapi b/apparmor.d/profiles-s-z/xbrlapi index 35006d46b..f40b4fa6b 100644 --- a/apparmor.d/profiles-s-z/xbrlapi +++ b/apparmor.d/profiles-s-z/xbrlapi @@ -9,14 +9,13 @@ include @{exec_path} = @{bin}/xbrlapi profile xbrlapi @{exec_path} flags=(attach_disconnected) { include + include network inet stream, network inet6 stream, @{exec_path} mr, - /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 2218a3dd6..be37123fd 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -151,7 +151,6 @@ @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 -#aa:only abi3 # Attachment path for attach_disconnected.path flag. # Automatically generated and set in profile preamble on ABI4. Disabled on ABI3. @{att}=/ From 116272b8ada281178150f1c9a564aac1967121f6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 11 Oct 2024 14:21:22 +0100 Subject: [PATCH 0333/1455] feat(aa-log): add support for attached path. --- pkg/logs/logs.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index 246394604..194e6dc03 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -64,6 +64,7 @@ var ( `/home/[^/]+/`, `@{HOME}/`, // Resolve system variables + `/att/[^/@]+`, `@{att}/`, `/usr/lib(32|64|exec)`, `@{lib}`, `/usr/lib`, `@{lib}`, `/usr/(bin|sbin)`, `@{bin}`, @@ -84,6 +85,7 @@ var ( `pci` + strings.Repeat(h, 4) + `:` + strings.Repeat(h, 2), `@{pci_bus}`, `@{pci_bus}/[0-9a-f:*./]*/`, `@{pci}/`, `1000`, `@{uid}`, + `@{att}//`, `@{att}/`, // Some system glob `:not.active.yet`, `@{busname}`, // dbus unique bus name From ebdeef152c5ee135615a9e603101fd0593a28443 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 11 Oct 2024 22:31:06 +0100 Subject: [PATCH 0334/1455] build: root -> share. --- Makefile | 7 ++++--- pkg/prebuild/prepare/synchronise.go | 4 ++-- .../usr/share => share}/bash-completion/completions/aa-log | 0 {root/usr/share => share}/libalpm/hooks/apparmor.hook | 0 {root/usr/share => share}/man/man8/aa-log.8 | 0 {root/usr/share => share}/man/man8/aa-log.md | 0 {root/usr/share => share}/zsh/site-functions/_aa-log.zsh | 0 7 files changed, 6 insertions(+), 5 deletions(-) rename {root/usr/share => share}/bash-completion/completions/aa-log (100%) rename {root/usr/share => share}/libalpm/hooks/apparmor.hook (100%) rename {root/usr/share => share}/man/man8/aa-log.8 (100%) rename {root/usr/share => share}/man/man8/aa-log.md (100%) rename {root/usr/share => share}/zsh/site-functions/_aa-log.zsh (100%) diff --git a/Makefile b/Makefile index 9c8ae3eae..6d576f8b2 100644 --- a/Makefile +++ b/Makefile @@ -24,13 +24,14 @@ enforce: build full: build @./${BUILD}/prebuild --complain --full -ROOT = $(shell find "${BUILD}/root" -type f -not -name "*.md" -printf "%P\n") +SHARE = $(shell find "${BUILD}/share" -type f -not -name "*.md" -printf "%P\n") PROFILES = $(shell find "${BUILD}/apparmor.d" -type f -printf "%P\n") DISABLES = $(shell find "${BUILD}/apparmor.d" -type l -printf "%P\n") install: + @install -Dm0755 ${BUILD}/aa ${DESTDIR}/usr/bin/aa @install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log - @for file in ${ROOT}; do \ - install -Dm0644 "${BUILD}/root/$${file}" "${DESTDIR}/$${file}"; \ + @for file in ${SHARE}; do \ + install -Dm0644 "${BUILD}/share/$${file}" "${DESTDIR}/usr/share/$${file}"; \ done; @for file in ${PROFILES}; do \ install -Dm0644 "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \ diff --git a/pkg/prebuild/prepare/synchronise.go b/pkg/prebuild/prepare/synchronise.go index 741c015c4..f3ca44c42 100644 --- a/pkg/prebuild/prepare/synchronise.go +++ b/pkg/prebuild/prepare/synchronise.go @@ -27,14 +27,14 @@ func init() { func (p Synchronise) Apply() ([]string, error) { res := []string{} - dirs := paths.PathList{prebuild.RootApparmord, prebuild.Root.Join("root"), prebuild.Root.Join("systemd")} + dirs := paths.PathList{prebuild.RootApparmord, prebuild.Root.Join("share"), prebuild.Root.Join("systemd")} for _, dir := range dirs { if err := dir.RemoveAll(); err != nil { return res, err } } if p.Path == "" { - for _, name := range []string{"apparmor.d", "root"} { + for _, name := range []string{"apparmor.d", "share"} { if err := util.CopyTo(paths.New(name), prebuild.Root.Join(name)); err != nil { return res, err } diff --git a/root/usr/share/bash-completion/completions/aa-log b/share/bash-completion/completions/aa-log similarity index 100% rename from root/usr/share/bash-completion/completions/aa-log rename to share/bash-completion/completions/aa-log diff --git a/root/usr/share/libalpm/hooks/apparmor.hook b/share/libalpm/hooks/apparmor.hook similarity index 100% rename from root/usr/share/libalpm/hooks/apparmor.hook rename to share/libalpm/hooks/apparmor.hook diff --git a/root/usr/share/man/man8/aa-log.8 b/share/man/man8/aa-log.8 similarity index 100% rename from root/usr/share/man/man8/aa-log.8 rename to share/man/man8/aa-log.8 diff --git a/root/usr/share/man/man8/aa-log.md b/share/man/man8/aa-log.md similarity index 100% rename from root/usr/share/man/man8/aa-log.md rename to share/man/man8/aa-log.md diff --git a/root/usr/share/zsh/site-functions/_aa-log.zsh b/share/zsh/site-functions/_aa-log.zsh similarity index 100% rename from root/usr/share/zsh/site-functions/_aa-log.zsh rename to share/zsh/site-functions/_aa-log.zsh From 982c2c66aa7cca2242a9a5ba4e8638359544524f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Oct 2024 15:31:24 +0100 Subject: [PATCH 0335/1455] refractor: rename some path util function. --- cmd/aa/main.go | 1 - pkg/aa/apparmor_test.go | 5 +-- pkg/aa/parse_test.go | 6 +-- pkg/aa/resolve.go | 3 +- pkg/paths/paths.go | 73 +++++++++++++++++++++++++++++++ pkg/prebuild/cli/cli.go | 3 +- pkg/prebuild/directive/exec.go | 3 +- pkg/prebuild/directive/stack.go | 2 +- pkg/prebuild/files.go | 5 +-- pkg/prebuild/prepare/flags.go | 3 +- pkg/prebuild/prepare/fsp.go | 4 +- pkg/prebuild/prepare/overwrite.go | 3 +- pkg/util/tools.go | 58 ------------------------ 13 files changed, 87 insertions(+), 82 deletions(-) diff --git a/cmd/aa/main.go b/cmd/aa/main.go index d5bc10d59..9f4070158 100644 --- a/cmd/aa/main.go +++ b/cmd/aa/main.go @@ -13,7 +13,6 @@ import ( "github.com/roddhjav/apparmor.d/pkg/aa" "github.com/roddhjav/apparmor.d/pkg/logging" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/util" ) const usage = `aa [-h] [--lint | --format | --tree] [-s] [-F file] [profiles...] diff --git a/pkg/aa/apparmor_test.go b/pkg/aa/apparmor_test.go index 19cfd5a42..0cc74d438 100644 --- a/pkg/aa/apparmor_test.go +++ b/pkg/aa/apparmor_test.go @@ -10,7 +10,6 @@ import ( "testing" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/util" ) var ( @@ -21,7 +20,7 @@ var ( // mustReadProfileFile read a file and return its content as a slice of string. // It panics if an error occurs. It removes the last comment line. func mustReadProfileFile(path *paths.Path) string { - res := strings.Split(util.MustReadFile(path), "\n") + res := strings.Split(path.MustReadFileAsString(), "\n") return strings.Join(res[:len(res)-2], "\n") } @@ -108,7 +107,7 @@ func TestAppArmorProfileFile_String(t *testing.T) { }, }}, }, - want: util.MustReadFile(testData.Join("string.aa")), + want: testData.Join("string.aa").MustReadFileAsString(), }, } for _, tt := range tests { diff --git a/pkg/aa/parse_test.go b/pkg/aa/parse_test.go index 8b54487ff..71607fd32 100644 --- a/pkg/aa/parse_test.go +++ b/pkg/aa/parse_test.go @@ -8,8 +8,6 @@ import ( "reflect" "strings" "testing" - - "github.com/roddhjav/apparmor.d/pkg/util" ) func Test_tokenizeRule(t *testing.T) { @@ -919,7 +917,7 @@ var ( }, { name: "string.aa", - raw: util.MustReadFile(testData.Join("string.aa")), + raw: testData.Join("string.aa").MustReadFileAsString(), apparmor: &AppArmorProfileFile{ Preamble: Rules{ &Comment{Base: Base{Comment: " Simple test profile for the AppArmorProfileFile.String() method", IsLineRule: true}}, @@ -1017,7 +1015,7 @@ var ( }, { name: "full.aa", - raw: util.MustReadFile(testData.Join("full.aa")), + raw: testData.Join("full.aa").MustReadFileAsString(), apparmor: &AppArmorProfileFile{ Preamble: Rules{ &Comment{Base: Base{IsLineRule: true, Comment: " Simple test profile with all rules used"}}, diff --git a/pkg/aa/resolve.go b/pkg/aa/resolve.go index 26a03691e..6ce768bc0 100644 --- a/pkg/aa/resolve.go +++ b/pkg/aa/resolve.go @@ -10,7 +10,6 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/util" ) var ( @@ -149,7 +148,7 @@ func (f *AppArmorProfileFile) resolveInclude(include *Include) error { iFile := &AppArmorProfileFile{} for _, file := range files { - raw, err := util.ReadFile(file) + raw, err := file.ReadFileAsString() if err != nil { return err } diff --git a/pkg/paths/paths.go b/pkg/paths/paths.go index b77adfa66..feb1e21c4 100644 --- a/pkg/paths/paths.go +++ b/pkg/paths/paths.go @@ -35,9 +35,12 @@ import ( "io/fs" "os" "path/filepath" + "slices" "strings" "syscall" "time" + + "github.com/roddhjav/apparmor.d/pkg/util" ) // Path represents a path @@ -360,6 +363,31 @@ func (p *Path) CopyTo(dst *Path) error { return nil } +// CopyTo recursivelly copy all files from a source path to a destination path. +func CopyTo(src *Path, dst *Path) error { + files, err := src.ReadDirRecursiveFiltered(nil, + FilterOutDirectories(), + FilterOutNames("README.md"), + ) + if err != nil { + return err + } + for _, file := range files { + destination, err := file.RelFrom(src) + if err != nil { + return err + } + destination = dst.JoinPath(destination) + if err := destination.Parent().MkdirAll(); err != nil { + return err + } + if err := file.CopyTo(destination); err != nil { + return err + } + } + return nil +} + // CopyDirTo recursively copies the directory denoted by the current path to // the destination path. The source directory must exist and the destination // directory must NOT exist (no implicit destination name allowed). @@ -460,6 +488,24 @@ func WriteToTempFile(data []byte, dir *Path, prefix string) (res *Path, err erro return New(f.Name()), nil } +// ReadFileAsString read a file and return its content as a string. +func (p *Path) ReadFileAsString() (string, error) { + content, err := p.ReadFile() + if err != nil { + return "", err + } + return string(content), nil +} + +// MustReadFileAsString read a file and return its content as a string. Panic if an error occurs. +func (p *Path) MustReadFileAsString() string { + content, err := p.ReadFile() + if err != nil { + panic(err) + } + return string(content) +} + // ReadFileAsLines reads the file named by filename and returns it as an // array of lines. This function takes care of the newline encoding // differences between different OS @@ -473,6 +519,33 @@ func (p *Path) ReadFileAsLines() ([]string, error) { return strings.Split(txt, "\n"), nil } +// MustReadFileAsLines read a file and return its content as a slice of string. Panic if an error occurs. +func (p *Path) MustReadFileAsLines() []string { + lines, err := p.ReadFileAsLines() + if err != nil { + panic(err) + } + return lines +} + +// MustReadFilteredFileAsLines read a file and return its content as a slice of string. +// It filter out comments and empty lines. Panic if an error occurs. +func (p *Path) MustReadFilteredFileAsLines() []string { + data, err := p.ReadFile() + if err != nil { + panic(err) + } + txt := string(data) + txt = strings.Replace(txt, "\r\n", "\n", -1) + txt = util.Filter(txt) + res := strings.Split(txt, "\n") + if slices.Contains(res, "") { + idx := slices.Index(res, "") + res = slices.Delete(res, idx, idx+1) + } + return res +} + // Truncate create an empty file named by path or if the file already // exist it truncates it (delete all contents) func (p *Path) Truncate() error { diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 7c91d8281..932851d02 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -15,7 +15,6 @@ import ( "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" "github.com/roddhjav/apparmor.d/pkg/prebuild/directive" "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" - "github.com/roddhjav/apparmor.d/pkg/util" ) const ( @@ -138,7 +137,7 @@ func Build() error { if !file.Exist() { continue } - profile, err := util.ReadFile(file) + profile, err := file.ReadFileAsString() if err != nil { return err } diff --git a/pkg/prebuild/directive/exec.go b/pkg/prebuild/directive/exec.go index c856b7268..5aee73740 100644 --- a/pkg/prebuild/directive/exec.go +++ b/pkg/prebuild/directive/exec.go @@ -13,7 +13,6 @@ import ( "github.com/roddhjav/apparmor.d/pkg/aa" "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/util" ) type Exec struct { @@ -44,7 +43,7 @@ func (d Exec) Apply(opt *Option, profileRaw string) (string, error) { rules := aa.Rules{} for name := range opt.ArgMap { - profiletoTransition := util.MustReadFile(prebuild.RootApparmord.Join(name)) + profiletoTransition := prebuild.RootApparmord.Join(name).MustReadFileAsString() dstProfile := aa.DefaultTunables() if _, err := dstProfile.Parse(profiletoTransition); err != nil { return "", err diff --git a/pkg/prebuild/directive/stack.go b/pkg/prebuild/directive/stack.go index 707405362..03dd826e1 100644 --- a/pkg/prebuild/directive/stack.go +++ b/pkg/prebuild/directive/stack.go @@ -55,7 +55,7 @@ func (s Stack) Apply(opt *Option, profile string) (string, error) { res := "" for name := range opt.ArgMap { - stackedProfile := util.MustReadFile(prebuild.RootApparmord.Join(name)) + stackedProfile := prebuild.RootApparmord.Join(name).MustReadFileAsString() m := regRules.FindStringSubmatch(stackedProfile) if len(m) < 2 { return "", fmt.Errorf("No profile found in %s", name) diff --git a/pkg/prebuild/files.go b/pkg/prebuild/files.go index d275c916d..c14730960 100644 --- a/pkg/prebuild/files.go +++ b/pkg/prebuild/files.go @@ -8,7 +8,6 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/util" ) // Default content of debian/apparmor.d.hide. Whonix has special addition. @@ -29,7 +28,7 @@ func (f Flagger) Read(name string) map[string][]string { return res } - lines := util.MustReadFileAsLines(path) + lines := path.MustReadFilteredFileAsLines() for _, line := range lines { manifest := strings.Split(line, " ") profile := manifest[0] @@ -49,7 +48,7 @@ func (i Ignorer) Read(name string) []string { if !path.Exist() { return []string{} } - return util.MustReadFileAsLines(path) + return path.MustReadFilteredFileAsLines() } type DebianHider struct { diff --git a/pkg/prebuild/prepare/flags.go b/pkg/prebuild/prepare/flags.go index 23998d4d0..5a851cbe9 100644 --- a/pkg/prebuild/prepare/flags.go +++ b/pkg/prebuild/prepare/flags.go @@ -10,7 +10,6 @@ import ( "strings" "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/util" ) var ( @@ -44,7 +43,7 @@ func (p SetFlags) Apply() ([]string, error) { // Overwrite profile flags if len(flags) > 0 { flagsStr := " flags=(" + strings.Join(flags, ",") + ") {\n" - out, err := util.ReadFile(file) + out, err := file.ReadFileAsString() if err != nil { return res, err } diff --git a/pkg/prebuild/prepare/fsp.go b/pkg/prebuild/prepare/fsp.go index af57ed9d7..b40030d2c 100644 --- a/pkg/prebuild/prepare/fsp.go +++ b/pkg/prebuild/prepare/fsp.go @@ -35,7 +35,7 @@ func (p FullSystemPolicy) Apply() ([]string, error) { // Set systemd profile name path := prebuild.RootApparmord.Join("tunables/multiarch.d/system") - out, err := util.ReadFile(path) + out, err := path.ReadFileAsString() if err != nil { return res, err } @@ -47,7 +47,7 @@ func (p FullSystemPolicy) Apply() ([]string, error) { // Fix conflicting x modifiers in abstractions - FIXME: Temporary solution path = prebuild.RootApparmord.Join("abstractions/gstreamer") - out, err = util.ReadFile(path) + out, err = path.ReadFileAsString() if err != nil { return res, err } diff --git a/pkg/prebuild/prepare/overwrite.go b/pkg/prebuild/prepare/overwrite.go index 209e8dc81..6f8951161 100644 --- a/pkg/prebuild/prepare/overwrite.go +++ b/pkg/prebuild/prepare/overwrite.go @@ -9,7 +9,6 @@ import ( "os" "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/util" ) const ext = ".apparmor.d" @@ -44,7 +43,7 @@ func (p Overwrite) Apply() ([]string, error) { if !path.Exist() { return res, fmt.Errorf("%s not found", path) } - for _, name := range util.MustReadFileAsLines(path) { + for _, name := range path.MustReadFilteredFileAsLines() { origin := prebuild.RootApparmord.Join(name) dest := prebuild.RootApparmord.Join(name + ext) if !dest.Exist() && p.OneFile { diff --git a/pkg/util/tools.go b/pkg/util/tools.go index 0d3372fcc..749a97e62 100644 --- a/pkg/util/tools.go +++ b/pkg/util/tools.go @@ -7,10 +7,6 @@ package util import ( "encoding/hex" "regexp" - "slices" - "strings" - - "github.com/roddhjav/apparmor.d/pkg/paths" ) var ( @@ -67,61 +63,7 @@ func DecodeHexInString(str string) string { return str } -// CopyTo recursivelly copy all files from a source path to a destination path. -func CopyTo(src *paths.Path, dst *paths.Path) error { - files, err := src.ReadDirRecursiveFiltered(nil, - paths.FilterOutDirectories(), - paths.FilterOutNames("README.md"), - ) - if err != nil { - return err - } - for _, file := range files { - destination, err := file.RelFrom(src) - if err != nil { - return err - } - destination = dst.JoinPath(destination) - if err := destination.Parent().MkdirAll(); err != nil { - return err - } - if err := file.CopyTo(destination); err != nil { - return err - } - } - return nil -} - // Filter out comments and empty line from a string func Filter(src string) string { return regFilter.Replace(src) } - -// ReadFile read a file and return its content as a string. -func ReadFile(path *paths.Path) (string, error) { - content, err := path.ReadFile() - if err != nil { - return "", err - } - return string(content), nil -} - -// MustReadFile read a file and return its content as a string. Panic if an error occurs. -func MustReadFile(path *paths.Path) string { - content, err := path.ReadFile() - if err != nil { - panic(err) - } - return string(content) -} - -// MustReadFileAsLines read a file and return its content as a slice of string. -// It panics if an error occurs and filter out comments and empty lines. -func MustReadFileAsLines(path *paths.Path) []string { - res := strings.Split(Filter(MustReadFile(path)), "\n") - if slices.Contains(res, "") { - idx := slices.Index(res, "") - res = slices.Delete(res, idx, idx+1) - } - return res -} From e90ccd214cb781409d69a5cb00fbd65d8948a83d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Oct 2024 15:40:17 +0100 Subject: [PATCH 0336/1455] refractor: move CopyTo Will be replaced by os.CopyFS with go 1.23 --- pkg/prebuild/prepare/configure.go | 6 ++-- pkg/prebuild/prepare/fsp.go | 4 +-- pkg/prebuild/prepare/synchronise.go | 3 +- pkg/prebuild/prepare/systemd.go | 6 ++-- pkg/util/tools_test.go | 43 ----------------------------- 5 files changed, 9 insertions(+), 53 deletions(-) diff --git a/pkg/prebuild/prepare/configure.go b/pkg/prebuild/prepare/configure.go index 9a423060f..4b8e11ec5 100644 --- a/pkg/prebuild/prepare/configure.go +++ b/pkg/prebuild/prepare/configure.go @@ -7,8 +7,8 @@ package prepare import ( "fmt" + "github.com/roddhjav/apparmor.d/pkg/paths" "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/util" ) type Configure struct { @@ -36,7 +36,7 @@ func (p Configure) Apply() ([]string, error) { } if prebuild.ABI == 3 { - if err := util.CopyTo(prebuild.DistDir.Join("ubuntu"), prebuild.RootApparmord); err != nil { + if err := paths.CopyTo(prebuild.DistDir.Join("ubuntu"), prebuild.RootApparmord); err != nil { return res, err } } @@ -47,7 +47,7 @@ func (p Configure) Apply() ([]string, error) { } // Copy Debian specific abstractions - if err := util.CopyTo(prebuild.DistDir.Join("ubuntu"), prebuild.RootApparmord); err != nil { + if err := paths.CopyTo(prebuild.DistDir.Join("ubuntu"), prebuild.RootApparmord); err != nil { return res, err } diff --git a/pkg/prebuild/prepare/fsp.go b/pkg/prebuild/prepare/fsp.go index b40030d2c..1d38ca294 100644 --- a/pkg/prebuild/prepare/fsp.go +++ b/pkg/prebuild/prepare/fsp.go @@ -29,7 +29,7 @@ func (p FullSystemPolicy) Apply() ([]string, error) { res := []string{} // Install full system policy profiles - if err := util.CopyTo(paths.New("apparmor.d/groups/_full/"), prebuild.Root.Join("apparmor.d")); err != nil { + if err := paths.CopyTo(paths.New("apparmor.d/groups/_full/"), prebuild.Root.Join("apparmor.d")); err != nil { return res, err } @@ -58,5 +58,5 @@ func (p FullSystemPolicy) Apply() ([]string, error) { } // Set systemd unit drop-in files - return res, util.CopyTo(prebuild.SystemdDir.Join("full"), prebuild.Root.Join("systemd")) + return res, paths.CopyTo(prebuild.SystemdDir.Join("full"), prebuild.Root.Join("systemd")) } diff --git a/pkg/prebuild/prepare/synchronise.go b/pkg/prebuild/prepare/synchronise.go index f3ca44c42..b272388c7 100644 --- a/pkg/prebuild/prepare/synchronise.go +++ b/pkg/prebuild/prepare/synchronise.go @@ -7,7 +7,6 @@ package prepare import ( "github.com/roddhjav/apparmor.d/pkg/paths" "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/util" ) type Synchronise struct { @@ -35,7 +34,7 @@ func (p Synchronise) Apply() ([]string, error) { } if p.Path == "" { for _, name := range []string{"apparmor.d", "share"} { - if err := util.CopyTo(paths.New(name), prebuild.Root.Join(name)); err != nil { + if err := paths.CopyTo(paths.New(name), prebuild.Root.Join(name)); err != nil { return res, err } } diff --git a/pkg/prebuild/prepare/systemd.go b/pkg/prebuild/prepare/systemd.go index cee952854..b7646e4bf 100644 --- a/pkg/prebuild/prepare/systemd.go +++ b/pkg/prebuild/prepare/systemd.go @@ -5,8 +5,8 @@ package prepare import ( + "github.com/roddhjav/apparmor.d/pkg/paths" "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/util" ) type SystemdDefault struct { @@ -33,9 +33,9 @@ func init() { } func (p SystemdDefault) Apply() ([]string, error) { - return []string{}, util.CopyTo(prebuild.SystemdDir.Join("default"), prebuild.Root.Join("systemd")) + return []string{}, paths.CopyTo(prebuild.SystemdDir.Join("default"), prebuild.Root.Join("systemd")) } func (p SystemdEarly) Apply() ([]string, error) { - return []string{}, util.CopyTo(prebuild.SystemdDir.Join("early"), prebuild.Root.Join("systemd")) + return []string{}, paths.CopyTo(prebuild.SystemdDir.Join("early"), prebuild.Root.Join("systemd")) } diff --git a/pkg/util/tools_test.go b/pkg/util/tools_test.go index df45d92b7..e8b2bb837 100644 --- a/pkg/util/tools_test.go +++ b/pkg/util/tools_test.go @@ -8,8 +8,6 @@ import ( "reflect" "regexp" "testing" - - "github.com/roddhjav/apparmor.d/pkg/paths" ) func TestDecodeHexInString(t *testing.T) { @@ -90,47 +88,6 @@ func TestRegexReplList_Replace(t *testing.T) { } } -func TestCopyTo(t *testing.T) { - tests := []struct { - name string - src *paths.Path - dst *paths.Path - wantErr bool - }{ - { - name: "default", - src: paths.New("../../apparmor.d/groups/_full/"), - dst: paths.New("/tmp/test/apparmor.d/groups/_full/"), - wantErr: false, - }, - { - name: "issue-source", - src: paths.New("../../apparmor.d/groups/nope/"), - dst: paths.New("/tmp/test/apparmor.d/groups/_full/"), - wantErr: true, - }, - // { - // name: "issue-dest-1", - // src: paths.New("../../apparmor.d/groups/_full/"), - // dst: paths.New("/"), - // wantErr: true, - // }, - // { - // name: "issue-dest-2", - // src: paths.New("../../apparmor.d/groups/_full/"), - // dst: paths.New("/_full/"), - // wantErr: true, - // }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - if err := CopyTo(tt.src, tt.dst); (err != nil) != tt.wantErr { - t.Errorf("CopyTo() error = %v, wantErr %v", err, tt.wantErr) - } - }) - } -} - func Test_Filter(t *testing.T) { tests := []struct { name string From 273485217c79e3931c441c109f8d822e764a1875 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Oct 2024 20:08:21 +0100 Subject: [PATCH 0337/1455] build: add the task to automatically attach disconnected path. Not yet enabled on build, as the profiles still require some testing. --- pkg/prebuild/builder/attach.go | 65 ++++++++++++++++++++++++++++++++++ pkg/prebuild/cli/cli.go | 7 +++- 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 pkg/prebuild/builder/attach.go diff --git a/pkg/prebuild/builder/attach.go b/pkg/prebuild/builder/attach.go new file mode 100644 index 000000000..6fd700291 --- /dev/null +++ b/pkg/prebuild/builder/attach.go @@ -0,0 +1,65 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2021-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package builder + +import ( + "regexp" + "strings" + + "github.com/roddhjav/apparmor.d/pkg/prebuild" +) + +var ( + regProfile = regexp.MustCompile(`profile ([^ ]+)`) +) + +type ReAttach struct { + prebuild.Base +} + +func init() { + RegisterBuilder(&ReAttach{ + Base: prebuild.Base{ + Keyword: "attach", + Msg: "Re-attach disconnect path", + }, + }) +} + +// Apply will re-attach the disconnected path +// - Add the attach_disconnected.path flag on all frofile with the attach_disconnected flag +// - Add the attached/base abstraction in the profile +// - For compatibility, non disconnected profile will have the @{att} variable set to / +func (b ReAttach) Apply(opt *Option, profile string) (string, error) { + var insert string + var origin = "profile " + opt.Name + + if strings.Contains(profile, "attach_disconnected") { + insert = "@{att} = /att/" + opt.Name + "/\n" + profile = strings.Replace(profile, + "attach_disconnected", + "attach_disconnected,attach_disconnected.path=@{att}", -1, + ) + + old := "include if exists " + new := "include \n " + old + profile = strings.Replace(profile, old, new, 1) + + for _, match := range regProfile.FindAllStringSubmatch(profile, -1) { + name := match[1] + if name == opt.Name { + continue + } + old = "include if exists " + new = "include \n " + old + profile = strings.Replace(profile, old, new, 1) + } + + } else { + insert = "@{att} = /\n" + } + + return strings.Replace(profile, origin, insert+origin, 1), nil +} diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 932851d02..2821d52c2 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -88,8 +88,13 @@ func Prebuild() { if abi != nilABI { prebuild.ABI = abi } - if prebuild.ABI == 3 { + switch prebuild.ABI { + case 3: builder.Register("abi3") // Convert all profiles from abi 4.0 to abi 3.0 + case 4: + // builder.Register("attach") // Re-attach disconnect path + default: + logging.Fatal("Invalid ABI version: %d", prebuild.ABI) } if file != "" { From 3ef6c4403885c47f7b9bdd73389ace79817597df Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Oct 2024 20:11:45 +0100 Subject: [PATCH 0338/1455] fix: small fix & cleaning. --- cmd/aa/main.go | 2 +- pkg/aa/mount.go | 9 +++++++++ pkg/aa/template.go | 11 ++--------- 3 files changed, 12 insertions(+), 10 deletions(-) diff --git a/cmd/aa/main.go b/cmd/aa/main.go index 9f4070158..5f7dd6396 100644 --- a/cmd/aa/main.go +++ b/cmd/aa/main.go @@ -135,7 +135,7 @@ func aaFormat(files paths.PathList) error { if !file.Exist() { return nil } - profile, err := util.ReadFile(file) + profile, err := file.ReadFileAsString() if err != nil { return err } diff --git a/pkg/aa/mount.go b/pkg/aa/mount.go index ad83801c6..a9d8dbeaf 100644 --- a/pkg/aa/mount.go +++ b/pkg/aa/mount.go @@ -16,6 +16,15 @@ const ( func init() { requirements[MOUNT] = requirement{ + "flags_bind": { + "B", "bind", "R", "rbind", + }, + "flags_change": { + "remount", "unbindable", "shared", "private", "slave", "runbindable", + "rshared", "rprivate", "rslave", "make-unbindable", "make-shared", + "make-private", "make-slave", "make-runbindable", "make-rshared", + "make-rprivate", "make-rslave", + }, "flags": { "ro", "rw", "acl", "async", "atime", "bind", "dev", "diratime", "dirsync", "exec", "iversion", "loud", "mand", "move", "noacl", diff --git a/pkg/aa/template.go b/pkg/aa/template.go index 92c10b46e..cb00d2f36 100644 --- a/pkg/aa/template.go +++ b/pkg/aa/template.go @@ -35,17 +35,10 @@ var ( // The apparmor templates tmpl = generateTemplates([]Kind{ // Global templates - "apparmor", - PROFILE, - HAT, - "rules", + "apparmor", PROFILE, HAT, "rules", // Preamble templates - ABI, - ALIAS, - INCLUDE, - VARIABLE, - COMMENT, + ABI, ALIAS, INCLUDE, VARIABLE, COMMENT, // Rules templates ALL, RLIMIT, USERNS, CAPABILITY, NETWORK, From 70d472018916c27329a7dfcd0203ada207713444 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Oct 2024 20:55:14 +0100 Subject: [PATCH 0339/1455] fix(build): do not install the aa helper tool --- Makefile | 1 - 1 file changed, 1 deletion(-) diff --git a/Makefile b/Makefile index 6d576f8b2..3aea44a78 100644 --- a/Makefile +++ b/Makefile @@ -28,7 +28,6 @@ SHARE = $(shell find "${BUILD}/share" -type f -not -name "*.md" -printf "%P\n") PROFILES = $(shell find "${BUILD}/apparmor.d" -type f -printf "%P\n") DISABLES = $(shell find "${BUILD}/apparmor.d" -type l -printf "%P\n") install: - @install -Dm0755 ${BUILD}/aa ${DESTDIR}/usr/bin/aa @install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log @for file in ${SHARE}; do \ install -Dm0644 "${BUILD}/share/$${file}" "${DESTDIR}/usr/share/$${file}"; \ From ffeb68af3b0b38793e687e75b8102caedce03ebf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Oct 2024 20:58:08 +0100 Subject: [PATCH 0340/1455] build: update ignore files with new ignore paths. --- dists/ignore/debian.ignore | 2 +- dists/ignore/opensuse.ignore | 2 +- dists/ignore/ubuntu.ignore | 3 +-- dists/ignore/whonix.ignore | 2 +- 4 files changed, 4 insertions(+), 5 deletions(-) diff --git a/dists/ignore/debian.ignore b/dists/ignore/debian.ignore index 9843d249a..bfd8998ae 100644 --- a/dists/ignore/debian.ignore +++ b/dists/ignore/debian.ignore @@ -1,6 +1,6 @@ # Archlinux specific apparmor.d/groups/pacman -root/usr/share/libalpm +share/libalpm # Ubuntu specific definition apparmor.d/groups/ubuntu diff --git a/dists/ignore/opensuse.ignore b/dists/ignore/opensuse.ignore index 0d393c6c1..7f79b77ef 100644 --- a/dists/ignore/opensuse.ignore +++ b/dists/ignore/opensuse.ignore @@ -1,6 +1,6 @@ # Archlinux specific apparmor.d/groups/pacman -root/usr/share/libalpm +share/libalpm # Debian specific definition apparmor.d/groups/apt diff --git a/dists/ignore/ubuntu.ignore b/dists/ignore/ubuntu.ignore index 714fa3273..eb0df718f 100644 --- a/dists/ignore/ubuntu.ignore +++ b/dists/ignore/ubuntu.ignore @@ -1,7 +1,6 @@ # Archlinux specific apparmor.d/groups/pacman -root/etc/xdg/autostart/apparmor-notify.desktop -root/usr/share/libalpm +share/libalpm # OpenSUSE specific definition apparmor.d/groups/suse diff --git a/dists/ignore/whonix.ignore b/dists/ignore/whonix.ignore index 5370a0f95..959f8ce6e 100644 --- a/dists/ignore/whonix.ignore +++ b/dists/ignore/whonix.ignore @@ -1,6 +1,6 @@ # Archlinux specific definition apparmor.d/groups/pacman -root/usr/share/libalpm +share/libalpm # OpenSUSE specific definition apparmor.d/groups/suse From 0525e51cde5769535817d66bb2fa890a1434a926 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Sun, 13 Oct 2024 14:19:52 +0300 Subject: [PATCH 0341/1455] xdg-mime xdg-open xdg-settings xprop --- apparmor.d/groups/freedesktop/xdg-mime | 9 +++++++++ apparmor.d/groups/freedesktop/xdg-open | 8 +++++++- apparmor.d/groups/freedesktop/xdg-settings | 5 +++++ apparmor.d/groups/freedesktop/xprop | 1 + 4 files changed, 22 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index e2486f9fd..650d1f554 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xdg-mime profile xdg-mime @{exec_path} flags=(attach_disconnected) { include + include include @{exec_path} r, @@ -50,14 +51,22 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{bin}/vendor_perl/mimetype Px, @{bin}/xprop Px, + owner @{user_config_dirs}/mimeapps.list{,.new} rw, + owner @{tmp}/wl-copy-buffer-@{rand6}/stdin r, + @{PROC}/version r, + /dev/tty rw, profile bus flags=(complain) { include include include + include + + @{bin}/dbus-send mr, + include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index 8e90bc423..b0b44e388 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -20,6 +20,7 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) { @{bin}/basename ix, @{bin}/cat ix, @{bin}/cut ix, + @{bin}/env ix, @{bin}/readlink ix, @{bin}/realpath ix, @{bin}/sed ix, @@ -35,10 +36,15 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) { @{bin}/xdg-mime Px, @{open_path} Px -> child-open-any, - profile bus { + @{PROC}/version r, + + profile bus flags=(attach_disconnected) { include include include + include + + @{bin}/dbus-send mr, include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index f64b879f6..2525e1462 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -28,6 +28,7 @@ profile xdg-settings @{exec_path} { @{bin}/realpath rix, @{bin}/rm ix, @{bin}/sed ix, + @{bin}/sleep ix, @{bin}/sort ix, @{bin}/touch ix, @{bin}/tr ix, @@ -46,6 +47,7 @@ profile xdg-settings @{exec_path} { @{bin}/xprop Px, owner @{user_config_dirs}/xfce4/helpers.rc{,.@{rand6}} rw, + owner @{user_share_dirs}/applications/{,**} rw, @{PROC}/version r, @@ -55,6 +57,9 @@ profile xdg-settings @{exec_path} { include include include + include + + @{bin}/dbus-send mr, include if exists } diff --git a/apparmor.d/groups/freedesktop/xprop b/apparmor.d/groups/freedesktop/xprop index 99959fc73..f83afae61 100644 --- a/apparmor.d/groups/freedesktop/xprop +++ b/apparmor.d/groups/freedesktop/xprop @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xprop profile xprop @{exec_path} flags=(attach_disconnected) { include + include include include From 22e5367db4e434432091ca61a51947020be3992f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 13 Oct 2024 23:24:50 +0100 Subject: [PATCH 0342/1455] fix(profile): torbrowser allow download. fix #539 --- apparmor.d/groups/browsers/torbrowser | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/groups/browsers/torbrowser b/apparmor.d/groups/browsers/torbrowser index 8d8336d6d..5068886c3 100644 --- a/apparmor.d/groups/browsers/torbrowser +++ b/apparmor.d/groups/browsers/torbrowser @@ -42,6 +42,9 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) { owner "@{tmp}/Tor Project*" rwk, owner "@{tmp}/Tor Project*/" rw, owner "@{tmp}/Tor Project*/**" rwk, + owner @{tmp}/@{rand8}.* rw, + owner @{tmp}/mozilla_pc@{int}/ rw, + owner @{tmp}/mozilla_pc@{int}/* rwk, # Due to the nature of the browser, we silence much more than for Firefox. deny capability sys_ptrace, From 5b7b921fc90f4f68d1fe4751788fe685cb0b7360 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 13 Oct 2024 23:26:54 +0100 Subject: [PATCH 0343/1455] fix(profile): *-glxtest needs wayland. fix #549 --- apparmor.d/groups/browsers/firefox-glxtest | 1 + apparmor.d/groups/browsers/torbrowser-glxtest | 1 + apparmor.d/profiles-s-z/thunderbird-glxtest | 1 + 3 files changed, 3 insertions(+) diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest index ad4fbb1ff..97e5645b9 100644 --- a/apparmor.d/groups/browsers/firefox-glxtest +++ b/apparmor.d/groups/browsers/firefox-glxtest @@ -17,6 +17,7 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) { include include include + include @{exec_path} mr, diff --git a/apparmor.d/groups/browsers/torbrowser-glxtest b/apparmor.d/groups/browsers/torbrowser-glxtest index ab5eee07f..4939edfbf 100644 --- a/apparmor.d/groups/browsers/torbrowser-glxtest +++ b/apparmor.d/groups/browsers/torbrowser-glxtest @@ -18,6 +18,7 @@ profile torbrowser-glxtest @{exec_path} flags=(attach_disconnected) { include include include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/thunderbird-glxtest b/apparmor.d/profiles-s-z/thunderbird-glxtest index a742a41fb..626896a09 100644 --- a/apparmor.d/profiles-s-z/thunderbird-glxtest +++ b/apparmor.d/profiles-s-z/thunderbird-glxtest @@ -16,6 +16,7 @@ profile thunderbird-glxtest @{exec_path} { include include include + include @{exec_path} mr, From 3586e202baeb4e21fdee77acea63781837c494ca Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Sun, 13 Oct 2024 18:55:40 +0800 Subject: [PATCH 0344/1455] A fix for fwupdmgr --- apparmor.d/profiles-a-f/fwupdmgr | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 1ec9fe657..4d53fdf57 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -50,6 +50,7 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected) { /dev/i2c-@{int} rw, /dev/tty rw, + /dev/pts/@{int} rw, profile bus flags=(attach_disconnected) { include From 247e84c9a96f561cf3767c81763e3be45b03b0df Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Sun, 13 Oct 2024 13:56:40 +0300 Subject: [PATCH 0345/1455] Vim; writing configuration files --- apparmor.d/groups/pacman/pacdiff | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/pacman/pacdiff b/apparmor.d/groups/pacman/pacdiff index e2a0f2609..64a813bf4 100644 --- a/apparmor.d/groups/pacman/pacdiff +++ b/apparmor.d/groups/pacman/pacdiff @@ -32,10 +32,14 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) { @{bin}/tput rix, @{bin}/vim rix, + owner @{HOME}/.viminfo{,.tmp} rw, + + owner @{user_cache_dirs}/vim/{,**} rw, + # packages files / r, /boot/{,**} r, - /etc/{,**} r, + /etc/{,**} rw, /opt/{,**} r, /srv/{,**} r, /usr/{,**} r, From 0dbc42e357ce447e6eb8585ee2699adecf37fb1b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 14 Oct 2024 15:56:37 +0100 Subject: [PATCH 0346/1455] fix(profile): ensure abi3 compatibility with re-attached path. See #559, #558 #557 #555 --- apparmor.d/tunables/multiarch.d/system | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index be37123fd..defc53af4 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -154,5 +154,6 @@ # Attachment path for attach_disconnected.path flag. # Automatically generated and set in profile preamble on ABI4. Disabled on ABI3. @{att}=/ +alias // -> /, # vim:syntax=apparmor From 04e39a47899d3d23adec5630b70f8793c9d824b6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 14 Oct 2024 16:09:19 +0100 Subject: [PATCH 0347/1455] feat(abs): update attached abstraction. --- apparmor.d/abstractions/attached/base | 2 +- apparmor.d/abstractions/attached/consoles | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index 65c163317..33c422bb0 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -7,7 +7,7 @@ abi , - @{att}/apparmor/.null rw, + deny @{att}/apparmor/.null rw, include if exists diff --git a/apparmor.d/abstractions/attached/consoles b/apparmor.d/abstractions/attached/consoles index 6959bc407..bf76e4a43 100644 --- a/apparmor.d/abstractions/attached/consoles +++ b/apparmor.d/abstractions/attached/consoles @@ -5,8 +5,8 @@ abi , + @{att}/dev/tty@{int} rw, owner @{att}/dev/pts/@{int} rw, - owner @{att}/dev/tty@{int} rw, include if exists From 48751f75b2ba10697053832cc41069f827307d84 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 14 Oct 2024 19:20:02 +0100 Subject: [PATCH 0348/1455] feat(profile): update kde profiles. --- apparmor.d/abstractions/kde-strict | 2 +- apparmor.d/groups/kde/baloo | 3 +++ apparmor.d/groups/kde/gmenudbusmenuproxy | 1 + apparmor.d/groups/kde/kconf_update | 3 +++ apparmor.d/groups/kde/kded | 27 ++++++------------------ apparmor.d/groups/kde/kwin_wayland | 22 ++++++++++++++++++- apparmor.d/groups/kde/plasmashell | 1 + apparmor.d/groups/kde/sddm-greeter | 2 +- apparmor.d/groups/kde/startplasma | 1 + apparmor.d/groups/kde/xembedsniproxy | 1 + 10 files changed, 39 insertions(+), 24 deletions(-) diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 490cf48a1..d85e58422 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -27,7 +27,7 @@ owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_??_* rwlk, + owner @{user_cache_dirs}/ksycoca{5,6}_??[_-]*.@{rand6} rwlk, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/dolphinrc r, diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index aa67ba5f5..5a4f480a1 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -34,6 +34,8 @@ profile baloo @{exec_path} { owner @{MOUNTS}/{,**} r, owner @{tmp}/*/{,**} r, + owner @{user_cache_dirs}/kcrash-metadata/ w, + owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/baloofilerc rwl, owner @{user_config_dirs}/baloofilerc.lock rwkl, @@ -60,6 +62,7 @@ profile baloo @{exec_path} { @{run}/udev/data/c29:@{int} r, # For /dev/fb[0-9]* @{run}/udev/data/c89:@{int} r, # For I2C bus interface @{run}/udev/data/c116:@{int} r, # For ALSA + @{run}/udev/data/c202:@{int} r, # CPU model-specific registers @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/groups/kde/gmenudbusmenuproxy b/apparmor.d/groups/kde/gmenudbusmenuproxy index 1d85b3a6b..d9879941b 100644 --- a/apparmor.d/groups/kde/gmenudbusmenuproxy +++ b/apparmor.d/groups/kde/gmenudbusmenuproxy @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/gmenudbusmenuproxy profile gmenudbusmenuproxy @{exec_path} { include + include include include include diff --git a/apparmor.d/groups/kde/kconf_update b/apparmor.d/groups/kde/kconf_update index d699f9d59..e152325ed 100644 --- a/apparmor.d/groups/kde/kconf_update +++ b/apparmor.d/groups/kde/kconf_update @@ -44,12 +44,15 @@ profile kconf_update @{exec_path} { /etc/machine-id r, /var/lib/dbus/machine-id r, + owner @{HOME}/.gtkrc-@{version} w, + owner @{user_config_dirs}/*rc rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/*rc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/*rc.lock rwk, owner @{user_config_dirs}/gtk-{3,4}.0/* rwlk -> @{user_config_dirs}/gtk-{3,4}.0/**, owner @{user_config_dirs}/sed@{rand6} rw, owner @{user_config_dirs}/xsettingsd/xsettingsd.conf rw, + owner @{user_config_dirs}/kcmfonts.lock rwk, owner @{user_share_dirs}/#@{int} rw, owner @{user_share_dirs}/krunnerstaterc.lock rwk, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index c14ba7e98..0ff08d02f 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -93,34 +93,16 @@ profile kded @{exec_path} { @{user_config_dirs}/kcookiejarrc.lock rwk, @{user_config_dirs}/kcookiejarrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/bluedevilglobalrc.lock rwk, - owner @{user_config_dirs}/bluedevilglobalrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/breezerc r, + owner @{user_config_dirs}/*rc rwl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/*rc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, + owner @{user_config_dirs}/*rc.lock rwk, owner @{user_config_dirs}/gtk-{3,4}.0/{,**} rwl, owner @{user_config_dirs}/gtk-{3,4}.0/settings.ini.lock rk, - owner @{user_config_dirs}/gtkrc{,*} rwlk, - owner @{user_config_dirs}/kconf_updaterc rw, - owner @{user_config_dirs}/kconf_updaterc.lock rwk, - owner @{user_config_dirs}/kdebugrc r, - owner @{user_config_dirs}/kded{5,6}rc.lock rwk, - owner @{user_config_dirs}/kded{5,6}rc{,.@{rand6}} rwl, owner @{user_config_dirs}/kdedefaults/{,**} r, - owner @{user_config_dirs}/khotkeysrc.lock rwk, - owner @{user_config_dirs}/khotkeysrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kioslaverc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/ksmserverrc r, - owner @{user_config_dirs}/ktimezonedrc.lock rwk, - owner @{user_config_dirs}/ktimezonedrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kwalletrc r, - owner @{user_config_dirs}/kwinrc.lock rwk, - owner @{user_config_dirs}/kwinrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - owner @{user_config_dirs}/kxkbrc r, owner @{user_config_dirs}/libaccounts-glib/ rw, owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk, owner @{user_config_dirs}/menus/{,**} r, - owner @{user_config_dirs}/networkmanagement.notifyrc r, owner @{user_config_dirs}/plasma* r, - owner @{user_config_dirs}/touchpadrc r, owner @{user_config_dirs}/Trolltech.conf.lock rwk, owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl, owner @{user_config_dirs}/xsettingsd/{,**} rw, @@ -137,6 +119,9 @@ profile kded @{exec_path} { owner @{user_share_dirs}/services5/{,**} r, owner @{user_share_dirs}/user-places.xbel r, + owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/plasmashellstaterc{,*} rwlk, + @{run}/mount/utab r, @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** @{run}/user/@{uid}/gvfs/ r, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 9922eff98..c02f3f87a 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -29,6 +29,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { @{exec_path} mr, + /etc/xdg/Xwayland-session.d/00-at-spi Cx -> at-spi, #aa:exec kscreenlocker_greet /usr/share/color-schemes/*.colors r, @@ -47,6 +48,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { /etc/xdg/menus/{,applications.menu} r, /etc/xdg/menus/applications-merged/ r, /etc/xdg/plasmarc r, + /etc/xdg/Xwayland-session.d/{,*} r, /etc/machine-id r, /var/lib/dbus/machine-id r, @@ -127,10 +129,28 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/input/event@{int} rw, + @{att}/dev/input/event@{int} rw, + @{att}/dev/dri/card@{int} rw, + /dev/tty r, /dev/tty@{int} rw, + profile at-spi { + include + + @{sh_path} r, + @{bin}/busctl rix, + @{bin}/sed rix, + @{bin}/xprop rPx, + + /etc/xdg/Xwayland-session.d/00-at-spi r, + + /home/ r, + owner @{HOME}/ r, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index a7bde918e..0d8a5d8cb 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -76,6 +76,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { /usr/share/solid/actions/{,**} r, /usr/share/swcatalog/{,**} r, /usr/share/templates/{,*.desktop} r, + /usr/share/thumbnailers/{,*} r, /usr/share/wallpapers/{,**} r, /etc/appstream.conf r, diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index 54284f03a..f2c133cec 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -14,7 +14,7 @@ profile sddm-greeter @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index e78464253..f10e80d7f 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -62,6 +62,7 @@ profile startplasma @{exec_path} { owner @{user_config_dirs}/startkderc r, owner @{user_config_dirs}/Trolltech.conf.lock rwk, owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl, + owner link @{user_config_dirs}/kdeglobals -> @{user_config_dirs}/#@{int}, owner @{user_share_dirs}/color-schemes/{,**} r, owner @{user_share_dirs}/kservices{5,6}/{,**} r, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index dc6b215f2..969a82f6c 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -10,6 +10,7 @@ include profile xembedsniproxy @{exec_path} { include include + include include include From 185dc96d456769a4b69abb44f4c6703277c48384 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 14 Oct 2024 19:32:48 +0100 Subject: [PATCH 0349/1455] feat(profile): general update. --- apparmor.d/abstractions/audio-client | 1 + apparmor.d/abstractions/common/electron | 1 + apparmor.d/abstractions/desktop | 2 + apparmor.d/abstractions/disks-read | 2 +- apparmor.d/abstractions/disks-write | 2 +- apparmor.d/abstractions/graphics | 2 +- apparmor.d/abstractions/gstreamer | 2 + apparmor.d/groups/_full/default | 2 +- apparmor.d/groups/browsers/chrome | 2 +- apparmor.d/groups/browsers/chromium | 2 +- apparmor.d/groups/browsers/chromium-wrapper | 2 +- apparmor.d/groups/browsers/epiphany | 3 + .../groups/children/child-modprobe-nvidia | 1 + .../freedesktop/update-desktop-database | 1 + .../freedesktop/xdg-desktop-portal-gnome | 1 + .../groups/freedesktop/xdg-document-portal | 2 +- apparmor.d/groups/freedesktop/xdg-open | 2 + apparmor.d/groups/freedesktop/xkbcomp | 6 +- apparmor.d/groups/freedesktop/xorg | 1 + apparmor.d/groups/pacman/makepkg | 6 + apparmor.d/groups/pacman/pacman-hook-systemd | 3 +- apparmor.d/groups/pacman/yay | 4 + apparmor.d/groups/systemd/systemd-journald | 2 +- apparmor.d/groups/systemd/systemd-resolved | 2 +- apparmor.d/groups/virt/dockerd | 7 +- .../profiles-a-f/cc-remote-login-helper | 1 + apparmor.d/profiles-a-f/file-roller | 12 +- apparmor.d/profiles-a-f/flatpak | 2 + apparmor.d/profiles-g-l/haveged | 2 +- apparmor.d/profiles-g-l/hbbr | 3 +- apparmor.d/profiles-g-l/hbbs | 3 +- apparmor.d/profiles-g-l/issue-generator | 3 + apparmor.d/profiles-m-r/rustdesk | 131 +++++++++--------- apparmor.d/profiles-m-r/rustdesk-utils | 3 +- apparmor.d/profiles-s-z/sanoid | 15 +- apparmor.d/profiles-s-z/snapshot | 5 +- apparmor.d/profiles-s-z/spotify | 2 +- apparmor.d/profiles-s-z/sslocal | 3 +- apparmor.d/profiles-s-z/ssmanager | 3 +- apparmor.d/profiles-s-z/ssserver | 3 +- apparmor.d/profiles-s-z/ssservice | 3 +- apparmor.d/profiles-s-z/ssurl | 3 +- apparmor.d/profiles-s-z/steam | 3 + apparmor.d/profiles-s-z/steam-game-proton | 13 +- .../profiles-s-z/steam-runtime-steam-remote | 2 +- apparmor.d/profiles-s-z/thermald | 2 +- apparmor.d/profiles-s-z/thunderbird | 2 + apparmor.d/profiles-s-z/vesktop | 5 + 48 files changed, 165 insertions(+), 120 deletions(-) diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index 45028f488..d847c732c 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -47,6 +47,7 @@ owner @{user_config_dirs}/pipewire/client.conf r, owner @{user_share_dirs}/openal/hrtf/{,**} r, + owner @{user_share_dirs}/sounds/ r, owner @{user_share_dirs}/sounds/__custom/index.theme r, owner @{run}/user/@{uid}/pipewire-@{int} rw, diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 7bfae1ffa..171815256 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -28,6 +28,7 @@ capability sys_chroot, capability sys_ptrace, + @{bin}/electron rix, @{bin}/electron@{int} rix, @{lib}/electron@{int}/{,**} r, @{lib}/electron@{int}/electron rix, diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index a9a3665d2..19ffe647e 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -33,6 +33,8 @@ /var/cache/gio-@{version}/gnome-mimeapps.list r, + / r, # deny? + owner @{user_share_dirs}/gnome-shell/session.gvdb rw, # else if @{DE} == kde diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 10cf0c90b..bf46eea1a 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -90,7 +90,7 @@ @{run}/udev/data/b230:@{int} r, # for /dev/zvol* @{run}/udev/data/b24[0-9]:@{int} r, # for dynamic assignment range 240 to 254 @{run}/udev/data/b25[0-4]:@{int} r, - @{run}/udev/data/b259:@{int} r, + @{run}/udev/data/b259:@{int} r, # Block Extended Major @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index bd34a6f42..844a4fbeb 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -90,7 +90,7 @@ @{run}/udev/data/b230:@{int} r, # for /dev/zvol* @{run}/udev/data/b24[0-9]:@{int} r, # for dynamic assignment range 240 to 254 @{run}/udev/data/b25[0-4]:@{int} r, - @{run}/udev/data/b259:@{int} r, + @{run}/udev/data/b259:@{int} r, # Block Extended Major @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** diff --git a/apparmor.d/abstractions/graphics b/apparmor.d/abstractions/graphics index 101fe1b45..37f6be70e 100644 --- a/apparmor.d/abstractions/graphics +++ b/apparmor.d/abstractions/graphics @@ -9,7 +9,7 @@ include include - /etc/igfx_user_feature{,_next}.txt w, + /etc/igfx_user_feature{,_next,_report}.txt w, /etc/libva.conf r, @{sys}/bus/pci/devices/ r, diff --git a/apparmor.d/abstractions/gstreamer b/apparmor.d/abstractions/gstreamer index b9f1cbadd..c7827b599 100644 --- a/apparmor.d/abstractions/gstreamer +++ b/apparmor.d/abstractions/gstreamer @@ -14,6 +14,8 @@ @{lib}/@{multiarch}/gstreamer-1.0/gst-plugin-scanner rix, @{lib}/gstreamer-1.0/gst-plugin-scanner rix, + /usr/share/gstreamer-1.0/presets/Gst*Enc.prs r, + /etc/openni2/OpenNI.ini r, /tmp/ r, diff --git a/apparmor.d/groups/_full/default b/apparmor.d/groups/_full/default index d3fd26682..acdfc0bff 100644 --- a/apparmor.d/groups/_full/default +++ b/apparmor.d/groups/_full/default @@ -34,7 +34,7 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) { network netlink dgram, network netlink raw, - signal (receive) set=(hup), + signal receive set=hup, @{bin}/bwrap rPx -> bwrap, @{bin}/pipewire-pulse rPx -> systemd//&pipewire-pulse, diff --git a/apparmor.d/groups/browsers/chrome b/apparmor.d/groups/browsers/chrome index 5b4738408..9c11f0a4a 100644 --- a/apparmor.d/groups/browsers/chrome +++ b/apparmor.d/groups/browsers/chrome @@ -14,7 +14,7 @@ include @{cache_dirs} = @{user_cache_dirs}/google-@{name} @{exec_path} = @{lib_dirs}/@{name} -profile chrome @{exec_path} { +profile chrome @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/browsers/chromium b/apparmor.d/groups/browsers/chromium index 04fa2c756..658dee398 100644 --- a/apparmor.d/groups/browsers/chromium +++ b/apparmor.d/groups/browsers/chromium @@ -14,7 +14,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{lib_dirs}/@{name} -profile chromium @{exec_path} { +profile chromium @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/browsers/chromium-wrapper b/apparmor.d/groups/browsers/chromium-wrapper index 40a775dba..dea35ae1a 100644 --- a/apparmor.d/groups/browsers/chromium-wrapper +++ b/apparmor.d/groups/browsers/chromium-wrapper @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/chromium -profile chromium-wrapper @{exec_path} { +profile chromium-wrapper @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany index dd01a36a8..98f21f472 100644 --- a/apparmor.d/groups/browsers/epiphany +++ b/apparmor.d/groups/browsers/epiphany @@ -38,12 +38,15 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { @{bin}/xdg-dbus-proxy rix, @{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix, + /usr/share/enchant*/{,**} r, + owner /bindfile@{rand6} rw, owner @{att}/.flatpak-info r, owner @{user_config_dirs}/glib-2.0/ w, owner @{user_config_dirs}/glib-2.0/settings/ w, + owner @{tmp}/ContentRuleList@{rand6} rw, owner @{tmp}/epiphany-*-@{rand6}/{,**} rw, owner @{tmp}/Serialized@{rand9} rw, owner @{tmp}/WebKit-Media-@{rand6} rw, diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index 15b9c2d9d..315a5bf07 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -19,6 +19,7 @@ include @{exec_path} = @{bin}/nvidia-modprobe profile child-modprobe-nvidia flags=(attach_disconnected) { include + include include capability chown, diff --git a/apparmor.d/groups/freedesktop/update-desktop-database b/apparmor.d/groups/freedesktop/update-desktop-database index 19aa4079a..ebf0ad6a3 100644 --- a/apparmor.d/groups/freedesktop/update-desktop-database +++ b/apparmor.d/groups/freedesktop/update-desktop-database @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/update-desktop-database profile update-desktop-database @{exec_path} flags=(attach_disconnected) { include + include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 944bbc205..e9bdfde1f 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -48,6 +48,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { owner @{desktop_cache_dirs}/dconf/user r, owner @{desktop_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rw, + owner @{desktop_config_dirs}/dconf/user r, owner @{DESKTOP_HOME}/greeter-dconf-defaults r, owner @{HOME}/ r, diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index e9f63dc57..a5e27c7d1 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -57,7 +57,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, - /dev/fuse rw, + /dev/fuse rw, profile fusermount flags=(attach_disconnected) { include diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index 8e90bc423..3cf4066b5 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -35,6 +35,8 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) { @{bin}/xdg-mime Px, @{open_path} Px -> child-open-any, + @{PROC}/version r, + profile bus { include include diff --git a/apparmor.d/groups/freedesktop/xkbcomp b/apparmor.d/groups/freedesktop/xkbcomp index 9ebecf6f7..dde1fe8c1 100644 --- a/apparmor.d/groups/freedesktop/xkbcomp +++ b/apparmor.d/groups/freedesktop/xkbcomp @@ -11,6 +11,7 @@ include profile xkbcomp @{exec_path} flags=(attach_disconnected) { include include + include include include @@ -29,6 +30,7 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/xorg/Xorg.@{int}.log w, /var/lib/{gdm{3,},sddm}/.local/share/xorg/Xorg.@{int}.log w, + /var/log/Xorg.@{int}.log w, owner /var/log/lightdm/x-@{int}.log w, owner @{run}/user/@{uid}/server-@{int}.xkm rwk, @@ -38,9 +40,7 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) { /dev/dri/card@{int} rw, /dev/fb@{int} rw, /dev/tty rw, - - deny /dev/input/event@{int} rw, - deny /var/log/Xorg.@{int}.log w, + /dev/input/event@{int} rw, include if exists } diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index dce42dc85..0f23d583c 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -134,6 +134,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { /dev/shm/shmfd-* rw, /dev/tty rw, /dev/tty@{int} rw, + /dev/udmabuf rw, /dev/vga_arbiter rw, # Graphic card modules profile pkexec { diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 12ead7ce8..6f4672f99 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -10,6 +10,12 @@ include profile makepkg @{exec_path} { include include + include + include + include + include + include + include network inet stream, network inet6 stream, diff --git a/apparmor.d/groups/pacman/pacman-hook-systemd b/apparmor.d/groups/pacman/pacman-hook-systemd index 3a4bd0eb3..2c32024a2 100644 --- a/apparmor.d/groups/pacman/pacman-hook-systemd +++ b/apparmor.d/groups/pacman/pacman-hook-systemd @@ -15,13 +15,14 @@ profile pacman-hook-systemd @{exec_path} { @{exec_path} mr, - @{bin}/bash rix, + @{sh_path} rix, @{bin}/touch rix, @{bin}/journalctl rPx, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/systemd-hwdb rPx, + @{bin}/systemd-notify rPx, @{bin}/systemd-sysusers rPx, @{bin}/systemd-tmpfiles rPx, @{bin}/udevadm rPx, diff --git a/apparmor.d/groups/pacman/yay b/apparmor.d/groups/pacman/yay index c737d4caa..e101fc06f 100644 --- a/apparmor.d/groups/pacman/yay +++ b/apparmor.d/groups/pacman/yay @@ -55,6 +55,10 @@ profile yay @{exec_path} { /usr/share/git{,-core}/{,**} r, + owner @{user_build_dirs}/**/.git/** r, + owner @{user_pkg_dirs}/**/.git/** r, + owner @{user_projects_dirs}/**/.git/** r, + owner @{HOME}/.gitconfig r, owner @{user_cache_dirs}/yay/ rw, owner @{user_cache_dirs}/yay/** rwlk -> @{user_cache_dirs}/yay/**, diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index a50ed62e3..4f95bed40 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -61,7 +61,7 @@ profile systemd-journald @{exec_path} { @{run}/udev/data/+usb:* r, @{run}/udev/data/+virtio:* r, @{run}/udev/data/b254:@{int} r, # for /dev/zram* - @{run}/udev/data/b259:@{int} r, + @{run}/udev/data/b259:@{int} r, # Block Extended Major @{run}/udev/data/c1:@{int} r, # For RAM disk @{run}/udev/data/c4:@{int} r, # For TTY devices @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features diff --git a/apparmor.d/groups/systemd/systemd-resolved b/apparmor.d/groups/systemd/systemd-resolved index 9b6bfdd94..4f9f965f5 100644 --- a/apparmor.d/groups/systemd/systemd-resolved +++ b/apparmor.d/groups/systemd/systemd-resolved @@ -1,6 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-3.0-only +# SPDX-License-Identifier: GPL-2.0-only abi , diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index cfbd2d7b9..2ea35f7b9 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -45,15 +45,12 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { mount options=(rw rslave) -> /, remount /tmp/containerd-mount@{int10}/, - remount /var/lib/docker/tmp/buildkit-mount@{int10}/, + remount /var/lib/docker/**/, umount /.pivot_root@{int}/, umount /run/docker/netns/*, umount /tmp/containerd-mount@{int}/, - umount /var/lib/docker/buildkit/**/, - umount /var/lib/docker/rootfs/**/, - umount /var/lib/docker/overlay*/**/, - umount /var/lib/docker/tmp/buildkit-mount@{int}/, + umount /var/lib/docker/**/, pivot_root oldroot=/var/lib/docker/overlay*/**/.pivot_root@{int}/ /var/lib/docker/overlay2/**/, pivot_root oldroot=/var/lib/docker/rootfs/overlayfs/@{hex64}/.pivot_root@{int}/ /var/lib/docker/rootfs/overlayfs/@{hex64}/, diff --git a/apparmor.d/profiles-a-f/cc-remote-login-helper b/apparmor.d/profiles-a-f/cc-remote-login-helper index cefc60f6d..d8128da74 100644 --- a/apparmor.d/profiles-a-f/cc-remote-login-helper +++ b/apparmor.d/profiles-a-f/cc-remote-login-helper @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index 1ea3b8e73..0c5a18e83 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -11,10 +11,8 @@ profile file-roller @{exec_path} { include include include + include include - include - include - include #aa:dbus own bus=session name=org.gnome.ArchiveManager1 #aa:dbus own bus=session name=org.gnome.FileRoller @@ -23,6 +21,9 @@ profile file-roller @{exec_path} { @{open_path} rPx -> child-open-help, + @{bin}/mv rix, + @{bin}/rm rix, + # Archivers @{bin}/7z rix, @{bin}/7zz rix, @@ -38,6 +39,11 @@ profile file-roller @{exec_path} { @{bin}/zstd rix, @{lib}/p7zip/7z rix, + # Full access to user's data + @{MOUNTS}/** rw, + owner @{HOME}/** rw, + owner @{tmp}/** rw, + @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index b38a03537..96d78b800 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -62,6 +62,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain owner @{HOME}/.var/ w, owner @{HOME}/.var/app/{,**} rw, + owner @{user_documents_dirs}/ rw, + owner @{user_cache_dirs}/flatpak/{,**} rw, owner @{user_config_dirs}/pulse/client.conf r, owner @{user_config_dirs}/user-dirs.dirs r, diff --git a/apparmor.d/profiles-g-l/haveged b/apparmor.d/profiles-g-l/haveged index e61b4404b..910e9a2f0 100644 --- a/apparmor.d/profiles-g-l/haveged +++ b/apparmor.d/profiles-g-l/haveged @@ -3,7 +3,7 @@ # Copyright (C) 2011-2014 Jérémy Bobbio ; # Copyright (C) 2020 krathalan https://git.sr.ht/~krathalan/apparmor-profiles/ # Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-3.0-only +# SPDX-License-Identifier: GPL-2.0-only abi , diff --git a/apparmor.d/profiles-g-l/hbbr b/apparmor.d/profiles-g-l/hbbr index 5257195f8..09b71b77f 100644 --- a/apparmor.d/profiles-g-l/hbbr +++ b/apparmor.d/profiles-g-l/hbbr @@ -1,11 +1,12 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , include -@{exec_path} = /{,usr/}{,local/}bin/hbbr +@{exec_path} = @{bin}/hbbr profile hbbr @{exec_path} { include diff --git a/apparmor.d/profiles-g-l/hbbs b/apparmor.d/profiles-g-l/hbbs index fd8aa3e74..4e7532724 100644 --- a/apparmor.d/profiles-g-l/hbbs +++ b/apparmor.d/profiles-g-l/hbbs @@ -1,11 +1,12 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , include -@{exec_path} = /{,usr/}{,local/}bin/hbbs +@{exec_path} = @{bin}/hbbs profile hbbs @{exec_path} { include diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index d358f080b..6c6d61c44 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -16,14 +16,17 @@ profile issue-generator @{exec_path} { @{sh_path} r, @{bin}/basename rix, @{bin}/cat rix, + @{bin}/chmod rix, @{bin}/cmp rix, @{bin}/mktemp rix, + @{bin}/mv rix, @{bin}/rm rix, @{bin}/sort rix, /etc/issue.d/{,**} r, /etc/sysconfig/issue-generator r, + @{run}/agetty.reload w, @{run}/issue r, @{run}/issue.@{rand10} rw, @{run}/issue.d/{,**} r, diff --git a/apparmor.d/profiles-m-r/rustdesk b/apparmor.d/profiles-m-r/rustdesk index 7733730a6..004c29d64 100644 --- a/apparmor.d/profiles-m-r/rustdesk +++ b/apparmor.d/profiles-m-r/rustdesk @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -34,9 +35,9 @@ profile rustdesk @{exec_path} { @{bin}/curl rix, @{bin}/ls rix, - @{bin}/sudo rCx -> sudo, - @{bin}/python3.@{int} rPx -> rustdesk_python, - @{sh_path} rPx -> rustdesk_shell, + @{bin}/sudo rCx -> sudo, + @{bin}/python3.@{int} rCx -> python, + @{sh_path} rCx -> shell, /etc/gdm{,3}/custom.conf r, @@ -59,80 +60,72 @@ profile rustdesk @{exec_path} { profile sudo { include - include include + include @{bin}/rustdesk rPx, - @{bin}/python3.@{int} rPx -> rustdesk_python, + @{bin}/python3.@{int} rPx -> rustdesk//python, include if exists } + profile python { + include + include + + capability dac_read_search, + capability dac_override, + + @{bin}/python3.@{int} r, + + @{sh_path} rix, + @{bin}/chmod rix, + @{bin}/uname rPx, + /usr/share/rustdesk/files/pynput_service.py rix, + + /usr/share/[rR]ust[dD]esk/files/{,**} r, + /tmp/[rR]ust[dD]esk/ w, + /tmp/[rR]ust[dD]esk/pynput_service rw, + + @{run}/user/@{uid}/gdm{,3}/Xauthority r, + + owner @{PROC}/@{pid}/fd/ r, + + # X-tiny + /tmp/.X11-unix/* rw, + owner @{HOME}/.xsession-errors w, + owner @{HOME}/.Xauthority r, + + include if exists + } + + profile shell { + include + + capability dac_override, + capability dac_read_search, + capability sys_ptrace, + + ptrace read, + + @{sh_path} r, + + @{bin}/tr rix, + @{bin}/{,e}grep rix, + @{bin}/tail rix, + @{bin}/xargs rix, + @{bin}/sed rix, + @{bin}/cat rix, + + @{bin}/ps rPx, + + @{PROC}/@{pid}/environ r, + owner @{PROC}/@{pid}/fd/ r, + + include if exists + } + include if exists } -profile rustdesk_pynput_service /usr/share/rustdesk/files/pynput_service.py { - include - - @{exec_path} r, - - include if exists -} - -profile rustdesk_python { - include - include - - capability dac_read_search, - capability dac_override, - - @{bin}/python3.@{int} r, - - @{sh_path} rix, - @{bin}/chmod rix, - @{bin}/uname rPx, - /usr/share/rustdesk/files/pynput_service.py rPx, - - /usr/share/[rR]ust[dD]esk/files/{,**} r, - /tmp/[rR]ust[dD]esk/ w, - /tmp/[rR]ust[dD]esk/pynput_service rw, - - @{run}/user/@{uid}/gdm{,3}/Xauthority r, - - owner @{PROC}/@{pid}/fd/ r, - - # X-tiny - /tmp/.X11-unix/* rw, - owner @{HOME}/.xsession-errors w, - owner @{HOME}/.Xauthority r, - - include if exists -} - -profile rustdesk_shell { - include - - capability sys_ptrace, - capability dac_read_search, - deny capability dac_override, - - ptrace (read), - - @{sh_path} r, - - @{bin}/tr rix, - @{bin}/{,e}grep rix, - @{bin}/tail rix, - @{bin}/xargs rix, - @{bin}/sed rix, - @{bin}/cat rix, - - @{bin}/ps rPx, - - owner @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/environ r, - - include if exists -} - # vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/rustdesk-utils b/apparmor.d/profiles-m-r/rustdesk-utils index d52e2b709..fc0c7d9bd 100644 --- a/apparmor.d/profiles-m-r/rustdesk-utils +++ b/apparmor.d/profiles-m-r/rustdesk-utils @@ -1,11 +1,12 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , include -@{exec_path} = /{,usr/}{,local/}bin/rustdesk-utils +@{exec_path} = @{bin}/rustdesk-utils profile rustdesk-utils @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/sanoid b/apparmor.d/profiles-s-z/sanoid index e9a8f8818..04ee747bf 100644 --- a/apparmor.d/profiles-s-z/sanoid +++ b/apparmor.d/profiles-s-z/sanoid @@ -6,26 +6,25 @@ abi , include -@{exec_path} = /{usr/,}{local/,}{s,}bin/sanoid +@{exec_path} = @{bin}/sanoid profile sanoid @{exec_path} flags=(complain) { include include - @{exec_path} mr, + @{exec_path} mr, @{sh_path} rix, @{bin}/perl rix, @{bin}/ps rPx, - /{usr/,}{local/,}{s,}bin/zfs rPx, + @{bin}/zfs rPx, - /etc/sanoid/{*,} r, + /usr/share/sanoid/{,**} r, - /var/cache/sanoid/snapshots.txt rw, + /etc/sanoid/{,*} r, - /usr/share/sanoid/{**,} r, + /var/cache/sanoid/{,**} rw, @{run}/sanoid/ rw, - @{run}/sanoid/sanoid_cacheupdate.lock rwk, - @{run}/sanoid/sanoid_pruning.lock rwk, + @{run}/sanoid/** rwk, include if exists } diff --git a/apparmor.d/profiles-s-z/snapshot b/apparmor.d/profiles-s-z/snapshot index 9c5d5b9d6..91ca7cd69 100644 --- a/apparmor.d/profiles-s-z/snapshot +++ b/apparmor.d/profiles-s-z/snapshot @@ -8,12 +8,13 @@ abi , include @{exec_path} = @{bin}/snapshot -profile snapshot @{exec_path} { +profile snapshot @{exec_path} flags=(attach_disconnected) { include include include include include + include @{exec_path} mr, @@ -22,6 +23,8 @@ profile snapshot @{exec_path} { owner @{user_pictures_dirs}/Camera/{,**} rw, owner @{user_videos_dirs}/Camera/{,**} rw, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + include if exists } diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 4bc0cb4be..8ccbbf0f1 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -13,7 +13,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name} -profile spotify @{exec_path} { +profile spotify @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/profiles-s-z/sslocal b/apparmor.d/profiles-s-z/sslocal index 0c46e5581..b71c97f55 100644 --- a/apparmor.d/profiles-s-z/sslocal +++ b/apparmor.d/profiles-s-z/sslocal @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # shadowsocks-rust only: @@ -8,7 +9,7 @@ abi , include -@{exec_path} = /{,usr/}{,local/}bin/sslocal +@{exec_path} = @{bin}/sslocal profile sslocal @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/ssmanager b/apparmor.d/profiles-s-z/ssmanager index 7e6fb0906..6165d433b 100644 --- a/apparmor.d/profiles-s-z/ssmanager +++ b/apparmor.d/profiles-s-z/ssmanager @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # shadowsocks-rust only: @@ -8,7 +9,7 @@ abi , include -@{exec_path} = /{,usr/}{,local/}bin/ssmanager +@{exec_path} = @{bin}/ssmanager profile ssmanager @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/ssserver b/apparmor.d/profiles-s-z/ssserver index c71fc1ea7..11ca72434 100644 --- a/apparmor.d/profiles-s-z/ssserver +++ b/apparmor.d/profiles-s-z/ssserver @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # shadowsocks-rust only: @@ -8,7 +9,7 @@ abi , include -@{exec_path} = /{,usr/}{,local/}bin/ssserver +@{exec_path} = @{bin}/ssserver profile ssserver @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/ssservice b/apparmor.d/profiles-s-z/ssservice index 5157bba63..4e4642895 100644 --- a/apparmor.d/profiles-s-z/ssservice +++ b/apparmor.d/profiles-s-z/ssservice @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # shadowsocks-rust only: @@ -8,7 +9,7 @@ abi , include -@{exec_path} = /{,usr/}{,local/}bin/ssservice +@{exec_path} = @{bin}/ssservice profile ssservice @{exec_path} { include diff --git a/apparmor.d/profiles-s-z/ssurl b/apparmor.d/profiles-s-z/ssurl index a066a9df6..9555a9825 100644 --- a/apparmor.d/profiles-s-z/ssurl +++ b/apparmor.d/profiles-s-z/ssurl @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # shadowsocks-rust only: @@ -8,7 +9,7 @@ abi , include -@{exec_path} = /{,usr/}{,local/}bin/ssurl +@{exec_path} = @{bin}/ssurl profile ssurl @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index e864663bb..252c89869 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -107,6 +107,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-system-info rix, @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-urlopen rix, @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, + @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-logger rix, @{runtime_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix, @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rcx -> web, @@ -182,6 +183,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/srt-fifo.@{rand6}/{,*} rw, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @@ -366,6 +368,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include + capability dac_override, capability dac_read_search, unix receive type=stream, diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton index bad85a84b..dfa8b84da 100644 --- a/apparmor.d/profiles-s-z/steam-game-proton +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -13,7 +13,7 @@ include @{app_dirs} = @{share_dirs}/steamapps/common/ @{exec_path} = @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap -profile steam-game-proton @{exec_path} flags=(attach_disconnected) { +profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) { include include include @@ -34,6 +34,8 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/bwrap mrix, + @{bin}/chmod rix, + @{bin}/fc-match rix, @{bin}/getopt rix, @{bin}/gzip rix, @{bin}/ldconfig rix, @@ -44,7 +46,6 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected) { @{bin}/steam-runtime-system-info rix, @{bin}/steam-runtime-urlopen rix, @{bin}/true rix, - @{bin}/chmod rix, @{open_path} rix, @{lib_dirs}/** mr, @@ -52,12 +53,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected) { @{lib}/pressure-vessel/from-host/@{lib}/** rix, @{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, - @{app_dirs}/** mr, - @{app_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix, - @{app_dirs}/Proton*/files/@{bin}/* rix, - @{app_dirs}/Proton*/files/@{lib}/** rix, - @{app_dirs}/Proton*/proton rix, - @{app_dirs}/@{runtime}/pressure-vessel/@{bin}/steam-runtime-launcher-interface-@{int} rix, + @{app_dirs}/** mrix, @{run}/host/@{bin}/ldconfig rix, @{run}/host/@{bin}/localedef rix, @@ -73,6 +69,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected) { owner /var/pressure-vessel/** rw, owner /var/cache/ldconfig/aux-cache* rw, + owner "@{app_dirs}/Steamworks Shared/runasadmin.vdf" rw, owner @{app_dirs}/@{runtime}/var/tmp-@{rand6}/usr/.ref rwk, owner @{app_dirs}/Proton*/** rwkl, diff --git a/apparmor.d/profiles-s-z/steam-runtime-steam-remote b/apparmor.d/profiles-s-z/steam-runtime-steam-remote index b3a36eac4..93a93e892 100644 --- a/apparmor.d/profiles-s-z/steam-runtime-steam-remote +++ b/apparmor.d/profiles-s-z/steam-runtime-steam-remote @@ -13,7 +13,7 @@ include @{app_dirs} = @{share_dirs}/steamapps/common/ @{exec_path} = @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote -profile steam-runtime-steam-remote @{exec_path} flags=(complain) { +profile steam-runtime-steam-remote @{exec_path} flags=(attach_disconnected,complain) { include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/thermald b/apparmor.d/profiles-s-z/thermald index 6bff0f1d8..fe30e6da8 100644 --- a/apparmor.d/profiles-s-z/thermald +++ b/apparmor.d/profiles-s-z/thermald @@ -16,7 +16,7 @@ profile thermald @{exec_path} flags=(attach_disconnected) { include capability sys_boot, - + #aa:dbus own bus=system name=org.freedesktop.thermald @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index e5404615c..1ee9f0941 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -56,6 +56,8 @@ profile thunderbird @{exec_path} { owner @{tmp}/nsma rw, owner @{tmp}/pid-@{pid}/{,**} w, + /dev/urandom w, + # Silencer deny capability sys_ptrace, deny @{lib_dirs}/** w, diff --git a/apparmor.d/profiles-s-z/vesktop b/apparmor.d/profiles-s-z/vesktop index bcbb30883..a3c3f5a03 100644 --- a/apparmor.d/profiles-s-z/vesktop +++ b/apparmor.d/profiles-s-z/vesktop @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 odomingao +# Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -15,6 +16,7 @@ profile vesktop @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -27,6 +29,9 @@ profile vesktop @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{bin}/speech-dispatcher rPx, + @{open_path} rPx -> child-open, + owner /tmp/.org.chromium.Chromium.@{rand6} mr, owner @{run}/user/@{uid}/discord-ipc-@{int} rw, From ebdcb94d7eb012eb9d9bfcd0e7999f77c792c066 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 14 Oct 2024 19:35:37 +0100 Subject: [PATCH 0350/1455] feat(profile): update gnome profiles. --- apparmor.d/groups/gnome/gdm-session-worker | 2 ++ apparmor.d/groups/gnome/gio-launch-desktop | 2 ++ apparmor.d/groups/gnome/gnome-control-center | 2 +- apparmor.d/groups/gnome/gnome-session-binary | 7 ++----- apparmor.d/groups/gnome/gnome-software | 4 ++-- apparmor.d/groups/gnome/gnome-tweaks | 14 ++++++++------ apparmor.d/groups/gnome/kgx | 1 + apparmor.d/groups/gnome/mutter-x11-frames | 1 + apparmor.d/groups/gnome/tracker-miner | 1 - apparmor.d/groups/gnome/yelp | 10 ++++++---- 10 files changed, 25 insertions(+), 19 deletions(-) diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 731d15768..4ca2b21b6 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -105,6 +105,8 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.pam_environment r, + owner @{user_cache_dirs}/ w, + @{run}/cockpit/inactive.motd r, owner @{run}/systemd/seats/seat@{int} r, owner @{run}/user/@{uid}/keyring/control rw, diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 12473b491..5e013012e 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -33,6 +33,8 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { owner @{HOME}/{,**} rw, + owner @{user_share_dirs}/gvfs-metadata/{,*} r, + owner @{tmp}/wl-copy-buffer-@{rand6}/stdin r, @{run}/mount/utab r, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 310b7a981..20aa66cfb 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -181,7 +181,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, - profile bwrap { + profile bwrap flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 995dbab6a..42c1265ae 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -48,11 +48,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/tput rix, @{bin}/session-migration rPx, - - @{lib}/gnome-session-check-accelerated rix, - @{lib}/gnome-session-check-accelerated-gl-helper rix, - @{lib}/gnome-session-check-accelerated-gles-helper rix, - @{lib}/gnome-session-failed rix, + @{lib}/gnome-session-check-* rPx, + @{lib}/gnome-session-failed rix, @{lib}/gio-launch-desktop rCx -> open, @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index cddcb730b..5ebedca69 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -64,8 +64,7 @@ profile gnome-software @{exec_path} { /var/lib/PackageKit/offline-update-competed r, /var/lib/PackageKit/prepared-update r, - /var/lib/swcatalog/icons/**.png r, - /var/lib/swcatalog/yaml/ r, + /var/lib/swcatalog/** r, /var/tmp/flatpak-cache-*/ rw, /var/tmp/flatpak-cache-*/** rwkl, @@ -91,6 +90,7 @@ profile gnome-software @{exec_path} { owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/deploy r, owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/metadata r, owner @{user_share_dirs}/flatpak/{app,runtime}/*/*/ r, + owner @{user_share_dirs}/flatpak/overrides/* r, owner @{user_share_dirs}/flatpak/repo/ rw, owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**, owner @{user_share_dirs}/gnome-software/{,**} rw, diff --git a/apparmor.d/groups/gnome/gnome-tweaks b/apparmor.d/groups/gnome/gnome-tweaks index d21e23824..d104e75c6 100644 --- a/apparmor.d/groups/gnome/gnome-tweaks +++ b/apparmor.d/groups/gnome/gnome-tweaks @@ -7,12 +7,10 @@ abi , include @{exec_path} = @{bin}/gnome-tweaks -profile gnome-tweaks @{exec_path} { +profile gnome-tweaks @{exec_path} flags=(attach_disconnected) { include include - include - include - include + include include include @@ -21,6 +19,7 @@ profile gnome-tweaks @{exec_path} { @{exec_path} mr, @{bin}/ r, + @{bin}/env r, @{bin}/ps rPx, @{bin}/python3.@{int} rix, @@ -28,8 +27,6 @@ profile gnome-tweaks @{exec_path} { @{lib}/python3.@{int}/site-packages/gtweak/{,*/,**/}__pycache__/*pyc* w, - /usr/share/gnome-tweaks/{,**} r, - /etc/xdg/autostart/{,**} r, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, @@ -44,7 +41,12 @@ profile gnome-tweaks @{exec_path} { @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/c13:@{int} r, # for /dev/input/* + @{sys}/bus/ r, + @{sys}/class/input/ r, + @{sys}/devices/**/uevent r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mounts r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, diff --git a/apparmor.d/groups/gnome/kgx b/apparmor.d/groups/gnome/kgx index 66a278036..c9177de5c 100644 --- a/apparmor.d/groups/gnome/kgx +++ b/apparmor.d/groups/gnome/kgx @@ -41,6 +41,7 @@ profile kgx @{exec_path} { @{PROC}/@{pids}/stat r, @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/ptmx rw, diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index 4fe3bc066..8a48b97a2 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -15,6 +15,7 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index e58f9b982..e10d81bb2 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -21,7 +21,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { include include include - include network netlink raw, diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index d9b709f99..aa459250b 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -28,11 +28,13 @@ profile yelp @{exec_path} { /etc/xml/{,**} r, - @{sys}/devices/virtual/dmi/id/chassis_type r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-yelp-*.scope/memory.* r, - + @{sys}/devices/virtual/dmi/id/chassis_type r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-yelp-*.scope/memory.* r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*.slice/*/memory.* r, - + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.current r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.high r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.max r, + @{PROC}/zoneinfo r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, From e73176e0c76b96182784dca494dcc363647fc548 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 14 Oct 2024 19:56:00 +0100 Subject: [PATCH 0351/1455] fix(profile): globbing fail. --- apparmor.d/abstractions/kde-strict | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index d85e58422..282ae1974 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -27,7 +27,7 @@ owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_??[_-]*.@{rand6} rwlk, + owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*.@{rand6} rwlk, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/dolphinrc r, From 6c211f4d2769b1c773c7cdbc1d650013dc6f9e36 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Mon, 14 Oct 2024 22:20:07 +0300 Subject: [PATCH 0352/1455] Moved dbus-send to the abstraction --- apparmor.d/abstractions/app/bus | 2 +- apparmor.d/groups/freedesktop/xdg-mime | 2 -- apparmor.d/groups/freedesktop/xdg-open | 2 -- apparmor.d/groups/freedesktop/xdg-settings | 2 -- 4 files changed, 1 insertion(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/app/bus b/apparmor.d/abstractions/app/bus index d1bd606a6..2ead91cc1 100644 --- a/apparmor.d/abstractions/app/bus +++ b/apparmor.d/abstractions/app/bus @@ -9,7 +9,7 @@ include @{bin}/dbus-launch mix, - @{bin}/dbus-send mix, + @{bin}/dbus-send mrix, @{bin}/dbus-daemon Px -> dbus-session, diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index 650d1f554..15b73a2d1 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -65,8 +65,6 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { include include - @{bin}/dbus-send mr, - include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index b0b44e388..559c69304 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -44,8 +44,6 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) { include include - @{bin}/dbus-send mr, - include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index 2525e1462..20246f659 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -59,8 +59,6 @@ profile xdg-settings @{exec_path} { include include - @{bin}/dbus-send mr, - include if exists } From 1e48160292da4032c8633ccf06fa638c4a0501f0 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Mon, 14 Oct 2024 22:37:16 +0300 Subject: [PATCH 0353/1455] Added app-open to xdg-open --- apparmor.d/groups/freedesktop/xdg-open | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index 559c69304..946b9aa59 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xdg-open profile xdg-open @{exec_path} flags=(attach_disconnected) { include + include include include From 604e71888c21fccda14cde6799253efa27bc2610 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 14 Oct 2024 20:38:27 +0100 Subject: [PATCH 0354/1455] feat(tunable): remove never used hci_id. --- apparmor.d/tunables/multiarch.d/system | 3 --- 1 file changed, 3 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index defc53af4..0a95d1837 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -144,9 +144,6 @@ @{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h} @{pci}=@{pci_bus}/**/ -# hci devices -@{hci_id}=dev_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c}_@{c}@{c} - # Udev data dynamic assignment ranges @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 From 04df7052725b4ac473f1bdcd1e1644b8163ff0d2 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Tue, 15 Oct 2024 10:40:47 +0800 Subject: [PATCH 0355/1455] Prepare for re-attached-path --- apparmor.d/profiles-g-l/linuxqq | 2 +- apparmor.d/profiles-s-z/ufw | 4 ++-- apparmor.d/profiles-s-z/wechat-universal | 2 +- apparmor.d/profiles-s-z/wemeet | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index c4bf64d75..4d579764f 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -14,6 +14,7 @@ include @{exec_path} = @{bin}/linuxqq @{lib_dirs}/qq profile linuxqq @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -42,7 +43,6 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, /dev/tty rw, - /dev/pts/@{int} rw, include if exists } diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 1c34b8579..2c0f5352f 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -8,9 +8,9 @@ abi , include @{exec_path} = @{bin}/ufw -profile ufw @{exec_path} { +profile ufw @{exec_path} flags=(attach_disconnected) { include - include + include include include diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index f29df13d0..31a7f7cde 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -14,6 +14,7 @@ include @{exec_path} = @{bin}/wechat-universal @{lib_dirs}/wechat profile wechat-universal @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -52,7 +53,6 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pid}/net/route r, /dev/tty rw, - /dev/pts/@{int} rw, include if exists } diff --git a/apparmor.d/profiles-s-z/wemeet b/apparmor.d/profiles-s-z/wemeet index 39862913c..bbc871f6c 100644 --- a/apparmor.d/profiles-s-z/wemeet +++ b/apparmor.d/profiles-s-z/wemeet @@ -11,6 +11,7 @@ include @{exec_path} += /opt/wemeet/bin/QtWebEngineProcess profile wemeet @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -54,7 +55,6 @@ profile wemeet @{exec_path} flags=(attach_disconnected) { /dev/ r, /dev/tty rw, /dev/shm/ r, - /dev/pts/@{int} rw, include if exists From 3a6844c8ceb3296370a2c1bface8cb52f70514a2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 15 Oct 2024 16:18:53 +0100 Subject: [PATCH 0356/1455] tests(check): also checks files header. --- tests/check.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/check.sh b/tests/check.sh index a46d38e30..b63524157 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -10,6 +10,21 @@ set -eu -o pipefail readonly APPARMORD="apparmor.d" +_ensure_header() { + local file="$1" + headers=( + "# apparmor.d - Full set of apparmor profiles" + "# Copyright (C) " + "# SPDX-License-Identifier: GPL-2.0-only" + ) + for header in "${headers[@]}"; do + if ! grep -q "^$header" "$file"; then + echo "$file does not contain '$header'" + exit 1 + fi + done +} + _ensure_include() { local file="$1" local include="$2" @@ -37,6 +52,7 @@ _ensure_vim() { check_profiles() { echo "⋅ Checking if all profiles contain:" + echo " - apparmor.d header & license" echo " - 'abi ,'" echo " - 'profile '" echo " - 'include if exists '" @@ -50,6 +66,7 @@ check_profiles() { name="$(basename "$file")" name="${name/.apparmor.d/}" include="include if exists " + _ensure_header "$file" _ensure_include "$file" "$include" _ensure_abi "$file" _ensure_vim "$file" @@ -71,11 +88,13 @@ check_profiles() { check_abstractions() { echo "⋅ Checking if all abstractions contain:" + echo " - apparmor.d header & license" echo " - 'abi ,'" echo " - 'include if exists '" echo " - vim:syntax=apparmor" directories=( "$APPARMORD/abstractions/" "$APPARMORD/abstractions/app/" + "$APPARMORD/abstractions/attached/" "$APPARMORD/abstractions/bus/" "$APPARMORD/abstractions/common/" ) for dir in "${directories[@]}"; do @@ -83,6 +102,7 @@ check_abstractions() { name="$(basename "$file")" root="${dir/${APPARMORD}\/abstractions\//}" include="include if exists " + _ensure_header "$file" _ensure_include "$file" "$include" _ensure_abi "$file" _ensure_vim "$file" From 682c98b3207258ce21126bd5bf946cc6181ce584 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 15 Oct 2024 16:24:03 +0100 Subject: [PATCH 0357/1455] feat(profile): minor update to xdg desktop profiles. --- apparmor.d/abstractions/app/bus | 1 + apparmor.d/groups/freedesktop/xdg-desktop-portal | 5 ++++- apparmor.d/groups/freedesktop/xdg-open | 1 - apparmor.d/groups/freedesktop/xdg-settings | 1 - 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app/bus b/apparmor.d/abstractions/app/bus index 2ead91cc1..4fa0c2c8b 100644 --- a/apparmor.d/abstractions/app/bus +++ b/apparmor.d/abstractions/app/bus @@ -6,6 +6,7 @@ abi , + include include @{bin}/dbus-launch mix, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index eb450ee4e..53218d821 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -71,7 +71,10 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { /etc/sysconfig/proxy r, - @{GDM_HOME}/greeter-dconf-defaults r, + @{GDM_HOME}/greeter-dconf-defaults r, + owner @{gdm_config_dirs}/dconf/user r, + owner @{gdm_config_dirs}/user-dirs.dirs r, + @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/xdg-desktop-portal/* r, diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index 946b9aa59..7893800d1 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -43,7 +43,6 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) { include include include - include include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index 20246f659..870d4cfe4 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -57,7 +57,6 @@ profile xdg-settings @{exec_path} { include include include - include include if exists } From 6e2d817805659bdb1e0377f850f324244440a497 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 19:22:52 +0100 Subject: [PATCH 0358/1455] feat(profile): update pkexec. --- apparmor.d/abstractions/app/pkexec | 4 ++-- apparmor.d/groups/ubuntu/update-notifier | 2 -- apparmor.d/profiles-m-r/pkexec | 10 +++++----- 3 files changed, 7 insertions(+), 9 deletions(-) diff --git a/apparmor.d/abstractions/app/pkexec b/apparmor.d/abstractions/app/pkexec index 5b9197957..65d34ec6a 100644 --- a/apparmor.d/abstractions/app/pkexec +++ b/apparmor.d/abstractions/app/pkexec @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no # Minimal set of rules for pkexec. @@ -18,6 +19,7 @@ capability net_admin, capability setgid, capability setuid, + capability sys_ptrace, capability sys_resource, network netlink raw, # PAM @@ -26,8 +28,6 @@ @{bin}/pkexec mr, - @{etc_ro}/environment r, - @{etc_ro}/security/limits.d/{,*} r, /etc/shells r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index c75c3f83e..36fae9ce3 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -72,8 +72,6 @@ profile update-notifier @{exec_path} { include include - capability sys_ptrace, - ptrace read peer=update-notifier, @{lib}/update-notifier/package-system-locked Px, diff --git a/apparmor.d/profiles-m-r/pkexec b/apparmor.d/profiles-m-r/pkexec index ce1ea9dcd..c7bfbcefa 100644 --- a/apparmor.d/profiles-m-r/pkexec +++ b/apparmor.d/profiles-m-r/pkexec @@ -8,15 +8,15 @@ abi , include @{exec_path} = @{bin}/pkexec -profile pkexec @{exec_path} flags=(complain) { +profile pkexec @{exec_path} { include include - audit capability sys_nice, + capability sys_nice, - signal (send) set=(term, kill) peer=polkit-agent-helper, + signal send set=(term, kill) peer=polkit-agent-helper, - ptrace (read), + ptrace read, @{exec_path} mr, @@ -28,7 +28,7 @@ profile pkexec @{exec_path} flags=(complain) { /etc/default/locale r, @{PROC}/@{pid}/fdinfo/@{int} r, - @{PROC}/@{pids}/stat r, + @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/fd/ r, include if exists From 37bafddc8088e49f5e0d8934ee11e85814506c83 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:36:13 +0100 Subject: [PATCH 0359/1455] chore: enforce indentation consistency across profile. --- apparmor.d/groups/avahi/avahi-browse | 2 +- apparmor.d/groups/browsers/msedge | 2 +- apparmor.d/groups/bus/ibus-memconf | 8 +- apparmor.d/groups/cron/cron | 2 +- apparmor.d/groups/gnome/gnome-software | 2 +- apparmor.d/groups/hyprland/hyprland | 2 +- apparmor.d/groups/network/iwd | 2 +- apparmor.d/groups/network/mullvad-daemon | 4 +- apparmor.d/groups/ssh/ssh-agent-launch | 12 +-- apparmor.d/groups/systemd/bootctl | 4 +- apparmor.d/groups/whonix/systemcheck-canary | 2 +- apparmor.d/profiles-a-f/cups-backend-pdf | 2 +- apparmor.d/profiles-a-f/cups-backend-snmp | 2 +- apparmor.d/profiles-a-f/cups-notifier-dbus | 2 +- apparmor.d/profiles-a-f/cups-notifier-mailto | 2 +- apparmor.d/profiles-a-f/cups-notifier-rss | 2 +- apparmor.d/profiles-g-l/gamemoded | 18 ++--- apparmor.d/profiles-g-l/ifup | 2 +- apparmor.d/profiles-g-l/linuxqq | 48 +++++------ apparmor.d/profiles-m-r/mutt | 4 +- .../needrestart-iucode-scan-versions | 2 +- apparmor.d/profiles-m-r/qbittorrent | 6 +- apparmor.d/profiles-m-r/qbittorrent-nox | 2 +- apparmor.d/profiles-s-z/sensors-detect | 2 +- apparmor.d/profiles-s-z/session-desktop | 2 +- apparmor.d/profiles-s-z/totem | 2 +- apparmor.d/profiles-s-z/ufw | 76 +++++++++--------- apparmor.d/profiles-s-z/update-pciids | 2 +- apparmor.d/profiles-s-z/wechat-universal | 66 ++++++++-------- apparmor.d/profiles-s-z/wemeet | 79 +++++++++---------- 30 files changed, 181 insertions(+), 182 deletions(-) diff --git a/apparmor.d/groups/avahi/avahi-browse b/apparmor.d/groups/avahi/avahi-browse index f04637ae3..47c22d72d 100644 --- a/apparmor.d/groups/avahi/avahi-browse +++ b/apparmor.d/groups/avahi/avahi-browse @@ -15,7 +15,7 @@ profile avahi-browse @{exec_path} { include dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int} - interface=org.freedesktop.Avahi.ServiceTypeBrowser + interface=org.freedesktop.Avahi.ServiceTypeBrowser member={ItemNew,AllForNow,CacheExhausted} peer=(name=:*, label=avahi-daemon), diff --git a/apparmor.d/groups/browsers/msedge b/apparmor.d/groups/browsers/msedge index fbe4288a3..f616df6c6 100644 --- a/apparmor.d/groups/browsers/msedge +++ b/apparmor.d/groups/browsers/msedge @@ -26,7 +26,7 @@ profile msedge @{exec_path} { @{lib_dirs}/xdg-mime rix, #-> xdg-mime, @{lib_dirs}/xdg-settings rix, #-> xdg-settings, - + @{lib_dirs}/microsoft-edge{,beta,-dev} rPx, @{lib_dirs}/chrome_crashpad_handler rPx -> msedge//&msedge-crashpad-handler, diff --git a/apparmor.d/groups/bus/ibus-memconf b/apparmor.d/groups/bus/ibus-memconf index 7e7299bc1..0a8d7bdab 100644 --- a/apparmor.d/groups/bus/ibus-memconf +++ b/apparmor.d/groups/bus/ibus-memconf @@ -16,10 +16,10 @@ profile ibus-memconf @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term) peer=ibus-daemon, - dbus receive bus=session - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*, label=gnome-shell), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 7db10924c..7c57f9468 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -74,7 +74,7 @@ profile cron @{exec_path} flags=(attach_disconnected) { owner @{tmp}/#@{int} rw, - include if exists + include if exists } include if exists diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 5ebedca69..f462894bc 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -128,7 +128,7 @@ profile gnome-software @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/fuse rw, - + deny owner @{user_share_dirs}/gvfs-metadata/* r, profile gpg { diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 136ebabb0..9c6107f6f 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -39,7 +39,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, @{run}/systemd/sessions/@{int} r, - + @{run}/udev/data/+acpi:* r, # for acpi @{run}/udev/data/+dmi:id r, # for motherboard info @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs diff --git a/apparmor.d/groups/network/iwd b/apparmor.d/groups/network/iwd index c6dda71ad..50827e77e 100644 --- a/apparmor.d/groups/network/iwd +++ b/apparmor.d/groups/network/iwd @@ -22,7 +22,7 @@ profile iwd @{exec_path} { network netlink dgram, network alg seqpacket, - @{exec_path} mr, + @{exec_path} mr, /etc/iwd/{,**} r, /var/lib/iwd/{,**} rw, diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index fd43bc33b..8dc29f568 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -48,9 +48,9 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { owner /var/cache/mullvad-vpn/{,*} rw, owner /var/log/mullvad-vpn/{,*} rw, owner /var/log/private/mullvad-vpn/*.log rw, - + + @{run}/NetworkManager/resolv.conf r, owner @{run}/mullvad-vpn rw, - @{run}/NetworkManager/resolv.conf r, @{sys}/fs/cgroup/net_cls/ w, @{sys}/fs/cgroup/net_cls/mullvad-exclusions/ w, diff --git a/apparmor.d/groups/ssh/ssh-agent-launch b/apparmor.d/groups/ssh/ssh-agent-launch index 34b1ea1dc..237a5ff76 100644 --- a/apparmor.d/groups/ssh/ssh-agent-launch +++ b/apparmor.d/groups/ssh/ssh-agent-launch @@ -25,14 +25,14 @@ profile ssh-agent-launch @{exec_path} { include dbus send bus=session path=/org/freedesktop/DBus - interface=org.freedesktop.DBus - member=UpdateActivationEnvironment - peer=(name=org.freedesktop.DBus, label=dbus-session), + interface=org.freedesktop.DBus + member=UpdateActivationEnvironment + peer=(name=org.freedesktop.DBus, label=dbus-session), dbus send bus=session path=/org/freedesktop/systemd1 - interface=org.freedesktop.systemd1.Manager - member=SetEnvironment - peer=(name=org.freedesktop.systemd1), + interface=org.freedesktop.systemd1.Manager + member=SetEnvironment + peer=(name=org.freedesktop.systemd1), @{bin}/dbus-update-activation-environment mr, diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index c59284e72..05655d308 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -67,8 +67,8 @@ profile bootctl @{exec_path} { @{sys}/firmware/efi/efivars/SetupMode-@{uuid} r, @{sys}/firmware/efi/fw_platform_size r, - @{PROC}/sys/kernel/random/poolsize r, - owner @{PROC}/@{pid}/cgroup r, + @{PROC}/sys/kernel/random/poolsize r, + owner @{PROC}/@{pid}/cgroup r, # Inherit silencer deny network inet6 stream, diff --git a/apparmor.d/groups/whonix/systemcheck-canary b/apparmor.d/groups/whonix/systemcheck-canary index 2a38680bd..4130d9cd9 100644 --- a/apparmor.d/groups/whonix/systemcheck-canary +++ b/apparmor.d/groups/whonix/systemcheck-canary @@ -12,7 +12,7 @@ profile systemcheck-canary @{exec_path} { include @{exec_path} mr, - + @{bin}/sleep rix, @{bin}/grep rix, @{bin}/whoami rix, diff --git a/apparmor.d/profiles-a-f/cups-backend-pdf b/apparmor.d/profiles-a-f/cups-backend-pdf index b6e6d59ad..7782ecb11 100644 --- a/apparmor.d/profiles-a-f/cups-backend-pdf +++ b/apparmor.d/profiles-a-f/cups-backend-pdf @@ -21,7 +21,7 @@ profile cups-backend-pdf @{exec_path} { unix peer=(label=cupsd), @{exec_path} mr, - + @{sh_path} rix, @{bin}/cp rix, @{bin}/gs rix, diff --git a/apparmor.d/profiles-a-f/cups-backend-snmp b/apparmor.d/profiles-a-f/cups-backend-snmp index 35f0392de..5badd529a 100644 --- a/apparmor.d/profiles-a-f/cups-backend-snmp +++ b/apparmor.d/profiles-a-f/cups-backend-snmp @@ -16,7 +16,7 @@ profile cups-backend-snmp @{exec_path} { network netlink raw, @{exec_path} mr, - + /etc/cups/snmp.conf r, /etc/papersize r, diff --git a/apparmor.d/profiles-a-f/cups-notifier-dbus b/apparmor.d/profiles-a-f/cups-notifier-dbus index e22b2f6a4..3f9b15dcc 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-dbus +++ b/apparmor.d/profiles-a-f/cups-notifier-dbus @@ -17,7 +17,7 @@ profile cups-notifier-dbus @{exec_path} { signal (receive) set=(term) peer=cupsd, @{exec_path} mr, - + owner /var/spool/cups/tmp/cups-dbus-notifier-lockfile rw, owner @{tmp}/cups-dbus-notifier-lockfile rwk, diff --git a/apparmor.d/profiles-a-f/cups-notifier-mailto b/apparmor.d/profiles-a-f/cups-notifier-mailto index 0df4984d4..e69afb072 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-mailto +++ b/apparmor.d/profiles-a-f/cups-notifier-mailto @@ -11,7 +11,7 @@ profile cups-notifier-mailto @{exec_path} { include @{exec_path} mr, - + include if exists } diff --git a/apparmor.d/profiles-a-f/cups-notifier-rss b/apparmor.d/profiles-a-f/cups-notifier-rss index 129cb8d6f..993392912 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-rss +++ b/apparmor.d/profiles-a-f/cups-notifier-rss @@ -11,7 +11,7 @@ profile cups-notifier-rss @{exec_path} { include @{exec_path} mr, - + include if exists } diff --git a/apparmor.d/profiles-g-l/gamemoded b/apparmor.d/profiles-g-l/gamemoded index af1f34005..8f5067b77 100644 --- a/apparmor.d/profiles-g-l/gamemoded +++ b/apparmor.d/profiles-g-l/gamemoded @@ -40,23 +40,23 @@ profile gamemoded @{exec_path} flags=(attach_disconnected) { include include include - + capability audit_write, capability mknod, capability setgid, capability sys_ptrace, - + ptrace read peer=gamemoded, - + network netlink raw, - + @{bin}/pkexec mr, - + @{lib}/gamemode/{,**} r, @{lib}/gamemode/cpugovctl ix, @{lib}/gamemode/gpuclockctl ix, @{lib}/gamemode/procsysctl ix, - + /etc/security/limits.d/ r, /etc/security/limits.d/@{int}-gamemode.conf r, /etc/shells r, @@ -66,15 +66,15 @@ profile gamemoded @{exec_path} flags=(attach_disconnected) { @{sys}/devices/system/cpu/ r, @{sys}/devices/system/cpu/cpu@{int}/cpufreq r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw, - + @{PROC}/@{pid}/fdinfo/@{int} r, @{PROC}/@{pid}/loginuid r, @{PROC}/@{pid}/stat r, @{PROC}/sys/kernel/split_lock_mitigate rw, - + include if exists } - + include if exists } diff --git a/apparmor.d/profiles-g-l/ifup b/apparmor.d/profiles-g-l/ifup index c800267c7..aac25b811 100644 --- a/apparmor.d/profiles-g-l/ifup +++ b/apparmor.d/profiles-g-l/ifup @@ -85,7 +85,7 @@ profile ifup @{exec_path} { /etc/network/if-up.d/ r, /etc/network/if-up.d/*resolvconf rPUx, - /etc/network/if-up.d/resolved rPUx, + /etc/network/if-up.d/resolved rPUx, /etc/network/if-up.d/chrony rPUx, /etc/network/if-up.d/ethtool rPUx, /etc/network/if-up.d/ifenslave rPUx, diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 4d579764f..0e18eab1b 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -13,38 +13,38 @@ include @{exec_path} = @{bin}/linuxqq @{lib_dirs}/qq profile linuxqq @{exec_path} flags=(attach_disconnected) { - include - include - include - include - include + include + include + include + include + include - network netlink raw, - network netlink dgram, - network inet stream, - network inet dgram, - network inet6 dgram, - network inet6 stream, + network netlink raw, + network netlink dgram, + network inet stream, + network inet dgram, + network inet6 dgram, + network inet6 stream, - @{exec_path} mrix, + @{exec_path} mrix, - @{sh_path} r, - @{bin}/grep rix, - @{lib_dirs}/chrome_crashpad_handler ix, - @{lib_dirs}/resources/app/{,**} m, - @{open_path} rPx -> child-open-strict, + @{sh_path} r, + @{bin}/grep rix, + @{lib_dirs}/chrome_crashpad_handler ix, + @{lib_dirs}/resources/app/{,**} m, + @{open_path} rPx -> child-open-strict, - /etc/machine-id r, + /etc/machine-id r, - @{att}/@{run}/systemd/inhibit/@{int}.ref rw, - @{run}/utmp r, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/utmp r, - owner @{PROC}/@{pid}/loginuid r, - owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/loginuid r, + owner @{PROC}/@{pid}/mounts r, - /dev/tty rw, + /dev/tty rw, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/mutt b/apparmor.d/profiles-m-r/mutt index 4e218a8a0..6a96796a7 100644 --- a/apparmor.d/profiles-m-r/mutt +++ b/apparmor.d/profiles-m-r/mutt @@ -27,14 +27,14 @@ profile mutt @{exec_path} { # There are countless programs that can be executed from the mailcap. # This profile includes only the most basic. @{sh_path} rix, - + @{lib}/{,sendmail/}sendmail rPUx, @{bin}/ispell rPUx, @{bin}/abook rPUx, @{bin}/mutt_dotlock rix, # Misc mutt scripts @{lib}/mutt/* rix, - + @{bin}/w3m rCx -> html-renderer, @{bin}/lynx rCx -> html-renderer, @{editor_path} rCx -> editor, diff --git a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions index b60b5f488..75b150042 100644 --- a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions +++ b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions @@ -26,7 +26,7 @@ profile needrestart-iucode-scan-versions @{exec_path} { /boot/intel-ucode.img r, /boot/early_ucode.cpio r, - + @{sys}/devices/system/cpu/cpu@{int}/microcode/processor_flags r, /dev/tty rw, diff --git a/apparmor.d/profiles-m-r/qbittorrent b/apparmor.d/profiles-m-r/qbittorrent index 97c81ebd4..a5fcbb91e 100644 --- a/apparmor.d/profiles-m-r/qbittorrent +++ b/apparmor.d/profiles-m-r/qbittorrent @@ -42,7 +42,7 @@ profile qbittorrent @{exec_path} { interface=org.kde.StatusNotifierItem member={NewToolTip,NewIcon} peer=(name=org.freedesktop.DBus), - + dbus receive bus=session path=/StatusNotifierItem interface=org.kde.StatusNotifierItem member=Activate @@ -52,12 +52,12 @@ profile qbittorrent @{exec_path} { interface=org.freedesktop.DBus.Properties member=GetAll peer=(name=:*), - + dbus send bus=session path=/MenuBar interface=com.canonical.dbusmenu member=ItemsPropertiesUpdated peer=(name=org.freedesktop.DBus), - + dbus receive bus=session path=/MenuBar interface=com.canonical.dbusmenu member={GetLayout,GetGroupProperties,AboutToShow,AboutToShowGroup,EventGroup,Event} diff --git a/apparmor.d/profiles-m-r/qbittorrent-nox b/apparmor.d/profiles-m-r/qbittorrent-nox index 81cf43011..5129f203b 100644 --- a/apparmor.d/profiles-m-r/qbittorrent-nox +++ b/apparmor.d/profiles-m-r/qbittorrent-nox @@ -51,7 +51,7 @@ profile qbittorrent-nox @{exec_path} { /dev/disk/by-label/ r, /dev/shm/#@{int} rw, - + deny owner @{user_share_dirs}/data/qBittorrent/ rw, # Old dir, not recommended to use include if exists diff --git a/apparmor.d/profiles-s-z/sensors-detect b/apparmor.d/profiles-s-z/sensors-detect index b781ae1d0..e3eca4e22 100644 --- a/apparmor.d/profiles-s-z/sensors-detect +++ b/apparmor.d/profiles-s-z/sensors-detect @@ -15,7 +15,7 @@ profile sensors-detect @{exec_path} { capability syslog, @{exec_path} rm, - + @{bin}/kmod rCx -> kmod, @{bin}/perl r, @{bin}/systemctl rCx -> systemctl, diff --git a/apparmor.d/profiles-s-z/session-desktop b/apparmor.d/profiles-s-z/session-desktop index d088bb0b1..98b194fb7 100644 --- a/apparmor.d/profiles-s-z/session-desktop +++ b/apparmor.d/profiles-s-z/session-desktop @@ -28,7 +28,7 @@ profile session-desktop @{exec_path} { network netlink raw, @{exec_path} mrix, - + @{lib_dirs}/resources/app.asar.unpacked/ts/webworker/workers/node/**.node mr, @{open_path} rPx -> child-open-strict, diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index 6883e48f2..64ab228ba 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -83,7 +83,7 @@ profile totem @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/task/@{tid}/comm w, /dev/ r, - + include if exists } diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/profiles-s-z/ufw index 2c0f5352f..b7e5f0c79 100644 --- a/apparmor.d/profiles-s-z/ufw +++ b/apparmor.d/profiles-s-z/ufw @@ -9,54 +9,54 @@ include @{exec_path} = @{bin}/ufw profile ufw @{exec_path} flags=(attach_disconnected) { - include - include - include - include + include + include + include + include - capability dac_read_search, - capability net_admin, - capability net_raw, - capability sys_ptrace, + capability dac_read_search, + capability net_admin, + capability net_raw, + capability sys_ptrace, - network inet dgram, - network inet raw, - network inet6 dgram, - network inet6 raw, - network netlink raw, + network inet dgram, + network inet raw, + network inet6 dgram, + network inet6 raw, + network netlink raw, - ptrace read, + ptrace read, - @{exec_path} mr, + @{exec_path} mr, - @{bin}/ r, - @{bin}/cat ix, - @{bin}/env r, - @{bin}/python3.@{int} ix, - @{bin}/sysctl ix, - @{bin}/xtables-legacy-multi ix, - @{bin}/xtables-nft-multi ix, - @{lib}/ufw/ufw-init ix, + @{bin}/ r, + @{bin}/cat ix, + @{bin}/env r, + @{bin}/python3.@{int} ix, + @{bin}/sysctl ix, + @{bin}/xtables-legacy-multi ix, + @{bin}/xtables-nft-multi ix, + @{lib}/ufw/ufw-init ix, - /etc/default/ufw rw, - /etc/ufw/ rw, - /etc/ufw/** rwk, + /etc/default/ufw rw, + /etc/ufw/ rw, + /etc/ufw/** rwk, - @{run}/xtables.lock rwk, - owner @{run}/ufw.lock rwk, + @{run}/xtables.lock rwk, + owner @{run}/ufw.lock rwk, - owner @{tmp}/@{word8} rw, - owner @{tmp}/tmp@{word8} rw, - owner /var/tmp/@{word8} rw, - owner /var/tmp/tmp@{word8} rw, + owner @{tmp}/@{word8} rw, + owner @{tmp}/tmp@{word8} rw, + owner /var/tmp/@{word8} rw, + owner /var/tmp/tmp@{word8} rw, - @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/net/ip_tables_names r, - @{PROC}/@{pid}/stat r, - @{PROC}/sys/net/ipv{4,6}/** rw, - @{PROC}/sys/kernel/modprobe r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/net/ip_tables_names r, + @{PROC}/@{pid}/stat r, + @{PROC}/sys/net/ipv{4,6}/** rw, + @{PROC}/sys/kernel/modprobe r, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/update-pciids b/apparmor.d/profiles-s-z/update-pciids index 3d07f75d9..d2e36ead0 100644 --- a/apparmor.d/profiles-s-z/update-pciids +++ b/apparmor.d/profiles-s-z/update-pciids @@ -38,7 +38,7 @@ profile update-pciids @{exec_path} { /usr/share/misc/ r, /usr/share/misc/* rwl -> /usr/share/misc/*, - # For shell pwd + # For shell pwd /root/ r, diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index 31a7f7cde..9d563111a 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -13,48 +13,48 @@ include @{exec_path} = @{bin}/wechat-universal @{lib_dirs}/wechat profile wechat-universal @{exec_path} flags=(attach_disconnected) { - include - include - include - include - include - include - include + include + include + include + include + include + include + include - network netlink raw, - network netlink dgram, - network inet stream, - network inet dgram, - network inet6 dgram, - network inet6 stream, + network netlink raw, + network netlink dgram, + network inet stream, + network inet dgram, + network inet6 dgram, + network inet6 stream, - @{exec_path} mrix, + @{exec_path} mrix, - @{sh_path} rix, - @{lib}/wechat-universal/common.sh ix, - @{bin}/sed ix, - @{bin}/ln ix, - @{bin}/mkdir ix, - @{bin}/lsblk Px, - @{bin}/bwrap rix, - @{bin}/xdg-user-dir rix, - @{lib_dirs}/crashpad_handler ix, - @{open_path} rPx -> child-open-strict, + @{sh_path} rix, + @{lib}/wechat-universal/common.sh ix, + @{bin}/sed ix, + @{bin}/ln ix, + @{bin}/mkdir ix, + @{bin}/lsblk Px, + @{bin}/bwrap rix, + @{bin}/xdg-user-dir rix, + @{lib_dirs}/crashpad_handler ix, + @{open_path} rPx -> child-open-strict, - /etc/lsb-release r, + /etc/lsb-release r, - owner @{HOME}/@{XDG_DOCUMENTS_DIR}/WeChat_Data/{,**} rwk, - owner @{HOME}/.xwechat/{,**} rwk, - owner @{HOME}/.sys1og.conf rw, + owner @{HOME}/@{XDG_DOCUMENTS_DIR}/WeChat_Data/{,**} rwk, + owner @{HOME}/.xwechat/{,**} rwk, + owner @{HOME}/.sys1og.conf rw, - @{att}/@{run}/systemd/inhibit/@{int}.ref rw, - @{run}/utmp r, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/utmp r, - @{PROC}/@{pid}/net/route r, + @{PROC}/@{pid}/net/route r, - /dev/tty rw, + /dev/tty rw, - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/wemeet b/apparmor.d/profiles-s-z/wemeet index bbc871f6c..861908a6b 100644 --- a/apparmor.d/profiles-s-z/wemeet +++ b/apparmor.d/profiles-s-z/wemeet @@ -10,54 +10,53 @@ include @{exec_path} += /opt/wemeet/bin/wemeetapp @{exec_path} += /opt/wemeet/bin/QtWebEngineProcess profile wemeet @{exec_path} flags=(attach_disconnected) { - include - include - include - include - include - include - include - include - include - include + include + include + include + include + include + include + include + include + include + include - network netlink raw, - network netlink dgram, - network inet stream, - network inet dgram, - network inet6 dgram, - network inet6 stream, + network netlink raw, + network netlink dgram, + network inet stream, + network inet dgram, + network inet6 dgram, + network inet6 stream, - @{exec_path} mr, + @{exec_path} mr, - @{sh_path} r, - @{bin}/basename rix, - @{bin}/bwrap rix, - @{bin}/id rix, - @{bin}/mkdir rix, - /opt/wemeet/bin/** rix, + @{sh_path} r, + @{bin}/basename rix, + @{bin}/bwrap rix, + @{bin}/id rix, + @{bin}/mkdir rix, + /opt/wemeet/bin/** rix, - /etc/machine-id r, - /var/cache/ w, + /etc/machine-id r, + /var/cache/ w, - owner @{user_share_dirs}/wemeetapp/ rw, - owner @{user_share_dirs}/wemeetapp/** rwlk -> @{user_share_dirs}/wemeetapp/**, + owner @{user_share_dirs}/wemeetapp/ rw, + owner @{user_share_dirs}/wemeetapp/** rwlk -> @{user_share_dirs}/wemeetapp/**, - @{PROC}/ r, - @{PROC}/asound/ r, - @{PROC}/@{pid}/net/route r, - @{PROC}/@{pid}/net/wireless r, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/statm r, - @{PROC}/sys/fs/inotify/max_user_watches r, - owner @{PROC}/@{pid}/cmdline r, + @{PROC}/ r, + @{PROC}/asound/ r, + @{PROC}/@{pid}/net/route r, + @{PROC}/@{pid}/net/wireless r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/statm r, + @{PROC}/sys/fs/inotify/max_user_watches r, + owner @{PROC}/@{pid}/cmdline r, - /dev/ r, - /dev/tty rw, - /dev/shm/ r, - - include if exists + /dev/ r, + /dev/tty rw, + /dev/shm/ r, + include if exists } # vim:syntax=apparmor From d793858d2611700b53fdaecd6ededa26e93d0200 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:38:04 +0100 Subject: [PATCH 0360/1455] tests(check): also checks indentation. --- tests/check.sh | 96 +++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 75 insertions(+), 21 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index b63524157..71fc244ab 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -9,50 +9,104 @@ set -eu -o pipefail readonly APPARMORD="apparmor.d" +readonly HEADERS=( + "# apparmor.d - Full set of apparmor profiles" + "# Copyright (C) " + "# SPDX-License-Identifier: GPL-2.0-only" +) + +_die() { + echo " ✗ $*" + exit 1 +} _ensure_header() { local file="$1" - headers=( - "# apparmor.d - Full set of apparmor profiles" - "# Copyright (C) " - "# SPDX-License-Identifier: GPL-2.0-only" - ) - for header in "${headers[@]}"; do + for header in "${HEADERS[@]}"; do if ! grep -q "^$header" "$file"; then - echo "$file does not contain '$header'" - exit 1 + _die "$file does not contain '$header'" fi done } +_ensure_indentation() { + local file="$1" + local in_profile=false + local first_line_after_profile=true + local line_number=0 + + while IFS= read -r line; do + line_number=$((line_number + 1)) + + if [[ "$line" =~ $'\t' ]]; then + _die "$file:$line_number: tabs are not allowed." + fi + + if [[ "$line" =~ ^profile ]]; then + in_profile=true + first_line_after_profile=true + + elif $in_profile; then + if $first_line_after_profile; then + local leading_spaces="${line%%[! ]*}" + local num_spaces=${#leading_spaces} + if ((num_spaces != 2)); then + _die "$file: profile must have a two-space indentation." + fi + first_line_after_profile=false + + else + local leading_spaces="${line%%[! ]*}" + local num_spaces=${#leading_spaces} + + if ((num_spaces % 2 != 0)); then + ok=false + for offset in 5 11; do + num_spaces=$((num_spaces - offset)) + if ((num_spaces < 0)); then + break + fi + if ((num_spaces % 2 == 0)); then + ok=true + break + fi + done + + if ! $ok; then + _die "$file:$line_number: invalid indentation." + fi + fi + fi + fi + done <"$file" +} + _ensure_include() { local file="$1" local include="$2" if ! grep -q "^ *${include}$" "$file"; then - echo "$file does not contain '$include'" - exit 1 + _die "$file does not contain '$include'" fi } _ensure_abi() { local file="$1" if ! grep -q "^ *abi ," "$file"; then - echo "$file does not contain 'abi ,'" - exit 1 + _die "$file does not contain 'abi ,'" fi } _ensure_vim() { local file="$1" if ! grep -q "^# vim:syntax=apparmor" "$file"; then - echo "$file does not contain '# vim:syntax=apparmor'" - exit 1 + _die "$file does not contain '# vim:syntax=apparmor'" fi } check_profiles() { - echo "⋅ Checking if all profiles contain:" + echo " ⋅ Checking if all profiles contain:" echo " - apparmor.d header & license" + echo " - Check indentation: 2 spaces" echo " - 'abi ,'" echo " - 'profile '" echo " - 'include if exists '" @@ -67,19 +121,18 @@ check_profiles() { name="${name/.apparmor.d/}" include="include if exists " _ensure_header "$file" + _ensure_indentation "$file" _ensure_include "$file" "$include" _ensure_abi "$file" _ensure_vim "$file" if ! grep -q "^profile $name" "$file"; then - echo "$name does not contain 'profile $name'" - exit 1 + _die "$name does not contain 'profile $name'" fi mapfile -t subrofiles < <(grep "^ *profile*" "$file" | awk '{print $2}') for subprofile in "${subrofiles[@]}"; do include="include if exists " if ! grep -q "^ *${include}$" "$file"; then - echo "$name: $name//$subprofile does not contain '$include'" - exit 1 + _die "$name: $name//$subprofile does not contain '$include'" fi done done @@ -87,8 +140,9 @@ check_profiles() { } check_abstractions() { - echo "⋅ Checking if all abstractions contain:" + echo " ⋅ Checking if all abstractions contain:" echo " - apparmor.d header & license" + echo " - Check indentation: 2 spaces" echo " - 'abi ,'" echo " - 'include if exists '" echo " - vim:syntax=apparmor" @@ -103,12 +157,12 @@ check_abstractions() { root="${dir/${APPARMORD}\/abstractions\//}" include="include if exists " _ensure_header "$file" + _ensure_indentation "$file" _ensure_include "$file" "$include" _ensure_abi "$file" _ensure_vim "$file" done done - } check_profiles From 49d10c94e450b2701726fed9d8df353b52836e15 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:40:28 +0100 Subject: [PATCH 0361/1455] chore: ensure app abstraction are not proposed by logprof. --- apparmor.d/abstractions/app/bus | 1 + apparmor.d/abstractions/app/chromium | 1 + apparmor.d/abstractions/app/editor | 1 + apparmor.d/abstractions/app/firefox | 1 + apparmor.d/abstractions/app/kmod | 1 + apparmor.d/abstractions/app/open | 1 + apparmor.d/abstractions/app/pgrep | 1 + apparmor.d/abstractions/app/sudo | 1 + apparmor.d/abstractions/app/systemctl | 1 + apparmor.d/abstractions/app/udevadm | 1 + 10 files changed, 10 insertions(+) diff --git a/apparmor.d/abstractions/app/bus b/apparmor.d/abstractions/app/bus index 4fa0c2c8b..8c7e6e98b 100644 --- a/apparmor.d/abstractions/app/bus +++ b/apparmor.d/abstractions/app/bus @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no # Minimal set of rules for dbus-send/dbus-launch. diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 6bf3f26ed..0bae4e0d2 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no # Full set of rules for all chromium based browsers. It works as a *function* # and requires some variables to be provided as *arguments* and set in the diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index 9daec6ad1..9816e7907 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -2,6 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # Copyright (C) 2024 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no abi , diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 2f9c93937..2a2f612b7 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no # Full set of rules for all firefox based browsers. It works as a *function* # and requires some variables to be provided as *arguments* and set in the diff --git a/apparmor.d/abstractions/app/kmod b/apparmor.d/abstractions/app/kmod index ad02acc54..25a0c0c38 100644 --- a/apparmor.d/abstractions/app/kmod +++ b/apparmor.d/abstractions/app/kmod @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no abi , diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index 9ae49c4bd..256eb5a6d 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no # Full set of rules for child-open-* profiles. diff --git a/apparmor.d/abstractions/app/pgrep b/apparmor.d/abstractions/app/pgrep index 13ebcd390..211c2710d 100644 --- a/apparmor.d/abstractions/app/pgrep +++ b/apparmor.d/abstractions/app/pgrep @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no # Minimal set of rules for pgrep/pkill. diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 0149cc883..53bb50f31 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no # Minimal set of rules for sudo. Interactive sudo need more rules. diff --git a/apparmor.d/abstractions/app/systemctl b/apparmor.d/abstractions/app/systemctl index 9f0da659b..38126c968 100644 --- a/apparmor.d/abstractions/app/systemctl +++ b/apparmor.d/abstractions/app/systemctl @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no abi , diff --git a/apparmor.d/abstractions/app/udevadm b/apparmor.d/abstractions/app/udevadm index cba83e1ff..e8414d026 100644 --- a/apparmor.d/abstractions/app/udevadm +++ b/apparmor.d/abstractions/app/udevadm @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no abi , From a41f85e87b75d7618bab68296e9d4f3cfac63bbc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:48:12 +0100 Subject: [PATCH 0362/1455] chore: fix indentation requirment. --- apparmor.d/abstractions/app-open | 80 +++++++++++----------- apparmor.d/groups/children/user_unconfined | 1 - 2 files changed, 41 insertions(+), 40 deletions(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 900fdc3c8..d257797eb 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -11,52 +11,54 @@ abi , # Sandbox managers - @{bin}/bwrap rPUx, - @{bin}/firejail rPUx, - @{bin}/flatpak rPx, - @{bin}/snap rPx, + @{bin}/bwrap PUx, + @{bin}/firejail PUx, + @{bin}/flatpak Px, + @{bin}/snap Px, # Labeled programs - @{archive_viewers_path} rPUx, - @{browsers_path} rPx, - @{document_viewers_path} rPUx, - @{emails_path} rPUx, - @{file_explorers_path} rPx, - @{help_path} rPx, - @{image_viewers_path} rPUx, - @{offices_path} rPUx, - @{text_editors_path} rPUx, + @{archive_viewers_path} PUx, + @{browsers_path} Px, + @{document_viewers_path} PUx, + @{emails_path} PUx, + @{file_explorers_path} Px, + @{help_path} Px, + @{image_viewers_path} PUx, + @{offices_path} PUx, + @{text_editors_path} PUx, # Others - @{bin}/amule rPx, - @{bin}/blueman-tray rPx, - @{bin}/discord{,-ptb} rPx, - @{bin}/draw.io rPUx, - @{bin}/dropbox rPx, - @{bin}/element-desktop rPx, - @{bin}/extension-manager rPx, - @{bin}/filezilla rPx, - @{bin}/flameshot rPx, - @{bin}/gimp* rPUx, - @{bin}/gnome-calculator rPUx, - @{bin}/gnome-disk-image-mounter rPx, - @{bin}/gnome-disks rPx, - @{bin}/gnome-software rPx, - @{bin}/gwenview rPUx, - @{bin}/kgx rPx, - @{bin}/qbittorrent rPx, - @{bin}/qpdfview rPx, - @{bin}/smplayer rPx, - @{bin}/steam-runtime rPUx, - @{bin}/telegram-desktop rPx, - @{bin}/transmission-gtk rPx, - @{bin}/viewnior rPUx, - @{bin}/vlc rPUx, - @{bin}/xbrlapi rPx, + @{bin}/amule Px, + @{bin}/blueman-tray Px, + @{bin}/discord{,-ptb} Px, + @{bin}/draw.io PUx, + @{bin}/dropbox Px, + @{bin}/element-desktop Px, + @{bin}/extension-manager Px, + @{bin}/filezilla Px, + @{bin}/flameshot Px, + @{bin}/gimp* PUx, + @{bin}/gnome-calculator PUx, + @{bin}/gnome-disk-image-mounter Px, + @{bin}/gnome-disks Px, + @{bin}/gnome-software Px, + @{bin}/gwenview PUx, + @{bin}/kgx Px, + @{bin}/qbittorrent Px, + @{bin}/qpdfview Px, + @{bin}/smplayer Px, + @{bin}/steam-runtime PUx, + @{bin}/telegram-desktop Px, + @{bin}/transmission-gtk Px, + @{bin}/viewnior PUx, + @{bin}/vlc PUx, + @{bin}/xbrlapi Px, #aa:only opensuse - @{lib}/YaST2/** rPUx, + @{lib}/YaST2/** PUx, + # Backup + @{lib}/deja-dup/deja-dup-monitor PUx, include if exists diff --git a/apparmor.d/groups/children/user_unconfined b/apparmor.d/groups/children/user_unconfined index f6e4e835e..db410d6a2 100644 --- a/apparmor.d/groups/children/user_unconfined +++ b/apparmor.d/groups/children/user_unconfined @@ -7,7 +7,6 @@ abi , include profile user_unconfined flags=(attach_disconnected,mediate_deleted) { - capability, network, mount, From c90d2fea94d1f9a8f27c31c7afc9707e28eca765 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:50:16 +0100 Subject: [PATCH 0363/1455] feat(profile): update some ctl tools. --- apparmor.d/groups/systemd/busctl | 1 + apparmor.d/groups/systemd/loginctl | 10 ++++++++-- apparmor.d/groups/systemd/userdbctl | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index d251e9b26..dcb60493e 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -43,6 +43,7 @@ profile busctl @{exec_path} { @{PROC}/@{pid}/comm r, @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/sessionid r, diff --git a/apparmor.d/groups/systemd/loginctl b/apparmor.d/groups/systemd/loginctl index 681d1438e..5386662c0 100644 --- a/apparmor.d/groups/systemd/loginctl +++ b/apparmor.d/groups/systemd/loginctl @@ -9,18 +9,24 @@ include @{exec_path} = @{bin}/loginctl profile loginctl @{exec_path} { include + include include - include - include include capability net_admin, capability sys_resource, + signal send set=cont peer=child-pager, + + #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + @{exec_path} mr, @{pager_path} rPx -> child-pager, + @{PROC}/sys/fs/nr_open r, + owner @{PROC}/@{pid}/cgroup r, + include if exists } diff --git a/apparmor.d/groups/systemd/userdbctl b/apparmor.d/groups/systemd/userdbctl index db1a3dda8..0e3a99ba8 100644 --- a/apparmor.d/groups/systemd/userdbctl +++ b/apparmor.d/groups/systemd/userdbctl @@ -21,7 +21,7 @@ profile userdbctl @{exec_path} { /etc/shadow r, /etc/gshadow r, - @{PROC}/@{pid}/cgroup r, + @{PROC}/1/cgroup r, include if exists } From f993db64b9302ee0d41bde36d66bc5fc949ee65f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:50:46 +0100 Subject: [PATCH 0364/1455] feat(profile): update fwupd to last release. --- apparmor.d/profiles-a-f/fwupd | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 9ac0e21e6..b6ef68b0a 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -31,6 +31,10 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { capability sys_rawio, capability syslog, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, network netlink raw, #aa:dbus own bus=system name=org.freedesktop.fwupd path=/ @@ -54,6 +58,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{bin}/gpgsm rCx -> gpg, /usr/share/fwupd/{,**} r, + /usr/share/hwdata/*.ids r, /usr/share/mime/mime.cache r, /etc/fwupd/{,**} rw, @@ -83,15 +88,20 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{sys}/**/ r, @{sys}/devices/** r, + @{sys}/bus/hid/drivers/*/uevent r, + @{sys}/bus/usb/drivers/usbhid/uevent r, @{sys}/firmware/acpi/** r, @{sys}/firmware/dmi/tables/DMI r, @{sys}/firmware/dmi/tables/smbios_entry_point r, @{sys}/firmware/efi/** r, - @{sys}/firmware/efi/efivars/BootNext-@{uuid} rw, @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} rw, + @{sys}/firmware/efi/efivars/BootNext-@{uuid} rw, @{sys}/firmware/efi/efivars/fwupd-* rw, @{sys}/kernel/security/lockdown r, - @{sys}/kernel/security/tpm[0-9]/binary_bios_measurements r, + @{sys}/kernel/security/tpm@{int}/binary_bios_measurements r, + @{sys}/module/*/uevent r, + @{sys}/module/uhid/uevent r, + @{sys}/module/usbhid/uevent r, @{sys}/power/mem_sleep r, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, From 4797026e28bac93c0f040cb11e8820aa157e92a2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:53:14 +0100 Subject: [PATCH 0365/1455] feat(profile): update some ui profiles. --- apparmor.d/profiles-s-z/terminator | 2 ++ apparmor.d/profiles-s-z/transmission | 12 ++++++++++++ apparmor.d/profiles-s-z/vlc | 7 +++++++ 3 files changed, 21 insertions(+) diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index e72588420..e5a8f80d9 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -23,6 +23,8 @@ profile terminator @{exec_path} flags=(attach_disconnected) { ptrace, + signal send set=hup peer=unconfined, + #aa:dbus own bus=session name=net.tenshu.Terminator@{hex} @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission index ff3373a2c..a6ccb7e2d 100644 --- a/apparmor.d/profiles-s-z/transmission +++ b/apparmor.d/profiles-s-z/transmission @@ -9,6 +9,11 @@ include @{exec_path} = @{bin}/transmission-{gtk,qt} profile transmission @{exec_path} { include + include + include + include + include + include include include include @@ -23,12 +28,18 @@ profile transmission @{exec_path} { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=com.transmissionbt.Transmission + #aa:dbus own bus=session name=com.transmissionbt.transmission_* + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + @{exec_path} mr, @{open_path} rPx -> child-open, /usr/share/transmission/{,**} r, + owner @{HOME}/ r, + owner @{user_torrents_dirs}/ r, owner @{user_torrents_dirs}/** rw, @@ -48,6 +59,7 @@ profile transmission @{exec_path} { owner @{PROC}/@{pid}/comm r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index fabde247b..d572ce9b8 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -75,6 +75,13 @@ profile vlc @{exec_path} { @{run}/mount/utab r, + @{sys}/devices/virtual/dmi/id/board_name r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/board_version r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/product_version r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + /dev/shm/#@{int} rw, /dev/snd/ r, /dev/tty r, From d406596124d53c552dc8e093ebf14b95ed8c7aaa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 16 Oct 2024 23:58:48 +0100 Subject: [PATCH 0366/1455] tests: small fixes on builders scripts. --- dists/docker.sh | 9 +++++---- tests/packer/builds.pkr.hcl | 5 ++--- tests/packer/init/init.sh | 20 ++++++++++---------- tests/packer/src/aa-update | 6 ++++-- 4 files changed, 21 insertions(+), 19 deletions(-) diff --git a/dists/docker.sh b/dists/docker.sh index e0cb64431..4dd958759 100644 --- a/dists/docker.sh +++ b/dists/docker.sh @@ -12,7 +12,8 @@ readonly PREFIX="builder-" readonly PKGNAME=apparmor.d readonly VOLUME=/tmp/build readonly BUILDIR=/home/build/tmp -readonly OUTPUT=".pkg" +readonly OUTDIR=".pkg" +readonly OUTPUT="$PWD/$OUTDIR" readonly COMMAND="$1" VERSION="0.$(git rev-list --count HEAD)" PACKAGER="$(git config user.name) <$(git config user.email)>" @@ -63,7 +64,7 @@ build_in_docker_makepkg() { fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh pkg - mv "$VOLUME/$PKGNAME"-*.pkg.* "$OUTPUT" + mv "$VOLUME/$PKGNAME/$OUTDIR/$PKGNAME"-*.pkg.* "$OUTPUT" } build_in_docker_dpkg() { @@ -86,7 +87,7 @@ build_in_docker_dpkg() { fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh dpkg - mv "$VOLUME/$PKGNAME/${PKGNAME}_${VERSION}-1"_*.* "$OUTPUT" + mv "$VOLUME/$PKGNAME/$OUTDIR/${PKGNAME}_${VERSION}-1"_*.* "$OUTPUT" } build_in_docker_rpm() { @@ -105,7 +106,7 @@ build_in_docker_rpm() { fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh rpm - mv "$VOLUME/$PKGNAME/$PKGNAME-$VERSION-"*.rpm "$OUTPUT" + mv "$VOLUME/$PKGNAME/$OUTDIR/$PKGNAME-$VERSION-"*.rpm "$OUTPUT" } main() { diff --git a/tests/packer/builds.pkr.hcl b/tests/packer/builds.pkr.hcl index c658a8bfd..1c16a6b84 100644 --- a/tests/packer/builds.pkr.hcl +++ b/tests/packer/builds.pkr.hcl @@ -29,18 +29,17 @@ build { provisioner "file" { only = ["qemu.opensuse"] destination = "/tmp/src/" - sources = ["${path.cwd}/../apparmor.d-${var.version}-1.x86_64.rpm"] + sources = ["${path.cwd}/../.pkg/apparmor.d-${var.version}-1.x86_64.rpm"] } provisioner "file" { only = ["qemu.debian", "qemu.ubuntu22", "qemu.ubuntu24"] destination = "/tmp/src/" - sources = ["${path.cwd}/../apparmor.d_${var.version}-1_amd64.deb"] + sources = ["${path.cwd}/../.pkg/apparmor.d_${var.version}-1_amd64.deb"] } # Wait for cloud-init to finish provisioner "shell" { - except = ["qemu.opensuse"] execute_command = "echo '${var.password}' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'" inline = [ "while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for Cloud-Init...'; sleep 20; done", diff --git a/tests/packer/init/init.sh b/tests/packer/init/init.sh index 495d2f2a5..df300c0c4 100644 --- a/tests/packer/init/init.sh +++ b/tests/packer/init/init.sh @@ -15,6 +15,16 @@ readonly SRC=/tmp/src readonly DISTRIBUTION main() { + install -dm0750 -o "$SUDO_USER" -g "$SUDO_USER" "/home/$SUDO_USER/Projects/" "/home/$SUDO_USER/Projects/apparmor.d" "/home/$SUDO_USER/.config/" + install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/.bash_aliases "/home/$SUDO_USER/.bash_aliases" + install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/monitors.xml "/home/$SUDO_USER/.config/monitors.xml" + install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/htoprc "/home/$SUDO_USER/.config/htop/htoprc" + install -Dm0644 $SRC/site.local /etc/apparmor.d/tunables/multiarch.d/site.local + install -Dm0755 $SRC/aa-update /usr/bin/aa-update + install -Dm0755 $SRC/aa-log-clean /usr/bin/aa-log-clean + cat $SRC/parser.conf >>/etc/apparmor/parser.conf + chown -R "$SUDO_USER:$SUDO_USER" "/home/$SUDO_USER/.config/" + case "$DISTRIBUTION" in arch) pacman --noconfirm -U $SRC/*.pkg.tar.zst @@ -35,16 +45,6 @@ main() { ;; esac - - install -dm0750 -o "$SUDO_USER" -g "$SUDO_USER" "/home/$SUDO_USER/Projects/" "/home/$SUDO_USER/Projects/apparmor.d" "/home/$SUDO_USER/.config/" - install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/.bash_aliases "/home/$SUDO_USER/.bash_aliases" - install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/monitors.xml "/home/$SUDO_USER/.config/monitors.xml" - install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/htoprc "/home/$SUDO_USER/.config/htop/htoprc" - install -Dm0644 $SRC/site.local /etc/apparmor.d/tunables/multiarch.d/site.local - install -Dm0755 $SRC/aa-update /usr/bin/aa-update - install -Dm0755 $SRC/aa-log-clean /usr/bin/aa-log-clean - cat $SRC/parser.conf >>/etc/apparmor/parser.conf - chown -R "$SUDO_USER:$SUDO_USER" "/home/$SUDO_USER/.config/" } main "$@" diff --git a/tests/packer/src/aa-update b/tests/packer/src/aa-update index 747d0101b..9a326305d 100644 --- a/tests/packer/src/aa-update +++ b/tests/packer/src/aa-update @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -eu -export BUILDDIR=/tmp/build/ PKGDEST=/tmp/pkg +export BUILDDIR=/tmp/build/ # shellcheck source=/dev/null _lsb_release() { @@ -20,6 +20,8 @@ debian | ubuntu | whonix) make dpkg sudo rm -rf debian/.debhelper/ ;; -opensuse*) make rpm ;; +opensuse*) + make rpm + ;; *) ;; esac From b8c052201b1bbbe3c27e4cfbb0dafba6e672fb74 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Thu, 17 Oct 2024 22:33:54 +0200 Subject: [PATCH 0367/1455] YubiKey support for sudo - the yubikey is a u2f usb device, so usb abstraction is required - the authentication with yubikey against sudo happens as challenge response, which is why rw on the challenge file is required - the elevator first checks whether a .yubico folder exists, which is why reading the folder (but not the files within) is required --- apparmor.d/abstractions/app/sudo | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 53bb50f31..b83c2d166 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -12,6 +12,7 @@ include include include + include capability audit_write, capability dac_override, @@ -51,6 +52,10 @@ owner @{HOME}/.sudo_as_admin_successful rw, + # yubikey support + owner @{HOME}/.yubico/challenge-* rw, + @{HOME}/.yubico/ r, + @{run}/faillock/ rw, @{run}/faillock/@{user} rwk, owner @{run}/sudo/ rw, From 2f968f4221e134b2335a088a77d9bf6972e25050 Mon Sep 17 00:00:00 2001 From: odomingao Date: Wed, 2 Oct 2024 11:15:43 -0300 Subject: [PATCH 0368/1455] Create extensions --- apparmor.d/tunables/multiarch.d/extensions | 25 ++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 apparmor.d/tunables/multiarch.d/extensions diff --git a/apparmor.d/tunables/multiarch.d/extensions b/apparmor.d/tunables/multiarch.d/extensions new file mode 100644 index 000000000..5f83f0a5e --- /dev/null +++ b/apparmor.d/tunables/multiarch.d/extensions @@ -0,0 +1,25 @@ +@{package_ext} = abb apk appx appxbundle emsix emsixbundle msix msixbundle deb crx jar msi pacman pkg mpkg pkg.tar pkg.tar.zst tgz rpm + +@{diskimage_ext} = adf adz bwt cif cue cdi b5t b6t daa dmg dms dsk d64 img iso img ima nrg mdf mds mdx partimg sdi wim swm esd + +@{archive_ext} = ?q? ?z? ??_ 7z s7z a ar aar ace afa alz arc arj bar b1 b6z ba bh br bz2 cab car cdx cfs cpio dar dgc ear gca gz genozip ha hki io kgb lz lzma lzo ice lbr lha lzh lzx mar pak paq@{int} lpaq@{int} par par2 pax pea phar pim pit pka pma pst qda rar r@{int} rk run rz sbx sda sea sen sfark sfx shar shk sit sitx sqs sz tar tar.z tar.bz2 tar.gz tgz tar.lz tar.lzma tlz tar.xz txz tar.zst uc uc0 uc2 ucn ur2 ue2 uca uha war xar xp3 xz yz1 z zip zipx zpaq zoo zst zz @{diskimage_ext} @{package_ext} + +@{audio_ext} = adts aac ass ac3 amr awb acn aal atx at3 aa3 omg au snd dls evc evb enw evw lbc l16 mhas mxmf m4a mp3 mpga mp1 mp2 oga ogg opus spx sid psid qcp smv sofa loas xhe koz uva uvva eol mlp dts dtshd plj lvp pya vbk ecelp4800 ecelp7470 ecelp9600 multitrack rip smp3 smp s1m mid midi kar aif aiff aifc axa flac mka mod ult uni m15 mtm 669 med m3u wax wma ram rm ra s3m stm wav + +@{lyrics_ext} = lrc lyric + +@{video_ext} = 3gp 3gpp 3g2 3gpp2 m4s mj2 mjp2 mp4 mpg4 m4v mpeg mpg mpe m1v m2v ogv mov qt uvh uvvh uvm uvvm uvu uvvu uvp uvvp uvs uvvs uvv uvvv dvb fvt mxu m4u pyv nim bik bk2 smk smpg s11 s14 sswf ssw smov smo s1q yt viv webm axv flv fxm mkv mk3d asx wm wmv wmx wvx avi movie + +@{subtitles_ext} = aqt ass gsub usf pac pjs psb rt sbv smi srt ssa ssf stl sub ttml ttxt vtt + +@{image_ext} = exr avci avcs avif hif bmp dib cgm drle dpx emf fits fit fts heic heics heif heifs hej2 hsj2 gif ief jls jp2 jpg2 jph jhc jpg jpeg jpe jfif jpm jpgm jpx jpf jxl jxr jxra jxrs jxs jxsc jxsi jxss ktx ktx2 png btif btf pti svg svgz t38 tiff tif tfx psd psdc azv uvi uvvi uvg uvvg djvu djv dwg dxf fbs fpx fst mmr rlc pgb ico apng mdi b16 hdr rgbe xyze spng spn s1n sgif sgi s1g sjpg sjp s1j tap vtf wbmp xif pcx wmf webp ras pnm pbm pgm ppm rgb tga xcf xbm xpm xwd + +@{model_ext} = glb gltf jt igs iges msh mesh silo mtl obj stpx stpxz stl u3d bary cld dae dwf gld gsm win dor lmp rsm msm ism gtw moml mts ogex x_b xmt_bin x_t xmt_txt pyo pyox vds usda usdz bsp vtu wrl vrml x3db x3dv x3dvz + +@{font_ext} = ttc ttf otf woff woff2 + +@{document_ext} = adx cdf doc docm docx dot dotx fni fodg fodp fods fodt info mdi odb odc odf odg odi odm odp ods odt otc otf otg oth oti otp ots ott oxt pages pdf stc std sti stw sxc sxd sxgsxi sxm sxw xps xodt xott xodp xotp xods xots pptx ppts xls xlsb xlsm xlsx tex texinfo texi latex + +@{text_ext} = appcache manifest ics ifb cql css csv csvs soa zone gff3 html htm js mjs cnd markdown md miz n3 txt asc text pm el c h cc hh cxx hxx f90 conf log provn rst tag dsc rtx sgml sgm shaclc shc shex spdx tsv t tr roff ttl uris uri vcf vcard a abc ascii copyright dms sub jtd vfk ged flt fly flx gv dot hans hgl 3dml 3dm spot spo mpf ccc mc2 uric jad sos ts si sl wml wmls vtt wgsl xml xsd rng ent sandboxed pod etx + +# vim:syntax=apparmor From 7f83fe45be842569ece3b569ac89c980d9c00963 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 6 Oct 2024 22:25:59 -0300 Subject: [PATCH 0369/1455] Add capital letters --- apparmor.d/tunables/multiarch.d/extensions | 48 ++++++++++++++++------ 1 file changed, 36 insertions(+), 12 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/extensions b/apparmor.d/tunables/multiarch.d/extensions index 5f83f0a5e..85a6e8b5e 100644 --- a/apparmor.d/tunables/multiarch.d/extensions +++ b/apparmor.d/tunables/multiarch.d/extensions @@ -1,25 +1,49 @@ -@{package_ext} = abb apk appx appxbundle emsix emsixbundle msix msixbundle deb crx jar msi pacman pkg mpkg pkg.tar pkg.tar.zst tgz rpm +# abb apk appx appxbundle emsix emsixbundle msix msixbundle deb crx jar msi pacman pkg mpkg pkg.tar pkg.tar.zst tgz rpm -@{diskimage_ext} = adf adz bwt cif cue cdi b5t b6t daa dmg dms dsk d64 img iso img ima nrg mdf mds mdx partimg sdi wim swm esd +@{package_ext} = [aA][aA][bB][bB] [aA][pP][kK] [aA][pP][pP][xX] [aA][pP][pP][xX][bB][uU][nN][dD][lL][eE] [eE][mM][sS][iI][xX] [eE][mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [mM][sS][iI][xX] [mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [dD][eE][bB] [cC][rR][xX] [jJ][aA][rR] [mM][sS][iI] [pP][aA][cC][mM][aA][nN] [pP][kK][gG] [mM][pP][kK][gG] [pP][kK][gG].[tT][aA][rR] [pP][kK][gG].[tT][aA][rR].[zZ][sS][tT] [tT][gG][zZ] [rR][pP][mM] -@{archive_ext} = ?q? ?z? ??_ 7z s7z a ar aar ace afa alz arc arj bar b1 b6z ba bh br bz2 cab car cdx cfs cpio dar dgc ear gca gz genozip ha hki io kgb lz lzma lzo ice lbr lha lzh lzx mar pak paq@{int} lpaq@{int} par par2 pax pea phar pim pit pka pma pst qda rar r@{int} rk run rz sbx sda sea sen sfark sfx shar shk sit sitx sqs sz tar tar.z tar.bz2 tar.gz tgz tar.lz tar.lzma tlz tar.xz txz tar.zst uc uc0 uc2 ucn ur2 ue2 uca uha war xar xp3 xz yz1 z zip zipx zpaq zoo zst zz @{diskimage_ext} @{package_ext} +# adf adz bwt cif cue cdi b5t b6t daa dmg dms dsk d64 iso img ima nrg mdf mds mdx partimg sdi wim swm esd -@{audio_ext} = adts aac ass ac3 amr awb acn aal atx at3 aa3 omg au snd dls evc evb enw evw lbc l16 mhas mxmf m4a mp3 mpga mp1 mp2 oga ogg opus spx sid psid qcp smv sofa loas xhe koz uva uvva eol mlp dts dtshd plj lvp pya vbk ecelp4800 ecelp7470 ecelp9600 multitrack rip smp3 smp s1m mid midi kar aif aiff aifc axa flac mka mod ult uni m15 mtm 669 med m3u wax wma ram rm ra s3m stm wav +@{diskimage_ext} = [aA][dD][fF] [aA][dD][zZ] [bB][wW][tT] [cC][iI][fF] [cC][uU][eE] [cC][dD][iI] [bB]5[tT] [bB]6[tT] [dD][aA][aA] [dD][mM][gG] [dD][mM][sS] [dD][sS][kK] [dD]64 [iI][sS][oO] [iI][mM][gG] [iI][mM][aA] [nN][rR][gG] [mM][dD][fF] [mM][dD][sS] [mM][dD][xX] [pP][aA][rR][tT][iI][mM][gG] [sS][dD][iI] [wW][iI][mM] [sS][wW][mM] [eE][sS][dD] -@{lyrics_ext} = lrc lyric +# ?q? ?z? ??_ 7z s7z a ar aar ace afa alz arc arj bar b1 b6z ba bh br bz2 cab car cdx cfs cpio dar dgc ear gca gz genozip ha hki io kgb lz lzma lzo ice lbr lha lzh lzx mar pak paq@{int} lpaq@{int} par par2 pax pea phar pim pit pka pma pst qda rar r@{int} rk run rz sbx sda sea sen sfark sfx shar shk sit sitx sqs sz tar tar.z tar.bz2 tar.gz tgz tar.lz tar.lzma tlz tar.xz txz tar.zst uc uc0 uc2 ucn ur2 ue2 uca uha war xar xp3 xz yz1 z zip zipx zpaq zoo zst zz @{diskimage_ext} @{package_ext} -@{video_ext} = 3gp 3gpp 3g2 3gpp2 m4s mj2 mjp2 mp4 mpg4 m4v mpeg mpg mpe m1v m2v ogv mov qt uvh uvvh uvm uvvm uvu uvvu uvp uvvp uvs uvvs uvv uvvv dvb fvt mxu m4u pyv nim bik bk2 smk smpg s11 s14 sswf ssw smov smo s1q yt viv webm axv flv fxm mkv mk3d asx wm wmv wmx wvx avi movie +@{archive_ext} = ?[qQ]? ?[zZ]? ??_ 7[zZ] [sS]7[zZ] [aA] [aA][rR] [aA][aA][rR] [aA][cC][eE] [aA][fF][aA] [aA][lL][zZ] [aA][rR][cC] [aA][rR][jJ] [bB][aA][rR] [bB]1 [bB]6[zZ] [bB][aA][hH] [bB][rR] [bB][zZ]2 [cC][aA][bB] [cC][aA][rR] [cC][dD][xX] [cC][fF][sS] [cC][pP][iI][oO] [dD][aA][rR] [dD][gG][cC] [eE][aA][rR] [gG][cC][aA] [gG][zZ] [gG][eE][nN][oO][zZ][iI][pP] [hH][aA] [hH][kK][iI] [iI][oO] [kK][gG][bB] [lL][zZ] [lL][zZ][mM][aA] [lL][zZ][oO] [iI][cC][eE] [lL][bB][rR] [lL][hH][aA] [lL][zZ][hH] [lL][zZ][xX] [mM][aA][rR] [pP][aA][kK] [pP][aA][qQ]@{int} [lL][pP][aA][qQ]@{int} [pP][aA][rR] [pP][aA][rR]2 [pP][aA][xX] [pP][eE][aA] [pP][hH][aA][rR] [pP][iI][mM] [pP][iI][tT] [pP][kK][aA] [pP][mM][aA] [pP][sS][tT] [qQ][dD][aA] [rR][aA][rR] [rR]@{int} [rR][kK] [rR][uU][nN] [rR][zZ] [sS][bB][xX] [sS][dD][aA] [sS][eE][aA] [sS][eE][nN] [sS][fF][aA][rR][kK] [sS][fF][xX] [sS][hH][aA][rR] [sS][hH][kK] [sS][iI][tT] [sS][iI][tT][xX] [sS][qQ][sS] [sS][zZ] [tT][aA][rR] [tT][aA][rR].[zZ] [tT][aA][rR].[bB][zZ]2 [tT][aA][rR].[gG][zZ] [tT][gG][zZ] [tT][aA][rR].[lL][zZ] [tT][aA][rR].[lL][zZ][mM][aA] [tT][lL][zZ] [tT][aA][rR].[xX][zZ] [tT][xX][zZ] [tT][aA][rR].[zZ][sS][tT] [uU][cC] [uU][cC]0 [uU][cC]2 [uU][cC][nN] [uU][rR]2 [uU][eE]2 [uU][cC][aA] [uU][hH][aA] [wW][aA][rR] [xX][aA][rR] [xX][pP]3 [xX][zZ] [yY][zZ]1 [zZ][iI][pP] [zZ][iI][pP][xX] [zZ][pP][aA][qQ] [zZ][oO][oO] [zZ][sS][tT] [zZ][zZ] @{diskimage_ext} @{package_ext} -@{subtitles_ext} = aqt ass gsub usf pac pjs psb rt sbv smi srt ssa ssf stl sub ttml ttxt vtt +# alac adts aac ass ac3 amr awb acn aal atx at3 aa3 omg au snd dls evc evb enw evw lbc l16 mhas mxmf m4a mp3 mpga mp1 mp2 oga ogg opus spx sid psid qcp smv sofa loas xhe koz uva uvva eol mlp dts dtshd plj lvp pya vbk ecelp4800 ecelp7470 ecelp9600 multitrack rip smp3 smp s1m mid midi kar aif aiff aifc axa flac mka mod ult uni m15 mtm 669 med m3u wax wma ram rm ra s3m stm wav -@{image_ext} = exr avci avcs avif hif bmp dib cgm drle dpx emf fits fit fts heic heics heif heifs hej2 hsj2 gif ief jls jp2 jpg2 jph jhc jpg jpeg jpe jfif jpm jpgm jpx jpf jxl jxr jxra jxrs jxs jxsc jxsi jxss ktx ktx2 png btif btf pti svg svgz t38 tiff tif tfx psd psdc azv uvi uvvi uvg uvvg djvu djv dwg dxf fbs fpx fst mmr rlc pgb ico apng mdi b16 hdr rgbe xyze spng spn s1n sgif sgi s1g sjpg sjp s1j tap vtf wbmp xif pcx wmf webp ras pnm pbm pgm ppm rgb tga xcf xbm xpm xwd +@{audio_ext} = [aA][lL][aA][cC] [aA][dD][tT][sS] [aA][aA][cC] [aA][sS][sS] [aA][cC]3 [aA][mM][rR] [aA][wW][bB] [aA][cC][nN] [aA][aA][lL] [aA][tT][xX] [aA][aA]3 [oO][mM][gG] [aA][uU] [sS][nN][dD] [dD][lL][sS] [eE][vV][cC] [eE][vV][bB] [eE][nN][wW] [eE][vV][wW] [lL][bB][cC] [lL]16 [mM][hH][aA][sS] [mM][xX][mM][fF] [mM]4[aA] [mM][pP]3 [mM][pP][gG][aA] [mM][pP]1 [mM][pP]2 [oO][gG][aA] [oO][gG] [oO][pP][uU][sS] [sS][pP][xX] [sS][iI][dD] [pP][sS][iI][dD] [qQ][cC][pP] [sS][mM][vV] [sS][oO][fF][aA] [lL][oO][aA][sS] [xX][hH][eE] [kK][oO][zZ] [uU][vV][aA] [uU][vV][vV][aA] [eE][oO][lL] [mM][lL][pP] [dD][tT][sS] [dD][tT][sS][hH][dD] [pP][lL][jJ] [lL][vV][pP] [pP][yY][aA] [vV][bB][kK] [eE][cC][eE][lL][pP]4800 [eE][cC][eE][lL][pP]7470 [eE][cC][eE][lL][pP]9600 [mM][uU][lL][tT][iI][tT][rR][aA][cC][kK] [rR][iI][pP] [sS][mM][pP]3 [sS][mM][pP] [sS]1[mM] [mM][iI][dD] [mM][iI][dD][iI] [kK][aA][rR] [aA][iI][fF] [aA][iI][fF][fF] [aA][iI][fF][cC] [aA][xX][aA] [fF][lL][aA][cC] [mM][kK][aA] [mM][oO][dD] [uU][lL][tT] [uU][nN][iI] [mM]15 [mM][tT][mM] 669 [mM][eE][dD] [mM]3[uU] [wW][aA][xX] [wW][mM][aA] [rR][aA][mM] [rR][mM] [rR][aA] [sS]3[mM] [sS][tT][mM] [wW][aA][vV] -@{model_ext} = glb gltf jt igs iges msh mesh silo mtl obj stpx stpxz stl u3d bary cld dae dwf gld gsm win dor lmp rsm msm ism gtw moml mts ogex x_b xmt_bin x_t xmt_txt pyo pyox vds usda usdz bsp vtu wrl vrml x3db x3dv x3dvz +# lrc lyric -@{font_ext} = ttc ttf otf woff woff2 +@{lyrics_ext} = [lL][rR][cC] [lL][yY][rR][iI][cC] -@{document_ext} = adx cdf doc docm docx dot dotx fni fodg fodp fods fodt info mdi odb odc odf odg odi odm odp ods odt otc otf otg oth oti otp ots ott oxt pages pdf stc std sti stw sxc sxd sxgsxi sxm sxw xps xodt xott xodp xotp xods xots pptx ppts xls xlsb xlsm xlsx tex texinfo texi latex +# 3gp 3gpp 3g2 3gpp2 m4s mj2 mjp2 mp4 mpg4 m4v mpeg mpg mpe m1v m2v ogv mov qt uvh uvvh uvm uvvm uvu uvvu uvp uvvp uvs uvvs uvv uvvv dvb fvt mxu m4u pyv nim bik bk2 smk smpg s11 s14 sswf ssw smov smo s1q yt viv webm axv flv fxm mkv mk3d asx wm wmv wmx wvx avi movie -@{text_ext} = appcache manifest ics ifb cql css csv csvs soa zone gff3 html htm js mjs cnd markdown md miz n3 txt asc text pm el c h cc hh cxx hxx f90 conf log provn rst tag dsc rtx sgml sgm shaclc shc shex spdx tsv t tr roff ttl uris uri vcf vcard a abc ascii copyright dms sub jtd vfk ged flt fly flx gv dot hans hgl 3dml 3dm spot spo mpf ccc mc2 uric jad sos ts si sl wml wmls vtt wgsl xml xsd rng ent sandboxed pod etx +@{video_ext} = 3[gG][pP] 3[gG][pP][pP] 3[gG]2 3[gG][pP][pP]2 [mM]4[sS] [mM][jJ]2 [mM][jJ][pP]2 [mM][pP]4 [mM][pP][gG]4 [mM]4[vV] [mM][pP][eE][gG] [mM][pP][gG] [mM][pP][eE] [mM]1[vV] [mM]2[vV] [oO][gG][vV] [mM][oO][vV] [qQ][tT] [uU][vV][hH] [uU][vV][vV][hH] [uU][vV][mM] [uU][vV][vV][mM] [uU][vV][uU] [uU][vV][vV][uU] [uU][vV][pP] [uU][vV][vV][pP] [uU][vV][sS] [uU][vV][vV][sS] [uU][vV][vV][vV] [dD][vV][bB] [fF][vV][tT] [mM][xX][uU] [mM]4[uU] [pP][yY][vV] [nN][iI][mM] [bB][iI][kK] [bB][kK]2 [sS][mM][kK] [sS][mM][pP][gG] [sS]11 [sS]14 [sS][sS][wW][fF] [sS][sS][mM][oO][vV] [sS][mM][oO] [sS]1[qQ] [yY][tT] [vV][iI][vV] [wW][eE][bB][mM] [aA][xX][vV] [fF][lL][vV] [fF][xX][mM] [mM][kK][vV] [mM][kK]3[dD] [aA][sS][xX] [wW][mM] [wW][mM][vV] [wW][mM][xX] [wW][vV][xX] [aA][vV][iI] [mM][oO][vV][iI][eE] + +# aqt ass gsub usf pac pjs psb rt sbv smi srt ssa ssf stl sub ttml ttxt vtt + +@{subtitles_ext} = [aA][qQ][tT] [aA][sS][sS] [gG][sS][uU][bB] [uU][sS][fF] [pP][aA][cC] [pP][jJ][sS] [pP][sS][bB] [rR][tT] [sS][bB][vV] [sS][mM][iI] [sS][rR][tT] [sS][sS][aA] [sS][sS][fF] [sS][tT][lL] [sS][uU][bB] [tT][t][mM][lL] [tT][t][xX][tT] [vV][tT][t] + +# exr avci avcs avif hif bmp dib cgm drle dpx emf fits fit fts heic heics heif heifs hej2 hsj2 gif ief jls jp2 jpg2 jph jhc jpg jpeg jpe jfif jpm jpgm jpx jpf jxl jxr jxra jxrs jxs jxsc jxsi jxss ktx ktx2 png btif btf pti svg svgz t38 tiff tif tfx psd psdc azv uvi uvvi uvg uvvg djvu djv dwg dxf fbs fpx fst mmr rlc pgb ico apng mdi b16 hdr rgbe xyze spng spn s1n sgif sgi s1g sjpg sjp s1j tap vtf wbmp xif pcx wmf webp ras pnm pbm pgm ppm rgb tga xcf xbm xpm xwd + +@{image_ext} = [eE][xX][rR] [aA][vV][cC][iI] [aA][vV][cC][sS] [aA][vV][iI][fF] [hH][iI][fF] [bB][mM][pP] [dD][iI][bB] [cC][gG][mM] [dD][rR][lL][eE] [dD][pP][xX] [eE][mM][fF] [fF][iI][tT][sS] [fF][iI][tT] [fF][tT][sS] [hH][eE][iI][cC] [hH][eE][iI][cC][sS][hH][eE][iI][fF] [hH][eE][iI][fF][sS] [hH][eE][jJ]2 [hH][sS][jJ]2 [gG][iI][fF] [iE][eE][fF] [jJ][lL][sS] [jJ][pP]2 [jJ][pP][gG]2 [jJ][pP][hH] [jJ][hH][cC] [jJ][pP][gG] [jJ][pP][eE][gG] [jJ][fF][iI][fF] [jJ][pP][mM] [jJ][pP][gG][mM] [jJ][pP][xX] [jJ][pP][fF] [jJ][xX][lL] [jJ][xX][rR] [jJ][xX][rR][aA] [jJ][xX][rR][sS] [jJ][xX][sS][cC] [jJ][xX][sS][iI] [jJ][xX][sS][sS] [kK][tT][xX] [kK][tT][xX]2 [pP][nN][gG] [bB][tT][iI][fF] [bB][tT][fF] [pP][tT][iI] [sS][vV][gG] [sS][vV][gG][zZ] [tT]38 [tT][iI][fF][fF] [tT][iI][fF] [pP][sS][dD] [pP][sS][dD][cC] [aA][zZ][vV] [uU][vV][iI] [uU][vV][vV][iI] [uU][vV][gG] [uU][vV][vV][gG] [dD][jJ][vV][uU] [dD][jJ][vV] [dD][wW][gG] [dD][xX][fF] [fF][bB][sS] [fF][pP][xX] [fF][sS][tT] [mM][mM][rR] [rR][lL][cC] [pP][gG][bB] [iI][cC][oO] [aA][pP][nN][gG] [mM][dD][iI] [bB]16 [hH][dD][rR] [rR][gG][bB][eE] [xX][yY][zZ][eE] [sS][pP][nN][gG] [sS][pP][nN] [sS]1[nN] [sS][gG][iI] [sS][gG]1[gG] [sS][jJ][pP][gG] [sS][jJ][pP] [sS]1[jJ] [tT][aA][pP] [vV][bB][mM] [xX][iI][fF] [pP][cC][xX] [wW][mM][fF] [wW][eE][bB][pP] [rR][aA][sS] [pP][nN][mM] [pP][bB][mM] [pP][gG][mM] [pP][pP][mM] [rR][gG][bB] [tT][gG][aA] [xX][cC][fF] [xX][bB][mM] [xX][pP][mM] [xX][wW][dD] + +# glb gltf jt igs iges msh mesh silo mtl obj stpx stpxz stl u3d bary cld dae dwf gld gsm win dor lmp rsm msm ism gtw moml mts ogex x_b xmt_bin x_t xmt_txt pyo pyox vds usda usdz bsp vtu wrl vrml x3db x3dv x3dvz + +@{model_ext} = [gG][lL][bB] [gG][lL][tT][fF] [jJ][tT] [iI][gG][sS] [iI][gG][eE][sS] [mM][sS][hH] [mM][eE][sS][hH] [sS][iI][lL][oO] [mM][tT][lL] [oO][bB][jJ] [sS][tT][pP][xX] [sS][tT][pP][xX][zZ] [sS][tT][lL] [uU]3[dD] [bB][aA][rR][yY] [cC][lL][dD] [dD][aA][eE] [dD][wW][fF] [gG][lL][dD] [gG][sS][mM] [wW][iI][nN] [dD][oO][rR] [lL][mM][pP] [rR][sS][mM] [mM][sS][mM] [iI][sS][mM] [gG][tT][wW] [mM][oO][mM][lL] [mM][tT][sS] [oO][gG][eE][xX] [xX]_[bB] [xX][mM][tT]_[bB][iI][nN] [xX]_[tT] [xX][mM][tT]_[tT][xX][tT] [pP][yY][oO] [pP][yY][oO][xX] [vV][dD][sS] [uU][sS][dD][aA] [uU][sS][dD][zZ] [bB][sS][pP] [vV][tT][uU] [wW][rR][lL] [vV][rR][mM][lL] [xX]3[dD][bB] [xX]3[dD][vV] [xX]3[dD][vV][zZ] + +# ttc ttf otf woff woff2 + +@{font_ext} = [tT][tT][cC] [tT][tT][fF] [oO][tT][fF] [wW][oO][fF] [wW][oO][fF]2 + +# adx cdf doc docm docx dot dotx fni fodg fodp fods fodt info mdi odb odc odf odg odi odm odp ods odt otc otf otg oth oti otp ots ott oxt pages pdf stc std sti stw sxc sxd sxgsxi sxm sxw xps xodt xott xodp xotp xods xots pptx ppts xls xlsb xlsm xlsx tex texinfo texi latex + +@{document_ext} = [aA][dD][xX] [cC][dD][fF] [dD][oO][cC] [dD][oO][cC][mM] [dD][oO][cC][xX] [dD][oO][tT] [dD][oO][tT][xX] [fF][nN][iI] [fF][oO][dD][gG] [fF][oO][dD][pP] [fF][oO][dD][sS] [fF][oO][dD][tT] [iI][nN][fF][oO] [mM][dD][iI] [oO][dD][bB] [oO][dD][cC] [oO][dD][fF] [oO][dD][gG] [oO][dD][iI] [oO][dD][mM] [oO][dD][pP] [oO][dD][sS] [oO][dD][tT] [oO][tT][cC] [oO][tT][fF] [oO][tT][gG] [oO][tT][hH] [oO][tT][iI] [oO][tT][pP] [oO][tT][sS] [oO][tT][tT] [oO][xX][tT] [pP][aA][gG][eE][sS] [pP][dD][fF] [sS][tT][cC] [sS][tT][dD] [sS][tT][iI] [sS][tT][wW] [sS][xX][cC] [sS][xX][dD] [sS][xX][gG][sS][xX][iI] [sS][xX][mM] [sS][xX][wW] [xX][pP][sS] [xX][oO][dD][tT] [xX][oO][tT][tT] [xX][oO][dD][pP] [xX][oO][tT][pP] [xX][oO][dD][sS] [xX][oO][tT][sS] [pP][pP][tT][xX] [pP][pP][tT][sS] [xX][lL][sS] [xX][lL][sS][bB] [xX][lL][sS][mM] [xX][lL][sS][xX] [tT][eE][xX] [tT][eE][xX][iI][nN][fF][oO] [tT][eE][xX][iI] [lL][aA][tT][eE][xX] + +# appcache manifest ics ifb cql css csv csvs soa zone gff3 html htm js mjs cnd markdown md miz n3 txt asc text pm el c h cc hh cxx hxx f90 conf log provn rst tag dsc rtx sgml sgm shaclc shc shex spdx tsv t tr roff ttl uris uri vcf vcard a abc ascii copyright dms sub jtd vfk ged flt fly flx gv dot hans hgl 3dml 3dm spot spo mpf ccc mc2 uric jad sos ts si sl wml wmls vtt wgsl xml xsd rng ent sandboxed pod etx + +@{text_ext} = [aA][pP][pP][cC][aA][cC][hH][eE] [mM][aA][nN][iI][fF][eE][sS][tT] [iI][cC][sS] [iI][fF][bB] [cC][qQ][lL] [cC][sS][sS] [cC][sS][vV] [cC][sS][vV][sS] [sS][oO][aA] [zZ][oO][nN][eE] [gG][fF][fF]3 [hH][tT][mM][lL] [hH][tT][mM] [jJ][sS] [mM][jJ][sS] [cC][nN][dD] [mM][aA][rR][kK][dD][oO][wW][nN] [mM][dD] [mM][iI][zZ] [nN]3 [tT][xX][tT] [aA][sS][cC] [tT][eE][xX][tT] [pP][mM] [eE][lL] [cC] [hH] [cC][cC] [hH][hH] [cC][xX][xX] [hH][xX][xX] [fF]90 [cC][oO][nN][fF] [lL][oO][gG] [pP][rR][oO][vV][nN] [rR][sS][tT] [tT][aA][gG] [dD][sS][cC] [rR][tT][xX] [sS][gG][mM][lL] [sS][gG][mM] [sS][hH][aA][cC][lL][cC] [sS][hH][cC] [sS][hH][eE][xX] [sS][pP][dD][xX] [tT][sS][vV] [tT] [tT][rR] [rR][oO][fF][fF] [tT][tT][lL] [uU][rR][iI][sS] [uU][rR][iI] [vV][cC][fF] [vV][cC][aA][rR][dD] [aA] [aA][bB][cC] [aA][sS][cC][iI][iI] [cC][oO][pP][yY][rR][iI][gG][hH][tT] [dD][mM][sS] [sS][uU][bB] [jJ][tT][dD] [vV][fF][kK] [gG][eE][dD] [fF][lL][tT] [fF][lL][yY] [fF][lL][xX] [gG][vV] [dD][oO][tT] [hH][aA][nN][sS] [hH][gG][lL] 3[dD][mM][lL] 3[dD][mM] [sS][pP][oO][tT] [sS][pP][oO] [mM][pP][fF] [cC][cC][cC] [mM][cC]2 [uU][rR][iI][cC] [jJ][aA][dD] [sS][oO][sS] [tT][sS] [sS][iI] [sS][lL] [wW][mM][lL] [wW][mM][lL][sS] [vV][tT][tT] [wW][gG][sS][lL] [xX][mM][lL] [xX][sS][dD] [rR][nN][gG] [eE][nN][tT] [sS][aA][nN][dD][bB][oO][xX][eE][dD] [pP][oO][dD] [eE][tT][xX] # vim:syntax=apparmor From 93269e0596a8d416a9ee647146c983115da2f346 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 6 Oct 2024 22:32:49 -0300 Subject: [PATCH 0370/1455] Small fix --- apparmor.d/tunables/multiarch.d/extensions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/extensions b/apparmor.d/tunables/multiarch.d/extensions index 85a6e8b5e..e008b558c 100644 --- a/apparmor.d/tunables/multiarch.d/extensions +++ b/apparmor.d/tunables/multiarch.d/extensions @@ -1,6 +1,6 @@ # abb apk appx appxbundle emsix emsixbundle msix msixbundle deb crx jar msi pacman pkg mpkg pkg.tar pkg.tar.zst tgz rpm -@{package_ext} = [aA][aA][bB][bB] [aA][pP][kK] [aA][pP][pP][xX] [aA][pP][pP][xX][bB][uU][nN][dD][lL][eE] [eE][mM][sS][iI][xX] [eE][mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [mM][sS][iI][xX] [mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [dD][eE][bB] [cC][rR][xX] [jJ][aA][rR] [mM][sS][iI] [pP][aA][cC][mM][aA][nN] [pP][kK][gG] [mM][pP][kK][gG] [pP][kK][gG].[tT][aA][rR] [pP][kK][gG].[tT][aA][rR].[zZ][sS][tT] [tT][gG][zZ] [rR][pP][mM] +@{package_ext} = [aA][bB][bB] [aA][pP][kK] [aA][pP][pP][xX] [aA][pP][pP][xX][bB][uU][nN][dD][lL][eE] [eE][mM][sS][iI][xX] [eE][mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [mM][sS][iI][xX] [mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [dD][eE][bB] [cC][rR][xX] [jJ][aA][rR] [mM][sS][iI] [pP][aA][cC][mM][aA][nN] [pP][kK][gG] [mM][pP][kK][gG] [pP][kK][gG].[tT][aA][rR] [pP][kK][gG].[tT][aA][rR].[zZ][sS][tT] [tT][gG][zZ] [rR][pP][mM] # adf adz bwt cif cue cdi b5t b6t daa dmg dms dsk d64 iso img ima nrg mdf mds mdx partimg sdi wim swm esd From f079792aeef4341487681acfd927d0d49814f637 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 17 Oct 2024 23:44:55 +0100 Subject: [PATCH 0371/1455] feat(tunable): make the extensions easier to read. --- apparmor.d/tunables/multiarch.d/extensions | 665 ++++++++++++++++++++- 1 file changed, 632 insertions(+), 33 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/extensions b/apparmor.d/tunables/multiarch.d/extensions index e008b558c..956e8c253 100644 --- a/apparmor.d/tunables/multiarch.d/extensions +++ b/apparmor.d/tunables/multiarch.d/extensions @@ -1,49 +1,648 @@ -# abb apk appx appxbundle emsix emsixbundle msix msixbundle deb crx jar msi pacman pkg mpkg pkg.tar pkg.tar.zst tgz rpm +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only -@{package_ext} = [aA][bB][bB] [aA][pP][kK] [aA][pP][pP][xX] [aA][pP][pP][xX][bB][uU][nN][dD][lL][eE] [eE][mM][sS][iI][xX] [eE][mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [mM][sS][iI][xX] [mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] [dD][eE][bB] [cC][rR][xX] [jJ][aA][rR] [mM][sS][iI] [pP][aA][cC][mM][aA][nN] [pP][kK][gG] [mM][pP][kK][gG] [pP][kK][gG].[tT][aA][rR] [pP][kK][gG].[tT][aA][rR].[zZ][sS][tT] [tT][gG][zZ] [rR][pP][mM] +# Define commonly used extensions -# adf adz bwt cif cue cdi b5t b6t daa dmg dms dsk d64 iso img ima nrg mdf mds mdx partimg sdi wim swm esd +# All variables that refer to an extension must have the `_ext` suffix. -@{diskimage_ext} = [aA][dD][fF] [aA][dD][zZ] [bB][wW][tT] [cC][iI][fF] [cC][uU][eE] [cC][dD][iI] [bB]5[tT] [bB]6[tT] [dD][aA][aA] [dD][mM][gG] [dD][mM][sS] [dD][sS][kK] [dD]64 [iI][sS][oO] [iI][mM][gG] [iI][mM][aA] [nN][rR][gG] [mM][dD][fF] [mM][dD][sS] [mM][dD][xX] [pP][aA][rR][tT][iI][mM][gG] [sS][dD][iI] [wW][iI][mM] [sS][wW][mM] [eE][sS][dD] +# Packages +@{package_ext} = [aA][bB][bB] # abb +@{package_ext} += [aA][pP][kK] # apk +@{package_ext} += [aA][pP][pP][xX] # appx +@{package_ext} += [aA][pP][pP][xX][bB][uU][nN][dD][lL][eE] # appxbundle +@{package_ext} += [cC][rR][xX] # crx +@{package_ext} += [dD][eE][bB] # deb +@{package_ext} += [eE][mM][sS][iI][xX] # emsix +@{package_ext} += [eE][mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] # emsixbundle +@{package_ext} += [jJ][aA][rR] # jar +@{package_ext} += [mM][pP][kK][gG] # mpkg +@{package_ext} += [mM][sS][iI] # msi +@{package_ext} += [mM][sS][iI][xX] # msix +@{package_ext} += [mM][sS][iI][xX][bB][uU][nN][dD][lL][eE] # msixbundle +@{package_ext} += [pP][kK][gG] # pkg +@{package_ext} += [pP][kK][gG].[tT][aA][rR]{,[zZ][sS][tT]} # pkg.tar{,.zst} +@{package_ext} += [rR][pP][mM] # rpm +@{package_ext} += [tT][gG][zZ] # tgz -# ?q? ?z? ??_ 7z s7z a ar aar ace afa alz arc arj bar b1 b6z ba bh br bz2 cab car cdx cfs cpio dar dgc ear gca gz genozip ha hki io kgb lz lzma lzo ice lbr lha lzh lzx mar pak paq@{int} lpaq@{int} par par2 pax pea phar pim pit pka pma pst qda rar r@{int} rk run rz sbx sda sea sen sfark sfx shar shk sit sitx sqs sz tar tar.z tar.bz2 tar.gz tgz tar.lz tar.lzma tlz tar.xz txz tar.zst uc uc0 uc2 ucn ur2 ue2 uca uha war xar xp3 xz yz1 z zip zipx zpaq zoo zst zz @{diskimage_ext} @{package_ext} +# Disk images +@{diskimage_ext} = [aA][dD][fF] # adf +@{diskimage_ext} += [aA][dD][zZ] # adz +@{diskimage_ext} += [bB][wW][tT] # bwt +@{diskimage_ext} += [cC][iI][fF] # cif +@{diskimage_ext} += [cC][uU][eE] # cue +@{diskimage_ext} += [cC][dD][iI] # cdi +@{diskimage_ext} += [bB]5[tT] # b5t +@{diskimage_ext} += [bB]6[tT] # b6t +@{diskimage_ext} += [dD][aA][aA] # daa +@{diskimage_ext} += [dD][mM][gG] # dmg +@{diskimage_ext} += [dD][mM][sS] # dms +@{diskimage_ext} += [dD][sS][kK] # dsk +@{diskimage_ext} += [dD]64 # d64 +@{diskimage_ext} += [iI][sS][oO] # iso +@{diskimage_ext} += [iI][mM][gG] # img +@{diskimage_ext} += [iI][mM][aA] # ima +@{diskimage_ext} += [nN][rR][gG] # nrg +@{diskimage_ext} += [mM][dD][fF] # mdf +@{diskimage_ext} += [mM][dD][sS] # mds +@{diskimage_ext} += [mM][dD][xX] # mdx +@{diskimage_ext} += [pP][aA][rR][tT][iI][mM][gG] # partimg +@{diskimage_ext} += [sS][dD][iI] # sdi +@{diskimage_ext} += [wW][iI][mM] # wim +@{diskimage_ext} += [sS][wW][mM] # swm +@{diskimage_ext} += [eE][sS][dD] # esd -@{archive_ext} = ?[qQ]? ?[zZ]? ??_ 7[zZ] [sS]7[zZ] [aA] [aA][rR] [aA][aA][rR] [aA][cC][eE] [aA][fF][aA] [aA][lL][zZ] [aA][rR][cC] [aA][rR][jJ] [bB][aA][rR] [bB]1 [bB]6[zZ] [bB][aA][hH] [bB][rR] [bB][zZ]2 [cC][aA][bB] [cC][aA][rR] [cC][dD][xX] [cC][fF][sS] [cC][pP][iI][oO] [dD][aA][rR] [dD][gG][cC] [eE][aA][rR] [gG][cC][aA] [gG][zZ] [gG][eE][nN][oO][zZ][iI][pP] [hH][aA] [hH][kK][iI] [iI][oO] [kK][gG][bB] [lL][zZ] [lL][zZ][mM][aA] [lL][zZ][oO] [iI][cC][eE] [lL][bB][rR] [lL][hH][aA] [lL][zZ][hH] [lL][zZ][xX] [mM][aA][rR] [pP][aA][kK] [pP][aA][qQ]@{int} [lL][pP][aA][qQ]@{int} [pP][aA][rR] [pP][aA][rR]2 [pP][aA][xX] [pP][eE][aA] [pP][hH][aA][rR] [pP][iI][mM] [pP][iI][tT] [pP][kK][aA] [pP][mM][aA] [pP][sS][tT] [qQ][dD][aA] [rR][aA][rR] [rR]@{int} [rR][kK] [rR][uU][nN] [rR][zZ] [sS][bB][xX] [sS][dD][aA] [sS][eE][aA] [sS][eE][nN] [sS][fF][aA][rR][kK] [sS][fF][xX] [sS][hH][aA][rR] [sS][hH][kK] [sS][iI][tT] [sS][iI][tT][xX] [sS][qQ][sS] [sS][zZ] [tT][aA][rR] [tT][aA][rR].[zZ] [tT][aA][rR].[bB][zZ]2 [tT][aA][rR].[gG][zZ] [tT][gG][zZ] [tT][aA][rR].[lL][zZ] [tT][aA][rR].[lL][zZ][mM][aA] [tT][lL][zZ] [tT][aA][rR].[xX][zZ] [tT][xX][zZ] [tT][aA][rR].[zZ][sS][tT] [uU][cC] [uU][cC]0 [uU][cC]2 [uU][cC][nN] [uU][rR]2 [uU][eE]2 [uU][cC][aA] [uU][hH][aA] [wW][aA][rR] [xX][aA][rR] [xX][pP]3 [xX][zZ] [yY][zZ]1 [zZ][iI][pP] [zZ][iI][pP][xX] [zZ][pP][aA][qQ] [zZ][oO][oO] [zZ][sS][tT] [zZ][zZ] @{diskimage_ext} @{package_ext} +# Archives +@{archive_ext} = @{diskimage_ext} @{package_ext} +@{archive_ext} += ??_ # ??_ +@{archive_ext} += ?[qQ]? # ?q? +@{archive_ext} += ?[zZ]? # ?z? +@{archive_ext} += [aA] # a +@{archive_ext} += [aA][aA][rR] # aar +@{archive_ext} += [aA][cC][eE] # ace +@{archive_ext} += [aA][fF][aA] # afa +@{archive_ext} += [aA][lL][zZ] # alz +@{archive_ext} += [aA][rR] # ar +@{archive_ext} += [aA][rR][cC] # arc +@{archive_ext} += [aA][rR][jJ] # arj +@{archive_ext} += [bB][aA][hH] # bah +@{archive_ext} += [bB][aA][rR] # bar +@{archive_ext} += [bB][rR] # br +@{archive_ext} += [bB][zZ]2 # bz2 +@{archive_ext} += [bB]1 # b1 +@{archive_ext} += [bB]6[zZ] # b6z +@{archive_ext} += [cC][aA][bB] # cab +@{archive_ext} += [cC][aA][rR] # car +@{archive_ext} += [cC][dD][xX] # cdx +@{archive_ext} += [cC][fF][sS] # cfs +@{archive_ext} += [cC][pP][iI][oO] # cpio +@{archive_ext} += [dD][aA][rR] # dar +@{archive_ext} += [dD][gG][cC] # dgc +@{archive_ext} += [eE][aA][rR] # ear +@{archive_ext} += [gG][cC][aA] # gca +@{archive_ext} += [gG][eE][nN][oO][zZ][iI][pP] # genozip +@{archive_ext} += [gG][zZ] # gz +@{archive_ext} += [hH][aA] # ha +@{archive_ext} += [hH][kK][iI] # hki +@{archive_ext} += [iI][cC][eE] # ice +@{archive_ext} += [iI][oO] # io +@{archive_ext} += [kK][gG][bB] # kgb +@{archive_ext} += [lL][bB][rR] # lbr +@{archive_ext} += [lL][hH][aA] # lha +@{archive_ext} += [lL][pP][aA][qQ]@{int} # lpaq@{int} +@{archive_ext} += [lL][zZ] # lz +@{archive_ext} += [lL][zZ][hH] # lzh +@{archive_ext} += [lL][zZ][mM][aA] # lzma +@{archive_ext} += [lL][zZ][oO] # lzo +@{archive_ext} += [lL][zZ][xX] # lzx +@{archive_ext} += [mM][aA][rR] # mar +@{archive_ext} += [pP][aA][kK] # pak +@{archive_ext} += [pP][aA][qQ]@{int} # paq@{int} +@{archive_ext} += [pP][aA][rR] # par +@{archive_ext} += [pP][aA][rR]2 # par2 +@{archive_ext} += [pP][aA][xX] # pax +@{archive_ext} += [pP][eE][aA] # pea +@{archive_ext} += [pP][hH][aA][rR] # phar +@{archive_ext} += [pP][iI][mM] # pim +@{archive_ext} += [pP][iI][tT] # pit +@{archive_ext} += [pP][kK][aA] # pka +@{archive_ext} += [pP][mM][aA] # pma +@{archive_ext} += [pP][sS][tT] # pst +@{archive_ext} += [qQ][dD][aA] # qda +@{archive_ext} += [rR][aA][rR] # rar +@{archive_ext} += [rR][kK] # rk +@{archive_ext} += [rR][uU][nN] # run +@{archive_ext} += [rR][zZ] # rz +@{archive_ext} += [rR]@{int} # r@{int} +@{archive_ext} += [sS][bB][xX] # sbx +@{archive_ext} += [sS][dD][aA] # sda +@{archive_ext} += [sS][eE][aA] # sea +@{archive_ext} += [sS][eE][nN] # sen +@{archive_ext} += [sS][fF][aA][rR][kK] # sfark +@{archive_ext} += [sS][fF][xX] # sfx +@{archive_ext} += [sS][hH][aA][rR] # shar +@{archive_ext} += [sS][hH][kK] # shk +@{archive_ext} += [sS][iI][tT] # sit +@{archive_ext} += [sS][iI][tT][xX] # sitx +@{archive_ext} += [sS][qQ][sS] # sqs +@{archive_ext} += [sS][zZ] # sz +@{archive_ext} += [sS]7[zZ] # s7z +@{archive_ext} += [tT][aA][rR] # tar +@{archive_ext} += [tT][aA][rR].[bB][zZ]2 # tar.bz2 +@{archive_ext} += [tT][aA][rR].[gG][zZ] # tar.gz +@{archive_ext} += [tT][aA][rR].[lL][zZ] # tar.lz +@{archive_ext} += [tT][aA][rR].[lL][zZ][mM][aA] # tar.lzma +@{archive_ext} += [tT][aA][rR].[xX][zZ] # tar.xz +@{archive_ext} += [tT][aA][rR].[zZ] # tar.z +@{archive_ext} += [tT][aA][rR].[zZ][sS][tT] # tar.zst +@{archive_ext} += [tT][gG][zZ] # tgz +@{archive_ext} += [tT][lL][zZ] # tlz +@{archive_ext} += [tT][xX][zZ] # txz +@{archive_ext} += [uU][cC] # uc +@{archive_ext} += [uU][cC][aA] # uca +@{archive_ext} += [uU][cC][nN] # ucn +@{archive_ext} += [uU][cC]0 # uc0 +@{archive_ext} += [uU][cC]2 # uc2 +@{archive_ext} += [uU][eE]2 # ue2 +@{archive_ext} += [uU][hH][aA] # uha +@{archive_ext} += [uU][rR]2 # ur2 +@{archive_ext} += [wW][aA][rR] # war +@{archive_ext} += [xX][aA][rR] # xar +@{archive_ext} += [xX][pP]3 # xp3 +@{archive_ext} += [xX][zZ] # xz +@{archive_ext} += [yY][zZ]1 # yz1 +@{archive_ext} += [zZ][iI][pP] # zip +@{archive_ext} += [zZ][iI][pP][xX] # zipx +@{archive_ext} += [zZ][oO][oO] # zoo +@{archive_ext} += [zZ][pP][aA][qQ] # zpaq +@{archive_ext} += [zZ][sS][tT] # zst +@{archive_ext} += [zZ][zZ] # zz +@{archive_ext} += 7[zZ] # 7z -# alac adts aac ass ac3 amr awb acn aal atx at3 aa3 omg au snd dls evc evb enw evw lbc l16 mhas mxmf m4a mp3 mpga mp1 mp2 oga ogg opus spx sid psid qcp smv sofa loas xhe koz uva uvva eol mlp dts dtshd plj lvp pya vbk ecelp4800 ecelp7470 ecelp9600 multitrack rip smp3 smp s1m mid midi kar aif aiff aifc axa flac mka mod ult uni m15 mtm 669 med m3u wax wma ram rm ra s3m stm wav +# Audio +@{audio_ext} = [aA][aA][cC] # aac +@{audio_ext} += [aA][aA][lL] # aal +@{audio_ext} += [aA][aA]3 # aa3 +@{audio_ext} += [aA][cC][nN] # acn +@{audio_ext} += [aA][cC]3 # ac3 +@{audio_ext} += [aA][dD][tT][sS] # adts +@{audio_ext} += [aA][iI][fF] # aif +@{audio_ext} += [aA][iI][fF][cC] # aifc +@{audio_ext} += [aA][iI][fF][fF] # aiff +@{audio_ext} += [aA][lL][aA][cC] # alac +@{audio_ext} += [aA][mM][rR] # amr +@{audio_ext} += [aA][sS][sS] # ass +@{audio_ext} += [aA][tT][xX] # atx +@{audio_ext} += [aA][uU] # au +@{audio_ext} += [aA][wW][bB] # awb +@{audio_ext} += [aA][xX][aA] # axa +@{audio_ext} += [dD][lL][sS] # dls +@{audio_ext} += [dD][tT][sS] # dts +@{audio_ext} += [dD][tT][sS][hH][dD] # dtshd +@{audio_ext} += [eE][cC][eE][lL][pP]4800 # ecelp4800 +@{audio_ext} += [eE][cC][eE][lL][pP]7470 # ecelp7470 +@{audio_ext} += [eE][cC][eE][lL][pP]9600 # ecelp9600 +@{audio_ext} += [eE][nN][wW] # enw +@{audio_ext} += [eE][oO][lL] # eol +@{audio_ext} += [eE][vV][bB] # evb +@{audio_ext} += [eE][vV][cC] # evc +@{audio_ext} += [eE][vV][wW] # wvw +@{audio_ext} += [fF][lL][aA][cC] # flac +@{audio_ext} += [kK][aA][rR] # kar +@{audio_ext} += [kK][oO][zZ] # koz +@{audio_ext} += [lL][bB][cC] # lbc +@{audio_ext} += [lL][oO][aA][sS] # loas +@{audio_ext} += [lL][vV][pP] # lvp +@{audio_ext} += [lL]16 # l16 +@{audio_ext} += [mM][eE][dD] # med +@{audio_ext} += [mM][hH][aA][sS] # mhas +@{audio_ext} += [mM][iI][dD] # mid +@{audio_ext} += [mM][iI][dD][iI] # midi +@{audio_ext} += [mM][kK][aA] # mka +@{audio_ext} += [mM][lL][pP] # mlp +@{audio_ext} += [mM][oO][dD] # mod +@{audio_ext} += [mM][pP][gG][aA] # mpga +@{audio_ext} += [mM][pP]1 # mp1 +@{audio_ext} += [mM][pP]2 # mp2 +@{audio_ext} += [mM][pP]3 # mp3 +@{audio_ext} += [mM][tT][mM] # mtm +@{audio_ext} += [mM][uU][lL][tT][iI][tT][rR][aA][cC][kK] # multitrack +@{audio_ext} += [mM][xX][mM][fF] # mxmf +@{audio_ext} += [mM]15 # m15 +@{audio_ext} += [mM]3[uU] # m3u +@{audio_ext} += [mM]4[aA] # m4a +@{audio_ext} += [oO][gG] # og +@{audio_ext} += [oO][gG][aA] # oga +@{audio_ext} += [oO][mM][gG] # omg +@{audio_ext} += [oO][pP][uU][sS] # opus +@{audio_ext} += [pP][lL][jJ] # plj +@{audio_ext} += [pP][sS][iI][dD] # psid +@{audio_ext} += [pP][yY][aA] # pya +@{audio_ext} += [qQ][cC][pP] # qcp +@{audio_ext} += [rR][aA] # ra +@{audio_ext} += [rR][aA][mM] # ram +@{audio_ext} += [rR][iI][pP] # rip +@{audio_ext} += [rR][mM] # rm +@{audio_ext} += [sS][iI][dD] # sid +@{audio_ext} += [sS][mM][pP] # smp +@{audio_ext} += [sS][mM][pP]3 # smp3 +@{audio_ext} += [sS][mM][vV] # smv +@{audio_ext} += [sS][nN][dD] # snd +@{audio_ext} += [sS][oO][fF][aA] # sofa +@{audio_ext} += [sS][pP][xX] # spx +@{audio_ext} += [sS][tT][mM] # stm +@{audio_ext} += [sS]1[mM] # s1m +@{audio_ext} += [sS]3[mM] # s3m +@{audio_ext} += [uU][lL][tT] # ult +@{audio_ext} += [uU][nN][iI] # uni +@{audio_ext} += [uU][vV][aA] # uva +@{audio_ext} += [uU][vV][vV][aA] # uvva +@{audio_ext} += [vV][bB][kK] # vbk +@{audio_ext} += [wW][aA][vV] # wav +@{audio_ext} += [wW][aA][xX] # wax +@{audio_ext} += [wW][mM][aA] # wma +@{audio_ext} += [xX][hH][eE] # xhe +@{audio_ext} += 669 # 669 -@{audio_ext} = [aA][lL][aA][cC] [aA][dD][tT][sS] [aA][aA][cC] [aA][sS][sS] [aA][cC]3 [aA][mM][rR] [aA][wW][bB] [aA][cC][nN] [aA][aA][lL] [aA][tT][xX] [aA][aA]3 [oO][mM][gG] [aA][uU] [sS][nN][dD] [dD][lL][sS] [eE][vV][cC] [eE][vV][bB] [eE][nN][wW] [eE][vV][wW] [lL][bB][cC] [lL]16 [mM][hH][aA][sS] [mM][xX][mM][fF] [mM]4[aA] [mM][pP]3 [mM][pP][gG][aA] [mM][pP]1 [mM][pP]2 [oO][gG][aA] [oO][gG] [oO][pP][uU][sS] [sS][pP][xX] [sS][iI][dD] [pP][sS][iI][dD] [qQ][cC][pP] [sS][mM][vV] [sS][oO][fF][aA] [lL][oO][aA][sS] [xX][hH][eE] [kK][oO][zZ] [uU][vV][aA] [uU][vV][vV][aA] [eE][oO][lL] [mM][lL][pP] [dD][tT][sS] [dD][tT][sS][hH][dD] [pP][lL][jJ] [lL][vV][pP] [pP][yY][aA] [vV][bB][kK] [eE][cC][eE][lL][pP]4800 [eE][cC][eE][lL][pP]7470 [eE][cC][eE][lL][pP]9600 [mM][uU][lL][tT][iI][tT][rR][aA][cC][kK] [rR][iI][pP] [sS][mM][pP]3 [sS][mM][pP] [sS]1[mM] [mM][iI][dD] [mM][iI][dD][iI] [kK][aA][rR] [aA][iI][fF] [aA][iI][fF][fF] [aA][iI][fF][cC] [aA][xX][aA] [fF][lL][aA][cC] [mM][kK][aA] [mM][oO][dD] [uU][lL][tT] [uU][nN][iI] [mM]15 [mM][tT][mM] 669 [mM][eE][dD] [mM]3[uU] [wW][aA][xX] [wW][mM][aA] [rR][aA][mM] [rR][mM] [rR][aA] [sS]3[mM] [sS][tT][mM] [wW][aA][vV] +# Lyrics +@{lyrics_ext} = [lL][rR][cC] # lrc +@{lyrics_ext} += [lL][yY][rR][iI][cC] # lyric -# lrc lyric +# Videos +@{video_ext} = [aA][sS][xX] # asx +@{video_ext} += [aA][vV][iI] # avi +@{video_ext} += [aA][xX][vV] # axv +@{video_ext} += [bB][iI][kK] # bik +@{video_ext} += [bB][kK]2 # bk2 +@{video_ext} += [dD][vV][bB] # dvb +@{video_ext} += [fF][lL][vV] # flv +@{video_ext} += [fF][vV][tT] # fvt +@{video_ext} += [fF][xX][mM] # fxm +@{video_ext} += [mM][jJ][pP]2 # mjp2 +@{video_ext} += [mM][jJ]2 # mj2 +@{video_ext} += [mM][kK][vV] # mkv +@{video_ext} += [mM][kK]3[dD] # mk3d +@{video_ext} += [mM][oO][vV] # mov +@{video_ext} += [mM][pP][eE] # mpe +@{video_ext} += [mM][pP][eE][gG] # mpeg +@{video_ext} += [mM][pP][gG] # mpg +@{video_ext} += [mM][pP][gG]4 # mpg4 +@{video_ext} += [mM][pP]4 # mp4 +@{video_ext} += [mM][xX][uU] # mxu +@{video_ext} += [mM]1[vV] # m1v +@{video_ext} += [mM]2[vV] # m2v +@{video_ext} += [mM]4[sS] # m4s +@{video_ext} += [mM]4[uU] # m4u +@{video_ext} += [mM]4[vV] # m4v +@{video_ext} += [nN][iI][mM] # nim +@{video_ext} += [oO][gG][vV] # ogv +@{video_ext} += [pP][yY][vV] # pyv +@{video_ext} += [qQ][tT] # qt +@{video_ext} += [sS][mM][kK] # smk +@{video_ext} += [sS][mM][oO] # smo +@{video_ext} += [sS][mM][pP][gG] # smpg +@{video_ext} += [sS][sS][mM][oO][vV] # ssmov +@{video_ext} += [sS][sS][wW][fF] # sswf +@{video_ext} += [sS]1[qQ] # s1q +@{video_ext} += [sS]11 # s11 +@{video_ext} += [sS]14 # s14 +@{video_ext} += [uU][vV][hH] # uvh +@{video_ext} += [uU][vV][mM] # uvm +@{video_ext} += [uU][vV][pP] # uvp +@{video_ext} += [uU][vV][sS] # uvs +@{video_ext} += [uU][vV][uU] # uvu +@{video_ext} += [uU][vV][vV][hH] # uvvh +@{video_ext} += [uU][vV][vV][mM] # uvvm +@{video_ext} += [uU][vV][vV][pP] # uvvp +@{video_ext} += [uU][vV][vV][sS] # uvvs +@{video_ext} += [uU][vV][vV][uU] # uvvu +@{video_ext} += [uU][vV][vV][vV] # uvv +@{video_ext} += [vV][iI][vV] # viv +@{video_ext} += [wW][eE][bB][mM] # webm +@{video_ext} += [wW][mM] # wm +@{video_ext} += [wW][mM][vV] # wmv +@{video_ext} += [wW][mM][xX] # wmx +@{video_ext} += [wW][vV][xX] # wvx +@{video_ext} += [yY][tT] # yt +@{video_ext} += 3[gG][pP] # 3gp +@{video_ext} += 3[gG][pP][pP] # 3gpp +@{video_ext} += 3[gG][pP][pP]2 # 3gpp2 +@{video_ext} += 3[gG]2 # 3g2 -@{lyrics_ext} = [lL][rR][cC] [lL][yY][rR][iI][cC] +# Subtitles +@{suntitles_ext} = [aA][qQ][tT] # aqt +@{suntitles_ext} += [aA][sS][sS] # ass +@{suntitles_ext} += [gG][sS][uU][bB] # gsub +@{suntitles_ext} += [uU][sS][fF] # usf +@{suntitles_ext} += [pP][aA][cC] # pac +@{suntitles_ext} += [pP][jJ][sS] # pjs +@{suntitles_ext} += [pP][sS][bB] # psb +@{suntitles_ext} += [rR][tT] # rt +@{suntitles_ext} += [sS][bB][vV] # sbv +@{suntitles_ext} += [sS][mM][iI] # smi +@{suntitles_ext} += [sS][rR][tT] # srt +@{suntitles_ext} += [sS][sS][aA] # ssa +@{suntitles_ext} += [sS][sS][fF] # ssf +@{suntitles_ext} += [sS][tT][lL] # stl +@{suntitles_ext} += [sS][uU][bB] # sub +@{suntitles_ext} += [tT][t][mM][lL] # ttml +@{suntitles_ext} += [tT][t][xX][tT] # ttxt +@{suntitles_ext} += [vV][tT][t] # vtt -# 3gp 3gpp 3g2 3gpp2 m4s mj2 mjp2 mp4 mpg4 m4v mpeg mpg mpe m1v m2v ogv mov qt uvh uvvh uvm uvvm uvu uvvu uvp uvvp uvs uvvs uvv uvvv dvb fvt mxu m4u pyv nim bik bk2 smk smpg s11 s14 sswf ssw smov smo s1q yt viv webm axv flv fxm mkv mk3d asx wm wmv wmx wvx avi movie +# Images +@{image_ext} = [aA][pP][nN][gG] # apng +@{image_ext} += [aA][vV][cC][iI] # avci +@{image_ext} += [aA][vV][cC][sS] # avcs +@{image_ext} += [aA][vV][iI][fF] # avif +@{image_ext} += [aA][zZ][vV] # azv +@{image_ext} += [bB][mM][pP] # bmp +@{image_ext} += [bB][tT][fF] # btf +@{image_ext} += [bB][tT][iI][fF] # btif +@{image_ext} += [bB]16 # b16 +@{image_ext} += [cC][gG][mM] # cgm +@{image_ext} += [dD][iI][bB] # dib +@{image_ext} += [dD][jJ][vV] # djv +@{image_ext} += [dD][jJ][vV][uU] # djvu +@{image_ext} += [dD][pP][xX] # dpx +@{image_ext} += [dD][rR][lL][eE] # drle +@{image_ext} += [dD][wW][gG] # dwg +@{image_ext} += [dD][xX][fF] # dxf +@{image_ext} += [eE][mM][fF] # emf +@{image_ext} += [eE][xX][rR] # exr +@{image_ext} += [fF][bB][sS] # fbs +@{image_ext} += [fF][iI][tT] # fit +@{image_ext} += [fF][iI][tT][sS] # fits +@{image_ext} += [fF][pP][xX] # fpx +@{image_ext} += [fF][sS][tT] # fst +@{image_ext} += [fF][tT][sS] # fts +@{image_ext} += [gG][iI][fF] # gif +@{image_ext} += [hH][dD][rR] # hdr +@{image_ext} += [hH][eE][iI][cC] # heic +@{image_ext} += [hH][eE][iI][cC][sS][hH][eE][iI][fF] # heics +@{image_ext} += [hH][eE][iI][fF][sS] # heif +@{image_ext} += [hH][eE][jJ]2 # heifs +@{image_ext} += [hH][iI][fF] # hif +@{image_ext} += [hH][sS][jJ]2 # hsj2 +@{image_ext} += [iE][eE][fF] # ief +@{image_ext} += [iI][cC][oO] # ico +@{image_ext} += [jJ][fF][iI][fF] # jfif +@{image_ext} += [jJ][hH][cC] # jhc +@{image_ext} += [jJ][lL][sS] # jls +@{image_ext} += [jJ][pP][eE][gG] # jpeg +@{image_ext} += [jJ][pP][fF] # jpf +@{image_ext} += [jJ][pP][gG] # jpg +@{image_ext} += [jJ][pP][gG][mM] # jpgm +@{image_ext} += [jJ][pP][gG]2 # jpg2 +@{image_ext} += [jJ][pP][hH] # jph +@{image_ext} += [jJ][pP][mM] # jpm +@{image_ext} += [jJ][pP][xX] # jpx +@{image_ext} += [jJ][pP]2 # jp2 +@{image_ext} += [jJ][xX][lL] # jxl +@{image_ext} += [jJ][xX][rR] # jxr +@{image_ext} += [jJ][xX][rR][aA] # jxra +@{image_ext} += [jJ][xX][rR][sS] # jxrs +@{image_ext} += [jJ][xX][sS][cC] # jxsc +@{image_ext} += [jJ][xX][sS][iI] # jxsi +@{image_ext} += [jJ][xX][sS][sS] # jxss +@{image_ext} += [kK][tT][xX] # ktx +@{image_ext} += [kK][tT][xX]2 # ktx2 +@{image_ext} += [mM][dD][iI] # mdi +@{image_ext} += [mM][mM][rR] # mmr +@{image_ext} += [pP][bB][mM] # pbm +@{image_ext} += [pP][cC][xX] # pcx +@{image_ext} += [pP][gG][bB] # pgb +@{image_ext} += [pP][gG][mM] # pgm +@{image_ext} += [pP][nN][gG] # png +@{image_ext} += [pP][nN][mM] # pnm +@{image_ext} += [pP][pP][mM] # ppm +@{image_ext} += [pP][sS][dD] # psd +@{image_ext} += [pP][sS][dD][cC] # psdc +@{image_ext} += [pP][tT][iI] # pti +@{image_ext} += [rR][aA][sS] # ras +@{image_ext} += [rR][gG][bB] # rgb +@{image_ext} += [rR][gG][bB][eE] # rgbe +@{image_ext} += [rR][lL][cC] # rlc +@{image_ext} += [sS][gG][iI] # sgi +@{image_ext} += [sS][gG]1[gG] # s1g +@{image_ext} += [sS][jJ][pP] # sjp +@{image_ext} += [sS][jJ][pP][gG] # sjpg +@{image_ext} += [sS][pP][nN] # spn +@{image_ext} += [sS][pP][nN][gG] # spng +@{image_ext} += [sS][vV][gG] # svg +@{image_ext} += [sS][vV][gG][zZ] # svgz +@{image_ext} += [sS]1[jJ] # s1j +@{image_ext} += [sS]1[nN] # s1n +@{image_ext} += [tT][aA][pP] # tap +@{image_ext} += [tT][gG][aA] # tga +@{image_ext} += [tT][iI][fF] # tif +@{image_ext} += [tT][iI][fF][fF] # tiff +@{image_ext} += [tT]38 # t38 +@{image_ext} += [uU][vV][gG] # uvg +@{image_ext} += [uU][vV][iI] # uvi +@{image_ext} += [uU][vV][vV][gG] # uvvg +@{image_ext} += [uU][vV][vV][iI] # uvvi +@{image_ext} += [vV][bB][mM] # vtf +@{image_ext} += [wW][eE][bB][pP] # webp +@{image_ext} += [wW][mM][fF] # wmf +@{image_ext} += [xX][bB][mM] # xbm +@{image_ext} += [xX][cC][fF] # xcf +@{image_ext} += [xX][iI][fF] # xif +@{image_ext} += [xX][pP][mM] # xpm +@{image_ext} += [xX][wW][dD] # xwd +@{image_ext} += [xX][yY][zZ][eE] # xyze -@{video_ext} = 3[gG][pP] 3[gG][pP][pP] 3[gG]2 3[gG][pP][pP]2 [mM]4[sS] [mM][jJ]2 [mM][jJ][pP]2 [mM][pP]4 [mM][pP][gG]4 [mM]4[vV] [mM][pP][eE][gG] [mM][pP][gG] [mM][pP][eE] [mM]1[vV] [mM]2[vV] [oO][gG][vV] [mM][oO][vV] [qQ][tT] [uU][vV][hH] [uU][vV][vV][hH] [uU][vV][mM] [uU][vV][vV][mM] [uU][vV][uU] [uU][vV][vV][uU] [uU][vV][pP] [uU][vV][vV][pP] [uU][vV][sS] [uU][vV][vV][sS] [uU][vV][vV][vV] [dD][vV][bB] [fF][vV][tT] [mM][xX][uU] [mM]4[uU] [pP][yY][vV] [nN][iI][mM] [bB][iI][kK] [bB][kK]2 [sS][mM][kK] [sS][mM][pP][gG] [sS]11 [sS]14 [sS][sS][wW][fF] [sS][sS][mM][oO][vV] [sS][mM][oO] [sS]1[qQ] [yY][tT] [vV][iI][vV] [wW][eE][bB][mM] [aA][xX][vV] [fF][lL][vV] [fF][xX][mM] [mM][kK][vV] [mM][kK]3[dD] [aA][sS][xX] [wW][mM] [wW][mM][vV] [wW][mM][xX] [wW][vV][xX] [aA][vV][iI] [mM][oO][vV][iI][eE] +# Models +@{model_ext} = [bB][aA][rR][yY] # bary +@{model_ext} += [bB][sS][pP] # bsp +@{model_ext} += [cC][lL][dD] # cld +@{model_ext} += [dD][aA][eE] # dae +@{model_ext} += [dD][oO][rR] # dor +@{model_ext} += [dD][wW][fF] # dwf +@{model_ext} += [gG][lL][bB] # glb +@{model_ext} += [gG][lL][dD] # gld +@{model_ext} += [gG][lL][tT][fF] # gltf +@{model_ext} += [gG][sS][mM] # gsm +@{model_ext} += [gG][tT][wW] # gtw +@{model_ext} += [iI][gG][eE][sS] # iges +@{model_ext} += [iI][gG][sS] # igs +@{model_ext} += [iI][sS][mM] # ism +@{model_ext} += [jJ][tT] # jt +@{model_ext} += [lL][mM][pP] # lmp +@{model_ext} += [mM][eE][sS][hH] # mesh +@{model_ext} += [mM][oO][mM][lL] # moml +@{model_ext} += [mM][sS][hH] # msh +@{model_ext} += [mM][sS][mM] # msm +@{model_ext} += [mM][tT][lL] # mtl +@{model_ext} += [mM][tT][sS] # mts +@{model_ext} += [oO][bB][jJ] # obj +@{model_ext} += [oO][gG][eE][xX] # ogex +@{model_ext} += [pP][yY][oO] # pyo +@{model_ext} += [pP][yY][oO][xX] # pyox +@{model_ext} += [rR][sS][mM] # rsm +@{model_ext} += [sS][iI][lL][oO] # silo +@{model_ext} += [sS][tT][lL] # stl +@{model_ext} += [sS][tT][pP][xX] # stpx +@{model_ext} += [sS][tT][pP][xX][zZ] # stpxz +@{model_ext} += [uU][sS][dD][aA] # usda +@{model_ext} += [uU][sS][dD][zZ] # usdz +@{model_ext} += [uU]3[dD] # u3d +@{model_ext} += [vV][dD][sS] # vds +@{model_ext} += [vV][rR][mM][lL] # vrml +@{model_ext} += [vV][tT][uU] # vtu +@{model_ext} += [wW][iI][nN] # win +@{model_ext} += [wW][rR][lL] # wrl +@{model_ext} += [xX]_[bB] # x_b +@{model_ext} += [xX]_[tT] # x_t +@{model_ext} += [xX][mM][tT]_[bB][iI][nN] # xmt_bin +@{model_ext} += [xX][mM][tT]_[tT][xX][tT] # xmt_txt +@{model_ext} += [xX]3[dD][bB] # x3db +@{model_ext} += [xX]3[dD][vV] # x3dv +@{model_ext} += [xX]3[dD][vV][zZ] # x3dvz -# aqt ass gsub usf pac pjs psb rt sbv smi srt ssa ssf stl sub ttml ttxt vtt +# Fonts +@{font_ext} = [tT][tT][cC] # ttc +@{font_ext} += [tT][tT][fF] # ttf +@{font_ext} += [oO][tT][fF] # otf +@{font_ext} += [wW][oO][fF] # woff +@{font_ext} += [wW][oO][fF]2 # woff2 -@{subtitles_ext} = [aA][qQ][tT] [aA][sS][sS] [gG][sS][uU][bB] [uU][sS][fF] [pP][aA][cC] [pP][jJ][sS] [pP][sS][bB] [rR][tT] [sS][bB][vV] [sS][mM][iI] [sS][rR][tT] [sS][sS][aA] [sS][sS][fF] [sS][tT][lL] [sS][uU][bB] [tT][t][mM][lL] [tT][t][xX][tT] [vV][tT][t] +# Documents +@{document_ext} = [aA][dD][xX] # adx +@{document_ext} += [cC][dD][fF] # cdf +@{document_ext} += [dD][oO][cC] # doc +@{document_ext} += [dD][oO][cC][mM] # docm +@{document_ext} += [dD][oO][cC][xX] # docx +@{document_ext} += [dD][oO][tT] # dot +@{document_ext} += [dD][oO][tT][xX] # dotx +@{document_ext} += [fF][nN][iI] # fni +@{document_ext} += [fF][oO][dD][gG] # fodg +@{document_ext} += [fF][oO][dD][pP] # fodp +@{document_ext} += [fF][oO][dD][sS] # fods +@{document_ext} += [fF][oO][dD][tT] # fodt +@{document_ext} += [iI][nN][fF][oO] # info +@{document_ext} += [lL][aA][tT][eE][xX] # latex +@{document_ext} += [mM][dD][iI] # mdi +@{document_ext} += [oO][dD][bB] # odb +@{document_ext} += [oO][dD][cC] # odc +@{document_ext} += [oO][dD][fF] # odf +@{document_ext} += [oO][dD][gG] # odg +@{document_ext} += [oO][dD][iI] # odi +@{document_ext} += [oO][dD][mM] # odm +@{document_ext} += [oO][dD][pP] # odp +@{document_ext} += [oO][dD][sS] # ods +@{document_ext} += [oO][dD][tT] # odt +@{document_ext} += [oO][tT][cC] # otc +@{document_ext} += [oO][tT][fF] # otf +@{document_ext} += [oO][tT][gG] # otg +@{document_ext} += [oO][tT][hH] # oth +@{document_ext} += [oO][tT][iI] # oti +@{document_ext} += [oO][tT][pP] # otp +@{document_ext} += [oO][tT][sS] # ots +@{document_ext} += [oO][tT][tT] # ott +@{document_ext} += [oO][xX][tT] # oxt +@{document_ext} += [pP][aA][gG][eE][sS] # pages +@{document_ext} += [pP][dD][fF] # pdf +@{document_ext} += [pP][pP][tT][sS] # ppts +@{document_ext} += [pP][pP][tT][xX] # pptx +@{document_ext} += [sS][tT][cC] # stc +@{document_ext} += [sS][tT][dD] # std +@{document_ext} += [sS][tT][iI] # sti +@{document_ext} += [sS][tT][wW] # stw +@{document_ext} += [sS][xX][cC] # sxc +@{document_ext} += [sS][xX][dD] # sxd +@{document_ext} += [sS][xX][gG][sS][xX][iI] # sxgsxi +@{document_ext} += [sS][xX][mM] # sxm +@{document_ext} += [sS][xX][wW] # sxw +@{document_ext} += [tT][eE][xX] # tex +@{document_ext} += [tT][eE][xX][iI] # texi +@{document_ext} += [tT][eE][xX][iI][nN][fF][oO] # texinfo +@{document_ext} += [xX][lL][sS] # xls +@{document_ext} += [xX][lL][sS][bB] # xlsb +@{document_ext} += [xX][lL][sS][mM] # xlsm +@{document_ext} += [xX][lL][sS][xX] # xlsx +@{document_ext} += [xX][oO][dD][pP] # xodp +@{document_ext} += [xX][oO][dD][sS] # xods +@{document_ext} += [xX][oO][dD][tT] # xodt +@{document_ext} += [xX][oO][tT][pP] # xotp +@{document_ext} += [xX][oO][tT][sS] # xots +@{document_ext} += [xX][oO][tT][tT] # xott +@{document_ext} += [xX][pP][sS] # xps -# exr avci avcs avif hif bmp dib cgm drle dpx emf fits fit fts heic heics heif heifs hej2 hsj2 gif ief jls jp2 jpg2 jph jhc jpg jpeg jpe jfif jpm jpgm jpx jpf jxl jxr jxra jxrs jxs jxsc jxsi jxss ktx ktx2 png btif btf pti svg svgz t38 tiff tif tfx psd psdc azv uvi uvvi uvg uvvg djvu djv dwg dxf fbs fpx fst mmr rlc pgb ico apng mdi b16 hdr rgbe xyze spng spn s1n sgif sgi s1g sjpg sjp s1j tap vtf wbmp xif pcx wmf webp ras pnm pbm pgm ppm rgb tga xcf xbm xpm xwd - -@{image_ext} = [eE][xX][rR] [aA][vV][cC][iI] [aA][vV][cC][sS] [aA][vV][iI][fF] [hH][iI][fF] [bB][mM][pP] [dD][iI][bB] [cC][gG][mM] [dD][rR][lL][eE] [dD][pP][xX] [eE][mM][fF] [fF][iI][tT][sS] [fF][iI][tT] [fF][tT][sS] [hH][eE][iI][cC] [hH][eE][iI][cC][sS][hH][eE][iI][fF] [hH][eE][iI][fF][sS] [hH][eE][jJ]2 [hH][sS][jJ]2 [gG][iI][fF] [iE][eE][fF] [jJ][lL][sS] [jJ][pP]2 [jJ][pP][gG]2 [jJ][pP][hH] [jJ][hH][cC] [jJ][pP][gG] [jJ][pP][eE][gG] [jJ][fF][iI][fF] [jJ][pP][mM] [jJ][pP][gG][mM] [jJ][pP][xX] [jJ][pP][fF] [jJ][xX][lL] [jJ][xX][rR] [jJ][xX][rR][aA] [jJ][xX][rR][sS] [jJ][xX][sS][cC] [jJ][xX][sS][iI] [jJ][xX][sS][sS] [kK][tT][xX] [kK][tT][xX]2 [pP][nN][gG] [bB][tT][iI][fF] [bB][tT][fF] [pP][tT][iI] [sS][vV][gG] [sS][vV][gG][zZ] [tT]38 [tT][iI][fF][fF] [tT][iI][fF] [pP][sS][dD] [pP][sS][dD][cC] [aA][zZ][vV] [uU][vV][iI] [uU][vV][vV][iI] [uU][vV][gG] [uU][vV][vV][gG] [dD][jJ][vV][uU] [dD][jJ][vV] [dD][wW][gG] [dD][xX][fF] [fF][bB][sS] [fF][pP][xX] [fF][sS][tT] [mM][mM][rR] [rR][lL][cC] [pP][gG][bB] [iI][cC][oO] [aA][pP][nN][gG] [mM][dD][iI] [bB]16 [hH][dD][rR] [rR][gG][bB][eE] [xX][yY][zZ][eE] [sS][pP][nN][gG] [sS][pP][nN] [sS]1[nN] [sS][gG][iI] [sS][gG]1[gG] [sS][jJ][pP][gG] [sS][jJ][pP] [sS]1[jJ] [tT][aA][pP] [vV][bB][mM] [xX][iI][fF] [pP][cC][xX] [wW][mM][fF] [wW][eE][bB][pP] [rR][aA][sS] [pP][nN][mM] [pP][bB][mM] [pP][gG][mM] [pP][pP][mM] [rR][gG][bB] [tT][gG][aA] [xX][cC][fF] [xX][bB][mM] [xX][pP][mM] [xX][wW][dD] - -# glb gltf jt igs iges msh mesh silo mtl obj stpx stpxz stl u3d bary cld dae dwf gld gsm win dor lmp rsm msm ism gtw moml mts ogex x_b xmt_bin x_t xmt_txt pyo pyox vds usda usdz bsp vtu wrl vrml x3db x3dv x3dvz - -@{model_ext} = [gG][lL][bB] [gG][lL][tT][fF] [jJ][tT] [iI][gG][sS] [iI][gG][eE][sS] [mM][sS][hH] [mM][eE][sS][hH] [sS][iI][lL][oO] [mM][tT][lL] [oO][bB][jJ] [sS][tT][pP][xX] [sS][tT][pP][xX][zZ] [sS][tT][lL] [uU]3[dD] [bB][aA][rR][yY] [cC][lL][dD] [dD][aA][eE] [dD][wW][fF] [gG][lL][dD] [gG][sS][mM] [wW][iI][nN] [dD][oO][rR] [lL][mM][pP] [rR][sS][mM] [mM][sS][mM] [iI][sS][mM] [gG][tT][wW] [mM][oO][mM][lL] [mM][tT][sS] [oO][gG][eE][xX] [xX]_[bB] [xX][mM][tT]_[bB][iI][nN] [xX]_[tT] [xX][mM][tT]_[tT][xX][tT] [pP][yY][oO] [pP][yY][oO][xX] [vV][dD][sS] [uU][sS][dD][aA] [uU][sS][dD][zZ] [bB][sS][pP] [vV][tT][uU] [wW][rR][lL] [vV][rR][mM][lL] [xX]3[dD][bB] [xX]3[dD][vV] [xX]3[dD][vV][zZ] - -# ttc ttf otf woff woff2 - -@{font_ext} = [tT][tT][cC] [tT][tT][fF] [oO][tT][fF] [wW][oO][fF] [wW][oO][fF]2 - -# adx cdf doc docm docx dot dotx fni fodg fodp fods fodt info mdi odb odc odf odg odi odm odp ods odt otc otf otg oth oti otp ots ott oxt pages pdf stc std sti stw sxc sxd sxgsxi sxm sxw xps xodt xott xodp xotp xods xots pptx ppts xls xlsb xlsm xlsx tex texinfo texi latex - -@{document_ext} = [aA][dD][xX] [cC][dD][fF] [dD][oO][cC] [dD][oO][cC][mM] [dD][oO][cC][xX] [dD][oO][tT] [dD][oO][tT][xX] [fF][nN][iI] [fF][oO][dD][gG] [fF][oO][dD][pP] [fF][oO][dD][sS] [fF][oO][dD][tT] [iI][nN][fF][oO] [mM][dD][iI] [oO][dD][bB] [oO][dD][cC] [oO][dD][fF] [oO][dD][gG] [oO][dD][iI] [oO][dD][mM] [oO][dD][pP] [oO][dD][sS] [oO][dD][tT] [oO][tT][cC] [oO][tT][fF] [oO][tT][gG] [oO][tT][hH] [oO][tT][iI] [oO][tT][pP] [oO][tT][sS] [oO][tT][tT] [oO][xX][tT] [pP][aA][gG][eE][sS] [pP][dD][fF] [sS][tT][cC] [sS][tT][dD] [sS][tT][iI] [sS][tT][wW] [sS][xX][cC] [sS][xX][dD] [sS][xX][gG][sS][xX][iI] [sS][xX][mM] [sS][xX][wW] [xX][pP][sS] [xX][oO][dD][tT] [xX][oO][tT][tT] [xX][oO][dD][pP] [xX][oO][tT][pP] [xX][oO][dD][sS] [xX][oO][tT][sS] [pP][pP][tT][xX] [pP][pP][tT][sS] [xX][lL][sS] [xX][lL][sS][bB] [xX][lL][sS][mM] [xX][lL][sS][xX] [tT][eE][xX] [tT][eE][xX][iI][nN][fF][oO] [tT][eE][xX][iI] [lL][aA][tT][eE][xX] - -# appcache manifest ics ifb cql css csv csvs soa zone gff3 html htm js mjs cnd markdown md miz n3 txt asc text pm el c h cc hh cxx hxx f90 conf log provn rst tag dsc rtx sgml sgm shaclc shc shex spdx tsv t tr roff ttl uris uri vcf vcard a abc ascii copyright dms sub jtd vfk ged flt fly flx gv dot hans hgl 3dml 3dm spot spo mpf ccc mc2 uric jad sos ts si sl wml wmls vtt wgsl xml xsd rng ent sandboxed pod etx - -@{text_ext} = [aA][pP][pP][cC][aA][cC][hH][eE] [mM][aA][nN][iI][fF][eE][sS][tT] [iI][cC][sS] [iI][fF][bB] [cC][qQ][lL] [cC][sS][sS] [cC][sS][vV] [cC][sS][vV][sS] [sS][oO][aA] [zZ][oO][nN][eE] [gG][fF][fF]3 [hH][tT][mM][lL] [hH][tT][mM] [jJ][sS] [mM][jJ][sS] [cC][nN][dD] [mM][aA][rR][kK][dD][oO][wW][nN] [mM][dD] [mM][iI][zZ] [nN]3 [tT][xX][tT] [aA][sS][cC] [tT][eE][xX][tT] [pP][mM] [eE][lL] [cC] [hH] [cC][cC] [hH][hH] [cC][xX][xX] [hH][xX][xX] [fF]90 [cC][oO][nN][fF] [lL][oO][gG] [pP][rR][oO][vV][nN] [rR][sS][tT] [tT][aA][gG] [dD][sS][cC] [rR][tT][xX] [sS][gG][mM][lL] [sS][gG][mM] [sS][hH][aA][cC][lL][cC] [sS][hH][cC] [sS][hH][eE][xX] [sS][pP][dD][xX] [tT][sS][vV] [tT] [tT][rR] [rR][oO][fF][fF] [tT][tT][lL] [uU][rR][iI][sS] [uU][rR][iI] [vV][cC][fF] [vV][cC][aA][rR][dD] [aA] [aA][bB][cC] [aA][sS][cC][iI][iI] [cC][oO][pP][yY][rR][iI][gG][hH][tT] [dD][mM][sS] [sS][uU][bB] [jJ][tT][dD] [vV][fF][kK] [gG][eE][dD] [fF][lL][tT] [fF][lL][yY] [fF][lL][xX] [gG][vV] [dD][oO][tT] [hH][aA][nN][sS] [hH][gG][lL] 3[dD][mM][lL] 3[dD][mM] [sS][pP][oO][tT] [sS][pP][oO] [mM][pP][fF] [cC][cC][cC] [mM][cC]2 [uU][rR][iI][cC] [jJ][aA][dD] [sS][oO][sS] [tT][sS] [sS][iI] [sS][lL] [wW][mM][lL] [wW][mM][lL][sS] [vV][tT][tT] [wW][gG][sS][lL] [xX][mM][lL] [xX][sS][dD] [rR][nN][gG] [eE][nN][tT] [sS][aA][nN][dD][bB][oO][xX][eE][dD] [pP][oO][dD] [eE][tT][xX] +# Texts +@{text_ext} = [aA][pP][pP][cC][aA][cC][hH][eE] # appcache +@{text_ext} += [aA] # a +@{text_ext} += [aA][bB][cC] # abc +@{text_ext} += [aA][sS][cC] # asc +@{text_ext} += [aA][sS][cC][iI][iI] # ascii +@{text_ext} += [cC] # c +@{text_ext} += [cC][cC] # cc +@{text_ext} += [cC][cC][cC] # ccc +@{text_ext} += [cC][nN][dD] # cnd +@{text_ext} += [cC][oO][nN][fF] # conf +@{text_ext} += [cC][oO][pP][yY][rR][iI][gG][hH][tT] # copyright +@{text_ext} += [cC][qQ][lL] # cql +@{text_ext} += [cC][sS][sS] # css +@{text_ext} += [cC][sS][vV] # csv +@{text_ext} += [cC][sS][vV][sS] # csvs +@{text_ext} += [cC][xX][xX] # cxx +@{text_ext} += [dD][mM][sS] # dms +@{text_ext} += [dD][oO][tT] # dot +@{text_ext} += [dD][sS][cC] # dsc +@{text_ext} += [eE][lL] # el +@{text_ext} += [eE][nN][tT] # ent +@{text_ext} += [eE][tT][xX] # etx +@{text_ext} += [fF][lL][tT] # flt +@{text_ext} += [fF][lL][xX] # flx +@{text_ext} += [fF][lL][yY] # fly +@{text_ext} += [fF]90 # f90 +@{text_ext} += [gG][eE][dD] # ged +@{text_ext} += [gG][fF][fF]3 # gff3 +@{text_ext} += [gG][vV] # gv +@{text_ext} += [hH] # h +@{text_ext} += [hH][aA][nN][sS] # hans +@{text_ext} += [hH][gG][lL] # hgl +@{text_ext} += [hH][hH] # hh +@{text_ext} += [hH][tT][mM] # htm +@{text_ext} += [hH][tT][mM][lL] # html +@{text_ext} += [hH][xX][xX] # hxx +@{text_ext} += [iI][cC][sS] # ics +@{text_ext} += [iI][fF][bB] # ifb +@{text_ext} += [jJ][aA][dD] # jad +@{text_ext} += [jJ][sS] # js +@{text_ext} += [jJ][tT][dD] # jtd +@{text_ext} += [lL][oO][gG] # log +@{text_ext} += [mM][aA][nN][iI][fF][eE][sS][tT] # manifest +@{text_ext} += [mM][aA][rR][kK][dD][oO][wW][nN] # markdown +@{text_ext} += [mM][cC]2 # mc2 +@{text_ext} += [mM][dD] # md +@{text_ext} += [mM][iI][zZ] # miz +@{text_ext} += [mM][jJ][sS] # mjs +@{text_ext} += [mM][pP][fF] # mpf +@{text_ext} += [nN]3 # n3 +@{text_ext} += [pP][mM] # pm +@{text_ext} += [pP][oO][dD] # pod +@{text_ext} += [pP][rR][oO][vV][nN] # provn +@{text_ext} += [rR][nN][gG] # rng +@{text_ext} += [rR][oO][fF][fF] # roff +@{text_ext} += [rR][sS][tT] # rst +@{text_ext} += [rR][tT][xX] # rtx +@{text_ext} += [sS][aA][nN][dD][bB][oO][xX][eE][dD] # sandboxed +@{text_ext} += [sS][gG][mM] # sgm +@{text_ext} += [sS][gG][mM][lL] # sgml +@{text_ext} += [sS][hH][aA][cC][lL][cC] # shaclc +@{text_ext} += [sS][hH][cC] # shc +@{text_ext} += [sS][hH][eE][xX] # shex +@{text_ext} += [sS][iI] # si +@{text_ext} += [sS][lL] # sl +@{text_ext} += [sS][oO][aA] # soa +@{text_ext} += [sS][oO][sS] # sos +@{text_ext} += [sS][pP][dD][xX] # spdx +@{text_ext} += [sS][pP][oO] # spo +@{text_ext} += [sS][pP][oO][tT] # spot +@{text_ext} += [sS][uU][bB] # sub +@{text_ext} += [tT] # t +@{text_ext} += [tT][aA][gG] # tag +@{text_ext} += [tT][eE][xX][tT] # text +@{text_ext} += [tT][rR] # tr +@{text_ext} += [tT][sS] # ts +@{text_ext} += [tT][sS][vV] # tsv +@{text_ext} += [tT][tT][lL] # ttl +@{text_ext} += [tT][xX][tT] # txt +@{text_ext} += [uU][rR][iI] # uri +@{text_ext} += [uU][rR][iI][cC] # uric +@{text_ext} += [uU][rR][iI][sS] # uris +@{text_ext} += [vV][cC][aA][rR][dD] # vcard +@{text_ext} += [vV][cC][fF] # vcf +@{text_ext} += [vV][fF][kK] # vfk +@{text_ext} += [vV][tT][tT] # vtt +@{text_ext} += [wW][gG][sS][lL] # wgsl +@{text_ext} += [wW][mM][lL] # wml +@{text_ext} += [wW][mM][lL][sS] # wmls +@{text_ext} += [xX][mM][lL] # xml +@{text_ext} += [xX][sS][dD] # xsd +@{text_ext} += [zZ][oO][nN][eE] # zone +@{text_ext} += 3[dD][mM] # 3dm +@{text_ext} += 3[dD][mM][lL] # 3dml # vim:syntax=apparmor From c59086311bf0c9f021aa0c2107c509add0f24ce2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 19 Oct 2024 22:50:09 +0100 Subject: [PATCH 0372/1455] tests: rewrite the way to generate integration tests. --- go.mod | 1 - tests/cmd/main.go | 177 +++++++---------------------- tests/cmd/tests.go | 111 ++++++++++++++++++ tests/{integration => cmd}/tldr.go | 85 +++++++++++--- tests/integration/paths.go | 72 ------------ tests/integration/scenario.go | 141 ----------------------- tests/integration/suite.go | 114 ------------------- 7 files changed, 217 insertions(+), 484 deletions(-) create mode 100644 tests/cmd/tests.go rename tests/{integration => cmd}/tldr.go (52%) delete mode 100644 tests/integration/paths.go delete mode 100644 tests/integration/scenario.go delete mode 100644 tests/integration/suite.go diff --git a/go.mod b/go.mod index bec7213d7..085850645 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,6 @@ go 1.21 require ( github.com/stretchr/testify v1.9.0 - gopkg.in/yaml.v3 v3.0.1 ) require ( diff --git a/tests/cmd/main.go b/tests/cmd/main.go index b549aab34..19dd1cf0d 100644 --- a/tests/cmd/main.go +++ b/tests/cmd/main.go @@ -8,171 +8,76 @@ import ( "flag" "fmt" "os" - "os/exec" - "strings" - "github.com/roddhjav/apparmor.d/pkg/aa" "github.com/roddhjav/apparmor.d/pkg/logging" "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/tests/integration" ) -const usage = `aa-test [-h] [--bootstrap | --run | --list] +const usage = `aa-test [-h] --bootstrap Integration tests manager tool for apparmor.d Options: -h, --help Show this help message and exit. - -b, --bootstrap Bootstrap tests using tldr pages. - -r, --run Run a predefined list of tests. - -l, --list List the configured tests. - -f, --file FILE Set a tests file. Default: tests/tests.yml - -d, --deps Install tests dependencies. - -D, --dryrun Do not do the action, list it. + -b, --bootstrap Download tests using tldr pages and generate Bats tests. ` var ( help bool bootstrap bool - run bool - list bool - deps bool - dryRun bool - cfg Config ) -type Config struct { - TldrDir *paths.Path // Default: tests/tldr - ScenariosDir *paths.Path // Default: tests - TldrFile *paths.Path // Default: tests/tldr.yml - TestsFile *paths.Path // Default: tests/tests.yml - SettingsFile *paths.Path // Default: tests/settings.yml - Profiles paths.PathList // List of profiles -} - -func NewConfig() Config { - cfg := Config{ - TldrDir: paths.New("tests/tldr"), - ScenariosDir: paths.New("tests/"), - Profiles: paths.PathList{}, - } - cfg.TldrFile = cfg.ScenariosDir.Join("tldr.yml") - cfg.TestsFile = cfg.ScenariosDir.Join("tests.yml") - cfg.SettingsFile = cfg.ScenariosDir.Join("settings.yml") - return cfg -} - -func LoadTestSuite() (*integration.TestSuite, error) { - tSuite := integration.NewTestSuite() - if err := tSuite.ReadTests(cfg.TestsFile); err != nil { - return tSuite, err - } - if err := tSuite.ReadSettings(cfg.SettingsFile); err != nil { - return tSuite, err - } - return tSuite, nil -} - func init() { - cfg = NewConfig() - files, _ := aa.MagicRoot.ReadDir(paths.FilterOutDirectories()) - for _, path := range files { - cfg.Profiles.Add(path) - } - flag.BoolVar(&help, "h", false, "Show this help message and exit.") flag.BoolVar(&help, "help", false, "Show this help message and exit.") - flag.BoolVar(&bootstrap, "b", false, "Bootstrap tests using tldr pages.") - flag.BoolVar(&bootstrap, "bootstrap", false, "Bootstrap tests using tldr pages.") - flag.BoolVar(&run, "r", false, "Run a predefined list of tests.") - flag.BoolVar(&run, "run", false, "Run a predefined list of tests.") - flag.BoolVar(&list, "l", false, "List the tests to run.") - flag.BoolVar(&list, "list", false, "List the tests to run.") - flag.BoolVar(&deps, "d", false, "Install tests dependencies.") - flag.BoolVar(&deps, "deps", false, "Install tests dependencies.") - flag.BoolVar(&dryRun, "D", false, "Do not do the action, list it.") - flag.BoolVar(&dryRun, "dryrun", false, "Do not do the action, list it.") + flag.BoolVar(&bootstrap, "b", false, "Download tests using tldr pages and generate Bats tests.") + flag.BoolVar(&bootstrap, "bootstrap", false, "Download tests using tldr pages and generate Bats tests.") } -func testDownload() error { - tldr := integration.NewTldr(cfg.TldrDir) +type Config struct { + TestsDir *paths.Path // Default: tests + TldrDir *paths.Path // Default: tests/tldr + TldrFile *paths.Path // Default: tests/tldr.yml + TestsFile *paths.Path // Default: tests/tests.yml + BatsDir *paths.Path // Default: tests/bats +} + +func NewConfig() *Config { + testsDir := paths.New("tests") + cfg := Config{ + TestsDir: testsDir, + TldrDir: testsDir.Join("tldr"), + TldrFile: testsDir.Join("tldr.yml"), + TestsFile: testsDir.Join("tldr.yml"), + BatsDir: testsDir.Join("bats_dirty"), + } + return &cfg +} + +func run() error { + logging.Step("Bootstraping tests") + cfg := NewConfig() + + tldr := NewTldr(cfg.TldrDir) if err := tldr.Download(); err != nil { return err } - tSuite, err := tldr.Parse() + tests, err := tldr.Parse() if err != nil { return err } + tests = tests.Filter() - // Default bootstraped scenarios file - if err := tSuite.Write(cfg.TldrFile); err != nil { - return err - } - logging.Bullet("Default scenarios saved: %s", cfg.TldrFile) - logging.Bullet("Number of tests found %d", len(tSuite.Tests)) - return nil -} - -func testDeps(dryRun bool) error { - tSuite, err := LoadTestSuite() - if err != nil { - return nil - } - - deps := tSuite.GetDependencies() - switch prebuild.Distribution { - case "arch": - arg := []string{"pacman", "-Sy", "--noconfirm"} - arg = append(arg, deps...) - cmd := exec.Command("sudo", arg...) - cmd.Stdout = os.Stdout - cmd.Stderr = os.Stderr - if dryRun { - fmt.Println(strings.Join(cmd.Args, " ")) - } else { - return cmd.Run() - } - default: - } - return nil -} - -func testRun(dryRun bool) error { - // Warning: There is no guarantee that the tests are not destructive - if dryRun { - logging.Step("List tests") - } else { - logging.Step("Run tests") - } - - tSuite, err := LoadTestSuite() - if err != nil { - return nil - } - integration.Arguments = tSuite.Arguments - integration.Ignore = tSuite.Ignore - integration.Profiles = cfg.Profiles - nbCmd := 0 - nbTest := 0 - for _, test := range tSuite.Tests { - ran, nb, err := test.Run(dryRun) - nbTest += ran - nbCmd += nb - if err != nil { + for _, test := range tests { + if err := test.Write(cfg.BatsDir); err != nil { return err } } - if dryRun { - logging.Bullet("Number of tests to run %d", nbTest) - logging.Bullet("Number of test commands to run %d", nbCmd) - } else { - logging.Success("Number of tests ran %d", nbTest) - logging.Success("Number of test command to ran %d", nbCmd) - } + logging.Bullet("Bats tests directory: %s", cfg.BatsDir) + logging.Bullet("Number of tests found %d", len(tests)) return nil } @@ -184,18 +89,12 @@ func main() { os.Exit(0) } - var err error - if bootstrap { - logging.Step("Bootstraping tests") - err = testDownload() - } else if run || list { - err = testRun(list) - } else if deps { - err = testDeps(dryRun) - } else { + if !bootstrap { flag.Usage() os.Exit(1) } + + err := run() if err != nil { logging.Fatal("%s", err.Error()) } diff --git a/tests/cmd/tests.go b/tests/cmd/tests.go new file mode 100644 index 000000000..d145fbb07 --- /dev/null +++ b/tests/cmd/tests.go @@ -0,0 +1,111 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2023-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package main + +import ( + "html/template" + "os/exec" + "slices" + "strings" + + "github.com/roddhjav/apparmor.d/pkg/aa" + "github.com/roddhjav/apparmor.d/pkg/paths" +) + +const tmplTest = `#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only +{{ $name := .Name -}} +{{ range .Commands }} +# bats test_tags={{ $name }} +@test "{{ $name }}: {{ .Description }}" { + {{ .Cmd }} +} +{{ end }} +` + +var ( + Profiles = getProfiles() // List of profiles in apparmor.d + tmpl = template.Must(template.New("bats").Parse(tmplTest)) +) + +type Tests []Test + +// Filter returns a new list of tests with only the ones that have a profile +func (t Tests) Filter() Tests { + for i := len(t) - 1; i >= 0; i-- { + if !t[i].HasProfile() { + t = slices.Delete(t, i, i+1) + } + } + return t +} + +// Test represents of a list of tests for a given program +type Test struct { + Name string + Commands []Command +} + +// Command is a command line to run as part of a test +type Command struct { + Description string + Cmd string +} + +func NewTest() *Test { + return &Test{ + Name: "", + Commands: []Command{}, + } +} + +// HasProfile returns true if the program in the scenario is profiled in apparmor.d +func (t *Test) HasProfile() bool { + return slices.Contains(Profiles, t.Name) +} + +// IsInstalled returns true if the program in the scenario is installed on the system +func (t *Test) IsInstalled() bool { + if _, err := exec.LookPath(t.Name); err != nil { + return false + } + return true +} + +func (t Test) Write(dir *paths.Path) error { + if !t.HasProfile() { + return nil + } + + path := dir.Join(t.Name + ".bats") + content := renderBatsFile(t) + if err := path.WriteFile([]byte(content)); err != nil { + return err + } + return nil +} + +func renderBatsFile(data any) string { + var res strings.Builder + err := tmpl.Execute(&res, data) + if err != nil { + panic(err) + } + return res.String() +} + +func getProfiles() []string { + p := []string{} + files, err := aa.MagicRoot.ReadDir(paths.FilterOutDirectories()) + if err != nil { + panic(err) + } + for _, path := range files { + p = append(p, path.Base()) + } + return p +} diff --git a/tests/integration/tldr.go b/tests/cmd/tldr.go similarity index 52% rename from tests/integration/tldr.go rename to tests/cmd/tldr.go index fb879d15e..d86c80565 100644 --- a/tests/integration/tldr.go +++ b/tests/cmd/tldr.go @@ -2,12 +2,15 @@ // Copyright (C) 2023-2024 Alexandre Pujol // SPDX-License-Identifier: GPL-2.0-only -package integration +package main import ( + "archive/tar" + "compress/gzip" "fmt" "io" "net/http" + "path/filepath" "strings" "github.com/roddhjav/apparmor.d/pkg/paths" @@ -51,9 +54,9 @@ func (t Tldr) Download() error { return extratTo(gzPath, t.Dir, pages) } -// Parse the tldr pages and return a list of scenarios -func (t Tldr) Parse() (*TestSuite, error) { - testSuite := NewTestSuite() +// Parse the tldr pages and return a list of tests +func (t Tldr) Parse() (Tests, error) { + tests := make(Tests, 0) files, _ := t.Dir.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories()) for _, path := range files { content, err := path.ReadFile() @@ -61,29 +64,77 @@ func (t Tldr) Parse() (*TestSuite, error) { return nil, err } raw := string(content) - t := &Test{ - Name: strings.TrimSuffix(path.Base(), ".md"), - Root: false, - Arguments: map[string]string{}, - Commands: []Command{}, - } - if strings.Contains(raw, "sudo") { - t.Root = true + t := Test{ + Name: strings.TrimSuffix(path.Base(), ".md"), + Commands: []Command{}, } rawTests := strings.Split(raw, "\n-")[1:] for _, test := range rawTests { res := strings.Split(test, "\n") dsc := strings.ReplaceAll(strings.Trim(res[0], " "), ":", "") cmd := strings.Trim(strings.Trim(res[2], "`"), " ") - if t.Root { - cmd = strings.ReplaceAll(cmd, "sudo ", "") - } t.Commands = append(t.Commands, Command{ Description: dsc, Cmd: cmd, }) } - testSuite.Tests = append(testSuite.Tests, *t) + tests = append(tests, t) } - return testSuite, nil + return tests, nil +} + +// Either or not to extract the file +func toExtrat(name string, subfolders []string) bool { + for _, subfolder := range subfolders { + if strings.HasPrefix(name, subfolder) { + return true + } + } + return false +} + +// Extract part of an archive to a destination directory +func extratTo(src *paths.Path, dst *paths.Path, subfolders []string) error { + gzIn, err := src.Open() + if err != nil { + return fmt.Errorf("opening %s: %w", src, err) + } + defer gzIn.Close() + + in, err := gzip.NewReader(gzIn) + if err != nil { + return fmt.Errorf("decoding %s: %w", src, err) + } + defer in.Close() + + if err := dst.MkdirAll(); err != nil { + return fmt.Errorf("creating %s: %w", src, err) + } + + tarIn := tar.NewReader(in) + for { + header, err := tarIn.Next() + if err == io.EOF { + break + } + if err != nil { + return err + } + + if header.Typeflag == tar.TypeReg { + if !toExtrat(header.Name, subfolders) { + continue + } + path := dst.Join(filepath.Base(header.Name)) + file, err := path.Create() + if err != nil { + return fmt.Errorf("creating %s: %w", file.Name(), err) + } + if _, err := io.Copy(file, tarIn); err != nil { + return fmt.Errorf("extracting %s: %w", file.Name(), err) + } + file.Close() + } + } + return nil } diff --git a/tests/integration/paths.go b/tests/integration/paths.go deleted file mode 100644 index 8d4a1cc9c..000000000 --- a/tests/integration/paths.go +++ /dev/null @@ -1,72 +0,0 @@ -// apparmor.d - Full set of apparmor profiles -// Copyright (C) 2023-2024 Alexandre Pujol -// SPDX-License-Identifier: GPL-2.0-only - -package integration - -import ( - "archive/tar" - "compress/gzip" - "fmt" - "io" - "path/filepath" - "strings" - - "github.com/roddhjav/apparmor.d/pkg/paths" -) - -// Either or not to extract the file -func toExtrat(name string, subfolders []string) bool { - for _, subfolder := range subfolders { - if strings.HasPrefix(name, subfolder) { - return true - } - } - return false -} - -// Extract part of an archive to a destination directory -func extratTo(src *paths.Path, dst *paths.Path, subfolders []string) error { - gzIn, err := src.Open() - if err != nil { - return fmt.Errorf("opening %s: %w", src, err) - } - defer gzIn.Close() - - in, err := gzip.NewReader(gzIn) - if err != nil { - return fmt.Errorf("decoding %s: %w", src, err) - } - defer in.Close() - - if err := dst.MkdirAll(); err != nil { - return fmt.Errorf("creating %s: %w", src, err) - } - - tarIn := tar.NewReader(in) - for { - header, err := tarIn.Next() - if err == io.EOF { - break - } - if err != nil { - return err - } - - if header.Typeflag == tar.TypeReg { - if !toExtrat(header.Name, subfolders) { - continue - } - path := dst.Join(filepath.Base(header.Name)) - file, err := path.Create() - if err != nil { - return fmt.Errorf("creating %s: %w", file.Name(), err) - } - if _, err := io.Copy(file, tarIn); err != nil { - return fmt.Errorf("extracting %s: %w", file.Name(), err) - } - file.Close() - } - } - return nil -} diff --git a/tests/integration/scenario.go b/tests/integration/scenario.go deleted file mode 100644 index 94e9a728f..000000000 --- a/tests/integration/scenario.go +++ /dev/null @@ -1,141 +0,0 @@ -// apparmor.d - Full set of apparmor profiles -// Copyright (C) 2023-2024 Alexandre Pujol -// SPDX-License-Identifier: GPL-2.0-only - -// TODO: -// - Finish templating -// - Provide a large selection of resources: files, disks, http server... for automatic test on them -// - Expand support for interactive program (stdin and Control-D) -// - Properlly log the test result -// - Dbus integration - -package integration - -import ( - "bytes" - "fmt" - "io" - "os/exec" - "strings" - - "github.com/roddhjav/apparmor.d/pkg/logging" - "github.com/roddhjav/apparmor.d/pkg/paths" -) - -var ( - Ignore []string // Do not run some scenarios - Arguments map[string]string // Common arguments used across all scenarios - Profiles paths.PathList // List of profiles in apparmor.d -) - -// Test represents of a list of tests for a given program -type Test struct { - Name string `yaml:"name"` - Root bool `yaml:"root"` // Run the test as user or as root - Dependencies []string `yaml:"require"` // Packages required for the tests to run "$(pacman -Qqo Scenario.Name)" - Arguments map[string]string `yaml:"arguments"` // Arguments to pass to the program, specific to this scenario - Commands []Command `yaml:"tests"` -} - -// Command is a command line to run as part of a test -type Command struct { - Description string `yaml:"dsc"` - Cmd string `yaml:"cmd"` - Stdin []string `yaml:"stdin"` -} - -func NewTest() *Test { - return &Test{ - Name: "", - Root: false, - Dependencies: []string{}, - Arguments: map[string]string{}, - Commands: []Command{}, - } -} - -// HasProfile returns true if the program in the scenario is profiled in apparmor.d -func (t *Test) HasProfile() bool { - for _, path := range Profiles { - if t.Name == path.Base() { - return true - } - } - return false -} - -// IsInstalled returns true if the program in the scenario is installed on the system -func (t *Test) IsInstalled() bool { - if _, err := exec.LookPath(t.Name); err != nil { - return false - } - return true -} - -func (t *Test) resolve(in string) string { - res := in - for key, value := range t.Arguments { - res = strings.ReplaceAll(res, "{{ "+key+" }}", value) - } - return res -} - -// mergeArguments merge the arguments of the scenario with the global arguments -// Test arguments have priority over global arguments -func (t *Test) mergeArguments(args map[string]string) { - if len(t.Arguments) == 0 { - t.Arguments = map[string]string{} - } - for key, value := range args { - t.Arguments[key] = value - } -} - -// Run the scenarios tests -func (t *Test) Run(dryRun bool) (ran int, nb int, err error) { - nb = 0 - if t.HasProfile() && t.IsInstalled() { - logging.Step("%s", t.Name) - t.mergeArguments(Arguments) - for _, test := range t.Commands { - cmd := t.resolve(test.Cmd) - if !strings.Contains(cmd, "{{") { - nb++ - if dryRun { - logging.Bullet("%s", cmd) - } else { - cmdErr := t.run(cmd, strings.Join(test.Stdin, "\n")) - if cmdErr != nil { - logging.Error("%v", cmdErr) - } else { - logging.Success("%s", cmd) - } - } - } - } - return 1, nb, err - } - return 0, nb, err -} - -func (t *Test) run(cmdline string, in string) error { - var testErr bytes.Buffer - - // Running the command in a shell ensure it does not run confined under the sudo profile. - // The shell is run unconfined and therefore the cmdline can be confined without no-new-privs issue. - sufix := " &" // TODO: we need a goroutine here - cmd := exec.Command("sh", "-c", cmdline+sufix) - if t.Root { - cmd = exec.Command("sudo", "sh", "-c", cmdline+sufix) - } - - stderr := io.MultiWriter(Stderr, &testErr) - cmd.Stdin = strings.NewReader(in) - cmd.Stdout = Stdout - cmd.Stderr = stderr - err := cmd.Run() - if testErr.Len() > 0 { - return fmt.Errorf("%s", testErr.String()) - } - return err -} diff --git a/tests/integration/suite.go b/tests/integration/suite.go deleted file mode 100644 index 26ef24994..000000000 --- a/tests/integration/suite.go +++ /dev/null @@ -1,114 +0,0 @@ -// apparmor.d - Full set of apparmor profiles -// Copyright (C) 2023-2024 Alexandre Pujol -// SPDX-License-Identifier: GPL-2.0-only - -package integration - -import ( - "os" - - "github.com/roddhjav/apparmor.d/pkg/logs" - "github.com/roddhjav/apparmor.d/pkg/paths" - "github.com/roddhjav/apparmor.d/pkg/util" - "gopkg.in/yaml.v3" -) - -var ( - // Integration tests standard output - Stdout *os.File - - // Integration tests standard error output - Stderr *os.File - - stdoutPath = paths.New("tests/out.log") - stderrPath = paths.New("tests/err.log") -) - -// TestSuite is the apparmod.d integration tests to run -type TestSuite struct { - Tests []Test // List of tests to run - Ignore []string // Do not run some tests - Arguments map[string]string // Common arguments used across all tests -} - -// NewScenarios returns a new list of scenarios -func NewTestSuite() *TestSuite { - var err error - Stdout, err = stdoutPath.Create() - if err != nil { - panic(err) - } - Stderr, err = stderrPath.Create() - if err != nil { - panic(err) - } - return &TestSuite{ - Tests: []Test{}, - Ignore: []string{}, - Arguments: map[string]string{}, - } -} - -// Write export the list of scenarios to a file -func (t *TestSuite) Write(path *paths.Path) error { - jsonString, err := yaml.Marshal(&t.Tests) - if err != nil { - return err - } - - path = path.Clean() - file, err := path.Create() - if err != nil { - return err - } - defer file.Close() - - // Cleanup a bit - res := string(jsonString) - regClean := util.ToRegexRepl([]string{ - "- name:", "\n- name:", - `(?m)^.*stdin: \[\].*$`, ``, - `{{`, `{{ `, - `}}`, ` }}`, - }) - res = regClean.Replace(res) - _, err = file.WriteString("---\n" + res) - return err -} - -// ReadTests import the tests from a file -func (t *TestSuite) ReadTests(path *paths.Path) error { - content, _ := path.ReadFile() - return yaml.Unmarshal(content, &t.Tests) -} - -// ReadSettings import the common argument and ignore list from a file -func (t *TestSuite) ReadSettings(path *paths.Path) error { - type temp struct { - Arguments map[string]string `yaml:"arguments"` - Ignore []string `yaml:"ignore"` - } - tmp := temp{} - content, _ := path.ReadFile() - if err := yaml.Unmarshal(content, &tmp); err != nil { - return err - } - t.Arguments = tmp.Arguments - t.Ignore = tmp.Ignore - return nil -} - -// Results returns a sum up of the apparmor logs raised by the scenarios -func (t *TestSuite) Results() string { - file, _ := logs.GetAuditLogs(logs.LogFiles[0]) - aaLogs := logs.New(file, "") - return aaLogs.String() -} - -func (t *TestSuite) GetDependencies() []string { - res := []string{} - for _, test := range t.Tests { - res = append(res, test.Dependencies...) - } - return res -} From 081399a160b0db3b371c593d73fe4ab607ac9cd9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 19 Oct 2024 22:55:17 +0100 Subject: [PATCH 0373/1455] tests: remove tests from the vendored paths module. --- pkg/paths/list_test.go | 169 ------- pkg/paths/paths_test.go | 432 ------------------ pkg/paths/process_test.go | 56 --- pkg/paths/readdir_test.go | 343 -------------- .../testdata/broken_symlink/dir_1/broken_link | 1 - pkg/paths/testdata/broken_symlink/dir_1/file2 | 0 .../testdata/broken_symlink/dir_1/linked_dir | 1 - .../testdata/broken_symlink/dir_1/linked_file | 1 - .../broken_symlink/dir_1/real_dir/file1 | 0 pkg/paths/testdata/delay/.gitignore | 1 - pkg/paths/testdata/delay/main.go | 40 -- pkg/paths/testdata/fileset/anotherFile | 4 - pkg/paths/testdata/fileset/file | 0 pkg/paths/testdata/fileset/folder/.hidden | 0 pkg/paths/testdata/fileset/folder/file2 | 0 pkg/paths/testdata/fileset/folder/file3 | 0 .../testdata/fileset/folder/subfolder/file4 | 0 pkg/paths/testdata/fileset/symlinktofolder | 1 - pkg/paths/testdata/fileset/test.txt | 20 - pkg/paths/testdata/fileset/test.txt.gz | Bin 411 -> 0 bytes pkg/paths/testdata/loops/loop_1/dir1/loop | 1 - pkg/paths/testdata/loops/loop_2/dir1/loop2 | 1 - pkg/paths/testdata/loops/loop_2/dir2/loop1 | 1 - pkg/paths/testdata/loops/loop_3/dir1/loop2 | 1 - .../testdata/loops/loop_3/dir2/dir3/loop2 | 1 - .../testdata/loops/loop_4/dir1/dir2/loop2 | 1 - .../loops/loop_4/dir1/dir3/dir4/loop1 | 1 - pkg/paths/testdata/loops/regular_1/dir1/file1 | 0 pkg/paths/testdata/loops/regular_1/dir2 | 1 - pkg/paths/testdata/loops/regular_2/dir1/file1 | 0 pkg/paths/testdata/loops/regular_2/dir2/dir1 | 1 - pkg/paths/testdata/loops/regular_2/dir2/file2 | 0 pkg/paths/testdata/loops/regular_3/dir1/file1 | 0 pkg/paths/testdata/loops/regular_3/dir2/dir1 | 1 - pkg/paths/testdata/loops/regular_3/dir2/file2 | 0 pkg/paths/testdata/loops/regular_3/link | 1 - .../dir1/file1 | 0 .../regular_4_with_permission_error/dir2/dir1 | 1 - .../dir2/file2 | 0 .../regular_4_with_permission_error/link | 1 - 40 files changed, 1082 deletions(-) delete mode 100644 pkg/paths/list_test.go delete mode 100644 pkg/paths/paths_test.go delete mode 100644 pkg/paths/process_test.go delete mode 100644 pkg/paths/readdir_test.go delete mode 120000 pkg/paths/testdata/broken_symlink/dir_1/broken_link delete mode 100644 pkg/paths/testdata/broken_symlink/dir_1/file2 delete mode 120000 pkg/paths/testdata/broken_symlink/dir_1/linked_dir delete mode 120000 pkg/paths/testdata/broken_symlink/dir_1/linked_file delete mode 100644 pkg/paths/testdata/broken_symlink/dir_1/real_dir/file1 delete mode 100644 pkg/paths/testdata/delay/.gitignore delete mode 100644 pkg/paths/testdata/delay/main.go delete mode 100644 pkg/paths/testdata/fileset/anotherFile delete mode 100644 pkg/paths/testdata/fileset/file delete mode 100644 pkg/paths/testdata/fileset/folder/.hidden delete mode 100644 pkg/paths/testdata/fileset/folder/file2 delete mode 100644 pkg/paths/testdata/fileset/folder/file3 delete mode 100644 pkg/paths/testdata/fileset/folder/subfolder/file4 delete mode 120000 pkg/paths/testdata/fileset/symlinktofolder delete mode 100644 pkg/paths/testdata/fileset/test.txt delete mode 100644 pkg/paths/testdata/fileset/test.txt.gz delete mode 120000 pkg/paths/testdata/loops/loop_1/dir1/loop delete mode 120000 pkg/paths/testdata/loops/loop_2/dir1/loop2 delete mode 120000 pkg/paths/testdata/loops/loop_2/dir2/loop1 delete mode 120000 pkg/paths/testdata/loops/loop_3/dir1/loop2 delete mode 120000 pkg/paths/testdata/loops/loop_3/dir2/dir3/loop2 delete mode 120000 pkg/paths/testdata/loops/loop_4/dir1/dir2/loop2 delete mode 120000 pkg/paths/testdata/loops/loop_4/dir1/dir3/dir4/loop1 delete mode 100644 pkg/paths/testdata/loops/regular_1/dir1/file1 delete mode 120000 pkg/paths/testdata/loops/regular_1/dir2 delete mode 100644 pkg/paths/testdata/loops/regular_2/dir1/file1 delete mode 120000 pkg/paths/testdata/loops/regular_2/dir2/dir1 delete mode 100644 pkg/paths/testdata/loops/regular_2/dir2/file2 delete mode 100644 pkg/paths/testdata/loops/regular_3/dir1/file1 delete mode 120000 pkg/paths/testdata/loops/regular_3/dir2/dir1 delete mode 100644 pkg/paths/testdata/loops/regular_3/dir2/file2 delete mode 120000 pkg/paths/testdata/loops/regular_3/link delete mode 100644 pkg/paths/testdata/loops/regular_4_with_permission_error/dir1/file1 delete mode 120000 pkg/paths/testdata/loops/regular_4_with_permission_error/dir2/dir1 delete mode 100644 pkg/paths/testdata/loops/regular_4_with_permission_error/dir2/file2 delete mode 120000 pkg/paths/testdata/loops/regular_4_with_permission_error/link diff --git a/pkg/paths/list_test.go b/pkg/paths/list_test.go deleted file mode 100644 index eaafc82ce..000000000 --- a/pkg/paths/list_test.go +++ /dev/null @@ -1,169 +0,0 @@ -/* - * This file is part of PathsHelper library. - * - * Copyright 2018 Arduino AG (http://www.arduino.cc/) - * - * PathsHelper library is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As a special exception, you may use this file as part of a free software - * library without restriction. Specifically, if other files instantiate - * templates or use macros or inline functions from this file, or you compile - * this file and link it with other files to produce an executable, this - * file does not by itself cause the resulting executable to be covered by - * the GNU General Public License. This exception does not however - * invalidate any other reasons why the executable file might be covered by - * the GNU General Public License. - */ - -package paths - -import ( - "fmt" - "testing" - - "github.com/stretchr/testify/require" -) - -func TestListConstructors(t *testing.T) { - list0 := NewPathList() - require.Len(t, list0, 0) - - list1 := NewPathList("test") - require.Len(t, list1, 1) - require.Equal(t, "[test]", fmt.Sprintf("%s", list1)) - - list3 := NewPathList("a", "b", "c") - require.Len(t, list3, 3) - require.Equal(t, "[a b c]", fmt.Sprintf("%s", list3)) - - require.False(t, list3.Contains(New("d"))) - require.True(t, list3.Contains(New("a"))) - require.False(t, list3.Contains(New("d/../a"))) - - require.False(t, list3.ContainsEquivalentTo(New("d"))) - require.True(t, list3.ContainsEquivalentTo(New("a"))) - require.True(t, list3.ContainsEquivalentTo(New("d/../a"))) - - list4 := list3.Clone() - require.Equal(t, "[a b c]", fmt.Sprintf("%s", list4)) - list4.AddIfMissing(New("d")) - require.Equal(t, "[a b c d]", fmt.Sprintf("%s", list4)) - list4.AddIfMissing(New("b")) - require.Equal(t, "[a b c d]", fmt.Sprintf("%s", list4)) - list4.AddAllMissing(NewPathList("a", "e", "i", "o", "u")) - require.Equal(t, "[a b c d e i o u]", fmt.Sprintf("%s", list4)) -} - -func TestListSorting(t *testing.T) { - list := NewPathList( - "pointless", - "spare", - "carve", - "unwieldy", - "empty", - "bow", - "tub", - "grease", - "error", - "energetic", - "depend", - "property") - require.Equal(t, "[pointless spare carve unwieldy empty bow tub grease error energetic depend property]", fmt.Sprintf("%s", list)) - list.Sort() - require.Equal(t, "[bow carve depend empty energetic error grease pointless property spare tub unwieldy]", fmt.Sprintf("%s", list)) -} - -func TestListFilters(t *testing.T) { - list := NewPathList( - "aaaa", - "bbbb", - "cccc", - "dddd", - "eeff", - "aaaa/bbbb", - "eeee/ffff", - "gggg/hhhh", - ) - - l1 := list.Clone() - l1.FilterPrefix("a") - require.Equal(t, "[aaaa]", fmt.Sprintf("%s", l1)) - - l2 := list.Clone() - l2.FilterPrefix("b") - require.Equal(t, "[bbbb aaaa/bbbb]", fmt.Sprintf("%s", l2)) - - l3 := list.Clone() - l3.FilterOutPrefix("b") - require.Equal(t, "[aaaa cccc dddd eeff eeee/ffff gggg/hhhh]", fmt.Sprintf("%s", l3)) - - l4 := list.Clone() - l4.FilterPrefix("a", "b") - require.Equal(t, "[aaaa bbbb aaaa/bbbb]", fmt.Sprintf("%s", l4)) - - l5 := list.Clone() - l5.FilterPrefix("test") - require.Equal(t, "[]", fmt.Sprintf("%s", l5)) - - l6 := list.Clone() - l6.FilterOutPrefix("b", "c", "h") - require.Equal(t, "[aaaa dddd eeff eeee/ffff]", fmt.Sprintf("%s", l6)) - - l7 := list.Clone() - l7.FilterSuffix("a") - require.Equal(t, "[aaaa]", fmt.Sprintf("%s", l7)) - - l8 := list.Clone() - l8.FilterSuffix("a", "h") - require.Equal(t, "[aaaa gggg/hhhh]", fmt.Sprintf("%s", l8)) - - l9 := list.Clone() - l9.FilterSuffix("test") - require.Equal(t, "[]", fmt.Sprintf("%s", l9)) - - l10 := list.Clone() - l10.FilterOutSuffix("a") - require.Equal(t, "[bbbb cccc dddd eeff aaaa/bbbb eeee/ffff gggg/hhhh]", fmt.Sprintf("%s", l10)) - - l11 := list.Clone() - l11.FilterOutSuffix("a", "h") - require.Equal(t, "[bbbb cccc dddd eeff aaaa/bbbb eeee/ffff]", fmt.Sprintf("%s", l11)) - - l12 := list.Clone() - l12.FilterOutSuffix("test") - require.Equal(t, "[aaaa bbbb cccc dddd eeff aaaa/bbbb eeee/ffff gggg/hhhh]", fmt.Sprintf("%s", l12)) - - l13 := list.Clone() - l13.FilterOutSuffix() - require.Equal(t, "[aaaa bbbb cccc dddd eeff aaaa/bbbb eeee/ffff gggg/hhhh]", fmt.Sprintf("%s", l13)) - - l14 := list.Clone() - l14.FilterSuffix() - require.Equal(t, "[]", fmt.Sprintf("%s", l14)) - - l15 := list.Clone() - l15.FilterOutPrefix() - require.Equal(t, "[aaaa bbbb cccc dddd eeff aaaa/bbbb eeee/ffff gggg/hhhh]", fmt.Sprintf("%s", l15)) - - l16 := list.Clone() - l16.FilterPrefix() - require.Equal(t, "[]", fmt.Sprintf("%s", l16)) - - l17 := list.Clone() - l17.Filter(func(p *Path) bool { - return p.Base() == "bbbb" - }) - require.Equal(t, "[bbbb aaaa/bbbb]", fmt.Sprintf("%s", l17)) -} diff --git a/pkg/paths/paths_test.go b/pkg/paths/paths_test.go deleted file mode 100644 index 27fde6248..000000000 --- a/pkg/paths/paths_test.go +++ /dev/null @@ -1,432 +0,0 @@ -/* - * This file is part of PathsHelper library. - * - * Copyright 2018 Arduino AG (http://www.arduino.cc/) - * - * PathsHelper library is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As a special exception, you may use this file as part of a free software - * library without restriction. Specifically, if other files instantiate - * templates or use macros or inline functions from this file, or you compile - * this file and link it with other files to produce an executable, this - * file does not by itself cause the resulting executable to be covered by - * the GNU General Public License. This exception does not however - * invalidate any other reasons why the executable file might be covered by - * the GNU General Public License. - */ - -package paths - -import ( - "path/filepath" - "runtime" - "strings" - "testing" - - "github.com/stretchr/testify/require" -) - -func pathEqualsTo(t *testing.T, expected string, actual *Path) { - require.Equal(t, expected, filepath.ToSlash(actual.String())) -} - -func TestPathNew(t *testing.T) { - test1 := New("path") - require.Equal(t, "path", test1.String()) - - test2 := New("path", "path") - require.Equal(t, filepath.Join("path", "path"), test2.String()) - - test3 := New() - require.Nil(t, test3) - - test4 := New("") - require.Nil(t, test4) -} - -func TestPath(t *testing.T) { - testPath := New("testdata", "fileset") - pathEqualsTo(t, "testdata/fileset", testPath) - isDir, err := testPath.IsDirCheck() - require.True(t, isDir) - require.NoError(t, err) - require.True(t, testPath.IsDir()) - require.False(t, testPath.IsNotDir()) - exist, err := testPath.ExistCheck() - require.True(t, exist) - require.NoError(t, err) - require.True(t, testPath.Exist()) - require.False(t, testPath.NotExist()) - - folderPath := testPath.Join("folder") - pathEqualsTo(t, "testdata/fileset/folder", folderPath) - isDir, err = folderPath.IsDirCheck() - require.True(t, isDir) - require.NoError(t, err) - require.True(t, folderPath.IsDir()) - require.False(t, folderPath.IsNotDir()) - - exist, err = folderPath.ExistCheck() - require.True(t, exist) - require.NoError(t, err) - require.True(t, folderPath.Exist()) - require.False(t, folderPath.NotExist()) - - filePath := testPath.Join("file") - pathEqualsTo(t, "testdata/fileset/file", filePath) - isDir, err = filePath.IsDirCheck() - require.False(t, isDir) - require.NoError(t, err) - require.False(t, filePath.IsDir()) - require.True(t, filePath.IsNotDir()) - exist, err = filePath.ExistCheck() - require.True(t, exist) - require.NoError(t, err) - require.True(t, filePath.Exist()) - require.False(t, filePath.NotExist()) - - anotherFilePath := filePath.Join("notexistent") - pathEqualsTo(t, "testdata/fileset/file/notexistent", anotherFilePath) - isDir, err = anotherFilePath.IsDirCheck() - require.False(t, isDir) - require.Error(t, err) - require.False(t, anotherFilePath.IsDir()) - require.False(t, anotherFilePath.IsNotDir()) - exist, err = anotherFilePath.ExistCheck() - require.False(t, exist) - require.NoError(t, err) - require.False(t, anotherFilePath.Exist()) - require.True(t, anotherFilePath.NotExist()) - - list, err := folderPath.ReadDir() - require.NoError(t, err) - require.Len(t, list, 4) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", list[0]) - pathEqualsTo(t, "testdata/fileset/folder/file2", list[1]) - pathEqualsTo(t, "testdata/fileset/folder/file3", list[2]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list[3]) - - list2 := list.Clone() - list2.FilterDirs() - require.Len(t, list2, 1) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list2[0]) - - list2 = list.Clone() - list2.FilterOutHiddenFiles() - require.Len(t, list2, 3) - pathEqualsTo(t, "testdata/fileset/folder/file2", list2[0]) - pathEqualsTo(t, "testdata/fileset/folder/file3", list2[1]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list2[2]) - - list2 = list.Clone() - list2.FilterOutPrefix("file") - require.Len(t, list2, 2) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", list2[0]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list2[1]) -} - -func TestResetStatCacheWhenFollowingSymlink(t *testing.T) { - testdata := New("testdata", "fileset") - files, err := testdata.ReadDir() - require.NoError(t, err) - for _, file := range files { - if file.Base() == "symlinktofolder" { - err = file.FollowSymLink() - require.NoError(t, err) - isDir, err := file.IsDirCheck() - require.NoError(t, err) - require.True(t, isDir) - break - } - } -} - -func TestIsInsideDir(t *testing.T) { - notInside := func(a, b *Path) { - isInside, err := a.IsInsideDir(b) - require.NoError(t, err) - require.False(t, isInside, "%s is inside %s", a, b) - } - - inside := func(a, b *Path) { - isInside, err := a.IsInsideDir(b) - require.NoError(t, err) - require.True(t, isInside, "%s is inside %s", a, b) - notInside(b, a) - } - - f1 := New("/a/b/c") - f2 := New("/a/b/c/d") - f3 := New("/a/b/c/d/e") - - notInside(f1, f1) - notInside(f1, f2) - inside(f2, f1) - notInside(f1, f3) - inside(f3, f1) - - r1 := New("a/b/c") - r2 := New("a/b/c/d") - r3 := New("a/b/c/d/e") - r4 := New("f/../a/b/c/d/e") - r5 := New("a/b/c/d/e/f/..") - - notInside(r1, r1) - notInside(r1, r2) - inside(r2, r1) - notInside(r1, r3) - inside(r3, r1) - inside(r4, r1) - notInside(r1, r4) - inside(r5, r1) - notInside(r1, r5) - - f4 := New("/home/megabug/aide/arduino-1.8.6/hardware/arduino/avr") - f5 := New("/home/megabug/a15/packages") - notInside(f5, f4) - notInside(f4, f5) - - if runtime.GOOS == "windows" { - f6 := New("C:\\", "A") - f7 := New("C:\\", "A", "B", "C") - f8 := New("E:\\", "A", "B", "C") - inside(f7, f6) - notInside(f8, f6) - } -} - -func TestReadFileAsLines(t *testing.T) { - lines, err := New("testdata/fileset/anotherFile").ReadFileAsLines() - require.NoError(t, err) - require.Len(t, lines, 4) - require.Equal(t, "line 1", lines[0]) - require.Equal(t, "line 2", lines[1]) - require.Equal(t, "", lines[2]) - require.Equal(t, "line 3", lines[3]) -} - -func TestCanonicaTempDir(t *testing.T) { - require.Equal(t, TempDir().String(), TempDir().Canonical().String()) -} - -func TestCopyDir(t *testing.T) { - tmp, err := MkTempDir("", "") - require.NoError(t, err) - defer tmp.RemoveAll() - - src := New("testdata", "fileset") - err = src.CopyDirTo(tmp.Join("dest")) - require.NoError(t, err, "copying dir") - - exist, err := tmp.Join("dest", "folder", "subfolder", "file4").ExistCheck() - require.True(t, exist) - require.NoError(t, err) - - isdir, err := tmp.Join("dest", "folder", "subfolder", "file4").IsDirCheck() - require.False(t, isdir) - require.NoError(t, err) - - err = src.CopyDirTo(tmp.Join("dest")) - require.Error(t, err, "copying dir to already existing") - - err = src.Join("file").CopyDirTo(tmp.Join("dest2")) - require.Error(t, err, "copying file as dir") -} - -func TestParents(t *testing.T) { - parents := New("/a/very/long/path").Parents() - require.Len(t, parents, 5) - pathEqualsTo(t, "/a/very/long/path", parents[0]) - pathEqualsTo(t, "/a/very/long", parents[1]) - pathEqualsTo(t, "/a/very", parents[2]) - pathEqualsTo(t, "/a", parents[3]) - pathEqualsTo(t, "/", parents[4]) - - parents2 := New("a/very/relative/path").Parents() - require.Len(t, parents, 5) - pathEqualsTo(t, "a/very/relative/path", parents2[0]) - pathEqualsTo(t, "a/very/relative", parents2[1]) - pathEqualsTo(t, "a/very", parents2[2]) - pathEqualsTo(t, "a", parents2[3]) - pathEqualsTo(t, ".", parents2[4]) -} - -func TestFilterDirs(t *testing.T) { - testPath := New("testdata", "fileset") - - list, err := testPath.ReadDir() - require.NoError(t, err) - require.Len(t, list, 6) - - pathEqualsTo(t, "testdata/fileset/anotherFile", list[0]) - pathEqualsTo(t, "testdata/fileset/file", list[1]) - pathEqualsTo(t, "testdata/fileset/folder", list[2]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", list[3]) - pathEqualsTo(t, "testdata/fileset/test.txt", list[4]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", list[5]) - - list.FilterDirs() - require.Len(t, list, 2) - pathEqualsTo(t, "testdata/fileset/folder", list[0]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", list[1]) -} - -func TestFilterOutDirs(t *testing.T) { - { - testPath := New("testdata", "fileset") - - list, err := testPath.ReadDir() - require.NoError(t, err) - require.Len(t, list, 6) - - pathEqualsTo(t, "testdata/fileset/anotherFile", list[0]) - pathEqualsTo(t, "testdata/fileset/file", list[1]) - pathEqualsTo(t, "testdata/fileset/folder", list[2]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", list[3]) - pathEqualsTo(t, "testdata/fileset/test.txt", list[4]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", list[5]) - - list.FilterOutDirs() - require.Len(t, list, 4) - pathEqualsTo(t, "testdata/fileset/anotherFile", list[0]) - pathEqualsTo(t, "testdata/fileset/file", list[1]) - pathEqualsTo(t, "testdata/fileset/test.txt", list[2]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", list[3]) - } - - { - list, err := New("testdata", "broken_symlink", "dir_1").ReadDirRecursive() - require.NoError(t, err) - - require.Len(t, list, 7) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/broken_link", list[0]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/file2", list[1]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/linked_dir", list[2]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/linked_dir/file1", list[3]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/linked_file", list[4]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/real_dir", list[5]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/real_dir/file1", list[6]) - - list.FilterOutDirs() - require.Len(t, list, 5) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/broken_link", list[0]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/file2", list[1]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/linked_dir/file1", list[2]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/linked_file", list[3]) - pathEqualsTo(t, "testdata/broken_symlink/dir_1/real_dir/file1", list[4]) - } -} - -func TestEquivalentPaths(t *testing.T) { - wd, err := Getwd() - require.NoError(t, err) - require.True(t, New("file1").EquivalentTo(New("file1", "somethingelse", ".."))) - require.True(t, New("file1", "abc").EquivalentTo(New("file1", "abc", "def", ".."))) - require.True(t, wd.Join("file1").EquivalentTo(New("file1"))) - require.True(t, wd.Join("file1").EquivalentTo(New("file1", "abc", ".."))) - - if runtime.GOOS == "windows" { - q := New("testdata", "fileset", "anotherFile") - r := New("testdata", "fileset", "ANOTHE~1") - require.True(t, q.EquivalentTo(r)) - require.True(t, r.EquivalentTo(q)) - } -} - -func TestCanonicalize(t *testing.T) { - wd, err := Getwd() - require.NoError(t, err) - - p := New("testdata", "fileset", "anotherFile").Canonical() - require.Equal(t, wd.Join("testdata", "fileset", "anotherFile").String(), p.String()) - - p = New("testdata", "fileset", "nonexistentFile").Canonical() - require.Equal(t, wd.Join("testdata", "fileset", "nonexistentFile").String(), p.String()) - - if runtime.GOOS == "windows" { - q := New("testdata", "fileset", "ANOTHE~1").Canonical() - require.Equal(t, wd.Join("testdata", "fileset", "anotherFile").String(), q.String()) - - r := New("c:\\").Canonical() - require.Equal(t, "C:\\", r.String()) - - tmp, err := MkTempDir("", "pref") - require.NoError(t, err) - require.Equal(t, tmp.String(), tmp.Canonical().String()) - } -} - -func TestRelativeTo(t *testing.T) { - res, err := New("/my/abs/path/123/456").RelTo(New("/my/abs/path")) - require.NoError(t, err) - pathEqualsTo(t, "../..", res) - - res, err = New("/my/abs/path").RelTo(New("/my/abs/path/123/456")) - require.NoError(t, err) - pathEqualsTo(t, "123/456", res) - - res, err = New("my/path").RelTo(New("/other/path")) - require.Error(t, err) - require.Nil(t, res) - - res, err = New("/my/abs/path/123/456").RelFrom(New("/my/abs/path")) - pathEqualsTo(t, "123/456", res) - require.NoError(t, err) - - res, err = New("/my/abs/path").RelFrom(New("/my/abs/path/123/456")) - require.NoError(t, err) - pathEqualsTo(t, "../..", res) - - res, err = New("my/path").RelFrom(New("/other/path")) - require.Error(t, err) - require.Nil(t, res) -} - -func TestWriteToTempFile(t *testing.T) { - tmpDir := New("testdata", "fileset", "tmp") - err := tmpDir.MkdirAll() - require.NoError(t, err) - defer tmpDir.RemoveAll() - - tmpData := []byte("test") - tmp, err := WriteToTempFile(tmpData, tmpDir, "prefix") - defer tmp.Remove() - require.NoError(t, err) - require.True(t, strings.HasPrefix(tmp.Base(), "prefix")) - isInside, err := tmp.IsInsideDir(tmpDir) - require.NoError(t, err) - require.True(t, isInside) - data, err := tmp.ReadFile() - require.NoError(t, err) - require.Equal(t, tmpData, data) -} - -func TestCopyToSamePath(t *testing.T) { - tmpDir := New(t.TempDir()) - srcFile := tmpDir.Join("test_file") - dstFile := srcFile - - // create the source file in tmp dir - err := srcFile.WriteFile([]byte("hello")) - require.NoError(t, err) - content, err := srcFile.ReadFile() - require.NoError(t, err) - require.Equal(t, []byte("hello"), content) - - // cannot copy the same file - err = srcFile.CopyTo(dstFile) - require.Error(t, err) - require.Contains(t, err.Error(), "are the same file") -} diff --git a/pkg/paths/process_test.go b/pkg/paths/process_test.go deleted file mode 100644 index 5346dda02..000000000 --- a/pkg/paths/process_test.go +++ /dev/null @@ -1,56 +0,0 @@ -// -// This file is part of PathsHelper library. -// -// Copyright 2023 Arduino AG (http://www.arduino.cc/) -// -// PathsHelper library is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; either version 2 of the License, or -// (at your option) any later version. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License -// along with this program; if not, write to the Free Software -// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -// -// As a special exception, you may use this file as part of a free software -// library without restriction. Specifically, if other files instantiate -// templates or use macros or inline functions from this file, or you compile -// this file and link it with other files to produce an executable, this -// file does not by itself cause the resulting executable to be covered by -// the GNU General Public License. This exception does not however -// invalidate any other reasons why the executable file might be covered by -// the GNU General Public License. -// - -package paths - -import ( - "context" - "testing" - "time" - - "github.com/stretchr/testify/require" -) - -func TestProcessWithinContext(t *testing.T) { - // Build `delay` helper inside testdata/delay - builder, err := NewProcess(nil, "go", "build") - require.NoError(t, err) - builder.SetDir("testdata/delay") - require.NoError(t, builder.Run()) - - // Run delay and test if the process is terminated correctly due to context - process, err := NewProcess(nil, "testdata/delay/delay") - require.NoError(t, err) - start := time.Now() - ctx, cancel := context.WithTimeout(context.Background(), 250*time.Millisecond) - err = process.RunWithinContext(ctx) - require.Error(t, err) - require.Less(t, time.Since(start), 500*time.Millisecond) - cancel() -} diff --git a/pkg/paths/readdir_test.go b/pkg/paths/readdir_test.go deleted file mode 100644 index ae25ede97..000000000 --- a/pkg/paths/readdir_test.go +++ /dev/null @@ -1,343 +0,0 @@ -/* - * This file is part of PathsHelper library. - * - * Copyright 2018-2022 Arduino AG (http://www.arduino.cc/) - * - * PathsHelper library is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As a special exception, you may use this file as part of a free software - * library without restriction. Specifically, if other files instantiate - * templates or use macros or inline functions from this file, or you compile - * this file and link it with other files to produce an executable, this - * file does not by itself cause the resulting executable to be covered by - * the GNU General Public License. This exception does not however - * invalidate any other reasons why the executable file might be covered by - * the GNU General Public License. - */ - -package paths - -import ( - "fmt" - "io/fs" - "os" - "runtime" - "testing" - "time" - - "github.com/stretchr/testify/require" -) - -func TestReadDirRecursive(t *testing.T) { - testPath := New("testdata", "fileset") - - list, err := testPath.ReadDirRecursive() - require.NoError(t, err) - require.Len(t, list, 16) - - pathEqualsTo(t, "testdata/fileset/anotherFile", list[0]) - pathEqualsTo(t, "testdata/fileset/file", list[1]) - pathEqualsTo(t, "testdata/fileset/folder", list[2]) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", list[3]) - pathEqualsTo(t, "testdata/fileset/folder/file2", list[4]) - pathEqualsTo(t, "testdata/fileset/folder/file3", list[5]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list[6]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder/file4", list[7]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", list[8]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/.hidden", list[9]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file2", list[10]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file3", list[11]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder", list[12]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder/file4", list[13]) - pathEqualsTo(t, "testdata/fileset/test.txt", list[14]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", list[15]) -} - -func TestReadDirRecursiveSymLinkLoop(t *testing.T) { - // Test symlink loop - tmp, err := MkTempDir("", "") - require.NoError(t, err) - defer tmp.RemoveAll() - - folder := tmp.Join("folder") - err = os.Symlink(tmp.String(), folder.String()) - require.NoError(t, err) - - l, err := tmp.ReadDirRecursive() - require.Error(t, err) - fmt.Println(err) - require.Nil(t, l) - - l, err = tmp.ReadDirRecursiveFiltered(nil) - require.Error(t, err) - fmt.Println(err) - require.Nil(t, l) -} - -func TestReadDirFiltered(t *testing.T) { - folderPath := New("testdata/fileset/folder") - list, err := folderPath.ReadDir() - require.NoError(t, err) - require.Len(t, list, 4) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", list[0]) - pathEqualsTo(t, "testdata/fileset/folder/file2", list[1]) - pathEqualsTo(t, "testdata/fileset/folder/file3", list[2]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list[3]) - - list, err = folderPath.ReadDir(FilterDirectories()) - require.NoError(t, err) - require.Len(t, list, 1) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list[0]) - - list, err = folderPath.ReadDir(FilterOutPrefixes("file")) - require.NoError(t, err) - require.Len(t, list, 2) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", list[0]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", list[1]) -} - -func TestReadDirRecursiveFiltered(t *testing.T) { - testdata := New("testdata", "fileset") - l, err := testdata.ReadDirRecursiveFiltered(nil) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 16) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/file", l[1]) - pathEqualsTo(t, "testdata/fileset/folder", l[2]) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", l[3]) - pathEqualsTo(t, "testdata/fileset/folder/file2", l[4]) - pathEqualsTo(t, "testdata/fileset/folder/file3", l[5]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", l[6]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder/file4", l[7]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", l[8]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/.hidden", l[9]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file2", l[10]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file3", l[11]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder", l[12]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder/file4", l[13]) - pathEqualsTo(t, "testdata/fileset/test.txt", l[14]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[15]) - - l, err = testdata.ReadDirRecursiveFiltered(FilterOutDirectories()) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 6) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/file", l[1]) - pathEqualsTo(t, "testdata/fileset/folder", l[2]) // <- this is listed but not traversed - pathEqualsTo(t, "testdata/fileset/symlinktofolder", l[3]) // <- this is listed but not traversed - pathEqualsTo(t, "testdata/fileset/test.txt", l[4]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[5]) - - l, err = testdata.ReadDirRecursiveFiltered(nil, FilterOutDirectories()) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 12) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/file", l[1]) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", l[2]) - pathEqualsTo(t, "testdata/fileset/folder/file2", l[3]) - pathEqualsTo(t, "testdata/fileset/folder/file3", l[4]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder/file4", l[5]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/.hidden", l[6]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file2", l[7]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file3", l[8]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder/file4", l[9]) - pathEqualsTo(t, "testdata/fileset/test.txt", l[10]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[11]) - - l, err = testdata.ReadDirRecursiveFiltered(FilterOutDirectories(), FilterOutDirectories()) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 4) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/file", l[1]) - pathEqualsTo(t, "testdata/fileset/test.txt", l[2]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[3]) - - l, err = testdata.ReadDirRecursiveFiltered(FilterOutPrefixes("sub"), FilterOutSuffixes("3")) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 12) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/file", l[1]) - pathEqualsTo(t, "testdata/fileset/folder", l[2]) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", l[3]) - pathEqualsTo(t, "testdata/fileset/folder/file2", l[4]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", l[5]) // <- subfolder skipped by Prefix("sub") - pathEqualsTo(t, "testdata/fileset/symlinktofolder", l[6]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/.hidden", l[7]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file2", l[8]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder", l[9]) // <- subfolder skipped by Prefix("sub") - pathEqualsTo(t, "testdata/fileset/test.txt", l[10]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[11]) - - l, err = testdata.ReadDirRecursiveFiltered(FilterOutPrefixes("sub"), AndFilter(FilterOutSuffixes("3"), FilterOutPrefixes("fil"))) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 9) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/folder", l[1]) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", l[2]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", l[3]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", l[4]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/.hidden", l[5]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder", l[6]) - pathEqualsTo(t, "testdata/fileset/test.txt", l[7]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[8]) - - l, err = testdata.ReadDirRecursiveFiltered(FilterOutPrefixes("sub"), AndFilter(FilterOutSuffixes("3"), FilterOutPrefixes("fil"), FilterOutSuffixes(".gz"))) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 8) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/folder", l[1]) - pathEqualsTo(t, "testdata/fileset/folder/.hidden", l[2]) - pathEqualsTo(t, "testdata/fileset/folder/subfolder", l[3]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", l[4]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/.hidden", l[5]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder", l[6]) - pathEqualsTo(t, "testdata/fileset/test.txt", l[7]) - - l, err = testdata.ReadDirRecursiveFiltered(OrFilter(FilterPrefixes("sub"), FilterSuffixes("tofolder"))) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 11) - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/file", l[1]) - pathEqualsTo(t, "testdata/fileset/folder", l[2]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", l[3]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/.hidden", l[4]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file2", l[5]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file3", l[6]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder", l[7]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder/file4", l[8]) - pathEqualsTo(t, "testdata/fileset/test.txt", l[9]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[10]) - - l, err = testdata.ReadDirRecursiveFiltered(nil, FilterNames("folder")) - require.NoError(t, err) - l.Sort() - require.Len(t, l, 1) - pathEqualsTo(t, "testdata/fileset/folder", l[0]) - - l, err = testdata.ReadDirRecursiveFiltered(FilterNames("symlinktofolder"), FilterOutNames(".hidden")) - require.NoError(t, err) - require.Len(t, l, 9) - l.Sort() - pathEqualsTo(t, "testdata/fileset/anotherFile", l[0]) - pathEqualsTo(t, "testdata/fileset/file", l[1]) - pathEqualsTo(t, "testdata/fileset/folder", l[2]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder", l[3]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file2", l[4]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/file3", l[5]) - pathEqualsTo(t, "testdata/fileset/symlinktofolder/subfolder", l[6]) - pathEqualsTo(t, "testdata/fileset/test.txt", l[7]) - pathEqualsTo(t, "testdata/fileset/test.txt.gz", l[8]) -} - -func TestReadDirRecursiveLoopDetection(t *testing.T) { - loopsPath := New("testdata", "loops") - unbuondedReaddir := func(testdir string) (PathList, error) { - var files PathList - var err error - done := make(chan bool) - go func() { - files, err = loopsPath.Join(testdir).ReadDirRecursive() - done <- true - }() - require.Eventually( - t, - func() bool { - select { - case <-done: - return true - default: - return false - } - }, - 5*time.Second, - 10*time.Millisecond, - "Infinite symlink loop while loading sketch", - ) - return files, err - } - - for _, dir := range []string{"loop_1", "loop_2", "loop_3", "loop_4"} { - l, err := unbuondedReaddir(dir) - require.EqualError(t, err, "directories symlink loop detected", "loop not detected in %s", dir) - require.Nil(t, l) - } - - { - l, err := unbuondedReaddir("regular_1") - require.NoError(t, err) - require.Len(t, l, 4) - l.Sort() - pathEqualsTo(t, "testdata/loops/regular_1/dir1", l[0]) - pathEqualsTo(t, "testdata/loops/regular_1/dir1/file1", l[1]) - pathEqualsTo(t, "testdata/loops/regular_1/dir2", l[2]) - pathEqualsTo(t, "testdata/loops/regular_1/dir2/file1", l[3]) - } - - { - l, err := unbuondedReaddir("regular_2") - require.NoError(t, err) - require.Len(t, l, 6) - l.Sort() - pathEqualsTo(t, "testdata/loops/regular_2/dir1", l[0]) - pathEqualsTo(t, "testdata/loops/regular_2/dir1/file1", l[1]) - pathEqualsTo(t, "testdata/loops/regular_2/dir2", l[2]) - pathEqualsTo(t, "testdata/loops/regular_2/dir2/dir1", l[3]) - pathEqualsTo(t, "testdata/loops/regular_2/dir2/dir1/file1", l[4]) - pathEqualsTo(t, "testdata/loops/regular_2/dir2/file2", l[5]) - } - - { - l, err := unbuondedReaddir("regular_3") - require.NoError(t, err) - require.Len(t, l, 7) - l.Sort() - pathEqualsTo(t, "testdata/loops/regular_3/dir1", l[0]) - pathEqualsTo(t, "testdata/loops/regular_3/dir1/file1", l[1]) - pathEqualsTo(t, "testdata/loops/regular_3/dir2", l[2]) - pathEqualsTo(t, "testdata/loops/regular_3/dir2/dir1", l[3]) - pathEqualsTo(t, "testdata/loops/regular_3/dir2/dir1/file1", l[4]) - pathEqualsTo(t, "testdata/loops/regular_3/dir2/file2", l[5]) - pathEqualsTo(t, "testdata/loops/regular_3/link", l[6]) // broken symlink is reported in files - } - - if runtime.GOOS != "windows" { - dir1 := loopsPath.Join("regular_4_with_permission_error", "dir1") - - l, err := unbuondedReaddir("regular_4_with_permission_error") - require.NoError(t, err) - require.NotEmpty(t, l) - - dir1Stat, err := dir1.Stat() - require.NoError(t, err) - err = dir1.Chmod(fs.FileMode(0)) // Enforce permission error - require.NoError(t, err) - t.Cleanup(func() { - // Restore normal permission after the test - dir1.Chmod(dir1Stat.Mode()) - }) - - l, err = unbuondedReaddir("regular_4_with_permission_error") - require.Error(t, err) - require.Nil(t, l) - } -} diff --git a/pkg/paths/testdata/broken_symlink/dir_1/broken_link b/pkg/paths/testdata/broken_symlink/dir_1/broken_link deleted file mode 120000 index 86a410dd1..000000000 --- a/pkg/paths/testdata/broken_symlink/dir_1/broken_link +++ /dev/null @@ -1 +0,0 @@ -broken \ No newline at end of file diff --git a/pkg/paths/testdata/broken_symlink/dir_1/file2 b/pkg/paths/testdata/broken_symlink/dir_1/file2 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/broken_symlink/dir_1/linked_dir b/pkg/paths/testdata/broken_symlink/dir_1/linked_dir deleted file mode 120000 index 4b019049f..000000000 --- a/pkg/paths/testdata/broken_symlink/dir_1/linked_dir +++ /dev/null @@ -1 +0,0 @@ -real_dir \ No newline at end of file diff --git a/pkg/paths/testdata/broken_symlink/dir_1/linked_file b/pkg/paths/testdata/broken_symlink/dir_1/linked_file deleted file mode 120000 index 30d67d467..000000000 --- a/pkg/paths/testdata/broken_symlink/dir_1/linked_file +++ /dev/null @@ -1 +0,0 @@ -file2 \ No newline at end of file diff --git a/pkg/paths/testdata/broken_symlink/dir_1/real_dir/file1 b/pkg/paths/testdata/broken_symlink/dir_1/real_dir/file1 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/delay/.gitignore b/pkg/paths/testdata/delay/.gitignore deleted file mode 100644 index fd5812a40..000000000 --- a/pkg/paths/testdata/delay/.gitignore +++ /dev/null @@ -1 +0,0 @@ -delay* diff --git a/pkg/paths/testdata/delay/main.go b/pkg/paths/testdata/delay/main.go deleted file mode 100644 index fa6030c40..000000000 --- a/pkg/paths/testdata/delay/main.go +++ /dev/null @@ -1,40 +0,0 @@ -/* - * This file is part of PathsHelper library. - * - * Copyright 2023 Arduino AG (http://www.arduino.cc/) - * - * PathsHelper library is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - * - * As a special exception, you may use this file as part of a free software - * library without restriction. Specifically, if other files instantiate - * templates or use macros or inline functions from this file, or you compile - * this file and link it with other files to produce an executable, this - * file does not by itself cause the resulting executable to be covered by - * the GNU General Public License. This exception does not however - * invalidate any other reasons why the executable file might be covered by - * the GNU General Public License. - */ - -package main - -import ( - "fmt" - "time" -) - -func main() { - time.Sleep(3 * time.Second) - fmt.Println("Elapsed!") -} diff --git a/pkg/paths/testdata/fileset/anotherFile b/pkg/paths/testdata/fileset/anotherFile deleted file mode 100644 index 27649646e..000000000 --- a/pkg/paths/testdata/fileset/anotherFile +++ /dev/null @@ -1,4 +0,0 @@ -line 1 -line 2 - -line 3 \ No newline at end of file diff --git a/pkg/paths/testdata/fileset/file b/pkg/paths/testdata/fileset/file deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/fileset/folder/.hidden b/pkg/paths/testdata/fileset/folder/.hidden deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/fileset/folder/file2 b/pkg/paths/testdata/fileset/folder/file2 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/fileset/folder/file3 b/pkg/paths/testdata/fileset/folder/file3 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/fileset/folder/subfolder/file4 b/pkg/paths/testdata/fileset/folder/subfolder/file4 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/fileset/symlinktofolder b/pkg/paths/testdata/fileset/symlinktofolder deleted file mode 120000 index 01196353b..000000000 --- a/pkg/paths/testdata/fileset/symlinktofolder +++ /dev/null @@ -1 +0,0 @@ -folder \ No newline at end of file diff --git a/pkg/paths/testdata/fileset/test.txt b/pkg/paths/testdata/fileset/test.txt deleted file mode 100644 index d3ded994d..000000000 --- a/pkg/paths/testdata/fileset/test.txt +++ /dev/null @@ -1,20 +0,0 @@ -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - -Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. - diff --git a/pkg/paths/testdata/fileset/test.txt.gz b/pkg/paths/testdata/fileset/test.txt.gz deleted file mode 100644 index e75120aef293a5d686de117d35f37b59d821e907..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 411 zcmb2|=HOTtzAb@)xg@o?M6aZxgyHQZ!#rg}9@pP9rSEo9xOPuzX7@_%gh@toR1amHo?)WOb&KoxhZ#qWBN!wq`&(Un zRA-$&8^*!?sr8v*#nyvcugu%vdh_f(=c>wjYpykc(+hLWm|DNF`Y$=#$F)gdrGv(r z|I2LL;sROpcfYjl$i_@% diff --git a/pkg/paths/testdata/loops/loop_1/dir1/loop b/pkg/paths/testdata/loops/loop_1/dir1/loop deleted file mode 120000 index c9f3ab1ea..000000000 --- a/pkg/paths/testdata/loops/loop_1/dir1/loop +++ /dev/null @@ -1 +0,0 @@ -../dir1 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/loop_2/dir1/loop2 b/pkg/paths/testdata/loops/loop_2/dir1/loop2 deleted file mode 120000 index d014eb492..000000000 --- a/pkg/paths/testdata/loops/loop_2/dir1/loop2 +++ /dev/null @@ -1 +0,0 @@ -../dir2 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/loop_2/dir2/loop1 b/pkg/paths/testdata/loops/loop_2/dir2/loop1 deleted file mode 120000 index c9f3ab1ea..000000000 --- a/pkg/paths/testdata/loops/loop_2/dir2/loop1 +++ /dev/null @@ -1 +0,0 @@ -../dir1 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/loop_3/dir1/loop2 b/pkg/paths/testdata/loops/loop_3/dir1/loop2 deleted file mode 120000 index d014eb492..000000000 --- a/pkg/paths/testdata/loops/loop_3/dir1/loop2 +++ /dev/null @@ -1 +0,0 @@ -../dir2 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/loop_3/dir2/dir3/loop2 b/pkg/paths/testdata/loops/loop_3/dir2/dir3/loop2 deleted file mode 120000 index 85babfdb0..000000000 --- a/pkg/paths/testdata/loops/loop_3/dir2/dir3/loop2 +++ /dev/null @@ -1 +0,0 @@ -../../dir1/ \ No newline at end of file diff --git a/pkg/paths/testdata/loops/loop_4/dir1/dir2/loop2 b/pkg/paths/testdata/loops/loop_4/dir1/dir2/loop2 deleted file mode 120000 index 3fd50ca46..000000000 --- a/pkg/paths/testdata/loops/loop_4/dir1/dir2/loop2 +++ /dev/null @@ -1 +0,0 @@ -../dir3 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/loop_4/dir1/dir3/dir4/loop1 b/pkg/paths/testdata/loops/loop_4/dir1/dir3/dir4/loop1 deleted file mode 120000 index 4f388a669..000000000 --- a/pkg/paths/testdata/loops/loop_4/dir1/dir3/dir4/loop1 +++ /dev/null @@ -1 +0,0 @@ -../../../dir1 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/regular_1/dir1/file1 b/pkg/paths/testdata/loops/regular_1/dir1/file1 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/loops/regular_1/dir2 b/pkg/paths/testdata/loops/regular_1/dir2 deleted file mode 120000 index df490f837..000000000 --- a/pkg/paths/testdata/loops/regular_1/dir2 +++ /dev/null @@ -1 +0,0 @@ -dir1 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/regular_2/dir1/file1 b/pkg/paths/testdata/loops/regular_2/dir1/file1 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/loops/regular_2/dir2/dir1 b/pkg/paths/testdata/loops/regular_2/dir2/dir1 deleted file mode 120000 index c9f3ab1ea..000000000 --- a/pkg/paths/testdata/loops/regular_2/dir2/dir1 +++ /dev/null @@ -1 +0,0 @@ -../dir1 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/regular_2/dir2/file2 b/pkg/paths/testdata/loops/regular_2/dir2/file2 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/loops/regular_3/dir1/file1 b/pkg/paths/testdata/loops/regular_3/dir1/file1 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/loops/regular_3/dir2/dir1 b/pkg/paths/testdata/loops/regular_3/dir2/dir1 deleted file mode 120000 index c9f3ab1ea..000000000 --- a/pkg/paths/testdata/loops/regular_3/dir2/dir1 +++ /dev/null @@ -1 +0,0 @@ -../dir1 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/regular_3/dir2/file2 b/pkg/paths/testdata/loops/regular_3/dir2/file2 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/loops/regular_3/link b/pkg/paths/testdata/loops/regular_3/link deleted file mode 120000 index 86a410dd1..000000000 --- a/pkg/paths/testdata/loops/regular_3/link +++ /dev/null @@ -1 +0,0 @@ -broken \ No newline at end of file diff --git a/pkg/paths/testdata/loops/regular_4_with_permission_error/dir1/file1 b/pkg/paths/testdata/loops/regular_4_with_permission_error/dir1/file1 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/loops/regular_4_with_permission_error/dir2/dir1 b/pkg/paths/testdata/loops/regular_4_with_permission_error/dir2/dir1 deleted file mode 120000 index c9f3ab1ea..000000000 --- a/pkg/paths/testdata/loops/regular_4_with_permission_error/dir2/dir1 +++ /dev/null @@ -1 +0,0 @@ -../dir1 \ No newline at end of file diff --git a/pkg/paths/testdata/loops/regular_4_with_permission_error/dir2/file2 b/pkg/paths/testdata/loops/regular_4_with_permission_error/dir2/file2 deleted file mode 100644 index e69de29bb..000000000 diff --git a/pkg/paths/testdata/loops/regular_4_with_permission_error/link b/pkg/paths/testdata/loops/regular_4_with_permission_error/link deleted file mode 120000 index 86a410dd1..000000000 --- a/pkg/paths/testdata/loops/regular_4_with_permission_error/link +++ /dev/null @@ -1 +0,0 @@ -broken \ No newline at end of file From 061b584b6601327c4b6d0c000253dbe5e4dcec18 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 19 Oct 2024 22:57:08 +0100 Subject: [PATCH 0374/1455] ci: update golangci-lint. --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a24ac7975..960dd2884 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -30,7 +30,7 @@ golangci-lint: stage: lint image: golangci/golangci-lint script: - - golangci-lint run --skip-dirs pkg/paths + - golangci-lint run --exclude-dirs pkg/paths packer: stage: lint From 2bace0178314399d48d83037a85dc26b5cb4fc9e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 19 Oct 2024 22:58:47 +0100 Subject: [PATCH 0375/1455] chore: all external go module have been removed. --- go.mod | 11 +---------- go.sum | 10 ---------- 2 files changed, 1 insertion(+), 20 deletions(-) diff --git a/go.mod b/go.mod index 085850645..f98df5c19 100644 --- a/go.mod +++ b/go.mod @@ -1,12 +1,3 @@ module github.com/roddhjav/apparmor.d -go 1.21 - -require ( - github.com/stretchr/testify v1.9.0 -) - -require ( - github.com/davecgh/go-spew v1.1.1 // indirect - github.com/pmezard/go-difflib v1.0.0 // indirect -) +go 1.22 diff --git a/go.sum b/go.sum index 60ce688a0..e69de29bb 100644 --- a/go.sum +++ b/go.sum @@ -1,10 +0,0 @@ -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= -github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= -github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= -gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= From 7e09351f8f7bc905ff5ad4f892879ab3d51fb93d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 14:12:02 +0100 Subject: [PATCH 0376/1455] feat(aa-log): add the --since option. --- cmd/aa-log/main.go | 4 +++- pkg/logs/loggers.go | 17 ++++++++++++----- pkg/logs/loggers_test.go | 2 +- 3 files changed, 16 insertions(+), 7 deletions(-) diff --git a/cmd/aa-log/main.go b/cmd/aa-log/main.go index f7c484fd7..0c16f5e4b 100644 --- a/cmd/aa-log/main.go +++ b/cmd/aa-log/main.go @@ -31,6 +31,7 @@ Options: -s, --systemd Parse systemd logs from journalctl. -r, --rules Convert the log into AppArmor rules. -R, --raw Print the raw log without any formatting. + -S, --since DATE Show entries not older than the specified date. ` @@ -41,6 +42,7 @@ var ( path string systemd bool raw bool + since string ) func aaLog(logger string, path string, profile string) error { @@ -51,7 +53,7 @@ func aaLog(logger string, path string, profile string) error { case "auditd": file, err = logs.GetAuditLogs(path) case "systemd": - file, err = logs.GetJournalctlLogs(path, !slices.Contains(logs.LogFiles, path)) + file, err = logs.GetJournalctlLogs(path, since, !slices.Contains(logs.LogFiles, path)) default: err = fmt.Errorf("Logger %s not supported.", logger) } diff --git a/pkg/logs/loggers.go b/pkg/logs/loggers.go index 78abbd7a2..53b3fbd3a 100644 --- a/pkg/logs/loggers.go +++ b/pkg/logs/loggers.go @@ -63,9 +63,10 @@ func GetAuditLogs(path string) (io.Reader, error) { } // GetJournalctlLogs return a reader with the logs entries from Systemd -func GetJournalctlLogs(path string, useFile bool) (io.Reader, error) { +func GetJournalctlLogs(path string, since string, useFile bool) (io.Reader, error) { var logs []systemdLog var stdout bytes.Buffer + var stderr bytes.Buffer var scanner *bufio.Scanner if useFile { @@ -77,14 +78,20 @@ func GetJournalctlLogs(path string, useFile bool) (io.Reader, error) { } else { // journalctl -b -o json -g apparmor -t kernel -t audit -t dbus-daemon --output-fields=MESSAGE > systemd.log args := []string{ - "--boot", "--grep=apparmor", - "--identifier=kernel", "--identifier=audit", "--identifier=dbus-daemon", + "--grep=apparmor", "--identifier=kernel", + "--identifier=audit", "--identifier=dbus-daemon", "--output=json", "--output-fields=MESSAGE", } + if since == "" { + args = append(args, "--boot") + } else { + args = append(args, "--since="+since) + } cmd := exec.Command("journalctl", args...) cmd.Stdout = &stdout - if err := cmd.Run(); err != nil { - return nil, err + cmd.Stderr = &stderr + if err := cmd.Run(); err != nil && stderr.Len() != 0 { + return nil, fmt.Errorf("journalctl: %s", stderr.String()) } scanner = bufio.NewScanner(&stdout) } diff --git a/pkg/logs/loggers_test.go b/pkg/logs/loggers_test.go index d1a485344..7e0a6002a 100644 --- a/pkg/logs/loggers_test.go +++ b/pkg/logs/loggers_test.go @@ -49,7 +49,7 @@ func TestGetJournalctlLogs(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - reader, _ := GetJournalctlLogs(tt.path, tt.useFile) + reader, _ := GetJournalctlLogs(tt.path, "", tt.useFile) if got := New(reader, tt.name); !reflect.DeepEqual(got, tt.want) { t.Errorf("New() = %v, want %v", got, tt.want) } From d6d4648106ee5e1dce60bc5837f40e473380f869 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 14:13:25 +0100 Subject: [PATCH 0377/1455] tests(bats): minor improvement to test generation. --- tests/cmd/main.go | 8 +++++++- tests/cmd/tests.go | 21 ++++++++++++--------- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/tests/cmd/main.go b/tests/cmd/main.go index 19dd1cf0d..5ca948196 100644 --- a/tests/cmd/main.go +++ b/tests/cmd/main.go @@ -40,7 +40,7 @@ type Config struct { TldrDir *paths.Path // Default: tests/tldr TldrFile *paths.Path // Default: tests/tldr.yml TestsFile *paths.Path // Default: tests/tests.yml - BatsDir *paths.Path // Default: tests/bats + BatsDir *paths.Path // Default: tests/bats_dirty } func NewConfig() *Config { @@ -70,6 +70,12 @@ func run() error { } tests = tests.Filter() + if err := cfg.BatsDir.RemoveAll(); err != nil { + return err + } + if err := cfg.BatsDir.MkdirAll(); err != nil { + return err + } for _, test := range tests { if err := test.Write(cfg.BatsDir); err != nil { return err diff --git a/tests/cmd/tests.go b/tests/cmd/tests.go index d145fbb07..2d37324ea 100644 --- a/tests/cmd/tests.go +++ b/tests/cmd/tests.go @@ -18,11 +18,18 @@ const tmplTest = `#!/usr/bin/env bats # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} {{ $name := .Name -}} {{ range .Commands }} # bats test_tags={{ $name }} @test "{{ $name }}: {{ .Description }}" { {{ .Cmd }} + aa_check } {{ end }} ` @@ -56,20 +63,13 @@ type Command struct { Cmd string } -func NewTest() *Test { - return &Test{ - Name: "", - Commands: []Command{}, - } -} - // HasProfile returns true if the program in the scenario is profiled in apparmor.d -func (t *Test) HasProfile() bool { +func (t Test) HasProfile() bool { return slices.Contains(Profiles, t.Name) } // IsInstalled returns true if the program in the scenario is installed on the system -func (t *Test) IsInstalled() bool { +func (t Test) IsInstalled() bool { if _, err := exec.LookPath(t.Name); err != nil { return false } @@ -82,6 +82,9 @@ func (t Test) Write(dir *paths.Path) error { } path := dir.Join(t.Name + ".bats") + if paths.New("tests/bats").Join(t.Name + ".bats").Exist() { + path = dir.Join("00." + t.Name + ".bats") + } content := renderBatsFile(t) if err := path.WriteFile([]byte(content)); err != nil { return err From 061f5aa95e50b62a30cd9590f83b49bc2b6a9729 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 19:07:47 +0100 Subject: [PATCH 0378/1455] test: add initial structure for the common integration tests. - Add bats common helpers. - Add a first set of tests for some simple program. --- Makefile | 4 ++ tests/bats/aa-status.bats | 40 ++++++++++++++ tests/bats/blkid.bats | 22 ++++++++ tests/bats/common.bash | 109 ++++++++++++++++++++++++++++++++++++++ tests/bats/df.bats | 34 ++++++++++++ tests/bats/lsblk.bats | 58 ++++++++++++++++++++ tests/bats/lscpu.bats | 28 ++++++++++ tests/bats/lspci.bats | 40 ++++++++++++++ tests/bats/ps.bats | 46 ++++++++++++++++ 9 files changed, 381 insertions(+) create mode 100644 tests/bats/aa-status.bats create mode 100644 tests/bats/blkid.bats create mode 100644 tests/bats/common.bash create mode 100644 tests/bats/df.bats create mode 100644 tests/bats/lsblk.bats create mode 100644 tests/bats/lscpu.bats create mode 100644 tests/bats/lspci.bats create mode 100644 tests/bats/ps.bats diff --git a/Makefile b/Makefile index 3aea44a78..8817b4f68 100644 --- a/Makefile +++ b/Makefile @@ -108,6 +108,10 @@ lint: check: @bash tests/check.sh +.PHONY: bats +bats: + @bats --print-output-on-failure tests/bats/ + manual: @pandoc -t man -s -o root/usr/share/man/man8/aa-log.8 root/usr/share/man/man8/aa-log.md diff --git a/tests/bats/aa-status.bats b/tests/bats/aa-status.bats new file mode 100644 index 000000000..8adcd1580 --- /dev/null +++ b/tests/bats/aa-status.bats @@ -0,0 +1,40 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=aa-status +@test "aa-status: Check status" { + sudo aa-status + aa_check +} + +# bats test_tags=aa-status +@test "aa-status: Display the number of loaded policies" { + sudo aa-status --profiled + aa_check +} + +# bats test_tags=aa-status +@test "aa-status: Display the number of loaded enforicing policies" { + sudo aa-status --enforced + aa_check +} + +# bats test_tags=aa-status +@test "aa-status: Display the number of loaded non-enforcing policies" { + sudo aa-status --complaining + aa_check +} + +# bats test_tags=aa-status +@test "aa-status: Display the number of loaded enforcing policies that kill tasks" { + sudo aa-status --kill + aa_check +} diff --git a/tests/bats/blkid.bats b/tests/bats/blkid.bats new file mode 100644 index 000000000..65160f188 --- /dev/null +++ b/tests/bats/blkid.bats @@ -0,0 +1,22 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=blkid +@test "blkid: List all partitions" { + sudo blkid + aa_check +} + +# bats test_tags=blkid +@test "blkid: List all partitions in a table, including current mountpoints" { + sudo blkid -o list + aa_check +} diff --git a/tests/bats/common.bash b/tests/bats/common.bash new file mode 100644 index 000000000..c08d13758 --- /dev/null +++ b/tests/bats/common.bash @@ -0,0 +1,109 @@ +#!/usr/bin/env bash +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +export BATS_LIB_PATH=${BATS_LIB_PATH:-/usr/lib/bats} +load "$BATS_LIB_PATH/bats-support/load" + +export XDG_CACHE_DIR=".cache" +export XDG_CONFIG_DIR=".config" +export XDG_DATA_DIR=".local/share" +export XDG_STATE_DIR=".local/state" +export XDG_BIN_DIR=".local/bin" +export XDG_LIB_DIR=".local/lib" + +# Define extended user directories not defined in the XDG standard but commonly +# used in profiles +export XDG_SCREENSHOTS_DIR="Pictures/Screenshots" +export XDG_WALLPAPERS_DIR="Pictures/Wallpapers" +export XDG_BOOKS_DIR="Books" +export XDG_GAMES_DIR="Games" +export XDG_PROJECTS_DIR="Projects" +export XDG_WORK_DIR="Work" +export XDG_MAIL_DIR="Mail" +export XDG_SYNC_DIR="Sync" +export XDG_TORRENTS_DIR="Torrents" +export XDG_GAMESSTUDIO_DIR="unity3d" + +# Define user directories for virtual machines, shared folders and disk images +export XDG_VM_DIR=".vm" +export XDG_VMSHARE_DIR=".vmshare" +export XDG_IMG_DIR=".img" + +# Define user build directories and artifacts output +export XDG_BUILD_DIR=".build" +export XDG_PKG_DIR=".pkg" + +# Define user personal keyrings +export XDG_GPG_DIR=".gnupg" +export XDG_SSH_DIR=".ssh" +export XDG_PASSWORDSTORE_DIR=".password-store" + +# Define user personal private directories +export XDG_PRIVATE_DIR=".private" + +# Full path of the XDG Base Directory +export user_cache_dirs=$HOME/$XDG_CACHE_DIR +export user_config_dirs=$HOME/$XDG_CONFIG_DIR +export user_state_dirs=$HOME/$XDG_STATE_DIR +export user_bin_dirs=$HOME/$XDG_BIN_DIR +export user_lib_dirs=$HOME/$XDG_LIB_DIR + +# Other user directories +export user_desktop_dirs=$HOME/$XDG_DESKTOP_DIR +export user_download_dirs=$HOME/$XDG_DOWNLOAD_DIR +export user_templates_dirs=$HOME/$XDG_TEMPLATES_DIR +export user_publicshare_dirs=$HOME/$XDG_PUBLICSHARE_DIR +export user_documents_dirs=$HOME/$XDG_DOCUMENTS_DIR +export user_music_dirs=$HOME/$XDG_MUSIC_DIR +export user_pictures_dirs=$HOME/$XDG_PICTURES_DIR +export user_videos_dirs=$HOME/$XDG_VIDEOS_DIR +export user_books_dirs=$HOME/$XDG_BOOKS_DIR +export user_games_dirs=$HOME/$XDG_GAMES_DIR +export user_projects_dirs=$HOME/$XDG_PROJECTS_DIR +export user_work_dirs=$HOME/$XDG_WORK_DIR +export user_mail_dirs=$HOME/$XDG_MAIL_DIR +export user_sync_dirs=$HOME/$XDG_SYNC_DIR +export user_torrents_dirs=$HOME/$XDG_TORRENTS_DIR +export user_vm_dirs=$HOME/$XDG_VM_DIR +export user_vmshare_dirs=$HOME/$XDG_VMSHARE_DIR +export user_img_dirs=$HOME/$XDG_IMG_DIR +export user_build_dirs=$HOME/$XDG_BUILD_DIR +export user_pkg_dirs=$HOME/$XDG_PKG_DIR +export user_gpg_dirs=$HOME/$XDG_GPG_DIR +export user_ssh_dirs=$HOME/$XDG_SSH_DIR +export user_passwordstore_dirs=$HOME/$XDG_PASSWORDSTORE_DIR +export user_private_dirs=$HOME/$XDG_PRIVATE_DIR + +_START="$(date +%s)" +PROGRAM="$(basename "$BATS_TEST_FILENAME")" +PROGRAM="${PROGRAM%.*}" +export _START PROGRAM + +skip_if_not_installed() { + if ! which "$PROGRAM" &>/dev/null; then + skip "$PROGRAM is not installed" + fi +} + +aa_setup() { + aa_start + skip_if_not_installed +} + +aa_start() { + _START=$(date +%s) +} + +aa_check() { + local now duration logs + + now=$(date +%s) + duration=$((now - _START + 2)) + logs=$(aa-log --raw --systemd --since "-${duration}s") + if [[ -n "$logs" ]]; then + fail "profile $PROGRAM raised logs: $logs" + fi + aa_start +} diff --git a/tests/bats/df.bats b/tests/bats/df.bats new file mode 100644 index 000000000..be2843213 --- /dev/null +++ b/tests/bats/df.bats @@ -0,0 +1,34 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=df +@test "df: Display all filesystems and their disk usage" { + df + aa_check +} + +# bats test_tags=df +@test "df: Display all filesystems and their disk usage in human-readable form" { + df -h + aa_check +} + +# bats test_tags=df +@test "df: Include statistics on the number of free inodes" { + df --inodes + aa_check +} + +# bats test_tags=df +@test "df: Display filesystem types" { + df --print-type + aa_check +} diff --git a/tests/bats/lsblk.bats b/tests/bats/lsblk.bats new file mode 100644 index 000000000..4fecf42a5 --- /dev/null +++ b/tests/bats/lsblk.bats @@ -0,0 +1,58 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=lsblk +@test "lsblk: List all storage devices in a tree-like format" { + lsblk + aa_check +} + +# bats test_tags=lsblk +@test "lsblk: Also list empty devices" { + lsblk -a + aa_check +} + +# bats test_tags=lsblk +@test "lsblk: Print the SIZE column in bytes rather than in a human-readable format" { + lsblk -b + aa_check +} + +# bats test_tags=lsblk +@test "lsblk: Output info about filesystems" { + lsblk -f + aa_check +} + +# bats test_tags=lsblk +@test "lsblk: Use ASCII characters for tree formatting" { + lsblk -i + aa_check +} + +# bats test_tags=lsblk +@test "lsblk: Output info about block-device topology" { + lsblk -t + aa_check +} + +# bats test_tags=lsblk +@test "lsblk: Exclude the devices specified by the comma-separated list of major device numbers" { + lsblk -e 1 + aa_check +} + +# bats test_tags=lsblk +@test "lsblk: Display a customized summary using a comma-separated list of columns" { + lsblk --output NAME,SERIAL,MODEL,TRAN,TYPE,SIZE,FSTYPE,MOUNTPOINT + aa_check +} diff --git a/tests/bats/lscpu.bats b/tests/bats/lscpu.bats new file mode 100644 index 000000000..ef09cfbb7 --- /dev/null +++ b/tests/bats/lscpu.bats @@ -0,0 +1,28 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=lscpu +@test "lscpu: Display information about all CPUs" { + lscpu + aa_check +} + +# bats test_tags=lscpu +@test "lscpu: Display information in a table" { + lscpu --extended + aa_check +} + +# bats test_tags=lscpu +@test "lscpu: Display only information about offline CPUs in a table" { + lscpu --extended --offline + aa_check +} diff --git a/tests/bats/lspci.bats b/tests/bats/lspci.bats new file mode 100644 index 000000000..bc6ea2013 --- /dev/null +++ b/tests/bats/lspci.bats @@ -0,0 +1,40 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=lspci +@test "lspci: Show a brief list of devices" { + lspci + aa_check +} + +# bats test_tags=lspci +@test "lspci: Display additional info" { + lspci -v + aa_check +} + +# bats test_tags=lspci +@test "lspci: Display drivers and modules handling each device" { + lspci -k + aa_check +} + +# bats test_tags=lspci +@test "lspci: Show a specific device" { + lspci -s 00:00.0 + aa_check +} + +# bats test_tags=lspci +@test "lspci: Dump info in a readable form" { + lspci -vm + aa_check +} diff --git a/tests/bats/ps.bats b/tests/bats/ps.bats new file mode 100644 index 000000000..4be301f7b --- /dev/null +++ b/tests/bats/ps.bats @@ -0,0 +1,46 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=ps +@test "ps: List all running processes" { + ps aux + aa_check +} + +# bats test_tags=ps +@test "ps: List all running processes including the full command string" { + ps auxww + aa_check +} + +# bats test_tags=ps +@test "ps: List all processes of the current user in extra full format" { + ps --user "$(id -u)" -F + aa_check +} + +# bats test_tags=ps +@test "ps: List all processes of the current user as a tree" { + ps --user "$(id -u)" -f + aa_check +} + +# bats test_tags=ps +@test "ps: Get the parent PID of a process" { + ps -o ppid= -p 1 + aa_check +} + +# bats test_tags=ps +@test "ps: Sort processes by memory consumption" { + ps auxww --sort size + aa_check +} From 5603f2627469539d2b8ef298944af792325ec047 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 19:49:11 +0100 Subject: [PATCH 0379/1455] ci(github): add tests job. --- .github/workflows/main.yml | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index ddc95834a..34a449ff5 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -9,10 +9,10 @@ jobs: matrix: os: - ubuntu-24.04 - - ubuntu-22.04 + # - ubuntu-22.04 mode: - default - - full-system-policy + # - full-system-policy steps: - name: Check out repository code uses: actions/checkout@v4 @@ -43,10 +43,9 @@ jobs: sudo systemctl status apparmor.service - name: Ensure compatibility with some AppArmor userspace tools + if: matrix.os != 'ubuntu-24.04' run: | - if [[ ${{ matrix.os }} != ubuntu-24.04 ]]; then - sudo aa-enforce /etc/apparmor.d/aa-notify - fi + sudo aa-enforce /etc/apparmor.d/aa-notify - name: Show AppArmor log and rules run: | @@ -56,3 +55,15 @@ jobs: - name: Show Number of loaded profile run: sudo aa-status --profiled + + - name: Install Tests dependencies + if: matrix.mode == 'default' && matrix.os == 'ubuntu-24.04' + run: | + sudo apt-get update -q + sudo apt-get install -y \ + bats bats-support + + - name: Run the bats integration tests + if: matrix.mode == 'default' && matrix.os == 'ubuntu-24.04' + run: | + make bats From a65ebc42b29afecce58fe37b208340223eeb9b9d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 19:56:09 +0100 Subject: [PATCH 0380/1455] fix(aa-log): add missing flag definition. --- cmd/aa-log/main.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cmd/aa-log/main.go b/cmd/aa-log/main.go index 0c16f5e4b..58aee3716 100644 --- a/cmd/aa-log/main.go +++ b/cmd/aa-log/main.go @@ -92,6 +92,8 @@ func init() { flag.BoolVar(&rules, "rules", false, "Convert the log into AppArmor rules.") flag.BoolVar(&raw, "R", false, "Print the raw log without any formatting.") flag.BoolVar(&raw, "raw", false, "Print the raw log without any formatting.") + flag.StringVar(&since, "S", "", "Display logs since the START time.") + flag.StringVar(&since, "since", "", "Display logs since the START time.") } func main() { From 1efb50e67e0590b8e7d69e2b4d4323d4db556f9e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 21:12:46 +0100 Subject: [PATCH 0381/1455] ci(github): split build job to build and then tests job. --- .github/workflows/main.yml | 45 +++++++++++++++++++++++++++++++------- 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 34a449ff5..7321399e5 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -9,10 +9,10 @@ jobs: matrix: os: - ubuntu-24.04 - # - ubuntu-22.04 + - ubuntu-22.04 mode: - default - # - full-system-policy + - full-system-policy steps: - name: Check out repository code uses: actions/checkout@v4 @@ -30,12 +30,10 @@ jobs: if [[ ${{ matrix.mode }} == full-system-policy ]]; then echo -e "\noverride_dh_auto_build:\n\tmake full" >> debian/rules fi - VERSION="0.$(git rev-list --count HEAD)-1" - dch --newversion="$VERSION" --urgency=medium --distribution=stable --controlmaint "Release $VERSION" - dpkg-buildpackage -b -d --no-sign + bash dists/build.sh dpkg - name: Install apparmor.d - run: sudo dpkg --install ../apparmor.d_*_amd64.deb || true + run: sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true - name: Reload AppArmor run: | @@ -56,14 +54,45 @@ jobs: - name: Show Number of loaded profile run: sudo aa-status --profiled - - name: Install Tests dependencies + - name: Cache the build package if: matrix.mode == 'default' && matrix.os == 'ubuntu-24.04' + uses: actions/cache/save@v4 + with: + path: .pkg/apparmor.d_*_amd64.deb + key: ${{ matrix.os }}-${{ matrix.mode }}-${{ hashFiles('.pkg/apparmor.d_*_amd64.deb') }} + + tests: + runs-on: ubuntu-24.04 + needs: build + steps: + - name: Check out repository code + uses: actions/checkout@v4 + + - name: Restore the cached build package + uses: actions/cache/restore@v4 + with: + fail-on-cache-miss: true + path: .pkg/apparmor.d_*_amd64.deb + key: ubuntu-24.04-default-${{ hashFiles('.pkg/apparmor.d_*_amd64.deb') }} + restore-keys: | + ubuntu-24.04-default- + + - name: Install Tests dependencies run: | sudo apt-get update -q sudo apt-get install -y \ + apparmor-profiles apparmor-utils \ bats bats-support + - name: Install apparmor.d + run: | + sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true + sudo systemctl restart apparmor.service + - name: Run the bats integration tests - if: matrix.mode == 'default' && matrix.os == 'ubuntu-24.04' run: | make bats + + - name: Show final AppArmor logs + run: | + sudo aa-log -s From 165a5f7b9a88bb44321a77164832951bdcba6d0c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 21:19:42 +0100 Subject: [PATCH 0382/1455] feat: add nvimpager as possible pager. Also ensure the child-pager uses pager_path. fix #568 --- apparmor.d/groups/children/child-pager | 4 ++-- apparmor.d/tunables/multiarch.d/programs | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/children/child-pager b/apparmor.d/groups/children/child-pager index 4f9edd9ea..e904f96dd 100644 --- a/apparmor.d/groups/children/child-pager +++ b/apparmor.d/groups/children/child-pager @@ -13,7 +13,6 @@ abi , include -@{exec_path} = @{bin}/pager @{bin}/less @{bin}/more profile child-pager flags=(attach_disconnected) { include include @@ -24,10 +23,11 @@ profile child-pager flags=(attach_disconnected) { signal (receive) set=(stop, cont, term, kill), @{bin}/ r, - @{exec_path} mr, + @{pager_path} mr, @{system_share_dirs}/terminfo/{,**} r, /usr/share/file/misc/** r, + /usr/share/nvim/{,**} r, @{HOME}/.lesshst r, diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 406336e49..e8f523b6a 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -36,7 +36,7 @@ @{editor_names} = sensible-editor vim{,.*} nvim nano # Pager -@{pager_names} = sensible-pager pager less more +@{pager_names} = sensible-pager pager less more nvimpager # Browsers From d9e8502f7433c66184e1485956a89b893794daed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Guerraz?= Date: Mon, 21 Oct 2024 14:51:11 +0200 Subject: [PATCH 0383/1455] Photos from contacts in google don't have an extension --- apparmor.d/groups/gnome/gnome-shell | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 227edc404..a2627c31b 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -268,7 +268,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/icc/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw, - owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r, + owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-* r, owner @{user_cache_dirs}/gnome-boxes/*.png r, owner @{user_cache_dirs}/gnome-photos/{,**} r, owner @{user_cache_dirs}/gnome-screenshot/{,**} rw, From 7aaa8272bb9163cdc074f892cd19b748f206cb74 Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 20 Oct 2024 22:49:53 -0300 Subject: [PATCH 0384/1455] Update reflector --- apparmor.d/groups/pacman/reflector | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/pacman/reflector b/apparmor.d/groups/pacman/reflector index 588c39ccc..119f0d2a1 100644 --- a/apparmor.d/groups/pacman/reflector +++ b/apparmor.d/groups/pacman/reflector @@ -25,13 +25,17 @@ profile reflector @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/ r, + @{bin}/rsync ix, /etc/xdg/reflector/reflector.conf r, /etc/pacman.d/mirrorlist rw, /var/cache/reflector/mirrorstatus.json rw, - owner @{user_cache_dirs}/mirrorstatus.json r, + owner @{user_cache_dirs}/mirrorstatus.json rw, + + @{tmp}/@{rand8} rw, + @{tmp}/tmp@{rand8}/{,**} rw, @{PROC}/1/environ r, @{PROC}/cmdline r, From 610d37ecf7a7db9dfe95162bbeb83e64f416ceb2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 21:35:10 +0100 Subject: [PATCH 0385/1455] feat(child): child-pager: add full support for nvim. see #564 --- apparmor.d/abstractions/app/editor | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index 9816e7907..1d501eb9f 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -9,18 +9,19 @@ include include - @{sh_path} rix, - @{bin}/nvim mrix, - @{bin}/sensible-editor mr, - @{bin}/vim{,.*} mrix, - @{bin}/which{,.debianutils} rix, + @{sh_path} rix, + @{bin}/nvim mix, + @{bin}/sensible-editor mr, + @{bin}/vim{,.*} mix, + @{bin}/which{,.debianutils} ix, /usr/share/nvim/{,**} r, /usr/share/terminfo/** r, /usr/share/vim/{,**} r, - /etc/vimrc r, /etc/vim/{,**} r, + /etc/vimrc r, + /etc/xdg/nvim/* r, owner @{HOME}/.selected_editor r, owner @{HOME}/.viminf@{c}{,.tmp} rw, @@ -31,6 +32,9 @@ owner @{user_cache_dirs}/vim/{,**} rw, owner @{user_config_dirs}/vim/{,**} r, owner @{user_state_dirs}/nvim/{,**} rw, + owner @{user_config_dirs}/nvim/{,**} rw, + + owner @{run}/user/@{uid}/nvim.* rw, include if exists From 48738a4cae0d1b967d610df89cd11f10fb1bd5ef Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 21:36:49 +0100 Subject: [PATCH 0386/1455] fix(profile): crontab temp dir. fix #564 --- apparmor.d/groups/cron/crontab | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index bfd4158ad..ccc948b01 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -38,7 +38,9 @@ profile crontab @{exec_path} { owner @{user_cache_dirs}/crontab/crontab.bak rw, - @{tmp}/crontab.@{rand6}/{,crontab} rwl, + @{tmp}/crontab.@{rand6} rw, + @{tmp}/crontab.@{rand6}/ rw, + @{tmp}/crontab.@{rand6}/crontab rwl, profile editor { include From 2823f7562b014a6bccbb3cdb5f068e59b739fbd1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 22:00:02 +0100 Subject: [PATCH 0387/1455] fix(profile): firt set of issues raised by the integration tests --- apparmor.d/abstractions/disks-read | 2 ++ apparmor.d/abstractions/disks-write | 2 ++ apparmor.d/profiles-a-f/aa-enforce | 2 +- apparmor.d/profiles-a-f/blkid | 5 ++++- apparmor.d/profiles-g-l/lspci | 3 ++- 5 files changed, 11 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index bf46eea1a..ec356306b 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -20,6 +20,8 @@ @{sys}/devices/@{pci}/host@{int}/** r, @{sys}/devices/@{pci}/usb@{int}/** r, @{sys}/devices/@{pci}/virtio@{int}/** r, + @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/ r, + @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/** r, # SSD Nvme devices /dev/nvme[0-9]* rk, diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index 844a4fbeb..8bf33882d 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -20,6 +20,8 @@ @{sys}/devices/@{pci}/host@{int}/** r, @{sys}/devices/@{pci}/usb@{int}/** r, @{sys}/devices/@{pci}/virtio@{int}/** r, + @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/ r, + @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/** r, # SSD Nvme devices /dev/nvme[0-9]* rwk, diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/profiles-a-f/aa-enforce index a5b18eb4e..da4d63460 100644 --- a/apparmor.d/profiles-a-f/aa-enforce +++ b/apparmor.d/profiles-a-f/aa-enforce @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/aa-enforce @{bin}/aa-complain @{bin}/aa-audit +@{exec_path} = @{bin}/aa-enforce @{bin}/aa-complain @{bin}/aa-audit @{bin}/aa-disable profile aa-enforce @{exec_path} { include include diff --git a/apparmor.d/profiles-a-f/blkid b/apparmor.d/profiles-a-f/blkid index 282081330..4aea919b4 100644 --- a/apparmor.d/profiles-a-f/blkid +++ b/apparmor.d/profiles-a-f/blkid @@ -23,6 +23,8 @@ profile blkid @{exec_path} flags=(attach_disconnected) { @{etc_rw}/blkid.tab{,-@{rand6}} rw, @{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab, + /.ismount-test-file rw, + # Image files @{user_img_dirs}/{,**} r, @@ -34,8 +36,9 @@ profile blkid @{exec_path} flags=(attach_disconnected) { @{run}/cloud-init/ds-identify.log w, # file_inherit - # For the EVALUATE=scan method + @{PROC}/@{pid}/mounts r, @{PROC}/partitions r, + @{PROC}/swaps r, owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-g-l/lspci b/apparmor.d/profiles-g-l/lspci index 0f3abf1dc..3f0fe5d95 100644 --- a/apparmor.d/profiles-g-l/lspci +++ b/apparmor.d/profiles-g-l/lspci @@ -30,10 +30,11 @@ profile lspci @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.pciids-cache.tmp-*-@{pid} rw, owner @{HOME}/.pciids-cache rw, + owner @{user_cache_dirs}/pci-ids rw, @{sys}/bus/pci/devices/ r, @{sys}/bus/pci/slots/ r, - @{sys}/bus/pci/slots/@{int}/address r, + @{sys}/bus/pci/slots/@{int}-@{int}/address r, @{sys}/devices/@{pci}/** r, @{sys}/module/compression r, From f14fef10c2adcee9613f524c2c74be06ae385a01 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 22:16:08 +0100 Subject: [PATCH 0388/1455] tests(integration): add more test cases. --- tests/bats/aa-enforce.bats | 34 ++++++++++++++++++++++++++++ tests/bats/groupadd.bats | 36 ++++++++++++++++++++++++++++++ tests/bats/id.bats | 45 ++++++++++++++++++++++++++++++++++++++ tests/bats/pstree.bats | 29 ++++++++++++++++++++++++ 4 files changed, 144 insertions(+) create mode 100644 tests/bats/aa-enforce.bats create mode 100644 tests/bats/groupadd.bats create mode 100644 tests/bats/id.bats create mode 100644 tests/bats/pstree.bats diff --git a/tests/bats/aa-enforce.bats b/tests/bats/aa-enforce.bats new file mode 100644 index 000000000..913eedce8 --- /dev/null +++ b/tests/bats/aa-enforce.bats @@ -0,0 +1,34 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=aa-enforce +@test "aa-enforce: Disable profile" { + sudo aa-disable pass + aa_check +} + +# bats test_tags=aa-enforce +@test "aa-enforce: Enforce a profile" { + sudo aa-enforce pass + aa_check +} + +# bats test_tags=aa-enforce +@test "aa-enforce: Complain a profile" { + sudo aa-complain pass + aa_check +} + +# bats test_tags=aa-enforce +@test "aa-enforce: Audit a profile" { + sudo aa-audit pass + aa_check +} diff --git a/tests/bats/groupadd.bats b/tests/bats/groupadd.bats new file mode 100644 index 000000000..f55579591 --- /dev/null +++ b/tests/bats/groupadd.bats @@ -0,0 +1,36 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=groupadd +@test "groupadd: Create a new group" { + sudo groupadd user2 + aa_check +} + +# bats test_tags=groupadd +@test "groupadd: Create a new system group" { + sudo groupadd --system system2 + aa_check +} + +# bats test_tags=groupadd +@test "groupadd: Create a new group with the specific groupid" { + sudo groupadd --gid 3000 user3 + aa_check +} + +# bats test_tags=groupadd +@test "groupdel: Delete newly created group" { + sudo groupdel user2 + sudo groupdel system2 + sudo groupdel user3 + aa_check +} diff --git a/tests/bats/id.bats b/tests/bats/id.bats new file mode 100644 index 000000000..5a7b58c50 --- /dev/null +++ b/tests/bats/id.bats @@ -0,0 +1,45 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=id +@test "id: Display current user's ID (UID), group ID (GID) and groups to which they belong" { + id + aa_check +} + +# bats test_tags=id +@test "id: Display the current user identity" { + id -un + aa_check +} + +# bats test_tags=id +@test "id: Display the current user identity as a number" { + id -u + aa_check +} + +# bats test_tags=id +@test "id: Display the current primary group identity" { + id -gn + aa_check +} + +# bats test_tags=id +@test "id: Display the current primary group identity as a number" { + id -g + aa_check +} + +# bats test_tags=id +@test "id: Display an arbitrary user ID (UID), group ID (GID) and groups to which they belong" { + id root +} diff --git a/tests/bats/pstree.bats b/tests/bats/pstree.bats new file mode 100644 index 000000000..e3ed5fa80 --- /dev/null +++ b/tests/bats/pstree.bats @@ -0,0 +1,29 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=pstree +@test "pstree: Display a tree of processes" { + pstree + aa_check +} + +# bats test_tags=pstree +@test "pstree: Display a tree of processes with PIDs" { + pstree -p + aa_check +} + +# bats test_tags=pstree +@test "pstree: Display all process trees rooted at processes owned by specified user" { + pstree root + aa_check +} + From 21dcda26bb38e8680c9411d9394a9c0173b58bd6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 23:36:51 +0100 Subject: [PATCH 0389/1455] tests(integration): add more test cases (2). --- tests/bats/fc-cache.bats | 29 ++++++++++++++ tests/bats/fc-list.bats | 16 ++++++++ tests/bats/flatpak.bats | 52 +++++++++++++++++++++++++ tests/bats/gpgconf.bats | 33 ++++++++++++++++ tests/bats/groups.bats | 23 +++++++++++ tests/bats/ip.bats | 41 ++++++++++++++++++++ tests/bats/snap.bats | 52 +++++++++++++++++++++++++ tests/bats/systemd-detect-virt.bats | 25 ++++++++++++ tests/bats/uname.bats | 59 +++++++++++++++++++++++++++++ tests/bats/uptime.bats | 35 +++++++++++++++++ tests/bats/users.bats | 23 +++++++++++ tests/bats/uuidgen.bats | 23 +++++++++++ tests/bats/who.bats | 29 ++++++++++++++ 13 files changed, 440 insertions(+) create mode 100644 tests/bats/fc-cache.bats create mode 100644 tests/bats/fc-list.bats create mode 100644 tests/bats/flatpak.bats create mode 100644 tests/bats/gpgconf.bats create mode 100644 tests/bats/groups.bats create mode 100644 tests/bats/ip.bats create mode 100644 tests/bats/snap.bats create mode 100644 tests/bats/systemd-detect-virt.bats create mode 100644 tests/bats/uname.bats create mode 100644 tests/bats/uptime.bats create mode 100644 tests/bats/users.bats create mode 100644 tests/bats/uuidgen.bats create mode 100644 tests/bats/who.bats diff --git a/tests/bats/fc-cache.bats b/tests/bats/fc-cache.bats new file mode 100644 index 000000000..7ad92d94c --- /dev/null +++ b/tests/bats/fc-cache.bats @@ -0,0 +1,29 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=fc-cache +@test "fc-cache: Generate font cache files" { + fc-cache + aa_check +} + +# bats test_tags=fc-cache +@test "fc-cache: Force a rebuild of all font cache files, without checking if cache is up-to-date" { + fc-cache -f + aa_check +} + +# bats test_tags=fc-cache +@test "fc-cache: Erase font cache files, then generate new font cache files" { + fc-cache -r + aa_check +} + diff --git a/tests/bats/fc-list.bats b/tests/bats/fc-list.bats new file mode 100644 index 000000000..b85b1037e --- /dev/null +++ b/tests/bats/fc-list.bats @@ -0,0 +1,16 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=fc-list +@test "fc-list: Return a list of installed fonts in your system" { + fc-list + aa_check +} diff --git a/tests/bats/flatpak.bats b/tests/bats/flatpak.bats new file mode 100644 index 000000000..23647c932 --- /dev/null +++ b/tests/bats/flatpak.bats @@ -0,0 +1,52 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=flatpak +@test "flatpak: List installed applications, ignoring runtimes" { + flatpak list --app + aa_check +} + +# bats test_tags=flatpak +@test "flatpak: Install an application from a remote source" { + flatpak install --noninteractive org.vim.Vim + aa_check +} + +# bats test_tags=flatpak +@test "flatpak: Show information about an installed application" { + flatpak info org.vim.Vim + aa_check +} + +# bats test_tags=flatpak +@test "flatpak: Run an installed application" { + flatpak run org.vim.Vim + aa_check +} + +# bats test_tags=flatpak +@test "flatpak: Update all installed applications and runtimes" { + flatpak update --noninteractive + aa_check +} + +# bats test_tags=flatpak +@test "flatpak: Remove an installed application" { + flatpak remove --noninteractive org.vim.Vim + aa_check +} + +# bats test_tags=flatpak +@test "flatpak: Remove all unused applications" { + flatpak remove --unused + aa_check +} diff --git a/tests/bats/gpgconf.bats b/tests/bats/gpgconf.bats new file mode 100644 index 000000000..871a8f1ec --- /dev/null +++ b/tests/bats/gpgconf.bats @@ -0,0 +1,33 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=gpgconf +@test "gpgconf: List all components" { + gpgconf --list-components + aa_check +} + +# bats test_tags=gpgconf +@test "gpgconf: List the directories used by gpgconf" { + gpgconf --list-dirs + aa_check +} + +# bats test_tags=gpgconf +@test "gpgconf: List all options of a component" { + gpgconf --list-options gpg + gpgconf --list-options gpgsm + gpgconf --list-options gpg-agent + gpgconf --list-options scdaemon + gpgconf --list-options dirmngr + aa_check +} + diff --git a/tests/bats/groups.bats b/tests/bats/groups.bats new file mode 100644 index 000000000..829e2393f --- /dev/null +++ b/tests/bats/groups.bats @@ -0,0 +1,23 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=groups +@test "groups: Print group memberships for the current user" { + groups + aa_check +} + +# bats test_tags=groups +@test "groups: Print group memberships for a list of users" { + groups root + aa_check +} + diff --git a/tests/bats/ip.bats b/tests/bats/ip.bats new file mode 100644 index 000000000..980495d2d --- /dev/null +++ b/tests/bats/ip.bats @@ -0,0 +1,41 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=ip +@test "ip: List interfaces with detailed info" { + ip address + aa_check +} + +# bats test_tags=ip +@test "ip: List interfaces with brief network layer info" { + ip -brief address + aa_check +} + +# bats test_tags=ip +@test "ip: List interfaces with brief link layer info" { + ip -brief link + aa_check +} + +# bats test_tags=ip +@test "ip: Display the routing table" { + ip route + aa_check +} + +# bats test_tags=ip +@test "ip: Show neighbors (ARP table)" { + ip neighbour + aa_check +} + diff --git a/tests/bats/snap.bats b/tests/bats/snap.bats new file mode 100644 index 000000000..ef6a292da --- /dev/null +++ b/tests/bats/snap.bats @@ -0,0 +1,52 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=snap +@test "snap: Search for a package" { + snap find vim + aa_check +} + +# bats test_tags=snap +@test "snap: Install a package" { + sudo snap install nano-strict + aa_check +} + +# bats test_tags=snap +@test "snap: Update a package to another channel (track, risk, or branch)" { + sudo snap refresh nano-strict --channel=edge + aa_check +} + +# bats test_tags=snap +@test "snap: Update all packages" { + sudo snap refresh + aa_check +} + +# bats test_tags=snap +@test "snap: Display basic information about installed snap software" { + sudo snap list + aa_check +} + +# bats test_tags=snap +@test "snap: Check for recent snap changes in the system" { + sudo snap changes + aa_check +} + +# bats test_tags=snap +@test "snap: Uninstall a package" { + sudo snap remove nano-strict + aa_check +} diff --git a/tests/bats/systemd-detect-virt.bats b/tests/bats/systemd-detect-virt.bats new file mode 100644 index 000000000..0ea5fae35 --- /dev/null +++ b/tests/bats/systemd-detect-virt.bats @@ -0,0 +1,25 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# bats test_tags=systemd-detect-virt +@test "systemd-detect-virt: List detectable virtualization technologies" { + systemd-detect-virt --list +} + +# bats test_tags=systemd-detect-virt +@test "systemd-detect-virt: Detect virtualization, print the result and return a zero status code when running in a VM or a container, and a non-zero code otherwise" { + systemd-detect-virt +} + +# bats test_tags=systemd-detect-virt +@test "systemd-detect-virt: Silently check without printing anything" { + systemd-detect-virt --quiet +} + +# bats test_tags=systemd-detect-virt +@test "systemd-detect-virt: Only detect hardware virtualization" { + systemd-detect-virt --vm +} + diff --git a/tests/bats/uname.bats b/tests/bats/uname.bats new file mode 100644 index 000000000..683cef111 --- /dev/null +++ b/tests/bats/uname.bats @@ -0,0 +1,59 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=uname +@test "uname: Print all information" { + uname --all + aa_check +} + +# bats test_tags=uname +@test "uname: Print the current kernel name" { + uname --kernel-name + aa_check +} + +# bats test_tags=uname +@test "uname: Print the current network node host name" { + uname --nodename + aa_check +} + +# bats test_tags=uname +@test "uname: Print the current kernel release" { + uname --kernel-release + aa_check +} + +# bats test_tags=uname +@test "uname: Print the current kernel version" { + uname --kernel-version + aa_check +} + +# bats test_tags=uname +@test "uname: Print the current machine hardware name" { + uname --machine + aa_check +} + +# bats test_tags=uname +@test "uname: Print the current processor type" { + uname --processor + aa_check +} + +# bats test_tags=uname +@test "uname: Print the current operating system name" { + uname --operating-system + aa_check +} + diff --git a/tests/bats/uptime.bats b/tests/bats/uptime.bats new file mode 100644 index 000000000..846342f47 --- /dev/null +++ b/tests/bats/uptime.bats @@ -0,0 +1,35 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=uptime +@test "uptime: Print current time, uptime, number of logged-in users and other information" { + uptime + aa_check +} + +# bats test_tags=uptime +@test "uptime: Show only the amount of time the system has been booted for" { + uptime --pretty + aa_check +} + +# bats test_tags=uptime +@test "uptime: Print the date and time the system booted up at" { + uptime --since + aa_check +} + +# bats test_tags=uptime +@test "uptime: Display version" { + uptime --version + aa_check +} + diff --git a/tests/bats/users.bats b/tests/bats/users.bats new file mode 100644 index 000000000..097870abf --- /dev/null +++ b/tests/bats/users.bats @@ -0,0 +1,23 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=users +@test "users: Print logged in usernames" { + users + aa_check +} + +# bats test_tags=users +@test "users: Print logged in usernames according to a given file" { + users /var/log/wmtp + aa_check +} + diff --git a/tests/bats/uuidgen.bats b/tests/bats/uuidgen.bats new file mode 100644 index 000000000..8caa41862 --- /dev/null +++ b/tests/bats/uuidgen.bats @@ -0,0 +1,23 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=uuidgen +@test "uuidgen: Create a random UUIDv4" { + uuidgen --random + aa_check +} + +# bats test_tags=uuidgen +@test "uuidgen: Create a UUIDv1 based on the current time" { + uuidgen --time + aa_check +} + diff --git a/tests/bats/who.bats b/tests/bats/who.bats new file mode 100644 index 000000000..f8aaf5a17 --- /dev/null +++ b/tests/bats/who.bats @@ -0,0 +1,29 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=who +@test "who: Display the username, line, and time of all currently logged-in sessions" { + who + aa_check +} + +# bats test_tags=who +@test "who: Display all available information" { + who -a + aa_check +} + +# bats test_tags=who +@test "who: Display all available information with table headers" { + who -a -H + aa_check +} + From 1f869c12ad43220fb5cd310fde13d000c59755d9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Oct 2024 23:49:56 +0100 Subject: [PATCH 0390/1455] ci: ensure final logs are showned regardless of tests result. --- .github/workflows/main.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 7321399e5..b07fc8990 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -87,12 +87,13 @@ jobs: - name: Install apparmor.d run: | sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true - sudo systemctl restart apparmor.service + sudo systemctl restart apparmor.service - name: Run the bats integration tests run: | make bats - name: Show final AppArmor logs + if: always() run: | - sudo aa-log -s + sudo aa-log -s --raw From cca8e6508fcbd835afc242022582eb5f8b025acf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 00:37:50 +0100 Subject: [PATCH 0391/1455] fix(profile): apply some fix raised by the test suite. --- apparmor.d/abstractions/disks-read | 3 +-- apparmor.d/abstractions/disks-write | 3 +-- apparmor.d/groups/cron/cron | 1 + apparmor.d/groups/freedesktop/fc-cache | 2 ++ apparmor.d/groups/gpg/gpgconf | 5 +++-- apparmor.d/groups/pacman/archlinux-java | 2 ++ apparmor.d/groups/ssh/ssh-keygen | 2 ++ apparmor.d/groups/systemd/systemd-generator-cloud-init | 4 ++++ apparmor.d/groups/systemd/systemd-generator-fstab | 2 +- apparmor.d/groups/systemd/systemd-hostnamed | 1 + apparmor.d/groups/systemd/systemd-notify | 1 + apparmor.d/groups/systemd/userdbctl | 7 ++++++- apparmor.d/groups/ubuntu/apt-esm-json-hook | 1 + apparmor.d/profiles-a-f/apparmor_parser | 2 ++ apparmor.d/profiles-a-f/flatpak | 4 ++-- apparmor.d/profiles-g-l/landscape-sysinfo.wrapper | 4 ++++ apparmor.d/profiles-m-r/needrestart | 7 +++++++ apparmor.d/profiles-m-r/pstree | 2 ++ apparmor.d/profiles-s-z/snapd | 4 +++- apparmor.d/profiles-s-z/sudo | 3 +++ apparmor.d/profiles-s-z/uuidd | 9 ++++++++- apparmor.d/profiles-s-z/uuidgen | 6 ++++++ tests/bats/aa-enforce.bats | 1 + tests/bats/snap.bats | 1 + 24 files changed, 65 insertions(+), 12 deletions(-) diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index ec356306b..143a6ea7a 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -20,8 +20,7 @@ @{sys}/devices/@{pci}/host@{int}/** r, @{sys}/devices/@{pci}/usb@{int}/** r, @{sys}/devices/@{pci}/virtio@{int}/** r, - @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/ r, - @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/** r, + @{sys}/devices/**/host@{int}/** r, # SSD Nvme devices /dev/nvme[0-9]* rk, diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index 8bf33882d..9d708ae57 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -20,8 +20,7 @@ @{sys}/devices/@{pci}/host@{int}/** r, @{sys}/devices/@{pci}/usb@{int}/** r, @{sys}/devices/@{pci}/virtio@{int}/** r, - @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/ r, - @{sys}/devices/**/host@{int}/**/block/{s,v}d[a-z]/** r, + @{sys}/devices/**/host@{int}/** r, # SSD Nvme devices /dev/nvme[0-9]* rwk, diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 7c57f9468..4ce618ef7 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -12,6 +12,7 @@ profile cron @{exec_path} flags=(attach_disconnected) { include include include + include include include diff --git a/apparmor.d/groups/freedesktop/fc-cache b/apparmor.d/groups/freedesktop/fc-cache index c74ad2958..128a4708b 100644 --- a/apparmor.d/groups/freedesktop/fc-cache +++ b/apparmor.d/groups/freedesktop/fc-cache @@ -26,6 +26,8 @@ profile fc-cache @{exec_path} { /var/tmp/mkinitramfs_*/{**,} rwl, + owner @{user_cache_dirs}/ w, + # Silencer deny network inet6 stream, deny network inet stream, diff --git a/apparmor.d/groups/gpg/gpgconf b/apparmor.d/groups/gpg/gpgconf index 61c6cf8de..d7f8cb353 100644 --- a/apparmor.d/groups/gpg/gpgconf +++ b/apparmor.d/groups/gpg/gpgconf @@ -22,10 +22,11 @@ profile gpgconf @{exec_path} { @{bin}/gpg-connect-agent rPx, @{bin}/gpg{,2} rPx, @{bin}/gpgsm rPx, - @{bin}/pinentry-* rPx, + @{bin}/pinentry{,-*} rPx, @{bin}/scdaemon rPx, + @{lib}/{,gnupg/}keyboxd rPUx, @{lib}/{,gnupg/}scdaemon rPx, - @{lib}/keyboxd rPUx, + @{lib}/{,gnupg/}tpm2daemon rPUx, /etc/gcrypt/hwf.deny r, /etc/gnupg/gpgconf.conf r, diff --git a/apparmor.d/groups/pacman/archlinux-java b/apparmor.d/groups/pacman/archlinux-java index e6728a606..fe83e168d 100644 --- a/apparmor.d/groups/pacman/archlinux-java +++ b/apparmor.d/groups/pacman/archlinux-java @@ -17,9 +17,11 @@ profile archlinux-java @{exec_path} { @{bin}/basename rix, @{bin}/bash rix, @{bin}/dirname rix, + @{bin}/find rix, @{bin}/id rix, @{bin}/ln rix, @{bin}/readlink rix, + @{bin}/sort rix, @{bin}/unlink rix, @{lib}/jvm/default w, diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index af43fb046..05a21d41f 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -21,6 +21,8 @@ profile ssh-keygen @{exec_path} { owner @{HOME}/@{XDG_SSH_DIR}/ w, owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw, + /tmp/snapd@{int}/*_*{,.pub} w, + /dev/tty@{int} rw, /dev/ttyS@{int} rw, diff --git a/apparmor.d/groups/systemd/systemd-generator-cloud-init b/apparmor.d/groups/systemd/systemd-generator-cloud-init index 2737a94f4..698a4fcb9 100644 --- a/apparmor.d/groups/systemd/systemd-generator-cloud-init +++ b/apparmor.d/groups/systemd/systemd-generator-cloud-init @@ -15,6 +15,7 @@ profile systemd-generator-cloud-init @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, + @{bin}/ln rix, @{bin}/mkdir rix, @{bin}/systemd-detect-virt rPx, @{lib}/cloud-init/ds-identify rPUx, @@ -22,6 +23,9 @@ profile systemd-generator-cloud-init @{exec_path} flags=(attach_disconnected) { @{run}/cloud-init/ w, @{run}/cloud-init/cloud-init-generator.* rw, @{run}/cloud-init/disabled w, + @{run}/cloud-init/enabled w, + @{run}/systemd/generator.early/multi-user.target.wants/ w, + @{run}/systemd/generator.early/multi-user.target.wants/cloud-init.target w, @{PROC}/cmdline r, diff --git a/apparmor.d/groups/systemd/systemd-generator-fstab b/apparmor.d/groups/systemd/systemd-generator-fstab index 55736d142..193ff22af 100644 --- a/apparmor.d/groups/systemd/systemd-generator-fstab +++ b/apparmor.d/groups/systemd/systemd-generator-fstab @@ -19,7 +19,7 @@ profile systemd-generator-fstab @{exec_path} { /etc/fstab r, - @{run}/systemd/generator/** w, + @{run}/systemd/generator/** rw, @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index 04cbbaf5e..a169a59d6 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -31,6 +31,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { @{etc_rw}/.#hostname* rw, @{etc_rw}/hostname rw, + /etc/.#machine-info@{hex16} rw, /etc/.#machine-info@{rand6} rw, /etc/machine-id r, /etc/machine-info rw, diff --git a/apparmor.d/groups/systemd/systemd-notify b/apparmor.d/groups/systemd/systemd-notify index aafb0d74c..f62599d28 100644 --- a/apparmor.d/groups/systemd/systemd-notify +++ b/apparmor.d/groups/systemd/systemd-notify @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/systemd-notify profile systemd-notify @{exec_path} { include + include capability sys_admin, capability net_admin, diff --git a/apparmor.d/groups/systemd/userdbctl b/apparmor.d/groups/systemd/userdbctl index 0e3a99ba8..177431f92 100644 --- a/apparmor.d/groups/systemd/userdbctl +++ b/apparmor.d/groups/systemd/userdbctl @@ -9,11 +9,14 @@ include @{exec_path} = @{bin}/userdbctl profile userdbctl @{exec_path} { include + include include capability dac_read_search, capability sys_resource, + signal send set=cont peer=child-pager, + @{exec_path} mr, @{pager_path} rPx -> child-pager, @@ -21,7 +24,9 @@ profile userdbctl @{exec_path} { /etc/shadow r, /etc/gshadow r, - @{PROC}/1/cgroup r, + @{PROC}/1/cgroup r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/uid_map r, include if exists } diff --git a/apparmor.d/groups/ubuntu/apt-esm-json-hook b/apparmor.d/groups/ubuntu/apt-esm-json-hook index 60569edd2..2dcf50743 100644 --- a/apparmor.d/groups/ubuntu/apt-esm-json-hook +++ b/apparmor.d/groups/ubuntu/apt-esm-json-hook @@ -20,6 +20,7 @@ profile apt-esm-json-hook @{exec_path} { /var/lib/ubuntu-advantage/{,**} r, /var/lib/ubuntu-advantage/apt-esm/{,**} rw, + /var/log/ubuntu-advantage-apt-hook.log w, @{run}/cloud-init/cloud-id-nocloud r, diff --git a/apparmor.d/profiles-a-f/apparmor_parser b/apparmor.d/profiles-a-f/apparmor_parser index bb4fe0739..b2c181042 100644 --- a/apparmor.d/profiles-a-f/apparmor_parser +++ b/apparmor.d/profiles-a-f/apparmor_parser @@ -44,6 +44,8 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/kernel/osrelease r, owner @{PROC}/@{pid}/mounts r, + deny network netlink raw, # file_inherit + include if exists } diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index 96d78b800..7368d7c3b 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -72,9 +72,9 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain owner @{user_share_dirs}/ r, owner @{user_share_dirs}/flatpak/{,**} rwl, - /tmp/#@{int} rw, - owner /dev/shm/flatpak*/{,**} rw, + owner @{tmp}/#@{int} rw, owner @{tmp}/ostree-gpg-@{rand6}/{,**} rw, + owner /dev/shm/flatpak*/{,**} rw, @{run}/.userns r, @{run}/user/@{uid}/.dbus-proxy/ w, diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper index e765a5dc6..e27e226c5 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper +++ b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper @@ -10,6 +10,10 @@ include profile landscape-sysinfo.wrapper @{exec_path} { include + capability dac_override, + capability fowner, + capability fsetid, + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 1f32df8c3..37a1c90a3 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -22,6 +22,8 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { ptrace (read), + mqueue r type=posix /, + @{exec_path} mrix, @{sh_path} rix, @@ -76,8 +78,13 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { include include + capability sys_resource, capability net_admin, + signal send set=term peer=systemd-tty-ask-password-agent, + + @{bin}/systemd-tty-ask-password-agent Px, + include if exists } diff --git a/apparmor.d/profiles-m-r/pstree b/apparmor.d/profiles-m-r/pstree index bd2265e32..4b75a0364 100644 --- a/apparmor.d/profiles-m-r/pstree +++ b/apparmor.d/profiles-m-r/pstree @@ -18,6 +18,8 @@ profile pstree @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + /usr/share/terminfo/** r, + @{PROC} r, @{PROC}/@{pids}/attr/current r, @{PROC}/@{pids}/stat r, diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index e6ded0956..d51c65d4d 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -121,9 +121,11 @@ profile snapd @{exec_path} { /var/cache/apparmor/*/snap* rw, /tmp/ r, + /tmp/read-file@{int}/{,**} rw, + /tmp/snapd@{int}/ rw, + /tmp/snapd@{int}/** rw, /tmp/syscheck-mountpoint-@{int}/{,**} rw, /tmp/syscheck-squashfs-@{int} rw, - /tmp/read-file@{int}/{,**} rw, /boot/ r, /boot/grub/grubenv r, diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index 49df90aa3..ca9f66d27 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -29,6 +29,9 @@ profile sudo @{exec_path} flags=(attach_disconnected) { signal (send) set=(winch) peer=child-pager, signal (send) set=(winch) peer=journalctl, signal (send) set=(winch) peer=pacman, + signal (send) set=(winch, hup, term) peer=rpm, + + unix bind type=stream addr=@@{hex16}/bus/sudo/system/, @{bin}/@{shells} rUx, @{lib}/** PUx, diff --git a/apparmor.d/profiles-s-z/uuidd b/apparmor.d/profiles-s-z/uuidd index 69f28da32..56b89fa2a 100644 --- a/apparmor.d/profiles-s-z/uuidd +++ b/apparmor.d/profiles-s-z/uuidd @@ -7,11 +7,18 @@ abi , include @{exec_path} = @{bin}/uuidd -profile uuidd @{exec_path} { +profile uuidd @{exec_path} flags=(attach_disconnected) { include + include + + network inet dgram, @{exec_path} mr, + owner /var/lib/libuuid/clock.txt rwk, + + @{att}/@{run}/uuidd/request w, + include if exists } diff --git a/apparmor.d/profiles-s-z/uuidgen b/apparmor.d/profiles-s-z/uuidgen index 56e8abef9..c056daaa0 100644 --- a/apparmor.d/profiles-s-z/uuidgen +++ b/apparmor.d/profiles-s-z/uuidgen @@ -11,8 +11,14 @@ profile uuidgen @{exec_path} { include include + network inet dgram, + @{exec_path} mr, + owner /var/lib/libuuid/clock.txt w, + + @{run}/uuidd/request w, + include if exists } diff --git a/tests/bats/aa-enforce.bats b/tests/bats/aa-enforce.bats index 913eedce8..05f311ca1 100644 --- a/tests/bats/aa-enforce.bats +++ b/tests/bats/aa-enforce.bats @@ -7,6 +7,7 @@ load common setup_file() { aa_setup + skip } # bats test_tags=aa-enforce diff --git a/tests/bats/snap.bats b/tests/bats/snap.bats index ef6a292da..a54dda828 100644 --- a/tests/bats/snap.bats +++ b/tests/bats/snap.bats @@ -7,6 +7,7 @@ load common setup_file() { aa_setup + skip } # bats test_tags=snap From d7521b36df464cd8ff46b61b5f706ca36df516c7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 00:53:50 +0100 Subject: [PATCH 0392/1455] test: improve gpgconf tests. --- tests/bats/gpgconf.bats | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/bats/gpgconf.bats b/tests/bats/gpgconf.bats index 871a8f1ec..7d522d859 100644 --- a/tests/bats/gpgconf.bats +++ b/tests/bats/gpgconf.bats @@ -26,8 +26,23 @@ setup_file() { gpgconf --list-options gpg gpgconf --list-options gpgsm gpgconf --list-options gpg-agent - gpgconf --list-options scdaemon + gpgconf --list-options scdaemon || true gpgconf --list-options dirmngr aa_check } +# bats test_tags=gpgconf +@test "gpgconf: List programs and test whether they are runnable" { + gpgconf --check-programs || true + aa_check +} + +# bats test_tags=gpgconf +@test "gpgconf: Reload a component" { + gpgconf --reload gpg + gpgconf --reload gpgsm + gpgconf --reload gpg-agent + gpgconf --reload scdaemon || true + gpgconf --reload dirmngr + aa_check +} From e9eb5cff342736df5ae0360f17efbefa593785b5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 01:03:46 +0100 Subject: [PATCH 0393/1455] feat(abs): include disk-read in disk-write. --- apparmor.d/abstractions/disks-write | 86 +++++------------------------ 1 file changed, 15 insertions(+), 71 deletions(-) diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index 9d708ae57..ce0a05dd5 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -3,99 +3,43 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - # The /sys/ entries probably should be tightened - abi , - /dev/ r, - /dev/block/ r, - /dev/disk/{,*/} r, + include # Regular disk/partition devices - /dev/{s,v}d[a-z]* rwk, - /dev/{s,v}d[a-z]*@{int} rwk, - @{sys}/devices/@{pci}/ata@{int}/** r, - @{sys}/devices/@{pci}/block/{s,v}d[a-z]/ r, - @{sys}/devices/@{pci}/block/{s,v}d[a-z]/** r, - @{sys}/devices/@{pci}/host@{int}/** r, - @{sys}/devices/@{pci}/usb@{int}/** r, - @{sys}/devices/@{pci}/virtio@{int}/** r, - @{sys}/devices/**/host@{int}/** r, + /dev/{s,v}d[a-z]* w, + /dev/{s,v}d[a-z]*@{int} w, # SSD Nvme devices - /dev/nvme[0-9]* rwk, - @{sys}/devices/@{pci}/nvme/nvme@{int}/{,**} r, + /dev/nvme[0-9]* w, # SD card devices - /dev/mmcblk[0-9]* rwk, - /dev/mmcblk[0-9]*p@{int} rwk, - @{sys}/devices/@{pci}/block/mmcblk@{int}/ r, - @{sys}/devices/@{pci}/block/mmcblk@{int}/** r, - @{sys}/devices/@{pci}/mmc@{int}/mmc*/ r, - @{sys}/devices/@{pci}/mmc@{int}/mmc*/** r, - @{sys}/devices/platform/**/block/mmcblk@{int}/ r, - @{sys}/devices/platform/**/block/mmcblk@{int}/** r, - @{sys}/devices/platform/**/mmc@{int}/ r, - @{sys}/devices/platform/**/mmc@{int}/** r, + /dev/mmcblk[0-9]* w, + /dev/mmcblk[0-9]*p@{int} w, # Loop devices - /dev/loop[0-9]* rwk, - /dev/loop[0-9]*p@{int} rwk, - @{sys}/devices/virtual/block/loop@{int}/ r, - @{sys}/devices/virtual/block/loop@{int}/** r, + /dev/loop[0-9]* w, + /dev/loop[0-9]*p@{int} w, # LUKS/LVM (device-mapper) devices - /dev/dm-@{int} rwk, - /dev/mapper/{,*} rw, - @{sys}/devices/virtual/block/dm-@{int}/ r, - @{sys}/devices/virtual/block/dm-@{int}/** r, + /dev/dm-@{int} w, + /dev/mapper/{,*} w, # ZFS devices - /dev/zd@{int} rwk, - /dev/*pool/ r, - /dev/zvol/{,*/} r, - @{sys}/devices/virtual/block/zd@{int}/ r, - @{sys}/devices/virtual/block/zd@{int}/** r, + /dev/zd@{int} w, # ZRAM devices - /dev/zram@{int} rwk, - @{sys}/devices/virtual/block/zram@{int}/ r, - @{sys}/devices/virtual/block/zram@{int}/** r, + /dev/zram@{int} w, # NBD devices - /dev/nbd* rwk, - @{sys}/devices/virtual/block/nbd@{int}/ r, - @{sys}/devices/virtual/block/nbd@{int}/** r, + /dev/nbd* w, # Floppy disks - /dev/fd@{int} rwk, - @{sys}/devices/platform/floppy.@{int}/block/fd@{int}/ r, - @{sys}/devices/platform/floppy.@{int}/block/fd@{int}/** r, + /dev/fd@{int} w, # CD-ROM - /dev/sr@{int} rwk, - - # Lookup block device by major:minor numbers - # See: https://apparmor.pujol.io/development/structure/#udev-rules - - @{sys}/block/ r, - @{sys}/class/block/ r, - @{sys}/dev/block/ r, - - @{run}/udev/data/b2:@{int} r, # for /dev/fd* - @{run}/udev/data/b7:@{int} r, # for /dev/loop* - @{run}/udev/data/b8:@{int} r, # for /dev/sd* - @{run}/udev/data/b11:@{int} r, # for /dev/sr* - @{run}/udev/data/b43:@{int} r, # for /dev/nbd* - @{run}/udev/data/b179:@{int} r, # for /dev/mmcblk* - @{run}/udev/data/b230:@{int} r, # for /dev/zvol* - @{run}/udev/data/b24[0-9]:@{int} r, # for dynamic assignment range 240 to 254 - @{run}/udev/data/b25[0-4]:@{int} r, - @{run}/udev/data/b259:@{int} r, # Block Extended Major - - @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** - - @{run}/udev/data/+usb:* r, # for disk over usb hub + /dev/sr@{int} w, include if exists From 3285de675fb6ac98f8c4ba582b29f55baa8b4c17 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 11:16:49 +0100 Subject: [PATCH 0394/1455] fix(profile): minor fixes. --- apparmor.d/groups/gpg/gpg-connect-agent | 2 ++ apparmor.d/groups/gpg/keyboxd | 1 + 2 files changed, 3 insertions(+) diff --git a/apparmor.d/groups/gpg/gpg-connect-agent b/apparmor.d/groups/gpg/gpg-connect-agent index d6c88c4fd..ebea13b56 100644 --- a/apparmor.d/groups/gpg/gpg-connect-agent +++ b/apparmor.d/groups/gpg/gpg-connect-agent @@ -20,6 +20,8 @@ profile gpg-connect-agent @{exec_path} { owner @{run}/user/@{uid}/gnupg/ w, owner @{run}/user/@{uid}/gnupg/d.*/ rw, + owner @{run}/user/@{uid}/gnupg/S.dirmngr rw, + owner @{run}/user/@{uid}/gnupg/S.gpg-agent rw, owner @{tmp}/tmp.*/.#lk0x@{hex}.*.@{pid} rw, owner @{tmp}/tmp.*/.#lk0x@{hex}.*.@{pid}x rwl -> /tmp/*/.#lk0x@{hex}.*.@{pid}, diff --git a/apparmor.d/groups/gpg/keyboxd b/apparmor.d/groups/gpg/keyboxd index cb0046fd6..a6eadd904 100644 --- a/apparmor.d/groups/gpg/keyboxd +++ b/apparmor.d/groups/gpg/keyboxd @@ -12,6 +12,7 @@ profile keyboxd @{exec_path} { @{exec_path} mr, + owner @{HOME}/@{XDG_GPG_DIR}/ w, owner @{HOME}/@{XDG_GPG_DIR}/common.conf r, owner @{HOME}/@{XDG_GPG_DIR}/public-keys.d/ rw, owner @{HOME}/@{XDG_GPG_DIR}/public-keys.d/* rwlk, From 75f25ebaecca0da2708fb2de4f0d2a197433b603 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 11:20:45 +0100 Subject: [PATCH 0395/1455] feat(abs): use dconf in dconf-write. --- apparmor.d/abstractions/dconf-write | 21 ++++----------------- apparmor.d/abstractions/dconf.d/complete | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 17 deletions(-) diff --git a/apparmor.d/abstractions/dconf-write b/apparmor.d/abstractions/dconf-write index b83a585e2..e84ffcb2e 100644 --- a/apparmor.d/abstractions/dconf-write +++ b/apparmor.d/abstractions/dconf-write @@ -7,25 +7,12 @@ abi , - dbus send bus=session path=/ca/desrt/dconf/Writer/user - interface=ca.desrt.dconf.Writer - member=Change - peer=(name=ca.desrt.dconf), # no peer's labels + include - dbus receive bus=session path=/ca/desrt/dconf/Writer/user - interface=ca.desrt.dconf.Writer - member=Notify - peer=(name=:*, label=dconf-service), + owner @{user_config_dirs}/glib-2.0/settings/keyfile w, - /usr/share/dconf/profile/gdm r, - - /etc/dconf/** r, - - owner @{user_config_dirs}/dconf/user r, - owner @{user_config_dirs}/glib-2.0/settings/keyfile rw, - - owner @{run}/user/@{uid}/dconf/ rw, - owner @{run}/user/@{uid}/dconf/user rw, + owner @{run}/user/@{uid}/dconf/ w, + owner @{run}/user/@{uid}/dconf/user w, include if exists diff --git a/apparmor.d/abstractions/dconf.d/complete b/apparmor.d/abstractions/dconf.d/complete index 108f6b8c7..ed8fa33e6 100644 --- a/apparmor.d/abstractions/dconf.d/complete +++ b/apparmor.d/abstractions/dconf.d/complete @@ -2,6 +2,20 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + dbus send bus=session path=/ca/desrt/dconf/Writer/user + interface=ca.desrt.dconf.Writer + member=Change + peer=(name=ca.desrt.dconf), # no peer's labels + + dbus receive bus=session path=/ca/desrt/dconf/Writer/user + interface=ca.desrt.dconf.Writer + member=Notify + peer=(name=:*, label=dconf-service), + + /usr/share/dconf/profile/gdm r, + owner @{user_config_dirs}/glib-2.0/settings/keyfile r, + owner @{run}/user/@{uid}/dconf/ r, + # vim:syntax=apparmor From 7ed8bcf1a7578f45924faf69517628a9cccd7959 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 11:27:07 +0100 Subject: [PATCH 0396/1455] feat(abs): use thumbnails-cache-read in thumbnails-cache-write. --- apparmor.d/abstractions/thumbnails-cache-read | 4 ++-- apparmor.d/abstractions/thumbnails-cache-write | 16 +++++++++------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/apparmor.d/abstractions/thumbnails-cache-read b/apparmor.d/abstractions/thumbnails-cache-read index adb80dd4d..22982e1f4 100644 --- a/apparmor.d/abstractions/thumbnails-cache-read +++ b/apparmor.d/abstractions/thumbnails-cache-read @@ -7,11 +7,11 @@ owner @{user_cache_dirs}/thumbnails/ r, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/ r, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/ r, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/*.png r, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/*.png r, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/*.png.@{rand6} r, owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/#@{int} r, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/ r, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/*.png r, include if exists diff --git a/apparmor.d/abstractions/thumbnails-cache-write b/apparmor.d/abstractions/thumbnails-cache-write index 5a31de221..5e64fc66f 100644 --- a/apparmor.d/abstractions/thumbnails-cache-write +++ b/apparmor.d/abstractions/thumbnails-cache-write @@ -5,13 +5,15 @@ abi , - owner @{user_cache_dirs}/thumbnails/ rw, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/ rw, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/ rw, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/*.png rw, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/*.png rwl -> @{user_cache_dirs}/thumbnails/{fail,*large,normal}/#@{int}, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/*.png.@{rand6} rw, - owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/#@{int} rw, + include + + owner @{user_cache_dirs}/thumbnails/ w, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/ w, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/*.png wl, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/*.png.@{rand6} w, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/#@{int} w, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/ w, + owner @{user_cache_dirs}/thumbnails/{fail,*large,normal}/gnome-thumbnail-factory/*.png w, include if exists From e24850344829c0bff22ff665a9ad7c1da59545a0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 11:29:58 +0100 Subject: [PATCH 0397/1455] feat(abs): use xdg-desktop in xfce. --- apparmor.d/abstractions/xfce | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/apparmor.d/abstractions/xfce b/apparmor.d/abstractions/xfce index 0d510a3fe..936504e74 100644 --- a/apparmor.d/abstractions/xfce +++ b/apparmor.d/abstractions/xfce @@ -9,17 +9,13 @@ include include include + include /usr/share/xfce4/ r, owner @{user_config_dirs}/xfce4/help{,ers}.rc rw, owner @{user_config_dirs}/xfce4/help{,ers}.rc.@{int}.tmp rw, - owner @{HOME}/.local/ rw, - owner @{user_cache_dirs}/ rw, - owner @{user_config_dirs}/ rw, - owner @{user_share_dirs}/ rw, - include if exists # vim:syntax=apparmor From d121092c566c2bf526298a9d965ff6279815451b Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Tue, 22 Oct 2024 18:45:14 +0800 Subject: [PATCH 0398/1455] Update to ABI4.0 for Arch Linux --- cmd/prebuild/main.go | 1 - 1 file changed, 1 deletion(-) diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 91f77e2e0..3f2dd9f43 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -38,7 +38,6 @@ func init() { // Compatibility with AppArmor 3 switch prebuild.Distribution { case "arch": - prebuild.ABI = 3 case "ubuntu": if !slices.Contains([]string{"noble"}, prebuild.Release["VERSION_CODENAME"]) { From 449c8d3e3ab3ce0f434c730c7c3169fc691f5425 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 13:16:03 +0100 Subject: [PATCH 0399/1455] tests(integration): add more tests. --- tests/bats/chsh.bats | 28 +++++++++++++++++++++++ tests/bats/lsusb.bats | 28 +++++++++++++++++++++++ tests/bats/useradd.bats | 49 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 105 insertions(+) create mode 100644 tests/bats/chsh.bats create mode 100644 tests/bats/lsusb.bats create mode 100644 tests/bats/useradd.bats diff --git a/tests/bats/chsh.bats b/tests/bats/chsh.bats new file mode 100644 index 000000000..42cfa1151 --- /dev/null +++ b/tests/bats/chsh.bats @@ -0,0 +1,28 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=chsh +@test "chsh: [l]ist available shells" { + chsh --list-shells + aa_check +} + +# bats test_tags=chsh +@test "chsh: Set a specific login [s]hell for the current user" { + chsh --shell /usr/bin/bash + aa_check +} + +# bats test_tags=chsh +@test "chsh: Set a login [s]hell for a specific user" { + sudo chsh --shell /usr/bin/sh root + aa_check +} diff --git a/tests/bats/lsusb.bats b/tests/bats/lsusb.bats new file mode 100644 index 000000000..530841a20 --- /dev/null +++ b/tests/bats/lsusb.bats @@ -0,0 +1,28 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=lsusb +@test "lsusb: List all the USB devices available" { + lsusb + aa_check +} + +# bats test_tags=lsusb +@test "lsusb: List the USB hierarchy as a tree" { + lsusb -t + aa_check +} + +# bats test_tags=lsusb +@test "lsusb: List verbose information about USB devices" { + lsusb --verbose + aa_check +} diff --git a/tests/bats/useradd.bats b/tests/bats/useradd.bats new file mode 100644 index 000000000..833e01606 --- /dev/null +++ b/tests/bats/useradd.bats @@ -0,0 +1,49 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=useradd +@test "useradd: Create a new user with the specified shell" { + sudo useradd --shell /bin/bash --create-home user2 + aa_check +} + +# bats test_tags=useradd +@test "useradd: Create a new user with the specified user ID" { + sudo useradd --uid 3000 user3 + aa_check +} + +# bats test_tags=useradd +@test "useradd: Create a new user belonging to additional groups (mind the lack of whitespace)" { + sudo useradd --groups adm user4 + aa_check +} + + +# bats test_tags=useradd +@test "useradd: Create a new system user without the home directory" { + sudo useradd --system sys2 + aa_check +} + +# bats test_tags=userdel +@test "userdel: Remove a user" { + sudo userdel user3 + sudo userdel user4 + sudo userdel sys2 + aa_check +} + +# bats test_tags=userdel +@test "userdel: Remove a user along with the home directory and mail spool" { + sudo userdel --remove user2 + aa_check +} From 887b2b0d62742af7744685447ed5a9c371a9c469 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 13:27:18 +0100 Subject: [PATCH 0400/1455] build: various improvment to the makefile. --- Makefile | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/Makefile b/Makefile index 8817b4f68..685649112 100644 --- a/Makefile +++ b/Makefile @@ -7,35 +7,35 @@ DESTDIR ?= / BUILD ?= .build PKGDEST ?= ${PWD}/.pkg PKGNAME := apparmor.d -P = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*))) - -.PHONY: all build enforce full install local $(P) dev package pkg dpkg rpm tests lint check manual docs serve clean +PROFILES = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*))) +.PHONY: all all: build @./${BUILD}/prebuild --complain +.PHONY: build build: @go build -o ${BUILD}/ ./cmd/aa-log @go build -o ${BUILD}/ ./cmd/prebuild +.PHONY: enforce enforce: build @./${BUILD}/prebuild +.PHONY: full full: build @./${BUILD}/prebuild --complain --full -SHARE = $(shell find "${BUILD}/share" -type f -not -name "*.md" -printf "%P\n") -PROFILES = $(shell find "${BUILD}/apparmor.d" -type f -printf "%P\n") -DISABLES = $(shell find "${BUILD}/apparmor.d" -type l -printf "%P\n") +.PHONY: install install: @install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log - @for file in ${SHARE}; do \ + @for file in $(shell find "${BUILD}/share" -type f -not -name "*.md" -printf "%P\n"); do \ install -Dm0644 "${BUILD}/share/$${file}" "${DESTDIR}/usr/share/$${file}"; \ done; - @for file in ${PROFILES}; do \ + @for file in $(shell find "${BUILD}/apparmor.d" -type f -printf "%P\n"); do \ install -Dm0644 "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \ done; - @for file in ${DISABLES}; do \ + @for file in $(shell find "${BUILD}/apparmor.d" -type l -printf "%P\n"); do \ mkdir -p "${DESTDIR}/etc/apparmor.d/disable"; \ cp -d "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \ done; @@ -48,19 +48,14 @@ install: install -Dm0644 "$${file}" "${DESTDIR}/usr/lib/systemd/user/$${service}.d/apparmor.conf"; \ done -local: - @make - @sudo make install - @sudo systemctl restart apparmor || sudo systemctl status apparmor -ABSTRACTIONS = $(shell find ${BUILD}/apparmor.d/abstractions/ -type f -printf "%P\n") -TUNABLES = $(shell find ${BUILD}/apparmor.d/tunables/ -type f -printf "%P\n") -$(P): +.PHONY: $(PROFILES) +$(PROFILES): @install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log - @for file in ${ABSTRACTIONS}; do \ + @for file in $(shell find ${BUILD}/apparmor.d/abstractions/ -type f -printf "%P\n"); do \ install -Dm0644 "${BUILD}/apparmor.d/abstractions/$${file}" "${DESTDIR}/etc/apparmor.d/abstractions/$${file}"; \ done; - @for file in ${TUNABLES}; do \ + @for file in $(shell find ${BUILD}/apparmor.d/tunables/ -type f -printf "%P\n"); do \ install -Dm0644 "${BUILD}/apparmor.d/tunables/$${file}" "${DESTDIR}/etc/apparmor.d/tunables/$${file}"; \ done; @echo "Warning: profile dependencies fallback to unconfined." @@ -69,34 +64,41 @@ $(P): sed -i -e "s/rPx/rPUx/g" "${BUILD}/apparmor.d/$${file}"; \ install -Dvm0644 "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \ done; - @systemctl restart apparmor || systemctl status apparmor + @systemctl restart apparmor || sudo journalctl -xeu apparmor.service +.PHONY: dev name ?= dev: @go run ./cmd/prebuild --complain --file $(shell find apparmor.d -iname ${name}) @sudo install -Dm644 ${BUILD}/apparmor.d/${name} /etc/apparmor.d/${name} - @sudo systemctl restart apparmor || systemctl status apparmor + @sudo systemctl restart apparmor || sudo journalctl -xeu apparmor.service +.PHONY: package dist ?= archlinux package: @bash dists/docker.sh ${dist} +.PHONY: pkg pkg: @makepkg --syncdeps --install --cleanbuild --force --noconfirm +.PHONY: dpkg dpkg: @bash dists/build.sh dpkg @sudo dpkg -i ${PKGDEST}/${PKGNAME}_*.deb +.PHONY: rpm rpm: @bash dists/build.sh rpm @sudo rpm -ivh --force ${PKGDEST}/${PKGNAME}-*.rpm +.PHONY: tests tests: @go test ./cmd/... -v -cover -coverprofile=coverage.out @go test ./pkg/... -v -cover -coverprofile=coverage.out @go tool cover -func=coverage.out +.PHONY: lint lint: @golangci-lint run @make --directory=tests lint @@ -105,6 +107,7 @@ lint: tests/packer/init/init.sh tests/packer/src/aa-update tests/packer/init/clean.sh \ debian/${PKGNAME}.postinst debian/${PKGNAME}.postrm +.PHONY: check check: @bash tests/check.sh @@ -112,15 +115,19 @@ check: bats: @bats --print-output-on-failure tests/bats/ +.PHONY: manual manual: @pandoc -t man -s -o root/usr/share/man/man8/aa-log.8 root/usr/share/man/man8/aa-log.md +.PHONY: docs docs: @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=true mkdocs build --strict +.PHONY: serve serve: @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=false mkdocs serve +.PHONY: clean clean: @rm -rf \ debian/.debhelper debian/debhelper* debian/*.debhelper debian/${PKGNAME} \ From 5240dcbdd1290644041afa034c73c27f01b76e55 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 13:38:42 +0100 Subject: [PATCH 0401/1455] fix(test): minor fixes. --- apparmor.d/profiles-a-f/chsh | 11 +++-------- apparmor.d/profiles-s-z/useradd | 4 ++-- tests/bats/chsh.bats | 2 +- tests/bats/lsusb.bats | 6 +++--- 4 files changed, 9 insertions(+), 14 deletions(-) diff --git a/apparmor.d/profiles-a-f/chsh b/apparmor.d/profiles-a-f/chsh index 61885ed4e..f73ae6709 100644 --- a/apparmor.d/profiles-a-f/chsh +++ b/apparmor.d/profiles-a-f/chsh @@ -10,26 +10,19 @@ include @{exec_path} = @{bin}/chsh profile chsh @{exec_path} { include - include include include + include - # To write records to the kernel auditing log. capability audit_write, - - # To set the right permission to the files in the /etc/ dir. capability chown, capability fsetid, - - # gpasswd is a SETUID binary capability setuid, network netlink raw, @{exec_path} mr, - owner @{PROC}/@{pid}/loginuid r, - /etc/shells r, /etc/passwd rw, @@ -44,6 +37,8 @@ profile chsh @{exec_path} { # modify the /etc/passwd or /etc/shadow password database. /etc/.pwd.lock rwk, + owner @{PROC}/@{pid}/loginuid r, + include if exists } diff --git a/apparmor.d/profiles-s-z/useradd b/apparmor.d/profiles-s-z/useradd index 42ab87607..0fbb9aa6d 100644 --- a/apparmor.d/profiles-s-z/useradd +++ b/apparmor.d/profiles-s-z/useradd @@ -53,9 +53,9 @@ profile useradd @{exec_path} { # To create user dirs and copy files from /etc/skel/ to them @{HOME}/ rw, - @{HOME}/.* w, + @{HOME}/.** w, /var/lib/*/{,*} rw, - /etc/skel/{,.*} r, + /etc/skel/{,.**} r, profile pam_tally2 { include diff --git a/tests/bats/chsh.bats b/tests/bats/chsh.bats index 42cfa1151..5365fea60 100644 --- a/tests/bats/chsh.bats +++ b/tests/bats/chsh.bats @@ -11,7 +11,7 @@ setup_file() { # bats test_tags=chsh @test "chsh: [l]ist available shells" { - chsh --list-shells + chsh --list-shells || true aa_check } diff --git a/tests/bats/lsusb.bats b/tests/bats/lsusb.bats index 530841a20..8f646d89e 100644 --- a/tests/bats/lsusb.bats +++ b/tests/bats/lsusb.bats @@ -11,18 +11,18 @@ setup_file() { # bats test_tags=lsusb @test "lsusb: List all the USB devices available" { - lsusb + lsusb || true aa_check } # bats test_tags=lsusb @test "lsusb: List the USB hierarchy as a tree" { - lsusb -t + lsusb -t || true aa_check } # bats test_tags=lsusb @test "lsusb: List verbose information about USB devices" { - lsusb --verbose + lsusb --verbose || true aa_check } From b72552bdf214319b14896ef1af5c8d9c6f7be271 Mon Sep 17 00:00:00 2001 From: odomingao Date: Tue, 22 Oct 2024 10:45:28 -0300 Subject: [PATCH 0402/1455] Create pypr --- apparmor.d/groups/hyprland/pypr | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 apparmor.d/groups/hyprland/pypr diff --git a/apparmor.d/groups/hyprland/pypr b/apparmor.d/groups/hyprland/pypr new file mode 100644 index 000000000..2f489e055 --- /dev/null +++ b/apparmor.d/groups/hyprland/pypr @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pypr +profile pypr @{exec_path} flags=(attach_disconnected) { + include + include + include + + signal send set=(term kill), + + ptrace read, + + @{exec_path} mr, + + owner @{user_config_dirs}/hypr/pyprland.toml r, + + owner @{run}/user/@{uid}/hypr/*/.pyprland.sock rw, + + owner /dev/tty@{int} rw, # file_inherit + + include if exists +} + +# vim:syntax=apparmor From 88b362f7fb39ca6ce9a3e3f329d7c1d4821039b2 Mon Sep 17 00:00:00 2001 From: Besanon Date: Tue, 22 Oct 2024 19:51:02 +0200 Subject: [PATCH 0403/1455] Create abstraction for lxqt desktop group (#572) first file for the LXQT 2.0 desktop group --- apparmor.d/abstractions/lxqt | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 apparmor.d/abstractions/lxqt diff --git a/apparmor.d/abstractions/lxqt b/apparmor.d/abstractions/lxqt new file mode 100644 index 000000000..c1633033f --- /dev/null +++ b/apparmor.d/abstractions/lxqt @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + include + include + include + include + include + include + include + include + + signal (receive) set=(kill, term) peer=lxqt-session, + + /usr/share/hwdata/pnp.ids r, + /usr/share/icu/@{int}.@{int}/*.dat r, + /usr/share/lxqt/** r, + + owner @{HOME}/.Xdefaults r, + + owner @{user_cache_dirs}/lxqt-notificationd/* r, + + owner @{user_config_dirs}/lxqt/*.conf rw, + + include if exists + +# vim:syntax=apparmor From 38b973c5965410cb33958b9ca9ade2d6328b3127 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 20:03:24 +0100 Subject: [PATCH 0404/1455] chore(profile): remove trailing whitespace in profiles. --- apparmor.d/abstractions/app/sudo | 2 +- .../abstractions/bus/org.freedesktop.GeoClue2 | 2 +- apparmor.d/abstractions/common/bwrap | 2 +- apparmor.d/abstractions/common/electron | 4 ++-- apparmor.d/abstractions/common/steam-game | 2 +- apparmor.d/abstractions/desktop | 2 +- apparmor.d/abstractions/dri | 2 +- apparmor.d/abstractions/gnome-strict | 2 +- apparmor.d/abstractions/gstreamer | 3 +-- apparmor.d/abstractions/lxqt | 2 +- apparmor.d/abstractions/uim | 6 +++--- .../groups/akonadi/akonadi_followupreminder_agent | 2 +- apparmor.d/groups/akonadi/akonadi_ical_resource | 2 +- apparmor.d/groups/akonadi/akonadi_mailfilter_agent | 2 +- apparmor.d/groups/akonadi/akonadi_migration_agent | 2 +- apparmor.d/groups/apt/apt-helper | 2 +- apparmor.d/groups/apt/apt-key | 4 ++-- apparmor.d/groups/apt/debsign | 2 +- apparmor.d/groups/apt/reportbug | 2 +- apparmor.d/groups/browsers/torbrowser-launcher | 2 +- apparmor.d/groups/browsers/torbrowser-tor | 2 +- apparmor.d/groups/bus/dbus-system | 2 +- apparmor.d/groups/bus/ibus-memconf | 2 +- apparmor.d/groups/children/child-modprobe-nvidia | 2 +- apparmor.d/groups/children/child-open-any | 2 +- apparmor.d/groups/cron/cron-cracklib | 2 +- apparmor.d/groups/cron/cron-etckeeper | 2 +- apparmor.d/groups/cron/cron-sysstat | 2 +- apparmor.d/groups/display-manager/lightdm-xsession | 2 +- apparmor.d/groups/display-manager/x11-xsession | 2 +- apparmor.d/groups/display-manager/xdm-xsession | 2 +- .../freedesktop/polkit-kde-authentication-agent | 2 +- apparmor.d/groups/freedesktop/xdg-document-portal | 2 +- apparmor.d/groups/gnome/deja-dup-monitor | 2 +- .../groups/gnome/evolution-addressbook-factory | 2 +- apparmor.d/groups/gnome/gdm-xsession | 2 +- apparmor.d/groups/gnome/gnome-boxes | 2 +- apparmor.d/groups/gnome/gnome-calendar | 2 +- apparmor.d/groups/gnome/gnome-control-center | 2 +- .../groups/gnome/gnome-control-center-goa-helper | 2 +- apparmor.d/groups/gnome/gnome-extension-ding | 2 +- apparmor.d/groups/gnome/gnome-session | 2 +- apparmor.d/groups/gnome/gnome-shell | 8 ++++---- apparmor.d/groups/gnome/gnome-shell-calendar-server | 2 +- apparmor.d/groups/gnome/gnome-software | 4 ++-- apparmor.d/groups/gnome/gsd-disk-utility-notify | 2 +- apparmor.d/groups/gnome/tracker-extract | 2 +- apparmor.d/groups/gnome/yelp | 2 +- apparmor.d/groups/gvfs/gvfs-afc-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-goa-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfsd-metadata | 2 +- apparmor.d/groups/gvfs/gvfsd-recent | 2 +- apparmor.d/groups/hyprland/hyprland | 2 +- apparmor.d/groups/hyprland/hyprpicker | 2 +- apparmor.d/groups/kde/baloo | 2 +- apparmor.d/groups/kde/kwin_wayland | 2 +- apparmor.d/groups/kde/okular | 2 +- apparmor.d/groups/kde/sddm | 2 +- apparmor.d/groups/network/dhcpcd | 2 +- apparmor.d/groups/network/mullvad-daemon | 2 +- apparmor.d/groups/network/mullvad-gui | 2 +- apparmor.d/groups/network/nm-online | 2 +- apparmor.d/groups/network/tailscaled | 2 +- apparmor.d/groups/pacman/arch-audit | 2 +- apparmor.d/groups/pacman/makepkg | 2 +- apparmor.d/groups/pacman/pacman-conf | 2 +- apparmor.d/groups/pacman/pacman-hook-mkinitcpio | 4 ++-- apparmor.d/groups/pacman/pacman-key | 2 +- apparmor.d/groups/ssh/ssh-agent-launch | 4 ++-- apparmor.d/groups/systemd/coredumpctl | 2 +- apparmor.d/groups/systemd/systemd-cryptsetup | 2 +- apparmor.d/groups/systemd/systemd-generator-ostree | 2 +- apparmor.d/groups/systemd/systemd-machine-id-setup | 2 +- .../groups/systemd/systemd-tty-ask-password-agent | 2 +- apparmor.d/groups/systemd/userdbctl | 2 +- apparmor.d/groups/ubuntu/apport | 2 +- apparmor.d/groups/ubuntu/apport-gtk | 2 +- apparmor.d/groups/ubuntu/ubuntu-advantage | 2 +- apparmor.d/groups/virt/cni-bandwidth | 4 ++-- apparmor.d/groups/virt/cni-calico | 8 ++++---- apparmor.d/groups/virt/cni-loopback | 2 +- apparmor.d/groups/virt/cni-portmap | 2 +- apparmor.d/groups/virt/cockpit-bridge | 2 +- apparmor.d/groups/virt/cockpit-update-motd | 2 +- apparmor.d/groups/virt/virt-aa-helper | 2 +- apparmor.d/groups/whonix/msgdispatcher-dispatch | 2 +- apparmor.d/groups/whonix/tor-bootstrap-check | 2 +- apparmor.d/groups/whonix/torbrowser-wrapper | 6 +++--- apparmor.d/groups/xfce/startxfce | 2 +- apparmor.d/profiles-a-f/acpi-powerbtn | 2 +- apparmor.d/profiles-a-f/anyremote | 4 ++-- apparmor.d/profiles-a-f/appstreamcli | 2 +- apparmor.d/profiles-a-f/borg | 2 +- apparmor.d/profiles-a-f/briar-desktop-tor | 2 +- apparmor.d/profiles-a-f/btrfs | 1 - apparmor.d/profiles-a-f/cups-notifier-dbus | 2 +- apparmor.d/profiles-a-f/cupsd | 2 +- apparmor.d/profiles-a-f/dig | 4 ++-- apparmor.d/profiles-a-f/discord | 2 +- apparmor.d/profiles-a-f/discord-chrome-sandbox | 2 +- apparmor.d/profiles-a-f/dkms-autoinstaller | 2 +- apparmor.d/profiles-a-f/dnscrypt-proxy | 6 +++--- apparmor.d/profiles-a-f/element-desktop | 2 +- apparmor.d/profiles-a-f/findmnt | 2 +- apparmor.d/profiles-a-f/flatpak-app | 6 +++--- apparmor.d/profiles-a-f/flatpak-session-helper | 2 +- apparmor.d/profiles-a-f/fractal | 2 +- apparmor.d/profiles-a-f/freetube | 2 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-a-f/fwupdmgr | 2 +- apparmor.d/profiles-g-l/gparted | 2 +- apparmor.d/profiles-g-l/gpartedbin | 2 +- apparmor.d/profiles-g-l/hw-probe | 4 ++-- apparmor.d/profiles-g-l/iceauth | 2 +- apparmor.d/profiles-g-l/initd-kexec | 2 +- apparmor.d/profiles-g-l/inxi | 2 +- apparmor.d/profiles-g-l/landscape-sysinfo.wrapper | 2 +- apparmor.d/profiles-g-l/logrotate | 2 +- apparmor.d/profiles-g-l/lynx | 2 +- apparmor.d/profiles-m-r/molly-guard | 2 +- apparmor.d/profiles-m-r/mount-nfs | 2 +- apparmor.d/profiles-m-r/mutt | 10 +++++----- apparmor.d/profiles-m-r/popularity-contest | 2 +- apparmor.d/profiles-m-r/protonmail-bridge-core | 2 +- apparmor.d/profiles-m-r/resolvconf | 2 +- apparmor.d/profiles-m-r/run-parts | 8 ++++---- apparmor.d/profiles-s-z/s3fs | 4 ++-- apparmor.d/profiles-s-z/session-desktop | 2 +- apparmor.d/profiles-s-z/snap-failure | 2 +- apparmor.d/profiles-s-z/spice-vdagent | 2 +- apparmor.d/profiles-s-z/steam-launcher | 2 +- apparmor.d/profiles-s-z/steam-runtime | 2 +- apparmor.d/profiles-s-z/steamerrorreporter | 2 +- apparmor.d/profiles-s-z/switcheroo-control | 2 +- apparmor.d/profiles-s-z/task | 2 +- apparmor.d/profiles-s-z/thunderbird | 2 +- apparmor.d/profiles-s-z/udev-dmi-memory-id | 2 +- apparmor.d/profiles-s-z/zed | 6 +++--- apparmor.d/profiles-s-z/zfs | 4 ++-- apparmor.d/profiles-s-z/zsys-system-autosnapshot | 2 +- apparmor.d/profiles-s-z/zsysd | 2 +- tests/check.sh | 13 +++++++++---- 143 files changed, 184 insertions(+), 181 deletions(-) diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index b83c2d166..14e3dfb72 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -46,7 +46,7 @@ /etc/machine-id r, /var/db/sudo/lectured/ r, - owner /var/lib/sudo/ts/ rw, + owner /var/lib/sudo/ts/ rw, owner /var/lib/sudo/ts/@{uid} rwk, owner /var/log/sudo.log wk, diff --git a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 index ddbf4d1de..17ea4e45a 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 +++ b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 @@ -18,7 +18,7 @@ interface=org.freedesktop.DBus.Properties member=GetAll peer=(name="@{busname}", label=geoclue), - + dbus send bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index 3a2b0c591..fca42427d 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# A minimal set of rules for sandboxed programs using bwrap. +# A minimal set of rules for sandboxed programs using bwrap. # A profile using this abstraction still needs to set: # - the flag: attach_disconnected # - bwrap execution: '@{bin}/bwrap rix,' diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 171815256..8134f8681 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -2,8 +2,8 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Minimal set of rules for all electron based UI application. It works as a -# *function* and requires some variables to be provided as *arguments* and set +# Minimal set of rules for all electron based UI application. It works as a +# *function* and requires some variables to be provided as *arguments* and set # in the header of the calling profile. Example: # # @{name} = spotify diff --git a/apparmor.d/abstractions/common/steam-game b/apparmor.d/abstractions/common/steam-game index b3c66e035..b60e74a10 100644 --- a/apparmor.d/abstractions/common/steam-game +++ b/apparmor.d/abstractions/common/steam-game @@ -23,7 +23,7 @@ owner @{share_dirs}/logs/* rwk, owner @{share_dirs}/shader_cache_temp_dir_*/fozpipelinesv@{int}/{,**} rw, owner @{share_dirs}/steamapps/ r, - owner @{share_dirs}/steamapps/appmanifest_* rw, + owner @{share_dirs}/steamapps/appmanifest_* rw, owner @{share_dirs}/steamapps/shadercache/{,**} rwk, owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw, diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 19ffe647e..a856cbd37 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -21,7 +21,7 @@ dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), /usr/{local/,}share/ r, diff --git a/apparmor.d/abstractions/dri b/apparmor.d/abstractions/dri index af634ff91..dd8f7b55a 100644 --- a/apparmor.d/abstractions/dri +++ b/apparmor.d/abstractions/dri @@ -3,7 +3,7 @@ # SPDX-License-Identifier: GPL-2.0-only # The Direct Rendering Infrastructure (DRI) is the framework comprising the modern -# Linux graphics stack which allows unprivileged user-space programs to issue +# Linux graphics stack which allows unprivileged user-space programs to issue # commands to graphics hardware without conflicting with other programs. abi , diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 27d648247..9862ca5e7 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -13,7 +13,7 @@ dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), /usr/share/desktop-base/{,**} r, diff --git a/apparmor.d/abstractions/gstreamer b/apparmor.d/abstractions/gstreamer index c7827b599..de2adb332 100644 --- a/apparmor.d/abstractions/gstreamer +++ b/apparmor.d/abstractions/gstreamer @@ -9,7 +9,6 @@ @{lib}/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr, @{lib}/frei0r-@{int}/*.so mr, - # FIXME: not compatible with FSP mode due conflicting x modifiers @{lib}/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner rix, @{lib}/@{multiarch}/gstreamer-1.0/gst-plugin-scanner rix, @{lib}/gstreamer-1.0/gst-plugin-scanner rix, @@ -40,7 +39,7 @@ @{run}/udev/data/+usb:* r, # For /dev/bus/usb/** @{run}/udev/data/c81:@{int} r, # For video4linux - @{run}/udev/data/c189:@{int} r, # For USB serial converters + @{run}/udev/data/c189:@{int} r, # For USB serial converters @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* @{sys}/bus/ r, diff --git a/apparmor.d/abstractions/lxqt b/apparmor.d/abstractions/lxqt index c1633033f..f20c24a32 100644 --- a/apparmor.d/abstractions/lxqt +++ b/apparmor.d/abstractions/lxqt @@ -18,7 +18,7 @@ /usr/share/hwdata/pnp.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/lxqt/** r, - + owner @{HOME}/.Xdefaults r, owner @{user_cache_dirs}/lxqt-notificationd/* r, diff --git a/apparmor.d/abstractions/uim b/apparmor.d/abstractions/uim index 88d75ec15..4a40e965e 100644 --- a/apparmor.d/abstractions/uim +++ b/apparmor.d/abstractions/uim @@ -6,12 +6,12 @@ abi , /usr/share/uim/* r, - + /var/lib/uim/* r, - + owner @{HOME}/.uim.d/customs/* r, owner @{HOME}/.XCompose r, - + owner @{run}/user/@{uid}/uim/socket/uim-helper rw, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent index e85bdcba3..be897ee9e 100644 --- a/apparmor.d/groups/akonadi/akonadi_followupreminder_agent +++ b/apparmor.d/groups/akonadi/akonadi_followupreminder_agent @@ -22,7 +22,7 @@ profile akonadi_followupreminder_agent @{exec_path} { owner @{user_config_dirs}/akonadi_followupreminder_agentrc r, owner @{user_config_dirs}/akonadi/ rw, owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, - + /dev/tty r, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_ical_resource b/apparmor.d/groups/akonadi/akonadi_ical_resource index 465eebd33..5f37f797c 100644 --- a/apparmor.d/groups/akonadi/akonadi_ical_resource +++ b/apparmor.d/groups/akonadi/akonadi_ical_resource @@ -22,7 +22,7 @@ profile akonadi_ical_resource @{exec_path} { owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, owner @{user_share_dirs}/apps/korganizer/{,**} rw, - + /dev/tty r, include if exists diff --git a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent index 37612c9ca..d1a2f008f 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent @@ -34,7 +34,7 @@ profile akonadi_mailfilter_agent @{exec_path} { owner @{user_config_dirs}/emailidentities* rwl, owner @{user_config_dirs}/kmail2rc r, - + owner @{tmp}/#@{int} rw, owner @{tmp}/akonadi_mailfilter_agent.* rwl, diff --git a/apparmor.d/groups/akonadi/akonadi_migration_agent b/apparmor.d/groups/akonadi/akonadi_migration_agent index b3541299a..55fedf4ea 100644 --- a/apparmor.d/groups/akonadi/akonadi_migration_agent +++ b/apparmor.d/groups/akonadi/akonadi_migration_agent @@ -20,7 +20,7 @@ profile akonadi_migration_agent @{exec_path} { owner @{user_config_dirs}/akonadi/** rwlk -> @{user_config_dirs}/akonadi/**, owner @{user_share_dirs}/akonadi_migration_agent/{,**} rw, - + /dev/tty r, include if exists diff --git a/apparmor.d/groups/apt/apt-helper b/apparmor.d/groups/apt/apt-helper index f02c01819..5a2d7dd55 100644 --- a/apparmor.d/groups/apt/apt-helper +++ b/apparmor.d/groups/apt/apt-helper @@ -22,7 +22,7 @@ profile apt-helper @{exec_path} { profile systemctl { include include - + capability net_admin, include if exists diff --git a/apparmor.d/groups/apt/apt-key b/apparmor.d/groups/apt/apt-key index f73df39d1..12a7b3a67 100644 --- a/apparmor.d/groups/apt/apt-key +++ b/apparmor.d/groups/apt/apt-key @@ -78,7 +78,7 @@ profile apt-key @{exec_path} { @{bin}/gpg-connect-agent rix, /usr/share/gnupg/sks-keyservers.netCA.pem r, - + /etc/hosts r, /etc/inputrc r, @@ -96,7 +96,7 @@ profile apt-key @{exec_path} { owner @{tmp}/apt-key-gpghome.*/ rw, owner @{tmp}/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**, owner @{tmp}/apt-key-gpghome.*/gpgoutput.{log,err} w, - + owner @{run}/user/@{uid}/gnupg/d.*/ rw, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/apt/debsign b/apparmor.d/groups/apt/debsign index b2f72f6cd..68d0d4184 100644 --- a/apparmor.d/groups/apt/debsign +++ b/apparmor.d/groups/apt/debsign @@ -34,7 +34,7 @@ profile debsign @{exec_path} { @{bin}/stty rix, @{bin}/gpg{,2} rCx -> gpg, - + /etc/devscripts.conf r, owner @{HOME}/.devscripts r, diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index dfc578117..8681e46d8 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -108,7 +108,7 @@ profile reportbug @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/groups/browsers/torbrowser-launcher b/apparmor.d/groups/browsers/torbrowser-launcher index 343d3e0d0..0f6273107 100644 --- a/apparmor.d/groups/browsers/torbrowser-launcher +++ b/apparmor.d/groups/browsers/torbrowser-launcher @@ -37,7 +37,7 @@ profile torbrowser-launcher @{exec_path} flags=(attach_disconnected) { @{bin}/tail ix, @{lib_dirs}/execdesktop ix, - @{lib_dirs}/start-tor-browser Px, # torbrowser-start + @{lib_dirs}/start-tor-browser Px, # torbrowser-start @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/start-tor-browser.desktop ix, /usr/share/file/** r, diff --git a/apparmor.d/groups/browsers/torbrowser-tor b/apparmor.d/groups/browsers/torbrowser-tor index 73a111206..57a49add7 100644 --- a/apparmor.d/groups/browsers/torbrowser-tor +++ b/apparmor.d/groups/browsers/torbrowser-tor @@ -9,7 +9,7 @@ include @{lib_dirs} = @{user_share_dirs}/torbrowser/tbb/@{arch}/tor-browser/Browser/ @{HOME}/.tb/tor-browser/Browser/ @{data_dirs} = @{lib_dirs}/TorBrowser/Data/ -@{exec_path} = @{lib_dirs}/TorBrowser/Tor/tor +@{exec_path} = @{lib_dirs}/TorBrowser/Tor/tor profile torbrowser-tor @{exec_path} { include include diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index 3b8a1e143..bda678f88 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -4,7 +4,7 @@ # Profile for system dbus, regardless of the dbus implementation used. # It does not specify an attachment path as it would be the same than -# "dbus-session". It is intended to be used only via "Px ->" or via +# "dbus-session". It is intended to be used only via "Px ->" or via # systemd drop-in AppArmorProfile= setting. abi , diff --git a/apparmor.d/groups/bus/ibus-memconf b/apparmor.d/groups/bus/ibus-memconf index 0a8d7bdab..803f28a4a 100644 --- a/apparmor.d/groups/bus/ibus-memconf +++ b/apparmor.d/groups/bus/ibus-memconf @@ -18,7 +18,7 @@ profile ibus-memconf @{exec_path} flags=(attach_disconnected) { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index 315a5bf07..8681e91f4 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -9,7 +9,7 @@ # and load the the nvidia kernel module. # Note: This profile does not specify an attachment path because it is -# intended to be used only via "Px -> child-modprobe-nvidia" exec transitions +# intended to be used only via "Px -> child-modprobe-nvidia" exec transitions # from other profiles. abi , diff --git a/apparmor.d/groups/children/child-open-any b/apparmor.d/groups/children/child-open-any index 58847a3e3..ea21f8487 100644 --- a/apparmor.d/groups/children/child-open-any +++ b/apparmor.d/groups/children/child-open-any @@ -31,7 +31,7 @@ profile child-open-any flags=(attach_disconnected) { / r, /usr/ r, /usr/local/bin/ r, - + /dev/tty rw, include if exists diff --git a/apparmor.d/groups/cron/cron-cracklib b/apparmor.d/groups/cron/cron-cracklib index 8a87bd2af..ede030682 100644 --- a/apparmor.d/groups/cron/cron-cracklib +++ b/apparmor.d/groups/cron/cron-cracklib @@ -12,7 +12,7 @@ profile cron-cracklib @{exec_path} { include @{exec_path} r, - + @{sh_path} rix, @{bin}/logger rix, @{bin}/update-cracklib rPx, diff --git a/apparmor.d/groups/cron/cron-etckeeper b/apparmor.d/groups/cron/cron-etckeeper index 28a845cfe..2029f8842 100644 --- a/apparmor.d/groups/cron/cron-etckeeper +++ b/apparmor.d/groups/cron/cron-etckeeper @@ -12,7 +12,7 @@ profile cron-etckeeper @{exec_path} { include @{exec_path} r, - + @{sh_path} rix, @{bin}/rm rix, @{bin}/find rix, diff --git a/apparmor.d/groups/cron/cron-sysstat b/apparmor.d/groups/cron/cron-sysstat index 4ca22b6a1..20aaee7e5 100644 --- a/apparmor.d/groups/cron/cron-sysstat +++ b/apparmor.d/groups/cron/cron-sysstat @@ -12,7 +12,7 @@ profile cron-sysstat @{exec_path} { include @{exec_path} r, - + @{sh_path} rix, @{lib}/sysstat/sa2 rPx, diff --git a/apparmor.d/groups/display-manager/lightdm-xsession b/apparmor.d/groups/display-manager/lightdm-xsession index 69a49eecf..5653b42ef 100644 --- a/apparmor.d/groups/display-manager/lightdm-xsession +++ b/apparmor.d/groups/display-manager/lightdm-xsession @@ -32,7 +32,7 @@ profile lightdm-xsession @{exec_path} { profile systemctl { include include - + owner @{HOME}/.xsession-errors w, include if exists diff --git a/apparmor.d/groups/display-manager/x11-xsession b/apparmor.d/groups/display-manager/x11-xsession index d2f005264..445531691 100644 --- a/apparmor.d/groups/display-manager/x11-xsession +++ b/apparmor.d/groups/display-manager/x11-xsession @@ -68,7 +68,7 @@ profile x11-xsession @{exec_path} { profile ssh-agent { include - + @{bin}/ssh-agent mr, @{sh_path} rix, diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index 687e0e920..cfdaeed3f 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -106,7 +106,7 @@ profile xdm-xsession @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index 7ca73cd63..f53f4d164 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -41,7 +41,7 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected, owner @{user_cache_dirs}/polkit-kde-authentication-agent-@{int}/** rwk, owner link @{user_cache_dirs}/polkit-kde-authentication-agent-@{int}/** -> @{user_cache_dirs}/polkit-kde-authentication-agent-@{int}/**, owner @{user_cache_dirs}/qtshadercache-*/* r, - + owner @{tmp}/#@{int} rw, owner @{tmp}/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int}, # owner /tmp/xauth_@{rand6} r, diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index a5e27c7d1..d47b830e0 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -84,7 +84,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { /dev/fuse rw, @{att}/dev/tty@{int} rw, - + include if exists } diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor index cc6645590..b7fc6a5b0 100644 --- a/apparmor.d/groups/gnome/deja-dup-monitor +++ b/apparmor.d/groups/gnome/deja-dup-monitor @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{lib}/deja-dup/deja-dup-monitor +@{exec_path} = @{lib}/deja-dup/deja-dup-monitor profile deja-dup-monitor @{exec_path} { include include diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index c6494c95f..9f18395f2 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -51,7 +51,7 @@ profile evolution-addressbook-factory @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession index 2cdae783d..03e77816c 100644 --- a/apparmor.d/groups/gnome/gdm-xsession +++ b/apparmor.d/groups/gnome/gdm-xsession @@ -73,7 +73,7 @@ profile gdm-xsession @{exec_path} { peer=(name=org.freedesktop.systemd1), @{bin}/dbus-update-activation-environment mr, - + owner @{HOME}/.xsession-errors w, /dev/tty rw, diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes index f44f42e63..0a5abe0a9 100644 --- a/apparmor.d/groups/gnome/gnome-boxes +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -78,7 +78,7 @@ profile gnome-boxes @{exec_path} { @{bin}/virsh mr, @{bin}/pkttyagent r, - + owner @{run}/user/@{uid}/libvirt/ r, owner @{run}/user/@{uid}/libvirt/virtqemud.lock rwk, diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index 741be7709..97309c1a7 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -23,7 +23,7 @@ profile gnome-calendar @{exec_path} { #aa:dbus own bus=session name=org.gnome.Calendar - #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} label=evolution-addressbook-factory + #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} label=evolution-addressbook-factory #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Calendar@{int} label=evolution-calendar-factory #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.CalendarView label=evolution-calendar-factory #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Source label=evolution-source-registry diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 20aa66cfb..00bc15f19 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -186,7 +186,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { include @{bin}/bwrap mr, - + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-control-center-goa-helper b/apparmor.d/groups/gnome/gnome-control-center-goa-helper index 4695c87d4..1fa7d7050 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-goa-helper +++ b/apparmor.d/groups/gnome/gnome-control-center-goa-helper @@ -70,7 +70,7 @@ profile gnome-control-center-goa-helper @{exec_path} { include @{bin}/bwrap mr, - + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index 7c9a80777..f74afdeac 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -37,7 +37,7 @@ profile gnome-extension-ding @{exec_path} { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=org.freedesktop.DBus, label=dbus-session), dbus send bus=session path=/org/freedesktop/DBus diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index 597a47c12..cf17391bc 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -66,7 +66,7 @@ profile gnome-session @{exec_path} { include @{bin}/flatpak mr, - + /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index a2627c31b..a2dd6d908 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -315,7 +315,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** - @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* + @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* @{run}/udev/data/n@{int} r, @{sys}/**/uevent r, @@ -374,13 +374,13 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { profile shell flags=(attach_disconnected,mediate_deleted) { include - + capability sys_ptrace, ptrace (read), @{sh_path} mr, - + @{bin}/pmap rix, @{bin}/grep rix, @@ -414,7 +414,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/gnome-shell/session.gvdb rw, - owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, + owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/gnome/gnome-shell-calendar-server b/apparmor.d/groups/gnome/gnome-shell-calendar-server index 357104e57..2f3e51670 100644 --- a/apparmor.d/groups/gnome/gnome-shell-calendar-server +++ b/apparmor.d/groups/gnome/gnome-shell-calendar-server @@ -30,7 +30,7 @@ profile gnome-shell-calendar-server @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index f462894bc..a75cfee63 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -154,10 +154,10 @@ profile gnome-software @{exec_path} { owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent{,.ssh,.browser,.extra} rw, owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw, owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, - + owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - + include if exists } diff --git a/apparmor.d/groups/gnome/gsd-disk-utility-notify b/apparmor.d/groups/gnome/gsd-disk-utility-notify index 55e6b3736..6e8ae0d90 100644 --- a/apparmor.d/groups/gnome/gsd-disk-utility-notify +++ b/apparmor.d/groups/gnome/gsd-disk-utility-notify @@ -17,7 +17,7 @@ profile gsd-disk-utility-notify @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index a8dc13b19..02237d932 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -79,7 +79,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { /dev/media@{int} r, /dev/video@{int} rw, - + # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index aa459250b..f0dd3b46c 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -34,7 +34,7 @@ profile yelp @{exec_path} { owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.current r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.high r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.max r, - + @{PROC}/zoneinfo r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, diff --git a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor index a681f2626..c1058c158 100644 --- a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor @@ -16,7 +16,7 @@ profile gvfs-afc-volume-monitor @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor index 1e65e2183..1b5f74ae3 100644 --- a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor @@ -16,7 +16,7 @@ profile gvfs-goa-volume-monitor @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), dbus send bus=session path=/org/gnome/OnlineAccounts diff --git a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor index a8d7ffb35..f2b534635 100644 --- a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor @@ -20,7 +20,7 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-metadata b/apparmor.d/groups/gvfs/gvfsd-metadata index 902bbf40e..f6f3820bb 100644 --- a/apparmor.d/groups/gvfs/gvfsd-metadata +++ b/apparmor.d/groups/gvfs/gvfsd-metadata @@ -21,7 +21,7 @@ profile gvfsd-metadata @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-recent b/apparmor.d/groups/gvfs/gvfsd-recent index 38819e872..03586b291 100644 --- a/apparmor.d/groups/gvfs/gvfsd-recent +++ b/apparmor.d/groups/gvfs/gvfsd-recent @@ -46,7 +46,7 @@ profile gvfsd-recent @{exec_path} { owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, @{run}/mount/utab r, - + owner @{PROC}/@{pid}/mountinfo r, include if exists diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 9c6107f6f..3a25c0a5a 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -51,7 +51,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+usb* r, # for USB mouse and keyboard @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** - @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* + @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* @{sys}/bus/ r, @{sys}/class/input/ r, diff --git a/apparmor.d/groups/hyprland/hyprpicker b/apparmor.d/groups/hyprland/hyprpicker index 38eccd297..78375c8b2 100644 --- a/apparmor.d/groups/hyprland/hyprpicker +++ b/apparmor.d/groups/hyprland/hyprpicker @@ -17,7 +17,7 @@ profile hyprpicker @{exec_path} { owner @{run}/user/@{uid}/.hyprpicker* rw, owner /dev/shm/wlroots-@{rand6} r, - + owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index 5a4f480a1..9a2f4c961 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -12,7 +12,7 @@ profile baloo @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index c02f3f87a..24d86bec6 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -94,7 +94,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { owner @{user_config_dirs}/kxkbrc r, owner @{user_config_dirs}/menus/{,applications-merged/} r, owner @{user_config_dirs}/plasmarc r, - owner @{user_config_dirs}/session/* r, + owner @{user_config_dirs}/session/* r, owner @{user_share_dirs}/kscreen/* r, owner @{user_share_dirs}/kwin/scripts/{,**} r, diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index f7f168364..fe1c5d8da 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -81,7 +81,7 @@ profile okular @{exec_path} { owner @{tmp}/#@{int} rw, owner @{tmp}/okular.@{rand6} rwl -> /tmp/#@{int}, owner @{tmp}/okular_@{rand6}.ps rwl -> /tmp/#@{int}, - owner @{tmp}/messageviewer_attachment_@{rand6}/{,*} r, # files opened from KMail as mail attachment, + owner @{tmp}/messageviewer_attachment_@{rand6}/{,*} r, # files opened from KMail as mail attachment, owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/okular@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 7f48fbec0..a09f55c4b 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -199,7 +199,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/groups/network/dhcpcd b/apparmor.d/groups/network/dhcpcd index 6d4ea3f7e..ebb861971 100644 --- a/apparmor.d/groups/network/dhcpcd +++ b/apparmor.d/groups/network/dhcpcd @@ -27,7 +27,7 @@ profile dhcpcd @{exec_path} flags=(attach_disconnected) { network inet6 raw, network netlink raw, network packet raw, - + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index 8dc29f568..55b5bda1a 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -13,7 +13,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { include capability dac_override, - + capability net_admin, capability fowner, capability fsetid, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index e1c55c7e1..6075f14b2 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -7,7 +7,7 @@ abi , include @{name} = Mullvad?VPN -@{lib_dirs} = /opt/@{name} +@{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/groups/network/nm-online b/apparmor.d/groups/network/nm-online index 144fd84cb..27a511dc4 100644 --- a/apparmor.d/groups/network/nm-online +++ b/apparmor.d/groups/network/nm-online @@ -16,7 +16,7 @@ profile nm-online @{exec_path} { interface=org.freedesktop.NetworkManager.Connection.Active member=StateChanged peer=(name=:*, label=NetworkManager), - + dbus send bus=system path=/org/freedesktop/NetworkManager/Settings/@{int} interface=org.freedesktop.NetworkManager.Settings.Connection member=GetSettings diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index 7bab28a22..ac29b0b28 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -79,7 +79,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) { capability mknod, capability net_admin, - + network netlink raw, /dev/net/tun rw, diff --git a/apparmor.d/groups/pacman/arch-audit b/apparmor.d/groups/pacman/arch-audit index b8c622c6e..7539c1c7f 100644 --- a/apparmor.d/groups/pacman/arch-audit +++ b/apparmor.d/groups/pacman/arch-audit @@ -21,7 +21,7 @@ profile arch-audit @{exec_path} { network netlink raw, @{exec_path} mr, - + /etc/arch-audit/settings.toml r, /usr/share/terminfo/** r, diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 6f4672f99..d5abc07db 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -80,7 +80,7 @@ profile makepkg @{exec_path} { ptrace read, - signal send set=winch peer=pacman, + signal send set=winch peer=pacman, signal send set=winch peer=pacman//systemctl, @{bin}/pacman Px, diff --git a/apparmor.d/groups/pacman/pacman-conf b/apparmor.d/groups/pacman/pacman-conf index b57ab746d..4884d248c 100644 --- a/apparmor.d/groups/pacman/pacman-conf +++ b/apparmor.d/groups/pacman/pacman-conf @@ -16,7 +16,7 @@ profile pacman-conf @{exec_path} flags=(attach_disconnected) { /etc/pacman.conf r, /etc/pacman.d/mirrorlist r, /etc/pacman.d/*-mirrorlist r, - + /dev/tty@{int} rw, # Inherit Silencer diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio index 09529cbb0..9ee488fbc 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio @@ -55,11 +55,11 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) { capability dac_read_search, @{bin}/pacman mr, - + @{bin}/gpg rix, @{bin}/gpgconf rix, @{bin}/gpgsm rix, - + /etc/pacman.conf r, /etc/pacman.d/{,**} r, /etc/pacman.d/gnupg/** rwkl, diff --git a/apparmor.d/groups/pacman/pacman-key b/apparmor.d/groups/pacman/pacman-key index 728bd84d2..287bc026a 100644 --- a/apparmor.d/groups/pacman/pacman-key +++ b/apparmor.d/groups/pacman/pacman-key @@ -35,7 +35,7 @@ profile pacman-key @{exec_path} { /usr/share/terminfo/** r, /etc/pacman.d/gnupg/* rw, - + /dev/tty rw, profile gpg { diff --git a/apparmor.d/groups/ssh/ssh-agent-launch b/apparmor.d/groups/ssh/ssh-agent-launch index 237a5ff76..7e0422c5a 100644 --- a/apparmor.d/groups/ssh/ssh-agent-launch +++ b/apparmor.d/groups/ssh/ssh-agent-launch @@ -26,12 +26,12 @@ profile ssh-agent-launch @{exec_path} { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus - member=UpdateActivationEnvironment + member=UpdateActivationEnvironment peer=(name=org.freedesktop.DBus, label=dbus-session), dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager - member=SetEnvironment + member=SetEnvironment peer=(name=org.freedesktop.systemd1), @{bin}/dbus-update-activation-environment mr, diff --git a/apparmor.d/groups/systemd/coredumpctl b/apparmor.d/groups/systemd/coredumpctl index 89a19fa11..d81933f5e 100644 --- a/apparmor.d/groups/systemd/coredumpctl +++ b/apparmor.d/groups/systemd/coredumpctl @@ -62,7 +62,7 @@ profile coredumpctl @{exec_path} flags=(complain) { /etc/inputrc r, /etc/gdb/** r, - + owner /var/tmp/coredump-* rw, @{PROC}/@{pids}/fd/ r, diff --git a/apparmor.d/groups/systemd/systemd-cryptsetup b/apparmor.d/groups/systemd/systemd-cryptsetup index 5e4b33a12..f8950c1fe 100644 --- a/apparmor.d/groups/systemd/systemd-cryptsetup +++ b/apparmor.d/groups/systemd/systemd-cryptsetup @@ -27,7 +27,7 @@ profile systemd-cryptsetup @{exec_path} { @{run}/cryptsetup/ r, @{run}/cryptsetup/* rwk, @{run}/systemd/ask-password/* rw, - + @{sys}/devices/virtual/bdi/*/read_ahead_kb r, @{sys}/fs/ r, diff --git a/apparmor.d/groups/systemd/systemd-generator-ostree b/apparmor.d/groups/systemd/systemd-generator-ostree index f50544f81..ce2ecaf43 100644 --- a/apparmor.d/groups/systemd/systemd-generator-ostree +++ b/apparmor.d/groups/systemd/systemd-generator-ostree @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{lib}/systemd/system-generators/ostree-system-generator +@{exec_path} = @{lib}/systemd/system-generators/ostree-system-generator profile systemd-generator-ostree @{exec_path} flags=(attach_disconnected) { include diff --git a/apparmor.d/groups/systemd/systemd-machine-id-setup b/apparmor.d/groups/systemd/systemd-machine-id-setup index 105f72e46..5f60b5676 100644 --- a/apparmor.d/groups/systemd/systemd-machine-id-setup +++ b/apparmor.d/groups/systemd/systemd-machine-id-setup @@ -19,7 +19,7 @@ profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) { ptrace (read), - mount options=(rw rshared) -> /, + mount options=(rw rshared) -> /, mount options=(rw rslave) -> /, umount /etc/machine-id, diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index 6083fc233..3e2129d39 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -27,7 +27,7 @@ profile systemd-tty-ask-password-agent @{exec_path} { @{run}/utmp rk, @{PROC}/@{pids}/stat r, - + @{sys}/devices/virtual/tty/console/active r, @{sys}/devices/virtual/tty/tty@{int}/active r, diff --git a/apparmor.d/groups/systemd/userdbctl b/apparmor.d/groups/systemd/userdbctl index 177431f92..b4081eacb 100644 --- a/apparmor.d/groups/systemd/userdbctl +++ b/apparmor.d/groups/systemd/userdbctl @@ -18,7 +18,7 @@ profile userdbctl @{exec_path} { signal send set=cont peer=child-pager, @{exec_path} mr, - + @{pager_path} rPx -> child-pager, /etc/shadow r, diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index ed39c7583..cd0187119 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -6,7 +6,7 @@ abi , include -@{exec_path} = /usr/share/apport/apport +@{exec_path} = /usr/share/apport/apport profile apport @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 25d136722..0121dd46d 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -102,7 +102,7 @@ profile apport-gtk @{exec_path} { include @{bin}/gdb mr, - + @{bin}/iconv rix, @{bin}/* r, diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index abbde2455..7d797bd97 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -13,7 +13,7 @@ profile ubuntu-advantage @{exec_path} { include include include - include + include capability dac_read_search, capability setgid, diff --git a/apparmor.d/groups/virt/cni-bandwidth b/apparmor.d/groups/virt/cni-bandwidth index a27f41fc0..3192c7051 100644 --- a/apparmor.d/groups/virt/cni-bandwidth +++ b/apparmor.d/groups/virt/cni-bandwidth @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/cni/bandwidth /opt/cni/bin/bandwidth profile cni-bandwidth @{exec_path} { include - + network inet dgram, network inet6 dgram, network inet stream, @@ -17,7 +17,7 @@ profile cni-bandwidth @{exec_path} { network netlink raw, @{exec_path} mr, - + include if exists } diff --git a/apparmor.d/groups/virt/cni-calico b/apparmor.d/groups/virt/cni-calico index 878a09119..a6c9149d2 100644 --- a/apparmor.d/groups/virt/cni-calico +++ b/apparmor.d/groups/virt/cni-calico @@ -25,15 +25,15 @@ profile cni-calico @{exec_path} flags=(attach_disconnected) { @{exec_path}-ipam rix, / r, - + /etc/cni/net.d/{,**} r, - + /var/lib/calico/{,**} r, /var/log/calico/cni/ r, /var/log/calico/cni/*.log rw, - + /usr/share/mime/globs2 r, - + @{run}/calico/ rw, @{run}/calico/ipam.lock rwk, @{run}/netns/cni-@{uuid} r, diff --git a/apparmor.d/groups/virt/cni-loopback b/apparmor.d/groups/virt/cni-loopback index 30e2800ce..fd4f50df3 100644 --- a/apparmor.d/groups/virt/cni-loopback +++ b/apparmor.d/groups/virt/cni-loopback @@ -21,7 +21,7 @@ profile cni-loopback @{exec_path} flags=(attach_disconnected) { @{run}/netns/ r, @{run}/netns/cni-@{uuid} rw, - + include if exists } diff --git a/apparmor.d/groups/virt/cni-portmap b/apparmor.d/groups/virt/cni-portmap index bd0206c4c..73ad13cb1 100644 --- a/apparmor.d/groups/virt/cni-portmap +++ b/apparmor.d/groups/virt/cni-portmap @@ -18,7 +18,7 @@ profile cni-portmap @{exec_path} { @{bin}/xtables-nft-multi rPx -> cni-xtables-nft, @{PROC}/sys/net/ipv{4,6}/conf/cali[0-9a-z]*/route_localnet rw, - + include if exists } diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 7487c8e70..1766cd2fb 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -76,7 +76,7 @@ profile cockpit-bridge @{exec_path} { /etc/shadow r, /etc/shells r, - / r, + / r, @{HOME}/ r, owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw, diff --git a/apparmor.d/groups/virt/cockpit-update-motd b/apparmor.d/groups/virt/cockpit-update-motd index c1a39a895..1de016aea 100644 --- a/apparmor.d/groups/virt/cockpit-update-motd +++ b/apparmor.d/groups/virt/cockpit-update-motd @@ -26,7 +26,7 @@ profile cockpit-update-motd @{exec_path} { profile systemctl { include include - + capability net_admin, capability sys_ptrace, diff --git a/apparmor.d/groups/virt/virt-aa-helper b/apparmor.d/groups/virt/virt-aa-helper index 74a93737b..c10f44922 100644 --- a/apparmor.d/groups/virt/virt-aa-helper +++ b/apparmor.d/groups/virt/virt-aa-helper @@ -25,7 +25,7 @@ profile virt-aa-helper @{exec_path} { @{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} rw, /etc/libnl{,-3}/classid r, # Allow reading libnl's classid file - + # System VM images /var/lib/libvirt/images/{,**} r, /var/lib/nova/instances/_base/* r, diff --git a/apparmor.d/groups/whonix/msgdispatcher-dispatch b/apparmor.d/groups/whonix/msgdispatcher-dispatch index 0adfe2797..5c2037c56 100644 --- a/apparmor.d/groups/whonix/msgdispatcher-dispatch +++ b/apparmor.d/groups/whonix/msgdispatcher-dispatch @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{lib}/msgcollector/msgdispatcher_dispatch_x +@{exec_path} = @{lib}/msgcollector/msgdispatcher_dispatch_x profile msgdispatcher-dispatch @{exec_path} { include include diff --git a/apparmor.d/groups/whonix/tor-bootstrap-check b/apparmor.d/groups/whonix/tor-bootstrap-check index 8a5d8f537..7829b8318 100644 --- a/apparmor.d/groups/whonix/tor-bootstrap-check +++ b/apparmor.d/groups/whonix/tor-bootstrap-check @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{lib}/helper-scripts/tor_bootstrap_check.py +@{exec_path} = @{lib}/helper-scripts/tor_bootstrap_check.py profile tor-bootstrap-check @{exec_path} { include include diff --git a/apparmor.d/groups/whonix/torbrowser-wrapper b/apparmor.d/groups/whonix/torbrowser-wrapper index ccdfe2ed4..fc20ad0fb 100644 --- a/apparmor.d/groups/whonix/torbrowser-wrapper +++ b/apparmor.d/groups/whonix/torbrowser-wrapper @@ -32,7 +32,7 @@ profile torbrowser-wrapper @{exec_path} { @{bin}/tty ix, @{bin}/whoami ix, - @{lib_dirs}/start-tor-browser Px, # torbrowser-start + @{lib_dirs}/start-tor-browser Px, # torbrowser-start @{lib}/msgcollector/msgcollector Px, @{lib}/open-link-confirmation/open-link-confirmation Px, @@ -44,11 +44,11 @@ profile torbrowser-wrapper @{exec_path} { owner @{HOME}/.tb/{,**} rw, owner @{HOME}/.xsession-errors rw, - + owner @{tmp}/tmp.@{rand10} rw, owner @{run}/mount/utab r, - + owner @{PROC}/@{pid}/mountinfo r, profile sudo { diff --git a/apparmor.d/groups/xfce/startxfce b/apparmor.d/groups/xfce/startxfce index 84abf8ced..8d91581cb 100644 --- a/apparmor.d/groups/xfce/startxfce +++ b/apparmor.d/groups/xfce/startxfce @@ -30,7 +30,7 @@ profile startxfce @{exec_path} { profile systemctl flags=(attach_disconnected) { include include - + include if exists } diff --git a/apparmor.d/profiles-a-f/acpi-powerbtn b/apparmor.d/profiles-a-f/acpi-powerbtn index c25d94526..796194146 100644 --- a/apparmor.d/profiles-a-f/acpi-powerbtn +++ b/apparmor.d/profiles-a-f/acpi-powerbtn @@ -57,7 +57,7 @@ profile acpi-powerbtn flags=(attach_disconnected) { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-a-f/anyremote b/apparmor.d/profiles-a-f/anyremote index 2ad4791d7..b7e4a127b 100644 --- a/apparmor.d/profiles-a-f/anyremote +++ b/apparmor.d/profiles-a-f/anyremote @@ -80,10 +80,10 @@ profile anyremote @{exec_path} { @{bin}/convert-im6.q16 mr, /usr/share/anyremote/cfg-data/Icons/common/*.png r, - + /usr/share/ImageMagick-[0-9]/*.xml rw, /etc/ImageMagick-[0-9]/*.xml r, - + owner @{HOME}/.anyRemote/*.png rw, owner @{HOME}/.kde/share/apps/amarok/albumcovers/cache/* r, diff --git a/apparmor.d/profiles-a-f/appstreamcli b/apparmor.d/profiles-a-f/appstreamcli index 72ee1e9dc..36ca9555f 100644 --- a/apparmor.d/profiles-a-f/appstreamcli +++ b/apparmor.d/profiles-a-f/appstreamcli @@ -47,7 +47,7 @@ profile appstreamcli @{exec_path} flags=(complain) { /var/log/cron-apt/temp w, owner /var/cache/app-info/{,**} rw, owner /var/cache/swcatalog/{,**} rw, - + owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/appstream-cache-*.mdb rw, owner @{user_cache_dirs}/appstream/ rw, diff --git a/apparmor.d/profiles-a-f/borg b/apparmor.d/profiles-a-f/borg index 15c6b71c9..dbf6c228d 100644 --- a/apparmor.d/profiles-a-f/borg +++ b/apparmor.d/profiles-a-f/borg @@ -111,7 +111,7 @@ profile borg @{exec_path} { /etc/fuse.conf r, @{MOUNTS}/ r, - @{MOUNTS}/*/ r, + @{MOUNTS}/*/ r, @{PROC}/@{pids}/mounts r, diff --git a/apparmor.d/profiles-a-f/briar-desktop-tor b/apparmor.d/profiles-a-f/briar-desktop-tor index e78420e34..af98f9fc7 100644 --- a/apparmor.d/profiles-a-f/briar-desktop-tor +++ b/apparmor.d/profiles-a-f/briar-desktop-tor @@ -14,7 +14,7 @@ profile briar-desktop-tor { network netlink raw, signal send set=term peer=briar-desktop-tor//obfs4proxy, - signal send set=term peer=briar-desktop-tor//snowflake, + signal send set=term peer=briar-desktop-tor//snowflake, owner @{HOME}/.briar/desktop/tor/.tor/{,**} rw, owner @{HOME}/.briar/desktop/tor/.tor/lock k, diff --git a/apparmor.d/profiles-a-f/btrfs b/apparmor.d/profiles-a-f/btrfs index cdf5eb0df..82742fd4a 100644 --- a/apparmor.d/profiles-a-f/btrfs +++ b/apparmor.d/profiles-a-f/btrfs @@ -59,7 +59,6 @@ profile btrfs @{exec_path} flags=(attach_disconnected) { /dev/btrfs-control rw, /dev/pts/@{int} rw, /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/profiles-a-f/cups-notifier-dbus b/apparmor.d/profiles-a-f/cups-notifier-dbus index 3f9b15dcc..6e3b38490 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-dbus +++ b/apparmor.d/profiles-a-f/cups-notifier-dbus @@ -21,7 +21,7 @@ profile cups-notifier-dbus @{exec_path} { owner /var/spool/cups/tmp/cups-dbus-notifier-lockfile rw, owner @{tmp}/cups-dbus-notifier-lockfile rwk, - + include if exists } diff --git a/apparmor.d/profiles-a-f/cupsd b/apparmor.d/profiles-a-f/cupsd index ac9984746..f65fc8349 100644 --- a/apparmor.d/profiles-a-f/cupsd +++ b/apparmor.d/profiles-a-f/cupsd @@ -95,7 +95,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/fd/ r, owner @{PROC}/@{pid}/mounts r, - + owner @{tmp}/*_latest_print_info w, /dev/tty rw, diff --git a/apparmor.d/profiles-a-f/dig b/apparmor.d/profiles-a-f/dig index 3e95a05dd..a8b482788 100644 --- a/apparmor.d/profiles-a-f/dig +++ b/apparmor.d/profiles-a-f/dig @@ -27,9 +27,9 @@ profile dig @{exec_path} { owner @{HOME}/.digrc r, owner @{HOME}/batch_mode.dig r, owner @{HOME}/tsig.key r, - + /tmp/batch_mode.dig r, - + owner @{PROC}/@{pids}/task/@{tid}/comm rw, include if exists diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index 74d1ce740..53038a6d7 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -12,7 +12,7 @@ include @{config_dirs} = @{user_config_dirs}/@{name} @{user_config_dirs}/discordptb @{cache_dirs} = @{user_cache_dirs}/@{name} -@{exec_path} = @{bin}/discord{,-ptb} @{lib_dirs}/Discord{,PTB} +@{exec_path} = @{bin}/discord{,-ptb} @{lib_dirs}/Discord{,PTB} profile discord @{exec_path} { include include diff --git a/apparmor.d/profiles-a-f/discord-chrome-sandbox b/apparmor.d/profiles-a-f/discord-chrome-sandbox index 4cfefd651..0599fa486 100644 --- a/apparmor.d/profiles-a-f/discord-chrome-sandbox +++ b/apparmor.d/profiles-a-f/discord-chrome-sandbox @@ -8,7 +8,7 @@ abi , include @{name} = discord -@{lib_dirs} = /usr/share/@{name} /opt/@{name} +@{lib_dirs} = /usr/share/@{name} /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{user_config_dirs}/discordptb @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-a-f/dkms-autoinstaller b/apparmor.d/profiles-a-f/dkms-autoinstaller index 00f1d8117..ffce30921 100644 --- a/apparmor.d/profiles-a-f/dkms-autoinstaller +++ b/apparmor.d/profiles-a-f/dkms-autoinstaller @@ -40,7 +40,7 @@ profile dkms-autoinstaller @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-a-f/dnscrypt-proxy b/apparmor.d/profiles-a-f/dnscrypt-proxy index 08dad1bd2..5573aaf83 100644 --- a/apparmor.d/profiles-a-f/dnscrypt-proxy +++ b/apparmor.d/profiles-a-f/dnscrypt-proxy @@ -27,17 +27,17 @@ profile dnscrypt-proxy @{exec_path} { @{exec_path} mrix, /etc/dnscrypt-proxy/{,**} r, - + owner /etc/dnscrypt-proxy/public-resolvers.md rw, owner /etc/dnscrypt-proxy/public-resolvers.md.minisig rw, owner /etc/dnscrypt-proxy/relays.md rw, owner /etc/dnscrypt-proxy/relays.md.minisig rw, owner /etc/dnscrypt-proxy/sf-*.tmp rw, - + /var/cache/private/dnscrypt-proxy/{,**} r, /var/cache/private/dnscrypt-proxy/public-resolvers.md{,.minisig} rw, /var/cache/private/dnscrypt-proxy/sf-*.tmp rw, - + /var/log/dnscrypt-proxy/ r, /var/log/dnscrypt-proxy/*.log w, /var/log/private/dnscrypt-proxy/ rw, diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index e4a9bef28..05a900889 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -7,7 +7,7 @@ abi , include @{name} = {E,e}lement -@{lib_dirs} = @{lib}/@{name} +@{lib_dirs} = @{lib}/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-a-f/findmnt b/apparmor.d/profiles-a-f/findmnt index bcffc5b89..0c027dc2c 100644 --- a/apparmor.d/profiles-a-f/findmnt +++ b/apparmor.d/profiles-a-f/findmnt @@ -20,7 +20,7 @@ profile findmnt @{exec_path} flags=(attach_disconnected,complain) { /etc/fstab r, /etc/mtab r, - + @{PROC}/@{pids}/mountinfo r, # File Inherit diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app index d91b9ac53..e332f50ca 100644 --- a/apparmor.d/profiles-a-f/flatpak-app +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -3,11 +3,11 @@ # SPDX-License-Identifier: GPL-2.0-only # Default profile for all flatpak applications. Ideally, this profile should be -# generated by flatpak itself with settings from the flatpak manifest and +# generated by flatpak itself with settings from the flatpak manifest and # fully separated from bwrap. # Note: This profile used to be split in two (flatpak-bwrap & flatpak-app) in order -# to separate bwrap from the sandboxed app itself. It was generating issue with +# to separate bwrap from the sandboxed app itself. It was generating issue with # zypak-sandbox, therefore the profiles have been merged. Meanwhile, to install # some applications, flatpak needs write access to the sandbox content. This is # done through bwrap and therefore in this profile. @@ -15,7 +15,7 @@ # 1. All of this will have to be improved. However, as of today, it is the only # way to not break some (major) flatpak app. # 2. It is not a big deal as flatpak is responsible for the sandbox anyway. -# This this only defence in depth. +# This this only defence in depth. # 3. The main purpose of this profile is to ensure all processes are confined. abi , diff --git a/apparmor.d/profiles-a-f/flatpak-session-helper b/apparmor.d/profiles-a-f/flatpak-session-helper index 7144a237a..162e3b448 100644 --- a/apparmor.d/profiles-a-f/flatpak-session-helper +++ b/apparmor.d/profiles-a-f/flatpak-session-helper @@ -43,7 +43,7 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/.flatpak-helper/{,**} rw, owner @{run}/user/@{uid}/.flatpak-helper/pkcs11-flatpak-@{int} rw, - + owner @{PROC}/@{pids}/fd/ r, /dev/ptmx rw, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 637cc0970..7f14df0e0 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -27,7 +27,7 @@ profile fractal @{exec_path} flags=(attach_disconnected) { /usr/share/xml/iso-codes/{,**} r, - owner @{tmp}/.@{rand6} rw, + owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index 333c9f368..295cbe760 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -8,7 +8,7 @@ abi , include @{name} = {F,f}ree{T,t}ube{,-vue} -@{lib_dirs} = @{lib}/@{name} /opt/@{name} +@{lib_dirs} = @{lib}/@{name} /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index b6ef68b0a..40dbda8c7 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -149,7 +149,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{bin}/gpg-agent rix, @{lib}/{,gnupg/}scdaemon rix, - + owner /var/lib/fwupd/gnupg/ rw, owner /var/lib/fwupd/gnupg/** rwkl -> /var/lib/fwupd/gnupg/**, diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 4d53fdf57..f599bbc1f 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -28,7 +28,7 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected) { network netlink raw, #aa:dbus talk bus=system name=org.freedesktop.fwupd label=fwupd path=/ - + @{exec_path} mr, @{bin}/dbus-launch Cx -> bus, diff --git a/apparmor.d/profiles-g-l/gparted b/apparmor.d/profiles-g-l/gparted index dd7d3bff3..93e65f0a2 100644 --- a/apparmor.d/profiles-g-l/gparted +++ b/apparmor.d/profiles-g-l/gparted @@ -92,7 +92,7 @@ profile gparted @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-g-l/gpartedbin b/apparmor.d/profiles-g-l/gpartedbin index 6cc77b9bc..e56bb5733 100644 --- a/apparmor.d/profiles-g-l/gpartedbin +++ b/apparmor.d/profiles-g-l/gpartedbin @@ -71,7 +71,7 @@ profile gpartedbin @{exec_path} { owner @{tmp}/gparted-*/ rw, @{run}/mount/utab r, - + @{PROC}/devices r, @{PROC}/partitions r, @{PROC}/swaps r, diff --git a/apparmor.d/profiles-g-l/hw-probe b/apparmor.d/profiles-g-l/hw-probe index 7c960482a..f5c1ecdd6 100644 --- a/apparmor.d/profiles-g-l/hw-probe +++ b/apparmor.d/profiles-g-l/hw-probe @@ -72,7 +72,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/nmcli rPx, @{bin}/pacman rCx -> pacman, @{bin}/rfkill rPx, - @{bin}/rpm rCx -> rpm, + @{bin}/rpm rCx -> rpm, @{bin}/sensors rPx, @{bin}/smartctl rPx, @{bin}/systemctl rCx -> systemctl, @@ -220,7 +220,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { profile systemctl flags=(attach_disconnected) { include include - + include if exists } diff --git a/apparmor.d/profiles-g-l/iceauth b/apparmor.d/profiles-g-l/iceauth index b3dbef04f..03c8650dd 100644 --- a/apparmor.d/profiles-g-l/iceauth +++ b/apparmor.d/profiles-g-l/iceauth @@ -14,7 +14,7 @@ profile iceauth @{exec_path} { @{exec_path} mr, owner @{tmp}/.xfsm-ICE-@{rand6} r, - owner @{tmp}/user/@{uid}/.xfsm-ICE-@{rand6} r, + owner @{tmp}/user/@{uid}/.xfsm-ICE-@{rand6} r, owner @{run}/user/@{uid}/ICEauthority rl -> @{run}/user/@{uid}/ICEauthority-n, owner @{run}/user/@{uid}/ICEauthority-c w, diff --git a/apparmor.d/profiles-g-l/initd-kexec b/apparmor.d/profiles-g-l/initd-kexec index 272679ede..074b4e735 100644 --- a/apparmor.d/profiles-g-l/initd-kexec +++ b/apparmor.d/profiles-g-l/initd-kexec @@ -41,7 +41,7 @@ profile initd-kexec @{exec_path} { profile systemctl { include include - + capability sys_resource, @{bin}/systemd-tty-ask-password-agent rix, diff --git a/apparmor.d/profiles-g-l/inxi b/apparmor.d/profiles-g-l/inxi index 97bd3bfed..eafcab799 100644 --- a/apparmor.d/profiles-g-l/inxi +++ b/apparmor.d/profiles-g-l/inxi @@ -153,7 +153,7 @@ profile inxi @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper index e27e226c5..e5c739bd5 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper +++ b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper @@ -28,7 +28,7 @@ profile landscape-sysinfo.wrapper @{exec_path} { / r, /etc/default/locale r, - + /var/lib/landscape/landscape-sysinfo.cache rw, @{PROC}/loadavg r, diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate index f98457155..7990fb27d 100644 --- a/apparmor.d/profiles-g-l/logrotate +++ b/apparmor.d/profiles-g-l/logrotate @@ -88,7 +88,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected) { profile pgrep { include include - + include if exists } diff --git a/apparmor.d/profiles-g-l/lynx b/apparmor.d/profiles-g-l/lynx index a1f4ced89..0fce66a96 100644 --- a/apparmor.d/profiles-g-l/lynx +++ b/apparmor.d/profiles-g-l/lynx @@ -23,7 +23,7 @@ profile lynx @{exec_path} { @{exec_path} mr, @{sh_path} rix, - + /usr/share/terminfo/{,**} r, /usr/share/doc/lynx-common/** r, diff --git a/apparmor.d/profiles-m-r/molly-guard b/apparmor.d/profiles-m-r/molly-guard index df1806311..281be7e0d 100644 --- a/apparmor.d/profiles-m-r/molly-guard +++ b/apparmor.d/profiles-m-r/molly-guard @@ -36,7 +36,7 @@ profile molly-guard @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-m-r/mount-nfs b/apparmor.d/profiles-m-r/mount-nfs index 3fafd269a..26f3e2d57 100644 --- a/apparmor.d/profiles-m-r/mount-nfs +++ b/apparmor.d/profiles-m-r/mount-nfs @@ -64,7 +64,7 @@ profile mount-nfs @{exec_path} flags=(complain) { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-m-r/mutt b/apparmor.d/profiles-m-r/mutt index 6a96796a7..fb1e94c1f 100644 --- a/apparmor.d/profiles-m-r/mutt +++ b/apparmor.d/profiles-m-r/mutt @@ -29,7 +29,7 @@ profile mutt @{exec_path} { @{sh_path} rix, @{lib}/{,sendmail/}sendmail rPUx, - @{bin}/ispell rPUx, + @{bin}/ispell rPUx, @{bin}/abook rPUx, @{bin}/mutt_dotlock rix, # Misc mutt scripts @@ -84,13 +84,13 @@ profile mutt @{exec_path} { # Used When viewing attachments owner /{var/,}tmp/* lrw, - + profile html-renderer { include @{bin}/w3m mrix, @{bin}/lynx mrix, - + owner @{HOME}/.w3m/* rw, owner @{user_mail_dirs}/{,**} r, owner @{user_mail_dirs}/tmp/{,**} rw, @@ -142,9 +142,9 @@ profile mutt @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, - + owner /{var/,}tmp/mutt* lrw, - + include if exists } diff --git a/apparmor.d/profiles-m-r/popularity-contest b/apparmor.d/profiles-m-r/popularity-contest index 166404dfa..ba9d813c2 100644 --- a/apparmor.d/profiles-m-r/popularity-contest +++ b/apparmor.d/profiles-m-r/popularity-contest @@ -46,7 +46,7 @@ profile popularity-contest @{exec_path} { /var/log/popularity-contest.new w, owner @{tmp}/#@{int} rw, - + @{PROC}/ r, include if exists diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index 81f27c40e..4de73d718 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -2,7 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# To force the use of the Gnome Keyring or Kwallet secret-service, add the +# To force the use of the Gnome Keyring or Kwallet secret-service, add the # following lines in your local/protonmail-bridge-core file: # deny @{bin}/pass x, # deny owner @{user_password_store_dirs}/** r, diff --git a/apparmor.d/profiles-m-r/resolvconf b/apparmor.d/profiles-m-r/resolvconf index 6601b8169..c050ce970 100644 --- a/apparmor.d/profiles-m-r/resolvconf +++ b/apparmor.d/profiles-m-r/resolvconf @@ -50,7 +50,7 @@ profile resolvconf @{exec_path} { include if exists } - + include if exists } diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 69e8c4d0d..c20b305e1 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -23,7 +23,7 @@ profile run-parts @{exec_path} { capability mknod, @{exec_path} mrix, - + @{sh_path} rix, @{bin}/anacron rix, @{bin}/cat rix, @@ -114,7 +114,7 @@ profile run-parts @{exec_path} { /etc/update-motd.d/ r, /etc/update-motd.d/* rCx -> motd, - # Kernel + # Kernel /etc/kernel/header_postinst.d/ r, /etc/kernel/header_postinst.d/dkms rCx -> kernel, @@ -169,7 +169,7 @@ profile run-parts @{exec_path} { @{bin}/sort rix, @{bin}/tr rix, @{bin}/uname rix, - + @{bin}/snap rPUx, @{lib}/ubuntu-release-upgrader/release-upgrade-motd rPx, @{lib}/update-notifier/update-motd-fsck-at-reboot rPx, @@ -238,7 +238,7 @@ profile run-parts @{exec_path} { # For shell pwd / r, /boot/ r, - + /etc/apt/apt.conf.d/ r, /etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw, /etc/modprobe.d/ r, diff --git a/apparmor.d/profiles-s-z/s3fs b/apparmor.d/profiles-s-z/s3fs index 985f124de..dab3593b6 100644 --- a/apparmor.d/profiles-s-z/s3fs +++ b/apparmor.d/profiles-s-z/s3fs @@ -48,10 +48,10 @@ profile s3fs @{exec_path} { mount fstype=fuse.s3fs -> @{MOUNTS}/, mount fstype=fuse.s3fs -> @{MOUNTS}/*/, - + umount @{MOUNTS}/, umount @{MOUNTS}/*/, - + @{bin}/fusermount{,3} mr, /etc/fuse.conf r, diff --git a/apparmor.d/profiles-s-z/session-desktop b/apparmor.d/profiles-s-z/session-desktop index 98b194fb7..4817f330a 100644 --- a/apparmor.d/profiles-s-z/session-desktop +++ b/apparmor.d/profiles-s-z/session-desktop @@ -7,7 +7,7 @@ abi , include @{name} = {S,s}ession -@{lib_dirs} = /opt/@{name} +@{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/snap-failure b/apparmor.d/profiles-s-z/snap-failure index e9bef6d4e..a4f89f558 100644 --- a/apparmor.d/profiles-s-z/snap-failure +++ b/apparmor.d/profiles-s-z/snap-failure @@ -24,7 +24,7 @@ profile snap-failure @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index 79204827f..04837d871 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -32,7 +32,7 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { dbus receive bus=session path=/ interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/steam-launcher b/apparmor.d/profiles-s-z/steam-launcher index 12138e360..0bd8c67d3 100644 --- a/apparmor.d/profiles-s-z/steam-launcher +++ b/apparmor.d/profiles-s-z/steam-launcher @@ -23,7 +23,7 @@ profile steam-launcher @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{lib_dirs}/** mr, - + include if exists } diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index abf84d3c0..2a3e839ff 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -62,7 +62,7 @@ profile steam-runtime @{exec_path} flags=(attach_disconnected) { owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/sniper_platform_*/**, owner @{share_dirs}/config/config.vdf{,.*} rw, - owner @{share_dirs}/steamapps/appmanifest_* rw, + owner @{share_dirs}/steamapps/appmanifest_* rw, owner @{tmp}/ r, owner @{tmp}/#@{int} rw, diff --git a/apparmor.d/profiles-s-z/steamerrorreporter b/apparmor.d/profiles-s-z/steamerrorreporter index 8214a1fb9..27fe69be9 100644 --- a/apparmor.d/profiles-s-z/steamerrorreporter +++ b/apparmor.d/profiles-s-z/steamerrorreporter @@ -27,7 +27,7 @@ profile steamerrorreporter @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.steam/steam.pipe r, - owner @{lib_dirs}/{,**} r, + owner @{lib_dirs}/{,**} r, owner @{runtime_dirs}/pinned_libs_{32,64}/ r, owner @{share_dirs}/ r, diff --git a/apparmor.d/profiles-s-z/switcheroo-control b/apparmor.d/profiles-s-z/switcheroo-control index b2df1a346..e1b9ab7de 100644 --- a/apparmor.d/profiles-s-z/switcheroo-control +++ b/apparmor.d/profiles-s-z/switcheroo-control @@ -23,7 +23,7 @@ profile switcheroo-control @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+drm:card@{int}-* r, # for screen outputs @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* + @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* @{sys}/bus/ r, @{sys}/class/ r, diff --git a/apparmor.d/profiles-s-z/task b/apparmor.d/profiles-s-z/task index 598e59341..3cffb0748 100644 --- a/apparmor.d/profiles-s-z/task +++ b/apparmor.d/profiles-s-z/task @@ -41,7 +41,7 @@ profile task @{exec_path} { include if exists } - + include if exists } diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index 1ee9f0941..f4fb49f8f 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -7,7 +7,7 @@ abi , include -@{name} = thunderbird{,-bin} +@{name} = thunderbird{,-bin} @{lib_dirs} = @{lib}/@{name} @{config_dirs} = @{HOME}/.@{name}/ @{cache_dirs} = @{user_cache_dirs}/@{name}/ diff --git a/apparmor.d/profiles-s-z/udev-dmi-memory-id b/apparmor.d/profiles-s-z/udev-dmi-memory-id index a26c4a263..1d6580311 100644 --- a/apparmor.d/profiles-s-z/udev-dmi-memory-id +++ b/apparmor.d/profiles-s-z/udev-dmi-memory-id @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{lib}/udev/dmi_memory_id +@{exec_path} = @{lib}/udev/dmi_memory_id profile udev-dmi-memory-id @{exec_path} { include diff --git a/apparmor.d/profiles-s-z/zed b/apparmor.d/profiles-s-z/zed index 048f2410c..bb160a5e5 100644 --- a/apparmor.d/profiles-s-z/zed +++ b/apparmor.d/profiles-s-z/zed @@ -10,11 +10,11 @@ include profile zed @{exec_path} { include include - + capability sys_admin, network netlink raw, - + @{exec_path} mr, @{bin}/{m,g,}awk rix, @@ -48,7 +48,7 @@ profile zed @{exec_path} { @{sys}/bus/pci/slots/ r, @{sys}/bus/pci/slots/@{int}/address r, @{sys}/module/zfs/parameters/zfs_zevent_len_max rw, - + @{PROC}/@{pids}/mounts r, owner @{PROC}/@{pids}/fd/ r, @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/profiles-s-z/zfs b/apparmor.d/profiles-s-z/zfs index 9ba71f45b..e28a2e439 100644 --- a/apparmor.d/profiles-s-z/zfs +++ b/apparmor.d/profiles-s-z/zfs @@ -10,13 +10,13 @@ include profile zfs @{exec_path} { include include - + capability sys_admin, capability dac_read_search, mount fstype=zfs, umount fstype=zfs, - + @{exec_path} mr, /etc/zfs/zfs-list.cache/{,*} rwk, diff --git a/apparmor.d/profiles-s-z/zsys-system-autosnapshot b/apparmor.d/profiles-s-z/zsys-system-autosnapshot index cbf48ba4f..799262482 100644 --- a/apparmor.d/profiles-s-z/zsys-system-autosnapshot +++ b/apparmor.d/profiles-s-z/zsys-system-autosnapshot @@ -12,7 +12,7 @@ profile zsys-system-autosnapshot @{exec_path} flags=(complain) { include @{exec_path} mr, - + @{sh_path} rix, @{bin}/cat rix, @{bin}/cp rix, diff --git a/apparmor.d/profiles-s-z/zsysd b/apparmor.d/profiles-s-z/zsysd index 30a17a6ad..8ac23a07c 100644 --- a/apparmor.d/profiles-s-z/zsysd +++ b/apparmor.d/profiles-s-z/zsysd @@ -24,7 +24,7 @@ profile zsysd @{exec_path} flags=(complain) { /etc/hostid r, /etc/zsys.conf r, - + /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw, @{run}/systemd/notify rw, diff --git a/tests/check.sh b/tests/check.sh index 71fc244ab..4d36c80c0 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -16,8 +16,8 @@ readonly HEADERS=( ) _die() { - echo " ✗ $*" - exit 1 + echo -e "\033[1;31m ✗ Error: \033[0m$*" + #exit 1 } _ensure_header() { @@ -46,6 +46,9 @@ _ensure_indentation() { in_profile=true first_line_after_profile=true + elif [[ "$line" =~ [[:space:]]+$ ]]; then + _die "$file:$line_number: line has trailing whitespace." + elif $in_profile; then if $first_line_after_profile; then local leading_spaces="${line%%[! ]*}" @@ -104,9 +107,10 @@ _ensure_vim() { } check_profiles() { - echo " ⋅ Checking if all profiles contain:" + echo -e "\033[1m ⋅ \033[0mChecking if all profiles contain:" echo " - apparmor.d header & license" echo " - Check indentation: 2 spaces" + echo " - Check for trailing whitespaces" echo " - 'abi ,'" echo " - 'profile '" echo " - 'include if exists '" @@ -140,9 +144,10 @@ check_profiles() { } check_abstractions() { - echo " ⋅ Checking if all abstractions contain:" + echo -e "\033[1m ⋅ \033[0mChecking if all abstractions contain:" echo " - apparmor.d header & license" echo " - Check indentation: 2 spaces" + echo " - Check for trailing whitespaces" echo " - 'abi ,'" echo " - 'include if exists '" echo " - vim:syntax=apparmor" From 897302bc5b1f96aae795f6716c9174c6fcd837ac Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 20:07:11 +0100 Subject: [PATCH 0405/1455] chore(profile): remove trailing whitespace in profiles (2). --- apparmor.d/abstractions/audio-server | 2 +- tests/check.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/audio-server b/apparmor.d/abstractions/audio-server index 97850305b..10bcef426 100644 --- a/apparmor.d/abstractions/audio-server +++ b/apparmor.d/abstractions/audio-server @@ -3,7 +3,7 @@ # SPDX-License-Identifier: GPL-2.0-only # Provide access to audio devices. It should only be used by audio servers that -# need direct access to them. +# need direct access to them. abi , diff --git a/tests/check.sh b/tests/check.sh index 4d36c80c0..3ddda9827 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -17,7 +17,7 @@ readonly HEADERS=( _die() { echo -e "\033[1;31m ✗ Error: \033[0m$*" - #exit 1 + exit 1 } _ensure_header() { From d9208e06480922239ed0391760e628564a293635 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Oct 2024 22:04:04 +0100 Subject: [PATCH 0406/1455] feat(profile): general update and fixes. --- apparmor.d/abstractions/app/sudo | 4 +- apparmor.d/abstractions/app/systemctl | 4 +- apparmor.d/abstractions/common/bwrap | 7 ++- apparmor.d/abstractions/desktop | 4 +- apparmor.d/abstractions/disks-read | 2 +- apparmor.d/abstractions/gstreamer | 2 +- apparmor.d/abstractions/xfce | 2 +- apparmor.d/groups/bus/dbus-system | 2 +- .../freedesktop/xdg-desktop-portal-gnome | 1 + .../groups/freedesktop/xdg-desktop-portal-gtk | 1 + apparmor.d/groups/kde/sddm | 3 +- apparmor.d/groups/network/mullvad-daemon | 2 +- apparmor.d/groups/pacman/aurpublish | 17 ++++++- apparmor.d/profiles-a-f/acpid | 3 +- apparmor.d/profiles-a-f/dfc | 5 +-- apparmor.d/profiles-a-f/dkms | 1 + apparmor.d/profiles-a-f/foliate | 2 +- apparmor.d/profiles-a-f/fwupd | 21 ++++----- apparmor.d/profiles-m-r/mkinitramfs | 45 ++++++++++--------- apparmor.d/profiles-s-z/vesktop | 1 + apparmor.d/profiles-s-z/vnstat | 28 +++--------- 21 files changed, 78 insertions(+), 79 deletions(-) diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 14e3dfb72..385ded540 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -36,8 +36,6 @@ @{bin}/sudo mr, @{lib}/sudo/** mr, - @{etc_ro}/environment r, - @{etc_ro}/security/limits.d/{,*} r, @{etc_ro}/sudo.conf r, @{etc_ro}/sudoers r, @{etc_ro}/sudoers.d/{,*} r, @@ -53,8 +51,8 @@ owner @{HOME}/.sudo_as_admin_successful rw, # yubikey support - owner @{HOME}/.yubico/challenge-* rw, @{HOME}/.yubico/ r, + owner @{HOME}/.yubico/challenge-* rw, @{run}/faillock/ rw, @{run}/faillock/@{user} rwk, diff --git a/apparmor.d/abstractions/app/systemctl b/apparmor.d/abstractions/app/systemctl index 38126c968..7857f9921 100644 --- a/apparmor.d/abstractions/app/systemctl +++ b/apparmor.d/abstractions/app/systemctl @@ -8,9 +8,9 @@ include include - ptrace (read) peer=@{p_systemd}, + ptrace read peer=@{p_systemd}, - unix (bind) type=stream addr=@@{hex16}/bus/systemctl/, + unix bind type=stream addr=@@{hex16}/bus/systemctl/, @{bin}/systemctl mr, diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index fca42427d..b5b119d0f 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -44,17 +44,16 @@ owner /tmp/newroot/ w, owner /tmp/oldroot/ w, + @{PROC}/sys/kernel/overflowgid r, + @{PROC}/sys/kernel/overflowuid r, @{att}/@{PROC}/sys/user/max_user_namespaces rw, owner @{att}/@{PROC}/@{pid}/cgroup r, + owner @{att}/@{PROC}/@{pid}/fd/ r, owner @{att}/@{PROC}/@{pid}/gid_map rw, owner @{att}/@{PROC}/@{pid}/mountinfo r, owner @{att}/@{PROC}/@{pid}/setgroups rw, owner @{att}/@{PROC}/@{pid}/uid_map rw, - @{PROC}/sys/kernel/overflowgid r, - @{PROC}/sys/kernel/overflowuid r, - owner @{PROC}/@{pid}/fd/ r, - include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index a856cbd37..743dfaf2d 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -52,7 +52,7 @@ owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_??_* rwlk, + owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*.@{rand6} rwlk, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/dolphinrc r, @@ -67,7 +67,7 @@ # else if @{DE} == xfce - /usr/share/xfce4/ r, + /usr/share/xfce{,4}/ r, owner @{user_config_dirs}/xfce4/help{,ers}.rc rw, owner @{user_config_dirs}/xfce4/help{,ers}.rc.@{int}.tmp rw, diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 143a6ea7a..62e24b70d 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -76,7 +76,7 @@ /dev/sr@{int} rk, # Lookup block device by major:minor numbers - # See: https://apparmor.pujol.io/development/structure/#udev-rules + # See: https://apparmor.pujol.io/development/internal/#udev-rules @{sys}/block/ r, @{sys}/class/block/ r, diff --git a/apparmor.d/abstractions/gstreamer b/apparmor.d/abstractions/gstreamer index de2adb332..1cf8869c4 100644 --- a/apparmor.d/abstractions/gstreamer +++ b/apparmor.d/abstractions/gstreamer @@ -6,7 +6,7 @@ abi , @{lib}/@{multiarch}/libproxy/*/modules/*.so mr, - @{lib}/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr, + @{lib}/@{multiarch}/libvisual-@{version}/*/*.so mr, @{lib}/frei0r-@{int}/*.so mr, @{lib}/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner rix, diff --git a/apparmor.d/abstractions/xfce b/apparmor.d/abstractions/xfce index 936504e74..3046c8f6d 100644 --- a/apparmor.d/abstractions/xfce +++ b/apparmor.d/abstractions/xfce @@ -11,7 +11,7 @@ include include - /usr/share/xfce4/ r, + /usr/share/xfce{,4}/ r, owner @{user_config_dirs}/xfce4/help{,ers}.rc rw, owner @{user_config_dirs}/xfce4/help{,ers}.rc.@{int}.tmp rw, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index bda678f88..6ef4e44ea 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -16,7 +16,7 @@ include profile dbus-system flags=(attach_disconnected) { include include - include + include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index e9bdfde1f..17d26e3b1 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -65,6 +65,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/task/@{tid}/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/status r, include if exists diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index 0daa77899..d4fa3dc1d 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/xdg-desktop-portal-gtk profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include + include include include include diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index a09f55c4b..5e024adfd 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -172,12 +172,13 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/#@{int} rw, owner @{tmp}/sddm-auth* rw, + @{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw, + @{run}/faillock/@{user} rwk, @{run}/sddm.pid rw, @{run}/sddm/\{@{uuid}\} rw, @{run}/sddm/#@{int} rw, @{run}/sddm/xauth_@{rand6} rwl -> @{run}/sddm/#@{int}, - @{run}/systemd/sessions/*.ref rw, @{run}/user/@{uid}/xauth_@{rand6} rwl, owner @{run}/sddm/ rw, owner @{run}/user/@{uid}/ r, diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index 55b5bda1a..ee98720b6 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -59,9 +59,9 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { owner @{tmp}/@{uuid} rw, owner @{tmp}/talpid-openvpn-@{uuid} rw, + @{PROC}/sys/net/ipv{4,6}/conf/all/src_valid_mark rw, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, - @{PROC}/sys/net/ipv{4,6}/conf/all/src_valid_mark rw, /dev/net/tun rw, diff --git a/apparmor.d/groups/pacman/aurpublish b/apparmor.d/groups/pacman/aurpublish index 82f935dcb..a7a7bf225 100644 --- a/apparmor.d/groups/pacman/aurpublish +++ b/apparmor.d/groups/pacman/aurpublish @@ -47,14 +47,15 @@ profile aurpublish @{exec_path} { /etc/makepkg.conf r, /etc/makepkg.conf.d/{,**} r, - owner @{user_build_dirs}/**/ w, + owner @{user_build_dirs}/{,**/} w, owner @{user_projects_dirs}/** r, owner @{user_projects_dirs}/**/.git/COMMIT_EDITMSG rw, owner @{user_projects_dirs}/**/.SRCINFO rw, - owner @{user_cache_dirs}/makepkg/src/* rw, + owner @{user_cache_dirs}/makepkg/src/** rw, owner @{user_config_dirs}/pacman/makepkg.conf r, + owner /tmp/*/src/ w, owner @{tmp}/tmp.@{rand10} rw, /dev/tty rw, @@ -64,14 +65,26 @@ profile aurpublish @{exec_path} { @{bin}/gpg{,2} mr, @{bin}/gpgconf mr, + @{bin}/gpg-agent rix, + @{lib}/{,gnupg/}scdaemon rix, owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, owner @{user_cache_dirs}/makepkg/src/*.asc r, + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/gnupg/ r, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent rw, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent.browser w, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent.extra w, + owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.gpg-agent.ssh w, + owner @{tmp}/tmp.@{rand10} rw, + owner @{PROC}/@{pid}/fd/ r, + include if exists } diff --git a/apparmor.d/profiles-a-f/acpid b/apparmor.d/profiles-a-f/acpid index 7c1a7d4ba..5bf6c433a 100644 --- a/apparmor.d/profiles-a-f/acpid +++ b/apparmor.d/profiles-a-f/acpid @@ -26,8 +26,9 @@ profile acpid @{exec_path} flags=(attach_disconnected) { /etc/acpi/{,**} r, /etc/acpi/handler.sh rix, + @{run}/acpid.socket w, owner @{run}/acpid.socket rw, - owner @{run}/acpid.pid rw, + owner @{run}/acpid.pid rw, owner @{PROC}/@{pids}/fd/ r, owner @{PROC}/@{pids}/loginuid r, diff --git a/apparmor.d/profiles-a-f/dfc b/apparmor.d/profiles-a-f/dfc index d23028a47..65f944638 100644 --- a/apparmor.d/profiles-a-f/dfc +++ b/apparmor.d/profiles-a-f/dfc @@ -12,9 +12,8 @@ profile dfc @{exec_path} { include include - capability dac_read_search, - # No visible effect - deny capability dac_override, + capability dac_override, + capability dac_read_search, @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 5e8a3ea0c..ecf1d1c64 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -30,6 +30,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{bin}/bc rix, @{bin}/gcc rix, @{bin}/getconf rix, + @{bin}/kill rix, @{bin}/kmod rCx -> kmod, @{bin}/ld rix, @{bin}/lsb_release rPx -> lsb_release, diff --git a/apparmor.d/profiles-a-f/foliate b/apparmor.d/profiles-a-f/foliate index 422652084..b1c485408 100644 --- a/apparmor.d/profiles-a-f/foliate +++ b/apparmor.d/profiles-a-f/foliate @@ -40,7 +40,7 @@ profile foliate @{exec_path} flags=(attach_disconnected) { /usr/share/com.github.johnfactotum.Foliate/{,**} r, owner /bindfile@{rand6} rw, - owner @{att}/.flatpak-info r, + owner /.flatpak-info r, owner @{user_books_dirs}/{,**} r, owner @{user_torrents_dirs}/{,**} r, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 40dbda8c7..6cee42be9 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -66,11 +66,8 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /etc/pki/fwupd-metadata/{,**} r, /etc/pki/fwupd/{,**} r, - /var/cache/fwupd/{,**} rw, - /var/lib/flatpak/exports/share/mime/mime.cache r, - /var/lib/fwupd/{,**} rw, - /var/lib/fwupd/pending.db rwk, - /var/tmp/etilqs_@{hex16} rw, + /etc/machine-id r, + /var/lib/dbus/machine-id r, /boot/{,**} r, /boot/EFI/*/.goutputstream-@{rand6} rw, @@ -78,8 +75,12 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /boot/EFI/*/fwupdx@{int}.efi rw, @{lib}/fwupd/efi/fwupdx@{int}.efi{,.signed} r, - /etc/machine-id r, - /var/lib/dbus/machine-id r, + /var/lib/flatpak/exports/share/mime/mime.cache r, + /var/tmp/etilqs_@{hex16} rw, + owner /var/cache/fwupd/ rw, + owner /var/cache/fwupd/** rwk, + owner /var/lib/fwupd/ rw, + owner /var/lib/fwupd/** rwk, # In order to get to this file, the attach_disconnected flag has to be set owner @{user_cache_dirs}/fwupd/lvfs-metadata.xml.gz r, @@ -88,8 +89,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{sys}/**/ r, @{sys}/devices/** r, - @{sys}/bus/hid/drivers/*/uevent r, - @{sys}/bus/usb/drivers/usbhid/uevent r, @{sys}/firmware/acpi/** r, @{sys}/firmware/dmi/tables/DMI r, @{sys}/firmware/dmi/tables/smbios_entry_point r, @@ -99,9 +98,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{sys}/firmware/efi/efivars/fwupd-* rw, @{sys}/kernel/security/lockdown r, @{sys}/kernel/security/tpm@{int}/binary_bios_measurements r, - @{sys}/module/*/uevent r, - @{sys}/module/uhid/uevent r, - @{sys}/module/usbhid/uevent r, + @{sys}/**/uevent r, @{sys}/power/mem_sleep r, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 3b02d97c2..774dfa9f8 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -50,6 +50,7 @@ profile mkinitramfs @{exec_path} { @{bin}/touch rix, @{bin}/tr rix, @{bin}/tsort rix, + @{bin}/uniq rix, @{bin}/xargs rix, @{bin}/xz rix, @{bin}/zstd rix, @@ -85,13 +86,15 @@ profile mkinitramfs @{exec_path} { owner /boot/initrd.img-*.new rw, /var/tmp/ r, - /var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.{order,builtin} rw, - owner /var/tmp/mkinitramfs_*/ rw, - owner /var/tmp/mkinitramfs_*/** rwl -> /var/tmp/mkinitramfs_*/**, - owner /var/tmp/mkinitramfs-* rw, + /var/tmp/modules_@{rand6} rw, + /var/tmp/mkinitramfs_@{rand6}/@{lib}/modules/*/modules.{order,builtin} rw, + owner /var/tmp/mkinitramfs_@{rand6} rw, + owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_*/**, + owner /var/tmp/mkinitramfs-@{rand6} rw, @{sys}/devices/platform/ r, - @{sys}/devices/platform/reg-dummy/{,**}/ r, + @{sys}/devices/platform/**/ r, + @{sys}/devices/platform/**/modalias r, @{sys}/module/compression r, @{PROC}/cmdline r, @@ -126,18 +129,18 @@ profile mkinitramfs @{exec_path} { @{sh_path} rix, @{bin}/ldconfig.real rix, - owner /var/tmp/mkinitramfs_*/etc/ld.so.conf r, - owner /var/tmp/mkinitramfs_*/etc/ld.so.conf.d/{,*.conf} r, + owner /var/tmp/mkinitramfs_@{rand6}/etc/ld.so.conf r, + owner /var/tmp/mkinitramfs_@{rand6}/etc/ld.so.conf.d/{,*.conf} r, - owner /var/tmp/mkinitramfs_*/{usr/,}lib{,32,x32}/ r, - owner /var/tmp/mkinitramfs_*/{usr/,}lib/@{multiarch}/ r, - owner /var/tmp/mkinitramfs_*/{usr/,}lib/@{multiarch}/*.so* rw, - owner /var/tmp/mkinitramfs_*/{usr/,}lib{,32,x32}/*.so* rw, + owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/ r, + owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/@{multiarch}/ r, + owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/@{multiarch}/*.so* rw, + owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/*.so* rw, - owner /var/tmp/mkinitramfs_*/etc/ld.so.cache{,~} rw, + owner /var/tmp/mkinitramfs_@{rand6}/etc/ld.so.cache{,~} rw, - owner /var/tmp/mkinitramfs_*/var/cache/ldconfig/ rw, - owner /var/tmp/mkinitramfs_*/var/cache/ldconfig/aux-cache{,~} rw, + owner /var/tmp/mkinitramfs_@{rand6}/var/cache/ldconfig/ rw, + owner /var/tmp/mkinitramfs_@{rand6}/var/cache/ldconfig/aux-cache{,~} rw, include if exists } @@ -156,7 +159,7 @@ profile mkinitramfs @{exec_path} { /usr/share/initramfs-tools/scripts/{,**/} r, /etc/initramfs-tools/scripts/{,**/} r, - owner /var/tmp/mkinitramfs_*/{,**/} r, + owner /var/tmp/mkinitramfs_@{rand6}/{,**/} r, include if exists } @@ -165,11 +168,13 @@ profile mkinitramfs @{exec_path} { include include - owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/ r, - owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.* rw, - owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/updates/{,**} r, - owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/kernel/{,**/} r, - owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/kernel/**/*.ko r, + owner /var/tmp/mkinitramfs_@{rand6}/usr/lib/modules/*/ r, + owner /var/tmp/mkinitramfs_@{rand6}/usr/lib/modules/*/modules.* rw, + owner /var/tmp/mkinitramfs_@{rand6}usr/lib/modules/*/updates/{,**} r, + owner /var/tmp/mkinitramfs_@{rand6}/usr/lib/modules/*/kernel/{,**/} r, + owner /var/tmp/mkinitramfs_@{rand6}/usr/lib/modules/*/kernel/**/*.ko* r, + + @{sys}/module/compression r, include if exists } diff --git a/apparmor.d/profiles-s-z/vesktop b/apparmor.d/profiles-s-z/vesktop index a3c3f5a03..b4b63fe74 100644 --- a/apparmor.d/profiles-s-z/vesktop +++ b/apparmor.d/profiles-s-z/vesktop @@ -4,6 +4,7 @@ # SPDX-License-Identifier: GPL-2.0-only abi , + include @{name} = vesktop diff --git a/apparmor.d/profiles-s-z/vnstat b/apparmor.d/profiles-s-z/vnstat index b780eb8d1..edce31840 100644 --- a/apparmor.d/profiles-s-z/vnstat +++ b/apparmor.d/profiles-s-z/vnstat @@ -12,35 +12,17 @@ profile vnstat @{exec_path} { include include - # The following rules are needed when adding a new interface to the vnstat database. Usually this - # action is performed as root, but the vnstatd daemon is run as vnstat (user/group), and all the - # database files under /var/lib/vnstat/ are owned by vnstat:vnstat. Because of the above, the - # dac_override CAP is needed to allow writing files in that dir. - # - # If this CAP was denied, then the following error is printed when adding new interfaces: - # - # Error: Exec step failed (8: attempt to write a readonly database): "insert into interface - # (name, active, created, updated, rxcounter, txcounter, rxtotal, txtotal) values ('eth0', 1, - # datetime('now', 'localtime'), datetime('now', 'localtime'), 0, 0, 0, 0)" - # Error: Adding interface "ifb0" to database failed. - # - capability dac_override, - # - # Also the vnstat.db file has to have the write permission: - /var/lib/vnstat/vnstat.db w, - /var/lib/vnstat/vnstat.db-journal rw, - # - # This is needed to change the owner:group to vnstat:vnstat of the database file. capability chown, + capability dac_override, @{exec_path} mr, - # Many apps/users can query vnstat database, so don't use owner here. - /var/lib/vnstat/ r, - /var/lib/vnstat/vnstat.db rk, - /etc/vnstat.conf r, + /var/lib/vnstat/ r, + /var/lib/vnstat/vnstat.db rwk, + /var/lib/vnstat/vnstat.db-journal rw, + @{sys}/class/net/ r, @{sys}/devices/@{pci}/net/*/statistics/{tx,rx}_{bytes,packets} r, From 25049292ebd9f02dd0bfc4925dcacb2144a94b62 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 23 Oct 2024 11:39:49 +0100 Subject: [PATCH 0407/1455] feat(profile): improve integration with Tumbleweed. see #576 --- apparmor.d/groups/freedesktop/fc-list | 1 + apparmor.d/groups/gpg/gpg-agent | 1 + apparmor.d/groups/gpg/gpgsm | 1 + apparmor.d/groups/systemd/systemd-escape | 1 + apparmor.d/groups/systemd/systemd-hwdb | 6 +++--- apparmor.d/groups/systemd/systemd-journald | 1 + apparmor.d/groups/systemd/systemd-sysusers | 6 +++--- apparmor.d/profiles-a-f/blkid | 4 ++++ apparmor.d/profiles-g-l/issue-generator | 1 + apparmor.d/profiles-g-l/lsblk | 2 +- apparmor.d/profiles-s-z/sync | 4 ++++ 11 files changed, 21 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/freedesktop/fc-list b/apparmor.d/groups/freedesktop/fc-list index 3f2fb4e02..ffe996c52 100644 --- a/apparmor.d/groups/freedesktop/fc-list +++ b/apparmor.d/groups/freedesktop/fc-list @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/fc-list profile fc-list @{exec_path} { include + include include include diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index 75bb7583f..708ccc5f3 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/gpg-agent profile gpg-agent @{exec_path} { include + include include signal (receive) peer=pinentry-*, diff --git a/apparmor.d/groups/gpg/gpgsm b/apparmor.d/groups/gpg/gpgsm index 364c05f73..bfa71cf53 100644 --- a/apparmor.d/groups/gpg/gpgsm +++ b/apparmor.d/groups/gpg/gpgsm @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/gpgsm profile gpgsm @{exec_path} { include + include include capability dac_read_search, diff --git a/apparmor.d/groups/systemd/systemd-escape b/apparmor.d/groups/systemd/systemd-escape index 0a38bf0fb..4a542497f 100644 --- a/apparmor.d/groups/systemd/systemd-escape +++ b/apparmor.d/groups/systemd/systemd-escape @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/systemd-escape profile systemd-escape @{exec_path} { include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-hwdb b/apparmor.d/groups/systemd/systemd-hwdb index 5664cde02..9b6203e92 100644 --- a/apparmor.d/groups/systemd/systemd-hwdb +++ b/apparmor.d/groups/systemd/systemd-hwdb @@ -16,11 +16,11 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{exec_path} mr, @{lib}/udev/#@{int} rwl, - @{lib}/udev/.#hwdb.bin@{hex} wl -> @{lib}/udev/#@{int}, + @{lib}/udev/.#hwdb.bin@{hex16} wl -> @{lib}/udev/#@{int}, @{lib}/udev/hwdb.bin w, - /etc/udev/.#hwdb.bind* rw, - /etc/udev/hwdb.bin rw, + /etc/udev/.#hwdb.bin@{hex16} wl -> /etc/udev/#@{int}, + /etc/udev/hwdb.bin w, /etc/udev/hwdb.d/{,*} r, owner @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index 4f95bed40..cc1f541dd 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -64,6 +64,7 @@ profile systemd-journald @{exec_path} { @{run}/udev/data/b259:@{int} r, # Block Extended Major @{run}/udev/data/c1:@{int} r, # For RAM disk @{run}/udev/data/c4:@{int} r, # For TTY devices + @{run}/udev/data/b8:@{int} r, # for /dev/sd* @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features @{run}/udev/data/c108:@{int} r, # For /dev/ppp @{run}/udev/data/c18[8-9]:@{int} r, # USB devices & USB serial converters diff --git a/apparmor.d/groups/systemd/systemd-sysusers b/apparmor.d/groups/systemd/systemd-sysusers index d6b1cb266..e1ca76d57 100644 --- a/apparmor.d/groups/systemd/systemd-sysusers +++ b/apparmor.d/groups/systemd/systemd-sysusers @@ -19,9 +19,9 @@ profile systemd-sysusers @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, # Config file locations - /etc/sysusers.d/*.conf r, - @{run}/sysusers.d/*.conf r, - /usr/lib/sysusers.d/*.conf r, + /etc/sysusers.d/{,*.conf} r, + @{run}/sysusers.d/{,*.conf} r, + /usr/lib/sysusers.d/{,*.conf} r, # Where the users can be created, /home/{,*} rw, diff --git a/apparmor.d/profiles-a-f/blkid b/apparmor.d/profiles-a-f/blkid index 4aea919b4..903e2cb62 100644 --- a/apparmor.d/profiles-a-f/blkid +++ b/apparmor.d/profiles-a-f/blkid @@ -40,6 +40,10 @@ profile blkid @{exec_path} flags=(attach_disconnected) { @{PROC}/partitions r, @{PROC}/swaps r, + # Other possible location of the cache file + /dev/.blkid.tab{,-@{rand6}} rw, + /dev/blkid.tab.old rwl -> /dev/blkid.tab, + owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index 6c6d61c44..3602a1a1e 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/issue-generator profile issue-generator @{exec_path} { include + include include @{exec_path} mr, diff --git a/apparmor.d/profiles-g-l/lsblk b/apparmor.d/profiles-g-l/lsblk index 147e1ba24..7559e4e48 100644 --- a/apparmor.d/profiles-g-l/lsblk +++ b/apparmor.d/profiles-g-l/lsblk @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/lsblk -profile lsblk @{exec_path} { +profile lsblk @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/profiles-s-z/sync b/apparmor.d/profiles-s-z/sync index 3b18ad36e..907def2b1 100644 --- a/apparmor.d/profiles-s-z/sync +++ b/apparmor.d/profiles-s-z/sync @@ -13,6 +13,10 @@ profile sync @{exec_path} { @{exec_path} mr, + # Common paths where sync is used to flush all write operations on a single file to disk + # TODO: /** rw, ? + /boot/initrd-*-default rw, + include if exists } From e92226f3615c8eabe32004cce45e7fd06e1df3e5 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Wed, 23 Oct 2024 23:03:04 +0300 Subject: [PATCH 0408/1455] Added files in /tmp (nscopy.tmp and others) to the ThunderBird profile --- apparmor.d/profiles-s-z/thunderbird | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index f4fb49f8f..997b81fb5 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -52,7 +52,8 @@ profile thunderbird @{exec_path} { owner @{tmp}/MozillaMailnews/ rw, owner @{tmp}/MozillaMailnews/*.msf rw, - owner @{tmp}/nsemail.eml rw, + owner @{tmp}/nscopy.tmp rw, + owner @{tmp}/nsemail{,-@{int}}.eml rw, owner @{tmp}/nsma rw, owner @{tmp}/pid-@{pid}/{,**} w, From db6c94ba5ad97112bc577cb66c2e1fa66df83a29 Mon Sep 17 00:00:00 2001 From: Besanon Date: Wed, 23 Oct 2024 23:34:13 +0200 Subject: [PATCH 0409/1455] Add startlxqt (#574) --- apparmor.d/groups/lxqt/startlxqt | 82 ++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 apparmor.d/groups/lxqt/startlxqt diff --git a/apparmor.d/groups/lxqt/startlxqt b/apparmor.d/groups/lxqt/startlxqt new file mode 100644 index 000000000..06967e694 --- /dev/null +++ b/apparmor.d/groups/lxqt/startlxqt @@ -0,0 +1,82 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/startlxqt +profile startlxqt @{exec_path} { + include + include + include + include + + signal (receive) set=(term) peer=sddm, + + @{exec_path} mr, + + @{bin}/xrdb rPx, + @{bin}/xsetroot rPx, + @{bin}/xprop rpx, + @{bin}/mkdir rix, + @{sh_path} rix, + @{bin}/lxqt-session rPx, + + @{bin}/systemctl rCx -> systemctl, + @{bin}/dbus-update-activation-environment rCx -> dbus, + + /usr/share/color-schemes/{,**} r, + /usr/share/desktop-directories/{,**} r, + /usr/share/kservices5/{,**} r, + /usr/share/mime/{,**} r, + + /etc/machine-id r, + /etc/xdg/menus/{,**} r, + + @{HOME}/ r, + + owner @{user_cache_dirs}/#@{int} rw, + @{user_cache_dirs}/ksycoca5_* rwkl -> @{user_cache_dirs}/#@{int}, + + owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/lxqt/ rw, + owner @{user_config_dirs}/menus/{,**} r, + + owner @{user_share_dirs}/kservices5/{,**} r, + owner @{user_share_dirs}/sddm/wayland-session.log rw, + owner @{user_share_dirs}/sddm/xorg-session.log rw, + + owner /tmp/#@{int} rw, + owner /tmp/startlxqt.@{rand6} rwl -> /tmp/#@{int}, + + owner @{run}/user/@{uid}/ r, + + owner @{PROC}/@{pid}/maps r, + + /dev/tty rw, + /dev/tty@{int} rw, + + include if exists + + profile systemctl flags=(attach_disconnected) { + include + include + + include if exists + } + + profile dbus { + include + + @{bin}/dbus-update-activation-environment mr, + + owner @{HOME}/.xsession-errors w, + + include if exists + } +} + +# vim:syntax=apparmor From d8da3147c9278ca8f398aea42c526fd84fd2f9b5 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Sun, 27 Oct 2024 03:35:19 +0300 Subject: [PATCH 0410/1455] /boot/EFI --- apparmor.d/groups/pacman/mkinitcpio | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index a9902e54b..dcf5b10fb 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -83,9 +83,10 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { # Manage /boot / r, - /boot/ r, - /boot/initramfs-*.img* rw, - /boot/vmlinuz-* r, + /{boot,efi}/ r, + /{boot,efi}/EFI/{,**} rw, + /{boot,efi}/initramfs-*.img* rw, + /{boot,efi}/vmlinuz-* r, /usr/share/systemd/bootctl/** r, From ce4a17870655064374fa2b9c4b7dd6c2ad081e8e Mon Sep 17 00:00:00 2001 From: odomingao Date: Sat, 26 Oct 2024 10:53:20 -0300 Subject: [PATCH 0411/1455] Update hyprland --- apparmor.d/groups/hyprland/hyprland | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 3a25c0a5a..68356741d 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -25,7 +25,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /usr/share/hyprland/{,*} r, + /usr/share/hypr{,land}/{,*} r, /usr/share/libinput/{,*} r, owner @{user_cache_dirs}/hyprland/{,**} rw, From 0a8727e83704e230a47cad05226d080505a18e13 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Fri, 25 Oct 2024 10:51:36 +0800 Subject: [PATCH 0412/1455] Fix gnome-boxes couldn't found VM that previously created --- apparmor.d/groups/gnome/gnome-boxes | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes index 0a5abe0a9..41ebab653 100644 --- a/apparmor.d/groups/gnome/gnome-boxes +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -58,6 +58,7 @@ profile gnome-boxes @{exec_path} { owner @{tmp}/*.iso-@{rand6} rw, owner @{tmp}/*.svg-@{rand6} rw, + owner @{run}/user/@{uid}/libvirt/ rw, owner @{run}/user/@{uid}/libvirt/virtqemud.lock rwk, @{run}/mount/utab r, From eef7e080f68047b9149fef31c61e07c1df9f9804 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Sun, 27 Oct 2024 23:38:08 +0800 Subject: [PATCH 0413/1455] Initial support for Xray and V2ray --- apparmor.d/profiles-s-z/v2ray | 32 ++++++++++++++++++++++++++++++++ apparmor.d/profiles-s-z/xray | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) create mode 100644 apparmor.d/profiles-s-z/v2ray create mode 100644 apparmor.d/profiles-s-z/xray diff --git a/apparmor.d/profiles-s-z/v2ray b/apparmor.d/profiles-s-z/v2ray new file mode 100644 index 000000000..fd36a9d78 --- /dev/null +++ b/apparmor.d/profiles-s-z/v2ray @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 EricLin +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/v2ray +profile v2ray @{exec_path} flags=(attach_disconnected) { + include + include + + network inet dgram, + network inet stream, + network inet raw, + network inet6 dgram, + network inet6 raw, + network netlink raw, + + @{exec_path} mr, + + /etc/v2ray/ r, + /etc/v2ray/**.json r, + /usr/share/v2ray/**.dat r, + + @{PROC}/sys/net/core/somaxconn r, + + include if exists +} + +# vim:syntax=apparmor \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/xray b/apparmor.d/profiles-s-z/xray new file mode 100644 index 000000000..c6f8135a0 --- /dev/null +++ b/apparmor.d/profiles-s-z/xray @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 EricLin +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/xray +profile xray @{exec_path} flags=(attach_disconnected) { + include + include + + network inet dgram, + network inet stream, + network inet raw, + network inet6 dgram, + network inet6 raw, + network netlink raw, + + @{exec_path} mr, + + /etc/xray/ r, + /etc/xray/**.json r, + /usr/share/xray/**.dat r, + + @{PROC}/sys/net/core/somaxconn r, + + include if exists +} + +# vim:syntax=apparmor \ No newline at end of file From 664b23677ee0b21616c001c59a3f224fcd80da7d Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Sun, 27 Oct 2024 23:45:43 +0800 Subject: [PATCH 0414/1455] Fix build error --- apparmor.d/profiles-s-z/v2ray | 2 +- apparmor.d/profiles-s-z/xray | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-s-z/v2ray b/apparmor.d/profiles-s-z/v2ray index fd36a9d78..b62cc59d5 100644 --- a/apparmor.d/profiles-s-z/v2ray +++ b/apparmor.d/profiles-s-z/v2ray @@ -29,4 +29,4 @@ profile v2ray @{exec_path} flags=(attach_disconnected) { include if exists } -# vim:syntax=apparmor \ No newline at end of file +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/xray b/apparmor.d/profiles-s-z/xray index c6f8135a0..39f321795 100644 --- a/apparmor.d/profiles-s-z/xray +++ b/apparmor.d/profiles-s-z/xray @@ -29,4 +29,4 @@ profile xray @{exec_path} flags=(attach_disconnected) { include if exists } -# vim:syntax=apparmor \ No newline at end of file +# vim:syntax=apparmor From be759e7c7c74da1a2daead1a23cdd39d7a69d6db Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Mon, 28 Oct 2024 00:42:21 +0800 Subject: [PATCH 0415/1455] Apply suggestion --- apparmor.d/profiles-s-z/v2ray | 3 +-- apparmor.d/profiles-s-z/xray | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/apparmor.d/profiles-s-z/v2ray b/apparmor.d/profiles-s-z/v2ray index b62cc59d5..5a9238355 100644 --- a/apparmor.d/profiles-s-z/v2ray +++ b/apparmor.d/profiles-s-z/v2ray @@ -20,8 +20,7 @@ profile v2ray @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /etc/v2ray/ r, - /etc/v2ray/**.json r, + /etc/v2ray/{,*} r, /usr/share/v2ray/**.dat r, @{PROC}/sys/net/core/somaxconn r, diff --git a/apparmor.d/profiles-s-z/xray b/apparmor.d/profiles-s-z/xray index 39f321795..7e86ada2c 100644 --- a/apparmor.d/profiles-s-z/xray +++ b/apparmor.d/profiles-s-z/xray @@ -20,8 +20,7 @@ profile xray @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /etc/xray/ r, - /etc/xray/**.json r, + /etc/xray/{,*} r, /usr/share/xray/**.dat r, @{PROC}/sys/net/core/somaxconn r, From 6f586f1f46376f15c806e9d3f15066d1c97265d5 Mon Sep 17 00:00:00 2001 From: Besanon Date: Mon, 28 Oct 2024 15:39:41 +0100 Subject: [PATCH 0416/1455] Add lxqt-session, enable start in sddm (#580) --- .../groups/kde/kscreen_backend_launcher | 1 + apparmor.d/groups/kde/sddm | 2 + apparmor.d/groups/lxqt/lxqt-session | 98 +++++++++++++++++++ 3 files changed, 101 insertions(+) create mode 100644 apparmor.d/groups/lxqt/lxqt-session diff --git a/apparmor.d/groups/kde/kscreen_backend_launcher b/apparmor.d/groups/kde/kscreen_backend_launcher index 5e09b0cbe..d4b547c7c 100644 --- a/apparmor.d/groups/kde/kscreen_backend_launcher +++ b/apparmor.d/groups/kde/kscreen_backend_launcher @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kscreen_backend_launcher profile kscreen_backend_launcher @{exec_path} { include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 5e024adfd..d8adff564 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -40,6 +40,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { ptrace (trace) peer=@{profile_name}, signal (receive) set=(hup) peer=@{p_systemd}, + signal (send) set=(kill, term) peer=lxqt-session, signal (send) set=(kill, term) peer=startplasma, signal (send) set=(kill, term) peer=xorg, signal (send) set=(kill, term) peer=xsetroot, @@ -94,6 +95,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/kwalletd{5,6} rPx, @{bin}/kwin_wayland rPx, @{bin}/sddm-greeter{,-qt6} rPx, + @{bin}/startlxqt rPx, @{bin}/startplasma-wayland rPx, @{bin}/startplasma-x11 rPx, @{bin}/sway rPUx, diff --git a/apparmor.d/groups/lxqt/lxqt-session b/apparmor.d/groups/lxqt/lxqt-session new file mode 100644 index 000000000..3a4a6cd61 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-session @@ -0,0 +1,98 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-session +profile lxqt-session @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + + network netlink raw, + + signal (send), + signal (receive) set=(kill, term) peer=startlxqt, + signal (receive) set=(kill, term) peer=sddm, + + ptrace (read), + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/sed rix, + @{bin}/readlink rix, + @{bin}/dirname rix, + @{bin}/system-config-printer-applet rPx, + @{bin}/dbus-update-activation-environment rCx -> dbus, + @{bin}/systemctl rCx -> systemctl, + + @{bin}/pavucontrol rPx, + @{lib}/geoclue-2.0/demos/agent rPx, + @{bin}/nm-connection-editor rPx, + @{bin}/nm-applet rPx, + @{bin}/openbox rix, + @{bin}/dconf-editor rPx, + @{bin}/setxkbmap rix, + @{bin}/start-pulseaudio-x11 rPx, + @{bin}/xrdb rPx, + @{bin}/xdg-user-dirs-update rPx, + + /usr/share/ r, + /usr/share/mime/ r, + /usr/share/cursors/ r, + /usr/share/backintime/common/* r, + /usr/share/desktop-directories/* r, + /usr/share/system-config-printer/* r, + + /etc/xdg/ r, + /etc/xdg/autostart/ r, + /etc/xdg/autostart/*.desktop r, + /etc/xdg/menus/lxqt-* r, + /etc/xdg/openbox/* r, + /etc/udev/udev.conf r, + + owner @{user_config_dirs}/autostart/ r, + owner @{user_config_dirs}/autostart/*.desktop r, + owner @{user_cache_dirs}/openbox/ rw, + owner @{user_cache_dirs}/openbox/sessions/ rw, + owner @{user_cache_dirs}/openbox/openbox.log rwk, + owner @{user_config_dirs}/mimeapps.list{,.@{rand6}} rw, + owner @{user_config_dirs}/openbox/rc.xml r, + + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + + @{PROC}/ r, + @{PROC}/uptime r, + @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/stat r, + + /dev/tty rw, + + profile systemctl { + include + include + + include if exists + } + profile dbus { + include + include + + @{bin}/dbus-update-activation-environment mr, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor From 1dc8714cb2efbd0f4272afd4da8b749f9fd1daeb Mon Sep 17 00:00:00 2001 From: valoq Date: Mon, 28 Oct 2024 15:41:41 +0100 Subject: [PATCH 0417/1455] various improvements (#590) --- apparmor.d/abstractions/app/editor | 2 +- apparmor.d/abstractions/app/firefox | 2 +- apparmor.d/abstractions/audio-client | 3 +++ apparmor.d/groups/gpg/scdaemon | 1 + apparmor.d/profiles-m-r/mutt | 6 +++++- apparmor.d/profiles-m-r/ouch | 1 + apparmor.d/profiles-m-r/pinentry-curses | 2 ++ .../profiles-m-r/{pinentry-gtk-2 => pinentry-gtk} | 11 +++++++---- apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox | 4 ++++ apparmor.d/profiles-s-z/w3m | 2 +- 10 files changed, 26 insertions(+), 8 deletions(-) rename apparmor.d/profiles-m-r/{pinentry-gtk-2 => pinentry-gtk} (70%) diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index 1d501eb9f..3992fb7b0 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -12,7 +12,7 @@ @{sh_path} rix, @{bin}/nvim mix, @{bin}/sensible-editor mr, - @{bin}/vim{,.*} mix, + @{bin}/vim{,.*} mrix, @{bin}/which{,.debianutils} ix, /usr/share/nvim/{,**} r, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 2a2f612b7..c749bf253 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -92,7 +92,7 @@ owner @{cache_dirs}/ rw, owner @{cache_dirs}/** rwk, - /tmp/ r, + /tmp/ rw, /var/tmp/ r, owner @{tmp}/@{name}/ rw, owner @{tmp}/@{name}/* rwk, diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index d847c732c..166229a09 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -11,6 +11,7 @@ /usr/share/openal/hrtf/{,**} r, /usr/share/pipewire/client-rt.conf r, /usr/share/pipewire/client.conf r, + /usr/share/pipewire/jack.conf r, /usr/share/sounds/{,**} r, /etc/alsa/conf.d/{,**} r, @@ -60,6 +61,8 @@ /dev/shm/ r, owner /dev/shm/pulse-shm-@{int} rw, + /dev/snd/controlC@{int} r, + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/gpg/scdaemon b/apparmor.d/groups/gpg/scdaemon index e88f34d4b..5d2cafd95 100644 --- a/apparmor.d/groups/gpg/scdaemon +++ b/apparmor.d/groups/gpg/scdaemon @@ -16,6 +16,7 @@ profile scdaemon @{exec_path} { network netlink raw, signal (send) peer=gpg-agent, + signal send set=usr2 peer=unconfined, @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/mutt b/apparmor.d/profiles-m-r/mutt index fb1e94c1f..28006f479 100644 --- a/apparmor.d/profiles-m-r/mutt +++ b/apparmor.d/profiles-m-r/mutt @@ -62,6 +62,7 @@ profile mutt @{exec_path} { owner @{HOME}/.mutthistory rwk, owner @{HOME}/.muttrc* r, owner @{HOME}/.signature r, # Mutt signature file + owner @{HOME}/ r, # User mbox # Could be a file or dir depending on mbox_type variable @@ -91,11 +92,14 @@ profile mutt @{exec_path} { @{bin}/w3m mrix, @{bin}/lynx mrix, - owner @{HOME}/.w3m/* rw, + owner @{HOME}/.w3m/{,**} rw, owner @{user_mail_dirs}/{,**} r, owner @{user_mail_dirs}/tmp/{,**} rw, owner /{var/,}tmp/mutt* rw, + owner /tmp/w3m-@{rand6} rw, + owner /tmp/w3m-@{rand6}/{,**} rw, + include if exists } diff --git a/apparmor.d/profiles-m-r/ouch b/apparmor.d/profiles-m-r/ouch index d0b75aae7..ef3ea4bee 100644 --- a/apparmor.d/profiles-m-r/ouch +++ b/apparmor.d/profiles-m-r/ouch @@ -15,6 +15,7 @@ profile ouch @{exec_path} { @{exec_path} mr, owner @{HOME}/.tmp@{rand6}/{,**} rw, + owner @{HOME}/.tmp-ouch@{rand6}/{,**} rw, @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, diff --git a/apparmor.d/profiles-m-r/pinentry-curses b/apparmor.d/profiles-m-r/pinentry-curses index a3ec65c45..c14b41027 100644 --- a/apparmor.d/profiles-m-r/pinentry-curses +++ b/apparmor.d/profiles-m-r/pinentry-curses @@ -17,6 +17,8 @@ profile pinentry-curses @{exec_path} { /usr/share/terminfo/** r, + owner /dev/tty@{int} r, + include if exists } diff --git a/apparmor.d/profiles-m-r/pinentry-gtk-2 b/apparmor.d/profiles-m-r/pinentry-gtk similarity index 70% rename from apparmor.d/profiles-m-r/pinentry-gtk-2 rename to apparmor.d/profiles-m-r/pinentry-gtk index 49e9ac307..a0244956d 100644 --- a/apparmor.d/profiles-m-r/pinentry-gtk-2 +++ b/apparmor.d/profiles-m-r/pinentry-gtk @@ -7,9 +7,10 @@ abi , include -@{exec_path} = @{bin}/pinentry-gtk-2 -profile pinentry-gtk-2 @{exec_path} { +@{exec_path} = @{bin}/pinentry-gtk{,-2} +profile pinentry-gtk @{exec_path} { include + include include include include @@ -17,11 +18,13 @@ profile pinentry-gtk-2 @{exec_path} { @{exec_path} mr, - /usr/share/gtk-2.0/gtkrc r, + /usr/share/gtk-@{int}.@{int}/{,**} r, owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, - include if exists + owner /dev/tty@{int} r, + + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox index b9efca35a..51c625d53 100644 --- a/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox +++ b/apparmor.d/profiles-s-z/signal-desktop-chrome-sandbox @@ -18,6 +18,7 @@ profile signal-desktop-chrome-sandbox @{exec_path} { capability sys_admin, capability sys_chroot, + capability dac_override, @{exec_path} mr, @@ -27,6 +28,9 @@ profile signal-desktop-chrome-sandbox @{exec_path} { @{PROC}/@{pid}/oom_adj w, @{PROC}/@{pid}/oom_score_adj w, + # Silencer + deny /dev/pts/@{int} rw, # file_inherit + include if exists } diff --git a/apparmor.d/profiles-s-z/w3m b/apparmor.d/profiles-s-z/w3m index 1a0e33418..ade896ea5 100644 --- a/apparmor.d/profiles-s-z/w3m +++ b/apparmor.d/profiles-s-z/w3m @@ -36,7 +36,7 @@ profile w3m @{exec_path} { owner @{user_config_dirs}/w3m/{,**} rw, - owner @{tmp}/@{rand6}/{,**} rw, + owner @{tmp}/w3m-@{rand6}/{,**} rw, include if exists } From a37e11f686f27ce82abcd81f9c137eb6122028f5 Mon Sep 17 00:00:00 2001 From: beroal Date: Mon, 28 Oct 2024 16:59:54 +0200 Subject: [PATCH 0418/1455] Writing locale.conf (#593) --- apparmor.d/groups/systemd/systemd-localed | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index 48318da8f..32f02f0d0 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -24,11 +24,12 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { /usr/share/systemd/*-map r, /usr/share/X11/xkb/{,**} r, + /etc/.#locale.conf@{hex16} rw, /etc/.#vconsole.conf* rw, /etc/default/.#locale* rw, /etc/default/keyboard r, /etc/default/locale rw, - /etc/locale.conf r, + /etc/locale.conf rw, /etc/vconsole.conf rw, /etc/X11/xorg.conf.d/ r, /etc/X11/xorg.conf.d/.#*.confd* rw, From 3144c30c0c01f7f13b6539e4855d9126a0861e22 Mon Sep 17 00:00:00 2001 From: odomingao Date: Tue, 29 Oct 2024 07:43:39 -0300 Subject: [PATCH 0419/1455] Update nvtop (#595) --- apparmor.d/profiles-m-r/nvtop | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/apparmor.d/profiles-m-r/nvtop b/apparmor.d/profiles-m-r/nvtop index 88a164c00..e4846d58e 100644 --- a/apparmor.d/profiles-m-r/nvtop +++ b/apparmor.d/profiles-m-r/nvtop @@ -31,7 +31,16 @@ profile nvtop @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/bus/ r, + @{sys}/devices/@{pci}/ r, + @{sys}/devices/@{pci}/current_link_{speed,width} r, @{sys}/devices/@{pci}/enable r, + @{sys}/devices/@{pci}/hwmon/hwmon@{int}/fan@{int}_{enable,max} r, + @{sys}/devices/@{pci}/hwmon/hwmon@{int}/power@{int}_cap r, + @{sys}/devices/@{pci}/hwmon/hwmon@{int}/pwm@{int} r, + @{sys}/devices/@{pci}/hwmon/hwmon@{int}/pwm@{int}_{enable,max} r, + @{sys}/devices/@{pci}/hwmon/hwmon@{int}/temp@{int}_crit r, + @{sys}/devices/@{pci}/max_link_{speed,width} r, + @{sys}/devices/@{pci}/pcie_bw r, @{sys}/devices/system/node/node@{int}/cpumap r, @{PROC}/ r, From a9a41ef810d97d0ffcf3d42e4d7ab4bb287da52e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 1 Nov 2024 11:59:30 +0100 Subject: [PATCH 0420/1455] feat(profile): pacman can restart any updated program. See #596 --- apparmor.d/groups/pacman/pacman | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 1c7015b1f..8215e3f6a 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -39,7 +39,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { ptrace read, - signal send set=usr1 peer=gvfsd, + signal send, signal receive set=winch peer=makepkg//sudo, @{exec_path} mrix, From 1eb7be5447a6603ca28faa33a23e2d32af97f64e Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Sun, 3 Nov 2024 16:53:56 +0200 Subject: [PATCH 0421/1455] /boot/EFI 2 --- apparmor.d/groups/pacman/mkinitcpio | 6 +++--- apparmor.d/groups/pacman/pacman-hook-mkinitcpio | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index dcf5b10fb..ed91f6c9c 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -83,10 +83,10 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { # Manage /boot / r, - /{boot,efi}/ r, + /boot/ r, /{boot,efi}/EFI/{,**} rw, - /{boot,efi}/initramfs-*.img* rw, - /{boot,efi}/vmlinuz-* r, + /boot/initramfs-*.img* rw, + /boot/vmlinuz-* r, /usr/share/systemd/bootctl/** r, diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio index 9ee488fbc..a9bf40360 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio @@ -37,7 +37,7 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) { / r, /boot/ r, - /boot/efi/boot/boot*.efi rw, + /{boot,efi}/EFI/boot/boot*.efi rw, /boot/initramfs-*-fallback.img rw, /boot/initramfs-*.img rw, /boot/vmlinuz-* rw, From 026fbf75520b3f20160c058936275354f1ecc652 Mon Sep 17 00:00:00 2001 From: Besanon Date: Mon, 4 Nov 2024 11:21:08 +0100 Subject: [PATCH 0422/1455] Add lxqt-panel (#594) --- apparmor.d/groups/lxqt/lxqt-panel | 92 +++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 apparmor.d/groups/lxqt/lxqt-panel diff --git a/apparmor.d/groups/lxqt/lxqt-panel b/apparmor.d/groups/lxqt/lxqt-panel new file mode 100644 index 000000000..650a7e402 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-panel @@ -0,0 +1,92 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-panel +profile lxqt-panel @{exec_path} { + include + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + network packet dgram, + + @{exec_path} mr, + + @{bin}/exo-open rix, + @{lib}/gio-launch-desktop rix, + @{bin}/nm-applet rPx, + @{bin}/nm-connection-editor rPx, + @{bin}/ControlPanel rPx, + + @{bin}/sudo rCx -> root, + + @{lib}/lxqt-panel/*.so mr, # LXQT-Plugins + @{lib}/lxqt-config/*.so mr, # LXQT-Plugins + + /usr/share/desktop-directories/{,**} r, + /usr/share/lxqt/{,**} r, + + /etc/fstab r, + /etc/udev/udev.conf r, + /etc/machine-id r, + /etc/xdg/lxqt-qtxdg.conf r, + /etc/xdg/menus/**.menu r, + /etc/xdg/menus/applications-merged/ r, + /etc/xdg/ui/uistandards.rc r, + + /var/lib/dbus/machine-id r, + + owner @{HOME}/Desktop/*.desktop rw, + owner @{HOME}/Desktop/#@{int} rw, + owner @{HOME}/Desktop/*.desktop l -> @{HOME}/Desktop/#@{int}, + + owner @{user_config_dirs}/menus/*.menu rw, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/share/desktop-directories/*.directory r, + owner @{user_config_dirs}/share/gvfs-metadata/{,*} r, + owner @{user_config_dirs}/lxqt/#@{int} rw, + owner @{user_config_dirs}/lxqt/panel.conf rw, + owner @{user_config_dirs}/lxqt/panel.conf.lock rwk, + owner @{user_config_dirs}/lxqt/panel.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/panel.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/pulse/{,**} rwk, + + @{run}/udev/data/* r, + + @{sys}/class/i2c-adapter/ r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{cur,min,max}_freq r, + + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/net/dev r, + owner @{PROC}/@{pid}/mounts r, + + /dev/tty rw, + /dev/tty@{int} rw, + /dev/pts/@{int} rw, + /dev/snd/controlC@{int} rw, + + profile root { + include + include + + @{bin}/lsblk rPx, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor From 51dfe0d35f0bbc8b5dc01e34c8ab8697033f6d24 Mon Sep 17 00:00:00 2001 From: barmogund Date: Sat, 9 Nov 2024 20:04:15 +0100 Subject: [PATCH 0423/1455] Add support for tlp (#585) --- apparmor.d/profiles-g-l/hdparm | 2 +- apparmor.d/profiles-s-z/tlp | 102 +++++++++++++++++++++++++++++++++ 2 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/profiles-s-z/tlp diff --git a/apparmor.d/profiles-g-l/hdparm b/apparmor.d/profiles-g-l/hdparm index 606540bb9..a4fa34973 100644 --- a/apparmor.d/profiles-g-l/hdparm +++ b/apparmor.d/profiles-g-l/hdparm @@ -10,9 +10,9 @@ include @{exec_path} = @{bin}/hdparm profile hdparm @{exec_path} flags=(complain) { include + include include include - include # To remove the following errors: # re-writing sector *: BLKFLSBUF failed: Permission denied diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp new file mode 100644 index 000000000..af5f67061 --- /dev/null +++ b/apparmor.d/profiles-s-z/tlp @@ -0,0 +1,102 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021-2024 Alexandre Pujol +# Copyright (C) 2024 Barmogund +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/tlp +profile tlp @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + + capability dac_read_search, + capability net_admin, + capability sys_nice, + capability sys_rawio, + capability sys_tty_config, + + network netlink raw, + + ptrace read peer=unconfined, + + @{exec_path} mr, + + @{bin}/systemctl rCx -> systemctl, + @{bin}/logger rix, + @{sh_path} rix, + @{bin}/cp rix, + @{bin}/chmod rix, + @{bin}/flock rix, + @{bin}/sort rix, + @{bin}/head rix, + @{bin}/mktemp rix, + @{bin}/readlink rix, + @{bin}/tr rix, + @{bin}/ethtool rix, + @{bin}/grep rix, + @{bin}/touch rix, + @{bin}/cat rix, + @{bin}/rm rix, + @{bin}/id rPx, + @{bin}/iw rPx, + @{bin}/hdparm rPx, + @{bin}/uname rpx, + @{bin}/udevadm rCx -> udevadm, + /usr/share/tlp/tlp-readconfs rix, + + / r, + + /etc/tlp.d/ r, + /etc/tlp.d/** rw, + /etc/tlp.conf rw, + + /usr/share/tlp/** r, + + /var/lib/power-profiles-daemon/state.ini rw, + + @{run}/udev/data/+platform:* r, + owner @{run}/tlp/* rw, + owner @{run}/tlp/lock_tlp rwk, + + @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw, + @{sys}/module/pcie_aspm/parameters/policy rw, + @{sys}/module/snd_hda_intel/parameters/power_save rw, + @{sys}/module/snd_hda_intel/parameters/power_save_controller rw, + @{sys}/firmware/acpi/platform_profile* rw, + @{sys}/firmware/acpi/pm_profile* rw, + + owner @{PROC}/sys/vm/laptop_mode rw, + owner @{PROC}/sys/vm/dirty_writeback_centisecs rw, + owner @{PROC}/sys/vm/dirty_expire_centisecs rw, + owner @{PROC}/sys/fs/xfs/xfssyncd_centisecs rw, + owner @{PROC}/sys/kernel/nmi_watchdog rw, + + /dev/disk/by-id/ r, + /dev/tty rw, + + profile systemctl { + include + include + + include if exists + } + + profile udevadm { + include + include + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor From 7b9d412f02f1474968ddd3278dd900ff9d805b45 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:00:45 +0000 Subject: [PATCH 0424/1455] feat(profile): gnome: allow receiving signal from gdm-session-worker as well as gdm. --- apparmor.d/groups/bus/at-spi2-registryd | 3 ++- apparmor.d/groups/freedesktop/xdg-desktop-portal | 1 + apparmor.d/groups/freedesktop/xdg-document-portal | 3 ++- apparmor.d/groups/freedesktop/xdg-permission-store | 5 +++-- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/bus/at-spi2-registryd b/apparmor.d/groups/bus/at-spi2-registryd index 8ead7a4e0..fd9707093 100644 --- a/apparmor.d/groups/bus/at-spi2-registryd +++ b/apparmor.d/groups/bus/at-spi2-registryd @@ -16,7 +16,8 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { include include - signal (receive) set=(term) peer=gdm, + signal receive set=term peer=gdm, + signal receive set=hup peer=gdm-session-worker, #aa:dbus own bus=accessibility name=org.a11y.atspi #aa:dbus talk bus=session name=org.a11y.{B,b}us label=dbus-accessibility diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 53218d821..8d8ae6662 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -32,6 +32,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { ptrace read, signal receive set=term peer=gdm, + signal receive set=hup peer=gdm-session-worker, #aa:dbus own bus=session name=org.freedesktop.portal.Desktop path=/org/freedesktop/portal/desktop interface={org.freedesktop.DBus.Properties,org.freedesktop{,.impl}.portal.{Settings,Background}} dbus receive bus=session path=/org/freedesktop/portal/desktop diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index d47b830e0..75ec9517c 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -22,7 +22,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/, - signal (receive) set=(term) peer=gdm, + signal receive set=term peer=gdm, + signal receive set=hup peer=gdm-session-worker, ptrace (read), diff --git a/apparmor.d/groups/freedesktop/xdg-permission-store b/apparmor.d/groups/freedesktop/xdg-permission-store index 298bc059d..441692ded 100644 --- a/apparmor.d/groups/freedesktop/xdg-permission-store +++ b/apparmor.d/groups/freedesktop/xdg-permission-store @@ -15,8 +15,9 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { capability sys_nice, - signal (receive) set=(term hup kill) peer=dbus-session, - signal (receive) set=(term hup kill) peer=gdm, + signal receive set=(term hup kill) peer=dbus-session, + signal receive set=(term hup kill) peer=gdm, + signal receive set=(term hup kill) peer=gdm-session-worker, #aa:dbus own bus=session name=org.freedesktop.impl.portal.PermissionStore From 3c0b83d1b0238765af951860b1713cb5dfdc7b46 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:02:07 +0000 Subject: [PATCH 0425/1455] feat(profile): improve some systemd profiles. --- apparmor.d/groups/systemd/systemd-cat | 5 ++--- apparmor.d/groups/systemd/systemd-cgls | 6 +++++- apparmor.d/groups/systemd/systemd-escape | 1 - apparmor.d/groups/systemd/systemd-sysusers | 6 ++++++ apparmor.d/groups/systemd/systemd-userdbd | 2 ++ apparmor.d/groups/systemd/userdbctl | 5 ++++- 6 files changed, 19 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/systemd/systemd-cat b/apparmor.d/groups/systemd/systemd-cat index 967d776d2..fd202c181 100644 --- a/apparmor.d/groups/systemd/systemd-cat +++ b/apparmor.d/groups/systemd/systemd-cat @@ -9,14 +9,13 @@ include @{exec_path} = @{bin}/systemd-cat profile systemd-cat @{exec_path} { include + include + include capability net_admin, @{exec_path} mr, - @{bin}/cat rix, - @{bin}/echo rix, - include if exists } diff --git a/apparmor.d/groups/systemd/systemd-cgls b/apparmor.d/groups/systemd/systemd-cgls index d0ded5ee7..e74280f67 100644 --- a/apparmor.d/groups/systemd/systemd-cgls +++ b/apparmor.d/groups/systemd/systemd-cgls @@ -10,7 +10,11 @@ include profile systemd-cgls @{exec_path} { include - ptrace (read), + capability sys_ptrace, + + ptrace read, + + signal send set=cont peer=child-pager, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-escape b/apparmor.d/groups/systemd/systemd-escape index 4a542497f..469ccc945 100644 --- a/apparmor.d/groups/systemd/systemd-escape +++ b/apparmor.d/groups/systemd/systemd-escape @@ -10,7 +10,6 @@ include profile systemd-escape @{exec_path} { include include - include @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-sysusers b/apparmor.d/groups/systemd/systemd-sysusers index e1ca76d57..254faeca0 100644 --- a/apparmor.d/groups/systemd/systemd-sysusers +++ b/apparmor.d/groups/systemd/systemd-sysusers @@ -16,8 +16,12 @@ profile systemd-sysusers @{exec_path} flags=(attach_disconnected) { capability fsetid, capability net_admin, + signal send set=cont peer=child-pager, + @{exec_path} mr, + @{pager_path} rPx -> child-pager, + # Config file locations /etc/sysusers.d/{,*.conf} r, @{run}/sysusers.d/{,*.conf} r, @@ -40,6 +44,8 @@ profile systemd-sysusers @{exec_path} flags=(attach_disconnected) { /etc/.#{group,gshadow}@{hex} rw, /etc/.pwd.lock rwk, + owner @{PROC}/@{pid}/cgroup r, + /dev/tty@{int} rw, owner /dev/pts/@{int} rw, diff --git a/apparmor.d/groups/systemd/systemd-userdbd b/apparmor.d/groups/systemd/systemd-userdbd index a38e455f3..ce698dc96 100644 --- a/apparmor.d/groups/systemd/systemd-userdbd +++ b/apparmor.d/groups/systemd/systemd-userdbd @@ -25,7 +25,9 @@ profile systemd-userdbd @{exec_path} flags=(attach_disconnected,mediate_deleted) @{lib}/systemd/systemd-userwork rix, + /etc/gshadow r, /etc/shadow r, + /etc/machine-id r, @{run}/systemd/userdb/{,**} rw, diff --git a/apparmor.d/groups/systemd/userdbctl b/apparmor.d/groups/systemd/userdbctl index b4081eacb..97625db38 100644 --- a/apparmor.d/groups/systemd/userdbctl +++ b/apparmor.d/groups/systemd/userdbctl @@ -21,11 +21,14 @@ profile userdbctl @{exec_path} { @{pager_path} rPx -> child-pager, - /etc/shadow r, /etc/gshadow r, + /etc/shadow r, + + /etc/machine-id r, @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/gid_map r, owner @{PROC}/@{pid}/uid_map r, include if exists From d30b673e99d4bc5931470353e6edfea5139e40ed Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:04:08 +0000 Subject: [PATCH 0426/1455] feat(profile): ip: improve support for network ns. --- apparmor.d/profiles-g-l/ip | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/apparmor.d/profiles-g-l/ip b/apparmor.d/profiles-g-l/ip index 1c870d94e..2797ae2ba 100644 --- a/apparmor.d/profiles-g-l/ip +++ b/apparmor.d/profiles-g-l/ip @@ -20,19 +20,20 @@ profile ip @{exec_path} flags=(attach_disconnected) { network netlink raw, - mount options=(rw, bind, rshared) -> /{var/,}run/netns/, - mount options=(rw, rslave) -> /, - mount options=(rw, bind) / -> /{var/,}run/netns/*, - mount options=(rw, bind) /etc/netns/firefox/resolv.conf -> /etc/resolv.conf, - mount fstype=sysfs -> /sys/, + mount options=(rw, rshared) -> @{run}/netns/, + mount options=(rw, rslave) -> /, + mount options=(rw, bind) @{att}/ -> @{run}/netns/*, + mount options=(rw, bind) /etc/netns/*/resolv.conf -> /etc/resolv.conf, + mount fstype=sysfs -> /sys/, umount @{run}/netns/*, umount /sys/, @{exec_path} mrix, - @{sh_path} rix, + @{shells_path} rUx, + @{bin}/sudo rPx, - / r, + @{att}/ r, /etc/iproute2/{,**} r, /etc/netns/*/ r, From 8f904132e19a9d13e57bc0216aaafc4dfa182c7f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:06:43 +0000 Subject: [PATCH 0427/1455] feat(profile): improve libreoffice tmp files. --- apparmor.d/profiles-g-l/libreoffice | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 2198ad925..6e1a2d07a 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -83,12 +83,13 @@ profile libreoffice @{exec_path} { owner @{user_share_dirs}/user-places.xbel r, owner @{tmp}/ r, - owner @{tmp}/@{rand6} rwk, - owner @{tmp}/*.tmp/{,**} rwk, - owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} w, owner @{tmp}/.java_pid@{int}{,.tmp} rw, + owner @{tmp}/@{rand6} rwk, + owner @{tmp}/@{u64} rw, + owner @{tmp}/*.tmp/{,**} rwk, owner @{tmp}/hsperfdata_@{user}/ rw, owner @{tmp}/hsperfdata_@{user}/@{int} rwk, + owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} w, owner @{run}/user/@{uid}/#@{int} rw, From d2f7ee0bb4fcbf4f355b1ad1516bddfde0353dd2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:10:18 +0000 Subject: [PATCH 0428/1455] feat(abs): add the devices-usb-read abstraction. --- apparmor.d/abstractions/devices-usb | 19 +++------------- apparmor.d/abstractions/devices-usb-read | 29 ++++++++++++++++++++++++ apparmor.d/profiles-g-l/lsusb | 2 +- 3 files changed, 33 insertions(+), 17 deletions(-) create mode 100644 apparmor.d/abstractions/devices-usb-read diff --git a/apparmor.d/abstractions/devices-usb b/apparmor.d/abstractions/devices-usb index 1a85a0100..85f8f6b92 100644 --- a/apparmor.d/abstractions/devices-usb +++ b/apparmor.d/abstractions/devices-usb @@ -5,24 +5,11 @@ abi , - /dev/ r, - /dev/bus/usb/ r, - /dev/bus/usb/@{int}/ r, - /dev/bus/usb/@{int}/@{int} rwk, + include - @{sys}/class/ r, - @{sys}/class/usbmisc/ r, + /dev/bus/usb/@{int}/@{int} wk, - @{sys}/bus/ r, - @{sys}/bus/usb/ r, - @{sys}/bus/usb/devices/{,**} r, - - @{sys}/devices/**/usb@{int}/{,**} rw, - - # Udev data about usb devices (~equal to content of lsusb -v) - @{run}/udev/data/+usb:* r, - @{run}/udev/data/c16[6,7]:@{int} r, # USB modems - @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters + @{sys}/devices/**/usb@{int}/{,**} w, include if exists diff --git a/apparmor.d/abstractions/devices-usb-read b/apparmor.d/abstractions/devices-usb-read new file mode 100644 index 000000000..6bd0c8015 --- /dev/null +++ b/apparmor.d/abstractions/devices-usb-read @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Mikhail Morfikov +# Copyright (C) 2021-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + /dev/ r, + /dev/bus/usb/ r, + /dev/bus/usb/@{int}/ r, + /dev/bus/usb/@{int}/@{int} r, + + @{sys}/class/ r, + @{sys}/class/usbmisc/ r, + + @{sys}/bus/ r, + @{sys}/bus/usb/ r, + @{sys}/bus/usb/devices/{,**} r, + + @{sys}/devices/**/usb@{int}/{,**} r, + + # Udev data about usb devices (~equal to content of lsusb -v) + @{run}/udev/data/+usb:* r, + @{run}/udev/data/c16[6,7]:@{int} r, # USB modems + @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/lsusb b/apparmor.d/profiles-g-l/lsusb index b628b3668..40e902a87 100644 --- a/apparmor.d/profiles-g-l/lsusb +++ b/apparmor.d/profiles-g-l/lsusb @@ -11,7 +11,7 @@ include profile lsusb @{exec_path} { include include - include + include capability net_admin, From 802259e99483afc19310e1f220a241c5f507bbe7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:15:22 +0000 Subject: [PATCH 0429/1455] feat(abs): add support for xe intel driver. observation_paranoid is the new perf_stream_paranoid See https://lists.freedesktop.org/archives/igt-dev/2024-July/075082.html fix #601 --- apparmor.d/abstractions/mesa.d/complete | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index 8ac3ad7f3..a19166367 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -26,4 +26,6 @@ owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.db rwk, owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.idx rwk, + @{PROC}/sys/dev/xe/observation_paranoid r, + # vim:syntax=apparmor From b0436029f02fb2a4c8a92be2150cd16e460bf019 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:20:00 +0000 Subject: [PATCH 0430/1455] fix(profile): ensure cpu policy can be set regardless of the CPU. fix #602 --- apparmor.d/groups/freedesktop/cpupower | 9 ++------- apparmor.d/profiles-m-r/power-profiles-daemon | 3 +-- 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/freedesktop/cpupower b/apparmor.d/groups/freedesktop/cpupower index b9811b1a6..2d58faffe 100644 --- a/apparmor.d/groups/freedesktop/cpupower +++ b/apparmor.d/groups/freedesktop/cpupower @@ -28,15 +28,10 @@ profile cpupower @{exec_path} { @{sys}/devices/system/cpu/{cpufreq,cpuidle}/** r, @{sys}/devices/system/cpu/cpu@{int}/{cpufreq,cpuidle}/ r, @{sys}/devices/system/cpu/cpu@{int}/{cpufreq,cpuidle}/** r, - - @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{min,max}_freq rw, - @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw, - @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_setspeed rw, @{sys}/devices/system/cpu/cpu@{int}/cpuidle/state@{int}/disable rw, - - @{sys}/devices/system/cpu/cpu@{int}/topology/{physical_package_id,core_id} r, - @{sys}/devices/system/cpu/cpu@{int}/online r, + @{sys}/devices/system/cpu/cpu@{int}/topology/{physical_package_id,core_id} r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/* rw, /dev/cpu/@{int}/msr r, diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index b39682804..fe4e35724 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -40,8 +40,7 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { @{sys}/devices/system/cpu/*_pstate/status r, @{sys}/devices/system/cpu/cpu@{int}/power/energy_perf_bias rw, @{sys}/devices/system/cpu/cpufreq/ r, - @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw, - @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/* rw, @{sys}/firmware/acpi/platform_profile* rw, @{sys}/firmware/acpi/pm_profile* rw, From d448e3ea087fafe5779089af7733af7541aa8b95 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:23:02 +0000 Subject: [PATCH 0431/1455] fix(profile): ensure keepass can check program calling its secret service. fix #582 --- apparmor.d/profiles-g-l/keepassxc | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index f48113b02..90a65a84b 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -83,12 +83,13 @@ profile keepassxc @{exec_path} { owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer w, owner @{run}/user/@{uid}/org.keepassxc.KeePassXC/ w, - @{PROC}/@{pids}/comm r, - @{PROC}/modules r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - deny @{PROC}/sys/kernel/random/boot_id r, - deny owner @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/stat r, + @{PROC}/modules r, + @{PROC}/sys/kernel/random/boot_id r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, /dev/shm/#@{int} rw, /dev/tty rw, From 0ec65c5653cb35fff71975892e36850386a495a3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:33:51 +0000 Subject: [PATCH 0432/1455] chore: fix trailing whitespace. --- apparmor.d/profiles-g-l/keepassxc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index 90a65a84b..d2dee61aa 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -88,7 +88,7 @@ profile keepassxc @{exec_path} { @{PROC}/modules r, @{PROC}/sys/kernel/random/boot_id r, owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, /dev/shm/#@{int} rw, From 3e0583fd8e1a7ae1bb7e17cdc55763d799c124e4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:46:33 +0000 Subject: [PATCH 0433/1455] feat(profile): various small improvement. --- apparmor.d/groups/browsers/chromium-sandbox | 2 +- apparmor.d/groups/freedesktop/dconf-service | 3 +- apparmor.d/groups/kde/startplasma | 1 - apparmor.d/profiles-m-r/mullvad-setup | 4 ++ apparmor.d/profiles-s-z/thunderbird | 2 +- apparmor.d/profiles-s-z/tlp | 45 +++++++++++---------- apparmor.d/profiles-s-z/transmission | 2 +- 7 files changed, 31 insertions(+), 28 deletions(-) diff --git a/apparmor.d/groups/browsers/chromium-sandbox b/apparmor.d/groups/browsers/chromium-sandbox index 98ebf5b62..f32af44ca 100644 --- a/apparmor.d/groups/browsers/chromium-sandbox +++ b/apparmor.d/groups/browsers/chromium-sandbox @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/chromium/chrome-sandbox -profile chromium-sandbox @{exec_path} { +profile chromium-sandbox @{exec_path} flags=(attach_disconnected) { include capability dac_override, diff --git a/apparmor.d/groups/freedesktop/dconf-service b/apparmor.d/groups/freedesktop/dconf-service index ccebcad74..790f03be3 100644 --- a/apparmor.d/groups/freedesktop/dconf-service +++ b/apparmor.d/groups/freedesktop/dconf-service @@ -10,6 +10,7 @@ include @{exec_path} = @{lib}/{,dconf/}dconf-service profile dconf-service @{exec_path} flags=(attach_disconnected) { include + include include include @@ -38,8 +39,6 @@ profile dconf-service @{exec_path} flags=(attach_disconnected) { @{PROC}/cmdline r, - /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index f10e80d7f..773122f57 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -37,7 +37,6 @@ profile startplasma @{exec_path} { /usr/share/kservicetypes5/{,**} r, /usr/share/plasma/{,**} r, - /etc/locale.alias r, /etc/machine-id r, /etc/xdg/menus/{,**} r, /etc/xdg/plasma-workspace/env/{,*} r, diff --git a/apparmor.d/profiles-m-r/mullvad-setup b/apparmor.d/profiles-m-r/mullvad-setup index 77ac07045..b30da1c13 100644 --- a/apparmor.d/profiles-m-r/mullvad-setup +++ b/apparmor.d/profiles-m-r/mullvad-setup @@ -13,6 +13,10 @@ profile mullvad-setup @{exec_path} { @{exec_path} mr, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index 997b81fb5..9a50dafa0 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -54,7 +54,7 @@ profile thunderbird @{exec_path} { owner @{tmp}/MozillaMailnews/*.msf rw, owner @{tmp}/nscopy.tmp rw, owner @{tmp}/nsemail{,-@{int}}.eml rw, - owner @{tmp}/nsma rw, + owner @{tmp}/nsma{,-@{int}} rw, owner @{tmp}/pid-@{pid}/{,**} w, /dev/urandom w, diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index af5f67061..0378e62fc 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -29,27 +29,27 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/systemctl rCx -> systemctl, - @{bin}/logger rix, @{sh_path} rix, - @{bin}/cp rix, - @{bin}/chmod rix, - @{bin}/flock rix, - @{bin}/sort rix, - @{bin}/head rix, - @{bin}/mktemp rix, - @{bin}/readlink rix, - @{bin}/tr rix, - @{bin}/ethtool rix, - @{bin}/grep rix, - @{bin}/touch rix, @{bin}/cat rix, - @{bin}/rm rix, + @{bin}/chmod rix, + @{bin}/cp rix, + @{bin}/ethtool rix, + @{bin}/flock rix, + @{bin}/grep rix, + @{bin}/hdparm rPx, + @{bin}/head rix, @{bin}/id rPx, @{bin}/iw rPx, - @{bin}/hdparm rPx, + @{bin}/logger rix, + @{bin}/mktemp rix, + @{bin}/readlink rix, + @{bin}/rm rix, + @{bin}/sort rix, + @{bin}/systemctl rCx -> systemctl, + @{bin}/touch rix, + @{bin}/tr rix, + @{bin}/udevadm rCx -> udevadm, @{bin}/uname rpx, - @{bin}/udevadm rCx -> udevadm, /usr/share/tlp/tlp-readconfs rix, / r, @@ -58,14 +58,16 @@ profile tlp @{exec_path} flags=(attach_disconnected) { /etc/tlp.d/** rw, /etc/tlp.conf rw, - /usr/share/tlp/** r, + /usr/share/tlp/{,**} r, + /var/lib/tlp/{,**} rw, /var/lib/power-profiles-daemon/state.ini rw, - @{run}/udev/data/+platform:* r, - owner @{run}/tlp/* rw, + owner @{run}/tlp/{,**} rw, owner @{run}/tlp/lock_tlp rwk, + @{run}/udev/data/+platform:* r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw, @{sys}/module/pcie_aspm/parameters/policy rw, @{sys}/module/snd_hda_intel/parameters/power_save rw, @@ -73,11 +75,10 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{sys}/firmware/acpi/platform_profile* rw, @{sys}/firmware/acpi/pm_profile* rw, - owner @{PROC}/sys/vm/laptop_mode rw, - owner @{PROC}/sys/vm/dirty_writeback_centisecs rw, - owner @{PROC}/sys/vm/dirty_expire_centisecs rw, owner @{PROC}/sys/fs/xfs/xfssyncd_centisecs rw, owner @{PROC}/sys/kernel/nmi_watchdog rw, + owner @{PROC}/sys/vm/dirty_*_centisecs rw, + owner @{PROC}/sys/vm/laptop_mode rw, /dev/disk/by-id/ r, /dev/tty rw, diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission index a6ccb7e2d..2a39981df 100644 --- a/apparmor.d/profiles-s-z/transmission +++ b/apparmor.d/profiles-s-z/transmission @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/transmission-{gtk,qt} -profile transmission @{exec_path} { +profile transmission @{exec_path} flags=(attach_disconnected) { include include include From 4d11367bec96dc012cc333e0264b59625e0bcfbb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Nov 2024 19:55:21 +0000 Subject: [PATCH 0434/1455] feat(profile): ensure flatpak can run programs in games dir. fix #586 --- apparmor.d/abstractions/common/app | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 4cb47c9d2..f2201bd64 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -61,7 +61,7 @@ owner @{HOME}/** rwlk -> @{HOME}/**, owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, - owner @{user_games_dirs}/** rm, + owner @{user_games_dirs}/** rmix, owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, owner @{tmp}/** rmwk, From 72d45c2cf510061b23f8060899443a3a6d549bee Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Nov 2024 20:47:07 +0000 Subject: [PATCH 0435/1455] feat(tunable): better definition of the version var. --- apparmor.d/tunables/multiarch.d/system | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 0a95d1837..0dc816899 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -130,7 +130,7 @@ @{group}=@{user} # Semantic version -@{version}=@{int}{.@{int},}{.@{int},}{-@{rand},} +@{version}=@{u16}{.@{u16},}{.@{u16},}{{-,_}@{rand},} # OpenSUSE does not have the same multiarch structure @{multiarch}+=*-suse-linux* #aa:only opensuse From 0206e04b3fd6802cf6e3565d35aa6afe25a0ce7d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Nov 2024 21:18:16 +0000 Subject: [PATCH 0436/1455] build: ensure build task get the proper profile name. --- pkg/prebuild/builder/core.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/builder/core.go b/pkg/prebuild/builder/core.go index b45075e15..93b73d76c 100644 --- a/pkg/prebuild/builder/core.go +++ b/pkg/prebuild/builder/core.go @@ -6,6 +6,7 @@ package builder import ( "fmt" + "strings" "github.com/roddhjav/apparmor.d/pkg/paths" "github.com/roddhjav/apparmor.d/pkg/prebuild" @@ -33,7 +34,7 @@ type Option struct { func NewOption(file *paths.Path) *Option { return &Option{ - Name: file.Base(), + Name: strings.TrimSuffix(file.Base(), ".apparmor.d"), File: file, } } From 9a3adc66d00bf41aba532b7c8c7327f36fe087e7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Nov 2024 22:18:39 +0000 Subject: [PATCH 0437/1455] feat(profile): small profile update. --- apparmor.d/abstractions/app/chromium | 2 +- apparmor.d/groups/freedesktop/xdg-document-portal | 1 + apparmor.d/groups/gnome/loupe | 6 +++++- apparmor.d/profiles-a-f/cctk | 1 + apparmor.d/profiles-g-l/libreoffice | 1 + apparmor.d/profiles-s-z/scrcpy | 1 - 6 files changed, 9 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 0bae4e0d2..666387d0a 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -186,6 +186,7 @@ @{PROC}/ r, @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/statm r, @{PROC}/@{pid}/task/@{tid}/status r, @{PROC}/pressure/{memory,cpu,io} r, @{PROC}/sys/fs/inotify/max_user_watches r, @@ -201,7 +202,6 @@ owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_{,score_}adj rw, owner @{PROC}/@{pid}/setgroups w, - owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat r, diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index 75ec9517c..3c60c1cf6 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -41,6 +41,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { @{bin}/flatpak rPUx, @{bin}/fusermount{,3} rCx -> fusermount, + / r, owner @{att}/ r, owner @{att}/.flatpak-info r, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index fb7bef34a..10853ea8f 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -30,6 +30,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) { / r, + owner @{user_cache_dirs}/glycin/{,**} rw, + @{run}/mount/utab r, @{sys}/fs/cgroup/user.slice/cpu.max r, @@ -51,7 +53,9 @@ profile loupe @{exec_path} flags=(attach_disconnected) { signal (receive) set=(kill) peer=loupe, @{bin}/bwrap mr, - @{lib}/glycin-loaders/*/glycin-image-rs rix, + @{lib}/glycin-loaders/*/glycin-* rix, + + owner @{PROC}/@{pid}/fd/ r, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/profiles-a-f/cctk b/apparmor.d/profiles-a-f/cctk index 40c5199b3..af7436f39 100644 --- a/apparmor.d/profiles-a-f/cctk +++ b/apparmor.d/profiles-a-f/cctk @@ -11,6 +11,7 @@ profile cctk @{exec_path} { include include + capability dac_read_search, capability mknod, capability sys_admin, capability sys_rawio, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 6e1a2d07a..63634d788 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -84,6 +84,7 @@ profile libreoffice @{exec_path} { owner @{tmp}/ r, owner @{tmp}/.java_pid@{int}{,.tmp} rw, + owner @{tmp}/@{hex} rw, owner @{tmp}/@{rand6} rwk, owner @{tmp}/@{u64} rw, owner @{tmp}/*.tmp/{,**} rwk, diff --git a/apparmor.d/profiles-s-z/scrcpy b/apparmor.d/profiles-s-z/scrcpy index 3d33e8a3e..83af575dd 100644 --- a/apparmor.d/profiles-s-z/scrcpy +++ b/apparmor.d/profiles-s-z/scrcpy @@ -25,7 +25,6 @@ profile scrcpy @{exec_path} { @{bin}/adb rPx, /usr/share/scrcpy/{,*} r, - /usr/share/icons/{,**} r, /etc/machine-id r, From ebd6d5473348419c287df45d087b80174b7dd00b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 20:36:18 +0000 Subject: [PATCH 0438/1455] feat(profile): update systemd profiles. --- apparmor.d/groups/systemd/hostnamectl | 2 ++ apparmor.d/groups/systemd/systemd-cgls | 1 + apparmor.d/groups/systemd/systemd-logind | 3 ++- apparmor.d/groups/systemd/systemd-modules-load | 1 + apparmor.d/groups/systemd/systemd-oomd | 3 ++- apparmor.d/groups/systemd/systemd-timesyncd | 3 ++- apparmor.d/groups/systemd/systemd-udevd | 1 + 7 files changed, 11 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/systemd/hostnamectl b/apparmor.d/groups/systemd/hostnamectl index 65e6ed11f..91fc31b51 100644 --- a/apparmor.d/groups/systemd/hostnamectl +++ b/apparmor.d/groups/systemd/hostnamectl @@ -14,6 +14,8 @@ profile hostnamectl @{exec_path} { capability net_admin, + unix bind type=stream addr=@@{hex16}/bus/hostnamectl/system, + #aa:dbus talk bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-cgls b/apparmor.d/groups/systemd/systemd-cgls index e74280f67..b25f861b5 100644 --- a/apparmor.d/groups/systemd/systemd-cgls +++ b/apparmor.d/groups/systemd/systemd-cgls @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/systemd-cgls profile systemd-cgls @{exec_path} { include + include capability sys_ptrace, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 53dd0acf8..206c09571 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -94,10 +94,11 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c226:@{int} r, # For /dev/dri/card* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{att}/@{run}/systemd/notify w, + @{run}/systemd/inhibit/ rw, @{run}/systemd/inhibit/.#* rw, @{run}/systemd/inhibit/@{int}{,.ref} rw, - @{run}/systemd/notify rw, @{run}/systemd/seats/ rw, @{run}/systemd/seats/.#seat* rw, @{run}/systemd/seats/seat@{int} rw, diff --git a/apparmor.d/groups/systemd/systemd-modules-load b/apparmor.d/groups/systemd/systemd-modules-load index abb437f83..d3527c22b 100644 --- a/apparmor.d/groups/systemd/systemd-modules-load +++ b/apparmor.d/groups/systemd/systemd-modules-load @@ -13,6 +13,7 @@ profile systemd-modules-load @{exec_path} { include capability net_admin, + capability perfmon, capability sys_module, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-oomd b/apparmor.d/groups/systemd/systemd-oomd index e5dce916c..469f72b03 100644 --- a/apparmor.d/groups/systemd/systemd-oomd +++ b/apparmor.d/groups/systemd/systemd-oomd @@ -24,9 +24,10 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) { /etc/systemd/oomd.conf r, /etc/systemd/oomd.conf.d/{,**} r, + @{att}/@{run}/systemd/notify w, + @{run}/systemd/io.system.ManagedOOM rw, @{run}/systemd/io.systemd.ManagedOOM rw, - @{run}/systemd/notify rw, @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/memory.* r, diff --git a/apparmor.d/groups/systemd/systemd-timesyncd b/apparmor.d/groups/systemd/systemd-timesyncd index de544c9d7..9f9136bca 100644 --- a/apparmor.d/groups/systemd/systemd-timesyncd +++ b/apparmor.d/groups/systemd/systemd-timesyncd @@ -34,9 +34,10 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) { owner /var/lib/systemd/timesync/clock rw, + @{att}/@{run}/systemd/notify rw, + @{run}/resolvconf/*.conf r, @{run}/systemd/netif/state r, - @{run}/systemd/notify rw, @{run}/systemd/timesyncd.conf.d/{,**} r, owner @{run}/systemd/timesync/synchronized rw, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index dae5ae67e..b8a0c7e4c 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -21,6 +21,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { capability fsetid, capability mknod, capability net_admin, + capability perfmon, capability sys_admin, capability sys_module, capability sys_ptrace, From cf2998b7bdd2bbfb2034161e74c1e802aa4b0de4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 20:37:28 +0000 Subject: [PATCH 0439/1455] feat(abs): cover more commonly attached path. --- apparmor.d/abstractions/attached/base | 2 ++ apparmor.d/abstractions/base.d/complete | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index 33c422bb0..1f37de00d 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -7,6 +7,8 @@ abi , + @{att}/@{run}/systemd/journal/socket w, + deny @{att}/apparmor/.null rw, include if exists diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index 3e10a94f5..3b5ecaf41 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -33,6 +33,4 @@ @{PROC}/sys/kernel/core_pattern r, - deny /apparmor/.null rw, - # vim:syntax=apparmor From 4108d6a987fac8f85ec3c1886c31ba1dbfab77a8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 20:42:31 +0000 Subject: [PATCH 0440/1455] feat(profile): update some core profiles. --- apparmor.d/groups/freedesktop/polkitd | 2 ++ apparmor.d/groups/freedesktop/upower | 2 ++ apparmor.d/groups/freedesktop/xdg-permission-store | 1 + apparmor.d/groups/network/netplan.script | 2 ++ apparmor.d/groups/ubuntu/apport | 8 +++++--- apparmor.d/groups/virt/containerd | 11 +++++++---- apparmor.d/profiles-a-f/chsh | 1 + apparmor.d/profiles-s-z/snap | 5 +++++ apparmor.d/profiles-s-z/snap-update-ns | 6 ++++++ apparmor.d/profiles-s-z/snapd-apparmor | 1 + apparmor.d/profiles-s-z/uuidd | 1 + 11 files changed, 33 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/freedesktop/polkitd b/apparmor.d/groups/freedesktop/polkitd index 089e61744..a8df0261c 100644 --- a/apparmor.d/groups/freedesktop/polkitd +++ b/apparmor.d/groups/freedesktop/polkitd @@ -53,6 +53,8 @@ profile polkitd @{exec_path} flags=(attach_disconnected) { /var/lib/polkit{,-1}/localauthority/{,**} r, owner /var/lib/polkit{,-1}/.cache/ rw, + @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw, + @{run}/systemd/sessions/* r, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/groups/freedesktop/upower b/apparmor.d/groups/freedesktop/upower index 1cb7c9583..2aeb4ee88 100644 --- a/apparmor.d/groups/freedesktop/upower +++ b/apparmor.d/groups/freedesktop/upower @@ -10,6 +10,8 @@ include @{exec_path} = @{bin}/upower profile upower @{exec_path} { include + include + include # Needed? audit capability sys_nice, diff --git a/apparmor.d/groups/freedesktop/xdg-permission-store b/apparmor.d/groups/freedesktop/xdg-permission-store index 441692ded..08cfc840c 100644 --- a/apparmor.d/groups/freedesktop/xdg-permission-store +++ b/apparmor.d/groups/freedesktop/xdg-permission-store @@ -43,6 +43,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/flatpak/db/ rw, owner @{user_share_dirs}/flatpak/db/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/flatpak/db/background rw, + owner @{user_share_dirs}/flatpak/db/desktop-used-apps r, owner @{user_share_dirs}/flatpak/db/devices rw, owner @{user_share_dirs}/flatpak/db/documents rw, owner @{user_share_dirs}/flatpak/db/notifications rw, diff --git a/apparmor.d/groups/network/netplan.script b/apparmor.d/groups/network/netplan.script index 53297493e..65d644e7b 100644 --- a/apparmor.d/groups/network/netplan.script +++ b/apparmor.d/groups/network/netplan.script @@ -49,6 +49,8 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) { capability net_admin, + @{att}/@{run}/systemd/private rw, + include if exists } diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index cd0187119..11aad0da3 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -22,9 +22,7 @@ profile apport @{exec_path} flags=(attach_disconnected) { capability setuid, capability sys_ptrace, - ptrace (read) peer=gnome-shell, - ptrace (read) peer=snap.cups.cupsd, - ptrace (read) peer=tracker-extract, + ptrace read, @{exec_path} mr, @@ -36,6 +34,10 @@ profile apport @{exec_path} flags=(attach_disconnected) { /usr/share/apport/{,**} r, /etc/apport/report-ignore/{,**} r, + /etc/login.defs r, + + /var/lib/dpkg/info/ r, + /var/lib/dpkg/info/*.list r, /var/crash/ rw, /var/crash/*.@{uid}.crash rw, diff --git a/apparmor.d/groups/virt/containerd b/apparmor.d/groups/virt/containerd index 627515640..4f73ff985 100644 --- a/apparmor.d/groups/virt/containerd +++ b/apparmor.d/groups/virt/containerd @@ -83,6 +83,8 @@ profile containerd @{exec_path} flags=(attach_disconnected) { @{run}/docker/containerd/{,**} rwk, @{run}/netns/ w, @{run}/netns/cni-@{uuid} rw, + @{run}/nri/ w, + @{run}/nri/nri.sock rw, @{run}/systemd/notify w, /tmp/cri-containerd.apparmor.d@{int} rwl, @@ -94,12 +96,13 @@ profile containerd @{exec_path} flags=(attach_disconnected) { @{sys}/kernel/security/apparmor/profiles r, @{sys}/module/apparmor/parameters/enabled r, + @{PROC}/@{pid}/task/@{tid}/mountinfo r, @{PROC}/@{pid}/task/@{tid}/ns/net rw, @{PROC}/sys/net/core/somaxconn r, - owner @{PROC}/@{pids}/attr/current r, - owner @{PROC}/@{pids}/cgroup r, - owner @{PROC}/@{pids}/mountinfo r, - owner @{PROC}/@{pids}/uid_map r, + owner @{PROC}/@{pid}/attr/current r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/uid_map r, /dev/bsg/ r, /dev/bus/ r, diff --git a/apparmor.d/profiles-a-f/chsh b/apparmor.d/profiles-a-f/chsh index f73ae6709..f8a2af5c4 100644 --- a/apparmor.d/profiles-a-f/chsh +++ b/apparmor.d/profiles-a-f/chsh @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/chsh profile chsh @{exec_path} { include + include include include include diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/profiles-s-z/snap index 912ab1a8b..a86304000 100644 --- a/apparmor.d/profiles-s-z/snap +++ b/apparmor.d/profiles-s-z/snap @@ -29,6 +29,7 @@ profile snap @{exec_path} { mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-@{int}/, #aa:dbus own bus=session name=io.snapcraft.Launcher + #aa:dbus own bus=session name=io.snapcraft.SessionAgent #aa:dbus own bus=session name=io.snapcraft.Settings #aa:dbus talk bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}" @@ -45,6 +46,7 @@ profile snap @{exec_path} { @{bin}/gpg{,2} rCx -> gpg, @{bin}/systemctl rCx -> systemctl, + @{lib_dirs}/** mr, @{lib_dirs}/snapd/snap-confine rPx, @{lib_dirs}/snapd/snap-seccomp rPx, @{lib_dirs}/snapd/snapd rPx, @@ -108,6 +110,9 @@ profile snap @{exec_path} { network unix stream, + owner @{run}/user/@{uid}/systemd/notify rw, + owner @{run}/user/@{uid}/systemd/private rw, + include if exists } diff --git a/apparmor.d/profiles-s-z/snap-update-ns b/apparmor.d/profiles-s-z/snap-update-ns index 3021a1ad7..345c089e3 100644 --- a/apparmor.d/profiles-s-z/snap-update-ns +++ b/apparmor.d/profiles-s-z/snap-update-ns @@ -23,11 +23,17 @@ profile snap-update-ns @{exec_path} { mount -> /tmp/.snap/**, mount -> /usr/**, mount -> /var/lib/dhcp/, + umount /snap/**, umount /var/lib/dhcp/, + umount @{lib}/@{multiarch}/webkit2gtk-@{version}/, + umount /usr/share/xml/iso-codes/, @{exec_path} mr, + @{lib}/@{multiarch}/webkit2gtk-@{version}/ w, + /usr/share/xml/iso-codes/ w, + /var/lib/snapd/mount/{,*} r, / r, diff --git a/apparmor.d/profiles-s-z/snapd-apparmor b/apparmor.d/profiles-s-z/snapd-apparmor index e7a3b4946..6d873982b 100644 --- a/apparmor.d/profiles-s-z/snapd-apparmor +++ b/apparmor.d/profiles-s-z/snapd-apparmor @@ -17,6 +17,7 @@ profile snapd-apparmor @{exec_path} { @{bin}/systemd-detect-virt rPx, @{bin}/apparmor_parser rPx, + @{lib_dirs}/** mr, @{lib_dirs}/snapd/apparmor_parser rPx -> apparmor_parser, @{lib_dirs}/snapd/info r, diff --git a/apparmor.d/profiles-s-z/uuidd b/apparmor.d/profiles-s-z/uuidd index 56b89fa2a..c1e14d013 100644 --- a/apparmor.d/profiles-s-z/uuidd +++ b/apparmor.d/profiles-s-z/uuidd @@ -17,6 +17,7 @@ profile uuidd @{exec_path} flags=(attach_disconnected) { owner /var/lib/libuuid/clock.txt rwk, + @{run}/uuidd/request w, @{att}/@{run}/uuidd/request w, include if exists From c741f7432357809f0393bce647f16654240f570b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 20:43:52 +0000 Subject: [PATCH 0441/1455] feat(profile): fractal uses bwrap for loading image. --- apparmor.d/profiles-a-f/fractal | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 7f14df0e0..6dfb84452 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -21,10 +21,14 @@ profile fractal @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, + signal send set=kill peer=fractal//bwrap, + @{exec_path} mr, @{open_path} rPx -> child-open-help, + @{bin}/bwrap rCx -> bwrap, + /usr/share/glycin-loaders/{,**} r, /usr/share/xml/iso-codes/{,**} r, owner @{tmp}/.@{rand6} rw, @@ -37,6 +41,22 @@ profile fractal @{exec_path} flags=(attach_disconnected) { /dev/ r, + profile bwrap flags=(attach_disconnected) { + include + include + + signal receive set=kill peer=fractal, + + @{bin}/bwrap mr, + @{lib}/glycin-loaders/*/glycin-* rix, + + owner @{PROC}/@{pid}/fd/ r, + + deny @{user_share_dirs}/gvfs-metadata/* r, + + include if exists + } + include if exists } From 5611001e5b4744ee5981afcccb88a12a7c58d755 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 21:42:31 +0000 Subject: [PATCH 0442/1455] tests: add more integration tests for core tools. --- tests/bats/chsh.bats | 2 +- tests/bats/common.bash | 5 ++- tests/bats/cpuid.bats | 28 +++++++++++++++ tests/bats/df.bats | 6 ++++ tests/bats/dfc.bats | 34 +++++++++++++++++++ tests/bats/homectl.bats | 58 ++++++++++++++++++++++++++++++++ tests/bats/hostnamectl.bats | 27 +++++++++++++++ tests/bats/ip.bats | 18 ++++++---- tests/bats/sync.bats | 22 ++++++++++++ tests/bats/systemd-ac-power.bats | 23 +++++++++++++ tests/bats/systemd-analyze.bats | 29 ++++++++++++++++ tests/bats/systemd-cat.bats | 22 ++++++++++++ tests/bats/systemd-cgls.bats | 29 ++++++++++++++++ tests/bats/systemd-id128.bats | 41 ++++++++++++++++++++++ tests/bats/systemd-sysusers.bats | 28 +++++++++++++++ tests/bats/upower.bats | 29 ++++++++++++++++ tests/bats/userdbctl.bats | 41 ++++++++++++++++++++++ tests/bats/uuidd.bats | 29 ++++++++++++++++ tests/bats/w.bats | 22 ++++++++++++ 19 files changed, 484 insertions(+), 9 deletions(-) create mode 100644 tests/bats/cpuid.bats create mode 100644 tests/bats/dfc.bats create mode 100644 tests/bats/homectl.bats create mode 100644 tests/bats/hostnamectl.bats create mode 100644 tests/bats/sync.bats create mode 100644 tests/bats/systemd-ac-power.bats create mode 100644 tests/bats/systemd-analyze.bats create mode 100644 tests/bats/systemd-cat.bats create mode 100644 tests/bats/systemd-cgls.bats create mode 100644 tests/bats/systemd-id128.bats create mode 100644 tests/bats/systemd-sysusers.bats create mode 100644 tests/bats/upower.bats create mode 100644 tests/bats/userdbctl.bats create mode 100644 tests/bats/uuidd.bats create mode 100644 tests/bats/w.bats diff --git a/tests/bats/chsh.bats b/tests/bats/chsh.bats index 5365fea60..f66eb1f97 100644 --- a/tests/bats/chsh.bats +++ b/tests/bats/chsh.bats @@ -17,7 +17,7 @@ setup_file() { # bats test_tags=chsh @test "chsh: Set a specific login [s]hell for the current user" { - chsh --shell /usr/bin/bash + echo "$PASSWORD" | chsh --shell /usr/bin/bash aa_check } diff --git a/tests/bats/common.bash b/tests/bats/common.bash index c08d13758..f99c3c197 100644 --- a/tests/bats/common.bash +++ b/tests/bats/common.bash @@ -6,6 +6,9 @@ export BATS_LIB_PATH=${BATS_LIB_PATH:-/usr/lib/bats} load "$BATS_LIB_PATH/bats-support/load" +# User password for sudo commands +export PASSWORD=${PASSWORD:-user} + export XDG_CACHE_DIR=".cache" export XDG_CONFIG_DIR=".config" export XDG_DATA_DIR=".local/share" @@ -100,7 +103,7 @@ aa_check() { local now duration logs now=$(date +%s) - duration=$((now - _START + 2)) + duration=$((now - _START + 1)) logs=$(aa-log --raw --systemd --since "-${duration}s") if [[ -n "$logs" ]]; then fail "profile $PROGRAM raised logs: $logs" diff --git a/tests/bats/cpuid.bats b/tests/bats/cpuid.bats new file mode 100644 index 000000000..1b1226e2b --- /dev/null +++ b/tests/bats/cpuid.bats @@ -0,0 +1,28 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=cpuid +@test "cpuid: Display information for all CPUs" { + cpuid + aa_check +} + +# bats test_tags=cpuid +@test "cpuid: Display information only for the current CPU" { + cpuid -1 + aa_check +} + +# bats test_tags=cpuid +@test "cpuid: Display raw hex information with no decoding" { + cpuid -r + aa_check +} diff --git a/tests/bats/df.bats b/tests/bats/df.bats index be2843213..ea9d3f44f 100644 --- a/tests/bats/df.bats +++ b/tests/bats/df.bats @@ -21,6 +21,12 @@ setup_file() { aa_check } +# bats test_tags=df +@test "df: Display the filesystem and its disk usage containing the given file or directory" { + df apparmor.d/ + aa_check +} + # bats test_tags=df @test "df: Include statistics on the number of free inodes" { df --inodes diff --git a/tests/bats/dfc.bats b/tests/bats/dfc.bats new file mode 100644 index 000000000..8a1d18918 --- /dev/null +++ b/tests/bats/dfc.bats @@ -0,0 +1,34 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=dfc +@test "dfc: Display filesystems and their disk usage in human-readable form with colors and graphs" { + dfc + aa_check +} + +# bats test_tags=dfc +@test "dfc: Display all filesystems including pseudo, duplicate and inaccessible filesystems" { + dfc -a + aa_check +} + +# bats test_tags=dfc +@test "dfc: Display filesystems without color" { + dfc -c never + aa_check +} + +# bats test_tags=dfc +@test "dfc: Display filesystems containing "ext" in the filesystem type" { + dfc -t ext + aa_check +} diff --git a/tests/bats/homectl.bats b/tests/bats/homectl.bats new file mode 100644 index 000000000..2fee79079 --- /dev/null +++ b/tests/bats/homectl.bats @@ -0,0 +1,58 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=homectl +@test "homectl: Display help" { + homectl --no-pager --help + aa_check +} + +# bats test_tags=homectl +@test "homectl: Create a user account and their associated home directory" { + sudo homectl create user2 + aa_check +} + +# bats test_tags=homectl +@test "homectl: List user accounts and their associated home directories" { + homectl list + aa_check +} + +# bats test_tags=homectl +@test "homectl: Change the password for a specific user" { + sudo homectl passwd user2 + aa_check +} + +# bats test_tags=homectl +@test "homectl: Run a shell or a command with access to a specific home directory" { + sudo homectl with user2 -- ls -al /home/user2 + aa_check +} + +# bats test_tags=homectl +@test "homectl: Lock or unlock a specific home directory" { + sudo homectl lock user2 + aa_check +} + +# bats test_tags=homectl +@test "homectl: Change the disk space assigned to a specific home directory to 100 GiB" { + sudo homectl resize user2 1G + aa_check +} + +# bats test_tags=homectl +@test "homectl: Remove a specific user and the associated home directory" { + sudo homectl remove user2 + aa_check +} diff --git a/tests/bats/hostnamectl.bats b/tests/bats/hostnamectl.bats new file mode 100644 index 000000000..dd4102575 --- /dev/null +++ b/tests/bats/hostnamectl.bats @@ -0,0 +1,27 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup() { + aa_setup +} + +# bats test_tags=hostnamectl +@test "hostnamectl: Get the hostname of the computer" { + hostnamectl +} + +# bats test_tags=hostnamectl +@test "hostnamectl: Get the location of the computer" { + hostnamectl location +} + +# bats test_tags=hostnamectl +@test "hostnamectl: Set the hostname of the computer" { + name=$(hostnamectl hostname) + sudo hostnamectl set-hostname "new" + sudo hostnamectl set-hostname "$name" +} diff --git a/tests/bats/ip.bats b/tests/bats/ip.bats index 980495d2d..47f16ccde 100644 --- a/tests/bats/ip.bats +++ b/tests/bats/ip.bats @@ -15,15 +15,9 @@ setup_file() { aa_check } -# bats test_tags=ip -@test "ip: List interfaces with brief network layer info" { - ip -brief address - aa_check -} - # bats test_tags=ip @test "ip: List interfaces with brief link layer info" { - ip -brief link + ip link aa_check } @@ -39,3 +33,13 @@ setup_file() { aa_check } +# bats test_tags=ip +@test "ip: Manage network namespace" { + sudo ip netns add foo + sudo ip netns list + sudo ip netns exec foo bash -c "pwd" + sudo ip netns delete foo + aa_check +} + + diff --git a/tests/bats/sync.bats b/tests/bats/sync.bats new file mode 100644 index 000000000..fba657ff7 --- /dev/null +++ b/tests/bats/sync.bats @@ -0,0 +1,22 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=sync +@test "sync: Flush all pending write operations on all disks" { + sync + aa_check +} + +# bats test_tags=sync +@test "sync: Flush all pending write operations on a single file to disk" { + sudo sync / + aa_check +} diff --git a/tests/bats/systemd-ac-power.bats b/tests/bats/systemd-ac-power.bats new file mode 100644 index 000000000..78f68d13a --- /dev/null +++ b/tests/bats/systemd-ac-power.bats @@ -0,0 +1,23 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=systemd-ac-power +@test "systemd-ac-power: Report whether we are connected to an external power source." { + systemd-ac-power || true + aa_check +} + +# bats test_tags=systemd-ac-power +@test "systemd-ac-power: Check if battery is discharging and low" { + systemd-ac-power --low || true + aa_check +} + diff --git a/tests/bats/systemd-analyze.bats b/tests/bats/systemd-analyze.bats new file mode 100644 index 000000000..3f6144a78 --- /dev/null +++ b/tests/bats/systemd-analyze.bats @@ -0,0 +1,29 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=systemd-analyze +@test "systemd-analyze: List all running units, ordered by the time they took to initialize" { + systemd-analyze --no-pager blame + aa_check +} + +# bats test_tags=systemd-analyze +@test "systemd-analyze: Print a tree of the time-critical chain of units" { + systemd-analyze --no-pager critical-chain + aa_check +} + +# bats test_tags=systemd-analyze +@test "systemd-analyze: Show security scores of running units" { + systemd-analyze --no-pager security + aa_check +} + diff --git a/tests/bats/systemd-cat.bats b/tests/bats/systemd-cat.bats new file mode 100644 index 000000000..595a6002d --- /dev/null +++ b/tests/bats/systemd-cat.bats @@ -0,0 +1,22 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=systemd-cat +@test "systemd-cat: Write the output of the specified command to the journal (both output streams are captured)" { + systemd-cat pwd + aa_check +} + +# bats test_tags=systemd-cat +@test "systemd-cat: Write the output of a pipeline to the journal (`stderr` stays connected to the terminal)" { + echo apparmor.d-test-suite | systemd-cat + aa_check +} diff --git a/tests/bats/systemd-cgls.bats b/tests/bats/systemd-cgls.bats new file mode 100644 index 000000000..b5bb89de6 --- /dev/null +++ b/tests/bats/systemd-cgls.bats @@ -0,0 +1,29 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=systemd-cgls +@test "systemd-cgls: Display the whole control group hierarchy on your system" { + systemd-cgls --no-pager + aa_check +} + +# bats test_tags=systemd-cgls +@test "systemd-cgls: Display a control group tree of a specific resource controller" { + systemd-cgls --no-pager io + aa_check +} + +# bats test_tags=systemd-cgls +@test "systemd-cgls: Display the control group hierarchy of one or more systemd units" { + systemd-cgls --no-pager --unit systemd-logind + aa_check +} + diff --git a/tests/bats/systemd-id128.bats b/tests/bats/systemd-id128.bats new file mode 100644 index 000000000..3b18bd032 --- /dev/null +++ b/tests/bats/systemd-id128.bats @@ -0,0 +1,41 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=systemd-id128 +@test "systemd-id128: Generate a new random identifier" { + systemd-id128 new + aa_check +} + +# bats test_tags=systemd-id128 +@test "systemd-id128: Print the identifier of the current machine" { + systemd-id128 machine-id + aa_check +} + +# bats test_tags=systemd-id128 +@test "systemd-id128: Print the identifier of the current boot" { + systemd-id128 boot-id + aa_check +} + +# bats test_tags=systemd-id128 +@test "systemd-id128: Print the identifier of the current service invocation (this is available in systemd services)" { + systemd-id128 invocation-id + aa_check +} + +# bats test_tags=systemd-id128 +@test "systemd-id128: Generate a new random identifier and print it as a UUID (five groups of digits separated by hyphens)" { + systemd-id128 new --uuid + aa_check +} + diff --git a/tests/bats/systemd-sysusers.bats b/tests/bats/systemd-sysusers.bats new file mode 100644 index 000000000..f4230d6b6 --- /dev/null +++ b/tests/bats/systemd-sysusers.bats @@ -0,0 +1,28 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=systemd-sysusers +@test "systemd-sysusers: Print the contents of all configuration files (before each file, its name is printed as a comment)" { + systemd-sysusers --cat-config + aa_check +} + +# bats test_tags=systemd-sysusers +@test "systemd-sysusers: Process configuration files and print what would be done without actually doing anything" { + systemd-sysusers --dry-run + aa_check +} + +# bats test_tags=systemd-sysusers +@test "systemd-sysusers: Create users and groups from all configuration file" { + sudo systemd-sysusers + aa_check +} diff --git a/tests/bats/upower.bats b/tests/bats/upower.bats new file mode 100644 index 000000000..73afc18e6 --- /dev/null +++ b/tests/bats/upower.bats @@ -0,0 +1,29 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=upower +@test "upower: Display power and battery information" { + upower --dump + aa_check +} + +# bats test_tags=upower +@test "upower: List all power devices" { + upower --enumerate + aa_check +} + +# bats test_tags=upower +@test "upower: Display version" { + upower --version + aa_check +} + diff --git a/tests/bats/userdbctl.bats b/tests/bats/userdbctl.bats new file mode 100644 index 000000000..6169de44b --- /dev/null +++ b/tests/bats/userdbctl.bats @@ -0,0 +1,41 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=userdbctl +@test "userdbctl: List all known user records" { + userdbctl --no-pager user + aa_check +} + +# bats test_tags=userdbctl +@test "userdbctl: Show details of a specific user" { + userdbctl --no-pager user "$USER" + aa_check +} + +# bats test_tags=userdbctl +@test "userdbctl: List all known groups" { + userdbctl --no-pager group + aa_check +} + +# bats test_tags=userdbctl +@test "userdbctl: Show details of a specific group" { + sudo userdbctl --no-pager group "$USER" + aa_check +} + +# bats test_tags=userdbctl +@test "userdbctl: List all services currently providing user/group definitions to the system" { + userdbctl --no-pager services + aa_check +} + diff --git a/tests/bats/uuidd.bats b/tests/bats/uuidd.bats new file mode 100644 index 000000000..e13653e3e --- /dev/null +++ b/tests/bats/uuidd.bats @@ -0,0 +1,29 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=uuidd +@test "uuidd: Generate a random UUID" { + uuidd --random + aa_check +} + +# bats test_tags=uuidd +@test "uuidd: Generate a bulk number of random UUIDs" { + uuidd --random --uuids 10 + aa_check +} + +# bats test_tags=uuidd +@test "uuidd: Generate a time-based UUID, based on the current time and MAC address of the system" { + uuidd --time + aa_check +} + diff --git a/tests/bats/w.bats b/tests/bats/w.bats new file mode 100644 index 000000000..7f358aac7 --- /dev/null +++ b/tests/bats/w.bats @@ -0,0 +1,22 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +setup_file() { + aa_setup +} + +# bats test_tags=w +@test "w: Display information about all users who are currently logged in" { + w + aa_check +} + +# bats test_tags=w +@test "w: Display information about a specific user" { + w root + aa_check +} From e4f0f066485b1bea40f40b13b9b476119a133391 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 21:43:42 +0000 Subject: [PATCH 0443/1455] tests(ci): install integration tests requirements. --- .github/workflows/main.yml | 1 + tests/requirements.sh | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 tests/requirements.sh diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index b07fc8990..c4f143f05 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -83,6 +83,7 @@ jobs: sudo apt-get install -y \ apparmor-profiles apparmor-utils \ bats bats-support + bash tests/requirements.sh - name: Install apparmor.d run: | diff --git a/tests/requirements.sh b/tests/requirements.sh new file mode 100644 index 000000000..91adc0031 --- /dev/null +++ b/tests/requirements.sh @@ -0,0 +1,27 @@ +#!/usr/bin/env bash +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Dependencies for the bats integration tests + +set -eu + +# shellcheck source=/dev/null +_lsb_release() { + . /etc/os-release || exit 1 + echo "$ID" +} +DISTRIBUTION="$(_lsb_release)" + +case "$DISTRIBUTION" in +arch) + ;; +debian | ubuntu | whonix) + sudo apt-get install -y \ + cpuid dfc systemd-userdbd + ;; +opensuse*) + ;; +*) ;; +esac From 66455a9251151f1e45175af9be9048496df3e884 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 22:18:11 +0000 Subject: [PATCH 0444/1455] feat(profile): improve support for some profiles. Most of the rules have come from the integration tests. --- apparmor.d/abstractions/bus/org.freedesktop.hostname1 | 5 +++++ apparmor.d/groups/bus/ibus-engine-simple | 3 +-- apparmor.d/groups/bus/ibus-x11 | 3 +-- apparmor.d/groups/cron/cron-apport | 2 +- apparmor.d/groups/freedesktop/polkitd | 1 + apparmor.d/groups/freedesktop/upower | 3 +-- apparmor.d/groups/freedesktop/xdg-desktop-portal | 5 +++-- apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk | 1 + apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/gpg/dirmngr | 1 + apparmor.d/groups/gpg/keyboxd | 1 + apparmor.d/groups/network/netplan.script | 5 ++++- apparmor.d/groups/systemd/systemd-analyze | 2 ++ apparmor.d/groups/systemd/systemd-cgls | 4 ++++ apparmor.d/groups/systemd/systemd-hostnamed | 3 ++- apparmor.d/groups/systemd/systemd-localed | 2 +- apparmor.d/groups/systemd/systemd-logind | 1 + apparmor.d/groups/systemd/systemd-oomd | 1 + apparmor.d/groups/systemd/systemd-resolved | 3 ++- apparmor.d/groups/systemd/systemd-timedated | 2 +- apparmor.d/groups/systemd/systemd-userdbd | 3 +++ apparmor.d/profiles-a-f/cpuid | 1 + apparmor.d/profiles-a-f/fprintd | 1 - apparmor.d/profiles-g-l/ip | 5 ++++- apparmor.d/profiles-g-l/lspci | 1 + apparmor.d/profiles-m-r/pinentry-gnome3 | 1 + apparmor.d/profiles-s-z/snap | 1 + apparmor.d/profiles-s-z/sync | 5 ++--- apparmor.d/profiles-s-z/uuidd | 4 ++-- 29 files changed, 50 insertions(+), 22 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 index 8957c4cdd..7dcb187f1 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 @@ -14,6 +14,11 @@ member={Get,GetAll} peer=(name=org.freedesktop.hostname1), + dbus receive bus=system path=/org/freedesktop/hostname1 + interface=org.freedesktop.DBus.Properties + member=PropertiesChanged + peer=(name="{@{busname},org.freedesktop.hostname1}", label=systemd-hostnamed), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/bus/ibus-engine-simple b/apparmor.d/groups/bus/ibus-engine-simple index ab3b2b2fd..f9f9870f8 100644 --- a/apparmor.d/groups/bus/ibus-engine-simple +++ b/apparmor.d/groups/bus/ibus-engine-simple @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/{,ibus/}ibus-engine-simple profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -28,8 +29,6 @@ profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) { owner @{desktop_config_dirs}/ibus/bus/ r, owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index 1096594aa..39d5ecccb 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/{,ibus/}ibus-x11 profile ibus-x11 @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -42,8 +43,6 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/ibus/bus/ r, owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/cron/cron-apport b/apparmor.d/groups/cron/cron-apport index 61aeaf881..1579115a7 100644 --- a/apparmor.d/groups/cron/cron-apport +++ b/apparmor.d/groups/cron/cron-apport @@ -18,7 +18,7 @@ profile cron-apport @{exec_path} { / r, /var/crash/ r, - /var/crash/*.crash w, + /var/crash/* w, include if exists } diff --git a/apparmor.d/groups/freedesktop/polkitd b/apparmor.d/groups/freedesktop/polkitd index a8df0261c..14edf32cc 100644 --- a/apparmor.d/groups/freedesktop/polkitd +++ b/apparmor.d/groups/freedesktop/polkitd @@ -54,6 +54,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) { owner /var/lib/polkit{,-1}/.cache/ rw, @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw, + @{att}/@{run}/systemd/userdb/io.systemd.Multiplexer rw, @{run}/systemd/sessions/* r, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/groups/freedesktop/upower b/apparmor.d/groups/freedesktop/upower index 2aeb4ee88..931b47509 100644 --- a/apparmor.d/groups/freedesktop/upower +++ b/apparmor.d/groups/freedesktop/upower @@ -13,8 +13,7 @@ profile upower @{exec_path} { include include - # Needed? - audit capability sys_nice, + #aa:dbus own bus=system name=org.freedesktop.UPower label=upowerd @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 8d8ae6662..489a04260 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -63,8 +63,9 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { @{lib}/xdg-desktop-portal-validate-icon rPx, @{open_path} rPx -> child-open, - / r, - @{att}/.flatpak-info r, + / r, + @{att}/.flatpak-info r, + owner @{att}/ r, /usr/share/dconf/profile/gdm r, /usr/share/xdg-desktop-portal/** r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index d4fa3dc1d..ff398f25e 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -30,6 +30,7 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include signal receive set=term peer=gdm, + signal receive set=hup peer=gdm-session-worker, unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/*", label=gnome-shell), diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index a2dd6d908..d8ae32fd9 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -17,7 +17,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include @@ -83,6 +82,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { # Talk with gnome-shell + #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon #aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm diff --git a/apparmor.d/groups/gpg/dirmngr b/apparmor.d/groups/gpg/dirmngr index 167e8757c..2fbdfb086 100644 --- a/apparmor.d/groups/gpg/dirmngr +++ b/apparmor.d/groups/gpg/dirmngr @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/dirmngr profile dirmngr @{exec_path} { include + include include include include diff --git a/apparmor.d/groups/gpg/keyboxd b/apparmor.d/groups/gpg/keyboxd index a6eadd904..51ec8b134 100644 --- a/apparmor.d/groups/gpg/keyboxd +++ b/apparmor.d/groups/gpg/keyboxd @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gnupg/keyboxd profile keyboxd @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/groups/network/netplan.script b/apparmor.d/groups/network/netplan.script index 65d644e7b..7f558a1c4 100644 --- a/apparmor.d/groups/network/netplan.script +++ b/apparmor.d/groups/network/netplan.script @@ -36,7 +36,10 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) { include include - @{run}/udev/control rw, + capability net_admin, + + @{att}/@{run}/udev/control rw, + @{run}/udev/rules.d/90-netplan.rules rw, @{run}/udev/rules.d/90-netplan.rules.@{rand6} rw, diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze index 09d432b2f..65feae3f2 100644 --- a/apparmor.d/groups/systemd/systemd-analyze +++ b/apparmor.d/groups/systemd/systemd-analyze @@ -22,6 +22,8 @@ profile systemd-analyze @{exec_path} { signal (send) peer=child-pager, + unix bind type=stream addr=@@{hex16}/bus/systemd-analyze/system, + #aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-cgls b/apparmor.d/groups/systemd/systemd-cgls index b25f861b5..9bfde3e6e 100644 --- a/apparmor.d/groups/systemd/systemd-cgls +++ b/apparmor.d/groups/systemd/systemd-cgls @@ -10,6 +10,8 @@ include profile systemd-cgls @{exec_path} { include include + include + include capability sys_ptrace, @@ -17,6 +19,8 @@ profile systemd-cgls @{exec_path} { signal send set=cont peer=child-pager, + unix bind type=stream addr=@@{hex16}/bus/systemd-cgls/system, + @{exec_path} mr, @{pager_path} rPx -> child-pager, diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index a169a59d6..878884ad1 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -37,8 +37,9 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { /etc/machine-info rw, /etc/os-release r, + @{att}/@{run}/systemd/notify rw, + @{run}/systemd/default-hostname rw, - @{run}/systemd/notify rw, @{run}/udev/data/+dmi:* r, # for motherboard info @{sys}/devices/virtual/dmi/id/ r, diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index 32f02f0d0..058c59db4 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -35,7 +35,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { /etc/X11/xorg.conf.d/.#*.confd* rw, /etc/X11/xorg.conf.d/*.conf rw, - @{run}/systemd/notify rw, + @{att}/@{run}/systemd/notify rw, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 206c09571..012a89789 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -95,6 +95,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{att}/@{run}/systemd/notify w, + @{att}/@{run}/systemd/userdb/io.systemd.Multiplexer rw, @{run}/systemd/inhibit/ rw, @{run}/systemd/inhibit/.#* rw, diff --git a/apparmor.d/groups/systemd/systemd-oomd b/apparmor.d/groups/systemd/systemd-oomd index 469f72b03..912888664 100644 --- a/apparmor.d/groups/systemd/systemd-oomd +++ b/apparmor.d/groups/systemd/systemd-oomd @@ -25,6 +25,7 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) { /etc/systemd/oomd.conf.d/{,**} r, @{att}/@{run}/systemd/notify w, + @{att}/@{run}/systemd/io.systemd.ManagedOOM rw, @{run}/systemd/io.system.ManagedOOM rw, @{run}/systemd/io.systemd.ManagedOOM rw, diff --git a/apparmor.d/groups/systemd/systemd-resolved b/apparmor.d/groups/systemd/systemd-resolved index 4f9f965f5..f6867f437 100644 --- a/apparmor.d/groups/systemd/systemd-resolved +++ b/apparmor.d/groups/systemd/systemd-resolved @@ -41,8 +41,9 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) { /etc/systemd/resolved.conf r, /etc/systemd/resolved.conf.d/{,*} r, + @{att}/@{run}/systemd/notify w, + @{run}/systemd/netif/links/* r, - @{run}/systemd/notify rw, @{run}/systemd/resolve/{,**} rw, @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/systemd/systemd-timedated b/apparmor.d/groups/systemd/systemd-timedated index e2b6caaa7..dd964f3b1 100644 --- a/apparmor.d/groups/systemd/systemd-timedated +++ b/apparmor.d/groups/systemd/systemd-timedated @@ -35,7 +35,7 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) { /etc/.#timezone* rw, /etc/timezone rw, - @{run}/systemd/notify rw, + @{att}/@{run}/systemd/notify rw, /dev/rtc@{int} r, diff --git a/apparmor.d/groups/systemd/systemd-userdbd b/apparmor.d/groups/systemd/systemd-userdbd index ce698dc96..c57327bcb 100644 --- a/apparmor.d/groups/systemd/systemd-userdbd +++ b/apparmor.d/groups/systemd/systemd-userdbd @@ -30,6 +30,9 @@ profile systemd-userdbd @{exec_path} flags=(attach_disconnected,mediate_deleted) /etc/machine-id r, + @{att}/@{run}/systemd/notify w, + @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw, + @{run}/systemd/userdb/{,**} rw, @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-a-f/cpuid b/apparmor.d/profiles-a-f/cpuid index c374d4685..332c1735c 100644 --- a/apparmor.d/profiles-a-f/cpuid +++ b/apparmor.d/profiles-a-f/cpuid @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/cpuid profile cpuid @{exec_path} { include + include capability mknod, diff --git a/apparmor.d/profiles-a-f/fprintd b/apparmor.d/profiles-a-f/fprintd index b3034dfef..182d9013d 100644 --- a/apparmor.d/profiles-a-f/fprintd +++ b/apparmor.d/profiles-a-f/fprintd @@ -29,7 +29,6 @@ profile fprintd @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/inhibit/@{int}.ref rw, - @{run}/systemd/journal/socket rw, @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/class/hidraw/ r, diff --git a/apparmor.d/profiles-g-l/ip b/apparmor.d/profiles-g-l/ip index 2797ae2ba..56c6f5f5e 100644 --- a/apparmor.d/profiles-g-l/ip +++ b/apparmor.d/profiles-g-l/ip @@ -30,8 +30,10 @@ profile ip @{exec_path} flags=(attach_disconnected) { umount /sys/, @{exec_path} mrix, + + # To run command with 'ip netns exec' @{shells_path} rUx, - @{bin}/sudo rPx, + @{bin}/sudo rPx, @{att}/ r, @@ -40,6 +42,7 @@ profile ip @{exec_path} flags=(attach_disconnected) { /usr/share/iproute2/{,**} r, + @{run}/netns/ r, @{run}/netns/* rw, owner @{run}/netns/ rwk, diff --git a/apparmor.d/profiles-g-l/lspci b/apparmor.d/profiles-g-l/lspci index 3f0fe5d95..b390346bb 100644 --- a/apparmor.d/profiles-g-l/lspci +++ b/apparmor.d/profiles-g-l/lspci @@ -35,6 +35,7 @@ profile lspci @{exec_path} flags=(attach_disconnected) { @{sys}/bus/pci/devices/ r, @{sys}/bus/pci/slots/ r, @{sys}/bus/pci/slots/@{int}-@{int}/address r, + @{sys}/bus/pci/slots/@{int}/address r, @{sys}/devices/@{pci}/** r, @{sys}/module/compression r, diff --git a/apparmor.d/profiles-m-r/pinentry-gnome3 b/apparmor.d/profiles-m-r/pinentry-gnome3 index f332ef21f..a955a9c6d 100644 --- a/apparmor.d/profiles-m-r/pinentry-gnome3 +++ b/apparmor.d/profiles-m-r/pinentry-gnome3 @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/pinentry-gnome3 profile pinentry-gnome3 @{exec_path} { include + include include signal (receive) set=(int) peer=gpg-agent, diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/profiles-s-z/snap index a86304000..aa1f6b2b8 100644 --- a/apparmor.d/profiles-s-z/snap +++ b/apparmor.d/profiles-s-z/snap @@ -42,6 +42,7 @@ profile snap @{exec_path} { @{exec_path} mrix, @{bin}/mount rix, + @{bin}/getent rix, @{bin}/gpg{,2} rCx -> gpg, @{bin}/systemctl rCx -> systemctl, diff --git a/apparmor.d/profiles-s-z/sync b/apparmor.d/profiles-s-z/sync index 907def2b1..85a408df8 100644 --- a/apparmor.d/profiles-s-z/sync +++ b/apparmor.d/profiles-s-z/sync @@ -13,9 +13,8 @@ profile sync @{exec_path} { @{exec_path} mr, - # Common paths where sync is used to flush all write operations on a single file to disk - # TODO: /** rw, ? - /boot/initrd-*-default rw, + # All paths where sync can be used to flush all write operations on a single file to disk + /** rw, include if exists } diff --git a/apparmor.d/profiles-s-z/uuidd b/apparmor.d/profiles-s-z/uuidd index c1e14d013..4d75a70ed 100644 --- a/apparmor.d/profiles-s-z/uuidd +++ b/apparmor.d/profiles-s-z/uuidd @@ -17,8 +17,8 @@ profile uuidd @{exec_path} flags=(attach_disconnected) { owner /var/lib/libuuid/clock.txt rwk, - @{run}/uuidd/request w, - @{att}/@{run}/uuidd/request w, + @{run}/uuidd/request rw, + @{att}/@{run}/uuidd/request rw, include if exists } From 9cb3ea244c388ed69ce5bc54baceb7daf294fb05 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 22:18:41 +0000 Subject: [PATCH 0445/1455] feat(profile): add homectl. --- apparmor.d/groups/systemd/homectl | 39 +++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 apparmor.d/groups/systemd/homectl diff --git a/apparmor.d/groups/systemd/homectl b/apparmor.d/groups/systemd/homectl new file mode 100644 index 000000000..aaae97d64 --- /dev/null +++ b/apparmor.d/groups/systemd/homectl @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/homectl +profile homectl @{exec_path} { + include + include + include + include + include + + capability net_admin, + capability sys_resource, + + signal send peer=child-pager, + + #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed + + @{exec_path} mr, + + @{bin}/pkttyagent rpx, + + @{pager_path} rPx -> child-pager, + + /etc/machine-id r, + + owner @{PROC}/@{pids}/cgroup r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor From 4c5761ee7105484f421088b56ed3ae59873b7ca7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 22:25:08 +0000 Subject: [PATCH 0446/1455] fix(profile): linting issue. --- apparmor.d/profiles-s-z/snap-update-ns | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/snap-update-ns b/apparmor.d/profiles-s-z/snap-update-ns index 345c089e3..3ce5bfdd4 100644 --- a/apparmor.d/profiles-s-z/snap-update-ns +++ b/apparmor.d/profiles-s-z/snap-update-ns @@ -27,7 +27,7 @@ profile snap-update-ns @{exec_path} { umount /snap/**, umount /var/lib/dhcp/, umount @{lib}/@{multiarch}/webkit2gtk-@{version}/, - umount /usr/share/xml/iso-codes/, + umount /usr/share/xml/iso-codes/, @{exec_path} mr, From f814bb4caf20a79677d28dcc097451b5e0e26f2b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Nov 2024 22:31:16 +0000 Subject: [PATCH 0447/1455] build(debian): disable make check by default on pkg build. Enable it manually in github action. --- .github/workflows/main.yml | 10 ++++++++++ debian/rules | 3 +++ 2 files changed, 13 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c4f143f05..27c8e3d85 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -3,6 +3,16 @@ name: Ubuntu on: [push, pull_request, workflow_dispatch] jobs: + check: + runs-on: ubuntu-24.04 + steps: + - name: Check out repository code + uses: actions/checkout@v4 + + - name: Run basic profile linter check + run: | + make check + build: runs-on: ${{ matrix.os }} strategy: diff --git a/debian/rules b/debian/rules index 6e7d2d6e4..a30a693df 100755 --- a/debian/rules +++ b/debian/rules @@ -8,3 +8,6 @@ # golang/1.19 compresses debug symbols itself. override_dh_dwz: + +# do not run 'make check' by default as it can be long for dev package +override_dh_auto_test: From 7c148fca95c42107ad2d0d3bd3ec409aee2b2e4f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 13 Nov 2024 11:25:04 +0000 Subject: [PATCH 0448/1455] feat(profile): small profile improvments. --- apparmor.d/abstractions/bus/org.freedesktop.systemd1 | 2 +- apparmor.d/profiles-a-f/blkid | 1 + apparmor.d/profiles-g-l/issue-generator | 2 +- apparmor.d/profiles-s-z/useradd | 1 + apparmor.d/profiles-s-z/w | 2 +- 5 files changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 index 115aefd78..41b08a80b 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 @@ -4,7 +4,7 @@ abi , - dbus send bus=system path=/org/freedesktop/systemd1 + dbus send bus=system path=/org/freedesktop/systemd1{,/**} interface=org.freedesktop.DBus.Properties member={Get,GetAll} peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), diff --git a/apparmor.d/profiles-a-f/blkid b/apparmor.d/profiles-a-f/blkid index 903e2cb62..27207bdb7 100644 --- a/apparmor.d/profiles-a-f/blkid +++ b/apparmor.d/profiles-a-f/blkid @@ -41,6 +41,7 @@ profile blkid @{exec_path} flags=(attach_disconnected) { @{PROC}/swaps r, # Other possible location of the cache file + /dev/.blkid.tab.old rwl -> /dev/.blkid.tab, /dev/.blkid.tab{,-@{rand6}} rw, /dev/blkid.tab.old rwl -> /dev/blkid.tab, diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index 3602a1a1e..8f2d53f76 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -28,7 +28,7 @@ profile issue-generator @{exec_path} { /etc/sysconfig/issue-generator r, @{run}/agetty.reload w, - @{run}/issue r, + @{run}/issue rw, @{run}/issue.@{rand10} rw, @{run}/issue.d/{,**} r, diff --git a/apparmor.d/profiles-s-z/useradd b/apparmor.d/profiles-s-z/useradd index 0fbb9aa6d..5768f1343 100644 --- a/apparmor.d/profiles-s-z/useradd +++ b/apparmor.d/profiles-s-z/useradd @@ -54,6 +54,7 @@ profile useradd @{exec_path} { # To create user dirs and copy files from /etc/skel/ to them @{HOME}/ rw, @{HOME}/.** w, + @{HOME}/**/ r, /var/lib/*/{,*} rw, /etc/skel/{,.**} r, diff --git a/apparmor.d/profiles-s-z/w b/apparmor.d/profiles-s-z/w index 3745015c1..b23a7bc23 100644 --- a/apparmor.d/profiles-s-z/w +++ b/apparmor.d/profiles-s-z/w @@ -24,7 +24,7 @@ profile w @{exec_path} { @{sys}/devices/system/node/node@{int}/meminfo r, @{run}/systemd/sessions/ r, - @{run}/systemd/sessions/@{int} r, + @{run}/systemd/sessions/* r, @{PROC}/ r, @{PROC}/@{pids}/cmdline r, From 24ea5f0a3acbccdbf5ddb4157c48d5df413de9a0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 13 Nov 2024 12:23:36 +0000 Subject: [PATCH 0449/1455] feat(tunable): add p_dbus_* variables. This allow for better integration for system when dbus is not confined. --- apparmor.d/abstractions/bus-accessibility | 4 ++-- apparmor.d/abstractions/bus-session | 4 ++-- apparmor.d/abstractions/bus-system | 4 ++-- apparmor.d/abstractions/bus/org.a11y | 2 +- apparmor.d/groups/_full/systemd | 2 +- apparmor.d/groups/apt/apt | 2 +- apparmor.d/groups/bus/at-spi2-registryd | 2 +- apparmor.d/groups/freedesktop/accounts-daemon | 2 +- apparmor.d/groups/freedesktop/colord | 2 +- apparmor.d/groups/freedesktop/geoclue | 2 +- apparmor.d/groups/freedesktop/pipewire | 2 +- apparmor.d/groups/freedesktop/pipewire-media-session | 2 +- apparmor.d/groups/freedesktop/polkitd | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal | 2 +- apparmor.d/groups/gnome/gdm | 2 +- apparmor.d/groups/gnome/gnome-extension-ding | 6 +++--- apparmor.d/groups/gnome/gnome-session-binary | 2 +- apparmor.d/groups/gnome/gnome-shell | 10 +++++----- apparmor.d/groups/gnome/gsd-media-keys | 2 +- apparmor.d/groups/gnome/gsd-xsettings | 2 +- apparmor.d/groups/gnome/nautilus | 4 ++-- apparmor.d/groups/network/NetworkManager | 2 +- apparmor.d/groups/ssh/ssh-agent-launch | 2 +- apparmor.d/groups/systemd/busctl | 2 +- apparmor.d/groups/systemd/systemd-hostnamed | 2 +- apparmor.d/groups/systemd/systemd-logind | 2 +- apparmor.d/groups/systemd/systemd-resolved | 2 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-m-r/packagekitd | 2 +- apparmor.d/profiles-m-r/rtkit-daemon | 2 +- apparmor.d/profiles-s-z/udisksd | 2 +- apparmor.d/tunables/multiarch.d/profiles | 5 +++++ docs/development/guidelines.md | 2 +- 33 files changed, 47 insertions(+), 42 deletions(-) diff --git a/apparmor.d/abstractions/bus-accessibility b/apparmor.d/abstractions/bus-accessibility index ee0a16b99..eba12457f 100644 --- a/apparmor.d/abstractions/bus-accessibility +++ b/apparmor.d/abstractions/bus-accessibility @@ -7,12 +7,12 @@ dbus send bus=accessibility path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} - peer=(name=org.freedesktop.DBus, label=dbus-accessibility), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_accessibility}"), dbus send bus=accessibility path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={RequestName,ReleaseName} - peer=(name=org.freedesktop.DBus, label=dbus-accessibility), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_accessibility}"), owner @{run}/user/@{uid}/at-spi/ rw, owner @{run}/user/@{uid}/at-spi/bus rw, diff --git a/apparmor.d/abstractions/bus-session b/apparmor.d/abstractions/bus-session index 811787bad..95325d7d3 100644 --- a/apparmor.d/abstractions/bus-session +++ b/apparmor.d/abstractions/bus-session @@ -11,12 +11,12 @@ dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={RequestName,ReleaseName} - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), /etc/machine-id r, /var/lib/dbus/machine-id r, diff --git a/apparmor.d/abstractions/bus-system b/apparmor.d/abstractions/bus-system index 0bfe96818..870443002 100644 --- a/apparmor.d/abstractions/bus-system +++ b/apparmor.d/abstractions/bus-system @@ -7,12 +7,12 @@ dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={RequestName,ReleaseName} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{run}/dbus/system_bus_socket rw, diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y index 357c06473..bb31a079c 100644 --- a/apparmor.d/abstractions/bus/org.a11y +++ b/apparmor.d/abstractions/bus/org.a11y @@ -36,7 +36,7 @@ dbus send bus=session path=/org/a11y/bus interface=org.a11y.Bus member=GetAddress - peer=(name=org.a11y.Bus, label=dbus-accessibility), + peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"), dbus send bus=session path=/org/a11y/bus interface=org.a11y.Bus diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index 9e1737a2a..9f611cf3d 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -138,7 +138,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=GetConnectionUnixUser - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{bin}/** Px, @{lib}/** Px, diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 19f187cc3..9d7ba9b7b 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -43,7 +43,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus/Bus interface=org.freedesktop.DBus member={GetConnectionUnixProcessID,GetConnectionUnixUser} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), dbus send bus=system interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/bus/at-spi2-registryd b/apparmor.d/groups/bus/at-spi2-registryd index fd9707093..9838ba40b 100644 --- a/apparmor.d/groups/bus/at-spi2-registryd +++ b/apparmor.d/groups/bus/at-spi2-registryd @@ -20,7 +20,7 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { signal receive set=hup peer=gdm-session-worker, #aa:dbus own bus=accessibility name=org.a11y.atspi - #aa:dbus talk bus=session name=org.a11y.{B,b}us label=dbus-accessibility + #aa:dbus talk bus=session name=org.a11y.{B,b}us label="@{p_dbus_accessibility}" dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/freedesktop/accounts-daemon b/apparmor.d/groups/freedesktop/accounts-daemon index 539a2a57d..42758585f 100644 --- a/apparmor.d/groups/freedesktop/accounts-daemon +++ b/apparmor.d/groups/freedesktop/accounts-daemon @@ -28,7 +28,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index ffdfe08a0..26a07d8aa 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -25,7 +25,7 @@ profile colord @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mrix, diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index ec1633a9e..383360ad4 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -29,7 +29,7 @@ profile geoclue @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index f6f4c12aa..e2b1b22d9 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -28,7 +28,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/freedesktop/pipewire-media-session b/apparmor.d/groups/freedesktop/pipewire-media-session index 212898a84..fa1e44d00 100644 --- a/apparmor.d/groups/freedesktop/pipewire-media-session +++ b/apparmor.d/groups/freedesktop/pipewire-media-session @@ -26,7 +26,7 @@ profile pipewire-media-session @{exec_path} { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=GetConnectionUnixProcessID - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/freedesktop/polkitd b/apparmor.d/groups/freedesktop/polkitd index 14edf32cc..5e3d3ee78 100644 --- a/apparmor.d/groups/freedesktop/polkitd +++ b/apparmor.d/groups/freedesktop/polkitd @@ -26,7 +26,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 489a04260..57b17b655 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -47,7 +47,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gnome/gdm b/apparmor.d/groups/gnome/gdm index b0f5e81a5..6bafb132b 100644 --- a/apparmor.d/groups/gnome/gdm +++ b/apparmor.d/groups/gnome/gdm @@ -40,7 +40,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixProcessID,GetConnectionUnixUser} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index f74afdeac..068469606 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -38,14 +38,14 @@ profile gnome-extension-ding @{exec_path} { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus* - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus* - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), dbus send bus=session path=/org/gtk/vfs/metadata interface=org.gtk.vfs.Metadata diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 42c1265ae..babd12c3d 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -37,7 +37,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID,UpdateActivationEnvironment} - peer=(name=org.freedesktop.DBus label=dbus-session), + peer=(name=org.freedesktop.DBus label="@{p_dbus_session}"), dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index d8ae32fd9..7cc739491 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -112,22 +112,22 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetNameOwner,ListNames} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), # Session bus dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetNameOwner,ListNames} - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/ interface=org.freedesktop.DBus member={GetConnectionUnixProcessID,GetNameOwner,ListNames} - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=accessibility path=/org/a11y/atspi/accessible/root interface=org.a11y.atspi.Socket @@ -161,7 +161,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { dbus send bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/org/gnome/*/SearchProvider interface=org.gnome.Shell.SearchProvider2 diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 3c2ef3dac..d9b0e5e27 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -43,7 +43,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { dbus send bus=session path=/ interface=org.freedesktop.DBus member=ListNames - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/org/gnome/SettingsDaemon/Power interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index 51bcf2e10..c7478292c 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -41,7 +41,7 @@ profile gsd-xsettings @{exec_path} { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=GetId - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index e4990a3e3..890e5b34e 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -43,12 +43,12 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=ListActivatableNames - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/org/freedesktop/dbus interface=org.freedesktop.DBus member=NameHasOwner - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), @{exec_path} mr, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index e20ea48b3..de4644bdd 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -70,7 +70,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/ssh/ssh-agent-launch b/apparmor.d/groups/ssh/ssh-agent-launch index 7e0422c5a..c9f0c6373 100644 --- a/apparmor.d/groups/ssh/ssh-agent-launch +++ b/apparmor.d/groups/ssh/ssh-agent-launch @@ -27,7 +27,7 @@ profile ssh-agent-launch @{exec_path} { dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=UpdateActivationEnvironment - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index dcb60493e..3cea03c9c 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -33,7 +33,7 @@ profile busctl @{exec_path} { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus.Monitoring member=BecomeMonitor - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index 878884ad1..46786c659 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -25,7 +25,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=GetConnectionUnixUser - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 012a89789..6b01f5147 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -43,7 +43,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetConnectionCredentials} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-resolved b/apparmor.d/groups/systemd/systemd-resolved index f6867f437..f693cbee4 100644 --- a/apparmor.d/groups/systemd/systemd-resolved +++ b/apparmor.d/groups/systemd/systemd-resolved @@ -34,7 +34,7 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 6cee42be9..45b2ccfb4 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -42,7 +42,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), dbus send bus=system path=/org/freedesktop/UDisks2/Manager interface=org.freedesktop.UDisks2.Manager diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index b97c5e9a8..6847476e3 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -43,7 +43,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/rtkit-daemon b/apparmor.d/profiles-m-r/rtkit-daemon index ddb62cb5f..d3a88d78a 100644 --- a/apparmor.d/profiles-m-r/rtkit-daemon +++ b/apparmor.d/profiles-m-r/rtkit-daemon @@ -26,7 +26,7 @@ profile rtkit-daemon @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index b89d9c72f..530373efd 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -67,7 +67,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} - peer=(name=org.freedesktop.DBus, label=dbus-system), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), @{exec_path} mr, diff --git a/apparmor.d/tunables/multiarch.d/profiles b/apparmor.d/tunables/multiarch.d/profiles index a24cefc01..2d1fccb32 100644 --- a/apparmor.d/tunables/multiarch.d/profiles +++ b/apparmor.d/tunables/multiarch.d/profiles @@ -11,4 +11,9 @@ @{p_systemd}=unconfined @{p_systemd_user}=unconfined +# Name of the dbus daemon profiles +@{p_dbus_system}=dbus-system +@{p_dbus_session}=dbus-session +@{p_dbus_accessibility}=dbus-accessibility + # vim:syntax=apparmor diff --git a/docs/development/guidelines.md b/docs/development/guidelines.md index f207e58a2..fad901581 100644 --- a/docs/development/guidelines.md +++ b/docs/development/guidelines.md @@ -85,7 +85,7 @@ For DBus, try to determine peer's label when possible. E.g.: dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={RequestName,ReleaseName} - peer=(name=org.freedesktop.DBus, label=dbus-session), + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), ``` If there is no predictable label it can be omitted. From 3013c1ea5a978c585f58a07463274ee1ee2b7bc0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 13 Nov 2024 12:31:17 +0000 Subject: [PATCH 0450/1455] ci(github): set local tunable for github actions. --- .github/workflows/main.yml | 1 + tests/github.local | 9 +++++++++ 2 files changed, 10 insertions(+) create mode 100644 tests/github.local diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 27c8e3d85..59449cb4c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -97,6 +97,7 @@ jobs: - name: Install apparmor.d run: | + sudo install -Dm0644 tests/github.local /etc/apparmor.d/tunables/global.d/github.local sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true sudo systemctl restart apparmor.service diff --git a/tests/github.local b/tests/github.local new file mode 100644 index 000000000..b4119bc56 --- /dev/null +++ b/tests/github.local @@ -0,0 +1,9 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Local tunables addition for bats integration tests on Github Action + +@{p_dbus_system}+=unconfined +@{p_dbus_session}+=unconfined +@{p_dbus_accessibility}+=unconfined From 194d18191ed9d65f279768576cfdc7a4907752a4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 13 Nov 2024 12:37:02 +0000 Subject: [PATCH 0451/1455] fix(profile): ensure useradd can fully populate the skelleton. --- apparmor.d/profiles-s-z/useradd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/useradd b/apparmor.d/profiles-s-z/useradd index 5768f1343..d27a34207 100644 --- a/apparmor.d/profiles-s-z/useradd +++ b/apparmor.d/profiles-s-z/useradd @@ -53,7 +53,7 @@ profile useradd @{exec_path} { # To create user dirs and copy files from /etc/skel/ to them @{HOME}/ rw, - @{HOME}/.** w, + @{HOME}/** wl, @{HOME}/**/ r, /var/lib/*/{,*} rw, /etc/skel/{,.**} r, From b4bcb2f16e61ae8d5a8393e84d092b7940999871 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 13 Nov 2024 13:31:06 +0000 Subject: [PATCH 0452/1455] fix(profile): minor fixes. --- apparmor.d/profiles-g-l/ip | 8 +++++--- apparmor.d/profiles-s-z/sync | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/apparmor.d/profiles-g-l/ip b/apparmor.d/profiles-g-l/ip index 56c6f5f5e..bcb521c01 100644 --- a/apparmor.d/profiles-g-l/ip +++ b/apparmor.d/profiles-g-l/ip @@ -20,11 +20,13 @@ profile ip @{exec_path} flags=(attach_disconnected) { network netlink raw, - mount options=(rw, rshared) -> @{run}/netns/, - mount options=(rw, rslave) -> /, + mount fstype=sysfs -> /sys/, + mount options=(rw bind) / -> @{run}/netns/*, + mount options=(rw rbind) @{run}/netns/ -> @{run}/netns/, mount options=(rw, bind) @{att}/ -> @{run}/netns/*, mount options=(rw, bind) /etc/netns/*/resolv.conf -> /etc/resolv.conf, - mount fstype=sysfs -> /sys/, + mount options=(rw, rshared) -> @{run}/netns/, + mount options=(rw, rslave) -> /, umount @{run}/netns/*, umount /sys/, diff --git a/apparmor.d/profiles-s-z/sync b/apparmor.d/profiles-s-z/sync index 85a408df8..9b47b4df2 100644 --- a/apparmor.d/profiles-s-z/sync +++ b/apparmor.d/profiles-s-z/sync @@ -14,7 +14,7 @@ profile sync @{exec_path} { @{exec_path} mr, # All paths where sync can be used to flush all write operations on a single file to disk - /** rw, + /{,**} rw, include if exists } From 4e5f4cb06a393e7f50b87a194eeff45c4b2c24e2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 19:04:27 +0000 Subject: [PATCH 0453/1455] feat: profiles and integration tests improvments. Add the udbus variable to be used in `unix bind` rule for dbus. --- apparmor.d/abstractions/app/sudo | 8 ++++---- apparmor.d/abstractions/app/systemctl | 2 +- apparmor.d/abstractions/attached/base | 2 ++ apparmor.d/groups/_full/systemd-user | 4 ++-- apparmor.d/groups/apt/apt | 2 +- apparmor.d/groups/apt/unattended-upgrade | 2 +- apparmor.d/groups/bus/dbus-system | 2 +- apparmor.d/groups/gnome/gdm-session-worker | 2 +- apparmor.d/groups/network/ModemManager | 8 ++++++-- apparmor.d/groups/network/NetworkManager | 9 +++++++-- apparmor.d/groups/network/netplan.script | 16 ++++++++++++++-- apparmor.d/groups/network/nm-online | 1 + apparmor.d/groups/network/nmcli | 4 ++++ apparmor.d/groups/ssh/ssh-keygen | 1 + apparmor.d/groups/ssh/sshd | 2 +- apparmor.d/groups/systemd/busctl | 2 +- apparmor.d/groups/systemd/hostnamectl | 1 + apparmor.d/groups/systemd/networkctl | 2 +- apparmor.d/groups/systemd/systemd-analyze | 2 +- apparmor.d/groups/systemd/systemd-cgls | 2 +- apparmor.d/groups/systemd/systemd-homed | 3 +++ apparmor.d/groups/systemd/systemd-hostnamed | 2 +- apparmor.d/groups/systemd/systemd-localed | 2 +- apparmor.d/groups/systemd/systemd-logind | 2 +- apparmor.d/groups/systemd/systemd-networkd | 2 +- apparmor.d/groups/systemd/systemd-oomd | 2 +- apparmor.d/groups/systemd/systemd-timedated | 2 +- apparmor.d/groups/systemd/systemd-timesyncd | 2 +- apparmor.d/groups/systemd/systemd-update-utmp | 2 +- .../groups/systemd/systemd-user-runtime-dir | 2 +- apparmor.d/groups/ubuntu/update-notifier | 4 ++-- apparmor.d/profiles-g-l/login | 2 +- apparmor.d/profiles-m-r/needrestart-apt-pinvoke | 2 ++ apparmor.d/profiles-m-r/qemu-ga | 2 +- apparmor.d/profiles-s-z/snapd | 2 +- apparmor.d/profiles-s-z/sudo | 2 -- apparmor.d/profiles-s-z/udisksd | 4 ++++ apparmor.d/tunables/multiarch.d/system | 3 +++ docs/development/directives.md | 2 +- tests/bats/homectl.bats | 1 + tests/bats/snap.bats | 1 - tests/bats/systemd-id128.bats | 6 ------ tests/requirements.sh | 2 +- 43 files changed, 81 insertions(+), 47 deletions(-) diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 385ded540..4c7de6ba5 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -24,10 +24,10 @@ network netlink raw, # PAM - dbus send bus=system path=/org/freedesktop/login1 - interface=org.freedesktop.logi1.Manager - member=CreateSession - peer=(name=org.freedesktop.login1, label=systemd-logind), + unix bind type=stream addr=@@{udbus}/bus/sudo/system, + + #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed + #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind dbus (send receive) bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd.Manager diff --git a/apparmor.d/abstractions/app/systemctl b/apparmor.d/abstractions/app/systemctl index 7857f9921..8489bb275 100644 --- a/apparmor.d/abstractions/app/systemctl +++ b/apparmor.d/abstractions/app/systemctl @@ -10,7 +10,7 @@ ptrace read peer=@{p_systemd}, - unix bind type=stream addr=@@{hex16}/bus/systemctl/, + unix bind type=stream addr=@@{udbus}/bus/systemctl/, @{bin}/systemctl mr, diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index 1f37de00d..9a53d1548 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -7,8 +7,10 @@ abi , + @{att}/@{run}/systemd/journal/dev-log w, @{att}/@{run}/systemd/journal/socket w, + deny /apparmor/.null rw, deny @{att}/apparmor/.null rw, include if exists diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index 32228f21b..919c53457 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -32,8 +32,8 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { ptrace read peer=@{p_systemd}, - unix bind type=stream addr=@@{hex16}/bus/systemd/bus-system, - unix bind type=stream addr=@@{hex16}/bus/systemd/bus-api-user, + unix bind type=stream addr=@@{udbus}/bus/systemd/bus-system, + unix bind type=stream addr=@@{udbus}/bus/systemd/bus-api-user, #aa:dbus own bus=session name=org.freedesktop.systemd1 diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 9d7ba9b7b..eb94791d7 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -34,7 +34,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { signal (send) peer=apt-methods-*, - unix (bind) type=stream addr=@@{hex16}/bus/apt/system, + unix (bind) type=stream addr=@@{udbus}/bus/apt/system, unix (send, receive) type=stream peer=(label=apt-esm-json-hook), unix (send, receive) type=stream peer=(label=snapd), diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index e4f6b61ea..d0fdad4b7 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -33,7 +33,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { signal (send) peer=apt-methods-http, - unix type=stream addr=@@{hex16}/bus/unattended-upgr/system, + unix type=stream addr=@@{udbus}/bus/unattended-upgr/system, @{exec_path} mr, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index 6ef4e44ea..e4eef2753 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -33,7 +33,7 @@ profile dbus-system flags=(attach_disconnected) { ptrace (read) peer=@{p_systemd}, - #aa:dbus own bus=system name=org.freedesktop.DBus + #aa:dbus own bus=system name=org.freedesktop.DBus path=/{,org/freedesktop/DBus} @{exec_path} mrix, diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 4ca2b21b6..59e6df788 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -47,7 +47,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { signal (send) set=hup peer=xorg, signal (send) set=hup peer=xwayland, - unix (bind) type=stream addr=@@{hex16}/bus/gdm-session-wor/system, + unix (bind) type=stream addr=@@{udbus}/bus/gdm-session-wor/system, #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index 8ac535f16..b92ad8e68 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -25,9 +25,13 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{run}/udev/data/+acpi:* r, # for acpi @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, + @{run}/udev/data/+pnp:* r, + @{run}/udev/data/+serial*:* r, @{run}/udev/data/+usb:* r, + @{run}/udev/data/+vmbus:* r, @{run}/udev/data/c16[6,7]:@{int} r, # USB modems @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters @{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]* @@ -43,9 +47,9 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { @{sys}/class/tty/ r, @{sys}/class/wwan/ r, - @{sys}/devices/**/uevent r, @{sys}/devices/@{pci}/revision r, - @{sys}/devices/virtual/net/*/ r, + @{sys}/devices/**/net/*/ r, + @{sys}/devices/**/uevent r, @{sys}/devices/virtual/tty/*/ r, include if exists diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index de4644bdd..de3a180bb 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -47,6 +47,10 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher #aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved + dbus send bus=system path=/org/freedesktop/nm_dispatcher + interface=org.freedesktop.nm_dispatcher + peer=(name=org.freedesktop.nm_dispatcher), + dbus receive bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects @@ -128,10 +132,11 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+rfkill:* r, @{run}/udev/data/n@{int} r, - @{sys}/devices/**/uevent r, - @{sys}/devices/virtual/net/{,**} r, @{sys}/devices/@{pci}/net/*/{,**} r, @{sys}/devices/@{pci}/usb@{int}/**/net/{,**} r, + @{sys}/devices/**/@{uuid}/net/*/{,**} r, + @{sys}/devices/**/uevent r, + @{sys}/devices/virtual/net/{,**} r, @{PROC}/@{pids}/stat r, @{PROC}/1/environ r, diff --git a/apparmor.d/groups/network/netplan.script b/apparmor.d/groups/network/netplan.script index 7f558a1c4..989f2ee09 100644 --- a/apparmor.d/groups/network/netplan.script +++ b/apparmor.d/groups/network/netplan.script @@ -12,6 +12,8 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) { include include + network netlink raw, + @{exec_path} mr, @{lib}/netplan/generate rix, @@ -22,15 +24,25 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) { /etc/netplan/{,*} r, - @{run}/NetworkManager/conf.d/10-globally-managed-devices.conf{,.@{rand6}} rw, + @{run}/netplan/ r, + + @{run}/NetworkManager/conf.d/@{int}-globally-managed-devices.conf{,.@{rand6}} rw, @{run}/NetworkManager/system-connections/ rw, @{run}/NetworkManager/system-connections/netplan-*.nmconnection{,.@{rand6}} rw, + + @{run}/systemd/network/ r, + @{run}/systemd/network/@{int}-netplan{,-*}.{network,link}{,.@{rand6}} rw, @{run}/systemd/system/ r, @{run}/systemd/system/netplan-* rw, + @{run}/systemd/system/systemd-networkd-wait-online.service.d/ r, + @{run}/systemd/system/systemd-networkd-wait-online.service.d/@{int}-netplan.conf{,.@{rand6}} rw, @{run}/systemd/system/systemd-networkd.service.wants/ rw, @{run}/systemd/system/systemd-networkd.service.wants/netplan-*.service rw, + @{run}/udev/rules.d/ r, - @{run}/udev/rules.d/90-netplan.rules{,.@{rand6}} rw, + @{run}/udev/rules.d/@{int}-netplan{,-*}.rules{,.@{rand6}} rw, + + @{sys}/devices/**/net/*/address r, profile udevadm { include diff --git a/apparmor.d/groups/network/nm-online b/apparmor.d/groups/network/nm-online index 27a511dc4..189afd74d 100644 --- a/apparmor.d/groups/network/nm-online +++ b/apparmor.d/groups/network/nm-online @@ -11,6 +11,7 @@ profile nm-online @{exec_path} { include include include + include dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/@{int} interface=org.freedesktop.NetworkManager.Connection.Active diff --git a/apparmor.d/groups/network/nmcli b/apparmor.d/groups/network/nmcli index a964ab958..43a9d0dca 100644 --- a/apparmor.d/groups/network/nmcli +++ b/apparmor.d/groups/network/nmcli @@ -9,10 +9,14 @@ include @{exec_path} = @{bin}/nmcli profile nmcli @{exec_path} { include + include + include capability dac_read_search, capability sys_nice, + #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager + @{exec_path} mr, @{pager_path} rPx -> child-pager, diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index 05a21d41f..14cbd3c87 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -22,6 +22,7 @@ profile ssh-keygen @{exec_path} { owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw, /tmp/snapd@{int}/*_*{,.pub} w, + /tmp/snapd@{int}/*.key{,.pub} w, /dev/tty@{int} rw, /dev/ttyS@{int} rw, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 2f704fb37..b4ecc068e 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -53,7 +53,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { ptrace (read,trace) peer=@{p_systemd}, - unix (bind) type=stream addr=@@{hex16}/bus/sshd/system, + unix (bind) type=stream addr=@@{udbus}/bus/sshd/system, dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index 3cea03c9c..6516a500c 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -22,7 +22,7 @@ profile busctl @{exec_path} { ptrace (read), - unix (bind) type=stream addr=@@{hex16}/bus/busctl/busctl, + unix (bind) type=stream addr=@@{udbus}/bus/busctl/busctl, signal (send) set=(cont) peer=child-pager, diff --git a/apparmor.d/groups/systemd/hostnamectl b/apparmor.d/groups/systemd/hostnamectl index 91fc31b51..2429d235e 100644 --- a/apparmor.d/groups/systemd/hostnamectl +++ b/apparmor.d/groups/systemd/hostnamectl @@ -10,6 +10,7 @@ include profile hostnamectl @{exec_path} { include include + include include capability net_admin, diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index dee55195d..a4bab2be3 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -24,7 +24,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { ptrace (read) peer=@{p_systemd}, - unix (bind) type=stream addr=@@{hex16}/bus/networkctl/system, + unix (bind) type=stream addr=@@{udbus}/bus/networkctl/system, #aa:dbus talk bus=system name=org.freedesktop.network1 label=systemd-networkd # No label available diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze index 65feae3f2..039f8dc64 100644 --- a/apparmor.d/groups/systemd/systemd-analyze +++ b/apparmor.d/groups/systemd/systemd-analyze @@ -22,7 +22,7 @@ profile systemd-analyze @{exec_path} { signal (send) peer=child-pager, - unix bind type=stream addr=@@{hex16}/bus/systemd-analyze/system, + unix bind type=stream addr=@@{udbus}/bus/systemd-analyze/system, #aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" diff --git a/apparmor.d/groups/systemd/systemd-cgls b/apparmor.d/groups/systemd/systemd-cgls index 9bfde3e6e..33191171e 100644 --- a/apparmor.d/groups/systemd/systemd-cgls +++ b/apparmor.d/groups/systemd/systemd-cgls @@ -19,7 +19,7 @@ profile systemd-cgls @{exec_path} { signal send set=cont peer=child-pager, - unix bind type=stream addr=@@{hex16}/bus/systemd-cgls/system, + unix bind type=stream addr=@@{udbus}/bus/systemd-cgls/system, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-homed b/apparmor.d/groups/systemd/systemd-homed index 5fe748abd..205012cd2 100644 --- a/apparmor.d/groups/systemd/systemd-homed +++ b/apparmor.d/groups/systemd/systemd-homed @@ -35,6 +35,8 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { mount options=(rw, rslave) -> @{run}/, mount /dev/dm-@{int} -> @{run}/systemd/user-home-mount/, + unix bind type=stream addr=@@{udbus}/bus/systemd-homed/system, + #aa:dbus own bus=system name=org.freedesktop.home1 @{exec_path} mr, @@ -61,6 +63,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { @{run}/systemd/home/{,**} rw, @{run}/systemd/userdb/io.systemd.home r, @{run}/systemd/user-home-mount/{,**} rw, + @{run}/systemd/notify w, @{sys}/bus/ r, @{sys}/fs/ r, diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index 46786c659..cd77b9826 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -18,7 +18,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { network unix stream, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-hostnam/system, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-hostnam/system, #aa:dbus own bus=system name=org.freedesktop.hostname1 diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index 058c59db4..205d8a55f 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -14,7 +14,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { include include - unix (bind) type=stream addr=@@{hex16}/bus/systemd-localed/system, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-localed/system, #aa:dbus own bus=system name=org.freedesktop.locale1 diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 6b01f5147..f7e0af838 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -29,7 +29,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { mqueue r type=posix /, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-logind/system, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-logind/system, #aa:dbus own bus=system name=org.freedesktop.login1 diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index f38564ae1..3eaedfaac 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -27,7 +27,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { network packet dgram, network packet raw, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-network/bus-api-network, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network, #aa:dbus own bus=system name=org.freedesktop.network1 diff --git a/apparmor.d/groups/systemd/systemd-oomd b/apparmor.d/groups/systemd/systemd-oomd index 912888664..d16c67f7d 100644 --- a/apparmor.d/groups/systemd/systemd-oomd +++ b/apparmor.d/groups/systemd/systemd-oomd @@ -15,7 +15,7 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) { capability dac_override, capability kill, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-oomd/bus-api-oom, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-oomd/bus-api-oom, #aa:dbus own bus=system name=org.freedesktop.oom1 diff --git a/apparmor.d/groups/systemd/systemd-timedated b/apparmor.d/groups/systemd/systemd-timedated index dd964f3b1..e070afe4e 100644 --- a/apparmor.d/groups/systemd/systemd-timedated +++ b/apparmor.d/groups/systemd/systemd-timedated @@ -15,7 +15,7 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) { capability sys_time, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-timedat/system, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-timedat/system, #aa:dbus own bus=system name=org.freedesktop.timedate1 diff --git a/apparmor.d/groups/systemd/systemd-timesyncd b/apparmor.d/groups/systemd/systemd-timesyncd index 9f9136bca..b603b2411 100644 --- a/apparmor.d/groups/systemd/systemd-timesyncd +++ b/apparmor.d/groups/systemd/systemd-timesyncd @@ -21,7 +21,7 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) { network inet stream, network inet6 stream, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-timesyn/bus-api-timesync, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-timesyn/bus-api-timesync, unix (send, receive) type=dgram addr=none peer=(label=@{p_systemd}, addr=none), #aa:dbus own bus=system name=org.freedesktop.timesync1 diff --git a/apparmor.d/groups/systemd/systemd-update-utmp b/apparmor.d/groups/systemd/systemd-update-utmp index 8703709c4..9d512b495 100644 --- a/apparmor.d/groups/systemd/systemd-update-utmp +++ b/apparmor.d/groups/systemd/systemd-update-utmp @@ -17,7 +17,7 @@ profile systemd-update-utmp @{exec_path} { network netlink raw, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-update-/, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-update-/, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-user-runtime-dir b/apparmor.d/groups/systemd/systemd-user-runtime-dir index 84dfb27ee..9c7fe975b 100644 --- a/apparmor.d/groups/systemd/systemd-user-runtime-dir +++ b/apparmor.d/groups/systemd/systemd-user-runtime-dir @@ -25,7 +25,7 @@ profile systemd-user-runtime-dir @{exec_path} { mount fstype=tmpfs options=(rw,nosuid,nodev) -> @{run}/user/@{uid}/, umount @{run}/user/@{uid}/, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-user-ru/system, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-user-ru/system, @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 36fae9ce3..4ffaf60e0 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -22,7 +22,7 @@ profile update-notifier @{exec_path} { include include - unix (bind) type=stream addr=@@{hex16}/bus/systemd/bus-api-user, + unix (bind) type=stream addr=@@{udbus}/bus/systemd/bus-api-user, #aa:dbus talk bus=system name=org.debian.apt label=apt #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell @@ -87,7 +87,7 @@ profile update-notifier @{exec_path} { include include - unix (bind) type=stream addr=@@{hex16}/bus/systemctl/system, + unix (bind) type=stream addr=@@{udbus}/bus/systemctl/system, dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager diff --git a/apparmor.d/profiles-g-l/login b/apparmor.d/profiles-g-l/login index cbaac35b7..9b32614a9 100644 --- a/apparmor.d/profiles-g-l/login +++ b/apparmor.d/profiles-g-l/login @@ -32,7 +32,7 @@ profile login @{exec_path} flags=(attach_disconnected) { signal (send) set=(hup term), - unix type=stream addr=@@{hex16}/bus/login/system, + unix type=stream addr=@@{udbus}/bus/login/system, ptrace read, diff --git a/apparmor.d/profiles-m-r/needrestart-apt-pinvoke b/apparmor.d/profiles-m-r/needrestart-apt-pinvoke index 0a9e1dc33..5f3912105 100644 --- a/apparmor.d/profiles-m-r/needrestart-apt-pinvoke +++ b/apparmor.d/profiles-m-r/needrestart-apt-pinvoke @@ -13,6 +13,8 @@ profile needrestart-apt-pinvoke @{exec_path} { include include + capability dac_read_search, + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index 5bf8fceb8..7e63560ec 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -21,7 +21,7 @@ profile qemu-ga @{exec_path} { ptrace (read) peer=@{p_systemd}, - unix type=stream addr=@@{hex16}/bus/shutdown/system, + unix type=stream addr=@@{udbus}/bus/shutdown/system, #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index d51c65d4d..63a1568b5 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -50,7 +50,7 @@ profile snapd @{exec_path} { ptrace (read) peer=snap, ptrace (read) peer=@{p_systemd}, - unix (bind) type=stream addr=@@{hex16}/bus/systemctl/, + unix (bind) type=stream addr=@@{udbus}/bus/systemctl/, dbus send bus=system path=/org/freedesktop/ interface=org.freedesktop.login1.Manager diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index ca9f66d27..1e6748235 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -31,8 +31,6 @@ profile sudo @{exec_path} flags=(attach_disconnected) { signal (send) set=(winch) peer=pacman, signal (send) set=(winch, hup, term) peer=rpm, - unix bind type=stream addr=@@{hex16}/bus/sudo/system/, - @{bin}/@{shells} rUx, @{lib}/** PUx, /opt/*/** PUx, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 530373efd..9155adf84 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -113,9 +113,11 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{run}/cryptsetup/ r, @{run}/cryptsetup/L* rwk, + @{run}/udev/data/+acpi:* r, # for acpi @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, @{run}/udev/data/+scsi:* r, + @{run}/udev/data/+vmbus:* r, @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/bus/ r, @@ -128,6 +130,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/{ata,usb,mmc,virtio}[0-9]/{,**/}uevent w, @{sys}/devices/@{pci}/{ata,usb,mmc}[0-9]/{,**/}remove rw, @{sys}/devices/@{pci}/uevent r, + @{sys}/devices/**/net/*/ r, + @{sys}/devices/**/uevent r, @{sys}/devices/virtual/bdi/**/read_ahead_kb r, @{sys}/devices/virtual/block/*/{,**} rw, @{sys}/devices/virtual/block/loop@{int}/uevent rw, diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 0dc816899..78bb73b03 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -122,6 +122,9 @@ # Dbus unique name @{busname}=:1.@{u16} :not.active.yet +# Unix dbus address prefix +@{udbus}=@{hex15} @{hex16} + # Universally unique identifier @{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} diff --git a/docs/development/directives.md b/docs/development/directives.md index 53c7e7dcd..841bc6608 100644 --- a/docs/development/directives.md +++ b/docs/development/directives.md @@ -140,7 +140,7 @@ The `exec` directive is useful to allow executing transitions to a profile witho include capability dac_override, capability kill, - unix (bind) type=stream addr=@@{hex16}/bus/systemd-oomd/bus-api-oom, + unix (bind) type=stream addr=@@{udbus}/bus/systemd-oomd/bus-api-oom, #aa:dbus own bus=system name=org.freedesktop.oom1 /etc/systemd/oomd.conf r, /etc/systemd/oomd.conf.d/{,**} r, diff --git a/tests/bats/homectl.bats b/tests/bats/homectl.bats index 2fee79079..2ce622147 100644 --- a/tests/bats/homectl.bats +++ b/tests/bats/homectl.bats @@ -7,6 +7,7 @@ load common setup_file() { aa_setup + skip } # bats test_tags=homectl diff --git a/tests/bats/snap.bats b/tests/bats/snap.bats index a54dda828..ef6a292da 100644 --- a/tests/bats/snap.bats +++ b/tests/bats/snap.bats @@ -7,7 +7,6 @@ load common setup_file() { aa_setup - skip } # bats test_tags=snap diff --git a/tests/bats/systemd-id128.bats b/tests/bats/systemd-id128.bats index 3b18bd032..9a9def4da 100644 --- a/tests/bats/systemd-id128.bats +++ b/tests/bats/systemd-id128.bats @@ -27,12 +27,6 @@ setup_file() { aa_check } -# bats test_tags=systemd-id128 -@test "systemd-id128: Print the identifier of the current service invocation (this is available in systemd services)" { - systemd-id128 invocation-id - aa_check -} - # bats test_tags=systemd-id128 @test "systemd-id128: Generate a new random identifier and print it as a UUID (five groups of digits separated by hyphens)" { systemd-id128 new --uuid diff --git a/tests/requirements.sh b/tests/requirements.sh index 91adc0031..c12f9249c 100644 --- a/tests/requirements.sh +++ b/tests/requirements.sh @@ -19,7 +19,7 @@ arch) ;; debian | ubuntu | whonix) sudo apt-get install -y \ - cpuid dfc systemd-userdbd + cpuid dfc systemd-userdbd systemd-homed tlp ;; opensuse*) ;; From a1f5640024031c3a9e88d2c22a5ea97dfe78b615 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 19:34:04 +0000 Subject: [PATCH 0454/1455] ci(github): restart some services to ensure they are confined. --- .github/workflows/main.yml | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 59449cb4c..89b0039ac 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,6 +15,7 @@ jobs: build: runs-on: ${{ matrix.os }} + needs: check strategy: matrix: os: @@ -93,19 +94,42 @@ jobs: sudo apt-get install -y \ apparmor-profiles apparmor-utils \ bats bats-support - bash tests/requirements.sh - name: Install apparmor.d run: | - sudo install -Dm0644 tests/github.local /etc/apparmor.d/tunables/global.d/github.local sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true sudo systemctl restart apparmor.service + - name: Restart some services to ensure they are confined + run: | + services=( + containerd cron + dbus docker + ModemManager multipathd + networkd-dispatcher + packagekit polkit + snapd + systemd-journald systemd-hostnamed systemd-logind systemd-networkd + systemd-resolved systemd-udevd + udisks2 + ) + sudo systemctl daemon-reload + for service in "${services[@]}"; do + sudo systemctl restart "$service" || systemctl status "$service.service" || true + done + sudo ps auxZ | grep -v '\[.*\]' + sudo aa-log -s --raw + + - name: Install integration dependencies + run: | + bash tests/requirements.sh + - name: Run the bats integration tests run: | make bats - - name: Show final AppArmor logs + - name: Show final AppArmor logs and processes security context if: always() run: | sudo aa-log -s --raw + sudo ps auxZ | grep -v '\[.*\]' From 5bf8d362faea2edd18542f2b814bccea2eb40068 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 19:49:22 +0000 Subject: [PATCH 0455/1455] fix(profile): minor improvment to ensure tests passes. --- apparmor.d/groups/apt/apt | 4 +++- apparmor.d/groups/apt/apt-methods-file | 3 ++- apparmor.d/groups/apt/apt-methods-mirror | 1 + apparmor.d/groups/bus/dbus-system | 3 +++ apparmor.d/profiles-a-f/apparmor_parser | 1 + 5 files changed, 10 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index eb94791d7..369dd3bbd 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -34,7 +34,9 @@ profile apt @{exec_path} flags=(attach_disconnected) { signal (send) peer=apt-methods-*, - unix (bind) type=stream addr=@@{udbus}/bus/apt/system, + unix bind type=stream addr=@@{udbus}/bus/apt-get/system, + unix bind type=stream addr=@@{udbus}/bus/apt/system, + unix (send, receive) type=stream peer=(label=apt-esm-json-hook), unix (send, receive) type=stream peer=(label=snapd), diff --git a/apparmor.d/groups/apt/apt-methods-file b/apparmor.d/groups/apt/apt-methods-file index 6d3e9d408..3c2489a32 100644 --- a/apparmor.d/groups/apt/apt-methods-file +++ b/apparmor.d/groups/apt/apt-methods-file @@ -30,8 +30,9 @@ profile apt-methods-file @{exec_path} { @{lib}/apt/apt-helper rix, - /etc/apt/apt.conf.d/{,*} r, + /etc/apt/apt-mirrors.txt r, /etc/apt/apt.conf r, + /etc/apt/apt.conf.d/{,*} r, /etc/apt/mirrors/* r, /usr/share/dpkg/cputable r, diff --git a/apparmor.d/groups/apt/apt-methods-mirror b/apparmor.d/groups/apt/apt-methods-mirror index 5acecd67a..d8e3adce3 100644 --- a/apparmor.d/groups/apt/apt-methods-mirror +++ b/apparmor.d/groups/apt/apt-methods-mirror @@ -28,6 +28,7 @@ profile apt-methods-mirror @{exec_path} { @{exec_path} mr, + /etc/apt/apt-mirrors.txt r, /etc/apt/mirrors/* r, # For shell pwd diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index e4eef2753..a569a7342 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -34,6 +34,9 @@ profile dbus-system flags=(attach_disconnected) { ptrace (read) peer=@{p_systemd}, #aa:dbus own bus=system name=org.freedesktop.DBus path=/{,org/freedesktop/DBus} + dbus receive bus=system path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + peer=(name=@{busname}), @{exec_path} mrix, diff --git a/apparmor.d/profiles-a-f/apparmor_parser b/apparmor.d/profiles-a-f/apparmor_parser index b2c181042..19c0f6902 100644 --- a/apparmor.d/profiles-a-f/apparmor_parser +++ b/apparmor.d/profiles-a-f/apparmor_parser @@ -45,6 +45,7 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, deny network netlink raw, # file_inherit + deny /apparmor/.null rw, include if exists } From 3c0c68f28f926b8e5ee8c1b3bbdd583b2f462106 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 20:00:04 +0000 Subject: [PATCH 0456/1455] ci(github): split the final step in two. --- .github/workflows/main.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 89b0039ac..c7a76f871 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -128,8 +128,12 @@ jobs: run: | make bats - - name: Show final AppArmor logs and processes security context + - name: Show final AppArmor logs if: always() run: | sudo aa-log -s --raw + + - name: Show final processes security context + if: always() + run: | sudo ps auxZ | grep -v '\[.*\]' From be627e5e9dc4f18c88248a5b35ece21783448106 Mon Sep 17 00:00:00 2001 From: odomingao Date: Mon, 18 Nov 2024 12:27:33 -0300 Subject: [PATCH 0457/1455] Update sysctl --- apparmor.d/profiles-s-z/sysctl | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-s-z/sysctl b/apparmor.d/profiles-s-z/sysctl index 6dd12a023..849aeb687 100644 --- a/apparmor.d/profiles-s-z/sysctl +++ b/apparmor.d/profiles-s-z/sysctl @@ -15,6 +15,7 @@ profile sysctl @{exec_path} { capability net_admin, capability sys_admin, + capability sys_ptrace, capability sys_resource, @{exec_path} mr, From 206bc3473db09e151d083dcf7887cfa1d2c39ff8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 20:44:34 +0000 Subject: [PATCH 0458/1455] fix: missing @{udbus} in unix bind. --- apparmor.d/groups/systemd/hostnamectl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/systemd/hostnamectl b/apparmor.d/groups/systemd/hostnamectl index 2429d235e..3107d2d8e 100644 --- a/apparmor.d/groups/systemd/hostnamectl +++ b/apparmor.d/groups/systemd/hostnamectl @@ -15,7 +15,7 @@ profile hostnamectl @{exec_path} { capability net_admin, - unix bind type=stream addr=@@{hex16}/bus/hostnamectl/system, + unix bind type=stream addr=@@{udbus}/bus/hostnamectl/system, #aa:dbus talk bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed From 7b4e01217b8b46ae1f2170fb5bee68dbd4ee6bee Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 21:13:25 +0000 Subject: [PATCH 0459/1455] tests: cleanup the basic structure of integration tests. --- Makefile | 2 +- tests/bats/aa-enforce.bats | 8 ------ tests/bats/aa-status.bats | 14 ---------- tests/bats/blkid.bats | 8 ------ tests/bats/chsh.bats | 9 ------ tests/bats/common.bash | 12 +++++++- tests/bats/cpuid.bats | 10 ------- tests/bats/df.bats | 14 ---------- tests/bats/dfc.bats | 12 -------- tests/bats/fc-cache.bats | 11 -------- tests/bats/fc-list.bats | 6 ---- tests/bats/flatpak.bats | 18 ------------ tests/bats/gpgconf.bats | 14 ---------- tests/bats/groupadd.bats | 12 -------- tests/bats/groups.bats | 8 ------ tests/bats/homectl.bats | 16 ----------- tests/bats/hostnamectl.bats | 7 ----- tests/bats/id.bats | 15 ---------- tests/bats/ip.bats | 43 +++++++++++++++-------------- tests/bats/lsblk.bats | 20 -------------- tests/bats/lscpu.bats | 10 ------- tests/bats/lspci.bats | 14 ---------- tests/bats/lsusb.bats | 10 ------- tests/bats/ps.bats | 16 ----------- tests/bats/pstree.bats | 10 ------- tests/bats/snap.bats | 18 ------------ tests/bats/sync.bats | 8 ------ tests/bats/systemd-ac-power.bats | 8 ------ tests/bats/systemd-analyze.bats | 11 +------- tests/bats/systemd-cat.bats | 8 ------ tests/bats/systemd-cgls.bats | 10 ------- tests/bats/systemd-detect-virt.bats | 9 +++--- tests/bats/systemd-id128.bats | 12 -------- tests/bats/systemd-sysusers.bats | 10 ------- tests/bats/uname.bats | 20 -------------- tests/bats/upower.bats | 10 ------- tests/bats/uptime.bats | 12 -------- tests/bats/useradd.bats | 17 ------------ tests/bats/userdbctl.bats | 14 ---------- tests/bats/users.bats | 8 ------ tests/bats/uuidd.bats | 11 -------- tests/bats/uuidgen.bats | 9 ------ tests/bats/w.bats | 8 ------ tests/bats/who.bats | 10 ------- tests/cmd/main.go | 7 ++++- tests/cmd/tests.go | 13 +++------ 46 files changed, 50 insertions(+), 502 deletions(-) diff --git a/Makefile b/Makefile index 685649112..b56d69c63 100644 --- a/Makefile +++ b/Makefile @@ -113,7 +113,7 @@ check: .PHONY: bats bats: - @bats --print-output-on-failure tests/bats/ + @bats --pretty --print-output-on-failure tests/bats/ .PHONY: manual manual: diff --git a/tests/bats/aa-enforce.bats b/tests/bats/aa-enforce.bats index 05f311ca1..d6b549b1e 100644 --- a/tests/bats/aa-enforce.bats +++ b/tests/bats/aa-enforce.bats @@ -10,26 +10,18 @@ setup_file() { skip } -# bats test_tags=aa-enforce @test "aa-enforce: Disable profile" { sudo aa-disable pass - aa_check } -# bats test_tags=aa-enforce @test "aa-enforce: Enforce a profile" { sudo aa-enforce pass - aa_check } -# bats test_tags=aa-enforce @test "aa-enforce: Complain a profile" { sudo aa-complain pass - aa_check } -# bats test_tags=aa-enforce @test "aa-enforce: Audit a profile" { sudo aa-audit pass - aa_check } diff --git a/tests/bats/aa-status.bats b/tests/bats/aa-status.bats index 8adcd1580..fbfb6667d 100644 --- a/tests/bats/aa-status.bats +++ b/tests/bats/aa-status.bats @@ -5,36 +5,22 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=aa-status @test "aa-status: Check status" { sudo aa-status - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded policies" { sudo aa-status --profiled - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded enforicing policies" { sudo aa-status --enforced - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded non-enforcing policies" { sudo aa-status --complaining - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded enforcing policies that kill tasks" { sudo aa-status --kill - aa_check } diff --git a/tests/bats/blkid.bats b/tests/bats/blkid.bats index 65160f188..6dcf4b4d7 100644 --- a/tests/bats/blkid.bats +++ b/tests/bats/blkid.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=blkid @test "blkid: List all partitions" { sudo blkid - aa_check } -# bats test_tags=blkid @test "blkid: List all partitions in a table, including current mountpoints" { sudo blkid -o list - aa_check } diff --git a/tests/bats/chsh.bats b/tests/bats/chsh.bats index f66eb1f97..a9f5a6978 100644 --- a/tests/bats/chsh.bats +++ b/tests/bats/chsh.bats @@ -5,24 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=chsh @test "chsh: [l]ist available shells" { chsh --list-shells || true - aa_check } -# bats test_tags=chsh @test "chsh: Set a specific login [s]hell for the current user" { echo "$PASSWORD" | chsh --shell /usr/bin/bash - aa_check } # bats test_tags=chsh @test "chsh: Set a login [s]hell for a specific user" { sudo chsh --shell /usr/bin/sh root - aa_check } diff --git a/tests/bats/common.bash b/tests/bats/common.bash index f99c3c197..556ef871b 100644 --- a/tests/bats/common.bash +++ b/tests/bats/common.bash @@ -105,8 +105,18 @@ aa_check() { now=$(date +%s) duration=$((now - _START + 1)) logs=$(aa-log --raw --systemd --since "-${duration}s") + aa_start if [[ -n "$logs" ]]; then fail "profile $PROGRAM raised logs: $logs" fi - aa_start +} + +# Bats setup and teardown hooks + +setup_file() { + aa_setup +} + +teardown() { + aa_check } diff --git a/tests/bats/cpuid.bats b/tests/bats/cpuid.bats index 1b1226e2b..0fe2da6ac 100644 --- a/tests/bats/cpuid.bats +++ b/tests/bats/cpuid.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=cpuid @test "cpuid: Display information for all CPUs" { cpuid - aa_check } -# bats test_tags=cpuid @test "cpuid: Display information only for the current CPU" { cpuid -1 - aa_check } -# bats test_tags=cpuid @test "cpuid: Display raw hex information with no decoding" { cpuid -r - aa_check } diff --git a/tests/bats/df.bats b/tests/bats/df.bats index ea9d3f44f..a97ad53cb 100644 --- a/tests/bats/df.bats +++ b/tests/bats/df.bats @@ -5,36 +5,22 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=df @test "df: Display all filesystems and their disk usage" { df - aa_check } -# bats test_tags=df @test "df: Display all filesystems and their disk usage in human-readable form" { df -h - aa_check } -# bats test_tags=df @test "df: Display the filesystem and its disk usage containing the given file or directory" { df apparmor.d/ - aa_check } -# bats test_tags=df @test "df: Include statistics on the number of free inodes" { df --inodes - aa_check } -# bats test_tags=df @test "df: Display filesystem types" { df --print-type - aa_check } diff --git a/tests/bats/dfc.bats b/tests/bats/dfc.bats index 8a1d18918..56871f16c 100644 --- a/tests/bats/dfc.bats +++ b/tests/bats/dfc.bats @@ -5,30 +5,18 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=dfc @test "dfc: Display filesystems and their disk usage in human-readable form with colors and graphs" { dfc - aa_check } -# bats test_tags=dfc @test "dfc: Display all filesystems including pseudo, duplicate and inaccessible filesystems" { dfc -a - aa_check } -# bats test_tags=dfc @test "dfc: Display filesystems without color" { dfc -c never - aa_check } -# bats test_tags=dfc @test "dfc: Display filesystems containing "ext" in the filesystem type" { dfc -t ext - aa_check } diff --git a/tests/bats/fc-cache.bats b/tests/bats/fc-cache.bats index 7ad92d94c..05b8f1930 100644 --- a/tests/bats/fc-cache.bats +++ b/tests/bats/fc-cache.bats @@ -5,25 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=fc-cache @test "fc-cache: Generate font cache files" { fc-cache - aa_check } -# bats test_tags=fc-cache @test "fc-cache: Force a rebuild of all font cache files, without checking if cache is up-to-date" { fc-cache -f - aa_check } -# bats test_tags=fc-cache @test "fc-cache: Erase font cache files, then generate new font cache files" { fc-cache -r - aa_check } - diff --git a/tests/bats/fc-list.bats b/tests/bats/fc-list.bats index b85b1037e..52ed43885 100644 --- a/tests/bats/fc-list.bats +++ b/tests/bats/fc-list.bats @@ -5,12 +5,6 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=fc-list @test "fc-list: Return a list of installed fonts in your system" { fc-list - aa_check } diff --git a/tests/bats/flatpak.bats b/tests/bats/flatpak.bats index 23647c932..e549e01ad 100644 --- a/tests/bats/flatpak.bats +++ b/tests/bats/flatpak.bats @@ -5,48 +5,30 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=flatpak @test "flatpak: List installed applications, ignoring runtimes" { flatpak list --app - aa_check } -# bats test_tags=flatpak @test "flatpak: Install an application from a remote source" { flatpak install --noninteractive org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Show information about an installed application" { flatpak info org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Run an installed application" { flatpak run org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Update all installed applications and runtimes" { flatpak update --noninteractive - aa_check } -# bats test_tags=flatpak @test "flatpak: Remove an installed application" { flatpak remove --noninteractive org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Remove all unused applications" { flatpak remove --unused - aa_check } diff --git a/tests/bats/gpgconf.bats b/tests/bats/gpgconf.bats index 7d522d859..7155c5aa9 100644 --- a/tests/bats/gpgconf.bats +++ b/tests/bats/gpgconf.bats @@ -5,44 +5,30 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=gpgconf @test "gpgconf: List all components" { gpgconf --list-components - aa_check } -# bats test_tags=gpgconf @test "gpgconf: List the directories used by gpgconf" { gpgconf --list-dirs - aa_check } -# bats test_tags=gpgconf @test "gpgconf: List all options of a component" { gpgconf --list-options gpg gpgconf --list-options gpgsm gpgconf --list-options gpg-agent gpgconf --list-options scdaemon || true gpgconf --list-options dirmngr - aa_check } -# bats test_tags=gpgconf @test "gpgconf: List programs and test whether they are runnable" { gpgconf --check-programs || true - aa_check } -# bats test_tags=gpgconf @test "gpgconf: Reload a component" { gpgconf --reload gpg gpgconf --reload gpgsm gpgconf --reload gpg-agent gpgconf --reload scdaemon || true gpgconf --reload dirmngr - aa_check } diff --git a/tests/bats/groupadd.bats b/tests/bats/groupadd.bats index f55579591..cbc0aa57e 100644 --- a/tests/bats/groupadd.bats +++ b/tests/bats/groupadd.bats @@ -5,32 +5,20 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=groupadd @test "groupadd: Create a new group" { sudo groupadd user2 - aa_check } -# bats test_tags=groupadd @test "groupadd: Create a new system group" { sudo groupadd --system system2 - aa_check } -# bats test_tags=groupadd @test "groupadd: Create a new group with the specific groupid" { sudo groupadd --gid 3000 user3 - aa_check } -# bats test_tags=groupadd @test "groupdel: Delete newly created group" { sudo groupdel user2 sudo groupdel system2 sudo groupdel user3 - aa_check } diff --git a/tests/bats/groups.bats b/tests/bats/groups.bats index 829e2393f..60bf6ea45 100644 --- a/tests/bats/groups.bats +++ b/tests/bats/groups.bats @@ -5,19 +5,11 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=groups @test "groups: Print group memberships for the current user" { groups - aa_check } -# bats test_tags=groups @test "groups: Print group memberships for a list of users" { groups root - aa_check } diff --git a/tests/bats/homectl.bats b/tests/bats/homectl.bats index 2ce622147..32ff3e575 100644 --- a/tests/bats/homectl.bats +++ b/tests/bats/homectl.bats @@ -10,50 +10,34 @@ setup_file() { skip } -# bats test_tags=homectl @test "homectl: Display help" { homectl --no-pager --help - aa_check } -# bats test_tags=homectl @test "homectl: Create a user account and their associated home directory" { sudo homectl create user2 - aa_check } -# bats test_tags=homectl @test "homectl: List user accounts and their associated home directories" { homectl list - aa_check } -# bats test_tags=homectl @test "homectl: Change the password for a specific user" { sudo homectl passwd user2 - aa_check } -# bats test_tags=homectl @test "homectl: Run a shell or a command with access to a specific home directory" { sudo homectl with user2 -- ls -al /home/user2 - aa_check } -# bats test_tags=homectl @test "homectl: Lock or unlock a specific home directory" { sudo homectl lock user2 - aa_check } -# bats test_tags=homectl @test "homectl: Change the disk space assigned to a specific home directory to 100 GiB" { sudo homectl resize user2 1G - aa_check } -# bats test_tags=homectl @test "homectl: Remove a specific user and the associated home directory" { sudo homectl remove user2 - aa_check } diff --git a/tests/bats/hostnamectl.bats b/tests/bats/hostnamectl.bats index dd4102575..2c15658ad 100644 --- a/tests/bats/hostnamectl.bats +++ b/tests/bats/hostnamectl.bats @@ -5,21 +5,14 @@ load common -setup() { - aa_setup -} - -# bats test_tags=hostnamectl @test "hostnamectl: Get the hostname of the computer" { hostnamectl } -# bats test_tags=hostnamectl @test "hostnamectl: Get the location of the computer" { hostnamectl location } -# bats test_tags=hostnamectl @test "hostnamectl: Set the hostname of the computer" { name=$(hostnamectl hostname) sudo hostnamectl set-hostname "new" diff --git a/tests/bats/id.bats b/tests/bats/id.bats index 5a7b58c50..a09def4a9 100644 --- a/tests/bats/id.bats +++ b/tests/bats/id.bats @@ -5,41 +5,26 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=id @test "id: Display current user's ID (UID), group ID (GID) and groups to which they belong" { id - aa_check } -# bats test_tags=id @test "id: Display the current user identity" { id -un - aa_check } -# bats test_tags=id @test "id: Display the current user identity as a number" { id -u - aa_check } -# bats test_tags=id @test "id: Display the current primary group identity" { id -gn - aa_check } -# bats test_tags=id @test "id: Display the current primary group identity as a number" { id -g - aa_check } -# bats test_tags=id @test "id: Display an arbitrary user ID (UID), group ID (GID) and groups to which they belong" { id root } diff --git a/tests/bats/ip.bats b/tests/bats/ip.bats index 47f16ccde..6d5508c84 100644 --- a/tests/bats/ip.bats +++ b/tests/bats/ip.bats @@ -5,41 +5,42 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=ip -@test "ip: List interfaces with detailed info" { +@test "ip-address: List network interfaces and their associated IP addresses" { ip address - aa_check } -# bats test_tags=ip -@test "ip: List interfaces with brief link layer info" { - ip link - aa_check +@test "ip-address: Filter to show only active network interfaces" { + ip address show up } -# bats test_tags=ip -@test "ip: Display the routing table" { +@test "ip-route: Display the routing table" { ip route - aa_check } -# bats test_tags=ip -@test "ip: Show neighbors (ARP table)" { +@test "ip-route-get: Print route to a destination" { + ip route get 1.1.1.1 +} + +@test "ip link: Show information about all network interfaces" { + ip link +} + +@test "ip neighbour: Display the neighbour/ARP table entries" { ip neighbour - aa_check } -# bats test_tags=ip +@test "ip rule: Display the routing policy" { + ip rule show + ip rule list +} + +@test "ip rule: Flush all deleted rules" { + ip rule flush +} + @test "ip: Manage network namespace" { sudo ip netns add foo sudo ip netns list sudo ip netns exec foo bash -c "pwd" sudo ip netns delete foo - aa_check } - - diff --git a/tests/bats/lsblk.bats b/tests/bats/lsblk.bats index 4fecf42a5..4dc3e20b7 100644 --- a/tests/bats/lsblk.bats +++ b/tests/bats/lsblk.bats @@ -5,54 +5,34 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lsblk @test "lsblk: List all storage devices in a tree-like format" { lsblk - aa_check } -# bats test_tags=lsblk @test "lsblk: Also list empty devices" { lsblk -a - aa_check } -# bats test_tags=lsblk @test "lsblk: Print the SIZE column in bytes rather than in a human-readable format" { lsblk -b - aa_check } -# bats test_tags=lsblk @test "lsblk: Output info about filesystems" { lsblk -f - aa_check } -# bats test_tags=lsblk @test "lsblk: Use ASCII characters for tree formatting" { lsblk -i - aa_check } -# bats test_tags=lsblk @test "lsblk: Output info about block-device topology" { lsblk -t - aa_check } -# bats test_tags=lsblk @test "lsblk: Exclude the devices specified by the comma-separated list of major device numbers" { lsblk -e 1 - aa_check } -# bats test_tags=lsblk @test "lsblk: Display a customized summary using a comma-separated list of columns" { lsblk --output NAME,SERIAL,MODEL,TRAN,TYPE,SIZE,FSTYPE,MOUNTPOINT - aa_check } diff --git a/tests/bats/lscpu.bats b/tests/bats/lscpu.bats index ef09cfbb7..d09599065 100644 --- a/tests/bats/lscpu.bats +++ b/tests/bats/lscpu.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lscpu @test "lscpu: Display information about all CPUs" { lscpu - aa_check } -# bats test_tags=lscpu @test "lscpu: Display information in a table" { lscpu --extended - aa_check } -# bats test_tags=lscpu @test "lscpu: Display only information about offline CPUs in a table" { lscpu --extended --offline - aa_check } diff --git a/tests/bats/lspci.bats b/tests/bats/lspci.bats index bc6ea2013..021906602 100644 --- a/tests/bats/lspci.bats +++ b/tests/bats/lspci.bats @@ -5,36 +5,22 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lspci @test "lspci: Show a brief list of devices" { lspci - aa_check } -# bats test_tags=lspci @test "lspci: Display additional info" { lspci -v - aa_check } -# bats test_tags=lspci @test "lspci: Display drivers and modules handling each device" { lspci -k - aa_check } -# bats test_tags=lspci @test "lspci: Show a specific device" { lspci -s 00:00.0 - aa_check } -# bats test_tags=lspci @test "lspci: Dump info in a readable form" { lspci -vm - aa_check } diff --git a/tests/bats/lsusb.bats b/tests/bats/lsusb.bats index 8f646d89e..f5444fced 100644 --- a/tests/bats/lsusb.bats +++ b/tests/bats/lsusb.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lsusb @test "lsusb: List all the USB devices available" { lsusb || true - aa_check } -# bats test_tags=lsusb @test "lsusb: List the USB hierarchy as a tree" { lsusb -t || true - aa_check } -# bats test_tags=lsusb @test "lsusb: List verbose information about USB devices" { lsusb --verbose || true - aa_check } diff --git a/tests/bats/ps.bats b/tests/bats/ps.bats index 4be301f7b..bcdfbe1b8 100644 --- a/tests/bats/ps.bats +++ b/tests/bats/ps.bats @@ -5,42 +5,26 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=ps @test "ps: List all running processes" { ps aux - aa_check } -# bats test_tags=ps @test "ps: List all running processes including the full command string" { ps auxww - aa_check } -# bats test_tags=ps @test "ps: List all processes of the current user in extra full format" { ps --user "$(id -u)" -F - aa_check } -# bats test_tags=ps @test "ps: List all processes of the current user as a tree" { ps --user "$(id -u)" -f - aa_check } -# bats test_tags=ps @test "ps: Get the parent PID of a process" { ps -o ppid= -p 1 - aa_check } -# bats test_tags=ps @test "ps: Sort processes by memory consumption" { ps auxww --sort size - aa_check } diff --git a/tests/bats/pstree.bats b/tests/bats/pstree.bats index e3ed5fa80..23094478c 100644 --- a/tests/bats/pstree.bats +++ b/tests/bats/pstree.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=pstree @test "pstree: Display a tree of processes" { pstree - aa_check } -# bats test_tags=pstree @test "pstree: Display a tree of processes with PIDs" { pstree -p - aa_check } -# bats test_tags=pstree @test "pstree: Display all process trees rooted at processes owned by specified user" { pstree root - aa_check } diff --git a/tests/bats/snap.bats b/tests/bats/snap.bats index ef6a292da..1eff200a8 100644 --- a/tests/bats/snap.bats +++ b/tests/bats/snap.bats @@ -5,48 +5,30 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=snap @test "snap: Search for a package" { snap find vim - aa_check } -# bats test_tags=snap @test "snap: Install a package" { sudo snap install nano-strict - aa_check } -# bats test_tags=snap @test "snap: Update a package to another channel (track, risk, or branch)" { sudo snap refresh nano-strict --channel=edge - aa_check } -# bats test_tags=snap @test "snap: Update all packages" { sudo snap refresh - aa_check } -# bats test_tags=snap @test "snap: Display basic information about installed snap software" { sudo snap list - aa_check } -# bats test_tags=snap @test "snap: Check for recent snap changes in the system" { sudo snap changes - aa_check } -# bats test_tags=snap @test "snap: Uninstall a package" { sudo snap remove nano-strict - aa_check } diff --git a/tests/bats/sync.bats b/tests/bats/sync.bats index fba657ff7..9f2e26885 100644 --- a/tests/bats/sync.bats +++ b/tests/bats/sync.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=sync @test "sync: Flush all pending write operations on all disks" { sync - aa_check } -# bats test_tags=sync @test "sync: Flush all pending write operations on a single file to disk" { sudo sync / - aa_check } diff --git a/tests/bats/systemd-ac-power.bats b/tests/bats/systemd-ac-power.bats index 78f68d13a..30019825a 100644 --- a/tests/bats/systemd-ac-power.bats +++ b/tests/bats/systemd-ac-power.bats @@ -5,19 +5,11 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-ac-power @test "systemd-ac-power: Report whether we are connected to an external power source." { systemd-ac-power || true - aa_check } -# bats test_tags=systemd-ac-power @test "systemd-ac-power: Check if battery is discharging and low" { systemd-ac-power --low || true - aa_check } diff --git a/tests/bats/systemd-analyze.bats b/tests/bats/systemd-analyze.bats index 3f6144a78..6bb275bb6 100644 --- a/tests/bats/systemd-analyze.bats +++ b/tests/bats/systemd-analyze.bats @@ -5,25 +5,16 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-analyze @test "systemd-analyze: List all running units, ordered by the time they took to initialize" { systemd-analyze --no-pager blame - aa_check } -# bats test_tags=systemd-analyze @test "systemd-analyze: Print a tree of the time-critical chain of units" { systemd-analyze --no-pager critical-chain - aa_check } -# bats test_tags=systemd-analyze @test "systemd-analyze: Show security scores of running units" { systemd-analyze --no-pager security - aa_check } + diff --git a/tests/bats/systemd-cat.bats b/tests/bats/systemd-cat.bats index 595a6002d..da634982a 100644 --- a/tests/bats/systemd-cat.bats +++ b/tests/bats/systemd-cat.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-cat @test "systemd-cat: Write the output of the specified command to the journal (both output streams are captured)" { systemd-cat pwd - aa_check } -# bats test_tags=systemd-cat @test "systemd-cat: Write the output of a pipeline to the journal (`stderr` stays connected to the terminal)" { echo apparmor.d-test-suite | systemd-cat - aa_check } diff --git a/tests/bats/systemd-cgls.bats b/tests/bats/systemd-cgls.bats index b5bb89de6..dca00b62a 100644 --- a/tests/bats/systemd-cgls.bats +++ b/tests/bats/systemd-cgls.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-cgls @test "systemd-cgls: Display the whole control group hierarchy on your system" { systemd-cgls --no-pager - aa_check } -# bats test_tags=systemd-cgls @test "systemd-cgls: Display a control group tree of a specific resource controller" { systemd-cgls --no-pager io - aa_check } -# bats test_tags=systemd-cgls @test "systemd-cgls: Display the control group hierarchy of one or more systemd units" { systemd-cgls --no-pager --unit systemd-logind - aa_check } diff --git a/tests/bats/systemd-detect-virt.bats b/tests/bats/systemd-detect-virt.bats index 0ea5fae35..41150ef7f 100644 --- a/tests/bats/systemd-detect-virt.bats +++ b/tests/bats/systemd-detect-virt.bats @@ -3,23 +3,24 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# bats test_tags=systemd-detect-virt +load common + @test "systemd-detect-virt: List detectable virtualization technologies" { systemd-detect-virt --list } # bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Detect virtualization, print the result and return a zero status code when running in a VM or a container, and a non-zero code otherwise" { - systemd-detect-virt + systemd-detect-virt || true } # bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Silently check without printing anything" { - systemd-detect-virt --quiet + systemd-detect-virt --quiet || true } # bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Only detect hardware virtualization" { - systemd-detect-virt --vm + systemd-detect-virt --vm || true } diff --git a/tests/bats/systemd-id128.bats b/tests/bats/systemd-id128.bats index 9a9def4da..67bf5907d 100644 --- a/tests/bats/systemd-id128.bats +++ b/tests/bats/systemd-id128.bats @@ -5,31 +5,19 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-id128 @test "systemd-id128: Generate a new random identifier" { systemd-id128 new - aa_check } -# bats test_tags=systemd-id128 @test "systemd-id128: Print the identifier of the current machine" { systemd-id128 machine-id - aa_check } -# bats test_tags=systemd-id128 @test "systemd-id128: Print the identifier of the current boot" { systemd-id128 boot-id - aa_check } -# bats test_tags=systemd-id128 @test "systemd-id128: Generate a new random identifier and print it as a UUID (five groups of digits separated by hyphens)" { systemd-id128 new --uuid - aa_check } diff --git a/tests/bats/systemd-sysusers.bats b/tests/bats/systemd-sysusers.bats index f4230d6b6..0816fd45e 100644 --- a/tests/bats/systemd-sysusers.bats +++ b/tests/bats/systemd-sysusers.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-sysusers @test "systemd-sysusers: Print the contents of all configuration files (before each file, its name is printed as a comment)" { systemd-sysusers --cat-config - aa_check } -# bats test_tags=systemd-sysusers @test "systemd-sysusers: Process configuration files and print what would be done without actually doing anything" { systemd-sysusers --dry-run - aa_check } -# bats test_tags=systemd-sysusers @test "systemd-sysusers: Create users and groups from all configuration file" { sudo systemd-sysusers - aa_check } diff --git a/tests/bats/uname.bats b/tests/bats/uname.bats index 683cef111..8723b9fe8 100644 --- a/tests/bats/uname.bats +++ b/tests/bats/uname.bats @@ -5,55 +5,35 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uname @test "uname: Print all information" { uname --all - aa_check } -# bats test_tags=uname @test "uname: Print the current kernel name" { uname --kernel-name - aa_check } -# bats test_tags=uname @test "uname: Print the current network node host name" { uname --nodename - aa_check } -# bats test_tags=uname @test "uname: Print the current kernel release" { uname --kernel-release - aa_check } -# bats test_tags=uname @test "uname: Print the current kernel version" { uname --kernel-version - aa_check } -# bats test_tags=uname @test "uname: Print the current machine hardware name" { uname --machine - aa_check } -# bats test_tags=uname @test "uname: Print the current processor type" { uname --processor - aa_check } -# bats test_tags=uname @test "uname: Print the current operating system name" { uname --operating-system - aa_check } diff --git a/tests/bats/upower.bats b/tests/bats/upower.bats index 73afc18e6..3917621b8 100644 --- a/tests/bats/upower.bats +++ b/tests/bats/upower.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=upower @test "upower: Display power and battery information" { upower --dump - aa_check } -# bats test_tags=upower @test "upower: List all power devices" { upower --enumerate - aa_check } -# bats test_tags=upower @test "upower: Display version" { upower --version - aa_check } diff --git a/tests/bats/uptime.bats b/tests/bats/uptime.bats index 846342f47..7b64e8d2c 100644 --- a/tests/bats/uptime.bats +++ b/tests/bats/uptime.bats @@ -5,31 +5,19 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uptime @test "uptime: Print current time, uptime, number of logged-in users and other information" { uptime - aa_check } -# bats test_tags=uptime @test "uptime: Show only the amount of time the system has been booted for" { uptime --pretty - aa_check } -# bats test_tags=uptime @test "uptime: Print the date and time the system booted up at" { uptime --since - aa_check } -# bats test_tags=uptime @test "uptime: Display version" { uptime --version - aa_check } diff --git a/tests/bats/useradd.bats b/tests/bats/useradd.bats index 833e01606..5ac024f15 100644 --- a/tests/bats/useradd.bats +++ b/tests/bats/useradd.bats @@ -5,45 +5,28 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=useradd @test "useradd: Create a new user with the specified shell" { sudo useradd --shell /bin/bash --create-home user2 - aa_check } -# bats test_tags=useradd @test "useradd: Create a new user with the specified user ID" { sudo useradd --uid 3000 user3 - aa_check } -# bats test_tags=useradd @test "useradd: Create a new user belonging to additional groups (mind the lack of whitespace)" { sudo useradd --groups adm user4 - aa_check } - -# bats test_tags=useradd @test "useradd: Create a new system user without the home directory" { sudo useradd --system sys2 - aa_check } -# bats test_tags=userdel @test "userdel: Remove a user" { sudo userdel user3 sudo userdel user4 sudo userdel sys2 - aa_check } -# bats test_tags=userdel @test "userdel: Remove a user along with the home directory and mail spool" { sudo userdel --remove user2 - aa_check } diff --git a/tests/bats/userdbctl.bats b/tests/bats/userdbctl.bats index 6169de44b..065dba5f5 100644 --- a/tests/bats/userdbctl.bats +++ b/tests/bats/userdbctl.bats @@ -5,37 +5,23 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=userdbctl @test "userdbctl: List all known user records" { userdbctl --no-pager user - aa_check } -# bats test_tags=userdbctl @test "userdbctl: Show details of a specific user" { userdbctl --no-pager user "$USER" - aa_check } -# bats test_tags=userdbctl @test "userdbctl: List all known groups" { userdbctl --no-pager group - aa_check } -# bats test_tags=userdbctl @test "userdbctl: Show details of a specific group" { sudo userdbctl --no-pager group "$USER" - aa_check } -# bats test_tags=userdbctl @test "userdbctl: List all services currently providing user/group definitions to the system" { userdbctl --no-pager services - aa_check } diff --git a/tests/bats/users.bats b/tests/bats/users.bats index 097870abf..8f8ad383d 100644 --- a/tests/bats/users.bats +++ b/tests/bats/users.bats @@ -5,19 +5,11 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=users @test "users: Print logged in usernames" { users - aa_check } -# bats test_tags=users @test "users: Print logged in usernames according to a given file" { users /var/log/wmtp - aa_check } diff --git a/tests/bats/uuidd.bats b/tests/bats/uuidd.bats index e13653e3e..9e3ac5ef0 100644 --- a/tests/bats/uuidd.bats +++ b/tests/bats/uuidd.bats @@ -5,25 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uuidd @test "uuidd: Generate a random UUID" { uuidd --random - aa_check } -# bats test_tags=uuidd @test "uuidd: Generate a bulk number of random UUIDs" { uuidd --random --uuids 10 - aa_check } -# bats test_tags=uuidd @test "uuidd: Generate a time-based UUID, based on the current time and MAC address of the system" { uuidd --time - aa_check } - diff --git a/tests/bats/uuidgen.bats b/tests/bats/uuidgen.bats index 8caa41862..eb6465c04 100644 --- a/tests/bats/uuidgen.bats +++ b/tests/bats/uuidgen.bats @@ -5,19 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uuidgen @test "uuidgen: Create a random UUIDv4" { uuidgen --random - aa_check } -# bats test_tags=uuidgen @test "uuidgen: Create a UUIDv1 based on the current time" { uuidgen --time - aa_check } - diff --git a/tests/bats/w.bats b/tests/bats/w.bats index 7f358aac7..1b97ba445 100644 --- a/tests/bats/w.bats +++ b/tests/bats/w.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=w @test "w: Display information about all users who are currently logged in" { w - aa_check } -# bats test_tags=w @test "w: Display information about a specific user" { w root - aa_check } diff --git a/tests/bats/who.bats b/tests/bats/who.bats index f8aaf5a17..c05995d0e 100644 --- a/tests/bats/who.bats +++ b/tests/bats/who.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=who @test "who: Display the username, line, and time of all currently logged-in sessions" { who - aa_check } -# bats test_tags=who @test "who: Display all available information" { who -a - aa_check } -# bats test_tags=who @test "who: Display all available information with table headers" { who -a -H - aa_check } diff --git a/tests/cmd/main.go b/tests/cmd/main.go index 5ca948196..eb88de1ec 100644 --- a/tests/cmd/main.go +++ b/tests/cmd/main.go @@ -68,7 +68,6 @@ func run() error { if err != nil { return err } - tests = tests.Filter() if err := cfg.BatsDir.RemoveAll(); err != nil { return err @@ -76,6 +75,12 @@ func run() error { if err := cfg.BatsDir.MkdirAll(); err != nil { return err } + if err := cfg.BatsDir.Join("profiled").MkdirAll(); err != nil { + return err + } + if err := cfg.BatsDir.Join("unprofiled").MkdirAll(); err != nil { + return err + } for _, test := range tests { if err := test.Write(cfg.BatsDir); err != nil { return err diff --git a/tests/cmd/tests.go b/tests/cmd/tests.go index 2d37324ea..1c5f55aee 100644 --- a/tests/cmd/tests.go +++ b/tests/cmd/tests.go @@ -20,16 +20,10 @@ const tmplTest = `#!/usr/bin/env bats # SPDX-License-Identifier: GPL-2.0-only load common - -setup_file() { - aa_setup -} {{ $name := .Name -}} {{ range .Commands }} -# bats test_tags={{ $name }} @test "{{ $name }}: {{ .Description }}" { {{ .Cmd }} - aa_check } {{ end }} ` @@ -77,13 +71,14 @@ func (t Test) IsInstalled() bool { } func (t Test) Write(dir *paths.Path) error { + dstDir := dir.Join("profiled") if !t.HasProfile() { - return nil + dstDir = dir.Join("unprofiled") } + path := dstDir.Join(t.Name + ".bats") - path := dir.Join(t.Name + ".bats") if paths.New("tests/bats").Join(t.Name + ".bats").Exist() { - path = dir.Join("00." + t.Name + ".bats") + path = dstDir.Join("00." + t.Name + ".bats") } content := renderBatsFile(t) if err := path.WriteFile([]byte(content)); err != nil { From 5c70c50c26d358f74862f7b0a5460e40e0b596d5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 21:27:04 +0000 Subject: [PATCH 0460/1455] tests: cleanup the basic structure of integration tests. --- tests/bats/aa-enforce.bats | 8 ------ tests/bats/aa-status.bats | 14 ---------- tests/bats/blkid.bats | 8 ------ tests/bats/chsh.bats | 9 ------ tests/bats/common.bash | 12 +++++++- tests/bats/cpuid.bats | 10 ------- tests/bats/df.bats | 14 ---------- tests/bats/dfc.bats | 12 -------- tests/bats/fc-cache.bats | 11 -------- tests/bats/fc-list.bats | 6 ---- tests/bats/flatpak.bats | 18 ------------ tests/bats/gpgconf.bats | 14 ---------- tests/bats/groupadd.bats | 12 -------- tests/bats/groups.bats | 8 ------ tests/bats/homectl.bats | 16 ----------- tests/bats/hostnamectl.bats | 7 ----- tests/bats/id.bats | 15 ---------- tests/bats/ip.bats | 43 +++++++++++++++-------------- tests/bats/lsblk.bats | 20 -------------- tests/bats/lscpu.bats | 10 ------- tests/bats/lspci.bats | 14 ---------- tests/bats/lsusb.bats | 10 ------- tests/bats/ps.bats | 16 ----------- tests/bats/pstree.bats | 10 ------- tests/bats/snap.bats | 18 ------------ tests/bats/sync.bats | 8 ------ tests/bats/systemd-ac-power.bats | 8 ------ tests/bats/systemd-analyze.bats | 11 +------- tests/bats/systemd-cat.bats | 8 ------ tests/bats/systemd-cgls.bats | 10 ------- tests/bats/systemd-detect-virt.bats | 9 +++--- tests/bats/systemd-id128.bats | 12 -------- tests/bats/systemd-sysusers.bats | 10 ------- tests/bats/uname.bats | 20 -------------- tests/bats/upower.bats | 10 ------- tests/bats/uptime.bats | 12 -------- tests/bats/useradd.bats | 17 ------------ tests/bats/userdbctl.bats | 14 ---------- tests/bats/users.bats | 8 ------ tests/bats/uuidd.bats | 11 -------- tests/bats/uuidgen.bats | 9 ------ tests/bats/w.bats | 8 ------ tests/bats/who.bats | 10 ------- tests/cmd/main.go | 7 ++++- tests/cmd/tests.go | 13 +++------ 45 files changed, 49 insertions(+), 501 deletions(-) diff --git a/tests/bats/aa-enforce.bats b/tests/bats/aa-enforce.bats index 05f311ca1..d6b549b1e 100644 --- a/tests/bats/aa-enforce.bats +++ b/tests/bats/aa-enforce.bats @@ -10,26 +10,18 @@ setup_file() { skip } -# bats test_tags=aa-enforce @test "aa-enforce: Disable profile" { sudo aa-disable pass - aa_check } -# bats test_tags=aa-enforce @test "aa-enforce: Enforce a profile" { sudo aa-enforce pass - aa_check } -# bats test_tags=aa-enforce @test "aa-enforce: Complain a profile" { sudo aa-complain pass - aa_check } -# bats test_tags=aa-enforce @test "aa-enforce: Audit a profile" { sudo aa-audit pass - aa_check } diff --git a/tests/bats/aa-status.bats b/tests/bats/aa-status.bats index 8adcd1580..fbfb6667d 100644 --- a/tests/bats/aa-status.bats +++ b/tests/bats/aa-status.bats @@ -5,36 +5,22 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=aa-status @test "aa-status: Check status" { sudo aa-status - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded policies" { sudo aa-status --profiled - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded enforicing policies" { sudo aa-status --enforced - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded non-enforcing policies" { sudo aa-status --complaining - aa_check } -# bats test_tags=aa-status @test "aa-status: Display the number of loaded enforcing policies that kill tasks" { sudo aa-status --kill - aa_check } diff --git a/tests/bats/blkid.bats b/tests/bats/blkid.bats index 65160f188..6dcf4b4d7 100644 --- a/tests/bats/blkid.bats +++ b/tests/bats/blkid.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=blkid @test "blkid: List all partitions" { sudo blkid - aa_check } -# bats test_tags=blkid @test "blkid: List all partitions in a table, including current mountpoints" { sudo blkid -o list - aa_check } diff --git a/tests/bats/chsh.bats b/tests/bats/chsh.bats index f66eb1f97..a9f5a6978 100644 --- a/tests/bats/chsh.bats +++ b/tests/bats/chsh.bats @@ -5,24 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=chsh @test "chsh: [l]ist available shells" { chsh --list-shells || true - aa_check } -# bats test_tags=chsh @test "chsh: Set a specific login [s]hell for the current user" { echo "$PASSWORD" | chsh --shell /usr/bin/bash - aa_check } # bats test_tags=chsh @test "chsh: Set a login [s]hell for a specific user" { sudo chsh --shell /usr/bin/sh root - aa_check } diff --git a/tests/bats/common.bash b/tests/bats/common.bash index f99c3c197..556ef871b 100644 --- a/tests/bats/common.bash +++ b/tests/bats/common.bash @@ -105,8 +105,18 @@ aa_check() { now=$(date +%s) duration=$((now - _START + 1)) logs=$(aa-log --raw --systemd --since "-${duration}s") + aa_start if [[ -n "$logs" ]]; then fail "profile $PROGRAM raised logs: $logs" fi - aa_start +} + +# Bats setup and teardown hooks + +setup_file() { + aa_setup +} + +teardown() { + aa_check } diff --git a/tests/bats/cpuid.bats b/tests/bats/cpuid.bats index 1b1226e2b..0fe2da6ac 100644 --- a/tests/bats/cpuid.bats +++ b/tests/bats/cpuid.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=cpuid @test "cpuid: Display information for all CPUs" { cpuid - aa_check } -# bats test_tags=cpuid @test "cpuid: Display information only for the current CPU" { cpuid -1 - aa_check } -# bats test_tags=cpuid @test "cpuid: Display raw hex information with no decoding" { cpuid -r - aa_check } diff --git a/tests/bats/df.bats b/tests/bats/df.bats index ea9d3f44f..a97ad53cb 100644 --- a/tests/bats/df.bats +++ b/tests/bats/df.bats @@ -5,36 +5,22 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=df @test "df: Display all filesystems and their disk usage" { df - aa_check } -# bats test_tags=df @test "df: Display all filesystems and their disk usage in human-readable form" { df -h - aa_check } -# bats test_tags=df @test "df: Display the filesystem and its disk usage containing the given file or directory" { df apparmor.d/ - aa_check } -# bats test_tags=df @test "df: Include statistics on the number of free inodes" { df --inodes - aa_check } -# bats test_tags=df @test "df: Display filesystem types" { df --print-type - aa_check } diff --git a/tests/bats/dfc.bats b/tests/bats/dfc.bats index 8a1d18918..56871f16c 100644 --- a/tests/bats/dfc.bats +++ b/tests/bats/dfc.bats @@ -5,30 +5,18 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=dfc @test "dfc: Display filesystems and their disk usage in human-readable form with colors and graphs" { dfc - aa_check } -# bats test_tags=dfc @test "dfc: Display all filesystems including pseudo, duplicate and inaccessible filesystems" { dfc -a - aa_check } -# bats test_tags=dfc @test "dfc: Display filesystems without color" { dfc -c never - aa_check } -# bats test_tags=dfc @test "dfc: Display filesystems containing "ext" in the filesystem type" { dfc -t ext - aa_check } diff --git a/tests/bats/fc-cache.bats b/tests/bats/fc-cache.bats index 7ad92d94c..05b8f1930 100644 --- a/tests/bats/fc-cache.bats +++ b/tests/bats/fc-cache.bats @@ -5,25 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=fc-cache @test "fc-cache: Generate font cache files" { fc-cache - aa_check } -# bats test_tags=fc-cache @test "fc-cache: Force a rebuild of all font cache files, without checking if cache is up-to-date" { fc-cache -f - aa_check } -# bats test_tags=fc-cache @test "fc-cache: Erase font cache files, then generate new font cache files" { fc-cache -r - aa_check } - diff --git a/tests/bats/fc-list.bats b/tests/bats/fc-list.bats index b85b1037e..52ed43885 100644 --- a/tests/bats/fc-list.bats +++ b/tests/bats/fc-list.bats @@ -5,12 +5,6 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=fc-list @test "fc-list: Return a list of installed fonts in your system" { fc-list - aa_check } diff --git a/tests/bats/flatpak.bats b/tests/bats/flatpak.bats index 23647c932..e549e01ad 100644 --- a/tests/bats/flatpak.bats +++ b/tests/bats/flatpak.bats @@ -5,48 +5,30 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=flatpak @test "flatpak: List installed applications, ignoring runtimes" { flatpak list --app - aa_check } -# bats test_tags=flatpak @test "flatpak: Install an application from a remote source" { flatpak install --noninteractive org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Show information about an installed application" { flatpak info org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Run an installed application" { flatpak run org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Update all installed applications and runtimes" { flatpak update --noninteractive - aa_check } -# bats test_tags=flatpak @test "flatpak: Remove an installed application" { flatpak remove --noninteractive org.vim.Vim - aa_check } -# bats test_tags=flatpak @test "flatpak: Remove all unused applications" { flatpak remove --unused - aa_check } diff --git a/tests/bats/gpgconf.bats b/tests/bats/gpgconf.bats index 7d522d859..7155c5aa9 100644 --- a/tests/bats/gpgconf.bats +++ b/tests/bats/gpgconf.bats @@ -5,44 +5,30 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=gpgconf @test "gpgconf: List all components" { gpgconf --list-components - aa_check } -# bats test_tags=gpgconf @test "gpgconf: List the directories used by gpgconf" { gpgconf --list-dirs - aa_check } -# bats test_tags=gpgconf @test "gpgconf: List all options of a component" { gpgconf --list-options gpg gpgconf --list-options gpgsm gpgconf --list-options gpg-agent gpgconf --list-options scdaemon || true gpgconf --list-options dirmngr - aa_check } -# bats test_tags=gpgconf @test "gpgconf: List programs and test whether they are runnable" { gpgconf --check-programs || true - aa_check } -# bats test_tags=gpgconf @test "gpgconf: Reload a component" { gpgconf --reload gpg gpgconf --reload gpgsm gpgconf --reload gpg-agent gpgconf --reload scdaemon || true gpgconf --reload dirmngr - aa_check } diff --git a/tests/bats/groupadd.bats b/tests/bats/groupadd.bats index f55579591..cbc0aa57e 100644 --- a/tests/bats/groupadd.bats +++ b/tests/bats/groupadd.bats @@ -5,32 +5,20 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=groupadd @test "groupadd: Create a new group" { sudo groupadd user2 - aa_check } -# bats test_tags=groupadd @test "groupadd: Create a new system group" { sudo groupadd --system system2 - aa_check } -# bats test_tags=groupadd @test "groupadd: Create a new group with the specific groupid" { sudo groupadd --gid 3000 user3 - aa_check } -# bats test_tags=groupadd @test "groupdel: Delete newly created group" { sudo groupdel user2 sudo groupdel system2 sudo groupdel user3 - aa_check } diff --git a/tests/bats/groups.bats b/tests/bats/groups.bats index 829e2393f..60bf6ea45 100644 --- a/tests/bats/groups.bats +++ b/tests/bats/groups.bats @@ -5,19 +5,11 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=groups @test "groups: Print group memberships for the current user" { groups - aa_check } -# bats test_tags=groups @test "groups: Print group memberships for a list of users" { groups root - aa_check } diff --git a/tests/bats/homectl.bats b/tests/bats/homectl.bats index 2ce622147..32ff3e575 100644 --- a/tests/bats/homectl.bats +++ b/tests/bats/homectl.bats @@ -10,50 +10,34 @@ setup_file() { skip } -# bats test_tags=homectl @test "homectl: Display help" { homectl --no-pager --help - aa_check } -# bats test_tags=homectl @test "homectl: Create a user account and their associated home directory" { sudo homectl create user2 - aa_check } -# bats test_tags=homectl @test "homectl: List user accounts and their associated home directories" { homectl list - aa_check } -# bats test_tags=homectl @test "homectl: Change the password for a specific user" { sudo homectl passwd user2 - aa_check } -# bats test_tags=homectl @test "homectl: Run a shell or a command with access to a specific home directory" { sudo homectl with user2 -- ls -al /home/user2 - aa_check } -# bats test_tags=homectl @test "homectl: Lock or unlock a specific home directory" { sudo homectl lock user2 - aa_check } -# bats test_tags=homectl @test "homectl: Change the disk space assigned to a specific home directory to 100 GiB" { sudo homectl resize user2 1G - aa_check } -# bats test_tags=homectl @test "homectl: Remove a specific user and the associated home directory" { sudo homectl remove user2 - aa_check } diff --git a/tests/bats/hostnamectl.bats b/tests/bats/hostnamectl.bats index dd4102575..2c15658ad 100644 --- a/tests/bats/hostnamectl.bats +++ b/tests/bats/hostnamectl.bats @@ -5,21 +5,14 @@ load common -setup() { - aa_setup -} - -# bats test_tags=hostnamectl @test "hostnamectl: Get the hostname of the computer" { hostnamectl } -# bats test_tags=hostnamectl @test "hostnamectl: Get the location of the computer" { hostnamectl location } -# bats test_tags=hostnamectl @test "hostnamectl: Set the hostname of the computer" { name=$(hostnamectl hostname) sudo hostnamectl set-hostname "new" diff --git a/tests/bats/id.bats b/tests/bats/id.bats index 5a7b58c50..a09def4a9 100644 --- a/tests/bats/id.bats +++ b/tests/bats/id.bats @@ -5,41 +5,26 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=id @test "id: Display current user's ID (UID), group ID (GID) and groups to which they belong" { id - aa_check } -# bats test_tags=id @test "id: Display the current user identity" { id -un - aa_check } -# bats test_tags=id @test "id: Display the current user identity as a number" { id -u - aa_check } -# bats test_tags=id @test "id: Display the current primary group identity" { id -gn - aa_check } -# bats test_tags=id @test "id: Display the current primary group identity as a number" { id -g - aa_check } -# bats test_tags=id @test "id: Display an arbitrary user ID (UID), group ID (GID) and groups to which they belong" { id root } diff --git a/tests/bats/ip.bats b/tests/bats/ip.bats index 47f16ccde..6d5508c84 100644 --- a/tests/bats/ip.bats +++ b/tests/bats/ip.bats @@ -5,41 +5,42 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=ip -@test "ip: List interfaces with detailed info" { +@test "ip-address: List network interfaces and their associated IP addresses" { ip address - aa_check } -# bats test_tags=ip -@test "ip: List interfaces with brief link layer info" { - ip link - aa_check +@test "ip-address: Filter to show only active network interfaces" { + ip address show up } -# bats test_tags=ip -@test "ip: Display the routing table" { +@test "ip-route: Display the routing table" { ip route - aa_check } -# bats test_tags=ip -@test "ip: Show neighbors (ARP table)" { +@test "ip-route-get: Print route to a destination" { + ip route get 1.1.1.1 +} + +@test "ip link: Show information about all network interfaces" { + ip link +} + +@test "ip neighbour: Display the neighbour/ARP table entries" { ip neighbour - aa_check } -# bats test_tags=ip +@test "ip rule: Display the routing policy" { + ip rule show + ip rule list +} + +@test "ip rule: Flush all deleted rules" { + ip rule flush +} + @test "ip: Manage network namespace" { sudo ip netns add foo sudo ip netns list sudo ip netns exec foo bash -c "pwd" sudo ip netns delete foo - aa_check } - - diff --git a/tests/bats/lsblk.bats b/tests/bats/lsblk.bats index 4fecf42a5..4dc3e20b7 100644 --- a/tests/bats/lsblk.bats +++ b/tests/bats/lsblk.bats @@ -5,54 +5,34 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lsblk @test "lsblk: List all storage devices in a tree-like format" { lsblk - aa_check } -# bats test_tags=lsblk @test "lsblk: Also list empty devices" { lsblk -a - aa_check } -# bats test_tags=lsblk @test "lsblk: Print the SIZE column in bytes rather than in a human-readable format" { lsblk -b - aa_check } -# bats test_tags=lsblk @test "lsblk: Output info about filesystems" { lsblk -f - aa_check } -# bats test_tags=lsblk @test "lsblk: Use ASCII characters for tree formatting" { lsblk -i - aa_check } -# bats test_tags=lsblk @test "lsblk: Output info about block-device topology" { lsblk -t - aa_check } -# bats test_tags=lsblk @test "lsblk: Exclude the devices specified by the comma-separated list of major device numbers" { lsblk -e 1 - aa_check } -# bats test_tags=lsblk @test "lsblk: Display a customized summary using a comma-separated list of columns" { lsblk --output NAME,SERIAL,MODEL,TRAN,TYPE,SIZE,FSTYPE,MOUNTPOINT - aa_check } diff --git a/tests/bats/lscpu.bats b/tests/bats/lscpu.bats index ef09cfbb7..d09599065 100644 --- a/tests/bats/lscpu.bats +++ b/tests/bats/lscpu.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lscpu @test "lscpu: Display information about all CPUs" { lscpu - aa_check } -# bats test_tags=lscpu @test "lscpu: Display information in a table" { lscpu --extended - aa_check } -# bats test_tags=lscpu @test "lscpu: Display only information about offline CPUs in a table" { lscpu --extended --offline - aa_check } diff --git a/tests/bats/lspci.bats b/tests/bats/lspci.bats index bc6ea2013..021906602 100644 --- a/tests/bats/lspci.bats +++ b/tests/bats/lspci.bats @@ -5,36 +5,22 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lspci @test "lspci: Show a brief list of devices" { lspci - aa_check } -# bats test_tags=lspci @test "lspci: Display additional info" { lspci -v - aa_check } -# bats test_tags=lspci @test "lspci: Display drivers and modules handling each device" { lspci -k - aa_check } -# bats test_tags=lspci @test "lspci: Show a specific device" { lspci -s 00:00.0 - aa_check } -# bats test_tags=lspci @test "lspci: Dump info in a readable form" { lspci -vm - aa_check } diff --git a/tests/bats/lsusb.bats b/tests/bats/lsusb.bats index 8f646d89e..f5444fced 100644 --- a/tests/bats/lsusb.bats +++ b/tests/bats/lsusb.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=lsusb @test "lsusb: List all the USB devices available" { lsusb || true - aa_check } -# bats test_tags=lsusb @test "lsusb: List the USB hierarchy as a tree" { lsusb -t || true - aa_check } -# bats test_tags=lsusb @test "lsusb: List verbose information about USB devices" { lsusb --verbose || true - aa_check } diff --git a/tests/bats/ps.bats b/tests/bats/ps.bats index 4be301f7b..bcdfbe1b8 100644 --- a/tests/bats/ps.bats +++ b/tests/bats/ps.bats @@ -5,42 +5,26 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=ps @test "ps: List all running processes" { ps aux - aa_check } -# bats test_tags=ps @test "ps: List all running processes including the full command string" { ps auxww - aa_check } -# bats test_tags=ps @test "ps: List all processes of the current user in extra full format" { ps --user "$(id -u)" -F - aa_check } -# bats test_tags=ps @test "ps: List all processes of the current user as a tree" { ps --user "$(id -u)" -f - aa_check } -# bats test_tags=ps @test "ps: Get the parent PID of a process" { ps -o ppid= -p 1 - aa_check } -# bats test_tags=ps @test "ps: Sort processes by memory consumption" { ps auxww --sort size - aa_check } diff --git a/tests/bats/pstree.bats b/tests/bats/pstree.bats index e3ed5fa80..23094478c 100644 --- a/tests/bats/pstree.bats +++ b/tests/bats/pstree.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=pstree @test "pstree: Display a tree of processes" { pstree - aa_check } -# bats test_tags=pstree @test "pstree: Display a tree of processes with PIDs" { pstree -p - aa_check } -# bats test_tags=pstree @test "pstree: Display all process trees rooted at processes owned by specified user" { pstree root - aa_check } diff --git a/tests/bats/snap.bats b/tests/bats/snap.bats index ef6a292da..1eff200a8 100644 --- a/tests/bats/snap.bats +++ b/tests/bats/snap.bats @@ -5,48 +5,30 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=snap @test "snap: Search for a package" { snap find vim - aa_check } -# bats test_tags=snap @test "snap: Install a package" { sudo snap install nano-strict - aa_check } -# bats test_tags=snap @test "snap: Update a package to another channel (track, risk, or branch)" { sudo snap refresh nano-strict --channel=edge - aa_check } -# bats test_tags=snap @test "snap: Update all packages" { sudo snap refresh - aa_check } -# bats test_tags=snap @test "snap: Display basic information about installed snap software" { sudo snap list - aa_check } -# bats test_tags=snap @test "snap: Check for recent snap changes in the system" { sudo snap changes - aa_check } -# bats test_tags=snap @test "snap: Uninstall a package" { sudo snap remove nano-strict - aa_check } diff --git a/tests/bats/sync.bats b/tests/bats/sync.bats index fba657ff7..9f2e26885 100644 --- a/tests/bats/sync.bats +++ b/tests/bats/sync.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=sync @test "sync: Flush all pending write operations on all disks" { sync - aa_check } -# bats test_tags=sync @test "sync: Flush all pending write operations on a single file to disk" { sudo sync / - aa_check } diff --git a/tests/bats/systemd-ac-power.bats b/tests/bats/systemd-ac-power.bats index 78f68d13a..30019825a 100644 --- a/tests/bats/systemd-ac-power.bats +++ b/tests/bats/systemd-ac-power.bats @@ -5,19 +5,11 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-ac-power @test "systemd-ac-power: Report whether we are connected to an external power source." { systemd-ac-power || true - aa_check } -# bats test_tags=systemd-ac-power @test "systemd-ac-power: Check if battery is discharging and low" { systemd-ac-power --low || true - aa_check } diff --git a/tests/bats/systemd-analyze.bats b/tests/bats/systemd-analyze.bats index 3f6144a78..6bb275bb6 100644 --- a/tests/bats/systemd-analyze.bats +++ b/tests/bats/systemd-analyze.bats @@ -5,25 +5,16 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-analyze @test "systemd-analyze: List all running units, ordered by the time they took to initialize" { systemd-analyze --no-pager blame - aa_check } -# bats test_tags=systemd-analyze @test "systemd-analyze: Print a tree of the time-critical chain of units" { systemd-analyze --no-pager critical-chain - aa_check } -# bats test_tags=systemd-analyze @test "systemd-analyze: Show security scores of running units" { systemd-analyze --no-pager security - aa_check } + diff --git a/tests/bats/systemd-cat.bats b/tests/bats/systemd-cat.bats index 595a6002d..da634982a 100644 --- a/tests/bats/systemd-cat.bats +++ b/tests/bats/systemd-cat.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-cat @test "systemd-cat: Write the output of the specified command to the journal (both output streams are captured)" { systemd-cat pwd - aa_check } -# bats test_tags=systemd-cat @test "systemd-cat: Write the output of a pipeline to the journal (`stderr` stays connected to the terminal)" { echo apparmor.d-test-suite | systemd-cat - aa_check } diff --git a/tests/bats/systemd-cgls.bats b/tests/bats/systemd-cgls.bats index b5bb89de6..dca00b62a 100644 --- a/tests/bats/systemd-cgls.bats +++ b/tests/bats/systemd-cgls.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-cgls @test "systemd-cgls: Display the whole control group hierarchy on your system" { systemd-cgls --no-pager - aa_check } -# bats test_tags=systemd-cgls @test "systemd-cgls: Display a control group tree of a specific resource controller" { systemd-cgls --no-pager io - aa_check } -# bats test_tags=systemd-cgls @test "systemd-cgls: Display the control group hierarchy of one or more systemd units" { systemd-cgls --no-pager --unit systemd-logind - aa_check } diff --git a/tests/bats/systemd-detect-virt.bats b/tests/bats/systemd-detect-virt.bats index 0ea5fae35..41150ef7f 100644 --- a/tests/bats/systemd-detect-virt.bats +++ b/tests/bats/systemd-detect-virt.bats @@ -3,23 +3,24 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# bats test_tags=systemd-detect-virt +load common + @test "systemd-detect-virt: List detectable virtualization technologies" { systemd-detect-virt --list } # bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Detect virtualization, print the result and return a zero status code when running in a VM or a container, and a non-zero code otherwise" { - systemd-detect-virt + systemd-detect-virt || true } # bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Silently check without printing anything" { - systemd-detect-virt --quiet + systemd-detect-virt --quiet || true } # bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Only detect hardware virtualization" { - systemd-detect-virt --vm + systemd-detect-virt --vm || true } diff --git a/tests/bats/systemd-id128.bats b/tests/bats/systemd-id128.bats index 9a9def4da..67bf5907d 100644 --- a/tests/bats/systemd-id128.bats +++ b/tests/bats/systemd-id128.bats @@ -5,31 +5,19 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-id128 @test "systemd-id128: Generate a new random identifier" { systemd-id128 new - aa_check } -# bats test_tags=systemd-id128 @test "systemd-id128: Print the identifier of the current machine" { systemd-id128 machine-id - aa_check } -# bats test_tags=systemd-id128 @test "systemd-id128: Print the identifier of the current boot" { systemd-id128 boot-id - aa_check } -# bats test_tags=systemd-id128 @test "systemd-id128: Generate a new random identifier and print it as a UUID (five groups of digits separated by hyphens)" { systemd-id128 new --uuid - aa_check } diff --git a/tests/bats/systemd-sysusers.bats b/tests/bats/systemd-sysusers.bats index f4230d6b6..0816fd45e 100644 --- a/tests/bats/systemd-sysusers.bats +++ b/tests/bats/systemd-sysusers.bats @@ -5,24 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=systemd-sysusers @test "systemd-sysusers: Print the contents of all configuration files (before each file, its name is printed as a comment)" { systemd-sysusers --cat-config - aa_check } -# bats test_tags=systemd-sysusers @test "systemd-sysusers: Process configuration files and print what would be done without actually doing anything" { systemd-sysusers --dry-run - aa_check } -# bats test_tags=systemd-sysusers @test "systemd-sysusers: Create users and groups from all configuration file" { sudo systemd-sysusers - aa_check } diff --git a/tests/bats/uname.bats b/tests/bats/uname.bats index 683cef111..8723b9fe8 100644 --- a/tests/bats/uname.bats +++ b/tests/bats/uname.bats @@ -5,55 +5,35 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uname @test "uname: Print all information" { uname --all - aa_check } -# bats test_tags=uname @test "uname: Print the current kernel name" { uname --kernel-name - aa_check } -# bats test_tags=uname @test "uname: Print the current network node host name" { uname --nodename - aa_check } -# bats test_tags=uname @test "uname: Print the current kernel release" { uname --kernel-release - aa_check } -# bats test_tags=uname @test "uname: Print the current kernel version" { uname --kernel-version - aa_check } -# bats test_tags=uname @test "uname: Print the current machine hardware name" { uname --machine - aa_check } -# bats test_tags=uname @test "uname: Print the current processor type" { uname --processor - aa_check } -# bats test_tags=uname @test "uname: Print the current operating system name" { uname --operating-system - aa_check } diff --git a/tests/bats/upower.bats b/tests/bats/upower.bats index 73afc18e6..3917621b8 100644 --- a/tests/bats/upower.bats +++ b/tests/bats/upower.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=upower @test "upower: Display power and battery information" { upower --dump - aa_check } -# bats test_tags=upower @test "upower: List all power devices" { upower --enumerate - aa_check } -# bats test_tags=upower @test "upower: Display version" { upower --version - aa_check } diff --git a/tests/bats/uptime.bats b/tests/bats/uptime.bats index 846342f47..7b64e8d2c 100644 --- a/tests/bats/uptime.bats +++ b/tests/bats/uptime.bats @@ -5,31 +5,19 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uptime @test "uptime: Print current time, uptime, number of logged-in users and other information" { uptime - aa_check } -# bats test_tags=uptime @test "uptime: Show only the amount of time the system has been booted for" { uptime --pretty - aa_check } -# bats test_tags=uptime @test "uptime: Print the date and time the system booted up at" { uptime --since - aa_check } -# bats test_tags=uptime @test "uptime: Display version" { uptime --version - aa_check } diff --git a/tests/bats/useradd.bats b/tests/bats/useradd.bats index 833e01606..5ac024f15 100644 --- a/tests/bats/useradd.bats +++ b/tests/bats/useradd.bats @@ -5,45 +5,28 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=useradd @test "useradd: Create a new user with the specified shell" { sudo useradd --shell /bin/bash --create-home user2 - aa_check } -# bats test_tags=useradd @test "useradd: Create a new user with the specified user ID" { sudo useradd --uid 3000 user3 - aa_check } -# bats test_tags=useradd @test "useradd: Create a new user belonging to additional groups (mind the lack of whitespace)" { sudo useradd --groups adm user4 - aa_check } - -# bats test_tags=useradd @test "useradd: Create a new system user without the home directory" { sudo useradd --system sys2 - aa_check } -# bats test_tags=userdel @test "userdel: Remove a user" { sudo userdel user3 sudo userdel user4 sudo userdel sys2 - aa_check } -# bats test_tags=userdel @test "userdel: Remove a user along with the home directory and mail spool" { sudo userdel --remove user2 - aa_check } diff --git a/tests/bats/userdbctl.bats b/tests/bats/userdbctl.bats index 6169de44b..065dba5f5 100644 --- a/tests/bats/userdbctl.bats +++ b/tests/bats/userdbctl.bats @@ -5,37 +5,23 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=userdbctl @test "userdbctl: List all known user records" { userdbctl --no-pager user - aa_check } -# bats test_tags=userdbctl @test "userdbctl: Show details of a specific user" { userdbctl --no-pager user "$USER" - aa_check } -# bats test_tags=userdbctl @test "userdbctl: List all known groups" { userdbctl --no-pager group - aa_check } -# bats test_tags=userdbctl @test "userdbctl: Show details of a specific group" { sudo userdbctl --no-pager group "$USER" - aa_check } -# bats test_tags=userdbctl @test "userdbctl: List all services currently providing user/group definitions to the system" { userdbctl --no-pager services - aa_check } diff --git a/tests/bats/users.bats b/tests/bats/users.bats index 097870abf..8f8ad383d 100644 --- a/tests/bats/users.bats +++ b/tests/bats/users.bats @@ -5,19 +5,11 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=users @test "users: Print logged in usernames" { users - aa_check } -# bats test_tags=users @test "users: Print logged in usernames according to a given file" { users /var/log/wmtp - aa_check } diff --git a/tests/bats/uuidd.bats b/tests/bats/uuidd.bats index e13653e3e..9e3ac5ef0 100644 --- a/tests/bats/uuidd.bats +++ b/tests/bats/uuidd.bats @@ -5,25 +5,14 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uuidd @test "uuidd: Generate a random UUID" { uuidd --random - aa_check } -# bats test_tags=uuidd @test "uuidd: Generate a bulk number of random UUIDs" { uuidd --random --uuids 10 - aa_check } -# bats test_tags=uuidd @test "uuidd: Generate a time-based UUID, based on the current time and MAC address of the system" { uuidd --time - aa_check } - diff --git a/tests/bats/uuidgen.bats b/tests/bats/uuidgen.bats index 8caa41862..eb6465c04 100644 --- a/tests/bats/uuidgen.bats +++ b/tests/bats/uuidgen.bats @@ -5,19 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=uuidgen @test "uuidgen: Create a random UUIDv4" { uuidgen --random - aa_check } -# bats test_tags=uuidgen @test "uuidgen: Create a UUIDv1 based on the current time" { uuidgen --time - aa_check } - diff --git a/tests/bats/w.bats b/tests/bats/w.bats index 7f358aac7..1b97ba445 100644 --- a/tests/bats/w.bats +++ b/tests/bats/w.bats @@ -5,18 +5,10 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=w @test "w: Display information about all users who are currently logged in" { w - aa_check } -# bats test_tags=w @test "w: Display information about a specific user" { w root - aa_check } diff --git a/tests/bats/who.bats b/tests/bats/who.bats index f8aaf5a17..c05995d0e 100644 --- a/tests/bats/who.bats +++ b/tests/bats/who.bats @@ -5,25 +5,15 @@ load common -setup_file() { - aa_setup -} - -# bats test_tags=who @test "who: Display the username, line, and time of all currently logged-in sessions" { who - aa_check } -# bats test_tags=who @test "who: Display all available information" { who -a - aa_check } -# bats test_tags=who @test "who: Display all available information with table headers" { who -a -H - aa_check } diff --git a/tests/cmd/main.go b/tests/cmd/main.go index 5ca948196..eb88de1ec 100644 --- a/tests/cmd/main.go +++ b/tests/cmd/main.go @@ -68,7 +68,6 @@ func run() error { if err != nil { return err } - tests = tests.Filter() if err := cfg.BatsDir.RemoveAll(); err != nil { return err @@ -76,6 +75,12 @@ func run() error { if err := cfg.BatsDir.MkdirAll(); err != nil { return err } + if err := cfg.BatsDir.Join("profiled").MkdirAll(); err != nil { + return err + } + if err := cfg.BatsDir.Join("unprofiled").MkdirAll(); err != nil { + return err + } for _, test := range tests { if err := test.Write(cfg.BatsDir); err != nil { return err diff --git a/tests/cmd/tests.go b/tests/cmd/tests.go index 2d37324ea..1c5f55aee 100644 --- a/tests/cmd/tests.go +++ b/tests/cmd/tests.go @@ -20,16 +20,10 @@ const tmplTest = `#!/usr/bin/env bats # SPDX-License-Identifier: GPL-2.0-only load common - -setup_file() { - aa_setup -} {{ $name := .Name -}} {{ range .Commands }} -# bats test_tags={{ $name }} @test "{{ $name }}: {{ .Description }}" { {{ .Cmd }} - aa_check } {{ end }} ` @@ -77,13 +71,14 @@ func (t Test) IsInstalled() bool { } func (t Test) Write(dir *paths.Path) error { + dstDir := dir.Join("profiled") if !t.HasProfile() { - return nil + dstDir = dir.Join("unprofiled") } + path := dstDir.Join(t.Name + ".bats") - path := dir.Join(t.Name + ".bats") if paths.New("tests/bats").Join(t.Name + ".bats").Exist() { - path = dir.Join("00." + t.Name + ".bats") + path = dstDir.Join("00." + t.Name + ".bats") } content := renderBatsFile(t) if err := path.WriteFile([]byte(content)); err != nil { From 4656a4933582bed15c5945e2694b95368feb4fe8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 21:35:39 +0000 Subject: [PATCH 0461/1455] fix(ci): remove forced color from github action. --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index b56d69c63..911bd4027 100644 --- a/Makefile +++ b/Makefile @@ -113,7 +113,7 @@ check: .PHONY: bats bats: - @bats --pretty --print-output-on-failure tests/bats/ + @bats --timing --print-output-on-failure tests/bats/ .PHONY: manual manual: From 3eba6bef6d1ca65cac30393c435396d85990a077 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 21:49:03 +0000 Subject: [PATCH 0462/1455] fix(tests): missing sudo in ip integration test. --- tests/bats/ip.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/bats/ip.bats b/tests/bats/ip.bats index 6d5508c84..163213fa3 100644 --- a/tests/bats/ip.bats +++ b/tests/bats/ip.bats @@ -35,7 +35,7 @@ load common } @test "ip rule: Flush all deleted rules" { - ip rule flush + sudo ip rule flush } @test "ip: Manage network namespace" { From e149e7753871350d561b68c9fe19ee94455fe53e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 21:52:12 +0000 Subject: [PATCH 0463/1455] fix(profile): dhcpcd executes resolvconf fix #608 --- apparmor.d/groups/network/dhcpcd | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/network/dhcpcd b/apparmor.d/groups/network/dhcpcd index ebb861971..c1b5d04c5 100644 --- a/apparmor.d/groups/network/dhcpcd +++ b/apparmor.d/groups/network/dhcpcd @@ -35,6 +35,7 @@ profile dhcpcd @{exec_path} flags=(attach_disconnected) { @{bin}/chmod rix, @{bin}/cmp rix, @{bin}/mkdir rix, + @{bin}/resolvconf rPx, @{bin}/rm rix, @{bin}/sed rix, @{lib}/dhcpcd/dhcpcd-run-hooks rix, From 688317fbe320ab9634e87af7be0b47ee2ba7bd15 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 21:57:54 +0000 Subject: [PATCH 0464/1455] feat(abs): vulkan allow write access to builtin_shaders. See #577 --- apparmor.d/abstractions/vulkan-strict | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/vulkan-strict b/apparmor.d/abstractions/vulkan-strict index edb258288..d4dd2fae6 100644 --- a/apparmor.d/abstractions/vulkan-strict +++ b/apparmor.d/abstractions/vulkan-strict @@ -19,6 +19,7 @@ owner @{user_cache_dirs}/gtk-4.0/vulkan-pipeline-cache/.goutputstream-@{rand6} rw, owner @{user_cache_dirs}/gtk-4.0/vulkan-pipeline-cache/@{uuid}.@{int} rw, owner @{user_cache_dirs}/radv_builtin_shaders{32,64} r, # Vulkan radv shaders cache + owner @{user_cache_dirs}/radv_builtin_shaders{32,64}@{rand6} w, owner @{user_share_dirs}/vulkan/ rw, owner @{user_share_dirs}/vulkan/implicit_layer.d/ rw, From a61460b60cdd84f380ef2c90ddd5b567d4d5da35 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 22:16:18 +0000 Subject: [PATCH 0465/1455] feat(abs): add the wine abstraction. --- apparmor.d/abstractions/wine | 20 ++++++++++++++++++++ apparmor.d/profiles-s-z/steam-game-proton | 9 +-------- 2 files changed, 21 insertions(+), 8 deletions(-) create mode 100644 apparmor.d/abstractions/wine diff --git a/apparmor.d/abstractions/wine b/apparmor.d/abstractions/wine new file mode 100644 index 000000000..139b03450 --- /dev/null +++ b/apparmor.d/abstractions/wine @@ -0,0 +1,20 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Basic set of resources for wine regardless of the installation method (system or through a game launcher). + + abi , + + owner @{user_share_dirs}/applications/wine/ rw, + owner @{user_share_dirs}/applications/wine/**/ rw, + + owner @{tmp}/.wine-@{uid}/ rw, + owner @{tmp}/.wine-@{uid}/** rwk, + + owner /dev/shm/wine-@{hex6}-fsync rw, + owner /dev/shm/wine-@{hex6}@{h}-fsync rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton index dfa8b84da..46f296c44 100644 --- a/apparmor.d/profiles-s-z/steam-game-proton +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -18,6 +18,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) { include include include + include capability dac_override, capability dac_read_search, @@ -79,19 +80,11 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) { owner @{share_dirs}/legacycompat/** mr, owner @{share_dirs}/steamapps/compatdata/{,**} rwk, - owner @{user_share_dirs}/applications/wine/ rw, - owner @{user_share_dirs}/applications/wine/**/ rw, - - owner @{tmp}/.wine-@{uid}/ rw, - owner @{tmp}/.wine-@{uid}/** rwk, owner @{tmp}/glx-icds-@{rand6}/{,**} w, owner @{tmp}/pressure-vessel-*-@{rand6}/ rw, owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} w, - owner /dev/shm/wine-@{hex6}-fsync rw, - owner /dev/shm/wine-@{hex6}@{h}-fsync rw, - @{run}/host/fonts/{,**} r, @{run}/host/share/{,**} r, @{run}/host/usr/{,**} r, From df02f7a0fd9275c5710254013e55fcde70b23a55 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 22:58:42 +0000 Subject: [PATCH 0466/1455] tests: remove hanged test --- tests/bats/ip.bats | 4 ---- 1 file changed, 4 deletions(-) diff --git a/tests/bats/ip.bats b/tests/bats/ip.bats index 163213fa3..585d11b2d 100644 --- a/tests/bats/ip.bats +++ b/tests/bats/ip.bats @@ -34,10 +34,6 @@ load common ip rule list } -@test "ip rule: Flush all deleted rules" { - sudo ip rule flush -} - @test "ip: Manage network namespace" { sudo ip netns add foo sudo ip netns list From 815e9bfda2119268165b7a30cf763ae9abf5a65a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 23:07:41 +0000 Subject: [PATCH 0467/1455] feat(profile): general update. --- apparmor.d/abstractions/app/firefox | 2 +- apparmor.d/abstractions/common/bwrap | 7 +++++-- apparmor.d/groups/bus/dbus-accessibility | 4 ++++ apparmor.d/groups/bus/dbus-session | 4 ++++ apparmor.d/groups/bus/dbus-system | 1 + apparmor.d/groups/gnome/gnome-session | 3 +++ apparmor.d/groups/gnome/gnome-shell | 5 ++--- apparmor.d/groups/gnome/loupe | 2 +- .../groups/gnome/org.gnome.NautilusPreviewer | 2 +- apparmor.d/groups/network/networkd-dispatcher | 1 + apparmor.d/groups/pacman/yay | 1 + apparmor.d/profiles-a-f/evince | 2 +- apparmor.d/profiles-m-r/mkinitramfs | 3 ++- apparmor.d/profiles-s-z/snap-seccomp | 2 ++ apparmor.d/profiles-s-z/spotify | 2 ++ apparmor.d/profiles-s-z/steam-game-proton | 1 + apparmor.d/profiles-s-z/tlp | 17 ++++++++++------- 17 files changed, 42 insertions(+), 17 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index c749bf253..87865197e 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -101,7 +101,7 @@ owner @{tmp}/Temp-@{uuid}/ rw, owner @{tmp}/Temp-@{uuid}/* rwk, owner @{tmp}/tmp-*.xpi rw, - owner @{tmp}/tmpaddon r, + owner @{tmp}/tmpaddon rw, owner @{tmp}/tmpaddon-@{int} r, owner /dev/shm/org.chromium.@{rand6} rw, diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index b5b119d0f..65bc2837f 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -44,8 +44,11 @@ owner /tmp/newroot/ w, owner /tmp/oldroot/ w, - @{PROC}/sys/kernel/overflowgid r, - @{PROC}/sys/kernel/overflowuid r, + @{PROC}/sys/kernel/overflowgid r, + @{PROC}/sys/kernel/overflowuid r, + @{PROC}/sys/user/max_user_namespaces r, + owner @{PROC}/@{pid}/fd/ r, + @{att}/@{PROC}/sys/user/max_user_namespaces rw, owner @{att}/@{PROC}/@{pid}/cgroup r, owner @{att}/@{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index 1a4b83e2e..e8f0328a2 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -28,6 +28,10 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=accessibility name=org.freedesktop.DBus #aa:dbus own bus=session name=org.a11y.{B,b}us + dbus receive bus=accessibility path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member=Hello + peer=(name=@{busname}), dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index ecec3cb49..014f7afd4 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -31,6 +31,10 @@ profile dbus-session flags=(attach_disconnected) { signal (send) set=(term hup kill) peer=xdg-*, #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/{d,D}Bus} + dbus receive bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member=Hello + peer=(name=@{busname}), @{exec_path} mrix, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index a569a7342..0296a262f 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -36,6 +36,7 @@ profile dbus-system flags=(attach_disconnected) { #aa:dbus own bus=system name=org.freedesktop.DBus path=/{,org/freedesktop/DBus} dbus receive bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus + member=Hello peer=(name=@{busname}), @{exec_path} mrix, diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index cf17391bc..798868271 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -17,6 +17,7 @@ profile gnome-session @{exec_path} { @{shells_path} rix, @{bin}/cat rix, + @{bin}/find rix, @{bin}/gettext rix, @{bin}/gettext.sh r, @{bin}/grep rix, @@ -32,6 +33,7 @@ profile gnome-session @{exec_path} { @{bin}/tr rix, @{bin}/tty rix, @{bin}/uname rPx, + @{bin}/xargs rix, @{bin}/dpkg-query rpx, @{bin}/flatpak rCx -> flatpak, @@ -57,6 +59,7 @@ profile gnome-session @{exec_path} { /etc/X11/Xsession.d/*im-config_launch r, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/loginuid r, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 7cc739491..f52340d41 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -198,10 +198,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/share/gdm/greeter-dconf-defaults r, /usr/share/gdm/greeter/applications/{,**} r, /usr/share/libgweather/Locations.xml r, - /usr/share/libinput*/ r, - /usr/share/libinput*/{,**/}@{int2}-*.quirks r, - /usr/share/libinput*/libinput/ r, + /usr/share/libinput*/{,**} r, /usr/share/libwacom/{,*.stylus,*.tablet} r, + /usr/share/poppler/{,**} r, /usr/share/wallpapers/** r, /usr/share/wayland-sessions/{,*.desktop} r, /usr/share/xml/iso-codes/{,**} r, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index 10853ea8f..75835395a 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -17,7 +17,7 @@ profile loupe @{exec_path} flags=(attach_disconnected) { include include - signal (send) set=(kill) peer=loupe//bwrap, + signal send set=kill peer=loupe//bwrap, #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index 2d06a9ab3..cdc563e07 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/org.gnome.NautilusPreviewer -profile org.gnome.NautilusPreviewer @{exec_path} { +profile org.gnome.NautilusPreviewer @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/network/networkd-dispatcher b/apparmor.d/groups/network/networkd-dispatcher index de8f9ccb0..632910933 100644 --- a/apparmor.d/groups/network/networkd-dispatcher +++ b/apparmor.d/groups/network/networkd-dispatcher @@ -26,6 +26,7 @@ profile networkd-dispatcher @{exec_path} { @{bin}/sed rix, @{lib}/networkd-dispatcher/routable.d/postfix rix, + @{lib}/NetworkManager/dispatcher.d/@{int}-chrony-onoffline rix, /etc/networkd-dispatcher/{,**} r, diff --git a/apparmor.d/groups/pacman/yay b/apparmor.d/groups/pacman/yay index e101fc06f..52c2de345 100644 --- a/apparmor.d/groups/pacman/yay +++ b/apparmor.d/groups/pacman/yay @@ -84,6 +84,7 @@ profile yay @{exec_path} { @{bin}/gpg{,2} mr, @{bin}/gpg-agent rPx, + @{bin}/dirmngr rPx, owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index 2638ad0e3..5ae754138 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -49,7 +49,7 @@ profile evince @{exec_path} { owner @{user_config_dirs}/evince/{,*} rw, owner @{tmp}/*.pdf r, - owner @{tmp}/evince-*/{,**} rw, + owner @{tmp}/evince-@{int}/{,**} rw, owner @{tmp}/gtkprint* rw, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 774dfa9f8..6585f6382 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -87,10 +87,11 @@ profile mkinitramfs @{exec_path} { /var/tmp/ r, /var/tmp/modules_@{rand6} rw, - /var/tmp/mkinitramfs_@{rand6}/@{lib}/modules/*/modules.{order,builtin} rw, owner /var/tmp/mkinitramfs_@{rand6} rw, + owner /var/tmp/mkinitramfs_@{rand6}/ rw, owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_*/**, owner /var/tmp/mkinitramfs-@{rand6} rw, + owner /var/tmp/mkinitramfs-*_@{rand6} rw, @{sys}/devices/platform/ r, @{sys}/devices/platform/**/ r, diff --git a/apparmor.d/profiles-s-z/snap-seccomp b/apparmor.d/profiles-s-z/snap-seccomp index 235ef2080..6b0917f8a 100644 --- a/apparmor.d/profiles-s-z/snap-seccomp +++ b/apparmor.d/profiles-s-z/snap-seccomp @@ -20,6 +20,8 @@ profile snap-seccomp @{exec_path} { @{lib_dirs}/**.so* mr, + @{bin}/getent rix, + /var/lib/snapd/seccomp/bpf/{,**} rw, owner @{PROC}/@{pids}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 8ccbbf0f1..41219a4f8 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -26,6 +26,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, + @{sh_path} mr, @{bin}/grep rix, @{open_path} rPx -> child-open-strict, @@ -44,6 +45,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw, @{PROC}/pressure/* r, + @{PROC}/@{pid}/net/unix r, owner @{PROC}/@{pid}/clear_refs w, /dev/tty rw, diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton index 46f296c44..ab82925a5 100644 --- a/apparmor.d/profiles-s-z/steam-game-proton +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -76,6 +76,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) { owner @{share_dirs}/*.dll r, owner @{share_dirs}/bin/ r, + owner @{share_dirs}/installscriptevalutor_log.txt rw, owner @{share_dirs}/legacycompat/ r, owner @{share_dirs}/legacycompat/** mr, owner @{share_dirs}/steamapps/compatdata/{,**} rwk, diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index 0378e62fc..153ded880 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -45,7 +45,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{bin}/readlink rix, @{bin}/rm rix, @{bin}/sort rix, - @{bin}/systemctl rCx -> systemctl, + @{bin}/systemctl rCx -> systemctl, @{bin}/touch rix, @{bin}/tr rix, @{bin}/udevadm rCx -> udevadm, @@ -63,30 +63,33 @@ profile tlp @{exec_path} flags=(attach_disconnected) { /var/lib/tlp/{,**} rw, /var/lib/power-profiles-daemon/state.ini rw, + owner /tmp/tlp-run.conf_tmp@{rand6} rw, + owner @{run}/tlp/{,**} rw, owner @{run}/tlp/lock_tlp rwk, @{run}/udev/data/+platform:* r, + @{sys}/bus/pci/devices/ r, + @{sys}/devices/@{pci}/{,**/}power/control w, @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw, - @{sys}/module/pcie_aspm/parameters/policy rw, - @{sys}/module/snd_hda_intel/parameters/power_save rw, - @{sys}/module/snd_hda_intel/parameters/power_save_controller rw, @{sys}/firmware/acpi/platform_profile* rw, @{sys}/firmware/acpi/pm_profile* rw, + @{sys}/module/*/parameters/power_save rw, + @{sys}/module/*/parameters/power_save_controller rw, + @{sys}/module/pcie_aspm/parameters/policy rw, owner @{PROC}/sys/fs/xfs/xfssyncd_centisecs rw, owner @{PROC}/sys/kernel/nmi_watchdog rw, owner @{PROC}/sys/vm/dirty_*_centisecs rw, owner @{PROC}/sys/vm/laptop_mode rw, - /dev/disk/by-id/ r, - /dev/tty rw, - profile systemctl { include include + capability net_admin, + include if exists } From 4a5fa74e6310cb3aec022f6da56a2229ebecfd52 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Nov 2024 23:43:17 +0000 Subject: [PATCH 0468/1455] tests: enable the homectl tests. --- tests/bats/homectl.bats | 5 ----- 1 file changed, 5 deletions(-) diff --git a/tests/bats/homectl.bats b/tests/bats/homectl.bats index 32ff3e575..3d506f67c 100644 --- a/tests/bats/homectl.bats +++ b/tests/bats/homectl.bats @@ -5,11 +5,6 @@ load common -setup_file() { - aa_setup - skip -} - @test "homectl: Display help" { homectl --no-pager --help } From 5ef78b1e6c03a0bddb295d8369dc2eea15adcd5e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 20 Nov 2024 00:08:26 +0000 Subject: [PATCH 0469/1455] tests: add dmesg.bats --- apparmor.d/profiles-a-f/dmesg | 2 +- tests/bats/dmesg.bats | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 tests/bats/dmesg.bats diff --git a/apparmor.d/profiles-a-f/dmesg b/apparmor.d/profiles-a-f/dmesg index 68fa13298..6abc40c37 100644 --- a/apparmor.d/profiles-a-f/dmesg +++ b/apparmor.d/profiles-a-f/dmesg @@ -17,7 +17,7 @@ profile dmesg @{exec_path} { @{exec_path} mr, - @{sh_path} rix, + @{sh_path} rix, @{pager_path} rPx -> child-pager, /usr/share/terminfo/** r, diff --git a/tests/bats/dmesg.bats b/tests/bats/dmesg.bats new file mode 100644 index 000000000..722b3204b --- /dev/null +++ b/tests/bats/dmesg.bats @@ -0,0 +1,30 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +@test "dmesg: Show kernel messages" { + sudo dmesg +} + +@test "dmesg: Show kernel error messages" { + sudo dmesg --level err +} + +@test "dmesg: Show how much physical memory is available on this system" { + sudo dmesg | grep -i memory +} + +@test "dmesg: Show kernel messages with a timestamp (available in kernels 3.5.0 and newer)" { + sudo dmesg -T +} + +@test "dmesg: Show kernel messages in human-readable form (available in kernels 3.5.0 and newer)" { + sudo dmesg -H +} + +@test "dmesg: Colorize output (available in kernels 3.5.0 and newer)" { + sudo dmesg -L +} From edad2e19842e3f74d1f58a724742e01557044e08 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 20 Nov 2024 00:11:57 +0000 Subject: [PATCH 0470/1455] tests: ensure systemd-homed is started before the homectl test. --- tests/bats/homectl.bats | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/bats/homectl.bats b/tests/bats/homectl.bats index 3d506f67c..656a3407b 100644 --- a/tests/bats/homectl.bats +++ b/tests/bats/homectl.bats @@ -5,6 +5,12 @@ load common +setup_file() { + sudo systemctl start systemd-homed + skip + aa_setup +} + @test "homectl: Display help" { homectl --no-pager --help } From 685105a662369df09db9263d28291a529478db1c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 20 Nov 2024 00:12:31 +0000 Subject: [PATCH 0471/1455] tests: add fwupdmgr.bats --- tests/bats/fwupdmgr.bats | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 tests/bats/fwupdmgr.bats diff --git a/tests/bats/fwupdmgr.bats b/tests/bats/fwupdmgr.bats new file mode 100644 index 000000000..2eb8282c9 --- /dev/null +++ b/tests/bats/fwupdmgr.bats @@ -0,0 +1,23 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +@test "fwupdmgr: Display all devices detected by fwupd" { + fwupdmgr get-devices +} + +@test "fwupdmgr: Download the latest firmware metadata from LVFS" { + fwupdmgr refresh +} + +@test "fwupdmgr: List the updates available for devices on your system" { + fwupdmgr get-updates +} + +@test "fwupdmgr: Install firmware updates" { + fwupdmgr update +} + From 2332f71b17cce7550f6d7aa42b805ba0c00a3550 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 20 Nov 2024 00:14:22 +0000 Subject: [PATCH 0472/1455] tests: add groupmod. --- tests/bats/groupadd.bats | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/bats/groupadd.bats b/tests/bats/groupadd.bats index cbc0aa57e..d93b1a690 100644 --- a/tests/bats/groupadd.bats +++ b/tests/bats/groupadd.bats @@ -17,8 +17,16 @@ load common sudo groupadd --gid 3000 user3 } +@test "groupmod: Change the group name" { + sudo groupmod --new-name user22 user2 +} + +@test "groupmod: Change the group ID" { + sudo groupmod --gid 2222 user22 +} + @test "groupdel: Delete newly created group" { - sudo groupdel user2 + sudo groupdel user22 sudo groupdel system2 sudo groupdel user3 } From ffd6ecba5b7383c990dca68dbd877b835f41dc33 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 19:15:56 +0000 Subject: [PATCH 0473/1455] fix(tests): ensure fwupdmgr don't fail even if the target does not support firmware update. --- tests/bats/fwupdmgr.bats | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/bats/fwupdmgr.bats b/tests/bats/fwupdmgr.bats index 2eb8282c9..332a63743 100644 --- a/tests/bats/fwupdmgr.bats +++ b/tests/bats/fwupdmgr.bats @@ -10,14 +10,14 @@ load common } @test "fwupdmgr: Download the latest firmware metadata from LVFS" { - fwupdmgr refresh + fwupdmgr refresh || true } @test "fwupdmgr: List the updates available for devices on your system" { - fwupdmgr get-updates + fwupdmgr get-updates || true } @test "fwupdmgr: Install firmware updates" { - fwupdmgr update + fwupdmgr update || true } From 8d4d17fa340e6ee5a541eec95acfcf76a01af4c2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 19:26:57 +0000 Subject: [PATCH 0474/1455] feat(profile): add fc-match & fc-pattern. --- apparmor.d/groups/freedesktop/fc-list | 2 +- tests/bats/fc-list.bats | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/fc-list b/apparmor.d/groups/freedesktop/fc-list index ffe996c52..6254b2456 100644 --- a/apparmor.d/groups/freedesktop/fc-list +++ b/apparmor.d/groups/freedesktop/fc-list @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/fc-list +@{exec_path} = @{bin}/fc-list @{bin}/fc-match @{bin}/fc-pattern profile fc-list @{exec_path} { include include diff --git a/tests/bats/fc-list.bats b/tests/bats/fc-list.bats index 52ed43885..12b1df2ca 100644 --- a/tests/bats/fc-list.bats +++ b/tests/bats/fc-list.bats @@ -8,3 +8,15 @@ load common @test "fc-list: Return a list of installed fonts in your system" { fc-list } + +@test "fc-match: Return a sorted list of best matching fonts" { + fc-match -s 'DejaVu Serif' +} + +@test "fc-pattern: Display default information about a font" { + fc-pattern --default 'DejaVu Serif' +} + +@test "fc-pattern: Display configuration information about a font" { + fc-pattern --config 'DejaVu Serif' +} From 5237ab39892908feeb20b100434245d9ce7c75f6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 19:33:07 +0000 Subject: [PATCH 0475/1455] test(integration): add sysctl. --- tests/bats/sysctl.bats | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 tests/bats/sysctl.bats diff --git a/tests/bats/sysctl.bats b/tests/bats/sysctl.bats new file mode 100644 index 000000000..171ee98a9 --- /dev/null +++ b/tests/bats/sysctl.bats @@ -0,0 +1,27 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +@test "sysctl: Show all available variables and their values" { + sysctl -a +} + +@test "sysctl: Set a changeable kernel state variable" { + sudo sysctl -w vm.panic_on_oom=0 +} + +@test "sysctl: Get currently open file handlers" { + sysctl fs.file-nr +} + +@test "sysctl: Get limit for simultaneous open files" { + sysctl fs.file-max +} + +@test "sysctl: Apply changes from `/etc/sysctl.conf`" { + sysctl -p +} + From 3960f20f00a0e53bada503210f6809e0caff247a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 19:39:55 +0000 Subject: [PATCH 0476/1455] feat(profile): add needrestart-vmlinuz-get-version & tests for needrestart. --- apparmor.d/profiles-m-r/needrestart | 11 ++++-- .../needrestart-vmlinuz-get-version | 30 ++++++++++++++++ tests/bats/needrestart.bats | 34 +++++++++++++++++++ 3 files changed, 73 insertions(+), 2 deletions(-) create mode 100644 apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version create mode 100644 tests/bats/needrestart.bats diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 37a1c90a3..f5722ed3d 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -35,11 +35,11 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{bin}/stty rix, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, - @{bin}/udevadm rPx, + @{bin}/udevadm rCx -> udevadm, @{bin}/unix_chkpwd rPx, @{bin}/whiptail rPx, @{bin}/who rix, - @{lib}/needrestart/iucode-scan-versions rPx, + @{lib}/needrestart/* rPx, /usr/share/debconf/frontend rix, @{bin}/networkd-dispatcher r, @@ -88,6 +88,13 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { include if exists } + profile udevadm { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version new file mode 100644 index 000000000..f7e9d76a1 --- /dev/null +++ b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/needrestart/vmlinuz-get-version +profile needrestart-vmlinuz-get-version @{exec_path} { + include + include + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/grep rix, + @{bin}/mktemp rix, + @{bin}/rm rix, + @{bin}/tr rix, + @{bin}/which{,.debianutils} rix, + + /boot/vmlinuz* r, + + owner @{tmp}/tmp.@{rand10} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/bats/needrestart.bats b/tests/bats/needrestart.bats new file mode 100644 index 000000000..4676b36af --- /dev/null +++ b/tests/bats/needrestart.bats @@ -0,0 +1,34 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +@test "needrestart: List outdated processes" { + needrestart +} + +@test "needrestart: Interactively restart services" { + sudo needrestart +} + +@test "needrestart: List outdated processes in verbose mode" { + needrestart -v +} + +@test "needrestart: Check if the kernel is outdated" { + needrestart -k +} + +@test "needrestart: Check if the CPU microcode is outdated" { + needrestart -w +} + +@test "needrestart: List outdated processes in batch mode" { + needrestart -b +} + +@test "needrestart: Display help" { + needrestart --help +} From 23eb08344cc0707e57bd9a912eba79d08755bb65 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 20:02:16 +0000 Subject: [PATCH 0477/1455] fix(tunable): udbus can be any hex up to 16. --- apparmor.d/tunables/multiarch.d/system | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 78bb73b03..cc4192d28 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -123,7 +123,7 @@ @{busname}=:1.@{u16} :not.active.yet # Unix dbus address prefix -@{udbus}=@{hex15} @{hex16} +@{udbus}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} # Universally unique identifier @{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} From 33a66ef6a2a38baacacb7745e617a4ea125cb7f8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 20:22:52 +0000 Subject: [PATCH 0478/1455] fix(integration): disable needrestart test due to upstream issue. --- tests/bats/needrestart.bats | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/bats/needrestart.bats b/tests/bats/needrestart.bats index 4676b36af..567f8c773 100644 --- a/tests/bats/needrestart.bats +++ b/tests/bats/needrestart.bats @@ -5,6 +5,10 @@ load common +setup_file() { + skip "mqueue raised despite the rule being present. See https://gitlab.com/apparmor/apparmor/-/issues/362" +} + @test "needrestart: List outdated processes" { needrestart } From 36d787fa4472747903571d7766b205ce7c3ce431 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 19:53:24 +0000 Subject: [PATCH 0479/1455] feat(abs): add abstraction/webkit. --- apparmor.d/abstractions/webkit | 31 +++++++++++++++++++++++++++++ apparmor.d/groups/browsers/epiphany | 16 +-------------- apparmor.d/profiles-a-f/foliate | 15 +------------- 3 files changed, 33 insertions(+), 29 deletions(-) create mode 100644 apparmor.d/abstractions/webkit diff --git a/apparmor.d/abstractions/webkit b/apparmor.d/abstractions/webkit new file mode 100644 index 000000000..c4410d026 --- /dev/null +++ b/apparmor.d/abstractions/webkit @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Minimal set of rules for webkit UI. + + abi , + + mount options=(rw rbind) /bindfile@{rand6} -> /newroot/.flatpak-info, + + @{bin}/xdg-dbus-proxy rix, + + @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, + @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix, + + owner /bindfile@{rand6} rw, + owner @{att}/.flatpak-info r, + + owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw, + + owner @{run}/user/@{uid}/.flatpak/ w, + owner @{run}/user/@{uid}/.flatpak/webkit-*/{,bwrapinfo.json} rw, + + owner @{run}/user/@{uid}/webkitgtk/ w, + owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw, + owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw, + owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-@{rand6} rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany index 98f21f472..b08a6b00f 100644 --- a/apparmor.d/groups/browsers/epiphany +++ b/apparmor.d/groups/browsers/epiphany @@ -19,6 +19,7 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { include include include + include capability dac_override, @@ -28,21 +29,14 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, - mount options=(rw rbind) /bindfile@{rand6} -> /newroot/.flatpak-info, - @{exec_path} mr, @{open_path} rPx -> child-open, @{bin}/bwrap rix, - @{bin}/xdg-dbus-proxy rix, - @{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix, /usr/share/enchant*/{,**} r, - owner /bindfile@{rand6} rw, - owner @{att}/.flatpak-info r, - owner @{user_config_dirs}/glib-2.0/ w, owner @{user_config_dirs}/glib-2.0/settings/ w, @@ -51,14 +45,6 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { owner @{tmp}/Serialized@{rand9} rw, owner @{tmp}/WebKit-Media-@{rand6} rw, - owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw, - owner @{run}/user/@{uid}/.flatpak/ w, - owner @{run}/user/@{uid}/.flatpak/webkit-*/{,bwrapinfo.json} rw, - owner @{run}/user/@{uid}/webkitgtk/ w, - owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw, - owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw, - owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-@{rand6} rw, - @{sys}/devices/virtual/dmi/id/chassis_type r, @{sys}/firmware/acpi/pm_profile r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-org.gnome.Epiphany-@{int}.scope/memory.* r, diff --git a/apparmor.d/profiles-a-f/foliate b/apparmor.d/profiles-a-f/foliate index b1c485408..f6380d125 100644 --- a/apparmor.d/profiles-a-f/foliate +++ b/apparmor.d/profiles-a-f/foliate @@ -15,6 +15,7 @@ profile foliate @{exec_path} flags=(attach_disconnected) { include include include + include capability dac_override, @@ -30,31 +31,17 @@ profile foliate @{exec_path} flags=(attach_disconnected) { @{bin}/bwrap rix, @{bin}/gjs-console rix, - @{bin}/xdg-dbus-proxy rix, @{bin}/speech-dispatcher rPx, @{open_path} rPx -> child-open-help, - @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, - @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix, - /usr/share/com.github.johnfactotum.Foliate/{,**} r, - owner /bindfile@{rand6} rw, - owner /.flatpak-info r, - owner @{user_books_dirs}/{,**} r, owner @{user_torrents_dirs}/{,**} r, owner @{user_cache_dirs}/com.github.johnfactotum.Foliate/{,**} rwlk, owner @{user_share_dirs}/com.github.johnfactotum.Foliate/{,**} rwlk, - owner @{run}/user/@{uid}/.flatpak/ w, - owner @{run}/user/@{uid}/.flatpak/webkit-*/{,bwrapinfo.json} rw, - owner @{run}/user/@{uid}/webkitgtk/ w, - owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw, - owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw, - owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-@{rand6} rw, - @{sys}/devices/virtual/dmi/id/chassis_type r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-dbus*org.gnome.Nautilus.slice/dbus*org.gnome.Nautilus@*.service/memory.* r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-com.github.johnfactotum.Foliate-@{int}.scope/memory.* r, From 65f2d21558a20528f4b7b8b77276d5e436c1a391 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 19:53:59 +0000 Subject: [PATCH 0480/1455] feat(profile): add profile for tecla. --- apparmor.d/groups/gnome/gnome-control-center | 2 +- apparmor.d/groups/gnome/gnome-shell | 1 + apparmor.d/groups/gnome/tecla | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/groups/gnome/tecla diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 00bc15f19..91f49c219 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -55,7 +55,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{bin}/grep rix, @{bin}/locale rix, @{bin}/sed rix, - @{bin}/tecla rix, + @{bin}/tecla rPx, @{bin}/bwrap rCx -> bwrap, @{bin}/gkbd-keyboard-display rPx, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index f52340d41..462733874 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -175,6 +175,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/glib-compile-schemas rPx, @{bin}/ibus-daemon rPx, @{bin}/Xwayland rPx, + @{bin}/tecla rPx, @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @{lib}/mutter-x11-frames rPx, #aa:exec polkit-agent-helper diff --git a/apparmor.d/groups/gnome/tecla b/apparmor.d/groups/gnome/tecla new file mode 100644 index 000000000..082c6c925 --- /dev/null +++ b/apparmor.d/groups/gnome/tecla @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/tecla +profile tecla @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From cb86f1c0763af93680e5cd2f9154b5253c7249f5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 20:08:48 +0000 Subject: [PATCH 0481/1455] feat(profile): general update. --- apparmor.d/groups/freedesktop/geoclue | 1 + .../groups/freedesktop/polkit-agent-helper | 2 +- .../groups/systemd/systemd-sleep-nvidia | 1 + .../groups/virt/containerd-shim-runc-v2 | 1 + apparmor.d/profiles-a-f/aa-notify | 2 +- apparmor.d/profiles-a-f/font-manager | 4 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-g-l/gsettings | 5 +- apparmor.d/profiles-g-l/jami-gnome | 61 ------------------- apparmor.d/profiles-m-r/passimd | 4 +- apparmor.d/profiles-m-r/pidof | 2 +- apparmor.d/profiles-s-z/sudo | 10 +-- apparmor.d/profiles-s-z/udisksd | 3 + apparmor.d/profiles-s-z/virt-manager | 1 + 14 files changed, 17 insertions(+), 82 deletions(-) delete mode 100644 apparmor.d/profiles-g-l/jami-gnome diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index 383360ad4..4492c7598 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/geoclue @{lib}/geoclue-2.0/demos/agent profile geoclue @{exec_path} flags=(attach_disconnected) { include + include include include include diff --git a/apparmor.d/groups/freedesktop/polkit-agent-helper b/apparmor.d/groups/freedesktop/polkit-agent-helper index bb6e457ff..7f5ecd107 100644 --- a/apparmor.d/groups/freedesktop/polkit-agent-helper +++ b/apparmor.d/groups/freedesktop/polkit-agent-helper @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] @{exec_path} += @{lib}/polkit-agent-helper-[0-9] -profile polkit-agent-helper @{exec_path} { +profile polkit-agent-helper @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-sleep-nvidia b/apparmor.d/groups/systemd/systemd-sleep-nvidia index 4ebb4851f..2ca5d7474 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-nvidia +++ b/apparmor.d/groups/systemd/systemd-sleep-nvidia @@ -11,6 +11,7 @@ profile systemd-sleep-nvidia @{exec_path} { include include + capability perfmon, capability sys_admin, capability sys_tty_config, diff --git a/apparmor.d/groups/virt/containerd-shim-runc-v2 b/apparmor.d/groups/virt/containerd-shim-runc-v2 index bff45ca39..4c3707493 100644 --- a/apparmor.d/groups/virt/containerd-shim-runc-v2 +++ b/apparmor.d/groups/virt/containerd-shim-runc-v2 @@ -50,6 +50,7 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/kubepods/{,**} rw, @{sys}/kernel/mm/hugepages/ r, + @{PROC}/@{pid}/task/@{tid}/mountinfo r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/oom_score_adj rw, diff --git a/apparmor.d/profiles-a-f/aa-notify b/apparmor.d/profiles-a-f/aa-notify index 7e901509f..53c64daf9 100644 --- a/apparmor.d/profiles-a-f/aa-notify +++ b/apparmor.d/profiles-a-f/aa-notify @@ -36,7 +36,7 @@ profile aa-notify @{exec_path} { owner @{HOME}/.inputrc r, owner @{HOME}/.terminfo/@{int}/dumb r, - owner @{tmp}/@{rand8} rw, + owner @{tmp}/@{word8} rw, owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, @{PROC}/ r, diff --git a/apparmor.d/profiles-a-f/font-manager b/apparmor.d/profiles-a-f/font-manager index 81c53aafd..56941f60b 100644 --- a/apparmor.d/profiles-a-f/font-manager +++ b/apparmor.d/profiles-a-f/font-manager @@ -11,11 +11,9 @@ include profile font-manager @{exec_path} { include include + include include - include - include include - include include include diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 45b2ccfb4..aa95a00d5 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -58,7 +58,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{bin}/gpgsm rCx -> gpg, /usr/share/fwupd/{,**} r, - /usr/share/hwdata/*.ids r, + /usr/share/hwdata/* r, /usr/share/mime/mime.cache r, /etc/fwupd/{,**} rw, diff --git a/apparmor.d/profiles-g-l/gsettings b/apparmor.d/profiles-g-l/gsettings index 4ac891769..e2a9ae515 100644 --- a/apparmor.d/profiles-g-l/gsettings +++ b/apparmor.d/profiles-g-l/gsettings @@ -7,8 +7,9 @@ abi , include @{exec_path} = @{bin}/gsettings -profile gsettings @{exec_path} { +profile gsettings @{exec_path} flags=(attach_disconnected) { include + include include include @@ -22,8 +23,6 @@ profile gsettings @{exec_path} { owner @{desktop_config_dirs}/dconf/user rw, owner @{DESKTOP_HOME}/greeter-dconf-defaults r, - /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/profiles-g-l/jami-gnome b/apparmor.d/profiles-g-l/jami-gnome deleted file mode 100644 index 3a1e504a8..000000000 --- a/apparmor.d/profiles-g-l/jami-gnome +++ /dev/null @@ -1,61 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/jami-gnome -profile jami-gnome @{exec_path} { - include - include - include - include - include - include - include - include - include - include - include - - network netlink raw, - - @{exec_path} mr, - - @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, - @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix, - - /usr/share/ring/{,**} r, - /usr/share/sounds/jami-gnome/{,**} r, - - owner @{user_cache_dirs}/ rw, - owner @{user_cache_dirs}/jami-gnome/ rw, - owner @{user_cache_dirs}/jami-gnome/** rw, - - owner @{user_share_dirs}/jami/ rw, - owner @{user_share_dirs}/jami/** rwkl -> @{user_share_dirs}/jami/, - - owner @{user_config_dirs}/autostart/jami-gnome.desktop w, - - owner @{user_share_dirs}/ r, - owner @{user_share_dirs}/webkitgtk/deviceidhashsalts/1/ r, - owner @{user_share_dirs}/webkitgtk/databases/indexeddb/v0 w, - owner @{user_share_dirs}/webkitgtk/databases/indexeddb/v1/ w, - - @{sys}/firmware/acpi/pm_profile r, - @{sys}/devices/virtual/dmi/id/chassis_type r, - @{sys}/fs/cgroup/** r, - - owner @{PROC}/@{pid}/statm r, - owner @{PROC}/@{pid}/smaps r, - deny owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/cgroup r, - @{PROC}/zoneinfo r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/passimd b/apparmor.d/profiles-m-r/passimd index 4e64e5fb9..c0aafeaf9 100644 --- a/apparmor.d/profiles-m-r/passimd +++ b/apparmor.d/profiles-m-r/passimd @@ -26,9 +26,7 @@ profile passimd @{exec_path} flags=(attach_disconnected) { /etc/passim.conf r, - /var/lib/passim/{,**} r, - /var/lib/passim/data/{,**} rw, - + owner /var/lib/passim/{,**} rw, owner /var/log/passim/* rw, @{PROC}/@{pid}/cmdline r, diff --git a/apparmor.d/profiles-m-r/pidof b/apparmor.d/profiles-m-r/pidof index 2a7b63038..5da955cba 100644 --- a/apparmor.d/profiles-m-r/pidof +++ b/apparmor.d/profiles-m-r/pidof @@ -28,7 +28,7 @@ profile pidof @{exec_path} { @{PROC}/sys/kernel/osrelease r, @{PROC}/uptime r, - owner /dev/tty@{int} rw, + /dev/tty@{int} rw, include if exists } diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index 1e6748235..b2074ba04 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -21,15 +21,9 @@ profile sudo @{exec_path} flags=(attach_disconnected) { network inet dgram, network inet6 dgram, - ptrace (read), + ptrace read, - signal (send,receive) peer=cockpit-bridge, - signal (send) peer=@{p_systemd}, - signal (send) set=(cont,hup,winch) peer=su, - signal (send) set=(winch) peer=child-pager, - signal (send) set=(winch) peer=journalctl, - signal (send) set=(winch) peer=pacman, - signal (send) set=(winch, hup, term) peer=rpm, + signal send set=(winch, hup, term), @{bin}/@{shells} rUx, @{lib}/** PUx, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 9155adf84..909112a70 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -48,6 +48,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { mount options=(rw move) -> @{MOUNTS}/, mount options=(rw move) -> @{MOUNTS}/*/, + mount fstype=vfat -> /boot/efi/, + # Allow mounting on temporary mount point mount -> @{run}/udisks2/temp-mount-*/, mount / -> @{MOUNTS}/*/, @@ -56,6 +58,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { umount @{MOUNTS}/, umount @{MOUNTS}/*/, umount @{run}/udisks2/temp-mount-*/, + umount /boot/efi/, umount /media/cdrom@{int}/, signal receive set=int peer=@{p_systemd}, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index bce236989..0a67b365b 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -89,6 +89,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/net/route r, owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, From 044f80b1db20869b3bf264bd4b86d3986233a954 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 21 Nov 2024 20:59:06 +0000 Subject: [PATCH 0482/1455] feat(tunable): unify some XDG and user dirs varibale name. --- apparmor.d/abstractions/deny-sensitive-home | 2 +- apparmor.d/groups/virt/virtiofsd | 6 +- apparmor.d/profiles-a-f/browserpass | 4 +- apparmor.d/profiles-g-l/keepassxc | 8 +- apparmor.d/profiles-m-r/pass | 12 +-- apparmor.d/profiles-m-r/pass-import | 2 +- .../profiles-m-r/protonmail-bridge-core | 16 ++-- apparmor.d/tunables/home.d/apparmor.d | 78 ++++++++++--------- .../tunables/xdg-user-dirs.d/apparmor.d | 8 +- docs/configuration.md | 4 +- docs/variables.md | 6 +- 11 files changed, 77 insertions(+), 69 deletions(-) diff --git a/apparmor.d/abstractions/deny-sensitive-home b/apparmor.d/abstractions/deny-sensitive-home index 4291762a4..68c013a51 100644 --- a/apparmor.d/abstractions/deny-sensitive-home +++ b/apparmor.d/abstractions/deny-sensitive-home @@ -34,7 +34,7 @@ deny @{HOME}/@{XDG_SSH_DIR}/{,**} mrwkl, deny @{run}/user/@{uid}/keyring** mrwkl, deny @{user_config_dirs}/*-store/{,**} mrwkl, - deny @{user_password_store_dirs}/{,**} mrwkl, + deny @{user_passwordstore_dirs}/{,**} mrwkl, deny @{user_share_dirs}/kwalletd/{,**} mrwkl, # Privacy violations diff --git a/apparmor.d/groups/virt/virtiofsd b/apparmor.d/groups/virt/virtiofsd index 905e2c170..899ecae04 100644 --- a/apparmor.d/groups/virt/virtiofsd +++ b/apparmor.d/groups/virt/virtiofsd @@ -31,13 +31,13 @@ profile virtiofsd @{exec_path} { mount options=(rw, rbind) -> @{user_publicshare_dirs}/, mount options=(rw, rbind) -> @{user_vm_dirs}/, - mount options=(rw, rbind) -> @{user_vm_shares}/, + mount options=(rw, rbind) -> @{user_vmshare_dirs}/, umount /, pivot_root @{user_publicshare_dirs}/, # TODO: -> pivoted, pivot_root @{user_vm_dirs}/, - pivot_root @{user_vm_shares}/, + pivot_root @{user_vmshare_dirs}/, signal (receive) set=term peer=libvirtd, @@ -50,7 +50,7 @@ profile virtiofsd @{exec_path} { @{user_publicshare_dirs}/{,**} r, @{user_vm_dirs}/{,**} r, - @{user_vm_shares}/{,**} r, + @{user_vmshare_dirs}/{,**} r, owner @{run}/libvirt/qemu/*.pid rw, diff --git a/apparmor.d/profiles-a-f/browserpass b/apparmor.d/profiles-a-f/browserpass index 86da0e6a7..272000f3f 100644 --- a/apparmor.d/profiles-a-f/browserpass +++ b/apparmor.d/profiles-a-f/browserpass @@ -48,8 +48,8 @@ profile browserpass @{exec_path} flags=(attach_disconnected) { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, - owner @{user_password_store_dirs}/ rw, - owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**, + owner @{user_passwordstore_dirs}/ rw, + owner @{user_passwordstore_dirs}/** rwkl -> @{HOME}/.password-store/**, owner @{user_projects_dirs}/**/*-store/ rw, owner @{user_projects_dirs}/**/*-store/** rwkl -> @{user_projects_dirs}/**/*-store/**, owner @{user_config_dirs}/*-store/ rw, diff --git a/apparmor.d/profiles-g-l/keepassxc b/apparmor.d/profiles-g-l/keepassxc index d2dee61aa..de95d3c9f 100644 --- a/apparmor.d/profiles-g-l/keepassxc +++ b/apparmor.d/profiles-g-l/keepassxc @@ -48,10 +48,10 @@ profile keepassxc @{exec_path} { owner @{HOME}/@{XDG_SSH_DIR}/ r, owner @{HOME}/@{XDG_SSH_DIR}/* r, - owner @{user_password_store_dirs}/ r, - owner @{user_password_store_dirs}/*.csv rw, - owner @{user_password_store_dirs}/*.kdbx* rwl -> @{KP_DB}/#@{int}, - owner @{user_password_store_dirs}/#@{int} rw, + owner @{user_passwordstore_dirs}/ r, + owner @{user_passwordstore_dirs}/*.csv rw, + owner @{user_passwordstore_dirs}/*.kdbx* rwl -> @{user_passwordstore_dirs}/#@{int}, + owner @{user_passwordstore_dirs}/#@{int} rw, owner @{user_config_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev}/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json rw, owner @{user_config_dirs}/chromium/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json rw, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 0736f98c4..fe06a346d 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -59,7 +59,7 @@ profile pass @{exec_path} { /usr/share/terminfo/** r, - owner @{user_password_store_dirs}/{,**} rw, + owner @{user_passwordstore_dirs}/{,**} rw, owner /dev/shm/pass.@{rand}/{,*} rw, @{sys}/devices/system/node/ r, @@ -88,7 +88,7 @@ profile pass @{exec_path} { /tmp/ r, - owner @{user_password_store_dirs}/{,**/} r, + owner @{user_passwordstore_dirs}/{,**/} r, owner /dev/shm/pass.@{rand}/{,*} rw, @@ -120,8 +120,8 @@ profile pass @{exec_path} { owner @{HOME}/.gitconfig r, owner @{user_config_dirs}/git/{,*} r, - owner @{user_password_store_dirs}/ rw, - owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**, + owner @{user_passwordstore_dirs}/ rw, + owner @{user_passwordstore_dirs}/** rwkl -> @{HOME}/.password-store/**, owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature owner /dev/shm/pass.@{rand}/.git_vtag_tmp@{rand6} rw, @@ -142,8 +142,8 @@ profile pass @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, - owner @{user_password_store_dirs}/ rw, - owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**, + owner @{user_passwordstore_dirs}/ rw, + owner @{user_passwordstore_dirs}/** rwkl -> @{HOME}/.password-store/**, owner /dev/shm/pass.@{rand}/* rw, owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature diff --git a/apparmor.d/profiles-m-r/pass-import b/apparmor.d/profiles-m-r/pass-import index bb2bc9107..4977bb51a 100644 --- a/apparmor.d/profiles-m-r/pass-import +++ b/apparmor.d/profiles-m-r/pass-import @@ -33,7 +33,7 @@ profile pass-import @{exec_path} { /usr/share/file/misc/magic.mgc r, - owner @{user_password_store_dirs}/{,**} rw, + owner @{user_passwordstore_dirs}/{,**} rw, owner @{tmp}/[a-zA-Z0-9]* rw, diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index 4de73d718..da0c5f785 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -5,7 +5,7 @@ # To force the use of the Gnome Keyring or Kwallet secret-service, add the # following lines in your local/protonmail-bridge-core file: # deny @{bin}/pass x, -# deny owner @{user_password_store_dirs}/** r, +# deny owner @{user_passwordstore_dirs}/** r, abi , @@ -30,8 +30,8 @@ profile protonmail-bridge-core @{exec_path} { /etc/lsb-release r, /etc/machine-id r, - owner @{user_password_store_dirs}/docker-credential-helpers/{,**} r, - owner @{user_password_store_dirs}/protonmail-credentials/{,**} r, + owner @{user_passwordstore_dirs}/docker-credential-helpers/{,**} r, + owner @{user_passwordstore_dirs}/protonmail-credentials/{,**} r, owner @{user_cache_dirs}/protonmail/{,**} rwk, owner @{user_config_dirs}/protonmail/{,**} rwk, @@ -48,7 +48,7 @@ profile protonmail-bridge-core @{exec_path} { @{PROC}/sys/net/core/somaxconn r, deny @{bin}/pass x, - deny owner @{user_password_store_dirs}/** r, + deny owner @{user_passwordstore_dirs}/** r, profile pass { include @@ -72,10 +72,10 @@ profile protonmail-bridge-core @{exec_path} { @{bin}/tty rix, @{bin}/which rix, - owner @{user_password_store_dirs}/ r, - owner @{user_password_store_dirs}/.gpg-id r, - owner @{user_password_store_dirs}/protonmail-credentials/{,**} rw, - deny owner @{user_password_store_dirs}/**/ r, + owner @{user_passwordstore_dirs}/ r, + owner @{user_passwordstore_dirs}/.gpg-id r, + owner @{user_passwordstore_dirs}/protonmail-credentials/{,**} rw, + deny owner @{user_passwordstore_dirs}/**/ r, /dev/tty rw, diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index f1be9acbe..c791f5376 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -11,30 +11,7 @@ # First part, second part in /etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d -# Extra user personal directories -@{XDG_SCREENSHOTS_DIR}="Pictures/Screenshots" -@{XDG_WALLPAPERS_DIR}="Pictures/Wallpapers" -@{XDG_BOOKS_DIR}="Books" -@{XDG_GAMES_DIR}=".games" -@{XDG_PROJECTS_DIR}="Projects" -@{XDG_WORK_DIR}="Work" -@{XDG_MAIL_DIR}="Mail" ".{m,M}ail" -@{XDG_SYNC_DIR}="Sync" -@{XDG_TORRENTS_DIR}="Torrents" -@{XDG_VM_DIR}=".vm" -@{XDG_VM_SHARES_DIR}="VM_Shares" -@{XDG_IMG_DIR}="images" -@{XDG_GAMESSTUDIO_DIR}="unity3d" - -# User personal keyrings -@{XDG_GPG_DIR}=".gnupg" -@{XDG_SSH_DIR}=".ssh" -@{XDG_PASSWORD_STORE_DIR}=".password-store" - -# User personal private directories -@{XDG_PRIVATE_DIR}=".{p,P}rivate" "{p,P}rivate" - -# Definition of local user configuration directories +# Define the XDG Base Directory @{XDG_CACHE_DIR}=".cache" @{XDG_CONFIG_DIR}=".config" @{XDG_DATA_DIR}=".local/share" @@ -42,28 +19,59 @@ @{XDG_BIN_DIR}=".local/bin" @{XDG_LIB_DIR}=".local/lib" -# Full path of the user configuration directories +# Define extended user directories not defined in the XDG standard but commonly +# used in profiles +@{XDG_SCREENSHOTS_DIR}="Pictures/Screenshots" +@{XDG_WALLPAPERS_DIR}="Pictures/Wallpapers" +@{XDG_BOOKS_DIR}="Books" +@{XDG_GAMES_DIR}="Games" +@{XDG_PROJECTS_DIR}="Projects" +@{XDG_WORK_DIR}="Work" +@{XDG_MAIL_DIR}="Mail" ".{m,M}ail" +@{XDG_SYNC_DIR}="Sync" +@{XDG_TORRENTS_DIR}="Torrents" +@{XDG_GAMESSTUDIO_DIR}="unity3d" + +# Define user directories for virtual machines, shared folders and disk images +@{XDG_VM_DIR}=".vm" +@{XDG_VMSHARE_DIR}=".vmshare" +@{XDG_IMG_DIR}=".img" + +# Define user build directories and artifacts output +@{XDG_BUILD_DIR}=".build" +@{XDG_PKG_DIR}=".pkg" + +# Define user personal keyrings +@{XDG_GPG_DIR}=".gnupg" +@{XDG_SSH_DIR}=".ssh" +@{XDG_PASSWORDSTORE_DIR}=".password-store" + +# Define user personal private directories +@{XDG_PRIVATE_DIR}=".{p,P}rivate" "{p,P}rivate" + +# Full path of the XDG Base Directory @{user_cache_dirs}=@{HOME}/@{XDG_CACHE_DIR} @{user_config_dirs}=@{HOME}/@{XDG_CONFIG_DIR} +@{user_state_dirs}=@{HOME}/@{XDG_STATE_DIR} @{user_bin_dirs}=@{HOME}/@{XDG_BIN_DIR} @{user_lib_dirs}=@{HOME}/@{XDG_LIB_DIR} -@{user_state_dirs}=@{HOME}/@{XDG_STATE_DIR} - -# User build directories and output -@{user_build_dirs}="/tmp/build/" -@{user_pkg_dirs}="/tmp/pkg/" -@{user_img_dirs}=@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR} # Other user directories @{user_books_dirs}=@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR} @{user_games_dirs}=@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR} -@{user_private_dirs}=@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR} -@{user_password_store_dirs}=@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR} +@{user_projects_dirs}=@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR} @{user_work_dirs}=@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR} @{user_mail_dirs}=@{HOME}/@{XDG_MAIL_DIR} @{MOUNTS}/@{XDG_MAIL_DIR} -@{user_projects_dirs}=@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR} -@{user_sync_dirs}=@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR} +@{user_sync_dirs}=@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/@{XDG_SYNC_DIR} @{user_torrents_dirs}=@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR} @{user_vm_dirs}=@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR} +@{user_vmshare_dirs}=@{HOME}/@{XDG_VMSHARE_DIR} @{MOUNTS}/@{XDG_VMSHARE_DIR} +@{user_img_dirs}=@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR} +@{user_build_dirs}=@{HOME}/@{XDG_BUILD_DIR} @{MOUNTS}/@{XDG_BUILD_DIR} +@{user_pkg_dirs}=@{HOME}/@{XDG_PKG_DIR} @{MOUNTS}/@{XDG_PKG_DIR} +@{user_gpg_dirs}=@{HOME}/@{XDG_GPG_DIR} @{MOUNTS}/@{XDG_GPG_DIR} +@{user_ssh_dirs}=@{HOME}/@{XDG_SSH_DIR} @{MOUNTS}/@{XDG_SSH_DIR} +@{user_passwordstore_dirs}=@{HOME}/@{XDG_PASSWORDSTORE_DIR} @{MOUNTS}/@{XDG_PASSWORDSTORE_DIR} +@{user_private_dirs}=@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR} # vim:syntax=apparmor diff --git a/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d b/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d index 00231cbce..52be8b920 100644 --- a/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d +++ b/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d @@ -14,14 +14,14 @@ @{XDG_DOWNLOAD_DIR}+=".tb/tor-browser/Browser/Downloads" # Other user directories -@{user_documents_dirs}=@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR} +@{user_desktop_dirs}=@{HOME}/@{XDG_DESKTOP_DIR} @{MOUNTS}/@{XDG_DESKTOP_DIR} @{user_download_dirs}=@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR} +@{user_templates_dirs}=@{HOME}/@{XDG_TEMPLATES_DIR} @{MOUNTS}/@{XDG_TEMPLATES_DIR} +@{user_publicshare_dirs}=@{HOME}/@{XDG_PUBLICSHARE_DIR} @{MOUNTS}/@{XDG_PUBLICSHARE_DIR} +@{user_documents_dirs}=@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR} @{user_music_dirs}=@{HOME}/@{XDG_MUSIC_DIR} @{MOUNTS}/@{XDG_MUSIC_DIR} @{user_pictures_dirs}=@{HOME}/@{XDG_PICTURES_DIR} @{MOUNTS}/@{XDG_PICTURES_DIR} @{user_videos_dirs}=@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR} -@{user_publicshare_dirs}=@{HOME}/@{XDG_PUBLICSHARE_DIR} @{MOUNTS}/@{XDG_PUBLICSHARE_DIR} -@{user_templates_dirs}=@{HOME}/@{XDG_TEMPLATES_DIR} @{MOUNTS}/@{XDG_TEMPLATES_DIR} -@{user_vm_shares}=@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR} include if exists diff --git a/docs/configuration.md b/docs/configuration.md index e3fbba5ea..c3017c28d 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -143,7 +143,7 @@ Please ensure that all personal directories you are using are well-defined XDG d | Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` | | Games | `@{user_games_dirs}` | `@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR}` | | Private | `@{user_private_dirs}` | `@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR}` | - | Passwords | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | + | Passwords | `@{user_passwordstore_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | | Work | `@{user_work_dirs}` | `@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR}` | | Mail | `@{user_mail_dirs}` | `@{HOME}/@{XDG_MAIL_DIR} @{MOUNTS}/@{XDG_MAIL_DIR}` | | Projects | `@{user_projects_dirs}` | `@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR}` | @@ -152,7 +152,7 @@ Please ensure that all personal directories you are using are well-defined XDG d | Torrents | `@{user_torrents_dirs}` | `@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}` | | Sync | `@{user_sync_dirs}` | `@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR}` | | Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` | - | Vm Shares | `@{user_vm_shares}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | + | Vm Shares | `@{user_vmshare_dirs}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | | Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | diff --git a/docs/variables.md b/docs/variables.md index ef2533c0f..7dc8e5ff6 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -29,7 +29,7 @@ title: Variables References | Sync | `@{XDG_SYNC_DIR}` | `Sync` | | Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | | Vm | `@{XDG_VM_DIR}` | `.vm` | -| Vm Shares | `@{XDG_VM_SHARES_DIR}` | `VM_Shares` | +| Vm Shares | `@{XDG_VMSHARE_DIR}` | `VM_Shares` | | Disk images | `@{XDG_IMG_DIR}` | `images` | | Games Studio | `@{XDG_GAMESSTUDIO_DIR}` | `.unity3d` | @@ -85,7 +85,7 @@ title: Variables References | Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` | | Games | `@{user_games_dirs}` | `@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR}` | | Private | `@{user_private_dirs}` | `@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR}` | -| Passwords | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | +| Passwords | `@{user_passwordstore_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | | Work | `@{user_work_dirs}` | `@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR}` | | Mail | `@{user_mail_dirs}` | `@{HOME}/@{XDG_MAIL_DIR} @{MOUNTS}/@{XDG_MAIL_DIR}` | | Projects | `@{user_projects_dirs}` | `@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR}` | @@ -94,7 +94,7 @@ title: Variables References | Torrents | `@{user_torrents_dirs}` | `@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}` | | Sync | `@{user_sync_dirs}` | `@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR}` | | Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` | -| Vm Shares | `@{user_vm_shares}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | +| Vm Shares | `@{user_vmshare_dirs}` | `@{HOME}/@{XDG_VMSHARE_DIR} @{MOUNTS}/@{XDG_VMSHARE_DIR}` | | Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | From 8efdc5d8e3fc0161bb49207f6e6a169004cc11ad Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 21 Nov 2024 14:12:02 -0700 Subject: [PATCH 0483/1455] Add profile for iftop (#604) * Add profile for iftop * iftop: clean up formatting --- apparmor.d/profiles-g-l/iftop | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 apparmor.d/profiles-g-l/iftop diff --git a/apparmor.d/profiles-g-l/iftop b/apparmor.d/profiles-g-l/iftop new file mode 100644 index 000000000..232aff538 --- /dev/null +++ b/apparmor.d/profiles-g-l/iftop @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Zane Zakraisek +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/iftop +profile iftop @{exec_path} { + include + include + include + + capability net_raw, + + network inet dgram, + network inet6 dgram, + network netlink raw, + network packet raw, + + @{exec_path} mr, + + /usr/share/terminfo/** r, + + owner @{HOME}/.iftoprc r, + + # When running in promiscuous mode + @{sys}/devices/**/net/*/statistics/* r, + + include if exists +} + +# vim:syntax=apparmor From 7acd9079a267cb5ff9f3f5d0e272ff55bc1a5e2d Mon Sep 17 00:00:00 2001 From: Besanon Date: Sat, 23 Nov 2024 18:44:18 +0100 Subject: [PATCH 0484/1455] add more lxqt files (#600) * Create abstraction for lxqt desktop group first file for the LXQT 2.0 desktop group * Update lxqt * xdg-desktop abstraction added * removing tabs * Create startlxqt starter file for LXQT Desktop * Create startlxqt * fixing startlxqt I use sddm as display manager I cant remove the other file - only use graphical env., sorry After startlxqt i would add 2 lines to sddm to enable the start of LXQT desktop * Delete apparmor.d/profiles-s-z/startlxqt * indented by 2 spaces (like other entries) * Update sddm Enable sddm to start an lxqt desktop session * Create lxqt-session lxqt-session to be started by startlxqt. Display manager: sddm * Update lxqt-session * Update lxqt-session * removed trailing whitespace * Update kscreen_backend_launcher to support lxqt desktop is needed for several complaints: DENIED kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r DENIED kscreen_backend_launcher open /usr/share/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r DENIED kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r DENIED kscreen_backend_launcher open /usr/share/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r * Update lxqt-session * Create lxqt-panel * Update lxqt-panel * Update lxqt-panel * Update lxqt-panel * fix conflicting x * Update lxqt-panel add child-open * remove include you think its too permissive to have app-launcher-user here, right? * Update lxqt-panel add needed programs * Update lxqt-panel turning back to layout of corresponding xfce file. * Create lxqt-globalkeysd * Create lxqt-about * Create lxqt-leave * Create lxqt-runner * Update lxqt-leave * Update lxqt-runner * Update lxqt-globalkeysd * remove video in lxqt-about * Update lxqt-about * Update lxqt-runner * remove abstr. in lxqt-globalkeysd * remove abstr. in lxqt-runner * remove abstr. in lxqt-leave --- apparmor.d/groups/lxqt/lxqt-about | 28 +++++++++++++++++ apparmor.d/groups/lxqt/lxqt-globalkeysd | 40 +++++++++++++++++++++++++ apparmor.d/groups/lxqt/lxqt-leave | 24 +++++++++++++++ apparmor.d/groups/lxqt/lxqt-runner | 34 +++++++++++++++++++++ 4 files changed, 126 insertions(+) create mode 100644 apparmor.d/groups/lxqt/lxqt-about create mode 100644 apparmor.d/groups/lxqt/lxqt-globalkeysd create mode 100644 apparmor.d/groups/lxqt/lxqt-leave create mode 100644 apparmor.d/groups/lxqt/lxqt-runner diff --git a/apparmor.d/groups/lxqt/lxqt-about b/apparmor.d/groups/lxqt/lxqt-about new file mode 100644 index 000000000..8f5830453 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-about @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-about +profile lxqt-about @{exec_path} { + include + include + + @{exec_path} mr, + + /usr/share/desktop-directories/{,**} r, + + /etc/xdg/menus/lxqt-applications.menu r, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/lxqt/lxqt-globalkeysd b/apparmor.d/groups/lxqt/lxqt-globalkeysd new file mode 100644 index 000000000..8729b1abb --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-globalkeysd @@ -0,0 +1,40 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-globalkeysd +profile lxqt-globalkeysd @{exec_path} { + include + include + include + include + + @{exec_path} mr, + + @{open_path} rPx -> child-open-help, + @{bin}/screengrab rPx, + @{bin}/lxqt-config-brightness rPx, + + /usr/share/lxqt/globalkeyshortcuts.conf rw, + + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/lxqt/ r, + owner @{user_config_dirs}/lxqt/globalkeyshortcuts.conf.lock wrk, + owner @{user_config_dirs}/lxqt/#@{int} wr, + owner @{user_config_dirs}/lxqt/globalkeyshortcuts.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/globalkeyshortcuts.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/lxqt/lxqt-leave b/apparmor.d/groups/lxqt/lxqt-leave new file mode 100644 index 000000000..e76d81f54 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-leave @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-leave +profile lxqt-leave @{exec_path} { + include + include + + @{exec_path} mr, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/lxqt/lxqt-runner b/apparmor.d/groups/lxqt/lxqt-runner new file mode 100644 index 000000000..9477c1bda --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-runner @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-runner +profile lxqt-runner @{exec_path} { + include + include + + @{exec_path} mr, + + /usr/share/icons/ r, + /usr/share/desktop-directories/ r, + /usr/share/desktop-directories/{,**} r, + + /etc/xdg/menus/lxqt-applications.menu r, + + owner @{user_config_dirs}/lxqt/lxqt-runner.conf.lock rwk, + owner @{user_config_dirs}/lxqt/#@{int} rw, + owner @{user_config_dirs}/lxqt/lxqt-runner.conf.@{rand6} rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor From e5ed979ce10e35ee4908ca1652161f7649782bf7 Mon Sep 17 00:00:00 2001 From: valoq Date: Sat, 23 Nov 2024 22:03:42 +0100 Subject: [PATCH 0485/1455] add profile for swayimg (#612) * add profile for swayimg * fix exec --- apparmor.d/profiles-s-z/swayimg | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 apparmor.d/profiles-s-z/swayimg diff --git a/apparmor.d/profiles-s-z/swayimg b/apparmor.d/profiles-s-z/swayimg new file mode 100644 index 000000000..a3ed158b1 --- /dev/null +++ b/apparmor.d/profiles-s-z/swayimg @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/swayimg +profile swayimg @{exec_path} { + include + include + include + include + + @{exec_path} mr, + + owner @{user_config_dirs}/swayimg/** r, + + include if exists +} + +# vim:syntax=apparmor From 3cc7f82d300e7a3490bd52a2aeb2b85986ddcffd Mon Sep 17 00:00:00 2001 From: odomingao Date: Sun, 24 Nov 2024 15:23:06 -0300 Subject: [PATCH 0486/1455] Fix typo --- apparmor.d/tunables/multiarch.d/extensions | 36 +++++++++++----------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/extensions b/apparmor.d/tunables/multiarch.d/extensions index 956e8c253..d3d56934e 100644 --- a/apparmor.d/tunables/multiarch.d/extensions +++ b/apparmor.d/tunables/multiarch.d/extensions @@ -311,24 +311,24 @@ @{video_ext} += 3[gG]2 # 3g2 # Subtitles -@{suntitles_ext} = [aA][qQ][tT] # aqt -@{suntitles_ext} += [aA][sS][sS] # ass -@{suntitles_ext} += [gG][sS][uU][bB] # gsub -@{suntitles_ext} += [uU][sS][fF] # usf -@{suntitles_ext} += [pP][aA][cC] # pac -@{suntitles_ext} += [pP][jJ][sS] # pjs -@{suntitles_ext} += [pP][sS][bB] # psb -@{suntitles_ext} += [rR][tT] # rt -@{suntitles_ext} += [sS][bB][vV] # sbv -@{suntitles_ext} += [sS][mM][iI] # smi -@{suntitles_ext} += [sS][rR][tT] # srt -@{suntitles_ext} += [sS][sS][aA] # ssa -@{suntitles_ext} += [sS][sS][fF] # ssf -@{suntitles_ext} += [sS][tT][lL] # stl -@{suntitles_ext} += [sS][uU][bB] # sub -@{suntitles_ext} += [tT][t][mM][lL] # ttml -@{suntitles_ext} += [tT][t][xX][tT] # ttxt -@{suntitles_ext} += [vV][tT][t] # vtt +@{subtitles_ext} = [aA][qQ][tT] # aqt +@{subtitles_ext} += [aA][sS][sS] # ass +@{subtitles_ext} += [gG][sS][uU][bB] # gsub +@{subtitles_ext} += [uU][sS][fF] # usf +@{subtitles_ext} += [pP][aA][cC] # pac +@{subtitles_ext} += [pP][jJ][sS] # pjs +@{subtitles_ext} += [pP][sS][bB] # psb +@{subtitles_ext} += [rR][tT] # rt +@{subtitles_ext} += [sS][bB][vV] # sbv +@{subtitles_ext} += [sS][mM][iI] # smi +@{subtitles_ext} += [sS][rR][tT] # srt +@{subtitles_ext} += [sS][sS][aA] # ssa +@{subtitles_ext} += [sS][sS][fF] # ssf +@{subtitles_ext} += [sS][tT][lL] # stl +@{subtitles_ext} += [sS][uU][bB] # sub +@{subtitles_ext} += [tT][t][mM][lL] # ttml +@{subtitles_ext} += [tT][t][xX][tT] # ttxt +@{subtitles_ext} += [vV][tT][t] # vtt # Images @{image_ext} = [aA][pP][nN][gG] # apng From 212b8dcf54357974c603c925a1207b591f995a47 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 29 Nov 2024 15:34:10 +0000 Subject: [PATCH 0487/1455] feat(profile): improve some core profiles. --- apparmor.d/groups/systemd/networkctl | 5 ++-- apparmor.d/profiles-a-f/cgrulesengd | 36 ++++++++++------------------ apparmor.d/profiles-a-f/chsh | 4 +++- 3 files changed, 18 insertions(+), 27 deletions(-) diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index a4bab2be3..ce81686ae 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -27,11 +27,10 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { unix (bind) type=stream addr=@@{udbus}/bus/networkctl/system, #aa:dbus talk bus=system name=org.freedesktop.network1 label=systemd-networkd - # No label available - dbus send bus=system path=/org/freedesktop/network@{int} + dbus send bus=system path=/org/freedesktop/network1{,/**} interface=org.freedesktop.DBus.Properties member=Get - peer=(name=org.freedesktop.network@{int}), + peer=(name=org.freedesktop.network1), @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/cgrulesengd b/apparmor.d/profiles-a-f/cgrulesengd index 08b1d83b5..6f31a43d5 100644 --- a/apparmor.d/profiles-a-f/cgrulesengd +++ b/apparmor.d/profiles-a-f/cgrulesengd @@ -12,19 +12,9 @@ profile cgrulesengd @{exec_path} { include include - # For creating Unix domain sockets/IPC sockets: - # socket(AF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR) = 3 - # ... - # bind(3, {sa_family=AF_NETLINK, nl_pid=13284, nl_groups=0x000001}, 12) = -1 EPERM (Operation - # not permitted) - capability net_admin, - - # To remove the following errors: - # readlink("/proc/12/exe", 0x7ffc9fa85cd0, 4096) = -1 EACCES (Permission denied) - capability sys_ptrace, - - # To be able to read the /proc/ files of all processes in the system. capability dac_read_search, + capability net_admin, + capability sys_ptrace, network netlink dgram, @@ -32,22 +22,22 @@ profile cgrulesengd @{exec_path} { @{exec_path} mr, - @{sys}/fs/cgroup/**/tasks w, + + /etc/cgconfig.conf r, + /etc/cgconfig.d/{,*} r, + + /etc/cgrules.conf r, + /etc/cgrules.d/{,*} r, + + owner @{run}/cgred.socket w, + + @{sys}/fs/cgroup/** rw, @{PROC}/ r, @{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/task/ r, - owner @{PROC}/@{pid}/mounts r, @{PROC}/cgroups r, - - @{sys}/fs/cgroup/unified/cgroup.controllers r, - - owner @{run}/cgred.socket w, - - /etc/cgconfig.conf r, - /etc/cgrules.conf r, - /etc/cgconfig.d/ r, - + owner @{PROC}/@{pid}/mounts r, include if exists } diff --git a/apparmor.d/profiles-a-f/chsh b/apparmor.d/profiles-a-f/chsh index f8a2af5c4..e124e4d19 100644 --- a/apparmor.d/profiles-a-f/chsh +++ b/apparmor.d/profiles-a-f/chsh @@ -26,11 +26,13 @@ profile chsh @{exec_path} { /etc/shells r, + /etc/.chsh.@{rand6} rw, /etc/passwd rw, /etc/passwd- w, - /etc/passwd+ rw, /etc/passwd.@{pid} w, /etc/passwd.lock wl -> /etc/passwd.@{pid}, + /etc/passwd.OLD wl -> /etc/passwd, + /etc/passwd+ rw, /etc/shadow r, From 94bf2495e3805167b73235062d1f0b44ce1ca9b0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 29 Nov 2024 15:41:54 +0000 Subject: [PATCH 0488/1455] feat(profile): needrestart improve mqueue rule. --- apparmor.d/profiles-m-r/needrestart | 2 +- tests/bats/needrestart.bats | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index f5722ed3d..cc411ef83 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -22,7 +22,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { ptrace (read), - mqueue r type=posix /, + mqueue (r,getattr) type=posix /, @{exec_path} mrix, diff --git a/tests/bats/needrestart.bats b/tests/bats/needrestart.bats index 567f8c773..4676b36af 100644 --- a/tests/bats/needrestart.bats +++ b/tests/bats/needrestart.bats @@ -5,10 +5,6 @@ load common -setup_file() { - skip "mqueue raised despite the rule being present. See https://gitlab.com/apparmor/apparmor/-/issues/362" -} - @test "needrestart: List outdated processes" { needrestart } From 3690a4c327118efd325f05582e4a8d35baca5fb0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Dec 2024 22:54:28 +0100 Subject: [PATCH 0489/1455] fix: apparmor parser inside snap. --- apparmor.d/profiles-a-f/apparmor_parser | 1 + apparmor.d/profiles-s-z/snap-seccomp | 2 ++ 2 files changed, 3 insertions(+) diff --git a/apparmor.d/profiles-a-f/apparmor_parser b/apparmor.d/profiles-a-f/apparmor_parser index 19c0f6902..dc15d48b9 100644 --- a/apparmor.d/profiles-a-f/apparmor_parser +++ b/apparmor.d/profiles-a-f/apparmor_parser @@ -17,6 +17,7 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{lib_dirs}/@{multiarch}/** mr, @{lib_dirs}/snapd/apparmor.d/{,**} r, @{lib_dirs}/snapd/apparmor/{,**} r, diff --git a/apparmor.d/profiles-s-z/snap-seccomp b/apparmor.d/profiles-s-z/snap-seccomp index 6b0917f8a..e7660f7b8 100644 --- a/apparmor.d/profiles-s-z/snap-seccomp +++ b/apparmor.d/profiles-s-z/snap-seccomp @@ -14,6 +14,8 @@ profile snap-seccomp @{exec_path} { include include + capability dac_read_search, + network netlink raw, @{exec_path} mr, From 14e9fea29a28cd4049ba3542e1d38209ed3e5914 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Dec 2024 23:17:27 +0100 Subject: [PATCH 0490/1455] feat: improve dbus integration for chsh, better handling of generic needrestart. --- .github/local/needrestart | 2 ++ .github/workflows/main.yml | 1 + apparmor.d/profiles-a-f/chsh | 8 +++++++- apparmor.d/profiles-m-r/needrestart | 3 +-- apparmor.d/profiles-s-z/snapd | 1 + 5 files changed, 12 insertions(+), 3 deletions(-) create mode 100644 .github/local/needrestart diff --git a/.github/local/needrestart b/.github/local/needrestart new file mode 100644 index 000000000..33b23e014 --- /dev/null +++ b/.github/local/needrestart @@ -0,0 +1,2 @@ + + /var/lib/waagent/** r, diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c7a76f871..75fa5c051 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -94,6 +94,7 @@ jobs: sudo apt-get install -y \ apparmor-profiles apparmor-utils \ bats bats-support + sudo install -Dm0644 .github/local/needrestart /etc/apparmor.d/local/needrestart - name: Install apparmor.d run: | diff --git a/apparmor.d/profiles-a-f/chsh b/apparmor.d/profiles-a-f/chsh index e124e4d19..bf2b92a98 100644 --- a/apparmor.d/profiles-a-f/chsh +++ b/apparmor.d/profiles-a-f/chsh @@ -10,18 +10,24 @@ include @{exec_path} = @{bin}/chsh profile chsh @{exec_path} { include - include include + include + include include include capability audit_write, capability chown, capability fsetid, + capability net_admin, capability setuid, network netlink raw, + unix type=stream addr=@@{udbus}/bus/chsh/system, + + #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed + @{exec_path} mr, /etc/shells r, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index cc411ef83..56f95b589 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -26,6 +26,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, + @{bin}/* r, @{sh_path} rix, @{bin}/dpkg-query rpx, @{bin}/fail2ban-server rPx, @@ -42,8 +43,6 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{lib}/needrestart/* rPx, /usr/share/debconf/frontend rix, - @{bin}/networkd-dispatcher r, - @{bin}/gettext.sh r, /usr/share/needrestart/{,**} r, /usr/share/unattended-upgrades/unattended-upgrade-shutdown r, diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index 63a1568b5..fe24ed061 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -93,6 +93,7 @@ profile snapd @{exec_path} { @{lib_dirs}/snapd/snap-update-ns rPx, /usr/share/bash-completion/{,**} r, + /usr/share/dbus-1/{system,session}.d.d/snapd.{system,session}-services.conf* rw, /usr/share/dbus-1/{system,session}.d/{,snapd*} r, /usr/share/dbus-1/services/*snap* r, /usr/share/polkit-1/actions/{,**/} r, From c7030f16a681b8f6272845ee758c4d4ac822c01e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Dec 2024 23:24:14 +0100 Subject: [PATCH 0491/1455] feat(profile): minor update. --- apparmor.d/groups/network/networkd-dispatcher | 3 ++- apparmor.d/profiles-a-f/flatpak | 7 +++++- apparmor.d/profiles-g-l/iotop | 24 ++++++++----------- 3 files changed, 18 insertions(+), 16 deletions(-) diff --git a/apparmor.d/groups/network/networkd-dispatcher b/apparmor.d/groups/network/networkd-dispatcher index 632910933..45fbf76aa 100644 --- a/apparmor.d/groups/network/networkd-dispatcher +++ b/apparmor.d/groups/network/networkd-dispatcher @@ -21,8 +21,9 @@ profile networkd-dispatcher @{exec_path} { @{exec_path} mr, @{bin}/ r, - @{bin}/networkctl rPx, + @{bin}/chronyc rPx, @{bin}/ls rix, + @{bin}/networkctl rPx, @{bin}/sed rix, @{lib}/networkd-dispatcher/routable.d/postfix rix, diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak index 7368d7c3b..bc21a583f 100644 --- a/apparmor.d/profiles-a-f/flatpak +++ b/apparmor.d/profiles-a-f/flatpak @@ -62,7 +62,12 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain owner @{HOME}/.var/ w, owner @{HOME}/.var/app/{,**} rw, - owner @{user_documents_dirs}/ rw, + # Can create dotfile directories for any app + owner @{user_cache_dirs}/*/ w, + owner @{user_config_dirs}/*/ w, + owner @{user_share_dirs}/*/ w, + owner @{user_games_dirs}/{,**/} w, + owner @{user_documents_dirs}/ w, owner @{user_cache_dirs}/flatpak/{,**} rw, owner @{user_config_dirs}/pulse/client.conf r, diff --git a/apparmor.d/profiles-g-l/iotop b/apparmor.d/profiles-g-l/iotop index c53b4656d..d85b0244f 100644 --- a/apparmor.d/profiles-g-l/iotop +++ b/apparmor.d/profiles-g-l/iotop @@ -10,32 +10,28 @@ include @{exec_path} = @{bin}/iotop profile iotop @{exec_path} { include - include include + include - # Needed? - audit deny capability net_admin, - - # To set processes' priorities capability sys_nice, - @{exec_path} r, - @{bin}/python3.@{int} r, + network netlink raw, - @{bin}/file rix, + @{exec_path} r, @{bin}/ r, + @{bin}/file rix, + @{bin}/python3.@{int} r, + + /etc/magic r, @{PROC}/ r, - @{PROC}/vmstat r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/fd/ r, @{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/task/ r, @{PROC}/sys/kernel/pid_max r, - - # For file - /etc/magic r, + @{PROC}/vmstat r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mounts r, include if exists } From c8b1751f37289da85eeaa4d0d5081e07594d7125 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Dec 2024 23:29:44 +0100 Subject: [PATCH 0492/1455] fix(profile): snap integration with dbus. --- apparmor.d/profiles-s-z/snapd | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index fe24ed061..0a9b332d1 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -93,8 +93,7 @@ profile snapd @{exec_path} { @{lib_dirs}/snapd/snap-update-ns rPx, /usr/share/bash-completion/{,**} r, - /usr/share/dbus-1/{system,session}.d.d/snapd.{system,session}-services.conf* rw, - /usr/share/dbus-1/{system,session}.d/{,snapd*} r, + /usr/share/dbus-1/{system,session}.d/{,snapd*} rw, /usr/share/dbus-1/services/*snap* r, /usr/share/polkit-1/actions/{,**/} r, From 64ed654fdfa79a4c5ceba0454d26d31143f0daeb Mon Sep 17 00:00:00 2001 From: Alex Date: Thu, 12 Dec 2024 18:26:16 +0100 Subject: [PATCH 0493/1455] fix(profile): cron communication with dbus. --- apparmor.d/groups/cron/cron | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 4ce618ef7..25549a39c 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -27,6 +27,8 @@ profile cron @{exec_path} flags=(attach_disconnected) { ptrace (read) peer=unconfined, + unix bind type=stream addr=@@{udbus}/bus/cron/system, + @{exec_path} mr, @{sh_path} rix, From c8cbeac9b245290efb1adb97c5240092c43c3df0 Mon Sep 17 00:00:00 2001 From: Alex Date: Thu, 12 Dec 2024 21:34:18 +0000 Subject: [PATCH 0494/1455] fix(profile): snapd --- apparmor.d/profiles-s-z/snapd | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index 0a9b332d1..250005f55 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -68,6 +68,7 @@ profile snapd @{exec_path} { @{sh_path} rix, @{bin}/apparmor_parser rPx, @{bin}/cp rix, + @{bin}/getent rix, @{bin}/gzip rix, @{bin}/journalctl rPx, @{bin}/kmod rPx, From 6dcb6c0362fd6abd5464b637aa9f33b4db8fc5fc Mon Sep 17 00:00:00 2001 From: odomingao Date: Fri, 6 Dec 2024 09:41:35 -0300 Subject: [PATCH 0495/1455] Add wttrbar --- apparmor.d/profiles-s-z/wttrbar | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 apparmor.d/profiles-s-z/wttrbar diff --git a/apparmor.d/profiles-s-z/wttrbar b/apparmor.d/profiles-s-z/wttrbar new file mode 100644 index 000000000..37933679d --- /dev/null +++ b/apparmor.d/profiles-s-z/wttrbar @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 odomingao +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/wttrbar +profile wttrbar @{exec_path} { + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + + @{exec_path} mr, + + owner /tmp/wttrbar--wttr.in.json rw, + + include if exists +} + +# vim:syntax=apparmor From 3721d12a5d2a4bd555f9adea2881e488ff6167f6 Mon Sep 17 00:00:00 2001 From: Besanon Date: Fri, 13 Dec 2024 18:06:59 +0100 Subject: [PATCH 0496/1455] more lxqt-files (#613) * Create abstraction for lxqt desktop group first file for the LXQT 2.0 desktop group * Update lxqt * xdg-desktop abstraction added * removing tabs * Create startlxqt starter file for LXQT Desktop * Create startlxqt * fixing startlxqt I use sddm as display manager I cant remove the other file - only use graphical env., sorry After startlxqt i would add 2 lines to sddm to enable the start of LXQT desktop * Delete apparmor.d/profiles-s-z/startlxqt * indented by 2 spaces (like other entries) * Update sddm Enable sddm to start an lxqt desktop session * Create lxqt-session lxqt-session to be started by startlxqt. Display manager: sddm * Update lxqt-session * Update lxqt-session * removed trailing whitespace * Update kscreen_backend_launcher to support lxqt desktop is needed for several complaints: DENIED kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r DENIED kscreen_backend_launcher open /usr/share/lxqt/lxqt.conf comm=kscreen_backend requested_mask=r denied_mask=r DENIED kscreen_backend_launcher open owner @{user_config_dirs}/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r DENIED kscreen_backend_launcher open /usr/share/lxqt/session.conf comm=kscreen_backend requested_mask=r denied_mask=r * Update lxqt-session * Create lxqt-panel * Update lxqt-panel * Update lxqt-panel * Update lxqt-panel * fix conflicting x * Update lxqt-panel add child-open * remove include you think its too permissive to have app-launcher-user here, right? * Update lxqt-panel add needed programs * Update lxqt-panel turning back to layout of corresponding xfce file. * Create lxqt-globalkeysd * Create lxqt-about * Create lxqt-leave * Create lxqt-runner * Update lxqt-leave * Update lxqt-runner * Update lxqt-globalkeysd * remove video in lxqt-about * Update lxqt-about * Update lxqt-runner * remove abstr. in lxqt-globalkeysd * remove abstr. in lxqt-runner * remove abstr. in lxqt-leave * Create lxqt-config-notificationd * Create lxqt-config-locale * Create lxqt-config-printer * Create lxqt-config-file-associations * Create lxqt-config-powermanagement * enable wayland-session for lxqt 2.1 startlxqtwayland for starting the session, support for labwc and kwin_wayland * Update lxqt-config-printer * Update lxqt-config-powermanagement * Update sddm * Update sddm * adapt pci-rules ok, havent seen this profile yet. I will change that in lxqt-powermanagement as well and check the other profiles * Update lxqt-config-powermanagement * Update lxqt-config-powermanagement * Update lxqt-config-powermanagement * Update lxqt-config-powermanagement --- apparmor.d/groups/kde/sddm | 4 ++ .../groups/lxqt/lxqt-config-file-associations | 36 ++++++++++++++++ apparmor.d/groups/lxqt/lxqt-config-locale | 40 +++++++++++++++++ .../groups/lxqt/lxqt-config-notificationd | 34 +++++++++++++++ .../groups/lxqt/lxqt-config-powermanagement | 43 +++++++++++++++++++ apparmor.d/groups/lxqt/lxqt-config-printer | 24 +++++++++++ 6 files changed, 181 insertions(+) create mode 100644 apparmor.d/groups/lxqt/lxqt-config-file-associations create mode 100644 apparmor.d/groups/lxqt/lxqt-config-locale create mode 100644 apparmor.d/groups/lxqt/lxqt-config-notificationd create mode 100644 apparmor.d/groups/lxqt/lxqt-config-powermanagement create mode 100644 apparmor.d/groups/lxqt/lxqt-config-printer diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index d8adff564..8e491bb2b 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -40,6 +40,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { ptrace (trace) peer=@{profile_name}, signal (receive) set=(hup) peer=@{p_systemd}, + signal (send) set=(kill, term) peer=labwc, signal (send) set=(kill, term) peer=lxqt-session, signal (send) set=(kill, term) peer=startplasma, signal (send) set=(kill, term) peer=xorg, @@ -47,6 +48,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { signal (send) set=(term) peer=kwin_wayland, signal (send) set=(term) peer=sddm-greeter, signal (send) set=(term) peer=startplasma-wayland, + signal (send) set=(term) peer=startlxqtwayland, dbus receive bus=system path=/org/freedesktop/DisplayManager/Seat@{int} interface=org.freedesktop.DBus.Introspectable @@ -95,7 +97,9 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/kwalletd{5,6} rPx, @{bin}/kwin_wayland rPx, @{bin}/sddm-greeter{,-qt6} rPx, + @{bin}/labwc rPx, @{bin}/startlxqt rPx, + @{bin}/startlxqtwayland rPx, @{bin}/startplasma-wayland rPx, @{bin}/startplasma-x11 rPx, @{bin}/sway rPUx, diff --git a/apparmor.d/groups/lxqt/lxqt-config-file-associations b/apparmor.d/groups/lxqt/lxqt-config-file-associations new file mode 100644 index 000000000..4232f1c70 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-file-associations @@ -0,0 +1,36 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-config-file-associations +profile lxqt-config-file-associations @{exec_path} { + include + include + include + + @{exec_path} mr, + + /etc/machine-id r, + + owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/mimeapps* rwk, + owner @{user_config_dirs}/lxqt-* rwk, + owner @{user_config_dirs}/lxqt/ r, + owner @{user_config_dirs}/lxqt/#@{int} rwk, + owner @{user_config_dirs}/lxqt/lxqt-config-file-associations.conf.lock rwk, + owner @{user_config_dirs}/lxqt/lxqt-config-file-associations.conf kl -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/lxqt/lxqt-config-file-associations.conf.@{rand6} rwkl -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/#@{int} rwk, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/lxqt/lxqt-config-locale b/apparmor.d/groups/lxqt/lxqt-config-locale new file mode 100644 index 000000000..c7c868c18 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-locale @@ -0,0 +1,40 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-config-locale +profile lxqt-config-locale @{exec_path} { + include + include + include + + @{exec_path} mr, + + /etc/machine-id r, + + owner @{user_config_dirs}/lxqt/* r, + owner @{user_config_dirs}/lxqt/#@{int} rw, + owner @{user_config_dirs}/lxqt/lxqt-config.conf.lock rwk, + owner @{user_config_dirs}/lxqt/lxqt-config.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/lxqt-config.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/lxqt/lxqt-config-locale.conf l -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/lxqt/lxqt-config-locale.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/lxqt-config-locale.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, + owner @{user_config_dirs}/lxqt/lxqt-config-locale.conf.lock rwk, + owner @{user_config_dirs}/lxqt/session.conf.lock rwk, + owner @{user_config_dirs}/lxqt/session.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/session.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/lxqt/lxqt-config-notificationd b/apparmor.d/groups/lxqt/lxqt-config-notificationd new file mode 100644 index 000000000..63b2eb673 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-notificationd @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-config-notificationd +profile lxqt-config-notificationd @{exec_path} { + include + include + include + + @{exec_path} mr, + + /etc/machine-id r, + + /var/lib/dbus/machine-id r, + + owner @{user_config_dirs}/lxqt/#@{int} rw, + owner @{user_config_dirs}/lxqt/notifications.conf.lock rwk, + owner @{user_config_dirs}/lxqt/notifications.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/notifications.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, + + owner /tmp/#@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/lxqt/lxqt-config-powermanagement b/apparmor.d/groups/lxqt/lxqt-config-powermanagement new file mode 100644 index 000000000..4b96ccb36 --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-powermanagement @@ -0,0 +1,43 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-config-powermanagement +profile lxqt-config-powermanagement @{exec_path} { + include + include + include + include + + @{exec_path} mr, + + /etc/machine-id r, + + owner @{user_config_dirs}/lxqt/#@{int} rw, + owner @{user_config_dirs}/lxqt/lxqt-powermanagement.conf.lock rwk, + owner @{user_config_dirs}/lxqt/lxqt-powermanagement.conf.@{rand6} rw, + owner @{user_config_dirs}/lxqt/lxqt-powermanagement.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, + + @{sys}/class/leds/ r, + @{sys}/devices/@{pci}/backlight/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/backlight/**/brightness rw, + @{sys}/devices/@{pci}/drm/card@{int}/**/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/drm/card@{int}/**/{uevent,type,enabled} r, + @{sys}/devices/@{pci}/drm/card@{int}/**/brightness rw, + @{sys}/devices/@{pci}/*_backlight/{,max_,actual_}brightness rw, + @{sys}/devices/@{pci}/*_backlight/{uevent,type,enabled} r, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/lxqt/lxqt-config-printer b/apparmor.d/groups/lxqt/lxqt-config-printer new file mode 100644 index 000000000..f4c38e94d --- /dev/null +++ b/apparmor.d/groups/lxqt/lxqt-config-printer @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024 Besanon +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lxqt-config-printer +profile lxqt-config-printer @{exec_path} { + include + include + + @{exec_path} mr, + + owner /tmp/@{int} r, + + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor From 313f2f7f2cace447c8f2420bcdc62bd283e76030 Mon Sep 17 00:00:00 2001 From: nobody43 <15267739+nobody43@users.noreply.github.com> Date: Mon, 18 Nov 2024 23:14:39 +0000 Subject: [PATCH 0497/1455] Create profile_check.py --- tests/profile_check.py | 463 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 463 insertions(+) create mode 100644 tests/profile_check.py diff --git a/tests/profile_check.py b/tests/profile_check.py new file mode 100644 index 000000000..5cc39d6b9 --- /dev/null +++ b/tests/profile_check.py @@ -0,0 +1,463 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0-only + +# KNOWN ISSUES: +# No guards for file type - expects AppArmor +# Diffirent suggestions for single line are mutually exclusive +# Suggestion could point to changed profile name, based on other suggestion + +import sys +import argparse +import pathlib +import shlex +import json +from copy import deepcopy + +def sanitizeProfileName(name): + + if name.startswith('/') or name.startswith('@{'): + name = pathlib.Path(name).stem + + if ' ' in name: + name = re.sub(r'\s+', '-', name) + + return name + +def makeLocalIdentity(nestingStacker_): + + newStacker = [] + for i in nestingStacker_: + i = sanitizeProfileName(i) + newStacker.append(i) + + identity = '_'.join(newStacker) # separate each (sub)profile identity with underscores + + return identity + +def getCurrentProfile(stacker): + + if stacker: + profile = stacker[-1] + else: + profile = None + + return profile + +def handleFileMessages(l, file, profile, lineNum): + + wholeFileAccessProfiles = ( +# '', + ) + suggestOwner = ( # TODO: switch to AARE + r'^@{HOME}', + r'^/home/\w+/', + r'^/run/user/\d+/', + r'^/tmp/', + r'^/var/tmp/', + r'^/dev/shm/', + ) + + lG = l.groupdict() + reason_ = None + if lG.get('path'): + if lG.get('path').startswith('/**') and profile not in wholeFileAccessProfiles: + severity_ = 'ERROR' + reason_ = 'Whole filesystem access is too broad' + suggestion_ = None + + for r in suggestOwner: + if re.match(r, lG.get('path')) and not lG.get('owner'): + indentRe = re.match(r'^\s+', l.group()) + if indentRe: + indent = indentRe.group() + else: + indent = '' + + severity_ = 'NOTICE' + reason_ = "'owner' is likely required" + suggestion_ = indent + 'owner ' + l.group().lstrip() + break + + elif lG.get('bare_file') and profile not in wholeFileAccessProfiles: + severity_ = 'ERROR' + reason_ = 'Whole filesystem access is too broad' + suggestion_ = None + + if reason_: # something matched + msg = ({'filename': file, + 'profile': profile, + 'severity': severity_, + 'line': lineNum, + 'reason': reason_, + 'suggestion': suggestion_}) + else: + msg = None + + return msg + +def readApparmorFile(fullpath): + '''AA file could contain multiple AA profiles''' + headers = ( + '# AppArmor.d - Full set of apparmor profiles', + '# Copyright (C) ', + '# SPDX-License-Identifier: GPL-2.0-only', + ) + + file_data = {} + fileVars = {} + nestingStacker = [] + duplicateProfilesCounter = [] + localExists = {} + localExists_eol = {} + messages = [] + exceptionMsg = None + line = None + gotAbi = False + gotHeaders = {} + gotAttach = False + isAfterProfileStart = False + try: + with open(fullpath, 'r') as f: + for n,line in enumerate(f, start=1): + if isAfterProfileStart: + isAfterProfileStart = False + expectedIndent = len(nestingStacker) * ' ' + indentRe = re.match(r'^\s+', line) + if indentRe: + indent = indentRe.group() + else: + indent = '' + + if indent != expectedIndent: + spacesCount = len(nestingStacker) * 2 + nesingCount = len(nestingStacker) + messages.append({'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'WARNING', + 'line': n, + 'reason': f"Expected {spacesCount} spaces for {nesingCount} nesting", + 'suggestion': f"{expectedIndent}{line}"}) + + if line.endswith(' \n'): + messages.append({'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'WARNING', + 'line': n, + 'reason': "Redundant trailing whitespace", + 'suggestion': line.rstrip()}) + + if '\t' in line: + messages.append({'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'WARNING', + 'line': n, + 'reason': "Tabs are not allowed", + 'suggestion': line.replace('\t', '')}) + + if len(gotHeaders) < 3 and not nestingStacker: + for nH,i in enumerate(headers): + if line.startswith(i): + gotHeaders[nH] = True + + if RE_ABI.search(line): + gotAbi = line + + elif RE_PROFILE_START.search(line) or RE_PROFILE_HAT_DEF.search(line): + isAfterProfileStart = True + m = parse_profile_start_line(line, fullpath) + if m.get('profile'): + nestingStacker.append(m.get('profile')) # set early + + if m.get('attachment') != '@{exec_path}' and not gotAttach: # can be only singular + gotAttach = True + messages.append({'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'WARNING', + 'line': n, + 'reason': "'@{exec_path}' must be defined as main path attachment", + 'suggestion': None}) + + profileMsg = {'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'WARNING', + 'line': n, + 'reason': "A short named profile must be defined", + 'suggestion': None} + if m.get('plainprofile'): + messages.append(profileMsg) + elif m.get('namedprofile'): + if m.get('namedprofile').startswith('/'): + messages.append(profileMsg) + + if m.get('flags'): + m['flags'] = set(shlex.split(m.pop('flags').replace(',', ''))) + if 'complain' in m['flags']: + messages.append({'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'WARNING', + 'line': n, + 'reason': "'complain' flag must be defined in 'dists/flags'", + 'suggestion': None}) + else: + m['flags'] = set() + + if m.get('profile'): + duplicateProfilesCounter.append(m.get('profile')) + profileIdentity = '//'.join(nestingStacker) + file_data[profileIdentity] = m + + elif RE_PROFILE_VARIABLE.search(line): + lineV = RE_PROFILE_VARIABLE.search(line).groups() + + name = strip_quotes(lineV[0]) + operation = lineV[1] + val = separate_vars(lineV[2]) + if fileVars.get(name): + fileVars[name].update(set(val)) + if operation == '=': + messages.append({'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'DEGRADED', + 'line': n, + 'reason': "Tunable must be appended with '+='", + 'suggestion': None}) + else: + fileVars[name] = set(val) + if operation == '+=': + messages.append({'filename': fullpath, + 'profile': getCurrentProfile(nestingStacker), + 'severity': 'DEGRADED', + 'line': n, + 'reason': "Tunable must be defined with '='", + 'suggestion': None}) + + elif RE_INCLUDE.search(line): + if nestingStacker: + profileIdentity = '//'.join(nestingStacker) + localIdentity = makeLocalIdentity(nestingStacker) + localValue = f'include if exists ' # commented out will also match + if localValue in line: + localExists[profileIdentity] = localValue + + # Handle file entries + elif RE_PROFILE_FILE_ENTRY.search(line): + lineF = RE_PROFILE_FILE_ENTRY.search(line) + fileMsg = handleFileMessages(lineF, fullpath, getCurrentProfile(nestingStacker), n) + if fileMsg: + messages.append(fileMsg) + + elif RE_PROFILE_END.search(line): + if getCurrentProfile(nestingStacker): + if not nestingStacker: + messages.append({'filename': fullpath, + 'profile': None, + 'severity': 'DEGRADED', + 'line': n, + 'reason': "Unbalanced parenthesis?", # not fully covered + 'suggestion': None}) + else: + profileIdentity = '//'.join(nestingStacker) + localExists_eol[profileIdentity] = n + del nestingStacker[-1] # remove last + + except PermissionError: + exceptionMsg = 'Unable to read the file (PermissionError)' + + except UnicodeDecodeError: + exceptionMsg = 'Unable to read the file (UnicodeDecodeError)' + + except FileNotFoundError: + exceptionMsg = 'No such file or directory (FileNotFoundError)' + + if exceptionMsg: + messages.append({'filename': fullpath, + 'profile': None, + 'severity': 'NOTICE', + 'line': None, + 'reason': exceptionMsg, + 'suggestion': None}) + + # Ensure proper header is present + if len(gotHeaders) < 3: + combinedHeader = '\n'.join(headers) + messages.append({'filename': fullpath, + 'profile': None, + 'severity': 'WARNING', + 'line': 1, + 'reason': 'No proper header', + 'suggestion': combinedHeader}) + + # Ensure ABI is present + changeAbi = False + abi = 'abi ,' + if gotAbi: + if gotAbi.strip() != abi: + changeAbi = True + else: + changeAbi = True + + if changeAbi: + messages.append({'filename': fullpath, + 'profile': None, + 'severity': 'WARNING', + 'line': None, + 'reason': 'ABI is required', + 'suggestion': abi}) + + # Ensure trailing vim syntax + if line: + trailingSyntax = '# vim:syntax=apparmor' + if line != trailingSyntax: + messages.append({'filename': fullpath, + 'profile': None, + 'severity': 'WARNING', + 'line': None, + 'reason': 'No trailing syntax hint', + 'suggestion': trailingSyntax}) + + # Assign variables to profile attachments as paths and assign filenames + for p,d in deepcopy(file_data).items(): + file_data[p]['filename'] = fullpath + attachment = d.get('attachment') + if attachment: + if attachment.startswith('@{'): + if fileVars.get(attachment): + file_data[p]['attach_paths'] = fileVars[attachment] # incoming set + else: + messages.append({'filename': fullpath, + 'profile': p, + 'severity': 'ERROR', + 'line': None, + 'reason': f"Unknown global variable as profile attachment: {attachment}", + 'suggestion': None}) + + else: + if isinstance(file_data[p].get('attachment'), set): + raise ValueError("Expecting 'str' or 'None', not 'set'") + file_data[p]['attach_paths'] = {file_data[p]['attachment']} + + # Check if profile block does not have corresponding 'local' include + for p,d in file_data.items(): + if not localExists.get(p): # not found previously + if '//' in p: + identity = p.split('//') + else: + identity = [p] + + localIdentity = makeLocalIdentity(identity) + filename = file_data[p]['filename'] + messages.append({'filename': filename, + 'profile': p, + 'severity': 'WARNING', + 'line': localExists_eol.get(p), # None? Unbalanced parenthesis? + 'reason': "The (sub)profile block does not have expected 'local' include", + 'suggestion': f'include if exists '}) + + # Track multiple definitions inside single file + for profile in duplicateProfilesCounter: + counter = duplicateProfilesCounter.count(profile) + if counter >= 2: + messages.append({'filename': fullpath, + 'profile': profile, + 'severity': 'DEGRADED', + 'line': None, + 'reason': "Profile has been defined {counter} times in the same file", + 'suggestion': None}) + + return (messages, file_data) + +def findAllProfileFilenames(profile_dir): + + profiles = set() + for path in pathlib.Path(profile_dir).iterdir(): + if path.is_file() and not is_skippable_file(path): + profiles.add(path.resolve()) + + # Not default, dig deeper + if not profiles: + nestedDirs = ( + 'groups', + 'profiles-a-f', + 'profiles-g-l', + 'profiles-m-r', + 'profiles-s-z', + ) + for d in nestedDirs: + dirpath = pathlib.Path(pathlib.Path(profile_dir).resolve(), pathlib.Path(d)) + for p in dirpath.rglob("*"): + if p.is_file(): + profiles.add(p) + + return profiles + +def handleArgs(): + """DEGRADED are purposed for fatal errors - when the profile set will fail to load entirely""" + + allSeverities = ['DEBUG', 'NOTICE', 'WARNING', 'ERROR', 'CRITICAL', 'DEGRADED'] + aaRoot = '/etc/apparmor.d' + + parser = argparse.ArgumentParser() + parser.add_argument('-d', '--aa-root-dir', action='store', + default=aaRoot, + help='Target different AppArmor root directory rather than default') + parser.add_argument('-p', '--profile', action='append', + help='Handle only specified profile') +# parser.add_argument('-s', '--severity', action='append', +# choices=allSeverities, +# help='Handle only specified severity event') + + args = parser.parse_args() + +# if not args.severity: +# args.severity = allSeverities + + return args + +def main(argv): + + args = handleArgs() + + messages = [] + + profile_dir = args.aa_root_dir + if not args.profile: + profiles = findAllProfileFilenames(profile_dir) + else: + profiles = set() + for p in args.profile: + absolutePath = pathlib.Path(p).resolve() + profiles.add(absolutePath) + + profile_data = {} + for path in sorted(profiles): + readApparmorFile_Out = readApparmorFile(path) + profilesInFile = readApparmorFile_Out[1] + messages.extend(readApparmorFile_Out[0]) + profile_data.update(profilesInFile) + + for m in messages: + m['filename'] = str(m.get('filename')) + print(json.dumps(m, indent=2)) + + if messages: + sys.exit(1) + + return None + +if __name__ == '__main__': + '''Safeguard errors does NOT cover loosening existing profiles after loading!''' + try: + from apparmor.regex import * + from apparmor.aa import is_skippable_file + from apparmor.rule.file import FileRule, FileRuleset + from apparmor.common import convert_regexp + try: + from apparmor.rule.variable import separate_vars + except ModuleNotFoundError: + from apparmor.aa import separate_vars + + except ModuleNotFoundError: + raise ModuleNotFoundError(f"""Can't find 'python3-apparmor' package! Install with: +$ sudo apt install python3-apparmor""") + + main(sys.argv) From 21b60b4fa3f931bdc19c07e010a0dd3e59d7e1e8 Mon Sep 17 00:00:00 2001 From: nobody43 <15267739+nobody43@users.noreply.github.com> Date: Mon, 18 Nov 2024 23:31:22 +0000 Subject: [PATCH 0498/1455] Update profile_check.py --- tests/profile_check.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/profile_check.py b/tests/profile_check.py index 5cc39d6b9..00f98ec02 100644 --- a/tests/profile_check.py +++ b/tests/profile_check.py @@ -445,7 +445,7 @@ def main(argv): return None if __name__ == '__main__': - '''Safeguard errors does NOT cover loosening existing profiles after loading!''' + try: from apparmor.regex import * from apparmor.aa import is_skippable_file From 679df325de9d2cd2dbf43083e01598f2285b569c Mon Sep 17 00:00:00 2001 From: nobody43 <15267739+nobody43@users.noreply.github.com> Date: Tue, 19 Nov 2024 18:49:49 +0000 Subject: [PATCH 0499/1455] polishing --- tests/profile_check.py | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/tests/profile_check.py b/tests/profile_check.py index 00f98ec02..ed4316280 100644 --- a/tests/profile_check.py +++ b/tests/profile_check.py @@ -49,9 +49,11 @@ def handleFileMessages(l, file, profile, lineNum): # '', ) suggestOwner = ( # TODO: switch to AARE - r'^@{HOME}', + r'^@{HOME}/', r'^/home/\w+/', + r'^@{run}/user/@{uid}/', r'^/run/user/\d+/', + r'^@{tmp}/', r'^/tmp/', r'^/var/tmp/', r'^/dev/shm/', @@ -60,7 +62,7 @@ def handleFileMessages(l, file, profile, lineNum): lG = l.groupdict() reason_ = None if lG.get('path'): - if lG.get('path').startswith('/**') and profile not in wholeFileAccessProfiles: + if lG.get('path').startswith('/**') and profile not in wholeFileAccessProfiles: # false positives severity_ = 'ERROR' reason_ = 'Whole filesystem access is too broad' suggestion_ = None @@ -84,12 +86,12 @@ def handleFileMessages(l, file, profile, lineNum): suggestion_ = None if reason_: # something matched - msg = ({'filename': file, - 'profile': profile, - 'severity': severity_, - 'line': lineNum, - 'reason': reason_, - 'suggestion': suggestion_}) + msg = {'filename': file, + 'profile': profile, + 'severity': severity_, + 'line': lineNum, + 'reason': reason_, + 'suggestion': suggestion_} else: msg = None @@ -98,7 +100,7 @@ def handleFileMessages(l, file, profile, lineNum): def readApparmorFile(fullpath): '''AA file could contain multiple AA profiles''' headers = ( - '# AppArmor.d - Full set of apparmor profiles', + '# apparmor.d - Full set of apparmor profiles', '# Copyright (C) ', '# SPDX-License-Identifier: GPL-2.0-only', ) @@ -129,14 +131,14 @@ def readApparmorFile(fullpath): indent = '' if indent != expectedIndent: - spacesCount = len(nestingStacker) * 2 - nesingCount = len(nestingStacker) + spacesCount = len(nestingStacker) * 2 + nestingCount = len(nestingStacker) messages.append({'filename': fullpath, 'profile': getCurrentProfile(nestingStacker), 'severity': 'WARNING', 'line': n, - 'reason': f"Expected {spacesCount} spaces for {nesingCount} nesting", - 'suggestion': f"{expectedIndent}{line}"}) + 'reason': f"Expected {spacesCount} spaces for {nestingCount} nesting", + 'suggestion': f"{expectedIndent}{line.lstrip()}"}) if line.endswith(' \n'): messages.append({'filename': fullpath, @@ -152,7 +154,7 @@ def readApparmorFile(fullpath): 'severity': 'WARNING', 'line': n, 'reason': "Tabs are not allowed", - 'suggestion': line.replace('\t', '')}) + 'suggestion': line.replace('\t', ' ')}) if len(gotHeaders) < 3 and not nestingStacker: for nH,i in enumerate(headers): From 3030c28c05604b4f1b669d80f6df1e10b404a9ff Mon Sep 17 00:00:00 2001 From: nobody43 <15267739+nobody43@users.noreply.github.com> Date: Fri, 22 Nov 2024 19:57:13 +0000 Subject: [PATCH 0500/1455] Update profile_check.py --- tests/profile_check.py | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/tests/profile_check.py b/tests/profile_check.py index ed4316280..c793543e3 100644 --- a/tests/profile_check.py +++ b/tests/profile_check.py @@ -13,6 +13,21 @@ import shlex import json from copy import deepcopy +try: + from apparmor.regex import * + from apparmor.aa import is_skippable_file + from apparmor.rule.file import FileRule, FileRuleset + from apparmor.common import convert_regexp + try: + from apparmor.rule.variable import separate_vars + except ImportError: + from apparmor.aa import separate_vars + + LIBAPPARMOR = True + +except ImportError: + LIBAPPARMOR = False + def sanitizeProfileName(name): if name.startswith('/') or name.startswith('@{'): @@ -118,6 +133,7 @@ def readApparmorFile(fullpath): gotHeaders = {} gotAttach = False isAfterProfileStart = False + lastLineNum = None try: with open(fullpath, 'r') as f: for n,line in enumerate(f, start=1): @@ -262,6 +278,8 @@ def readApparmorFile(fullpath): localExists_eol[profileIdentity] = n del nestingStacker[-1] # remove last + lastLineNum = n + except PermissionError: exceptionMsg = 'Unable to read the file (PermissionError)' @@ -308,12 +326,12 @@ def readApparmorFile(fullpath): # Ensure trailing vim syntax if line: - trailingSyntax = '# vim:syntax=apparmor' + trailingSyntax = '# vim:syntax=apparmor\n' if line != trailingSyntax: messages.append({'filename': fullpath, 'profile': None, 'severity': 'WARNING', - 'line': None, + 'line': lastLineNum, 'reason': 'No trailing syntax hint', 'suggestion': trailingSyntax}) @@ -448,18 +466,8 @@ def main(argv): if __name__ == '__main__': - try: - from apparmor.regex import * - from apparmor.aa import is_skippable_file - from apparmor.rule.file import FileRule, FileRuleset - from apparmor.common import convert_regexp - try: - from apparmor.rule.variable import separate_vars - except ModuleNotFoundError: - from apparmor.aa import separate_vars - - except ModuleNotFoundError: - raise ModuleNotFoundError(f"""Can't find 'python3-apparmor' package! Install with: + if not LIBAPPARMOR: + raise ImportError(f"""Can't find 'python3-apparmor' package! Install with: $ sudo apt install python3-apparmor""") main(sys.argv) From 8f4b3304075325f09b5d5d199597db1c1660fc0f Mon Sep 17 00:00:00 2001 From: nobody43 <15267739+nobody43@users.noreply.github.com> Date: Sat, 23 Nov 2024 18:35:53 +0000 Subject: [PATCH 0501/1455] Update profile_check.py --- tests/profile_check.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/profile_check.py b/tests/profile_check.py index c793543e3..90f5b56b2 100644 --- a/tests/profile_check.py +++ b/tests/profile_check.py @@ -456,6 +456,9 @@ def main(argv): profile_data.update(profilesInFile) for m in messages: + if m.get('suggestion'): + if m['suggestion'].endswith('\n'): + m['suggestion'] = m.get('suggestion').removesuffix('\n') m['filename'] = str(m.get('filename')) print(json.dumps(m, indent=2)) From edaa45067abd5f18fa702ca3f08897d93425bbc5 Mon Sep 17 00:00:00 2001 From: nobody43 <15267739+nobody43@users.noreply.github.com> Date: Sat, 23 Nov 2024 19:54:17 +0000 Subject: [PATCH 0502/1455] fix exec_path bug, ignore skipable files --- tests/profile_check.py | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/tests/profile_check.py b/tests/profile_check.py index 90f5b56b2..9b61e6367 100644 --- a/tests/profile_check.py +++ b/tests/profile_check.py @@ -186,14 +186,8 @@ def readApparmorFile(fullpath): if m.get('profile'): nestingStacker.append(m.get('profile')) # set early - if m.get('attachment') != '@{exec_path}' and not gotAttach: # can be only singular + if m.get('attachment') == '@{exec_path}' and not gotAttach: # can be only singular gotAttach = True - messages.append({'filename': fullpath, - 'profile': getCurrentProfile(nestingStacker), - 'severity': 'WARNING', - 'line': n, - 'reason': "'@{exec_path}' must be defined as main path attachment", - 'suggestion': None}) profileMsg = {'filename': fullpath, 'profile': getCurrentProfile(nestingStacker), @@ -324,6 +318,15 @@ def readApparmorFile(fullpath): 'reason': 'ABI is required', 'suggestion': abi}) + # Ensure singular '@{exec_path}' + if not gotAttach: + messages.append({'filename': fullpath, + 'profile': None, + 'severity': 'WARNING', + 'line': None, + 'reason': "'@{exec_path}' must be defined as main path attachment", + 'suggestion': None}) + # Ensure trailing vim syntax if line: trailingSyntax = '# vim:syntax=apparmor\n' @@ -450,10 +453,11 @@ def main(argv): profile_data = {} for path in sorted(profiles): - readApparmorFile_Out = readApparmorFile(path) - profilesInFile = readApparmorFile_Out[1] - messages.extend(readApparmorFile_Out[0]) - profile_data.update(profilesInFile) + if not is_skippable_file(path): + readApparmorFile_Out = readApparmorFile(path) + profilesInFile = readApparmorFile_Out[1] + messages.extend(readApparmorFile_Out[0]) + profile_data.update(profilesInFile) for m in messages: if m.get('suggestion'): From 7167de932cc3f2678b0b496e9fa9f84bde79b0ba Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 23 Dec 2024 22:17:35 +0100 Subject: [PATCH 0503/1455] feat(profile): firefox: restric access to /tmp --- apparmor.d/groups/browsers/firefox | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 27eb0d54d..dfaff6064 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -59,9 +59,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw, owner @{tmp}/.xfsm-ICE-@{rand6} rw, - owner @{tmp}/@{rand6}.tmp r, - owner @{tmp}/@{rand8}.txt w, - owner @{tmp}/* w, # file downloads (to anywhere) + owner @{tmp}/@{rand8}.* rw, # file downloads (to anywhere) + owner @{tmp}/@{uuid}.zip{,.tmp} rw, owner @{tmp}/Mozilla@{uuid}-cachePurge-{@{hex15},@{hex16}} rwk, owner @{tmp}/mozilla* rw, owner @{tmp}/mozilla*/ rw, From 01c1562e7cd3fde793b926247d8f0fd910b675b7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 23 Dec 2024 22:19:29 +0100 Subject: [PATCH 0504/1455] feat(profile): firefox: better naming of possible attachment. --- apparmor.d/groups/browsers/firefox | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index dfaff6064..f7b0e1964 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -7,8 +7,8 @@ abi , include -@{name} = firefox{,.sh,-esr,-bin} -@{lib_dirs} = @{lib}/@{name} /opt/@{name} +@{name} = firefox{,-esr,-bin} +@{lib_dirs} = @{lib}/firefox{,-esr,-beta,-devedition,-nightly} /opt/@{name} @{config_dirs} = @{HOME}/.mozilla/ @{cache_dirs} = @{user_cache_dirs}/mozilla/ From b35c2a0abf72340537c466e6fbdd6a08a2052163 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Tue, 17 Dec 2024 20:28:17 +0200 Subject: [PATCH 0505/1455] non-owner accesses authorized_keys --- apparmor.d/groups/ssh/sshd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index b4ecc068e..825612af0 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -94,7 +94,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { owner @{user_download_dirs}/{,**} rwl, owner @{user_sync_dirs}/{,**} rwl, - owner @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r, + @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r, owner @{user_cache_dirs}/{,motd*} rw, @{att}/@{run}/systemd/sessions/@{int}.ref rw, From cf1d7504f4a329d7654cc4afd8d6c2f9e912c91f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 23 Dec 2024 22:48:24 +0100 Subject: [PATCH 0506/1455] fix(profile): sensors: simplify hwmon access. fix #628 --- apparmor.d/profiles-s-z/sensors | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/apparmor.d/profiles-s-z/sensors b/apparmor.d/profiles-s-z/sensors index fd839099e..e6ae103ae 100644 --- a/apparmor.d/profiles-s-z/sensors +++ b/apparmor.d/profiles-s-z/sensors @@ -18,19 +18,12 @@ profile sensors @{exec_path} { /etc/sensors.d/{,*} r, /etc/sensors3.conf r, + @{sys}/bus/i2c/devices/ r, @{sys}/class/hwmon/ r, @{sys}/class/i2c-adapter/ r, - @{sys}/devices/**/hwmon*/{,**/} r, - @{sys}/devices/**/hwmon*/{in[0-9]_label,in[0-9]_min,in[0-9]_max} r, - @{sys}/devices/**/hwmon*/{name,temp*,*_input} r, - @{sys}/devices/**/hwmon*/**/{name,temp*,*_input} r, - @{sys}/devices/**/hwmon/hwmon@{int}/power@{int}_crit r, - @{sys}/devices/**/hwmon/hwmon@{int}/fan@{int}_{label,max,min} r, @{sys}/devices/{,platform/*.{i2c,hdmi}/}i2c-@{int}/name r, @{sys}/devices/@{pci}/name r, - @{sys}/devices/platform/**/power_supply/**/hwmon@{int}/curr1_max r, - @{sys}/devices/virtual/hwmon/hwmon@{int}/ r, - @{sys}/devices/virtual/hwmon/hwmon@{int}/{name,temp*} r, + @{sys}/devices/**/hwmon*/** r, # file_inherit deny @{PROC}/@{pid}/net/dev r, From f8fc1aa38743aafbb493132b955c99d9059f9e15 Mon Sep 17 00:00:00 2001 From: Roman Beslik Date: Sun, 15 Dec 2024 19:40:06 +0200 Subject: [PATCH 0507/1455] systemd user ask-password --- apparmor.d/groups/systemd/systemd-tty-ask-password-agent | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index 3e2129d39..b16577de8 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -24,6 +24,7 @@ profile systemd-tty-ask-password-agent @{exec_path} { @{run}/systemd/ask-password-block/{,*} rw, @{run}/systemd/ask-password/{,*} rw, + @{run}/user/@{uid}/systemd/ask-password/ rw, @{run}/utmp rk, @{PROC}/@{pids}/stat r, From 57ddfd29ced85da5c0de78471a2136053e1e7038 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 24 Dec 2024 23:56:12 +0100 Subject: [PATCH 0508/1455] fix(profile): pacman-hook-systemd: add systemd-tty-ask-password-agent. fix #632 --- apparmor.d/groups/pacman/pacman-hook-systemd | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apparmor.d/groups/pacman/pacman-hook-systemd b/apparmor.d/groups/pacman/pacman-hook-systemd index 2c32024a2..59acc34d9 100644 --- a/apparmor.d/groups/pacman/pacman-hook-systemd +++ b/apparmor.d/groups/pacman/pacman-hook-systemd @@ -45,6 +45,10 @@ profile pacman-hook-systemd @{exec_path} { capability net_admin, + signal send set=term peer=systemd-tty-ask-password-agent, + + @{bin}/systemd-tty-ask-password-agent Px, + include if exists } From 2560e9645ff11d4fd24c69ef8145adf9bc8f817c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 25 Dec 2024 00:05:36 +0100 Subject: [PATCH 0509/1455] feat(profile): various improvements and update. --- apparmor.d/groups/gnome/gnome-session | 2 ++ apparmor.d/groups/gnome/gnome-software | 1 + apparmor.d/groups/network/mullvad-daemon | 1 + apparmor.d/groups/pacman/pacman-hook-systemd | 1 + apparmor.d/groups/systemd/bootctl | 2 +- apparmor.d/groups/systemd/busctl | 2 +- apparmor.d/groups/systemd/systemd-backlight | 2 +- apparmor.d/groups/systemd/systemd-cryptsetup | 2 +- apparmor.d/groups/systemd/systemd-generator-user-autostart | 2 +- apparmor.d/groups/systemd/systemd-generator-user-environment | 2 +- apparmor.d/groups/systemd/systemd-journald | 2 +- apparmor.d/groups/systemd/systemd-machined | 2 +- apparmor.d/groups/systemd/systemd-random-seed | 2 +- apparmor.d/groups/systemd/systemd-update-done | 2 +- apparmor.d/groups/systemd/systemd-update-utmp | 2 +- apparmor.d/groups/systemd/systemd-user-runtime-dir | 2 +- apparmor.d/groups/systemd/systemd-user-sessions | 2 +- apparmor.d/groups/virt/libvirtd | 1 + apparmor.d/profiles-a-f/flatpak-system-helper | 3 ++- apparmor.d/profiles-a-f/fwupd | 3 +-- 20 files changed, 22 insertions(+), 16 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index 798868271..bec97e7de 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -58,6 +58,8 @@ profile gnome-session @{exec_path} { /etc/X11/xinit/xinputrc r, /etc/X11/Xsession.d/*im-config_launch r, + owner @{HOME}/ r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index a75cfee63..601e6b6df 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -39,6 +39,7 @@ profile gnome-software @{exec_path} { /usr/share/app-info/{,**} r, /usr/share/appdata/{,**} r, + /usr/share/flatpak/remotes.d/ r, /usr/share/metainfo/{,**} r, /usr/share/swcatalog/{,**} r, /usr/share/xml/iso-codes/{,**} r, diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index ee98720b6..6c4c41e6c 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -59,6 +59,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { owner @{tmp}/@{uuid} rw, owner @{tmp}/talpid-openvpn-@{uuid} rw, + @{PROC}/sys/net/ipv{4,6}/conf/all/arp_ignore rw, @{PROC}/sys/net/ipv{4,6}/conf/all/src_valid_mark rw, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, diff --git a/apparmor.d/groups/pacman/pacman-hook-systemd b/apparmor.d/groups/pacman/pacman-hook-systemd index 59acc34d9..6f154269d 100644 --- a/apparmor.d/groups/pacman/pacman-hook-systemd +++ b/apparmor.d/groups/pacman/pacman-hook-systemd @@ -44,6 +44,7 @@ profile pacman-hook-systemd @{exec_path} { include capability net_admin, + capability sys_resource, signal send set=term peer=systemd-tty-ask-password-agent, diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index 05655d308..c7bb7b19f 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/bootctl -profile bootctl @{exec_path} { +profile bootctl @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index 6516a500c..826405d2d 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/busctl -profile busctl @{exec_path} { +profile busctl @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-backlight b/apparmor.d/groups/systemd/systemd-backlight index f67cb301c..374e9c4ae 100644 --- a/apparmor.d/groups/systemd/systemd-backlight +++ b/apparmor.d/groups/systemd/systemd-backlight @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-backlight -profile systemd-backlight @{exec_path} { +profile systemd-backlight @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/systemd/systemd-cryptsetup b/apparmor.d/groups/systemd/systemd-cryptsetup index f8950c1fe..090412ff5 100644 --- a/apparmor.d/groups/systemd/systemd-cryptsetup +++ b/apparmor.d/groups/systemd/systemd-cryptsetup @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/systemd-cryptsetup @{lib}/systemd/systemd-cryptsetup -profile systemd-cryptsetup @{exec_path} { +profile systemd-cryptsetup @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-generator-user-autostart b/apparmor.d/groups/systemd/systemd-generator-user-autostart index c42548ef5..8e3ebb6b3 100644 --- a/apparmor.d/groups/systemd/systemd-generator-user-autostart +++ b/apparmor.d/groups/systemd/systemd-generator-user-autostart @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/user-generators/systemd-xdg-autostart-generator -profile systemd-generator-user-autostart @{exec_path} { +profile systemd-generator-user-autostart @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-generator-user-environment b/apparmor.d/groups/systemd/systemd-generator-user-environment index db128405f..27db22078 100644 --- a/apparmor.d/groups/systemd/systemd-generator-user-environment +++ b/apparmor.d/groups/systemd/systemd-generator-user-environment @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/user-environment-generators/* -profile systemd-generator-user-environment @{exec_path} { +profile systemd-generator-user-environment @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index cc1f541dd..d63a4211d 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-journald -profile systemd-journald @{exec_path} { +profile systemd-journald @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-machined b/apparmor.d/groups/systemd/systemd-machined index 3a111f7f3..b37f2300b 100644 --- a/apparmor.d/groups/systemd/systemd-machined +++ b/apparmor.d/groups/systemd/systemd-machined @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-machined -profile systemd-machined @{exec_path} { +profile systemd-machined @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-random-seed b/apparmor.d/groups/systemd/systemd-random-seed index be33d39cd..86ea02a0d 100644 --- a/apparmor.d/groups/systemd/systemd-random-seed +++ b/apparmor.d/groups/systemd/systemd-random-seed @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-random-seed -profile systemd-random-seed @{exec_path} { +profile systemd-random-seed @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/systemd/systemd-update-done b/apparmor.d/groups/systemd/systemd-update-done index c17be7ab2..e7a44d01d 100644 --- a/apparmor.d/groups/systemd/systemd-update-done +++ b/apparmor.d/groups/systemd/systemd-update-done @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-update-done -profile systemd-update-done @{exec_path} { +profile systemd-update-done @{exec_path} flags=(attach_disconnected) { include capability net_admin, diff --git a/apparmor.d/groups/systemd/systemd-update-utmp b/apparmor.d/groups/systemd/systemd-update-utmp index 9d512b495..1a2ff9a31 100644 --- a/apparmor.d/groups/systemd/systemd-update-utmp +++ b/apparmor.d/groups/systemd/systemd-update-utmp @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-update-utmp -profile systemd-update-utmp @{exec_path} { +profile systemd-update-utmp @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-user-runtime-dir b/apparmor.d/groups/systemd/systemd-user-runtime-dir index 9c7fe975b..363b9a32d 100644 --- a/apparmor.d/groups/systemd/systemd-user-runtime-dir +++ b/apparmor.d/groups/systemd/systemd-user-runtime-dir @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-user-runtime-dir -profile systemd-user-runtime-dir @{exec_path} { +profile systemd-user-runtime-dir @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-user-sessions b/apparmor.d/groups/systemd/systemd-user-sessions index 6f16b2f19..8de32dfe2 100644 --- a/apparmor.d/groups/systemd/systemd-user-sessions +++ b/apparmor.d/groups/systemd/systemd-user-sessions @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-user-sessions -profile systemd-user-sessions @{exec_path} { +profile systemd-user-sessions @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index db6d5d377..061866717 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -171,6 +171,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+leds:* r, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, + @{run}/udev/data/+power_supply:* r, @{run}/udev/data/+rfkill:* r, @{run}/udev/data/+sound:card@{int} r, # For sound card @{run}/udev/data/+thunderbolt:* r, diff --git a/apparmor.d/profiles-a-f/flatpak-system-helper b/apparmor.d/profiles-a-f/flatpak-system-helper index 2268de064..60c41a6a9 100644 --- a/apparmor.d/profiles-a-f/flatpak-system-helper +++ b/apparmor.d/profiles-a-f/flatpak-system-helper @@ -37,8 +37,9 @@ profile flatpak-system-helper @{exec_path} { /etc/flatpak/{,**} r, /etc/machine-id r, - /usr/share/mime/mime.cache r, + /usr/share/flatpak/remotes.d/ r, /usr/share/flatpak/triggers/ r, + /usr/share/mime/mime.cache r, /var/lib/flatpak/{,**} rwkl, /var/tmp/flatpak-cache-*/{,**} rw, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index aa95a00d5..643bbe96a 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -17,7 +17,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { include include include - include + include include include @@ -129,7 +129,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /dev/mei@{int} rw, /dev/mem r, /dev/mtd@{int} rw, - /dev/sd[a-z]* r, /dev/tpm@{int} rw, /dev/tpmrm@{int} rw, /dev/wmi/* r, From 6348dafa8e7a41303b6ecd26301247b614dc195f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 9 Jan 2025 22:23:45 +0100 Subject: [PATCH 0510/1455] fix(profile): gnome on X fix #641 --- apparmor.d/groups/ssh/ssh-agent | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/ssh/ssh-agent b/apparmor.d/groups/ssh/ssh-agent index 72d6618e6..f6732b1cf 100644 --- a/apparmor.d/groups/ssh/ssh-agent +++ b/apparmor.d/groups/ssh/ssh-agent @@ -19,6 +19,7 @@ profile ssh-agent @{exec_path} { @{sh_path} rix, @{bin}/gpg-agent rPx, + @{bin}/im-launch rPx, owner @{HOME}/@{XDG_SSH_DIR}/ rw, owner @{HOME}/@{XDG_SSH_DIR}/* r, From f21006dfd2e37d0673be7faccf25ec0584cb99c6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 9 Jan 2025 22:41:17 +0100 Subject: [PATCH 0511/1455] fix(profile): xfce-terminal graphics fix #638 --- apparmor.d/groups/xfce/xfce-terminal | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/xfce/xfce-terminal b/apparmor.d/groups/xfce/xfce-terminal index 342ffd3b4..d0d895c5a 100644 --- a/apparmor.d/groups/xfce/xfce-terminal +++ b/apparmor.d/groups/xfce/xfce-terminal @@ -9,8 +9,10 @@ include @{exec_path} = @{bin}/xfce4-terminal profile xfce-terminal @{exec_path} { include + include include include + include include include From 70c06a054744503ffc8fd98133c29e965e942b3d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 9 Jan 2025 22:48:23 +0100 Subject: [PATCH 0512/1455] fix(profile): set dettached flag on some systemd services. should fix #630 --- dists/flags/main.flags | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index ac4547850..6a1a1b6a7 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -309,7 +309,7 @@ systemd-ask-password complain systemd-binfmt attach_disconnected,complain systemd-cgls complain systemd-cgtop complain -systemd-cryptsetup complain +systemd-cryptsetup attach_disconnected,complain systemd-dissect attach_disconnected,complain systemd-escape complain systemd-generator-bless-boot attach_disconnected,complain @@ -327,8 +327,8 @@ systemd-generator-integritysetup attach_disconnected,complain systemd-generator-ostree attach_disconnected,complain systemd-generator-run attach_disconnected,complain systemd-generator-system-update attach_disconnected,complain -systemd-generator-user-autostart complain -systemd-generator-user-environment complain +systemd-generator-user-autostart attach_disconnected,complain +systemd-generator-user-environment attach_disconnected,complain systemd-generator-veritysetup attach_disconnected,complain systemd-homed attach_disconnected,complain systemd-homework complain @@ -342,7 +342,7 @@ systemd-shutdown complain systemd-sleep-tlp complain systemd-socket-proxyd complain systemd-udevd attach_disconnected,complain -systemd-user-sessions complain +systemd-user-sessions attach_disconnected,complain systemd-userwork attach_disconnected,complain systemsettings complain telegram-desktop complain From fa85d909d70c80d524d320cc2e83f94e18fcf166 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 9 Jan 2025 22:58:53 +0100 Subject: [PATCH 0513/1455] feat(profile): general update. --- apparmor.d/groups/apt/apt | 1 + apparmor.d/groups/bus/dbus-accessibility | 2 ++ apparmor.d/groups/freedesktop/xorg | 5 +++ apparmor.d/groups/gnome/gdm | 2 +- apparmor.d/groups/gnome/gdm-prime-defaut | 3 ++ apparmor.d/groups/network/NetworkManager | 1 + apparmor.d/groups/network/nm-dispatcher | 2 +- apparmor.d/groups/ssh/sshfs | 15 +++++++++ .../systemd/systemd-tty-ask-password-agent | 1 + apparmor.d/groups/systemd/systemd-udevd | 2 ++ apparmor.d/groups/virt/cockpit-bridge | 2 +- apparmor.d/groups/whonix/anondate | 2 +- apparmor.d/profiles-a-f/bluetoothd | 11 ++----- apparmor.d/profiles-a-f/fwupd | 6 +--- apparmor.d/profiles-g-l/gpu-manager | 1 + apparmor.d/profiles-m-r/mount-cifs | 31 ++++++++++++------- apparmor.d/profiles-s-z/udisksd | 2 +- apparmor.d/profiles-s-z/wireplumber | 2 +- apparmor.d/profiles-s-z/xinit | 1 + 19 files changed, 61 insertions(+), 31 deletions(-) diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 369dd3bbd..c0545f2ec 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -130,6 +130,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { /var/lib/update-notifier/dpkg-run-stamp rw, /var/log/apt/{,**} rw, + /var/log/ubuntu-advantage-apt-hook.log w, # For package building @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index e8f0328a2..35a507559 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -26,6 +26,8 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term hup kill) peer=dbus-session, signal (receive) set=(term hup kill) peer=gdm{,-session-worker}, + unix type=stream addr=none peer=(label=xorg, addr=@/tmp/.X11-unix/X0), + #aa:dbus own bus=accessibility name=org.freedesktop.DBus #aa:dbus own bus=session name=org.a11y.{B,b}us dbus receive bus=accessibility path=/org/freedesktop/DBus diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 0f23d583c..90016a8ee 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -45,6 +45,11 @@ profile xorg @{exec_path} flags=(attach_disconnected) { network netlink raw, + dbus send bus=system path=/org/freedesktop/login1/session/* + interface=org.freedesktop.login1.Session + member=ReleaseControl + peer=(name=org.freedesktop.login1, label=systemd-logind), + @{exec_path} mrix, @{sh_path} rix, diff --git a/apparmor.d/groups/gnome/gdm b/apparmor.d/groups/gnome/gdm index 6bafb132b..fc7ff4bb1 100644 --- a/apparmor.d/groups/gnome/gdm +++ b/apparmor.d/groups/gnome/gdm @@ -50,7 +50,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) { @{bin}/plymouth rPx, @{bin}/prime-switch rPUx, @{bin}/sleep rix, - @{bin}/systemd-cat rPx, + @{bin}/systemd-cat rix, @{lib}/{,gdm/}gdm-session-worker rPx, /etc/gdm{3,}/PrimeOff/Default rix, diff --git a/apparmor.d/groups/gnome/gdm-prime-defaut b/apparmor.d/groups/gnome/gdm-prime-defaut index 189e166f2..eea0ee3b3 100644 --- a/apparmor.d/groups/gnome/gdm-prime-defaut +++ b/apparmor.d/groups/gnome/gdm-prime-defaut @@ -12,6 +12,9 @@ profile gdm-prime-defaut @{exec_path} flags=(complain) { @{exec_path} mr, + @{sh_path} r, + @{bin}/prime-offload ix, + include if exists } diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index de3a180bb..1bb2de231 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -43,6 +43,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=system name=org.freedesktop.NetworkManager + #aa:dbus talk bus=system name=fi.w1.wpa_supplicant1 label=wpa-supplicant #aa:dbus talk bus=system name=org.fedoraproject.FirewallD1 label=firewalld #aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher #aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved diff --git a/apparmor.d/groups/network/nm-dispatcher b/apparmor.d/groups/network/nm-dispatcher index 40984f7fa..ee2e5274b 100644 --- a/apparmor.d/groups/network/nm-dispatcher +++ b/apparmor.d/groups/network/nm-dispatcher @@ -51,7 +51,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) { @{bin}/run-parts rCx -> run-parts, @{bin}/sed rix, @{bin}/systemctl rCx -> systemctl, - @{bin}/systemd-cat rPx, + @{bin}/systemd-cat rix, @{bin}/tr rix, /usr/share/tlp/tlp-readconfs rPUx, diff --git a/apparmor.d/groups/ssh/sshfs b/apparmor.d/groups/ssh/sshfs index a367b0f7a..173b6602e 100644 --- a/apparmor.d/groups/ssh/sshfs +++ b/apparmor.d/groups/ssh/sshfs @@ -13,6 +13,10 @@ profile sshfs @{exec_path} flags=(complain) { mount fstype=fuse.sshfs -> @{HOME}/*/, mount fstype=fuse.sshfs -> @{HOME}/*/*/, + mount fstype=fuse.sshfs -> @{MOUNTDIRS}/, + mount fstype=fuse.sshfs -> @{MOUNTS}/, + mount fstype=fuse.sshfs -> @{MOUNTS}/*/, + mount fstype=fuse.sshfs -> @{MOUNTS}/*/*/, unix (connect, send, receive) type=stream peer=(label="sshfs//fusermount",addr=none), @@ -33,6 +37,17 @@ profile sshfs @{exec_path} flags=(complain) { mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/, mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/*/, + mount fstype={fuse,fuse.sshfs} -> @{MOUNTDIRS}/, + mount fstype={fuse,fuse.sshfs} -> @{MOUNTS}/, + mount fstype={fuse,fuse.sshfs} -> @{MOUNTS}/*/, + mount fstype={fuse,fuse.sshfs} -> @{MOUNTS}/*/*/, + + umount @{HOME}/*/, + umount @{HOME}/*/*/, + umount @{MOUNTDIRS}/, + umount @{MOUNTS}/, + umount @{MOUNTS}/*/, + umount @{MOUNTS}/*/*/, unix (connect, send, receive) type=stream peer=(label="sshfs",addr=none), diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index b16577de8..4c57d0200 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -13,6 +13,7 @@ profile systemd-tty-ask-password-agent @{exec_path} { include capability dac_override, + capability dac_read_search, capability net_admin, capability sys_resource, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index b8a0c7e4c..f52a2fc6c 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -95,6 +95,8 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{run}/systemd/notify rw, @{run}/systemd/seats/seat@{int} r, + @{att}/@{run}/udev/control rw, + @{run}/udev/ rw, @{run}/udev/** rwk, diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 1766cd2fb..94b185162 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -114,7 +114,7 @@ profile cockpit-bridge @{exec_path} { include include - signal (send receive) set=term peer=cockpit-bridge, + signal (send receive) set=(cont hup term) peer=cockpit-bridge, @{bin}/cockpit-bridge Px, @{lib}/cockpit/cockpit-askpass Px, diff --git a/apparmor.d/groups/whonix/anondate b/apparmor.d/groups/whonix/anondate index d39517569..27e4eb594 100644 --- a/apparmor.d/groups/whonix/anondate +++ b/apparmor.d/groups/whonix/anondate @@ -22,7 +22,7 @@ profile anondate @{exec_path} { @{bin}/grep rix, @{bin}/minimum-unixtime-show rix, @{bin}/rm rix, - @{bin}/systemd-cat rPx, + @{bin}/systemd-cat rix, @{bin}/tee rix, @{bin}/timeout rix, @{bin}/tor-circuit-established-check rix, diff --git a/apparmor.d/profiles-a-f/bluetoothd b/apparmor.d/profiles-a-f/bluetoothd index ee7efdcfd..8ca699aaf 100644 --- a/apparmor.d/profiles-a-f/bluetoothd +++ b/apparmor.d/profiles-a-f/bluetoothd @@ -25,20 +25,15 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=system name=org.bluez - dbus receive bus=system path=/ + dbus send bus=system path=/{,MediaEndpoint} interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name=:*, label="{brave,NetworkManager,pulseaudio,upowerd}"), - - dbus send bus=system path=/MediaEndpoint - interface=org.freedesktop.DBus.ObjectManager - member=GetManagedObjects - peer=(name=:*, label=pulseaudio), + peer=(name=@{busname}), dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=InterfacesRemoved - peer=(name=org.freedesktop.DBus, label="{jwupd,NetworkManager,pulseaudio,upowerd}"), + peer=(name=org.freedesktop.DBus), @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 643bbe96a..5abf1d294 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -38,17 +38,13 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { network netlink raw, #aa:dbus own bus=system name=org.freedesktop.fwupd path=/ + #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={GetConnectionUnixUser,GetConnectionUnixProcessID} peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), - dbus send bus=system path=/org/freedesktop/UDisks2/Manager - interface=org.freedesktop.UDisks2.Manager - member=GetBlockDevices - peer=(name=:*, label=udisksd), - @{exec_path} mr, @{lib}/fwupd/fwupd-detect-cet rix, diff --git a/apparmor.d/profiles-g-l/gpu-manager b/apparmor.d/profiles-g-l/gpu-manager index 8cc49acdf..795c92f00 100644 --- a/apparmor.d/profiles-g-l/gpu-manager +++ b/apparmor.d/profiles-g-l/gpu-manager @@ -25,6 +25,7 @@ profile gpu-manager @{exec_path} { /var/lib/ubuntu-drivers-common/* rw, /var/log/gpu-manager.log w, + /var/log/gpu-manager-switch.log w, @{sys}/devices/@{pci}/boot_vga r, @{sys}/module/compression r, diff --git a/apparmor.d/profiles-m-r/mount-cifs b/apparmor.d/profiles-m-r/mount-cifs index 78651ba23..190db34da 100644 --- a/apparmor.d/profiles-m-r/mount-cifs +++ b/apparmor.d/profiles-m-r/mount-cifs @@ -12,16 +12,29 @@ profile mount-cifs @{exec_path} flags=(complain) { include include - # To mount anything. capability sys_admin, - - # (#FIXME#) capability setpcap, + network inet dgram, network inet stream, + network inet6 dgram, network inet6 stream, network netlink raw, + mount fstype=cifs -> @{HOME}/*/, + mount fstype=cifs -> @{HOME}/*/*/, + mount fstype=cifs -> @{MOUNTDIRS}/, + mount fstype=cifs -> @{MOUNTS}/, + mount fstype=cifs -> @{MOUNTS}/*/, + mount fstype=cifs -> @{MOUNTS}/*/*/, + + umount @{HOME}/*/, + umount @{HOME}/*/*/, + umount @{MOUNTDIRS}/, + umount @{MOUNTS}/, + umount @{MOUNTS}/*/, + umount @{MOUNTS}/*/*/, + @{exec_path} mr, @{bin}/systemd-ask-password rPUx, @@ -31,18 +44,12 @@ profile mount-cifs @{exec_path} flags=(complain) { owner @{HOME}/.smbcredentials r, # Mount points + @{HOME}/*/ r, + @{HOME}/*/*/ r, @{MOUNTDIRS}/ r, @{MOUNTS}/ r, @{MOUNTS}/*/ r, - - # Allow to mount smb/cifs disks only under the /media/ dirs - mount fstype=cifs -> @{MOUNTDIRS}/, - mount fstype=cifs -> @{MOUNTS}/, - mount fstype=cifs -> @{MOUNTS}/*/, - - umount @{MOUNTDIRS}/, - umount @{MOUNTS}/, - umount @{MOUNTS}/*/, + @{MOUNTS}/*/*/ r, include if exists } diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 909112a70..90ea63dd2 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -132,7 +132,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{sys}/class/nvme/ r, @{sys}/devices/@{pci}/{ata,usb,mmc,virtio}[0-9]/{,**/}uevent w, @{sys}/devices/@{pci}/{ata,usb,mmc}[0-9]/{,**/}remove rw, - @{sys}/devices/@{pci}/uevent r, + @{sys}/devices/@{pci}/uevent rw, @{sys}/devices/**/net/*/ r, @{sys}/devices/**/uevent r, @{sys}/devices/virtual/bdi/**/read_ahead_kb r, diff --git a/apparmor.d/profiles-s-z/wireplumber b/apparmor.d/profiles-s-z/wireplumber index 87b4e27ca..cc19872c6 100644 --- a/apparmor.d/profiles-s-z/wireplumber +++ b/apparmor.d/profiles-s-z/wireplumber @@ -24,7 +24,7 @@ profile wireplumber @{exec_path} { network bluetooth stream, network netlink raw, - #aa:dbus own bus=session name=org.freedesktop.ReserveDevice1.Audio0 + #aa:dbus own bus=session name=org.freedesktop.ReserveDevice1.Audio@{int} dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/profiles-s-z/xinit b/apparmor.d/profiles-s-z/xinit index 0801ac188..a332bd20b 100644 --- a/apparmor.d/profiles-s-z/xinit +++ b/apparmor.d/profiles-s-z/xinit @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xinit profile xinit @{exec_path} { include + include include signal (receive) set=(usr1) peer=xorg, From 34913ab0c02b836b71a463fba234663174111dc4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 9 Jan 2025 22:59:42 +0100 Subject: [PATCH 0514/1455] build: update debian control. --- debian/control | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/debian/control b/debian/control index 3d15800b8..800642d86 100644 --- a/debian/control +++ b/debian/control @@ -9,16 +9,15 @@ Build-Depends: debhelper (>= 13.4), Homepage: https://github.com/roddhjav/apparmor.d Vcs-Browser: https://github.com/roddhjav/apparmor.d Vcs-Git: https://github.com/roddhjav/apparmor.d.git -Standards-Version: 4.5.0 +Standards-Version: 4.6.0 Rules-Requires-Root: no Package: apparmor.d Architecture: any -Depends: - apparmor-profiles, +Depends: apparmor-profiles, ${shlibs:Depends} Conflicts: apparmor-profiles-extra Provides: apparmor-profiles-extra Description: Full set of AppArmor profiles (~ 1500 profiles) - apparmor.d is a set of over 1500 AppArmor profiles whose aim is to confine - most Linux based applications and processes. + apparmor.d is a set of over 1500 AppArmor profiles whose aim is to confine + most Linux based applications and processes. From 0769e42ea22d869f4079076c8d1012c5a5a406cf Mon Sep 17 00:00:00 2001 From: nobody43 Date: Tue, 31 Dec 2024 00:32:12 +0000 Subject: [PATCH 0515/1455] regression: session names 2 --- apparmor.d/abstractions/app/firefox | 2 +- apparmor.d/groups/gnome/gdm | 2 +- apparmor.d/groups/ssh/sshd | 2 +- apparmor.d/groups/virt/k3s | 2 +- apparmor.d/profiles-a-f/briar-desktop | 2 +- apparmor.d/profiles-g-l/libreoffice | 2 +- apparmor.d/profiles-m-r/mullvad-setup | 2 +- apparmor.d/profiles-m-r/ouch | 2 +- apparmor.d/profiles-s-z/signal-desktop | 4 ++-- apparmor.d/profiles-s-z/virt-manager | 2 +- 10 files changed, 11 insertions(+), 11 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 87865197e..602651587 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -125,7 +125,7 @@ @{sys}/devices/power/events/energy-* r, @{sys}/devices/power/type r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/**/cpu.max r, @{PROC}/@{pid}/net/arp r, diff --git a/apparmor.d/groups/gnome/gdm b/apparmor.d/groups/gnome/gdm index fc7ff4bb1..10d116a6c 100644 --- a/apparmor.d/groups/gnome/gdm +++ b/apparmor.d/groups/gnome/gdm @@ -92,7 +92,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) { @{sys}/devices/**/uevent r, @{sys}/devices/@{pci}/boot_vga r, @{sys}/devices/virtual/tty/tty@{int}/active r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cgroup.events r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cgroup.events r, @{PROC}/@{pid}/cgroup r, @{PROC}/1/environ r, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 825612af0..21892cc47 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -107,7 +107,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { owner @{run}/sshd{,.init}.pid wl, @{sys}/fs/cgroup/*/user/*/@{int}/ rw, - @{sys}/fs/cgroup/systemd/user.slice/user-@{uid}.slice/session-*.scope/ rw, + @{sys}/fs/cgroup/systemd/user.slice/user-@{uid}.slice/session-@{word}.scope/ rw, @{PROC}/@{pids}/fd/ r, @{PROC}/1/environ r, diff --git a/apparmor.d/groups/virt/k3s b/apparmor.d/groups/virt/k3s index 96e50ba35..0949e72ee 100644 --- a/apparmor.d/groups/virt/k3s +++ b/apparmor.d/groups/virt/k3s @@ -159,7 +159,7 @@ profile k3s @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/ r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user-runtime-dir@@{uid}.service/ r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**/} r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/{,**/} r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/{,**/} r, @{sys}/kernel/mm/hugepages/ r, @{sys}/kernel/mm/hugepages/hugepages-*/nr_hugepages r, diff --git a/apparmor.d/profiles-a-f/briar-desktop b/apparmor.d/profiles-a-f/briar-desktop index a0b57a38b..24088be3f 100644 --- a/apparmor.d/profiles-a-f/briar-desktop +++ b/apparmor.d/profiles-a-f/briar-desktop @@ -57,7 +57,7 @@ profile briar-desktop @{exec_path} { owner @{tmp}/jna@{u64}.tmp mrw, @{sys}/devices/system/cpu/cpu@{int}/microcode/version r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/{cpu,memory}.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/{cpu,memory}.max r, @{sys}/kernel/mm/{hugepages/,transparent_hugepage/enabled} r, @{PROC}/cgroups r, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 63634d788..03dfe9749 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -99,7 +99,7 @@ profile libreoffice @{exec_path} { @{sys}/kernel/mm/hugepages/ r, @{sys}/kernel/mm/transparent_hugepage/enabled r, @{sys}/kernel/mm/transparent_hugepage/shmem_enabled r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/{cpu,memory}.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/{cpu,memory}.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/**/memory.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r, diff --git a/apparmor.d/profiles-m-r/mullvad-setup b/apparmor.d/profiles-m-r/mullvad-setup index b30da1c13..d2bb2eb44 100644 --- a/apparmor.d/profiles-m-r/mullvad-setup +++ b/apparmor.d/profiles-m-r/mullvad-setup @@ -13,7 +13,7 @@ profile mullvad-setup @{exec_path} { @{exec_path} mr, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/cpu.max r, diff --git a/apparmor.d/profiles-m-r/ouch b/apparmor.d/profiles-m-r/ouch index ef3ea4bee..a5b62ca93 100644 --- a/apparmor.d/profiles-m-r/ouch +++ b/apparmor.d/profiles-m-r/ouch @@ -19,7 +19,7 @@ profile ouch @{exec_path} { @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index b905e8f3a..ca9da155c 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -44,8 +44,8 @@ profile signal-desktop @{exec_path} { @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.high r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/memory.high r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/memory.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index 0a67b365b..052192d8f 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -85,7 +85,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/drm/ttm/uevent r, @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, @{PROC}/@{pids}/net/route r, owner @{PROC}/@{pid}/cgroup r, From f66ef4d5ea65c8e911337fb5495ba9b937b39341 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 9 Jan 2025 23:36:42 +0100 Subject: [PATCH 0516/1455] chore: fix profile styling issue. --- apparmor.d/groups/ssh/sshfs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/ssh/sshfs b/apparmor.d/groups/ssh/sshfs index 173b6602e..f7c635dd4 100644 --- a/apparmor.d/groups/ssh/sshfs +++ b/apparmor.d/groups/ssh/sshfs @@ -41,7 +41,7 @@ profile sshfs @{exec_path} flags=(complain) { mount fstype={fuse,fuse.sshfs} -> @{MOUNTS}/, mount fstype={fuse,fuse.sshfs} -> @{MOUNTS}/*/, mount fstype={fuse,fuse.sshfs} -> @{MOUNTS}/*/*/, - + umount @{HOME}/*/, umount @{HOME}/*/*/, umount @{MOUNTDIRS}/, From bffb837ff3814e416e7ddca6d1db604c29e61ee7 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Fri, 3 Jan 2025 11:07:04 +0800 Subject: [PATCH 0517/1455] Update profile for xray --- apparmor.d/profiles-s-z/xray | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-s-z/xray b/apparmor.d/profiles-s-z/xray index 7e86ada2c..fccd2c569 100644 --- a/apparmor.d/profiles-s-z/xray +++ b/apparmor.d/profiles-s-z/xray @@ -22,6 +22,7 @@ profile xray @{exec_path} flags=(attach_disconnected) { /etc/xray/{,*} r, /usr/share/xray/**.dat r, + /usr/share/v2ray/**.dat r, @{PROC}/sys/net/core/somaxconn r, From 17520a94bf1be89d5025722ab4397b911dcbcd71 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 10 Jan 2025 00:09:24 +0100 Subject: [PATCH 0518/1455] feat(profile): improve snap & login bus. --- apparmor.d/abstractions/bus/org.freedesktop.login1 | 2 +- apparmor.d/profiles-s-z/snap | 1 + apparmor.d/profiles-s-z/snapd | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.login1 b/apparmor.d/abstractions/bus/org.freedesktop.login1 index 77271fe23..385c75730 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.login1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.login1 @@ -21,7 +21,7 @@ dbus receive bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager - member={SessionNew,SessionRemoved,UserNew,UserRemoved,PrepareFor*} + member={SessionNew,SessionRemoved,UserNew,UserRemoved,SeatNew,PrepareFor*} peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), dbus send bus=system path=/org/freedesktop/login1 diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/profiles-s-z/snap index aa1f6b2b8..cdb01d14a 100644 --- a/apparmor.d/profiles-s-z/snap +++ b/apparmor.d/profiles-s-z/snap @@ -73,6 +73,7 @@ profile snap @{exec_path} { @{run}/mount/utab r, @{run}/snapd.socket rw, + @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/kernel/security/apparmor/features/{,**} r, @{PROC}/@{pids}/cgroup r, diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index 250005f55..4e383b777 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -153,6 +153,7 @@ profile snapd @{exec_path} { @{run}/systemd/private rw, @{sys}/fs/cgroup/{,*/} r, + @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/system.slice/{,**/} r, @{sys}/fs/cgroup/user.slice/ r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r, From b94b11cbee0ea96b7fc7272b68a27b3b21ed5679 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 10 Jan 2025 18:55:37 +0100 Subject: [PATCH 0519/1455] feat(profile): steam: update web paths. --- apparmor.d/profiles-s-z/steam | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 252c89869..9cb5ac86b 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -317,6 +317,8 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{share_dirs}/public/** k, @{tmp}/ r, + owner @{tmp}/.com.valvesoftware.Steam.@{rand6} rw, + owner @{tmp}/.com.valvesoftware.Steam.@{rand6}/{,**} rw, owner @{tmp}/#@{int} rw, owner @{tmp}/dumps/ rw, owner @{tmp}/dumps/** rwk, @@ -324,6 +326,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, + owner /dev/shm/.com.valvesoftware.Steam.@{rand6} rw, owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw, owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, From 078b0de752d302a63b48ba32d5f3da5b4c37823b Mon Sep 17 00:00:00 2001 From: nobody43 <15267739+nobody43@users.noreply.github.com> Date: Fri, 10 Jan 2025 19:42:29 +0000 Subject: [PATCH 0520/1455] Fix `rand` typo --- apparmor.d/tunables/multiarch.d/system | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index cc4192d28..4e8b1bc11 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -78,7 +78,7 @@ @{rand15}=@{rand8}@{rand4}@{rand2}@{c} @{rand16}=@{rand8}@{rand8} @{rand32}=@{rand16}@{rand16} -@{rand64}=@{rand64}@{rand64} +@{rand64}=@{rand32}@{rand32} # Any x word characters @{word2}=@{w}@{w} From 61939a3bf8732d71088396a7a8b5f73196442b39 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 12 Jan 2025 18:22:39 +0100 Subject: [PATCH 0521/1455] build: disable dummy upstream profile in favor of ours. --- dists/overwrite | 1 + pkg/prebuild/prepare/overwrite.go | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/dists/overwrite b/dists/overwrite index 767c07312..3ddd83d97 100644 --- a/dists/overwrite +++ b/dists/overwrite @@ -13,6 +13,7 @@ flatpak foliate loupe msedge +mullvad nautilus opera plasmashell diff --git a/pkg/prebuild/prepare/overwrite.go b/pkg/prebuild/prepare/overwrite.go index 6f8951161..1bacd446f 100644 --- a/pkg/prebuild/prepare/overwrite.go +++ b/pkg/prebuild/prepare/overwrite.go @@ -49,9 +49,10 @@ func (p Overwrite) Apply() ([]string, error) { if !dest.Exist() && p.OneFile { continue } - if err := origin.Rename(dest); err != nil { - - return res, err + if origin.Exist() { + if err := origin.Rename(dest); err != nil { + return res, err + } } originRel, err := origin.RelFrom(dest) if err != nil { From 88f1821b19d9a298592727898f7b2055bde4102d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 12 Jan 2025 18:23:43 +0100 Subject: [PATCH 0522/1455] tests: cosmetic. --- tests/bats/chsh.bats | 6 +++--- tests/boxes.yml | 2 +- tests/cmd/main.go | 3 ++- tests/requirements.sh | 2 +- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/tests/bats/chsh.bats b/tests/bats/chsh.bats index a9f5a6978..81a9f76a6 100644 --- a/tests/bats/chsh.bats +++ b/tests/bats/chsh.bats @@ -5,15 +5,15 @@ load common -@test "chsh: [l]ist available shells" { +@test "chsh: list available shells" { chsh --list-shells || true } -@test "chsh: Set a specific login [s]hell for the current user" { +@test "chsh: Set a specific login shell for the current user" { echo "$PASSWORD" | chsh --shell /usr/bin/bash } # bats test_tags=chsh -@test "chsh: Set a login [s]hell for a specific user" { +@test "chsh: Set a login shell for a specific user" { sudo chsh --shell /usr/bin/sh root } diff --git a/tests/boxes.yml b/tests/boxes.yml index ef037e07f..532c5e18f 100644 --- a/tests/boxes.yml +++ b/tests/boxes.yml @@ -2,7 +2,7 @@ defaults: uefi: true - ram: '4096' + ram: '3072' cpu: '6' boxes: diff --git a/tests/cmd/main.go b/tests/cmd/main.go index eb88de1ec..e7e620b00 100644 --- a/tests/cmd/main.go +++ b/tests/cmd/main.go @@ -88,7 +88,8 @@ func run() error { } logging.Bullet("Bats tests directory: %s", cfg.BatsDir) - logging.Bullet("Number of tests found %d", len(tests)) + logging.Bullet("Number of profiles with tests found %d", len(tests)) + logging.Bullet("Number of programs without profile found %d", len(tests)) return nil } diff --git a/tests/requirements.sh b/tests/requirements.sh index c12f9249c..c22e70108 100644 --- a/tests/requirements.sh +++ b/tests/requirements.sh @@ -19,7 +19,7 @@ arch) ;; debian | ubuntu | whonix) sudo apt-get install -y \ - cpuid dfc systemd-userdbd systemd-homed tlp + cpuid dfc systemd-userdbd systemd-homed tlp network-manager ;; opensuse*) ;; From fc85b9fc58d814c5029c0e377cde5c65c07eff2a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 12 Jan 2025 19:41:47 +0100 Subject: [PATCH 0523/1455] build: better division of prebuild stages. --- cmd/prebuild/main.go | 1 + pkg/prebuild/cli/cli.go | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 3f2dd9f43..59eff4912 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -67,5 +67,6 @@ func init() { } func main() { + cli.Configure() cli.Prebuild() } diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 2821d52c2..53f3c5589 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -58,7 +58,7 @@ func init() { flag.StringVar(&file, "file", "", "Only prebuild a given file.") } -func Prebuild() { +func Configure() { flag.Usage = func() { fmt.Printf("%s\n%s\n%s\n%s", usage, prebuild.Help("Prepare", prepare.Tasks), @@ -103,7 +103,9 @@ func Prebuild() { overwrite, _ := prepare.Tasks["overwrite"].(*prepare.Overwrite) overwrite.OneFile = true } +} +func Prebuild() { logging.Step("Building apparmor.d profiles for %s on ABI%d.", prebuild.Distribution, prebuild.ABI) if err := Prepare(); err != nil { logging.Fatal("%s", err.Error()) From f1182b27bb64a3bf44e92a4bafb58178ebfbf5ac Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 12 Jan 2025 20:30:52 +0100 Subject: [PATCH 0524/1455] build: do not resolve files in local/ --- pkg/prebuild/builder/userspace.go | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/pkg/prebuild/builder/userspace.go b/pkg/prebuild/builder/userspace.go index d62cad522..71c1ce23e 100644 --- a/pkg/prebuild/builder/userspace.go +++ b/pkg/prebuild/builder/userspace.go @@ -33,11 +33,10 @@ func init() { } func (b Userspace) Apply(opt *Option, profile string) (string, error) { - if ok, _ := opt.File.IsInsideDir(prebuild.RootApparmord.Join("abstractions")); ok { - return profile, nil - } - if ok, _ := opt.File.IsInsideDir(prebuild.RootApparmord.Join("tunables")); ok { - return profile, nil + for _, dir := range []string{"abstractions", "tunables", "local"} { + if ok, _ := opt.File.IsInsideDir(prebuild.RootApparmord.Join(dir)); ok { + return profile, nil + } } f := aa.DefaultTunables() From 9953cf1fbd08375c24f4263e18ec28fa1b0b8700 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 14 Jan 2025 23:57:19 +0100 Subject: [PATCH 0525/1455] build: make synchronise task configurable. Required by downtream repository. --- pkg/prebuild/cli/cli.go | 2 +- pkg/prebuild/prepare/synchronise.go | 47 +++++++++++++++-------------- 2 files changed, 25 insertions(+), 24 deletions(-) diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 53f3c5589..2af5549a1 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -99,7 +99,7 @@ func Configure() { if file != "" { sync, _ := prepare.Tasks["synchronise"].(*prepare.Synchronise) - sync.Path = file + sync.Paths = []string{file} overwrite, _ := prepare.Tasks["overwrite"].(*prepare.Overwrite) overwrite.OneFile = true } diff --git a/pkg/prebuild/prepare/synchronise.go b/pkg/prebuild/prepare/synchronise.go index b272388c7..fe24471d8 100644 --- a/pkg/prebuild/prepare/synchronise.go +++ b/pkg/prebuild/prepare/synchronise.go @@ -11,7 +11,7 @@ import ( type Synchronise struct { prebuild.Base - Path string + Paths []string // File or directory to sync into the build directory. } func init() { @@ -20,38 +20,39 @@ func init() { Keyword: "synchronise", Msg: "Initialize a new clean apparmor.d build directory", }, - Path: "", + Paths: []string{"apparmor.d", "share"}, }) } func (p Synchronise) Apply() ([]string, error) { res := []string{} - dirs := paths.PathList{prebuild.RootApparmord, prebuild.Root.Join("share"), prebuild.Root.Join("systemd")} - for _, dir := range dirs { - if err := dir.RemoveAll(); err != nil { + if err := prebuild.Root.Join("systemd").RemoveAll(); err != nil { + return res, err + } + if err := prebuild.RootApparmord.RemoveAll(); err != nil { + return res, err + } + + for _, name := range p.Paths { + src := paths.New(name) + dst := prebuild.Root.Join(name) + if err := dst.RemoveAll(); err != nil { return res, err } - } - if p.Path == "" { - for _, name := range []string{"apparmor.d", "share"} { - if err := paths.CopyTo(paths.New(name), prebuild.Root.Join(name)); err != nil { + + if src.IsDir() { + if err := paths.CopyTo(src, dst); err != nil { + return res, err + } + } else { + if err := dst.Parent().MkdirAll(); err != nil { + return res, err + } + if err := src.CopyTo(dst); err != nil { return res, err } } - } else { - file := paths.New(p.Path) - destination, err := file.RelFrom(paths.New("apparmor.d")) - if err != nil { - return res, err - } - destination = prebuild.RootApparmord.JoinPath(destination) - if err := destination.Parent().MkdirAll(); err != nil { - return res, err - } - if err := file.CopyTo(destination); err != nil { - return res, err - } - res = append(res, destination.String()) + res = append(res, dst.String()) } return res, nil } From ba067a021472d89714c3ee26814277374d9a223a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 14 Jan 2025 23:58:01 +0100 Subject: [PATCH 0526/1455] build: naming cosmetic. --- pkg/prebuild/cli/cli.go | 2 +- pkg/prebuild/prepare/overwrite.go | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 2af5549a1..f33296881 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -101,7 +101,7 @@ func Configure() { sync, _ := prepare.Tasks["synchronise"].(*prepare.Synchronise) sync.Paths = []string{file} overwrite, _ := prepare.Tasks["overwrite"].(*prepare.Overwrite) - overwrite.OneFile = true + overwrite.Optional = true } } diff --git a/pkg/prebuild/prepare/overwrite.go b/pkg/prebuild/prepare/overwrite.go index 1bacd446f..530e88690 100644 --- a/pkg/prebuild/prepare/overwrite.go +++ b/pkg/prebuild/prepare/overwrite.go @@ -15,7 +15,7 @@ const ext = ".apparmor.d" type Overwrite struct { prebuild.Base - OneFile bool + Optional bool } func init() { @@ -24,7 +24,7 @@ func init() { Keyword: "overwrite", Msg: "Overwrite dummy upstream profiles", }, - OneFile: false, + Optional: false, }) } @@ -46,7 +46,7 @@ func (p Overwrite) Apply() ([]string, error) { for _, name := range path.MustReadFilteredFileAsLines() { origin := prebuild.RootApparmord.Join(name) dest := prebuild.RootApparmord.Join(name + ext) - if !dest.Exist() && p.OneFile { + if !dest.Exist() && p.Optional { continue } if origin.Exist() { From d20435eb210708b50748732cdb46cbd914abcb24 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 15 Jan 2025 00:08:43 +0100 Subject: [PATCH 0527/1455] feat(profiles): remove unused user role & mappings - Not enabled, tested. - Will come back under another form later. --- apparmor.d/groups/children/user_confined | 31 ---------- apparmor.d/groups/children/user_default | 32 ---------- apparmor.d/groups/children/user_unconfined | 25 -------- apparmor.d/profiles-m-r/pam/mappings | 72 ---------------------- 4 files changed, 160 deletions(-) delete mode 100644 apparmor.d/groups/children/user_confined delete mode 100644 apparmor.d/groups/children/user_default delete mode 100644 apparmor.d/groups/children/user_unconfined delete mode 100644 apparmor.d/profiles-m-r/pam/mappings diff --git a/apparmor.d/groups/children/user_confined b/apparmor.d/groups/children/user_confined deleted file mode 100644 index c4d3c9fed..000000000 --- a/apparmor.d/groups/children/user_confined +++ /dev/null @@ -1,31 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Allow confined users to read, write, lock and link to their own files -# anywhere, and execute from some places. - -abi , - -include - -profile user_confined flags=(complain) { - include - include - include - include - - deny capability sys_ptrace, - - @{bin}/** Pixmr, - - owner /** rwkl, - owner @{HOMEDIRS}/bin/** ixmr, - owner @{user_bin_dirs}/** ixmr, - - @{PROC}/** r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/children/user_default b/apparmor.d/groups/children/user_default deleted file mode 100644 index 2853a8deb..000000000 --- a/apparmor.d/groups/children/user_default +++ /dev/null @@ -1,32 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# By default, allow users to read, lock and link to their own files anywhere, -# but only write to files in their home directory. Only allow limited execution -# of files. - -abi , - -include - -profile user_default flags=(complain) { - include - include - include - include - - deny capability sys_ptrace, - - @{bin}/** Pixmr, - - owner /** rkl, - owner @{HOMEDIRS}/ w, - owner @{HOMEDIRS}/** w, - - @{PROC}/** r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/children/user_unconfined b/apparmor.d/groups/children/user_unconfined deleted file mode 100644 index db410d6a2..000000000 --- a/apparmor.d/groups/children/user_unconfined +++ /dev/null @@ -1,25 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -profile user_unconfined flags=(attach_disconnected,mediate_deleted) { - capability, - network, - mount, - remount, - umount, - pivot_root, - ptrace, - signal, - dbus, - unix, - file, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/pam/mappings b/apparmor.d/profiles-m-r/pam/mappings deleted file mode 100644 index cbcb539ed..000000000 --- a/apparmor.d/profiles-m-r/pam/mappings +++ /dev/null @@ -1,72 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# See more at: https://gitlab.com/apparmor/apparmor/wikis/Pam_apparmor_example - -# This file contains the mappings from users to roles for the binaries -# confined with AppArmor and configured for use with libpam-apparmor. Users -# without a mapping will not be able to login. -# -# The default hat is a confined user. The hat contains only the permissions -# necessary to transition to the user's login shell. All other permissions have -# been moved into the default_user profile. -^DEFAULT { - include - include - - capability dac_override, - capability setgid, - capability setuid, - - /etc/default/su r, - @{etc_ro}/environment r, - - @{shells_path} rPx -> user_default, - - include if exists -} - -# USER is a confined user. The hat contains only the permissions necessary -# to transition to gray's login shell. All other permissions have been -# moved into the confined_user profile. -^USER { - include - include - - capability dac_override, - capability audit_write, - capability setgid, - capability setuid, - - @{shells_path} rPx -> user_confined, - - /etc/default/su r, - @{etc_ro}/environment r, - - include if exists -} - -# Don't confine members whose primary group is 'admin' who are not specifically -# confined. Systems without this special primary group may want to define an -# unconfined 'root' hat in this manner (depending on site policy). -^root { - include - include - include - - capability dac_override, - capability audit_write, - capability setgid, - capability setuid, - - @{shells_path} rUx, - - /etc/default/su r, - @{etc_ro}/environment r, - - include if exists -} - -# vim:syntax=apparmor From 462a972abc12e834c7ecdd44cf7b1944c3b07645 Mon Sep 17 00:00:00 2001 From: adombeck <18482300+adombeck@users.noreply.github.com> Date: Wed, 15 Jan 2025 18:54:43 +0100 Subject: [PATCH 0528/1455] docs: Fix typos --- docs/development/integration.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/development/integration.md b/docs/development/integration.md index 1e5878aa0..15f939cdd 100644 --- a/docs/development/integration.md +++ b/docs/development/integration.md @@ -49,7 +49,7 @@ To build a VM image for development purpose, run the following from the `tests` | Debian | Server | `make debian flavor=server` | `debian-server` | | openSUSE | KDE | `make opensuse flavor=kde` | `opensuse-kde` | | Ubuntu | Server | `make ubuntu flavor=server` | `ubuntu-server` | -| Ubuntu | Desktop | `make ubuntu falvor=desktop` | `ubuntu-desktop` | +| Ubuntu | Desktop | `make ubuntu flavor=desktop` | `ubuntu-desktop` | **VM management** @@ -88,7 +88,7 @@ On all images, `aa-update` can be used to rebuild and install the latest version Prepare the test environment: ```sh cd tests -make falvor= +make flavor= AA_INTEGRATION=true vagrant up ``` From e41c5f6055197b3ad0985f5af735b7d272148360 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 17 Jan 2025 00:06:35 +0100 Subject: [PATCH 0529/1455] build; make the pkgname configurable. --- pkg/prebuild/directories.go | 3 +++ pkg/prebuild/prepare/overwrite.go | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/directories.go b/pkg/prebuild/directories.go index cd5958b72..dcf368f51 100644 --- a/pkg/prebuild/directories.go +++ b/pkg/prebuild/directories.go @@ -10,6 +10,9 @@ var ( // AppArmor ABI version ABI uint = 0 + // Pkgname is the name of the package + Pkgname string = "apparmor.d" + // Root is the root directory for the build (default: .build) Root *paths.Path = paths.New(".build") diff --git a/pkg/prebuild/prepare/overwrite.go b/pkg/prebuild/prepare/overwrite.go index 530e88690..d974b26e4 100644 --- a/pkg/prebuild/prepare/overwrite.go +++ b/pkg/prebuild/prepare/overwrite.go @@ -11,7 +11,7 @@ import ( "github.com/roddhjav/apparmor.d/pkg/prebuild" ) -const ext = ".apparmor.d" +var ext = "." + prebuild.Pkgname type Overwrite struct { prebuild.Base From 693259d8c12eeab2bc996fb5c7a2c78475dea7b3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 20 Jan 2025 21:23:31 +0100 Subject: [PATCH 0530/1455] feat(profile): general update --- apparmor.d/groups/apt/apt-extracttemplates | 2 +- apparmor.d/groups/apt/dpkg-preconfigure | 1 + apparmor.d/groups/freedesktop/pipewire | 1 + apparmor.d/groups/freedesktop/xdg-dbus-proxy | 1 + apparmor.d/groups/freedesktop/xdg-desktop-portal | 3 +-- apparmor.d/groups/freedesktop/xdg-permission-store | 2 +- apparmor.d/groups/gnome/gdm-session-worker | 1 + apparmor.d/groups/kde/konsole | 7 +++++-- apparmor.d/groups/kde/xembedsniproxy | 2 ++ apparmor.d/groups/pacman/pacman | 2 ++ apparmor.d/groups/pacman/pacman-hook-systemd | 2 +- apparmor.d/groups/ssh/sftp-server | 3 +-- apparmor.d/groups/systemd/systemd-fsck | 2 +- apparmor.d/groups/systemd/systemd-networkd | 2 +- apparmor.d/groups/systemd/systemd-rfkill | 2 +- apparmor.d/groups/virt/cockpit-session | 3 ++- apparmor.d/groups/virt/cockpit-ws | 2 ++ apparmor.d/groups/virt/dockerd | 11 ++++------- apparmor.d/profiles-m-r/mullvad-setup | 6 ++++-- apparmor.d/profiles-m-r/needrestart | 8 ++++++-- apparmor.d/profiles-s-z/update-alternatives | 2 ++ apparmor.d/profiles-s-z/virt-manager | 2 +- 22 files changed, 42 insertions(+), 25 deletions(-) diff --git a/apparmor.d/groups/apt/apt-extracttemplates b/apparmor.d/groups/apt/apt-extracttemplates index 2e41b10bf..beb563f31 100644 --- a/apparmor.d/groups/apt/apt-extracttemplates +++ b/apparmor.d/groups/apt/apt-extracttemplates @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/apt-extracttemplates +@{exec_path} = @{bin}/apt-extracttemplates @{lib}/apt/apt-extracttemplates profile apt-extracttemplates @{exec_path} { include include diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index cf957ab4f..34163333b 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -34,6 +34,7 @@ profile dpkg-preconfigure @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/apt-extracttemplates rPx, @{bin}/whiptail rPx, + @{lib}/apt/apt-extracttemplates rPx, /usr/share/debconf/confmodule r, diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index e2b1b22d9..da4350d74 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -46,6 +46,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { / r, @{att}/ r, + owner @{att}// r, owner @{att}/.flatpak-info r, owner @{user_config_dirs}/pipewire/{,**} r, diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index e51f21e1e..eaaa90769 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -28,6 +28,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + owner @{att}/@{HOME}/.var/app/** r, owner @{HOME}/.var/app/*/.local/share/*/logs/* rw, owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 57b17b655..80fa07ec7 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -77,11 +77,10 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_config_dirs}/user-dirs.dirs r, - @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/xdg-desktop-portal/* r, - owner @{tmp}/icon* rw, + owner @{tmp}/icon@{rand6} rw, owner @{run}/user/@{uid}/.flatpak/{,*/*} r, diff --git a/apparmor.d/groups/freedesktop/xdg-permission-store b/apparmor.d/groups/freedesktop/xdg-permission-store index 08cfc840c..ceca1e2b1 100644 --- a/apparmor.d/groups/freedesktop/xdg-permission-store +++ b/apparmor.d/groups/freedesktop/xdg-permission-store @@ -43,7 +43,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/flatpak/db/ rw, owner @{user_share_dirs}/flatpak/db/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/flatpak/db/background rw, - owner @{user_share_dirs}/flatpak/db/desktop-used-apps r, + owner @{user_share_dirs}/flatpak/db/desktop-used-apps rw, owner @{user_share_dirs}/flatpak/db/devices rw, owner @{user_share_dirs}/flatpak/db/documents rw, owner @{user_share_dirs}/flatpak/db/notifications rw, diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 59e6df788..d98b764df 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -107,6 +107,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/ w, + @{run}/cockpit/active.issue r, @{run}/cockpit/inactive.motd r, owner @{run}/systemd/seats/seat@{int} r, owner @{run}/user/@{uid}/keyring/control rw, diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 17ed13f27..8f9ff48dd 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -74,8 +74,11 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/#@{int} rw, owner @{tmp}/konsole.@{rand6} rw, - @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pid}/stat r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-org.kde.konsole-@{int}.scope/** rw, + + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/cgroup r, /dev/ptmx rw, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index 969a82f6c..6cb93163c 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -21,6 +21,8 @@ profile xembedsniproxy @{exec_path} { owner @{tmp}/xauth_@{rand6} r, + owner @{run}/user/@{uid}/iceauth_@{rand6} r, + @{run}/user/@{uid}/xauth_@{rand6} rl, include if exists diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 8215e3f6a..6c0e782fa 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -99,6 +99,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/update-grub rPx, @{bin}/update-mime-database rPx, @{bin}/vercmp rix, + @{bin}/which rix, @{bin}/xmlcatalog rix, @{lib}/systemd/systemd-* rPx, @{lib}/ghc-@{version}/bin/ghc-pkg-@{version} rix, @@ -198,6 +199,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { signal receive set=winch peer=makepkg//sudo, @{pager_path} rPx -> child-pager, + @{bin}/systemd-tty-ask-password-agent rPx, /etc/machine-id r, diff --git a/apparmor.d/groups/pacman/pacman-hook-systemd b/apparmor.d/groups/pacman/pacman-hook-systemd index 6f154269d..0878385c5 100644 --- a/apparmor.d/groups/pacman/pacman-hook-systemd +++ b/apparmor.d/groups/pacman/pacman-hook-systemd @@ -46,7 +46,7 @@ profile pacman-hook-systemd @{exec_path} { capability net_admin, capability sys_resource, - signal send set=term peer=systemd-tty-ask-password-agent, + signal send set=(cont, term) peer=systemd-tty-ask-password-agent, @{bin}/systemd-tty-ask-password-agent Px, diff --git a/apparmor.d/groups/ssh/sftp-server b/apparmor.d/groups/ssh/sftp-server index 3deddb092..a0fc3e2f8 100644 --- a/apparmor.d/groups/ssh/sftp-server +++ b/apparmor.d/groups/ssh/sftp-server @@ -6,8 +6,7 @@ abi , include -@{exec_path} = @{lib}/openssh/sftp-server -@{exec_path} += @{lib}/ssh/sftp-server +@{exec_path} = @{lib}/{openssh,ssh}/sftp-server profile sftp-server @{exec_path} { include include diff --git a/apparmor.d/groups/systemd/systemd-fsck b/apparmor.d/groups/systemd/systemd-fsck index a7290dc48..0680e0be8 100644 --- a/apparmor.d/groups/systemd/systemd-fsck +++ b/apparmor.d/groups/systemd/systemd-fsck @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-fsck -profile systemd-fsck @{exec_path} { +profile systemd-fsck @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 3eaedfaac..7b271c9de 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -51,12 +51,12 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { /etc/networkd-dispatcher/carrier.d/{,*} r, @{att}/ r, + @{att}/@{run}/systemd/notify rw, owner @{att}/var/lib/systemd/network/ r, @{run}/systemd/network/ r, @{run}/systemd/network/*.network r, - @{run}/systemd/notify rw, owner @{run}/systemd/netif/** rw, @{run}/udev/data/n@{int} r, diff --git a/apparmor.d/groups/systemd/systemd-rfkill b/apparmor.d/groups/systemd/systemd-rfkill index ff9e2d540..552bd9996 100644 --- a/apparmor.d/groups/systemd/systemd-rfkill +++ b/apparmor.d/groups/systemd/systemd-rfkill @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-rfkill -profile systemd-rfkill @{exec_path} { +profile systemd-rfkill @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/virt/cockpit-session b/apparmor.d/groups/virt/cockpit-session index 67ecd800e..5b67b14d7 100644 --- a/apparmor.d/groups/virt/cockpit-session +++ b/apparmor.d/groups/virt/cockpit-session @@ -36,11 +36,12 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) { /etc/motd.d/ r, /etc/shells r, + @{att}/@{run}/systemd/sessions/*.ref rw, + @{run}/cockpit/active.motd r, @{run}/cockpit/inactive.motd r, @{run}/faillock/@{user} rwk, @{run}/motd.d/{,*} r, - @{run}/systemd/sessions/*.ref rw, @{run}/utmp rwk, /var/log/btmp rw, diff --git a/apparmor.d/groups/virt/cockpit-ws b/apparmor.d/groups/virt/cockpit-ws index c78f63a63..2a685f04e 100644 --- a/apparmor.d/groups/virt/cockpit-ws +++ b/apparmor.d/groups/virt/cockpit-ws @@ -9,9 +9,11 @@ include @{exec_path} = @{lib}/cockpit/cockpit-ws profile cockpit-ws @{exec_path} { include + include @{exec_path} mr, + @{sh_path} rix, @{lib}/cockpit/cockpit-session rPx, /usr/share/cockpit/{,**} r, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 2ea35f7b9..13f050c7d 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -33,15 +33,9 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { network netlink raw, mount /tmp/containerd-mount@{int}/, - mount /var/lib/docker/buildkit/**/, - mount /var/lib/docker/overlay2/**/, - mount /var/lib/docker/tmp/buildkit-mount@{int}/, - mount fstype=overlay overlay -> /var/lib/docker/rootfs/overlayfs/@{hex64}/, + mount /var/lib/docker/**/, mount options=(rw bind) -> /run/docker/netns/*, - mount options=(rw rbind) -> /var/lib/docker/tmp/docker-builder@{int}/, - mount options=(rw rbind) /var/lib/docker/volumes/**/- -> /var/lib/docker/rootfs/overlayfs/**/, mount options=(rw rprivate) -> /.pivot_root@{int}/, - mount options=(rw rprivate) -> /var/lib/docker/rootfs/overlayfs/@{hex64}/var/lib/buildkit/, mount options=(rw rslave) -> /, remount /tmp/containerd-mount@{int10}/, @@ -90,6 +84,9 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { owner /var/lib/docker/{,**} rwk, owner /var/lib/docker/tmp/qemu-check@{int}/check rix, + /tmp/build/ w, + /tmp/containerd-mount@{int10}/{,**} rw, + owner @{run}/docker/ rw, owner @{run}/docker/** rwlk, owner @{run}/docker.pid rw, diff --git a/apparmor.d/profiles-m-r/mullvad-setup b/apparmor.d/profiles-m-r/mullvad-setup index d2bb2eb44..bc20a0f9a 100644 --- a/apparmor.d/profiles-m-r/mullvad-setup +++ b/apparmor.d/profiles-m-r/mullvad-setup @@ -13,9 +13,11 @@ profile mullvad-setup @{exec_path} { @{exec_path} mr, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 56f95b589..4bc314b0e 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -20,9 +20,9 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { capability kill, capability sys_ptrace, - ptrace (read), + ptrace read, - mqueue (r,getattr) type=posix /, + mqueue r type=posix /, @{exec_path} mrix, @@ -43,6 +43,8 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{lib}/needrestart/* rPx, /usr/share/debconf/frontend rix, + @{att}/@{lib}/python3.@{int}/** r, + /usr/share/needrestart/{,**} r, /usr/share/unattended-upgrades/unattended-upgrade-shutdown r, @@ -60,6 +62,8 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { owner /var/lib/juju/agents/{,**} r, owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, + /tmp/@{word10}/ rw, + owner @{run}/sshd.pid r, @{PROC}/ r, diff --git a/apparmor.d/profiles-s-z/update-alternatives b/apparmor.d/profiles-s-z/update-alternatives index a83e985d7..8f08b74fa 100644 --- a/apparmor.d/profiles-s-z/update-alternatives +++ b/apparmor.d/profiles-s-z/update-alternatives @@ -12,6 +12,8 @@ profile update-alternatives @{exec_path} { include include + capability dac_override, + @{exec_path} mr, @{bin}/* w, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index 052192d8f..af472b4d5 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -31,7 +31,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { @{exec_path} rix, @{sh_path} rix, - @{bin}/python3.@{int} r, + @{bin}/python3.@{int} rix, @{lib}/python3.@{int}/site-packages/__pycache__/guestfs.cpython-@{int}.pyc.@{int} w, @{bin}/ r, From 2f98d0817e426ca01bc183d4173250b65f6de37f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 20 Jan 2025 21:26:54 +0100 Subject: [PATCH 0531/1455] fix(profile): child-open-any See #647 --- apparmor.d/groups/children/child-open-any | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/children/child-open-any b/apparmor.d/groups/children/child-open-any index ea21f8487..b0c0b053e 100644 --- a/apparmor.d/groups/children/child-open-any +++ b/apparmor.d/groups/children/child-open-any @@ -11,11 +11,11 @@ abi , include -profile child-open-any flags=(attach_disconnected) { +profile child-open-any flags=(attach_disconnected,mediate_deleted) { include include - @{open_path} mr, + @{open_path} mrix, @{sh_path} r, @@ -32,6 +32,8 @@ profile child-open-any flags=(attach_disconnected) { /usr/ r, /usr/local/bin/ r, + owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, + /dev/tty rw, include if exists From cf254c8021fd76609ffe855a848d3988d4142bdf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 20 Jan 2025 21:31:08 +0100 Subject: [PATCH 0532/1455] feat(profile): do not use the uname profile directly see #611 --- apparmor.d/groups/gnome/gnome-session | 2 +- apparmor.d/profiles-a-f/amule | 2 +- apparmor.d/profiles-m-r/rustdesk | 2 +- apparmor.d/profiles-s-z/tlp | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index bec97e7de..ce6abe6d9 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -32,7 +32,7 @@ profile gnome-session @{exec_path} { @{bin}/tput rix, @{bin}/tr rix, @{bin}/tty rix, - @{bin}/uname rPx, + @{bin}/uname rix, @{bin}/xargs rix, @{bin}/dpkg-query rpx, diff --git a/apparmor.d/profiles-a-f/amule b/apparmor.d/profiles-a-f/amule index b54e62022..ce600200a 100644 --- a/apparmor.d/profiles-a-f/amule +++ b/apparmor.d/profiles-a-f/amule @@ -27,7 +27,7 @@ profile amule @{exec_path} { # @{open_path} rPx -> child-open, @{exec_path} mr, - @{bin}/uname rPx, + @{bin}/uname rix, @{sh_path} rix, @{system_share_dirs}/amule/{,**} r, owner @{HOME}/.aMule/{,**} rwk, diff --git a/apparmor.d/profiles-m-r/rustdesk b/apparmor.d/profiles-m-r/rustdesk index 004c29d64..2a0f9b391 100644 --- a/apparmor.d/profiles-m-r/rustdesk +++ b/apparmor.d/profiles-m-r/rustdesk @@ -80,7 +80,7 @@ profile rustdesk @{exec_path} { @{sh_path} rix, @{bin}/chmod rix, - @{bin}/uname rPx, + @{bin}/uname rix, /usr/share/rustdesk/files/pynput_service.py rix, /usr/share/[rR]ust[dD]esk/files/{,**} r, diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index 153ded880..5d81c0a75 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -49,7 +49,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{bin}/touch rix, @{bin}/tr rix, @{bin}/udevadm rCx -> udevadm, - @{bin}/uname rpx, + @{bin}/uname rix, /usr/share/tlp/tlp-readconfs rix, / r, From f15cbdfc5bbe4e55ce7718360d1eb61e8eab444a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 20 Jan 2025 21:36:52 +0100 Subject: [PATCH 0533/1455] feat(tunable): add terminal_path fix #656 --- apparmor.d/tunables/multiarch.d/paths | 3 +++ apparmor.d/tunables/multiarch.d/programs | 3 +++ 2 files changed, 6 insertions(+) diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 83aec3ce3..eedf07033 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -65,4 +65,7 @@ # Help @{help_path} = @{bin}/@{help_names} +# Terminal emulator +@{terminal_path} = @{bin}/@{offices_names} + # vim:syntax=apparmor diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index e8f523b6a..18ba854d5 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -89,4 +89,7 @@ # Help @{help_names} = yelp +# Terminal emulator +@{terminal_name} = kgx terminator konsole + # vim:syntax=apparmor From ef99c81eb1f5f590801932fad51e85598517f80c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 20 Jan 2025 22:40:36 +0100 Subject: [PATCH 0534/1455] feat(abs): rewrite the app/open abstraction to accomodate kde requirements. See #630 #605 #647 --- apparmor.d/abstractions/app/open | 31 ++++++++++++++++++++--- apparmor.d/groups/children/child-open-any | 10 +------- 2 files changed, 28 insertions(+), 13 deletions(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index 256eb5a6d..d47c3a4ba 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -3,19 +3,42 @@ # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no -# Full set of rules for child-open-* profiles. +# Full set of rules for desktop generic open-* used in child-open-* profiles. abi , include - @{open_path} mrix, + # We cannot use `@{open_path} mrix,` here because it includes: + # @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop + # And `@{multiarch}` as a wildcard that cannot be merged and that will generate + # "has merged rule with conflicting x modifiers" error when used with other + # wilcard over PUx transition. + @{bin}/exo-open mrix, + @{bin}/xdg-open mrix, + @{bin}/gio mrix, + @{bin}/kde-open mrix, + @{bin}/gio-launch-desktop mrix, + @{lib}/gio-launch-desktop mrix, - @{sh_path} r, @{bin}/env rix, - + @{sh_path} r, + /dev/tty rw, + # if @{DE} == kde + + include + include + include + include + include + + owner @{run}/user//@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, + + # fi + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/children/child-open-any b/apparmor.d/groups/children/child-open-any index b0c0b053e..1259d7708 100644 --- a/apparmor.d/groups/children/child-open-any +++ b/apparmor.d/groups/children/child-open-any @@ -13,11 +13,7 @@ include profile child-open-any flags=(attach_disconnected,mediate_deleted) { include - include - - @{open_path} mrix, - - @{sh_path} r, + include @{bin}/** PUx, @{lib}/** PUx, @@ -32,10 +28,6 @@ profile child-open-any flags=(attach_disconnected,mediate_deleted) { /usr/ r, /usr/local/bin/ r, - owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, - - /dev/tty rw, - include if exists include if exists } From c6a7879e02eab51a738368e565db34217df8ba87 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 20 Jan 2025 23:00:20 +0100 Subject: [PATCH 0535/1455] fix: profile linter. --- apparmor.d/abstractions/app/open | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index d47c3a4ba..be4eda72d 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -11,7 +11,7 @@ # We cannot use `@{open_path} mrix,` here because it includes: # @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop - # And `@{multiarch}` as a wildcard that cannot be merged and that will generate + # And `@{multiarch}` as a wildcard that cannot be merged and that will generate # "has merged rule with conflicting x modifiers" error when used with other # wilcard over PUx transition. @{bin}/exo-open mrix, @@ -23,7 +23,7 @@ @{bin}/env rix, @{sh_path} r, - + /dev/tty rw, # if @{DE} == kde @@ -34,7 +34,7 @@ include include - owner @{run}/user//@{uid}/#@{int} rw, + owner @{run}/user//@{uid}/#@{int} rw, owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, # fi From 0b3c49d26af85211c32c3b6462465fcc74b428e2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 20 Jan 2025 23:29:13 +0100 Subject: [PATCH 0536/1455] fix(profile): mqueue definition in needrestart. --- apparmor.d/profiles-m-r/needrestart | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 4bc314b0e..1e5ee2f91 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -22,7 +22,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { ptrace read, - mqueue r type=posix /, + mqueue (r,getattr) type=posix /, @{exec_path} mrix, From 044c490f10d26018aa5ccc747464b30db004fefd Mon Sep 17 00:00:00 2001 From: beroal Date: Thu, 23 Jan 2025 00:26:31 +0200 Subject: [PATCH 0537/1455] `pacat`: a CLI utility for playing and recording audio from the PulseAudio suite (#653) --- apparmor.d/groups/freedesktop/pacat | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 apparmor.d/groups/freedesktop/pacat diff --git a/apparmor.d/groups/freedesktop/pacat b/apparmor.d/groups/freedesktop/pacat new file mode 100644 index 000000000..8329b7924 --- /dev/null +++ b/apparmor.d/groups/freedesktop/pacat @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Roman Beslik +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pacat +profile pacat @{exec_path} { + include + include + include + + @{exec_path} mr, + + /etc/machine-id r, + + owner @{user_music_dirs}/{,**} rw, + + include if exists +} + +# vim:syntax=apparmor From 4286b5330ca33335f957501cadfb776d516e3464 Mon Sep 17 00:00:00 2001 From: nobody43 Date: Wed, 22 Jan 2025 22:50:59 +0000 Subject: [PATCH 0538/1455] xfce, updates --- apparmor.d/groups/apt/dpkg-preconfigure | 7 +++++++ apparmor.d/groups/children/child-dpkg-divert | 1 + apparmor.d/groups/display-manager/lightdm | 11 +++++++++++ .../polkit-gnome-authentication-agent | 8 ++++++++ apparmor.d/groups/freedesktop/polkitd | 1 + apparmor.d/groups/gnome/gnome-system-monitor | 2 +- apparmor.d/groups/grub/grub-mkconfig | 1 + apparmor.d/groups/grub/grub-probe | 1 + apparmor.d/groups/gvfs/gvfsd-computer | 3 +++ apparmor.d/groups/gvfs/gvfsd-wsdd | 3 +++ apparmor.d/groups/network/NetworkManager | 1 + apparmor.d/groups/network/wg | 1 + apparmor.d/groups/network/wg-quick | 1 + apparmor.d/groups/systemd/systemd-hwdb | 4 ++-- apparmor.d/groups/systemd/systemd-udevd | 2 +- apparmor.d/groups/xfce/startxfce | 4 ++++ apparmor.d/groups/xfce/thunar | 9 +++++++++ apparmor.d/groups/xfce/thunar-volman | 2 ++ apparmor.d/groups/xfce/tumblerd | 15 +++++++++++++++ apparmor.d/groups/xfce/xfce-clipman-settings | 4 ++++ apparmor.d/groups/xfce/xfce-notifyd | 5 +++++ apparmor.d/groups/xfce/xfce-panel | 18 +++++++++++++++++- apparmor.d/groups/xfce/xfce-power-manager | 7 +++++++ apparmor.d/groups/xfce/xfce-screensaver | 4 ++++ apparmor.d/groups/xfce/xfce-session | 11 +++++++++++ apparmor.d/groups/xfce/xfce-terminal | 11 +++++++++++ apparmor.d/groups/xfce/xfconfd | 5 ++++- apparmor.d/groups/xfce/xfdesktop | 10 ++++++++++ apparmor.d/groups/xfce/xfsettingsd | 6 ++++++ apparmor.d/groups/xfce/xfwm | 2 ++ apparmor.d/profiles-a-f/blueman | 2 ++ apparmor.d/profiles-a-f/blueman-mechanism | 1 + apparmor.d/profiles-a-f/filezilla | 2 ++ apparmor.d/profiles-g-l/iceauth | 2 +- apparmor.d/profiles-g-l/im-launch | 1 + apparmor.d/profiles-g-l/libreoffice | 9 +++++++-- apparmor.d/profiles-m-r/mkinitramfs | 1 + apparmor.d/profiles-m-r/mount-cifs | 2 ++ apparmor.d/profiles-m-r/nemo | 5 +++++ apparmor.d/profiles-m-r/remmina | 6 ++++++ apparmor.d/profiles-m-r/run-parts | 2 ++ apparmor.d/profiles-s-z/su | 2 ++ .../profiles-s-z/system-config-printer-applet | 3 +++ apparmor.d/profiles-s-z/xarchiver | 1 + 44 files changed, 190 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index 34163333b..eb022b3cb 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -30,6 +30,9 @@ profile dpkg-preconfigure @{exec_path} { @{bin}/sort rix, @{bin}/stty rix, @{bin}/tr rix, + @{bin}/head rix, + @{bin}/readlink rix, + @{bin}/realpath rix, @{bin}/dpkg rPx -> child-dpkg, @{bin}/apt-extracttemplates rPx, @@ -37,11 +40,14 @@ profile dpkg-preconfigure @{exec_path} { @{lib}/apt/apt-extracttemplates rPx, /usr/share/debconf/confmodule r, + /usr/share/dictionaries-common/{,*} r, + /etc/cloud/cloud.cfg.d/90_dpkg.cfg r, /etc/debconf.conf r, /etc/default/grub r, /etc/inputrc r, /etc/shadow r, + /etc/X11/Xwrapper.config r, owner @{tmp}/*.template.* rw, owner @{tmp}/*.config.* rwPUx, @@ -54,6 +60,7 @@ profile dpkg-preconfigure @{exec_path} { owner /var/cache/debconf/tmp.ci/*.config.@{rand6} w, owner /var/cache/debconf/tmp.ci/*.passwords.@{rand6} w, owner /var/cache/debconf/tmp.ci/*.template.@{rand6} w, + owner /var/cache/dictionaries-common/flag-wordlist-new w, owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw, @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, diff --git a/apparmor.d/groups/children/child-dpkg-divert b/apparmor.d/groups/children/child-dpkg-divert index 6ea41a9e8..ddfff5fc2 100644 --- a/apparmor.d/groups/children/child-dpkg-divert +++ b/apparmor.d/groups/children/child-dpkg-divert @@ -22,6 +22,7 @@ profile child-dpkg-divert { /var/lib/dpkg/arch r, /var/lib/dpkg/status r, /var/lib/dpkg/updates/ r, + /var/lib/dpkg/updates/@{int} r, /var/lib/dpkg/triggers/File r, /var/lib/dpkg/triggers/Unincorp r, /var/lib/dpkg/diversions r, diff --git a/apparmor.d/groups/display-manager/lightdm b/apparmor.d/groups/display-manager/lightdm index 04accbbf0..a70779fc4 100644 --- a/apparmor.d/groups/display-manager/lightdm +++ b/apparmor.d/groups/display-manager/lightdm @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/lightdm profile lightdm @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -36,6 +37,10 @@ profile lightdm @{exec_path} flags=(attach_disconnected) { signal (send) set=(term) peer=xfce-session, signal (send) set=(term) peer=xorg, + unix (bind) type=stream addr="@@{hex}/bus/lightdm/system", + + dbus (bind) bus=system name=org.freedesktop.DisplayManager, + @{exec_path} mrix, @{bin}/rm rix, @@ -45,6 +50,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) { @{bin}/Xorg rPx, @{bin}/plymouth rPx, @{bin}/gnome-keyring-daemon rPx, + @{bin}/lightdm-session rPx, @{lib}/security-misc/* rPx, #aa:only whonix @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx, @@ -52,6 +58,10 @@ profile lightdm @{exec_path} flags=(attach_disconnected) { /etc/lightdm/Xsession rPx, /etc/X11/Xsession rPx, + @{sh_path} rix, + @{bin}/{,e,f}grep rix, + @{bin}/df rix, + /usr/share/lightdm/{,**} r, /usr/share/wayland-sessions/{,*.desktop} r, /usr/share/xgreeters/{,**} r, @@ -81,6 +91,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/loginuid rw, owner @{PROC}/@{pid}/uid_map r, + owner @{PROC}/@{pid}/mountinfo r, /dev/tty@{int} r, diff --git a/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent b/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent index 94bc7ece6..e488272ca 100644 --- a/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent @@ -12,11 +12,19 @@ include @{exec_path} += @{lib}/polkit-gnome/polkit-gnome-authentication-agent-1 profile polkit-gnome-authentication-agent @{exec_path} { include + include + include + include + include include include + signal (send) set=(term) peer=polkit-agent-helper, + @{exec_path} mr, + @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx, + @{PROC}/@{pid}/cgroup r, include if exists diff --git a/apparmor.d/groups/freedesktop/polkitd b/apparmor.d/groups/freedesktop/polkitd index 5e3d3ee78..5b630a15a 100644 --- a/apparmor.d/groups/freedesktop/polkitd +++ b/apparmor.d/groups/freedesktop/polkitd @@ -31,6 +31,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/pkla-check-authorization rPUx, + @{bin}/pkla-admin-identities rPx, /etc/machine-id r, diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 92cbd369e..8df82b290 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -36,7 +36,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { @{bin}/tr rix, /usr/share/gnome-system-monitor/{,**} r, - /usr/share/firefox-esr/browser/chrome/icons/default/*.png r, + /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r, / r, diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index 2a60d69c5..1ff23f1fe 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -65,6 +65,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { @{lib}/grub/grub-sort-version rPx, @{lib}/libostree/grub[0-9]-@{int}_ostree rix, + /usr/share/desktop-base/*/grub/* r, /usr/share/grub/{,**} r, /usr/share/terminfo/** r, diff --git a/apparmor.d/groups/grub/grub-probe b/apparmor.d/groups/grub/grub-probe index 80d517deb..2e2d9232b 100644 --- a/apparmor.d/groups/grub/grub-probe +++ b/apparmor.d/groups/grub/grub-probe @@ -27,6 +27,7 @@ profile grub-probe @{exec_path} { / r, /boot/ r, + /boot/grub/ r, /boot/grub/themes/{,**} r, @{PROC}/@{pids}/mountinfo r, diff --git a/apparmor.d/groups/gvfs/gvfsd-computer b/apparmor.d/groups/gvfs/gvfsd-computer index e756c8440..f72fc17c7 100644 --- a/apparmor.d/groups/gvfs/gvfsd-computer +++ b/apparmor.d/groups/gvfs/gvfsd-computer @@ -10,6 +10,9 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-computer profile gvfsd-computer @{exec_path} { include + include + + dbus (bind) bus=session name=org.gtk.vfs.mountpoint_@{int}, @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-wsdd b/apparmor.d/groups/gvfs/gvfsd-wsdd index f971b5f6a..1b0dc2cc2 100644 --- a/apparmor.d/groups/gvfs/gvfsd-wsdd +++ b/apparmor.d/groups/gvfs/gvfsd-wsdd @@ -9,9 +9,12 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-wsdd profile gvfsd-wsdd @{exec_path} { include + include network netlink raw, + dbus (bind) bus=session name=org.gtk.vfs.mountpoint_wsdd, + @{exec_path} mr, @{bin}/env r, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 1bb2de231..39c68fda9 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -105,6 +105,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { /etc/ r, /etc/iproute2/* r, /etc/machine-id r, + /etc/netplan/90-NM-@{uuid}.yaml w, /etc/network/interfaces r, /etc/network/interfaces.d/{,*} r, /etc/NetworkManager/{,**} r, diff --git a/apparmor.d/groups/network/wg b/apparmor.d/groups/network/wg index 781a52f7a..57e6ec769 100644 --- a/apparmor.d/groups/network/wg +++ b/apparmor.d/groups/network/wg @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/wg profile wg @{exec_path} { include + include capability net_admin, capability net_bind_service, diff --git a/apparmor.d/groups/network/wg-quick b/apparmor.d/groups/network/wg-quick index c7ea6b1bd..5c4a5579b 100644 --- a/apparmor.d/groups/network/wg-quick +++ b/apparmor.d/groups/network/wg-quick @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/wg-quick profile wg-quick @{exec_path} { include + include capability dac_read_search, capability net_admin, diff --git a/apparmor.d/groups/systemd/systemd-hwdb b/apparmor.d/groups/systemd/systemd-hwdb index 9b6203e92..ae64274c6 100644 --- a/apparmor.d/groups/systemd/systemd-hwdb +++ b/apparmor.d/groups/systemd/systemd-hwdb @@ -16,10 +16,10 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{exec_path} mr, @{lib}/udev/#@{int} rwl, - @{lib}/udev/.#hwdb.bin@{hex16} wl -> @{lib}/udev/#@{int}, + @{lib}/udev/.#hwdb.bin{@{hex16},@{rand6}} wl -> @{lib}/udev/#@{int}, @{lib}/udev/hwdb.bin w, - /etc/udev/.#hwdb.bin@{hex16} wl -> /etc/udev/#@{int}, + /etc/udev/.#hwdb.bin{@{hex16},@{rand6}} wl -> /etc/udev/#@{int}, /etc/udev/hwdb.bin w, /etc/udev/hwdb.d/{,*} r, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index f52a2fc6c..0ba3be209 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -79,7 +79,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { /etc/nfs.conf rk, /etc/udev/{,**} r, - /etc/udev/.#hwdb.bin* rw, + /etc/udev/.#hwdb.bin{@{hex16},@{rand6}} rw, /etc/udev/hwdb.bin rw, /etc/modprobe.d/ r, diff --git a/apparmor.d/groups/xfce/startxfce b/apparmor.d/groups/xfce/startxfce index 8d91581cb..110da187b 100644 --- a/apparmor.d/groups/xfce/startxfce +++ b/apparmor.d/groups/xfce/startxfce @@ -19,6 +19,7 @@ profile startxfce @{exec_path} { @{bin}/mkdir rix, @{bin}/id rix, + @{bin}/xdg-user-dirs-update rPx, @{bin}/xfce4-session rPx, @{bin}/xrdb rPx, @{bin}/systemctl rCx -> systemctl, @@ -27,6 +28,8 @@ profile startxfce @{exec_path} { /etc/X11/xinit/xinitrc.d/{,**} r, /etc/xdg/xfce4/{,**} r, + owner @{HOME}/.Xdefaults r, + profile systemctl flags=(attach_disconnected) { include include @@ -36,6 +39,7 @@ profile startxfce @{exec_path} { profile dbus { include + include @{bin}/dbus-update-activation-environment mr, diff --git a/apparmor.d/groups/xfce/thunar b/apparmor.d/groups/xfce/thunar index d8f04d49c..629fc2b4b 100644 --- a/apparmor.d/groups/xfce/thunar +++ b/apparmor.d/groups/xfce/thunar @@ -9,6 +9,8 @@ include @{exec_path} = @{bin}/thunar profile thunar @{exec_path} { include + include + include include include include @@ -17,6 +19,10 @@ profile thunar @{exec_path} { network netlink raw, + dbus (bind) bus=session name=org.xfce.Thunar, + dbus (bind) bus=session name=org.xfce.FileManager, + dbus (bind) bus=session name=org.freedesktop.FileManager1, + @{exec_path} mr, @{bin}/thunar-volman rPx, @@ -30,6 +36,7 @@ profile thunar @{exec_path} { /etc/fstab r, /etc/timezone r, + /etc/xdg/{,xdg-xubuntu/}Thunar/{,**} r, # Full access to user's data / r, @@ -50,6 +57,8 @@ profile thunar @{exec_path} { deny /tmp/.* rw, deny /tmp/.*/{,**} rw, + @{run}/mount/utab r, + owner @{PROC}/@{pid}/mountinfo r, profile dbus { diff --git a/apparmor.d/groups/xfce/thunar-volman b/apparmor.d/groups/xfce/thunar-volman index 350255834..fc73a14c9 100644 --- a/apparmor.d/groups/xfce/thunar-volman +++ b/apparmor.d/groups/xfce/thunar-volman @@ -9,6 +9,8 @@ include @{exec_path} = @{bin}/thunar-volman profile thunar-volman @{exec_path} { include + include + include include include diff --git a/apparmor.d/groups/xfce/tumblerd b/apparmor.d/groups/xfce/tumblerd index 99971abb8..db90af4c5 100644 --- a/apparmor.d/groups/xfce/tumblerd +++ b/apparmor.d/groups/xfce/tumblerd @@ -9,18 +9,33 @@ include @{exec_path} = @{lib}/{,@{multiarch}/}tumbler-1/tumblerd profile tumblerd @{exec_path} { include + include + include + include + include + include + include include include include + dbus (bind) bus=session name=org.freedesktop.thumbnails.Cache1, + dbus (bind) bus=session name=org.freedesktop.thumbnails.Manager1, + dbus (bind) bus=session name=org.freedesktop.thumbnails.Thumbnailer1, + @{exec_path} mr, + @{bin}/gdk-pixbuf-thumbnailer rPx, + /usr/share/backgrounds/xfce/{,**} r, /usr/share/thumbnailers/{,**} r, /etc/fstab r, /etc/xdg/tumbler/* r, + owner /tmp/tumbler-@{rand6}.png r, + owner /tmp/tumbler-@{rand6}.??? w, + owner @{PROC}/@{pid}/mountinfo r, /dev/ r, diff --git a/apparmor.d/groups/xfce/xfce-clipman-settings b/apparmor.d/groups/xfce/xfce-clipman-settings index 248d60b7e..2c777a0a1 100644 --- a/apparmor.d/groups/xfce/xfce-clipman-settings +++ b/apparmor.d/groups/xfce/xfce-clipman-settings @@ -9,8 +9,12 @@ include @{exec_path} = @{bin}/xfce4-clipman-settings profile xfce-clipman-settings @{exec_path} { include + include + include include + dbus (bind) bus=session name=org.xfce.clipman.settings, + @{exec_path} mr, @{open_path} rPx -> child-open-help, diff --git a/apparmor.d/groups/xfce/xfce-notifyd b/apparmor.d/groups/xfce/xfce-notifyd index f5c80e07c..d8ef2a9e0 100644 --- a/apparmor.d/groups/xfce/xfce-notifyd +++ b/apparmor.d/groups/xfce/xfce-notifyd @@ -10,6 +10,8 @@ include @{exec_path} = @{lib}/{,@{multiarch}/}xfce4/notifyd/xfce4-notifyd profile xfce-notifyd @{exec_path} { include + include + include include include include @@ -22,6 +24,9 @@ profile xfce-notifyd @{exec_path} { network inet6 stream, network netlink raw, + dbus (bind) bus=session name=org.xfce.Notifyd, + dbus (bind) bus=session name=org.freedesktop.Notifications, + @{exec_path} mr, owner @{user_cache_dirs}/xfce4/notifyd/ rw, diff --git a/apparmor.d/groups/xfce/xfce-panel b/apparmor.d/groups/xfce/xfce-panel index 7b192ffc5..d2a9cdbf6 100644 --- a/apparmor.d/groups/xfce/xfce-panel +++ b/apparmor.d/groups/xfce/xfce-panel @@ -9,12 +9,22 @@ include @{exec_path} = @{bin}/xfce4-panel @{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0 profile xfce-panel @{exec_path} { include + include + include + include + include + include include include include include include + ptrace (read) peer=xfce-terminal, + + dbus (bind) bus=session name=org.xfce.Panel, + dbus (bind) bus=session name=org.kde.StatusNotifierWatcher, + @{exec_path} mr, @{bin}/exo-open rix, @@ -26,6 +36,7 @@ profile xfce-panel @{exec_path} { @{bin}/sudo rCx -> root, /usr/share/desktop-directories/{,**} r, + /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r, /usr/share/livecheck/** r, /usr/share/xfce4/{,**} r, @@ -33,15 +44,20 @@ profile xfce-panel @{exec_path} { /etc/machine-id r, /etc/timezone r, /etc/xdg/menus/{,**} r, - /etc/xdg/xfce4/{,**} r, + /etc/xdg/{,xdg-xubuntu/}xfce4/{,**} r, owner @{user_cache_dirs}/xfce4/notifyd/icons/ rw, + owner @{user_cache_dirs}/xfce4-indicator-plugin.log w, owner @{user_config_dirs}/xfce4/panel/{,**} rw, + owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} w, + @{PROC}/cmdline r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mountinfo r, + deny @{user_share_dirs}/gvfs-metadata/{,*} r, + profile root { include include diff --git a/apparmor.d/groups/xfce/xfce-power-manager b/apparmor.d/groups/xfce/xfce-power-manager index 1c2a0263d..4f3199a9e 100644 --- a/apparmor.d/groups/xfce/xfce-power-manager +++ b/apparmor.d/groups/xfce/xfce-power-manager @@ -9,9 +9,16 @@ include @{exec_path} = @{bin}/xfce4-power-manager profile xfce-power-manager @{exec_path} flags=(attach_disconnected) { include + include + include + include + include include include + dbus (bind) bus=session name=org.xfce.PowerManager, + dbus (bind) bus=session name=org.freedesktop.PowerManagement, + @{exec_path} mr, @{bin}/xfpm-power-backlight-helper rPx, diff --git a/apparmor.d/groups/xfce/xfce-screensaver b/apparmor.d/groups/xfce/xfce-screensaver index e486ac6d9..911cc1b9f 100644 --- a/apparmor.d/groups/xfce/xfce-screensaver +++ b/apparmor.d/groups/xfce/xfce-screensaver @@ -9,11 +9,15 @@ include @{exec_path} = @{bin}/xfce4-screensaver profile xfce-screensaver @{exec_path} flags=(attach_disconnected) { include + include + include include include include include + dbus (bind) bus=session name=org.xfce.ScreenSaver, + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/xfce/xfce-session b/apparmor.d/groups/xfce/xfce-session index 17007122e..6db8277d7 100644 --- a/apparmor.d/groups/xfce/xfce-session +++ b/apparmor.d/groups/xfce/xfce-session @@ -9,6 +9,10 @@ include @{exec_path} = @{bin}/xfce4-session profile xfce-session @{exec_path} flags=(attach_disconnected) { include + include + include + include + include include include include @@ -16,6 +20,8 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term) peer=lightdm, + dbus (bind) bus=session name=org.xfce.SessionManager, + @{exec_path} mr, @{sh_path} rix, @@ -33,6 +39,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) { @{lib}/msgcollector/msgdispatcher_xdg_autostart rPx, @{lib}/sdwdate-gui/start-maybe rPx, @{lib}/setup-wizard-dist/setup-dist_check_for_start rPx, + @{lib}/xapps/sn-watcher/xapp-sn-watcher rPUx, /usr/share/kde-power-savings-disable-in-vms/{,**} r, /usr/share/kde-screen-locker-disable-in-vms/{,**} r, @@ -48,11 +55,15 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) { /etc/xdg/autostart/*.desktop r, owner @{user_cache_dirs}/sessions/{,**} rw, + owner @{user_config_dirs}/autostart/ r, + owner @{user_config_dirs}/autostart/*.desktop r, owner @{tmp}/.xfsm-ICE-@{rand6} rw, owner @{PROC}/@{pid}/stat r, + @{sys}/class/i2c-adapter/ r, + /dev/tty rw, profile systemctl flags=(attach_disconnected) { diff --git a/apparmor.d/groups/xfce/xfce-terminal b/apparmor.d/groups/xfce/xfce-terminal index d0d895c5a..46a17ca7f 100644 --- a/apparmor.d/groups/xfce/xfce-terminal +++ b/apparmor.d/groups/xfce/xfce-terminal @@ -9,6 +9,9 @@ include @{exec_path} = @{bin}/xfce4-terminal profile xfce-terminal @{exec_path} { include + include + include + include include include include @@ -16,6 +19,10 @@ profile xfce-terminal @{exec_path} { include include + signal (send), + + dbus (bind) bus=session name=org.xfce.Terminal5, + @{exec_path} mr, @{open_path} rPx -> child-open-help, @@ -28,7 +35,10 @@ profile xfce-terminal @{exec_path} { @{bin}/micro rPUx, @{bin}/nvtop rPx, + @{bin}/vim{,.basic} rPUx, + /usr/share/ r, + /usr/share/desktop-base/profiles/xdg-config/ r, /usr/share/xfce4/ r, /usr/share/xfce4/terminal/{,**} r, @@ -36,6 +46,7 @@ profile xfce-terminal @{exec_path} { /etc/xdg/ r, /etc/xdg/xfce4/ r, + owner @{user_config_dirs}/xfce4/ r, owner @{user_config_dirs}/xfce4/terminal/{,**} r, owner @{tmp}/#@{int} rw, diff --git a/apparmor.d/groups/xfce/xfconfd b/apparmor.d/groups/xfce/xfconfd index 0ab17ac5c..de82191a7 100644 --- a/apparmor.d/groups/xfce/xfconfd +++ b/apparmor.d/groups/xfce/xfconfd @@ -10,11 +10,14 @@ include @{exec_path} = @{lib}/{,@{multiarch}/}xfce4/xfconf/xfconfd profile xfconfd @{exec_path} { include + include include + dbus (bind) bus=session name=org.xfce.Xfconf, + @{exec_path} mr, - /etc/xdg/xfce4/xfconf/** r, + /etc/xdg/{,xdg-xubuntu/}xfce4/xfconf/** r, owner @{HOME}/ r, diff --git a/apparmor.d/groups/xfce/xfdesktop b/apparmor.d/groups/xfce/xfdesktop index d19e3de63..ed7d18ddc 100644 --- a/apparmor.d/groups/xfce/xfdesktop +++ b/apparmor.d/groups/xfce/xfdesktop @@ -9,15 +9,25 @@ include @{exec_path} = @{bin}/xfdesktop profile xfdesktop @{exec_path} { include + include + include + include + include include include include include + dbus (bind) bus=session name=org.xfce.xfdesktop, + @{exec_path} mr, @{bin}/xfce4-mime-helper rix, + /etc/xdg/{,xdg-xubuntu/}xfce4/helpers.rc r, + /etc/xdg/menus/{,*.menu} r, + /usr/share/xfce4/helpers/{,*.desktop} r, + /usr/share/desktop-directories/{,*.directory} r, /usr/share/backgrounds/xfce/{,**} r, /etc/fstab r, diff --git a/apparmor.d/groups/xfce/xfsettingsd b/apparmor.d/groups/xfce/xfsettingsd index 3eec3377f..b2f783390 100644 --- a/apparmor.d/groups/xfce/xfsettingsd +++ b/apparmor.d/groups/xfce/xfsettingsd @@ -10,8 +10,14 @@ include profile xfsettingsd @{exec_path} { include include + include + include + include + include include + dbus (bind) bus=session name=org.xfce.SettingsDaemon, + @{exec_path} mr, /etc/xdg/autostart/xfsettingsd.desktop r, diff --git a/apparmor.d/groups/xfce/xfwm b/apparmor.d/groups/xfce/xfwm index d7af2ccb9..7ecd2c8fe 100644 --- a/apparmor.d/groups/xfce/xfwm +++ b/apparmor.d/groups/xfce/xfwm @@ -9,6 +9,8 @@ include @{exec_path} = @{bin}/xfwm4 profile xfwm @{exec_path} { include + include + include include include include diff --git a/apparmor.d/profiles-a-f/blueman b/apparmor.d/profiles-a-f/blueman index 08a553c1d..7a2b4530f 100644 --- a/apparmor.d/profiles-a-f/blueman +++ b/apparmor.d/profiles-a-f/blueman @@ -11,6 +11,7 @@ include profile blueman @{exec_path} flags=(attach_disconnected) { include include + include include include include @@ -61,6 +62,7 @@ profile blueman @{exec_path} flags=(attach_disconnected) { /dev/shm/ r, /dev/tty rw, + deny @{lib}/python3/dist-packages/blueman/__pycache__/** w, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, include if exists diff --git a/apparmor.d/profiles-a-f/blueman-mechanism b/apparmor.d/profiles-a-f/blueman-mechanism index aae5d53cd..bb6c6cdf7 100644 --- a/apparmor.d/profiles-a-f/blueman-mechanism +++ b/apparmor.d/profiles-a-f/blueman-mechanism @@ -10,6 +10,7 @@ include @{exec_path} = @{lib}/blueman-mechanism @{lib}/blueman/blueman-mechanism profile blueman-mechanism @{exec_path} flags=(attach_disconnected) { include + include include include diff --git a/apparmor.d/profiles-a-f/filezilla b/apparmor.d/profiles-a-f/filezilla index be734ed50..4463ac581 100644 --- a/apparmor.d/profiles-a-f/filezilla +++ b/apparmor.d/profiles-a-f/filezilla @@ -29,6 +29,7 @@ profile filezilla @{exec_path} { network netlink raw, signal send set=(term, kill) peer=fzsftp, + signal send set=(term, kill) peer=fzputtygen, @{exec_path} mr, @@ -36,6 +37,7 @@ profile filezilla @{exec_path} { @{bin}/uname rix, @{bin}/fzsftp rPx, # When using SFTP protocol + @{bin}/fzputtygen rPUx, @{bin}/lsb_release rPx -> lsb_release, /usr/share/filezilla/{,**} r, diff --git a/apparmor.d/profiles-g-l/iceauth b/apparmor.d/profiles-g-l/iceauth index 03c8650dd..d46374984 100644 --- a/apparmor.d/profiles-g-l/iceauth +++ b/apparmor.d/profiles-g-l/iceauth @@ -16,7 +16,7 @@ profile iceauth @{exec_path} { owner @{tmp}/.xfsm-ICE-@{rand6} r, owner @{tmp}/user/@{uid}/.xfsm-ICE-@{rand6} r, - owner @{run}/user/@{uid}/ICEauthority rl -> @{run}/user/@{uid}/ICEauthority-n, + owner @{run}/user/@{uid}/ICEauthority rwl -> @{run}/user/@{uid}/ICEauthority-n, owner @{run}/user/@{uid}/ICEauthority-c w, owner @{run}/user/@{uid}/ICEauthority-l wl -> @{run}/user/@{uid}/ICEauthority-c, owner @{run}/user/@{uid}/ICEauthority-n rw, diff --git a/apparmor.d/profiles-g-l/im-launch b/apparmor.d/profiles-g-l/im-launch index c5c4aa276..04abb7e0c 100644 --- a/apparmor.d/profiles-g-l/im-launch +++ b/apparmor.d/profiles-g-l/im-launch @@ -22,6 +22,7 @@ profile im-launch @{exec_path} { @{bin}/sed rix, @{bin}/sleep rix, @{bin}/startplasma-x11 rPx, + @{bin}/startxfce4 rPx, @{bin}/true rix, @{bin}/uim-toolbar-gtk3 rPUx, @{bin}/uim-xim rPUx, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 03dfe9749..11773c911 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -11,6 +11,7 @@ include profile libreoffice @{exec_path} { include include + include include include include @@ -67,11 +68,14 @@ profile libreoffice @{exec_path} { /usr/share/mythes/{,**} r, /usr/share/thumbnailers/{,**} r, - /etc/java{,@{version}}-openjdk/{,**} r, + /etc/java{,-}{,@{version}}-openjdk/{,**} r, /etc/libreoffice/{,**} r, /etc/paperspecs r, + /etc/papersize r, /etc/xdg/* r, + owner /var/spool/libreoffice/uno_packages/cache/stamp.sys w, + owner @{user_cache_dirs}/libreoffice/{,**} rw, owner @{user_config_dirs}/libreoffice/ rw, owner @{user_config_dirs}/libreoffice/** rwk, @@ -90,7 +94,7 @@ profile libreoffice @{exec_path} { owner @{tmp}/*.tmp/{,**} rwk, owner @{tmp}/hsperfdata_@{user}/ rw, owner @{tmp}/hsperfdata_@{user}/@{int} rwk, - owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} w, + owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex32} rw, owner @{run}/user/@{uid}/#@{int} rw, @@ -99,6 +103,7 @@ profile libreoffice @{exec_path} { @{sys}/kernel/mm/hugepages/ r, @{sys}/kernel/mm/transparent_hugepage/enabled r, @{sys}/kernel/mm/transparent_hugepage/shmem_enabled r, + @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/{cpu,memory}.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/**/memory.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 6585f6382..00fdc5cf0 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -43,6 +43,7 @@ profile mkinitramfs @{exec_path} { @{bin}/mkdir rix, @{bin}/mktemp rix, @{bin}/readlink rix, + @{bin}/realpath rix, @{bin}/rm rix, @{bin}/rmdir rix, @{bin}/sed rix, diff --git a/apparmor.d/profiles-m-r/mount-cifs b/apparmor.d/profiles-m-r/mount-cifs index 190db34da..6000f6334 100644 --- a/apparmor.d/profiles-m-r/mount-cifs +++ b/apparmor.d/profiles-m-r/mount-cifs @@ -10,10 +10,12 @@ include @{exec_path} = @{bin}/mount.cifs profile mount-cifs @{exec_path} flags=(complain) { include + include include capability sys_admin, capability setpcap, + capability dac_read_search, network inet dgram, network inet stream, diff --git a/apparmor.d/profiles-m-r/nemo b/apparmor.d/profiles-m-r/nemo index e3edb99c3..c7c9160d7 100644 --- a/apparmor.d/profiles-m-r/nemo +++ b/apparmor.d/profiles-m-r/nemo @@ -21,7 +21,12 @@ profile nemo @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open, + + @{bin}/gdk-pixbuf-thumbnailer rPx, + /usr/share/nemo/** r, + /usr/share/thumbnailers/{,*.thumbnailer} r, # Full access to user's data / r, diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index f59880046..44b18cf42 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -22,6 +22,7 @@ profile remmina @{exec_path} { include include include + include include include include @@ -29,6 +30,8 @@ profile remmina @{exec_path} { network inet stream, network inet6 stream, + network inet dgram, + network inet6 dgram, network netlink raw, #aa:dbus own bus=session name=org.remmina.Remmina @@ -58,6 +61,9 @@ profile remmina @{exec_path} { owner @{run}/user/@{uid}/keyring/ssh rw, + @{sys}/devices/system/node/ r, + @{sys}/devices/system/node/node@{int}/meminfo r, + include if exists } diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index c20b305e1..dca0fbe63 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -247,6 +247,8 @@ profile run-parts @{exec_path} { @{run}/reboot-required w, @{run}/reboot-required.pkgs rw, + @{sys}/module/compression r, + @{PROC}/devices r, @{PROC}/cmdline r, diff --git a/apparmor.d/profiles-s-z/su b/apparmor.d/profiles-s-z/su index 02a212150..8d717274d 100644 --- a/apparmor.d/profiles-s-z/su +++ b/apparmor.d/profiles-s-z/su @@ -27,6 +27,8 @@ profile su @{exec_path} { @{bin}/nologin rPx, @{etc_ro}/default/su r, + /etc/default/locale r, + /etc/environment r, @{HOME}/.xauth@{rand6} rw, diff --git a/apparmor.d/profiles-s-z/system-config-printer-applet b/apparmor.d/profiles-s-z/system-config-printer-applet index 0197e3c3b..99cdbc996 100644 --- a/apparmor.d/profiles-s-z/system-config-printer-applet +++ b/apparmor.d/profiles-s-z/system-config-printer-applet @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/system-config-printer-applet /usr/share/system-config-printer/applet.py profile system-config-printer-applet @{exec_path} { include + include include include @@ -29,6 +30,8 @@ profile system-config-printer-applet @{exec_path} { /dev/tty rw, + deny @{lib}/python3/dist-packages/cupshelpers/__pycache__/** w, + include if exists } diff --git a/apparmor.d/profiles-s-z/xarchiver b/apparmor.d/profiles-s-z/xarchiver index 003770008..1e0d75fd0 100644 --- a/apparmor.d/profiles-s-z/xarchiver +++ b/apparmor.d/profiles-s-z/xarchiver @@ -55,6 +55,7 @@ profile xarchiver @{exec_path} { /home/ r, #owner @{HOME}/ r, #owner @{HOME}/** rw, + owner @{HOME}/@{XDG_DOWNLOAD_DIR}/{,**} rwl, @{MOUNTS}/ r, @{MOUNTS}/** rw, /tmp/ r, From c04ee92d26ff0846da2e6d7332cb0135eb3bb374 Mon Sep 17 00:00:00 2001 From: nobody43 Date: Wed, 22 Jan 2025 23:06:56 +0000 Subject: [PATCH 0539/1455] xfce, new profiles --- .../groups/display-manager/lightdm-session | 23 ++++++++++ .../groups/freedesktop/pkla-admin-identities | 20 +++++++++ .../profiles-g-l/gdk-pixbuf-thumbnailer | 15 +++++++ apparmor.d/profiles-s-z/ucf | 45 +++++++++++++++++++ 4 files changed, 103 insertions(+) create mode 100644 apparmor.d/groups/display-manager/lightdm-session create mode 100644 apparmor.d/groups/freedesktop/pkla-admin-identities create mode 100644 apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer create mode 100644 apparmor.d/profiles-s-z/ucf diff --git a/apparmor.d/groups/display-manager/lightdm-session b/apparmor.d/groups/display-manager/lightdm-session new file mode 100644 index 000000000..fda263a8a --- /dev/null +++ b/apparmor.d/groups/display-manager/lightdm-session @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lightdm-session +profile lightdm-session @{exec_path} { + include + + @{exec_path} mr, + + @{bin}/im-launch rPx, + + @{sh_path} rix, + @{bin}/mktemp rix, + @{bin}/expr rix, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/freedesktop/pkla-admin-identities b/apparmor.d/groups/freedesktop/pkla-admin-identities new file mode 100644 index 000000000..0fa176db5 --- /dev/null +++ b/apparmor.d/groups/freedesktop/pkla-admin-identities @@ -0,0 +1,20 @@ +# apparmor.d - Full set of apparmor profiles +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pkla-admin-identities +profile pkla-admin-identities @{exec_path} { + include + include + + @{exec_path} mr, + + /etc/polkit-1/localauthority.conf.d/{,**} r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer b/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer new file mode 100644 index 000000000..99ffb6dad --- /dev/null +++ b/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer @@ -0,0 +1,15 @@ +# apparmor.d - Full set of apparmor profiles +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/gdk-pixbuf-thumbnailer +profile gdk-pixbuf-thumbnailer @{exec_path} { + include + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf new file mode 100644 index 000000000..52d65e0c5 --- /dev/null +++ b/apparmor.d/profiles-s-z/ucf @@ -0,0 +1,45 @@ +# apparmor.d - Full set of apparmor profiles +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ucf +profile ucf @{bin}/ucf { + include + include + + @{exec_path} mr, + + @{bin}/dpkg-query rPx, + @{bin}/dpkg-divert rPx -> child-dpkg-divert, + /usr/share/debconf/frontend rPx, + + @{sh_path} rix, + @{bin}/perl rix, + @{bin}/basename rix, + @{bin}/dirname rix, + @{bin}/getopt rix, + @{bin}/id rix, + @{bin}/readlink rix, + @{bin}/sed rix, + @{bin}/tr rix, + @{bin}/{,e,f}grep rix, + @{bin}/{,g,m}awk rix, + @{bin}/md5sum rix, + @{bin}/cp rix, + + /etc/ucf.conf r, + /etc/libreoffice/registry/** r, + + /var/lib/ucf/hashfile r, + + /usr/share/debconf/confmodule r, + + owner /tmp/tmp.@{rand10} r, + + include if exists +} + +# vim:syntax=apparmor From bb3bbb492b7fd83af869daa047b1b1a30d9f87c7 Mon Sep 17 00:00:00 2001 From: nobody43 Date: Wed, 22 Jan 2025 23:10:29 +0000 Subject: [PATCH 0540/1455] xfce, proper abi --- apparmor.d/groups/freedesktop/pkla-admin-identities | 2 +- apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer | 2 +- apparmor.d/profiles-s-z/ucf | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/freedesktop/pkla-admin-identities b/apparmor.d/groups/freedesktop/pkla-admin-identities index 0fa176db5..973de2be3 100644 --- a/apparmor.d/groups/freedesktop/pkla-admin-identities +++ b/apparmor.d/groups/freedesktop/pkla-admin-identities @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer b/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer index 99ffb6dad..1fd7d9e12 100644 --- a/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer +++ b/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf index 52d65e0c5..5f810269a 100644 --- a/apparmor.d/profiles-s-z/ucf +++ b/apparmor.d/profiles-s-z/ucf @@ -1,7 +1,7 @@ # apparmor.d - Full set of apparmor profiles # SPDX-License-Identifier: GPL-2.0-only -abi , +abi , include From e749145544a52b99d6dedf34610bfea583749778 Mon Sep 17 00:00:00 2001 From: nobody43 Date: Wed, 22 Jan 2025 23:10:50 +0000 Subject: [PATCH 0541/1455] xfce, flags --- dists/flags/main.flags | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 6a1a1b6a7..27cb94d22 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -113,6 +113,7 @@ flatpak-validate-icon complain fstrim complain fuse-overlayfs complain fusermount complain +gdk-pixbuf-thumbnailer complain gdm-generate-config complain gdm-runtime-config complain gdm-session attach_disconnected,complain @@ -217,6 +218,7 @@ libreoffice complain libvirt-dbus complain libvirtd attach_disconnected,complain lightdm attach_disconnected,complain +lightdm-session complain locale-gen complain localectl complain login attach_disconnected,complain @@ -251,6 +253,7 @@ pam-tmpdir-helper complain passimd attach_disconnected,complain pidof complain pkttyagent complain +pkla-admin-identities complain plank complain plasma_waitforname complain plasma-browser-integration-host complain @@ -348,6 +351,7 @@ systemsettings complain telegram-desktop complain totem attach_disconnected,complain tracker-writeback complain +ucf complain udev-dmi-memory-id complain udisksctl complain udisksd attach_disconnected,complain From 39b38b9ee50c021eadf93dc3162d8d2d05e91752 Mon Sep 17 00:00:00 2001 From: nobody43 Date: Thu, 23 Jan 2025 00:13:29 +0000 Subject: [PATCH 0542/1455] Adapt to RO root --- apparmor.d/groups/network/NetworkManager | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 39c68fda9..cb2e1c9c7 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -105,11 +105,11 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { /etc/ r, /etc/iproute2/* r, /etc/machine-id r, - /etc/netplan/90-NM-@{uuid}.yaml w, /etc/network/interfaces r, /etc/network/interfaces.d/{,*} r, /etc/NetworkManager/{,**} r, /etc/NetworkManager/system-connections/{,**} w, + @{etc_rw}/netplan/90-NM-@{uuid}.yaml w, @{etc_rw}/resolv.conf rw, @{etc_rw}/resolv.conf.[0-9A-Z]* rw, From 8ce3c02000b10e37c64bb17aa99332cfb2486a71 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 24 Jan 2025 21:47:49 +0100 Subject: [PATCH 0543/1455] feat(abs): add modern dbus definition in upstream dbus abs. required for compqtibility with profile using upstream abstaction. --- .../abstractions/dbus-accessibility-strict.d/complete | 7 +++++++ apparmor.d/abstractions/dbus-session-strict.d/complete | 7 +++++++ apparmor.d/abstractions/dbus-strict.d/complete | 7 +++++++ 3 files changed, 21 insertions(+) create mode 100644 apparmor.d/abstractions/dbus-accessibility-strict.d/complete create mode 100644 apparmor.d/abstractions/dbus-session-strict.d/complete create mode 100644 apparmor.d/abstractions/dbus-strict.d/complete diff --git a/apparmor.d/abstractions/dbus-accessibility-strict.d/complete b/apparmor.d/abstractions/dbus-accessibility-strict.d/complete new file mode 100644 index 000000000..f71f7d869 --- /dev/null +++ b/apparmor.d/abstractions/dbus-accessibility-strict.d/complete @@ -0,0 +1,7 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + include + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/dbus-session-strict.d/complete b/apparmor.d/abstractions/dbus-session-strict.d/complete new file mode 100644 index 000000000..8d82bd277 --- /dev/null +++ b/apparmor.d/abstractions/dbus-session-strict.d/complete @@ -0,0 +1,7 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + include + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/dbus-strict.d/complete b/apparmor.d/abstractions/dbus-strict.d/complete new file mode 100644 index 000000000..86936b953 --- /dev/null +++ b/apparmor.d/abstractions/dbus-strict.d/complete @@ -0,0 +1,7 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + include + +# vim:syntax=apparmor From cd8ae6a39128eae759161dd7de45dead9879c2c9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 24 Jan 2025 21:51:44 +0100 Subject: [PATCH 0544/1455] refraator(test): cloud init source out of packer directory. --- tests/{packer/init => cloud-init}/archlinux-cosmic.user-data.yml | 0 tests/{packer/init => cloud-init}/archlinux-gnome.user-data.yml | 0 tests/{packer/init => cloud-init}/archlinux-kde.user-data.yml | 0 tests/{packer/init => cloud-init}/archlinux-server.user-data.yml | 0 tests/{packer/init => cloud-init}/archlinux-xfce.user-data.yml | 0 tests/{packer/init => cloud-init}/debian-gnome.user-data.yml | 0 tests/{packer/init => cloud-init}/debian-kde.user-data.yml | 0 tests/{packer/init => cloud-init}/debian-server.user-data.yml | 0 tests/{packer/init => cloud-init}/opensuse-gnome.user-data.yml | 0 tests/{packer/init => cloud-init}/opensuse-kde.user-data.yml | 0 tests/{packer/init => cloud-init}/ubuntu22-desktop.user-data.yml | 0 tests/{packer/init => cloud-init}/ubuntu24-desktop.user-data.yml | 0 tests/{packer/init => cloud-init}/ubuntu24-server.user-data.yml | 0 tests/packer/{init => }/clean.sh | 0 tests/packer/{init => }/init.sh | 0 15 files changed, 0 insertions(+), 0 deletions(-) rename tests/{packer/init => cloud-init}/archlinux-cosmic.user-data.yml (100%) rename tests/{packer/init => cloud-init}/archlinux-gnome.user-data.yml (100%) rename tests/{packer/init => cloud-init}/archlinux-kde.user-data.yml (100%) rename tests/{packer/init => cloud-init}/archlinux-server.user-data.yml (100%) rename tests/{packer/init => cloud-init}/archlinux-xfce.user-data.yml (100%) rename tests/{packer/init => cloud-init}/debian-gnome.user-data.yml (100%) rename tests/{packer/init => cloud-init}/debian-kde.user-data.yml (100%) rename tests/{packer/init => cloud-init}/debian-server.user-data.yml (100%) rename tests/{packer/init => cloud-init}/opensuse-gnome.user-data.yml (100%) rename tests/{packer/init => cloud-init}/opensuse-kde.user-data.yml (100%) rename tests/{packer/init => cloud-init}/ubuntu22-desktop.user-data.yml (100%) rename tests/{packer/init => cloud-init}/ubuntu24-desktop.user-data.yml (100%) rename tests/{packer/init => cloud-init}/ubuntu24-server.user-data.yml (100%) rename tests/packer/{init => }/clean.sh (100%) rename tests/packer/{init => }/init.sh (100%) diff --git a/tests/packer/init/archlinux-cosmic.user-data.yml b/tests/cloud-init/archlinux-cosmic.user-data.yml similarity index 100% rename from tests/packer/init/archlinux-cosmic.user-data.yml rename to tests/cloud-init/archlinux-cosmic.user-data.yml diff --git a/tests/packer/init/archlinux-gnome.user-data.yml b/tests/cloud-init/archlinux-gnome.user-data.yml similarity index 100% rename from tests/packer/init/archlinux-gnome.user-data.yml rename to tests/cloud-init/archlinux-gnome.user-data.yml diff --git a/tests/packer/init/archlinux-kde.user-data.yml b/tests/cloud-init/archlinux-kde.user-data.yml similarity index 100% rename from tests/packer/init/archlinux-kde.user-data.yml rename to tests/cloud-init/archlinux-kde.user-data.yml diff --git a/tests/packer/init/archlinux-server.user-data.yml b/tests/cloud-init/archlinux-server.user-data.yml similarity index 100% rename from tests/packer/init/archlinux-server.user-data.yml rename to tests/cloud-init/archlinux-server.user-data.yml diff --git a/tests/packer/init/archlinux-xfce.user-data.yml b/tests/cloud-init/archlinux-xfce.user-data.yml similarity index 100% rename from tests/packer/init/archlinux-xfce.user-data.yml rename to tests/cloud-init/archlinux-xfce.user-data.yml diff --git a/tests/packer/init/debian-gnome.user-data.yml b/tests/cloud-init/debian-gnome.user-data.yml similarity index 100% rename from tests/packer/init/debian-gnome.user-data.yml rename to tests/cloud-init/debian-gnome.user-data.yml diff --git a/tests/packer/init/debian-kde.user-data.yml b/tests/cloud-init/debian-kde.user-data.yml similarity index 100% rename from tests/packer/init/debian-kde.user-data.yml rename to tests/cloud-init/debian-kde.user-data.yml diff --git a/tests/packer/init/debian-server.user-data.yml b/tests/cloud-init/debian-server.user-data.yml similarity index 100% rename from tests/packer/init/debian-server.user-data.yml rename to tests/cloud-init/debian-server.user-data.yml diff --git a/tests/packer/init/opensuse-gnome.user-data.yml b/tests/cloud-init/opensuse-gnome.user-data.yml similarity index 100% rename from tests/packer/init/opensuse-gnome.user-data.yml rename to tests/cloud-init/opensuse-gnome.user-data.yml diff --git a/tests/packer/init/opensuse-kde.user-data.yml b/tests/cloud-init/opensuse-kde.user-data.yml similarity index 100% rename from tests/packer/init/opensuse-kde.user-data.yml rename to tests/cloud-init/opensuse-kde.user-data.yml diff --git a/tests/packer/init/ubuntu22-desktop.user-data.yml b/tests/cloud-init/ubuntu22-desktop.user-data.yml similarity index 100% rename from tests/packer/init/ubuntu22-desktop.user-data.yml rename to tests/cloud-init/ubuntu22-desktop.user-data.yml diff --git a/tests/packer/init/ubuntu24-desktop.user-data.yml b/tests/cloud-init/ubuntu24-desktop.user-data.yml similarity index 100% rename from tests/packer/init/ubuntu24-desktop.user-data.yml rename to tests/cloud-init/ubuntu24-desktop.user-data.yml diff --git a/tests/packer/init/ubuntu24-server.user-data.yml b/tests/cloud-init/ubuntu24-server.user-data.yml similarity index 100% rename from tests/packer/init/ubuntu24-server.user-data.yml rename to tests/cloud-init/ubuntu24-server.user-data.yml diff --git a/tests/packer/init/clean.sh b/tests/packer/clean.sh similarity index 100% rename from tests/packer/init/clean.sh rename to tests/packer/clean.sh diff --git a/tests/packer/init/init.sh b/tests/packer/init.sh similarity index 100% rename from tests/packer/init/init.sh rename to tests/packer/init.sh From 5b9c1a8fea2213c83db14ba853775acf10ddadce Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 24 Jan 2025 21:59:02 +0100 Subject: [PATCH 0545/1455] test(packer): remove useless definition in cloud-init. --- tests/cloud-init/archlinux-cosmic.user-data.yml | 3 --- tests/cloud-init/archlinux-gnome.user-data.yml | 3 --- tests/cloud-init/archlinux-kde.user-data.yml | 3 --- tests/cloud-init/archlinux-server.user-data.yml | 3 --- tests/cloud-init/archlinux-xfce.user-data.yml | 3 --- tests/cloud-init/debian-gnome.user-data.yml | 3 --- tests/cloud-init/debian-kde.user-data.yml | 3 --- tests/cloud-init/debian-server.user-data.yml | 3 --- tests/cloud-init/opensuse-gnome.user-data.yml | 3 --- tests/cloud-init/opensuse-kde.user-data.yml | 3 --- tests/cloud-init/ubuntu22-desktop.user-data.yml | 3 --- tests/cloud-init/ubuntu24-desktop.user-data.yml | 3 --- tests/cloud-init/ubuntu24-server.user-data.yml | 3 --- 13 files changed, 39 deletions(-) diff --git a/tests/cloud-init/archlinux-cosmic.user-data.yml b/tests/cloud-init/archlinux-cosmic.user-data.yml index 442c32470..d95381b96 100644 --- a/tests/cloud-init/archlinux-cosmic.user-data.yml +++ b/tests/cloud-init/archlinux-cosmic.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/archlinux-gnome.user-data.yml b/tests/cloud-init/archlinux-gnome.user-data.yml index c65dfc4dd..a2a3d78b8 100644 --- a/tests/cloud-init/archlinux-gnome.user-data.yml +++ b/tests/cloud-init/archlinux-gnome.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/archlinux-kde.user-data.yml b/tests/cloud-init/archlinux-kde.user-data.yml index 97e8ffa7b..eea5df046 100644 --- a/tests/cloud-init/archlinux-kde.user-data.yml +++ b/tests/cloud-init/archlinux-kde.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/archlinux-server.user-data.yml b/tests/cloud-init/archlinux-server.user-data.yml index 93fd254a5..4a7f17374 100644 --- a/tests/cloud-init/archlinux-server.user-data.yml +++ b/tests/cloud-init/archlinux-server.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/archlinux-xfce.user-data.yml b/tests/cloud-init/archlinux-xfce.user-data.yml index 1cc18f556..07d87364b 100644 --- a/tests/cloud-init/archlinux-xfce.user-data.yml +++ b/tests/cloud-init/archlinux-xfce.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/debian-gnome.user-data.yml b/tests/cloud-init/debian-gnome.user-data.yml index 0e2571883..5c95dc231 100644 --- a/tests/cloud-init/debian-gnome.user-data.yml +++ b/tests/cloud-init/debian-gnome.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/debian-kde.user-data.yml b/tests/cloud-init/debian-kde.user-data.yml index a608e9b0b..c81ced653 100644 --- a/tests/cloud-init/debian-kde.user-data.yml +++ b/tests/cloud-init/debian-kde.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/debian-server.user-data.yml b/tests/cloud-init/debian-server.user-data.yml index 5f4fe526e..47e4d832d 100644 --- a/tests/cloud-init/debian-server.user-data.yml +++ b/tests/cloud-init/debian-server.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/opensuse-gnome.user-data.yml b/tests/cloud-init/opensuse-gnome.user-data.yml index b54bb458e..66966bd6d 100644 --- a/tests/cloud-init/opensuse-gnome.user-data.yml +++ b/tests/cloud-init/opensuse-gnome.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/opensuse-kde.user-data.yml b/tests/cloud-init/opensuse-kde.user-data.yml index b54bb458e..66966bd6d 100644 --- a/tests/cloud-init/opensuse-kde.user-data.yml +++ b/tests/cloud-init/opensuse-kde.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/ubuntu22-desktop.user-data.yml b/tests/cloud-init/ubuntu22-desktop.user-data.yml index 30a82279a..4c6450a6a 100644 --- a/tests/cloud-init/ubuntu22-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu22-desktop.user-data.yml @@ -3,9 +3,6 @@ # Based on https://github.com/canonical/autoinstall-desktop hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/ubuntu24-desktop.user-data.yml b/tests/cloud-init/ubuntu24-desktop.user-data.yml index 3c3807e29..4fa229416 100644 --- a/tests/cloud-init/ubuntu24-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu24-desktop.user-data.yml @@ -5,9 +5,6 @@ # https://github.com/canonical/ubuntu-desktop-provision/blob/main/README.md hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: diff --git a/tests/cloud-init/ubuntu24-server.user-data.yml b/tests/cloud-init/ubuntu24-server.user-data.yml index 5e6d853ba..96318214c 100644 --- a/tests/cloud-init/ubuntu24-server.user-data.yml +++ b/tests/cloud-init/ubuntu24-server.user-data.yml @@ -1,9 +1,6 @@ #cloud-config hostname: ${hostname} -locale: en_IE -keyboard: - layout: ie ssh_pwauth: true users: From 45f5689d6aa62d1fc3a12f3e49587023c6709b06 Mon Sep 17 00:00:00 2001 From: nobody43 Date: Fri, 24 Jan 2025 21:48:31 +0000 Subject: [PATCH 0546/1455] xfce, fixes --- apparmor.d/groups/display-manager/lightdm | 4 ++-- apparmor.d/groups/gvfs/gvfsd-computer | 2 +- apparmor.d/groups/gvfs/gvfsd-wsdd | 2 +- apparmor.d/groups/xfce/thunar | 6 +++--- apparmor.d/groups/xfce/tumblerd | 9 +++------ apparmor.d/groups/xfce/xfce-clipman-settings | 2 +- apparmor.d/groups/xfce/xfce-notifyd | 4 ++-- apparmor.d/groups/xfce/xfce-panel | 4 ++-- apparmor.d/groups/xfce/xfce-power-manager | 4 ++-- apparmor.d/groups/xfce/xfce-screensaver | 2 +- apparmor.d/groups/xfce/xfce-session | 2 +- apparmor.d/groups/xfce/xfce-terminal | 4 ++-- apparmor.d/groups/xfce/xfconfd | 2 +- apparmor.d/groups/xfce/xfdesktop | 3 +-- apparmor.d/groups/xfce/xfsettingsd | 2 +- apparmor.d/profiles-a-f/blueman | 1 - apparmor.d/profiles-s-z/system-config-printer-applet | 2 -- apparmor.d/profiles-s-z/xarchiver | 1 - 18 files changed, 24 insertions(+), 32 deletions(-) diff --git a/apparmor.d/groups/display-manager/lightdm b/apparmor.d/groups/display-manager/lightdm index a70779fc4..67b789906 100644 --- a/apparmor.d/groups/display-manager/lightdm +++ b/apparmor.d/groups/display-manager/lightdm @@ -37,9 +37,9 @@ profile lightdm @{exec_path} flags=(attach_disconnected) { signal (send) set=(term) peer=xfce-session, signal (send) set=(term) peer=xorg, - unix (bind) type=stream addr="@@{hex}/bus/lightdm/system", + unix (bind) type=stream addr="@@{udbus}/bus/lightdm/system", - dbus (bind) bus=system name=org.freedesktop.DisplayManager, + #aa:dbus own bus=system name=org.freedesktop.DisplayManager @{exec_path} mrix, diff --git a/apparmor.d/groups/gvfs/gvfsd-computer b/apparmor.d/groups/gvfs/gvfsd-computer index f72fc17c7..0a520d138 100644 --- a/apparmor.d/groups/gvfs/gvfsd-computer +++ b/apparmor.d/groups/gvfs/gvfsd-computer @@ -12,7 +12,7 @@ profile gvfsd-computer @{exec_path} { include include - dbus (bind) bus=session name=org.gtk.vfs.mountpoint_@{int}, + #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-wsdd b/apparmor.d/groups/gvfs/gvfsd-wsdd index 1b0dc2cc2..b88d36b18 100644 --- a/apparmor.d/groups/gvfs/gvfsd-wsdd +++ b/apparmor.d/groups/gvfs/gvfsd-wsdd @@ -13,7 +13,7 @@ profile gvfsd-wsdd @{exec_path} { network netlink raw, - dbus (bind) bus=session name=org.gtk.vfs.mountpoint_wsdd, + #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/thunar b/apparmor.d/groups/xfce/thunar index 629fc2b4b..77379c54f 100644 --- a/apparmor.d/groups/xfce/thunar +++ b/apparmor.d/groups/xfce/thunar @@ -19,9 +19,9 @@ profile thunar @{exec_path} { network netlink raw, - dbus (bind) bus=session name=org.xfce.Thunar, - dbus (bind) bus=session name=org.xfce.FileManager, - dbus (bind) bus=session name=org.freedesktop.FileManager1, + #aa:dbus own bus=session name=org.xfce.Thunar + #aa:dbus own bus=session name=org.xfce.FileManager + #aa:dbus own bus=session name=org.freedesktop.FileManager1 @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/tumblerd b/apparmor.d/groups/xfce/tumblerd index db90af4c5..d47be7e98 100644 --- a/apparmor.d/groups/xfce/tumblerd +++ b/apparmor.d/groups/xfce/tumblerd @@ -12,16 +12,13 @@ profile tumblerd @{exec_path} { include include include - include - include - include include include include - dbus (bind) bus=session name=org.freedesktop.thumbnails.Cache1, - dbus (bind) bus=session name=org.freedesktop.thumbnails.Manager1, - dbus (bind) bus=session name=org.freedesktop.thumbnails.Thumbnailer1, + #aa:dbus own bus=session name=org.freedesktop.thumbnails.Cache1 + #aa:dbus own bus=session name=org.freedesktop.thumbnails.Manager1 + #aa:dbus own bus=session name=org.freedesktop.thumbnails.Thumbnailer1 @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfce-clipman-settings b/apparmor.d/groups/xfce/xfce-clipman-settings index 2c777a0a1..9e74d8046 100644 --- a/apparmor.d/groups/xfce/xfce-clipman-settings +++ b/apparmor.d/groups/xfce/xfce-clipman-settings @@ -13,7 +13,7 @@ profile xfce-clipman-settings @{exec_path} { include include - dbus (bind) bus=session name=org.xfce.clipman.settings, + #aa:dbus own bus=session name=org.xfce.clipman.settings @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfce-notifyd b/apparmor.d/groups/xfce/xfce-notifyd index d8ef2a9e0..c594b8ed3 100644 --- a/apparmor.d/groups/xfce/xfce-notifyd +++ b/apparmor.d/groups/xfce/xfce-notifyd @@ -24,8 +24,8 @@ profile xfce-notifyd @{exec_path} { network inet6 stream, network netlink raw, - dbus (bind) bus=session name=org.xfce.Notifyd, - dbus (bind) bus=session name=org.freedesktop.Notifications, + #aa:dbus own bus=session name=org.xfce.Notifyd + #aa:dbus own bus=session name=org.freedesktop.Notifications @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfce-panel b/apparmor.d/groups/xfce/xfce-panel index d2a9cdbf6..b04ed2eb9 100644 --- a/apparmor.d/groups/xfce/xfce-panel +++ b/apparmor.d/groups/xfce/xfce-panel @@ -22,8 +22,8 @@ profile xfce-panel @{exec_path} { ptrace (read) peer=xfce-terminal, - dbus (bind) bus=session name=org.xfce.Panel, - dbus (bind) bus=session name=org.kde.StatusNotifierWatcher, + #aa:dbus own bus=session name=org.xfce.Panel + #aa:dbus own bus=session name=org.kde.StatusNotifierWatcher @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfce-power-manager b/apparmor.d/groups/xfce/xfce-power-manager index 4f3199a9e..91be9eede 100644 --- a/apparmor.d/groups/xfce/xfce-power-manager +++ b/apparmor.d/groups/xfce/xfce-power-manager @@ -16,8 +16,8 @@ profile xfce-power-manager @{exec_path} flags=(attach_disconnected) { include include - dbus (bind) bus=session name=org.xfce.PowerManager, - dbus (bind) bus=session name=org.freedesktop.PowerManagement, + #aa:dbus own bus=session name=org.xfce.PowerManager + #aa:dbus own bus=session name=org.freedesktop.PowerManagement @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfce-screensaver b/apparmor.d/groups/xfce/xfce-screensaver index 911cc1b9f..2c0f13bc1 100644 --- a/apparmor.d/groups/xfce/xfce-screensaver +++ b/apparmor.d/groups/xfce/xfce-screensaver @@ -16,7 +16,7 @@ profile xfce-screensaver @{exec_path} flags=(attach_disconnected) { include include - dbus (bind) bus=session name=org.xfce.ScreenSaver, + #aa:dbus own bus=session name=org.xfce.ScreenSaver @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfce-session b/apparmor.d/groups/xfce/xfce-session index 6db8277d7..beddcce1f 100644 --- a/apparmor.d/groups/xfce/xfce-session +++ b/apparmor.d/groups/xfce/xfce-session @@ -20,7 +20,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term) peer=lightdm, - dbus (bind) bus=session name=org.xfce.SessionManager, + #aa:dbus own bus=session name=org.xfce.SessionManager @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfce-terminal b/apparmor.d/groups/xfce/xfce-terminal index 46a17ca7f..5250814de 100644 --- a/apparmor.d/groups/xfce/xfce-terminal +++ b/apparmor.d/groups/xfce/xfce-terminal @@ -21,7 +21,7 @@ profile xfce-terminal @{exec_path} { signal (send), - dbus (bind) bus=session name=org.xfce.Terminal5, + #aa:dbus own bus=session name=org.xfce.Terminal5 @{exec_path} mr, @@ -35,7 +35,7 @@ profile xfce-terminal @{exec_path} { @{bin}/micro rPUx, @{bin}/nvtop rPx, - @{bin}/vim{,.basic} rPUx, + @{editor_path} rPUx, /usr/share/ r, /usr/share/desktop-base/profiles/xdg-config/ r, diff --git a/apparmor.d/groups/xfce/xfconfd b/apparmor.d/groups/xfce/xfconfd index de82191a7..9cd273544 100644 --- a/apparmor.d/groups/xfce/xfconfd +++ b/apparmor.d/groups/xfce/xfconfd @@ -13,7 +13,7 @@ profile xfconfd @{exec_path} { include include - dbus (bind) bus=session name=org.xfce.Xfconf, + #aa:dbus own bus=session name=org.xfce.Xfconf @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfdesktop b/apparmor.d/groups/xfce/xfdesktop index ed7d18ddc..05705332d 100644 --- a/apparmor.d/groups/xfce/xfdesktop +++ b/apparmor.d/groups/xfce/xfdesktop @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/xfdesktop profile xfdesktop @{exec_path} { include - include include include include @@ -18,7 +17,7 @@ profile xfdesktop @{exec_path} { include include - dbus (bind) bus=session name=org.xfce.xfdesktop, + #aa:dbus own bus=session name=org.xfce.xfdesktop @{exec_path} mr, diff --git a/apparmor.d/groups/xfce/xfsettingsd b/apparmor.d/groups/xfce/xfsettingsd index b2f783390..22db3f80d 100644 --- a/apparmor.d/groups/xfce/xfsettingsd +++ b/apparmor.d/groups/xfce/xfsettingsd @@ -16,7 +16,7 @@ profile xfsettingsd @{exec_path} { include include - dbus (bind) bus=session name=org.xfce.SettingsDaemon, + #aa:dbus own bus=session name=org.xfce.SettingsDaemon @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/blueman b/apparmor.d/profiles-a-f/blueman index 7a2b4530f..469fb24a0 100644 --- a/apparmor.d/profiles-a-f/blueman +++ b/apparmor.d/profiles-a-f/blueman @@ -62,7 +62,6 @@ profile blueman @{exec_path} flags=(attach_disconnected) { /dev/shm/ r, /dev/tty rw, - deny @{lib}/python3/dist-packages/blueman/__pycache__/** w, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, include if exists diff --git a/apparmor.d/profiles-s-z/system-config-printer-applet b/apparmor.d/profiles-s-z/system-config-printer-applet index 99cdbc996..6424ebcc4 100644 --- a/apparmor.d/profiles-s-z/system-config-printer-applet +++ b/apparmor.d/profiles-s-z/system-config-printer-applet @@ -30,8 +30,6 @@ profile system-config-printer-applet @{exec_path} { /dev/tty rw, - deny @{lib}/python3/dist-packages/cupshelpers/__pycache__/** w, - include if exists } diff --git a/apparmor.d/profiles-s-z/xarchiver b/apparmor.d/profiles-s-z/xarchiver index 1e0d75fd0..003770008 100644 --- a/apparmor.d/profiles-s-z/xarchiver +++ b/apparmor.d/profiles-s-z/xarchiver @@ -55,7 +55,6 @@ profile xarchiver @{exec_path} { /home/ r, #owner @{HOME}/ r, #owner @{HOME}/** rw, - owner @{HOME}/@{XDG_DOWNLOAD_DIR}/{,**} rwl, @{MOUNTS}/ r, @{MOUNTS}/** rw, /tmp/ r, From aae36aa4e02700e5108b1fbddfc9f9327d03dc7b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 24 Jan 2025 23:32:24 +0100 Subject: [PATCH 0547/1455] test(packer): make image builder simplier. --- tests/Makefile | 5 +- tests/cloud-init/debian-gnome.user-data.yml | 4 +- tests/cloud-init/debian-kde.user-data.yml | 2 +- tests/cloud-init/opensuse-gnome.user-data.yml | 8 +-- tests/cloud-init/opensuse-kde.user-data.yml | 8 +-- .../cloud-init/ubuntu22-desktop.user-data.yml | 11 ++-- .../cloud-init/ubuntu24-desktop.user-data.yml | 11 ++-- tests/packer/archlinux.pkr.hcl | 2 +- tests/packer/builds.pkr.hcl | 55 +++++++------------ tests/packer/clean.sh | 31 ++++------- tests/packer/debian.pkr.hcl | 4 +- tests/packer/init.sh | 11 ++-- tests/packer/opensuse.pkr.hcl | 2 +- tests/packer/ubuntu.pkr.hcl | 8 +-- tests/packer/variables.pkr.hcl | 6 -- 15 files changed, 65 insertions(+), 103 deletions(-) diff --git a/tests/Makefile b/tests/Makefile index 8bf5f6182..3453ecee8 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -12,14 +12,13 @@ flavor ?= disk ?= 10G -VERSION := 0.$(shell git rev-list --count HEAD) -BASE = archlinux debian ubuntu opensuse fedora +BASE = archlinux debian ubuntu22 ubuntu24 opensuse fedora .PHONY: ${BASE} lint $(BASE): @make --directory=../ package dist=${@} - @packer build -force -var version=${VERSION} \ + @packer build -force \ -var disk_size=${disk} -var flavor="${flavor}" \ -only=qemu.${@} packer/ diff --git a/tests/cloud-init/debian-gnome.user-data.yml b/tests/cloud-init/debian-gnome.user-data.yml index 5c95dc231..1c48eb2e9 100644 --- a/tests/cloud-init/debian-gnome.user-data.yml +++ b/tests/cloud-init/debian-gnome.user-data.yml @@ -24,10 +24,10 @@ packages: - devscripts - htop - qemu-guest-agent - - spice-vdagent - rsync - - vim + - spice-vdagent - task-gnome-desktop + - vim runcmd: - apt-get update -y diff --git a/tests/cloud-init/debian-kde.user-data.yml b/tests/cloud-init/debian-kde.user-data.yml index c81ced653..e644414fa 100644 --- a/tests/cloud-init/debian-kde.user-data.yml +++ b/tests/cloud-init/debian-kde.user-data.yml @@ -24,8 +24,8 @@ packages: - devscripts - htop - qemu-guest-agent - - spice-vdagent - rsync + - spice-vdagent - vim - task-kde-desktop diff --git a/tests/cloud-init/opensuse-gnome.user-data.yml b/tests/cloud-init/opensuse-gnome.user-data.yml index 66966bd6d..5e5b197bc 100644 --- a/tests/cloud-init/opensuse-gnome.user-data.yml +++ b/tests/cloud-init/opensuse-gnome.user-data.yml @@ -20,19 +20,15 @@ packages: - bash-completion - distribution-release - git + - go - golang-packaging - htop - make - rpmbuild + - rsync - vim write_files: - # Set some bash aliases - - path: /home/${username}/.bashrc - append: true - content: | - [[ -f ~/.bash_aliases ]] && source ~/.bash_aliases - # Setup shared directory - path: /etc/fstab append: true diff --git a/tests/cloud-init/opensuse-kde.user-data.yml b/tests/cloud-init/opensuse-kde.user-data.yml index 66966bd6d..5e5b197bc 100644 --- a/tests/cloud-init/opensuse-kde.user-data.yml +++ b/tests/cloud-init/opensuse-kde.user-data.yml @@ -20,19 +20,15 @@ packages: - bash-completion - distribution-release - git + - go - golang-packaging - htop - make - rpmbuild + - rsync - vim write_files: - # Set some bash aliases - - path: /home/${username}/.bashrc - append: true - content: | - [[ -f ~/.bash_aliases ]] && source ~/.bash_aliases - # Setup shared directory - path: /etc/fstab append: true diff --git a/tests/cloud-init/ubuntu22-desktop.user-data.yml b/tests/cloud-init/ubuntu22-desktop.user-data.yml index 4c6450a6a..75dc6349d 100644 --- a/tests/cloud-init/ubuntu22-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu22-desktop.user-data.yml @@ -18,18 +18,19 @@ package_update: true package_upgrade: true package_reboot_if_required: false packages: - - ubuntu-desktop - - linux-generic-hwe-22.04 - - qemu-guest-agent - - spice-vdagent - - terminator - apparmor-profiles - build-essential - config-package-dev - debhelper - devscripts - golang-go + - linux-generic-hwe-22.04 + - qemu-guest-agent - rsync + - spice-vdagent + - terminator + - ubuntu-desktop + - vim snap: commands: diff --git a/tests/cloud-init/ubuntu24-desktop.user-data.yml b/tests/cloud-init/ubuntu24-desktop.user-data.yml index 4fa229416..9f7225367 100644 --- a/tests/cloud-init/ubuntu24-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu24-desktop.user-data.yml @@ -20,18 +20,19 @@ package_update: true package_upgrade: true package_reboot_if_required: false packages: - - ubuntu-desktop - - linux-generic-hwe-24.04 - - qemu-guest-agent - - spice-vdagent - - terminator - apparmor-profiles - build-essential - config-package-dev - debhelper - devscripts - golang-go + - linux-generic-hwe-24.04 + - qemu-guest-agent - rsync + - spice-vdagent + - terminator + - ubuntu-desktop + - vim snap: commands: diff --git a/tests/packer/archlinux.pkr.hcl b/tests/packer/archlinux.pkr.hcl index 41a2627d5..88a5a1cba 100644 --- a/tests/packer/archlinux.pkr.hcl +++ b/tests/packer/archlinux.pkr.hcl @@ -27,7 +27,7 @@ source "qemu" "archlinux" { cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", + "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" diff --git a/tests/packer/builds.pkr.hcl b/tests/packer/builds.pkr.hcl index 1c16a6b84..7071c3983 100644 --- a/tests/packer/builds.pkr.hcl +++ b/tests/packer/builds.pkr.hcl @@ -12,53 +12,38 @@ build { "source.qemu.ubuntu24", ] - # Upload local files + # Upload artifacts provisioner "file" { - destination = "/tmp" - sources = ["${path.cwd}/packer/src"] - } - - provisioner "file" { - only = ["qemu.archlinux"] - destination = "/tmp/src/" + destination = "/tmp/" sources = [ - "${path.cwd}/../.pkg/apparmor.d-${var.version}-1-x86_64.pkg.tar.zst", + "${path.cwd}/packer/src/", + "${path.cwd}/packer/init.sh", + "${path.cwd}/packer/clean.sh", + "${path.cwd}/../.pkg/", ] } - provisioner "file" { - only = ["qemu.opensuse"] - destination = "/tmp/src/" - sources = ["${path.cwd}/../.pkg/apparmor.d-${var.version}-1.x86_64.rpm"] - } - - provisioner "file" { - only = ["qemu.debian", "qemu.ubuntu22", "qemu.ubuntu24"] - destination = "/tmp/src/" - sources = ["${path.cwd}/../.pkg/apparmor.d_${var.version}-1_amd64.deb"] - } - - # Wait for cloud-init to finish + # Full system provisioning provisioner "shell" { execute_command = "echo '${var.password}' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'" inline = [ + # Wait for cloud-init to finish "while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for Cloud-Init...'; sleep 20; done", - "cloud-init clean", # Remove logs and artifacts so cloud-init can re-run + + # Ensure cloud-init is successful + "cloud-init status", + + # Remove logs and artifacts so cloud-init can re-run + "cloud-init clean", + + # Install local files and config + "bash /tmp/init.sh", + + # Minimize the image + "bash /tmp/clean.sh", ] } - # Install local files and config - provisioner "shell" { - script = "${path.cwd}/packer/init/init.sh" - execute_command = "echo '${var.password}' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'" - } - - # Minimize the image - provisioner "shell" { - script = "${path.cwd}/packer/init/clean.sh" - execute_command = "echo '${var.password}' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'" - } - post-processor "vagrant" { output = "${var.base_dir}/packer_${var.prefix}${source.name}-${var.flavor}.box" } diff --git a/tests/packer/clean.sh b/tests/packer/clean.sh index 2e1e7b551..8459421a1 100644 --- a/tests/packer/clean.sh +++ b/tests/packer/clean.sh @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -set -u +set -eu -o pipefail # shellcheck source=/dev/null _lsb_release() { @@ -46,23 +46,15 @@ _sshdgenkeys() { _EOF } -clean_debian() { - _msg "Apt clean configuration" - - _msg "Full system upgrade" - apt-get update -y - apt-get -qq -y --no-install-recommends upgrade - apt-get -qq -y --no-install-recommends dist-upgrade - - _msg "Clean the apt cache" +clean_apt() { + _msg "Cleaning the apt cache" apt-get -y autoremove --purge apt-get -y autoclean apt-get -y clean } -clean_arch() { - _msg "Pacman clean configuration" - +clean_pacman() { + _msg "Cleaning pacman cache" pacman -Syu --noconfirm pacman -Qdtq | while IFS='' read -r pkg; do pacman -Rsccn --noconfirm "$pkg" @@ -70,16 +62,15 @@ clean_arch() { pacman -Scc --noconfirm } -clean_opensuse() { - _msg "zypper clean configuration" - +clean_zypper() { + _msg "Cleaning zypper cache" zypper update -y zypper clean -y } # Make the image as impersonal as possible. impersonalize() { - _msg "Make the image as impersonal as possible." + _msg "Making the image as impersonal as possible." # Remove remaining pkg file, docs and caches dirs=( @@ -159,16 +150,16 @@ main() { begin=$(_diskused) case "$DISTRIBUTION" in debian | ubuntu) - clean_debian + clean_apt _sshdgenkeys ;; opensuse*) - clean_opensuse + clean_zypper ;; arch) - clean_arch + clean_pacman ;; esac impersonalize diff --git a/tests/packer/debian.pkr.hcl b/tests/packer/debian.pkr.hcl index 7fd176b6e..d45ed3d37 100644 --- a/tests/packer/debian.pkr.hcl +++ b/tests/packer/debian.pkr.hcl @@ -6,7 +6,7 @@ source "qemu" "debian" { disk_image = true iso_url = "https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/debian-${var.release.debian.version}-genericcloud-amd64.qcow2" iso_checksum = "file:https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/SHA512SUMS" - iso_target_path = "${var.iso_dir}/debian-cloudimg-amd64.img" + iso_target_path = "${var.iso_dir}/debian-${var.release.debian.codename}-cloudimg-amd64.img" cpu_model = "host" cpus = 6 memory = 4096 @@ -28,7 +28,7 @@ source "qemu" "debian" { cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", + "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" diff --git a/tests/packer/init.sh b/tests/packer/init.sh index df300c0c4..be9529666 100644 --- a/tests/packer/init.sh +++ b/tests/packer/init.sh @@ -11,7 +11,7 @@ _lsb_release() { echo "$ID" } DISTRIBUTION="$(_lsb_release)" -readonly SRC=/tmp/src +readonly SRC=/tmp/ readonly DISTRIBUTION main() { @@ -28,23 +28,22 @@ main() { case "$DISTRIBUTION" in arch) pacman --noconfirm -U $SRC/*.pkg.tar.zst - systemctl start apparmor.service ;; debian | ubuntu) - apt-get update -y - apt-get install -y apparmor-profiles build-essential config-package-dev \ - debhelper devscripts htop rsync vim dpkg -i $SRC/*.deb ;; opensuse*) mv "/home/$SUDO_USER/.bash_aliases" "/home/$SUDO_USER/.alias" - zypper install -y bash-completion git go htop make rsync vim rpm -i $SRC/*.rpm ;; esac + + rm -rf /var/cache/apparmor/* + rm -rf /etc/apparmor/earlypolicy/ + systemctl reload apparmor.service } main "$@" diff --git a/tests/packer/opensuse.pkr.hcl b/tests/packer/opensuse.pkr.hcl index 49ba09f70..29649d4bc 100644 --- a/tests/packer/opensuse.pkr.hcl +++ b/tests/packer/opensuse.pkr.hcl @@ -30,7 +30,7 @@ source "qemu" "opensuse" { cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", + "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" diff --git a/tests/packer/ubuntu.pkr.hcl b/tests/packer/ubuntu.pkr.hcl index 052b460da..f69818060 100644 --- a/tests/packer/ubuntu.pkr.hcl +++ b/tests/packer/ubuntu.pkr.hcl @@ -6,7 +6,7 @@ source "qemu" "ubuntu22" { disk_image = true iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu22.codename}/current/${var.release.ubuntu22.codename}-server-cloudimg-amd64.img" iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu22.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu22-cloudimg-amd64.img" + iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu22.codename}-cloudimg-amd64.img" cpu_model = "host" cpus = 6 memory = 4096 @@ -28,7 +28,7 @@ source "qemu" "ubuntu22" { cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", + "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" @@ -43,7 +43,7 @@ source "qemu" "ubuntu24" { disk_image = true iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/${var.release.ubuntu24.codename}-server-cloudimg-amd64.img" iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu24-cloudimg-amd64.img" + iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu24.codename}-cloudimg-amd64.img" cpu_model = "host" cpus = 6 memory = 4096 @@ -65,7 +65,7 @@ source "qemu" "ubuntu24" { cd_label = "cidata" cd_content = { "meta-data" = "" - "user-data" = templatefile("${path.cwd}/packer/init/${source.name}-${var.flavor}.user-data.yml", + "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", { username = "${var.username}" password = "${var.password}" diff --git a/tests/packer/variables.pkr.hcl b/tests/packer/variables.pkr.hcl index a37c89bf0..82251f25a 100644 --- a/tests/packer/variables.pkr.hcl +++ b/tests/packer/variables.pkr.hcl @@ -58,12 +58,6 @@ variable "prefix" { default = "aa-" } -variable "version" { - description = "apparmor.d version" - type = string - default = "0.001" -} - variable "flavor" { description = "Distribution flavor to use (server, desktop, gnome, kde...)" type = string From 4e73f7209fcdec7f7a87e8bb0fd6150a5a5dd470 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 24 Jan 2025 23:44:11 +0100 Subject: [PATCH 0548/1455] test(packer): add cpu & ram internal variable. --- tests/packer/archlinux.pkr.hcl | 4 ++-- tests/packer/debian.pkr.hcl | 4 ++-- tests/packer/opensuse.pkr.hcl | 4 ++-- tests/packer/ubuntu.pkr.hcl | 8 ++++---- tests/packer/variables.pkr.hcl | 12 ++++++++++++ 5 files changed, 22 insertions(+), 10 deletions(-) diff --git a/tests/packer/archlinux.pkr.hcl b/tests/packer/archlinux.pkr.hcl index 88a5a1cba..06f2ad3a7 100644 --- a/tests/packer/archlinux.pkr.hcl +++ b/tests/packer/archlinux.pkr.hcl @@ -8,8 +8,8 @@ source "qemu" "archlinux" { iso_checksum = "file:https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256" iso_target_path = "${var.iso_dir}/archlinux-cloudimg-amd64.img" cpu_model = "host" - cpus = 6 - memory = 4096 + cpus = var.cpus + memory = var.ram disk_size = var.disk_size accelerator = "kvm" headless = true diff --git a/tests/packer/debian.pkr.hcl b/tests/packer/debian.pkr.hcl index d45ed3d37..12d4a513c 100644 --- a/tests/packer/debian.pkr.hcl +++ b/tests/packer/debian.pkr.hcl @@ -8,8 +8,8 @@ source "qemu" "debian" { iso_checksum = "file:https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/SHA512SUMS" iso_target_path = "${var.iso_dir}/debian-${var.release.debian.codename}-cloudimg-amd64.img" cpu_model = "host" - cpus = 6 - memory = 4096 + cpus = var.cpus + memory = var.ram disk_size = var.disk_size accelerator = "kvm" headless = true diff --git a/tests/packer/opensuse.pkr.hcl b/tests/packer/opensuse.pkr.hcl index 29649d4bc..46cf4af29 100644 --- a/tests/packer/opensuse.pkr.hcl +++ b/tests/packer/opensuse.pkr.hcl @@ -10,8 +10,8 @@ source "qemu" "opensuse" { iso_checksum = "sha256:223ed62160ef4f1a4f21b69c574f552a07eee6ef66cf66eef2b49c5a7c4864f4" iso_target_path = "${var.base_dir}/base-tumbleweed-gnome.qcow2" cpu_model = "host" - cpus = 6 - memory = 4096 + cpus = var.cpus + memory = var.ram disk_size = var.disk_size accelerator = "kvm" headless = false diff --git a/tests/packer/ubuntu.pkr.hcl b/tests/packer/ubuntu.pkr.hcl index f69818060..3689882ad 100644 --- a/tests/packer/ubuntu.pkr.hcl +++ b/tests/packer/ubuntu.pkr.hcl @@ -8,8 +8,8 @@ source "qemu" "ubuntu22" { iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu22.codename}/current/SHA256SUMS" iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu22.codename}-cloudimg-amd64.img" cpu_model = "host" - cpus = 6 - memory = 4096 + cpus = var.cpus + memory = var.ram disk_size = var.disk_size accelerator = "kvm" headless = true @@ -45,8 +45,8 @@ source "qemu" "ubuntu24" { iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/SHA256SUMS" iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu24.codename}-cloudimg-amd64.img" cpu_model = "host" - cpus = 6 - memory = 4096 + cpus = var.cpus + memory = var.ram disk_size = var.disk_size accelerator = "kvm" headless = true diff --git a/tests/packer/variables.pkr.hcl b/tests/packer/variables.pkr.hcl index 82251f25a..0361698d6 100644 --- a/tests/packer/variables.pkr.hcl +++ b/tests/packer/variables.pkr.hcl @@ -22,6 +22,18 @@ variable "ssh_publickey" { default = "~/.ssh/id_ed25519.pub" } +variable "cpus" { + description = "Default CPU of the VM" + type = string + default = "6" +} + +variable "ram" { + description = "Default RAM of the VM" + type = string + default = "4096" +} + variable "disk_size" { description = "Disk size of the VM to build" type = string From 8806030a0a41835c2bf75437c1a7c519f19dc7fc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 25 Jan 2025 22:31:29 +0100 Subject: [PATCH 0549/1455] feat(profile): more use @{etc_ro} when we know it is needed. --- apparmor.d/groups/_full/systemd | 4 ++-- apparmor.d/groups/apt/unattended-upgrade | 2 +- apparmor.d/groups/cron/crontab | 4 ++-- apparmor.d/groups/display-manager/lightdm | 4 ++-- apparmor.d/groups/gnome/gnome-initial-setup | 4 ++-- apparmor.d/groups/hyprland/hyprlock | 2 +- apparmor.d/groups/kde/kscreenlocker_greet | 9 +++++---- apparmor.d/groups/kde/sddm | 6 +++--- apparmor.d/groups/ubuntu/apport | 2 +- apparmor.d/groups/ubuntu/apport-checkreports | 2 +- apparmor.d/groups/virt/cockpit-bridge | 2 +- apparmor.d/profiles-a-f/agetty | 5 ++--- apparmor.d/profiles-a-f/chage | 2 +- apparmor.d/profiles-a-f/chpasswd | 3 ++- apparmor.d/profiles-a-f/firecfg | 3 ++- apparmor.d/profiles-g-l/gamemoded | 4 ++-- apparmor.d/profiles-g-l/gpasswd | 2 +- apparmor.d/profiles-g-l/groupadd | 2 +- apparmor.d/profiles-g-l/groupdel | 2 +- apparmor.d/profiles-g-l/groupmod | 2 +- apparmor.d/profiles-g-l/grpck | 2 +- apparmor.d/profiles-g-l/lastlog | 3 ++- apparmor.d/profiles-g-l/login | 6 +++--- apparmor.d/profiles-m-r/newgrp | 4 ++-- apparmor.d/profiles-m-r/pwck | 3 ++- apparmor.d/profiles-s-z/snapd | 2 +- apparmor.d/profiles-s-z/useradd | 2 +- apparmor.d/profiles-s-z/userdel | 2 +- apparmor.d/profiles-s-z/usermod | 2 +- apparmor.d/profiles-s-z/vipw-vigr | 2 +- 30 files changed, 49 insertions(+), 45 deletions(-) diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index 9f611cf3d..d71647705 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -181,12 +181,12 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { /var/lib/*/ r, /var/tmp/ r, + @{etc_ro}/environment r, + @{etc_ro}/environment.d/{,**} r, /etc/binfmt.d/{,**} r, /etc/conf.d/{,**} r, /etc/credstore.encrypted/{,**} r, /etc/credstore/{,**} r, - /etc/environment r, - /etc/environment.d/{,**} r, /etc/machine-id r, /etc/modules-load.d/{,**} r, /etc/systemd/{,**} r, diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index d0fdad4b7..ead68957a 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -62,6 +62,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /usr/share/distro-info/* r, + @{etc_ro}/security/capability.conf r, /etc/apt/*.list r, /etc/apt/apt.conf.d/{,**} r, /etc/debian_version r, @@ -79,7 +80,6 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /etc/pki/fwupd-metadata/{,**} r, /etc/pki/fwupd/{,**} r, /etc/profile.d/* r, - /etc/security/capability.conf r, /etc/update-manager/{,**} r, /etc/update-motd.d/* r, /etc/vmware-tools/* r, diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index ccc948b01..d240454f5 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -28,10 +28,10 @@ profile crontab @{exec_path} { @{sh_path} rix, @{editor_path} rCx -> editor, + @{etc_ro}/environment r, + @{etc_ro}/security/*.conf r, /etc/cron.{allow,deny} r, - /etc/environment r, /etc/pam.d/* r, - /etc/security/*.conf r, /var/spool/cron/ r, /var/spool/cron/** rw, diff --git a/apparmor.d/groups/display-manager/lightdm b/apparmor.d/groups/display-manager/lightdm index 04accbbf0..112daf091 100644 --- a/apparmor.d/groups/display-manager/lightdm +++ b/apparmor.d/groups/display-manager/lightdm @@ -56,11 +56,11 @@ profile lightdm @{exec_path} flags=(attach_disconnected) { /usr/share/wayland-sessions/{,*.desktop} r, /usr/share/xgreeters/{,**} r, + @{etc_ro}/environment r, + @{etc_ro}/security/limits.d/{,*} r, /etc/default/locale r, - /etc/environment r, /etc/lightdm/{,**} r, /etc/machine-id r, - /etc/security/limits.d/{,*} r, /etc/shells r, /var/cache/lightdm/dmrc/*.dmrc* rw, diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index d27ccb8bb..84f6b15c8 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -46,8 +46,8 @@ profile gnome-initial-setup @{exec_path} { /usr/share/gnome-initial-setup/{,**} r, /usr/share/xml/iso-codes/{,**} r, - /etc/security/pwquality.conf r, - /etc/security/pwquality.conf.d/{,**} r, + @{etc_ro}/security/pwquality.conf r, + @{etc_ro}/security/pwquality.conf.d/{,**} r, /etc/timezone r, /etc/gdm{,3}/custom.conf r, diff --git a/apparmor.d/groups/hyprland/hyprlock b/apparmor.d/groups/hyprland/hyprlock index b17c0c66a..996d9f170 100644 --- a/apparmor.d/groups/hyprland/hyprlock +++ b/apparmor.d/groups/hyprland/hyprlock @@ -19,7 +19,7 @@ profile hyprlock @{exec_path} { @{exec_path} mr, - /etc/security/faillock.conf r, + @{etc_ro}/security/faillock.conf r, /etc/shells r, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/** r, diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index 79e2b4c59..a13270c93 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -51,12 +51,13 @@ profile kscreenlocker_greet @{exec_path} { /usr/share/xsessions/{,*.desktop} r, /usr/share/hunspell/* r, - /{usr/,}etc/environment r, - /{usr/,}etc/login.defs r, - /{usr/,}etc/login.defs.d/ r, - /{usr/,}etc/security/*.conf r, + @{etc_ro}/environment r, + @{etc_ro}/login.defs r, + @{etc_ro}/login.defs.d/ r, + @{etc_ro}/security/*.conf r, /etc/fstab r, /etc/machine-id r, + /etc/os-release r, /etc/pam.d/* r, /etc/shells r, /etc/xdg/kscreenlockerrc r, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 8e491bb2b..56f0f5820 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -128,9 +128,9 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { /etc/X11/xinit/xinitrc.d/{,*} r, - /{usr/,}etc/environment r, - /{usr/,}etc/security/limits.d/{,*.conf} r, - /{usr/,}etc/X11/Xmodmap r, + @{etc_ro}/environment r, + @{etc_ro}/security/limits.d/{,*.conf} r, + @{etc_ro}/X11/Xmodmap r, /etc/debuginfod/{,*} r, /etc/manpath.config r, /etc/default/locale r, diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index 11aad0da3..7c683ae27 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -33,8 +33,8 @@ profile apport @{exec_path} flags=(attach_disconnected) { /usr/share/apport/{,**} r, + @{etc_ro}/login.defs r, /etc/apport/report-ignore/{,**} r, - /etc/login.defs r, /var/lib/dpkg/info/ r, /var/lib/dpkg/info/*.list r, diff --git a/apparmor.d/groups/ubuntu/apport-checkreports b/apparmor.d/groups/ubuntu/apport-checkreports index 665b3eaca..6e1bb05f2 100644 --- a/apparmor.d/groups/ubuntu/apport-checkreports +++ b/apparmor.d/groups/ubuntu/apport-checkreports @@ -20,9 +20,9 @@ profile apport-checkreports @{exec_path} flags=(attach_disconnected) { /usr/share/dpkg/tupletable r, /usr/share/apport/ r, + @{etc_ro}/login.defs r, /etc/apt/apt.conf.d/{,**} r, /etc/default/apport r, - /etc/login.defs r, /var/crash/ r, diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 94b185162..6ca662859 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -67,9 +67,9 @@ profile cockpit-bridge @{exec_path} { /usr/share/file/** r, /usr/share/iproute2/* r, + @{etc_ro}/login.defs r, /etc/cockpit/{,**} r, /etc/httpd/conf/mime.types r, - /etc/login.defs r, /etc/machine-id r, /etc/mime.types r, /etc/motd r, diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/profiles-a-f/agetty index 9e6db414e..4605822e7 100644 --- a/apparmor.d/profiles-a-f/agetty +++ b/apparmor.d/profiles-a-f/agetty @@ -24,15 +24,14 @@ profile agetty @{exec_path} { @{bin}/login rPx, + @{etc_ro}/login.defs r, + @{etc_ro}/login.defs.d/{,*} r, @{etc_rw}/issue r, /{,usr/}lib/os-release r, /{etc,run,lib,usr/lib}/issue r, /{etc,run,lib,usr/lib}/issue.d/{,*} r, /etc/inittab r, - /etc/login.defs r, - /etc/login.defs.d/{,*} r, /etc/os-release r, - /usr/etc/login.defs r, @{run}/credentials/getty@tty@{int}.service/ r, @{run}/credentials/serial-getty@ttyS@{int}.service/ r, diff --git a/apparmor.d/profiles-a-f/chage b/apparmor.d/profiles-a-f/chage index a89e204a8..43f34a703 100644 --- a/apparmor.d/profiles-a-f/chage +++ b/apparmor.d/profiles-a-f/chage @@ -20,7 +20,7 @@ profile chage @{exec_path} { @{exec_path} mr, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{passwd,shadow} rw, /etc/{passwd,shadow}.@{pid} w, diff --git a/apparmor.d/profiles-a-f/chpasswd b/apparmor.d/profiles-a-f/chpasswd index fb8438cc1..869ba20ab 100644 --- a/apparmor.d/profiles-a-f/chpasswd +++ b/apparmor.d/profiles-a-f/chpasswd @@ -18,8 +18,9 @@ profile chpasswd @{exec_path} { @{exec_path} mr, + @{etc_ro}/login.defs r, + /etc/.pwd.lock wk, - /etc/login.defs r, /etc/passwd rw, /etc/passwd.@{int} w, /etc/passwd.lock l -> /etc/passwd.@{int}, diff --git a/apparmor.d/profiles-a-f/firecfg b/apparmor.d/profiles-a-f/firecfg index a3aba8af1..02201e78e 100644 --- a/apparmor.d/profiles-a-f/firecfg +++ b/apparmor.d/profiles-a-f/firecfg @@ -21,7 +21,8 @@ profile firecfg @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/apparmor_parser rPx, - /etc/login.defs r, + @{etc_ro}/login.defs r, + /etc/firejail/firejail.users r, /etc/firejail/firecfg.config r, diff --git a/apparmor.d/profiles-g-l/gamemoded b/apparmor.d/profiles-g-l/gamemoded index 8f5067b77..eb2d3fc1e 100644 --- a/apparmor.d/profiles-g-l/gamemoded +++ b/apparmor.d/profiles-g-l/gamemoded @@ -57,8 +57,8 @@ profile gamemoded @{exec_path} flags=(attach_disconnected) { @{lib}/gamemode/gpuclockctl ix, @{lib}/gamemode/procsysctl ix, - /etc/security/limits.d/ r, - /etc/security/limits.d/@{int}-gamemode.conf r, + @{etc_ro}/security/limits.d/ r, + @{etc_ro}/security/limits.d/@{int}-gamemode.conf r, /etc/shells r, @{sys}/devices/@{pci}/power_dpm_force_performance_level rw, diff --git a/apparmor.d/profiles-g-l/gpasswd b/apparmor.d/profiles-g-l/gpasswd index 8afdff8db..ab2d21860 100644 --- a/apparmor.d/profiles-g-l/gpasswd +++ b/apparmor.d/profiles-g-l/gpasswd @@ -29,7 +29,7 @@ profile gpasswd @{exec_path} { owner @{PROC}/@{pid}/loginuid r, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{group,gshadow} rw, /etc/{group,gshadow}.@{pid} w, diff --git a/apparmor.d/profiles-g-l/groupadd b/apparmor.d/profiles-g-l/groupadd index 9450974a1..65e735605 100644 --- a/apparmor.d/profiles-g-l/groupadd +++ b/apparmor.d/profiles-g-l/groupadd @@ -22,7 +22,7 @@ profile groupadd @{exec_path} { @{exec_path} mr, @{bin}/nscd rix, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{group,gshadow} rw, /etc/{group,gshadow}- w, diff --git a/apparmor.d/profiles-g-l/groupdel b/apparmor.d/profiles-g-l/groupdel index 99b7fddaa..734b22463 100644 --- a/apparmor.d/profiles-g-l/groupdel +++ b/apparmor.d/profiles-g-l/groupdel @@ -25,7 +25,7 @@ profile groupdel @{exec_path} { @{exec_path} mr, @{bin}/nscd rix, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{group,gshadow} rw, /etc/{group,gshadow}.@{pid} w, diff --git a/apparmor.d/profiles-g-l/groupmod b/apparmor.d/profiles-g-l/groupmod index 4b9b0446a..01841483e 100644 --- a/apparmor.d/profiles-g-l/groupmod +++ b/apparmor.d/profiles-g-l/groupmod @@ -24,7 +24,7 @@ profile groupmod @{exec_path} { @{exec_path} mr, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{passwd,gshadow,group} rw, /etc/{passwd,gshadow,group}.@{pid} w, diff --git a/apparmor.d/profiles-g-l/grpck b/apparmor.d/profiles-g-l/grpck index 5fad8960c..3b820febb 100644 --- a/apparmor.d/profiles-g-l/grpck +++ b/apparmor.d/profiles-g-l/grpck @@ -18,7 +18,7 @@ profile grpck @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{gshadow,group} rw, /etc/{gshadow,group}.@{pid} rw, diff --git a/apparmor.d/profiles-g-l/lastlog b/apparmor.d/profiles-g-l/lastlog index 392aba362..0cb62819f 100644 --- a/apparmor.d/profiles-g-l/lastlog +++ b/apparmor.d/profiles-g-l/lastlog @@ -17,8 +17,9 @@ profile lastlog @{exec_path} { @{exec_path} mr, + @{etc_ro}/login.defs r, + /var/log/lastlog r, - /etc/login.defs r, include if exists } diff --git a/apparmor.d/profiles-g-l/login b/apparmor.d/profiles-g-l/login index 9b32614a9..a4d1b8cd2 100644 --- a/apparmor.d/profiles-g-l/login +++ b/apparmor.d/profiles-g-l/login @@ -43,15 +43,15 @@ profile login @{exec_path} flags=(attach_disconnected) { @{bin}/@{shells} rUx, @{etc_ro}/environment r, + @{etc_ro}/security/group.conf r, + @{etc_ro}/security/limits.conf r, @{etc_ro}/security/limits.d/{,*} r, + @{etc_ro}/security/pam_env.conf r, /etc/default/locale r, /etc/legal r, /etc/machine-id r, /etc/motd r, /etc/motd.d/ r, - /etc/security/group.conf r, - /etc/security/limits.conf r, - /etc/security/pam_env.conf r, /etc/shells r, /var/lib/faillock/@{user} rwk, diff --git a/apparmor.d/profiles-m-r/newgrp b/apparmor.d/profiles-m-r/newgrp index ebd15d4b6..1452f34fc 100644 --- a/apparmor.d/profiles-m-r/newgrp +++ b/apparmor.d/profiles-m-r/newgrp @@ -23,9 +23,9 @@ profile newgrp @{exec_path} { @{bin}/@{shells} rUx, - /etc/{passwd,group,shadow,gshadow} r, + @{etc_ro}/login.defs r, - /etc/login.defs r, + /etc/{passwd,group,shadow,gshadow} r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/profiles-m-r/pwck b/apparmor.d/profiles-m-r/pwck index 0c9e1ac0a..6aef4d028 100644 --- a/apparmor.d/profiles-m-r/pwck +++ b/apparmor.d/profiles-m-r/pwck @@ -16,7 +16,8 @@ profile pwck @{exec_path} flags=(attach_disconnected) { @{bin}/nscd rix, - /etc/login.defs r, + @{etc_ro}/login.defs r, + /etc/.pwd.lock wk, /etc/passwd rw, /etc/passwd.@{int} rw, diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index 4e383b777..2788ed4a3 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -98,9 +98,9 @@ profile snapd @{exec_path} { /usr/share/dbus-1/services/*snap* r, /usr/share/polkit-1/actions/{,**/} r, + @{etc_ro}/environment r, /etc/apparmor.d/*snapd.snap* r, /etc/dbus-1/system.d/{,**/} r, - /etc/environment r, /etc/fstab r, /etc/mime.types r, /etc/modprobe.d/{,**/} r, diff --git a/apparmor.d/profiles-s-z/useradd b/apparmor.d/profiles-s-z/useradd index d27a34207..021ede783 100644 --- a/apparmor.d/profiles-s-z/useradd +++ b/apparmor.d/profiles-s-z/useradd @@ -30,7 +30,7 @@ profile useradd @{exec_path} { @{bin}/pam_tally2 rCx -> pam_tally2, /etc/default/useradd r, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{passwd,shadow,gshadow,group,subuid,subgid} rw, /etc/{passwd,shadow,gshadow,group,subuid,subgid}- w, diff --git a/apparmor.d/profiles-s-z/userdel b/apparmor.d/profiles-s-z/userdel index 05df64874..afaa52a03 100644 --- a/apparmor.d/profiles-s-z/userdel +++ b/apparmor.d/profiles-s-z/userdel @@ -26,7 +26,7 @@ profile userdel @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{passwd,shadow,gshadow,group,subuid,subgid} rw, /etc/{passwd,shadow,gshadow,group,subuid,subgid}.@{pid} w, diff --git a/apparmor.d/profiles-s-z/usermod b/apparmor.d/profiles-s-z/usermod index c0f8f0e45..1e5c6e4eb 100644 --- a/apparmor.d/profiles-s-z/usermod +++ b/apparmor.d/profiles-s-z/usermod @@ -28,7 +28,7 @@ profile usermod @{exec_path} flags=(attach_disconnected) { @{bin}/nscd rix, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/subuid r, /etc/{passwd,shadow,gshadow,group} rw, diff --git a/apparmor.d/profiles-s-z/vipw-vigr b/apparmor.d/profiles-s-z/vipw-vigr index 50ada1d64..396f1e4f8 100644 --- a/apparmor.d/profiles-s-z/vipw-vigr +++ b/apparmor.d/profiles-s-z/vipw-vigr @@ -18,7 +18,7 @@ profile vipw-vigr @{exec_path} { @{sh_path} rix, @{editor_path} rCx -> editor, - /etc/login.defs r, + @{etc_ro}/login.defs r, /etc/{passwd,shadow,gshadow,group}{,.edit} rw, /etc/{passwd,shadow,gshadow,group}.@{pid} rw, From de690ab878200fe0727571aeb97ff06d08323a64 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 25 Jan 2025 22:34:15 +0100 Subject: [PATCH 0550/1455] fix(ci): update path to shellcheck. --- .gitlab-ci.yml | 2 +- Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 960dd2884..a93767d20 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -24,7 +24,7 @@ bash: script: - shellcheck --shell=bash PKGBUILD dists/build.sh dists/docker.sh tests/check.sh - tests/packer/init/init.sh tests/packer/src/aa-update tests/packer/init/clean.sh + tests/packer/init.sh tests/packer/src/aa-update tests/packer/clean.sh golangci-lint: stage: lint diff --git a/Makefile b/Makefile index 911bd4027..7de055c9f 100644 --- a/Makefile +++ b/Makefile @@ -104,7 +104,7 @@ lint: @make --directory=tests lint @shellcheck --shell=bash \ PKGBUILD dists/build.sh dists/docker.sh tests/check.sh \ - tests/packer/init/init.sh tests/packer/src/aa-update tests/packer/init/clean.sh \ + tests/packer/init.sh tests/packer/src/aa-update tests/packer/clean.sh \ debian/${PKGNAME}.postinst debian/${PKGNAME}.postrm .PHONY: check From df8ac22e0cb67aa6e612ac9dba55fb38008d08b7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 26 Jan 2025 12:10:23 +0100 Subject: [PATCH 0551/1455] test(vagrant): update boxes name. --- tests/boxes.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/boxes.yml b/tests/boxes.yml index 532c5e18f..3e15fc304 100644 --- a/tests/boxes.yml +++ b/tests/boxes.yml @@ -26,17 +26,17 @@ boxes: box: aa-archlinux-server uefi: false - - name: ubuntu-desktop - box: aa-ubuntu-desktop + - name: ubuntu22-desktop + box: aa-ubuntu22-desktop - - name: ubuntu-desktop24 - box: aa-ubuntu-desktop24 + - name: ubuntu24-desktop + box: aa-ubuntu24-desktop - - name: ubuntu-server - box: aa-ubuntu-server + - name: ubuntu22-server + box: aa-ubuntu22-server - - name: ubuntu-server24 - box: aa-ubuntu-server24 + - name: ubuntu24-server + box: aa-ubuntu24-server24 - name: debian-server box: aa-debian-server From c427765909c2790e40346b67c8400c9bb342354d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 26 Jan 2025 17:04:11 +0100 Subject: [PATCH 0552/1455] feat(profile): initial support for gimp 3. see #656 --- apparmor.d/profiles-g-l/gimp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index a9be29bec..83457578f 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -13,6 +13,7 @@ profile gimp @{exec_path} { include include include + include include include @@ -23,7 +24,12 @@ profile gimp @{exec_path} { @{exec_path} mr, + @{bin}/env rix, + @{bin}/gjs-console rix, + @{bin}/lua rix, + @{lib}/gimp/@{version}/extensions/*/* rix, @{lib}/gimp/*/plug-ins/** rix, + @{python_path} rix, @{bin}/xsane-gimp rPx, @{open_path} rPx -> child-open-help, From aefa46359ee66ef22d5da6090fc4684059bcfd82 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 26 Jan 2025 18:36:18 +0100 Subject: [PATCH 0553/1455] Update firecfg --- apparmor.d/profiles-a-f/firecfg | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-a-f/firecfg b/apparmor.d/profiles-a-f/firecfg index 02201e78e..a54d1c9ac 100644 --- a/apparmor.d/profiles-a-f/firecfg +++ b/apparmor.d/profiles-a-f/firecfg @@ -25,6 +25,7 @@ profile firecfg @{exec_path} flags=(attach_disconnected) { /etc/firejail/firejail.users r, /etc/firejail/firecfg.config r, + /etc/firejail/firecfg.d/{,*} r, /usr/local/bin/ r, /usr/local/bin/* rw, @@ -33,10 +34,14 @@ profile firecfg @{exec_path} flags=(attach_disconnected) { /usr/share/applications/ r, /usr/share/applications/*.desktop r, @{user_share_dirs}/applications/ r, - @{user_share_dirs}/applications/*.desktop rw, - /dev/tty rw, + @{user_config_dirs}/firejail/{,*} r, + + /dev/tty rw, + /dev/tty@{int} rw, + owner /dev/pts/@{int} rw, + include if exists } From 01b173a1daef6d4c47adf6f369e28858020e4b06 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 26 Jan 2025 18:28:42 +0100 Subject: [PATCH 0554/1455] Update needrestart-vmlinuz-get-version --- apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version index f7e9d76a1..0c3c669a0 100644 --- a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version +++ b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version @@ -14,12 +14,19 @@ profile needrestart-vmlinuz-get-version @{exec_path} { @{exec_path} mr, @{sh_path} rix, + @{bin}/bzip2 rix, @{bin}/grep rix, + @{bin}/gunzip rix, + @{bin}/gzip rix, + @{bin}/lzop rix, @{bin}/mktemp rix, @{bin}/rm rix, + @{bin}/tail rix, @{bin}/tr rix, @{bin}/which{,.debianutils} rix, + @{bin}/xz rix, + /boot/intel-ucode.img r, /boot/vmlinuz* r, owner @{tmp}/tmp.@{rand10} rw, From 54a16eb0559197a1b8d6c582c3e9dbd09d4a40b0 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 26 Jan 2025 18:03:37 +0100 Subject: [PATCH 0555/1455] Update okular Typo. --- apparmor.d/groups/kde/okular | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index fe1c5d8da..7618a10d4 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -94,7 +94,7 @@ profile okular @{exec_path} { include @{bin}/gpg{,2} mr, - @{bin}/gpgcon mr, + @{bin}/gpgconf mr, @{bin}/gpgsm mr, owner @{HOME}/@{XDG_GPG_DIR}/*.conf r, From 5a1a5418eccbf21b966aa1a9e6528e3d7c7a39e1 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 26 Jan 2025 17:53:34 +0100 Subject: [PATCH 0556/1455] Update kscreenlocker_greet --- apparmor.d/groups/kde/kscreenlocker_greet | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index a13270c93..c006f354c 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -101,9 +101,11 @@ profile kscreenlocker_greet @{exec_path} { @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node@{int}/meminfo r, + @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/loginuid r, + @{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/loginuid r, From aec02b8f64221d7d22f318d9de4ce1d09ea3d796 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 26 Jan 2025 17:49:11 +0100 Subject: [PATCH 0557/1455] Update systemd-tmpfiles profile systemd-tmpfiles { @{sys}/devices/system/cpu/cpufreq/ r, @{sys}/devices/system/cpu/cpufreq/policy0/scaling_governor w, @{sys}/devices/system/cpu/cpufreq/policy1/scaling_governor w, @{sys}/devices/system/cpu/cpufreq/policy2/scaling_governor w, @{sys}/devices/system/cpu/cpufreq/policy3/scaling_governor w, @{sys}/devices/system/cpu/cpufreq/policy4/scaling_governor w, @{sys}/devices/system/cpu/cpufreq/policy5/scaling_governor w, @{sys}/devices/system/cpu/cpufreq/policy6/scaling_governor w, @{sys}/devices/system/cpu/cpufreq/policy7/scaling_governor w, @{sys}/module/pcie_aspm/parameters/policy w, } --- apparmor.d/groups/systemd/systemd-tmpfiles | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/groups/systemd/systemd-tmpfiles b/apparmor.d/groups/systemd/systemd-tmpfiles index f591ef9f7..e37073f47 100644 --- a/apparmor.d/groups/systemd/systemd-tmpfiles +++ b/apparmor.d/groups/systemd/systemd-tmpfiles @@ -51,7 +51,10 @@ profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) { @{sys}/kernel/security/{,**} rw, @{sys}/class/net/ r, + @{sys}/devices/system/cpu/cpufreq/ r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor w, @{sys}/devices/system/cpu/microcode/reload w, + @{sys}/module/pcie_aspm/parameters/policy w, @{PROC}/@{pid}/net/unix r, @{PROC}/1/cmdline r, From d802bf82f28ac3566c431f7ad7ebbf306ea1b33b Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 26 Jan 2025 17:41:53 +0100 Subject: [PATCH 0558/1455] Update pacman profile pacman//systemctl { signal send set=(cont term) peer=systemd-tty-ask-password-agent, } --- apparmor.d/groups/pacman/pacman | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 6c0e782fa..16a8171ca 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -196,6 +196,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { capability sys_resource, signal send set=cont peer=child-pager, + signal send set=(cont term) peer=systemd-tty-ask-password-agent, signal receive set=winch peer=makepkg//sudo, @{pager_path} rPx -> child-pager, From 4a978ef9b6d6a846a3a34618b3f978b795399735 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 26 Jan 2025 21:07:44 +0100 Subject: [PATCH 0559/1455] systemd-journald: adding mediate_deleted (#657) * Update systemd-journald profile systemd-journald flags=(mediate_deleted) { link /var/log/journal/@{hex32}/#42742 , # Failed name lookup - deleted entry link /var/log/journal/@{hex32}/#42744 , # Failed name lookup - deleted entry link /var/log/journal/@{hex32}/.#system@@{hex32}-@{hex16}-@{hex16}.journal@{hex16} -> /var/log/journal/@{hex32}/#42744, link /var/log/journal/@{hex32}/.#user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal@{hex16} -> /var/log/journal/@{hex32}/#42742, } * Update main.flags Adding `systemd-journald attach_disconnected,mediate_deleted` --- apparmor.d/groups/systemd/systemd-journald | 2 +- dists/flags/main.flags | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index d63a4211d..b0a646f66 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-journald -profile systemd-journald @{exec_path} flags=(attach_disconnected) { +profile systemd-journald @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 6a1a1b6a7..70bbd4a36 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -333,6 +333,7 @@ systemd-generator-veritysetup attach_disconnected,complain systemd-homed attach_disconnected,complain systemd-homework complain systemd-inhibit attach_disconnected,complain +systemd-journald attach_disconnected,mediate_deleted systemd-mount complain systemd-network-generator complain systemd-portabled complain From a68cd26d4103036a50ae64fc67a5512cee5cec4d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 26 Jan 2025 21:10:26 +0100 Subject: [PATCH 0560/1455] fix(profile): yay: pacman can be used by yay without installing anything ie: without `sudo pacmcan -U ...` see #420 --- apparmor.d/groups/pacman/yay | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/pacman/yay b/apparmor.d/groups/pacman/yay index 52c2de345..42932cc2e 100644 --- a/apparmor.d/groups/pacman/yay +++ b/apparmor.d/groups/pacman/yay @@ -25,6 +25,7 @@ profile yay @{exec_path} { @{bin}/git Cx -> git, @{bin}/gpg{,2} Cx -> gpg, @{bin}/makepkg Px, + @{bin}/pacman Px, @{bin}/pacman-conf Px, @{bin}/sudo Cx -> sudo, From feee34ef7e9fe0baaab6c2680e8ac90c0cec991d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 26 Jan 2025 21:17:18 +0100 Subject: [PATCH 0561/1455] feat(profile): allow drkonqi to read logs. fix #655 --- apparmor.d/groups/kde/drkonqi | 17 +++++++++++++++++ .../groups/kde/drkonqi-coredump-processor | 1 + 2 files changed, 18 insertions(+) diff --git a/apparmor.d/groups/kde/drkonqi b/apparmor.d/groups/kde/drkonqi index 961c18cfe..83fd07181 100644 --- a/apparmor.d/groups/kde/drkonqi +++ b/apparmor.d/groups/kde/drkonqi @@ -23,18 +23,35 @@ profile drkonqi @{exec_path} { @{exec_path} mr, + @{bin}/plasmashell r, @{bin}/lsb_release rPx -> lsb_release, /usr/share/drkonqi/{,**} r, + /etc/machine-id r, + + / r, + owner @{user_cache_dirs}/drkonqi/ rw, owner @{user_cache_dirs}/drkonqi/** rwlk -> @{user_cache_dirs}/drkonqi/**, owner @{user_cache_dirs}/kcrash-metadata/* w, + owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/drkonqirc r, + /{run,var}/log/journal/ r, + /{run,var}/log/journal/@{hex32}/ r, + /{run,var}/log/journal/@{hex32}/system.journal r, + /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}.journal r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* r, + /{run,var}/log/journal/remote/ r, + /dev/tty r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, + include if exists } diff --git a/apparmor.d/groups/kde/drkonqi-coredump-processor b/apparmor.d/groups/kde/drkonqi-coredump-processor index e07a6c1d4..9b1e6c379 100644 --- a/apparmor.d/groups/kde/drkonqi-coredump-processor +++ b/apparmor.d/groups/kde/drkonqi-coredump-processor @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}drkonqi-coredump-processor profile drkonqi-coredump-processor @{exec_path} { include + include include capability dac_override, From c29927ea2ffa0501d9ba6b6a3c90d323241db6ce Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 28 Jan 2025 23:28:11 +0100 Subject: [PATCH 0562/1455] fix(profile): ensure all child-open* profiles share the same flags. fix #630 --- apparmor.d/groups/children/child-open | 2 +- apparmor.d/groups/children/child-open-browsers | 2 +- apparmor.d/groups/children/child-open-help | 2 +- apparmor.d/groups/children/child-open-strict | 2 +- dists/flags/main.flags | 1 - 5 files changed, 4 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/children/child-open b/apparmor.d/groups/children/child-open index 6804326aa..84b1d1ea1 100644 --- a/apparmor.d/groups/children/child-open +++ b/apparmor.d/groups/children/child-open @@ -19,7 +19,7 @@ abi , include -profile child-open flags=(attach_disconnected) { +profile child-open flags=(attach_disconnected,mediate_deleted) { include include include diff --git a/apparmor.d/groups/children/child-open-browsers b/apparmor.d/groups/children/child-open-browsers index 6873ea2fc..473276bff 100644 --- a/apparmor.d/groups/children/child-open-browsers +++ b/apparmor.d/groups/children/child-open-browsers @@ -15,7 +15,7 @@ abi , include -profile child-open-browsers flags=(attach_disconnected) { +profile child-open-browsers flags=(attach_disconnected,mediate_deleted) { include include diff --git a/apparmor.d/groups/children/child-open-help b/apparmor.d/groups/children/child-open-help index d70cd920a..1150d16d3 100644 --- a/apparmor.d/groups/children/child-open-help +++ b/apparmor.d/groups/children/child-open-help @@ -6,7 +6,7 @@ abi , include -profile child-open-help { +profile child-open-help flags=(attach_disconnected,mediate_deleted) { include include diff --git a/apparmor.d/groups/children/child-open-strict b/apparmor.d/groups/children/child-open-strict index 98bbdcdb9..7faf52185 100644 --- a/apparmor.d/groups/children/child-open-strict +++ b/apparmor.d/groups/children/child-open-strict @@ -11,7 +11,7 @@ abi , include -profile child-open-strict { +profile child-open-strict flags=(attach_disconnected,mediate_deleted) { include include diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 70bbd4a36..cf38d2756 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -45,7 +45,6 @@ calibre complain cc-remote-login-helper complain cctk complain child-modprobe-nvidia attach_disconnected,complain -child-open attach_disconnected,complain cockpit-askpass complain cockpit-bridge complain cockpit-certificate-ensure attach_disconnected,complain From 5784ff83cf98c821375d6e9337077e889c3dddd8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 28 Jan 2025 23:30:25 +0100 Subject: [PATCH 0563/1455] feat(abs): minor improvement to some abstraction. --- apparmor.d/abstractions/app/pgrep | 1 + apparmor.d/abstractions/common/systemd | 1 + apparmor.d/abstractions/dconf.d/complete | 2 +- apparmor.d/abstractions/desktop | 2 +- apparmor.d/abstractions/gnome-strict | 2 +- apparmor.d/abstractions/gnome.d/complete | 2 +- apparmor.d/abstractions/gtk.d/complete | 8 ++++---- apparmor.d/abstractions/kde-open5.d/complete | 2 +- 8 files changed, 11 insertions(+), 9 deletions(-) diff --git a/apparmor.d/abstractions/app/pgrep b/apparmor.d/abstractions/app/pgrep index 211c2710d..d6b7ba8a7 100644 --- a/apparmor.d/abstractions/app/pgrep +++ b/apparmor.d/abstractions/app/pgrep @@ -21,6 +21,7 @@ @{PROC}/ r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/environ r, @{PROC}/@{pids}/stat r, @{PROC}/sys/kernel/osrelease r, @{PROC}/uptime r, diff --git a/apparmor.d/abstractions/common/systemd b/apparmor.d/abstractions/common/systemd index df138bf6c..f4a10076e 100644 --- a/apparmor.d/abstractions/common/systemd +++ b/apparmor.d/abstractions/common/systemd @@ -8,6 +8,7 @@ ptrace read peer=@{p_systemd}, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, + @{sys}/fs/cgroup/system.slice/@{profile_name}.service/ r, @{sys}/fs/cgroup/system.slice/@{profile_name}.service/memory.pressure rw, @{PROC}/1/cgroup r, diff --git a/apparmor.d/abstractions/dconf.d/complete b/apparmor.d/abstractions/dconf.d/complete index ed8fa33e6..4f53689d5 100644 --- a/apparmor.d/abstractions/dconf.d/complete +++ b/apparmor.d/abstractions/dconf.d/complete @@ -10,7 +10,7 @@ dbus receive bus=session path=/ca/desrt/dconf/Writer/user interface=ca.desrt.dconf.Writer member=Notify - peer=(name=:*, label=dconf-service), + peer=(name=@{busname}, label=dconf-service), /usr/share/dconf/profile/gdm r, diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 743dfaf2d..78a98a3cf 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -22,7 +22,7 @@ dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), /usr/{local/,}share/ r, /usr/{local/,}share/glib-@{version}/schemas/** r, diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 9862ca5e7..fadaedcbf 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -14,7 +14,7 @@ dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), /usr/share/desktop-base/{,**} r, /usr/share/hwdata/*.ids r, diff --git a/apparmor.d/abstractions/gnome.d/complete b/apparmor.d/abstractions/gnome.d/complete index 90f705ac7..71e76f9da 100644 --- a/apparmor.d/abstractions/gnome.d/complete +++ b/apparmor.d/abstractions/gnome.d/complete @@ -7,7 +7,7 @@ dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r, diff --git a/apparmor.d/abstractions/gtk.d/complete b/apparmor.d/abstractions/gtk.d/complete index ac702a70f..700e5e305 100644 --- a/apparmor.d/abstractions/gtk.d/complete +++ b/apparmor.d/abstractions/gtk.d/complete @@ -5,7 +5,7 @@ dbus send bus=session interface=org.gtk.Actions member=DescribeAll - peer=(name=:*), + peer=(name=@{busname}), dbus send bus=session interface=org.gtk.Actions member=DescribeAll @@ -14,7 +14,7 @@ dbus receive bus=session interface=org.gtk.Actions member=Changed - peer=(name=:*), + peer=(name=@{busname}), dbus receive bus=session interface=org.gtk.Actions member=Changed @@ -23,11 +23,11 @@ dbus send bus=session path=/org/gtk/Settings interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gsd-xsettings), + peer=(name=@{busname}, label=gsd-xsettings), dbus receive bus=session path=/org/gtk/Settings interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gsd-xsettings), + peer=(name=@{busname}, label=gsd-xsettings), @{lib}/{,@{multiarch}/}gtk*/** mr, diff --git a/apparmor.d/abstractions/kde-open5.d/complete b/apparmor.d/abstractions/kde-open5.d/complete index 37038b129..adeb9a4bb 100644 --- a/apparmor.d/abstractions/kde-open5.d/complete +++ b/apparmor.d/abstractions/kde-open5.d/complete @@ -6,6 +6,6 @@ owner @{user_config_dirs}/menus/{,**} r, - owner @{run}/user/@{uid}/kioclient*.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, + owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, # vim:syntax=apparmor From da68c4f2d9bd65e4d6f7ebb099d4487b62285231 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 00:11:09 +0100 Subject: [PATCH 0564/1455] feat(profile): general update. --- apparmor.d/groups/apt/dpkg-preconfigure | 3 +++ apparmor.d/groups/bus/dbus-accessibility | 1 + apparmor.d/groups/bus/dbus-session | 3 ++- apparmor.d/groups/freedesktop/polkitd | 2 +- apparmor.d/groups/gnome/gnome-shell | 8 +++----- apparmor.d/groups/gnome/session-migration | 4 +++- apparmor.d/groups/gnome/yelp | 1 + apparmor.d/groups/grub/grub-check-signatures | 4 +++- apparmor.d/groups/grub/grub-install | 12 ++++++++++-- apparmor.d/groups/kde/dolphin | 4 ++++ apparmor.d/groups/kde/kde-powerdevil | 1 + apparmor.d/groups/systemd/systemd-networkd | 7 ++++--- apparmor.d/groups/systemd/systemd-udevd | 1 + apparmor.d/profiles-a-f/boltd | 3 ++- apparmor.d/profiles-a-f/frontend | 5 ++++- apparmor.d/profiles-g-l/libreoffice | 5 +++-- apparmor.d/profiles-s-z/setpci | 1 + apparmor.d/profiles-s-z/snap | 10 ++++++++++ apparmor.d/profiles-s-z/snapd | 9 ++++----- apparmor.d/profiles-s-z/syncthing | 8 ++++---- 20 files changed, 65 insertions(+), 27 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index 34163333b..94b7603fa 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -41,8 +41,11 @@ profile dpkg-preconfigure @{exec_path} { /etc/debconf.conf r, /etc/default/grub r, /etc/inputrc r, + /etc/locale.gen r, /etc/shadow r, + /var/lib/locales/supported.d/{,*} r, + owner @{tmp}/*.template.* rw, owner @{tmp}/*.config.* rwPUx, diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index 35a507559..e699d416d 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -76,6 +76,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_score_adj r, diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index 014f7afd4..f87e71c81 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -74,8 +74,9 @@ profile dbus-session flags=(attach_disconnected) { @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/attr/apparmor/current r, owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/oom_score_adj r, + owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/oom_score_adj r, /dev/ptmx rw, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/freedesktop/polkitd b/apparmor.d/groups/freedesktop/polkitd index 5e3d3ee78..9b3db683f 100644 --- a/apparmor.d/groups/freedesktop/polkitd +++ b/apparmor.d/groups/freedesktop/polkitd @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{lib}/{,polkit-1/}polkitd +@{exec_path} = @{lib}/polkitd @{lib}/polkit-1/polkitd profile polkitd @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 462733874..f8888f95b 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -83,15 +83,17 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { # Talk with gnome-shell #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon + #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd #aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind #aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm #aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding + #aa:dbus talk bus=session name=org.gnome.* label=gnome-* #aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console - #aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-* #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + #aa:dbus talk bus=session name=org.gnome.Nautilus label=nautilus # System bus @@ -163,10 +165,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { member=Introspect peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), - dbus send bus=session path=/org/gnome/*/SearchProvider - interface=org.gnome.Shell.SearchProvider2 - peer=(name=@{busname}), - @{exec_path} mr, @{bin}/unzip rix, diff --git a/apparmor.d/groups/gnome/session-migration b/apparmor.d/groups/gnome/session-migration index d519dca6e..c2df97896 100644 --- a/apparmor.d/groups/gnome/session-migration +++ b/apparmor.d/groups/gnome/session-migration @@ -9,12 +9,14 @@ include @{exec_path} = @{bin}/session-migration profile session-migration @{exec_path} { include + include @{exec_path} mr, @{sh_path} rix, + @{python_path} rix, @{bin}/gsettings rPx, - /usr/share/session-migration/scripts/*.sh rix, + /usr/share/session-migration/scripts/* rix, /usr/share/session-migration/{,**} r, diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index f0dd3b46c..f172eac21 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -14,6 +14,7 @@ profile yelp @{exec_path} { network netlink raw, + #aa:dbus own bus=accessibility name=org.gnome.Yelp #aa:dbus own bus=session name=org.gnome.Yelp @{exec_path} mr, diff --git a/apparmor.d/groups/grub/grub-check-signatures b/apparmor.d/groups/grub/grub-check-signatures index 1a1110091..d33b33265 100644 --- a/apparmor.d/groups/grub/grub-check-signatures +++ b/apparmor.d/groups/grub/grub-check-signatures @@ -22,7 +22,9 @@ profile grub-check-signatures @{exec_path} { /usr/share/debconf/confmodule r, - owner @{tmp}/tmp.*/ rw, + owner @{tmp}/tmp.@{rand10}/ rw, + + @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, include if exists } diff --git a/apparmor.d/groups/grub/grub-install b/apparmor.d/groups/grub/grub-install index 83e30cbf6..e52e96b8a 100644 --- a/apparmor.d/groups/grub/grub-install +++ b/apparmor.d/groups/grub/grub-install @@ -25,20 +25,28 @@ profile grub-install @{exec_path} flags=(complain) { @{bin}/udevadm rPx, /usr/share/grub/{,**} r, + /usr/share/locale-langpack/{,**} r, /etc/default/grub.d/{,**} r, /etc/default/grub r, - /boot/efi/EFI/ubuntu/* w, - /boot/efi/EFI/BOOT/{,**} rw, + /boot/efi/ r, /boot/EFI/*/grubx*.efi rw, + /boot/efi/EFI/ r, + /boot/efi/EFI/BOOT/{,**} rw, + /boot/efi/EFI/ubuntu/* w, /boot/grub/{,**} rw, + @{sys}/devices/**/hid r, + @{sys}/devices/**/path r, + @{sys}/devices/**/uid r, + @{sys}/firmware/efi/ r, @{sys}/firmware/efi/efivars/ r, @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} rw, @{sys}/firmware/efi/efivars/BootCurrent-@{uuid} r, @{sys}/firmware/efi/efivars/BootOrder-@{uuid} r, @{sys}/firmware/efi/efivars/Timeout-@{uuid} r, + @{sys}/firmware/efi/fw_platform_size r, @{sys}/firmware/efi/w_platform_size r, @{PROC}/devices r, diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 8465da560..d01965bb0 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -40,6 +40,7 @@ profile dolphin @{exec_path} { /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,**} r, /usr/share/misc/termcap r, + /usr/share/thumbnailers/{,**} r, /etc/fstab r, /etc/machine-id r, @@ -71,6 +72,7 @@ profile dolphin @{exec_path} { owner @{user_share_dirs}/dolphin/ rw, owner @{user_share_dirs}/dolphin/** rwkl -> @{user_share_dirs}/dolphin/#@{int}, owner @{user_share_dirs}/recently-used.xbel{,.*} rwlk, + owner @{user_state_dirs}/dolphinstaterc{,.*} rwlk, owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/dolphinrc rwl -> @{user_config_dirs}/#@{int}, @@ -89,6 +91,8 @@ profile dolphin @{exec_path} { owner @{user_state_dirs}/dolphinstaterc{,.*} rwlk -> @{user_state_dirs}/#@{int}, + owner @{tmp}/dolphin.@{rand6} rwl, + @{run}/issue r, @{run}/mount/utab r, owner @{run}/user/@{uid}/#@{int} rw, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index d37b53ddd..c37ee870b 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -72,6 +72,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{sys}/devices/platform/*/i2c-@{int}/name r, @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/mounts r, /dev/i2c-@{int} rwk, diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 7b271c9de..0ca507140 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -68,9 +68,10 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/product_version r, - @{PROC}/@{pid}/cgroup r, - @{PROC}/pressure/* r, - @{PROC}/sys/net/ipv{4,6}/** rw, + @{PROC}/@{pid}/cgroup r, + @{PROC}/pressure/* r, + @{PROC}/sys/net/ipv{4,6}/** rw, + owner @{PROC}/@{pid}/fdinfo/@{int} r, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index f52a2fc6c..d71ccf1a1 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -95,6 +95,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{run}/systemd/notify rw, @{run}/systemd/seats/seat@{int} r, + @{att}/@{run}/systemd/notify w, @{att}/@{run}/udev/control rw, @{run}/udev/ rw, diff --git a/apparmor.d/profiles-a-f/boltd b/apparmor.d/profiles-a-f/boltd index b70b72088..8f55bb375 100644 --- a/apparmor.d/profiles-a-f/boltd +++ b/apparmor.d/profiles-a-f/boltd @@ -25,7 +25,8 @@ profile boltd @{exec_path} flags=(attach_disconnected) { owner @{run}/boltd/{,**} rw, - @{run}/systemd/notify rw, + @{att}/@{run}/systemd/notify w, + @{run}/udev/data/+thunderbolt:* r, @{sys}/bus/ r, diff --git a/apparmor.d/profiles-a-f/frontend b/apparmor.d/profiles-a-f/frontend index ac8a6a5a8..3d7ee07f8 100644 --- a/apparmor.d/profiles-a-f/frontend +++ b/apparmor.d/profiles-a-f/frontend @@ -74,9 +74,12 @@ profile frontend @{exec_path} flags=(complain) { /etc/inputrc r, /etc/shadow r, - owner @{tmp}/file* w, owner /var/cache/debconf/* rwk, + owner @{tmp}/file* w, + owner @{tmp}/tmp.@{rand10} rw, + owner @{tmp}/updateppds.@{rand6} rw, + @{HOME}/.Xauthority r, @{run}/user/@{uid}/pk-debconf-socket rw, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 03dfe9749..ac3ee0c26 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -49,11 +49,12 @@ profile libreoffice @{exec_path} { @{bin}/gpgconf rPx, @{bin}/gpgsm rPx, + @{lib}/jvm/java*/bin/java rix, + @{lib}/jvm/java*/lib/** rm, @{lib}/libreoffice/program/javaldx rix, @{lib}/libreoffice/program/oosplash rix, @{lib}/libreoffice/program/soffice.bin rix, - @{lib}/jvm/java*/bin/java rix, - @{lib}/jvm/java*/lib/** rm, + @{lib}/libreoffice/program/xpdfimport rix, @{lib}/libreoffice/{,**} rm, @{lib}/libreoffice/share/uno_packages/cache/stamp.sys w, diff --git a/apparmor.d/profiles-s-z/setpci b/apparmor.d/profiles-s-z/setpci index 72c9b8a93..019e89e23 100644 --- a/apparmor.d/profiles-s-z/setpci +++ b/apparmor.d/profiles-s-z/setpci @@ -16,6 +16,7 @@ profile setpci @{exec_path} flags=(complain) { @{sys}/bus/pci/devices/ r, @{sys}/devices/@{pci}/** r, + @{sys}/devices/@{pci}/config w, include if exists } diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/profiles-s-z/snap index cdb01d14a..90b2ceef3 100644 --- a/apparmor.d/profiles-s-z/snap +++ b/apparmor.d/profiles-s-z/snap @@ -14,6 +14,7 @@ profile snap @{exec_path} { include include include + include include include include @@ -24,6 +25,8 @@ profile snap @{exec_path} { network netlink raw, + ptrace read peer=snap.snap-store.snap-store, + unix (send, receive) type=stream peer=(label=apt), mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-@{int}/, @@ -32,6 +35,7 @@ profile snap @{exec_path} { #aa:dbus own bus=session name=io.snapcraft.SessionAgent #aa:dbus own bus=session name=io.snapcraft.Settings + #aa:dbus talk bus=session name=io.snapcraft.PrivilegedDesktopLauncher label=snap.snap-store.snap-store #aa:dbus talk bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}" dbus send bus=session path=/org/freedesktop/portal/documents @@ -39,6 +43,11 @@ profile snap @{exec_path} { member=GetMountPoint peer=(name=org.freedesktop.portal.Documents, label="{xdg-document-portal,unconfined}"), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mrix, @{bin}/mount rix, @@ -83,6 +92,7 @@ profile snap @{exec_path} { @{PROC}/sys/kernel/random/uuid r, @{PROC}/sys/kernel/seccomp/actions_avail r, @{PROC}/version r, + owner @{PROC}/@{pid}/attr/apparmor/current r, owner @{PROC}/@{pid}/mounts r, /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/profiles-s-z/snapd index 2788ed4a3..dc80b17a4 100644 --- a/apparmor.d/profiles-s-z/snapd +++ b/apparmor.d/profiles-s-z/snapd @@ -47,8 +47,8 @@ profile snapd @{exec_path} { umount /tmp/syscheck-mountpoint-@{int}/, umount /snap/*/*/, - ptrace (read) peer=snap, - ptrace (read) peer=@{p_systemd}, + ptrace read peer=@{p_systemd}, + ptrace read peer=snap{,.*}, unix (bind) type=stream addr=@@{udbus}/bus/systemctl/, @@ -155,16 +155,15 @@ profile snapd @{exec_path} { @{sys}/fs/cgroup/{,*/} r, @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/system.slice/{,**/} r, + @{sys}/fs/cgroup/system.slice/snap*.service/cgroup.procs r, @{sys}/fs/cgroup/user.slice/ r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.procs r, @{sys}/kernel/kexec_loaded r, @{sys}/kernel/security/apparmor/.notify r, @{sys}/kernel/security/apparmor/features/{,**} r, @{sys}/kernel/security/apparmor/profiles r, - @{sys}/fs/cgroup/system.slice/snap*.service/cgroup.procs r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.procs r, - @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/mounts r, @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/profiles-s-z/syncthing b/apparmor.d/profiles-s-z/syncthing index f668f5a00..d03ece9e4 100644 --- a/apparmor.d/profiles-s-z/syncthing +++ b/apparmor.d/profiles-s-z/syncthing @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/syncthing profile syncthing @{exec_path} { include + include include include @@ -28,15 +29,14 @@ profile syncthing @{exec_path} { /etc/mime.types r, - owner @{HOME}/ r, - owner @{HOME}/@{XDG_DATA_DIR}/syncthing/{,**} rwk, - owner @{user_config_dirs}/syncthing/{,**} rwk, - owner @{user_state_dirs}/syncthing/{,**} rwk, + @{HOME}/ r, + @{HOME}/** rwk, /home/ r, @{user_sync_dirs}/{,**} rw, @{PROC}/@{pids}/net/route r, + @{PROC}/sys/kernel/osrelease r, @{PROC}/sys/net/core/somaxconn r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mountinfo r, From 77eb8c3c11a0b8983567aca7d48f370fb978a073 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 20:26:52 +0100 Subject: [PATCH 0565/1455] feat(profile): minor update. --- apparmor.d/groups/virt/dockerd | 2 +- apparmor.d/profiles-a-f/fractal | 4 +++- apparmor.d/profiles-m-r/mount-cifs | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 13f050c7d..2e2d36355 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -85,7 +85,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { owner /var/lib/docker/tmp/qemu-check@{int}/check rix, /tmp/build/ w, - /tmp/containerd-mount@{int10}/{,**} rw, + /tmp/containerd-mount@{int}/{,**} rw, owner @{run}/docker/ rw, owner @{run}/docker/** rwlk, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 6dfb84452..9de5761c2 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -33,11 +33,13 @@ profile fractal @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, - owner @{tmp}/@{rand6} rw, + + owner @{run}/user/@{uid}/fractal/{,**} rw, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, /dev/ r, diff --git a/apparmor.d/profiles-m-r/mount-cifs b/apparmor.d/profiles-m-r/mount-cifs index 190db34da..899ab0801 100644 --- a/apparmor.d/profiles-m-r/mount-cifs +++ b/apparmor.d/profiles-m-r/mount-cifs @@ -40,6 +40,7 @@ profile mount-cifs @{exec_path} flags=(complain) { @{bin}/systemd-ask-password rPUx, /etc/fstab r, + /etc/sync-credentials r, owner @{HOME}/.smbcredentials r, From 63cbf2829b43325a5d77a0f82ce11e2db3b44015 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 20:28:40 +0100 Subject: [PATCH 0566/1455] feat(tunable): add p_ variables definition for a few core profiles. --- apparmor.d/tunables/multiarch.d/profiles | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/apparmor.d/tunables/multiarch.d/profiles b/apparmor.d/tunables/multiarch.d/profiles index 2d1fccb32..8917c88d8 100644 --- a/apparmor.d/tunables/multiarch.d/profiles +++ b/apparmor.d/tunables/multiarch.d/profiles @@ -16,4 +16,13 @@ @{p_dbus_session}=dbus-session @{p_dbus_accessibility}=dbus-accessibility +@{p_at_spi2_registryd}=at-spi2-registryd +@{p_colord}=colord +@{p_gnome_shell}=gnome-shell +@{p_packagekitd}=packagekitd +@{p_snap}=snap +@{p_systemd_logind}=systemd-logind +@{p_xdg_desktop_portal}=xdg-desktop-portal + + # vim:syntax=apparmor From 86906d26014bb331f737bd47f68ad62c2116a784 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 20:32:06 +0100 Subject: [PATCH 0567/1455] feat(profile): add localsearch (renamed from tracker-extract localsearch is the new name of tracker-extract. The profile for tracker-extract is kept as they will differ in the future. --- apparmor.d/groups/gnome/localsearch | 69 +++++++++++++++++++ apparmor.d/groups/gnome/localsearch-control | 21 ++++++ apparmor.d/groups/gnome/localsearch-writeback | 21 ++++++ 3 files changed, 111 insertions(+) create mode 100644 apparmor.d/groups/gnome/localsearch create mode 100644 apparmor.d/groups/gnome/localsearch-control create mode 100644 apparmor.d/groups/gnome/localsearch-writeback diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch new file mode 100644 index 000000000..e6d2bba7c --- /dev/null +++ b/apparmor.d/groups/gnome/localsearch @@ -0,0 +1,69 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/localsearch @{lib}/localsearch-3 +profile localsearch @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + + network netlink raw, + + #aa:dbus own bus=session name=org.freedesktop.LocalSearch3 + + @{exec_path} mr, + + @{lib}/localsearch-extractor-3 ix, # nnp + + /usr/share/localsearch3/{,**} r, + /usr/share/poppler/{,**} r, + + # Allow to search user files + owner @{HOME}/ r, + owner @{HOME}/{,**} r, + owner @{MOUNTS}/{,**} r, + owner @{tmp}/*/{,**} r, + + owner @{user_cache_dirs}/tracker3/ rw, + owner @{user_cache_dirs}/tracker3/files/ rw, + owner @{user_cache_dirs}/tracker3/files/** rwk, + + owner /var/tmp/etilqs_@{hex15} rw, + owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{hex15} rw, + owner @{tmp}/etilqs_@{hex16} rw, + + @{run}/mount/utab r, + + @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + + @{PROC}/sys/fs/fanotify/max_user_marks r, + @{PROC}/sys/fs/inotify/max_user_watches r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + /dev/media@{int} rw, + /dev/video@{int} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/localsearch-control b/apparmor.d/groups/gnome/localsearch-control new file mode 100644 index 000000000..354f85009 --- /dev/null +++ b/apparmor.d/groups/gnome/localsearch-control @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/localsearch-control-3 +profile localsearch-control @{exec_path} { + include + include + + #aa:dbus own bus=session name=org.freedesktop.Tracker3.Miner.Files.Control + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/localsearch-writeback b/apparmor.d/groups/gnome/localsearch-writeback new file mode 100644 index 000000000..7d50726c0 --- /dev/null +++ b/apparmor.d/groups/gnome/localsearch-writeback @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/localsearch-writeback-3 +profile localsearch-writeback @{exec_path} { + include + include + + #aa:dbus own bus=session name=org.freedesktop.LocalSearch3.Writeback + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From ba5079d95c2b457db9e1758829c0e7db4aafdfee Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 20:33:37 +0100 Subject: [PATCH 0568/1455] build: update flag manifest. --- dists/flags/main.flags | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index cf38d2756..87c070c56 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -40,11 +40,9 @@ avahi-resolve complain avahi-set-host-name complain baloo complain baloorunner complain -busctl complain calibre complain cc-remote-login-helper complain cctk complain -child-modprobe-nvidia attach_disconnected,complain cockpit-askpass complain cockpit-bridge complain cockpit-certificate-ensure attach_disconnected,complain @@ -218,6 +216,9 @@ libvirtd attach_disconnected,complain lightdm attach_disconnected,complain locale-gen complain localectl complain +localsearch complain +localsearch-control complain +localsearch-writeback complain login attach_disconnected,complain loginctl complain low-memory-monitor attach_disconnected,complain @@ -373,6 +374,7 @@ xdg-dbus-proxy attach_disconnected,complain xdg-desktop-icon complain xdg-desktop-portal-kde complain xdg-desktop-portal-rewrite-launchers complain +xdg-desktop-portal-validate-icon attach_disconnected,complain xdg-user-dirs-gtk-update complain xdm-xsession complain xembedsniproxy complain From ace9a12c95c16e36fb233ddad819e053764eb475 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 20:34:25 +0100 Subject: [PATCH 0569/1455] feat(profile): add profile for xdg-desktop-portal-validate-icon. --- .../xdg-desktop-portal-validate-icon | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 apparmor.d/groups/freedesktop/xdg-desktop-portal-validate-icon diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-validate-icon b/apparmor.d/groups/freedesktop/xdg-desktop-portal-validate-icon new file mode 100644 index 000000000..2c6c37538 --- /dev/null +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-validate-icon @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/xdg-desktop-portal-validate-icon +profile xdg-desktop-portal-validate-icon @{exec_path} flags=(attach_disconnected) { + include + include + include + + capability dac_override, + + @{exec_path} mrix, + + @{bin}/bwrap ix, + + owner @{tmp}/icon@{rand6} r, + + include if exists +} + +# vim:syntax=apparmor From 5ea339803a4cbf8d0d359a261b9a31fe84dc03cd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 20:39:44 +0100 Subject: [PATCH 0570/1455] chore: fix typo & cosmetic. --- apparmor.d/abstractions/app/open | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index be4eda72d..2b865457c 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -11,15 +11,15 @@ # We cannot use `@{open_path} mrix,` here because it includes: # @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop - # And `@{multiarch}` as a wildcard that cannot be merged and that will generate + # And `@{multiarch}` has a wildcard that cannot be merged and that will generate # "has merged rule with conflicting x modifiers" error when used with other # wilcard over PUx transition. - @{bin}/exo-open mrix, - @{bin}/xdg-open mrix, - @{bin}/gio mrix, - @{bin}/kde-open mrix, - @{bin}/gio-launch-desktop mrix, - @{lib}/gio-launch-desktop mrix, + @{bin}/exo-open mrix, + @{bin}/xdg-open mrix, + @{bin}/gio mrix, + @{bin}/kde-open mrix, + @{bin}/gio-launch-desktop mrix, + @{lib}/gio-launch-desktop mrix, @{bin}/env rix, @{sh_path} r, From e5aad04be45270297eb709743bf5a5cea47964e7 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sun, 9 Feb 2025 21:07:43 +0100 Subject: [PATCH 0571/1455] Update dkms (#663) --- apparmor.d/profiles-a-f/dkms | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index ecf1d1c64..75487fbec 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -28,11 +28,14 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{coreutils_path} rix, @{bin}/as rix, @{bin}/bc rix, + @{bin}/clang-@{version} rix, @{bin}/gcc rix, @{bin}/getconf rix, @{bin}/kill rix, @{bin}/kmod rCx -> kmod, @{bin}/ld rix, + @{bin}/ld.lld rix, + @{bin}/llvm-objcopy rix, @{bin}/lsb_release rPx -> lsb_release, @{bin}/make rix, @{bin}/objcopy rix, @@ -47,10 +50,14 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{lib}/linux-kbuild-*/scripts/** rix, @{lib}/linux-kbuild-*/tools/objtool/objtool rix, @{lib}/llvm-[0-9]*/bin/clang rix, + @{lib}/modules/*/build/arch/x86/** rix, + @{lib}/modules/*/build/include/** rix, @{lib}/modules/*/build/scripts/** rix, @{lib}/modules/*/build/tools/** rix, + @{lib}/os-release rix, /var/lib/dkms/**/build/* rix, + /var/lib/dkms/vboxhost/*/build/** rw, /var/lib/dkms/**/configure rix, /var/lib/dkms/**/dkms.postbuild rix, @@ -94,9 +101,13 @@ profile dkms @{exec_path} flags=(attach_disconnected) { owner @{tmp}/sh-thd.* rw, owner @{tmp}/tmp.* rw, + @{PROC}/cpuinfo r, @{PROC}/sys/kernel/osrelease r, + @{PROC}/sys/vm/overcommit_memory r, owner @{PROC}/@{pid}/fd/ r, + /dev/pts/@{int} rw, + profile kmod { include include From 9304c9a668e656047aa4ca97ca506f92780b6dfe Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 21:46:10 +0100 Subject: [PATCH 0572/1455] refractor: moce a lot of profiles inside they own groups. --- .../{profiles-a-f => groups/apparmor}/aa-enabled | 0 .../{profiles-a-f => groups/apparmor}/aa-enforce | 0 apparmor.d/{profiles-a-f => groups/apparmor}/aa-log | 0 apparmor.d/{profiles-a-f => groups/apparmor}/aa-notify | 0 apparmor.d/{profiles-a-f => groups/apparmor}/aa-status | 0 .../{profiles-a-f => groups/apparmor}/aa-teardown | 0 .../{profiles-a-f => groups/apparmor}/aa-unconfined | 0 .../{profiles-a-f => groups/apparmor}/apparmor.systemd | 0 .../{profiles-a-f => groups/apparmor}/apparmor_parser | 0 .../{profiles-a-f => groups/cups}/cups-backend-beh | 0 .../cups}/cups-backend-bluetooth | 0 .../{profiles-a-f => groups/cups}/cups-backend-brf | 0 .../{profiles-a-f => groups/cups}/cups-backend-dnssd | 0 .../{profiles-a-f => groups/cups}/cups-backend-hp | 0 .../cups}/cups-backend-implicitclass | 0 .../{profiles-a-f => groups/cups}/cups-backend-ipp | 0 .../{profiles-a-f => groups/cups}/cups-backend-lpd | 0 .../{profiles-a-f => groups/cups}/cups-backend-mdns | 0 .../cups}/cups-backend-parallel | 0 .../{profiles-a-f => groups/cups}/cups-backend-pdf | 0 .../{profiles-a-f => groups/cups}/cups-backend-serial | 0 .../{profiles-a-f => groups/cups}/cups-backend-snmp | 0 .../{profiles-a-f => groups/cups}/cups-backend-socket | 0 .../{profiles-a-f => groups/cups}/cups-backend-usb | 0 apparmor.d/{profiles-a-f => groups/cups}/cups-browsed | 0 .../{profiles-a-f => groups/cups}/cups-notifier-dbus | 0 .../{profiles-a-f => groups/cups}/cups-notifier-mailto | 0 .../{profiles-a-f => groups/cups}/cups-notifier-rss | 0 .../cups}/cups-pk-helper-mechanism | 0 apparmor.d/{profiles-a-f => groups/cups}/cupsd | 0 apparmor.d/{profiles-a-f => groups/flatpak}/flatpak | 0 .../{profiles-a-f => groups/flatpak}/flatpak-app | 0 .../flatpak}/flatpak-oci-authenticator | 0 .../{profiles-a-f => groups/flatpak}/flatpak-portal | 0 .../flatpak}/flatpak-session-helper | 0 .../flatpak}/flatpak-system-helper | 0 .../flatpak}/flatpak-validate-icon | 0 apparmor.d/{profiles-s-z => groups/snap}/snap | 0 .../{profiles-s-z => groups/snap}/snap-bootstrap | 0 .../{profiles-s-z => groups/snap}/snap-device-helper | 0 .../{profiles-s-z => groups/snap}/snap-discard-ns | 0 apparmor.d/{profiles-s-z => groups/snap}/snap-failure | 0 apparmor.d/{profiles-s-z => groups/snap}/snap-repair | 0 apparmor.d/{profiles-s-z => groups/snap}/snap-seccomp | 0 .../{profiles-s-z => groups/snap}/snap-update-ns | 0 apparmor.d/{profiles-s-z => groups/snap}/snapd | 0 .../snap}/snapd-aa-prompt-listener | 0 .../{profiles-s-z => groups/snap}/snapd-aa-prompt-ui | 0 .../{profiles-s-z => groups/snap}/snapd-apparmor | 0 .../{profiles-s-z => groups/snap}/snapd-core-fixup | 0 apparmor.d/{profiles-s-z => groups/steam}/steam | 0 .../{profiles-s-z => groups/steam}/steam-fossilize | 0 .../{profiles-s-z => groups/steam}/steam-game-native | 0 .../{profiles-s-z => groups/steam}/steam-game-proton | 0 .../{profiles-s-z => groups/steam}/steam-gameoverlayui | 0 apparmor.d/{profiles-s-z => groups/steam}/steam-launch | 0 .../{profiles-s-z => groups/steam}/steam-launcher | 0 .../{profiles-s-z => groups/steam}/steam-runtime | 0 .../steam}/steam-runtime-steam-remote | 0 .../{profiles-s-z => groups/steam}/steamerrorreporter | 0 dists/ignore/main.ignore | 10 +--------- 61 files changed, 1 insertion(+), 9 deletions(-) rename apparmor.d/{profiles-a-f => groups/apparmor}/aa-enabled (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/aa-enforce (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/aa-log (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/aa-notify (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/aa-status (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/aa-teardown (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/aa-unconfined (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/apparmor.systemd (100%) rename apparmor.d/{profiles-a-f => groups/apparmor}/apparmor_parser (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-beh (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-bluetooth (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-brf (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-dnssd (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-hp (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-implicitclass (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-ipp (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-lpd (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-mdns (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-parallel (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-pdf (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-serial (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-snmp (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-socket (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-backend-usb (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-browsed (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-notifier-dbus (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-notifier-mailto (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-notifier-rss (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cups-pk-helper-mechanism (100%) rename apparmor.d/{profiles-a-f => groups/cups}/cupsd (100%) rename apparmor.d/{profiles-a-f => groups/flatpak}/flatpak (100%) rename apparmor.d/{profiles-a-f => groups/flatpak}/flatpak-app (100%) rename apparmor.d/{profiles-a-f => groups/flatpak}/flatpak-oci-authenticator (100%) rename apparmor.d/{profiles-a-f => groups/flatpak}/flatpak-portal (100%) rename apparmor.d/{profiles-a-f => groups/flatpak}/flatpak-session-helper (100%) rename apparmor.d/{profiles-a-f => groups/flatpak}/flatpak-system-helper (100%) rename apparmor.d/{profiles-a-f => groups/flatpak}/flatpak-validate-icon (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap-bootstrap (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap-device-helper (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap-discard-ns (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap-failure (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap-repair (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap-seccomp (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snap-update-ns (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snapd (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snapd-aa-prompt-listener (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snapd-aa-prompt-ui (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snapd-apparmor (100%) rename apparmor.d/{profiles-s-z => groups/snap}/snapd-core-fixup (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-fossilize (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-game-native (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-game-proton (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-gameoverlayui (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-launch (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-launcher (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-runtime (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steam-runtime-steam-remote (100%) rename apparmor.d/{profiles-s-z => groups/steam}/steamerrorreporter (100%) diff --git a/apparmor.d/profiles-a-f/aa-enabled b/apparmor.d/groups/apparmor/aa-enabled similarity index 100% rename from apparmor.d/profiles-a-f/aa-enabled rename to apparmor.d/groups/apparmor/aa-enabled diff --git a/apparmor.d/profiles-a-f/aa-enforce b/apparmor.d/groups/apparmor/aa-enforce similarity index 100% rename from apparmor.d/profiles-a-f/aa-enforce rename to apparmor.d/groups/apparmor/aa-enforce diff --git a/apparmor.d/profiles-a-f/aa-log b/apparmor.d/groups/apparmor/aa-log similarity index 100% rename from apparmor.d/profiles-a-f/aa-log rename to apparmor.d/groups/apparmor/aa-log diff --git a/apparmor.d/profiles-a-f/aa-notify b/apparmor.d/groups/apparmor/aa-notify similarity index 100% rename from apparmor.d/profiles-a-f/aa-notify rename to apparmor.d/groups/apparmor/aa-notify diff --git a/apparmor.d/profiles-a-f/aa-status b/apparmor.d/groups/apparmor/aa-status similarity index 100% rename from apparmor.d/profiles-a-f/aa-status rename to apparmor.d/groups/apparmor/aa-status diff --git a/apparmor.d/profiles-a-f/aa-teardown b/apparmor.d/groups/apparmor/aa-teardown similarity index 100% rename from apparmor.d/profiles-a-f/aa-teardown rename to apparmor.d/groups/apparmor/aa-teardown diff --git a/apparmor.d/profiles-a-f/aa-unconfined b/apparmor.d/groups/apparmor/aa-unconfined similarity index 100% rename from apparmor.d/profiles-a-f/aa-unconfined rename to apparmor.d/groups/apparmor/aa-unconfined diff --git a/apparmor.d/profiles-a-f/apparmor.systemd b/apparmor.d/groups/apparmor/apparmor.systemd similarity index 100% rename from apparmor.d/profiles-a-f/apparmor.systemd rename to apparmor.d/groups/apparmor/apparmor.systemd diff --git a/apparmor.d/profiles-a-f/apparmor_parser b/apparmor.d/groups/apparmor/apparmor_parser similarity index 100% rename from apparmor.d/profiles-a-f/apparmor_parser rename to apparmor.d/groups/apparmor/apparmor_parser diff --git a/apparmor.d/profiles-a-f/cups-backend-beh b/apparmor.d/groups/cups/cups-backend-beh similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-beh rename to apparmor.d/groups/cups/cups-backend-beh diff --git a/apparmor.d/profiles-a-f/cups-backend-bluetooth b/apparmor.d/groups/cups/cups-backend-bluetooth similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-bluetooth rename to apparmor.d/groups/cups/cups-backend-bluetooth diff --git a/apparmor.d/profiles-a-f/cups-backend-brf b/apparmor.d/groups/cups/cups-backend-brf similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-brf rename to apparmor.d/groups/cups/cups-backend-brf diff --git a/apparmor.d/profiles-a-f/cups-backend-dnssd b/apparmor.d/groups/cups/cups-backend-dnssd similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-dnssd rename to apparmor.d/groups/cups/cups-backend-dnssd diff --git a/apparmor.d/profiles-a-f/cups-backend-hp b/apparmor.d/groups/cups/cups-backend-hp similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-hp rename to apparmor.d/groups/cups/cups-backend-hp diff --git a/apparmor.d/profiles-a-f/cups-backend-implicitclass b/apparmor.d/groups/cups/cups-backend-implicitclass similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-implicitclass rename to apparmor.d/groups/cups/cups-backend-implicitclass diff --git a/apparmor.d/profiles-a-f/cups-backend-ipp b/apparmor.d/groups/cups/cups-backend-ipp similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-ipp rename to apparmor.d/groups/cups/cups-backend-ipp diff --git a/apparmor.d/profiles-a-f/cups-backend-lpd b/apparmor.d/groups/cups/cups-backend-lpd similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-lpd rename to apparmor.d/groups/cups/cups-backend-lpd diff --git a/apparmor.d/profiles-a-f/cups-backend-mdns b/apparmor.d/groups/cups/cups-backend-mdns similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-mdns rename to apparmor.d/groups/cups/cups-backend-mdns diff --git a/apparmor.d/profiles-a-f/cups-backend-parallel b/apparmor.d/groups/cups/cups-backend-parallel similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-parallel rename to apparmor.d/groups/cups/cups-backend-parallel diff --git a/apparmor.d/profiles-a-f/cups-backend-pdf b/apparmor.d/groups/cups/cups-backend-pdf similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-pdf rename to apparmor.d/groups/cups/cups-backend-pdf diff --git a/apparmor.d/profiles-a-f/cups-backend-serial b/apparmor.d/groups/cups/cups-backend-serial similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-serial rename to apparmor.d/groups/cups/cups-backend-serial diff --git a/apparmor.d/profiles-a-f/cups-backend-snmp b/apparmor.d/groups/cups/cups-backend-snmp similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-snmp rename to apparmor.d/groups/cups/cups-backend-snmp diff --git a/apparmor.d/profiles-a-f/cups-backend-socket b/apparmor.d/groups/cups/cups-backend-socket similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-socket rename to apparmor.d/groups/cups/cups-backend-socket diff --git a/apparmor.d/profiles-a-f/cups-backend-usb b/apparmor.d/groups/cups/cups-backend-usb similarity index 100% rename from apparmor.d/profiles-a-f/cups-backend-usb rename to apparmor.d/groups/cups/cups-backend-usb diff --git a/apparmor.d/profiles-a-f/cups-browsed b/apparmor.d/groups/cups/cups-browsed similarity index 100% rename from apparmor.d/profiles-a-f/cups-browsed rename to apparmor.d/groups/cups/cups-browsed diff --git a/apparmor.d/profiles-a-f/cups-notifier-dbus b/apparmor.d/groups/cups/cups-notifier-dbus similarity index 100% rename from apparmor.d/profiles-a-f/cups-notifier-dbus rename to apparmor.d/groups/cups/cups-notifier-dbus diff --git a/apparmor.d/profiles-a-f/cups-notifier-mailto b/apparmor.d/groups/cups/cups-notifier-mailto similarity index 100% rename from apparmor.d/profiles-a-f/cups-notifier-mailto rename to apparmor.d/groups/cups/cups-notifier-mailto diff --git a/apparmor.d/profiles-a-f/cups-notifier-rss b/apparmor.d/groups/cups/cups-notifier-rss similarity index 100% rename from apparmor.d/profiles-a-f/cups-notifier-rss rename to apparmor.d/groups/cups/cups-notifier-rss diff --git a/apparmor.d/profiles-a-f/cups-pk-helper-mechanism b/apparmor.d/groups/cups/cups-pk-helper-mechanism similarity index 100% rename from apparmor.d/profiles-a-f/cups-pk-helper-mechanism rename to apparmor.d/groups/cups/cups-pk-helper-mechanism diff --git a/apparmor.d/profiles-a-f/cupsd b/apparmor.d/groups/cups/cupsd similarity index 100% rename from apparmor.d/profiles-a-f/cupsd rename to apparmor.d/groups/cups/cupsd diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/groups/flatpak/flatpak similarity index 100% rename from apparmor.d/profiles-a-f/flatpak rename to apparmor.d/groups/flatpak/flatpak diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/groups/flatpak/flatpak-app similarity index 100% rename from apparmor.d/profiles-a-f/flatpak-app rename to apparmor.d/groups/flatpak/flatpak-app diff --git a/apparmor.d/profiles-a-f/flatpak-oci-authenticator b/apparmor.d/groups/flatpak/flatpak-oci-authenticator similarity index 100% rename from apparmor.d/profiles-a-f/flatpak-oci-authenticator rename to apparmor.d/groups/flatpak/flatpak-oci-authenticator diff --git a/apparmor.d/profiles-a-f/flatpak-portal b/apparmor.d/groups/flatpak/flatpak-portal similarity index 100% rename from apparmor.d/profiles-a-f/flatpak-portal rename to apparmor.d/groups/flatpak/flatpak-portal diff --git a/apparmor.d/profiles-a-f/flatpak-session-helper b/apparmor.d/groups/flatpak/flatpak-session-helper similarity index 100% rename from apparmor.d/profiles-a-f/flatpak-session-helper rename to apparmor.d/groups/flatpak/flatpak-session-helper diff --git a/apparmor.d/profiles-a-f/flatpak-system-helper b/apparmor.d/groups/flatpak/flatpak-system-helper similarity index 100% rename from apparmor.d/profiles-a-f/flatpak-system-helper rename to apparmor.d/groups/flatpak/flatpak-system-helper diff --git a/apparmor.d/profiles-a-f/flatpak-validate-icon b/apparmor.d/groups/flatpak/flatpak-validate-icon similarity index 100% rename from apparmor.d/profiles-a-f/flatpak-validate-icon rename to apparmor.d/groups/flatpak/flatpak-validate-icon diff --git a/apparmor.d/profiles-s-z/snap b/apparmor.d/groups/snap/snap similarity index 100% rename from apparmor.d/profiles-s-z/snap rename to apparmor.d/groups/snap/snap diff --git a/apparmor.d/profiles-s-z/snap-bootstrap b/apparmor.d/groups/snap/snap-bootstrap similarity index 100% rename from apparmor.d/profiles-s-z/snap-bootstrap rename to apparmor.d/groups/snap/snap-bootstrap diff --git a/apparmor.d/profiles-s-z/snap-device-helper b/apparmor.d/groups/snap/snap-device-helper similarity index 100% rename from apparmor.d/profiles-s-z/snap-device-helper rename to apparmor.d/groups/snap/snap-device-helper diff --git a/apparmor.d/profiles-s-z/snap-discard-ns b/apparmor.d/groups/snap/snap-discard-ns similarity index 100% rename from apparmor.d/profiles-s-z/snap-discard-ns rename to apparmor.d/groups/snap/snap-discard-ns diff --git a/apparmor.d/profiles-s-z/snap-failure b/apparmor.d/groups/snap/snap-failure similarity index 100% rename from apparmor.d/profiles-s-z/snap-failure rename to apparmor.d/groups/snap/snap-failure diff --git a/apparmor.d/profiles-s-z/snap-repair b/apparmor.d/groups/snap/snap-repair similarity index 100% rename from apparmor.d/profiles-s-z/snap-repair rename to apparmor.d/groups/snap/snap-repair diff --git a/apparmor.d/profiles-s-z/snap-seccomp b/apparmor.d/groups/snap/snap-seccomp similarity index 100% rename from apparmor.d/profiles-s-z/snap-seccomp rename to apparmor.d/groups/snap/snap-seccomp diff --git a/apparmor.d/profiles-s-z/snap-update-ns b/apparmor.d/groups/snap/snap-update-ns similarity index 100% rename from apparmor.d/profiles-s-z/snap-update-ns rename to apparmor.d/groups/snap/snap-update-ns diff --git a/apparmor.d/profiles-s-z/snapd b/apparmor.d/groups/snap/snapd similarity index 100% rename from apparmor.d/profiles-s-z/snapd rename to apparmor.d/groups/snap/snapd diff --git a/apparmor.d/profiles-s-z/snapd-aa-prompt-listener b/apparmor.d/groups/snap/snapd-aa-prompt-listener similarity index 100% rename from apparmor.d/profiles-s-z/snapd-aa-prompt-listener rename to apparmor.d/groups/snap/snapd-aa-prompt-listener diff --git a/apparmor.d/profiles-s-z/snapd-aa-prompt-ui b/apparmor.d/groups/snap/snapd-aa-prompt-ui similarity index 100% rename from apparmor.d/profiles-s-z/snapd-aa-prompt-ui rename to apparmor.d/groups/snap/snapd-aa-prompt-ui diff --git a/apparmor.d/profiles-s-z/snapd-apparmor b/apparmor.d/groups/snap/snapd-apparmor similarity index 100% rename from apparmor.d/profiles-s-z/snapd-apparmor rename to apparmor.d/groups/snap/snapd-apparmor diff --git a/apparmor.d/profiles-s-z/snapd-core-fixup b/apparmor.d/groups/snap/snapd-core-fixup similarity index 100% rename from apparmor.d/profiles-s-z/snapd-core-fixup rename to apparmor.d/groups/snap/snapd-core-fixup diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/groups/steam/steam similarity index 100% rename from apparmor.d/profiles-s-z/steam rename to apparmor.d/groups/steam/steam diff --git a/apparmor.d/profiles-s-z/steam-fossilize b/apparmor.d/groups/steam/steam-fossilize similarity index 100% rename from apparmor.d/profiles-s-z/steam-fossilize rename to apparmor.d/groups/steam/steam-fossilize diff --git a/apparmor.d/profiles-s-z/steam-game-native b/apparmor.d/groups/steam/steam-game-native similarity index 100% rename from apparmor.d/profiles-s-z/steam-game-native rename to apparmor.d/groups/steam/steam-game-native diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/groups/steam/steam-game-proton similarity index 100% rename from apparmor.d/profiles-s-z/steam-game-proton rename to apparmor.d/groups/steam/steam-game-proton diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/groups/steam/steam-gameoverlayui similarity index 100% rename from apparmor.d/profiles-s-z/steam-gameoverlayui rename to apparmor.d/groups/steam/steam-gameoverlayui diff --git a/apparmor.d/profiles-s-z/steam-launch b/apparmor.d/groups/steam/steam-launch similarity index 100% rename from apparmor.d/profiles-s-z/steam-launch rename to apparmor.d/groups/steam/steam-launch diff --git a/apparmor.d/profiles-s-z/steam-launcher b/apparmor.d/groups/steam/steam-launcher similarity index 100% rename from apparmor.d/profiles-s-z/steam-launcher rename to apparmor.d/groups/steam/steam-launcher diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/groups/steam/steam-runtime similarity index 100% rename from apparmor.d/profiles-s-z/steam-runtime rename to apparmor.d/groups/steam/steam-runtime diff --git a/apparmor.d/profiles-s-z/steam-runtime-steam-remote b/apparmor.d/groups/steam/steam-runtime-steam-remote similarity index 100% rename from apparmor.d/profiles-s-z/steam-runtime-steam-remote rename to apparmor.d/groups/steam/steam-runtime-steam-remote diff --git a/apparmor.d/profiles-s-z/steamerrorreporter b/apparmor.d/groups/steam/steamerrorreporter similarity index 100% rename from apparmor.d/profiles-s-z/steamerrorreporter rename to apparmor.d/groups/steam/steamerrorreporter diff --git a/dists/ignore/main.ignore b/dists/ignore/main.ignore index 917b117f1..3cccf4c05 100644 --- a/dists/ignore/main.ignore +++ b/dists/ignore/main.ignore @@ -9,14 +9,6 @@ apparmor.d/groups/_full man # Work in progress profiles +apparmor.d/groups/steam dunst plasma-discover -steam -steam-fossilize -steam-game-native -steam-game-proton -steam-gameoverlayui -steam-launch -steam-launcher -steam-runtime -steamerrorreporter From fadc08b1ea0a7a887abef8f49d24c1e023336aed Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Feb 2025 22:16:33 +0100 Subject: [PATCH 0573/1455] fix(test): update reference path for aa-status. --- pkg/aa/apparmor_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/aa/apparmor_test.go b/pkg/aa/apparmor_test.go index 0cc74d438..9d68596d3 100644 --- a/pkg/aa/apparmor_test.go +++ b/pkg/aa/apparmor_test.go @@ -237,7 +237,7 @@ func TestAppArmorProfileFile_Integration(t *testing.T) { }, }}, }, - want: mustReadProfileFile(intData.Join("profiles-a-f/aa-status")), + want: mustReadProfileFile(intData.Join("groups/apparmor/aa-status")), }, } for _, tt := range tests { From 9d74168be2700f18b031ebd580553c6001caabf6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 10 Feb 2025 00:20:15 +0100 Subject: [PATCH 0574/1455] refractor: move more profiles to groups. --- apparmor.d/{profiles-a-f => groups/cron}/anacron | 0 apparmor.d/{profiles-g-l => groups/procps}/htop | 0 apparmor.d/{profiles-m-r => groups/procps}/ps | 0 apparmor.d/{profiles-s-z => groups/procps}/sysctl | 0 apparmor.d/{profiles-s-z => groups/procps}/top | 0 apparmor.d/{profiles-s-z => groups/procps}/uptime | 0 apparmor.d/{profiles-s-z => groups/procps}/w | 0 apparmor.d/{profiles-a-f => groups/shadow}/chage | 0 apparmor.d/{profiles-a-f => groups/shadow}/chpasswd | 0 apparmor.d/{profiles-g-l => groups/shadow}/gpasswd | 0 apparmor.d/{profiles-g-l => groups/shadow}/groupadd | 0 apparmor.d/{profiles-g-l => groups/shadow}/groupdel | 0 apparmor.d/{profiles-g-l => groups/shadow}/groupmod | 0 apparmor.d/{profiles-g-l => groups/shadow}/grpck | 0 apparmor.d/{profiles-g-l => groups/shadow}/lastlog | 0 apparmor.d/{profiles-m-r => groups/shadow}/newgidmap | 0 apparmor.d/{profiles-m-r => groups/shadow}/newuidmap | 0 apparmor.d/{profiles-m-r => groups/shadow}/passwd | 0 apparmor.d/{profiles-m-r => groups/shadow}/pwck | 0 apparmor.d/{profiles-s-z => groups/shadow}/useradd | 0 apparmor.d/{profiles-s-z => groups/shadow}/userdel | 0 apparmor.d/{profiles-s-z => groups/shadow}/usermod | 0 apparmor.d/{profiles-a-f => groups/utils}/agetty | 0 apparmor.d/{profiles-a-f => groups/utils}/blkid | 0 apparmor.d/{profiles-a-f => groups/utils}/blockdev | 0 apparmor.d/{profiles-a-f => groups/utils}/chfn | 0 apparmor.d/{profiles-a-f => groups/utils}/chsh | 0 apparmor.d/{profiles-a-f => groups/utils}/df | 0 apparmor.d/{profiles-a-f => groups/utils}/eject | 0 apparmor.d/{profiles-a-f => groups/utils}/findmnt | 0 apparmor.d/{profiles-a-f => groups/utils}/fsck | 0 apparmor.d/{profiles-a-f => groups/utils}/fstrim | 0 apparmor.d/{profiles-g-l => groups/utils}/locale-gen | 0 apparmor.d/{profiles-g-l => groups/utils}/login | 0 apparmor.d/{profiles-g-l => groups/utils}/losetup | 0 apparmor.d/{profiles-g-l => groups/utils}/lsblk | 0 apparmor.d/{profiles-g-l => groups/utils}/lscpu | 0 apparmor.d/{profiles-g-l => groups/utils}/lspci | 0 apparmor.d/{profiles-m-r => groups/utils}/newgrp | 0 apparmor.d/{profiles-m-r => groups/utils}/nologin | 0 apparmor.d/{profiles-m-r => groups/utils}/pstree | 0 apparmor.d/{profiles-s-z => groups/utils}/su | 0 apparmor.d/{profiles-s-z => groups/utils}/sulogin | 0 apparmor.d/{profiles-s-z => groups/utils}/swapon | 0 apparmor.d/{profiles-s-z => groups/utils}/sync | 0 apparmor.d/{profiles-s-z => groups/utils}/uname | 0 apparmor.d/{profiles-s-z => groups/utils}/users | 0 apparmor.d/{profiles-s-z => groups/utils}/uuidd | 0 apparmor.d/{profiles-s-z => groups/utils}/uuidgen | 0 apparmor.d/{profiles-s-z => groups/utils}/who | 0 apparmor.d/groups/{systemd => utils}/zramctl | 0 51 files changed, 0 insertions(+), 0 deletions(-) rename apparmor.d/{profiles-a-f => groups/cron}/anacron (100%) rename apparmor.d/{profiles-g-l => groups/procps}/htop (100%) rename apparmor.d/{profiles-m-r => groups/procps}/ps (100%) rename apparmor.d/{profiles-s-z => groups/procps}/sysctl (100%) rename apparmor.d/{profiles-s-z => groups/procps}/top (100%) rename apparmor.d/{profiles-s-z => groups/procps}/uptime (100%) rename apparmor.d/{profiles-s-z => groups/procps}/w (100%) rename apparmor.d/{profiles-a-f => groups/shadow}/chage (100%) rename apparmor.d/{profiles-a-f => groups/shadow}/chpasswd (100%) rename apparmor.d/{profiles-g-l => groups/shadow}/gpasswd (100%) rename apparmor.d/{profiles-g-l => groups/shadow}/groupadd (100%) rename apparmor.d/{profiles-g-l => groups/shadow}/groupdel (100%) rename apparmor.d/{profiles-g-l => groups/shadow}/groupmod (100%) rename apparmor.d/{profiles-g-l => groups/shadow}/grpck (100%) rename apparmor.d/{profiles-g-l => groups/shadow}/lastlog (100%) rename apparmor.d/{profiles-m-r => groups/shadow}/newgidmap (100%) rename apparmor.d/{profiles-m-r => groups/shadow}/newuidmap (100%) rename apparmor.d/{profiles-m-r => groups/shadow}/passwd (100%) rename apparmor.d/{profiles-m-r => groups/shadow}/pwck (100%) rename apparmor.d/{profiles-s-z => groups/shadow}/useradd (100%) rename apparmor.d/{profiles-s-z => groups/shadow}/userdel (100%) rename apparmor.d/{profiles-s-z => groups/shadow}/usermod (100%) rename apparmor.d/{profiles-a-f => groups/utils}/agetty (100%) rename apparmor.d/{profiles-a-f => groups/utils}/blkid (100%) rename apparmor.d/{profiles-a-f => groups/utils}/blockdev (100%) rename apparmor.d/{profiles-a-f => groups/utils}/chfn (100%) rename apparmor.d/{profiles-a-f => groups/utils}/chsh (100%) rename apparmor.d/{profiles-a-f => groups/utils}/df (100%) rename apparmor.d/{profiles-a-f => groups/utils}/eject (100%) rename apparmor.d/{profiles-a-f => groups/utils}/findmnt (100%) rename apparmor.d/{profiles-a-f => groups/utils}/fsck (100%) rename apparmor.d/{profiles-a-f => groups/utils}/fstrim (100%) rename apparmor.d/{profiles-g-l => groups/utils}/locale-gen (100%) rename apparmor.d/{profiles-g-l => groups/utils}/login (100%) rename apparmor.d/{profiles-g-l => groups/utils}/losetup (100%) rename apparmor.d/{profiles-g-l => groups/utils}/lsblk (100%) rename apparmor.d/{profiles-g-l => groups/utils}/lscpu (100%) rename apparmor.d/{profiles-g-l => groups/utils}/lspci (100%) rename apparmor.d/{profiles-m-r => groups/utils}/newgrp (100%) rename apparmor.d/{profiles-m-r => groups/utils}/nologin (100%) rename apparmor.d/{profiles-m-r => groups/utils}/pstree (100%) rename apparmor.d/{profiles-s-z => groups/utils}/su (100%) rename apparmor.d/{profiles-s-z => groups/utils}/sulogin (100%) rename apparmor.d/{profiles-s-z => groups/utils}/swapon (100%) rename apparmor.d/{profiles-s-z => groups/utils}/sync (100%) rename apparmor.d/{profiles-s-z => groups/utils}/uname (100%) rename apparmor.d/{profiles-s-z => groups/utils}/users (100%) rename apparmor.d/{profiles-s-z => groups/utils}/uuidd (100%) rename apparmor.d/{profiles-s-z => groups/utils}/uuidgen (100%) rename apparmor.d/{profiles-s-z => groups/utils}/who (100%) rename apparmor.d/groups/{systemd => utils}/zramctl (100%) diff --git a/apparmor.d/profiles-a-f/anacron b/apparmor.d/groups/cron/anacron similarity index 100% rename from apparmor.d/profiles-a-f/anacron rename to apparmor.d/groups/cron/anacron diff --git a/apparmor.d/profiles-g-l/htop b/apparmor.d/groups/procps/htop similarity index 100% rename from apparmor.d/profiles-g-l/htop rename to apparmor.d/groups/procps/htop diff --git a/apparmor.d/profiles-m-r/ps b/apparmor.d/groups/procps/ps similarity index 100% rename from apparmor.d/profiles-m-r/ps rename to apparmor.d/groups/procps/ps diff --git a/apparmor.d/profiles-s-z/sysctl b/apparmor.d/groups/procps/sysctl similarity index 100% rename from apparmor.d/profiles-s-z/sysctl rename to apparmor.d/groups/procps/sysctl diff --git a/apparmor.d/profiles-s-z/top b/apparmor.d/groups/procps/top similarity index 100% rename from apparmor.d/profiles-s-z/top rename to apparmor.d/groups/procps/top diff --git a/apparmor.d/profiles-s-z/uptime b/apparmor.d/groups/procps/uptime similarity index 100% rename from apparmor.d/profiles-s-z/uptime rename to apparmor.d/groups/procps/uptime diff --git a/apparmor.d/profiles-s-z/w b/apparmor.d/groups/procps/w similarity index 100% rename from apparmor.d/profiles-s-z/w rename to apparmor.d/groups/procps/w diff --git a/apparmor.d/profiles-a-f/chage b/apparmor.d/groups/shadow/chage similarity index 100% rename from apparmor.d/profiles-a-f/chage rename to apparmor.d/groups/shadow/chage diff --git a/apparmor.d/profiles-a-f/chpasswd b/apparmor.d/groups/shadow/chpasswd similarity index 100% rename from apparmor.d/profiles-a-f/chpasswd rename to apparmor.d/groups/shadow/chpasswd diff --git a/apparmor.d/profiles-g-l/gpasswd b/apparmor.d/groups/shadow/gpasswd similarity index 100% rename from apparmor.d/profiles-g-l/gpasswd rename to apparmor.d/groups/shadow/gpasswd diff --git a/apparmor.d/profiles-g-l/groupadd b/apparmor.d/groups/shadow/groupadd similarity index 100% rename from apparmor.d/profiles-g-l/groupadd rename to apparmor.d/groups/shadow/groupadd diff --git a/apparmor.d/profiles-g-l/groupdel b/apparmor.d/groups/shadow/groupdel similarity index 100% rename from apparmor.d/profiles-g-l/groupdel rename to apparmor.d/groups/shadow/groupdel diff --git a/apparmor.d/profiles-g-l/groupmod b/apparmor.d/groups/shadow/groupmod similarity index 100% rename from apparmor.d/profiles-g-l/groupmod rename to apparmor.d/groups/shadow/groupmod diff --git a/apparmor.d/profiles-g-l/grpck b/apparmor.d/groups/shadow/grpck similarity index 100% rename from apparmor.d/profiles-g-l/grpck rename to apparmor.d/groups/shadow/grpck diff --git a/apparmor.d/profiles-g-l/lastlog b/apparmor.d/groups/shadow/lastlog similarity index 100% rename from apparmor.d/profiles-g-l/lastlog rename to apparmor.d/groups/shadow/lastlog diff --git a/apparmor.d/profiles-m-r/newgidmap b/apparmor.d/groups/shadow/newgidmap similarity index 100% rename from apparmor.d/profiles-m-r/newgidmap rename to apparmor.d/groups/shadow/newgidmap diff --git a/apparmor.d/profiles-m-r/newuidmap b/apparmor.d/groups/shadow/newuidmap similarity index 100% rename from apparmor.d/profiles-m-r/newuidmap rename to apparmor.d/groups/shadow/newuidmap diff --git a/apparmor.d/profiles-m-r/passwd b/apparmor.d/groups/shadow/passwd similarity index 100% rename from apparmor.d/profiles-m-r/passwd rename to apparmor.d/groups/shadow/passwd diff --git a/apparmor.d/profiles-m-r/pwck b/apparmor.d/groups/shadow/pwck similarity index 100% rename from apparmor.d/profiles-m-r/pwck rename to apparmor.d/groups/shadow/pwck diff --git a/apparmor.d/profiles-s-z/useradd b/apparmor.d/groups/shadow/useradd similarity index 100% rename from apparmor.d/profiles-s-z/useradd rename to apparmor.d/groups/shadow/useradd diff --git a/apparmor.d/profiles-s-z/userdel b/apparmor.d/groups/shadow/userdel similarity index 100% rename from apparmor.d/profiles-s-z/userdel rename to apparmor.d/groups/shadow/userdel diff --git a/apparmor.d/profiles-s-z/usermod b/apparmor.d/groups/shadow/usermod similarity index 100% rename from apparmor.d/profiles-s-z/usermod rename to apparmor.d/groups/shadow/usermod diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/groups/utils/agetty similarity index 100% rename from apparmor.d/profiles-a-f/agetty rename to apparmor.d/groups/utils/agetty diff --git a/apparmor.d/profiles-a-f/blkid b/apparmor.d/groups/utils/blkid similarity index 100% rename from apparmor.d/profiles-a-f/blkid rename to apparmor.d/groups/utils/blkid diff --git a/apparmor.d/profiles-a-f/blockdev b/apparmor.d/groups/utils/blockdev similarity index 100% rename from apparmor.d/profiles-a-f/blockdev rename to apparmor.d/groups/utils/blockdev diff --git a/apparmor.d/profiles-a-f/chfn b/apparmor.d/groups/utils/chfn similarity index 100% rename from apparmor.d/profiles-a-f/chfn rename to apparmor.d/groups/utils/chfn diff --git a/apparmor.d/profiles-a-f/chsh b/apparmor.d/groups/utils/chsh similarity index 100% rename from apparmor.d/profiles-a-f/chsh rename to apparmor.d/groups/utils/chsh diff --git a/apparmor.d/profiles-a-f/df b/apparmor.d/groups/utils/df similarity index 100% rename from apparmor.d/profiles-a-f/df rename to apparmor.d/groups/utils/df diff --git a/apparmor.d/profiles-a-f/eject b/apparmor.d/groups/utils/eject similarity index 100% rename from apparmor.d/profiles-a-f/eject rename to apparmor.d/groups/utils/eject diff --git a/apparmor.d/profiles-a-f/findmnt b/apparmor.d/groups/utils/findmnt similarity index 100% rename from apparmor.d/profiles-a-f/findmnt rename to apparmor.d/groups/utils/findmnt diff --git a/apparmor.d/profiles-a-f/fsck b/apparmor.d/groups/utils/fsck similarity index 100% rename from apparmor.d/profiles-a-f/fsck rename to apparmor.d/groups/utils/fsck diff --git a/apparmor.d/profiles-a-f/fstrim b/apparmor.d/groups/utils/fstrim similarity index 100% rename from apparmor.d/profiles-a-f/fstrim rename to apparmor.d/groups/utils/fstrim diff --git a/apparmor.d/profiles-g-l/locale-gen b/apparmor.d/groups/utils/locale-gen similarity index 100% rename from apparmor.d/profiles-g-l/locale-gen rename to apparmor.d/groups/utils/locale-gen diff --git a/apparmor.d/profiles-g-l/login b/apparmor.d/groups/utils/login similarity index 100% rename from apparmor.d/profiles-g-l/login rename to apparmor.d/groups/utils/login diff --git a/apparmor.d/profiles-g-l/losetup b/apparmor.d/groups/utils/losetup similarity index 100% rename from apparmor.d/profiles-g-l/losetup rename to apparmor.d/groups/utils/losetup diff --git a/apparmor.d/profiles-g-l/lsblk b/apparmor.d/groups/utils/lsblk similarity index 100% rename from apparmor.d/profiles-g-l/lsblk rename to apparmor.d/groups/utils/lsblk diff --git a/apparmor.d/profiles-g-l/lscpu b/apparmor.d/groups/utils/lscpu similarity index 100% rename from apparmor.d/profiles-g-l/lscpu rename to apparmor.d/groups/utils/lscpu diff --git a/apparmor.d/profiles-g-l/lspci b/apparmor.d/groups/utils/lspci similarity index 100% rename from apparmor.d/profiles-g-l/lspci rename to apparmor.d/groups/utils/lspci diff --git a/apparmor.d/profiles-m-r/newgrp b/apparmor.d/groups/utils/newgrp similarity index 100% rename from apparmor.d/profiles-m-r/newgrp rename to apparmor.d/groups/utils/newgrp diff --git a/apparmor.d/profiles-m-r/nologin b/apparmor.d/groups/utils/nologin similarity index 100% rename from apparmor.d/profiles-m-r/nologin rename to apparmor.d/groups/utils/nologin diff --git a/apparmor.d/profiles-m-r/pstree b/apparmor.d/groups/utils/pstree similarity index 100% rename from apparmor.d/profiles-m-r/pstree rename to apparmor.d/groups/utils/pstree diff --git a/apparmor.d/profiles-s-z/su b/apparmor.d/groups/utils/su similarity index 100% rename from apparmor.d/profiles-s-z/su rename to apparmor.d/groups/utils/su diff --git a/apparmor.d/profiles-s-z/sulogin b/apparmor.d/groups/utils/sulogin similarity index 100% rename from apparmor.d/profiles-s-z/sulogin rename to apparmor.d/groups/utils/sulogin diff --git a/apparmor.d/profiles-s-z/swapon b/apparmor.d/groups/utils/swapon similarity index 100% rename from apparmor.d/profiles-s-z/swapon rename to apparmor.d/groups/utils/swapon diff --git a/apparmor.d/profiles-s-z/sync b/apparmor.d/groups/utils/sync similarity index 100% rename from apparmor.d/profiles-s-z/sync rename to apparmor.d/groups/utils/sync diff --git a/apparmor.d/profiles-s-z/uname b/apparmor.d/groups/utils/uname similarity index 100% rename from apparmor.d/profiles-s-z/uname rename to apparmor.d/groups/utils/uname diff --git a/apparmor.d/profiles-s-z/users b/apparmor.d/groups/utils/users similarity index 100% rename from apparmor.d/profiles-s-z/users rename to apparmor.d/groups/utils/users diff --git a/apparmor.d/profiles-s-z/uuidd b/apparmor.d/groups/utils/uuidd similarity index 100% rename from apparmor.d/profiles-s-z/uuidd rename to apparmor.d/groups/utils/uuidd diff --git a/apparmor.d/profiles-s-z/uuidgen b/apparmor.d/groups/utils/uuidgen similarity index 100% rename from apparmor.d/profiles-s-z/uuidgen rename to apparmor.d/groups/utils/uuidgen diff --git a/apparmor.d/profiles-s-z/who b/apparmor.d/groups/utils/who similarity index 100% rename from apparmor.d/profiles-s-z/who rename to apparmor.d/groups/utils/who diff --git a/apparmor.d/groups/systemd/zramctl b/apparmor.d/groups/utils/zramctl similarity index 100% rename from apparmor.d/groups/systemd/zramctl rename to apparmor.d/groups/utils/zramctl From 33681e14f22c8738d04caa3e89433b643f6932fe Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 13 Feb 2025 19:12:48 +0100 Subject: [PATCH 0575/1455] refractor: tests/bats -> tests/integration --- .github/workflows/main.yml | 4 ++-- Makefile | 6 +++--- tests/{bats => integration}/aa-enforce.bats | 0 tests/{bats => integration}/aa-status.bats | 0 tests/{bats => integration}/blkid.bats | 0 tests/{bats => integration}/chsh.bats | 0 tests/{bats => integration}/common.bash | 0 tests/{bats => integration}/cpuid.bats | 0 tests/{bats => integration}/df.bats | 0 tests/{bats => integration}/dfc.bats | 0 tests/{bats => integration}/dmesg.bats | 0 tests/{bats => integration}/fc-cache.bats | 0 tests/{bats => integration}/fc-list.bats | 0 tests/{bats => integration}/flatpak.bats | 0 tests/{bats => integration}/fwupdmgr.bats | 0 tests/{bats => integration}/gpgconf.bats | 0 tests/{bats => integration}/groupadd.bats | 0 tests/{bats => integration}/groups.bats | 0 tests/{bats => integration}/homectl.bats | 0 tests/{bats => integration}/hostnamectl.bats | 0 tests/{bats => integration}/id.bats | 0 tests/{bats => integration}/ip.bats | 0 tests/{bats => integration}/lsblk.bats | 0 tests/{bats => integration}/lscpu.bats | 0 tests/{bats => integration}/lspci.bats | 0 tests/{bats => integration}/lsusb.bats | 0 tests/{bats => integration}/needrestart.bats | 0 tests/{bats => integration}/ps.bats | 0 tests/{bats => integration}/pstree.bats | 0 tests/{bats => integration}/snap.bats | 0 tests/{bats => integration}/sync.bats | 0 tests/{bats => integration}/sysctl.bats | 0 tests/{bats => integration}/systemd-ac-power.bats | 0 tests/{bats => integration}/systemd-analyze.bats | 0 tests/{bats => integration}/systemd-cat.bats | 0 tests/{bats => integration}/systemd-cgls.bats | 0 tests/{bats => integration}/systemd-detect-virt.bats | 0 tests/{bats => integration}/systemd-id128.bats | 0 tests/{bats => integration}/systemd-sysusers.bats | 0 tests/{bats => integration}/uname.bats | 0 tests/{bats => integration}/upower.bats | 0 tests/{bats => integration}/uptime.bats | 0 tests/{bats => integration}/useradd.bats | 0 tests/{bats => integration}/userdbctl.bats | 0 tests/{bats => integration}/users.bats | 0 tests/{bats => integration}/uuidd.bats | 0 tests/{bats => integration}/uuidgen.bats | 0 tests/{bats => integration}/w.bats | 0 tests/{bats => integration}/who.bats | 0 49 files changed, 5 insertions(+), 5 deletions(-) rename tests/{bats => integration}/aa-enforce.bats (100%) rename tests/{bats => integration}/aa-status.bats (100%) rename tests/{bats => integration}/blkid.bats (100%) rename tests/{bats => integration}/chsh.bats (100%) rename tests/{bats => integration}/common.bash (100%) rename tests/{bats => integration}/cpuid.bats (100%) rename tests/{bats => integration}/df.bats (100%) rename tests/{bats => integration}/dfc.bats (100%) rename tests/{bats => integration}/dmesg.bats (100%) rename tests/{bats => integration}/fc-cache.bats (100%) rename tests/{bats => integration}/fc-list.bats (100%) rename tests/{bats => integration}/flatpak.bats (100%) rename tests/{bats => integration}/fwupdmgr.bats (100%) rename tests/{bats => integration}/gpgconf.bats (100%) rename tests/{bats => integration}/groupadd.bats (100%) rename tests/{bats => integration}/groups.bats (100%) rename tests/{bats => integration}/homectl.bats (100%) rename tests/{bats => integration}/hostnamectl.bats (100%) rename tests/{bats => integration}/id.bats (100%) rename tests/{bats => integration}/ip.bats (100%) rename tests/{bats => integration}/lsblk.bats (100%) rename tests/{bats => integration}/lscpu.bats (100%) rename tests/{bats => integration}/lspci.bats (100%) rename tests/{bats => integration}/lsusb.bats (100%) rename tests/{bats => integration}/needrestart.bats (100%) rename tests/{bats => integration}/ps.bats (100%) rename tests/{bats => integration}/pstree.bats (100%) rename tests/{bats => integration}/snap.bats (100%) rename tests/{bats => integration}/sync.bats (100%) rename tests/{bats => integration}/sysctl.bats (100%) rename tests/{bats => integration}/systemd-ac-power.bats (100%) rename tests/{bats => integration}/systemd-analyze.bats (100%) rename tests/{bats => integration}/systemd-cat.bats (100%) rename tests/{bats => integration}/systemd-cgls.bats (100%) rename tests/{bats => integration}/systemd-detect-virt.bats (100%) rename tests/{bats => integration}/systemd-id128.bats (100%) rename tests/{bats => integration}/systemd-sysusers.bats (100%) rename tests/{bats => integration}/uname.bats (100%) rename tests/{bats => integration}/upower.bats (100%) rename tests/{bats => integration}/uptime.bats (100%) rename tests/{bats => integration}/useradd.bats (100%) rename tests/{bats => integration}/userdbctl.bats (100%) rename tests/{bats => integration}/users.bats (100%) rename tests/{bats => integration}/uuidd.bats (100%) rename tests/{bats => integration}/uuidgen.bats (100%) rename tests/{bats => integration}/w.bats (100%) rename tests/{bats => integration}/who.bats (100%) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 75fa5c051..c97229256 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -125,9 +125,9 @@ jobs: run: | bash tests/requirements.sh - - name: Run the bats integration tests + - name: Run the integration tests run: | - make bats + make integration - name: Show final AppArmor logs if: always() diff --git a/Makefile b/Makefile index 7de055c9f..90dacd5c0 100644 --- a/Makefile +++ b/Makefile @@ -111,9 +111,9 @@ lint: check: @bash tests/check.sh -.PHONY: bats -bats: - @bats --timing --print-output-on-failure tests/bats/ +.PHONY: integration +integration : + @bats --timing --print-output-on-failure tests/integration/ .PHONY: manual manual: diff --git a/tests/bats/aa-enforce.bats b/tests/integration/aa-enforce.bats similarity index 100% rename from tests/bats/aa-enforce.bats rename to tests/integration/aa-enforce.bats diff --git a/tests/bats/aa-status.bats b/tests/integration/aa-status.bats similarity index 100% rename from tests/bats/aa-status.bats rename to tests/integration/aa-status.bats diff --git a/tests/bats/blkid.bats b/tests/integration/blkid.bats similarity index 100% rename from tests/bats/blkid.bats rename to tests/integration/blkid.bats diff --git a/tests/bats/chsh.bats b/tests/integration/chsh.bats similarity index 100% rename from tests/bats/chsh.bats rename to tests/integration/chsh.bats diff --git a/tests/bats/common.bash b/tests/integration/common.bash similarity index 100% rename from tests/bats/common.bash rename to tests/integration/common.bash diff --git a/tests/bats/cpuid.bats b/tests/integration/cpuid.bats similarity index 100% rename from tests/bats/cpuid.bats rename to tests/integration/cpuid.bats diff --git a/tests/bats/df.bats b/tests/integration/df.bats similarity index 100% rename from tests/bats/df.bats rename to tests/integration/df.bats diff --git a/tests/bats/dfc.bats b/tests/integration/dfc.bats similarity index 100% rename from tests/bats/dfc.bats rename to tests/integration/dfc.bats diff --git a/tests/bats/dmesg.bats b/tests/integration/dmesg.bats similarity index 100% rename from tests/bats/dmesg.bats rename to tests/integration/dmesg.bats diff --git a/tests/bats/fc-cache.bats b/tests/integration/fc-cache.bats similarity index 100% rename from tests/bats/fc-cache.bats rename to tests/integration/fc-cache.bats diff --git a/tests/bats/fc-list.bats b/tests/integration/fc-list.bats similarity index 100% rename from tests/bats/fc-list.bats rename to tests/integration/fc-list.bats diff --git a/tests/bats/flatpak.bats b/tests/integration/flatpak.bats similarity index 100% rename from tests/bats/flatpak.bats rename to tests/integration/flatpak.bats diff --git a/tests/bats/fwupdmgr.bats b/tests/integration/fwupdmgr.bats similarity index 100% rename from tests/bats/fwupdmgr.bats rename to tests/integration/fwupdmgr.bats diff --git a/tests/bats/gpgconf.bats b/tests/integration/gpgconf.bats similarity index 100% rename from tests/bats/gpgconf.bats rename to tests/integration/gpgconf.bats diff --git a/tests/bats/groupadd.bats b/tests/integration/groupadd.bats similarity index 100% rename from tests/bats/groupadd.bats rename to tests/integration/groupadd.bats diff --git a/tests/bats/groups.bats b/tests/integration/groups.bats similarity index 100% rename from tests/bats/groups.bats rename to tests/integration/groups.bats diff --git a/tests/bats/homectl.bats b/tests/integration/homectl.bats similarity index 100% rename from tests/bats/homectl.bats rename to tests/integration/homectl.bats diff --git a/tests/bats/hostnamectl.bats b/tests/integration/hostnamectl.bats similarity index 100% rename from tests/bats/hostnamectl.bats rename to tests/integration/hostnamectl.bats diff --git a/tests/bats/id.bats b/tests/integration/id.bats similarity index 100% rename from tests/bats/id.bats rename to tests/integration/id.bats diff --git a/tests/bats/ip.bats b/tests/integration/ip.bats similarity index 100% rename from tests/bats/ip.bats rename to tests/integration/ip.bats diff --git a/tests/bats/lsblk.bats b/tests/integration/lsblk.bats similarity index 100% rename from tests/bats/lsblk.bats rename to tests/integration/lsblk.bats diff --git a/tests/bats/lscpu.bats b/tests/integration/lscpu.bats similarity index 100% rename from tests/bats/lscpu.bats rename to tests/integration/lscpu.bats diff --git a/tests/bats/lspci.bats b/tests/integration/lspci.bats similarity index 100% rename from tests/bats/lspci.bats rename to tests/integration/lspci.bats diff --git a/tests/bats/lsusb.bats b/tests/integration/lsusb.bats similarity index 100% rename from tests/bats/lsusb.bats rename to tests/integration/lsusb.bats diff --git a/tests/bats/needrestart.bats b/tests/integration/needrestart.bats similarity index 100% rename from tests/bats/needrestart.bats rename to tests/integration/needrestart.bats diff --git a/tests/bats/ps.bats b/tests/integration/ps.bats similarity index 100% rename from tests/bats/ps.bats rename to tests/integration/ps.bats diff --git a/tests/bats/pstree.bats b/tests/integration/pstree.bats similarity index 100% rename from tests/bats/pstree.bats rename to tests/integration/pstree.bats diff --git a/tests/bats/snap.bats b/tests/integration/snap.bats similarity index 100% rename from tests/bats/snap.bats rename to tests/integration/snap.bats diff --git a/tests/bats/sync.bats b/tests/integration/sync.bats similarity index 100% rename from tests/bats/sync.bats rename to tests/integration/sync.bats diff --git a/tests/bats/sysctl.bats b/tests/integration/sysctl.bats similarity index 100% rename from tests/bats/sysctl.bats rename to tests/integration/sysctl.bats diff --git a/tests/bats/systemd-ac-power.bats b/tests/integration/systemd-ac-power.bats similarity index 100% rename from tests/bats/systemd-ac-power.bats rename to tests/integration/systemd-ac-power.bats diff --git a/tests/bats/systemd-analyze.bats b/tests/integration/systemd-analyze.bats similarity index 100% rename from tests/bats/systemd-analyze.bats rename to tests/integration/systemd-analyze.bats diff --git a/tests/bats/systemd-cat.bats b/tests/integration/systemd-cat.bats similarity index 100% rename from tests/bats/systemd-cat.bats rename to tests/integration/systemd-cat.bats diff --git a/tests/bats/systemd-cgls.bats b/tests/integration/systemd-cgls.bats similarity index 100% rename from tests/bats/systemd-cgls.bats rename to tests/integration/systemd-cgls.bats diff --git a/tests/bats/systemd-detect-virt.bats b/tests/integration/systemd-detect-virt.bats similarity index 100% rename from tests/bats/systemd-detect-virt.bats rename to tests/integration/systemd-detect-virt.bats diff --git a/tests/bats/systemd-id128.bats b/tests/integration/systemd-id128.bats similarity index 100% rename from tests/bats/systemd-id128.bats rename to tests/integration/systemd-id128.bats diff --git a/tests/bats/systemd-sysusers.bats b/tests/integration/systemd-sysusers.bats similarity index 100% rename from tests/bats/systemd-sysusers.bats rename to tests/integration/systemd-sysusers.bats diff --git a/tests/bats/uname.bats b/tests/integration/uname.bats similarity index 100% rename from tests/bats/uname.bats rename to tests/integration/uname.bats diff --git a/tests/bats/upower.bats b/tests/integration/upower.bats similarity index 100% rename from tests/bats/upower.bats rename to tests/integration/upower.bats diff --git a/tests/bats/uptime.bats b/tests/integration/uptime.bats similarity index 100% rename from tests/bats/uptime.bats rename to tests/integration/uptime.bats diff --git a/tests/bats/useradd.bats b/tests/integration/useradd.bats similarity index 100% rename from tests/bats/useradd.bats rename to tests/integration/useradd.bats diff --git a/tests/bats/userdbctl.bats b/tests/integration/userdbctl.bats similarity index 100% rename from tests/bats/userdbctl.bats rename to tests/integration/userdbctl.bats diff --git a/tests/bats/users.bats b/tests/integration/users.bats similarity index 100% rename from tests/bats/users.bats rename to tests/integration/users.bats diff --git a/tests/bats/uuidd.bats b/tests/integration/uuidd.bats similarity index 100% rename from tests/bats/uuidd.bats rename to tests/integration/uuidd.bats diff --git a/tests/bats/uuidgen.bats b/tests/integration/uuidgen.bats similarity index 100% rename from tests/bats/uuidgen.bats rename to tests/integration/uuidgen.bats diff --git a/tests/bats/w.bats b/tests/integration/w.bats similarity index 100% rename from tests/bats/w.bats rename to tests/integration/w.bats diff --git a/tests/bats/who.bats b/tests/integration/who.bats similarity index 100% rename from tests/bats/who.bats rename to tests/integration/who.bats From 8ba3dbd90f63758a2b89bffd587d7a6897b741e5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 15 Feb 2025 16:09:52 +0100 Subject: [PATCH 0576/1455] refractor: move more profiles to groups. --- apparmor.d/{profiles-a-f => groups/bluetooth}/blueman | 0 apparmor.d/{profiles-a-f => groups/bluetooth}/blueman-mechanism | 0 .../{profiles-a-f => groups/bluetooth}/blueman-rfcomm-watcher | 2 +- apparmor.d/{profiles-a-f => groups/bluetooth}/bluemoon | 0 apparmor.d/{profiles-a-f => groups/bluetooth}/bluetoothctl | 0 apparmor.d/{profiles-a-f => groups/bluetooth}/bluetoothd | 0 .../{profiles-m-r => groups/bluetooth}/obex-folder-listing | 0 apparmor.d/{profiles-m-r => groups/bluetooth}/obexautofs | 0 apparmor.d/{profiles-m-r => groups/bluetooth}/obexctl | 0 apparmor.d/{profiles-m-r => groups/bluetooth}/obexd | 0 apparmor.d/{profiles-m-r => groups/bluetooth}/obexfs | 0 apparmor.d/{profiles-m-r => groups/bluetooth}/obexpush-atd | 0 apparmor.d/{profiles-m-r => groups/bluetooth}/obexpushd | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mke2fs | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mkfs-btrfs | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mkfs-fat | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mkntfs | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mkswap | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mount | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mount-cifs | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mount-nfs | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mount-zfs | 0 apparmor.d/{profiles-a-f => groups/firewall}/firewall-applet | 0 apparmor.d/{profiles-a-f => groups/firewall}/firewall-config | 0 apparmor.d/{profiles-a-f => groups/firewall}/firewalld | 0 apparmor.d/{profiles-m-r => groups/firewall}/nft | 0 apparmor.d/{profiles-s-z => groups/firewall}/ufw | 0 apparmor.d/{profiles-a-f => groups/freedesktop}/boltd | 0 apparmor.d/{profiles-s-z => groups/freedesktop}/wireplumber | 0 apparmor.d/{profiles-g-l => groups/usb}/lsusb | 2 +- apparmor.d/{profiles-s-z => groups/usb}/usb-devices | 1 + apparmor.d/{profiles-s-z => groups/usb}/usbguard | 0 apparmor.d/{profiles-s-z => groups/usb}/usbguard-applet-qt | 0 apparmor.d/{profiles-s-z => groups/usb}/usbguard-daemon | 0 apparmor.d/{profiles-s-z => groups/usb}/usbguard-dbus | 0 apparmor.d/{profiles-s-z => groups/usb}/usbguard-notifier | 0 apparmor.d/{profiles-a-f => groups/utils}/dmesg | 0 apparmor.d/{profiles-s-z => groups/utils}/whereis | 0 38 files changed, 3 insertions(+), 2 deletions(-) rename apparmor.d/{profiles-a-f => groups/bluetooth}/blueman (100%) rename apparmor.d/{profiles-a-f => groups/bluetooth}/blueman-mechanism (100%) rename apparmor.d/{profiles-a-f => groups/bluetooth}/blueman-rfcomm-watcher (86%) rename apparmor.d/{profiles-a-f => groups/bluetooth}/bluemoon (100%) rename apparmor.d/{profiles-a-f => groups/bluetooth}/bluetoothctl (100%) rename apparmor.d/{profiles-a-f => groups/bluetooth}/bluetoothd (100%) rename apparmor.d/{profiles-m-r => groups/bluetooth}/obex-folder-listing (100%) rename apparmor.d/{profiles-m-r => groups/bluetooth}/obexautofs (100%) rename apparmor.d/{profiles-m-r => groups/bluetooth}/obexctl (100%) rename apparmor.d/{profiles-m-r => groups/bluetooth}/obexd (100%) rename apparmor.d/{profiles-m-r => groups/bluetooth}/obexfs (100%) rename apparmor.d/{profiles-m-r => groups/bluetooth}/obexpush-atd (100%) rename apparmor.d/{profiles-m-r => groups/bluetooth}/obexpushd (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mke2fs (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mkfs-btrfs (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mkfs-fat (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mkntfs (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mkswap (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mount (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mount-cifs (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mount-nfs (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mount-zfs (100%) rename apparmor.d/{profiles-a-f => groups/firewall}/firewall-applet (100%) rename apparmor.d/{profiles-a-f => groups/firewall}/firewall-config (100%) rename apparmor.d/{profiles-a-f => groups/firewall}/firewalld (100%) rename apparmor.d/{profiles-m-r => groups/firewall}/nft (100%) rename apparmor.d/{profiles-s-z => groups/firewall}/ufw (100%) rename apparmor.d/{profiles-a-f => groups/freedesktop}/boltd (100%) rename apparmor.d/{profiles-s-z => groups/freedesktop}/wireplumber (100%) rename apparmor.d/{profiles-g-l => groups/usb}/lsusb (92%) rename apparmor.d/{profiles-s-z => groups/usb}/usb-devices (96%) rename apparmor.d/{profiles-s-z => groups/usb}/usbguard (100%) rename apparmor.d/{profiles-s-z => groups/usb}/usbguard-applet-qt (100%) rename apparmor.d/{profiles-s-z => groups/usb}/usbguard-daemon (100%) rename apparmor.d/{profiles-s-z => groups/usb}/usbguard-dbus (100%) rename apparmor.d/{profiles-s-z => groups/usb}/usbguard-notifier (100%) rename apparmor.d/{profiles-a-f => groups/utils}/dmesg (100%) rename apparmor.d/{profiles-s-z => groups/utils}/whereis (100%) diff --git a/apparmor.d/profiles-a-f/blueman b/apparmor.d/groups/bluetooth/blueman similarity index 100% rename from apparmor.d/profiles-a-f/blueman rename to apparmor.d/groups/bluetooth/blueman diff --git a/apparmor.d/profiles-a-f/blueman-mechanism b/apparmor.d/groups/bluetooth/blueman-mechanism similarity index 100% rename from apparmor.d/profiles-a-f/blueman-mechanism rename to apparmor.d/groups/bluetooth/blueman-mechanism diff --git a/apparmor.d/profiles-a-f/blueman-rfcomm-watcher b/apparmor.d/groups/bluetooth/blueman-rfcomm-watcher similarity index 86% rename from apparmor.d/profiles-a-f/blueman-rfcomm-watcher rename to apparmor.d/groups/bluetooth/blueman-rfcomm-watcher index 516f14bdd..639e475ac 100644 --- a/apparmor.d/profiles-a-f/blueman-rfcomm-watcher +++ b/apparmor.d/groups/bluetooth/blueman-rfcomm-watcher @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{lib}/blueman-rfcomm-watcher +@{exec_path} = @{lib}/blueman-mechanism @{lib}/blueman/blueman-rfcomm-watcher profile blueman-rfcomm-watcher @{exec_path} { include include diff --git a/apparmor.d/profiles-a-f/bluemoon b/apparmor.d/groups/bluetooth/bluemoon similarity index 100% rename from apparmor.d/profiles-a-f/bluemoon rename to apparmor.d/groups/bluetooth/bluemoon diff --git a/apparmor.d/profiles-a-f/bluetoothctl b/apparmor.d/groups/bluetooth/bluetoothctl similarity index 100% rename from apparmor.d/profiles-a-f/bluetoothctl rename to apparmor.d/groups/bluetooth/bluetoothctl diff --git a/apparmor.d/profiles-a-f/bluetoothd b/apparmor.d/groups/bluetooth/bluetoothd similarity index 100% rename from apparmor.d/profiles-a-f/bluetoothd rename to apparmor.d/groups/bluetooth/bluetoothd diff --git a/apparmor.d/profiles-m-r/obex-folder-listing b/apparmor.d/groups/bluetooth/obex-folder-listing similarity index 100% rename from apparmor.d/profiles-m-r/obex-folder-listing rename to apparmor.d/groups/bluetooth/obex-folder-listing diff --git a/apparmor.d/profiles-m-r/obexautofs b/apparmor.d/groups/bluetooth/obexautofs similarity index 100% rename from apparmor.d/profiles-m-r/obexautofs rename to apparmor.d/groups/bluetooth/obexautofs diff --git a/apparmor.d/profiles-m-r/obexctl b/apparmor.d/groups/bluetooth/obexctl similarity index 100% rename from apparmor.d/profiles-m-r/obexctl rename to apparmor.d/groups/bluetooth/obexctl diff --git a/apparmor.d/profiles-m-r/obexd b/apparmor.d/groups/bluetooth/obexd similarity index 100% rename from apparmor.d/profiles-m-r/obexd rename to apparmor.d/groups/bluetooth/obexd diff --git a/apparmor.d/profiles-m-r/obexfs b/apparmor.d/groups/bluetooth/obexfs similarity index 100% rename from apparmor.d/profiles-m-r/obexfs rename to apparmor.d/groups/bluetooth/obexfs diff --git a/apparmor.d/profiles-m-r/obexpush-atd b/apparmor.d/groups/bluetooth/obexpush-atd similarity index 100% rename from apparmor.d/profiles-m-r/obexpush-atd rename to apparmor.d/groups/bluetooth/obexpush-atd diff --git a/apparmor.d/profiles-m-r/obexpushd b/apparmor.d/groups/bluetooth/obexpushd similarity index 100% rename from apparmor.d/profiles-m-r/obexpushd rename to apparmor.d/groups/bluetooth/obexpushd diff --git a/apparmor.d/profiles-m-r/mke2fs b/apparmor.d/groups/filesystem/mke2fs similarity index 100% rename from apparmor.d/profiles-m-r/mke2fs rename to apparmor.d/groups/filesystem/mke2fs diff --git a/apparmor.d/profiles-m-r/mkfs-btrfs b/apparmor.d/groups/filesystem/mkfs-btrfs similarity index 100% rename from apparmor.d/profiles-m-r/mkfs-btrfs rename to apparmor.d/groups/filesystem/mkfs-btrfs diff --git a/apparmor.d/profiles-m-r/mkfs-fat b/apparmor.d/groups/filesystem/mkfs-fat similarity index 100% rename from apparmor.d/profiles-m-r/mkfs-fat rename to apparmor.d/groups/filesystem/mkfs-fat diff --git a/apparmor.d/profiles-m-r/mkntfs b/apparmor.d/groups/filesystem/mkntfs similarity index 100% rename from apparmor.d/profiles-m-r/mkntfs rename to apparmor.d/groups/filesystem/mkntfs diff --git a/apparmor.d/profiles-m-r/mkswap b/apparmor.d/groups/filesystem/mkswap similarity index 100% rename from apparmor.d/profiles-m-r/mkswap rename to apparmor.d/groups/filesystem/mkswap diff --git a/apparmor.d/profiles-m-r/mount b/apparmor.d/groups/filesystem/mount similarity index 100% rename from apparmor.d/profiles-m-r/mount rename to apparmor.d/groups/filesystem/mount diff --git a/apparmor.d/profiles-m-r/mount-cifs b/apparmor.d/groups/filesystem/mount-cifs similarity index 100% rename from apparmor.d/profiles-m-r/mount-cifs rename to apparmor.d/groups/filesystem/mount-cifs diff --git a/apparmor.d/profiles-m-r/mount-nfs b/apparmor.d/groups/filesystem/mount-nfs similarity index 100% rename from apparmor.d/profiles-m-r/mount-nfs rename to apparmor.d/groups/filesystem/mount-nfs diff --git a/apparmor.d/profiles-m-r/mount-zfs b/apparmor.d/groups/filesystem/mount-zfs similarity index 100% rename from apparmor.d/profiles-m-r/mount-zfs rename to apparmor.d/groups/filesystem/mount-zfs diff --git a/apparmor.d/profiles-a-f/firewall-applet b/apparmor.d/groups/firewall/firewall-applet similarity index 100% rename from apparmor.d/profiles-a-f/firewall-applet rename to apparmor.d/groups/firewall/firewall-applet diff --git a/apparmor.d/profiles-a-f/firewall-config b/apparmor.d/groups/firewall/firewall-config similarity index 100% rename from apparmor.d/profiles-a-f/firewall-config rename to apparmor.d/groups/firewall/firewall-config diff --git a/apparmor.d/profiles-a-f/firewalld b/apparmor.d/groups/firewall/firewalld similarity index 100% rename from apparmor.d/profiles-a-f/firewalld rename to apparmor.d/groups/firewall/firewalld diff --git a/apparmor.d/profiles-m-r/nft b/apparmor.d/groups/firewall/nft similarity index 100% rename from apparmor.d/profiles-m-r/nft rename to apparmor.d/groups/firewall/nft diff --git a/apparmor.d/profiles-s-z/ufw b/apparmor.d/groups/firewall/ufw similarity index 100% rename from apparmor.d/profiles-s-z/ufw rename to apparmor.d/groups/firewall/ufw diff --git a/apparmor.d/profiles-a-f/boltd b/apparmor.d/groups/freedesktop/boltd similarity index 100% rename from apparmor.d/profiles-a-f/boltd rename to apparmor.d/groups/freedesktop/boltd diff --git a/apparmor.d/profiles-s-z/wireplumber b/apparmor.d/groups/freedesktop/wireplumber similarity index 100% rename from apparmor.d/profiles-s-z/wireplumber rename to apparmor.d/groups/freedesktop/wireplumber diff --git a/apparmor.d/profiles-g-l/lsusb b/apparmor.d/groups/usb/lsusb similarity index 92% rename from apparmor.d/profiles-g-l/lsusb rename to apparmor.d/groups/usb/lsusb index 40e902a87..f824343d6 100644 --- a/apparmor.d/profiles-g-l/lsusb +++ b/apparmor.d/groups/usb/lsusb @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/lsusb +@{exec_path} = @{bin}/lsusb @{bin}/lsusb.py profile lsusb @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/usb-devices b/apparmor.d/groups/usb/usb-devices similarity index 96% rename from apparmor.d/profiles-s-z/usb-devices rename to apparmor.d/groups/usb/usb-devices index c67b78faf..59ff12feb 100644 --- a/apparmor.d/profiles-s-z/usb-devices +++ b/apparmor.d/groups/usb/usb-devices @@ -22,6 +22,7 @@ profile usb-devices @{exec_path} { @{bin}/{,e}grep rix, @{bin}/basename rix, @{bin}/cat rix, + @{bin}/sed rix, @{bin}/cut rix, @{bin}/find rix, @{bin}/readlink rix, diff --git a/apparmor.d/profiles-s-z/usbguard b/apparmor.d/groups/usb/usbguard similarity index 100% rename from apparmor.d/profiles-s-z/usbguard rename to apparmor.d/groups/usb/usbguard diff --git a/apparmor.d/profiles-s-z/usbguard-applet-qt b/apparmor.d/groups/usb/usbguard-applet-qt similarity index 100% rename from apparmor.d/profiles-s-z/usbguard-applet-qt rename to apparmor.d/groups/usb/usbguard-applet-qt diff --git a/apparmor.d/profiles-s-z/usbguard-daemon b/apparmor.d/groups/usb/usbguard-daemon similarity index 100% rename from apparmor.d/profiles-s-z/usbguard-daemon rename to apparmor.d/groups/usb/usbguard-daemon diff --git a/apparmor.d/profiles-s-z/usbguard-dbus b/apparmor.d/groups/usb/usbguard-dbus similarity index 100% rename from apparmor.d/profiles-s-z/usbguard-dbus rename to apparmor.d/groups/usb/usbguard-dbus diff --git a/apparmor.d/profiles-s-z/usbguard-notifier b/apparmor.d/groups/usb/usbguard-notifier similarity index 100% rename from apparmor.d/profiles-s-z/usbguard-notifier rename to apparmor.d/groups/usb/usbguard-notifier diff --git a/apparmor.d/profiles-a-f/dmesg b/apparmor.d/groups/utils/dmesg similarity index 100% rename from apparmor.d/profiles-a-f/dmesg rename to apparmor.d/groups/utils/dmesg diff --git a/apparmor.d/profiles-s-z/whereis b/apparmor.d/groups/utils/whereis similarity index 100% rename from apparmor.d/profiles-s-z/whereis rename to apparmor.d/groups/utils/whereis From 5aab9da0308f209c27fc98ca5486c9cd2ee03e49 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 15 Feb 2025 16:38:07 +0100 Subject: [PATCH 0577/1455] fix(profile): blueman-rfcomm-watcher entrypoint. --- apparmor.d/groups/bluetooth/blueman-rfcomm-watcher | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/bluetooth/blueman-rfcomm-watcher b/apparmor.d/groups/bluetooth/blueman-rfcomm-watcher index 639e475ac..2d52a6e01 100644 --- a/apparmor.d/groups/bluetooth/blueman-rfcomm-watcher +++ b/apparmor.d/groups/bluetooth/blueman-rfcomm-watcher @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{lib}/blueman-mechanism @{lib}/blueman/blueman-rfcomm-watcher +@{exec_path} = @{lib}/blueman-rfcomm-watcher @{lib}/blueman/blueman-rfcomm-watcher profile blueman-rfcomm-watcher @{exec_path} { include include From 5870e1ee4026b28b9ffe0f232b1e1b900857e0bd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 17 Feb 2025 21:04:28 +0100 Subject: [PATCH 0578/1455] refractor: move more profiles to groups. --- apparmor.d/{profiles-a-f => groups/cap}/filecap | 0 apparmor.d/{profiles-m-r => groups/cap}/netcap | 0 apparmor.d/{profiles-m-r => groups/cap}/pscap | 0 apparmor.d/{profiles-a-f => groups/filesystem}/btrfs | 0 apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-convert | 0 apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-find-root | 0 apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-image | 0 apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-map-logical | 0 apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-select-super | 0 apparmor.d/{profiles-a-f => groups/filesystem}/btrfstune | 0 apparmor.d/{profiles-a-f => groups/filesystem}/fsck.btrfs | 0 apparmor.d/{profiles-a-f => groups/filesystem}/fsck.fat | 0 apparmor.d/{profiles-g-l => groups/filesystem}/lvm | 0 apparmor.d/{profiles-g-l => groups/filesystem}/lvmconfig | 0 apparmor.d/{profiles-g-l => groups/filesystem}/lvmdump | 0 apparmor.d/{profiles-g-l => groups/filesystem}/lvmpolld | 0 apparmor.d/{profiles-m-r => groups/filesystem}/mtools | 0 apparmor.d/{profiles-m-r => groups/filesystem}/nfsdcld | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfs-3g | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfs-3g-probe | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfscat | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsclone | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfscluster | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfscmp | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfscp | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsdecrypt | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsfallocate | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsfix | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsinfo | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfslabel | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsls | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsmove | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsrecover | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsresize | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfssecaudit | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfstruncate | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsundelete | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfsusermap | 0 apparmor.d/{profiles-m-r => groups/filesystem}/ntfswipe | 0 apparmor.d/{profiles-s-z => groups/filesystem}/udiskie | 0 apparmor.d/{profiles-s-z => groups/filesystem}/udiskie-info | 0 apparmor.d/{profiles-s-z => groups/filesystem}/udiskie-mount | 0 apparmor.d/{profiles-s-z => groups/filesystem}/udiskie-umount | 0 apparmor.d/{profiles-s-z => groups/filesystem}/udisksctl | 0 apparmor.d/{profiles-s-z => groups/filesystem}/udisksd | 0 apparmor.d/{profiles-s-z => groups/filesystem}/umount.udisks2 | 0 apparmor.d/{profiles-s-z => groups/utils}/swaplabel | 0 apparmor.d/{profiles-s-z => groups/utils}/umount | 0 48 files changed, 0 insertions(+), 0 deletions(-) rename apparmor.d/{profiles-a-f => groups/cap}/filecap (100%) rename apparmor.d/{profiles-m-r => groups/cap}/netcap (100%) rename apparmor.d/{profiles-m-r => groups/cap}/pscap (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/btrfs (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-convert (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-find-root (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-image (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-map-logical (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/btrfs-select-super (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/btrfstune (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/fsck.btrfs (100%) rename apparmor.d/{profiles-a-f => groups/filesystem}/fsck.fat (100%) rename apparmor.d/{profiles-g-l => groups/filesystem}/lvm (100%) rename apparmor.d/{profiles-g-l => groups/filesystem}/lvmconfig (100%) rename apparmor.d/{profiles-g-l => groups/filesystem}/lvmdump (100%) rename apparmor.d/{profiles-g-l => groups/filesystem}/lvmpolld (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/mtools (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/nfsdcld (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfs-3g (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfs-3g-probe (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfscat (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsclone (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfscluster (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfscmp (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfscp (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsdecrypt (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsfallocate (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsfix (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsinfo (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfslabel (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsls (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsmove (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsrecover (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsresize (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfssecaudit (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfstruncate (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsundelete (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfsusermap (100%) rename apparmor.d/{profiles-m-r => groups/filesystem}/ntfswipe (100%) rename apparmor.d/{profiles-s-z => groups/filesystem}/udiskie (100%) rename apparmor.d/{profiles-s-z => groups/filesystem}/udiskie-info (100%) rename apparmor.d/{profiles-s-z => groups/filesystem}/udiskie-mount (100%) rename apparmor.d/{profiles-s-z => groups/filesystem}/udiskie-umount (100%) rename apparmor.d/{profiles-s-z => groups/filesystem}/udisksctl (100%) rename apparmor.d/{profiles-s-z => groups/filesystem}/udisksd (100%) rename apparmor.d/{profiles-s-z => groups/filesystem}/umount.udisks2 (100%) rename apparmor.d/{profiles-s-z => groups/utils}/swaplabel (100%) rename apparmor.d/{profiles-s-z => groups/utils}/umount (100%) diff --git a/apparmor.d/profiles-a-f/filecap b/apparmor.d/groups/cap/filecap similarity index 100% rename from apparmor.d/profiles-a-f/filecap rename to apparmor.d/groups/cap/filecap diff --git a/apparmor.d/profiles-m-r/netcap b/apparmor.d/groups/cap/netcap similarity index 100% rename from apparmor.d/profiles-m-r/netcap rename to apparmor.d/groups/cap/netcap diff --git a/apparmor.d/profiles-m-r/pscap b/apparmor.d/groups/cap/pscap similarity index 100% rename from apparmor.d/profiles-m-r/pscap rename to apparmor.d/groups/cap/pscap diff --git a/apparmor.d/profiles-a-f/btrfs b/apparmor.d/groups/filesystem/btrfs similarity index 100% rename from apparmor.d/profiles-a-f/btrfs rename to apparmor.d/groups/filesystem/btrfs diff --git a/apparmor.d/profiles-a-f/btrfs-convert b/apparmor.d/groups/filesystem/btrfs-convert similarity index 100% rename from apparmor.d/profiles-a-f/btrfs-convert rename to apparmor.d/groups/filesystem/btrfs-convert diff --git a/apparmor.d/profiles-a-f/btrfs-find-root b/apparmor.d/groups/filesystem/btrfs-find-root similarity index 100% rename from apparmor.d/profiles-a-f/btrfs-find-root rename to apparmor.d/groups/filesystem/btrfs-find-root diff --git a/apparmor.d/profiles-a-f/btrfs-image b/apparmor.d/groups/filesystem/btrfs-image similarity index 100% rename from apparmor.d/profiles-a-f/btrfs-image rename to apparmor.d/groups/filesystem/btrfs-image diff --git a/apparmor.d/profiles-a-f/btrfs-map-logical b/apparmor.d/groups/filesystem/btrfs-map-logical similarity index 100% rename from apparmor.d/profiles-a-f/btrfs-map-logical rename to apparmor.d/groups/filesystem/btrfs-map-logical diff --git a/apparmor.d/profiles-a-f/btrfs-select-super b/apparmor.d/groups/filesystem/btrfs-select-super similarity index 100% rename from apparmor.d/profiles-a-f/btrfs-select-super rename to apparmor.d/groups/filesystem/btrfs-select-super diff --git a/apparmor.d/profiles-a-f/btrfstune b/apparmor.d/groups/filesystem/btrfstune similarity index 100% rename from apparmor.d/profiles-a-f/btrfstune rename to apparmor.d/groups/filesystem/btrfstune diff --git a/apparmor.d/profiles-a-f/fsck.btrfs b/apparmor.d/groups/filesystem/fsck.btrfs similarity index 100% rename from apparmor.d/profiles-a-f/fsck.btrfs rename to apparmor.d/groups/filesystem/fsck.btrfs diff --git a/apparmor.d/profiles-a-f/fsck.fat b/apparmor.d/groups/filesystem/fsck.fat similarity index 100% rename from apparmor.d/profiles-a-f/fsck.fat rename to apparmor.d/groups/filesystem/fsck.fat diff --git a/apparmor.d/profiles-g-l/lvm b/apparmor.d/groups/filesystem/lvm similarity index 100% rename from apparmor.d/profiles-g-l/lvm rename to apparmor.d/groups/filesystem/lvm diff --git a/apparmor.d/profiles-g-l/lvmconfig b/apparmor.d/groups/filesystem/lvmconfig similarity index 100% rename from apparmor.d/profiles-g-l/lvmconfig rename to apparmor.d/groups/filesystem/lvmconfig diff --git a/apparmor.d/profiles-g-l/lvmdump b/apparmor.d/groups/filesystem/lvmdump similarity index 100% rename from apparmor.d/profiles-g-l/lvmdump rename to apparmor.d/groups/filesystem/lvmdump diff --git a/apparmor.d/profiles-g-l/lvmpolld b/apparmor.d/groups/filesystem/lvmpolld similarity index 100% rename from apparmor.d/profiles-g-l/lvmpolld rename to apparmor.d/groups/filesystem/lvmpolld diff --git a/apparmor.d/profiles-m-r/mtools b/apparmor.d/groups/filesystem/mtools similarity index 100% rename from apparmor.d/profiles-m-r/mtools rename to apparmor.d/groups/filesystem/mtools diff --git a/apparmor.d/profiles-m-r/nfsdcld b/apparmor.d/groups/filesystem/nfsdcld similarity index 100% rename from apparmor.d/profiles-m-r/nfsdcld rename to apparmor.d/groups/filesystem/nfsdcld diff --git a/apparmor.d/profiles-m-r/ntfs-3g b/apparmor.d/groups/filesystem/ntfs-3g similarity index 100% rename from apparmor.d/profiles-m-r/ntfs-3g rename to apparmor.d/groups/filesystem/ntfs-3g diff --git a/apparmor.d/profiles-m-r/ntfs-3g-probe b/apparmor.d/groups/filesystem/ntfs-3g-probe similarity index 100% rename from apparmor.d/profiles-m-r/ntfs-3g-probe rename to apparmor.d/groups/filesystem/ntfs-3g-probe diff --git a/apparmor.d/profiles-m-r/ntfscat b/apparmor.d/groups/filesystem/ntfscat similarity index 100% rename from apparmor.d/profiles-m-r/ntfscat rename to apparmor.d/groups/filesystem/ntfscat diff --git a/apparmor.d/profiles-m-r/ntfsclone b/apparmor.d/groups/filesystem/ntfsclone similarity index 100% rename from apparmor.d/profiles-m-r/ntfsclone rename to apparmor.d/groups/filesystem/ntfsclone diff --git a/apparmor.d/profiles-m-r/ntfscluster b/apparmor.d/groups/filesystem/ntfscluster similarity index 100% rename from apparmor.d/profiles-m-r/ntfscluster rename to apparmor.d/groups/filesystem/ntfscluster diff --git a/apparmor.d/profiles-m-r/ntfscmp b/apparmor.d/groups/filesystem/ntfscmp similarity index 100% rename from apparmor.d/profiles-m-r/ntfscmp rename to apparmor.d/groups/filesystem/ntfscmp diff --git a/apparmor.d/profiles-m-r/ntfscp b/apparmor.d/groups/filesystem/ntfscp similarity index 100% rename from apparmor.d/profiles-m-r/ntfscp rename to apparmor.d/groups/filesystem/ntfscp diff --git a/apparmor.d/profiles-m-r/ntfsdecrypt b/apparmor.d/groups/filesystem/ntfsdecrypt similarity index 100% rename from apparmor.d/profiles-m-r/ntfsdecrypt rename to apparmor.d/groups/filesystem/ntfsdecrypt diff --git a/apparmor.d/profiles-m-r/ntfsfallocate b/apparmor.d/groups/filesystem/ntfsfallocate similarity index 100% rename from apparmor.d/profiles-m-r/ntfsfallocate rename to apparmor.d/groups/filesystem/ntfsfallocate diff --git a/apparmor.d/profiles-m-r/ntfsfix b/apparmor.d/groups/filesystem/ntfsfix similarity index 100% rename from apparmor.d/profiles-m-r/ntfsfix rename to apparmor.d/groups/filesystem/ntfsfix diff --git a/apparmor.d/profiles-m-r/ntfsinfo b/apparmor.d/groups/filesystem/ntfsinfo similarity index 100% rename from apparmor.d/profiles-m-r/ntfsinfo rename to apparmor.d/groups/filesystem/ntfsinfo diff --git a/apparmor.d/profiles-m-r/ntfslabel b/apparmor.d/groups/filesystem/ntfslabel similarity index 100% rename from apparmor.d/profiles-m-r/ntfslabel rename to apparmor.d/groups/filesystem/ntfslabel diff --git a/apparmor.d/profiles-m-r/ntfsls b/apparmor.d/groups/filesystem/ntfsls similarity index 100% rename from apparmor.d/profiles-m-r/ntfsls rename to apparmor.d/groups/filesystem/ntfsls diff --git a/apparmor.d/profiles-m-r/ntfsmove b/apparmor.d/groups/filesystem/ntfsmove similarity index 100% rename from apparmor.d/profiles-m-r/ntfsmove rename to apparmor.d/groups/filesystem/ntfsmove diff --git a/apparmor.d/profiles-m-r/ntfsrecover b/apparmor.d/groups/filesystem/ntfsrecover similarity index 100% rename from apparmor.d/profiles-m-r/ntfsrecover rename to apparmor.d/groups/filesystem/ntfsrecover diff --git a/apparmor.d/profiles-m-r/ntfsresize b/apparmor.d/groups/filesystem/ntfsresize similarity index 100% rename from apparmor.d/profiles-m-r/ntfsresize rename to apparmor.d/groups/filesystem/ntfsresize diff --git a/apparmor.d/profiles-m-r/ntfssecaudit b/apparmor.d/groups/filesystem/ntfssecaudit similarity index 100% rename from apparmor.d/profiles-m-r/ntfssecaudit rename to apparmor.d/groups/filesystem/ntfssecaudit diff --git a/apparmor.d/profiles-m-r/ntfstruncate b/apparmor.d/groups/filesystem/ntfstruncate similarity index 100% rename from apparmor.d/profiles-m-r/ntfstruncate rename to apparmor.d/groups/filesystem/ntfstruncate diff --git a/apparmor.d/profiles-m-r/ntfsundelete b/apparmor.d/groups/filesystem/ntfsundelete similarity index 100% rename from apparmor.d/profiles-m-r/ntfsundelete rename to apparmor.d/groups/filesystem/ntfsundelete diff --git a/apparmor.d/profiles-m-r/ntfsusermap b/apparmor.d/groups/filesystem/ntfsusermap similarity index 100% rename from apparmor.d/profiles-m-r/ntfsusermap rename to apparmor.d/groups/filesystem/ntfsusermap diff --git a/apparmor.d/profiles-m-r/ntfswipe b/apparmor.d/groups/filesystem/ntfswipe similarity index 100% rename from apparmor.d/profiles-m-r/ntfswipe rename to apparmor.d/groups/filesystem/ntfswipe diff --git a/apparmor.d/profiles-s-z/udiskie b/apparmor.d/groups/filesystem/udiskie similarity index 100% rename from apparmor.d/profiles-s-z/udiskie rename to apparmor.d/groups/filesystem/udiskie diff --git a/apparmor.d/profiles-s-z/udiskie-info b/apparmor.d/groups/filesystem/udiskie-info similarity index 100% rename from apparmor.d/profiles-s-z/udiskie-info rename to apparmor.d/groups/filesystem/udiskie-info diff --git a/apparmor.d/profiles-s-z/udiskie-mount b/apparmor.d/groups/filesystem/udiskie-mount similarity index 100% rename from apparmor.d/profiles-s-z/udiskie-mount rename to apparmor.d/groups/filesystem/udiskie-mount diff --git a/apparmor.d/profiles-s-z/udiskie-umount b/apparmor.d/groups/filesystem/udiskie-umount similarity index 100% rename from apparmor.d/profiles-s-z/udiskie-umount rename to apparmor.d/groups/filesystem/udiskie-umount diff --git a/apparmor.d/profiles-s-z/udisksctl b/apparmor.d/groups/filesystem/udisksctl similarity index 100% rename from apparmor.d/profiles-s-z/udisksctl rename to apparmor.d/groups/filesystem/udisksctl diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/groups/filesystem/udisksd similarity index 100% rename from apparmor.d/profiles-s-z/udisksd rename to apparmor.d/groups/filesystem/udisksd diff --git a/apparmor.d/profiles-s-z/umount.udisks2 b/apparmor.d/groups/filesystem/umount.udisks2 similarity index 100% rename from apparmor.d/profiles-s-z/umount.udisks2 rename to apparmor.d/groups/filesystem/umount.udisks2 diff --git a/apparmor.d/profiles-s-z/swaplabel b/apparmor.d/groups/utils/swaplabel similarity index 100% rename from apparmor.d/profiles-s-z/swaplabel rename to apparmor.d/groups/utils/swaplabel diff --git a/apparmor.d/profiles-s-z/umount b/apparmor.d/groups/utils/umount similarity index 100% rename from apparmor.d/profiles-s-z/umount rename to apparmor.d/groups/utils/umount From af85db9148b17bb37b4d73454e78d4efec4c2db9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 17 Feb 2025 21:28:40 +0100 Subject: [PATCH 0579/1455] refractor: use @{python_path} in all profiles. --- apparmor.d/groups/apt/apt-listchanges | 2 +- apparmor.d/groups/apt/command-not-found | 4 ++-- apparmor.d/groups/apt/debsecan | 2 +- apparmor.d/groups/apt/debtags | 2 +- apparmor.d/groups/apt/querybts | 2 +- apparmor.d/groups/apt/reportbug | 4 ++-- apparmor.d/groups/apt/unattended-upgrade | 2 +- apparmor.d/groups/apt/update-apt-xapian-index | 2 +- apparmor.d/groups/bus/ibus-engine-table | 2 +- apparmor.d/groups/cups/cupsd | 2 +- apparmor.d/groups/filesystem/udiskie | 2 +- apparmor.d/groups/filesystem/udiskie-info | 2 +- apparmor.d/groups/filesystem/udiskie-mount | 2 +- apparmor.d/groups/filesystem/udiskie-umount | 2 +- apparmor.d/groups/firewall/firewall-applet | 2 +- apparmor.d/groups/firewall/firewalld | 2 +- apparmor.d/groups/firewall/ufw | 2 +- apparmor.d/groups/gnome/gnome-browser-connector-host | 4 ++-- apparmor.d/groups/gnome/gnome-music | 4 ++-- apparmor.d/groups/gnome/gnome-tweaks | 4 ++-- apparmor.d/groups/kde/kconf_update | 2 +- apparmor.d/groups/kde/kded | 2 +- apparmor.d/groups/network/nm-dispatcher | 2 +- apparmor.d/groups/pacman/pacman-hook-code | 2 +- apparmor.d/groups/steam/steam-game-proton | 2 +- apparmor.d/groups/ubuntu/apport-checkreports | 2 +- apparmor.d/groups/ubuntu/check-new-release-gtk | 4 ++-- apparmor.d/groups/ubuntu/list-oem-metapackages | 2 +- apparmor.d/groups/ubuntu/software-properties-dbus | 2 +- apparmor.d/groups/ubuntu/software-properties-gtk | 2 +- apparmor.d/groups/ubuntu/update-manager | 6 +++--- apparmor.d/groups/ubuntu/update-motd-updates-available | 2 +- apparmor.d/groups/ubuntu/update-notifier | 2 +- apparmor.d/groups/virt/cockpit-bridge | 2 +- apparmor.d/groups/whonix/sdwdate-gui | 2 +- apparmor.d/profiles-a-f/alacarte | 4 ++-- apparmor.d/profiles-a-f/arandr | 2 +- apparmor.d/profiles-a-f/borg | 2 +- apparmor.d/profiles-a-f/convertall | 2 +- apparmor.d/profiles-a-f/execute-dcut | 2 +- apparmor.d/profiles-a-f/execute-dput | 2 +- apparmor.d/profiles-a-f/fail2ban-client | 2 +- apparmor.d/profiles-a-f/fail2ban-server | 2 +- apparmor.d/profiles-g-l/gajim | 2 +- apparmor.d/profiles-g-l/ganyremote | 2 +- apparmor.d/profiles-g-l/gpo | 2 +- apparmor.d/profiles-g-l/gpodder | 2 +- apparmor.d/profiles-g-l/gpodder-migrate2tres | 2 +- apparmor.d/profiles-g-l/hardinfo | 2 +- apparmor.d/profiles-g-l/hypnotix | 2 +- apparmor.d/profiles-g-l/install-printerdriver | 2 +- apparmor.d/profiles-g-l/iotop | 2 +- apparmor.d/profiles-g-l/kconfig-hardened-check | 2 +- apparmor.d/profiles-m-r/metadata-cleaner | 2 +- apparmor.d/profiles-m-r/mpsyt | 2 +- apparmor.d/profiles-m-r/needrestart | 4 ++-- apparmor.d/profiles-m-r/obamenu | 2 +- apparmor.d/profiles-m-r/openbox | 2 +- apparmor.d/profiles-m-r/pass | 2 +- apparmor.d/profiles-m-r/pass-import | 2 +- apparmor.d/profiles-m-r/ps-mem | 2 +- apparmor.d/profiles-m-r/qbittorrent | 6 +++--- apparmor.d/profiles-m-r/repo | 2 +- apparmor.d/profiles-m-r/rustdesk | 6 +++--- apparmor.d/profiles-s-z/speedtest | 2 +- apparmor.d/profiles-s-z/system-config-printer | 2 +- apparmor.d/profiles-s-z/system-config-printer-applet | 2 +- apparmor.d/profiles-s-z/terminator | 2 +- apparmor.d/profiles-s-z/update-command-not-found | 2 +- apparmor.d/profiles-s-z/vcsi | 2 +- apparmor.d/profiles-s-z/vidcutter | 2 +- apparmor.d/profiles-s-z/virt-manager | 4 ++-- apparmor.d/profiles-s-z/wsdd | 2 +- apparmor.d/profiles-s-z/youtube-dl | 2 +- apparmor.d/profiles-s-z/yt-dlp | 2 +- apparmor.d/profiles-s-z/ytdl | 2 +- apparmor.d/profiles-s-z/zenmap | 2 +- 77 files changed, 92 insertions(+), 92 deletions(-) diff --git a/apparmor.d/groups/apt/apt-listchanges b/apparmor.d/groups/apt/apt-listchanges index 89cf63067..dbbba9d4d 100644 --- a/apparmor.d/groups/apt/apt-listchanges +++ b/apparmor.d/groups/apt/apt-listchanges @@ -17,7 +17,7 @@ profile apt-listchanges @{exec_path} { #capability sys_tty_config, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{sh_path} rix, diff --git a/apparmor.d/groups/apt/command-not-found b/apparmor.d/groups/apt/command-not-found index e6c0fdee6..1ba7b5cb3 100644 --- a/apparmor.d/groups/apt/command-not-found +++ b/apparmor.d/groups/apt/command-not-found @@ -18,12 +18,12 @@ profile command-not-found @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/lsb_release rPx -> lsb_release, @{bin}/snap rPUx, - @{lib}/python3/dist-packages/CommandNotFound/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, + @{lib}/@{python_name}/dist-packages/CommandNotFound/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, @{lib}/ r, diff --git a/apparmor.d/groups/apt/debsecan b/apparmor.d/groups/apt/debsecan index ee29b4923..c9448c7fb 100644 --- a/apparmor.d/groups/apt/debsecan +++ b/apparmor.d/groups/apt/debsecan @@ -21,7 +21,7 @@ profile debsecan @{exec_path} { network inet6 stream, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{sh_path} rix, diff --git a/apparmor.d/groups/apt/debtags b/apparmor.d/groups/apt/debtags index 8bda4efff..3e3fd2ab9 100644 --- a/apparmor.d/groups/apt/debtags +++ b/apparmor.d/groups/apt/debtags @@ -17,7 +17,7 @@ profile debtags @{exec_path} { #capability sys_tty_config, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/dpkg rPx -> child-dpkg, diff --git a/apparmor.d/groups/apt/querybts b/apparmor.d/groups/apt/querybts index 5c46246a2..85bd2e6c3 100644 --- a/apparmor.d/groups/apt/querybts +++ b/apparmor.d/groups/apt/querybts @@ -26,7 +26,7 @@ profile querybts @{exec_path} { network netlink raw, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{sh_path} rix, diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index 8681e46d8..ae2e64e5d 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -28,7 +28,7 @@ profile reportbug @{exec_path} { @{exec_path} r, @{bin}/ r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ldconfig rix, @{bin}/selinuxenabled rix, @@ -57,7 +57,7 @@ profile reportbug @{exec_path} { @{bin}/run-parts rCx -> run-parts, @{open_path} rPx -> child-open, - @{lib}/python3/dist-packages/pylocales/locales.db rk, + @{lib}/@{python_name}/dist-packages/pylocales/locales.db rk, /usr/share/bug/*/{control,presubj} r, diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index ead68957a..dbbfb413e 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -43,7 +43,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { @{bin}/echo rix, @{bin}/gdbus rix, @{bin}/ischroot rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/test rix, @{bin}/touch rix, @{bin}/uname rix, diff --git a/apparmor.d/groups/apt/update-apt-xapian-index b/apparmor.d/groups/apt/update-apt-xapian-index index 15af33d88..5da82090f 100644 --- a/apparmor.d/groups/apt/update-apt-xapian-index +++ b/apparmor.d/groups/apt/update-apt-xapian-index @@ -14,7 +14,7 @@ profile update-apt-xapian-index @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/dpkg rPx -> child-dpkg, diff --git a/apparmor.d/groups/bus/ibus-engine-table b/apparmor.d/groups/bus/ibus-engine-table index 5182b0dca..abe0d22c0 100644 --- a/apparmor.d/groups/bus/ibus-engine-table +++ b/apparmor.d/groups/bus/ibus-engine-table @@ -14,7 +14,7 @@ profile ibus-engine-table @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, /usr/share/ibus-table/engine/{,**} r, /usr/share/ibus-table/tables/ r, diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index f65fc8349..697a307f9 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -57,7 +57,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { @{bin}/ippfind rix, @{bin}/mktemp rix, @{bin}/printenv rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/rm rix, @{bin}/sed rix, @{bin}/smbspool rPx, diff --git a/apparmor.d/groups/filesystem/udiskie b/apparmor.d/groups/filesystem/udiskie index 014955032..a6a2e2ad3 100644 --- a/apparmor.d/groups/filesystem/udiskie +++ b/apparmor.d/groups/filesystem/udiskie @@ -23,7 +23,7 @@ profile udiskie @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{open_path} rPx -> child-open, diff --git a/apparmor.d/groups/filesystem/udiskie-info b/apparmor.d/groups/filesystem/udiskie-info index 855c5b54c..0b39fd3dc 100644 --- a/apparmor.d/groups/filesystem/udiskie-info +++ b/apparmor.d/groups/filesystem/udiskie-info @@ -13,7 +13,7 @@ profile udiskie-info @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, /usr/bin/ r, diff --git a/apparmor.d/groups/filesystem/udiskie-mount b/apparmor.d/groups/filesystem/udiskie-mount index a57a6091f..0513a8c35 100644 --- a/apparmor.d/groups/filesystem/udiskie-mount +++ b/apparmor.d/groups/filesystem/udiskie-mount @@ -13,7 +13,7 @@ profile udiskie-mount @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, /usr/bin/ r, diff --git a/apparmor.d/groups/filesystem/udiskie-umount b/apparmor.d/groups/filesystem/udiskie-umount index 8fe075f94..cf147b875 100644 --- a/apparmor.d/groups/filesystem/udiskie-umount +++ b/apparmor.d/groups/filesystem/udiskie-umount @@ -13,7 +13,7 @@ profile udiskie-umount @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, /usr/bin/ r, diff --git a/apparmor.d/groups/firewall/firewall-applet b/apparmor.d/groups/firewall/firewall-applet index 17fca1462..280bd9d04 100644 --- a/apparmor.d/groups/firewall/firewall-applet +++ b/apparmor.d/groups/firewall/firewall-applet @@ -17,7 +17,7 @@ profile firewall-applet @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/ r, - @{bin}/python3.@{int} r, + @{python_path} r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/firewall/firewalld b/apparmor.d/groups/firewall/firewalld index 142b25cde..123dff77f 100644 --- a/apparmor.d/groups/firewall/firewalld +++ b/apparmor.d/groups/firewall/firewalld @@ -42,7 +42,7 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{bin}/xtables-legacy-multi rix, @{bin}/xtables-nft-multi rix, - /usr/local/lib/python3.@{int}/dist-packages/ r, + /usr/local/lib/@{python_name}/dist-packages/ r, /usr/share/iproute2/{,**} r, /usr/share/libalternatives/{,**} r, diff --git a/apparmor.d/groups/firewall/ufw b/apparmor.d/groups/firewall/ufw index b7e5f0c79..3b5a1dcc1 100644 --- a/apparmor.d/groups/firewall/ufw +++ b/apparmor.d/groups/firewall/ufw @@ -32,7 +32,7 @@ profile ufw @{exec_path} flags=(attach_disconnected) { @{bin}/ r, @{bin}/cat ix, @{bin}/env r, - @{bin}/python3.@{int} ix, + @{python_path} ix, @{bin}/sysctl ix, @{bin}/xtables-legacy-multi ix, @{bin}/xtables-nft-multi ix, diff --git a/apparmor.d/groups/gnome/gnome-browser-connector-host b/apparmor.d/groups/gnome/gnome-browser-connector-host index d31811152..95af09ed6 100644 --- a/apparmor.d/groups/gnome/gnome-browser-connector-host +++ b/apparmor.d/groups/gnome/gnome-browser-connector-host @@ -15,9 +15,9 @@ profile gnome-browser-connector-host @{exec_path} { @{exec_path} mr, @{bin}/env rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, - @{lib}/python3.@{int}/site-packages/gnome_browser_connector/__pycache__/{,**} rw, + @{lib}/@{python_name}/site-packages/gnome_browser_connector/__pycache__/{,**} rw, /usr/share/glib-2.0/schemas/gschemas.compiled r, diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index 82be211fc..7874e95ff 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -33,8 +33,8 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { @{bin}/ r, @{bin}/env r, - @{bin}/python3.@{int} rix, - @{lib}/python3.@{int}/site-packages/gnomemusic/__pycache__/{,**} rw, + @{python_path} rix, + @{lib}/@{python_name}/site-packages/gnomemusic/__pycache__/{,**} rw, /usr/share/grilo-plugins/grl-lua-factory/{,*} r, /usr/share/org.gnome.Music/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-tweaks b/apparmor.d/groups/gnome/gnome-tweaks index d104e75c6..fa94d56e8 100644 --- a/apparmor.d/groups/gnome/gnome-tweaks +++ b/apparmor.d/groups/gnome/gnome-tweaks @@ -21,11 +21,11 @@ profile gnome-tweaks @{exec_path} flags=(attach_disconnected) { @{bin}/ r, @{bin}/env r, @{bin}/ps rPx, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{open_path} rPx -> child-open-help, - @{lib}/python3.@{int}/site-packages/gtweak/{,*/,**/}__pycache__/*pyc* w, + @{lib}/@{python_name}/site-packages/gtweak/{,*/,**/}__pycache__/*pyc* w, /etc/xdg/autostart/{,**} r, diff --git a/apparmor.d/groups/kde/kconf_update b/apparmor.d/groups/kde/kconf_update index e152325ed..49da5e3ca 100644 --- a/apparmor.d/groups/kde/kconf_update +++ b/apparmor.d/groups/kde/kconf_update @@ -25,7 +25,7 @@ profile kconf_update @{exec_path} { @{sh_path} rix, @{bin}/{,p}grep rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/qtpaths rix, @{bin}/sed rix, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 0ff08d02f..9efaec4fc 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -54,7 +54,7 @@ profile kded @{exec_path} { @{bin}/kcminit rPx, @{bin}/pgrep rCx -> pgrep, @{bin}/plasma-welcome rPUx, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/setxkbmap rix, @{bin}/xmodmap rPUx, @{bin}/xrdb rPx, diff --git a/apparmor.d/groups/network/nm-dispatcher b/apparmor.d/groups/network/nm-dispatcher index ee2e5274b..e6150c509 100644 --- a/apparmor.d/groups/network/nm-dispatcher +++ b/apparmor.d/groups/network/nm-dispatcher @@ -45,7 +45,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) { @{bin}/mktemp rix, @{bin}/netconfig rPUx, @{bin}/nmcli rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/readlink rix, @{bin}/rm rix, @{bin}/run-parts rCx -> run-parts, diff --git a/apparmor.d/groups/pacman/pacman-hook-code b/apparmor.d/groups/pacman/pacman-hook-code index 3a6bbd7fe..2496d7a9b 100644 --- a/apparmor.d/groups/pacman/pacman-hook-code +++ b/apparmor.d/groups/pacman/pacman-hook-code @@ -16,7 +16,7 @@ profile pacman-hook-code @{exec_path} { @{exec_path} mr, @{bin}/env r, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{lib}/code/product.json rw, diff --git a/apparmor.d/groups/steam/steam-game-proton b/apparmor.d/groups/steam/steam-game-proton index ab82925a5..3c4695e4f 100644 --- a/apparmor.d/groups/steam/steam-game-proton +++ b/apparmor.d/groups/steam/steam-game-proton @@ -41,7 +41,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) { @{bin}/gzip rix, @{bin}/ldconfig rix, @{bin}/localedef rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/readlink rix, @{bin}/steam-runtime-launcher-interface-@{int} rix, @{bin}/steam-runtime-system-info rix, diff --git a/apparmor.d/groups/ubuntu/apport-checkreports b/apparmor.d/groups/ubuntu/apport-checkreports index 6e1bb05f2..5e39988fd 100644 --- a/apparmor.d/groups/ubuntu/apport-checkreports +++ b/apparmor.d/groups/ubuntu/apport-checkreports @@ -14,7 +14,7 @@ profile apport-checkreports @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/python3.@{int} r, + @{python_path} r, /usr/share/dpkg/cputable r, /usr/share/dpkg/tupletable r, diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index b2fe83f6b..1ff6df2ae 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -32,8 +32,8 @@ profile check-new-release-gtk @{exec_path} { @{bin}/ischroot rix, @{bin}/lsb_release rPx -> lsb_release, - @{lib}/python3/dist-packages/UpdateManager/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, - @{lib}/python3/dist-packages/gi/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, + @{lib}/@{python_name}/dist-packages/UpdateManager/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, + @{lib}/@{python_name}/dist-packages/gi/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, /usr/share/distro-info/{,**} r, /usr/share/ubuntu-release-upgrader/{,**} r, diff --git a/apparmor.d/groups/ubuntu/list-oem-metapackages b/apparmor.d/groups/ubuntu/list-oem-metapackages index 0023b48cb..75e4279f2 100644 --- a/apparmor.d/groups/ubuntu/list-oem-metapackages +++ b/apparmor.d/groups/ubuntu/list-oem-metapackages @@ -17,7 +17,7 @@ profile list-oem-metapackages @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/ischroot rix, - @{lib}/python3/dist-packages/UbuntuDrivers/__pycache__/*.cpython-@{int}.pyc.@{int} rw, + @{lib}/@{python_name}/dist-packages/UbuntuDrivers/__pycache__/*.cpython-@{int}.pyc.@{int} rw, /etc/machine-id r, diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index 93fd9ffcc..c4c795649 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -27,7 +27,7 @@ profile software-properties-dbus @{exec_path} { @{exec_path} mr, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/env rix, @{bin}/apt-key rPx, # Changing trusted keys @{bin}/lsb_release rPx -> lsb_release, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 4715f570c..e2bb2dc98 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -28,7 +28,7 @@ profile software-properties-gtk @{exec_path} { @{bin}/ r, @{sh_path} rix, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/aplay rPx, @{bin}/apt-key rPx, @{bin}/dpkg rPx -> child-dpkg, diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 119ac517c..44e0cc403 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -51,9 +51,9 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { @{bin}/uname rix, @{lib}/apt/methods/http{,s} rPx, - @{lib}/python3/dist-packages/UpdateManager/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, - @{lib}/python3/dist-packages/gi/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, - @{lib}/python3/dist-packages/uaclient/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, + @{lib}/@{python_name}/dist-packages/UpdateManager/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, + @{lib}/@{python_name}/dist-packages/gi/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, + @{lib}/@{python_name}/dist-packages/uaclient/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, /usr/share/distro-info/{,**} r, /usr/share/ubuntu-release-upgrader/{,**} r, diff --git a/apparmor.d/groups/ubuntu/update-motd-updates-available b/apparmor.d/groups/ubuntu/update-motd-updates-available index b0101504c..776cc9bf8 100644 --- a/apparmor.d/groups/ubuntu/update-motd-updates-available +++ b/apparmor.d/groups/ubuntu/update-motd-updates-available @@ -18,7 +18,7 @@ profile update-motd-updates-available @{exec_path} { @{exec_path} mr, - @{bin}/python3.@{int} r, + @{python_path} r, @{sh_path} rix, @{bin}/apt-config rPx, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 4ffaf60e0..d540ed0e8 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -49,7 +49,7 @@ profile update-notifier @{exec_path} { /usr/share/apport/apport-checkreports rPx, /usr/share/apport/apport-gtk rPx, - @{lib}/python3.@{int}/dist-packages/{apt,gi}/**/__pycache__/{,**} rw, + @{lib}/@{python_name}/dist-packages/{apt,gi}/**/__pycache__/{,**} rw, /usr/share/dpkg/cputable r, /usr/share/dpkg/tupletable r, diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 6ca662859..d7b1b45e0 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -39,7 +39,7 @@ profile cockpit-bridge @{exec_path} { @{bin}/date ix, @{bin}/find ix, @{bin}/ip ix, - @{bin}/python3.@{int} ix, + @{python_path} ix, @{bin}/test ix, @{bin}/file ix, diff --git a/apparmor.d/groups/whonix/sdwdate-gui b/apparmor.d/groups/whonix/sdwdate-gui index 23c0a6df4..84a6fb379 100644 --- a/apparmor.d/groups/whonix/sdwdate-gui +++ b/apparmor.d/groups/whonix/sdwdate-gui @@ -28,7 +28,7 @@ profile sdwdate-gui @{exec_path} { @{lib}/sdwdate-gui/log-viewer rix, @{lib}/helper-scripts/* rix, - @{lib}/python3/dist-packages/sdwdate_gui/__pycache__/ rw, + @{lib}/@{python_name}/dist-packages/sdwdate_gui/__pycache__/ rw, @{lib}/sdwdate-gui/ r, diff --git a/apparmor.d/profiles-a-f/alacarte b/apparmor.d/profiles-a-f/alacarte index 7ebb3b629..eed67619d 100644 --- a/apparmor.d/profiles-a-f/alacarte +++ b/apparmor.d/profiles-a-f/alacarte @@ -14,9 +14,9 @@ profile alacarte @{exec_path} { include @{exec_path} mr, - @{bin}/python3.@{int} rix, + @{python_path} rix, - @{lib}/python3.@{int}/site-packages/Alacarte/{,**/}__pycache__/*.cpython-@{int}.*.pyc.@{int} w, + @{lib}/@{python_name}/site-packages/Alacarte/{,**/}__pycache__/*.cpython-@{int}.*.pyc.@{int} w, /usr/share/alacarte/{,**} r, /usr/share/desktop-directories/{,**} r, diff --git a/apparmor.d/profiles-a-f/arandr b/apparmor.d/profiles-a-f/arandr index e260321e6..77bf1bf96 100644 --- a/apparmor.d/profiles-a-f/arandr +++ b/apparmor.d/profiles-a-f/arandr @@ -19,7 +19,7 @@ profile arandr @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/xrandr rPx, diff --git a/apparmor.d/profiles-a-f/borg b/apparmor.d/profiles-a-f/borg index dbf6c228d..a53c135ca 100644 --- a/apparmor.d/profiles-a-f/borg +++ b/apparmor.d/profiles-a-f/borg @@ -27,7 +27,7 @@ profile borg @{exec_path} { @{exec_path} r, @{bin}/ r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/{,@{multiarch}-}ld.bfd rix, @{bin}/cat rix, diff --git a/apparmor.d/profiles-a-f/convertall b/apparmor.d/profiles-a-f/convertall index 8c38f85a3..52e80cc54 100644 --- a/apparmor.d/profiles-a-f/convertall +++ b/apparmor.d/profiles-a-f/convertall @@ -20,7 +20,7 @@ profile convertall @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, /usr/share/convertall/{,**} r, /usr/share/doc/convertall/{,*} r, diff --git a/apparmor.d/profiles-a-f/execute-dcut b/apparmor.d/profiles-a-f/execute-dcut index 41d2324f6..817ba6215 100644 --- a/apparmor.d/profiles-a-f/execute-dcut +++ b/apparmor.d/profiles-a-f/execute-dcut @@ -13,7 +13,7 @@ profile execute-dcut @{exec_path} flags=(complain) { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, include if exists } diff --git a/apparmor.d/profiles-a-f/execute-dput b/apparmor.d/profiles-a-f/execute-dput index 0decde05c..7161c5900 100644 --- a/apparmor.d/profiles-a-f/execute-dput +++ b/apparmor.d/profiles-a-f/execute-dput @@ -15,7 +15,7 @@ profile execute-dput @{exec_path} flags=(complain) { @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{sh_path} rix, @{bin}/dpkg rPx -> child-dpkg, diff --git a/apparmor.d/profiles-a-f/fail2ban-client b/apparmor.d/profiles-a-f/fail2ban-client index 7fae1218c..d432bee94 100644 --- a/apparmor.d/profiles-a-f/fail2ban-client +++ b/apparmor.d/profiles-a-f/fail2ban-client @@ -15,7 +15,7 @@ profile fail2ban-client @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/ r, - @{bin}/python3.@{int} r, + @{python_path} r, /etc/fail2ban/{,**} r, diff --git a/apparmor.d/profiles-a-f/fail2ban-server b/apparmor.d/profiles-a-f/fail2ban-server index e858c2d8e..2506b1db9 100644 --- a/apparmor.d/profiles-a-f/fail2ban-server +++ b/apparmor.d/profiles-a-f/fail2ban-server @@ -24,7 +24,7 @@ profile fail2ban-server @{exec_path} flags=(attach_disconnected) { @{bin}/iptables rix, @{bin}/ r, - @{bin}/python3.@{int} r, + @{python_path} r, /etc/fail2ban/{,**} r, diff --git a/apparmor.d/profiles-g-l/gajim b/apparmor.d/profiles-g-l/gajim index 1de493892..e06c49b9d 100644 --- a/apparmor.d/profiles-g-l/gajim +++ b/apparmor.d/profiles-g-l/gajim @@ -86,7 +86,7 @@ profile gajim @{exec_path} { # Silencer deny /usr/share/gajim/** w, - deny /usr/lib/python3/dist-packages/** w, + deny @{lib}/@{python_name}/dist-packages/** w, profile ccache { include diff --git a/apparmor.d/profiles-g-l/ganyremote b/apparmor.d/profiles-g-l/ganyremote index e9f4d4e30..79f8c2fc7 100644 --- a/apparmor.d/profiles-g-l/ganyremote +++ b/apparmor.d/profiles-g-l/ganyremote @@ -22,7 +22,7 @@ profile ganyremote @{exec_path} { network inet6 stream, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{sh_path} rix, diff --git a/apparmor.d/profiles-g-l/gpo b/apparmor.d/profiles-g-l/gpo index 4088f51fb..562980d35 100644 --- a/apparmor.d/profiles-g-l/gpo +++ b/apparmor.d/profiles-g-l/gpo @@ -22,7 +22,7 @@ profile gpo @{exec_path} { network inet6 stream, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{sh_path} rix, diff --git a/apparmor.d/profiles-g-l/gpodder b/apparmor.d/profiles-g-l/gpodder index ec1adabe4..7ccf428c3 100644 --- a/apparmor.d/profiles-g-l/gpodder +++ b/apparmor.d/profiles-g-l/gpodder @@ -24,7 +24,7 @@ profile gpodder @{exec_path} { network netlink raw, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{sh_path} rix, diff --git a/apparmor.d/profiles-g-l/gpodder-migrate2tres b/apparmor.d/profiles-g-l/gpodder-migrate2tres index 11896a26c..55033d107 100644 --- a/apparmor.d/profiles-g-l/gpodder-migrate2tres +++ b/apparmor.d/profiles-g-l/gpodder-migrate2tres @@ -13,7 +13,7 @@ profile gpodder-migrate2tres @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{sh_path} rix, diff --git a/apparmor.d/profiles-g-l/hardinfo b/apparmor.d/profiles-g-l/hardinfo index f91887297..839e0d98a 100644 --- a/apparmor.d/profiles-g-l/hardinfo +++ b/apparmor.d/profiles-g-l/hardinfo @@ -38,7 +38,7 @@ profile hardinfo @{exec_path} { @{bin}/locale rix, @{bin}/make rix, @{bin}/perl rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/route rix, @{bin}/ruby[0-9].@{int} rix, @{bin}/strace rix, diff --git a/apparmor.d/profiles-g-l/hypnotix b/apparmor.d/profiles-g-l/hypnotix index be18726a0..cda55bc59 100644 --- a/apparmor.d/profiles-g-l/hypnotix +++ b/apparmor.d/profiles-g-l/hypnotix @@ -31,7 +31,7 @@ profile hypnotix @{exec_path} { network netlink raw, @{exec_path} rix, - @{bin}/python3.@{int} r, + @{python_path} r, @{sh_path} rix, @{bin}/ldconfig rix, diff --git a/apparmor.d/profiles-g-l/install-printerdriver b/apparmor.d/profiles-g-l/install-printerdriver index 8ea351857..facd2fa3b 100644 --- a/apparmor.d/profiles-g-l/install-printerdriver +++ b/apparmor.d/profiles-g-l/install-printerdriver @@ -16,7 +16,7 @@ profile install-printerdriver @{exec_path} flags=(complain) { @{exec_path} mrix, @{sh_path} rix, - @{bin}/python3.@{int} r, + @{python_path} r, /usr/share/system-config-printer/{,**} r, diff --git a/apparmor.d/profiles-g-l/iotop b/apparmor.d/profiles-g-l/iotop index d85b0244f..8ea787ea6 100644 --- a/apparmor.d/profiles-g-l/iotop +++ b/apparmor.d/profiles-g-l/iotop @@ -21,7 +21,7 @@ profile iotop @{exec_path} { @{bin}/ r, @{bin}/file rix, - @{bin}/python3.@{int} r, + @{python_path} r, /etc/magic r, diff --git a/apparmor.d/profiles-g-l/kconfig-hardened-check b/apparmor.d/profiles-g-l/kconfig-hardened-check index 743da77a1..264e49ebc 100644 --- a/apparmor.d/profiles-g-l/kconfig-hardened-check +++ b/apparmor.d/profiles-g-l/kconfig-hardened-check @@ -13,7 +13,7 @@ profile kconfig-hardened-check @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, diff --git a/apparmor.d/profiles-m-r/metadata-cleaner b/apparmor.d/profiles-m-r/metadata-cleaner index 0de151536..4aa662cd0 100644 --- a/apparmor.d/profiles-m-r/metadata-cleaner +++ b/apparmor.d/profiles-m-r/metadata-cleaner @@ -18,7 +18,7 @@ profile metadata-cleaner @{exec_path} flags=(attach_disconnected) { include @{exec_path} mr, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/bwrap rCx -> bwrap, @{open_path} rPx -> child-open-help, diff --git a/apparmor.d/profiles-m-r/mpsyt b/apparmor.d/profiles-m-r/mpsyt index 9a138ff50..502f941be 100644 --- a/apparmor.d/profiles-m-r/mpsyt +++ b/apparmor.d/profiles-m-r/mpsyt @@ -24,7 +24,7 @@ profile mpsyt @{exec_path} { network netlink raw, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/ldconfig rix, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 1e5ee2f91..41d327f93 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -31,7 +31,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{bin}/dpkg-query rpx, @{bin}/fail2ban-server rPx, @{bin}/locale rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/sed rix, @{bin}/stty rix, @{bin}/systemctl rCx -> systemctl, @@ -43,7 +43,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{lib}/needrestart/* rPx, /usr/share/debconf/frontend rix, - @{att}/@{lib}/python3.@{int}/** r, + @{att}/@{lib}/@{python_name}/** r, /usr/share/needrestart/{,**} r, /usr/share/unattended-upgrades/unattended-upgrade-shutdown r, diff --git a/apparmor.d/profiles-m-r/obamenu b/apparmor.d/profiles-m-r/obamenu index b0c4d88c6..9d9ed2a94 100644 --- a/apparmor.d/profiles-m-r/obamenu +++ b/apparmor.d/profiles-m-r/obamenu @@ -13,7 +13,7 @@ profile obamenu @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/ r, diff --git a/apparmor.d/profiles-m-r/openbox b/apparmor.d/profiles-m-r/openbox index d136ee08f..15957b348 100644 --- a/apparmor.d/profiles-m-r/openbox +++ b/apparmor.d/profiles-m-r/openbox @@ -75,7 +75,7 @@ profile openbox @{exec_path} { /etc/xdg/autostart/{,*} r, # Silencer - deny @{lib}/python3/** w, + deny @{lib}/@{python_name}/** w, deny owner @{user_lib_dirs}/python*/site-packages/ r, # file_inherit diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index fe06a346d..5ae5df7e6 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -53,7 +53,7 @@ profile pass @{exec_path} { # Pass extensions @{bin}/oathtool ix, # pass-otp - @{bin}/python3.@{int} Px -> pass-import, # pass-import, pass-audit + @{python_path} Px -> pass-import, # pass-import, pass-audit @{bin}/qrencode PUx, # pass-otp @{bin}/tomb PUx, # pass-tomb diff --git a/apparmor.d/profiles-m-r/pass-import b/apparmor.d/profiles-m-r/pass-import index 4977bb51a..c8fb38e44 100644 --- a/apparmor.d/profiles-m-r/pass-import +++ b/apparmor.d/profiles-m-r/pass-import @@ -26,7 +26,7 @@ profile pass-import @{exec_path} { @{bin}/ld rix, @{bin}/ldconfig rix, @{bin}/pass rPx, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{lib}/gcc/**/collect2 rix, @{lib}/python{2.[4-7],3,3.@{int}}/** w, # TODO: Test deny diff --git a/apparmor.d/profiles-m-r/ps-mem b/apparmor.d/profiles-m-r/ps-mem index da5753161..08b286b5a 100644 --- a/apparmor.d/profiles-m-r/ps-mem +++ b/apparmor.d/profiles-m-r/ps-mem @@ -17,7 +17,7 @@ profile ps-mem @{exec_path} { ptrace (read), @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, diff --git a/apparmor.d/profiles-m-r/qbittorrent b/apparmor.d/profiles-m-r/qbittorrent index a5fcbb91e..8c6608e01 100644 --- a/apparmor.d/profiles-m-r/qbittorrent +++ b/apparmor.d/profiles-m-r/qbittorrent @@ -29,7 +29,7 @@ profile qbittorrent @{exec_path} { include include - signal send set=(term, kill) peer=qbittorrent//python3, + signal send set=(term, kill) peer=qbittorrent//python, network inet dgram, network inet6 dgram, @@ -68,7 +68,7 @@ profile qbittorrent @{exec_path} { @{exec_path} mr, @{open_path} rPx -> child-open, - @{bin}/python3.@{int} rCx -> python, # For "search engine" + @{python_path} rCx -> python, # For "search engine" # Allowed apps to open @{bin}/ebook-viewer rPx, @@ -129,7 +129,7 @@ profile qbittorrent @{exec_path} { network inet6 stream, network netlink raw, - @{bin}/python3.@{int} r, + @{python_path} r, owner @{user_share_dirs}/{,data/}qBittorrent/nova[0-9]/{,**} rw, diff --git a/apparmor.d/profiles-m-r/repo b/apparmor.d/profiles-m-r/repo index a1fd7b3b3..5ad84fb15 100644 --- a/apparmor.d/profiles-m-r/repo +++ b/apparmor.d/profiles-m-r/repo @@ -27,7 +27,7 @@ profile repo @{exec_path} { @{bin}/curl rix, @{bin}/env rix, @{bin}/git rix, - @{bin}/python3.@{int} rix, + @{python_path} rix, @{bin}/uname rix, @{lib}/git{,-core}/git* rix, diff --git a/apparmor.d/profiles-m-r/rustdesk b/apparmor.d/profiles-m-r/rustdesk index 2a0f9b391..acdad5640 100644 --- a/apparmor.d/profiles-m-r/rustdesk +++ b/apparmor.d/profiles-m-r/rustdesk @@ -36,7 +36,7 @@ profile rustdesk @{exec_path} { @{bin}/ls rix, @{bin}/sudo rCx -> sudo, - @{bin}/python3.@{int} rCx -> python, + @{python_path} rCx -> python, @{sh_path} rCx -> shell, /etc/gdm{,3}/custom.conf r, @@ -64,7 +64,7 @@ profile rustdesk @{exec_path} { include @{bin}/rustdesk rPx, - @{bin}/python3.@{int} rPx -> rustdesk//python, + @{python_path} rPx -> rustdesk//python, include if exists } @@ -76,7 +76,7 @@ profile rustdesk @{exec_path} { capability dac_read_search, capability dac_override, - @{bin}/python3.@{int} r, + @{python_path} r, @{sh_path} rix, @{bin}/chmod rix, diff --git a/apparmor.d/profiles-s-z/speedtest b/apparmor.d/profiles-s-z/speedtest index f31818354..7e9728fc9 100644 --- a/apparmor.d/profiles-s-z/speedtest +++ b/apparmor.d/profiles-s-z/speedtest @@ -21,7 +21,7 @@ profile speedtest @{exec_path} { network netlink raw, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/file rix, diff --git a/apparmor.d/profiles-s-z/system-config-printer b/apparmor.d/profiles-s-z/system-config-printer index 4db5c6f92..84f6d52d3 100644 --- a/apparmor.d/profiles-s-z/system-config-printer +++ b/apparmor.d/profiles-s-z/system-config-printer @@ -28,7 +28,7 @@ profile system-config-printer @{exec_path} flags=(complain) { @{exec_path} mrix, @{sh_path} rix, - @{bin}/python3.@{int} r, + @{python_path} r, @{lib}/cups/*/* rPUx, /usr/share/hplip/query.py rPUx, diff --git a/apparmor.d/profiles-s-z/system-config-printer-applet b/apparmor.d/profiles-s-z/system-config-printer-applet index 0197e3c3b..de34ea608 100644 --- a/apparmor.d/profiles-s-z/system-config-printer-applet +++ b/apparmor.d/profiles-s-z/system-config-printer-applet @@ -19,7 +19,7 @@ profile system-config-printer-applet @{exec_path} { @{exec_path} mrix, @{sh_path} rix, - @{bin}/python3.@{int} r, + @{python_path} r, /usr/share/system-config-printer/{,**} r, diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index e5a8f80d9..679a0fd32 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -30,7 +30,7 @@ profile terminator @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/ r, - @{bin}/python3.@{int} rix, + @{python_path} rix, # The shell is not confined on purpose. @{bin}/@{shells} rUx, diff --git a/apparmor.d/profiles-s-z/update-command-not-found b/apparmor.d/profiles-s-z/update-command-not-found index f1bf99bf8..9801f8737 100644 --- a/apparmor.d/profiles-s-z/update-command-not-found +++ b/apparmor.d/profiles-s-z/update-command-not-found @@ -20,7 +20,7 @@ profile update-command-not-found @{exec_path} { @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{lib}/ r, @{bin}/dpkg rPx -> child-dpkg, diff --git a/apparmor.d/profiles-s-z/vcsi b/apparmor.d/profiles-s-z/vcsi index 25f4a979f..eaf6ca24b 100644 --- a/apparmor.d/profiles-s-z/vcsi +++ b/apparmor.d/profiles-s-z/vcsi @@ -16,7 +16,7 @@ profile vcsi @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/ffmpeg rPx, diff --git a/apparmor.d/profiles-s-z/vidcutter b/apparmor.d/profiles-s-z/vidcutter index 283eab051..1460fb1a7 100644 --- a/apparmor.d/profiles-s-z/vidcutter +++ b/apparmor.d/profiles-s-z/vidcutter @@ -25,7 +25,7 @@ profile vidcutter @{exec_path} { include @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/ldconfig rix, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index af472b4d5..614084c71 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -31,8 +31,8 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { @{exec_path} rix, @{sh_path} rix, - @{bin}/python3.@{int} rix, - @{lib}/python3.@{int}/site-packages/__pycache__/guestfs.cpython-@{int}.pyc.@{int} w, + @{python_path} rix, + @{lib}/@{python_name}/site-packages/__pycache__/guestfs.cpython-@{int}.pyc.@{int} w, @{bin}/ r, @{bin}/env rix, diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd index 22713e3bf..20575b2a8 100644 --- a/apparmor.d/profiles-s-z/wsdd +++ b/apparmor.d/profiles-s-z/wsdd @@ -21,7 +21,7 @@ profile wsdd @{exec_path} { @{exec_path} mr, @{bin}/env r, - @{bin}/python3.@{int} rix, + @{python_path} rix, /etc/machine-id r, diff --git a/apparmor.d/profiles-s-z/youtube-dl b/apparmor.d/profiles-s-z/youtube-dl index 781e24768..d618a0db1 100644 --- a/apparmor.d/profiles-s-z/youtube-dl +++ b/apparmor.d/profiles-s-z/youtube-dl @@ -30,7 +30,7 @@ profile youtube-dl @{exec_path} { signal (receive) set=(term, kill), @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ffmpeg rPx, @{bin}/ffprobe rPx, diff --git a/apparmor.d/profiles-s-z/yt-dlp b/apparmor.d/profiles-s-z/yt-dlp index 551a8edf4..ffa78eda3 100644 --- a/apparmor.d/profiles-s-z/yt-dlp +++ b/apparmor.d/profiles-s-z/yt-dlp @@ -24,7 +24,7 @@ profile yt-dlp @{exec_path} { network netlink raw, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/file rix, diff --git a/apparmor.d/profiles-s-z/ytdl b/apparmor.d/profiles-s-z/ytdl index 81ccfc284..12fd657c3 100644 --- a/apparmor.d/profiles-s-z/ytdl +++ b/apparmor.d/profiles-s-z/ytdl @@ -24,7 +24,7 @@ profile ytdl @{exec_path} { signal (receive) set=(term, kill), @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/ r, @{bin}/ldconfig rix, diff --git a/apparmor.d/profiles-s-z/zenmap b/apparmor.d/profiles-s-z/zenmap index 59a8d772e..f4dc9fc77 100644 --- a/apparmor.d/profiles-s-z/zenmap +++ b/apparmor.d/profiles-s-z/zenmap @@ -20,7 +20,7 @@ profile zenmap @{exec_path} { signal (send) set=(term, kill) peer=nmap, @{exec_path} r, - @{bin}/python3.@{int} r, + @{python_path} r, @{bin}/nmap rPx, From a53ffeb251da8df49f12676e497c82fb243bd40c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 20 Feb 2025 20:18:44 +0100 Subject: [PATCH 0580/1455] fix(profile): ensure gsconnect-preferences is part of gnome-extension-gsconnect. --- apparmor.d/groups/gnome/gnome-extension-gsconnect | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 4c4b00c5d..cf5c0a855 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -9,7 +9,7 @@ include @{share_dirs} = /usr/share/gnome-shell/extensions/gsconnect@andyholmes.github.io @{share_dirs} += @{user_share_dirs}/gnome-shell/extensions/gsconnect@andyholmes.github.io -@{exec_path} = @{share_dirs}/service/daemon.js +@{exec_path} = @{share_dirs}/service/daemon.js @{share_dirs}/gsconnect-preferences profile gnome-extension-gsconnect @{exec_path} { include include From 1f3fb1513a0ae0959b556f294c5c605cf05c9db3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 21 Feb 2025 00:05:36 +0100 Subject: [PATCH 0581/1455] feat(profile): enforce apparmor.systemd --- apparmor.d/groups/apparmor/apparmor.systemd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/apparmor/apparmor.systemd b/apparmor.d/groups/apparmor/apparmor.systemd index 75394f5de..79b3f1a86 100644 --- a/apparmor.d/groups/apparmor/apparmor.systemd +++ b/apparmor.d/groups/apparmor/apparmor.systemd @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/apparmor/apparmor.systemd -profile apparmor.systemd @{exec_path} flags=(complain) { +profile apparmor.systemd @{exec_path} { include include include From 2ae16a93f4b68aa16a6362557a435134d6ae0cb0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 21 Feb 2025 00:07:08 +0100 Subject: [PATCH 0582/1455] feat(abs): remove mesa 24.2 fix as it has been fixed upstream. --- apparmor.d/abstractions/base.d/complete | 6 ------ 1 file changed, 6 deletions(-) diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index 3b5ecaf41..230e0c9d5 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -23,12 +23,6 @@ @{etc_rw}/localtime r, /etc/locale.conf r, - # mesa 24.2 introduced a shader disk cache which opens quite a lot of fd. - # They are not closed and get inherited by child programs. Denying it can cause - # crash, so we are allowing it globally while the issue is beeing fixed in mesa. - owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.db rw, - owner @{user_cache_dirs}/mesa_shader_cache_db/part@{int}/mesa_cache.idx rw, - @{sys}/devices/system/cpu/possible r, @{PROC}/sys/kernel/core_pattern r, From c1bea69cbf1c062a1aa501867a0dbf22774681e1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 21 Feb 2025 00:10:08 +0100 Subject: [PATCH 0583/1455] feat(profile): minor gnome improvments. --- apparmor.d/groups/gnome/gnome-control-center | 4 ++-- apparmor.d/groups/gnome/gnome-extension-gsconnect | 2 +- apparmor.d/groups/gnome/nautilus | 1 + 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 91f49c219..cfb40f5c4 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -90,10 +90,10 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { /usr/share/wallpapers/{,**} r, /usr/share/xml/iso-codes/{,**} r, + @{etc_ro}/security/pwquality.conf r, + @{etc_ro}/security/pwquality.conf.d/{,**} r, /etc/machine-info r, /etc/rygel.conf r, - /etc/security/pwquality.conf r, - /etc/security/pwquality.conf.d/{,**} r, /etc/fstab r, /etc/machine-id r, diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index cf5c0a855..7bb34e52f 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -53,7 +53,7 @@ profile gnome-extension-gsconnect @{exec_path} { owner @{user_config_dirs}/mimeapps.list w, owner @{user_config_dirs}/mimeapps.list.@{rand6} rw, - owner @{run}/user/@{uid}/gsconnect/ w, + owner @{run}/user/@{uid}/gsconnect/{,**} rw, @{sys}/devices/virtual/dmi/id/chassis_type r, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 890e5b34e..7e25ee08c 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -108,6 +108,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/tty rw, From 8912aaf12695b4b2278d471db76cbbe4fcf7e1bf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 21 Feb 2025 00:55:52 +0100 Subject: [PATCH 0584/1455] feat(profile): general update. --- apparmor.d/groups/gvfs/gvfsd-sftp | 1 + apparmor.d/groups/pacman/mkinitcpio | 1 + apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/groups/procps/htop | 95 +++++++++++------------ apparmor.d/groups/procps/uptime | 2 + apparmor.d/groups/ssh/ssh | 10 ++- apparmor.d/groups/ssh/ssh-sk-helper | 2 +- apparmor.d/groups/systemd/busctl | 6 +- apparmor.d/groups/systemd/systemd-analyze | 1 + apparmor.d/profiles-s-z/spotify | 3 +- apparmor.d/profiles-s-z/transmission | 1 + apparmor.d/profiles-s-z/wpa-cli | 2 +- 12 files changed, 67 insertions(+), 59 deletions(-) diff --git a/apparmor.d/groups/gvfs/gvfsd-sftp b/apparmor.d/groups/gvfs/gvfsd-sftp index cabee57c2..157af621c 100644 --- a/apparmor.d/groups/gvfs/gvfsd-sftp +++ b/apparmor.d/groups/gvfs/gvfsd-sftp @@ -19,6 +19,7 @@ profile gvfsd-sftp @{exec_path} { @{bin}/ssh rPx, owner @{run}/user/@{uid}/gvfsd-sftp/ rw, + owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} w, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index ed91f6c9c..8c92421f1 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -49,6 +49,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { @{bin}/plymouth rPx, @{bin}/plymouth-set-default-theme rPx, @{bin}/sbctl rPx, + @{bin}/sync rPx, @{lib}/initcpio/busybox rix, @{lib}/initcpio/post/** rix, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 16a8171ca..327af130f 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -135,8 +135,8 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/ r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/environ r, @{PROC}/@{pids}/stat r, - @{PROC}/1/environ r, @{PROC}/sys/kernel/osrelease r, @{PROC}/tty/drivers r, @{PROC}/uptime r, diff --git a/apparmor.d/groups/procps/htop b/apparmor.d/groups/procps/htop index 08b58ebd2..c720929f3 100644 --- a/apparmor.d/groups/procps/htop +++ b/apparmor.d/groups/procps/htop @@ -20,10 +20,10 @@ profile htop @{exec_path} { network netlink raw, - signal (send), - signal (receive) set=(hup) peer=gnome-terminal-server, + signal send, + signal receive set=hup peer=gnome-terminal-server, - ptrace (read), + ptrace read, @{exec_path} mr, @@ -38,51 +38,6 @@ profile htop @{exec_path} { owner @{user_config_dirs}/htop/ rw, owner @{user_config_dirs}/htop/* rw, - owner @{PROC}/@{pid}/smaps_rollup r, - - @{PROC}/ r, - @{PROC}/diskstats r, - @{PROC}/loadavg r, - @{PROC}/pressure/cpu r, - @{PROC}/pressure/io r, - @{PROC}/pressure/memory r, - @{PROC}/sys/kernel/osrelease r, - @{PROC}/sys/kernel/pid_max r, - @{PROC}/sys/kernel/sched_autogroup_enabled r, - @{PROC}/tty/drivers r, - @{PROC}/uptime r, - - @{PROC}/@{pids}/ r, - @{PROC}/@{pids}/attr/current r, - @{PROC}/@{pids}/autogroup rw, - @{PROC}/@{pids}/cgroup r, - @{PROC}/@{pids}/cmdline r, - @{PROC}/@{pids}/comm r, - @{PROC}/@{pids}/environ r, - @{PROC}/@{pids}/io r, - @{PROC}/@{pids}/mounts r, - @{PROC}/@{pids}/net/dev r, - @{PROC}/@{pids}/oom_{,score_}adj r, - @{PROC}/@{pids}/oom_score r, - @{PROC}/@{pids}/stat r, - @{PROC}/@{pids}/statm r, - @{PROC}/@{pids}/wchan r, - - @{PROC}/@{pids}/task/ r, - @{PROC}/@{pids}/task/@{tid}/ r, - @{PROC}/@{pids}/task/@{tid}/attr/current r, - @{PROC}/@{pids}/task/@{tid}/cgroup r, - @{PROC}/@{pids}/task/@{tid}/cmdline r, - @{PROC}/@{pids}/task/@{tid}/comm r, - @{PROC}/@{pids}/task/@{tid}/environ r, - @{PROC}/@{pids}/task/@{tid}/io r, - @{PROC}/@{pids}/task/@{tid}/oom_{,score_}adj r, - @{PROC}/@{pids}/task/@{tid}/oom_score r, - @{PROC}/@{pids}/task/@{tid}/stat r, - @{PROC}/@{pids}/task/@{tid}/statm r, - @{PROC}/@{pids}/task/@{tid}/status r, - @{PROC}/@{pids}/task/@{tid}/wchan r, - @{sys}/bus/dax/devices/ r, @{sys}/bus/i2c/devices/ r, @{sys}/bus/soc/devices/ r, @@ -129,8 +84,52 @@ profile htop @{exec_path} { @{sys}/kernel/mm/hugepages/ r, @{sys}/kernel/mm/hugepages/hugepages-*/nr_hugepages r, + @{PROC}/ r, + @{PROC}/diskstats r, + @{PROC}/loadavg r, + @{PROC}/pressure/cpu r, + @{PROC}/pressure/io r, + @{PROC}/pressure/memory r, + @{PROC}/sys/kernel/osrelease r, + @{PROC}/sys/kernel/pid_max r, + @{PROC}/sys/kernel/sched_autogroup_enabled r, + @{PROC}/tty/drivers r, + @{PROC}/uptime r, + + @{PROC}/@{pids}/ r, + @{PROC}/@{pids}/attr/current r, + @{PROC}/@{pids}/autogroup rw, + @{PROC}/@{pids}/cgroup r, + @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/comm r, + @{PROC}/@{pids}/environ r, + @{PROC}/@{pids}/io r, + @{PROC}/@{pids}/mounts r, + @{PROC}/@{pids}/net/dev r, + @{PROC}/@{pids}/oom_{,score_}adj r, + @{PROC}/@{pids}/oom_score r, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/statm r, + @{PROC}/@{pids}/wchan r, + + @{PROC}/@{pids}/task/ r, + @{PROC}/@{pids}/task/@{tid}/ r, + @{PROC}/@{pids}/task/@{tid}/attr/current r, + @{PROC}/@{pids}/task/@{tid}/cgroup r, + @{PROC}/@{pids}/task/@{tid}/cmdline r, + @{PROC}/@{pids}/task/@{tid}/comm r, + @{PROC}/@{pids}/task/@{tid}/environ r, + @{PROC}/@{pids}/task/@{tid}/io r, + @{PROC}/@{pids}/task/@{tid}/oom_{,score_}adj r, + @{PROC}/@{pids}/task/@{tid}/oom_score r, + @{PROC}/@{pids}/task/@{tid}/stat r, + @{PROC}/@{pids}/task/@{tid}/statm r, + @{PROC}/@{pids}/task/@{tid}/status r, + @{PROC}/@{pids}/task/@{tid}/wchan r, + @{PROC}/cmdline r, owner @{PROC}/@{pid}/cpuset r, + owner @{PROC}/@{pid}/smaps_rollup r, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/procps/uptime b/apparmor.d/groups/procps/uptime index 904ebe415..3da204a38 100644 --- a/apparmor.d/groups/procps/uptime +++ b/apparmor.d/groups/procps/uptime @@ -15,6 +15,8 @@ profile uptime @{exec_path} { @{exec_path} mr, + @{run}/systemd/sessions/@{int} r, + @{PROC}/uptime r, @{PROC}/loadavg r, @{PROC}/sys/kernel/osrelease r, diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 69f594f7a..0c86919b1 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -13,19 +13,20 @@ profile ssh @{exec_path} { include include - signal (receive) set=(term) peer=gnome-keyring-daemon, - network inet stream, network inet6 stream, network inet dgram, network inet6 dgram, network netlink raw, + signal receive set=term peer=gnome-keyring-daemon, + signal send set=hup peer=unconfined, + @{exec_path} mrix, @{bin}/@{shells} rUx, - @{lib}/ssh/ssh-sk-helper rPx -> ssh-sk-helper, + @{lib}/{,ssh/}ssh-sk-helper rPx, @{etc_ro}/ssh/ssh_config r, @{etc_ro}/ssh/ssh_config.d/{,*} r, @@ -42,8 +43,9 @@ profile ssh @{exec_path} { owner @{user_projects_dirs}/**/ssh/{,*} r, owner @{user_projects_dirs}/**/config r, - owner @{tmp}/ssh-*/{,agent.@{int}} rwkl, + audit owner @{tmp}/ssh-*/{,agent.@{int}} rwkl, + owner @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{hex16} rwl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{hex16}, owner @{run}/user/@{uid}/keyring/ssh rw, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/ssh/ssh-sk-helper b/apparmor.d/groups/ssh/ssh-sk-helper index d913e2a2d..c8c29dbaf 100644 --- a/apparmor.d/groups/ssh/ssh-sk-helper +++ b/apparmor.d/groups/ssh/ssh-sk-helper @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{lib}/ssh/ssh-sk-helper +@{exec_path} = @{lib}/{,ssh/}ssh-sk-helper profile ssh-sk-helper flags=(complain) { include diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index 826405d2d..765758771 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -20,11 +20,11 @@ profile busctl @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_ptrace, - ptrace (read), + ptrace read, - unix (bind) type=stream addr=@@{udbus}/bus/busctl/busctl, + unix bind type=stream addr=@@{udbus}/bus/busctl/busctl, - signal (send) set=(cont) peer=child-pager, + signal send set=cont peer=child-pager, dbus eavesdrop bus=accessibility, dbus eavesdrop bus=session, diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze index 039f8dc64..7310586e8 100644 --- a/apparmor.d/groups/systemd/systemd-analyze +++ b/apparmor.d/groups/systemd/systemd-analyze @@ -61,6 +61,7 @@ profile systemd-analyze @{exec_path} { @{sys}/firmware/efi/efivars/LoaderTimeExecUSec-@{uuid} r, @{PROC}/swaps r, + @{PROC}/sys/fs/nr_open r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/comm r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 41219a4f8..ef516a7d6 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -44,9 +44,10 @@ profile spotify @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw, - @{PROC}/pressure/* r, @{PROC}/@{pid}/net/unix r, + @{PROC}/pressure/* r, owner @{PROC}/@{pid}/clear_refs w, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/tty rw, diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission index 2a39981df..ad219f1ab 100644 --- a/apparmor.d/profiles-s-z/transmission +++ b/apparmor.d/profiles-s-z/transmission @@ -59,6 +59,7 @@ profile transmission @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/comm r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/profiles-s-z/wpa-cli b/apparmor.d/profiles-s-z/wpa-cli index c9987fa01..3920a21df 100644 --- a/apparmor.d/profiles-s-z/wpa-cli +++ b/apparmor.d/profiles-s-z/wpa-cli @@ -13,7 +13,7 @@ profile wpa-cli @{exec_path} { @{exec_path} mr, - /{usr/,}{s,}/wpa_action rPx, + @{bin}/wpa_action rPx, /etc/inputrc r, From 360c009a6797a49bd55b4b0eb851400dc3e070e6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 21 Feb 2025 21:17:57 +0100 Subject: [PATCH 0585/1455] fix: add missing desktop abs to gcr-prompter see #404 --- apparmor.d/groups/gnome/gcr-prompter | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/gnome/gcr-prompter b/apparmor.d/groups/gnome/gcr-prompter index a1e323c87..6bcbd1cc0 100644 --- a/apparmor.d/groups/gnome/gcr-prompter +++ b/apparmor.d/groups/gnome/gcr-prompter @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/gcr-prompter profile gcr-prompter @{exec_path} { include + include @{exec_path} mr, From 7c49a45cbb170c4c3dba27dc47dedfbdd0d42734 Mon Sep 17 00:00:00 2001 From: c-jaenicke <72254270+c-jaenicke@users.noreply.github.com> Date: Sat, 22 Feb 2025 14:56:18 +0100 Subject: [PATCH 0586/1455] fix regex on line 65, missing star --- apparmor.d/groups/pacman/mkinitcpio | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index 8c92421f1..f1d4818ef 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -62,7 +62,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { /etc/mkinitcpio.conf r, /etc/mkinitcpio.conf.d/{,**} r, /etc/mkinitcpio.d/{,**} r, - /etc/modprobe.d/{,*} r, + /etc/modprobe.d/{,**} r, /etc/os-release r, /etc/plymouth/plymouthd.conf r, /etc/vconsole.conf r, From 6ea379eecde880ce45b5e9d9b8387efbf0b7e959 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 21 Feb 2025 21:30:05 +0100 Subject: [PATCH 0587/1455] chore: remove deprecated golangci config. --- .golangci.yaml | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 .golangci.yaml diff --git a/.golangci.yaml b/.golangci.yaml deleted file mode 100644 index 7718ccda2..000000000 --- a/.golangci.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -linters-settings: - staticcheck: - checks: ["all", "-SA1019" ] From 898066c76c409852ea57d3b9a383044c09868894 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 22 Feb 2025 22:56:40 +0100 Subject: [PATCH 0588/1455] refractor: add new polkit group. --- apparmor.d/{profiles-m-r => groups/polkit}/pkexec | 0 apparmor.d/{profiles-m-r => groups/polkit}/pkttyagent | 0 apparmor.d/groups/{freedesktop => polkit}/polkit-agent-helper | 0 apparmor.d/groups/{freedesktop => polkit}/polkitd | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename apparmor.d/{profiles-m-r => groups/polkit}/pkexec (100%) rename apparmor.d/{profiles-m-r => groups/polkit}/pkttyagent (100%) rename apparmor.d/groups/{freedesktop => polkit}/polkit-agent-helper (100%) rename apparmor.d/groups/{freedesktop => polkit}/polkitd (100%) diff --git a/apparmor.d/profiles-m-r/pkexec b/apparmor.d/groups/polkit/pkexec similarity index 100% rename from apparmor.d/profiles-m-r/pkexec rename to apparmor.d/groups/polkit/pkexec diff --git a/apparmor.d/profiles-m-r/pkttyagent b/apparmor.d/groups/polkit/pkttyagent similarity index 100% rename from apparmor.d/profiles-m-r/pkttyagent rename to apparmor.d/groups/polkit/pkttyagent diff --git a/apparmor.d/groups/freedesktop/polkit-agent-helper b/apparmor.d/groups/polkit/polkit-agent-helper similarity index 100% rename from apparmor.d/groups/freedesktop/polkit-agent-helper rename to apparmor.d/groups/polkit/polkit-agent-helper diff --git a/apparmor.d/groups/freedesktop/polkitd b/apparmor.d/groups/polkit/polkitd similarity index 100% rename from apparmor.d/groups/freedesktop/polkitd rename to apparmor.d/groups/polkit/polkitd From e9b022a9a1711bc94bd531a2c632e7df7e17f347 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 12:47:22 +0100 Subject: [PATCH 0589/1455] fix: ensure sync is not inherited fix #670 --- apparmor.d/tunables/multiarch.d/programs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 18ba854d5..97a9446aa 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -22,7 +22,7 @@ @{coreutils} += ln locate logname ls md5sum mkdir mkfifo mknod mktemp mv nice nl nohup nproc numfmt @{coreutils} += od paste pathchk pinky pr printenv printf ptx pwd readlink realpath rm rmdir @{coreutils} += runcon sdiff sed seq sha1sum sha224sum sha256sum sha384sum sha512sum shred shuf sleep -@{coreutils} += sort split stat stdbuf stty sum sync tac tail tee test timeout touch tr true +@{coreutils} += sort split stat stdbuf stty sum tac tail tee test timeout touch tr true @{coreutils} += truncate tsort tty uname unexpand uniq unlink updatedb vdir wc who whoami xargs yes # Python interpreters From 8a381b2f6babcf429ba2edb7dcb25d772d9dbeab Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 18:13:16 +0100 Subject: [PATCH 0590/1455] feat(profile): various update for ubuntu. --- apparmor.d/groups/apt/apt | 1 + apparmor.d/groups/apt/apt-methods-gpgv | 1 + apparmor.d/groups/apt/dpkg | 1 - apparmor.d/groups/apt/dpkg-preconfigure | 6 ++++++ apparmor.d/groups/filesystem/lvm | 1 + apparmor.d/groups/firewall/firewalld | 2 +- apparmor.d/groups/polkit/polkitd | 1 + apparmor.d/groups/snap/snapd | 2 +- apparmor.d/groups/utils/login | 3 ++- apparmor.d/profiles-g-l/landscape-sysinfo.wrapper | 1 + apparmor.d/profiles-m-r/mkinitramfs | 11 +++++++---- apparmor.d/profiles-m-r/needrestart | 2 +- apparmor.d/profiles-m-r/run-parts | 6 ++++++ 13 files changed, 29 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index c0545f2ec..cbf1c4f9f 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -53,6 +53,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { peer=(name="{:*,org.freedesktop.DBus}"), @{exec_path} mr, + @{python_path} mr, @{bin}/ r, diff --git a/apparmor.d/groups/apt/apt-methods-gpgv b/apparmor.d/groups/apt/apt-methods-gpgv index 4b2a15773..f4e77fa4d 100644 --- a/apparmor.d/groups/apt/apt-methods-gpgv +++ b/apparmor.d/groups/apt/apt-methods-gpgv @@ -84,6 +84,7 @@ profile apt-methods-gpgv @{exec_path} { owner @{tmp}/apt-key-gpghome.*/ rw, owner @{tmp}/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**, owner @{tmp}/apt.{conf,sig,data}.* rw, + owner @{tmp}/apt.@{rand6}.gpg rw, @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/apt/dpkg b/apparmor.d/groups/apt/dpkg index dd87414bf..6d47e748b 100644 --- a/apparmor.d/groups/apt/dpkg +++ b/apparmor.d/groups/apt/dpkg @@ -37,7 +37,6 @@ profile dpkg @{exec_path} { @{pager_path} rPx -> child-pager, # Package maintainer's scripts - # Move it to a child profile once more transitions will be available /var/lib/dpkg/info/*.{config,templates} rPUx, /var/lib/dpkg/info/*.{preinst,postinst} rPUx, /var/lib/dpkg/info/*.{prerm,postrm} rPUx, diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index 94b7603fa..30fc78445 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -23,14 +23,17 @@ profile dpkg-preconfigure @{exec_path} { @{bin}/{,e}grep rix, @{bin}/{,g,m}awk rix, @{bin}/cat rix, + @{bin}/debconf-escape rix, @{bin}/dialog rix, @{bin}/expr rix, @{bin}/locale rix, + @{bin}/readlink rix, @{bin}/sed rix, @{bin}/sort rix, @{bin}/stty rix, @{bin}/tr rix, + @{bin}/findmnt rPx, @{bin}/dpkg rPx -> child-dpkg, @{bin}/apt-extracttemplates rPx, @{bin}/whiptail rPx, @@ -40,9 +43,12 @@ profile dpkg-preconfigure @{exec_path} { /etc/debconf.conf r, /etc/default/grub r, + /etc/default/mdadm r, /etc/inputrc r, /etc/locale.gen r, + /etc/mdadm/mdadm.conf r, /etc/shadow r, + /etc/ssh/sshd_config r, /var/lib/locales/supported.d/{,*} r, diff --git a/apparmor.d/groups/filesystem/lvm b/apparmor.d/groups/filesystem/lvm index cff4ce186..75cd0de80 100644 --- a/apparmor.d/groups/filesystem/lvm +++ b/apparmor.d/groups/filesystem/lvm @@ -23,6 +23,7 @@ profile lvm @{exec_path} flags=(attach_disconnected) { ptrace (read), + mqueue getattr type=posix /, mqueue r type=posix /, @{exec_path} rm, diff --git a/apparmor.d/groups/firewall/firewalld b/apparmor.d/groups/firewall/firewalld index 123dff77f..6d84dfe47 100644 --- a/apparmor.d/groups/firewall/firewalld +++ b/apparmor.d/groups/firewall/firewalld @@ -40,7 +40,7 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{bin}/kmod rix, @{bin}/modprobe rix, @{bin}/xtables-legacy-multi rix, - @{bin}/xtables-nft-multi rix, + @{bin}/xtables-nft-multi rmix, /usr/local/lib/@{python_name}/dist-packages/ r, diff --git a/apparmor.d/groups/polkit/polkitd b/apparmor.d/groups/polkit/polkitd index 9b3db683f..649fe9ceb 100644 --- a/apparmor.d/groups/polkit/polkitd +++ b/apparmor.d/groups/polkit/polkitd @@ -53,6 +53,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) { /var/lib/polkit{,-1}/localauthority/{,**} r, owner /var/lib/polkit{,-1}/.cache/ rw, + @{att}/@{run}/systemd/notify w, @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw, @{att}/@{run}/systemd/userdb/io.systemd.Multiplexer rw, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index dc80b17a4..273b68fc5 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -108,7 +108,7 @@ profile snapd @{exec_path} { /etc/modules-load.d/*snap* rw, /etc/systemd/system/{,**/} r, /etc/systemd/system/snap* rw, - /etc/systemd/user/{,**/} r, + /etc/systemd/user/{,**/} rw, /etc/systemd/user/**/*snap* rw, /etc/systemd/user/*snap* rw, /etc/udev/rules.d/{,*snap*} rw, diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login index a4d1b8cd2..f83c1687e 100644 --- a/apparmor.d/groups/utils/login +++ b/apparmor.d/groups/utils/login @@ -59,12 +59,13 @@ profile login @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/motd.legal-displayed rw, + @{att}/@{run}/systemd/sessions/@{int}.ref w, + @{run}/credentials/getty@tty@{int}.service/ r, @{run}/dbus/system_bus_socket rw, @{run}/faillock/@{user} rwk, @{run}/motd.d/{,*} r, @{run}/motd.dynamic{,.new} rw, - @{run}/systemd/sessions/*.ref rw, @{PROC}/@{pids}/cgroup r, @{PROC}/1/limits r, diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper index e5c739bd5..fb9b75824 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper +++ b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper @@ -15,6 +15,7 @@ profile landscape-sysinfo.wrapper @{exec_path} { capability fsetid, @{exec_path} mr, + @{python_path} mr, @{sh_path} rix, @{bin}/bc rix, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 6585f6382..c377889c8 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -19,11 +19,10 @@ profile mkinitramfs @{exec_path} { capability fsetid, @{exec_path} r, - @{sh_path} rix, + @{sh_path} rix, - @{bin}/ r, - @{lib}/ r, - @{lib}64/ r, + @{bin}/ r, + @{lib}/ r, @{bin}/{,e}grep rix, @{bin}/basename rix, @@ -43,6 +42,7 @@ profile mkinitramfs @{exec_path} { @{bin}/mkdir rix, @{bin}/mktemp rix, @{bin}/readlink rix, + @{bin}/realpath rix, @{bin}/rm rix, @{bin}/rmdir rix, @{bin}/sed rix, @@ -60,6 +60,7 @@ profile mkinitramfs @{exec_path} { @{bin}/kmod rCx -> kmod, @{bin}/ldconfig rCx -> ldconfig, @{bin}/ldd rCx -> ldd, + @{lib}/@{multiarch}/ld-linux-*so* rCx -> ldd, @{lib}/ld-linux.so* rCx -> ldd, @{bin}/dpkg rPx -> child-dpkg, @@ -108,6 +109,8 @@ profile mkinitramfs @{exec_path} { include @{bin}/ldd mr, + @{lib}/@{multiarch}/ld-linux-*so* mr, + @{lib}/ld-linux.so* mr, @{sh_path} rix, @{bin}/kmod mr, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 41d327f93..397646c5e 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -84,7 +84,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { capability sys_resource, capability net_admin, - signal send set=term peer=systemd-tty-ask-password-agent, + signal send set=(cont term) peer=systemd-tty-ask-password-agent, @{bin}/systemd-tty-ask-password-agent Px, diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index c20b305e1..d0ecbbd9e 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -38,6 +38,7 @@ profile run-parts @{exec_path} { /etc/anacrontab r, /etc/conf.d/snapper{,**} r, /etc/default/* r, + /etc/profile.d/{,**} r, /etc/snapper/configs/root r, # Crontab @@ -159,6 +160,10 @@ profile run-parts @{exec_path} { include include + network inet dgram, + network inet6 dgram, + network netlink raw, + @{sh_path} rix, @{bin}/{e,}grep rix, @{bin}/cat rix, @@ -169,6 +174,7 @@ profile run-parts @{exec_path} { @{bin}/sort rix, @{bin}/tr rix, @{bin}/uname rix, + @{bin}/hostname rPx, @{bin}/snap rPUx, @{lib}/ubuntu-release-upgrader/release-upgrade-motd rPx, From d51826542b37e941824a3ccd594e1f85757155c1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 18:13:49 +0100 Subject: [PATCH 0591/1455] Revert "chore: remove deprecated golangci config." This reverts commit 6ea379eecde880ce45b5e9d9b8387efbf0b7e959. --- .golangci.yaml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .golangci.yaml diff --git a/.golangci.yaml b/.golangci.yaml new file mode 100644 index 000000000..7718ccda2 --- /dev/null +++ b/.golangci.yaml @@ -0,0 +1,5 @@ +--- + +linters-settings: + staticcheck: + checks: ["all", "-SA1019" ] From 2f5637bd6587444f46730b52bcd894dafcbdc606 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 18:16:27 +0100 Subject: [PATCH 0592/1455] feat(profile): improve makepkg. --- apparmor.d/groups/pacman/makepkg | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index d5abc07db..b2c043a6e 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -28,14 +28,20 @@ profile makepkg @{exec_path} { file, - @{bin}/gpg{,2} Cx -> gpg, - @{bin}/gpgconf Cx -> gpg, - @{bin}/gpgsm Cx -> gpg, - @{bin}/sudo Cx -> sudo, + @{bin}/gpg{,2} Cx -> gpg, + @{bin}/gpgconf Cx -> gpg, + @{bin}/gpgsm Cx -> gpg, + @{bin}/sudo Cx -> sudo, + + deny capability sys_ptrace, + deny ptrace read, profile gpg { include include + include + + network netlink raw, @{bin}/gpg{,2} mr, @{bin}/gpgconf mr, From b10f2df5ecc4229368427732bdb5ae975af4aa35 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 20:10:21 +0100 Subject: [PATCH 0593/1455] doc: add roadmap and prebuilt pages. --- docs/development/build.md | 152 ++++++++++++++++++++++++++++++++++++ docs/development/roadmap.md | 60 ++++++++++++++ mkdocs.yml | 3 + 3 files changed, 215 insertions(+) create mode 100644 docs/development/build.md create mode 100644 docs/development/roadmap.md diff --git a/docs/development/build.md b/docs/development/build.md new file mode 100644 index 000000000..89bf8e89e --- /dev/null +++ b/docs/development/build.md @@ -0,0 +1,152 @@ +--- +title: Building the profiles +--- + +The profiles in `apparmor.d` must not be used directly. They need to be prebuilt (by running `make`). This page documents all possibles prebuild tasks. It is not intended to be read by end user, and it is only targeted at developers and maintainers. + +The build system is fully configurable, general usage can be seen with: +```sh +go run ./cmd/prebuild -h +``` + +``` +aa-prebuild [-h] [--complain | --enforce] [--full] [--abi 3|4] + + Prebuild apparmor.d profiles for a given distribution and apply + internal built-in directives. + +Options: + -h, --help Show this help message and exit. + -c, --complain Set complain flag on all profiles. + -e, --enforce Set enforce flag on all profiles. + -a, --abi ABI Target apparmor ABI. + -f, --full Set AppArmor for full system policy. + -F, --file Only prebuild a given file. + +Prepare tasks: + configure - Set distribution specificities + setflags - Set flags on some profiles + fsp - Configure AppArmor for full system policy + merge - Merge profiles (from group/, profiles-*-*/) to a unified apparmor.d directory + overwrite - Overwrite dummy upstream profiles + synchronise - Initialize a new clean apparmor.d build directory + ignore - Ignore profiles and files from: + systemd-default - Configure systemd unit drop in files to a profile for some units + systemd-early - Configure systemd unit drop in files to ensure some service start after apparmor + +Build tasks: + abi3 - Convert all profiles from abi 4.0 to abi 3.0 + attach - Re-attach disconnected path + complain - Set complain flag on all profiles + enforce - All profiles have been enforced + fsp - Prevent unconfined transitions in profile rules + hotfix - Temporary fix for #74, #80 & #235 + userspace - Resolve variable in profile attachments + +Directive: + #aa:dbus own bus= name= [interface=AARE] [path=AARE] + #aa:dbus talk bus= name= label= [interface=AARE] [path=AARE] + #aa:exec [P|U|p|u|PU|pu|] profiles... + #aa:only filters... + #aa:exclude filters... + #aa:stack [X] profiles... +``` + +## Prepare Tasks + +### **`synchronise`** + +Initialize a new clean `apparmor.d` build directory in `.build/`. + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`ignore`** + +Ignore profiles and files as defined in the `dist/ignore` directory. See [workflow](workflow.md#ignore-profiles). + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`merge`** + +Merge profiles from `apparmor.d/group/`, `apparmor.d/profiles-*-*/` to a unified directory in `.build/apparmor.d` that AppArmor can parse. + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`configure`** + +Set distribution specificities as defined in [`pkg/prebuild/prepare/configure.go`](https://github.com/roddhjav/apparmor.d/blob/main/pkg/prebuild/prepare/configure.go) + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`setflags`** + +Set flags on profiles as defined in the [flags manifest](workflow.md#profile-flags). + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`overwrite`** + +Overwrite (dummy) upstream profiles as defined in `dist/overwrite`. + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`systemd-default`** + +Install systemd unit drop in files from `systemd/default`. They configure the various dbus daemon to use specific profiles. + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`systemd-early`** + +Install systemd unit drop in files from `systemd/early` to ensure some services start after AppArmor. THis task will be removed in the future, as it will not be needed any more. + +*Enabled by default. Can be disabled in `pkg/prebuild/cli/cli.go`* + +### **`fsp`** + +Configure AppArmor for full system policy. + +*Enable with the `--full` option in the prebuild command.* + + +## Build Tasks + +### **`abi3`** + +This task will convert all profiles from `abi/4.0` to `abi/3.0`. The rules not supported by `abi/3.0` are commented in the build profiles. + +*Enable with the `--abi 3` option in the prebuild command.* + +### **`complain | enforce`** + +Set or remove the complain flag on all profiles. The `complain` task is enabled by default. When building in enforce mode, it is disabled. Enabling the `enforce` task will enforce **all** profiles including the one set in the [flags manifest](workflow.md#profile-flags). It is intended to be used in specialized system such as CTF or (very) high security VM. + +*Enable with the `--complain` or `--enforce` option in the prebuild command.* + +### **`userspace`** + +Resolve variables in profile attachments. It fixes issues with the userland AppArmor tools (aa-enforce, aa-logprof...) that does not support identical variable in the profiles attachments. + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`attach`** + +This task reattaches disconnected paths. See [#559](https://github.com/roddhjav/apparmor.d/issues/559): + +- Add the `attach_disconnected.path` flag on all profiles with the `attach_disconnected` flag +- Add the attached/base abstraction in the profile +- For compatibility, non-disconnected profile will have the `@{att}` variable set to `/` + +*Enabled when abi >= 4.0* + +### **`hotfix`** + +Temporary fix for #74, #80 & #235. Only an issue on Gnome, can be disabled on server. + +*Enabled by default. Can be disabled in `cmd/prebuild/main.go`* + +### **`fsp`** + +Prevent unconfined transitions in profile rules. + +*Enable with the `--full` option in the prebuild command.* diff --git a/docs/development/roadmap.md b/docs/development/roadmap.md new file mode 100644 index 000000000..e8a047a03 --- /dev/null +++ b/docs/development/roadmap.md @@ -0,0 +1,60 @@ +--- +title: Roadmap +--- + +## Toward a stable release + +This is the current list of features that must be implemented to get to a stable release + +- [ ] **Play machine** + +- [ ] **[Sub packages](https://github.com/roddhjav/apparmor.d/issues/464)** + - [x] Move most profiles into groups such that + - [ ] New simplified build system to generate the packages with profile dependencies check + +- [ ] **Tests** + - [x] Tests VM for all supported targets (see [tests/vm](vm.md)) + - [ ] Small integration tests for all core profiles (see [tests/integration](integration.md)) + +- [ ] **Documentation** + - [ ] Initial draft of the security model and goal + - [ ] General documentation improvements + +- [ ] **General improvements** + - [ ] Provide a proper fix for #74, #80 & #235 + - [ ] The apt/dpkg profiles needs to be reworked + +## Next features + +- [ ] **Conditions** + - [ ] Integrate the new condition feature in the profiles and restrict them a lot according to the application actually in use. Eg: `Gnome | KDE`, `X11 | Wayland`, etc. + - [ ] Create a new `aa-config` tool, similar to seboolean, to manage various settings, based on conditions. + +- [ ] **User Data** + - [ ] Fully rewrite the way user data is allowed / denied. The current implementation requires too much configuration to be usable by everyone. + - [ ] Add a prompt listener to handle the user data access. + +- [ ] **[Full System Policy](https://github.com/roddhjav/apparmor.d/issues/252)** + - [ ] Debug tool to show the profiles transition tree, and ensure no profile is missing + - [ ] Remove the `default` profile + +## Done + +**Abstractions** + +- [x] New `audio-client` and `audio-server` abstractions +- [x] New desktop agnostic `desktop` abstraction for all common access for any GUI app. +- [x] New `graphics` abstraction, hardware-agnostic. Fully replace and restrict the old `opencl` abstractions +- [x] All new abstractions are documented in the [abstractions](abstractions.md) page + +**Dbus** + +- [x] New `dbus-{system,session,accessibility}` profiles. Works regardless of the dbus implementation in use. +- [x] New talk directive: Allow the application to talk to session services. (send to) +- [x] New own directive: Allow the application to own session services under the given name. (receive, send, bind) +- [x] New `bus-{system,session,accessibility}` abstraction to be used in the profiles + +**Directives** + +- [x] Add directive. See the [directive](directives.md) page + diff --git a/mkdocs.yml b/mkdocs.yml index 9390b3dde..ed14108a8 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -152,6 +152,7 @@ nav: - recovery.md - Development: - development/index.md + - development/roadmap.md - Profiles: - development/workflow.md - development/guidelines.md @@ -160,6 +161,8 @@ nav: - development/directives.md - development/dbus.md - development/recommendations.md + - Packages: + - development/build.md - Tests: - development/tests.md - development/integration.md From 7bc248577ac391fbdcb69cdaf7f758597a0b0223 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 20:13:21 +0100 Subject: [PATCH 0594/1455] feat(profile): small improvment with systemd. --- apparmor.d/groups/systemd/bootctl | 1 + apparmor.d/groups/systemd/busctl | 15 ++++++++------- apparmor.d/groups/systemd/networkctl | 2 ++ apparmor.d/groups/systemd/systemd-coredump | 1 + apparmor.d/groups/systemd/systemd-logind | 2 ++ apparmor.d/groups/systemd/systemd-networkd | 1 + apparmor.d/groups/systemd/systemd-sulogin-shell | 2 +- .../groups/systemd/systemd-tty-ask-password-agent | 4 ++++ 8 files changed, 20 insertions(+), 8 deletions(-) diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index c7bb7b19f..28c2851fa 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -43,6 +43,7 @@ profile bootctl @{exec_path} flags=(attach_disconnected) { @{sys}/class/tpmrm/ r, + @{sys}/devices/pnp@{int}/**/tpm/tpm@{int}/tpm_version_major r, @{sys}/devices/virtual/dmi/id/{board_vendor,bios_vendor} r, @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r, diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index 765758771..8b32b348f 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -39,13 +39,14 @@ profile busctl @{exec_path} flags=(attach_disconnected) { @{pager_path} rPx -> child-pager, - @{PROC}/@{pid}/cgroup r, - @{PROC}/@{pid}/comm r, - @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/fdinfo/@{int} r, - owner @{PROC}/@{pid}/loginuid r, - owner @{PROC}/@{pid}/sessionid r, + @{PROC}/@{pid}/attr/current r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/loginuid r, + @{PROC}/@{pid}/sessionid r, + @{PROC}/@{pid}/stat r, include if exists } diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index ce81686ae..0163f2258 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -50,6 +50,8 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { /{run,var}/log/journal/@{hex32}/system.journal* r, /{run,var}/log/journal/@{hex32}/system@@{hex}.journal* r, + @{att}/@{run}/systemd/netif/io.systemd.Network rw, + @{run}/systemd/netif/leases/@{int} r, @{run}/systemd/netif/links/@{int} r, @{run}/systemd/netif/state r, diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 2e841dc51..b26dabae7 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -34,6 +34,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted / r, @{bin}/* r, /opt/** r, + @{user_lib_dirs}/** r, /etc/systemd/coredump.conf r, /etc/systemd/coredump.conf.d/{,**} r, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index f7e0af838..f558e57e7 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -27,6 +27,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { network netlink raw, + mqueue getattr type=posix /, mqueue r type=posix /, unix (bind) type=stream addr=@@{udbus}/bus/systemd-logind/system, @@ -95,6 +96,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{att}/@{run}/systemd/notify w, + @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw, @{att}/@{run}/systemd/userdb/io.systemd.Multiplexer rw, @{run}/systemd/inhibit/ rw, diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 0ca507140..619ca9dbb 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -72,6 +72,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { @{PROC}/pressure/* r, @{PROC}/sys/net/ipv{4,6}/** rw, owner @{PROC}/@{pid}/fdinfo/@{int} r, + owner @{PROC}/@{pid}/mountinfo r, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-sulogin-shell b/apparmor.d/groups/systemd/systemd-sulogin-shell index 094366391..d28531e56 100644 --- a/apparmor.d/groups/systemd/systemd-sulogin-shell +++ b/apparmor.d/groups/systemd/systemd-sulogin-shell @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-sulogin-shell -profile systemd-sulogin-shell @{exec_path} { +profile systemd-sulogin-shell @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index 4c57d0200..71c5a1503 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -25,7 +25,11 @@ profile systemd-tty-ask-password-agent @{exec_path} { @{run}/systemd/ask-password-block/{,*} rw, @{run}/systemd/ask-password/{,*} rw, + + @{run}/user/@{uid}/ w, + @{run}/user/@{uid}/systemd/ w, @{run}/user/@{uid}/systemd/ask-password/ rw, + @{run}/utmp rk, @{PROC}/@{pids}/stat r, From 644f6b74aab62c4f20b7101a766e20442bf7668f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 20:15:09 +0100 Subject: [PATCH 0595/1455] feat(profile): improve some core profiles. --- apparmor.d/groups/utils/blockdev | 2 +- apparmor.d/groups/utils/losetup | 11 ++++++++--- apparmor.d/groups/utils/sulogin | 6 +++--- apparmor.d/groups/virt/virtnodedevd | 9 +++++---- apparmor.d/profiles-a-f/dmsetup | 1 + apparmor.d/profiles-g-l/hostname | 1 + 6 files changed, 19 insertions(+), 11 deletions(-) diff --git a/apparmor.d/groups/utils/blockdev b/apparmor.d/groups/utils/blockdev index 88059a4c5..96e3ad23f 100644 --- a/apparmor.d/groups/utils/blockdev +++ b/apparmor.d/groups/utils/blockdev @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/blockdev profile blockdev @{exec_path} { include - include + include capability sys_admin, diff --git a/apparmor.d/groups/utils/losetup b/apparmor.d/groups/utils/losetup index fd2472dce..bb0ac6c74 100644 --- a/apparmor.d/groups/utils/losetup +++ b/apparmor.d/groups/utils/losetup @@ -10,18 +10,23 @@ include profile losetup @{exec_path} { include include + include capability dac_override, capability dac_read_search, - unix (receive) type=stream, + unix receive type=stream, @{exec_path} mr, - @{sys}/devices/**/usb[0-9]/{,**} r, + @{user_img_dirs}/** rw, + @{user_vm_dirs}/** rw, + + @{sys}/block/ r, + @{sys}/devices/virtual/block/loop@{int}/{,**} r, /dev/loop-control rw, - /dev/loop[0-9]* rw, + /dev/loop@{int} rw, include if exists } diff --git a/apparmor.d/groups/utils/sulogin b/apparmor.d/groups/utils/sulogin index 556808aeb..ccf7216e0 100644 --- a/apparmor.d/groups/utils/sulogin +++ b/apparmor.d/groups/utils/sulogin @@ -9,9 +9,12 @@ include @{exec_path} = @{bin}/sulogin profile sulogin @{exec_path} { include + include include + capability checkpoint_restore, capability sys_admin, + capability sys_tty_config, @{exec_path} mr, @@ -22,9 +25,6 @@ profile sulogin @{exec_path} { @{PROC}/consoles r, - /dev/ r, - /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index 0b48d63fd..957164e85 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -52,6 +52,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+leds:* r, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, + @{run}/udev/data/+power_supply:* r, @{run}/udev/data/+rfkill:* r, @{run}/udev/data/+sound:card@{int} r, # For sound card @{run}/udev/data/+thunderbolt:* r, @@ -73,14 +74,14 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/n@{int} r, @{sys}/**/ r, + @{sys}/devices/@{pci}/net/{,**} r, + @{sys}/devices/@{pci}/numa_node r, + @{sys}/devices/@{pci}/resource r, + @{sys}/devices/@{pci}/sriov_totalvfs r, @{sys}/devices/@{pci}/vpd r, @{sys}/devices/**/{class,revision,subsystem_vendor,subsystem_device} r, @{sys}/devices/**/{config,device,vendor} r, @{sys}/devices/**/uevent r, - @{sys}/devices/@{pci}/net/{,**} r, - @{sys}/devices/@{pci}/net/*/{duplex,address,speed,operstate} r, - @{sys}/devices/@{pci}/numa_node r, - @{sys}/devices/@{pci}/sriov_totalvfs r, @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node@{int}/meminfo r, @{sys}/devices/virtual/dmi/id/{product_name,product_serial,product_uuid,sys_vendor,board_vendor,bios_vendor,bios_date,bios_version,product_version} r, diff --git a/apparmor.d/profiles-a-f/dmsetup b/apparmor.d/profiles-a-f/dmsetup index d532bb8cf..b5a1f3ab7 100644 --- a/apparmor.d/profiles-a-f/dmsetup +++ b/apparmor.d/profiles-a-f/dmsetup @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/dmsetup profile dmsetup @{exec_path} { include + include include capability sys_admin, diff --git a/apparmor.d/profiles-g-l/hostname b/apparmor.d/profiles-g-l/hostname index 326d156ef..ac2ceb6e2 100644 --- a/apparmor.d/profiles-g-l/hostname +++ b/apparmor.d/profiles-g-l/hostname @@ -16,6 +16,7 @@ profile hostname @{exec_path} { capability sys_admin, network inet dgram, + network inet6 dgram, # network ip=127.0.0.1:53, TODO: abi 4.0 network netlink raw, From 81ecce1ef7a63de5e9be21fd79f8448abc117ac0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 20:17:49 +0100 Subject: [PATCH 0596/1455] fix(build): test in directive. --- pkg/prebuild/directive/exec_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/prebuild/directive/exec_test.go b/pkg/prebuild/directive/exec_test.go index 5581d7f2b..255d9a237 100644 --- a/pkg/prebuild/directive/exec_test.go +++ b/pkg/prebuild/directive/exec_test.go @@ -36,7 +36,7 @@ func TestExec_Apply(t *testing.T) { }, { name: "exec-unconfined", - rootApparmord: paths.New("../../../apparmor.d/groups/freedesktop/"), + rootApparmord: paths.New("../../../apparmor.d/groups/polkit/"), opt: &Option{ Name: "exec", ArgMap: map[string]string{"U": "", "polkit-agent-helper": ""}, From 972ae950e41a5091375dcbfff21259e2a279282c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 20:53:49 +0100 Subject: [PATCH 0597/1455] build: improve the dbus directive. - Support for additional interfaces: += - Restrict the generated dbus rules - Add the required unix bind rule. --- pkg/prebuild/directive/core_test.go | 12 +- pkg/prebuild/directive/dbus.go | 187 ++++++++++++++++++---------- pkg/prebuild/directive/dbus_test.go | 131 ++++++++++--------- 3 files changed, 199 insertions(+), 131 deletions(-) diff --git a/pkg/prebuild/directive/core_test.go b/pkg/prebuild/directive/core_test.go index faf39df4b..229dda630 100644 --- a/pkg/prebuild/directive/core_test.go +++ b/pkg/prebuild/directive/core_test.go @@ -20,7 +20,7 @@ func TestNewOption(t *testing.T) { }{ { name: "dbus", - file: nil, + file: paths.New("dbus"), match: []string{ " #aa:dbus own bus=system name=org.gnome.DisplayManager", "dbus", @@ -34,13 +34,13 @@ func TestNewOption(t *testing.T) { "own": "", }, ArgList: []string{"own", "bus=system", "name=org.gnome.DisplayManager"}, - File: nil, + File: paths.New("dbus"), Raw: " #aa:dbus own bus=system name=org.gnome.DisplayManager", }, }, { name: "only", - file: nil, + file: paths.New("only"), match: []string{ " #aa:only opensuse", "only", @@ -50,7 +50,7 @@ func TestNewOption(t *testing.T) { Name: "only", ArgMap: map[string]string{"opensuse": ""}, ArgList: []string{"opensuse"}, - File: nil, + File: paths.New("only"), Raw: " #aa:only opensuse", }, }, @@ -74,13 +74,13 @@ func TestRun(t *testing.T) { }{ { name: "none", - file: nil, + file: paths.New("dummy"), profile: ` `, want: ` `, }, { name: "present", - file: nil, + file: paths.New("fake-own"), profile: ` #aa:dbus own bus=system name=org.freedesktop.systemd1`, want: dbusOwnSystemd1, }, diff --git a/pkg/prebuild/directive/dbus.go b/pkg/prebuild/directive/dbus.go index a1135d675..4a9030505 100644 --- a/pkg/prebuild/directive/dbus.go +++ b/pkg/prebuild/directive/dbus.go @@ -21,11 +21,6 @@ import ( "github.com/roddhjav/apparmor.d/pkg/prebuild" ) -var defaultInterfaces = []string{ - "org.freedesktop.DBus.Properties", - "org.freedesktop.DBus.ObjectManager", -} - type Dbus struct { prebuild.Base } @@ -43,15 +38,6 @@ func init() { ) } -func setInterfaces(rules map[string]string) []string { - interfaces := []string{rules["name"]} - if _, present := rules["interface"]; present { - interfaces = append(interfaces, rules["interface"]) - } - interfaces = append(interfaces, defaultInterfaces...) - return interfaces -} - func (d Dbus) Apply(opt *Option, profile string) (string, error) { var r aa.Rules @@ -59,11 +45,15 @@ func (d Dbus) Apply(opt *Option, profile string) (string, error) { if err != nil { return "", err } + name := opt.File.Base() + if len(name) > 15 { + name = name[:15] + } switch action { case "own": - r = d.own(opt.ArgMap) + r = d.own(opt.ArgMap, name) case "talk": - r = d.talk(opt.ArgMap) + r = d.talk(opt.ArgMap, name) } aa.IndentationLevel = strings.Count( @@ -103,63 +93,132 @@ func (d Dbus) sanityCheck(opt *Option) (string, error) { return action, nil } -func (d Dbus) own(rules map[string]string) aa.Rules { - interfaces := setInterfaces(rules) - res := aa.Rules{} - res = append(res, &aa.Dbus{ - Access: []string{"bind"}, Bus: rules["bus"], Name: rules["name"], - }) - for _, iface := range interfaces { - res = append(res, &aa.Dbus{ - Access: []string{"receive"}, - Bus: rules["bus"], - Path: rules["path"], - Interface: iface, - PeerName: `":1.@{int}"`, - }) +func getInterfaces(rules map[string]string) []string { + var interfaces []string + if _, present := rules["interface"]; present { + interfaces = []string{rules["interface"]} + } else { + interfaces = []string{rules["name"]} } - for _, iface := range interfaces { - res = append(res, &aa.Dbus{ - Access: []string{"send"}, - Bus: rules["bus"], - Path: rules["path"], - Interface: iface, - PeerName: `"{:1.@{int},org.freedesktop.DBus}"`, - }) + + if _, present := rules["interface+"]; present { + interfaces = append(interfaces, rules["interface+"]) } - res = append(res, &aa.Dbus{ - Access: []string{"receive"}, - Bus: rules["bus"], - Path: rules["path"], - Interface: "org.freedesktop.DBus.Introspectable", - Member: "Introspect", - PeerName: `":1.@{int}"`, - }) + return interfaces +} + +func (d Dbus) own(rules map[string]string, name string) aa.Rules { + interfaces := getInterfaces(rules) + + res := aa.Rules{ + &aa.Unix{ + Access: []string{"bind"}, Type: "stream", + Address: `@@{udbus}/bus/` + name + `/` + rules["bus"], + }, + &aa.Dbus{ + Access: []string{"bind"}, Bus: rules["bus"], Name: rules["name"], + }, + } + + // Interfaces + for _, iface := range interfaces { + res = append(res, + &aa.Dbus{ + Access: []string{"receive"}, Bus: rules["bus"], Path: rules["path"], + Interface: iface, + PeerName: `"@{busname}"`, + }, + &aa.Dbus{ + Access: []string{"send"}, Bus: rules["bus"], Path: rules["path"], + Interface: iface, + PeerName: `"{@{busname},org.freedesktop.DBus}"`, + }, + ) + } + + res = append(res, + // DBus.Properties + &aa.Dbus{ + Access: []string{"send", "receive"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.Properties", + Member: "{Get,GetAll,Set,PropertiesChanged}", + PeerName: `"{@{busname},org.freedesktop.DBus}"`, + }, + + // DBus.Introspectable + &aa.Dbus{ + Access: []string{"receive"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.Introspectable", + Member: "Introspect", + PeerName: `"@{busname}"`, + }, + + // DBus.ObjectManager + &aa.Dbus{ + Access: []string{"receive"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.ObjectManager", + Member: "GetManagedObjects", + PeerName: `"{@{busname},` + rules["name"] + `}"`, + }, + &aa.Dbus{ + Access: []string{"send"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.ObjectManager", + Member: "{InterfacesAdded,InterfacesRemoved}", + PeerName: `"{@{busname},org.freedesktop.DBus}"`, + }, + ) return res } -func (d Dbus) talk(rules map[string]string) aa.Rules { - interfaces := setInterfaces(rules) - res := aa.Rules{} +func (d Dbus) talk(rules map[string]string, name string) aa.Rules { + interfaces := getInterfaces(rules) + + res := aa.Rules{ + &aa.Unix{ + Access: []string{"bind"}, Type: "stream", + Address: `@@{udbus}/bus/` + name + `/` + rules["bus"], + }, + } + + // Interfaces for _, iface := range interfaces { res = append(res, &aa.Dbus{ - Access: []string{"send"}, - Bus: rules["bus"], - Path: rules["path"], + Access: []string{"send", "receive"}, Bus: rules["bus"], Path: rules["path"], Interface: iface, - PeerName: `"{:1.@{int},` + rules["name"] + `}"`, - PeerLabel: rules["label"], - }) - } - for _, iface := range interfaces { - res = append(res, &aa.Dbus{ - Access: []string{"receive"}, - Bus: rules["bus"], - Path: rules["path"], - Interface: iface, - PeerName: `"{:1.@{int},` + rules["name"] + `}"`, - PeerLabel: rules["label"], + PeerName: `"{@{busname},` + rules["name"] + `}"`, PeerLabel: rules["label"], }) } + + res = append(res, + // DBus.Properties + &aa.Dbus{ + Access: []string{"send", "receive"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.Properties", + Member: "{Get,GetAll,Set,PropertiesChanged}", + PeerName: `"{@{busname},` + rules["name"] + `}"`, PeerLabel: rules["label"], + }, + + // DBus.Introspectable + &aa.Dbus{ + Access: []string{"send"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.Introspectable", + Member: "Introspect", + PeerName: `"{@{busname},` + rules["name"] + `}"`, PeerLabel: rules["label"], + }, + + // DBus.ObjectManager + &aa.Dbus{ + Access: []string{"send"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.ObjectManager", + Member: "GetManagedObjects", + PeerName: `"{@{busname},` + rules["name"] + `}"`, PeerLabel: rules["label"], + }, + &aa.Dbus{ + Access: []string{"receive"}, Bus: rules["bus"], Path: rules["path"], + Interface: "org.freedesktop.DBus.ObjectManager", + Member: "{InterfacesAdded,InterfacesRemoved}", + PeerName: `"{@{busname},` + rules["name"] + `}"`, PeerLabel: rules["label"], + }, + ) return res } diff --git a/pkg/prebuild/directive/dbus_test.go b/pkg/prebuild/directive/dbus_test.go index 65e55e785..f2d4997e4 100644 --- a/pkg/prebuild/directive/dbus_test.go +++ b/pkg/prebuild/directive/dbus_test.go @@ -6,31 +6,35 @@ package directive import ( "testing" + + "github.com/roddhjav/apparmor.d/pkg/paths" ) -const dbusOwnSystemd1 = ` dbus bind bus=system name=org.freedesktop.systemd1{,.*}, +const dbusOwnSystemd1 = ` unix bind type=stream addr=@@{udbus}/bus/fake-own/system, + + dbus bind bus=system name=org.freedesktop.systemd1{,.*}, dbus receive bus=system path=/org/freedesktop/systemd1{,/**} interface=org.freedesktop.systemd1{,.*} - peer=(name=":1.@{int}"), - dbus receive bus=system path=/org/freedesktop/systemd1{,/**} - interface=org.freedesktop.DBus.Properties - peer=(name=":1.@{int}"), - dbus receive bus=system path=/org/freedesktop/systemd1{,/**} - interface=org.freedesktop.DBus.ObjectManager - peer=(name=":1.@{int}"), + peer=(name="@{busname}"), dbus send bus=system path=/org/freedesktop/systemd1{,/**} interface=org.freedesktop.systemd1{,.*} - peer=(name="{:1.@{int},org.freedesktop.DBus}"), - dbus send bus=system path=/org/freedesktop/systemd1{,/**} + peer=(name="{@{busname},org.freedesktop.DBus}"), + dbus (send receive) bus=system path=/org/freedesktop/systemd1{,/**} interface=org.freedesktop.DBus.Properties - peer=(name="{:1.@{int},org.freedesktop.DBus}"), - dbus send bus=system path=/org/freedesktop/systemd1{,/**} - interface=org.freedesktop.DBus.ObjectManager - peer=(name="{:1.@{int},org.freedesktop.DBus}"), + member={Get,GetAll,Set,PropertiesChanged} + peer=(name="{@{busname},org.freedesktop.DBus}"), dbus receive bus=system path=/org/freedesktop/systemd1{,/**} interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=":1.@{int}"),` + peer=(name="@{busname}"), + dbus receive bus=system path=/org/freedesktop/systemd1{,/**} + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name="{@{busname},org.freedesktop.systemd1{,.*}}"), + dbus send bus=system path=/org/freedesktop/systemd1{,/**} + interface=org.freedesktop.DBus.ObjectManager + member={InterfacesAdded,InterfacesRemoved} + peer=(name="{@{busname},org.freedesktop.DBus}"),` func TestDbus_Apply(t *testing.T) { tests := []struct { @@ -50,7 +54,7 @@ func TestDbus_Apply(t *testing.T) { "own": "", }, ArgList: []string{"own", "bus=system", "name=org.freedesktop.systemd1"}, - File: nil, + File: paths.New("fake-own"), Raw: " #aa:dbus own bus=system name=org.freedesktop.systemd1", }, profile: " #aa:dbus own bus=system name=org.freedesktop.systemd1", @@ -61,45 +65,47 @@ func TestDbus_Apply(t *testing.T) { opt: &Option{ Name: "dbus", ArgMap: map[string]string{ - "bus": "session", - "name": "com.rastersoft.dingextension", - "interface": "org.gtk.Actions", - "own": "", + "bus": "session", + "name": "com.rastersoft.ding", + "interface+": "org.gtk.Actions", + "own": "", }, - ArgList: []string{"own", "bus=session", "name=com.rastersoft.dingextension", "interface=org.gtk.Actions"}, - File: nil, - Raw: " #aa:dbus own bus=session name=com.rastersoft.dingextension interface=org.gtk.Actions", + ArgList: []string{"own", "bus=session", "name=com.rastersoft.ding", "interface+=org.gtk.Actions"}, + File: paths.New("fake-interface"), + Raw: " #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions", }, - profile: " #aa:dbus own bus=session name=com.rastersoft.dingextension interface=org.gtk.Actions", - want: ` dbus bind bus=session name=com.rastersoft.dingextension{,.*}, - dbus receive bus=session path=/com/rastersoft/dingextension{,/**} - interface=com.rastersoft.dingextension{,.*} - peer=(name=":1.@{int}"), - dbus receive bus=session path=/com/rastersoft/dingextension{,/**} + profile: " #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions", + want: ` unix bind type=stream addr=@@{udbus}/bus/fake-interface/session, + + dbus bind bus=session name=com.rastersoft.ding{,.*}, + dbus receive bus=session path=/com/rastersoft/ding{,/**} + interface=com.rastersoft.ding{,.*} + peer=(name="@{busname}"), + dbus send bus=session path=/com/rastersoft/ding{,/**} + interface=com.rastersoft.ding{,.*} + peer=(name="{@{busname},org.freedesktop.DBus}"), + dbus receive bus=session path=/com/rastersoft/ding{,/**} interface=org.gtk.Actions - peer=(name=":1.@{int}"), - dbus receive bus=session path=/com/rastersoft/dingextension{,/**} - interface=org.freedesktop.DBus.Properties - peer=(name=":1.@{int}"), - dbus receive bus=session path=/com/rastersoft/dingextension{,/**} - interface=org.freedesktop.DBus.ObjectManager - peer=(name=":1.@{int}"), - dbus send bus=session path=/com/rastersoft/dingextension{,/**} - interface=com.rastersoft.dingextension{,.*} - peer=(name="{:1.@{int},org.freedesktop.DBus}"), - dbus send bus=session path=/com/rastersoft/dingextension{,/**} + peer=(name="@{busname}"), + dbus send bus=session path=/com/rastersoft/ding{,/**} interface=org.gtk.Actions - peer=(name="{:1.@{int},org.freedesktop.DBus}"), - dbus send bus=session path=/com/rastersoft/dingextension{,/**} + peer=(name="{@{busname},org.freedesktop.DBus}"), + dbus (send receive) bus=session path=/com/rastersoft/ding{,/**} interface=org.freedesktop.DBus.Properties - peer=(name="{:1.@{int},org.freedesktop.DBus}"), - dbus send bus=session path=/com/rastersoft/dingextension{,/**} - interface=org.freedesktop.DBus.ObjectManager - peer=(name="{:1.@{int},org.freedesktop.DBus}"), - dbus receive bus=session path=/com/rastersoft/dingextension{,/**} + member={Get,GetAll,Set,PropertiesChanged} + peer=(name="{@{busname},org.freedesktop.DBus}"), + dbus receive bus=session path=/com/rastersoft/ding{,/**} interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=":1.@{int}"),`, + peer=(name="@{busname}"), + dbus receive bus=session path=/com/rastersoft/ding{,/**} + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name="{@{busname},com.rastersoft.ding{,.*}}"), + dbus send bus=session path=/com/rastersoft/ding{,/**} + interface=org.freedesktop.DBus.ObjectManager + member={InterfacesAdded,InterfacesRemoved} + peer=(name="{@{busname},org.freedesktop.DBus}"),`, }, { name: "talk", @@ -112,28 +118,31 @@ func TestDbus_Apply(t *testing.T) { "talk": "", }, ArgList: []string{"talk", "bus=system", "name=org.freedesktop.Accounts", "label=accounts-daemon"}, - File: nil, + File: paths.New("gdm-session-worker"), Raw: " #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon", }, profile: " #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon", - want: ` dbus send bus=system path=/org/freedesktop/Accounts{,/**} + want: ` unix bind type=stream addr=@@{udbus}/bus/gdm-session-wor/system, + + dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} interface=org.freedesktop.Accounts{,.*} - peer=(name="{:1.@{int},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), - dbus send bus=system path=/org/freedesktop/Accounts{,/**} + peer=(name="{@{busname},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), + dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} interface=org.freedesktop.DBus.Properties - peer=(name="{:1.@{int},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), + member={Get,GetAll,Set,PropertiesChanged} + peer=(name="{@{busname},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), + dbus send bus=system path=/org/freedesktop/Accounts{,/**} + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name="{@{busname},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), dbus send bus=system path=/org/freedesktop/Accounts{,/**} interface=org.freedesktop.DBus.ObjectManager - peer=(name="{:1.@{int},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), - dbus receive bus=system path=/org/freedesktop/Accounts{,/**} - interface=org.freedesktop.Accounts{,.*} - peer=(name="{:1.@{int},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), - dbus receive bus=system path=/org/freedesktop/Accounts{,/**} - interface=org.freedesktop.DBus.Properties - peer=(name="{:1.@{int},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), + member=GetManagedObjects + peer=(name="{@{busname},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), dbus receive bus=system path=/org/freedesktop/Accounts{,/**} interface=org.freedesktop.DBus.ObjectManager - peer=(name="{:1.@{int},org.freedesktop.Accounts{,.*}}", label=accounts-daemon),`, + member={InterfacesAdded,InterfacesRemoved} + peer=(name="{@{busname},org.freedesktop.Accounts{,.*}}", label=accounts-daemon),`, }, } for _, tt := range tests { From 6ebbb31589f908ed2e37669104429ef721dd9243 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 21:06:41 +0100 Subject: [PATCH 0598/1455] feat(profile): dbus directive use the new interface+= --- apparmor.d/groups/gnome/gnome-calculator-search-provider | 2 +- apparmor.d/groups/gnome/gnome-characters | 2 +- apparmor.d/groups/gnome/gnome-extension-ding | 4 ++-- apparmor.d/groups/gnome/gnome-initial-setup | 2 +- apparmor.d/groups/gnome/gnome-terminal-server | 2 +- apparmor.d/groups/gnome/nautilus | 2 +- apparmor.d/groups/gnome/tracker-extract | 2 +- apparmor.d/groups/gvfs/gvfs-afc-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-goa-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor | 2 +- apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor | 2 +- 12 files changed, 13 insertions(+), 13 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-calculator-search-provider b/apparmor.d/groups/gnome/gnome-calculator-search-provider index 2eaacdefb..da03ed665 100644 --- a/apparmor.d/groups/gnome/gnome-calculator-search-provider +++ b/apparmor.d/groups/gnome/gnome-calculator-search-provider @@ -17,7 +17,7 @@ profile gnome-calculator-search-provider @{exec_path} { signal (send) set=kill peer=unconfined, - #aa:dbus own bus=session name=org.gnome.Calculator.SearchProvider interface=org.gnome.Shell.SearchProvider2 + #aa:dbus own bus=session name=org.gnome.Calculator.SearchProvider interface+=org.gnome.Shell.SearchProvider2 @{exec_path} mrix, diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 9ae8a7b8a..9511e781f 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -15,7 +15,7 @@ profile gnome-characters @{exec_path} { include include - #aa:dbus own bus=session name=org.gnome.Characters interface=org.gnome.Shell.SearchProvider2 + #aa:dbus own bus=session name=org.gnome.Characters interface+=org.gnome.Shell.SearchProvider2 @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index 068469606..72833a065 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -32,8 +32,8 @@ profile gnome-extension-ding @{exec_path} { unix (send,receive) type=stream addr=none peer=(label=gnome-shell), - #aa:dbus own bus=session name=com.rastersoft.ding interface=org.gtk.Actions - #aa:dbus talk bus=session name=com.rastersoft.dingextension label=gnome-shell interface=org.gtk.Actions + #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions + #aa:dbus talk bus=session name=com.rastersoft.dingextension label=gnome-shell interface+=org.gtk.Actions dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index 84f6b15c8..89769477a 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -29,7 +29,7 @@ profile gnome-initial-setup @{exec_path} { network inet6 stream, network netlink raw, - #aa:dbus own bus=session name=org.gnome.InitialSetup interface=org.gtk.Actions + #aa:dbus own bus=session name=org.gnome.InitialSetup interface+=org.gtk.Actions @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index d96c20c36..55a7f4687 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -25,7 +25,7 @@ profile gnome-terminal-server @{exec_path} { ptrace (read) peer=htop, ptrace (read) peer=unconfined, - #aa:dbus own bus=session name=org.gnome.Terminal interface=org.gtk.Actions + #aa:dbus own bus=session name=org.gnome.Terminal interface+=org.gtk.Actions dbus receive bus=session path=/org/gnome/Terminal/SearchProvider interface=org.gnome.Shell.SearchProvider2 diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 7e25ee08c..3a7fdd4f4 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -28,7 +28,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { mqueue r type=posix /, - #aa:dbus own bus=session name=org.gnome.Nautilus interface=org.gtk.{Application,Actions} + #aa:dbus own bus=session name=org.gnome.Nautilus interface+=org.gtk.{Application,Actions} #aa:dbus own bus=session name=org.freedesktop.FileManager1 #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 02237d932..40d938a63 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -28,7 +28,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.Tracker3.Miner.Extract - #aa:dbus talk bus=session name=org.freedesktop.Tracker3 label=tracker-miner interface=org.freedesktop.DBus.Peer + #aa:dbus talk bus=session name=org.freedesktop.Tracker3 label=tracker-miner interface+=org.freedesktop.DBus.Peer dbus send bus=session path=/org/gtk/vfs/metadata interface=org.gtk.vfs.Metadata diff --git a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor index c1058c158..7f50d8b45 100644 --- a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor @@ -12,7 +12,7 @@ profile gvfs-afc-volume-monitor @{exec_path} { include include - #aa:dbus own bus=session name=org.gtk.vfs.AfcVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor + #aa:dbus own bus=session name=org.gtk.vfs.AfcVolumeMonitor interface+=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor index 1b5f74ae3..3f2fb0138 100644 --- a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor @@ -12,7 +12,7 @@ profile gvfs-goa-volume-monitor @{exec_path} { include include - #aa:dbus own bus=session name=org.gtk.vfs.GoaVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor + #aa:dbus own bus=session name=org.gtk.vfs.GoaVolumeMonitor interface+=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor index f2b534635..dd03254b1 100644 --- a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor @@ -16,7 +16,7 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} { network netlink raw, - #aa:dbus own bus=session name=org.gtk.vfs.GPhoto2VolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor + #aa:dbus own bus=session name=org.gtk.vfs.GPhoto2VolumeMonitor interface+=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor index d71b71523..6fbbc6092 100644 --- a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor @@ -15,7 +15,7 @@ profile gvfs-mtp-volume-monitor @{exec_path} { network netlink raw, - #aa:dbus own bus=session name=org.gtk.vfs.MTPVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor + #aa:dbus own bus=session name=org.gtk.vfs.MTPVolumeMonitor interface+=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor index ccbe15fd1..4ed214b71 100644 --- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor @@ -29,7 +29,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) { ptrace (read), - #aa:dbus own bus=session name=org.gtk.vfs.UDisks2VolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor + #aa:dbus own bus=session name=org.gtk.vfs.UDisks2VolumeMonitor interface+=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd dbus receive bus=session From a793e711e5789097114bd4b72e85371a472ef05a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 23 Feb 2025 22:18:38 +0100 Subject: [PATCH 0599/1455] fix(profile): dbus rule malformed. --- apparmor.d/groups/bus/dbus-session | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index f87e71c81..cc6b33f61 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -30,7 +30,7 @@ profile dbus-session flags=(attach_disconnected) { signal (send) set=(term hup kill) peer=dconf-service, signal (send) set=(term hup kill) peer=xdg-*, - #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/{d,D}Bus} + #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/{dBus,DBus,dbus}} dbus receive bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=Hello From 161078ed900493f028e06ffc7efc3c5f816374d6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 13:18:19 +0100 Subject: [PATCH 0600/1455] tests: move common cloud-init config to a unified file, rename some base distribution. --- .../cloud-init/archlinux-cosmic.user-data.yml | 15 -------- .../cloud-init/archlinux-gnome.user-data.yml | 15 -------- tests/cloud-init/archlinux-kde.user-data.yml | 15 -------- .../cloud-init/archlinux-server.user-data.yml | 15 -------- tests/cloud-init/archlinux-xfce.user-data.yml | 15 -------- tests/cloud-init/common.yml | 17 +++++++++ ...-data.yml => debian12-gnome.user-data.yml} | 15 -------- ...er-data.yml => debian12-kde.user-data.yml} | 15 -------- ...data.yml => debian12-server.user-data.yml} | 15 -------- tests/cloud-init/opensuse-gnome.user-data.yml | 15 -------- tests/cloud-init/opensuse-kde.user-data.yml | 15 -------- .../cloud-init/opensuse-server.user-data.yml | 36 +++++++++++++++++++ .../cloud-init/ubuntu22-desktop.user-data.yml | 15 -------- .../cloud-init/ubuntu24-desktop.user-data.yml | 17 --------- .../cloud-init/ubuntu24-server.user-data.yml | 15 -------- 15 files changed, 53 insertions(+), 197 deletions(-) create mode 100644 tests/cloud-init/common.yml rename tests/cloud-init/{debian-gnome.user-data.yml => debian12-gnome.user-data.yml} (74%) rename tests/cloud-init/{debian-kde.user-data.yml => debian12-kde.user-data.yml} (68%) rename tests/cloud-init/{debian-server.user-data.yml => debian12-server.user-data.yml} (73%) create mode 100644 tests/cloud-init/opensuse-server.user-data.yml diff --git a/tests/cloud-init/archlinux-cosmic.user-data.yml b/tests/cloud-init/archlinux-cosmic.user-data.yml index d95381b96..70d446076 100644 --- a/tests/cloud-init/archlinux-cosmic.user-data.yml +++ b/tests/cloud-init/archlinux-cosmic.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: # Install core packages - apparmor diff --git a/tests/cloud-init/archlinux-gnome.user-data.yml b/tests/cloud-init/archlinux-gnome.user-data.yml index a2a3d78b8..1fa1c9c1d 100644 --- a/tests/cloud-init/archlinux-gnome.user-data.yml +++ b/tests/cloud-init/archlinux-gnome.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: # Install core packages - apparmor diff --git a/tests/cloud-init/archlinux-kde.user-data.yml b/tests/cloud-init/archlinux-kde.user-data.yml index eea5df046..5953eab2e 100644 --- a/tests/cloud-init/archlinux-kde.user-data.yml +++ b/tests/cloud-init/archlinux-kde.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: # Install core packages - apparmor diff --git a/tests/cloud-init/archlinux-server.user-data.yml b/tests/cloud-init/archlinux-server.user-data.yml index 4a7f17374..e0edaca16 100644 --- a/tests/cloud-init/archlinux-server.user-data.yml +++ b/tests/cloud-init/archlinux-server.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: # Install core packages - apparmor diff --git a/tests/cloud-init/archlinux-xfce.user-data.yml b/tests/cloud-init/archlinux-xfce.user-data.yml index 07d87364b..e9f4a78a6 100644 --- a/tests/cloud-init/archlinux-xfce.user-data.yml +++ b/tests/cloud-init/archlinux-xfce.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: # Install core packages - apparmor diff --git a/tests/cloud-init/common.yml b/tests/cloud-init/common.yml new file mode 100644 index 000000000..ac619c879 --- /dev/null +++ b/tests/cloud-init/common.yml @@ -0,0 +1,17 @@ +#cloud-config + +hostname: ${hostname} + +ssh_pwauth: true +users: + - name: ${username} + plain_text_passwd: ${password} + shell: /bin/bash + ssh_authorized_keys: + - ${ssh_key} + lock_passwd: false + sudo: ALL=(ALL) NOPASSWD:ALL + +package_update: true +package_upgrade: true +package_reboot_if_required: false diff --git a/tests/cloud-init/debian-gnome.user-data.yml b/tests/cloud-init/debian12-gnome.user-data.yml similarity index 74% rename from tests/cloud-init/debian-gnome.user-data.yml rename to tests/cloud-init/debian12-gnome.user-data.yml index 1c48eb2e9..5ce6cedf5 100644 --- a/tests/cloud-init/debian-gnome.user-data.yml +++ b/tests/cloud-init/debian12-gnome.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - auditd diff --git a/tests/cloud-init/debian-kde.user-data.yml b/tests/cloud-init/debian12-kde.user-data.yml similarity index 68% rename from tests/cloud-init/debian-kde.user-data.yml rename to tests/cloud-init/debian12-kde.user-data.yml index e644414fa..451068db1 100644 --- a/tests/cloud-init/debian-kde.user-data.yml +++ b/tests/cloud-init/debian12-kde.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - auditd diff --git a/tests/cloud-init/debian-server.user-data.yml b/tests/cloud-init/debian12-server.user-data.yml similarity index 73% rename from tests/cloud-init/debian-server.user-data.yml rename to tests/cloud-init/debian12-server.user-data.yml index 47e4d832d..aef29f579 100644 --- a/tests/cloud-init/debian-server.user-data.yml +++ b/tests/cloud-init/debian12-server.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - auditd diff --git a/tests/cloud-init/opensuse-gnome.user-data.yml b/tests/cloud-init/opensuse-gnome.user-data.yml index 5e5b197bc..406b4445d 100644 --- a/tests/cloud-init/opensuse-gnome.user-data.yml +++ b/tests/cloud-init/opensuse-gnome.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - bash-completion diff --git a/tests/cloud-init/opensuse-kde.user-data.yml b/tests/cloud-init/opensuse-kde.user-data.yml index 5e5b197bc..406b4445d 100644 --- a/tests/cloud-init/opensuse-kde.user-data.yml +++ b/tests/cloud-init/opensuse-kde.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - bash-completion diff --git a/tests/cloud-init/opensuse-server.user-data.yml b/tests/cloud-init/opensuse-server.user-data.yml new file mode 100644 index 000000000..7699fb074 --- /dev/null +++ b/tests/cloud-init/opensuse-server.user-data.yml @@ -0,0 +1,36 @@ +#cloud-config + +packages: + - apparmor-profiles + - bash-completion + - distribution-release + - git + - go + - golang-packaging + - htop + - make + - rpmbuild + - rsync + - vim + +write_files: + + # Setup shared directory + - path: /etc/fstab + append: true + content: | + 0a31bc478ef8e2461a4b1cc10a24cc4 /home/user/Projects/apparmor.d virtiofs defaults 0 1 + + # Network configuration + - path: /etc/systemd/network/20-wired.network + owner: "root:root" + permissions: "0644" + content: | + [Match] + Name=en* + + [Network] + DHCP=yes + + [DHCPv4] + RouteMetric=10 diff --git a/tests/cloud-init/ubuntu22-desktop.user-data.yml b/tests/cloud-init/ubuntu22-desktop.user-data.yml index 75dc6349d..5f4dc69f5 100644 --- a/tests/cloud-init/ubuntu22-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu22-desktop.user-data.yml @@ -2,21 +2,6 @@ # Based on https://github.com/canonical/autoinstall-desktop -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - build-essential diff --git a/tests/cloud-init/ubuntu24-desktop.user-data.yml b/tests/cloud-init/ubuntu24-desktop.user-data.yml index 9f7225367..7a71b0afe 100644 --- a/tests/cloud-init/ubuntu24-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu24-desktop.user-data.yml @@ -2,23 +2,6 @@ # Based on https://github.com/canonical/autoinstall-desktop -# https://github.com/canonical/ubuntu-desktop-provision/blob/main/README.md - -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - build-essential diff --git a/tests/cloud-init/ubuntu24-server.user-data.yml b/tests/cloud-init/ubuntu24-server.user-data.yml index 96318214c..8e9c7bd38 100644 --- a/tests/cloud-init/ubuntu24-server.user-data.yml +++ b/tests/cloud-init/ubuntu24-server.user-data.yml @@ -1,20 +1,5 @@ #cloud-config -hostname: ${hostname} - -ssh_pwauth: true -users: - - name: ${username} - plain_text_passwd: ${password} - shell: /bin/bash - ssh_authorized_keys: - - ${ssh_key} - lock_passwd: false - sudo: ALL=(ALL) NOPASSWD:ALL - -package_update: true -package_upgrade: true -package_reboot_if_required: false packages: - apparmor-profiles - auditd From d8d4ec11a611c153bae2f68aec69a7aa02c64298 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 14:20:35 +0100 Subject: [PATCH 0601/1455] feat(profile): systemd-networkd: update cap. --- apparmor.d/groups/systemd/systemd-networkd | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 619ca9dbb..20b396a72 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -14,10 +14,12 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { include include + capability bpf, capability net_admin, capability net_bind_service, capability net_broadcast, capability net_raw, + capability sys_admin, network inet dgram, network inet6 dgram, @@ -61,12 +63,14 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/n@{int} r, + @{sys}/devices/@{pci}/ r, @{sys}/devices/@{pci}/rfkill@{int}/* r, @{sys}/devices/**/net/** r, - @{sys}/devices/@{pci}/ r, @{sys}/devices/virtual/dmi/id/{sys,board,bios}_vendor r, @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/product_version r, + @{sys}/fs/cgroup/ r, + @{sys}/kernel/btf/vmlinux r, @{PROC}/@{pid}/cgroup r, @{PROC}/pressure/* r, From 835b73f64e72e8c81542ea4f9ea937cbf54b0b0a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 14:27:55 +0100 Subject: [PATCH 0602/1455] build: prepare apparmor 4.1 Split upstreamed and non upstreamed tunable so that it easy to ignore the upstreamed version on apparmor 4.1. --- apparmor.d/tunables/multiarch.d/base | 93 ++++++++++++++++++++++++++ apparmor.d/tunables/multiarch.d/system | 92 ------------------------- 2 files changed, 93 insertions(+), 92 deletions(-) create mode 100644 apparmor.d/tunables/multiarch.d/base diff --git a/apparmor.d/tunables/multiarch.d/base b/apparmor.d/tunables/multiarch.d/base new file mode 100644 index 000000000..9661b1e51 --- /dev/null +++ b/apparmor.d/tunables/multiarch.d/base @@ -0,0 +1,93 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Base variables, upstreamed in apparmor 4.1 + +# Any digit +@{d}=[0-9] + +# Any letter +@{l}=[a-zA-Z] + +# Single alphanumeric character +@{c}=[0-9a-zA-Z] + +# Word character: matches any letter, digit or underscore. +@{w}=[a-zA-Z0-9_] + +# Single hexadecimal character +@{h}=[0-9a-fA-F] + +# Integer up to 10 digits (0-9999999999) +@{int}=@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},} + +# hexadecimal, alphanumeric and word up to 64 characters +@{hex}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} +@{rand}=@{c}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},} +@{word}=@{w}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} + +# Unsigned integer over 8 bits (0...255) +@{u8}=[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5] + +# Unsigned integer over 16 bits (0...65,535 5 digits) +@{u16}={@{d},[1-9]@{d},[1-9][@{d}@{d},[1-9]@{d}@{d}@{d},[1-6]@{d}@{d}@{d}@{d}} + +# Unsigned integer over 32 bits (0...4,294,967,295 10 digits) +@{u32}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-4]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} + +# Unsigned integer over 64 bits (0...18,446,744,073,709,551,615 20 digits). +@{u64}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},1@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} + +# Any x digits characters +@{int2}=@{d}@{d} +@{int4}=@{int2}@{int2} +@{int6}=@{int4}@{int2} +@{int8}=@{int4}@{int4} +@{int9}=@{int8}@{d} +@{int10}=@{int8}@{int2} +@{int12}=@{int8}@{int4} +@{int15}=@{int8}@{int4}@{int2}@{d} +@{int16}=@{int8}@{int8} +@{int32}=@{int16}@{int16} +@{int64}=@{int32}@{int32} + +# Any x hexadecimal characters +@{hex2}=@{h}@{h} +@{hex4}=@{hex2}@{hex2} +@{hex6}=@{hex4}@{hex2} +@{hex8}=@{hex4}@{hex4} +@{hex9}=@{hex8}@{h} +@{hex10}=@{hex8}@{hex2} +@{hex12}=@{hex8}@{hex4} +@{hex15}=@{hex8}@{hex4}@{hex2}@{h} +@{hex16}=@{hex8}@{hex8} +@{hex32}=@{hex16}@{hex16} +@{hex38}=@{hex32}@{hex6} +@{hex64}=@{hex32}@{hex32} + +# Any x alphanumeric characters +@{rand2}=@{c}@{c} +@{rand4}=@{rand2}@{rand2} +@{rand6}=@{rand4}@{rand2} +@{rand8}=@{rand4}@{rand4} +@{rand9}=@{rand8}@{c} +@{rand10}=@{rand8}@{rand2} +@{rand12}=@{rand8}@{rand4} +@{rand15}=@{rand8}@{rand4}@{rand2}@{c} +@{rand16}=@{rand8}@{rand8} +@{rand32}=@{rand16}@{rand16} +@{rand64}=@{rand32}@{rand32} + +# Any x word characters +@{word2}=@{w}@{w} +@{word4}=@{word2}@{word2} +@{word6}=@{word4}@{word2} +@{word8}=@{word4}@{word4} +@{word9}=@{word8}@{w} +@{word10}=@{word8}@{word2} +@{word12}=@{word8}@{word4} +@{word15}=@{word8}@{word4}@{word2}@{w} +@{word16}=@{word8}@{word8} +@{word32}=@{word16}@{word16} +@{word64}=@{word32}@{word32} diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 4e8b1bc11..a2f99a2ec 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -2,98 +2,6 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Base variables -# -------------- - -# Any digit -@{d}=[0-9] - -# Any letter -@{l}=[a-zA-Z] - -# Single alphanumeric character -@{c}=[0-9a-zA-Z] - -# Word character: matches any letter, digit or underscore. -@{w}=[a-zA-Z0-9_] - -# Single hexadecimal character -@{h}=[0-9a-fA-F] - -# Integer up to 10 digits (0-9999999999) -@{int}=@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},} - -# hexadecimal, alphanumeric and word up to 64 characters -@{hex}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} -@{rand}=@{c}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},} -@{word}=@{w}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} - -# Unsigned integer over 8 bits (0...255) -@{u8}=[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5] - -# Unsigned integer over 16 bits (0...65,535 5 digits) -@{u16}={@{d},[1-9]@{d},[1-9][@{d}@{d},[1-9]@{d}@{d}@{d},[1-6]@{d}@{d}@{d}@{d}} - -# Unsigned integer over 32 bits (0...4,294,967,295 10 digits) -@{u32}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-4]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} - -# Unsigned integer over 64 bits (0...18,446,744,073,709,551,615 20 digits). -@{u64}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},1@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} - -# Any x digits characters -@{int2}=@{d}@{d} -@{int4}=@{int2}@{int2} -@{int6}=@{int4}@{int2} -@{int8}=@{int4}@{int4} -@{int9}=@{int8}@{d} -@{int10}=@{int8}@{int2} -@{int12}=@{int8}@{int4} -@{int15}=@{int8}@{int4}@{int2}@{d} -@{int16}=@{int8}@{int8} -@{int32}=@{int16}@{int16} -@{int64}=@{int32}@{int32} - -# Any x hexadecimal characters -@{hex2}=@{h}@{h} -@{hex4}=@{hex2}@{hex2} -@{hex6}=@{hex4}@{hex2} -@{hex8}=@{hex4}@{hex4} -@{hex9}=@{hex8}@{h} -@{hex10}=@{hex8}@{hex2} -@{hex12}=@{hex8}@{hex4} -@{hex15}=@{hex8}@{hex4}@{hex2}@{h} -@{hex16}=@{hex8}@{hex8} -@{hex32}=@{hex16}@{hex16} -@{hex38}=@{hex32}@{hex6} -@{hex64}=@{hex32}@{hex32} - -# Any x alphanumeric characters -@{rand2}=@{c}@{c} -@{rand4}=@{rand2}@{rand2} -@{rand6}=@{rand4}@{rand2} -@{rand8}=@{rand4}@{rand4} -@{rand9}=@{rand8}@{c} -@{rand10}=@{rand8}@{rand2} -@{rand12}=@{rand8}@{rand4} -@{rand15}=@{rand8}@{rand4}@{rand2}@{c} -@{rand16}=@{rand8}@{rand8} -@{rand32}=@{rand16}@{rand16} -@{rand64}=@{rand32}@{rand32} - -# Any x word characters -@{word2}=@{w}@{w} -@{word4}=@{word2}@{word2} -@{word6}=@{word4}@{word2} -@{word8}=@{word4}@{word4} -@{word9}=@{word8}@{w} -@{word10}=@{word8}@{word2} -@{word12}=@{word8}@{word4} -@{word15}=@{word8}@{word4}@{word2}@{w} -@{word16}=@{word8}@{word8} -@{word32}=@{word16}@{word16} -@{word64}=@{word32}@{word32} - - # System Paths # ------------ From fa6c37a7ab1cdbe94340ee50d857552c5415effd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 16:04:18 +0100 Subject: [PATCH 0603/1455] doc: update integration tests section. --- docs/development/integration.md | 136 +++----------------------------- docs/development/internal.md | 10 ++- docs/development/tests.md | 38 +++++++-- docs/development/vm.md | 112 ++++++++++++++++++++++++++ mkdocs.yml | 1 + 5 files changed, 161 insertions(+), 136 deletions(-) create mode 100644 docs/development/vm.md diff --git a/docs/development/integration.md b/docs/development/integration.md index 15f939cdd..de60c8c47 100644 --- a/docs/development/integration.md +++ b/docs/development/integration.md @@ -2,147 +2,33 @@ title: Integration Tests --- -!!! danger "Work in Progress" - The purpose of integration testing in apparmor.d is to ensure the profiles are not going to break programs found in Linux distributions and Desktop Environment that we support. +Although the integration test suite is intended to be run in a [Development VM](vm.md), it is also deployed the GitHub Action pipeline. + **Workflow** 1. Create a testing VM -2. Start the VM, do some dev -3. Run the integration tests against the testing VM -4. Ensure no new logs have been raised +2. Run the integration tests against the testing VM +3. Ensure no new logs have been raised - -## Test Virtual Machines - -The test VMs are built using [`cloud-init`][cloud-init] (when available), [`packer`][packer], and [`vagrant`][vagrant] on Qemu/KVM using Libvirt. No other hypervisor will be targeted for these tests. The files that generate these images can be found in the **[tests/packer](https://github.com/roddhjav/apparmor.d/tree/main/tests/packer)** directory. - -[cloud-init]: https://cloud-init.io/ -[packer]: https://www.packer.io/ -[vagrant]: https://www.vagrantup.com/ - -### Requirements - -* docker -* [packer] -* [vagrant] -* vagrant plugin install vagrant-libvirt - -!!! note - - You may need to edit some settings to fit your setup: - - - The libvirt configuration in `tests/Vagrantfile` - - The default ssh key and ISO directory in `tests/packer/variables.pkr.hcl` - -### Build - -**Build an image** - -To build a VM image for development purpose, run the following from the `tests` directory: - -| Distribution | Flavor | Build command | VM name | -|:------------:|:------:|:-------------:|:-------:| -| Arch Linux | Gnome | `make archlinux flavor=gnome` | `arch-gnome` | -| Arch Linux | KDE | `make archlinux flavor=kde` | `arch-kde` | -| Debian | Server | `make debian flavor=server` | `debian-server` | -| openSUSE | KDE | `make opensuse flavor=kde` | `opensuse-kde` | -| Ubuntu | Server | `make ubuntu flavor=server` | `ubuntu-server` | -| Ubuntu | Desktop | `make ubuntu flavor=desktop` | `ubuntu-desktop` | - -**VM management** - -The development workflow is done through vagrant: - -* Star a VM: `vagran up ` -* Shutdown a VM: `vagrant halt ` -* Reboot a VM: `vagrant reload ` - -The available VM `name` is defined in the `tests/boxes.yml` file - - -### Develop - -**Credentials** - -The admin user is: `user`, its password is: `user`. It has passwordless sudo access. Automatic login is **not** enabled on DE. The root user is not locked. - -**Directories** - -All the images come pre-configured with the latest version of `apparmor.d` installed and running in the VM. apparmor.d is mounted as `/home/user/Projects/apparmor.d` - -**Usage** - -On all images, `aa-update` can be used to rebuild and install the latest version of the profiles. `p`, `pf`, and `pu` are two pre-configured aliases of `ps` that show the security status of processes. `htop` is also configured to show this status. - - -## Tests - -!!! warning - - The test suite is expected to be run in a [VM](#test-virtual-machines) - -### Getting started +## Getting started Prepare the test environment: ```sh -cd tests -make flavor= -AA_INTEGRATION=true vagrant up +just img +just vm ``` Run the integration tests on the test VM: ```sh -make integration box= IP= +just integration ``` -### Create integration tests +## Create integration tests -**Test suite usage** +All integration tests are written in [Bats](https://github.com/bats-core/bats-core) and are located in the `tests/integration` directory. The initial tests have been generated using [tldr page](https://tldr.sh/) with the following command: -Initialise the tests with: ```sh -./aa-test --bootstrap -``` - -List the tests scenarios to be run -```sh -./aa-test --list -``` - -Start the tests and collect the results -```sh -./aa-test --run -``` - -**Tests manifest** - -A basic set of test is generated on initialization. More tests can be manually written in yaml file. They must have the following structure: - -```yaml -- name: acpi - profiled: true - root: false - require: [] - arguments: {} - tests: - - dsc: Show battery information - cmd: acpi - stdin: [] - - dsc: Show thermal information - cmd: acpi -t - stdin: [] - - dsc: Show cooling device information - cmd: acpi -c - stdin: [] - - dsc: Show thermal information in Fahrenheit - cmd: acpi -tf - stdin: [] - - dsc: Show all information - cmd: acpi -V - stdin: [] - - dsc: Extract information from `/proc` instead of `/sys` - cmd: acpi -p - stdin: [] +go run ./tests/cmd --bootstrap ``` diff --git a/docs/development/internal.md b/docs/development/internal.md index 459f1ad71..c90391b04 100644 --- a/docs/development/internal.md +++ b/docs/development/internal.md @@ -157,12 +157,14 @@ It is recommended to transition [in a subprofile](abstractions.md#appsystemctl) All common programs are tracked and labelled in the [`apparmor.d/tunables/multiarch.d/programs`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/programs) and [`apparmor.d/tunables/multiarch.d/paths`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/paths) files. They can be used in a `child-open` profile or directly in a profile. They are useful to allow opening resources using a kind of program (browsers, image viewer, text editor...), instead of allowing a given program path. -## Re-attached path +## Re-attached path + +**[:material-tag-heart-outline: abi/4.0]("Minimum version")** The flag `attach_disconnect` control how disconnected paths are handled. It determines if pathnames resolved to be outside the namespace are attached to the root (ie. have the `/` character prepended). It is a security issue as it allows disconnected paths to alias to other files that exist in the file name. Therefore, it is only provided to work around problems that can arise with sandboxed programs. -AppAmor 4.0 provides the `attach_disconnect.path` flag allowing to reattach this path to a prefix that is not `/`. When used it provide an important security improvement from AppArmor 3.0. +AppAmor 4.0 provides the `attach_disconnect.path` flag allowing to reattach this path to a prefix that is not `/`. When used it provides an important security improvement from AppArmor 3.0. **`apparmor.d`** uses `attach_disconnect.path` by **default and automatically** on all profiles with the `attach_disconnect` flag. The attached path is set to `@{att}` a new dynamically generated variable set at build time in the preamble of all profile to be: @@ -170,7 +172,9 @@ AppAmor 4.0 provides the `attach_disconnect.path` flag allowing to reattach this - `@{att}=/` for other profiles -## User Confinement [:material-police-badge-outline:{ .pg-red }](../full-system-policy.md "Only for Full System Policy (FSP)") +## User Confinement + +[:material-police-badge-outline:{ .pg-red }](../full-system-policy.md "Full System Policy only (FSP)") !!! warning "TODO" diff --git a/docs/development/tests.md b/docs/development/tests.md index 7fcdf1555..652907155 100644 --- a/docs/development/tests.md +++ b/docs/development/tests.md @@ -1,15 +1,37 @@ --- -title: Tests suite +title: Overview --- -A full test suite to ensure compatibility across supported distributions and that software is still considered a work in progress. Here is an overview of the current CI jobs: +Misconfigured AppArmor profiles is one of the most effective ways to break someone's system. This section present the various tests applied to the profiles as well as their current stage of deployment. -**On Gitlab CI** +**Current** -- Packages build for all supported distributions -- Profiles preprocessing verification for all supported distributions -- Go based command linting, coverage, and unit tests +- [x] **[Build:](https://gitlab.com/roddhjav/apparmor.d/-/pipelines)** `make` + - Build the profiles for all supported distributions. + - All CI jobs validate the profiles syntax and ensure they can be safely loaded into a kernel. + - Ensure the profile entry point (`@{exec_path}`) is defined. -**On Github Action** +- [x] **[Checks:](https://github.com/roddhjav/apparmor.d/blob/main/tests/check.sh)** `make check` checks basic style of profiles: + - Ensure apparmor.d header & licence + - Ensure 2 spaces indentation + - Ensure local include for profile and subprofiles + - Ensure abi 4 is used + - Ensure modern profile naming + - Ensure `vim:syntax=apparmor` -- Integration test on the ubuntu-latest VM: run a simple list of tasks with all the rules enabled and ensure no new issue has been raised. Github Action is used as it offers direct access to a VM with AppArmor included. +- [x] **[Integration Tests:](integration.md)** `make integration` + - Run simple CLI commands to ensure no logs are raised. + - Uses the [bats](https://github.com/bats-core/bats-core) test system. + - Run in the Github Action as well as in all local [test VM](vm.md). + +**Plan** + +For more complex software suite, more integration tests need to be done. The plan is to run existing integration suite from these very software in an environment with `apparmor.d` profiles. + +- [ ] Systemd + - They use mkosi to generate a VM image to run their own integration tests. + - See https://www.codethink.co.uk/articles/2024/systemd-integration-testing-part-1/ + +- [ ] Gnome + - They use openQA to run their integration tests. + - See https://gitlab.gnome.org/GNOME/openqa-tests/ diff --git a/docs/development/vm.md b/docs/development/vm.md new file mode 100644 index 000000000..ead82ed0f --- /dev/null +++ b/docs/development/vm.md @@ -0,0 +1,112 @@ +--- +title: Development VM +--- + +To ensure compatibility across distribution, this project ships a wide range of development and tests VM images. + +The test VMs can be built locally using [cloud-init](https://cloud-init.io/), [packer](https://www.packer.io/) on Qemu/KVM using Libvirt. No other hypervisor will be targeted for these tests. The files that generate these images can be found in the **[tests/packer](https://github.com/roddhjav/apparmor.d/tree/main/tests/packer)** directory. +The VMs are fully managed using a [justfile](https://github.com/casey/just) that provide an integration environment helper for `apparmor.d`. + +```sh +$ just +``` + +``` +Integration environment helper for apparmor.d + +Available recipes: + default # Show this help message + package dist # Build the apparmor.d package + img dist flavor # Build the image + vm dist flavor # Create the machine + up dist flavor # Start a machine + halt dist flavor # Stops the machine + destroy dist flavor # Destroy the machine + ssh dist flavor # Connect to the machine + list # List the machines + images # List the machine images + available # List the machine that can be created + integration dist flavor # Run the integration tests on the machine + lint # Run the linters + clean # Remove the machine images + get_ip dist flavor + get_osinfo dist +``` + +## Requirements + +* [docker](https://www.docker.com/) +* [just](https://github.com/casey/just) +* [packer](https://www.packer.io/) +* [libvirt](https://libvirt.org/) +* [qemu](https://www.qemu.org/) + +!!! note + + You may need to edit some settings to fit your setup: + + - The default ssh key and ISO directory in `tests/packer/variables.pkr.hcl` + +## Build + +One can see the available images by running: + +```sh +$ just available +``` + +``` +Distribution Flavor +archlinux gnome +archlinux kde +archlinux server +archlinux xfce +debian12 gnome +debian12 kde +debian12 server +ubuntu24 server +... +``` + +A VM image can be build with: + +```sh +$ just img archlinux gnome +``` + +The image will then be showed in the list of images: + +```sh +$ just images +``` + +``` +Distribution Flavor Size Date +archlinux gnome 3.3G Mar 1 14:49 +``` + +The VM can then be created with: + +```sh +$ just vm archlinux gnome +``` + +And connected to with: + +```sh +$ just ssh archlinux gnome +``` + +## Develop + +**Credentials** + +The admin user is: `user`, its password is: `user`. It has passwordless sudo access. Automatic login is **not** enabled on DE. The root user is not locked. + +**Directories** + +All the images come pre-configured with the latest version of `apparmor.d` installed and running in the VM. The apparmor.d project directory is mounted as `/home/user/Projects/apparmor.d` + +**Usage** + +On all images, `aa-update` can be used to rebuild and install the latest version of the profiles. `p`, `pf`, and `pu` are two pre-configured aliases of `ps` that show the security status of processes. `htop` is also configured to show this status. diff --git a/mkdocs.yml b/mkdocs.yml index ed14108a8..153af0d4e 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -165,4 +165,5 @@ nav: - development/build.md - Tests: - development/tests.md + - development/vm.md - development/integration.md From 6d5a522dcb03f3f51ae5e9fe39dead9d1dbde447 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 16:07:10 +0100 Subject: [PATCH 0604/1455] test(packer): update sources --- tests/packer/init.sh | 5 ++--- tests/packer/src/aa-clean | 4 ++++ tests/packer/src/aa-log-clean | 4 ---- tests/packer/src/aa-update | 2 +- tests/packer/src/monitors.xml | 23 ----------------------- tests/packer/src/parser.conf | 9 +++++++-- 6 files changed, 14 insertions(+), 33 deletions(-) create mode 100644 tests/packer/src/aa-clean delete mode 100644 tests/packer/src/aa-log-clean delete mode 100644 tests/packer/src/monitors.xml diff --git a/tests/packer/init.sh b/tests/packer/init.sh index be9529666..4a189d176 100644 --- a/tests/packer/init.sh +++ b/tests/packer/init.sh @@ -17,12 +17,11 @@ readonly DISTRIBUTION main() { install -dm0750 -o "$SUDO_USER" -g "$SUDO_USER" "/home/$SUDO_USER/Projects/" "/home/$SUDO_USER/Projects/apparmor.d" "/home/$SUDO_USER/.config/" install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/.bash_aliases "/home/$SUDO_USER/.bash_aliases" - install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/monitors.xml "/home/$SUDO_USER/.config/monitors.xml" install -Dm0644 -o "$SUDO_USER" -g "$SUDO_USER" $SRC/htoprc "/home/$SUDO_USER/.config/htop/htoprc" + install -Dm0644 $SRC/parser.conf /etc/apparmor/parser.conf install -Dm0644 $SRC/site.local /etc/apparmor.d/tunables/multiarch.d/site.local install -Dm0755 $SRC/aa-update /usr/bin/aa-update - install -Dm0755 $SRC/aa-log-clean /usr/bin/aa-log-clean - cat $SRC/parser.conf >>/etc/apparmor/parser.conf + install -Dm0755 $SRC/aa-clean /usr/bin/aa-clean chown -R "$SUDO_USER:$SUDO_USER" "/home/$SUDO_USER/.config/" case "$DISTRIBUTION" in diff --git a/tests/packer/src/aa-clean b/tests/packer/src/aa-clean new file mode 100644 index 000000000..a01b9d77e --- /dev/null +++ b/tests/packer/src/aa-clean @@ -0,0 +1,4 @@ +#!/usr/bin/env bash +set -eu -o pipefail +rm -vf /var/log/audit/* /var/log/syslog* +touch /var/log/audit/audit.log /var/log/syslog diff --git a/tests/packer/src/aa-log-clean b/tests/packer/src/aa-log-clean deleted file mode 100644 index 9f3ebd818..000000000 --- a/tests/packer/src/aa-log-clean +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/env bash -set -eu -rm -rf /var/log/audit/* -touch /var/log/audit/audit.log diff --git a/tests/packer/src/aa-update b/tests/packer/src/aa-update index 9a326305d..48267d2f0 100644 --- a/tests/packer/src/aa-update +++ b/tests/packer/src/aa-update @@ -1,5 +1,5 @@ #!/usr/bin/env bash -set -eu +set -eu -o pipefail export BUILDDIR=/tmp/build/ diff --git a/tests/packer/src/monitors.xml b/tests/packer/src/monitors.xml deleted file mode 100644 index b17136584..000000000 --- a/tests/packer/src/monitors.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - 0 - 0 - 1 - yes - - - Virtual-1 - RHT - QEMU Monitor - 0x00000000 - - - 1920 - 1080 - 60 - - - - - diff --git a/tests/packer/src/parser.conf b/tests/packer/src/parser.conf index be8c42560..8651efad1 100644 --- a/tests/packer/src/parser.conf +++ b/tests/packer/src/parser.conf @@ -1,4 +1,9 @@ - +# Turn creating/updating of the cache on by default write-cache -cache-loc /etc/apparmor/earlypolicy/ + +# Enable early policy loads to confine systemd, and services that can not depend +# on the apparmor unit. +cache-loc=/etc/apparmor/earlypolicy/ + +# Adjust compression Optimize=compress-fast From 0b029ec42f55946c13f2a360b21cbf7f6dc5d518 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 16:10:09 +0100 Subject: [PATCH 0605/1455] tests(packer): rewrite the way to build the tests images. --- tests/packer/archlinux.pkr.hcl | 39 ----------------- tests/packer/builds.pkr.hcl | 65 +++++++++++++++++++++------- tests/packer/clean.sh | 7 ---- tests/packer/debian.pkr.hcl | 40 ------------------ tests/packer/init.sh | 10 +++-- tests/packer/main.pkr.hcl | 4 -- tests/packer/opensuse.pkr.hcl | 42 ------------------- tests/packer/ubuntu.pkr.hcl | 77 ---------------------------------- tests/packer/variables.pkr.hcl | 68 ++++++++++++++++++------------ 9 files changed, 98 insertions(+), 254 deletions(-) delete mode 100644 tests/packer/archlinux.pkr.hcl delete mode 100644 tests/packer/debian.pkr.hcl delete mode 100644 tests/packer/opensuse.pkr.hcl delete mode 100644 tests/packer/ubuntu.pkr.hcl diff --git a/tests/packer/archlinux.pkr.hcl b/tests/packer/archlinux.pkr.hcl deleted file mode 100644 index 06f2ad3a7..000000000 --- a/tests/packer/archlinux.pkr.hcl +++ /dev/null @@ -1,39 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -source "qemu" "archlinux" { - disk_image = true - iso_url = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2" - iso_checksum = "file:https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256" - iso_target_path = "${var.iso_dir}/archlinux-cloudimg-amd64.img" - cpu_model = "host" - cpus = var.cpus - memory = var.ram - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = var.output - vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" - boot_wait = "10s" - shutdown_command = "echo ${var.password} | sudo -S shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}-${var.flavor}" - } - ) - } -} diff --git a/tests/packer/builds.pkr.hcl b/tests/packer/builds.pkr.hcl index 7071c3983..151df236e 100644 --- a/tests/packer/builds.pkr.hcl +++ b/tests/packer/builds.pkr.hcl @@ -2,24 +2,63 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +locals { + name = "${var.prefix}${var.dist}-${var.flavor}" +} + +source "qemu" "default" { + disk_image = true + iso_url = var.DM[var.dist].img_url + iso_checksum = "file:${var.DM[var.dist].img_checksum}" + iso_target_path = pathexpand("${var.iso_dir}/${basename("${var.DM[var.dist].img_url}")}") + cpu_model = "host" + cpus = var.cpus + memory = var.ram + disk_size = var.disk_size + accelerator = "kvm" + headless = true + ssh_username = var.username + ssh_password = var.password + ssh_port = 22 + ssh_wait_timeout = "1000s" + disk_compression = true + disk_detect_zeroes = "unmap" + disk_discard = "unmap" + output_directory = pathexpand(var.output) + vm_name = "${local.name}.qcow2" + boot_wait = "10s" + firmware = pathexpand(var.firmware) + shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" + cd_label = "cidata" + cd_content = { + "meta-data" = "" + "user-data" = format("%s\n%s", + templatefile("${path.cwd}/tests/cloud-init/common.yml", + { + username = "${var.username}" + password = "${var.password}" + ssh_key = file("${var.ssh_publickey}") + hostname = "${local.name}" + } + ), + file("${path.cwd}/tests/cloud-init/${var.dist}-${var.flavor}.user-data.yml") + ) + } +} + build { sources = [ - "source.qemu.archlinux", - "source.qemu.debian", - "source.qemu.fedora", - "source.qemu.opensuse", - "source.qemu.ubuntu22", - "source.qemu.ubuntu24", + "source.qemu.default", ] # Upload artifacts provisioner "file" { destination = "/tmp/" sources = [ - "${path.cwd}/packer/src/", - "${path.cwd}/packer/init.sh", - "${path.cwd}/packer/clean.sh", - "${path.cwd}/../.pkg/", + "${path.cwd}/tests/packer/src/", + "${path.cwd}/tests/packer/init.sh", + "${path.cwd}/tests/packer/clean.sh", + "${path.cwd}/.pkg/", ] } @@ -44,13 +83,9 @@ build { ] } - post-processor "vagrant" { - output = "${var.base_dir}/packer_${var.prefix}${source.name}-${var.flavor}.box" - } - post-processor "shell-local" { inline = [ - "vagrant box add --force --name ${var.prefix}${source.name}-${var.flavor} ${var.base_dir}/packer_${var.prefix}${source.name}-${var.flavor}.box" + "mv ${var.output}/${local.name}.qcow2 ${var.base_dir}/${local.name}.qcow2", ] } diff --git a/tests/packer/clean.sh b/tests/packer/clean.sh index 8459421a1..b7650a1d5 100644 --- a/tests/packer/clean.sh +++ b/tests/packer/clean.sh @@ -56,9 +56,6 @@ clean_apt() { clean_pacman() { _msg "Cleaning pacman cache" pacman -Syu --noconfirm - pacman -Qdtq | while IFS='' read -r pkg; do - pacman -Rsccn --noconfirm "$pkg" - done pacman -Scc --noconfirm } @@ -136,10 +133,6 @@ trim() { truncate --size=0 /swap/swapfile fi - # _msg "Fill root filesystem with 0 to reduce box size" - # dd if=/dev/zero of=/EMPTY bs=1M || true - # rm -f /EMPTY - # Block until the empty file has been removed, otherwise, Packer will # try to kill the box while the disk is still full and that is bad. sync diff --git a/tests/packer/debian.pkr.hcl b/tests/packer/debian.pkr.hcl deleted file mode 100644 index 12d4a513c..000000000 --- a/tests/packer/debian.pkr.hcl +++ /dev/null @@ -1,40 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -source "qemu" "debian" { - disk_image = true - iso_url = "https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/debian-${var.release.debian.version}-genericcloud-amd64.qcow2" - iso_checksum = "file:https://cdimage.debian.org/images/cloud/${var.release.debian.codename}/latest/SHA512SUMS" - iso_target_path = "${var.iso_dir}/debian-${var.release.debian.codename}-cloudimg-amd64.img" - cpu_model = "host" - cpus = var.cpus - memory = var.ram - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = var.output - vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} diff --git a/tests/packer/init.sh b/tests/packer/init.sh index 4a189d176..4e4e1ec99 100644 --- a/tests/packer/init.sh +++ b/tests/packer/init.sh @@ -26,6 +26,7 @@ main() { case "$DISTRIBUTION" in arch) + rm -f $SRC/*.sig # Ignore signature files pacman --noconfirm -U $SRC/*.pkg.tar.zst ;; @@ -40,9 +41,12 @@ main() { esac - rm -rf /var/cache/apparmor/* - rm -rf /etc/apparmor/earlypolicy/ - systemctl reload apparmor.service + verb="start" + rm -rf /var/cache/apparmor/* || true + if systemctl is-active -q apparmor; then + verb="reload" + fi + systemctl "$verb" apparmor.service || journalctl -xeu apparmor.service } main "$@" diff --git a/tests/packer/main.pkr.hcl b/tests/packer/main.pkr.hcl index ee13e8f92..d2b1a6dbf 100644 --- a/tests/packer/main.pkr.hcl +++ b/tests/packer/main.pkr.hcl @@ -8,9 +8,5 @@ packer { source = "github.com/hashicorp/qemu" version = "~> 1" } - vagrant = { - source = "github.com/hashicorp/vagrant" - version = "~> 1" - } } } diff --git a/tests/packer/opensuse.pkr.hcl b/tests/packer/opensuse.pkr.hcl deleted file mode 100644 index 46cf4af29..000000000 --- a/tests/packer/opensuse.pkr.hcl +++ /dev/null @@ -1,42 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# TODO: Fully automate the creation of the base image - -source "qemu" "opensuse" { - disk_image = true - iso_url = "${var.base_dir}/base-tumbleweed-gnome.qcow2" - iso_checksum = "sha256:223ed62160ef4f1a4f21b69c574f552a07eee6ef66cf66eef2b49c5a7c4864f4" - iso_target_path = "${var.base_dir}/base-tumbleweed-gnome.qcow2" - cpu_model = "host" - cpus = var.cpus - memory = var.ram - disk_size = var.disk_size - accelerator = "kvm" - headless = false - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = var.output - vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} diff --git a/tests/packer/ubuntu.pkr.hcl b/tests/packer/ubuntu.pkr.hcl deleted file mode 100644 index 3689882ad..000000000 --- a/tests/packer/ubuntu.pkr.hcl +++ /dev/null @@ -1,77 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -source "qemu" "ubuntu22" { - disk_image = true - iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu22.codename}/current/${var.release.ubuntu22.codename}-server-cloudimg-amd64.img" - iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu22.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu22.codename}-cloudimg-amd64.img" - cpu_model = "host" - cpus = var.cpus - memory = var.ram - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = var.output - vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} - -source "qemu" "ubuntu24" { - disk_image = true - iso_url = "https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/${var.release.ubuntu24.codename}-server-cloudimg-amd64.img" - iso_checksum = "file:https://cloud-images.ubuntu.com/${var.release.ubuntu24.codename}/current/SHA256SUMS" - iso_target_path = "${var.iso_dir}/ubuntu-${var.release.ubuntu24.codename}-cloudimg-amd64.img" - cpu_model = "host" - cpus = var.cpus - memory = var.ram - disk_size = var.disk_size - accelerator = "kvm" - headless = true - ssh_username = var.username - ssh_password = var.password - ssh_port = 22 - ssh_wait_timeout = "1000s" - disk_compression = true - disk_detect_zeroes = "unmap" - disk_discard = "unmap" - output_directory = var.output - vm_name = "${var.prefix}${source.name}-${var.flavor}.qcow2" - boot_wait = "10s" - firmware = var.firmware - shutdown_command = "echo ${var.password} | sudo -S /sbin/shutdown -hP now" - cd_label = "cidata" - cd_content = { - "meta-data" = "" - "user-data" = templatefile("${path.cwd}/cloud-init/${source.name}-${var.flavor}.user-data.yml", - { - username = "${var.username}" - password = "${var.password}" - ssh_key = file("${var.ssh_publickey}") - hostname = "${var.prefix}${source.name}" - } - ) - } -} diff --git a/tests/packer/variables.pkr.hcl b/tests/packer/variables.pkr.hcl index 0361698d6..de83ac659 100644 --- a/tests/packer/variables.pkr.hcl +++ b/tests/packer/variables.pkr.hcl @@ -16,12 +16,6 @@ variable "password" { default = "user" } -variable "ssh_publickey" { - description = "Path to the ssh public key" - type = string - default = "~/.ssh/id_ed25519.pub" -} - variable "cpus" { description = "Default CPU of the VM" type = string @@ -40,22 +34,28 @@ variable "disk_size" { default = "40G" } +variable "ssh_publickey" { + description = "Path to the ssh public key" + type = string + default = "~/.ssh/id_ed25519.pub" +} + variable "iso_dir" { description = "Original ISO file directory" type = string - default = "/var/lib/libvirt/images" + default = "~/.libvirt/iso" } variable "base_dir" { description = "Final packer image output directory" type = string - default = "/var/lib/libvirt/images" + default = "~/.libvirt/base" } variable "firmware" { description = "Path to the UEFI firmware" type = string - default = "/usr/share/edk2/x64/OVMF_CODE.fd" + default = "/usr/share/edk2/x64/OVMF.4m.fd" } variable "output" { @@ -70,38 +70,52 @@ variable "prefix" { default = "aa-" } +variable "dist" { + description = "Distribution to target" + type = string + default = "ubuntu24" +} + variable "flavor" { description = "Distribution flavor to use (server, desktop, gnome, kde...)" type = string default = "" } -variable "release" { - description = "Distribution metadata to use" +variable "DM" { + description = "Distribution Metadata to use" type = map(object({ - codename = string - version = string + img_url = string + img_checksum = string })) default = { + "archlinux" : { + img_url = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2" + img_checksum = "https://geo.mirror.pkgbuild.com/images/latest/Arch-Linux-x86_64-cloudimg.qcow2.SHA256" + }, + "debian12" : { + img_url = "https://cdimage.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2" + img_checksum = "https://cdimage.debian.org/images/cloud/bookworm/latest/SHA512SUMS" + } + "debian13" : { + img_url = "https://cdimage.debian.org/images/cloud/trixie/daily/latest/debian-13-genericcloud-amd64-daily.qcow2" + img_checksum = "https://cdimage.debian.org/images/cloud/trixie/daily/latest/SHA512SUMS" + } "ubuntu22" : { - codename = "jammy", - version = "22.04.2", + img_url = "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img" + img_checksum = "https://cloud-images.ubuntu.com/jammy/current/SHA256SUMS" }, "ubuntu24" : { - codename = "noble", - version = "24.04", + img_url = "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img" + img_checksum = "https://cloud-images.ubuntu.com/noble/current/SHA256SUMS" + }, + "ubuntu25" : { + img_url = "https://cloud-images.ubuntu.com/plucky/current/plucky-server-cloudimg-amd64.img" + img_checksum = "https://cloud-images.ubuntu.com/plucky/current/SHA256SUMS" }, - "debian" : { - codename = "bookworm", - version = "12", - } "opensuse" : { - codename = "tumbleweed", - version = "", - } - "fedora" : { - codename = "40", - version = "1.14", + img_url = "https://download.opensuse.org/tumbleweed/appliances/openSUSE-Tumbleweed-Minimal-VM.x86_64-Cloud.qcow2" + img_checksum = "https://download.opensuse.org/tumbleweed/appliances/openSUSE-Tumbleweed-Minimal-VM.x86_64-Cloud.qcow2.sha256" } } } From 1392b078ab9348d35cd6073761694ef574bd06d1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 16:15:55 +0100 Subject: [PATCH 0606/1455] tests: add Justile, used as integration environment helper. --- Justfile | 162 ++++++++++++++++++++++++++++++++++++++++++++++ tests/Makefile | 27 -------- tests/Vagrantfile | 62 ------------------ tests/boxes.yml | 51 --------------- 4 files changed, 162 insertions(+), 140 deletions(-) create mode 100644 Justfile delete mode 100644 tests/Makefile delete mode 100644 tests/Vagrantfile delete mode 100644 tests/boxes.yml diff --git a/Justfile b/Justfile new file mode 100644 index 000000000..7b39fb8a6 --- /dev/null +++ b/Justfile @@ -0,0 +1,162 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Integration environment for apparmor.d +# +# Usage: +# just +# just img ubuntu24 server +# just vm ubuntu24 server +# just up ubuntu24 server +# just ssh ubuntu24 server +# just halt ubuntu24 server +# just destroy ubuntu24 server +# just list +# just images +# just available +# just clean + +base_dir := home_dir() / ".libvirt/base" +vm := home_dir() / ".vm" +output := base_dir / "packer" +disk_size := "15G" +prefix := "aa-" +c := "--connect=qemu:///system" +sshopt := "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" + +[doc('Show this help message')] +default: + @echo -e "Integration environment helper for apparmor.d\n" + @just --list --unsorted + @echo -e "\nSee https://apparmor.pujol.io/development/vm/ for more information." + +[doc('Build the apparmor.d package')] +package dist: + #!/usr/bin/env bash + set -eu -o pipefail + dist="{{dist}}" + [[ $dist =~ ubuntu* ]] && dist=ubuntu + [[ $dist =~ debian* ]] && dist=debian + make package dist=$dist + +[doc('Build the image')] +img dist flavor: (package dist) + @mkdir -p {{base_dir}} + packer build -force \ + -var dist={{dist}} \ + -var flavor={{flavor}} \ + -var disk_size={{disk_size}} \ + -var prefix={{prefix}} \ + -var base_dir={{base_dir}} \ + -var output={{output}} \ + tests/packer/ + +[doc('Create the machine')] +vm dist flavor: + @cp -f {{base_dir}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 {{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 + virt-install {{c}} \ + --import \ + --name {{prefix}}{{dist}}-{{flavor}} \ + --vcpus 6 \ + --ram 4096 \ + --machine q35 \ + --boot uefi \ + --memorybacking source.type=memfd,access.mode=shared \ + --disk path={{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2,format=qcow2,bus=virtio \ + --filesystem "`pwd`,0a31bc478ef8e2461a4b1cc10a24cc4",accessmode=passthrough,driver.type=virtiofs \ + --os-variant "`just get_osinfo {{dist}}`" \ + --graphics spice \ + --audio id=1,type=spice \ + --sound model=ich9 \ + --noautoconsole + +[doc('Start a machine')] +up dist flavor: + @virsh {{c}} start {{prefix}}{{dist}}-{{flavor}} + +[doc('Stops the machine')] +halt dist flavor: + @virsh {{c}} shutdown {{prefix}}{{dist}}-{{flavor}} + +[doc('Destroy the machine')] +destroy dist flavor: + @virsh {{c}} destroy {{prefix}}{{dist}}-{{flavor}} || true + @virsh {{c}} undefine {{prefix}}{{dist}}-{{flavor}} --nvram + @rm -fv {{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 + +[doc('Connect to the machine')] +ssh dist flavor: + @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` + +[doc('List the machines')] +list: + @echo -e '\033[1m Id Name State\033[0m' + @virsh {{c}} list --all | grep {{prefix}} + +[doc('List the machine images')] +images: + #!/usr/bin/env bash + set -eu -o pipefail + ls -lh {{base_dir}} | awk ' + BEGIN { + printf("\033[1m%-18s %-10s %-5s %s\033[0m\n", "Distribution", "Flavor", "Size", "Date") + } + { + if ($9 ~ /^{{prefix}}.*\.qcow2$/) { + split($9, arr, "-|\\.") + printf("%-18s %-10s %-5s %s %s %s\n", arr[2], arr[3], $5, $6, $7, $8) + } + } + ' + +[doc('List the machine that can be created')] +available: + #!/usr/bin/env bash + set -eu -o pipefail + ls -lh tests/cloud-init | awk ' + BEGIN { + printf("\033[1m%-18s %s\033[0m\n", "Distribution", "Flavor") + } + { + if ($9 ~ /^.*\.user-data.yml$/) { + split($9, arr, "-|\\.") + printf("%-18s %s\n", arr[1], arr[2]) + } + } + ' + +[doc('Run the integration tests on the machine')] +integration dist flavor: + @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` \ + cp -rf /home/user/Projects/apparmor.d/tests/integration/ /home/user/Projects + @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` \ + sudo umount /home/user/Projects/apparmor.d + @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` \ + @bats --recursive --timing --print-output-on-failure Projects/integration/ + +[doc('Run the linters')] +lint: + @packer fmt packer/ + @packer validate --syntax-only packer/ + +[doc('Remove the machine images')] +clean: + @rm -fv {{base_dir}}/{{prefix}}*.qcow2 + +get_ip dist flavor: + @virsh --quiet --readonly {{c}} domifaddr {{prefix}}{{dist}}-{{flavor}} | \ + grep -E -o '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}' + +get_osinfo dist: + #!/usr/bin/env python3 + osinfo = { + "archlinux": "archlinux", + "debian12": "debian12", + "debian13": "debian13", + "ubuntu22": "ubuntu22.04", + "ubuntu24": "ubuntu24.04", + "ubuntu25": "ubuntu25.04", + "opensuse": "opensusetumbleweed", + } + print(osinfo.get("{{dist}}", "{{dist}}")) diff --git a/tests/Makefile b/tests/Makefile deleted file mode 100644 index 3453ecee8..000000000 --- a/tests/Makefile +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/make -f -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Usage: -# make archlinux flavor=gnome -# vagrant up arch-gnome -# vagrant ssh archl-gnome - -# Build variables -flavor ?= -disk ?= 10G - -BASE = archlinux debian ubuntu22 ubuntu24 opensuse fedora - -.PHONY: ${BASE} lint - -$(BASE): - @make --directory=../ package dist=${@} - @packer build -force \ - -var disk_size=${disk} -var flavor="${flavor}" \ - -only=qemu.${@} packer/ - -lint: - @packer fmt --check packer/ - @packer validate --syntax-only packer/ diff --git a/tests/Vagrantfile b/tests/Vagrantfile deleted file mode 100644 index 4bdaac985..000000000 --- a/tests/Vagrantfile +++ /dev/null @@ -1,62 +0,0 @@ -# -*- mode: ruby -*- -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -require 'yaml' - -machines = YAML.load_file(File.join(File.dirname(__FILE__), 'boxes.yml')) -default = machines['defaults'] - -Vagrant.require_version '>= 2.0.0' - -Vagrant.configure("2") do |config| - - config.ssh.keys_only = true - config.ssh.insert_key = false - config.ssh.private_key_path = [ '~/.ssh/id_ed25519' ] - config.ssh.username = 'user' - - machines['boxes'].each do |instance| - - # Configure the VMs per details in boxes.yml - config.vm.define instance['name'] do |srv| - srv.vm.box = instance['box'] - srv.vm.box_check_update = false - srv.vm.post_up_message = instance.to_yaml - srv.vm.synced_folder '.', '/vagrant', disabled: true - if !ENV['AA_INTEGRATION'] - srv.vm.synced_folder '../', '/home/user/Projects/apparmor.d', type: 'virtiofs', mount: false - end - - # Configure Libvirt provider - srv.vm.provider 'libvirt' do |libvirt| - libvirt.driver = 'kvm' - libvirt.default_prefix = 'aa-' - libvirt.connect_via_ssh = false - libvirt.storage_pool_name = 'ssd' - libvirt.memory = instance.fetch('ram', default['ram']) - libvirt.cpus = instance.fetch('cpu', default['cpu']) - libvirt.cpu_mode = 'host-passthrough' - libvirt.machine_type = 'q35' - libvirt.video_type = 'virtio' - libvirt.graphics_type = 'spice' - libvirt.sound_type = 'ich9' - libvirt.tpm_model = 'tpm-crb' - libvirt.tpm_type = 'emulator' - libvirt.tpm_version = '2.0' - libvirt.random model: 'random' - libvirt.memorybacking 'source', type: 'memfd' - libvirt.memorybacking 'access', mode: 'shared' - libvirt.channel type: 'unix', target_name: 'org.qemu.guest_agent.0', target_type: 'virtio' - (1..2).each do - libvirt.redirdev :type => "spicevmc" - end - if instance.fetch('uefi', default['uefi']) - libvirt.loader = '/usr/share/edk2/x64/OVMF_CODE.fd' - end - end - - end - end -end diff --git a/tests/boxes.yml b/tests/boxes.yml deleted file mode 100644 index 3e15fc304..000000000 --- a/tests/boxes.yml +++ /dev/null @@ -1,51 +0,0 @@ ---- - -defaults: - uefi: true - ram: '3072' - cpu: '6' - -boxes: - - name: arch-gnome - box: aa-archlinux-gnome - uefi: false - - - name: arch-kde - box: aa-archlinux-kde - uefi: false - - - name: arch-xfce - box: aa-archlinux-xfce - uefi: false - - - name: arch-cosmic - box: aa-archlinux-cosmic - uefi: false - - - name: arch-server - box: aa-archlinux-server - uefi: false - - - name: ubuntu22-desktop - box: aa-ubuntu22-desktop - - - name: ubuntu24-desktop - box: aa-ubuntu24-desktop - - - name: ubuntu22-server - box: aa-ubuntu22-server - - - name: ubuntu24-server - box: aa-ubuntu24-server24 - - - name: debian-server - box: aa-debian-server - - - name: debian-gnome - box: aa-debian-gnome - - - name: debian-kde - box: aa-debian-kde - - - name: opensuse-kde - box: aa-opensuse-kde From 4dd78c0087f189a8b678faac9bb4bb1086c85363 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 22:06:38 +0100 Subject: [PATCH 0607/1455] tests: improve justfile. --- Justfile | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/Justfile b/Justfile index 7b39fb8a6..79e2c5fd5 100644 --- a/Justfile +++ b/Justfile @@ -20,7 +20,6 @@ base_dir := home_dir() / ".libvirt/base" vm := home_dir() / ".vm" output := base_dir / "packer" -disk_size := "15G" prefix := "aa-" c := "--connect=qemu:///system" sshopt := "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" @@ -46,7 +45,6 @@ img dist flavor: (package dist) packer build -force \ -var dist={{dist}} \ -var flavor={{flavor}} \ - -var disk_size={{disk_size}} \ -var prefix={{prefix}} \ -var base_dir={{base_dir}} \ -var output={{output}} \ @@ -137,8 +135,8 @@ integration dist flavor: [doc('Run the linters')] lint: - @packer fmt packer/ - @packer validate --syntax-only packer/ + @packer fmt tests/packer/ + @packer validate --syntax-only tests/packer/ [doc('Remove the machine images')] clean: @@ -146,6 +144,7 @@ clean: get_ip dist flavor: @virsh --quiet --readonly {{c}} domifaddr {{prefix}}{{dist}}-{{flavor}} | \ + head -1 | \ grep -E -o '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}' get_osinfo dist: From 80e85769ce83098c88a64be3e0cbe1ba4b61a718 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 22:09:19 +0100 Subject: [PATCH 0608/1455] feat(profile): improve gnome profiles. --- apparmor.d/groups/freedesktop/xorg | 1 + apparmor.d/groups/gnome/deja-dup-monitor | 3 ++- apparmor.d/groups/gnome/gdm-generate-config | 4 ++-- apparmor.d/groups/gnome/gnome-calculator | 2 ++ apparmor.d/groups/gnome/gnome-clocks | 4 ++-- apparmor.d/groups/gnome/gnome-control-center | 2 ++ .../groups/gnome/gnome-extension-gsconnect | 9 ++++++-- apparmor.d/groups/gnome/gnome-initial-setup | 1 + .../groups/gnome/gnome-remote-desktop-daemon | 1 + apparmor.d/groups/gnome/gnome-session-check | 22 +++++++++++++++++++ apparmor.d/groups/gnome/gnome-shell | 3 +++ apparmor.d/groups/gnome/mutter-x11-frames | 2 +- apparmor.d/groups/gnome/nautilus | 2 +- apparmor.d/groups/gnome/session-migration | 1 + apparmor.d/groups/gnome/yelp | 2 +- 15 files changed, 49 insertions(+), 10 deletions(-) create mode 100644 apparmor.d/groups/gnome/gnome-session-check diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 90016a8ee..00e277f1f 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -121,6 +121,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/backlight/**/{uevent,type,enabled} r, @{sys}/devices/@{pci}/backlight/**/brightness rw, @{sys}/devices/@{pci}/boot_vga r, + @{sys}/devices/@{pci}/resource@{int} rw, @{sys}/devices/**/{uevent,name,id,config} r, @{sys}/devices/**/hid r, @{sys}/devices/**/power_supply/**/{type,online} r, diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor index b7fc6a5b0..90a5b0f64 100644 --- a/apparmor.d/groups/gnome/deja-dup-monitor +++ b/apparmor.d/groups/gnome/deja-dup-monitor @@ -15,12 +15,13 @@ profile deja-dup-monitor @{exec_path} { include include include + include include network netlink raw, #aa:dbus own bus=session name=org.gnome.DejaDup.Monitor - #aa:dbus talk bus=session name=org.gnome.DejaDup label=deja-dup + #aa:dbus talk bus=session name=org.gnome.DejaDup interface+=org.gtk.Actions label=deja-dup dbus send bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index dc11e8169..6d621f18b 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -32,8 +32,7 @@ profile gdm-generate-config @{exec_path} { /usr/share/gdm{3,}/{,**} r, /var/lib/ r, - @{GDM_HOME}/ r, - owner @{GDM_HOME}/ rw, + @{GDM_HOME}/ rw, owner @{GDM_HOME}/greeter-dconf-defaults rw, owner @{GDM_HOME}/greeter-dconf-defaults.@{rand6} rw, @@ -44,6 +43,7 @@ profile gdm-generate-config @{exec_path} { @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/stat r, + @{PROC}/tty/drivers r, @{PROC}/uptime r, include if exists diff --git a/apparmor.d/groups/gnome/gnome-calculator b/apparmor.d/groups/gnome/gnome-calculator index 2e553d9f4..3f2290e6a 100644 --- a/apparmor.d/groups/gnome/gnome-calculator +++ b/apparmor.d/groups/gnome/gnome-calculator @@ -23,6 +23,8 @@ profile gnome-calculator @{exec_path} { @{open_path} rPx -> child-open-help, + owner @{PROC}/@{pid}/stat r, + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-clocks b/apparmor.d/groups/gnome/gnome-clocks index fd6ded04f..13f161dfd 100644 --- a/apparmor.d/groups/gnome/gnome-clocks +++ b/apparmor.d/groups/gnome/gnome-clocks @@ -10,7 +10,7 @@ include profile gnome-clocks @{exec_path} { include include - include + include include include include @@ -19,7 +19,7 @@ profile gnome-clocks @{exec_path} { network netlink raw, - #aa:dbus own bus=session name=org.gnome.clocks + #aa:dbus own bus=session name=org.gnome.clocks interface+=org.gtk.Actions @{exec_path} mr, @{open_path} rPx -> child-open-help, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index cfb40f5c4..74b0cb041 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -38,7 +38,9 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { unix (send, receive, connect) type=stream peer=(addr="@/home/*/.cache/ibus/dbus-????????", label=ibus-daemon), #aa:dbus own bus=session name=org.gnome.Settings + #aa:dbus own bus=session name=org.bluez.obex.Agent1 + #aa:dbus talk bus=session name=org.bluez.obex label=obexd #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color #aa:dbus talk bus=session name=org.gnome.Shell label=gnome-shell diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 7bb34e52f..c0f131dd1 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -36,8 +36,9 @@ profile gnome-extension-gsconnect @{exec_path} { @{bin}/openssl rix, @{bin}/ssh-add rix, - @{bin}/ssh-keygen rPx, - @{bin}/xdg-screensaver rPx, + @{bin}/dconf rPx, + @{bin}/ssh-keygen rPx, + @{bin}/xdg-screensaver rPx, @{lib}/gio/modules/*.so* rm, @{lib}/girepository-1.0/* r, @@ -53,6 +54,10 @@ profile gnome-extension-gsconnect @{exec_path} { owner @{user_config_dirs}/mimeapps.list w, owner @{user_config_dirs}/mimeapps.list.@{rand6} rw, + owner @{HOME}/.mozilla/firefox/firefox-mpris/@{word}.png r, + + owner @{tmp}/.org.chromium.Chromium.@{rand6} r, + owner @{run}/user/@{uid}/gsconnect/{,**} rw, @{sys}/devices/virtual/dmi/id/chassis_type r, diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index 89769477a..be73974c8 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -41,6 +41,7 @@ profile gnome-initial-setup @{exec_path} { @{bin}/xrandr rPx, @{lib}/gnome-initial-setup-goa-helper rix, + @{lib}/@{multiarch}/ld-linux-*.so* rix, /usr/share/dconf/profile/gdm r, /usr/share/gnome-initial-setup/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon index 19e448b1b..c092f9372 100644 --- a/apparmor.d/groups/gnome/gnome-remote-desktop-daemon +++ b/apparmor.d/groups/gnome/gnome-remote-desktop-daemon @@ -15,6 +15,7 @@ profile gnome-remote-desktop-daemon @{exec_path} { include include include + include network inet stream, network inet6 stream, diff --git a/apparmor.d/groups/gnome/gnome-session-check b/apparmor.d/groups/gnome/gnome-session-check new file mode 100644 index 000000000..2a0b4965f --- /dev/null +++ b/apparmor.d/groups/gnome/gnome-session-check @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/gnome-session-check-* +profile gnome-session-check @{exec_path} { + include + include + + @{exec_path} mr, + + @{lib}/gnome-session-check-accelerated-gl-helper ix, + @{lib}/gnome-session-check-accelerated-gles-helper ix, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index f8888f95b..f2ff71f03 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -242,6 +242,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{HOME}/.face r, owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r, + owner @{HOME}/.mozilla/native-messaging-hosts/ r, + owner @{HOME}/.mozilla/native-messaging-hosts/org.gnome.shell.extensions.gsconnect.json rw, + owner @{HOME}/.mozilla/native-messaging-hosts/org.gnome.shell.extensions.gsconnect.json.@{rand6} rw, owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw, owner @{HOME}/.var/app/**.{png,jpg,svg} r, owner @{HOME}/.var/app/**/ r, diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index 8a48b97a2..d41ba2c7e 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -28,7 +28,7 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { /usr/share/gdm/greeter-dconf-defaults r, owner @{GDM_HOME}/greeter-dconf-defaults r, - owner @{gdm_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} r, + owner @{gdm_cache_dirs}/fontconfig/@{hex32}-*.cache-?{,.NEW,.LCK,.TMP-@{rand6}} rw, owner @{gdm_config_dirs}/dconf/user r, @{sys}/devices/@{pci}/boot_vga r, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 3a7fdd4f4..016a41bd5 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -28,7 +28,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { mqueue r type=posix /, - #aa:dbus own bus=session name=org.gnome.Nautilus interface+=org.gtk.{Application,Actions} + #aa:dbus own bus=session name=org.gnome.Nautilus interface+="org.gtk.{Application,Actions}" #aa:dbus own bus=session name=org.freedesktop.FileManager1 #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell diff --git a/apparmor.d/groups/gnome/session-migration b/apparmor.d/groups/gnome/session-migration index c2df97896..ac3009fc7 100644 --- a/apparmor.d/groups/gnome/session-migration +++ b/apparmor.d/groups/gnome/session-migration @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/session-migration profile session-migration @{exec_path} { include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index f172eac21..b3f27187b 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -15,7 +15,7 @@ profile yelp @{exec_path} { network netlink raw, #aa:dbus own bus=accessibility name=org.gnome.Yelp - #aa:dbus own bus=session name=org.gnome.Yelp + #aa:dbus own bus=session name=org.gnome.Yelp interface+=org.gtk.Actions @{exec_path} mr, @{open_path} rPx -> child-open-help, From e6752cb4b9761c58a26362891e8bbc29474e9435 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 22:11:06 +0100 Subject: [PATCH 0609/1455] feat(profile): improve libreoffice, add missing dbus access. --- apparmor.d/profiles-g-l/libreoffice | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index ac3ee0c26..43fe51757 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -11,7 +11,13 @@ include profile libreoffice @{exec_path} { include include + include include + include + include + include + include + include include include include @@ -30,7 +36,7 @@ profile libreoffice @{exec_path} { network inet6 stream, network netlink raw, - #aa:dbus own bus=session name=org.libreoffice.LibreOfficeIpc0 + #aa:dbus own bus=session name=org.libreoffice interface+=org.gtk.Actions @{exec_path} mr, From c9d249e5e35613aaf7b474c1a19abea0df07fc45 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 22:44:56 +0100 Subject: [PATCH 0610/1455] tests(packer): add test images for ubuntu 25.04 & debian 13 --- .../cloud-init/debian13-server.user-data.yml | 36 +++++++++++++++++ .../cloud-init/ubuntu24-desktop.user-data.yml | 39 +++++-------------- ...ata.yml => ubuntu25-desktop.user-data.yml} | 37 +++++------------- 3 files changed, 55 insertions(+), 57 deletions(-) create mode 100644 tests/cloud-init/debian13-server.user-data.yml rename tests/cloud-init/{ubuntu22-desktop.user-data.yml => ubuntu25-desktop.user-data.yml} (53%) diff --git a/tests/cloud-init/debian13-server.user-data.yml b/tests/cloud-init/debian13-server.user-data.yml new file mode 100644 index 000000000..1400584ba --- /dev/null +++ b/tests/cloud-init/debian13-server.user-data.yml @@ -0,0 +1,36 @@ +#cloud-config + +packages: + - apparmor-profiles + - auditd + - build-essential + - config-package-dev + - debhelper + - devscripts + - golang-go + - htop + - qemu-guest-agent + - rsync + - vim + +write_files: + + # Setup shared directory + - path: /etc/fstab + append: true + content: | + 0a31bc478ef8e2461a4b1cc10a24cc4 /home/user/Projects/apparmor.d virtiofs defaults 0 1 + + # Network configuration + - path: /etc/systemd/network/20-wired.network + owner: "root:root" + permissions: "0644" + content: | + [Match] + Name=en* + + [Network] + DHCP=yes + + [DHCPv4] + RouteMetric=10 diff --git a/tests/cloud-init/ubuntu24-desktop.user-data.yml b/tests/cloud-init/ubuntu24-desktop.user-data.yml index 7a71b0afe..d1b1f169c 100644 --- a/tests/cloud-init/ubuntu24-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu24-desktop.user-data.yml @@ -17,29 +17,23 @@ packages: - ubuntu-desktop - vim -snap: - commands: - - install firefox - - install gtk-common-themes - - install snap-store - - install snapd-desktop-integration - runcmd: + # Add missing snap packages + - snap install snap-store + - snap install snapd-desktop-integration + # Remove default filesystem and related tools not used with the suggested # storage layout. These may yet be required if different partitioning schemes # are used. - - apt-get -y purge btrfs-progs cryptsetup* lvm2 xfsprogs + - apt-get -y purge btrfs-progs xfsprogs # Remove other packages present by default in Ubuntu Server but not # normally present in Ubuntu Desktop. - # - >- - # apt-get -y purge - # ubuntu-server ubuntu-server-minimal netplan.io cloud-init - # binutils byobu curl dmeventd finalrd gawk - # kpartx mdadm ncurses-term needrestart open-iscsi - # sg3-utils ssh-import-id sssd thin-provisioning-tools tmux - # sosreport screen open-vm-tools motd-news-config lxd-agent-loader - # landscape-common fonts-ubuntu-console ethtool + - >- + apt-get -y purge + byobu dmeventd finalrd gawk kpartx landscape-common lxd-agent-loader + mdadm motd-news-config ncurses-term open-iscsi open-vm-tools + screen sg3-utils sosreport ssh-import-id sssd tmux # Finally, remove things only installed as dependencies of other things # we have already removed. @@ -51,16 +45,3 @@ write_files: append: true content: | 0a31bc478ef8e2461a4b1cc10a24cc4 /home/user/Projects/apparmor.d virtiofs defaults 0 1 - - - path: /etc/systemd/network/20-wired.network - owner: "root:root" - permissions: "0644" - content: | - [Match] - Name=en* - - [Network] - DHCP=yes - - [DHCPv4] - RouteMetric=10 diff --git a/tests/cloud-init/ubuntu22-desktop.user-data.yml b/tests/cloud-init/ubuntu25-desktop.user-data.yml similarity index 53% rename from tests/cloud-init/ubuntu22-desktop.user-data.yml rename to tests/cloud-init/ubuntu25-desktop.user-data.yml index 5f4dc69f5..881e9b4e9 100644 --- a/tests/cloud-init/ubuntu22-desktop.user-data.yml +++ b/tests/cloud-init/ubuntu25-desktop.user-data.yml @@ -9,7 +9,7 @@ packages: - debhelper - devscripts - golang-go - - linux-generic-hwe-22.04 + - linux-generic-hwe-24.04 - qemu-guest-agent - rsync - spice-vdagent @@ -17,29 +17,23 @@ packages: - ubuntu-desktop - vim -snap: - commands: - - install firefox - - install gtk-common-themes - - install snap-store - - install snapd-desktop-integration - runcmd: + - snap install snap-store + - snap install snapd-desktop-integration + - snap install --edge desktop-security-center + # Remove default filesystem and related tools not used with the suggested # storage layout. These may yet be required if different partitioning schemes # are used. - - apt-get -y purge btrfs-progs cryptsetup* lvm2 xfsprogs + - apt-get -y purge btrfs-progs xfsprogs # Remove other packages present by default in Ubuntu Server but not # normally present in Ubuntu Desktop. - >- apt-get -y purge - ubuntu-server ubuntu-server-minimal netplan.io cloud-init - binutils byobu curl dmeventd finalrd gawk - kpartx mdadm ncurses-term needrestart open-iscsi - sg3-utils ssh-import-id sssd thin-provisioning-tools tmux - sosreport screen open-vm-tools motd-news-config lxd-agent-loader - landscape-common fonts-ubuntu-console ethtool + byobu dmeventd finalrd gawk kpartx landscape-common lxd-agent-loader + mdadm motd-news-config ncurses-term open-iscsi open-vm-tools + screen sg3-utils sosreport ssh-import-id sssd tmux # Finally, remove things only installed as dependencies of other things # we have already removed. @@ -51,16 +45,3 @@ write_files: append: true content: | 0a31bc478ef8e2461a4b1cc10a24cc4 /home/user/Projects/apparmor.d virtiofs defaults 0 1 - - - path: /etc/systemd/network/20-wired.network - owner: "root:root" - permissions: "0644" - content: | - [Match] - Name=en* - - [Network] - DHCP=yes - - [DHCPv4] - RouteMetric=10 From eba7357cb13e51a8a78978d560fc4851f37affc7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 1 Mar 2025 22:48:24 +0100 Subject: [PATCH 0611/1455] doc: show off our tests a bit. --- README.md | 3 +-- docs/index.md | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 7aed183da..a2ae8d6fb 100644 --- a/README.md +++ b/README.md @@ -35,8 +35,7 @@ * Gnome (GDM) * KDE (SDDM) * XFCE (Lightdm) *(work in progress)* -- Fully tested *(work in progress)* - +- [Fully tested](https://apparmor.pujol.io/development/tests/) > This project is originally based on the work from [Morfikov][upstream] and aims to extend it to more Linux distributions and desktop environments. diff --git a/docs/index.md b/docs/index.md index 8f5696074..6f09983cb 100644 --- a/docs/index.md +++ b/docs/index.md @@ -34,7 +34,7 @@ See the [Concepts](concepts.md)' page for more detail on the architecture. - [x] :material-gnome: Gnome (GDM) - [x] :simple-kde: KDE (SDDM) - [ ] :simple-xfce: XFCE (Lightdm) *(work in progress)* -- Fully tested *(work in progress)* +- [Fully tested](development/tests.md) ### Presentations From 86aba45d67a69c99d2e930c93da9f2616262aadb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 2 Mar 2025 00:00:08 +0100 Subject: [PATCH 0612/1455] tests(integration): move most test inside groups. --- tests/integration/{ => apparmor}/aa-enforce.bats | 3 +-- tests/integration/{ => apparmor}/aa-status.bats | 2 +- tests/integration/{ => gpg}/gpgconf.bats | 2 +- tests/integration/{ => procps}/ps.bats | 2 +- tests/integration/{ => procps}/sysctl.bats | 3 +-- tests/integration/{ => procps}/w.bats | 7 ++++++- tests/integration/{ => shadow}/groupadd.bats | 2 +- tests/integration/{ => shadow}/groups.bats | 2 +- tests/integration/{ => systemd}/homectl.bats | 2 +- tests/integration/{ => systemd}/hostnamectl.bats | 2 +- tests/integration/{ => systemd}/systemd-ac-power.bats | 2 +- tests/integration/{ => systemd}/systemd-analyze.bats | 4 +--- tests/integration/{ => systemd}/systemd-cat.bats | 2 +- tests/integration/{ => systemd}/systemd-cgls.bats | 3 +-- tests/integration/{ => systemd}/systemd-detect-virt.bats | 5 +---- tests/integration/{ => systemd}/systemd-id128.bats | 2 +- tests/integration/{ => systemd}/systemd-sysusers.bats | 2 +- tests/integration/{ => systemd}/userdbctl.bats | 2 +- tests/integration/{ => usb}/lsusb.bats | 2 +- tests/integration/{ => utils}/blkid.bats | 2 +- tests/integration/{ => utils}/chsh.bats | 2 +- tests/integration/{ => utils}/df.bats | 2 +- tests/integration/{ => utils}/dmesg.bats | 2 +- tests/integration/{ => utils}/lsblk.bats | 2 +- tests/integration/{ => utils}/lscpu.bats | 2 +- tests/integration/{ => utils}/lspci.bats | 2 +- tests/integration/{ => utils}/pstree.bats | 2 +- tests/integration/{ => utils}/sync.bats | 2 +- tests/integration/{ => utils}/users.bats | 2 +- tests/integration/{ => utils}/uuidd.bats | 2 +- tests/integration/{ => utils}/uuidgen.bats | 2 +- tests/integration/{ => utils}/who.bats | 2 +- 32 files changed, 37 insertions(+), 40 deletions(-) rename tests/integration/{ => apparmor}/aa-enforce.bats (94%) rename tests/integration/{ => apparmor}/aa-status.bats (97%) rename tests/integration/{ => gpg}/gpgconf.bats (98%) rename tests/integration/{ => procps}/ps.bats (97%) rename tests/integration/{ => procps}/sysctl.bats (97%) rename tests/integration/{ => procps}/w.bats (68%) rename tests/integration/{ => shadow}/groupadd.bats (97%) rename tests/integration/{ => shadow}/groups.bats (95%) rename tests/integration/{ => systemd}/homectl.bats (98%) rename tests/integration/{ => systemd}/hostnamectl.bats (97%) rename tests/integration/{ => systemd}/systemd-ac-power.bats (96%) rename tests/integration/{ => systemd}/systemd-analyze.bats (97%) rename tests/integration/{ => systemd}/systemd-cat.bats (96%) rename tests/integration/{ => systemd}/systemd-cgls.bats (97%) rename tests/integration/{ => systemd}/systemd-detect-virt.bats (85%) rename tests/integration/{ => systemd}/systemd-id128.bats (97%) rename tests/integration/{ => systemd}/systemd-sysusers.bats (97%) rename tests/integration/{ => systemd}/userdbctl.bats (97%) rename tests/integration/{ => usb}/lsusb.bats (96%) rename tests/integration/{ => utils}/blkid.bats (95%) rename tests/integration/{ => utils}/chsh.bats (96%) rename tests/integration/{ => utils}/df.bats (97%) rename tests/integration/{ => utils}/dmesg.bats (97%) rename tests/integration/{ => utils}/lsblk.bats (98%) rename tests/integration/{ => utils}/lscpu.bats (96%) rename tests/integration/{ => utils}/lspci.bats (97%) rename tests/integration/{ => utils}/pstree.bats (96%) rename tests/integration/{ => utils}/sync.bats (95%) rename tests/integration/{ => utils}/users.bats (95%) rename tests/integration/{ => utils}/uuidd.bats (96%) rename tests/integration/{ => utils}/uuidgen.bats (95%) rename tests/integration/{ => utils}/who.bats (96%) diff --git a/tests/integration/aa-enforce.bats b/tests/integration/apparmor/aa-enforce.bats similarity index 94% rename from tests/integration/aa-enforce.bats rename to tests/integration/apparmor/aa-enforce.bats index d6b549b1e..7bc0e740b 100644 --- a/tests/integration/aa-enforce.bats +++ b/tests/integration/apparmor/aa-enforce.bats @@ -3,10 +3,9 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common setup_file() { - aa_setup skip } diff --git a/tests/integration/aa-status.bats b/tests/integration/apparmor/aa-status.bats similarity index 97% rename from tests/integration/aa-status.bats rename to tests/integration/apparmor/aa-status.bats index fbfb6667d..e7e0fc3d5 100644 --- a/tests/integration/aa-status.bats +++ b/tests/integration/apparmor/aa-status.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "aa-status: Check status" { sudo aa-status diff --git a/tests/integration/gpgconf.bats b/tests/integration/gpg/gpgconf.bats similarity index 98% rename from tests/integration/gpgconf.bats rename to tests/integration/gpg/gpgconf.bats index 7155c5aa9..41627dc67 100644 --- a/tests/integration/gpgconf.bats +++ b/tests/integration/gpg/gpgconf.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "gpgconf: List all components" { gpgconf --list-components diff --git a/tests/integration/ps.bats b/tests/integration/procps/ps.bats similarity index 97% rename from tests/integration/ps.bats rename to tests/integration/procps/ps.bats index bcdfbe1b8..a27bdf98d 100644 --- a/tests/integration/ps.bats +++ b/tests/integration/procps/ps.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "ps: List all running processes" { ps aux diff --git a/tests/integration/sysctl.bats b/tests/integration/procps/sysctl.bats similarity index 97% rename from tests/integration/sysctl.bats rename to tests/integration/procps/sysctl.bats index 171ee98a9..2f284070a 100644 --- a/tests/integration/sysctl.bats +++ b/tests/integration/procps/sysctl.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "sysctl: Show all available variables and their values" { sysctl -a @@ -24,4 +24,3 @@ load common @test "sysctl: Apply changes from `/etc/sysctl.conf`" { sysctl -p } - diff --git a/tests/integration/w.bats b/tests/integration/procps/w.bats similarity index 68% rename from tests/integration/w.bats rename to tests/integration/procps/w.bats index 1b97ba445..3ee1fe218 100644 --- a/tests/integration/w.bats +++ b/tests/integration/procps/w.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "w: Display information about all users who are currently logged in" { w @@ -12,3 +12,8 @@ load common @test "w: Display information about a specific user" { w root } + +@test "w: Display information without including the header, the login, JCPU and PCPU columns" { + w --no-header + w --short +} diff --git a/tests/integration/groupadd.bats b/tests/integration/shadow/groupadd.bats similarity index 97% rename from tests/integration/groupadd.bats rename to tests/integration/shadow/groupadd.bats index d93b1a690..3d07619b2 100644 --- a/tests/integration/groupadd.bats +++ b/tests/integration/shadow/groupadd.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "groupadd: Create a new group" { sudo groupadd user2 diff --git a/tests/integration/groups.bats b/tests/integration/shadow/groups.bats similarity index 95% rename from tests/integration/groups.bats rename to tests/integration/shadow/groups.bats index 60bf6ea45..f932e9129 100644 --- a/tests/integration/groups.bats +++ b/tests/integration/shadow/groups.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "groups: Print group memberships for the current user" { groups diff --git a/tests/integration/homectl.bats b/tests/integration/systemd/homectl.bats similarity index 98% rename from tests/integration/homectl.bats rename to tests/integration/systemd/homectl.bats index 656a3407b..0bdd625c4 100644 --- a/tests/integration/homectl.bats +++ b/tests/integration/systemd/homectl.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common setup_file() { sudo systemctl start systemd-homed diff --git a/tests/integration/hostnamectl.bats b/tests/integration/systemd/hostnamectl.bats similarity index 97% rename from tests/integration/hostnamectl.bats rename to tests/integration/systemd/hostnamectl.bats index 2c15658ad..38924920a 100644 --- a/tests/integration/hostnamectl.bats +++ b/tests/integration/systemd/hostnamectl.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "hostnamectl: Get the hostname of the computer" { hostnamectl diff --git a/tests/integration/systemd-ac-power.bats b/tests/integration/systemd/systemd-ac-power.bats similarity index 96% rename from tests/integration/systemd-ac-power.bats rename to tests/integration/systemd/systemd-ac-power.bats index 30019825a..65779b617 100644 --- a/tests/integration/systemd-ac-power.bats +++ b/tests/integration/systemd/systemd-ac-power.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "systemd-ac-power: Report whether we are connected to an external power source." { systemd-ac-power || true diff --git a/tests/integration/systemd-analyze.bats b/tests/integration/systemd/systemd-analyze.bats similarity index 97% rename from tests/integration/systemd-analyze.bats rename to tests/integration/systemd/systemd-analyze.bats index 6bb275bb6..b36abb62d 100644 --- a/tests/integration/systemd-analyze.bats +++ b/tests/integration/systemd/systemd-analyze.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "systemd-analyze: List all running units, ordered by the time they took to initialize" { systemd-analyze --no-pager blame @@ -16,5 +16,3 @@ load common @test "systemd-analyze: Show security scores of running units" { systemd-analyze --no-pager security } - - diff --git a/tests/integration/systemd-cat.bats b/tests/integration/systemd/systemd-cat.bats similarity index 96% rename from tests/integration/systemd-cat.bats rename to tests/integration/systemd/systemd-cat.bats index da634982a..9d796ff07 100644 --- a/tests/integration/systemd-cat.bats +++ b/tests/integration/systemd/systemd-cat.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "systemd-cat: Write the output of the specified command to the journal (both output streams are captured)" { systemd-cat pwd diff --git a/tests/integration/systemd-cgls.bats b/tests/integration/systemd/systemd-cgls.bats similarity index 97% rename from tests/integration/systemd-cgls.bats rename to tests/integration/systemd/systemd-cgls.bats index dca00b62a..a0822a516 100644 --- a/tests/integration/systemd-cgls.bats +++ b/tests/integration/systemd/systemd-cgls.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "systemd-cgls: Display the whole control group hierarchy on your system" { systemd-cgls --no-pager @@ -16,4 +16,3 @@ load common @test "systemd-cgls: Display the control group hierarchy of one or more systemd units" { systemd-cgls --no-pager --unit systemd-logind } - diff --git a/tests/integration/systemd-detect-virt.bats b/tests/integration/systemd/systemd-detect-virt.bats similarity index 85% rename from tests/integration/systemd-detect-virt.bats rename to tests/integration/systemd/systemd-detect-virt.bats index 41150ef7f..bb2b2a659 100644 --- a/tests/integration/systemd-detect-virt.bats +++ b/tests/integration/systemd/systemd-detect-virt.bats @@ -3,23 +3,20 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "systemd-detect-virt: List detectable virtualization technologies" { systemd-detect-virt --list } -# bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Detect virtualization, print the result and return a zero status code when running in a VM or a container, and a non-zero code otherwise" { systemd-detect-virt || true } -# bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Silently check without printing anything" { systemd-detect-virt --quiet || true } -# bats test_tags=systemd-detect-virt @test "systemd-detect-virt: Only detect hardware virtualization" { systemd-detect-virt --vm || true } diff --git a/tests/integration/systemd-id128.bats b/tests/integration/systemd/systemd-id128.bats similarity index 97% rename from tests/integration/systemd-id128.bats rename to tests/integration/systemd/systemd-id128.bats index 67bf5907d..68e48d9a4 100644 --- a/tests/integration/systemd-id128.bats +++ b/tests/integration/systemd/systemd-id128.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "systemd-id128: Generate a new random identifier" { systemd-id128 new diff --git a/tests/integration/systemd-sysusers.bats b/tests/integration/systemd/systemd-sysusers.bats similarity index 97% rename from tests/integration/systemd-sysusers.bats rename to tests/integration/systemd/systemd-sysusers.bats index 0816fd45e..7fff472ee 100644 --- a/tests/integration/systemd-sysusers.bats +++ b/tests/integration/systemd/systemd-sysusers.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "systemd-sysusers: Print the contents of all configuration files (before each file, its name is printed as a comment)" { systemd-sysusers --cat-config diff --git a/tests/integration/userdbctl.bats b/tests/integration/systemd/userdbctl.bats similarity index 97% rename from tests/integration/userdbctl.bats rename to tests/integration/systemd/userdbctl.bats index 065dba5f5..eda5f5b09 100644 --- a/tests/integration/userdbctl.bats +++ b/tests/integration/systemd/userdbctl.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "userdbctl: List all known user records" { userdbctl --no-pager user diff --git a/tests/integration/lsusb.bats b/tests/integration/usb/lsusb.bats similarity index 96% rename from tests/integration/lsusb.bats rename to tests/integration/usb/lsusb.bats index f5444fced..85bee2fd6 100644 --- a/tests/integration/lsusb.bats +++ b/tests/integration/usb/lsusb.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "lsusb: List all the USB devices available" { lsusb || true diff --git a/tests/integration/blkid.bats b/tests/integration/utils/blkid.bats similarity index 95% rename from tests/integration/blkid.bats rename to tests/integration/utils/blkid.bats index 6dcf4b4d7..625f5f9bb 100644 --- a/tests/integration/blkid.bats +++ b/tests/integration/utils/blkid.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "blkid: List all partitions" { sudo blkid diff --git a/tests/integration/chsh.bats b/tests/integration/utils/chsh.bats similarity index 96% rename from tests/integration/chsh.bats rename to tests/integration/utils/chsh.bats index 81a9f76a6..ccdadc6e3 100644 --- a/tests/integration/chsh.bats +++ b/tests/integration/utils/chsh.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "chsh: list available shells" { chsh --list-shells || true diff --git a/tests/integration/df.bats b/tests/integration/utils/df.bats similarity index 97% rename from tests/integration/df.bats rename to tests/integration/utils/df.bats index a97ad53cb..b0f3430ea 100644 --- a/tests/integration/df.bats +++ b/tests/integration/utils/df.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "df: Display all filesystems and their disk usage" { df diff --git a/tests/integration/dmesg.bats b/tests/integration/utils/dmesg.bats similarity index 97% rename from tests/integration/dmesg.bats rename to tests/integration/utils/dmesg.bats index 722b3204b..f2880666d 100644 --- a/tests/integration/dmesg.bats +++ b/tests/integration/utils/dmesg.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "dmesg: Show kernel messages" { sudo dmesg diff --git a/tests/integration/lsblk.bats b/tests/integration/utils/lsblk.bats similarity index 98% rename from tests/integration/lsblk.bats rename to tests/integration/utils/lsblk.bats index 4dc3e20b7..4093526a9 100644 --- a/tests/integration/lsblk.bats +++ b/tests/integration/utils/lsblk.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "lsblk: List all storage devices in a tree-like format" { lsblk diff --git a/tests/integration/lscpu.bats b/tests/integration/utils/lscpu.bats similarity index 96% rename from tests/integration/lscpu.bats rename to tests/integration/utils/lscpu.bats index d09599065..eb60d890d 100644 --- a/tests/integration/lscpu.bats +++ b/tests/integration/utils/lscpu.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "lscpu: Display information about all CPUs" { lscpu diff --git a/tests/integration/lspci.bats b/tests/integration/utils/lspci.bats similarity index 97% rename from tests/integration/lspci.bats rename to tests/integration/utils/lspci.bats index 021906602..1b86dd41f 100644 --- a/tests/integration/lspci.bats +++ b/tests/integration/utils/lspci.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "lspci: Show a brief list of devices" { lspci diff --git a/tests/integration/pstree.bats b/tests/integration/utils/pstree.bats similarity index 96% rename from tests/integration/pstree.bats rename to tests/integration/utils/pstree.bats index 23094478c..1fc43c76c 100644 --- a/tests/integration/pstree.bats +++ b/tests/integration/utils/pstree.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "pstree: Display a tree of processes" { pstree diff --git a/tests/integration/sync.bats b/tests/integration/utils/sync.bats similarity index 95% rename from tests/integration/sync.bats rename to tests/integration/utils/sync.bats index 9f2e26885..03cc4730f 100644 --- a/tests/integration/sync.bats +++ b/tests/integration/utils/sync.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "sync: Flush all pending write operations on all disks" { sync diff --git a/tests/integration/users.bats b/tests/integration/utils/users.bats similarity index 95% rename from tests/integration/users.bats rename to tests/integration/utils/users.bats index 8f8ad383d..885121a58 100644 --- a/tests/integration/users.bats +++ b/tests/integration/utils/users.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "users: Print logged in usernames" { users diff --git a/tests/integration/uuidd.bats b/tests/integration/utils/uuidd.bats similarity index 96% rename from tests/integration/uuidd.bats rename to tests/integration/utils/uuidd.bats index 9e3ac5ef0..d3ab28cc0 100644 --- a/tests/integration/uuidd.bats +++ b/tests/integration/utils/uuidd.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "uuidd: Generate a random UUID" { uuidd --random diff --git a/tests/integration/uuidgen.bats b/tests/integration/utils/uuidgen.bats similarity index 95% rename from tests/integration/uuidgen.bats rename to tests/integration/utils/uuidgen.bats index eb6465c04..838be5cbc 100644 --- a/tests/integration/uuidgen.bats +++ b/tests/integration/utils/uuidgen.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "uuidgen: Create a random UUIDv4" { uuidgen --random diff --git a/tests/integration/who.bats b/tests/integration/utils/who.bats similarity index 96% rename from tests/integration/who.bats rename to tests/integration/utils/who.bats index c05995d0e..b69fc2dd1 100644 --- a/tests/integration/who.bats +++ b/tests/integration/utils/who.bats @@ -3,7 +3,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -load common +load ../common @test "who: Display the username, line, and time of all currently logged-in sessions" { who From 189064c9f83ba8b4b4312fe9b833236b5387ef6a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 2 Mar 2025 13:25:30 +0100 Subject: [PATCH 0613/1455] tests: make the integration tests work recursivelly. --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 90dacd5c0..cef8bd719 100644 --- a/Makefile +++ b/Makefile @@ -112,8 +112,8 @@ check: @bash tests/check.sh .PHONY: integration -integration : - @bats --timing --print-output-on-failure tests/integration/ +integration: + @bats --recursive --timing --print-output-on-failure tests/integration/ .PHONY: manual manual: From 6c284435ae6c47c5f832bcf2b509699f65af3dcb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 2 Mar 2025 13:52:38 +0100 Subject: [PATCH 0614/1455] feat(profile): improve bluetoothctl fix #671 --- apparmor.d/groups/bluetooth/bluetoothctl | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/apparmor.d/groups/bluetooth/bluetoothctl b/apparmor.d/groups/bluetooth/bluetoothctl index 01565b4ff..e408b94b9 100644 --- a/apparmor.d/groups/bluetooth/bluetoothctl +++ b/apparmor.d/groups/bluetooth/bluetoothctl @@ -10,9 +10,17 @@ include @{exec_path} = @{bin}/bluetoothctl profile bluetoothctl @{exec_path} { include + include + include + + network bluetooth raw, + + #aa:dbus talk bus=system name=org.bluez label=bluetoothd @{exec_path} mr, + /usr/share/terminfo/** r, + /etc/inputrc r, owner @{user_cache_dirs}/ rw, From 3f9fe25fd469123c17022979c91be6fe278b465e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 2 Mar 2025 14:03:38 +0100 Subject: [PATCH 0615/1455] doc: update aa-log usage. --- cmd/aa-log/main.go | 6 +++--- docs/usage.md | 9 +++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/cmd/aa-log/main.go b/cmd/aa-log/main.go index 58aee3716..d58089310 100644 --- a/cmd/aa-log/main.go +++ b/cmd/aa-log/main.go @@ -15,15 +15,15 @@ import ( "github.com/roddhjav/apparmor.d/pkg/logs" ) -const usage = `aa-log [-h] [--systemd] [--file file] [--rules | --raw] [profile] +const usage = `aa-log [-h] [--systemd] [--file file] [--rules | --raw] [--since] [profile] Review AppArmor generated messages in a colorful way. It supports logs from auditd, systemd, syslog as well as dbus session events. It can be given an optional profile name to filter the output with. - Default logs are read from '/var/log/audit/audit.log'. Other files in - '/var/log/audit/' can easily be checked: 'aa-log -f 1' parses 'audit.log.1' + Default logs are read from '/var/log/audit/audit.log'. Other files in + '/var/log/audit/' can easily be checked: 'aa-log -f 1' parses 'audit.log.1' Options: -h, --help Show this help message and exit. diff --git a/docs/usage.md b/docs/usage.md index e73439efc..372762998 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -116,15 +116,15 @@ profile dnsmasq { ### Help ``` -aa-log [-h] [--systemd] [--file file] [--rules | --raw] [profile] +aa-log [-h] [--systemd] [--file file] [--rules | --raw] [--since] [profile] - Review AppArmor generated messages in a colorful way. Supports logs from + Review AppArmor generated messages in a colorful way. It supports logs from auditd, systemd, syslog as well as dbus session events. It can be given an optional profile name to filter the output with. - Default logs are read from '/var/log/audit/audit.log'. Other files in - '/var/log/audit/' can easily be checked: 'aa-log -f 1' parses 'audit.log.1' + Default logs are read from '/var/log/audit/audit.log'. Other files in + '/var/log/audit/' can easily be checked: 'aa-log -f 1' parses 'audit.log.1' Options: -h, --help Show this help message and exit. @@ -132,4 +132,5 @@ Options: -s, --systemd Parse systemd logs from journalctl. -r, --rules Convert the log into AppArmor rules. -R, --raw Print the raw log without any formatting. + -S, --since DATE Show entries not older than the specified date. ``` From d49e93523fca55b4fa359e0195c93bb0deeada34 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 4 Mar 2025 22:26:07 +0100 Subject: [PATCH 0616/1455] feat(profile): restrict the qemu-ga profile. --- apparmor.d/profiles-m-r/qemu-ga | 36 ++++++++++++++------------------- 1 file changed, 15 insertions(+), 21 deletions(-) diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index 7e63560ec..b100e4e15 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -7,40 +7,34 @@ abi , include @{exec_path} = @{bin}/qemu-ga -profile qemu-ga @{exec_path} { +profile qemu-ga @{exec_path} flags=(complain) { include - include - - capability mknod, - capability net_admin, - capability sys_ptrace, - - network inet stream, - network inet6 stream, - network netlink raw, - - ptrace (read) peer=@{p_systemd}, - - unix type=stream addr=@@{udbus}/bus/shutdown/system, - - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind @{exec_path} mr, - @{bin}/systemctl rix, + audit @{bin}/systemctl Cx -> systemctl, /etc/qemu/qemu-ga.conf r, - owner @{run}/qga.state* rw, + owner @{run}/qga.state rw, + owner @{run}/qga.state.@{rand6} rw, @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node@{int}/meminfo r, - @{PROC}/sys/vm/max_map_count r, - owner @{PROC}/@{pid}/net/dev r, - /dev/vport@{int}p@{int} rw, + profile systemctl flags=(complain) { + include + include + + unix type=stream addr=@@{udbus}/bus/shutdown/system, + + #aa-dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + + include if exists + } + include if exists } From 334b48749a67f97d2eab517ce8418807965390ea Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 4 Mar 2025 22:33:42 +0100 Subject: [PATCH 0617/1455] feat(profile): various minor update. --- apparmor.d/groups/bus/dbus-system | 2 ++ apparmor.d/groups/filesystem/lvm | 1 + apparmor.d/groups/gnome/gnome-shell | 2 ++ apparmor.d/groups/shadow/chpasswd | 8 ++++++++ apparmor.d/groups/snap/snapd | 5 +++++ apparmor.d/groups/ssh/ssh | 3 ++- apparmor.d/groups/ssh/sshd | 12 ++++++------ apparmor.d/groups/systemd/systemd-coredump | 2 ++ apparmor.d/groups/systemd/systemd-update-utmp | 2 +- apparmor.d/groups/systemd/systemd-vconsole-setup | 2 +- apparmor.d/groups/ubuntu/release-upgrade-motd | 2 ++ apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot | 2 ++ apparmor.d/groups/utils/login | 1 - apparmor.d/groups/utils/uname | 3 +++ apparmor.d/groups/virt/dockerd | 3 +++ apparmor.d/profiles-a-f/console-setup | 1 + apparmor.d/profiles-a-f/file-roller | 1 + apparmor.d/profiles-a-f/fractal | 2 ++ apparmor.d/profiles-g-l/landscape-sysinfo.wrapper | 2 ++ apparmor.d/profiles-m-r/run-parts | 2 ++ apparmor.d/profiles-s-z/tlp | 3 +++ 21 files changed, 51 insertions(+), 10 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index 0296a262f..cafaf0570 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -63,6 +63,7 @@ profile dbus-system flags=(attach_disconnected) { @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw, + @{run}/systemd/notify w, @{run}/systemd/users/@{int} r, @@ -78,6 +79,7 @@ profile dbus-system flags=(attach_disconnected) { @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_score_adj rw, diff --git a/apparmor.d/groups/filesystem/lvm b/apparmor.d/groups/filesystem/lvm index 75cd0de80..a73262d75 100644 --- a/apparmor.d/groups/filesystem/lvm +++ b/apparmor.d/groups/filesystem/lvm @@ -30,6 +30,7 @@ profile lvm @{exec_path} flags=(attach_disconnected) { @{etc_rw}/lvm/** rwkl, /etc/multipath.conf r, + /etc/multipath/* r, @{run}/lock/ rw, @{run}/lock/lvm/ rw, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index f2ff71f03..ee4bfe33b 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -269,6 +269,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/icc/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw, + owner @{user_share_dirs}/applications/org.gnome.Shell.Extensions.GSConnect{,.Preferences}.desktop rw, + owner @{user_share_dirs}/applications/org.gnome.Shell.Extensions.GSConnect{,.Preferences}.desktop.@{rand6} w, owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-* r, owner @{user_cache_dirs}/gnome-boxes/*.png r, owner @{user_cache_dirs}/gnome-photos/{,**} r, diff --git a/apparmor.d/groups/shadow/chpasswd b/apparmor.d/groups/shadow/chpasswd index 869ba20ab..4b752a440 100644 --- a/apparmor.d/groups/shadow/chpasswd +++ b/apparmor.d/groups/shadow/chpasswd @@ -9,13 +9,18 @@ include @{exec_path} = @{bin}/chpasswd profile chpasswd @{exec_path} { include + include include include + capability audit_write, capability chown, capability fsetid, + capability net_admin, capability setuid, + network netlink raw, + @{exec_path} mr, @{etc_ro}/login.defs r, @@ -32,6 +37,9 @@ profile chpasswd @{exec_path} { /etc/shadow.lock w, /etc/shadow+ rw, + /etc/pam.d/chpasswd r, + /etc/pam.d/common-* r, + include if exists } diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 273b68fc5..3e6a4460a 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -57,6 +57,11 @@ profile snapd @{exec_path} { member={SetWallMessage,ScheduleShutdown} peer=(name=org.freedesktop.login1, label=systemd-logind), + dbus send bus=system path=/org/freedesktop/timedate1 + interface=org.freedesktop.DBus.Properties + member=Get + peer=(name=org.freedesktop.timedate1, label=unconfined), + @{exec_path} mrix, @{bin}/adduser rPx, diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 0c86919b1..bdbcf8fa6 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -45,7 +45,8 @@ profile ssh @{exec_path} { audit owner @{tmp}/ssh-*/{,agent.@{int}} rwkl, - owner @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{hex16} rwl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{hex16}, + owner @{run}/user/@{uid}/gvfsd-sftp/@{hex} wl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand}, + owner @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand} wl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand}, owner @{run}/user/@{uid}/keyring/ssh rw, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 21892cc47..f6638d5d9 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -62,12 +62,12 @@ profile sshd @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{bin}/@{shells} rUx, - @{bin}/false rix, - @{bin}/nologin rPx, - @{bin}/passwd rPx, - @{lib}/openssh/sftp-server rPx, - @{lib}/ssh/sshd-session rix, + @{bin}/@{shells} rUx, + @{bin}/false rix, + @{bin}/nologin rPx, + @{bin}/passwd rPx, + @{lib}/{openssh,ssh}/sftp-server rPx, + @{lib}/{openssh,ssh}/sshd-session rix, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*.conf} r, diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index b26dabae7..856bee914 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -39,6 +39,8 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted /etc/systemd/coredump.conf r, /etc/systemd/coredump.conf.d/{,**} r, + owner @{HOME}/**.so r, + /var/lib/systemd/coredump/{,**} rwl, @{PROC}/@{pids}/cgroup r, diff --git a/apparmor.d/groups/systemd/systemd-update-utmp b/apparmor.d/groups/systemd/systemd-update-utmp index 1a2ff9a31..82025859b 100644 --- a/apparmor.d/groups/systemd/systemd-update-utmp +++ b/apparmor.d/groups/systemd/systemd-update-utmp @@ -17,7 +17,7 @@ profile systemd-update-utmp @{exec_path} flags=(attach_disconnected) { network netlink raw, - unix (bind) type=stream addr=@@{udbus}/bus/systemd-update-/, + unix bind type=stream addr=@@{udbus}/bus/systemd-update-/, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-vconsole-setup b/apparmor.d/groups/systemd/systemd-vconsole-setup index 5f28050c1..8c99d606c 100644 --- a/apparmor.d/groups/systemd/systemd-vconsole-setup +++ b/apparmor.d/groups/systemd/systemd-vconsole-setup @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-vconsole-setup -profile systemd-vconsole-setup @{exec_path} { +profile systemd-vconsole-setup @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/ubuntu/release-upgrade-motd b/apparmor.d/groups/ubuntu/release-upgrade-motd index 08a54df0a..b5d7d2885 100644 --- a/apparmor.d/groups/ubuntu/release-upgrade-motd +++ b/apparmor.d/groups/ubuntu/release-upgrade-motd @@ -22,6 +22,8 @@ profile release-upgrade-motd @{exec_path} { /var/lib/ubuntu-release-upgrader/release-upgrade-available rw, + @{run}/motd.dynamic.new w, + /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot index 86ac61f41..77b24fa27 100644 --- a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot +++ b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot @@ -25,6 +25,8 @@ profile update-motd-fsck-at-reboot @{exec_path} { /var/lib/update-notifier/fsck-at-reboot rw, + @{run}/motd.dynamic.new w, + @{PROC}/uptime r, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login index f83c1687e..dbf334577 100644 --- a/apparmor.d/groups/utils/login +++ b/apparmor.d/groups/utils/login @@ -62,7 +62,6 @@ profile login @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/sessions/@{int}.ref w, @{run}/credentials/getty@tty@{int}.service/ r, - @{run}/dbus/system_bus_socket rw, @{run}/faillock/@{user} rwk, @{run}/motd.d/{,*} r, @{run}/motd.dynamic{,.new} rw, diff --git a/apparmor.d/groups/utils/uname b/apparmor.d/groups/utils/uname index 45a864c23..6ca8a6370 100644 --- a/apparmor.d/groups/utils/uname +++ b/apparmor.d/groups/utils/uname @@ -14,6 +14,9 @@ profile uname @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{lib}/@{multiarch}/ld-linux-*so* r, + @{lib}/@{multiarch}/libc.so* mr, + @{att}/dev/tty@{int} rw, deny network, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 2e2d36355..b2228ec6f 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -21,6 +21,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { capability kill, capability mknod, capability net_admin, + capability net_raw, capability setfcap, capability sys_admin, capability sys_chroot, @@ -31,6 +32,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network inet6 stream, network netlink raw, + network packet dgram, mount /tmp/containerd-mount@{int}/, mount /var/lib/docker/**/, @@ -91,6 +93,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { owner @{run}/docker/** rwlk, owner @{run}/docker.pid rw, + @{sys}/devices/virtual/net/** r, @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/cpuset.cpus.effective r, @{sys}/fs/cgroup/cpuset.mems.effective r, diff --git a/apparmor.d/profiles-a-f/console-setup b/apparmor.d/profiles-a-f/console-setup index d3aaddf7f..5b867e1eb 100644 --- a/apparmor.d/profiles-a-f/console-setup +++ b/apparmor.d/profiles-a-f/console-setup @@ -15,6 +15,7 @@ profile console-setup @{exec_path} { @{bin}/uname rPx, @{bin}/mkdir rix, + @{run}/console-setup/ rw, @{run}/console-setup/boot_completed w, include if exists diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index 0c5a18e83..269a3b02a 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -47,6 +47,7 @@ profile file-roller @{exec_path} { @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, include if exists } diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 9de5761c2..0895d12eb 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -33,6 +33,8 @@ profile fractal @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, + owner @{tmp}/@{rand6} rw, + owner @{tmp}/etilqs_@{hex16} rw, owner @{run}/user/@{uid}/fractal/{,**} rw, diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper index fb9b75824..44c7a8ac7 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper +++ b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper @@ -32,6 +32,8 @@ profile landscape-sysinfo.wrapper @{exec_path} { /var/lib/landscape/landscape-sysinfo.cache rw, + @{run}/motd.dynamic.new w, + @{PROC}/loadavg r, /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index d0ecbbd9e..f50b23199 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -154,6 +154,8 @@ profile run-parts @{exec_path} { owner @{sys}/class/power_supply/ r, + @{run}/motd.dynamic.new w, + /dev/tty@{int} rw, profile motd { diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index 5d81c0a75..04e3b7ffc 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -44,6 +44,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{bin}/mktemp rix, @{bin}/readlink rix, @{bin}/rm rix, + @{bin}/sed rix, @{bin}/sort rix, @{bin}/systemctl rCx -> systemctl, @{bin}/touch rix, @@ -71,7 +72,9 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+platform:* r, @{sys}/bus/pci/devices/ r, + @{sys}/devices/@{pci}/ r, @{sys}/devices/@{pci}/{,**/}power/control w, + @{sys}/devices/@{pci}/class r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw, @{sys}/firmware/acpi/platform_profile* rw, @{sys}/firmware/acpi/pm_profile* rw, From b752ff540c9df45cb560073659088c9a0342fb7b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 4 Mar 2025 22:38:46 +0100 Subject: [PATCH 0618/1455] build: allow the docker build script to be sourced by downstream repository. --- dists/docker.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dists/docker.sh b/dists/docker.sh index 4dd958759..a99fefaf7 100644 --- a/dists/docker.sh +++ b/dists/docker.sh @@ -14,7 +14,7 @@ readonly VOLUME=/tmp/build readonly BUILDIR=/home/build/tmp readonly OUTDIR=".pkg" readonly OUTPUT="$PWD/$OUTDIR" -readonly COMMAND="$1" +readonly COMMAND="${1:-}" VERSION="0.$(git rev-list --count HEAD)" PACKAGER="$(git config user.name) <$(git config user.email)>" readonly VERSION PACKAGER From e3a1ba5d0d10bb5186f998544a162c029b1bdcf0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 21:15:46 +0100 Subject: [PATCH 0619/1455] feat(profile): systemd-tty-ask-password-agent: add support for rpm. see #576 --- apparmor.d/groups/systemd/systemd-tty-ask-password-agent | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index 71c5a1503..ecac3e1a8 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -20,6 +20,7 @@ profile systemd-tty-ask-password-agent @{exec_path} { signal (receive) set=(term cont) peer=*//systemctl, signal (receive) set=(term cont) peer=default, signal (receive) set=(term cont) peer=logrotate, + signal (receive) set=(term cont) peer=rpm, @{exec_path} mrix, From 06f2fb46597758ac968779ee06a6b258e52cc3a6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 21:22:57 +0100 Subject: [PATCH 0620/1455] feat(profile): improve gimp. see #656 --- apparmor.d/profiles-g-l/gimp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index 83457578f..158885375 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -11,8 +11,10 @@ profile gimp @{exec_path} { include include include + include include include + include include include include @@ -38,12 +40,14 @@ profile gimp @{exec_path} { /usr/share/mypaint-data/{,**} r, /usr/share/xml/iso-codes/{,**} r, + /etc/fstab r, /etc/gimp/{,**} r, owner @{user_documents_dirs}/{,**} rw, owner @{user_pictures_dirs}/{,**} rw, owner @{user_work_dirs}/{,**} rw, + owner @{user_cache_dirs}//thumbnails/normal/gimp-thumb* rw, owner @{user_cache_dirs}/babl/{,**} rw, owner @{user_cache_dirs}/gegl-*/{,**} r, owner @{user_cache_dirs}/gegl-*/{,**} r, @@ -58,6 +62,8 @@ profile gimp @{exec_path} { owner @{tmp}/gimp/{,**} rw, + owner @{PROC}/@{pid}/mountinfo r, + include if exists } From 7e1c08b75d1d3eb6e2bb4c0cf64067e2ddd6a7b1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 21:53:41 +0100 Subject: [PATCH 0621/1455] feat(profile): improve kde profiles. See #676 --- .../groups/freedesktop/xdg-desktop-portal-kde | 4 +++ apparmor.d/groups/kde/dolphin | 32 +++++++++++++++++++ apparmor.d/groups/kde/kioworker | 11 ++++--- apparmor.d/groups/kde/plasmashell | 4 ++- apparmor.d/profiles-s-z/thunderbird | 3 ++ 5 files changed, 49 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde index 309248e18..3b02d2b16 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde @@ -21,6 +21,8 @@ profile xdg-desktop-portal-kde @{exec_path} { network inet6 stream, network netlink raw, + signal send set=term peer=kioworker, + @{exec_path} mr, #aa:exec kioworker @@ -33,6 +35,8 @@ profile xdg-desktop-portal-kde @{exec_path} { owner @{run}/user/@{uid}/xdg-desktop-portal-kde@{rand6}.*.socket rw, + owner @{PROC}/@{pid}/mountinfo r, + /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index d01965bb0..b42b37dec 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -21,6 +21,7 @@ profile dolphin @{exec_path} { include include include + include network netlink raw, @@ -98,9 +99,40 @@ profile dolphin @{exec_path} { owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, + @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+bluetooth:* r, + @{run}/udev/data/+dmi* r, # for motherboard info + @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+i2c:* r, + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/+leds:* r, + @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) + @{run}/udev/data/+platform:* r, + @{run}/udev/data/+power_supply* r, + @{run}/udev/data/+rfkill:* r, + @{run}/udev/data/+sound:card@{int} r, # for sound card + + @{run}/udev/data/c1:@{int} r, # For RAM disk + @{run}/udev/data/c4:@{int} r, # For TTY devices + @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx + @{run}/udev/data/c7:@{int} r, # For Virtual console capture devices + @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features + @{run}/udev/data/c116:@{int} r, # For ALSA + @{run}/udev/data/c13:@{int} r, # For /dev/input/* + @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters + @{run}/udev/data/c29:@{int} r, # For /dev/fb[0-9]* + @{run}/udev/data/c89:@{int} r, # For I2C bus interface + @{run}/udev/data/c202:@{int} r, # CPU model-specific registers + @{run}/udev/data/c203:@{int} r, # CPU CPUID information + @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* + @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{sys}/bus/ r, @{sys}/bus/*/devices/ r, + @{sys}/class/*/ r, + @{sys}/devices/**/uevent r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 37dd3eeae..e992e09fd 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -26,10 +26,11 @@ profile kioworker @{exec_path} { network netlink raw, network netlink dgram, - signal (receive) set=term peer=dolphin, - signal (receive) set=term peer=firefox-kmozillahelper, - signal (receive) set=term peer=plasma-discover, - signal (receive) set=term peer=plasmashell, + signal receive set=term peer=dolphin, + signal receive set=term peer=firefox-kmozillahelper, + signal receive set=term peer=plasma-discover, + signal receive set=term peer=plasmashell, + signal receive set=term peer=xdg-desktop-portal-kde, @{exec_path} mr, @@ -37,6 +38,7 @@ profile kioworker @{exec_path} { @{lib}/libheif/*.so* rm, @{bin}/wrestool rPUx, + @{bin}/gs rPUx, #aa:exec kio_http_cache_cleaner @@ -91,6 +93,7 @@ profile kioworker @{exec_path} { owner @{run}/user/@{uid}/kio_*.socket rwl -> @{run}/user/@{uid}/#@{int}, owner @{run}/user/@{uid}/kioworker*.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 0d8a5d8cb..f800136e0 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -93,6 +93,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{MOUNTS}/ r, @{HOME}/ r, + owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r, owner @{HOME}/.var/app/**.{png,jpg,svg} r, owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, @@ -137,6 +138,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_config_dirs}/kcookiejarrc r, owner @{user_config_dirs}/kdedefaults/plasmarc r, owner @{user_config_dirs}/kdiff3fileitemactionrc r, + owner @{user_config_dirs}/kiorc r, owner @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/klaunchrc r, owner @{user_config_dirs}/klipperrc r, @@ -156,7 +158,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk, owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw, owner @{user_share_dirs}/kio/servicemenus/{,**} r, - owner @{user_share_dirs}/klipper/{,*} rwl, + owner @{user_share_dirs}/klipper/{,**} rwl, owner @{user_share_dirs}/konsole/ r, owner @{user_share_dirs}/kpeople/persondb rwk, owner @{user_share_dirs}/kpeoplevcard/ r, diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index 9a50dafa0..594d04b64 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -37,6 +37,9 @@ profile thunderbird @{exec_path} { # Desktop integration @{open_path} rPx -> child-open, + # Extensions + @{bin}/SysTray-X rPUx, + /usr/share/lightning/{,**} r, owner /var/mail/** rwk, From cfce68a5df7fd49042d22258420c75d52a463a9b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 21:59:20 +0100 Subject: [PATCH 0622/1455] feat(profile): allow to start hyprland from sddm. fix #674 --- apparmor.d/groups/kde/sddm | 1 + apparmor.d/profiles-m-r/pidof | 2 +- apparmor.d/profiles-s-z/waybar | 4 +++- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 56f0f5820..0205dacd7 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -94,6 +94,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/dbus-update-activation-environment rPx -> dbus-session, @{bin}/flatpak rPx, @{bin}/gnome-keyring-daemon rPx, + @{bin}/Hyprland rPx, @{bin}/kwalletd{5,6} rPx, @{bin}/kwin_wayland rPx, @{bin}/sddm-greeter{,-qt6} rPx, diff --git a/apparmor.d/profiles-m-r/pidof b/apparmor.d/profiles-m-r/pidof index 5da955cba..76b9942fb 100644 --- a/apparmor.d/profiles-m-r/pidof +++ b/apparmor.d/profiles-m-r/pidof @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/pidof -profile pidof @{exec_path} { +profile pidof @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-s-z/waybar b/apparmor.d/profiles-s-z/waybar index 8499a1ad6..b8d1d5326 100644 --- a/apparmor.d/profiles-s-z/waybar +++ b/apparmor.d/profiles-s-z/waybar @@ -26,11 +26,13 @@ profile waybar @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/waybar/{,**} r, + @{sys}/devices/@{pci}/uevent r, + @{sys}/devices/system/cpu/present r, @{sys}/devices/virtual/dmi/id/bios_vendor r, @{sys}/devices/virtual/dmi/id/board_vendor r, @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, - @{sys}/devices/system/cpu/present r, + @{sys}/devices/virtual/dmi/id/uevent r, @{PROC}/@{pid}/net/dev r, @{PROC}/spl/kstat/zfs/arcstats r, From f360d12ec19fcc2ade26e330400a56c1d706036d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 22:22:56 +0100 Subject: [PATCH 0623/1455] feat(profile): improve kde profiles. See #675 --- apparmor.d/groups/kde/baloo | 17 ++++++----------- apparmor.d/groups/kde/kde-powerdevil | 8 ++++++-- apparmor.d/groups/kde/kioworker | 2 +- apparmor.d/groups/kde/kwin_wayland | 17 +++++++++++++++++ apparmor.d/groups/kde/plasmashell | 2 +- apparmor.d/groups/kde/sddm | 2 +- 6 files changed, 32 insertions(+), 16 deletions(-) diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index 9a2f4c961..75532a773 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -42,27 +42,22 @@ profile baloo @{exec_path} { owner @{user_share_dirs}/baloo/{,**} rwk, - @{run}/udev/data/+acpi:* r, # for acpi - @{run}/udev/data/+backlight:* r, - @{run}/udev/data/+bluetooth:* r, - @{run}/udev/data/+dmi:* r, # For motherboard info - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+leds:* r, - @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+power_supply* r, - @{run}/udev/data/+rfkill:* r, - @{run}/udev/data/+sound:card@{int} r, # for sound card + @{run}/mount/utab r, + + @{run}/udev/data/+*:* r, @{run}/udev/data/c1:@{int} r, # For RAM disk @{run}/udev/data/c4:@{int} r, # For TTY devices + @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx @{run}/udev/data/c7:@{int} r, # For Virtual console capture devices @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features @{run}/udev/data/c13:@{int} r, # For /dev/input/* @{run}/udev/data/c29:@{int} r, # For /dev/fb[0-9]* @{run}/udev/data/c89:@{int} r, # For I2C bus interface + @{run}/udev/data/c99:@{int} r, # For raw parallel ports /dev/parport* @{run}/udev/data/c116:@{int} r, # For ALSA @{run}/udev/data/c202:@{int} r, # CPU model-specific registers + @{run}/udev/data/c203:@{int} r, # CPU CPUID information @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index c37ee870b..0747d1b47 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -27,6 +27,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{bin}/grep rix, @{bin}/kcminit rPx, @{bin}/sed rix, + @{bin}/uname rPx, @{bin}/xargs rix, @{lib}/drkonqi rPx, @@ -45,10 +46,13 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) owner @{user_config_dirs}/powermanagementprofilesrc.lock rwk, owner @{user_config_dirs}/powermanagementprofilesrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, - @{att}/@{run}/systemd/inhibit/@{int}.ref rw, - @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + + @{run}/mount/utab r, owner @{run}/user/@{uid}kcrash_@{int} rw, + @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** + @{sys}/bus/ r, @{sys}/bus/i2c/devices/ r, @{sys}/class/ r, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index e992e09fd..592e5811e 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -30,7 +30,7 @@ profile kioworker @{exec_path} { signal receive set=term peer=firefox-kmozillahelper, signal receive set=term peer=plasma-discover, signal receive set=term peer=plasmashell, - signal receive set=term peer=xdg-desktop-portal-kde, + signal receive set=term peer=xdg-desktop-portal-kde, @{exec_path} mr, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 24d86bec6..240869a31 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -30,6 +30,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { @{exec_path} mr, /etc/xdg/Xwayland-session.d/00-at-spi Cx -> at-spi, + /etc/xdg/Xwayland-session.d/00-pulseaudio-x11 Cx -> pulseaudio, #aa:exec kscreenlocker_greet /usr/share/color-schemes/*.colors r, @@ -119,6 +120,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+platform:* r, # for ? + @{run}/udev/data/+serio:* r, # for touchpad @{run}/udev/data/+sound:card@{int} r, # for sound card @{run}/udev/data/+usb:* r, @@ -137,6 +139,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { profile at-spi { include + include @{sh_path} r, @{bin}/busctl rix, @@ -151,6 +154,20 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { include if exists } + profile pulseaudio { + include + include + + @{sh_path} rix, + @{bin}/pactl Px, + + /etc/xdg/Xwayland-session.d/00-pulseaudio-x11 r, + + owner @{HOME}/ r, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index f800136e0..059760bd3 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -158,7 +158,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk, owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw, owner @{user_share_dirs}/kio/servicemenus/{,**} r, - owner @{user_share_dirs}/klipper/{,**} rwl, + owner @{user_share_dirs}/klipper/{,**} rwlk, owner @{user_share_dirs}/konsole/ r, owner @{user_share_dirs}/kpeople/persondb rwk, owner @{user_share_dirs}/kpeoplevcard/ r, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 0205dacd7..a7525d099 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -97,8 +97,8 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/Hyprland rPx, @{bin}/kwalletd{5,6} rPx, @{bin}/kwin_wayland rPx, - @{bin}/sddm-greeter{,-qt6} rPx, @{bin}/labwc rPx, + @{bin}/sddm-greeter{,-qt6} rPx, @{bin}/startlxqt rPx, @{bin}/startlxqtwayland rPx, @{bin}/startplasma-wayland rPx, From 03406096ceb9b395bb7245eae8f08d606f61e04b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 23:46:49 +0100 Subject: [PATCH 0624/1455] feat(dbus): simplify the way to provide unix address for dbus. --- apparmor.d/abstractions/bus-session | 4 +--- apparmor.d/abstractions/bus-system | 2 ++ pkg/prebuild/directive/dbus.go | 24 +++++------------------- pkg/prebuild/directive/dbus_test.go | 12 +++--------- 4 files changed, 11 insertions(+), 31 deletions(-) diff --git a/apparmor.d/abstractions/bus-session b/apparmor.d/abstractions/bus-session index 95325d7d3..0c3abd96e 100644 --- a/apparmor.d/abstractions/bus-session +++ b/apparmor.d/abstractions/bus-session @@ -4,9 +4,7 @@ abi , - unix (bind, listen) type=stream addr="@/tmp/dbus-*", - unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-*", - unix (connect, send, receive, accept) type=stream peer=(addr="@/tmp/dbus-*"), + unix bind type=stream addr=@@{udbus}/bus/@{profile_name}/session, dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus diff --git a/apparmor.d/abstractions/bus-system b/apparmor.d/abstractions/bus-system index 870443002..24d2cf4c2 100644 --- a/apparmor.d/abstractions/bus-system +++ b/apparmor.d/abstractions/bus-system @@ -4,6 +4,8 @@ abi , + unix bind type=stream addr=@@{udbus}/bus/@{profile_name}/system, + dbus send bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} diff --git a/pkg/prebuild/directive/dbus.go b/pkg/prebuild/directive/dbus.go index 4a9030505..99a8f6138 100644 --- a/pkg/prebuild/directive/dbus.go +++ b/pkg/prebuild/directive/dbus.go @@ -45,15 +45,11 @@ func (d Dbus) Apply(opt *Option, profile string) (string, error) { if err != nil { return "", err } - name := opt.File.Base() - if len(name) > 15 { - name = name[:15] - } switch action { case "own": - r = d.own(opt.ArgMap, name) + r = d.own(opt.ArgMap) case "talk": - r = d.talk(opt.ArgMap, name) + r = d.talk(opt.ArgMap) } aa.IndentationLevel = strings.Count( @@ -107,14 +103,10 @@ func getInterfaces(rules map[string]string) []string { return interfaces } -func (d Dbus) own(rules map[string]string, name string) aa.Rules { +func (d Dbus) own(rules map[string]string) aa.Rules { interfaces := getInterfaces(rules) res := aa.Rules{ - &aa.Unix{ - Access: []string{"bind"}, Type: "stream", - Address: `@@{udbus}/bus/` + name + `/` + rules["bus"], - }, &aa.Dbus{ Access: []string{"bind"}, Bus: rules["bus"], Name: rules["name"], }, @@ -170,15 +162,9 @@ func (d Dbus) own(rules map[string]string, name string) aa.Rules { return res } -func (d Dbus) talk(rules map[string]string, name string) aa.Rules { +func (d Dbus) talk(rules map[string]string) aa.Rules { interfaces := getInterfaces(rules) - - res := aa.Rules{ - &aa.Unix{ - Access: []string{"bind"}, Type: "stream", - Address: `@@{udbus}/bus/` + name + `/` + rules["bus"], - }, - } + res := aa.Rules{} // Interfaces for _, iface := range interfaces { diff --git a/pkg/prebuild/directive/dbus_test.go b/pkg/prebuild/directive/dbus_test.go index f2d4997e4..5f8d57d10 100644 --- a/pkg/prebuild/directive/dbus_test.go +++ b/pkg/prebuild/directive/dbus_test.go @@ -10,9 +10,7 @@ import ( "github.com/roddhjav/apparmor.d/pkg/paths" ) -const dbusOwnSystemd1 = ` unix bind type=stream addr=@@{udbus}/bus/fake-own/system, - - dbus bind bus=system name=org.freedesktop.systemd1{,.*}, +const dbusOwnSystemd1 = ` dbus bind bus=system name=org.freedesktop.systemd1{,.*}, dbus receive bus=system path=/org/freedesktop/systemd1{,/**} interface=org.freedesktop.systemd1{,.*} peer=(name="@{busname}"), @@ -75,9 +73,7 @@ func TestDbus_Apply(t *testing.T) { Raw: " #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions", }, profile: " #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions", - want: ` unix bind type=stream addr=@@{udbus}/bus/fake-interface/session, - - dbus bind bus=session name=com.rastersoft.ding{,.*}, + want: ` dbus bind bus=session name=com.rastersoft.ding{,.*}, dbus receive bus=session path=/com/rastersoft/ding{,/**} interface=com.rastersoft.ding{,.*} peer=(name="@{busname}"), @@ -122,9 +118,7 @@ func TestDbus_Apply(t *testing.T) { Raw: " #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon", }, profile: " #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon", - want: ` unix bind type=stream addr=@@{udbus}/bus/gdm-session-wor/system, - - dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} + want: ` dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} interface=org.freedesktop.Accounts{,.*} peer=(name="{@{busname},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} From f270809c5f3770cb7645ace2734e1135b8f49e89 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 23:49:55 +0100 Subject: [PATCH 0625/1455] feat(tunable): set alias // -> / for all install. This is required when the re-attached path feature is enabled. --- apparmor.d/tunables/multiarch.d/system | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index a2f99a2ec..b155b2e36 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -62,6 +62,7 @@ # Attachment path for attach_disconnected.path flag. # Automatically generated and set in profile preamble on ABI4. Disabled on ABI3. @{att}=/ + alias // -> /, # vim:syntax=apparmor From 0d5e363bbca961b87c464cc151ed4580f67aaf4d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 23:50:27 +0100 Subject: [PATCH 0626/1455] feat(abs): add more base attached files. --- apparmor.d/abstractions/attached/base | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index 9a53d1548..4fcfe2665 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -9,6 +9,7 @@ @{att}/@{run}/systemd/journal/dev-log w, @{att}/@{run}/systemd/journal/socket w, + @{att}/@{run}/systemd/journal/stdout rw, deny /apparmor/.null rw, deny @{att}/apparmor/.null rw, From 71632a6456ab3edd82253d6081887c34db1bb085 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 6 Mar 2025 23:58:20 +0100 Subject: [PATCH 0627/1455] doc: minor improvements --- docs/development/build.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/development/build.md b/docs/development/build.md index 89bf8e89e..5145a8416 100644 --- a/docs/development/build.md +++ b/docs/development/build.md @@ -119,22 +119,22 @@ This task will convert all profiles from `abi/4.0` to `abi/3.0`. The rules not s ### **`complain | enforce`** -Set or remove the complain flag on all profiles. The `complain` task is enabled by default. When building in enforce mode, it is disabled. Enabling the `enforce` task will enforce **all** profiles including the one set in the [flags manifest](workflow.md#profile-flags). It is intended to be used in specialized system such as CTF or (very) high security VM. +Set or remove the complain flag on all profiles. The `complain` task is enabled by default. When building in enforce mode, it is disabled. Enabling the `enforce` task will enforce **all** profiles including the one set in the [flags manifest](workflow.md#profile-flags). It is intended to be used in specialized system such as a CTF challenge or in (very) high security VM. *Enable with the `--complain` or `--enforce` option in the prebuild command.* ### **`userspace`** -Resolve variables in profile attachments. It fixes issues with the userland AppArmor tools (aa-enforce, aa-logprof...) that does not support identical variable in the profiles attachments. +Resolve variables in profile attachments. It fixes issues with the userland AppArmor tools (aa-enforce, aa-logprof...) that do not support identical variable in the profiles attachments. *Enabled by default. Can be disabled in `cmd/prebuild/main.go`* ### **`attach`** -This task reattaches disconnected paths. See [#559](https://github.com/roddhjav/apparmor.d/issues/559): +This task reattaches disconnected paths. See the [Re-attached path](internal.md#re-attached-path) page. It will: - Add the `attach_disconnected.path` flag on all profiles with the `attach_disconnected` flag -- Add the attached/base abstraction in the profile +- Add the `` abstraction in the profile - For compatibility, non-disconnected profile will have the `@{att}` variable set to `/` *Enabled when abi >= 4.0* From da7958a2f9a02e86df049d3b2a5760d99b045d92 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 7 Mar 2025 00:00:24 +0100 Subject: [PATCH 0628/1455] feat(fsp): improve the base systemd profiles. --- apparmor.d/groups/_full/systemd | 25 +++++++++++++++----- apparmor.d/groups/_full/systemd-service | 5 ++++ apparmor.d/groups/_full/systemd-user | 10 ++++++++ apparmor.d/groups/_full/systemd-user-service | 2 +- 4 files changed, 35 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index d71647705..0206b0189 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -65,14 +65,21 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { mount fstype=autofs systemd-1 -> @{PROC}/sys/fs/binfmt_misc/, mount fstype=autofs systemd-1 -> /efi/, - mount fstype=hugetlbfs options=(rw nosuid nodev) hugetlbfs -> /dev/hugepages/, - mount fstype=proc options=(rw nosuid nodev noexec) proc -> @{run}/systemd/namespace-@{rand6}/, - mount fstype=sysfs options=(rw nosuid nodev noexec) sysfs -> @{run}/systemd/namespace-@{rand6}/, + mount fstype=binfmt_misc options=(rw nodev noexec nosuid) binfmt_misc -> @{PROC}/sys/fs/binfmt_misc/, + mount fstype=configfs options=(rw nodev noexec nosuid) configfs -> @{sys}/kernel/config/, + mount fstype=debugfs options=(rw nodev noexec nosuid) debugfs -> @{sys}/kernel/debug/, + mount fstype=fusectl options=(rw nodev noexec nosuid) fusectl -> @{sys}/fs/fuse/connections/, + mount fstype=hugetlbfs options=(rw nosuid nodev) hugetlbfs -> /dev/hugepages/, + mount fstype=mqueue options=(rw nodev noexec nosuid) mqueue -> /dev/mqueue/, + mount fstype=proc options=(rw nosuid nodev noexec) proc -> @{run}/systemd/namespace-@{rand6}/, + mount fstype=sysfs options=(rw nosuid nodev noexec) sysfs -> @{run}/systemd/namespace-@{rand6}/, mount fstype=tmpfs tmpfs -> /dev/shm/, mount fstype=tmpfs tmpfs -> /tmp/, - mount fstype=tmpfs options=(rw nosuid nodev noexec strictatime) tmpfs -> @{run}/systemd/mount-rootfs/@{run}/credentials/, - mount fstype=tmpfs options=(rw nosuid nodev noexec) tmpfs -> /dev/shm/, - mount fstype=tmpfs options=(rw nosuid noexec strictatime) tmpfs -> @{run}/systemd/namespace-@{rand6}/dev/, + mount fstype=tmpfs options=(rw nosuid nodev noexec strictatime) tmpfs -> @{run}/systemd/mount-rootfs/@{run}/credentials/, + mount fstype=tmpfs options=(rw nosuid nodev noexec) tmpfs -> /dev/shm/, + mount fstype=tmpfs options=(rw nosuid noexec strictatime) tmpfs -> @{run}/systemd/namespace-@{rand6}/dev/, + mount fstype=tracefs options=(rw nodev noexec nosuid) tracefs -> @{sys}/kernel/tracing/, + mount fstype=vfat -> /boot/efi/, mount options=(rw bind) /dev/** -> /tmp/namespace-dev-@{rand6}/**, mount options=(rw bind) /dev/** -> @{run}/systemd/namespace-@{rand6}/dev/**, @@ -157,8 +164,10 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { # Unit services @{bin}/mount ix, + @{bin}/kill ix, # Shell based systemd unit services + # TODO: create unit profile for all of them @{bin}/ldconfig Px -> systemd-service, @{bin}/mandb Px -> systemd-service, @{bin}/savelog Px -> systemd-service, @@ -187,8 +196,10 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { /etc/conf.d/{,**} r, /etc/credstore.encrypted/{,**} r, /etc/credstore/{,**} r, + /etc/default/{,**} r, /etc/machine-id r, /etc/modules-load.d/{,**} r, + /etc/networkd-dispatcher/{,**} r, /etc/systemd/{,**} r, /etc/udev/hwdb.d/{,**} r, @@ -199,6 +210,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { /tmp/systemd-private-*/{,**} rw, @{run}/ rw, + @{run}/*.socket w, @{run}/*/ rw, @{run}/*/* rw, @{run}/auditd.pid r, @@ -263,6 +275,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { /dev/autofs r, /dev/kmsg w, + /dev/tty@{int} rw, owner /dev/console rwk, owner /dev/dri/card@{int} rw, owner /dev/hugepages/ rw, diff --git a/apparmor.d/groups/_full/systemd-service b/apparmor.d/groups/_full/systemd-service index e6c4a4b7b..dfe3000bc 100644 --- a/apparmor.d/groups/_full/systemd-service +++ b/apparmor.d/groups/_full/systemd-service @@ -17,6 +17,7 @@ profile systemd-service flags=(attach_disconnected) { include include + capability dac_read_search, capability chown, capability fsetid, @@ -42,9 +43,13 @@ profile systemd-service flags=(attach_disconnected) { /var/cache/ldconfig/{,**} rw, + / r, + /boot/grub/grubenv rw, /boot/grub/ w, + /var/spool/cron/atjobs/ r, + /var/log/ r, /var/log/dmesg rw, /var/log/dmesg.* rwl -> /var/log/dmesg, diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index 919c53457..401e73bd9 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -102,6 +102,9 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { @{run}/udev/tags/systemd/ r, @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/**/uevent r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} r, @@ -112,6 +115,7 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/comm r, @{PROC}/@{pids}/stat r, + @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/pressure/* r, @{PROC}/swaps r, @@ -134,6 +138,12 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { /dev/tty rw, + deny capability bpf, + deny capability mknod, + deny capability net_admin, + deny capability perfmon, + deny capability sys_resource, + profile systemctl { include include diff --git a/apparmor.d/groups/_full/systemd-user-service b/apparmor.d/groups/_full/systemd-user-service index d65846f82..0cb9efa49 100644 --- a/apparmor.d/groups/_full/systemd-user-service +++ b/apparmor.d/groups/_full/systemd-user-service @@ -12,7 +12,7 @@ abi , include -profile systemd-user-service flags=(complain) { +profile systemd-user-service flags=(attach_disconnected) { include include From b623dc4a77ed6919428844ce48aca382d5930a8a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 7 Mar 2025 00:07:11 +0100 Subject: [PATCH 0629/1455] feat(profile): minor improvements. --- apparmor.d/abstractions/app/sudo | 2 -- apparmor.d/groups/apt/command-not-found | 2 +- apparmor.d/groups/gnome/gnome-logs | 2 ++ apparmor.d/groups/systemd/journalctl | 2 ++ apparmor.d/groups/systemd/loginctl | 4 +++- apparmor.d/groups/systemd/systemd-networkd | 2 +- apparmor.d/groups/systemd/systemd-udevd | 4 ++-- apparmor.d/groups/utils/chsh | 2 -- apparmor.d/groups/utils/login | 2 -- apparmor.d/groups/utils/su | 2 -- apparmor.d/profiles-a-f/console-setup | 1 + apparmor.d/profiles-g-l/hugo | 9 ++++++++- apparmor.d/profiles-m-r/qemu-ga | 4 ++-- 13 files changed, 22 insertions(+), 16 deletions(-) diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 4c7de6ba5..333cbddbd 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -24,8 +24,6 @@ network netlink raw, # PAM - unix bind type=stream addr=@@{udbus}/bus/sudo/system, - #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind diff --git a/apparmor.d/groups/apt/command-not-found b/apparmor.d/groups/apt/command-not-found index 1ba7b5cb3..ee8e3bcb5 100644 --- a/apparmor.d/groups/apt/command-not-found +++ b/apparmor.d/groups/apt/command-not-found @@ -21,7 +21,7 @@ profile command-not-found @{exec_path} { @{python_path} r, @{bin}/lsb_release rPx -> lsb_release, - @{bin}/snap rPUx, + @{bin}/snap rPx, @{lib}/@{python_name}/dist-packages/CommandNotFound/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, diff --git a/apparmor.d/groups/gnome/gnome-logs b/apparmor.d/groups/gnome/gnome-logs index 5e3ab03bd..06e66a43b 100644 --- a/apparmor.d/groups/gnome/gnome-logs +++ b/apparmor.d/groups/gnome/gnome-logs @@ -27,6 +27,8 @@ profile gnome-logs @{exec_path} { /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal r, /{run,var}/log/journal/remote/ r, + owner @{PROC}/@{pid}/stat r, + include if exists } diff --git a/apparmor.d/groups/systemd/journalctl b/apparmor.d/groups/systemd/journalctl index 3c5595345..36fbd9e75 100644 --- a/apparmor.d/groups/systemd/journalctl +++ b/apparmor.d/groups/systemd/journalctl @@ -33,6 +33,8 @@ profile journalctl @{exec_path} flags=(attach_disconnected) { /var/lib/systemd/catalog/database rw, /var/lib/systemd/catalog/.#database* rw, + /var/log/dmesg w, + /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/ r, /{run,var}/log/journal/@{hex32}/system.journal* r, diff --git a/apparmor.d/groups/systemd/loginctl b/apparmor.d/groups/systemd/loginctl index 5386662c0..2892c88c3 100644 --- a/apparmor.d/groups/systemd/loginctl +++ b/apparmor.d/groups/systemd/loginctl @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/loginctl -profile loginctl @{exec_path} { +profile loginctl @{exec_path} flags=(attach_disconnected) { include include include @@ -27,6 +27,8 @@ profile loginctl @{exec_path} { @{PROC}/sys/fs/nr_open r, owner @{PROC}/@{pid}/cgroup r, + /dev/rfkill r, + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 20b396a72..ca5450826 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -29,7 +29,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { network packet dgram, network packet raw, - unix (bind) type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network, + unix bind type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network, #aa:dbus own bus=system name=org.freedesktop.network1 diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index d71ccf1a1..1af847cd4 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -42,7 +42,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{bin}/*-print-pci-ids rix, @{bin}/alsactl rPUx, @{bin}/ddcutil rPx, - @{bin}/dmsetup rPUx, + @{bin}/dmsetup rPx, @{bin}/ethtool rix, @{bin}/issue-generator rPx, @{bin}/kmod rPx, @@ -56,7 +56,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) { @{bin}/perl rix, @{bin}/setfacl rix, @{bin}/sg_inq rix, - @{bin}/snap rPUx, + @{bin}/snap rPx, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-run rix, @{bin}/unshare rix, diff --git a/apparmor.d/groups/utils/chsh b/apparmor.d/groups/utils/chsh index bf2b92a98..73f097a94 100644 --- a/apparmor.d/groups/utils/chsh +++ b/apparmor.d/groups/utils/chsh @@ -24,8 +24,6 @@ profile chsh @{exec_path} { network netlink raw, - unix type=stream addr=@@{udbus}/bus/chsh/system, - #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed @{exec_path} mr, diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login index dbf334577..c04c4230c 100644 --- a/apparmor.d/groups/utils/login +++ b/apparmor.d/groups/utils/login @@ -32,8 +32,6 @@ profile login @{exec_path} flags=(attach_disconnected) { signal (send) set=(hup term), - unix type=stream addr=@@{udbus}/bus/login/system, - ptrace read, #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind diff --git a/apparmor.d/groups/utils/su b/apparmor.d/groups/utils/su index 02a212150..2615085ab 100644 --- a/apparmor.d/groups/utils/su +++ b/apparmor.d/groups/utils/su @@ -19,8 +19,6 @@ profile su @{exec_path} { signal (receive) set=(int,quit,term), signal (receive) set=(cont,hup) peer=sudo, - unix (bind) type=dgram, - @{exec_path} mr, @{bin}/@{shells} rUx, diff --git a/apparmor.d/profiles-a-f/console-setup b/apparmor.d/profiles-a-f/console-setup index 5b867e1eb..7a11e407f 100644 --- a/apparmor.d/profiles-a-f/console-setup +++ b/apparmor.d/profiles-a-f/console-setup @@ -12,6 +12,7 @@ profile console-setup @{exec_path} { @{exec_path} mr, + @{sh_path} r, @{bin}/uname rPx, @{bin}/mkdir rix, diff --git a/apparmor.d/profiles-g-l/hugo b/apparmor.d/profiles-g-l/hugo index 6bb737ca0..ed62f48f1 100644 --- a/apparmor.d/profiles-g-l/hugo +++ b/apparmor.d/profiles-g-l/hugo @@ -37,10 +37,17 @@ profile hugo @{exec_path} { owner @{user_cache_dirs}/hugo_cache/{,**} rwkl, + owner @{user_config_dirs}/git/*config r, + owner @{user_config_dirs}/go/telemetry/mode r, + owner @{tmp}/hugo_cache/{,**} rwkl, owner @{tmp}/go-codehost-@{int} rw, - @{PROC}/sys/net/core/somaxconn r, + @{sys}/kernel/mm/hugepages/ r, + + @{PROC}/sys/net/core/somaxconn r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/mountinfo r, include if exists } diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index b100e4e15..b6bbf5f73 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/qemu-ga -profile qemu-ga @{exec_path} flags=(complain) { +profile qemu-ga @{exec_path} { include @{exec_path} mr, @@ -24,7 +24,7 @@ profile qemu-ga @{exec_path} flags=(complain) { /dev/vport@{int}p@{int} rw, - profile systemctl flags=(complain) { + profile systemctl { include include From 9e1cc72cc443e8604a747315678e212196a4a698 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 7 Mar 2025 00:08:17 +0100 Subject: [PATCH 0630/1455] feat(abs): kde: allow to access gtk resources. They are required for gtk based app on KDE. --- apparmor.d/abstractions/kde-strict | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 282ae1974..0f4410a12 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -6,6 +6,7 @@ include include + include include include include From 106921df234b90762c481e97ee390dc3428f7a6f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 8 Mar 2025 14:23:08 +0100 Subject: [PATCH 0631/1455] fix(build): ensure fsp mode set the systemd profile name correctly. --- pkg/prebuild/prepare/fsp.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/prebuild/prepare/fsp.go b/pkg/prebuild/prepare/fsp.go index 1d38ca294..c216b53eb 100644 --- a/pkg/prebuild/prepare/fsp.go +++ b/pkg/prebuild/prepare/fsp.go @@ -34,7 +34,7 @@ func (p FullSystemPolicy) Apply() ([]string, error) { } // Set systemd profile name - path := prebuild.RootApparmord.Join("tunables/multiarch.d/system") + path := prebuild.RootApparmord.Join("tunables/multiarch.d/profiles") out, err := path.ReadFileAsString() if err != nil { return res, err From 0ef623ed40a36d4653a81f3a1525aa904716ef1f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 8 Mar 2025 21:54:39 +0100 Subject: [PATCH 0632/1455] fix: ensure pidof use the attach_disconnected and enforce it. see #677 --- dists/flags/main.flags | 1 - 1 file changed, 1 deletion(-) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 87c070c56..d4e7d5a9f 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -249,7 +249,6 @@ os-prober attach_disconnected,complain pam_kwallet_init complain pam-tmpdir-helper complain passimd attach_disconnected,complain -pidof complain pkttyagent complain plank complain plasma_waitforname complain From 7badf80854e6bf008110e56ba839d272f5219beb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Mar 2025 22:58:27 +0100 Subject: [PATCH 0633/1455] feat(profile): improve dbus abstractions and interopaerability with profiles. --- apparmor.d/abstractions/app/systemctl | 1 + apparmor.d/abstractions/dbus-strict.d/complete | 12 +++++++++++- apparmor.d/abstractions/ibus.d/complete | 5 +++++ 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/app/systemctl b/apparmor.d/abstractions/app/systemctl index 8489bb275..4ecfbecad 100644 --- a/apparmor.d/abstractions/app/systemctl +++ b/apparmor.d/abstractions/app/systemctl @@ -11,6 +11,7 @@ ptrace read peer=@{p_systemd}, unix bind type=stream addr=@@{udbus}/bus/systemctl/, + unix bind type=stream addr=@@{udbus}/bus/systemctl/system, @{bin}/systemctl mr, diff --git a/apparmor.d/abstractions/dbus-strict.d/complete b/apparmor.d/abstractions/dbus-strict.d/complete index 86936b953..0428c745a 100644 --- a/apparmor.d/abstractions/dbus-strict.d/complete +++ b/apparmor.d/abstractions/dbus-strict.d/complete @@ -2,6 +2,16 @@ # Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - include + dbus send bus=system path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), + + dbus send bus=system path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={RequestName,ReleaseName} + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), + + @{run}/dbus/system_bus_socket rw, # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/ibus.d/complete b/apparmor.d/abstractions/ibus.d/complete index 33d034b5a..5c53b9fa1 100644 --- a/apparmor.d/abstractions/ibus.d/complete +++ b/apparmor.d/abstractions/ibus.d/complete @@ -21,6 +21,11 @@ type=stream addr="@/home/*/.cache/ibus/dbus-????????", + dbus receive bus=session path=/org/freedesktop/IBus + interface=org.freedesktop.DBus.Peer + member=Ping + peer=(name=@{busname}, label=ibus-daemon), + owner @{user_cache_dirs}/ibus/dbus-@{rand8} rw, # vim:syntax=apparmor From 47b6e3c616f8b57575436bfc09e57d424cea0fac Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Mar 2025 23:04:32 +0100 Subject: [PATCH 0634/1455] feat(profile): various core update. --- apparmor.d/groups/filesystem/mke2fs | 2 ++ apparmor.d/groups/firewall/firewalld | 1 + apparmor.d/groups/procps/htop | 1 + apparmor.d/groups/procps/w | 2 +- apparmor.d/groups/systemd/systemd-cryptsetup | 2 ++ apparmor.d/groups/systemd/systemd-generator-ds-identify | 1 + apparmor.d/groups/systemd/systemd-modules-load | 2 +- apparmor.d/groups/systemd/systemd-remount-fs | 4 ++-- apparmor.d/groups/systemd/systemd-tty-ask-password-agent | 9 +++++---- apparmor.d/groups/systemd/zram-generator | 4 ++-- apparmor.d/groups/ubuntu/apt-esm-json-hook | 2 +- apparmor.d/groups/ubuntu/update-notifier | 2 -- apparmor.d/groups/utils/agetty | 2 ++ apparmor.d/groups/utils/login | 4 ++-- apparmor.d/groups/utils/su | 6 +++--- apparmor.d/groups/utils/uname | 3 --- apparmor.d/profiles-a-f/blkdeactivate | 2 ++ apparmor.d/profiles-s-z/YACReader | 2 ++ 18 files changed, 30 insertions(+), 21 deletions(-) diff --git a/apparmor.d/groups/filesystem/mke2fs b/apparmor.d/groups/filesystem/mke2fs index acf88197f..56a223bdd 100644 --- a/apparmor.d/groups/filesystem/mke2fs +++ b/apparmor.d/groups/filesystem/mke2fs @@ -34,6 +34,8 @@ profile mke2fs @{exec_path} { owner @{run}/blkid/blkid.tab{,-@{rand6}} rw, owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab, + owner @{tmp}/.guestfs-@{uid}/appliance.d.@{rand8}/@{user} rw, + @{PROC}/swaps r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/firewall/firewalld b/apparmor.d/groups/firewall/firewalld index 6d84dfe47..003089ca4 100644 --- a/apparmor.d/groups/firewall/firewalld +++ b/apparmor.d/groups/firewall/firewalld @@ -30,6 +30,7 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=system name=org.fedoraproject.FirewallD1 @{exec_path} mr, + @{python_path} r, @{bin}/ r, @{bin}/alts rix, diff --git a/apparmor.d/groups/procps/htop b/apparmor.d/groups/procps/htop index c720929f3..5e1079802 100644 --- a/apparmor.d/groups/procps/htop +++ b/apparmor.d/groups/procps/htop @@ -28,6 +28,7 @@ profile htop @{exec_path} { @{exec_path} mr, @{bin}/lsof rix, + @{bin}/strace rix, /usr/share/terminfo/** r, diff --git a/apparmor.d/groups/procps/w b/apparmor.d/groups/procps/w index b23a7bc23..2445034e9 100644 --- a/apparmor.d/groups/procps/w +++ b/apparmor.d/groups/procps/w @@ -16,7 +16,7 @@ profile w @{exec_path} { capability sys_ptrace, - ptrace (read), + ptrace read, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-cryptsetup b/apparmor.d/groups/systemd/systemd-cryptsetup index 090412ff5..fdddebe03 100644 --- a/apparmor.d/groups/systemd/systemd-cryptsetup +++ b/apparmor.d/groups/systemd/systemd-cryptsetup @@ -31,6 +31,8 @@ profile systemd-cryptsetup @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/bdi/*/read_ahead_kb r, @{sys}/fs/ r, + @{run}/systemd/ask-password/ r, + @{PROC}/devices r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/systemd/systemd-generator-ds-identify b/apparmor.d/groups/systemd/systemd-generator-ds-identify index 6b42e55ed..d9a6639c1 100644 --- a/apparmor.d/groups/systemd/systemd-generator-ds-identify +++ b/apparmor.d/groups/systemd/systemd-generator-ds-identify @@ -18,6 +18,7 @@ profile systemd-generator-ds-identify @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/blkid rPx, + @{bin}/grep rix, @{bin}/systemd-detect-virt rPx, @{bin}/tr rix, @{bin}/uname rix, diff --git a/apparmor.d/groups/systemd/systemd-modules-load b/apparmor.d/groups/systemd/systemd-modules-load index d3527c22b..cc44f385f 100644 --- a/apparmor.d/groups/systemd/systemd-modules-load +++ b/apparmor.d/groups/systemd/systemd-modules-load @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-modules-load -profile systemd-modules-load @{exec_path} { +profile systemd-modules-load @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/systemd/systemd-remount-fs b/apparmor.d/groups/systemd/systemd-remount-fs index 8c63a1d5a..4231f7e7b 100644 --- a/apparmor.d/groups/systemd/systemd-remount-fs +++ b/apparmor.d/groups/systemd/systemd-remount-fs @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-remount-fs -profile systemd-remount-fs @{exec_path} { +profile systemd-remount-fs @{exec_path} flags=(attach_disconnected) { include include include @@ -17,7 +17,7 @@ profile systemd-remount-fs @{exec_path} { capability sys_resource, mount options=(rw, remount) -> /, - mount options=(rw, remount) -> /proc/, + mount options=(rw, remount) -> @{PROC}/, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index ecac3e1a8..7ab8be35c 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -17,10 +17,11 @@ profile systemd-tty-ask-password-agent @{exec_path} { capability net_admin, capability sys_resource, - signal (receive) set=(term cont) peer=*//systemctl, - signal (receive) set=(term cont) peer=default, - signal (receive) set=(term cont) peer=logrotate, - signal (receive) set=(term cont) peer=rpm, + signal receive set=(term cont) peer=*//systemctl, + signal receive set=(term cont) peer=default, + signal receive set=(term cont) peer=logrotate, + signal receive set=(term cont) peer=role_*, + signal receive set=(term cont) peer=rpm, @{exec_path} mrix, diff --git a/apparmor.d/groups/systemd/zram-generator b/apparmor.d/groups/systemd/zram-generator index f6406811d..d156d88a4 100644 --- a/apparmor.d/groups/systemd/zram-generator +++ b/apparmor.d/groups/systemd/zram-generator @@ -27,8 +27,8 @@ profile zram-generator @{exec_path} flags=(attach_disconnected) { owner @{run}/systemd/generator/swap.target.wants/{,dev-zram@{int}.swap} rw, owner @{run}/systemd/generator/systemd-zram-setup@zram@{int}.service.d/{,*.conf} rw, - @{sys}/block/zram@{int}/{disksize,reset} rw, - @{sys}/devices/virtual/block/zram@{int}/{disksize,reset,comp_algorithm} rw, + @{sys}/block/zram@{int}/* rw, + @{sys}/devices/virtual/block/zram@{int}/* rw, @{sys}/module/compression r, @{PROC}/crypto r, diff --git a/apparmor.d/groups/ubuntu/apt-esm-json-hook b/apparmor.d/groups/ubuntu/apt-esm-json-hook index 2dcf50743..2edc09970 100644 --- a/apparmor.d/groups/ubuntu/apt-esm-json-hook +++ b/apparmor.d/groups/ubuntu/apt-esm-json-hook @@ -22,7 +22,7 @@ profile apt-esm-json-hook @{exec_path} { /var/lib/ubuntu-advantage/apt-esm/{,**} rw, /var/log/ubuntu-advantage-apt-hook.log w, - @{run}/cloud-init/cloud-id-nocloud r, + @{run}/cloud-init/cloud-id-* r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index d540ed0e8..8d1571c1e 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -87,8 +87,6 @@ profile update-notifier @{exec_path} { include include - unix (bind) type=stream addr=@@{udbus}/bus/systemctl/system, - dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=GetUnitFileState diff --git a/apparmor.d/groups/utils/agetty b/apparmor.d/groups/utils/agetty index 4605822e7..3eca54abc 100644 --- a/apparmor.d/groups/utils/agetty +++ b/apparmor.d/groups/utils/agetty @@ -20,6 +20,8 @@ profile agetty @{exec_path} { network netlink raw, + signal receive set=hup peer=@{p_systemd}, + @{exec_path} mr, @{bin}/login rPx, diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login index c04c4230c..6968be40e 100644 --- a/apparmor.d/groups/utils/login +++ b/apparmor.d/groups/utils/login @@ -30,7 +30,7 @@ profile login @{exec_path} flags=(attach_disconnected) { network netlink raw, - signal (send) set=(hup term), + signal send set=(hup term), ptrace read, @@ -38,7 +38,7 @@ profile login @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/@{shells} rUx, + @{shells_path} rUx, @{etc_ro}/environment r, @{etc_ro}/security/group.conf r, diff --git a/apparmor.d/groups/utils/su b/apparmor.d/groups/utils/su index 2615085ab..aec037e84 100644 --- a/apparmor.d/groups/utils/su +++ b/apparmor.d/groups/utils/su @@ -15,9 +15,9 @@ profile su @{exec_path} { capability chown, # pseudo-terminal - signal (send) set=(term,kill), - signal (receive) set=(int,quit,term), - signal (receive) set=(cont,hup) peer=sudo, + signal send set=(term kill), + signal receive set=(int quit term), + signal receive set=(cont hup) peer=sudo, @{exec_path} mr, diff --git a/apparmor.d/groups/utils/uname b/apparmor.d/groups/utils/uname index 6ca8a6370..45a864c23 100644 --- a/apparmor.d/groups/utils/uname +++ b/apparmor.d/groups/utils/uname @@ -14,9 +14,6 @@ profile uname @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{lib}/@{multiarch}/ld-linux-*so* r, - @{lib}/@{multiarch}/libc.so* mr, - @{att}/dev/tty@{int} rw, deny network, diff --git a/apparmor.d/profiles-a-f/blkdeactivate b/apparmor.d/profiles-a-f/blkdeactivate index ad575351f..2cabb639f 100644 --- a/apparmor.d/profiles-a-f/blkdeactivate +++ b/apparmor.d/profiles-a-f/blkdeactivate @@ -14,8 +14,10 @@ profile blkdeactivate @{exec_path} flags=(complain) { @{exec_path} rm, + @{sh_path} rix, @{bin}/dmsetup rPUx, @{bin}/grep rix, + @{bin}/touch rix, @{bin}/lsblk rPx, @{bin}/lvm rPx, @{bin}/multipathd rPx, diff --git a/apparmor.d/profiles-s-z/YACReader b/apparmor.d/profiles-s-z/YACReader index de55bf829..3552b6dc0 100644 --- a/apparmor.d/profiles-s-z/YACReader +++ b/apparmor.d/profiles-s-z/YACReader @@ -39,6 +39,8 @@ profile YACReader @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists } From ab41d2e0f37c5cf795eaff074d06a288cef8a84d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Mar 2025 23:12:01 +0100 Subject: [PATCH 0635/1455] feat(fsp): improve the systemd profiles. --- apparmor.d/groups/_full/systemd | 22 ++++++++++++++++------ apparmor.d/groups/_full/systemd-user | 6 ++++++ 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index 0206b0189..c56a0936a 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -108,6 +108,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { remount @{run}/systemd/unit-root/{,**}, remount /, remount /snap/{,**}, + remount options=(ro bind) /boot/efi/, remount options=(ro noexec noatime bind) /var/snap/{,**}, remount options=(ro nosuid bind) /dev/, remount options=(ro nosuid nodev bind) /dev/hugepages/, @@ -127,18 +128,20 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { pivot_root oldroot=@{run}/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/, pivot_root oldroot=@{run}/systemd/unit-root/ @{run}/systemd/unit-root/, + mqueue (read getattr) type=posix /, + change_profile, - signal (receive) set=(rtmin+23) peer=plymouthd, - signal (receive) set=(term, hup, cont), - signal (send), + signal receive set=(rtmin+23) peer=plymouthd, + signal receive set=(term hup cont), + signal send, ptrace (read, readby), - unix (send) type=dgram, + unix send type=dgram, - unix (receive) type=dgram addr=none peer=(label=systemd-timesyncd, addr=none), - unix (send, receive, connect) type=stream addr=none peer=(label=plymouthd, addr=@/org/freedesktop/plymouthd), + unix receive type=dgram peer=(label=systemd-timesyncd), + unix (send, receive, connect) type=stream peer=(label=plymouthd, addr=@/org/freedesktop/plymouthd), #aa:dbus own bus=system name=org.freedesktop.systemd1 @@ -151,6 +154,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{lib}/** Px, /etc/cron.*/* Px, /etc/init.d/* Px, + /etc/update-motd.d/* Px, /usr/share/*/** Px, # Systemd internal service started and config handler (sandboxing, namespacing, cgroup, etc.) @@ -192,6 +196,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{etc_ro}/environment r, @{etc_ro}/environment.d/{,**} r, + /etc/acpi/events/{,**} r, /etc/binfmt.d/{,**} r, /etc/conf.d/{,**} r, /etc/credstore.encrypted/{,**} r, @@ -203,12 +208,16 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { /etc/systemd/{,**} r, /etc/udev/hwdb.d/{,**} r, + /var/log/dmesg rw, /var/lib/systemd/{,**} rw, owner /var/tmp/systemd-private-*/{,**} rw, /tmp/namespace-dev-@{rand6}/{,**} rw, /tmp/systemd-private-*/{,**} rw, + @{att}/@{run}/systemd/journal/socket r, + @{att}/@{run}/systemd/journal/dev-log r, + @{run}/ rw, @{run}/*.socket w, @{run}/*/ rw, @@ -274,6 +283,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/oom_score_adj rw, /dev/autofs r, + /dev/input/ r, /dev/kmsg w, /dev/tty@{int} rw, owner /dev/console rwk, diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index 401e73bd9..e3ae3acb4 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -136,18 +136,24 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pids}/fd/ r, owner @{PROC}/@{pids}/oom_score_adj rw, + /dev/kmsg w, /dev/tty rw, deny capability bpf, + deny capability dac_override, + deny capability dac_read_search, deny capability mknod, deny capability net_admin, deny capability perfmon, + deny capability sys_admin, deny capability sys_resource, profile systemctl { include include + deny capability net_admin, + include if exists include if exists } From f8340aa6605e4bb22e75e71257f4e296e51b7fd4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Mar 2025 23:14:53 +0100 Subject: [PATCH 0636/1455] feat(fsp): add mapping abstractions for use with pam_apparmor. --- apparmor.d/abstractions/mapping/login | 41 +++++++++++++++++++ apparmor.d/abstractions/mapping/shadow | 11 ++++++ apparmor.d/abstractions/mapping/sshd | 55 ++++++++++++++++++++++++++ apparmor.d/abstractions/mapping/sudo | 20 ++++++++++ 4 files changed, 127 insertions(+) create mode 100644 apparmor.d/abstractions/mapping/login create mode 100644 apparmor.d/abstractions/mapping/shadow create mode 100644 apparmor.d/abstractions/mapping/sshd create mode 100644 apparmor.d/abstractions/mapping/sudo diff --git a/apparmor.d/abstractions/mapping/login b/apparmor.d/abstractions/mapping/login new file mode 100644 index 000000000..54a8c1c7f --- /dev/null +++ b/apparmor.d/abstractions/mapping/login @@ -0,0 +1,41 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Minimal set of rules for login based hat mapping. + + abi , + + include + include + include + include + + capability audit_write, + capability chown, + capability fowner, + capability setgid, + capability setuid, + capability fsetid, + + deny capability net_admin, + + network netlink raw, + + dbus send bus=system path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager + member=ReleaseSession + peer=(name=org.freedesktop.login1, label=systemd-logind), + + @{etc_ro}/security/group.conf r, + @{etc_ro}/security/limits.conf r, + @{etc_ro}/security/limits.d/{,*} r, + @{etc_ro}/security/pam_env.conf r, + + @{etc_ro}/login.defs r, + @{etc_ro}/login.defs.d/{,*} r, + @{etc_ro}/security/capability.conf r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/mapping/shadow b/apparmor.d/abstractions/mapping/shadow new file mode 100644 index 000000000..5bf542c17 --- /dev/null +++ b/apparmor.d/abstractions/mapping/shadow @@ -0,0 +1,11 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Minimal set of rules for shadow based hat mapping. + + abi , + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/mapping/sshd b/apparmor.d/abstractions/mapping/sshd new file mode 100644 index 000000000..d9cf57761 --- /dev/null +++ b/apparmor.d/abstractions/mapping/sshd @@ -0,0 +1,55 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Minimal set of rules for sshd based hat mapping. Similar to sshd-session + + abi , + + include + include + include + include + include + + capability audit_write, + capability chown, + capability dac_read_search, + capability kill, + capability setgid, + capability setuid, + capability sys_resource, + + # sshd doesn't require net_admin. libpam-systemd tries to + # use it if available to set the send/receive buffers size, + # but will fall back to a non-privileged version if it fails. + deny capability net_admin, + + network inet6 stream, + network netlink raw, + network netlink raw, + + signal receive set=exists peer=systemd-journald, + signal receive set=hup peer=@{p_systemd}, + + unix bind type=stream addr=@@{udbus}/bus/sshd/system, + + dbus send bus=system path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager + member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} + peer=(name=org.freedesktop.login1, label=systemd-logind), + + /etc/motd r, + /etc/locale.conf r, + + @{run}/motd.dynamic rw, + @{run}/motd.dynamic.new rw, + + @{PROC}/1/limits r, + + /dev/ptmx rw, + /dev/pts/@{int} k, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/mapping/sudo b/apparmor.d/abstractions/mapping/sudo new file mode 100644 index 000000000..3347a91af --- /dev/null +++ b/apparmor.d/abstractions/mapping/sudo @@ -0,0 +1,20 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Minimal set of rules for su/sudo based hat mapping. + + abi , + + capability audit_write, + capability setgid, + capability setuid, + + network netlink raw, + + @{etc_ro}/login.defs r, + /etc/passwd r, + + include if exists + +# vim:syntax=apparmor From d93db0eca92f7255040ab7ecdd88ef82c7a1610c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Mar 2025 23:43:39 +0100 Subject: [PATCH 0637/1455] feat(profile): add motd. --- apparmor.d/profiles-m-r/motd | 58 ++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 apparmor.d/profiles-m-r/motd diff --git a/apparmor.d/profiles-m-r/motd b/apparmor.d/profiles-m-r/motd new file mode 100644 index 000000000..414512c89 --- /dev/null +++ b/apparmor.d/profiles-m-r/motd @@ -0,0 +1,58 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/update-motd.d/* +profile motd @{exec_path} { + include + include + + network inet dgram, + network inet6 dgram, + network netlink raw, + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/{e,}grep rix, + @{bin}/cat rix, + @{bin}/cut rix, + @{bin}/find rix, + @{bin}/head rix, + @{bin}/hostname rPx, + @{bin}/id rix, + @{bin}/snap rPx, + @{bin}/sort rix, + @{bin}/tr rix, + @{bin}/uname rPx, + + @{lib}/ubuntu-release-upgrader/release-upgrade-motd rPx, + @{lib}/update-notifier/update-motd-fsck-at-reboot rPx, + @{lib}/update-notifier/update-motd-reboot-required rix, + /usr/share/unattended-upgrades/update-motd-unattended-upgrades rix, + /usr/share/update-notifier/notify-updates-outdated rPx, + + / r, + /etc/default/motd-news r, + /etc/lsb-release r, + /etc/update-motd.d/* r, + + /var/cache/motd-news rw, + /var/lib/update-notifier/updates-available r, + /var/lib/ubuntu-advantage/messages/motd-esm-announce r, + + @{run}/motd.d/{,*} r, + @{run}/motd.dynamic.new rw, + + @{PROC}/@{pids}/mounts r, + + /dev/tty@{int} rw, + + include if exists +} + +# vim:syntax=apparmor From 20699b20b609a033fe683a2d38509df128d32f9a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 9 Mar 2025 23:58:18 +0100 Subject: [PATCH 0638/1455] fix: minor build issue. --- apparmor.d/groups/_full/systemd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index c56a0936a..a2f5fbd87 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -70,7 +70,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { mount fstype=debugfs options=(rw nodev noexec nosuid) debugfs -> @{sys}/kernel/debug/, mount fstype=fusectl options=(rw nodev noexec nosuid) fusectl -> @{sys}/fs/fuse/connections/, mount fstype=hugetlbfs options=(rw nosuid nodev) hugetlbfs -> /dev/hugepages/, - mount fstype=mqueue options=(rw nodev noexec nosuid) mqueue -> /dev/mqueue/, + mount fstype=mqueue options=(rw nodev noexec nosuid) -> /dev/mqueue/, mount fstype=proc options=(rw nosuid nodev noexec) proc -> @{run}/systemd/namespace-@{rand6}/, mount fstype=sysfs options=(rw nosuid nodev noexec) sysfs -> @{run}/systemd/namespace-@{rand6}/, mount fstype=tmpfs tmpfs -> /dev/shm/, From 404b3d0ce2d2bdfd856db54f0c71bdc98a0bd29e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 10 Mar 2025 00:03:30 +0100 Subject: [PATCH 0639/1455] ci(github): drop FSP tests in ubtuntu 22.04 --- .github/workflows/main.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c97229256..584b0b75a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -18,12 +18,13 @@ jobs: needs: check strategy: matrix: - os: - - ubuntu-24.04 - - ubuntu-22.04 - mode: - - default - - full-system-policy + include: + - os: ubuntu-24.04 + mode: default + - os: ubuntu-24.04 + mode: full-system-policy + - os: ubuntu-22.04 + mode: default steps: - name: Check out repository code uses: actions/checkout@v4 From f79f22c06aea2b8cb769d514d5e3cde71ff764b2 Mon Sep 17 00:00:00 2001 From: Yifan Zhu Date: Sun, 9 Mar 2025 21:01:45 -0700 Subject: [PATCH 0640/1455] docs: fix typo --- docs/configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration.md b/docs/configuration.md index c3017c28d..dda450a85 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -189,7 +189,7 @@ Common mount points are defined in the `@{MOUNTS}` variable. If you mount a disk If you mount a disk on `/ssd/`, add the following to `/etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d.d/local`: ```sh -@{MOUNT}+=/ssd/ +@{MOUNTS}+=/ssd/ ``` nOmHc!RJ3FmglyY2dy>^F?u5n@ss1ezyB@ z^>D|_XgyzQUaqDu*j?Cu&kI~UpS}I@(~OOqJG3R1GatBdd&P>}O}teVdN&(q*wwyu z^?PEIBzyeI=VxvwckDSHx6+%zdg-+_S5M@cK9VtcX+DQHzV=qHmA&!#!)Jb1T4$^) z*!((WPKq*D+ntsC7N9BlQ%_F3Ue7Nv^S*b`(&_52t$uF&R`=m|SKOCHV);gHo72vR zy`G}^a=-XzQ{~-jH*S~YW8b;`XTf3P!{Pf+Np^K}ymu|xeRTW&#b4EPtnU0MvHtkL zzDVx*PT88A-Z^LM1@C|INj6w~PE}b`ZE<UuWbld5vXV^ zDoX30v*bY7AJO+qb$zlm+%^_h9nLM@AM^ZP+M2ZRNxQ0dZB00?9oK&MLn6<`PuF@P zjvId6_p?nrF?>>)YLv+IlRr2MpZGVbeO5nl8J6|rz_H~FFBOwwprWr zoa*!UUXvD0l$`@wEAZ4VbMD119;j zPFJ72WUKz(bB;4oUg)~tn7ZWt{t3J9uFcq--NmyzamJ>7+xD!vAz=08gw)PC&!Y-^ zlck1Fdd^IFmR_L-+Q~Oz=6w13&`T?yIKAKut*YJhuHXKm^zLs(3TlE?%TrqKb+*NN zT75WlqO?3)7c_Ep{d{TV|AmR?uO9AKTfgd=_l;i5%;o4A5MZN zeGio%@I2Wvd)I;1(wA)JwKuyzbmdR%*?M+P%9DLFe!KqGw&`v>z#Vep-QC@f-EK|# z=OB7-&$l1m>x)1hS-$Mv3A35t)brCiZtcqr(slbSbl02z+H~t~R(tHpmuC~Y*n;c5 z>)&>4nEj{6n>G5ek<{%@ligl=?$fw-Z#tF(in%%I1_Bk0Tt$L^&1#jx6+h(N{=be- zCi}UAkJ6WOb1aQztJH-6+1@lY;97P8{F4r}xGuxymn%CA(ic-zc4A z#-=-!cXyYD(2Xl)lR91Mj~k0~>~Uyi4cwmhBWQD2(Y8hVUu`}2a-aIVrw&sTzW8P4 z&JDQn_T9^if99^g>Ux9s;-|3q_~V9O^X|Uzy)kvk-)*jQ%~loYtt+0?EfKl%O3=Q; ziQ(sX;+I*A7R-(Lb^fI3**SAg-q70<5Uo#lR>J&OdD+=uLbz1`g2 zd*(x^!m10O_H9XR?<*v9!!wVUqh*6i(g zxWM3s9`_25QP3OfW7k@~f z`f$Cce({9QHX+w6r&j8Aohf!Usxq`owUB$BQI_hqFIYEx^XeW@YkBs+X5LHj&qXXN zGCp(1l(MtLE$|Y3xa*7j=a_Gs=P+e|y+6OE@3Fzl!!xp~mT&3%5m9#H#Fe|37gt)x zYrndbzN|wdyNm1jPy6ZL-=?j*VAm_Q{U2-Gb%ocTzLm;cKe;wv<@18mHs(2fkHzP$ zK52X)MJ8W3FCSVcNIv&|wlh)X?>*O&17_hSZ=_nM3zWglh8EZCJ7fCfs{ye&PzuN0LQkK03HL7nNY5TFIt1b4VXQOX>tmiqcD*N+63LluR zRuxwLz4?9a7W=T_+)ju zYc5)`DH{A^3Q(^g8M-oZKkMu zMb>{_{9U>F>rcTl)t4(>X6GC|ocBYnBjtwau{k-vOMWria5o;{u6T5yjko#Si;IH# zVP=6-Yk&Il+pKaCC2hr+e#bm2>Oeg87g7rfrW&l0AO)_cOQkhu*bsi+q1; z8K_!or>nK7uN6B$Uc(fV2L}Re75V))|9r%jl6C8ks*%ledSqySI@RoQ2ll= zxIcT>oG70q3lFVR;l1=}+S!T6uk}Rj-#sfad{W)y8DSqcyuLKOg8Oiu%7(Mw)>l4b zY!v@+rZN1wyor&rSo+$q)4#X(+brF8gCU$x@8a6co4vWs@+VBZa!tgu{hk}gZpHP{ z_oQssC%rv>b@$WK{6p&|Zc#OKZEs$7sx5Zrm5_x7Z=_roz1y0+KF{KWHaEwfhW4J` ze??F3uQs0k{qcFb>-Otv+n9rt-rN6-C`xU+l3kMaBDV$7nl4Uu=iR=?T`pRAy5Zjy zw-U<(-27FSh1tE?^(3|B@CI$=n-2dE81r-NX;{v;@8gv!Px;=6AdQJDyo4%V+`Rwl z?_qaKjmcLk7kPi)o+DwnXOhWU%|&X-pX8WC3ul-d<4UX4fA{*6`%NeDt{HFaRBLi8 z6-ub>wimnZhJbbWy6wN6P!3x8#i#P+`PcYA~bCm zW7&B*v2WY|&Uw21>DH%z>UPgr+AfwQ#Iqzo$fNN{*_@UM8f8|T0v@H)Q%;xNNsZoS z`uWcFpUG)YCYnrg%Y8QSOXdDJznqsdXS(~(ejl@I{_DKeH{M;#x1YNG%f-IrrM1~p ze_v*Md;8PB?pObhe%iQD>-Ww-Tcba1-glz7H{VLHd6UrcJxOaVnefkqZ~=-sjpseZ|bAKOt7{runaW)m)GGdrq@nJ)R!B z_Qkn4$@b-W7EyQK%IkMey{8s@^?mP>X{XlpD!uUwOWht6W^LwkRO|h*u2=6;Ldw<} z-RujvIdw^T@`dwU#eMr$M8|8q+nzRcYOHnC#;>c`Z#SIE+rKAz)$^*TS(EPm66?Hl z-Q8vZBa{Ax2S;Atjh|fOzW;T7^RZ8M`|_Ieb}a6lYvdNaJ@@*@@9SmET(&)%RJX8v zSKHlBp97xC?oUc@+ja)jn=4FQ$MuzO_cJcTZ``{l*=GCN#y8p3wwA?+Oyt!_wnW@5? zX~!Hxbc9l-=VoPFpSjA;5|_aB;@wvL8EfKCZE;FowTGQw_L}&*eSLF{ypFzlw{}(P zfh{Mm&f-4RYmmNy_jB#~igmZ12~KO9<6W`hxztlD-mf+xmB-gD&)!^ix4vAnM(*yu zxO?Yn*X~Smy|CuYWgTWg978I3DJcV&On-Jj(>MS4+` z)m81?Q~Q<}PX3*v6;f#)S3Y%5lF$DSQ)5@}l2==`N!!z0JnHKj^{@Q94X2*@eSNjA z&fU*1=KkLCtKk5*&(h}IN9~?(YM#2)P}_7yzRT}r|BHW`-m2fwE*spu`0Cw@l3HK< zmT!m->)2TGyteG$k$KHC*L|9{dUqt}?%B4>tv_vkl2^3)Pp#v|XE8hn)cPky$Mf#| z|6cUhHRToYYj0{<_f3hOSb6_;U1it1ebJ%Et24t9Jzp%dJ3dQlVtE-=Fe!zS?v~E_}Aus@=VOyY()c{;c$B zU-2eN^G#pK&8r^S<4`x2>PPz4(5>-7bcRRQrgh zc5+{SEI!^Adh`6%Z_i_2>a5j%@=C7k?A}G$y;Fl6EGC#dwL53c#{c`ERK)a7@zzrWP$?VlwZeDqpTX?c^3?7f7`dT+kfmYvR+S{~na?9;cB z+-vLDZy5=e-EG=eoU)G3TlDiM&!8!hnP%HwO!|8E>$UoScG~?PboZBKTCRR$5wt2I zdd-YWJ4)_q|1Z=2V*7qw^UitxgbW7<7}S4emeKRx>hZp z^qj{a@ao-0#Uj6=5~)WoMaooH?b({Kf7^}n?H3cTpD9V-=jva*?%&kdn->@IEIqX@ z#)y0V?TgpS8dmdj>^Wd!@crhr^)n)?|4$GWy;O7f+DqZ^n6@K>sLHfow`8OB$*Qc($)D!mN)!UWQ>n3}J?l}2F*>m&c1xK`Q{rg=IZ2RNG`Sh)O zpSkE7&nY_Iw&tYM)a`$7t)4QiE<51f{Y?ii_pCT&r}_TzzJsjy{@++3(`!+{gPit!NZJ3#Ke_49n-i(iu@28g3?EgOL z#iu2P%MVRUFJGlO{qpMgnrA)t%%ivGhDTI&o>4d7Hgn0d1h2goK1DB2`AO5*`-r~q^|NIlLznA1*`?Yj>n9AK>p=G%T4sNoscjrIyY*%~iPHmA( zmuB4U+93VrV_)d@f2!|!W@xVXkfc^P`R~>kX0KHn^PRffempC+zj(Oc-gI&KnUtQp zvVPe@Q@G7?53M^>a>RCa?lY-~r@8yzWmV2Hvw4%()0wAvW?lV_sa^XIa&3&iF;!&t zo&RyCp6IiImdnLS-*=&YJb+# z*geXiQZ2dDyf)`SipWvDf4#dKb8oM^`|JC9-KoFNXz#ePdzZDr7cZh$+7AA&ITK6*dYM8&2K-p4(&qpsFo0@pN#K7ce{iC@I#_#sd_idP& z_I=s%UE+FmiJPB1|6bp(={q^4_ovK_jitMvotwEhd`{)9o}1!drFL7-S(eaM#2YR% zmn(7mrml%sH}2W|+63%{Yw>|HyKkS^P+fm((QNKwDWS5n!6zRd*swa`*OO!0rf&b> z*D$kPEkyXnpM2baNnQ5@~=0hUpqVF?}Zbu@|IfGPQABM7L;!$ zU8&10e3Peq_#Gerue$tf=R@mMG?z6WT6gE#`J0yCi}x@$9N<19(r-7*{CmC3m(uTT z-=67;1pR$HUGMU{cYiO}iHjV6w=N(oZ~d&vGiEjYsy& z>{#}12|NF_RGobP@a1K9>!+Vt#Ae2|S?l+bJ^g$CnA%%?j(qw(x8rYS=r`{vuejQHx?Qxn6Nsa!ms;mpRQZ*Vv#BYN8%-8B+2RnoV&Cf@Fg{q|%;`<2|d`>a#%tbV}4FEU?wcI$OsR_&JoJC}zjdkQ#Yd0(xV4HK z$5r3<-=DXsn!R?hjcht|?W5@HFHU})z3l3@d%JRX_wE0F?acb;Z&X&SJk>sTr9fGK z+r2lr*S}nN5>i>c%c{G!Tw0{8f5*$!KUuBb^m6PDTJc6TPO@z3np;=4{V7`aMd1U} z1lRu^cdFR#{ZGzx?An<4JxJE>&g%X9pS-?xd2jrwCpJ-w|9`&1Yd_^uiPxI9Yg9DS z-SY#3c>7o8O0Le8&8b;`U3#W`)TI?`Pa2S!-Do{>GiT+Z7q9_u1e_ z`^T;guQ&d$`0VJ+;klckur|M^8^l zGuhMQc75Aht9SRN24~GZJ@wwokeh3#9M#IVDeyd#-!qb?I%Z zQ*|lc$`2 z!M;@Y{@fjXyl=0^sV?29nE1W(#u{m^;x5OyusN>}{+cyMGwMInIu%#$rLT%IcXlnx zeZzfHPctOsw|3p-fM2^q_8h#X`z?P)m`u>e+r5eQw&jgNc~Q)#Zr!RmD5+nkvgG68 z=5xIHZ*+1deVJ|gdTYi(o4sGYJoi6&c6aIT&6l=IS+BlTVbXf3Hz!!*&9_jqGgCI6 zy#A!MX;!~|+-C9q{IrA4v2&xouk~jCE4EB7u{_%6%hEqgvJ-nFZoZA~FAOVN8-K&M z+jv#zx~ZOO)=9HUAMUFTD=SQ7_qy(A##j(?T-LreM9wbO)M3i;&t@0W_y2Xi`}st2 zaM5kM(!W>MybGHZyEHZO+TnE}Yd)nF_Iz;(sWcB=`RhxWP`pdBo~c)x(c`i$I~szXayd3RjjweFI{*YokaV$SEhniF)p z2E^seal`yE&R{51#*ekRbuCFd$sY# zodp}B|2>dpZ@sH<`~6wn`b!u5pE5Lx&#*GPR~lR`^+i8)zofMF*9{?W?tHjDe^*F* zzs$)$+vfOPz1z6Z+}!8I*`OP`?rU}2?j2e<&oH!-zqB;#`rq7A{@ve~ZQioUV0B{R z^(3vI4>m++wSVK6Ex)&;QQN}d0c+N^o7?^r8Apei#+X#RO7yHsy6g7${rcK)Ior!; zbCyS!Zl88x_R$U5YNAF}haWt9Uz2?0_|;`yuk!XDdS{$DdEKe=xiL3N^?Ps2%9Ndb zGws{e)BDa&l~(w`w3y$-^WAxs+|^Z|L_YDpJ+JM#{qFY-`zp?Uoq4zJ^449}F)z+$ z-B|ml{MwSmYd*=ndUfU9@7u4W%C=W6S}*oY`~HFr+TSk~tU8z&{waO-^Ygzo!gCTb zwx}|-)c&+Pqi?An2O{`>3F=0>HTzodQ6Mz{F(d+~7nt9N?+ zeSbezNnfV1{_ki1=0odZy54c6&Gg>)TmJvndB5NBU)}O%*V6dQ2Yp|+aqOOIfBQ(w z-M?}rp6{97ep}+07|ylPAmQn$?A*Xj-R6JZEIZE9aDcn#>b-BK*~H0| z*)PuMO;P(UtE~^Cr_1qfo-9*VeHWBff!gp3`a;)?VF|U$m61 z?f3+?1#EBgE3Vpm?%Mw<;n0jzNpZb08n5NP%1@77SzZ5i_L-c`%kzFb+#A!``>P&x7g|JGerM?>D^x-%Kd)o?Ik7q9elh`PjjxTtgPN~ zch~>9+9n1@T6-LHZ{7N1=^a<#p7qe*cb2h6L&cQ#V|=+C7fYWv@4xbX@0X*$=05Jr zeDUnozU1~tqVwk)UcKve)GPn1BSTT=?ocDEa;s zoqp=>>bBU`e}1}g?M`#fyZ!0^dhh3%p;oKo**7F@(EWS-)a%5h8>~N^T$3bg`s&m= z8?7nnLDB&?OE=&346e95Z}+L)KJ1u-@zESp_ z?V|m^&rIK1czRpgy5o=S|2ckKwoh`E>WrerJd?lj><(Ken6_cH`}0fdd47K0`hP{l z-L>vFVg;j1s~0vVhObl6m6>~O&;7R(#GHBLZx%e?#JBDYD9aYSU7a8K@Kb&Wzw}X0 zO{rMp+m~w{>i@3P&pbY_miMGi?CtqiH?Gc~{qgvz45$3Phx6`-8{Js;=EF7JS9NbD zIvx)NH<`-IV-LM!E}WKk;(TVp4P8IIhpWWORKtI~T6Xnx-m@+qfr>`Y%Zcp&9mV9< z%(Ggg!#wrux!m)w^#8s7d~5fAhr98=S4!8dP&r$?;EF_*v}oDVQxg~6+_ckc>h{O( z?(bR7PJpci`2Ef=?MAK6wv5cWxcxh2UrCj%HJLo?_^QO~I)4@^zxkhjP7l;fUbk(V z)1=Es^R{iS`sE>Q_jiNJ+RXcF?En8zy;Z+qdEWY+wa58ncmFEun<(X+uY5S~ez|S+ z_Vu#2cDdf&U$-P*mVfH1-IHa@%q#rvpEw_!lX1gW)qiz(+1au-wd(n|ZgI_t1chCR z^t+gAi5KCo#D?X$JQf<<&E>iC8T$m zFeGnTUwii0PyLF-^*i_Ptcu9|vqWUlmfYugf6MN&?fqK1K2UGwp5VIQeX^e3(>mcqnvL#-pPrrv#Y z=itfxIlIztez%wmI)3i|h24c`YrCiI`QSQfe(2lZif)yYOleU32M?u<=H|kar7yo2|LK`NNdU^EV`juYPrQfnM=R^Rag3QX=Y-QQ~sJ2Uxdoq z>(<7&zL3qnvDak3ga2~hUf$h?r$QvG-bDTItG@lI{^=XgR=_gn_mhOD>wk%SeyYav zt3bf3to&g6FLpIogSO^XOqy$VkNac8L*BoK*IgATQ~z+`M8*xF zLr%6cTQ|J^sd#wZov?D58^7Fd?V9R8k)cui#0KBli*&6XKAScz^8M7G8?TCSzB_v0 z_KDdyw4C05ySw`fd;0#YkcH*H`((ZJ|Jx*&tDiXFrJq>-;yTw-hF9;lw%@IJe0bfR zsXs1EjrDx}_>E=$tGL?dj^{WU4sfU3dzd?$Prmw7=JwsK_R~UN-wAkgarK1W3%}3Y z;$6(Qmp^`INb$;demO6;CcWsr*RUZvctUQ?4c+zb>tq73?zx2<(W!|LqeAZOw{7Ew}>`s0!H~0IiiS6b& zcmJ(gStM!_x61=wU=HOJ2Pa} zmo|fg6Vq}QZeLv7JuhZ^V1C`*>?xh=q}-J1jtudDo#czo5<`ok0XeD)nsV|cY#`Abd6rSolZN?IbHHnFW= z9vyJT^yNNx`OEQtpD!=n@I2uD_igWQEKCl&f9%|v#m@w$NF;8bR%(^fX%`%^gqN3Z zchTgfl`9w7#jC!#ceifC>%%e+LA62Lty^5~-=5sh-4xF&UZwkXYSxU})p85JPw%&1 z-2d;rf7bhd%#)U=*L?w13BNZnE;RQEcro( zd;3=2&7*<5S3c_Y`Z8R(|LC)RRpP5%*G2ke-+j*TDeC3jJLycfv#wu8*RSatqK`{9 zZl73{93tcVYVNwk?b^@2yga1z_G8L{<8CJxPfs&j6MVz>v(&atueTi+w%-2uU8;Y9 z3UjHR)CSImU$=K>o;{cBZ~N9!Ge##k`0LU=5wp2?9mPD^Wp`WA~`C?tp(rSipqGnC!jlLOrZ_mqS>G1o1jQcec1honGrTd)NJbq%&6{XzqazZEc)O1;o-5ZqzEwUFyxvebxGf&rA8T?x}ZA zef_R@DDS8dbJ(VB8?0l@*JT*25OP4arFS}$Nd-&blmol~LbImu*vr4(4`~UKpS8`>lJ8f## zJf8Q|+cF9i5|2yE*HorloMha$~3T1zKa>AL+r6|Lf_&s7qBD(J=Bb&21v zZ3(@veMVZs(4A*@ZRAy_RFS!FHfT@(x4HQ0r}M>AK?~g7ad17bkD5d~|4C=$Z#lTJFBKdLQ}E-a@J|CowBgp?c5fc~9kw zw#)NLi`a-&*QcdOCGGr@l5?$IR4jA)=g3`wvzjzRIwuC}zRBzC{I|JajoFc9o&39* zneuZJx3?woq?woPdw8{8r*osN!!<6Z943X?yZ*m%wx7E{^Ym%oZ-*8#H=lkob7tF( zq$_r+RTrYaB%RJy+*>7GoG2gga&A`Q_mwvmofi|!eBZEr1t;(B+WM^z53gH&%y4(q z#YFb|%U7>k6fQr((MOjj<>t@l&;9z=n$LPU_pt7>w62Ak#+L<7FNu8iD}LwRs-0gq z$xExq?_FkjbCXC}`10Z}b1nQUx1Z$Sy|i9@`e(!T*y(HE*lhU9|MkVx52EU0bdc@0}d|F#|u3^aqoi^Xd#r~O-bxvGb(d5IwWV7k{MR5-6?;VSIa8{%? zt0i`NNwHP`Uaou+6-8 zI{!`X+5KUcKDToViJdmyl$u=8Jp0S*8;j&v_g?wbtLGqGWh_UoTj2 zt7C(5^T=_z!FKMc8%8twd)e5@zrp(l1DVIU@cWXT>wg69 zGp*mYIggyJ#By>8O7Ro^QXwLi+)Ya(;8CM`8P;>B5~8?`FuE{St4(#<30hYF|J*rw?^km1-s&4qW4b(pGh_0Z^-Vh{E&3OJ*>0}riw74tSicu;&6o4P(VMr+^4wK_u3|6WubTwQVim>M))#NRmTY_b z-dWzP16Q0|#b>=i>Kn+jv5&J{#SYPuEVrG_&zdK>p*EU;5PF z$OT?Ved+YqX0B?g)|+Rh84HdtIJGYC-J6@=;=ub_0-j&ky}tG=FSnm@#4FBdE8zL=(=w)5D!Hw}h+Cv7dy@}B0jgizX4XljXRc@8t0NPb zF#VeTmubvP`|aQ4eVt<$ZV~2xG)+@Ear=!`>jR=DCmvpR`s>GYSGE7OE(RSecVfjm z-|Y9%8-9FwJ1JIycdn%GBq>|%=&2X9J*D@0`d4p`OLV_-Xve)@t@paT-bWmM*ZeZ4 zc4I-$H;t1%H>U1(ikfhfBk{WE;zP%+!u9{#xPuOEoKX1t)^$6p`je8`Ic!ft!uyi z!?VBA>K1>O{rR^RKX(29zpC?HSLi*HAkWj6D|cz0 z3;Z%+?S|RQmM*k9+#c&0Yk2GS_B*@(7=AMW6&t)Z|L1i3X|n9U`&3`X@QaqlvrUp! z>9b$|_x$$C^dX1!)^iKD@3AhcTy&bN`%BMrHkVs$?XgpD^;ND>d~@rTLUs1#;|TRl84D?!zxuPyXYP zRx1{4cG6#a`qd`uzIQF|$=&-V$SqzwFXZQf5|fIk`xCGH-~E_>_ce3VQo}dX*#GXD zwB<^2dCP{^mz-zWKIffV{x?Ot8dTWNNaM@DUGn3{^f})SJFVY)$S0j={}%IY&4&fd zH%(ouzg4e#F3hiT@HIg`==dijSXJ;c1F#UQ|oT#p4z^zw)pnf z-#1r-(uB#@>btwP>`s1L`q|I+?@qP7RX5J847zPJ(`);#bgeJ%zPNnP6?p#a@ONZd-Nt*tH8AUT3a6zAlSn_pVK!dDs7R`2KzW$v;;?#`x!7uXOW`+MQ-BDMvG{*mps}gYc}61c`_-_JNoO^KTdDI#e6%I z=OcQ`d^xXtS*+Z?J3F(E-e0x0Hy(V^nz3j3?^{v`L6 zZcP3%`^KWv+@H6ech)?Truk;qq#5!eIjdV^Cx1J7#eT=neN(l;fyq$vs`7nB;FSAX znT5L3`(`|OBFVdVQc0b~68n>Huj{PZYig}?ng7%0lIiF5mY&IJjs3hrfZMb+c6#ZF z%iU({_q{cL6A3DsYvVrLzgJuH{-N^er&hbCJ?&n&{h#vUGmD+9KGnJ(k6g9?s>xzwG-Ij{EO@_CP|*4{8ZWW%>R zqQB`~Z}F2!=eESzJq({Xy`(mA-Lz%gB@T+!iPuAUc0bKiRBnl#9(H8jlee?w_f+y% zi#zQ1W?|sjV>YMe9P9iEH}_vJnY&?u$&*)g#?fo1#(7%lKKW{XGEUb2_a-~pd6%F5 zWWBXyS&@D-Putx+YwoiMJGaG7KQ!GsT>t;_g>hU5&bYRUJA~eqef@4$`76ouv)Oj@xX_C@f;?G!Vl;6B7-#35B(Aqoc%dY~D`bj0(?|9}c z%uUX@bm-CMAr56x><}2$>owmCwx+3k5t_hUICLW#mPKHzkTb1?*SkOXl3WwriJ#|nH0Vw=U-FYN*o|MfEY)`2=KXi>Y=1ZRC&xa_ z`vz}fx6`L}=e9-5J$wVI9Rv1X_`R&$Zu@tSs^*#VgI}vIpBF6DZ~DdS(&J#rY+S&v-(Yxq_s5ydzvtIK`Yu*+I_6~k{%QOdYd3Gcs{EyIk^g&#+qTQA zAIWSzu~p@XsL>wzYZaUK#Y8N*`Z7m!lU!M{qoVE=sj|DxvD;L??AiZ&-RJ9v9b7xOpdPTDkGj3n9}L`5v$Q;&n-L+V%Fyd2`t9$sTZ?(c3*pZ@L$^LRifd=WuPcJ;rGJ!d#?Uub@P*dShvPC zC3(EMbTo0#!s{w?C(B%7pZs^$`eXO5O!L~MK6ml!%R6tazvP=K$+vr%hBx=okGo7; zV$HYiPTRjc`>XH%Cu=~%WfLs9;|u>Cs{EW5|9sQ-Yrkexl@?0mznI!(zICs;P=g+?7_5UWv&hZ7sx>0Se z<;y$eF-qU-S8R=6pW;>QJGm}$R>uYHP`=_9YfrP?ecV|m^Zez#l5ZCm%zU^ZTWgz4 zab<4ebLC zSb}r#=by^vUjJ6zTJPg%m^tf;(S4WJxRn;cx2q>HR|Q*GBp#Mov?R2!FVE+B=KBLm zm2HRfI#!;!JnQhflzy}GUiUUXJeMjvM;GMNW$VKCu6p^z^8D{L)qf(^I?KeU&3`g) zudrm5>PrjnujdLJp5IoS*=xJbUM{*Mcg}LY{8if$H%XQ))~@*X;&h)(+1<12?rqxr zRsZXeuY2dHfQ@XOe189jq@^FZri)$qC9!>p#gW8Gc^R``T+sIP)>+>@IdAU~x9N|q zY?sR~`}}pscAl@A3e}0%W1p>b+PS~TH}N`ORY(2q)T_B$WI(ybfYSY>sHxkIt-u^O?ghqz1#LF@9xXo6=**>dtvS-r}ZIoj{n_L;PKv@ zPowa9QT|og!oI57mifxriQ!spvEMJY++~(~^L}^O+CO^kwxAP?C7)mUtQR#&>+i%n z=jF~W)oz<(dHH=-ve}~-|uOSEe`K!-FGyLbGO>>UhO^gr}u7O_b`L~ zf(GYo1_$N0+3}mVSD)+**X!`@^jSao`n976ZBE_s?)HC@UOxFuN?{RGzN6Wn53M|H zv6Hns1I4&&`{ga)MDcj(-Mv%t;_vV9zd7vgRt;{84sk0O`_=rlzL)Uq{^UPLF2)>t zq_RbS_8YJFS2%YED*FDmty{7o`{1_7Rs7|41-IYITxHm#uz`~y<><8EVR!D{z4gmz z`dSHJE1t}KH=@p{>&@9EYVCYwuik`-8=}{|64P?3&rLL+@h)ek@$aWCu?&$;t>O-9 za|`ZS|I=LZQP}9L)LB*CHW$0bVBzaqFU_91LAtxP^!L(R6A!Jst!R4l|Nhjgr}T@y zfI2n~z4OZNS;vVa{i>b3x2Pn1ThRS`oV$)(RsE8t@Mc!bv}K#>?l!pd?M|zT@%*&# z?CQL~y6(CSI**o_GR!PpQ2X}W-}8|LPn(uqQ@H#(MG{0XGQl))p-PGmm>lEKiyR;`H`Nq~y#XLN_-*II+rZwk>Yqvjsm3V!Z z5P$u(%KxXVEvy(*WJTi`f}P5b@A_uhJ*~!iOUrZ5D%Z90H+qdxQ6+Kfm~!v$y4AeyX^uHLPsl(r?gw{=~lGHhZ#SP3*JdJ?|zi-MIJh zoTa%=T6=kUc2Ck43G&RGD*3vNdw1gYNl)^3hppeyw^-mnh*PWhfhm{o?tAy~xt`tI zQ+rA_d8YTOrOsNulqWNJ{=AAkQ}4O8#+J{#6cm5gV%3K1H0{~5CvPuXx9h88p94cM zFUaAyIG@K>Y^?lMy0cIE?bG}{x@V4syvz-_p?l6}y4S_-)7PcSM88G&{oj!KH8;F) z3#f8%Xr5E`u6kbhhr{4>R;z^E#7^wq@n}F5J$TXnrIqbo>2JTU%ne?@s!+ z_VvHp`%VV3HXPt)kSzWbeXp`fUaRK#(|qZ_q8CNhddj)gXUdp;xn}uh)@~=AzRO=1 zb6*iDYi_N6G-sLp+g-(x?C!##TTfCff6V*5jei-}^jUv?T(rC9om}m19UOi2LiF(s z*Ma{vz^&M+9-~1B$xn}?Cs)U>VmR<}# z=^+)2KGk<+UtbeX&-6|^S+Z?OpzqGGoR?3R&b*biLU@YyUc+hA=Cy2)j_njrF??Hn za@OH>ky_Wk^Bup_dfslwBf~xchRdJ?X?)5vf6oWgSH1TOe?}%(?rC>1e3Hd?O7X1x z*)75XWvZT;As?Lf*Tfdz=-qZLrGDejgST&4NHLrd38`Q_qj6XIdd|zbbAR&nGiJ@6 zb@S$=S?-~#1>r);hO_%j&K&gFuF%1si@XMBx#HUDPNjjxUG z;@8|eFp(iaZQ&vAgqiXyS{WEvzI(bjh8(kcIH%h$uw!~u&wIJs#wUh}g*q*POcwHxFn(F@@PxnRFpNV5Lm~6O&@j%b^{l$N8 zJ&rHB^|Uo^rssb9TiJ_OK00Q`ef9Q?sd*{fPqp3_Bwkas|JO~g6h*Z6UEOy#{N>dJ8?xipyqIb{(bqu|3$z5mfM`W2fk^Z=Vi-hy*)Sfd|=(_C-wTNX`2hz$p;T! z1%{oF=iU8|OVoHtujZRsxzk(y%kGx{zJ9Zs;ex!g6vKk9zi+eWRpfnsd0*$u*28MQ zZGXPlW$CeWTgt|ewYp{pY@@O_ERm?O)$+U?bVHXlN_tL3JJ)VC>!fKl&U<&?yZQCP ztKT<@83NX_FfvG7<9r@d(iO7f%ANbB*IqB1stm#~pvbpySc5RT>SrZie zd47J})*9VvPEbR^AWwbowm7|BH>$x^HH^ zEo%LL=huVR|CUsLE?@DA$zkpEC^JTeo_mGs>;LW%oBv;*>(`9k+xz}Y#>Q!c@a|TV z{V1^R-Oc-7*8i^Cox~q44{}<7x%!;qi<+MfrK{9Bd@?w9LfiXyX;#OkC+VKSm;a~C z(E~Nc7A*9uxw|_~(fW_-^m_*DF1!vDTkP{t@vN8KwxzjGn{#5p`#IeAW%qoL zoPJK`wyUMh+l&9#zHXdqpPJ1Cx{cnbI@k8&o$Y`5U4Q#e*I)P1FgEXDcXY9Bd}wrZ zqb~;oOB}-tCObJlo9_qhr`}e-`}ate_l}(1XY_7XW&FPW<;CL4ZIU3@B%HE*yM;T7 z?_b~FwVwag`j2}~+WB_!m#>E!zZl=HFFx+LO$egQ`q_8A8TQ)g|L3d7>itkJx8Jg9 k_F5)}Q81)JAfe=+e(#Q2@o23_pFj@xboFyt=akR{01LcOlK=n! literal 0 HcmV?d00001 diff --git a/docs/index.md b/docs/index.md index 39679d01a..5e6c70c56 100644 --- a/docs/index.md +++ b/docs/index.md @@ -1,52 +1,106 @@ --- title: AppArmor.d +hide: + - toc --- - + + -### Presentations - -Building the largest set of AppArmor profiles: - -- [Linux Security Summit North America (LSS-NA 2023)](https://events.linuxfoundation.org/linux-security-summit-north-america/) *([Slide](https://lssna2023.sched.com/event/1K7bI/building-the-largest-working-set-of-apparmor-profiles-alexandre-pujol-the-collaboratory-tudublin), [Video](https://www.youtube.com/watch?v=OzyalrOzxE8))* -- [Ubuntu Summit 2023](https://events.canonical.com/event/31/) *([Slide](https://events.canonical.com/event/31/contributions/209/), [Video](https://www.youtube.com/watch?v=GK1J0TlxnFI))* - -### Chat - -A development chat is available on https://matrix.to/#/#apparmor.d:matrix.org +
+
+
+
+ +

apparmor.d

+

Full set of AppArmor policies

+

apparmor.d is a collection of AppArmor profiles designed to restrict the behavior of Linux applications and processes.

+

Its goal is to confine everything, targeting both desktops and servers across all distributions that support AppArmor.

+ + Get started + + + + Demo Server + + +
+
+
+
diff --git a/docs/install.md b/docs/install.md index ff4a1b6bb..a18185fbf 100644 --- a/docs/install.md +++ b/docs/install.md @@ -89,7 +89,7 @@ echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf !!! warning - **Beware**: do not install a `.deb` made for Debian on Ubuntu, the packages are different. + **Beware**: do not install a `.deb` made for Debian on Ubuntu as the packages are different. If your distribution is based on Ubuntu, you may want to manually set the target distribution by exporting `DISTRIBUTION=ubuntu`. @@ -125,7 +125,7 @@ echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf !!! warning - **Beware**: do not install a `.deb` made for Ubuntu on Debian, the packages are different. + **Beware**: do not install a `.deb` made for Ubuntu on Debian as the packages are different. If your distribution is based on Debian, you may want to manually set the target distribution by exporting `DISTRIBUTION=debian`. diff --git a/docs/overview.md b/docs/overview.md new file mode 100644 index 000000000..fb6712a14 --- /dev/null +++ b/docs/overview.md @@ -0,0 +1,48 @@ +--- +title: Overview +--- + +!!! danger "Help Wanted" + + This project is still in its early development. Help is very welcome; see [Development](development/index.md) + +**AppArmor.d** is a set of over 1500 AppArmor profiles whose aim is to confine most Linux based applications and processes. + +### Purpose + +- Confine all root processes such as all `systemd` tools, `bluetooth`, `dbus`, `polkit`, `NetworkManager`, `OpenVPN`, `GDM`, `rtkit`, `colord` +- Confine all Desktop environments +- Confine all user services such as `Pipewire`, `Gvfsd`, `dbus`, `xdg`, `xwayland` +- Confine some *"special"* user applications: web browsers, file managers, etc +- Should not break a normal usage of the confined software + +See the [Concepts](concepts.md)' page for more detail on the architecture. + +### Goals + +- Target both desktops and servers +- Support for all distributions that support AppArmor: + * [:material-arch: Arch Linux](install.md#archlinux) + * [:material-ubuntu: Ubuntu 24.04/22.04](install.md#ubuntu) + * [:material-debian: Debian 12/13](install.md#debian) + * [:simple-suse: openSUSE Tumbleweed](install.md#opensuse) +- Support for all major desktop environments: + - [x] :material-gnome: Gnome (GDM) + - [x] :simple-kde: KDE (SDDM) + - [ ] :simple-xfce: XFCE (Lightdm) *(work in progress)* +- [Fully tested](development/tests.md) + +### Demo + +You want to try this project, or you are curious about the advanced usage and security it can provide without installing it on your machine. You can try it online on my AppArmor play machine at https://play.pujol.io/ + +### Presentations + +Building the largest set of AppArmor profiles: + +- [Linux Security Summit North America (LSS-NA 2023)](https://events.linuxfoundation.org/linux-security-summit-north-america/) *([Slide](https://lssna2023.sched.com/event/1K7bI/building-the-largest-working-set-of-apparmor-profiles-alexandre-pujol-the-collaboratory-tudublin), [Video](https://www.youtube.com/watch?v=OzyalrOzxE8))* +- [Ubuntu Summit 2023](https://events.canonical.com/event/31/) *([Slide](https://events.canonical.com/event/31/contributions/209/), [Video](https://www.youtube.com/watch?v=GK1J0TlxnFI))* + +### Chat + +A development chat is available on https://matrix.to/#/#apparmor.d:matrix.org diff --git a/mkdocs.yml b/mkdocs.yml index 153af0d4e..12783b566 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -138,6 +138,7 @@ nav: - Home: - index.md - Getting Started: + - overview.md - concepts.md - install.md - configuration.md From daa6a1239b810dbc4458869a59a896dca42296df Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 14:20:08 +0200 Subject: [PATCH 0872/1455] feat(profile): improve protonmail-bridge-core. --- apparmor.d/profiles-m-r/protonmail-bridge-core | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index 92d379724..493199974 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -12,8 +12,9 @@ abi , include @{exec_path} = @{lib}/protonmail/bridge/bridge -profile protonmail-bridge-core @{exec_path} { +profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) { include + include include include @@ -25,7 +26,7 @@ profile protonmail-bridge-core @{exec_path} { @{exec_path} mr, - @{bin}/pass rCx -> pass, + @{bin}/pass Cx -> pass, @{lib}/protonmail/bridge/bridge-gui ix, @@ -49,7 +50,6 @@ profile protonmail-bridge-core @{exec_path} { @{PROC}/1/cgroup r, @{PROC}/sys/net/core/somaxconn r, - deny @{bin}/pass x, deny owner @{user_passwordstore_dirs}/** r, profile pass { @@ -76,6 +76,7 @@ profile protonmail-bridge-core @{exec_path} { owner @{user_passwordstore_dirs}/ r, owner @{user_passwordstore_dirs}/.gpg-id r, + owner @{user_passwordstore_dirs}/docker-credential-helpers/{,**} rw, owner @{user_passwordstore_dirs}/protonmail-credentials/{,**} rw, deny owner @{user_passwordstore_dirs}/**/ r, From a46967cb43e643efc925644b234093f249fdc313 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 14:56:51 +0200 Subject: [PATCH 0873/1455] feat(tunable): add papers to the list of document viewers. --- apparmor.d/tunables/multiarch.d/programs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index 198776f9b..b3e36cae7 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -76,7 +76,7 @@ @{text_editors_names} = code gedit mousepad gnome-text-editor zeditor zedit zed-cli # Document viewers -@{document_viewers_names} = evince okular *{F,f}oliate YACReader +@{document_viewers_names} = evince papers okular *{F,f}oliate YACReader # Image viewers @{image_viewers_names} = eog loupe ristretto From 043dc3fc0589d3c361dd9e4a1cdf543fab8284df Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 15:23:24 +0200 Subject: [PATCH 0874/1455] feat(profile): add paperspecs to cups backend. --- apparmor.d/groups/cups/cups-backend-beh | 1 + apparmor.d/groups/cups/cups-backend-bluetooth | 1 + apparmor.d/groups/cups/cups-backend-brf | 1 + apparmor.d/groups/cups/cups-backend-dnssd | 1 + apparmor.d/groups/cups/cups-backend-hp | 1 + apparmor.d/groups/cups/cups-backend-implicitclass | 1 + apparmor.d/groups/cups/cups-backend-ipp | 1 + apparmor.d/groups/cups/cups-backend-lpd | 1 + apparmor.d/groups/cups/cups-backend-mdns | 1 + apparmor.d/groups/cups/cups-backend-parallel | 1 + apparmor.d/groups/cups/cups-backend-pdf | 6 ++++-- apparmor.d/groups/cups/cups-backend-serial | 1 + apparmor.d/groups/cups/cups-backend-snmp | 1 + apparmor.d/groups/cups/cups-backend-socket | 1 + apparmor.d/groups/cups/cups-backend-usb | 1 + 15 files changed, 18 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/cups/cups-backend-beh b/apparmor.d/groups/cups/cups-backend-beh index e2dbc1b51..1e9fe5b78 100644 --- a/apparmor.d/groups/cups/cups-backend-beh +++ b/apparmor.d/groups/cups/cups-backend-beh @@ -13,6 +13,7 @@ profile cups-backend-beh @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-bluetooth b/apparmor.d/groups/cups/cups-backend-bluetooth index ada4926ce..78ffbac77 100644 --- a/apparmor.d/groups/cups/cups-backend-bluetooth +++ b/apparmor.d/groups/cups/cups-backend-bluetooth @@ -13,6 +13,7 @@ profile cups-backend-bluetooth @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-brf b/apparmor.d/groups/cups/cups-backend-brf index 27e98efc3..6d50b284f 100644 --- a/apparmor.d/groups/cups/cups-backend-brf +++ b/apparmor.d/groups/cups/cups-backend-brf @@ -15,6 +15,7 @@ profile cups-backend-brf @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-dnssd b/apparmor.d/groups/cups/cups-backend-dnssd index f45b99216..1009a0ef2 100644 --- a/apparmor.d/groups/cups/cups-backend-dnssd +++ b/apparmor.d/groups/cups/cups-backend-dnssd @@ -14,6 +14,7 @@ profile cups-backend-dnssd @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-hp b/apparmor.d/groups/cups/cups-backend-hp index 636121553..cd9af3d7f 100644 --- a/apparmor.d/groups/cups/cups-backend-hp +++ b/apparmor.d/groups/cups/cups-backend-hp @@ -13,6 +13,7 @@ profile cups-backend-hp @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-implicitclass b/apparmor.d/groups/cups/cups-backend-implicitclass index ba85c62fa..c71295f83 100644 --- a/apparmor.d/groups/cups/cups-backend-implicitclass +++ b/apparmor.d/groups/cups/cups-backend-implicitclass @@ -13,6 +13,7 @@ profile cups-backend-implicitclass @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-ipp b/apparmor.d/groups/cups/cups-backend-ipp index b473ecaa3..8d61f4072 100644 --- a/apparmor.d/groups/cups/cups-backend-ipp +++ b/apparmor.d/groups/cups/cups-backend-ipp @@ -13,6 +13,7 @@ profile cups-backend-ipp @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-lpd b/apparmor.d/groups/cups/cups-backend-lpd index af2901be0..89b62b569 100644 --- a/apparmor.d/groups/cups/cups-backend-lpd +++ b/apparmor.d/groups/cups/cups-backend-lpd @@ -13,6 +13,7 @@ profile cups-backend-lpd @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-mdns b/apparmor.d/groups/cups/cups-backend-mdns index 0b9cce0da..9e5dfbe0f 100644 --- a/apparmor.d/groups/cups/cups-backend-mdns +++ b/apparmor.d/groups/cups/cups-backend-mdns @@ -13,6 +13,7 @@ profile cups-backend-mdns @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-parallel b/apparmor.d/groups/cups/cups-backend-parallel index a985e5042..b4340b2ed 100644 --- a/apparmor.d/groups/cups/cups-backend-parallel +++ b/apparmor.d/groups/cups/cups-backend-parallel @@ -13,6 +13,7 @@ profile cups-backend-parallel @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-pdf b/apparmor.d/groups/cups/cups-backend-pdf index 7782ecb11..6f658b064 100644 --- a/apparmor.d/groups/cups/cups-backend-pdf +++ b/apparmor.d/groups/cups/cups-backend-pdf @@ -14,9 +14,10 @@ profile cups-backend-pdf @{exec_path} { include capability chown, + capability dac_override, + capability dac_read_search, capability setgid, capability setuid, - capability dac_override, unix peer=(label=cupsd), @@ -30,10 +31,11 @@ profile cups-backend-pdf @{exec_path} { /usr/share/ghostscript/{,**} r, - /etc/papersize r, /etc/cups/ r, /etc/cups/cups-pdf.conf r, /etc/cups/ppd/*.ppd r, + /etc/papersize r, + /etc/paperspecs r, /var/log/cups/cups-pdf*_log w, /var/spool/cups-pdf/{,**} rw, diff --git a/apparmor.d/groups/cups/cups-backend-serial b/apparmor.d/groups/cups/cups-backend-serial index 3959a091d..26811ab59 100644 --- a/apparmor.d/groups/cups/cups-backend-serial +++ b/apparmor.d/groups/cups/cups-backend-serial @@ -13,6 +13,7 @@ profile cups-backend-serial @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, /dev/ttyS@{int} w, diff --git a/apparmor.d/groups/cups/cups-backend-snmp b/apparmor.d/groups/cups/cups-backend-snmp index 5badd529a..816f6c25b 100644 --- a/apparmor.d/groups/cups/cups-backend-snmp +++ b/apparmor.d/groups/cups/cups-backend-snmp @@ -19,6 +19,7 @@ profile cups-backend-snmp @{exec_path} { /etc/cups/snmp.conf r, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-socket b/apparmor.d/groups/cups/cups-backend-socket index 3efcf183b..f8f36a056 100644 --- a/apparmor.d/groups/cups/cups-backend-socket +++ b/apparmor.d/groups/cups/cups-backend-socket @@ -13,6 +13,7 @@ profile cups-backend-socket @{exec_path} { @{exec_path} mr, /etc/papersize r, + /etc/paperspecs r, include if exists } diff --git a/apparmor.d/groups/cups/cups-backend-usb b/apparmor.d/groups/cups/cups-backend-usb index fa21e0204..7d9dbd237 100644 --- a/apparmor.d/groups/cups/cups-backend-usb +++ b/apparmor.d/groups/cups/cups-backend-usb @@ -21,6 +21,7 @@ profile cups-backend-usb @{exec_path} { /etc/cups/ppd/*.ppd r, /etc/papersize r, + /etc/paperspecs r, include if exists } From 00327dfae17112aac14ab572ddb1ed026797465c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 18:38:48 +0200 Subject: [PATCH 0875/1455] feat(profile): minor improvements. --- apparmor.d/groups/apt/apt | 2 +- apparmor.d/groups/apt/apt-systemd-daily | 2 +- apparmor.d/groups/apt/aptitude-create-state-bundle | 2 +- apparmor.d/groups/apt/unattended-upgrade | 7 +++++-- apparmor.d/groups/grub/update-grub | 5 +++-- apparmor.d/profiles-a-f/acpi | 1 - apparmor.d/profiles-a-f/evince | 5 +++-- apparmor.d/profiles-g-l/kmod | 14 +++++++++++++- apparmor.d/profiles-m-r/mkinitramfs | 6 ++++++ apparmor.d/profiles-s-z/spice-vdagent | 2 ++ 10 files changed, 35 insertions(+), 11 deletions(-) diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 5c33a1866..947dba149 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -177,7 +177,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{bin}/ r, @{sh_path} rix, @{pager_path} rmix, - @{bin}/which{,.debianutils} rix, + @{bin}/which rix, /root/ r, # For shell pwd diff --git a/apparmor.d/groups/apt/apt-systemd-daily b/apparmor.d/groups/apt/apt-systemd-daily index 04907876e..08e1400b2 100644 --- a/apparmor.d/groups/apt/apt-systemd-daily +++ b/apparmor.d/groups/apt/apt-systemd-daily @@ -37,7 +37,7 @@ profile apt-systemd-daily @{exec_path} { @{bin}/touch rix, @{bin}/uniq rix, @{bin}/wc rix, - @{bin}/which{,.debianutils} rix, + @{bin}/which rix, @{bin}/xargs rix, @{bin}/apt-config rPx, diff --git a/apparmor.d/groups/apt/aptitude-create-state-bundle b/apparmor.d/groups/apt/aptitude-create-state-bundle index c700e325f..59f7a54f6 100644 --- a/apparmor.d/groups/apt/aptitude-create-state-bundle +++ b/apparmor.d/groups/apt/aptitude-create-state-bundle @@ -16,7 +16,7 @@ profile aptitude-create-state-bundle @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{bin}/which{,.debianutils} rix, + @{bin}/which rix, @{bin}/tar rix, @{bin}/bzip2 rix, @{bin}/gzip rix, diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index 3e60798e9..8413d9975 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -10,13 +10,14 @@ include @{exec_path} = @{bin}/unattended-upgrade profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { include - include include include include include + include include include + include include capability chown, @@ -65,7 +66,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { @{etc_ro}/login.defs r, @{etc_ro}/security/capability.conf r, - /etc/apport/report-ignore/ r, + /etc/apport/report-ignore/{,**} r, /etc/apt/*.list r, /etc/apt/apt.conf.d/{,**} r, /etc/debian_version r, @@ -89,8 +90,10 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /etc/vmware-tools/* r, /var/log/unattended-upgrades/{,**} rw, + /var/crash/*.crash w, /var/lib/apt/periodic/unattended-upgrades-stamp w, + /var/lib/dpkg/info/ r, /var/lib/dpkg/lock rwk, /var/lib/dpkg/lock-frontend rwk, /var/lib/dpkg/updates/ r, diff --git a/apparmor.d/groups/grub/update-grub b/apparmor.d/groups/grub/update-grub index 1996b346b..ff17c160a 100644 --- a/apparmor.d/groups/grub/update-grub +++ b/apparmor.d/groups/grub/update-grub @@ -14,8 +14,9 @@ profile update-grub @{exec_path} { capability dac_read_search, @{exec_path} mr, - @{sh_path} rix, - @{sbin}/grub-mkconfig rPx, + + @{sh_path} rix, + @{sbin}/grub-mkconfig rPx, /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-a-f/acpi b/apparmor.d/profiles-a-f/acpi index 2914180e6..3b42be234 100644 --- a/apparmor.d/profiles-a-f/acpi +++ b/apparmor.d/profiles-a-f/acpi @@ -19,7 +19,6 @@ profile acpi @{exec_path} flags=(complain) { @{sys}/devices/**/power_supply/{,**} r, @{sys}/devices/virtual/thermal/{,**} r, - include if exists } diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index 5ae754138..b7b087309 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -44,13 +44,14 @@ profile evince @{exec_path} { /usr/share/poppler/{,**} r, /usr/share/thumbnailers/{,*} r, - owner @{user_share_dirs}/ r, owner @{user_share_dirs}/gvfs-metadata/{,*} r, owner @{user_config_dirs}/evince/{,*} rw, + owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/*.pdf r, owner @{tmp}/evince-@{int}/{,**} rw, - owner @{tmp}/gtkprint* rw, + owner @{tmp}/gtkprint_@{rand6} rw, + owner @{tmp}/gtkprint@{rand6} rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index 0338e3975..ccc8d6913 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -28,7 +28,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) { @{bin}/basename rix, @{bin}/false rix, @{bin}/id rix, - @{sbin}/sysctl rPx, + @{sbin}/sysctl rCx -> sysctl, @{bin}/true rix, @{lib}/modprobe.d/{,*.conf} r, @@ -74,6 +74,18 @@ profile kmod @{exec_path} flags=(attach_disconnected) { deny @{user_share_dirs}/gvfs-metadata/* r, deny unix (receive) type=stream, + profile sysctl { + include + + @{sbin}/sysctl mr, + + /etc/sysctl.conf r, + /etc/sysctl.d/{,**} r, + /usr/lib/sysctl.d/{,**} r, + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index ad626192c..eaf5645f3 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -96,6 +96,12 @@ profile mkinitramfs @{exec_path} { owner /var/tmp/mkinitramfs-@{rand6} rw, owner /var/tmp/mkinitramfs-*_@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**, + owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, + @{sys}/devices/platform/ r, @{sys}/devices/platform/**/ r, @{sys}/devices/platform/**/modalias r, diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index 9562fec75..c73f5f678 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -47,6 +47,8 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pids}/task/@{tid}/comm rw, + /dev/udmabuf rw, + include if exists } From 2bad07f5ffe85486104bb775df646bb5cc5aad6f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 18:44:59 +0200 Subject: [PATCH 0876/1455] doc: hide the date of revision on the front page. --- docs/index.md | 5 +++++ mkdocs.yml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/index.md b/docs/index.md index 5e6c70c56..9602207d0 100644 --- a/docs/index.md +++ b/docs/index.md @@ -19,6 +19,11 @@ hide: display: none; } + /* Hide the date of revision */ + .md-source-file { + display: none; + } + /* Get started button */ .md-typeset .md-button--primary { color: var(--md-primary-fg-color); diff --git a/mkdocs.yml b/mkdocs.yml index 12783b566..e5244a529 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -15,7 +15,7 @@ repo_url: https://github.com/roddhjav/apparmor.d edit_uri: edit/main/docs/ # Copyright -copyright: Copyright © 2021-2024 Alexandre Pujol +copyright: Copyright © 2021-2025 Alexandre Pujol # Configuration theme: From f9f409716434735336e9de871cad8fcfb329cd4f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:12:24 +0200 Subject: [PATCH 0877/1455] feat(abs): add the path abstraction. --- apparmor.d/abstractions/app-launcher-root | 7 ++----- apparmor.d/abstractions/app-launcher-user | 10 +++------- apparmor.d/abstractions/common/app | 5 +---- apparmor.d/abstractions/path | 23 +++++++++++++++++++++++ apparmor.d/groups/children/child-open-any | 7 +------ 5 files changed, 30 insertions(+), 22 deletions(-) create mode 100644 apparmor.d/abstractions/path diff --git a/apparmor.d/abstractions/app-launcher-root b/apparmor.d/abstractions/app-launcher-root index 0bc7dbeff..7f7e2a673 100644 --- a/apparmor.d/abstractions/app-launcher-root +++ b/apparmor.d/abstractions/app-launcher-root @@ -5,15 +5,12 @@ abi , + include + @{bin}/** PUx, @{sbin}/** PUx, /usr/local/{s,}bin/** PUx, - @{bin}/ r, - / r, - /usr/ r, - /usr/local/{s,}bin/ r, - include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/app-launcher-user b/apparmor.d/abstractions/app-launcher-user index 800de5106..3f35d5882 100644 --- a/apparmor.d/abstractions/app-launcher-user +++ b/apparmor.d/abstractions/app-launcher-user @@ -5,6 +5,8 @@ abi , + include + @{bin}/** PUx, /opt/*/** PUx, /usr/share/** PUx, @@ -18,13 +20,7 @@ @{thunderbird_path} Px, @{offices_path} PUx, - @{bin}/ r, - / r, - /usr/ r, - /usr/local/bin/ r, - - @{user_bin_dirs}/ r, - @{user_bin_dirs}/** PUx, + @{user_bin_dirs}/** PUx, include if exists diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index cc802ef06..0d63b72c8 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -27,6 +27,7 @@ include include include + include include include @@ -39,12 +40,8 @@ /etc/{,**} r, - / r, /.* r, - /*/ r, - @{bin}/ r, @{lib}/ r, - /usr/local/bin/ r, owner /_@{int}_/ w, owner /@{uuid}/ w, owner /var/cache/ldconfig/{,**} rw, diff --git a/apparmor.d/abstractions/path b/apparmor.d/abstractions/path new file mode 100644 index 000000000..dee241b29 --- /dev/null +++ b/apparmor.d/abstractions/path @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Common directories in $PATH, used by launchers and interactive shells. + + abi , + + @{bin}/ r, + @{bin}/*/ r, + @{sbin}/ r, + @{sbin}/*/ r, + + / r, + /usr/ r, + /usr/local/bin/ r, + /usr/local/sbin/ r, + + @{user_bin_dirs}/ r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/children/child-open-any b/apparmor.d/groups/children/child-open-any index 1259d7708..446627e85 100644 --- a/apparmor.d/groups/children/child-open-any +++ b/apparmor.d/groups/children/child-open-any @@ -14,6 +14,7 @@ include profile child-open-any flags=(attach_disconnected,mediate_deleted) { include include + include @{bin}/** PUx, @{lib}/** PUx, @@ -22,12 +23,6 @@ profile child-open-any flags=(attach_disconnected,mediate_deleted) { /usr/local/bin/** PUx, /usr/share/** PUx, - @{bin}/ r, - @{user_bin_dirs}/ r, - / r, - /usr/ r, - /usr/local/bin/ r, - include if exists include if exists } From efba6e164e8dcb99e26856394f924333b302fa60 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:22:00 +0200 Subject: [PATCH 0878/1455] feat(profile): add initial profile for decibels. --- apparmor.d/groups/gnome/decibels | 37 ++++++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 38 insertions(+) create mode 100644 apparmor.d/groups/gnome/decibels diff --git a/apparmor.d/groups/gnome/decibels b/apparmor.d/groups/gnome/decibels new file mode 100644 index 000000000..88d292b07 --- /dev/null +++ b/apparmor.d/groups/gnome/decibels @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/decibels @{bin}/org.gnome.Decibels +profile decibels @{exec_path} { + include + include + include + include + include + + @{exec_path} mr, + + @{bin}/gjs-console rix, + + @{open_path} rPx -> child-open-help, + + /usr/share/org.gnome.Decibels/{,**} r, + + owner @{user_music_dirs}/{,**} r, + owner @{user_pictures_dirs}/{,**} r, + owner @{user_torrents_dirs}/{,**} r, + owner @{user_videos_dirs}/{,**} r, + + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/@{tid}/stat r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index adced30c9..bcebd472d 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -77,6 +77,7 @@ cupsd attach_disconnected,complain ddcutil complain deb-systemd-helper complain deb-systemd-invoke complain +decibels complain dino attach_disconnected,complain discord complain discord-chrome-sandbox complain From 5a448cb39dda25ddf11ce446af10dda253613bc4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:23:35 +0200 Subject: [PATCH 0879/1455] feat(profile): add initial profile for papers. --- apparmor.d/groups/gnome/papers | 51 ++++++++++++++++++++++++++++++++++ dists/flags/main.flags | 2 +- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/groups/gnome/papers diff --git a/apparmor.d/groups/gnome/papers b/apparmor.d/groups/gnome/papers new file mode 100644 index 000000000..ee829d8f3 --- /dev/null +++ b/apparmor.d/groups/gnome/papers @@ -0,0 +1,51 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/papers +profile papers @{exec_path} { + include + include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + + @{exec_path} mr, + + @{open_path} Cx -> open, + + /usr/share/poppler/{,**} r, + + owner @{user_share_dirs}/gvfs-metadata/{,*} r, + + owner @{tmp}/.goutputstream-@{rand6} rw, + owner @{tmp}/gtkprint_@{rand6} rw, + owner @{tmp}/gtkprint@{rand6} rw, + + @{run}/mount/utab r, + + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, + + profile open { + include + include + + @{browsers_path} Px, + @{help_path} Px, + @{bin}/papers Px, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index bcebd472d..70d484953 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -257,7 +257,7 @@ nvidia-persistenced complain ollama attach_disconnected,complain os-prober attach_disconnected,complain pam_kwallet_init complain -pam-tmpdir-helper complain +papers complain passimd attach_disconnected,complain pkla-admin-identities complain pkla-check-authorization complain From 8d374ed8761dfd518e7d4f09e8ec699261d76b56 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:25:27 +0200 Subject: [PATCH 0880/1455] feat(fsp): add tunables for the future systemd executor profiles. --- apparmor.d/tunables/multiarch.d/profiles | 2 ++ pkg/prebuild/prepare/fsp.go | 2 ++ 2 files changed, 4 insertions(+) diff --git a/apparmor.d/tunables/multiarch.d/profiles b/apparmor.d/tunables/multiarch.d/profiles index e966623d4..92ab19fc9 100644 --- a/apparmor.d/tunables/multiarch.d/profiles +++ b/apparmor.d/tunables/multiarch.d/profiles @@ -9,7 +9,9 @@ # Name of the systemd profiles. Can be `unconfined` or `systemd`, `systemd-user` @{p_systemd}=unconfined +@{p_systemd_executor}=unconfined @{p_systemd_user}=unconfined +@{p_systemd_user_executor}=unconfined # Name of the dbus daemon profiles @{p_dbus_accessibility}=dbus-accessibility diff --git a/pkg/prebuild/prepare/fsp.go b/pkg/prebuild/prepare/fsp.go index e46efe0e8..0d4c23076 100644 --- a/pkg/prebuild/prepare/fsp.go +++ b/pkg/prebuild/prepare/fsp.go @@ -40,7 +40,9 @@ func (p FullSystemPolicy) Apply() ([]string, error) { return res, err } out = strings.ReplaceAll(out, "@{p_systemd}=unconfined", "@{p_systemd}=systemd") + out = strings.ReplaceAll(out, "@{p_systemd_executor}=unconfined", "@{p_systemd_executor}=systemd-executor") out = strings.ReplaceAll(out, "@{p_systemd_user}=unconfined", "@{p_systemd_user}=systemd-user") + out = strings.ReplaceAll(out, "@{p_systemd_user_executor}=unconfined", "@{p_systemd_user_executor}=systemd-user-executor") if err := path.WriteFile([]byte(out)); err != nil { return res, err } From dbd0a7d271930f6a85ceda79feab610599b54222 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:25:58 +0200 Subject: [PATCH 0881/1455] feat(tunable): add the efi variable. --- apparmor.d/tunables/multiarch.d/system | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 3f6e0f890..d7834cc8a 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -22,6 +22,8 @@ # Common places for temporary files @{tmp}=/tmp/ /tmp/user/@{uid}/ +# Common places for EFI +@{efi}=/boot/ /efi/ /boot/efi/ # System Variables # ---------------- From 4beb096532ab6c60c376fb4a3acf070e11e2d56b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:29:33 +0200 Subject: [PATCH 0882/1455] feat(abs): expand zsh abs to more default locations - Add support for oh-my-zsh - Add support for gitstatus & p10k - Add more zsh config dirctories. --- apparmor.d/abstractions/zsh | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/zsh b/apparmor.d/abstractions/zsh index a22895c91..ff90849c0 100644 --- a/apparmor.d/abstractions/zsh +++ b/apparmor.d/abstractions/zsh @@ -10,24 +10,40 @@ @{lib}/@{multiarch}/zsh/@{int}/zsh/*.so mr, - /usr/share/zsh/{,**} r, /usr/local/share/zsh/{,**} r, + /usr/share/oh-my-zsh/{,**} r, + /usr/share/zsh/{,**} r, /etc/zsh/* r, - owner @{HOME}/.zshrc r, - owner @{HOME}/.zshenv r, + owner @{HOME}/.zcompdump-* rw, owner @{HOME}/.zsh_history rw, owner @{HOME}/.zsh_history.LOCK rwk, + owner @{HOME}/.zsh_history.new rw, + owner @{HOME}/.zshenv r, + owner @{HOME}/.zshrc r, owner @{HOME}/.oh-my-zsh/{,**} r, owner @{HOME}/.oh-my-zsh/log/update.lock/ w, - owner @{HOME}/.zcompdump-* rw, + owner @{user_cache_dirs}/oh-my-zsh/{,**} r, + owner @{user_cache_dirs}/p10k-@{user}/{,**} rw, + owner @{user_cache_dirs}/p10k-dump-@{user}.zsh{,.*} rw, + owner @{user_cache_dirs}/p10k-instant-prompt-@{user}.zsh{,.*} rw, owner @{user_config_dirs}/zsh/.zcompdump-* rw, owner @{user_config_dirs}/zsh/{,**} r, + owner @{user_share_dirs}/zsh/history rw, + owner @{user_share_dirs}/zsh/history.LOCK rwk, + owner @{user_share_dirs}/zsh/history.new rw, + + owner @{tmp}/gitstatus.POWERLEVEL9K.*.fifo rw, + owner @{tmp}/gitstatus.POWERLEVEL9K.*.lock rwk, + + @{PROC}/version r, + owner @{PROC}/@{pid}/loginuid r, + include if exists # vim:syntax=apparmor From d74a47764665fbdcbfd74ec8d0549b557ab1075e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:33:03 +0200 Subject: [PATCH 0883/1455] feat(tunable): add @{backup_path}. --- apparmor.d/abstractions/app-open | 7 ++----- apparmor.d/tunables/multiarch.d/paths | 3 +++ apparmor.d/tunables/multiarch.d/programs | 3 +++ 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 8c74d1f08..27f0c96fc 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -26,6 +26,7 @@ @{image_viewers_path} PUx, @{offices_path} PUx, @{text_editors_path} PUx, + @{backup_path} PUx, # Others @{bin}/amule Px, @@ -41,6 +42,7 @@ @{bin}/gnome-calculator Px, @{bin}/gnome-disk-image-mounter Px, @{bin}/gnome-disks Px, + @{bin}/gnome-session-quit Px, @{bin}/gnome-software Px, @{bin}/gwenview PUx, @{bin}/kgx Px, @@ -57,11 +59,6 @@ #aa:only opensuse @{lib}/YaST2/** PUx, - # Backup - @{lib}/deja-dup/deja-dup-monitor PUx, - - @{bin}/gnome-session-quit rPx, - include if exists # vim:syntax=apparmor diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 733f8925c..cb889ee19 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -69,4 +69,7 @@ # Terminal emulator @{terminal_path} = @{bin}/@{offices_names} +# Backup +@{backup_path} = @{bin}/@{backup_names} @{lib}/deja-dup/deja-dup-monitor + # vim:syntax=apparmor diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index b3e36cae7..c1eea10b3 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -93,4 +93,7 @@ # Terminal emulator @{terminal_name} = kgx terminator konsole +# Backup +@{backup_names} = deja-dup borg + # vim:syntax=apparmor From 3b1fe1f931337c7e6d9428797866045effe3e0ca Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 17 May 2025 22:41:43 +0200 Subject: [PATCH 0884/1455] feat(tunable): fix and use terminal_path. --- apparmor.d/abstractions/app-open | 4 ++-- apparmor.d/tunables/multiarch.d/paths | 2 +- apparmor.d/tunables/multiarch.d/programs | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 27f0c96fc..c7d2a86c8 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -18,6 +18,7 @@ # Labeled programs @{archive_viewers_path} PUx, + @{backup_path} PUx, @{browsers_path} Px, @{document_viewers_path} PUx, @{emails_path} PUx, @@ -25,8 +26,8 @@ @{help_path} Px, @{image_viewers_path} PUx, @{offices_path} PUx, + @{terminal_path} Px, @{text_editors_path} PUx, - @{backup_path} PUx, # Others @{bin}/amule Px, @@ -45,7 +46,6 @@ @{bin}/gnome-session-quit Px, @{bin}/gnome-software Px, @{bin}/gwenview PUx, - @{bin}/kgx Px, @{bin}/qbittorrent Px, @{bin}/qpdfview Px, @{bin}/smplayer Px, diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index cb889ee19..059f337fd 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -67,7 +67,7 @@ @{help_path} = @{bin}/@{help_names} # Terminal emulator -@{terminal_path} = @{bin}/@{offices_names} +@{terminal_path} = @{bin}/@{terminal_names} # Backup @{backup_path} = @{bin}/@{backup_names} @{lib}/deja-dup/deja-dup-monitor diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index c1eea10b3..cddb1a7d2 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -91,7 +91,7 @@ @{help_names} = yelp # Terminal emulator -@{terminal_name} = kgx terminator konsole +@{terminal_names} = kgx terminator konsole ptyxis # Backup @{backup_names} = deja-dup borg From 053ce04c8e040c47095b32468d8e046033a14466 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 13:09:06 +0200 Subject: [PATCH 0885/1455] feat(tunanle): add the sqlhex variable. --- apparmor.d/abstractions/common/app | 3 ++- apparmor.d/groups/flatpak/flatpak-app | 1 - apparmor.d/groups/gnome/gnome-music | 4 ++-- apparmor.d/groups/gnome/localsearch | 8 ++------ apparmor.d/groups/gnome/tracker-miner | 6 ++---- apparmor.d/profiles-a-f/dropbox | 3 ++- apparmor.d/profiles-a-f/fractal | 2 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-g-l/gpo | 3 ++- apparmor.d/profiles-g-l/gpodder | 3 ++- apparmor.d/profiles-m-r/protonmail-bridge-core | 4 ++-- apparmor.d/profiles-m-r/psi | 2 +- apparmor.d/profiles-m-r/psi-plus | 2 +- apparmor.d/profiles-m-r/quiterss | 3 ++- apparmor.d/profiles-s-z/strawberry | 2 +- apparmor.d/profiles-s-z/wechat-appimage | 6 ++++-- apparmor.d/tunables/multiarch.d/system | 3 +++ 17 files changed, 30 insertions(+), 27 deletions(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 0d63b72c8..99da31590 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -59,9 +59,10 @@ owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, owner @{user_games_dirs}/** rmix, - owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, owner @{tmp}/** rmwk, owner /dev/shm/** rwlk -> /dev/shm/**, + owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, + owner /var/tmp/etilqs_@{sqlhex} rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/groups/flatpak/flatpak-app b/apparmor.d/groups/flatpak/flatpak-app index 8d35bc8e0..bb824c7cb 100644 --- a/apparmor.d/groups/flatpak/flatpak-app +++ b/apparmor.d/groups/flatpak/flatpak-app @@ -82,7 +82,6 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { /var/lib/flatpak/app/{,**} r, /var/lib/flatpak/exports/** rw, - /var/tmp/etilqs_@{hex16} rw, @{run}/.userns r, @{run}/parent/** r, diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index 7874e95ff..511a48987 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -51,8 +51,8 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw, - owner /var/tmp/etilqs_@{hex15} rw, - owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch index 263604ba7..1503ba747 100644 --- a/apparmor.d/groups/gnome/localsearch +++ b/apparmor.d/groups/gnome/localsearch @@ -47,12 +47,8 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/tracker3/files/ rw, owner @{user_cache_dirs}/tracker3/files/** rwk, - owner /var/tmp/etilqs_@{hex15} rw, - owner /var/tmp/etilqs_@{hex16} rw, - owner @{tmp}/etilqs_@{hex12}@{h} rw, - owner @{tmp}/etilqs_@{hex12}@{hex2} rw, - owner @{tmp}/etilqs_@{hex15} rw, - owner @{tmp}/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, @{run}/mount/utab r, diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index e10d81bb2..d35f6467f 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -63,10 +63,8 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_share_dirs}/applications/ r, - owner /var/tmp/etilqs_@{hex15} rw, - owner /var/tmp/etilqs_@{hex16} rw, - owner @{tmp}/etilqs_@{hex15} rw, - owner @{tmp}/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, # Allow to search user files owner @{HOME}/{,**} r, diff --git a/apparmor.d/profiles-a-f/dropbox b/apparmor.d/profiles-a-f/dropbox index eecdb2e6d..b4baf1d0c 100644 --- a/apparmor.d/profiles-a-f/dropbox +++ b/apparmor.d/profiles-a-f/dropbox @@ -61,7 +61,8 @@ profile dropbox @{exec_path} { # Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead owner @{tmp}/dropbox-antifreeze-* rw, owner @{tmp}/#@{int} rw, - owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index c6746843d..5971764f0 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -34,7 +34,7 @@ profile fractal @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, - owner @{tmp}/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, owner @{run}/user/@{uid}/fractal/{,**} rw, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 75d5197ae..71addde64 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -67,7 +67,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{lib}/fwupd/efi/fwupdx@{int}.efi{,.signed} r, /var/lib/flatpak/exports/share/mime/mime.cache r, - /var/tmp/etilqs_@{hex16} rw, + /var/tmp/etilqs_@{sqlhex} rw, owner /var/cache/fwupd/ rw, owner /var/cache/fwupd/** rwk, owner /var/lib/fwupd/ rw, diff --git a/apparmor.d/profiles-g-l/gpo b/apparmor.d/profiles-g-l/gpo index 562980d35..cebfc955f 100644 --- a/apparmor.d/profiles-g-l/gpo +++ b/apparmor.d/profiles-g-l/gpo @@ -36,7 +36,8 @@ profile gpo @{exec_path} { owner @{HOME}/gPodder/ rw, owner @{HOME}/gPodder/** rwk, - owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-g-l/gpodder b/apparmor.d/profiles-g-l/gpodder index 7ccf428c3..dd7a20eb7 100644 --- a/apparmor.d/profiles-g-l/gpodder +++ b/apparmor.d/profiles-g-l/gpodder @@ -47,7 +47,8 @@ profile gpodder @{exec_path} { owner @{HOME}/gPodder/ rw, owner @{HOME}/gPodder/** rwk, - owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index 493199974..ee7adab75 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -43,8 +43,8 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) { owner "@{user_config_dirs}/autostart/Proton Mail Bridge.desktop" rw, owner @{tmp}/bridge@{int} rw, - owner @{tmp}/etilqs_@{hex16} rw, - owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, @{PROC}/ r, @{PROC}/1/cgroup r, diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index 33435fa8d..24e0c61dd 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -54,7 +54,7 @@ profile psi @{exec_path} { owner @{user_share_dirs}/psi/** rwk, owner @{tmp}/#@{int} rw, - owner @{tmp}/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, owner @{tmp}/Psi.* rwl -> /tmp/#@{int}, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index 32c05e55b..1d3850ba5 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -54,7 +54,7 @@ profile psi-plus @{exec_path} { owner @{user_share_dirs}/psi+/** rwk, owner @{tmp}/#@{int} rw, - owner @{tmp}/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, owner @{tmp}/Psi+.* rwl -> /tmp/#@{int}, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/profiles-m-r/quiterss b/apparmor.d/profiles-m-r/quiterss index 89395f8b5..d1194abf5 100644 --- a/apparmor.d/profiles-m-r/quiterss +++ b/apparmor.d/profiles-m-r/quiterss @@ -47,7 +47,8 @@ profile quiterss @{exec_path} { owner @{tmp}/qtsingleapp-quiter-@{int}-@{int} rw, owner @{tmp}/qtsingleapp-quiter-@{int}-@{int}-lockfile rwk, - owner /var/tmp/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, @{PROC}/sys/kernel/random/boot_id r, owner @{PROC}/@{pid}/cmdline r, diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index 6a337a66b..84bbcf1f2 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -68,7 +68,7 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/.*/s rw, owner @{tmp}/*= w, owner @{tmp}/#@{int} rw, - owner @{tmp}/etilqs_@{hex16} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, owner @{tmp}/kdsingleapp-daemonspudguy-strawberry w, owner @{tmp}/kdsingleapp-daemonspudguy-strawberry.lock rwk, owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw, diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage index 67b3cf503..6f4c120a0 100755 --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -59,11 +59,13 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) { @{tmp}/.mount_wechat@{word6}/ rw, @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} mr, - owner /var/tmp/etilqs_* rw, - @{HOME}/.xwechat/{,**} rwk, + owner @{user_documents_dirs}/xwechat_files/{,**} rwk, + owner @{tmp}/etilqs_@{sqlhex} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, + /dev/fuse rw, /dev/tty rw, diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index d7834cc8a..f1be21e49 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -54,6 +54,9 @@ # System Internal # --------------- +# SQlite temporary files (hexadecimal from 12 to 16 characters) +@{sqlhex}=@{hex12} @{hex12}@{h} @{hex12}@{hex2} @{hex15} @{hex16} + # Shortcut for PCI device @{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h} @{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h} From 94991165421ca3bc422af6893792bb3aa5dfbd9f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 13:39:32 +0200 Subject: [PATCH 0886/1455] feat(profile): add initial profile for ptyxis. --- apparmor.d/groups/gnome/ptyxis | 38 +++++++++++++++++++++++ apparmor.d/groups/gnome/ptyxis-agent | 46 ++++++++++++++++++++++++++++ dists/flags/main.flags | 2 ++ 3 files changed, 86 insertions(+) create mode 100644 apparmor.d/groups/gnome/ptyxis create mode 100644 apparmor.d/groups/gnome/ptyxis-agent diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis new file mode 100644 index 000000000..739681eae --- /dev/null +++ b/apparmor.d/groups/gnome/ptyxis @@ -0,0 +1,38 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ptyxis +profile ptyxis @{exec_path} { + include + include + include + + @{exec_path} mr, + + @{lib}/ptyxis-agent Px, + @{open_path} Px -> child-open-help, + + /etc/shells r, + + owner @{user_cache_dirs}/org.gnome.Ptyxis/ rw, + owner @{user_cache_dirs}/org.gnome.Ptyxis/** rwlk -> @{user_cache_dirs}/org.gnome.Ptyxis/**, + + owner @{user_config_dirs}/org.gnome.Ptyxis/ rw, + owner @{user_config_dirs}/org.gnome.Ptyxis/** rwlk -> @{user_config_dirs}/org.gnome.Ptyxis/**, + + owner @{user_share_dirs}/org.gnome.Ptyxis/ rw, + owner @{user_share_dirs}/org.gnome.Ptyxis/** rwlk -> @{user_share_dirs}/org.gnome.Ptyxis/**, + + owner @{PROC}/@{pid}/stat r, + + /dev/ptmx rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/ptyxis-agent b/apparmor.d/groups/gnome/ptyxis-agent new file mode 100644 index 000000000..239993f21 --- /dev/null +++ b/apparmor.d/groups/gnome/ptyxis-agent @@ -0,0 +1,46 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/ptyxis-agent +profile ptyxis-agent @{exec_path} { + include + include + include + include + + signal send set=hup peer=unconfined, + + ptrace read, + + @{exec_path} mr, + + @{bin}/podman Px, + @{bin}/systemd-run Cx -> shell, + + /usr/share/glib-2.0/schemas/gschemas.compiled r, + + owner @{PROC}/@{pid}/cmdline r, + + /dev/ptmx rw, + + profile shell { + include + include + + signal send, + + @{bin}/systemd-run mr, + @{bin}/@{shells} Ux, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 70d484953..2cef12304 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -271,6 +271,8 @@ plymouth complain plymouth-set-default-theme attach_disconnected,complain plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted +ptyxis complain +ptyxis-agent complain qdbus complain remmina complain run-parts complain From 1fab846875cae905de7c4e194848a043793185c6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 13:47:08 +0200 Subject: [PATCH 0887/1455] feat(abs): add proc stat to the gnome common abs. --- apparmor.d/abstractions/common/gnome | 1 + apparmor.d/groups/apparmor/aa-notify | 1 - apparmor.d/groups/gnome/decibels | 1 - apparmor.d/groups/gnome/gnome-calculator | 2 -- apparmor.d/groups/gnome/gnome-characters | 1 - apparmor.d/groups/gnome/gnome-extensions-app | 1 - apparmor.d/groups/gnome/gnome-logs | 2 -- apparmor.d/groups/gnome/gnome-maps | 1 - apparmor.d/groups/gnome/gnome-text-editor | 1 - apparmor.d/groups/gnome/gnome-weather | 1 - apparmor.d/groups/gnome/papers | 1 - apparmor.d/groups/gnome/ptyxis | 2 -- apparmor.d/profiles-a-f/file-roller | 1 - apparmor.d/profiles-a-f/foliate | 1 - apparmor.d/profiles-a-f/fractal | 1 - 15 files changed, 1 insertion(+), 17 deletions(-) diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index ccb5de8b3..056f6581b 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -32,6 +32,7 @@ owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists diff --git a/apparmor.d/groups/apparmor/aa-notify b/apparmor.d/groups/apparmor/aa-notify index b64317a57..7cb64af80 100644 --- a/apparmor.d/groups/apparmor/aa-notify +++ b/apparmor.d/groups/apparmor/aa-notify @@ -75,7 +75,6 @@ profile aa-notify @{exec_path} { owner @{user_share_dirs}/org.gnome.TextEditor/{,**} rw, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/stat r, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/gnome/decibels b/apparmor.d/groups/gnome/decibels index 88d292b07..2bb38dfd5 100644 --- a/apparmor.d/groups/gnome/decibels +++ b/apparmor.d/groups/gnome/decibels @@ -28,7 +28,6 @@ profile decibels @{exec_path} { owner @{user_videos_dirs}/{,**} r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/stat r, include if exists diff --git a/apparmor.d/groups/gnome/gnome-calculator b/apparmor.d/groups/gnome/gnome-calculator index 3f2290e6a..2e553d9f4 100644 --- a/apparmor.d/groups/gnome/gnome-calculator +++ b/apparmor.d/groups/gnome/gnome-calculator @@ -23,8 +23,6 @@ profile gnome-calculator @{exec_path} { @{open_path} rPx -> child-open-help, - owner @{PROC}/@{pid}/stat r, - include if exists } diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 890a54691..7ee0f835e 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -29,7 +29,6 @@ profile gnome-characters @{exec_path} { /usr/share/xml/iso-codes/{,**} r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/status r, owner @{PROC}/@{pid}/task/@{tid}/stat r, diff --git a/apparmor.d/groups/gnome/gnome-extensions-app b/apparmor.d/groups/gnome/gnome-extensions-app index f1e229b59..0a65c95f2 100644 --- a/apparmor.d/groups/gnome/gnome-extensions-app +++ b/apparmor.d/groups/gnome/gnome-extensions-app @@ -22,7 +22,6 @@ profile gnome-extensions-app @{exec_path} { /usr/share/terminfo/** r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pids}/stat r, owner @{PROC}/@{pids}/task/@{tid}/stat r, /dev/tty rw, diff --git a/apparmor.d/groups/gnome/gnome-logs b/apparmor.d/groups/gnome/gnome-logs index 06e66a43b..5e3ab03bd 100644 --- a/apparmor.d/groups/gnome/gnome-logs +++ b/apparmor.d/groups/gnome/gnome-logs @@ -27,8 +27,6 @@ profile gnome-logs @{exec_path} { /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal r, /{run,var}/log/journal/remote/ r, - owner @{PROC}/@{pid}/stat r, - include if exists } diff --git a/apparmor.d/groups/gnome/gnome-maps b/apparmor.d/groups/gnome/gnome-maps index 294d6229a..705857391 100644 --- a/apparmor.d/groups/gnome/gnome-maps +++ b/apparmor.d/groups/gnome/gnome-maps @@ -45,7 +45,6 @@ profile gnome-maps @{exec_path} { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/stat r, include if exists diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index 693b1618f..22823753b 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -24,7 +24,6 @@ profile gnome-text-editor @{exec_path} { owner @{user_share_dirs}/org.gnome.TextEditor/{,**} rw, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/stat r, deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/gnome/gnome-weather b/apparmor.d/groups/gnome/gnome-weather index c73ff0a19..fe2bf69b2 100644 --- a/apparmor.d/groups/gnome/gnome-weather +++ b/apparmor.d/groups/gnome/gnome-weather @@ -31,7 +31,6 @@ profile gnome-weather @{exec_path} { @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/stat r, deny owner @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/gnome/papers b/apparmor.d/groups/gnome/papers index ee829d8f3..87820376c 100644 --- a/apparmor.d/groups/gnome/papers +++ b/apparmor.d/groups/gnome/papers @@ -32,7 +32,6 @@ profile papers @{exec_path} { @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/stat r, profile open { include diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis index 739681eae..2f7dee368 100644 --- a/apparmor.d/groups/gnome/ptyxis +++ b/apparmor.d/groups/gnome/ptyxis @@ -28,8 +28,6 @@ profile ptyxis @{exec_path} { owner @{user_share_dirs}/org.gnome.Ptyxis/ rw, owner @{user_share_dirs}/org.gnome.Ptyxis/** rwlk -> @{user_share_dirs}/org.gnome.Ptyxis/**, - owner @{PROC}/@{pid}/stat r, - /dev/ptmx rw, include if exists diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index b8eedb263..24610cd8c 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -48,7 +48,6 @@ profile file-roller @{exec_path} { @{run}/mount/utab r, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/stat r, include if exists } diff --git a/apparmor.d/profiles-a-f/foliate b/apparmor.d/profiles-a-f/foliate index f6380d125..a07976ce9 100644 --- a/apparmor.d/profiles-a-f/foliate +++ b/apparmor.d/profiles-a-f/foliate @@ -51,7 +51,6 @@ profile foliate @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/smaps r, - owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/task/@{tid}/stat r, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 5971764f0..40001da68 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -41,7 +41,6 @@ profile fractal @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/stat r, /dev/ r, From 658c054c47a7a0ffc054b5ada18137e62c063354 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 14:46:35 +0200 Subject: [PATCH 0888/1455] feat(profile): update and enforce a few profiles. --- apparmor.d/groups/filesystem/mke2fs | 1 + apparmor.d/groups/gnome/gnome-session-binary | 1 - apparmor.d/groups/gnome/gnome-software | 14 ++-------- apparmor.d/groups/gnome/gnome-system-monitor | 8 +----- apparmor.d/groups/gnome/gnome-terminal-server | 18 ++++++------ apparmor.d/groups/gnome/gnome-tweaks | 2 +- apparmor.d/groups/gnome/kgx | 16 +++++------ apparmor.d/groups/network/ModemManager | 3 +- apparmor.d/groups/polkit/pkttyagent | 4 +-- apparmor.d/groups/shadow/newgidmap | 2 ++ apparmor.d/groups/shadow/newuidmap | 2 ++ apparmor.d/profiles-a-f/calibre | 28 +++++++++++++------ apparmor.d/profiles-m-r/mdevctl | 1 + apparmor.d/profiles-m-r/metadata-cleaner | 14 +++------- apparmor.d/profiles-s-z/totem | 8 ++++++ apparmor.d/profiles-s-z/xsane-gimp | 18 +++++++----- dists/flags/main.flags | 22 ++------------- 17 files changed, 76 insertions(+), 86 deletions(-) diff --git a/apparmor.d/groups/filesystem/mke2fs b/apparmor.d/groups/filesystem/mke2fs index a3edbeb50..90df8ecb1 100644 --- a/apparmor.d/groups/filesystem/mke2fs +++ b/apparmor.d/groups/filesystem/mke2fs @@ -10,6 +10,7 @@ include @{exec_path} = @{sbin}/mke2fs @{sbin}/mkfs.ext2 @{sbin}/mkfs.ext3 @{sbin}/mkfs.ext4 profile mke2fs @{exec_path} { include + include include include diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 1f17b35a3..027a1ab96 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -103,7 +103,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { profile open flags=(attach_disconnected) { include include - include include @{bin}/env rix, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index dd872c53a..c10261c02 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -9,10 +9,8 @@ include @{exec_path} = @{bin}/gnome-software profile gnome-software @{exec_path} { include - include + include include - include - include include include include @@ -71,15 +69,11 @@ profile gnome-software @{exec_path} { /var/tmp/flatpak-cache-*/** rwkl, /var/tmp/#@{int} rw, - / r, - owner @{HOME}/.var/app/{,**} rw, owner @{user_download_dirs}/*.flatpakref r, owner @{user_cache_dirs}/flatpak/{,**} rwl, - owner @{user_cache_dirs}/gnome-software/ rw, - owner @{user_cache_dirs}/gnome-software/** rwlk -> @{user_cache_dirs}/gnome-software/**, owner @{user_config_dirs}/flatpak/{,**} r, owner @{user_config_dirs}/pulse/*.conf r, @@ -94,7 +88,6 @@ profile gnome-software @{exec_path} { owner @{user_share_dirs}/flatpak/overrides/* r, owner @{user_share_dirs}/flatpak/repo/ rw, owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**, - owner @{user_share_dirs}/gnome-software/{,**} rw, owner @{tmp}/ostree-gpg-@{rand6}/ rw, owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, @@ -123,10 +116,7 @@ profile gnome-software @{exec_path} { @{PROC}/sys/fs/pipe-max-size r, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fdinfo/@{int} r, - owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/fuse rw, @@ -166,6 +156,8 @@ profile gnome-software @{exec_path} { include include + capability setuid, + mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/, umount /var/tmp/flatpak-cache-*/*/, diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 8df82b290..a3d039dea 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -9,10 +9,7 @@ include @{exec_path} = @{bin}/gnome-system-monitor profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { include - include - include - include - include + include include capability sys_ptrace, @@ -35,7 +32,6 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { @{bin}/sed rix, @{bin}/tr rix, - /usr/share/gnome-system-monitor/{,**} r, /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r, / r, @@ -78,8 +74,6 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { @{PROC}/diskstats r, @{PROC}/vmstat r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, /dev/tty rw, diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index 55a7f4687..837f00f68 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -19,11 +19,11 @@ profile gnome-terminal-server @{exec_path} { include include - signal (send) set=(hup) peer=htop, - signal (send) set=(term hup kill) peer=unconfined, + signal send set=(hup) peer=htop, + signal send set=(term hup kill) peer=unconfined, - ptrace (read) peer=htop, - ptrace (read) peer=unconfined, + ptrace read peer=htop, + ptrace read peer=unconfined, #aa:dbus own bus=session name=org.gnome.Terminal interface+=org.gtk.Actions @@ -39,14 +39,14 @@ profile gnome-terminal-server @{exec_path} { @{exec_path} mr, # The shell is not confined on purpose. - @{bin}/@{shells} rUx, + @{bin}/@{shells} Ux, # Some CLI program can be launched directly from Gnome Shell - @{bin}/htop rPx, - @{bin}/micro rPUx, - @{bin}/nvtop rPx, + @{bin}/htop Px, + @{bin}/micro PUx, + @{bin}/nvtop Px, - @{open_path} rPx -> child-open, + @{open_path} Px -> child-open, /etc/shells r, diff --git a/apparmor.d/groups/gnome/gnome-tweaks b/apparmor.d/groups/gnome/gnome-tweaks index fa94d56e8..96e83b846 100644 --- a/apparmor.d/groups/gnome/gnome-tweaks +++ b/apparmor.d/groups/gnome/gnome-tweaks @@ -32,7 +32,7 @@ profile gnome-tweaks @{exec_path} flags=(attach_disconnected) { owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, owner @{user_config_dirs}/autostart/ rw, - owner @{user_config_dirs}/autostart/*.desktop r, + owner @{user_config_dirs}/autostart/*.desktop rw, owner @{user_config_dirs}/gtk-{3,4}.0/settings.ini* rw, owner @{user_share_dirs}/backgrounds/{,**} r, owner @{user_share_dirs}/gnome-shell/extensions/**/schemas/* r, diff --git a/apparmor.d/groups/gnome/kgx b/apparmor.d/groups/gnome/kgx index c9177de5c..a32a3d8c3 100644 --- a/apparmor.d/groups/gnome/kgx +++ b/apparmor.d/groups/gnome/kgx @@ -17,7 +17,7 @@ profile kgx @{exec_path} { capability sys_ptrace, - ptrace (read), + ptrace read, @{exec_path} mr, @@ -25,14 +25,14 @@ profile kgx @{exec_path} { @{bin}/@{shells} rUx, # Some CLI program can be launched directly from Gnome Shell - @{bin}/btop rPUx, - @{bin}/htop rPx, - @{bin}/micro rPUx, - @{bin}/nvtop rPx, - @{bin}/nvtop rPx, - @{bin}/vim rUx, + @{bin}/btop PUx, + @{bin}/htop Px, + @{bin}/micro PUx, + @{bin}/nvtop Px, + @{bin}/nvtop Px, + @{bin}/vim Ux, - @{open_path} rPx -> child-open-help, + @{open_path} Px -> child-open-help, owner @{tmp}/#@{int} rw, diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index 1d8987709..59efc3201 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -14,7 +14,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { include include include - include + include capability net_admin, @@ -47,7 +47,6 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { @{sys}/class/tty/ r, @{sys}/class/wwan/ r, - @{sys}/devices/@{pci}/revision r, @{sys}/devices/**/net/*/ r, @{sys}/devices/**/uevent r, @{sys}/devices/virtual/tty/*/ r, diff --git a/apparmor.d/groups/polkit/pkttyagent b/apparmor.d/groups/polkit/pkttyagent index de0eeef33..436447aef 100644 --- a/apparmor.d/groups/polkit/pkttyagent +++ b/apparmor.d/groups/polkit/pkttyagent @@ -18,8 +18,8 @@ profile pkttyagent @{exec_path} { capability sys_nice, capability audit_write, - ptrace (read), - signal (send,receive), + ptrace read, + signal (send, receive), @{exec_path} mr, diff --git a/apparmor.d/groups/shadow/newgidmap b/apparmor.d/groups/shadow/newgidmap index 4a7196fc2..6fa555504 100644 --- a/apparmor.d/groups/shadow/newgidmap +++ b/apparmor.d/groups/shadow/newgidmap @@ -18,6 +18,8 @@ profile newgidmap @{exec_path} { @{exec_path} mr, + @{etc_ro}/login.defs r, + @{etc_ro}/login.defs.d/{,*} r, /etc/subgid r, @{PROC}/@{pids}/ r, diff --git a/apparmor.d/groups/shadow/newuidmap b/apparmor.d/groups/shadow/newuidmap index 549eb06ef..6a53bf5c1 100644 --- a/apparmor.d/groups/shadow/newuidmap +++ b/apparmor.d/groups/shadow/newuidmap @@ -18,6 +18,8 @@ profile newuidmap @{exec_path} { @{exec_path} mr, + @{etc_ro}/login.defs r, + @{etc_ro}/login.defs.d/{,*} r, /etc/subuid r, @{PROC}/@{pids}/ r, diff --git a/apparmor.d/profiles-a-f/calibre b/apparmor.d/profiles-a-f/calibre index e3643ab6d..bba3dfedb 100644 --- a/apparmor.d/profiles-a-f/calibre +++ b/apparmor.d/profiles-a-f/calibre @@ -15,9 +15,10 @@ profile calibre @{exec_path} { include include include - include include + include include + include include include include @@ -35,11 +36,13 @@ profile calibre @{exec_path} { capability sys_ptrace, + network inet dgram, network inet stream, + network inet6 dgram, network inet6 stream, network netlink raw, - unix (send, receive) type=stream peer=(addr=none, label=xorg), + # unix (send, receive) type=stream peer=(addr=none, label=xorg), unix (bind, listen) type=stream addr="@*-calibre-gui.socket", unix (bind) type=stream addr="@calibre-*", @@ -47,9 +50,10 @@ profile calibre @{exec_path} { @{sh_path} rix, @{python_path} rix, + @{bin}/env r, @{bin}/file rix, - @{sbin}/ldconfig{,.real} rix, @{bin}/uname rix, + @{sbin}/ldconfig{,.real} rix, @{lib}/{,@{multiarch}/}qt{5,6}{,/libexec/}QtWebEngineProcess rix, @{bin}/pdftoppm rPUx, # (#FIXME#) @@ -61,6 +65,7 @@ profile calibre @{exec_path} { /usr/share/calibre/{,**} r, /etc/fstab r, + /etc/httpd/conf/mime.types r, /etc/inputrc r, /etc/magic r, /etc/mime.types r, @@ -68,10 +73,15 @@ profile calibre @{exec_path} { owner @{HOME}/ r, owner "@{HOME}/Calibre Library/{,**}" rw, owner "@{HOME}/Calibre Library/metadata.db" rwk, - owner @{user_documents_dirs}/{,**} rwl, + owner @{user_books_dirs}/{,**} rwl, + owner @{user_books_dirs}/Calibre/** rwk, + owner @{user_documents_dirs}/{,**} rwl, + owner @{user_documents_dirs}/Calibre/** rwk, owner @{user_torrents_dirs}/{,**} rwl, + owner @{user_torrents_dirs}/Calibre/** rwk, owner @{user_work_dirs}/{,**} rwl, + owner @{user_work_dirs}/Calibre/** rwk, owner @{user_config_dirs}/calibre/ rw, owner @{user_config_dirs}/calibre/** rwk, @@ -82,10 +92,11 @@ profile calibre @{exec_path} { owner @{user_cache_dirs}/calibre/ rw, owner @{user_cache_dirs}/calibre/** rwkl -> @{user_cache_dirs}/calibre/**, - owner @{tmp}/calibre_*_tmp_*/{,**} rw, - owner @{tmp}/calibre-*/{,**} rw, - owner @{tmp}/@{int}-*/ rw, - owner @{tmp}/@{int}-*/** rwl, + owner @{tmp}/@{rand8} rw, + audit owner @{tmp}/@{int}-*/ rw, + audit owner @{tmp}/@{int}-*/** rwl, + audit owner @{tmp}/calibre_@{rand8}_tmp_*/{,**} rw, + audit owner @{tmp}/calibre-@{rand8}/{,**} rw, owner /dev/shm/#@{int} rw, @@ -108,6 +119,7 @@ profile calibre @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/status r, + /dev/tty r, owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/profiles-m-r/mdevctl b/apparmor.d/profiles-m-r/mdevctl index f1b5034e6..906dcf512 100644 --- a/apparmor.d/profiles-m-r/mdevctl +++ b/apparmor.d/profiles-m-r/mdevctl @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/mdevctl profile mdevctl @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/metadata-cleaner b/apparmor.d/profiles-m-r/metadata-cleaner index 4aa662cd0..808427d85 100644 --- a/apparmor.d/profiles-m-r/metadata-cleaner +++ b/apparmor.d/profiles-m-r/metadata-cleaner @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/metadata-cleaner profile metadata-cleaner @{exec_path} flags=(attach_disconnected) { include - include - include - include + include include include include @@ -20,12 +18,10 @@ profile metadata-cleaner @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{python_path} rix, - @{bin}/bwrap rCx -> bwrap, - @{open_path} rPx -> child-open-help, + @{bin}/bwrap Cx -> bwrap, + @{open_path} Px -> child-open-help, - /usr/share/metadata-cleaner/{,**} r, /usr/share/metadata-cleaner/src/metadatacleaner/{,*/}__pycache__/ w, - /usr/share/poppler/{,**} r, /etc/httpd/conf/mime.types r, @@ -38,10 +34,8 @@ profile metadata-cleaner @{exec_path} flags=(attach_disconnected) { @{run}/mount/utab r, - owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, deny owner @{user_share_dirs}/gvfs-metadata/* r, deny owner @{user_cache_dirs}/thumbnails/** r, @@ -51,7 +45,7 @@ profile metadata-cleaner @{exec_path} flags=(attach_disconnected) { include include - signal (receive) set=(kill) peer=metadata-cleaner, + signal receive set=(kill) peer=metadata-cleaner, @{bin}/bwrap mr, @{bin}/vendor_perl/exiftool rix, diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index 64ab228ba..fc582cae2 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -14,6 +14,7 @@ profile totem @{exec_path} flags=(attach_disconnected) { include include include + include include network netlink raw, @@ -67,6 +68,10 @@ profile totem @{exec_path} flags=(attach_disconnected) { include capability dac_override, + capability sys_ptrace, + + network inet dgram, + network inet6 dgram, @{bin}/bwrap mr, @{bin}/totem-video-thumbnailer rix, @@ -78,8 +83,11 @@ profile totem @{exec_path} flags=(attach_disconnected) { owner @{tmp}/flatpak-seccomp-@{rand6} rw, owner @{tmp}/gnome-desktop-file-to-thumbnail.* rw, owner @{tmp}/gnome-desktop-thumbnailer-@{rand6}/{,**} rw, + owner @{tmp}/gnome-desktop-thumbnailer.png rw, @{PROC}/sys/vm/mmap_min_addr r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/comm w, /dev/ r, diff --git a/apparmor.d/profiles-s-z/xsane-gimp b/apparmor.d/profiles-s-z/xsane-gimp index 41ac0b973..4273e803d 100644 --- a/apparmor.d/profiles-s-z/xsane-gimp +++ b/apparmor.d/profiles-s-z/xsane-gimp @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Roman Beslik +# Copyright (C) 2024-2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -10,27 +11,30 @@ include profile xsane-gimp @{exec_path} { include include - include - - signal (receive) set=(term, kill) peer=gimp, + include network inet dgram, network inet6 dgram, network netlink raw, + signal receive set=(term, kill) peer=gimp, + @{exec_path} mr, + @{system_share_dirs}/gimp/{,**} r, @{system_share_dirs}/sane/xsane/{,**} r, - @{system_share_dirs}/snmp/mibs/{,**} r, # network + @{system_share_dirs}/snmp/mibs/{,**} r, + /etc/sane.d/{,**} r, + owner @{HOME}/.sane/{,**} rw, owner @{tmp}/xsane-*-@{rand6} rw, - @{sys}/devices/@{pci}/{model,type,vendor} r, - @{PROC}/sys/dev/parport/{,parport@{int}/{base-addr,irq}} r, - # SCSI @{sys}/bus/scsi/devices/ r, + @{sys}/devices/@{pci}/{model,type,vendor} r, + @{PROC}/scsi/scsi r, + @{PROC}/sys/dev/parport/{,parport@{int}/{base-addr,irq}} r, include if exists } diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 2cef12304..b710f2d94 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -9,7 +9,6 @@ systemd attach_disconnected,mediate_deleted,complain systemd-service attach_disconnected,complain systemd-user attach_disconnected,mediate_deleted,complain -aa-notify complain akonadi_akonotes_resource complain akonadi_archivemail_agent complain akonadi_birthdays_resource complain @@ -106,7 +105,6 @@ filezilla complain finalrd complain firewall-applet attach_disconnected,complain firewall-config complain -firewalld attach_disconnected,complain flameshot complain flatpak attach_disconnected,mediate_deleted,complain flatpak-app attach_disconnected,mediate_deleted,complain @@ -117,29 +115,20 @@ flatpak-system-helper complain flatpak-validate-icon complain fstrim complain fuse-overlayfs complain -fusermount complain gdk-pixbuf-thumbnailer complain gdm-generate-config complain gdm-runtime-config complain gdm-session attach_disconnected,complain gdm-xsession complain -gimp complain gmenudbusmenuproxy complain gnome-browser-connector-host complain gnome-control-center attach_disconnected,complain gnome-control-center-goa-helper complain gnome-disk-image-mounter complain -gnome-disks complain gnome-extension-gsconnect complain gnome-extension-manager complain gnome-initial-setup complain -gnome-music attach_disconnected,complain -gnome-photos-thumbnailer complain gnome-remote-desktop-daemon complain -gnome-software complain -gnome-system-monitor attach_disconnected,complain -gnome-terminal-server complain -gnome-tweaks complain grub-bios-setup complain grub-editenv complain grub-file complain @@ -173,8 +162,8 @@ gsettings complain gvfsd-dav complain gvfsd-wsdd complain hostnamectl complain -hyprctl complain -hyprlock complain +hyprctl attach_disconnected,complain +hyprlock attach_disconnected,complain hyprpaper attach_disconnected,complain hyprpicker complain hyprpm complain @@ -184,7 +173,6 @@ im-launch complain install-info complain iwctl complain iwd complain -jitterentropy-rngd complain kaccess complain kactivitymanagerd complain kalendarac complain @@ -202,7 +190,6 @@ kded complain kernel-install complain keyboxd complain kglobalacceld complain -kgx complain kio_http_cache_cleaner complain kiod complain kioworker complain @@ -238,9 +225,6 @@ lvmdump complain lvmpolld complain man complain mate-notification-daemon complain -mdevctl complain -metadata-cleaner attach_disconnected,complain -mke2fs complain ModemManager attach_disconnected,complain mount attach_disconnected,complain multipath attach_disconnected,complain @@ -357,7 +341,6 @@ systemd-network-generator complain systemd-nsresourced complain systemd-nsresourcework complain systemd-portabled complain -systemd-remount-fs complain systemd-resolve complain systemd-shutdown complain systemd-sleep-tlp complain @@ -408,6 +391,5 @@ xdm-xsession complain xembedsniproxy complain xfce-session attach_disconnected,complain xsettingsd complain -xwaylandvideobridge complain zpool complain From 21abf59132bc39f72fba96bad60eed1d41a1e5cb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 14:48:33 +0200 Subject: [PATCH 0889/1455] feat(profile): libvirt: simplify udev access. --- apparmor.d/groups/virt/libvirtd | 31 ++----------------------------- 1 file changed, 2 insertions(+), 29 deletions(-) diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 53dcb0703..94fa568a3 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -162,35 +162,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{run}/systemd/notify w, @{run}/utmp rk, - @{run}/udev/data/+backlight:* r, - @{run}/udev/data/+bluetooth:* r, - @{run}/udev/data/+dmi:* r, # for motherboard info - @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs - @{run}/udev/data/+hid:* r, - @{run}/udev/data/+input:input@{int} r, # For mouse, keyboard, touchpad - @{run}/udev/data/+leds:* r, - @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+power_supply:* r, - @{run}/udev/data/+rfkill:* r, - @{run}/udev/data/+sound:card@{int} r, # For sound card - @{run}/udev/data/+thunderbolt:* r, - @{run}/udev/data/c1:@{int} r, # For RAM disk - @{run}/udev/data/c6:@{int} r, # For parallel printer devices /dev/lp* - @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features - @{run}/udev/data/c13:@{int} r, # For /dev/input/* - @{run}/udev/data/c21:@{int} r, # Generic SCSI access - @{run}/udev/data/c29:@{int} r, # For /dev/fb[0-9]* - @{run}/udev/data/c81:@{int} r, # For video4linux - @{run}/udev/data/c89:@{int} r, # For I2C bus interface - @{run}/udev/data/c90:@{int} r, # For RAM, ROM, Flash - @{run}/udev/data/c99:@{int} r, # For raw parallel ports /dev/parport* - @{run}/udev/data/c108:@{int} r, # For /dev/ppp - @{run}/udev/data/c116:@{int} r, # For ALSA - @{run}/udev/data/c202:@{int} r, # CPU model-specific registers - @{run}/udev/data/c203:@{int} r, # CPU CPUID information - @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* - @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{run}/udev/data/+*:* r, + @{run}/udev/data/c@{int}:@{int} r, @{run}/udev/data/n@{int} r, @{sys}/bus/[a-z]*/devices/ r, From 64f02ff6084d5084339211cdcd7f5a468cab5bf2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 14:50:09 +0200 Subject: [PATCH 0890/1455] feat(profile): snapd: add journalctl subprofile. --- apparmor.d/groups/snap/snapd | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 38d803655..c1b24176e 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -60,7 +60,7 @@ profile snapd @{exec_path} { dbus send bus=system path=/org/freedesktop/timedate1 interface=org.freedesktop.DBus.Properties member=Get - peer=(name=org.freedesktop.timedate1, label=unconfined), + peer=(name=org.freedesktop.timedate1), @{exec_path} mrix, @@ -72,7 +72,7 @@ profile snapd @{exec_path} { @{sbin}/groupadd rPx, @{bin}/gzip rix, @{bin}/hostnamectl rPx, - @{bin}/journalctl rPx, + @{bin}/journalctl rCx -> journalctl, @{bin}/kmod rPx, @{bin}/mount rix, @{sbin}/runuser rCx -> runuser, @@ -199,6 +199,25 @@ profile snapd @{exec_path} { include if exists } + profile journalctl { + include + include + + capability net_admin, + + network netlink raw, + + @{bin}/journalctl mr, + + /etc/machine-id r, + /var/lib/dbus/machine-id r, + + /{run,var}/log/journal/ r, + /{run,var}/log/journal/@{hex32}/{,*} r, + + include if exists + } + profile runuser { include From b677d4a0b537ff1c22ab2260f418cbe348df80f5 Mon Sep 17 00:00:00 2001 From: tpaau-17DB Date: Sun, 18 May 2025 18:36:39 +0200 Subject: [PATCH 0891/1455] Fix hyprland profile. --- apparmor.d/groups/hyprland/hyprland | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 68356741d..c06671b34 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -31,6 +31,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/hyprland/{,**} rw, owner @{user_config_dirs}/hypr/** r, owner @{user_share_dirs}/hyprpm/** mr, + owner @{user_share_dirs}/hyprland/** rw, owner @{run}/user/@{uid}/gamescope-* rw, owner @{run}/user/@{uid}/.hyprpaper_* rw, From 10ef829d31efe2f4f9de20ef9b52b999852d489d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 19:31:33 +0200 Subject: [PATCH 0892/1455] fix(profile): more possible id than int for i2c. --- apparmor.d/groups/kde/kde-powerdevil | 10 +++++----- apparmor.d/groups/procps/htop | 6 +++--- apparmor.d/groups/xfce/xfce-sensors | 2 +- apparmor.d/profiles-m-r/monitorix | 2 +- apparmor.d/profiles-s-z/sensors | 2 +- apparmor.d/profiles-s-z/sensors-detect | 2 +- apparmor.d/profiles-s-z/sysstat-sadc | 2 +- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index f5ffa6a82..ebb150ed2 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -70,12 +70,12 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{sys}/devices/@{pci}/drm/card@{int}/*/edid r, @{sys}/devices/@{pci}/drm/card@{int}/*/enabled r, @{sys}/devices/@{pci}/drm/card@{int}/*/status r, - @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, - @{sys}/devices/@{pci}/i2c-@{int}/**/dev r, + @{sys}/devices/@{pci}/i2c-*/{,**/}name r, + @{sys}/devices/@{pci}/i2c-*/**/dev r, @{sys}/devices/**/ r, - @{sys}/devices/i2c-@{int}/name r, - @{sys}/devices/platform/**/i2c-@{int}/**/name r, - @{sys}/devices/platform/*/i2c-@{int}/name r, + @{sys}/devices/i2c-*/name r, + @{sys}/devices/platform/**/i2c-*/**/name r, + @{sys}/devices/platform/*/i2c-*/name r, @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/procps/htop b/apparmor.d/groups/procps/htop index 5e1079802..d59fde5e5 100644 --- a/apparmor.d/groups/procps/htop +++ b/apparmor.d/groups/procps/htop @@ -45,7 +45,7 @@ profile htop @{exec_path} { @{sys}/class/hwmon/ r, @{sys}/class/i2c-adapter/ r, @{sys}/class/power_supply/ r, - @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, + @{sys}/devices/@{pci}/i2c-*/{,**/}name r, @{sys}/devices/**/hwmon@{int}/ r, @{sys}/devices/**/hwmon@{int}/{name,temp*} r, @{sys}/devices/**/hwmon@{int}/**/ r, @@ -56,8 +56,8 @@ profile htop @{exec_path} { @{sys}/devices/**/hwmon/**/{name,temp*} r, @{sys}/devices/**/power_supply/**/{uevent,type,online} r, @{sys}/devices/*/name r, - @{sys}/devices/i2c-@{int}/name r, - @{sys}/devices/platform/*/i2c-@{int}/name r, + @{sys}/devices/i2c-*/name r, + @{sys}/devices/platform/*/i2c-*/name r, @{sys}/devices/system/cpu/cpu@{int}/** r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_{cur,min,max}_freq r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{cur,min,max}_freq r, diff --git a/apparmor.d/groups/xfce/xfce-sensors b/apparmor.d/groups/xfce/xfce-sensors index e7ee1080b..c1bd98111 100644 --- a/apparmor.d/groups/xfce/xfce-sensors +++ b/apparmor.d/groups/xfce/xfce-sensors @@ -16,7 +16,7 @@ profile xfce-sensors @{exec_path} { @{sys}/class/hwmon/ r, @{sys}/class/power_supply/ r, @{sys}/class/thermal/ r, - @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, + @{sys}/devices/@{pci}/i2c-*/{,**/}name r, @{sys}/devices/**/hwmon@{int}/ r, @{sys}/devices/**/hwmon@{int}/{name,temp*} r, @{sys}/devices/**/hwmon@{int}/**/ r, diff --git a/apparmor.d/profiles-m-r/monitorix b/apparmor.d/profiles-m-r/monitorix index b640d90fd..c708b587c 100644 --- a/apparmor.d/profiles-m-r/monitorix +++ b/apparmor.d/profiles-m-r/monitorix @@ -95,7 +95,7 @@ profile monitorix @{exec_path} { @{PROC}/@{pids}/io r, @{sys}/class/i2c-adapter/ r, - @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, + @{sys}/devices/@{pci}/i2c-*/{,**/}name r, @{sys}/class/hwmon/ r, @{sys}/devices/**/thermal*/{,**} r, @{sys}/devices/**/hwmon*/{,**} r, diff --git a/apparmor.d/profiles-s-z/sensors b/apparmor.d/profiles-s-z/sensors index 4028680a6..ca2d43a65 100644 --- a/apparmor.d/profiles-s-z/sensors +++ b/apparmor.d/profiles-s-z/sensors @@ -21,7 +21,7 @@ profile sensors @{exec_path} { @{sys}/bus/i2c/devices/ r, @{sys}/class/hwmon/ r, @{sys}/class/i2c-adapter/ r, - @{sys}/devices/{,platform/*.{i2c,hdmi}/}i2c-@{int}/name r, + @{sys}/devices/{,platform/*.{i2c,hdmi}/}i2c-*/name r, @{sys}/devices/@{pci}/name r, @{sys}/devices/**/hwmon*/{,**} r, diff --git a/apparmor.d/profiles-s-z/sensors-detect b/apparmor.d/profiles-s-z/sensors-detect index 96dc17042..d21cf6f56 100644 --- a/apparmor.d/profiles-s-z/sensors-detect +++ b/apparmor.d/profiles-s-z/sensors-detect @@ -27,7 +27,7 @@ profile sensors-detect @{exec_path} { @{sys}/bus/pci/devices/ r, @{sys}/class/i2c-adapter/ r, @{sys}/devices/@{pci}/{class,vendor,device} r, - @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r, + @{sys}/devices/@{pci}/i2c-*/{,**/}name r, @{sys}/devices/@{pci}/modalias r, @{sys}/devices/virtual/dmi/id/board_{version,vendor,name} r, @{sys}/devices/virtual/dmi/id/chassis_type r, diff --git a/apparmor.d/profiles-s-z/sysstat-sadc b/apparmor.d/profiles-s-z/sysstat-sadc index e076f313c..9a4b5cebe 100644 --- a/apparmor.d/profiles-s-z/sysstat-sadc +++ b/apparmor.d/profiles-s-z/sysstat-sadc @@ -24,7 +24,7 @@ profile sysstat-sadc @{exec_path} { @{sys}/class/fc_host/ r, @{sys}/class/hwmon/ r, @{sys}/class/i2c-adapter/ r, - @{sys}/devices/@{pci}/i2c-@{int}/name r, + @{sys}/devices/@{pci}/i2c-*/name r, @{sys}/devices/@{pci}/net/*/duplex r, @{sys}/devices/**/net/*/duplex r, @{sys}/devices/**/net/*/speed r, From 86afef4920601f4e8babdfaf15d232ac5aed2979 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 19:33:58 +0200 Subject: [PATCH 0893/1455] build: improve `just install` --- Justfile | 13 ++++++++----- PKGBUILD | 3 ++- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/Justfile b/Justfile index 1e626dc1c..825097a1b 100644 --- a/Justfile +++ b/Justfile @@ -18,7 +18,7 @@ # Build setings destdir := "/" build := ".build" -pkgdest := `pwd` / ".pkg/dist" +pkgdest := `pwd` / ".pkg" pkgname := "apparmor.d" # Admin username @@ -86,13 +86,16 @@ install: #!/usr/bin/env bash set -eu -o pipefail install -Dm0755 {{build}}/aa-log {{destdir}}/usr/bin/aa-log - for file in $(find "{{build}}/share" -type f -not -name "*.md" -printf "%P\n"); do + mapfile -t share < <(find "{{build}}/share" -type f -not -name "*.md" -printf "%P\n") + for file in "${share[@]}"; do install -Dm0644 "{{build}}/share/$file" "{{destdir}}/usr/share/$file" done - for file in $(find "{{build}}/apparmor.d" -type f -printf "%P\n"); do + mapfile -t aa < <(find "{{build}}/apparmor.d" -type f -printf "%P\n") + for file in "${aa[@]}"; do install -Dm0644 "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file" done - for file in $(find "{{build}}/apparmor.d" -type l -printf "%P\n"); do + mapfile -t links < <(find "{{build}}/apparmor.d" -type l -printf "%P\n") + for file in "${links[@]}"; do mkdir -p "{{destdir}}/etc/apparmor.d/disable" cp -d "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file" done @@ -155,7 +158,7 @@ serve: clean: @rm -rf \ debian/.debhelper debian/debhelper* debian/*.debhelper debian/{{pkgname}} \ - .pkg/{{pkgname}}* {{build}} coverage.out + {{pkgdest}}/{{pkgname}}* {{build}} coverage.out [doc('Build the package in a clean OCI container')] package dist: diff --git a/PKGBUILD b/PKGBUILD index 58a693d34..b48e55153 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -30,7 +30,8 @@ build() { export CGO_CXXFLAGS="${CXXFLAGS}" export CGO_LDFLAGS="${LDFLAGS}" export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw" - DISTRIBUTION=arch just complain + export DISTRIBUTION=arch + just complain } package() { From 707a5e8beec085376c6bc772352289ace86633d9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 20 May 2025 21:41:52 +0200 Subject: [PATCH 0894/1455] feat(profile): firewalld move kmod into a subprofile. --- apparmor.d/groups/firewall/firewalld | 36 +++++++++++++++------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/apparmor.d/groups/firewall/firewalld b/apparmor.d/groups/firewall/firewalld index ddf0291ee..01f853c26 100644 --- a/apparmor.d/groups/firewall/firewalld +++ b/apparmor.d/groups/firewall/firewalld @@ -9,7 +9,6 @@ include @{exec_path} = @{sbin}/firewalld profile firewalld @{exec_path} flags=(attach_disconnected) { include - include include include include @@ -21,7 +20,6 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { capability net_admin, capability net_raw, capability setpcap, - capability sys_module, network inet raw, network inet6 raw, @@ -34,15 +32,14 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{bin}/ r, @{sbin}/ r, - @{bin}/alts rix, - @{sbin}/ebtables-legacy rix, - @{sbin}/ebtables-legacy-restore rix, - @{bin}/false rix, - @{sbin}/ipset rix, - @{bin}/kmod rix, - @{sbin}/modprobe rix, - @{sbin}/xtables-legacy-multi rix, - @{sbin}/xtables-nft-multi rmix, + @{bin}/alts ix, + @{bin}/false ix, + @{bin}/kmod Cx -> kmod, + @{sbin}/ebtables-legacy ix, + @{sbin}/ebtables-legacy-restore ix, + @{sbin}/ipset ix, + @{sbin}/xtables-legacy-multi ix, + @{sbin}/xtables-nft-multi mix, /usr/local/lib/@{python_name}/dist-packages/ r, @@ -58,18 +55,25 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { /var/log/firewalld rw, @{run}/firewalld/{,*} rw, - @{run}/modprobe.d/{,*.conf} r, @{run}/xtables.lock rwk, - @{sys}/module/compression r, - @{sys}/module/*/initstate r, - - @{PROC}/sys/kernel/modprobe r, @{PROC}/sys/net/ipv{4,6}/ip_forward rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pids}/net/ip_tables_names r, + profile kmod flags=(attach_disconnected) { + include + include + + capability sys_module, + + @{sys}/module/compression r, + @{sys}/module/nf_*/initstate r, + + include if exists + } + include if exists } From 85d35a4f86ac4a6a9479153a0aaf0b6da8063dae Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 14:30:34 +0200 Subject: [PATCH 0895/1455] feat(profile): mkinitcpio ensure support for different kernel. fix #749 --- apparmor.d/groups/pacman/mkinitcpio | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index 785f4f448..9eafb72a9 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -84,8 +84,9 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { # Manage /boot / r, - /boot/ r, - /{boot,efi}/EFI/{,**} rw, + @{efi}/ r, + @{efi}/EFI/{,**} rw, + @{efi}/@{hex32}/{,**} rw, /boot/initramfs-*.img* rw, /boot/vmlinuz-* r, From facc504ae9769f3053557665d85940027ccd9fd3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 14:32:28 +0200 Subject: [PATCH 0896/1455] fix(abs): editor: use of neovim as editor. fix #749 --- apparmor.d/abstractions/app/editor | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index 1c0b87e6a..f62e36339 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -10,7 +10,7 @@ include @{sh_path} rix, - @{bin}/nvim mix, + @{bin}/nvim mrix, @{bin}/sensible-editor mr, @{bin}/vim{,.*} mrix, @{bin}/which rix, From 58d677b5f0ba8e3ae60be71dbb0f6fcbf66ff721 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 14:48:54 +0200 Subject: [PATCH 0897/1455] fix: tweak kde related abs to ensure all common rules are allowed. fix #741 --- apparmor.d/abstractions/app/open | 4 ++++ apparmor.d/abstractions/desktop | 2 +- apparmor.d/abstractions/kde-strict | 4 +++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index 2b865457c..2a43affcf 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -34,9 +34,13 @@ include include + /etc/xdg/menus/ r, + owner @{run}/user//@{uid}/#@{int} rw, owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, + @{PROC}/sys/kernel/random/boot_id r, + # fi include if exists diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 78a98a3cf..181339a12 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -52,7 +52,7 @@ owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*.@{rand6} rwlk, + owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*={.@{rand6}} rwlk, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/dolphinrc r, diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 0f4410a12..7439cd9e9 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -28,7 +28,7 @@ owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*.@{rand6} rwlk, + owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*={.@{rand6}} rwlk, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/dolphinrc r, @@ -41,6 +41,8 @@ owner @{user_config_dirs}/kwinrc r, owner @{user_config_dirs}/trashrc r, + owner @{user_share_dirs}/#@{int} rw, + include if exists # vim:syntax=apparmor From 222125e593d0931a38650888ef1120091c520eaa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 15:01:21 +0200 Subject: [PATCH 0898/1455] fix: processing regexs --- apparmor.d/abstractions/desktop | 2 +- apparmor.d/abstractions/kde-strict | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 181339a12..73e533992 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -52,7 +52,7 @@ owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*={.@{rand6}} rwlk, + owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}* rwlk, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/dolphinrc r, diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 7439cd9e9..56aa88798 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -28,7 +28,7 @@ owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, - owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}*={.@{rand6}} rwlk, + owner @{user_cache_dirs}/ksycoca{5,6}_??{_,-}* rwlk, owner @{user_config_dirs}/baloofilerc r, owner @{user_config_dirs}/dolphinrc r, From 6495061360d6d8ddbd695e27314ff3acb0cf37cb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 20:27:44 +0200 Subject: [PATCH 0899/1455] feat(profile): add initial version for dpkg-scripts. --- apparmor.d/groups/apt/dpkg-script-apparmor | 10 +- .../{dpkg-script-udev => dpkg-script-kmod} | 11 +- apparmor.d/groups/apt/dpkg-script-linux | 45 ++++++ apparmor.d/groups/apt/dpkg-script-man | 27 ---- apparmor.d/groups/apt/dpkg-script-systemd | 64 ++++++++ apparmor.d/groups/apt/dpkg-scripts | 141 ++++++++++++++++++ dists/flags/main.flags | 6 +- 7 files changed, 263 insertions(+), 41 deletions(-) rename apparmor.d/groups/apt/{dpkg-script-udev => dpkg-script-kmod} (54%) create mode 100644 apparmor.d/groups/apt/dpkg-script-linux delete mode 100644 apparmor.d/groups/apt/dpkg-script-man create mode 100644 apparmor.d/groups/apt/dpkg-script-systemd create mode 100644 apparmor.d/groups/apt/dpkg-scripts diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index 088fff84a..585d9c59d 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -15,12 +15,12 @@ profile dpkg-script-apparmor @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/grep rix, + @{bin}/grep ix, - @{bin}/deb-systemd-helper rPx, - @{bin}/deb-systemd-invoke rPx, - @{bin}/dpkg-divert rix, - @{bin}/systemctl rCx -> systemctl, + @{bin}/deb-systemd-helper Px, + @{bin}/deb-systemd-invoke Px, + @{bin}/dpkg-divert ix, + @{bin}/systemctl Cx -> systemctl, /usr/share/apparmor.d/** rw, diff --git a/apparmor.d/groups/apt/dpkg-script-udev b/apparmor.d/groups/apt/dpkg-script-kmod similarity index 54% rename from apparmor.d/groups/apt/dpkg-script-udev rename to apparmor.d/groups/apt/dpkg-script-kmod index 58840ef39..f900bba17 100644 --- a/apparmor.d/groups/apt/dpkg-script-udev +++ b/apparmor.d/groups/apt/dpkg-script-kmod @@ -6,16 +6,13 @@ abi , include -@{exec_path} = /var/lib/dpkg/info/udev* -profile dpkg-script-udev @{exec_path} { +@{exec_path} = /var/lib/dpkg/info/kmod* +profile dpkg-script-kmod @{exec_path} { include - @{exec_path} mr, + @{exec_path} mrix, - @{bin}/systemd-hwdb rPx, - @{bin}/deb-systemd-invoke rPx, - - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux new file mode 100644 index 000000000..c84d6aa4b --- /dev/null +++ b/apparmor.d/groups/apt/dpkg-script-linux @@ -0,0 +1,45 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /var/lib/dpkg/info/linux* +profile dpkg-script-linux @{exec_path} { + include + include + + @{exec_path} mrix, + + @{sh_path} rix, + @{bin}/cat ix, + @{bin}/locale ix, + @{bin}/mkdir ix, + @{bin}/mkdir ix, + @{bin}/rm ix, + @{bin}/run-parts ix, + @{bin}/stty ix, + + @{bin}/dpkg-trigger Px, + @{bin}/kmod Px, + @{bin}/linux-check-removal Px, + @{bin}/linux-update-symlinks Px, + @{bin}/whiptail Px, + + /usr/share/{update,reboot}-notifier/notify-reboot-required Px, + /etc/kernel/{,header_}postinst.d/* Px, + /etc/kernel/postrm.d/* Px, + /etc/kernel/preinst.d/* Px, + /etc/kernel/prerm.d/* Px, + + /etc/kernel/*.d/ r, + + @{lib}/linux/triggers/* w, + @{lib}/modules/*/.fresh-install w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-man b/apparmor.d/groups/apt/dpkg-script-man deleted file mode 100644 index 63f5c5c78..000000000 --- a/apparmor.d/groups/apt/dpkg-script-man +++ /dev/null @@ -1,27 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2025 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /var/lib/dpkg/info/man-db.* -profile dpkg-script-man @{exec_path} { - include - include - include - - capability setgid, - capability setuid, - - @{exec_path} mr, - - @{sh_path} rix, - @{bin}/setpriv rix, - @{bin}/mandb rPx, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd new file mode 100644 index 000000000..28f4b6e87 --- /dev/null +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -0,0 +1,64 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /var/lib/dpkg/info/systemd* +profile dpkg-script-systemd @{exec_path} { + include + include + + @{exec_path} mrix, + + @{sh_path} rix, + + @{bin}/deb-systemd-helper Px, + @{bin}/deb-systemd-invoke Px, + @{bin}/dpkg Cx -> dpkg, + @{bin}/dpkg-divert Px, + @{bin}/dpkg-maintscript-helper Px, + @{bin}/journalctl Px, + @{bin}/kernel-install Px, + @{bin}/systemctl Cx -> systemctl, + @{bin}/systemd-machine-id-setup Px, + @{bin}/systemd-sysusers Px, + @{bin}/systemd-tmpfiles Px, + @{lib}/systemd/systemd-sysctl Px, + @{sbin}/pam-auth-update Px, + + /etc/systemd/system/*.wants/ rw, + /etc/systemd/system/*.wants/* rw, + + /var/lib/systemd/{,*} rw, + /var/log/journal/ rw, + + profile dpkg { + include + include + + @{bin}/dpkg mr, + + include if exists + } + + profile systemctl { + include + include + + capability net_admin, + capability sys_resource, + + signal send set=(cont term) peer=systemd-tty-ask-password-agent, + + @{bin}/systemd-tty-ask-password-agent Px, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts new file mode 100644 index 000000000..d644b6c3e --- /dev/null +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -0,0 +1,141 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /var/lib/dpkg/** +profile dpkg-scripts @{exec_path} { + include + include + include + + capability chown, + capability dac_read_search, + capability fowner, + capability fsetid, + capability setgid, + capability setuid, + + @{exec_path} mrix, + + # Common program found in maintainer scripts + @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/run-parts rix, + + @{bin}/setpriv ix, + @{bin}/envsubst ix, + @{bin}/getent ix, + @{bin}/gzip ix, + @{bin}/helpztags ix, + @{bin}/locale ix, + @{bin}/tput ix, + @{bin}/zcat ix, + @{lib}/ubuntu-advantage/cloud-id-shim.sh ix, + @{lib}/ubuntu-advantage/postinst-migrations.sh ix, + + @{bin}/dbus-send Cx -> bus, + @{bin}/dpkg Px -> child-dpkg, + @{bin}/systemctl Cx -> systemctl, + @{sbin}/invoke-rc.d Cx -> rc, + @{sbin}/ldconfig Cx -> ldconfig, + @{sbin}/ldconfig.real Cx -> ldconfig, + @{sbin}/update-rc.d Cx -> rc, + + # Maintainer scripts can legitimately start/restart anything + @{bin}/** Px, + @{sbin}/** Px, + @{lib}/** Px, + /usr/share/** Px, + /etc/init.d/* Px, + + /var/lib/dpkg/info/*.@{dpkg_script_ext} ix, # dpkg-scripts-* + /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px, # dpkg-script-tmp + + # Maintainer's scripts can update a lot of files + / r, + /*/ r, + @{bin}/ r, + @{lib}/ r, + /etc/ r, + /etc/** rw, + /usr/share/*/ r, + /usr/share/*/** rw, + /var/** rw, + @{run}/** rw, + @{efi}/grub/* rw, + + /tmp/grub.@{rand10} rw, + /tmp/sed@{rand6} rw, + /tmp/tmp.@{rand10} rw, + + profile bus { + include + include + include + + dbus send bus=system path=/ + interface=org.freedesktop.DBus + member=ReloadConfig + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), + + include if exists + } + + profile systemctl { + include + include + + capability net_admin, + capability sys_ptrace, + + @{run}/utmp rk, + + include if exists + } + + profile rc { + include + include + + @{sbin}/update-rc.d mr, + @{sbin}/invoke-rc.d mr, + + @{coreutils_path} rix, + @{sh_path} rix, + @{bin}/systemctl rPx -> dpkg-scripts//systemctl, + + /etc/ r, + /etc/init.d/* r, + /etc/rc?.d/ r, + /etc/rc@{int}.d/ r, + /etc/rc@{int}.d/* rw, + /etc/rc@{c}.d/* rw, + + include if exists + } + + profile ldconfig { + include + include + + @{sh_path} rix, + @{sbin}/ldconfig mrix, + @{sbin}/ldconfig.real rix, + + @{lib}/ r, + /usr/local/ r, + /usr/local/lib/ r, + + owner /var/cache/ldconfig/aux-cache* rw, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index b710f2d94..9aa61f15b 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -88,8 +88,10 @@ dolphin complain downloadhelper complain dpkg-maintscript-helper complain dpkg-script-apparmor complain -dpkg-script-man complain -dpkg-script-udev complain +dpkg-script-kmod complain +dpkg-script-linux complain +dpkg-script-systemd complain +dpkg-scripts complain drkonqi complain drkonqi-coredump-cleanup complain drkonqi-coredump-processor complain From c446c44ded1f9239f065b341b85dec332d1cc157 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 20:32:57 +0200 Subject: [PATCH 0900/1455] feat(profile): add dpkg-script-tmp. --- apparmor.d/groups/apt/deb-systemd-invoke | 2 +- apparmor.d/groups/apt/dpkg-architecture | 9 ++-- apparmor.d/groups/apt/dpkg-db-backup | 42 +++++++++++++++ apparmor.d/groups/apt/dpkg-maintscript-helper | 6 +-- apparmor.d/groups/apt/dpkg-script-tmp | 53 +++++++++++++++++++ apparmor.d/groups/apt/dpkg-vendor | 1 - dists/flags/main.flags | 2 + 7 files changed, 104 insertions(+), 11 deletions(-) create mode 100644 apparmor.d/groups/apt/dpkg-db-backup create mode 100644 apparmor.d/groups/apt/dpkg-script-tmp diff --git a/apparmor.d/groups/apt/deb-systemd-invoke b/apparmor.d/groups/apt/deb-systemd-invoke index 63dfdaf52..0994006da 100644 --- a/apparmor.d/groups/apt/deb-systemd-invoke +++ b/apparmor.d/groups/apt/deb-systemd-invoke @@ -21,7 +21,7 @@ profile deb-systemd-invoke @{exec_path} { @{sh_path} rix, @{bin}/systemctl rix, - @{bin}/systemd-tty-ask-password-agent rPx, + @{bin}/systemd-tty-ask-password-agent Px, include if exists } diff --git a/apparmor.d/groups/apt/dpkg-architecture b/apparmor.d/groups/apt/dpkg-architecture index a58257271..b1a23f222 100644 --- a/apparmor.d/groups/apt/dpkg-architecture +++ b/apparmor.d/groups/apt/dpkg-architecture @@ -16,10 +16,9 @@ profile dpkg-architecture @{exec_path} { capability dac_read_search, @{exec_path} r, - /usr/bin/perl r, - @{bin}/{,@{multiarch}-}gcc-[0-9]* rix, - @{lib}/llvm-[0-9]*/bin/clang rix, + @{bin}/{,@{multiarch}-}gcc-[0-9]* ix, + @{lib}/llvm-[0-9]*/bin/clang ix, @{bin}/ccache rCx -> ccache, @{bin}/dpkg rPx -> child-dpkg, @@ -28,9 +27,7 @@ profile dpkg-architecture @{exec_path} { /etc/debian_version r, - # file_inherit - owner @{tmp}/* rw, - + audit owner @{tmp}/* rw, profile ccache { include diff --git a/apparmor.d/groups/apt/dpkg-db-backup b/apparmor.d/groups/apt/dpkg-db-backup new file mode 100644 index 000000000..d83bdbb45 --- /dev/null +++ b/apparmor.d/groups/apt/dpkg-db-backup @@ -0,0 +1,42 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/dpkg/dpkg-db-backup +profile dpkg-db-backup @{exec_path} { + include + include + include + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/basename rix, + @{bin}/cmp rix, + @{bin}/cp rix, + @{bin}/date rix, + @{bin}/dirname rix, + @{bin}/gzip rix, + @{bin}/mv rix, + @{bin}/rm rix, + @{bin}/savelog rix, + @{bin}/tar rix, + @{bin}/touch rix, + + /usr/share/dpkg/{,**} r, + + /var/lib/dpkg/ r, + /var/lib/dpkg/alternatives/{,*} r, + /var/lib/dpkg/diversions r, + /var/lib/dpkg/statoverride r, + + /var/backups/{,**} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-maintscript-helper b/apparmor.d/groups/apt/dpkg-maintscript-helper index b7d8675e8..dfb881e32 100644 --- a/apparmor.d/groups/apt/dpkg-maintscript-helper +++ b/apparmor.d/groups/apt/dpkg-maintscript-helper @@ -13,9 +13,9 @@ profile dpkg-maintscript-helper @{exec_path} { @{exec_path} mr, - @{sh_path} rix, - @{bin}/basename rix, - @{bin}/dpkg rCx -> dpkg, + @{sh_path} rix, + @{bin}/basename rix, + @{bin}/dpkg rCx -> dpkg, /usr/share/dpkg/sh/* r, diff --git a/apparmor.d/groups/apt/dpkg-script-tmp b/apparmor.d/groups/apt/dpkg-script-tmp new file mode 100644 index 000000000..e6c7fbe44 --- /dev/null +++ b/apparmor.d/groups/apt/dpkg-script-tmp @@ -0,0 +1,53 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} +profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) { + include + include + + @{exec_path} mrix, + + @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/run-parts rix, + @{bin}/deb-systemd-invoke Px, + @{bin}/dpkg Px, + @{bin}/dpkg-divert Px, + @{bin}/dpkg-maintscript-helper Px, + @{bin}/kmod Cx -> kmod, + @{bin}/systemctl Cx -> systemctl, + + /etc/kernel/preinst.d/*-microcode ix, + + @{lib}/modules/*/.fresh-install w, + + profile kmod { + include + include + + include if exists + } + + profile systemctl { + include + include + + capability net_admin, + capability sys_ptrace, + capability sys_resource, + + @{bin}/systemd-tty-ask-password-agent Px, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-vendor b/apparmor.d/groups/apt/dpkg-vendor index aee717257..70d2199f2 100644 --- a/apparmor.d/groups/apt/dpkg-vendor +++ b/apparmor.d/groups/apt/dpkg-vendor @@ -13,7 +13,6 @@ profile dpkg-vendor @{exec_path} { include @{exec_path} r, - /usr/bin/perl r, /etc/dpkg/origins/* r, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 9aa61f15b..aa62f9108 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -86,11 +86,13 @@ dmsetup complain dockerd attach_disconnected,complain dolphin complain downloadhelper complain +dpkg-db-backup complain dpkg-maintscript-helper complain dpkg-script-apparmor complain dpkg-script-kmod complain dpkg-script-linux complain dpkg-script-systemd complain +dpkg-script-tmp complain dpkg-scripts complain drkonqi complain drkonqi-coredump-cleanup complain From 9eff482ebf37d218c35cdf4cb9fcd7a3e2f618a5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 20:34:05 +0200 Subject: [PATCH 0901/1455] feat(profile): update unattended upgrade profiles. --- apparmor.d/groups/apt/unattended-upgrade | 52 +++++++++++-------- .../groups/apt/unattended-upgrade-shutdown | 4 +- apparmor.d/groups/apt/update-apt-xapian-index | 14 +++-- 3 files changed, 37 insertions(+), 33 deletions(-) diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index 8413d9975..95b8b2760 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -32,7 +32,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { network netlink raw, - signal (send) peer=apt-methods-http, + signal send peer=apt-methods-http, unix type=stream addr=@@{udbus}/bus/unattended-upgr/system, @@ -41,26 +41,29 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { @{bin}/ r, @{sh_path} rix, - @{bin}/echo rix, - @{bin}/gdbus rix, - @{bin}/ischroot rix, @{python_path} rix, - @{bin}/test rix, - @{bin}/touch rix, - @{bin}/uname rix, + @{bin}/echo ix, + @{bin}/gdbus ix, + @{bin}/md5sum ix, + @{bin}/tar ix, + @{bin}/test ix, + @{bin}/touch ix, + @{bin}/uname ix, - @{bin}/apt-listchanges rPx, - @{bin}/dpkg rPx, - @{bin}/dpkg-divert rPx, - @{sbin}/dpkg-preconfigure rPx, - @{bin}/etckeeper rPx, - @{bin}/lsb_release rPx -> lsb_release, - @{sbin}/on_ac_power rPx, - @{sbin}/sendmail rPUx, - @{lib}/apt/methods/http{,s} rPx, - @{lib}/needrestart/apt-pinvoke rPx, - @{lib}/update-notifier/update-motd-updates-available rPx, - @{lib}/zsys-system-autosnapshot rPx, + @{bin}/dpkg-deb px, + @{bin}/apt-listchanges Px, + @{bin}/dpkg Px, + @{bin}/dpkg-divert Px, + @{bin}/etckeeper Px, + @{bin}/ischroot Px, + @{bin}/lsb_release Px -> lsb_release, + @{sbin}/dpkg-preconfigure Px, + @{sbin}/on_ac_power Px, + @{sbin}/sendmail Px, + @{lib}/apt/methods/http{,s} Px, + @{lib}/needrestart/apt-pinvoke Px, + @{lib}/update-notifier/update-motd-updates-available Px, + @{lib}/zsys-system-autosnapshot Px, /usr/share/distro-info/* r, @@ -70,8 +73,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /etc/apt/*.list r, /etc/apt/apt.conf.d/{,**} r, /etc/debian_version r, - /etc/default/apport r, - /etc/default/grub.d/* r, + /etc/default/{,**} r, /etc/dpkg/origins/{,debian,ubuntu} r, /etc/fwupd/{,**} r, /etc/grub.d/* r, @@ -85,9 +87,13 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /etc/pki/fwupd-metadata/{,**} r, /etc/pki/fwupd/{,**} r, /etc/profile.d/* r, + /etc/ssh/moduli r, + /etc/ssh/ssh_config r, + /etc/ufw/{,**} r, /etc/update-manager/{,**} r, - /etc/update-motd.d/* r, - /etc/vmware-tools/* r, + /etc/update-motd.d/{,**} r, + /etc/vim/{,**} r, + /etc/vmware-tools/{,**} r, /var/log/unattended-upgrades/{,**} rw, /var/crash/*.crash w, diff --git a/apparmor.d/groups/apt/unattended-upgrade-shutdown b/apparmor.d/groups/apt/unattended-upgrade-shutdown index cd35bb5ae..f36505e7a 100644 --- a/apparmor.d/groups/apt/unattended-upgrade-shutdown +++ b/apparmor.d/groups/apt/unattended-upgrade-shutdown @@ -12,15 +12,15 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) { include include include + include include include @{exec_path} mr, - @{bin}/ischroot rix, + @{bin}/ischroot Px, /usr/share/unattended-upgrades/{,*} r, - /etc/apt/apt.conf.d/{,*} r, owner /var/log/unattended-upgrades/*.log* rw, diff --git a/apparmor.d/groups/apt/update-apt-xapian-index b/apparmor.d/groups/apt/update-apt-xapian-index index 5da82090f..f829ab3ff 100644 --- a/apparmor.d/groups/apt/update-apt-xapian-index +++ b/apparmor.d/groups/apt/update-apt-xapian-index @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/update-apt-xapian-index profile update-apt-xapian-index @{exec_path} { include + include include include @@ -17,10 +18,13 @@ profile update-apt-xapian-index @{exec_path} { @{python_path} r, @{bin}/ r, - @{bin}/dpkg rPx -> child-dpkg, + @{bin}/dpkg Px -> child-dpkg, /usr/share/apt-xapian-index/{,**} r, + /var/lib/dbus/machine-id r, + /etc/machine-id r, + /var/cache/apt-xapian-index/ rw, /var/cache/apt-xapian-index/** rwk, @@ -30,15 +34,9 @@ profile update-apt-xapian-index @{exec_path} { /var/cache/apt/ r, /var/cache/apt/** rwk, - owner @{PROC}/@{pid}/fd/ r, - /var/lib/debtags/package-tags r, - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - # file_inherit - owner /dev/tty@{int} rw, + owner @{PROC}/@{pid}/fd/ r, include if exists } From 760eb91ac6eed4a72ddcf4a5bf2e7324e9e0591a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:06:21 +0200 Subject: [PATCH 0902/1455] feat(profile): add profile for t-methods-sq. --- apparmor.d/groups/apt/apt-methods-sqv | 42 +++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 43 insertions(+) create mode 100644 apparmor.d/groups/apt/apt-methods-sqv diff --git a/apparmor.d/groups/apt/apt-methods-sqv b/apparmor.d/groups/apt/apt-methods-sqv new file mode 100644 index 000000000..416328cd4 --- /dev/null +++ b/apparmor.d/groups/apt/apt-methods-sqv @@ -0,0 +1,42 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2019-2021 Mikhail Morfikov +# Copyright (C) 2021-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/apt/methods/sqv +profile apt-methods-sqv @{exec_path} { + include + include + include + + # To handle the _apt user + capability setgid, + capability setuid, + + signal receive set=int peer=apt, + + @{exec_path} mr, + + @{bin}/sqv ix, + + /usr/share/apt/default-sequoia.config r, + /usr/share/keyrings/debian-archive-keyring.gpg r, + /usr/share/keyrings/debian-archive-keyring.pgp r, + + owner /var/lib/apt/lists/{,**} r, + + owner /tmp/apt.data.@{rand6} rw, + owner /tmp/apt.sig.@{rand6} rw, + owner /tmp/apt.sqverr.@{rand6} rw, + owner /tmp/apt.sqvout.@{rand6} rw, + + @{PROC}/@{pid}/fd/ r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index aa62f9108..d2c57b682 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -27,6 +27,7 @@ akonadi_notes_agent complain akonadi_sendlater_agent complain akonadi_unifiedmailbox_agent complain anacron complain +apt-methods-sqv complain at complain atd complain auditctl attach_disconnected,complain From c64901353e095f45e34eccaea31e946168a52693 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:10:48 +0200 Subject: [PATCH 0903/1455] fix(profile): some fix on the dpkg-scipts profiles. --- apparmor.d/groups/apt/dpkg-script-apparmor | 5 +++-- apparmor.d/groups/apt/dpkg-script-linux | 11 ++++++----- apparmor.d/groups/apt/dpkg-script-systemd | 1 + apparmor.d/groups/apt/dpkg-script-tmp | 4 ++++ apparmor.d/groups/apt/dpkg-scripts | 4 ++-- 5 files changed, 16 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index 585d9c59d..5dba3d3cb 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -9,10 +9,10 @@ include @{exec_path} = /var/lib/dpkg/info/apparmor* profile dpkg-script-apparmor @{exec_path} { include + include include - include - @{exec_path} mr, + @{exec_path} mrix, @{sh_path} rix, @{bin}/grep ix, @@ -21,6 +21,7 @@ profile dpkg-script-apparmor @{exec_path} { @{bin}/deb-systemd-invoke Px, @{bin}/dpkg-divert ix, @{bin}/systemctl Cx -> systemctl, + @{sbin}/apparmor_parser Px, /usr/share/apparmor.d/** rw, diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux index c84d6aa4b..8b2470a6c 100644 --- a/apparmor.d/groups/apt/dpkg-script-linux +++ b/apparmor.d/groups/apt/dpkg-script-linux @@ -22,11 +22,12 @@ profile dpkg-script-linux @{exec_path} { @{bin}/run-parts ix, @{bin}/stty ix, - @{bin}/dpkg-trigger Px, - @{bin}/kmod Px, - @{bin}/linux-check-removal Px, - @{bin}/linux-update-symlinks Px, - @{bin}/whiptail Px, + @{bin}/dpkg-trigger Px, + @{bin}/kmod Px, + @{bin}/linux-check-removal Px, + @{bin}/linux-update-symlinks Px, + @{bin}/whiptail Px, + @{bin}/dpkg-maintscript-helper Px, /usr/share/{update,reboot}-notifier/notify-reboot-required Px, /etc/kernel/{,header_}postinst.d/* Px, diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd index 28f4b6e87..ccaa62a30 100644 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -9,6 +9,7 @@ include @{exec_path} = /var/lib/dpkg/info/systemd* profile dpkg-script-systemd @{exec_path} { include + include include @{exec_path} mrix, diff --git a/apparmor.d/groups/apt/dpkg-script-tmp b/apparmor.d/groups/apt/dpkg-script-tmp index e6c7fbe44..65e63d076 100644 --- a/apparmor.d/groups/apt/dpkg-script-tmp +++ b/apparmor.d/groups/apt/dpkg-script-tmp @@ -10,6 +10,7 @@ include profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) { include include + include @{exec_path} mrix, @@ -22,6 +23,9 @@ profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) { @{bin}/dpkg-maintscript-helper Px, @{bin}/kmod Cx -> kmod, @{bin}/systemctl Cx -> systemctl, + /usr/share/debconf/frontend Px, + + /usr/share/debconf/confmodule r, /etc/kernel/preinst.d/*-microcode ix, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index d644b6c3e..dcb6ca379 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -62,8 +62,8 @@ profile dpkg-scripts @{exec_path} { @{lib}/ r, /etc/ r, /etc/** rw, - /usr/share/*/ r, - /usr/share/*/** rw, + /usr/share/*/{,**} rw, + /usr/local/share/*/{,**} rw, /var/** rw, @{run}/** rw, @{efi}/grub/* rw, From 2c880ba22001f5dcfcaa84b67df211d4925c9094 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:16:35 +0200 Subject: [PATCH 0904/1455] feat(profile): rewrite the apt stack of profiles. --- apparmor.d/groups/apt/apt | 6 ++- apparmor.d/groups/apt/apt-listchanges | 39 ++++---------- apparmor.d/groups/apt/debsums | 16 ++---- apparmor.d/groups/apt/dpkg | 27 +++++----- apparmor.d/groups/apt/dpkg-preconfigure | 68 +++++++++++-------------- apparmor.d/groups/apt/dpkg-statoverride | 18 +++++++ 6 files changed, 78 insertions(+), 96 deletions(-) create mode 100644 apparmor.d/groups/apt/dpkg-statoverride diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 947dba149..e2e9b00f4 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -85,8 +85,8 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{bin}/etckeeper rPx, @{bin}/localepurge rPx, @{bin}/ps rPx, - @{bin}/snap rPUx, - @{bin}/systemctl rCx -> systemctl, + @{bin}/snap rPx, + @{bin}/systemctl rCx -> systemctl, @{bin}/update-command-not-found rPx, @{lib}/cnf-update-db rPx, @{lib}/needrestart/apt-pinvoke rPx, @@ -138,6 +138,8 @@ profile apt @{exec_path} flags=(attach_disconnected) { /var/log/apt/{,**} rw, /var/log/ubuntu-advantage-apt-hook.log w, + @{efi}/ r, + # For package building @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, diff --git a/apparmor.d/groups/apt/apt-listchanges b/apparmor.d/groups/apt/apt-listchanges index 559e58504..35684feb5 100644 --- a/apparmor.d/groups/apt/apt-listchanges +++ b/apparmor.d/groups/apt/apt-listchanges @@ -14,7 +14,7 @@ profile apt-listchanges @{exec_path} { include include - #capability sys_tty_config, + capability dac_read_search, @{exec_path} r, @{python_path} r, @@ -26,11 +26,11 @@ profile apt-listchanges @{exec_path} { # Do not strip env to avoid errors like the following: # ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open # shared object file): ignored. - @{bin}/dpkg-deb rpx, - # - @{pager_path} rCx -> pager, - # Send results using email - @{bin}/exim4 rPx, + @{bin}/dpkg-deb px, + + @{pager_path} Cx -> pager, + @{bin}/dpkg Px -> child-dpkg, + @{bin}/exim4 Px, # Send results using email /usr/share/apt-listchanges/{,**} r, @@ -50,31 +50,12 @@ profile apt-listchanges @{exec_path} { /var/cache/apt/archives/ r, - owner @{PROC}/@{pid}/fd/ r, - /tmp/ r, - owner @{tmp}/* rw, - owner @{tmp}/apt-listchanges*/ rw, - owner @{tmp}/apt-listchanges*/**/ rw, - owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.gz rw, - owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.Debian*.gz rw, - owner @{tmp}/apt-listchanges*/*/*/*/*/NEWS.Debian.gz rw, - owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog.gz rw, - owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw, - owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw, - owner @{tmp}/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw, - - # The following is needed when apt-listchanges uses debcconf GUI frontends. - include - include - include - include - capability dac_read_search, - @{bin}/lsb_release rPx -> lsb_release, - @{bin}/hostname rix, - owner @{PROC}/@{pid}/mounts r, - @{HOME}/.Xauthority r, + owner @{tmp}/@{word8} rw, + owner @{tmp}/apt-listchanges@{word8}/ rw, + owner @{tmp}/apt-listchanges@{word8}/** rw, + owner @{PROC}/@{pid}/fd/ r, profile pager { include diff --git a/apparmor.d/groups/apt/debsums b/apparmor.d/groups/apt/debsums index 01e9ac152..6f66426ec 100644 --- a/apparmor.d/groups/apt/debsums +++ b/apparmor.d/groups/apt/debsums @@ -12,28 +12,20 @@ profile debsums @{exec_path} { include include - # Needed to read files owned by other users than root. capability dac_read_search, @{exec_path} r, @{sh_path} rix, - @{bin}/{m,g,}awk rix, + @{bin}/{m,g,}awk ix, # Do not strip env to avoid errors like the following: # ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open # shared object file): ignored. - @{bin}/dpkg-query rpx, + @{bin}/dpkg-query px, # - @{bin}/dpkg rPx -> child-dpkg, - @{bin}/dpkg-divert rPx -> child-dpkg-divert, - - /etc/dpkg/dpkg.cfg.d/{,*} r, - /etc/dpkg/dpkg.cfg r, - - /etc/locale.nopurge r, - - /var/lib/dpkg/info/* r, + @{bin}/dpkg Px -> child-dpkg, + @{bin}/dpkg-divert Px -> child-dpkg-divert, # For shell pwd / r, diff --git a/apparmor.d/groups/apt/dpkg b/apparmor.d/groups/apt/dpkg index 93f5ebca5..53bebdccf 100644 --- a/apparmor.d/groups/apt/dpkg +++ b/apparmor.d/groups/apt/dpkg @@ -22,24 +22,23 @@ profile dpkg @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/cat rix, - @{bin}/deb-systemd-helper rix, - @{bin}/deb-systemd-invoke rix, - @{bin}/rm rix, + @{bin}/cat ix, + @{bin}/deb-systemd-helper Px, + @{bin}/deb-systemd-invoke Px, + @{bin}/rm ix, - @{bin}/dpkg-deb rpx, - @{bin}/dpkg-query rpx, - @{bin}/dpkg-split rpx, - @{bin}/systemctl rCx -> systemctl, - @{lib}/needrestart/dpkg-status rPx, - /usr/share/debian-security-support/check-support-status.hook rPx, - - @{pager_path} rPx -> child-pager, + @{bin}/dpkg-deb px, + @{bin}/dpkg-query px, + @{bin}/dpkg-split px, + @{bin}/systemctl Cx -> systemctl, + @{lib}/needrestart/dpkg-status Px, + @{pager_path} Px -> child-pager, + /usr/share/debian-security-support/check-support-status.hook Px, # Package maintainer's scripts - /var/lib/dpkg/info/*.@{dpkg_script_ext} rPUx, + /var/lib/dpkg/info/*.@{dpkg_script_ext} Px, /var/lib/dpkg/info/*.control r, - /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} rPUx, + /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px, # For shell pwd /root/ r, diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index ef7852863..fd67f930e 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -11,35 +11,36 @@ include profile dpkg-preconfigure @{exec_path} { include include - include include - - #capability sys_tty_config, + include + include @{exec_path} r, - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/{,g,m}awk rix, - @{bin}/cat rix, - @{bin}/debconf-escape rix, - @{bin}/dialog rix, - @{bin}/expr rix, - @{bin}/locale rix, - @{bin}/readlink rix, - @{bin}/sed rix, - @{bin}/sort rix, - @{bin}/stty rix, - @{bin}/tr rix, - @{bin}/head rix, - @{bin}/readlink rix, - @{bin}/realpath rix, + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/{,g,m}awk ix, + @{bin}/cat ix, + @{bin}/debconf-escape Px, + @{bin}/dialog ix, + @{bin}/expr ix, + @{bin}/find ix, + @{bin}/head ix, + @{bin}/locale ix, + @{bin}/readlink ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/sed ix, + @{bin}/sort ix, + @{bin}/stty ix, + @{bin}/tr ix, + @{bin}/uniq ix, - @{bin}/findmnt rPx, - @{bin}/dpkg rPx -> child-dpkg, - @{bin}/apt-extracttemplates rPx, - @{bin}/whiptail rPx, - @{lib}/apt/apt-extracttemplates rPx, + @{bin}/apt-extracttemplates Px, + @{bin}/dpkg Px -> child-dpkg, + @{bin}/findmnt Px, + @{bin}/whiptail Px, + @{lib}/apt/apt-extracttemplates Px, /usr/share/debconf/confmodule r, /usr/share/dictionaries-common/{,*} r, @@ -59,9 +60,6 @@ profile dpkg-preconfigure @{exec_path} { /var/cache/debconf/tmp.ci/ w, - owner @{tmp}/*.template.* rw, - owner @{tmp}/*.config.* rwPUx, - /var/lib/dbus/machine-id r, owner /var/cache/debconf/ rw, owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk, @@ -73,23 +71,15 @@ profile dpkg-preconfigure @{exec_path} { owner /var/cache/dictionaries-common/flag-wordlist-new w, owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw, + owner @{tmp}/*.template.* rw, + owner @{tmp}/*.config.* rwPUx, + @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, @{run}/user/@{uid}/pk-debconf-socket rw, owner @{PROC}/@{pid}/fd/ r, - # The following is needed when dpkg-preconfigure uses debcconf GUI frontends. - include - include - include - include - capability dac_read_search, - @{bin}/lsb_release rPx -> lsb_release, - @{bin}/hostname rix, - @{HOME}/.Xauthority r, - owner @{PROC}/@{pid}/mounts r, - - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-statoverride b/apparmor.d/groups/apt/dpkg-statoverride new file mode 100644 index 000000000..34d6412c1 --- /dev/null +++ b/apparmor.d/groups/apt/dpkg-statoverride @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/dpkg-statoverride +profile dpkg-statoverride @{exec_path} flags=(complain) { + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From f033e698116aa250a14d32a442133d073b54a2d7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:21:23 +0200 Subject: [PATCH 0905/1455] feat(abs): add the pager app abstaction. --- apparmor.d/abstractions/app/pager | 37 ++++++++++++++++++++++++++ apparmor.d/groups/apt/apt | 13 +-------- apparmor.d/groups/apt/apt-listchanges | 17 +----------- apparmor.d/groups/apt/aptitude | 9 ------- apparmor.d/groups/children/child-pager | 25 +---------------- apparmor.d/profiles-m-r/mutt | 14 +--------- 6 files changed, 41 insertions(+), 74 deletions(-) create mode 100644 apparmor.d/abstractions/app/pager diff --git a/apparmor.d/abstractions/app/pager b/apparmor.d/abstractions/app/pager new file mode 100644 index 000000000..3be45b4dd --- /dev/null +++ b/apparmor.d/abstractions/app/pager @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no + +# Minimal set of rules for pagers. + + abi , + + include + + capability dac_override, + capability dac_read_search, + + signal (receive) set=(stop, cont, term, kill), + + @{bin}/ r, + @{pager_path} mrix, + + @{system_share_dirs}/terminfo/{,**} r, + /usr/share/file/misc/** r, + /usr/share/nvim/{,**} r, + + @{HOME}/.lesshst r, + + owner @{HOME}/ r, + owner @{HOME}/.lesshs* rw, + owner @{HOME}/.terminfo/@{int}/* r, + owner @{user_cache_dirs}/lesshs* rw, + owner @{user_state_dirs}/ r, + owner @{user_state_dirs}/lesshs* rw, + + /dev/tty@{int} rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index e2e9b00f4..2b103270d 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -172,18 +172,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { profile pager { include - include - - capability dac_read_search, - - @{bin}/ r, - @{sh_path} rix, - @{pager_path} rmix, - @{bin}/which rix, - - /root/ r, # For shell pwd - - owner @{HOME}/.less* rw, + include owner @{tmp}/apt-changelog-*/ r, owner @{tmp}/apt-changelog-*/*.changelog r, diff --git a/apparmor.d/groups/apt/apt-listchanges b/apparmor.d/groups/apt/apt-listchanges index 35684feb5..936d15d42 100644 --- a/apparmor.d/groups/apt/apt-listchanges +++ b/apparmor.d/groups/apt/apt-listchanges @@ -59,23 +59,8 @@ profile apt-listchanges @{exec_path} { profile pager { include - include + include - capability dac_read_search, - #capability sys_tty_config, - - @{pager_path} mrix, - - @{bin}/ r, - @{sh_path} rix, - @{bin}/which rix, - - owner @{HOME}/.less* rw, - - # For shell pwd - /root/ r, - - /tmp/ r, owner @{tmp}/apt-listchanges-tmp*.txt r, include if exists diff --git a/apparmor.d/groups/apt/aptitude b/apparmor.d/groups/apt/aptitude index e3a6a794b..e60630efa 100644 --- a/apparmor.d/groups/apt/aptitude +++ b/apparmor.d/groups/apt/aptitude @@ -171,17 +171,8 @@ profile aptitude @{exec_path} flags=(complain) { include include - @{bin}/ r, - @{editor_path} mrix, - @{sh_path} rix, - @{bin}/which rix, - - owner @{HOME}/.less* rw, owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw, - # For shell pwd - /root/ r, - include if exists } diff --git a/apparmor.d/groups/children/child-pager b/apparmor.d/groups/children/child-pager index e904f96dd..8e60bce47 100644 --- a/apparmor.d/groups/children/child-pager +++ b/apparmor.d/groups/children/child-pager @@ -15,30 +15,7 @@ include profile child-pager flags=(attach_disconnected) { include - include - - capability dac_override, - capability dac_read_search, - - signal (receive) set=(stop, cont, term, kill), - - @{bin}/ r, - @{pager_path} mr, - - @{system_share_dirs}/terminfo/{,**} r, - /usr/share/file/misc/** r, - /usr/share/nvim/{,**} r, - - @{HOME}/.lesshst r, - - owner @{HOME}/ r, - owner @{HOME}/.lesshs* rw, - owner @{HOME}/.terminfo/@{int}/* r, - owner @{user_cache_dirs}/lesshs* rw, - owner @{user_state_dirs}/ r, - owner @{user_state_dirs}/lesshs* rw, - - /dev/tty@{int} rw, + include include if exists } diff --git a/apparmor.d/profiles-m-r/mutt b/apparmor.d/profiles-m-r/mutt index 28006f479..a91aba241 100644 --- a/apparmor.d/profiles-m-r/mutt +++ b/apparmor.d/profiles-m-r/mutt @@ -115,19 +115,7 @@ profile mutt @{exec_path} { profile pager { include - include - - @{pager_path} mr, - - /usr/share/terminfo/** r, - /usr/share/file/misc/magic.mgc r, - - owner @{HOME}/ r, - owner @{HOME}/.lesshs* rw, - owner @{HOME}/.terminfo/@{int}/* r, - owner @{user_cache_dirs}/lesshs* rw, - owner @{user_state_dirs}/ r, - owner @{user_state_dirs}/lesshs* rw, + include # This is the file that holds the message owner /{var/,}tmp/mutt* rw, From 390cc27ab85e169efccdc6764eebc91123c54cd3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:24:01 +0200 Subject: [PATCH 0906/1455] feat(abs): add debconf common abs. --- apparmor.d/abstractions/common/debconf | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 apparmor.d/abstractions/common/debconf diff --git a/apparmor.d/abstractions/common/debconf b/apparmor.d/abstractions/common/debconf new file mode 100644 index 000000000..c21974212 --- /dev/null +++ b/apparmor.d/abstractions/common/debconf @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no + + abi , + + include + include + include + + /usr/share/debconf/frontend rix, + /usr/share/debconf/confmodule r, + + /etc/debconf.conf r, + + owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, + + include if exists + +# vim:syntax=apparmor From 49155625a5aaa32d5194f12405f65d48719d3d71 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:31:03 +0200 Subject: [PATCH 0907/1455] feat(profile): rewrite debconf & add debconf-frontend. --- apparmor.d/groups/apt/aptitude | 2 +- apparmor.d/groups/apt/debconf-apt-progress | 32 +---- apparmor.d/groups/apt/debconf-frontend | 75 ++++++++++ apparmor.d/groups/apt/dpkg-script-apparmor | 2 +- apparmor.d/groups/apt/dpkg-script-linux | 2 +- apparmor.d/groups/apt/dpkg-script-systemd | 2 +- apparmor.d/groups/apt/dpkg-scripts | 2 +- apparmor.d/groups/grub/grub-check-signatures | 10 +- apparmor.d/groups/grub/grub-multi-install | 2 +- apparmor.d/profiles-a-f/frontend | 133 ------------------ apparmor.d/profiles-s-z/tasksel | 49 +------ .../profiles-s-z/update-secureboot-policy | 5 +- 12 files changed, 92 insertions(+), 224 deletions(-) create mode 100644 apparmor.d/groups/apt/debconf-frontend delete mode 100644 apparmor.d/profiles-a-f/frontend diff --git a/apparmor.d/groups/apt/aptitude b/apparmor.d/groups/apt/aptitude index e60630efa..9254be27d 100644 --- a/apparmor.d/groups/apt/aptitude +++ b/apparmor.d/groups/apt/aptitude @@ -169,7 +169,7 @@ profile aptitude @{exec_path} flags=(complain) { profile pager { include - include + include owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw, diff --git a/apparmor.d/groups/apt/debconf-apt-progress b/apparmor.d/groups/apt/debconf-apt-progress index d60668c03..1d88c829b 100644 --- a/apparmor.d/groups/apt/debconf-apt-progress +++ b/apparmor.d/groups/apt/debconf-apt-progress @@ -10,42 +10,12 @@ include @{exec_path} = @{bin}/debconf-apt-progress profile debconf-apt-progress @{exec_path} flags=(complain) { include - include + include @{exec_path} r, @{bin}/apt-get rPx, - # Think what to do about this (#FIXME#) - /usr/share/debconf/frontend rPx, - #/usr/share/debconf/frontend rCx -> frontend, - - profile frontend flags=(complain) { - include - include - include - include - - /usr/share/debconf/frontend r, - - @{bin}/debconf-apt-progress rPx, - - @{sh_path} rix, - @{bin}/stty rix, - @{bin}/locale rix, - - # The following is needed when debconf uses dialog/whiptail frontend. - @{bin}/whiptail rPx, - - /etc/debconf.conf r, - owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, - /usr/share/debconf/templates/adequate.templates r, - - /etc/shadow r, - - include if exists - } - include if exists } diff --git a/apparmor.d/groups/apt/debconf-frontend b/apparmor.d/groups/apt/debconf-frontend new file mode 100644 index 000000000..5ec13fcff --- /dev/null +++ b/apparmor.d/groups/apt/debconf-frontend @@ -0,0 +1,75 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2019-2021 Mikhail Morfikov +# Copyright (C) 2022-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /usr/share/debconf/frontend +profile debconf-frontend @{exec_path} flags=(complain) { + include + include + include + include + include + include + + capability dac_read_search, + + @{exec_path} r, + + @{sh_path} rix, + @{bin}/hostname ix, + @{bin}/locale ix, + @{bin}/lsb_release Px -> lsb_release, + @{bin}/stty ix, + @{sbin}/update-secureboot-policy Px, + + # debconf apps + @{bin}/adequate Px, + @{bin}/debconf-apt-progress Px, + @{bin}/linux-check-removal Px, + @{bin}/ucf Px, + @{bin}/whiptail Px, + @{sbin}/aspell-autobuildhash Px, + @{sbin}/pam-auth-update Px, + @{lib}/tasksel/tasksel-debconf Px -> tasksel, + /usr/share/debian-security-support/check-support-status.hook Px, + + # Grub + @{lib}/grub/grub-multi-install Px, + /usr/share/grub/grub-check-signatures Px, + + # Package maintainer's scripts + /var/lib/dpkg/info/*.@{dpkg_script_ext} Px, + /var/lib/dpkg/info/*.control r, + /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px, + + # DKMS scipts + @{lib}/dkms/common.postinst rPUx, + @{lib}/dkms/dkms-* rPUx, + @{lib}/dkms/dkms_* rPUx, + + /usr/share/debconf/{,**} r, + + /etc/inputrc r, + /etc/shadow r, + + owner /var/cache/debconf/* rwk, + + owner @{tmp}/file* w, + owner @{tmp}/tmp.@{rand10} rw, + owner @{tmp}/updateppds.@{rand6} rw, + + @{HOME}/.Xauthority r, + + @{run}/user/@{uid}/pk-debconf-socket rw, + + owner @{PROC}/@{pid}/mounts r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index 5dba3d3cb..9de0ce0b4 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -9,7 +9,7 @@ include @{exec_path} = /var/lib/dpkg/info/apparmor* profile dpkg-script-apparmor @{exec_path} { include - include + include include @{exec_path} mrix, diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux index 8b2470a6c..52c74c192 100644 --- a/apparmor.d/groups/apt/dpkg-script-linux +++ b/apparmor.d/groups/apt/dpkg-script-linux @@ -9,7 +9,7 @@ include @{exec_path} = /var/lib/dpkg/info/linux* profile dpkg-script-linux @{exec_path} { include - include + include @{exec_path} mrix, diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd index ccaa62a30..cb652108d 100644 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -9,7 +9,7 @@ include @{exec_path} = /var/lib/dpkg/info/systemd* profile dpkg-script-systemd @{exec_path} { include - include + include include @{exec_path} mrix, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index dcb6ca379..32063f5c5 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -9,7 +9,7 @@ include @{exec_path} = /var/lib/dpkg/** profile dpkg-scripts @{exec_path} { include - include + include include capability chown, diff --git a/apparmor.d/groups/grub/grub-check-signatures b/apparmor.d/groups/grub/grub-check-signatures index d33b33265..310138595 100644 --- a/apparmor.d/groups/grub/grub-check-signatures +++ b/apparmor.d/groups/grub/grub-check-signatures @@ -9,18 +9,14 @@ include @{exec_path} = /usr/share/grub/grub-check-signatures profile grub-check-signatures @{exec_path} { include - include + include @{exec_path} mr, @{sh_path} rix, @{bin}/{m,g,}awk rix, - @{bin}//mktemp rix, - @{bin}//od rix, - - /usr/share/debconf/frontend rPx, - - /usr/share/debconf/confmodule r, + @{bin}/mktemp rix, + @{bin}/od rix, owner @{tmp}/tmp.@{rand10}/ rw, diff --git a/apparmor.d/groups/grub/grub-multi-install b/apparmor.d/groups/grub/grub-multi-install index d147b94fb..ba7956438 100644 --- a/apparmor.d/groups/grub/grub-multi-install +++ b/apparmor.d/groups/grub/grub-multi-install @@ -24,7 +24,7 @@ profile grub-multi-install @{exec_path} { @{bin}/sort rix, @{bin}/touch rix, @{bin}/udevadm rPx, - /usr/share/debconf/frontend rPx, + /usr/share/debconf/frontend rix, /usr/lib/terminfo/x/xterm-256color r, /usr/share/debconf/confmodule r, diff --git a/apparmor.d/profiles-a-f/frontend b/apparmor.d/profiles-a-f/frontend deleted file mode 100644 index 6d9502220..000000000 --- a/apparmor.d/profiles-a-f/frontend +++ /dev/null @@ -1,133 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov -# Copyright (C) 2022-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /usr/share/debconf/frontend -profile frontend @{exec_path} flags=(complain) { - include - include - include - include - include - include - include - include - - capability dac_read_search, - - @{exec_path} r, - @{bin}/perl r, - - @{sh_path} rix, - @{bin}/hostname rix, - @{bin}/locale rix, - @{bin}/lsb_release rPx -> lsb_release, - @{bin}/stty rix, - @{sbin}/update-secureboot-policy rPx, - - # debconf apps - @{bin}/adequate rPx, - @{sbin}/aspell-autobuildhash rPx, - @{bin}/debconf-apt-progress rPx, - @{bin}/linux-check-removal rPx, - @{sbin}/pam-auth-update rPx, - @{bin}/ucf rPx, - @{bin}/whiptail rPx, - @{lib}/tasksel/tasksel-debconf rPx -> tasksel, - /usr/share/debian-security-support/check-support-status.hook rPx, - - # Grub - @{lib}/grub/grub-multi-install rPx, - /usr/share/grub/grub-check-signatures rPx, - - # Run the package maintainer's scripts - # What to do with it? Maintainer scripts can use lots of tools. (#FIXME#) - #/var/lib/dpkg/info/*.{config,templates} rPUx, - #/var/lib/dpkg/info/*.{preinst,postinst} rPUx, - #/var/lib/dpkg/info/*.{prerm,postrm} rPUx, - /var/lib/dpkg/info/*.control r, - #/var/lib/dpkg/tmp.ci/{config,templates} rPUx, - #/var/lib/dpkg/tmp.ci/{preinst,postinst} rPUx, - #/var/lib/dpkg/tmp.ci/{prerm,postrm} rPUx, - /var/lib/dpkg/tmp.ci/control r, - /var/lib/dpkg/info/*.{config,templates} rCx -> scripts, - /var/lib/dpkg/info/*.{preinst,postinst} rCx -> scripts, - /var/lib/dpkg/info/*.{prerm,postrm} rCx -> scripts, - /var/lib/dpkg/tmp.ci/{config,templates} rCx -> scripts, - /var/lib/dpkg/tmp.ci/{preinst,postinst} rCx -> scripts, - /var/lib/dpkg/tmp.ci/{prerm,postrm} rCx -> scripts, - - # DKMS scipts - # What to do with it? (#FIXME#) - @{lib}/dkms/common.postinst rPUx, - @{lib}/dkms/dkms-* rPUx, - @{lib}/dkms/dkms_* rPUx, - - /usr/share/debconf/{,**} r, - - /etc/debconf.conf r, - /etc/inputrc r, - /etc/shadow r, - - owner /var/cache/debconf/* rwk, - - owner @{tmp}/file* w, - owner @{tmp}/tmp.@{rand10} rw, - owner @{tmp}/updateppds.@{rand6} rw, - - @{HOME}/.Xauthority r, - - @{run}/user/@{uid}/pk-debconf-socket rw, - - owner @{PROC}/@{pid}/mounts r, - - profile scripts flags=(complain) { - include - include - - capability dac_read_search, - - /var/lib/dpkg/info/*.config r, - /var/lib/dpkg/info/*.{preinst,postinst} r, - /var/lib/dpkg/info/*.{prerm,postrm} r, - /var/lib/dpkg/tmp.ci/config r, - /var/lib/dpkg/tmp.ci/{preinst,postinst} r, - /var/lib/dpkg/tmp.ci/{prerm,postrm} r, - - / r, - - @{bin}/ r, - @{bin}/* rPUx, - - @{lib}/ r, - @{lib}/** rPUx, - - /usr/share/ r, - /usr/share/** rPUx, - - /etc/init.d/ r, - /etc/init.d/* rPUx, - - /etc/ r, - /etc/** rw, - /var/ r, - /var/** rw, - @{sys}/ r, - @{sys}/**/ r, - @{run}/ r, - @{run}/** rw, - /tmp/ r, - owner @{tmp}/** rw, - - include if exists - } - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/tasksel b/apparmor.d/profiles-s-z/tasksel index 64b3ed4ad..f4900f225 100644 --- a/apparmor.d/profiles-s-z/tasksel +++ b/apparmor.d/profiles-s-z/tasksel @@ -10,32 +10,24 @@ include @{exec_path} = @{bin}/tasksel profile tasksel @{exec_path} flags=(complain) { include - include + include @{exec_path} r, @{sh_path} rix, @{bin}/tempfile rix, @{lib}/tasksel/tasksel-debconf rix, - - @{lib}/tasksel/tests/* rCx -> tasksel-tests, - - # Think what to do about this (#FIXME#) - /usr/share/debconf/frontend rPx, - #/usr/share/debconf/frontend rCx -> frontend, + @{lib}/tasksel/tests/* Cx -> tasksel-tests, # Do not strip env to avoid errors like the following: # ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open # shared object file): ignored. - @{bin}/dpkg-query rpx, + @{bin}/dpkg-query px, # - @{bin}/apt-cache rPx, + @{bin}/apt-cache Px, + @{bin}/debconf-apt-progress Px, - @{bin}/debconf-apt-progress rPx, - - /usr/share/tasksel/** r, - - /usr/share/debconf/confmodule r, + /usr/share/tasksel/{,**} r, owner @{tmp}/file* w, @@ -48,35 +40,6 @@ profile tasksel @{exec_path} flags=(complain) { include if exists } - profile frontend flags=(complain) { - include - include - include - include - - /usr/share/debconf/frontend r, - - @{bin}/tasksel rPx, - - @{sh_path} rix, - @{bin}/stty rix, - @{bin}/locale rix, - - # The following is needed when debconf uses dialog/whiptail frontend. - @{bin}/whiptail rPx, - owner @{tmp}/file* w, - - /usr/share/debconf/confmodule r, - - /etc/debconf.conf r, - owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, - /usr/share/debconf/templates/adequate.templates r, - - /etc/shadow r, - - include if exists - } - include if exists } diff --git a/apparmor.d/profiles-s-z/update-secureboot-policy b/apparmor.d/profiles-s-z/update-secureboot-policy index 232c92d0c..f8581f532 100644 --- a/apparmor.d/profiles-s-z/update-secureboot-policy +++ b/apparmor.d/profiles-s-z/update-secureboot-policy @@ -10,7 +10,7 @@ include @{exec_path} = @{sbin}/update-secureboot-policy profile update-secureboot-policy @{exec_path} { include - include + include @{exec_path} rm, @@ -23,12 +23,9 @@ profile update-secureboot-policy @{exec_path} { @{bin}/sort rix, @{bin}/touch rix, @{bin}/wc rix, - /usr/share/debconf/frontend rPx, / r, - /usr/share/debconf/confmodule r, - /var/lib/dkms/ r, /var/lib/shim-signed/dkms-list rw, From 6e0c646d14c17a9f2ce9ba6f4faa3afbf38c115d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:37:37 +0200 Subject: [PATCH 0908/1455] feat(profile): add profile for ischroot. --- apparmor.d/groups/apt/apt | 4 ++-- apparmor.d/groups/ubuntu/apport-gtk | 2 +- .../groups/ubuntu/check-new-release-gtk | 2 +- apparmor.d/groups/ubuntu/do-release-upgrade | 2 +- .../groups/ubuntu/list-oem-metapackages | 2 +- .../groups/ubuntu/software-properties-gtk | 2 +- apparmor.d/groups/ubuntu/ubuntu-advantage | 3 +-- apparmor.d/groups/ubuntu/update-manager | 2 +- .../ubuntu/update-motd-updates-available | 2 +- apparmor.d/groups/ubuntu/update-notifier | 2 +- apparmor.d/profiles-g-l/ischroot | 21 +++++++++++++++++++ apparmor.d/profiles-m-r/packagekitd | 4 ++-- apparmor.d/profiles-s-z/update-initramfs | 2 +- 13 files changed, 35 insertions(+), 15 deletions(-) create mode 100644 apparmor.d/profiles-g-l/ischroot diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 2b103270d..2a0969156 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -67,7 +67,6 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{bin}/echo rix, @{bin}/gdbus rix, @{bin}/id rix, - @{bin}/ischroot rix, @{bin}/test rix, @{bin}/touch rix, @@ -80,14 +79,15 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{bin}/df rPx, @{bin}/dmesg rPx, @{bin}/dpkg rPx, - @{sbin}/dpkg-preconfigure rPx, @{bin}/dpkg-source rcx -> dpkg-source, @{bin}/etckeeper rPx, + @{bin}/ischroot rPx, @{bin}/localepurge rPx, @{bin}/ps rPx, @{bin}/snap rPx, @{bin}/systemctl rCx -> systemctl, @{bin}/update-command-not-found rPx, + @{sbin}/dpkg-preconfigure rPx, @{lib}/cnf-update-db rPx, @{lib}/needrestart/apt-pinvoke rPx, @{lib}/zsys-system-autosnapshot rPx, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 1307313d9..bb5cd329c 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -41,7 +41,7 @@ profile apport-gtk @{exec_path} { @{bin}/dpkg-query rpx, @{bin}/gdb rCx -> gdb, @{bin}/gsettings rPx, - @{bin}/ischroot rix, + @{bin}/ischroot rPx, @{bin}/journalctl rPx, @{sbin}/killall5 rix, @{bin}/kmod rPx, diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index 1ff6df2ae..bdd2a0f54 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -29,7 +29,7 @@ profile check-new-release-gtk @{exec_path} { @{exec_path} mr, @{bin}/dpkg rPx, - @{bin}/ischroot rix, + @{bin}/ischroot rPx, @{bin}/lsb_release rPx -> lsb_release, @{lib}/@{python_name}/dist-packages/UpdateManager/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, diff --git a/apparmor.d/groups/ubuntu/do-release-upgrade b/apparmor.d/groups/ubuntu/do-release-upgrade index 86c211f24..e7d6687d2 100644 --- a/apparmor.d/groups/ubuntu/do-release-upgrade +++ b/apparmor.d/groups/ubuntu/do-release-upgrade @@ -26,7 +26,7 @@ profile do-release-upgrade @{exec_path} { @{exec_path} mr, @{bin}/dpkg rPx -> child-dpkg, - @{bin}/ischroot rix, + @{bin}/ischroot rPx, @{bin}/lsb_release rPx -> lsb_release, /usr/share/distro-info/*.csv r, diff --git a/apparmor.d/groups/ubuntu/list-oem-metapackages b/apparmor.d/groups/ubuntu/list-oem-metapackages index 75e4279f2..91bc4876f 100644 --- a/apparmor.d/groups/ubuntu/list-oem-metapackages +++ b/apparmor.d/groups/ubuntu/list-oem-metapackages @@ -15,7 +15,7 @@ profile list-oem-metapackages @{exec_path} { @{exec_path} mr, @{bin}/dpkg rPx -> child-dpkg, - @{bin}/ischroot rix, + @{bin}/ischroot rPx, @{lib}/@{python_name}/dist-packages/UbuntuDrivers/__pycache__/*.cpython-@{int}.pyc.@{int} rw, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index e2bb2dc98..d5762a84e 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -32,7 +32,7 @@ profile software-properties-gtk @{exec_path} { @{bin}/aplay rPx, @{bin}/apt-key rPx, @{bin}/dpkg rPx -> child-dpkg, - @{bin}/ischroot rix, + @{bin}/ischroot rPx, @{bin}/lsb_release rPx -> lsb_release, @{bin}/ubuntu-advantage rPx, diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index 7d797bd97..34b697732 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -29,13 +29,12 @@ profile ubuntu-advantage @{exec_path} { @{exec_path} mr, - @{bin}/ischroot rix, - @{bin}/apt rPx, @{bin}/apt-cache rPx, @{bin}/apt-config rPx, @{bin}/apt-get rPx, @{bin}/dpkg rPx -> child-dpkg, + @{bin}/ischroot rPx, @{bin}/ps rPx, @{bin}/snap rPUx, @{bin}/systemctl rCx -> systemctl, diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 44e0cc403..e1636c6d5 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -44,7 +44,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/dpkg rPx -> child-dpkg, @{bin}/hwe-support-status rPx, - @{bin}/ischroot rix, + @{bin}/ischroot rPx, @{bin}/lsb_release rPx -> lsb_release, @{bin}/snap rPUx, @{bin}/software-properties-gtk rPx, diff --git a/apparmor.d/groups/ubuntu/update-motd-updates-available b/apparmor.d/groups/ubuntu/update-motd-updates-available index 776cc9bf8..e6a3e7152 100644 --- a/apparmor.d/groups/ubuntu/update-motd-updates-available +++ b/apparmor.d/groups/ubuntu/update-motd-updates-available @@ -26,7 +26,7 @@ profile update-motd-updates-available @{exec_path} { @{bin}/dirname rix, @{bin}/dpkg rPx -> child-dpkg, @{bin}/find rix, - @{bin}/ischroot rix, + @{bin}/ischroot rPx, @{bin}/lsb_release rPx -> lsb_release, @{bin}/mktemp rix, @{bin}/mv rix, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 8d1571c1e..ea6318156 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -31,10 +31,10 @@ profile update-notifier @{exec_path} { @{sh_path} rix, @{bin}/ionice rix, - @{bin}/ischroot rix, @{bin}/nice rix, @{bin}/dpkg rPx -> child-dpkg, + @{bin}/ischroot rPx, @{bin}/lsb_release rPx -> lsb_release, @{bin}/pkexec rCx -> pkexec, @{bin}/snap rPUx, diff --git a/apparmor.d/profiles-g-l/ischroot b/apparmor.d/profiles-g-l/ischroot new file mode 100644 index 000000000..c5b848bab --- /dev/null +++ b/apparmor.d/profiles-g-l/ischroot @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ischroot +profile ischroot @{exec_path} { + include + include + + @{exec_path} mr, + + @{PROC}/@{pid}/mountinfo r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index ca93ade6b..873b4ef7d 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -51,7 +51,6 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { @{bin}/echo rix, @{bin}/gdbus rix, @{bin}/gzip rix, - @{bin}/ischroot rix, @{sbin}/ldconfig rix, @{bin}/repo2solv rix, @{bin}/tar rix, @@ -63,7 +62,8 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { @{bin}/dpkg rPx -> child-dpkg, #aa:only apt @{bin}/fc-cache rPx, @{bin}/glib-compile-schemas rPx, - @{sbin}/install-info rPx, + @{bin}/install-info rPx, + @{bin}/ischroot rPx, @{bin}/rpm rPUx, #aa:only opensuse @{bin}/rpmdb2solv rPUx, #aa:only opensuse @{bin}/systemd-inhibit rPx, diff --git a/apparmor.d/profiles-s-z/update-initramfs b/apparmor.d/profiles-s-z/update-initramfs index 51961efb3..f9e47cb52 100644 --- a/apparmor.d/profiles-s-z/update-initramfs +++ b/apparmor.d/profiles-s-z/update-initramfs @@ -22,7 +22,6 @@ profile update-initramfs @{exec_path} { @{bin}/cat rix, @{bin}/{m,g,}awk rix, @{bin}/getopt rix, - @{bin}/ischroot rix, @{bin}/ln rix, @{bin}/mv rix, @{bin}/rm rix, @@ -31,6 +30,7 @@ profile update-initramfs @{exec_path} { @{bin}/uname rix, @{bin}/dpkg-trigger rPx, + @{bin}/ischroot rPx, @{bin}/linux-version rPx, @{sbin}/mkinitramfs rPx, From 7a3016724a6a2a97e337d57187416cabb6dcdfb0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:42:34 +0200 Subject: [PATCH 0909/1455] feat(profile): update linux check scripts. --- apparmor.d/profiles-g-l/linux-check-removal | 40 ++++--------------- apparmor.d/profiles-g-l/linux-update-symlinks | 25 ++++++++++++ dists/flags/main.flags | 2 + 3 files changed, 34 insertions(+), 33 deletions(-) create mode 100644 apparmor.d/profiles-g-l/linux-update-symlinks diff --git a/apparmor.d/profiles-g-l/linux-check-removal b/apparmor.d/profiles-g-l/linux-check-removal index 1c6ff2f03..2c2a8ba21 100644 --- a/apparmor.d/profiles-g-l/linux-check-removal +++ b/apparmor.d/profiles-g-l/linux-check-removal @@ -10,42 +10,16 @@ include @{exec_path} = @{bin}/linux-check-removal profile linux-check-removal @{exec_path} flags=(complain) { include - include - include + include - @{exec_path} r, + @{exec_path} rmix, - # Think what to do about this (#FIXME#) - /usr/share/debconf/frontend rPx, - #/usr/share/debconf/frontend rCx -> frontend, + @{sh_path} rix, + @{bin}/stty rix, + @{bin}/locale rix, + @{bin}/whiptail rPx, - - profile frontend flags=(complain) { - include - include - include - include - - /usr/share/debconf/frontend r, - - @{bin}/linux-check-removal rPx, - - @{sh_path} rix, - @{bin}/stty rix, - @{bin}/locale rix, - - # The following is needed when debconf uses dialog/whiptail frontend. - @{bin}/whiptail rPx, - owner @{tmp}/file* w, - - /usr/share/debconf/confmodule r, - - /etc/debconf.conf r, - owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, - /usr/share/debconf/templates/adequate.templates r, - - include if exists - } + audit owner @{tmp}/file* w, include if exists } diff --git a/apparmor.d/profiles-g-l/linux-update-symlinks b/apparmor.d/profiles-g-l/linux-update-symlinks new file mode 100644 index 000000000..b97a0305b --- /dev/null +++ b/apparmor.d/profiles-g-l/linux-update-symlinks @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/linux-update-symlinks +profile linux-update-symlinks @{exec_path} { + include + include + include + + @{exec_path} mr, + + /etc/kernel-img.conf r, + + @{efi}/ r, + @{efi}/* rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index d2c57b682..edf6789c7 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -216,6 +216,8 @@ libvirt-dbus complain libvirtd attach_disconnected,complain lightdm attach_disconnected,complain lightdm-session complain +linux-check-removal complain +linux-update-symlinks complain locale-gen complain localectl complain localsearch complain From 8755c4a1b7c036ecc0b905bf57a75b42f7c614b1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:51:12 +0200 Subject: [PATCH 0910/1455] fix(profile): remove sbin on some program path Debian and opensuse do not install the same programs under /usr/sbin. This will have to be tracked by distribution. For now, sbin.list follows debian install. --- apparmor.d/groups/gnome/gnome-initial-setup | 2 +- apparmor.d/groups/kde/systemsettings | 2 +- apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/groups/utils/lspci | 2 +- apparmor.d/profiles-a-f/adequate | 2 +- apparmor.d/profiles-g-l/hardinfo | 2 +- apparmor.d/profiles-g-l/install-info | 2 +- apparmor.d/profiles-g-l/inxi | 2 +- apparmor.d/profiles-s-z/update-alternatives | 2 +- tests/sbin.list | 3 --- 10 files changed, 9 insertions(+), 12 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index cf7dc2506..4063fc473 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -42,7 +42,7 @@ profile gnome-initial-setup @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/locale rix, @{bin}/lscpu rPx, - @{sbin}/lspci rPx, + @{bin}/lspci rPx, @{bin}/xrandr rPx, @{lib}/gnome-initial-setup-goa-helper rix, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index 0d7156502..e68d248b6 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -29,7 +29,7 @@ profile systemsettings @{exec_path} { @{bin}/cat rix, @{bin}/eglinfo rPUx, @{bin}/kcminit rPx, - @{sbin}/lspci rPx, + @{bin}/lspci rPx, @{bin}/openssl rix, @{bin}/pactl rPx, @{bin}/plasma-discover rPx, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 9cf9d6a36..6af9bae96 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -74,7 +74,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/gtk{,4}-update-icon-cache rPx, @{sbin}/iconvconfig rix, @{bin}/install-catalog rPx, - @{sbin}/install-info rPx, + @{bin}/install-info rPx, @{sbin}/iscsi-iname rix, @{bin}/journalctl rPx, @{bin}/killall rix, diff --git a/apparmor.d/groups/utils/lspci b/apparmor.d/groups/utils/lspci index 7fc88e41a..b390346bb 100644 --- a/apparmor.d/groups/utils/lspci +++ b/apparmor.d/groups/utils/lspci @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/lspci +@{exec_path} = @{bin}/lspci profile lspci @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-a-f/adequate b/apparmor.d/profiles-a-f/adequate index c4741b09a..6999f5baf 100644 --- a/apparmor.d/profiles-a-f/adequate +++ b/apparmor.d/profiles-a-f/adequate @@ -34,7 +34,7 @@ profile adequate @{exec_path} flags=(complain) { # shared object file): ignored. @{bin}/dpkg-query rpx, # - @{sbin}/update-alternatives rPx, + @{bin}/update-alternatives rPx, /var/lib/adequate/pending rwk, diff --git a/apparmor.d/profiles-g-l/hardinfo b/apparmor.d/profiles-g-l/hardinfo index 459efa23e..97fad1f13 100644 --- a/apparmor.d/profiles-g-l/hardinfo +++ b/apparmor.d/profiles-g-l/hardinfo @@ -53,7 +53,7 @@ profile hardinfo @{exec_path} { @{bin}/glxinfo rPx, @{bin}/xdpyinfo rPx, - @{sbin}/lspci rPx, + @{bin}/lspci rPx, @{bin}/lsusb rPx, @{bin}/netstat rPx, @{bin}/qtchooser rPx, diff --git a/apparmor.d/profiles-g-l/install-info b/apparmor.d/profiles-g-l/install-info index e7fdfd95a..f155339b1 100644 --- a/apparmor.d/profiles-g-l/install-info +++ b/apparmor.d/profiles-g-l/install-info @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/install-info +@{exec_path} = @{bin}/install-info profile install-info @{exec_path} { include include diff --git a/apparmor.d/profiles-g-l/inxi b/apparmor.d/profiles-g-l/inxi index 01d358fbf..38b2a17a2 100644 --- a/apparmor.d/profiles-g-l/inxi +++ b/apparmor.d/profiles-g-l/inxi @@ -51,7 +51,7 @@ profile inxi @{exec_path} { @{bin}/glxinfo rPx, @{bin}/hddtemp rPx, @{bin}/lsblk rPx, - @{sbin}/lspci rPx, + @{bin}/lspci rPx, @{bin}/lsusb rPx, @{bin}/openbox rPx, @{bin}/ps rPx, diff --git a/apparmor.d/profiles-s-z/update-alternatives b/apparmor.d/profiles-s-z/update-alternatives index 68ddb97a5..8f08b74fa 100644 --- a/apparmor.d/profiles-s-z/update-alternatives +++ b/apparmor.d/profiles-s-z/update-alternatives @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/update-alternatives +@{exec_path} = @{bin}/update-alternatives profile update-alternatives @{exec_path} { include include diff --git a/tests/sbin.list b/tests/sbin.list index 869729543..82596a62a 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -341,7 +341,6 @@ inputattach insmod install_acx100_firmware install_intersil_firmware -install-info install-sgmlcatalog installkernel integritysetup @@ -447,7 +446,6 @@ lpc lpinfo lpmove lsmod -lspci lspcmcia luksformat lvchange @@ -920,7 +918,6 @@ unix_chkpwd unix_update unix2_chkpwd uobjnew -update-alternatives update-bootloader update-ca-certificates update-catalog From a9303e82bb0310336b995210da042bbb21fdc99c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:53:04 +0200 Subject: [PATCH 0911/1455] fix: linter --- apparmor.d/groups/apt/dpkg-preconfigure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index fd67f930e..8a9ea568e 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -79,7 +79,7 @@ profile dpkg-preconfigure @{exec_path} { owner @{PROC}/@{pid}/fd/ r, - include if exists + include if exists } # vim:syntax=apparmor From 6650f45ee0c25967f5e85cb95c79f7b332d135f2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 18 May 2025 23:54:33 +0200 Subject: [PATCH 0912/1455] feat(profile): add pycompile. --- apparmor.d/profiles-m-r/pycompile | 54 +++++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 55 insertions(+) create mode 100644 apparmor.d/profiles-m-r/pycompile diff --git a/apparmor.d/profiles-m-r/pycompile b/apparmor.d/profiles-m-r/pycompile new file mode 100644 index 000000000..b441d84cd --- /dev/null +++ b/apparmor.d/profiles-m-r/pycompile @@ -0,0 +1,54 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/py{,3}compile @{bin}/py{,3}clean +profile pycompile @{exec_path} flags=(attach_disconnected,complain) { + include + include + include + # include + + capability dac_override, + capability dac_read_search, + + @{exec_path} mr, + @{python_path} rix, + + @{bin}/dpkg rCx -> dpkg, + + @{lib}/@{python_name}/dist-packages/__pycache__/ w, + @{lib}/@{python_name}/dist-packages/__pycache__/*.pyc w, + @{lib}/@{python_name}/dist-packages/__pycache__/*.pyc.* w, + @{lib}/@{python_name}/dist-packages/**/__pycache__/ w, + @{lib}/@{python_name}/dist-packages/**/__pycache__/*.pyc w, + @{lib}/@{python_name}/dist-packages/**/__pycache__/*.pyc.* w, + + /usr/share/python3/{,**} r, + + / r, + + profile dpkg { + include + include + include + + capability dac_read_search, + + @{bin}/dpkg mr, + @{bin}/dpkg-query rpx, + + /etc/dpkg/dpkg.cfg.d/{,*} r, + /etc/dpkg/dpkg.cfg r, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index edf6789c7..4332c78d9 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -264,6 +264,7 @@ plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted ptyxis complain ptyxis-agent complain +pycompile complain qdbus complain remmina complain run-parts complain From 31e90e6c58574d45aac59a91ebd094d6a05f6919 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 19 May 2025 00:00:44 +0200 Subject: [PATCH 0913/1455] feat(profile): add kernel update/install profiles. --- apparmor.d/profiles-g-l/kdump-config | 60 ++++++++++++++++ apparmor.d/profiles-g-l/kernel | 71 +++++++++++++++++++ apparmor.d/profiles-g-l/kernel-postinst-kdump | 34 +++++++++ dists/flags/main.flags | 3 + 4 files changed, 168 insertions(+) create mode 100644 apparmor.d/profiles-g-l/kdump-config create mode 100644 apparmor.d/profiles-g-l/kernel create mode 100644 apparmor.d/profiles-g-l/kernel-postinst-kdump diff --git a/apparmor.d/profiles-g-l/kdump-config b/apparmor.d/profiles-g-l/kdump-config new file mode 100644 index 000000000..e6ec78f67 --- /dev/null +++ b/apparmor.d/profiles-g-l/kdump-config @@ -0,0 +1,60 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/kdump-config +profile kdump-config @{exec_path} { + include + + ptrace readby peer=systemd-journald, + + @{exec_path} mr, + + @{sh_path} ix, + @{bin}/basename ix, + @{bin}/cut ix, + @{bin}/file ix, + @{bin}/find ix, + @{bin}/grep ix, + @{bin}/hexdump ix, + @{bin}/ln ix, + @{bin}/logger ix, + @{bin}/rev ix, + @{bin}/run-parts ix, + @{bin}/sed ix, + @{sbin}/kexec Cx -> kexec, + @{sbin}/sysctl Cx -> sysctl, + + /etc/kernel/postinst.d/kdump-tools rPx, + + owner /var/lib/kdump/{,**} rw, + + profile sysctl { + include + + @{sbin}/sysctl mr, + + @{PROC}/sys/kernel/panic_on_oops rw, + + include if exists + } + + profile kexec { + include + + capability sys_admin, + capability sys_boot, + + @{sbin}/kexec mr, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel new file mode 100644 index 000000000..2382ea062 --- /dev/null +++ b/apparmor.d/profiles-g-l/kernel @@ -0,0 +1,71 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/kernel/{,header_}postinst.d/* /etc/kernel/postrm.d/* +@{exec_path} += /etc/kernel/preinst.d/* /etc/kernel/prerm.d/* +profile kernel @{exec_path} { + include + include + include + + capability sys_module, + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/{,e}grep rix, + @{bin}/{,m,g}awk rix, + @{bin}/cat rix, + @{bin}/chmod rix, + @{bin}/cut rix, + @{bin}/dirname rix, + @{bin}/kmod rix, + @{bin}/mv rix, + @{bin}/rm rix, + @{bin}/rmdir rix, + @{bin}/sed rix, + @{bin}/sort rix, + @{bin}/touch rix, + @{bin}/tr rix, + @{bin}/uname rix, + @{bin}/which rix, + + @{bin}/apt-config rPx, + @{bin}/dpkg rPx -> child-dpkg, + @{bin}/systemd-detect-virt rPx, + @{bin}/update-alternatives rPx, + @{sbin}/dkms rPx, + @{sbin}/update-grub rPx, + @{sbin}/update-initramfs rPx, + @{lib}/dkms/dkms_autoinstaller rPx, + + @{lib}/modules/*/updates/ w, + @{lib}/modules/*/updates/dkms/ w, + + /etc/kernel/header_postinst.d/* r, + /etc/kernel/{postinst,postrm,preinst,prerm}.d/* r, + + # For shell pwd + / r, + /boot/ r, + + /etc/apt/apt.conf.d/ r, + /etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw, + /etc/modprobe.d/ r, + /etc/modprobe.d/*.conf r, + + @{run}/reboot-required w, + @{run}/reboot-required.pkgs rw, + + @{PROC}/devices r, + @{PROC}/cmdline r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/kernel-postinst-kdump b/apparmor.d/profiles-g-l/kernel-postinst-kdump new file mode 100644 index 000000000..91af3a842 --- /dev/null +++ b/apparmor.d/profiles-g-l/kernel-postinst-kdump @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/kernel/postinst.d/kdump-tools +profile kernel-postinst-kdump @{exec_path} { + include + + @{exec_path} mr, + + @{bin}/du rix, + @{bin}/find rix, + @{bin}/gawk rix, + @{bin}/mv rix, + @{bin}/rm rix, + @{bin}/sync rix, + @{sbin}/mkinitramfs rPx, + + owner /var/lib/kdump/* w, + + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**, + owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 4332c78d9..5f5d8dc5f 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -192,7 +192,10 @@ kconf_update complain kde-powerdevil attach_disconnected,mediate_deleted,complain kde-systemd-start-condition complain kded complain +kdump-config complain +kernel complain kernel-install complain +kernel-postinst-kdump complain keyboxd complain kglobalacceld complain kio_http_cache_cleaner complain From b90c4073c94f06e83a16677398d338c05f5df395 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 23 May 2025 23:55:01 +0200 Subject: [PATCH 0914/1455] ci: show full journalctl log on failure. --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f04ac1381..4593fe78c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -55,7 +55,7 @@ jobs: - name: Reload AppArmor run: | sudo systemctl restart apparmor.service || true - sudo systemctl status apparmor.service + sudo journalctl -xeu apparmor.service - name: Ensure compatibility with some AppArmor userspace tools if: matrix.os != 'ubuntu-24.04' From f3ed1a30065065300a0b5dca307f9081f9501025 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 24 May 2025 00:08:57 +0200 Subject: [PATCH 0915/1455] fix: profile compilation. --- apparmor.d/profiles-g-l/linux-check-removal | 2 +- dists/flags/main.flags | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-g-l/linux-check-removal b/apparmor.d/profiles-g-l/linux-check-removal index 2c2a8ba21..40eb26b93 100644 --- a/apparmor.d/profiles-g-l/linux-check-removal +++ b/apparmor.d/profiles-g-l/linux-check-removal @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/linux-check-removal -profile linux-check-removal @{exec_path} flags=(complain) { +profile linux-check-removal @{exec_path} { include include diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 5f5d8dc5f..d139c7622 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -219,7 +219,7 @@ libvirt-dbus complain libvirtd attach_disconnected,complain lightdm attach_disconnected,complain lightdm-session complain -linux-check-removal complain +linux-check-removal complain linux-update-symlinks complain locale-gen complain localectl complain From 3848838e53a5824417590f97c43ad0135a50e6a1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 24 May 2025 17:35:16 +0200 Subject: [PATCH 0916/1455] feat(profile): merge dpkg-scripts and dpkg-script-tmp. --- apparmor.d/groups/apt/dpkg-preconfigure | 2 + apparmor.d/groups/apt/dpkg-script-systemd | 2 + apparmor.d/groups/apt/dpkg-script-tmp | 57 ----------------------- apparmor.d/groups/apt/dpkg-scripts | 17 +++++-- dists/flags/main.flags | 1 - 5 files changed, 16 insertions(+), 63 deletions(-) delete mode 100644 apparmor.d/groups/apt/dpkg-script-tmp diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index 8a9ea568e..4dbfae0a8 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -15,6 +15,8 @@ profile dpkg-preconfigure @{exec_path} { include include + capability dac_read_search, + @{exec_path} r, @{sh_path} rix, diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd index cb652108d..713f2981f 100644 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -16,6 +16,8 @@ profile dpkg-script-systemd @{exec_path} { @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/bootctl Px, @{bin}/deb-systemd-helper Px, @{bin}/deb-systemd-invoke Px, @{bin}/dpkg Cx -> dpkg, diff --git a/apparmor.d/groups/apt/dpkg-script-tmp b/apparmor.d/groups/apt/dpkg-script-tmp deleted file mode 100644 index 65e63d076..000000000 --- a/apparmor.d/groups/apt/dpkg-script-tmp +++ /dev/null @@ -1,57 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2025 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} -profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) { - include - include - include - - @{exec_path} mrix, - - @{sh_path} rix, - @{coreutils_path} rix, - @{bin}/run-parts rix, - @{bin}/deb-systemd-invoke Px, - @{bin}/dpkg Px, - @{bin}/dpkg-divert Px, - @{bin}/dpkg-maintscript-helper Px, - @{bin}/kmod Cx -> kmod, - @{bin}/systemctl Cx -> systemctl, - /usr/share/debconf/frontend Px, - - /usr/share/debconf/confmodule r, - - /etc/kernel/preinst.d/*-microcode ix, - - @{lib}/modules/*/.fresh-install w, - - profile kmod { - include - include - - include if exists - } - - profile systemctl { - include - include - - capability net_admin, - capability sys_ptrace, - capability sys_resource, - - @{bin}/systemd-tty-ask-password-agent Px, - - include if exists - } - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 32063f5c5..e765b334c 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -38,6 +38,7 @@ profile dpkg-scripts @{exec_path} { @{lib}/ubuntu-advantage/postinst-migrations.sh ix, @{bin}/dbus-send Cx -> bus, + @{bin}/kmod Cx -> kmod, @{bin}/dpkg Px -> child-dpkg, @{bin}/systemctl Cx -> systemctl, @{sbin}/invoke-rc.d Cx -> rc, @@ -52,9 +53,6 @@ profile dpkg-scripts @{exec_path} { /usr/share/** Px, /etc/init.d/* Px, - /var/lib/dpkg/info/*.@{dpkg_script_ext} ix, # dpkg-scripts-* - /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px, # dpkg-script-tmp - # Maintainer's scripts can update a lot of files / r, /*/ r, @@ -85,12 +83,20 @@ profile dpkg-scripts @{exec_path} { include if exists } + profile kmod { + include + include + + include if exists + } + profile systemctl { include include capability net_admin, capability sys_ptrace, + capability sys_resource, @{run}/utmp rk, @@ -99,6 +105,7 @@ profile dpkg-scripts @{exec_path} { profile rc { include + include include @{sbin}/update-rc.d mr, @@ -110,10 +117,10 @@ profile dpkg-scripts @{exec_path} { /etc/ r, /etc/init.d/* r, - /etc/rc?.d/ r, + /etc/rc@{c}.d/ r, + /etc/rc@{c}.d/* rw, /etc/rc@{int}.d/ r, /etc/rc@{int}.d/* rw, - /etc/rc@{c}.d/* rw, include if exists } diff --git a/dists/flags/main.flags b/dists/flags/main.flags index d139c7622..b1bd2fa0e 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -93,7 +93,6 @@ dpkg-script-apparmor complain dpkg-script-kmod complain dpkg-script-linux complain dpkg-script-systemd complain -dpkg-script-tmp complain dpkg-scripts complain drkonqi complain drkonqi-coredump-cleanup complain From d5926e9411f224cf094506c9cae221b84d740b20 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 24 May 2025 17:48:15 +0200 Subject: [PATCH 0917/1455] feat(abs): update debconf abs. --- apparmor.d/abstractions/common/debconf | 7 +++ apparmor.d/groups/apt/debconf-frontend | 5 +- apparmor.d/groups/apt/dpkg-script-apparmor | 2 - apparmor.d/groups/apt/dpkg-script-linux | 4 -- apparmor.d/groups/apt/dpkg-script-systemd | 3 -- apparmor.d/groups/apt/dpkg-scripts | 1 - apparmor.d/groups/grub/grub-check-signatures | 7 ++- apparmor.d/profiles-g-l/linux-check-removal | 5 -- apparmor.d/profiles-m-r/needrestart | 9 +++- apparmor.d/profiles-m-r/pam-auth-update | 48 ++----------------- apparmor.d/profiles-s-z/tasksel | 9 ++-- .../profiles-s-z/update-secureboot-policy | 17 ++++--- 12 files changed, 35 insertions(+), 82 deletions(-) diff --git a/apparmor.d/abstractions/common/debconf b/apparmor.d/abstractions/common/debconf index c21974212..1d9a6d145 100644 --- a/apparmor.d/abstractions/common/debconf +++ b/apparmor.d/abstractions/common/debconf @@ -9,11 +9,18 @@ include include + @{sh_path} rix, + @{bin}/locale ix, + @{bin}/whiptail Px, + /usr/share/debconf/frontend rix, /usr/share/debconf/confmodule r, /etc/debconf.conf r, + /var/ r, + /var/cache/ r, + /var/cache/debconf/ r, owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, include if exists diff --git a/apparmor.d/groups/apt/debconf-frontend b/apparmor.d/groups/apt/debconf-frontend index 5ec13fcff..a8f7057e7 100644 --- a/apparmor.d/groups/apt/debconf-frontend +++ b/apparmor.d/groups/apt/debconf-frontend @@ -20,9 +20,7 @@ profile debconf-frontend @{exec_path} flags=(complain) { @{exec_path} r, - @{sh_path} rix, @{bin}/hostname ix, - @{bin}/locale ix, @{bin}/lsb_release Px -> lsb_release, @{bin}/stty ix, @{sbin}/update-secureboot-policy Px, @@ -32,7 +30,6 @@ profile debconf-frontend @{exec_path} flags=(complain) { @{bin}/debconf-apt-progress Px, @{bin}/linux-check-removal Px, @{bin}/ucf Px, - @{bin}/whiptail Px, @{sbin}/aspell-autobuildhash Px, @{sbin}/pam-auth-update Px, @{lib}/tasksel/tasksel-debconf Px -> tasksel, @@ -45,7 +42,7 @@ profile debconf-frontend @{exec_path} flags=(complain) { # Package maintainer's scripts /var/lib/dpkg/info/*.@{dpkg_script_ext} Px, /var/lib/dpkg/info/*.control r, - /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px, + /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px -> dpkg-scripts, # DKMS scipts @{lib}/dkms/common.postinst rPUx, diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index 9de0ce0b4..73b14390a 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -10,11 +10,9 @@ include profile dpkg-script-apparmor @{exec_path} { include include - include @{exec_path} mrix, - @{sh_path} rix, @{bin}/grep ix, @{bin}/deb-systemd-helper Px, diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux index 52c74c192..d6a8db473 100644 --- a/apparmor.d/groups/apt/dpkg-script-linux +++ b/apparmor.d/groups/apt/dpkg-script-linux @@ -13,10 +13,7 @@ profile dpkg-script-linux @{exec_path} { @{exec_path} mrix, - @{sh_path} rix, @{bin}/cat ix, - @{bin}/locale ix, - @{bin}/mkdir ix, @{bin}/mkdir ix, @{bin}/rm ix, @{bin}/run-parts ix, @@ -26,7 +23,6 @@ profile dpkg-script-linux @{exec_path} { @{bin}/kmod Px, @{bin}/linux-check-removal Px, @{bin}/linux-update-symlinks Px, - @{bin}/whiptail Px, @{bin}/dpkg-maintscript-helper Px, /usr/share/{update,reboot}-notifier/notify-reboot-required Px, diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd index 713f2981f..4acafd139 100644 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -10,12 +10,9 @@ include profile dpkg-script-systemd @{exec_path} { include include - include @{exec_path} mrix, - @{sh_path} rix, - @{coreutils_path} rix, @{bin}/bootctl Px, @{bin}/deb-systemd-helper Px, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index e765b334c..f1c56bd49 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -31,7 +31,6 @@ profile dpkg-scripts @{exec_path} { @{bin}/getent ix, @{bin}/gzip ix, @{bin}/helpztags ix, - @{bin}/locale ix, @{bin}/tput ix, @{bin}/zcat ix, @{lib}/ubuntu-advantage/cloud-id-shim.sh ix, diff --git a/apparmor.d/groups/grub/grub-check-signatures b/apparmor.d/groups/grub/grub-check-signatures index 310138595..f09ba540d 100644 --- a/apparmor.d/groups/grub/grub-check-signatures +++ b/apparmor.d/groups/grub/grub-check-signatures @@ -13,10 +13,9 @@ profile grub-check-signatures @{exec_path} { @{exec_path} mr, - @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/mktemp rix, - @{bin}/od rix, + @{bin}/{m,g,}awk ix, + @{bin}/mktemp ix, + @{bin}/od ix, owner @{tmp}/tmp.@{rand10}/ rw, diff --git a/apparmor.d/profiles-g-l/linux-check-removal b/apparmor.d/profiles-g-l/linux-check-removal index 40eb26b93..04d2f0330 100644 --- a/apparmor.d/profiles-g-l/linux-check-removal +++ b/apparmor.d/profiles-g-l/linux-check-removal @@ -14,12 +14,7 @@ profile linux-check-removal @{exec_path} { @{exec_path} rmix, - @{sh_path} rix, @{bin}/stty rix, - @{bin}/locale rix, - @{bin}/whiptail rPx, - - audit owner @{tmp}/file* w, include if exists } diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index c2bc8b2b6..5d5e76ed5 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -40,7 +40,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{bin}/whiptail rPx, @{bin}/who rix, @{lib}/needrestart/* rPx, - /usr/share/debconf/frontend rix, + /usr/share/debconf/frontend rCx -> debconf, /etc/debconf.conf r, /etc/init.d/* r, @@ -97,6 +97,13 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { include if exists } + profile debconf { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-m-r/pam-auth-update b/apparmor.d/profiles-m-r/pam-auth-update index 655ed9d40..aff011389 100644 --- a/apparmor.d/profiles-m-r/pam-auth-update +++ b/apparmor.d/profiles-m-r/pam-auth-update @@ -10,56 +10,18 @@ include @{exec_path} = @{sbin}/pam-auth-update profile pam-auth-update @{exec_path} flags=(complain) { include - include - include + include @{exec_path} mr, - @{bin}/md5sum rix, - @{bin}/cp rix, + @{bin}/md5sum ix, + @{bin}/cp ix, - # Think what to do about this (#FIXME#) - /usr/share/debconf/frontend rPx, - #/usr/share/debconf/frontend rCx -> frontend, - - /etc/pam.d/* rw, - /var/lib/pam/* rw, /usr/share/pam{,-configs}/{,*} r, + /etc/pam.d/* rw, - profile frontend flags=(complain) { - include - include - include - include - - /usr/share/debconf/frontend r, - - @{sbin}/pam-auth-update rPx, - - @{sh_path} rix, - @{bin}/stty rix, - @{bin}/locale rix, - - /etc/debconf.conf r, - owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, - /usr/share/debconf/templates/adequate.templates r, - - # The following is needed when debconf uses GUI frontends. - include - include - include - include - capability dac_read_search, - @{bin}/lsb_release rPx -> lsb_release, - @{bin}/hostname rix, - owner @{PROC}/@{pid}/mounts r, - @{HOME}/.Xauthority r, - - /etc/shadow r, - - include if exists - } + /var/lib/pam/* rw, include if exists } diff --git a/apparmor.d/profiles-s-z/tasksel b/apparmor.d/profiles-s-z/tasksel index f4900f225..8a33649a0 100644 --- a/apparmor.d/profiles-s-z/tasksel +++ b/apparmor.d/profiles-s-z/tasksel @@ -14,9 +14,8 @@ profile tasksel @{exec_path} flags=(complain) { @{exec_path} r, - @{sh_path} rix, - @{bin}/tempfile rix, - @{lib}/tasksel/tasksel-debconf rix, + @{bin}/tempfile ix, + @{lib}/tasksel/tasksel-debconf ix, @{lib}/tasksel/tests/* Cx -> tasksel-tests, # Do not strip env to avoid errors like the following: @@ -29,13 +28,11 @@ profile tasksel @{exec_path} flags=(complain) { /usr/share/tasksel/{,**} r, - owner @{tmp}/file* w, - profile tasksel-tests flags=(complain) { include - @{lib}/tasksel/tests/* r, @{sh_path} rix, + @{lib}/tasksel/tests/* r, include if exists } diff --git a/apparmor.d/profiles-s-z/update-secureboot-policy b/apparmor.d/profiles-s-z/update-secureboot-policy index f8581f532..31a03ef7b 100644 --- a/apparmor.d/profiles-s-z/update-secureboot-policy +++ b/apparmor.d/profiles-s-z/update-secureboot-policy @@ -14,15 +14,14 @@ profile update-secureboot-policy @{exec_path} { @{exec_path} rm, - @{sh_path} rix, - @{bin}/{,m,g}awk rix, - @{bin}/dpkg-trigger rPx, - @{bin}/find rix, - @{bin}/id rix, - @{bin}/od rix, - @{bin}/sort rix, - @{bin}/touch rix, - @{bin}/wc rix, + @{bin}/{,m,g}awk ix, + @{bin}/dpkg-trigger Px, + @{bin}/find ix, + @{bin}/id ix, + @{bin}/od ix, + @{bin}/sort ix, + @{bin}/touch ix, + @{bin}/wc ix, / r, From 3e098b715205074cc2eab4b3518658f50b65d464 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 00:47:02 +0200 Subject: [PATCH 0918/1455] feat(profile): initramfs: add hooks and scripts. --- apparmor.d/profiles-m-r/initramfs-hooks | 86 +++++++++++++++++++++++ apparmor.d/profiles-m-r/initramfs-scripts | 55 +++++++++++++++ apparmor.d/profiles-m-r/mkinitramfs | 10 +-- 3 files changed, 146 insertions(+), 5 deletions(-) create mode 100644 apparmor.d/profiles-m-r/initramfs-hooks create mode 100644 apparmor.d/profiles-m-r/initramfs-scripts diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks new file mode 100644 index 000000000..b4f3ac2f4 --- /dev/null +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -0,0 +1,86 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /usr/share/initramfs-tools/hooks/** /etc/initramfs-tools/hooks/** +profile initramfs-hooks @{exec_path} { + include + include + + @{exec_path} mr, + + @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/ischroot Px, + @{bin}/ldd Cx -> ldd, + @{bin}/plymouth Px, + @{bin}/update-alternatives Px, + @{sbin}/blkid Px, + @{lib}/dracut/dracut-install Px, + @{lib}/initramfs-tools/bin/busybox ix, + @{lib}/klibc/bin/fstype ix, + /usr/share/mdadm/mkconf Px, + + @{bin}/* r, + @{sbin}/* r, + @{lib}/ r, + @{lib}/** r, + + /usr/share/initramfs-tools/{,**} r, + /usr/share/plymouth/{,**} r, + /usr/share/cryptsetup/initramfs/{,**} r, + + /etc/console-setup/{,**} r, + /etc/cryptsetup-initramfs/{,**} r, + /etc/crypttab r, + /etc/default/* r, + /etc/fstab r, + /etc/iscsi/*.iscsi r, + /etc/lvm/{,**} r, + /etc/mdadm/mdadm.conf r, + /etc/systemd/network/{,**} r, + /etc/udev/{,**} r, + + / r, + @{efi}/config-* r, + + /var/tmp/ r, + /var/tmp/modules_@{rand6} rw, + owner /var/tmp/mkinitramfs_@{rand6} rw, + owner /var/tmp/mkinitramfs_@{rand6}/ rw, + owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**, + owner /var/tmp/mkinitramfs-@{rand6} rw, + owner /var/tmp/mkinitramfs-*_@{rand6} rw, + + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**, + owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, + + @{sys}/firmware/efi/efivars/ r, + + @{PROC}/@{pid}/mounts r, + @{PROC}/cmdline r, + @{PROC}/swaps r, + + profile ldd { + include + include + + @{bin}/ldd mr, + @{bin}/* mr, + @{lib}/@{multiarch}/ld-linux-*so* mrix, + @{lib}/ld-linux.so* mr, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/initramfs-scripts b/apparmor.d/profiles-m-r/initramfs-scripts new file mode 100644 index 000000000..85437017b --- /dev/null +++ b/apparmor.d/profiles-m-r/initramfs-scripts @@ -0,0 +1,55 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /usr/share/initramfs-tools/scripts/** /etc/initramfs-tools/scripts/** +profile initramfs-scripts @{exec_path} { + include + + @{exec_path} mr, + + @{sh_path} rix, + @{coreutils_path} rix, + @{sbin}/blkid Px, + @{bin}/dd ix, + @{bin}/debconf-escape Px, + @{bin}/ischroot Px, + @{bin}/ldd Cx -> ldd, + @{bin}/plymouth Px, + @{bin}/update-alternatives Px, + @{lib}/dracut/dracut-install Px, + @{lib}/initramfs-tools/bin/busybox Px, + /usr/share/mdadm/mkconf Px, + + /usr/share/initramfs-tools/{,**} r, + + /etc/cryptsetup-initramfs/{,**} r, + /etc/crypttab r, + /etc/default/console-setup r, + /etc/fstab r, + /etc/initramfs-tools/{,**} r, + /etc/mdadm/mdadm.conf r, + /etc/udev/rules.d/{,**} r, + + /var/tmp/modules_@{rand6} rw, + owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**, + + profile ldd { + include + include + + @{bin}/ldd mr, + @{lib}/@{multiarch}/ld-linux-*so* mrix, + @{lib}/ld-linux.so* mr, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index eaf5645f3..f37029627 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -66,11 +66,10 @@ profile mkinitramfs @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/linux-version rPx, - # What to do with it? (#FIXME#) - /usr/share/initramfs-tools/hooks/* rPUx, - /usr/share/initramfs-tools/scripts/*/* rPUx, - /etc/initramfs-tools/hooks/* rPUx, - /etc/initramfs-tools/scripts/*/* rPUx, + /usr/share/initramfs-tools/hooks/** rPx, + /usr/share/initramfs-tools/scripts/** rPx, + /etc/initramfs-tools/hooks/** rPx, + /etc/initramfs-tools/scripts/** rPx, /usr/share/initramfs-tools/{,**} r, /etc/initramfs-tools/{,**} r, @@ -106,6 +105,7 @@ profile mkinitramfs @{exec_path} { @{sys}/devices/platform/**/ r, @{sys}/devices/platform/**/modalias r, @{sys}/module/compression r, + @{sys}/module/firmware_class/parameters/path r, @{PROC}/cmdline r, @{PROC}/modules r, From c70f9b22fcdfe7ebc718f1144ec8ff5a713ffcb1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 00:50:10 +0200 Subject: [PATCH 0919/1455] feat(tunable): add more variables for profile name. --- apparmor.d/tunables/multiarch.d/profiles | 44 +++++++++++++++++++++--- 1 file changed, 40 insertions(+), 4 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/profiles b/apparmor.d/tunables/multiarch.d/profiles index 92ab19fc9..ec1eff79c 100644 --- a/apparmor.d/tunables/multiarch.d/profiles +++ b/apparmor.d/tunables/multiarch.d/profiles @@ -23,14 +23,50 @@ @{p_dbus_system}=dbus-system @{p_dbus_session}=dbus-session +@{p_accounts_daemon}=accounts-daemon +@{p_apt_news}=apt_news @{p_at_spi2_registryd}=at-spi2-registryd +@{p_avahi_daemon}=avahi-daemon +@{p_bluetoothd}=bluetoothd @{p_colord}=colord +@{p_e2scrub_all}=e2scrub_all +@{p_e2scrub}=e2scrub +@{p_file_roller}=file-roller +@{p_fprintd}=fprintd +@{p_fwupd}=fwupd +@{p_fwupdmgr}=fwupdmgr +@{p_geoclue}=geoclue @{p_gnome_shell}=gnome-shell -@{p_packagekitd}=packagekitd -@{p_snap}=snap -@{p_systemd_logind}=systemd-logind -@{p_xdg_desktop_portal}=xdg-desktop-portal @{p_gsd_media_keys}=gsd-media-keys +@{p_irqbalance}=irqbalance +@{p_logrotate}=logrotate +@{p_ModemManager}=ModemManager +@{p_nm_priv_helper}=nm-priv-helper +@{p_packagekitd}=packagekitd +@{p_pcscd}=pcscd +@{p_polkitd}=polkitd +@{p_power_profiles_daemon}=power-profiles-daemon +@{p_rsyslogd}=rsyslogd @{p_rtkit_daemon}=rtkit-daemon +@{p_snap}=snap +@{p_systemd_coredump}=systemd-coredump +@{p_systemd_homed}=systemd-homed +@{p_systemd_hostnamed}=systemd-hostnamed +@{p_systemd_importd}=systemd-importd +@{p_systemd_initctl}=systemd-initctl +@{p_systemd_journal_remote}=systemd-journal-remote +@{p_systemd_journald}=systemd-journald +@{p_systemd_localed}=systemd-localed +@{p_systemd_logind}=systemd-logind +@{p_systemd_networkd}=systemd-networkd +@{p_systemd_oomd}=systemd-oomd +@{p_systemd_resolved}=systemd-resolved +@{p_systemd_rfkill}=systemd-rfkill +@{p_systemd_timedated}=systemd-timedated +@{p_systemd_timesyncd}=systemd-timesyncd +@{p_systemd_userdbd}=systemd-userdbd +@{p_upowerd}=upowerd +@{p_xdg_desktop_portal}=xdg-desktop-portal + # vim:syntax=apparmor From 8b542434bdb1435ca67169bee6fa8911b3d802a7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 00:52:38 +0200 Subject: [PATCH 0920/1455] feat(profile): update kdump profiles. --- apparmor.d/profiles-g-l/kdump-config | 49 +++++++++++++++++++-- apparmor.d/profiles-g-l/kdump-tools-init | 38 ++++++++++++++++ apparmor.d/profiles-g-l/kdump_mem_estimator | 36 +++++++++++++++ dists/flags/main.flags | 2 + 4 files changed, 122 insertions(+), 3 deletions(-) create mode 100644 apparmor.d/profiles-g-l/kdump-tools-init create mode 100644 apparmor.d/profiles-g-l/kdump_mem_estimator diff --git a/apparmor.d/profiles-g-l/kdump-config b/apparmor.d/profiles-g-l/kdump-config index e6ec78f67..2b3516202 100644 --- a/apparmor.d/profiles-g-l/kdump-config +++ b/apparmor.d/profiles-g-l/kdump-config @@ -7,32 +7,69 @@ abi , include @{exec_path} = @{sbin}/kdump-config -profile kdump-config @{exec_path} { +profile kdump-config @{exec_path} flags=(attach_disconnected) { include - ptrace readby peer=systemd-journald, + capability sys_admin, + + ptrace readby peer=@{p_systemd_journald}, @{exec_path} mr, - @{sh_path} ix, + @{sh_path} rix, @{bin}/basename ix, + @{bin}/cat ix, + @{bin}/cmp ix, + @{bin}/cp ix, @{bin}/cut ix, @{bin}/file ix, @{bin}/find ix, + @{bin}/flock ix, @{bin}/grep ix, @{bin}/hexdump ix, @{bin}/ln ix, @{bin}/logger ix, + @{bin}/plymouth Px, + @{bin}/readlink ix, @{bin}/rev ix, @{bin}/run-parts ix, @{bin}/sed ix, + @{bin}/systemctl Cx -> systemctl, + @{bin}/uname ix, @{sbin}/kexec Cx -> kexec, @{sbin}/sysctl Cx -> sysctl, /etc/kernel/postinst.d/kdump-tools rPx, + /etc/kdump/{,**} r, + /etc/default/kdump-tools r, + /etc/magic r, + + / r, + @{efi}/ r, + + /var/crash/kdump_lock wk, + /var/crash/kexec_cmd w, owner /var/lib/kdump/{,**} rw, + @{sys}/firmware/efi/efivars/ r, + @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, + @{sys}/firmware/efi/efivars/SetupMode-@{uuid} r, + @{sys}/kernel/kexec_crash_loaded r, + + @{PROC}/cmdline r, + @{PROC}/iomem r, + + profile systemctl flags=(attach_disconnected) { + include + include + + capability net_admin, + capability sys_ptrace, + + include if exists + } + profile sysctl { include @@ -51,6 +88,12 @@ profile kdump-config @{exec_path} { @{sbin}/kexec mr, + @{efi}/* r, + + owner /var/lib/kdump/* r, + + @{PROC}/iomem r, + include if exists } diff --git a/apparmor.d/profiles-g-l/kdump-tools-init b/apparmor.d/profiles-g-l/kdump-tools-init new file mode 100644 index 000000000..b5af4dcc9 --- /dev/null +++ b/apparmor.d/profiles-g-l/kdump-tools-init @@ -0,0 +1,38 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/init.d/kdump-tools +profile kdump-tools-init @{exec_path} flags=(attach_disconnected) { + include + + @{exec_path} mr, + @{sh_path} mr, + + @{bin}/cat ix, + @{bin}/plymouth Px, + @{bin}/run-parts ix, + @{bin}/systemctl Cx -> systemctl, + @{sbin}/kdump-config Px, + + /etc/default/kdump-tools r, + + @{PROC}/cmdline r, + + profile systemctl flags=(attach_disconnected) { + include + include + + capability net_admin, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/kdump_mem_estimator b/apparmor.d/profiles-g-l/kdump_mem_estimator new file mode 100644 index 000000000..b80a89343 --- /dev/null +++ b/apparmor.d/profiles-g-l/kdump_mem_estimator @@ -0,0 +1,36 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /usr/share/kdump-tools/kdump_mem_estimator +profile kdump_mem_estimator @{exec_path} { + include + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/cat ix, + @{bin}/mkdir ix, + @{bin}/uname ix, + @{bin}/systemctl Cx -> systemctl, + @{bin}/uname ix, + + owner /var/lib/kdump/mem* w, + + profile systemctl { + include + include + + capability net_admin, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index b1bd2fa0e..9faad80f9 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -191,7 +191,9 @@ kconf_update complain kde-powerdevil attach_disconnected,mediate_deleted,complain kde-systemd-start-condition complain kded complain +kdump_mem_estimator complain kdump-config complain +kdump-tools-init complain,attach_disconnected kernel complain kernel-install complain kernel-postinst-kdump complain From c03bcbef7a800d3d4523d4d21b41563d598358d5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:00:08 +0200 Subject: [PATCH 0921/1455] feat(profile): rewrite the needrestart profiles. --- apparmor.d/profiles-m-r/needrestart | 37 ++++++++++--------- apparmor.d/profiles-m-r/needrestart-hook | 25 +++++++++++++ .../needrestart-iucode-scan-versions | 4 +- apparmor.d/profiles-m-r/needrestart-notify | 32 ++++++++++++++++ apparmor.d/profiles-m-r/needrestart-restart | 32 ++++++++++++++++ .../needrestart-vmlinuz-get-version | 2 +- dists/flags/main.flags | 3 ++ 7 files changed, 115 insertions(+), 20 deletions(-) create mode 100644 apparmor.d/profiles-m-r/needrestart-hook create mode 100644 apparmor.d/profiles-m-r/needrestart-notify create mode 100644 apparmor.d/profiles-m-r/needrestart-restart diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 5d5e76ed5..13838902e 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -22,35 +22,34 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { ptrace read, - mqueue (r,getattr) type=posix /, - @{exec_path} mrix, @{sh_path} rix, @{bin}/dpkg-query rpx, @{bin}/fail2ban-server rPx, - @{bin}/locale rix, - @{python_path} rix, @{bin}/sed rix, @{bin}/stty rix, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/udevadm rCx -> udevadm, - @{sbin}/unix_chkpwd rPx, - @{bin}/whiptail rPx, @{bin}/who rix, @{lib}/needrestart/* rPx, + @{python_path} rix, + @{sbin}/unix_chkpwd rPx, + /usr/share/debconf/frontend rCx -> debconf, - /etc/debconf.conf r, + /etc/needrestart/hook.d/* rPx, + /etc/needrestart/notify.d/* rPx, + /etc/needrestart/restart.d/* rPx, + /etc/init.d/* r, /etc/needrestart/{,**} r, - /etc/needrestart/*.d/* rix, /etc/shadow r, / r, - /boot/ r, - /boot/* r, + @{efi}/ r, + @{efi}/* r, /opt/*/** r, @{bin}/* r, @{lib}/** r, @@ -59,23 +58,23 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { /usr/share/** r, /var/lib/*/** r, - owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk, + @{run}/systemd/sessions/* r, /tmp/@{word10}/ rw, - owner @{run}/sshd.pid r, - @{PROC}/ r, - @{PROC}/@{pids}/cgroup r, - @{PROC}/@{pids}/cmdline r, - @{PROC}/@{pids}/environ r, - @{PROC}/@{pids}/maps r, - @{PROC}/@{pids}/stat r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/environ r, + @{PROC}/@{pid}/maps r, + @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/fd/ r, /dev/ r, /dev/**/ r, + deny mqueue type=posix /, + profile systemctl { include include @@ -101,6 +100,8 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { include include + @{sbin}/needrestart Px, + include if exists } diff --git a/apparmor.d/profiles-m-r/needrestart-hook b/apparmor.d/profiles-m-r/needrestart-hook new file mode 100644 index 000000000..fa77834e8 --- /dev/null +++ b/apparmor.d/profiles-m-r/needrestart-hook @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/needrestart/hook.d/* +profile needrestart-hook @{exec_path} { + include + include + include + + @{exec_path} mr, + @{sh_path} rix, + + @{bin}/dpkg-query px, + + /tmp/ r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions index 3484ea298..d75301fc6 100644 --- a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions +++ b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions @@ -12,19 +12,21 @@ profile needrestart-iucode-scan-versions @{exec_path} { @{exec_path} mr, - @{sbin}/iucode_tool rix, @{sh_path} rix, @{bin}/{,e}grep rix, @{bin}/bsdtar rix, @{bin}/cat rix, + @{sbin}/iucode_tool rix, /usr/share/misc/ r, + /usr/share/misc/amd64-microcode* r, /usr/share/misc/intel-microcode* r, /etc/default/amd64-microcode r, /etc/default/intel-microcode r, /etc/needrestart/iucode.sh r, + /boot/amd64-ucode.img r, /boot/intel-ucode.img r, /boot/early_ucode.cpio r, diff --git a/apparmor.d/profiles-m-r/needrestart-notify b/apparmor.d/profiles-m-r/needrestart-notify new file mode 100644 index 000000000..dc4a30c69 --- /dev/null +++ b/apparmor.d/profiles-m-r/needrestart-notify @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/needrestart/notify.d/* +profile needrestart-notify @{exec_path} { + include + + capability dac_read_search, + capability sys_ptrace, + + ptrace read peer=unconfined, + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/gettext.sh r, + @{bin}/sed ix, + + /etc/needrestart/notify.conf r, + + @{PROC}/@{pid}/environ r, + @{PROC}/filesystems r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/needrestart-restart b/apparmor.d/profiles-m-r/needrestart-restart new file mode 100644 index 000000000..2fc79b70c --- /dev/null +++ b/apparmor.d/profiles-m-r/needrestart-restart @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/needrestart/restart.d/* +profile needrestart-restart @{exec_path} { + include + + @{exec_path} mr, + + @{bin}/systemctl Cx -> systemctl, + + /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw, + + profile systemctl { + include + include + + capability net_admin, + capability sys_ptrace, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version index 655566c74..e5ee2fd8f 100644 --- a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version +++ b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version @@ -23,7 +23,7 @@ profile needrestart-vmlinuz-get-version @{exec_path} { @{bin}/rm rix, @{bin}/tail rix, @{bin}/tr rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rPx, @{bin}/xz rix, /boot/intel-ucode.img r, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 9faad80f9..592b681e5 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -240,6 +240,9 @@ ModemManager attach_disconnected,complain mount attach_disconnected,complain multipath attach_disconnected,complain multipathd complain +needrestart-hook complain +needrestart-notify complain +needrestart-restart complain netplan.script attach_disconnected,complain networkctl attach_disconnected,complain networkd-dispatcher complain From 21b31a06a755026a30620afb740668cbf85c80ee Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:03:23 +0200 Subject: [PATCH 0922/1455] feat(profile): rewrite the run-parts profile. --- apparmor.d/profiles-m-r/run-parts | 143 +++--------------------------- 1 file changed, 10 insertions(+), 133 deletions(-) diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 8adb0f748..e5d44e13a 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -4,12 +4,6 @@ # Copyright (C) 2022 Jeroen Rijken # SPDX-License-Identifier: GPL-2.0-only -# TODO: Rewrite this profile. Most of the rule should be confined directly by the calling profile -# Possible confinement depending of profile architecture: -# - As rix, -# - As rCx -> run-parts, -# - As rPx -> foo-run-parts, - abi , include @@ -116,33 +110,21 @@ profile run-parts @{exec_path} { /etc/update-motd.d/* rPx, # Kernel - /etc/kernel/header_postinst.d/ r, - /etc/kernel/header_postinst.d/dkms rCx -> kernel, - - /etc/kernel/postinst.d/ r, - /etc/kernel/postinst.d/apt-auto-removal rCx -> kernel, - /etc/kernel/postinst.d/dkms rCx -> kernel, - /etc/kernel/postinst.d/initramfs-tools rCx -> kernel, - /etc/kernel/postinst.d/unattended-upgrades rCx -> kernel, - /etc/kernel/postinst.d/zz-update-grub rCx -> kernel, - /etc/kernel/postinst.d/zz-shim rCx -> kernel, - /etc/kernel/postinst.d/xx-update-initrd-links rCx -> kernel, - + /etc/kernel/{,header_}postinst.d/ r, + /etc/kernel/{,header_}postinst.d/* rPx, /etc/kernel/postrm.d/ r, - /etc/kernel/postrm.d/initramfs-tools rCx -> kernel, - /etc/kernel/postrm.d/zz-update-grub rCx -> kernel, - + /etc/kernel/postrm.d/* rPx, /etc/kernel/preinst.d/ r, - /etc/kernel/preinst.d/intel-microcode rCx -> kernel, - + /etc/kernel/preinst.d/* rPx, /etc/kernel/prerm.d/ r, - /etc/kernel/prerm.d/dkms rCx -> kernel, + /etc/kernel/prerm.d/* rPx, + # Finalrd /usr/share/finalrd/ r, - /usr/share/finalrd/mdadm.finalrd rPUx, - /usr/share/finalrd/open-iscsi.finalrd rPUx, + /usr/share/finalrd/mdadm.finalrd rPUx, + /usr/share/finalrd/open-iscsi.finalrd rPUx, - /usr/share/landscape/landscape-sysinfo.wrapper rPUx, + /usr/share/landscape/landscape-sysinfo.wrapper rPx, /root/ r, @@ -152,117 +134,12 @@ profile run-parts @{exec_path} { owner @{tmp}/$anacron@{rand6} rw, owner @{tmp}/file@{rand6} rw, - owner @{sys}/class/power_supply/ r, + owner @{sys}/class/power_supply/ r, @{run}/motd.dynamic.new w, /dev/tty@{int} rw, - profile motd { - include - include - - network inet dgram, - network inet6 dgram, - network netlink raw, - - @{sh_path} rix, - @{bin}/{e,}grep rix, - @{bin}/cat rix, - @{bin}/cut rix, - @{bin}/find rix, - @{bin}/head rix, - @{bin}/id rix, - @{bin}/sort rix, - @{bin}/tr rix, - @{bin}/uname rix, - @{bin}/hostname rPx, - - @{bin}/snap rPUx, - @{lib}/ubuntu-release-upgrader/release-upgrade-motd rPx, - @{lib}/update-notifier/update-motd-fsck-at-reboot rPx, - @{lib}/update-notifier/update-motd-reboot-required rix, - /usr/share/unattended-upgrades/update-motd-unattended-upgrades rix, - /usr/share/update-notifier/notify-updates-outdated rPx, - - / r, - /etc/default/motd-news r, - /etc/lsb-release r, - /etc/update-motd.d/* r, - - /var/cache/motd-news rw, - /var/lib/update-notifier/updates-available r, - /var/lib/ubuntu-advantage/messages/motd-esm-announce r, - - @{run}/motd.d/{,*} r, - - @{PROC}/@{pids}/mounts r, - - /dev/tty@{int} rw, - - include if exists - } - - profile kernel { - include - include - include - - capability sys_module, - - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/{,m,g}awk rix, - @{bin}/cat rix, - @{bin}/chmod rix, - @{bin}/cut rix, - @{bin}/dirname rix, - @{bin}/kmod rix, - @{bin}/mv rix, - @{bin}/rm rix, - @{bin}/rmdir rix, - @{bin}/sed rix, - @{bin}/sort rix, - @{bin}/touch rix, - @{bin}/tr rix, - @{bin}/uname rix, - @{bin}/which{,.debianutils} rix, - - @{bin}/apt-config rPx, - @{sbin}/dkms rPx, - @{bin}/dpkg rPx -> child-dpkg, - @{bin}/systemd-detect-virt rPx, - @{sbin}/update-alternatives rPx, - @{sbin}/update-grub rPUx, - @{sbin}/update-initramfs rPx, - @{lib}/dkms/dkms_autoinstaller rPx, - - @{lib}/modules/*/updates/ w, - @{lib}/modules/*/updates/dkms/ w, - - /etc/kernel/header_postinst.d/* r, - /etc/kernel/{postinst,postrm,preinst,prerm}.d/* r, - - # For shell pwd - / r, - /boot/ r, - - /etc/apt/apt.conf.d/ r, - /etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw, - /etc/modprobe.d/ r, - /etc/modprobe.d/*.conf r, - - @{run}/reboot-required w, - @{run}/reboot-required.pkgs rw, - - @{sys}/module/compression r, - - @{PROC}/devices r, - @{PROC}/cmdline r, - - include if exists - } - include if exists } From 649d2da8d2b33744ca892fcea4b19a304d4f2d7b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:04:07 +0200 Subject: [PATCH 0923/1455] feat(profile): expand and restrict motd. --- apparmor.d/profiles-m-r/motd | 40 ++++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 11 deletions(-) diff --git a/apparmor.d/profiles-m-r/motd b/apparmor.d/profiles-m-r/motd index fe684f671..67f216212 100644 --- a/apparmor.d/profiles-m-r/motd +++ b/apparmor.d/profiles-m-r/motd @@ -9,16 +9,11 @@ include @{exec_path} = /etc/update-motd.d/* profile motd @{exec_path} { include - include - include - network inet dgram, - network inet stream, - network inet6 dgram, - network inet6 stream, - network netlink raw, + capability net_admin, @{exec_path} mr, + @{bin}/ r, @{sh_path} rix, @{coreutils_path} rix, @@ -28,7 +23,7 @@ profile motd @{exec_path} { @{bin}/snap rPx, @{bin}/dpkg rPx -> child-dpkg, @{bin}/systemd-detect-virt rPx, - @{bin}/wget rix, + @{bin}/wget rCx -> wget, @{lib}/ubuntu-release-upgrader/release-upgrade-motd rPx, @{lib}/update-notifier/update-motd-fsck-at-reboot rPx, @@ -37,26 +32,49 @@ profile motd @{exec_path} { /usr/share/update-notifier/notify-updates-outdated rPx, / r, + /etc/cloud/cloud.cfg r, + /etc/cloud/cloud.cfg.d/{,*} r, /etc/default/motd-news r, /etc/lsb-release r, /etc/update-motd.d/* r, - /etc/cloud/cloud.cfg r, - /etc/cloud/cloud.cfg.d/{,*} r, + /etc/wgetrc r, /var/cache/motd-news rw, /var/lib/update-notifier/updates-available r, /var/lib/ubuntu-advantage/messages/motd-esm-announce r, + /var/lib/cloud/instances/nocloud/cloud-config.txt r, - /tmp/tmp.@{rand10} rw, + # /tmp/tmp.@{rand10} rw, + @{run}/cloud-init/cloud.cfg r, @{run}/motd.d/{,*} r, @{run}/motd.dynamic.new rw, @{run}/reboot-required r, @{PROC}/@{pids}/mounts r, + @{PROC}/1/environ r, + @{PROC}/cmdline r, /dev/tty@{int} rw, + profile wget { + include + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + @{bin}/wget mr, + + /tmp/tmp.@{rand10} rw, + + include if exists + } + profile systemctl { include include From 8c526b32c615bc30e4400836368f13dfb8eff87a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:09:08 +0200 Subject: [PATCH 0924/1455] feat(profile): small update on core upgrade profiles. --- apparmor.d/groups/apt/apt | 2 +- apparmor.d/groups/apt/apt-methods-cdrom | 8 ++-- apparmor.d/groups/apt/apt-methods-copy | 8 ++-- apparmor.d/groups/apt/apt-methods-file | 10 ++--- apparmor.d/groups/apt/apt-methods-ftp | 8 ++-- apparmor.d/groups/apt/apt-methods-gpgv | 12 +++--- apparmor.d/groups/apt/apt-methods-http | 18 ++++----- apparmor.d/groups/apt/apt-methods-mirror | 10 ++--- apparmor.d/groups/apt/apt-methods-rred | 10 ++--- apparmor.d/groups/apt/apt-methods-rsh | 8 ++-- apparmor.d/groups/apt/apt-methods-store | 12 +++--- apparmor.d/groups/apt/deb-systemd-helper | 4 +- apparmor.d/groups/grub/grub-install | 2 +- apparmor.d/groups/grub/grub-mkdevicemap | 7 ++++ apparmor.d/profiles-a-f/e2scrub_all | 4 +- apparmor.d/profiles-a-f/finalrd | 41 ++++++++++---------- apparmor.d/profiles-g-l/glib-compile-schemas | 2 +- apparmor.d/profiles-g-l/landscape-sysinfo | 1 + apparmor.d/profiles-g-l/logrotate | 4 +- apparmor.d/profiles-m-r/multipathd | 3 +- apparmor.d/profiles-m-r/pycompile | 1 + apparmor.d/profiles-m-r/qemu-ga | 2 +- 22 files changed, 94 insertions(+), 83 deletions(-) diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 2a0969156..5be4284f9 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -36,7 +36,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { unix bind type=stream addr=@@{udbus}/bus/apt-get/system, unix bind type=stream addr=@@{udbus}/bus/apt/system, - unix type=stream peer=(label=snap), + unix type=stream peer=(label=@{p_snap}), unix (send, receive) type=stream peer=(label=apt-esm-json-hook), unix (send, receive) type=stream peer=(label=snapd), diff --git a/apparmor.d/groups/apt/apt-methods-cdrom b/apparmor.d/groups/apt/apt-methods-cdrom index 9cf47e758..96ce36a72 100644 --- a/apparmor.d/groups/apt/apt-methods-cdrom +++ b/apparmor.d/groups/apt/apt-methods-cdrom @@ -19,10 +19,10 @@ profile apt-methods-cdrom @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt, - signal (receive) peer=apt-get, - signal (receive) peer=aptitude, - signal (receive) peer=synaptic, + signal receive peer=apt, + signal receive peer=apt-get, + signal receive peer=aptitude, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-copy b/apparmor.d/groups/apt/apt-methods-copy index 6d906bf80..e2878e108 100644 --- a/apparmor.d/groups/apt/apt-methods-copy +++ b/apparmor.d/groups/apt/apt-methods-copy @@ -20,10 +20,10 @@ profile apt-methods-copy @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt, - signal (receive) peer=apt-get, - signal (receive) peer=aptitude, - signal (receive) peer=synaptic, + signal receive peer=apt, + signal receive peer=apt-get, + signal receive peer=aptitude, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-file b/apparmor.d/groups/apt/apt-methods-file index 3c2489a32..781f9714e 100644 --- a/apparmor.d/groups/apt/apt-methods-file +++ b/apparmor.d/groups/apt/apt-methods-file @@ -20,11 +20,11 @@ profile apt-methods-file @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt-get, - signal (receive) peer=apt, - signal (receive) peer=aptitude, - signal (receive) peer=packagekitd, - signal (receive) peer=synaptic, + signal receive peer=apt-get, + signal receive peer=apt, + signal receive peer=aptitude, + signal receive peer=@{p_packagekitd}, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-ftp b/apparmor.d/groups/apt/apt-methods-ftp index 47c679ea1..e753b4cf8 100644 --- a/apparmor.d/groups/apt/apt-methods-ftp +++ b/apparmor.d/groups/apt/apt-methods-ftp @@ -19,10 +19,10 @@ profile apt-methods-ftp @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt, - signal (receive) peer=apt-get, - signal (receive) peer=aptitude, - signal (receive) peer=synaptic, + signal receive peer=apt, + signal receive peer=apt-get, + signal receive peer=aptitude, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-gpgv b/apparmor.d/groups/apt/apt-methods-gpgv index db5d50f43..5f3654f6e 100644 --- a/apparmor.d/groups/apt/apt-methods-gpgv +++ b/apparmor.d/groups/apt/apt-methods-gpgv @@ -20,12 +20,12 @@ profile apt-methods-gpgv @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt-get, - signal (receive) peer=apt, - signal (receive) peer=aptitude, - signal (receive) peer=packagekitd, - signal (receive) peer=role_*, - signal (receive) peer=synaptic, + signal receive peer=apt-get, + signal receive peer=apt, + signal receive peer=aptitude, + signal receive peer=@{p_packagekitd}, + signal receive peer=role_*, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-http b/apparmor.d/groups/apt/apt-methods-http index b6976e9af..0b375c8f8 100644 --- a/apparmor.d/groups/apt/apt-methods-http +++ b/apparmor.d/groups/apt/apt-methods-http @@ -23,15 +23,15 @@ profile apt-methods-http @{exec_path} { network inet6 stream, network netlink raw, - signal (receive) peer=apt-get, - signal (receive) peer=apt, - signal (receive) peer=aptitude, - signal (receive) peer=packagekitd, - signal (receive) peer=role_*, - signal (receive) peer=synaptic, - signal (receive) peer=ubuntu-advantage, - signal (receive) peer=unattended-upgrade, - signal (receive) peer=update-manager, + signal receive peer=apt-get, + signal receive peer=apt, + signal receive peer=aptitude, + signal receive peer=@{p_packagekitd}, + signal receive peer=role_*, + signal receive peer=synaptic, + signal receive peer=ubuntu-advantage, + signal receive peer=unattended-upgrade, + signal receive peer=update-manager, ptrace (read), diff --git a/apparmor.d/groups/apt/apt-methods-mirror b/apparmor.d/groups/apt/apt-methods-mirror index d8e3adce3..025a1c01b 100644 --- a/apparmor.d/groups/apt/apt-methods-mirror +++ b/apparmor.d/groups/apt/apt-methods-mirror @@ -20,11 +20,11 @@ profile apt-methods-mirror @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt-get, - signal (receive) peer=apt, - signal (receive) peer=aptitude, - signal (receive) peer=packagekitd, - signal (receive) peer=synaptic, + signal receive peer=apt-get, + signal receive peer=apt, + signal receive peer=aptitude, + signal receive peer=@{p_packagekitd}, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-rred b/apparmor.d/groups/apt/apt-methods-rred index 85da35efc..1aadac2ec 100644 --- a/apparmor.d/groups/apt/apt-methods-rred +++ b/apparmor.d/groups/apt/apt-methods-rred @@ -20,11 +20,11 @@ profile apt-methods-rred @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt, - signal (receive) peer=apt-get, - signal (receive) peer=aptitude, - signal (receive) peer=synaptic, - signal (receive) set=(int) peer=packagekitd, + signal receive peer=apt, + signal receive peer=apt-get, + signal receive peer=aptitude, + signal receive peer=synaptic, + signal receive set=(int) peer=@{p_packagekitd}, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-rsh b/apparmor.d/groups/apt/apt-methods-rsh index 95d70b31f..1b76551b9 100644 --- a/apparmor.d/groups/apt/apt-methods-rsh +++ b/apparmor.d/groups/apt/apt-methods-rsh @@ -19,10 +19,10 @@ profile apt-methods-rsh @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt, - signal (receive) peer=apt-get, - signal (receive) peer=aptitude, - signal (receive) peer=synaptic, + signal receive peer=apt, + signal receive peer=apt-get, + signal receive peer=aptitude, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-methods-store b/apparmor.d/groups/apt/apt-methods-store index 5492fdd5e..a6875a432 100644 --- a/apparmor.d/groups/apt/apt-methods-store +++ b/apparmor.d/groups/apt/apt-methods-store @@ -20,12 +20,12 @@ profile apt-methods-store @{exec_path} { capability setgid, capability setuid, - signal (receive) peer=apt-get, - signal (receive) peer=apt, - signal (receive) peer=aptitude, - signal (receive) peer=packagekitd, - signal (receive) peer=role_*, - signal (receive) peer=synaptic, + signal receive peer=apt-get, + signal receive peer=apt, + signal receive peer=aptitude, + signal receive peer=@{p_packagekitd}, + signal receive peer=role_*, + signal receive peer=synaptic, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/deb-systemd-helper b/apparmor.d/groups/apt/deb-systemd-helper index 77fe1f455..d6e89f9a0 100644 --- a/apparmor.d/groups/apt/deb-systemd-helper +++ b/apparmor.d/groups/apt/deb-systemd-helper @@ -16,8 +16,8 @@ profile deb-systemd-helper @{exec_path} { @{bin}/systemctl rCx -> systemctl, - /etc/systemd/system/* w, - /etc/systemd/user/* w, + /etc/systemd/system/{,**} rw, + /etc/systemd/user/{,**} rw, /var/lib/systemd/deb-systemd-helper-enabled/{,**} rw, /var/lib/systemd/deb-systemd-helper-masked/{,**} rw, diff --git a/apparmor.d/groups/grub/grub-install b/apparmor.d/groups/grub/grub-install index 3274a5e6d..f044b0f44 100644 --- a/apparmor.d/groups/grub/grub-install +++ b/apparmor.d/groups/grub/grub-install @@ -44,7 +44,7 @@ profile grub-install @{exec_path} flags=(complain) { @{sys}/firmware/efi/efivars/ r, @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} rw, @{sys}/firmware/efi/efivars/BootCurrent-@{uuid} r, - @{sys}/firmware/efi/efivars/BootOrder-@{uuid} r, + @{sys}/firmware/efi/efivars/BootOrder-@{uuid} rw, @{sys}/firmware/efi/efivars/Timeout-@{uuid} r, @{sys}/firmware/efi/fw_platform_size r, @{sys}/firmware/efi/w_platform_size r, diff --git a/apparmor.d/groups/grub/grub-mkdevicemap b/apparmor.d/groups/grub/grub-mkdevicemap index 2a7082c64..ca9f3ad3c 100644 --- a/apparmor.d/groups/grub/grub-mkdevicemap +++ b/apparmor.d/groups/grub/grub-mkdevicemap @@ -10,9 +10,16 @@ include profile grub-mkdevicemap @{exec_path} { include include + include + + capability sys_admin, @{exec_path} mr, + @{PROC}/devices r, + + /dev/mapper/control rw, + include if exists } diff --git a/apparmor.d/profiles-a-f/e2scrub_all b/apparmor.d/profiles-a-f/e2scrub_all index af10dddcd..0079053e0 100644 --- a/apparmor.d/profiles-a-f/e2scrub_all +++ b/apparmor.d/profiles-a-f/e2scrub_all @@ -17,8 +17,8 @@ profile e2scrub_all @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{sh_path} r, - @{bin}/readlink rix, + @{sh_path} mr, + @{bin}/readlink ix, /etc/e2scrub.conf r, diff --git a/apparmor.d/profiles-a-f/finalrd b/apparmor.d/profiles-a-f/finalrd index bc6c4cf62..d8f2f819e 100644 --- a/apparmor.d/profiles-a-f/finalrd +++ b/apparmor.d/profiles-a-f/finalrd @@ -20,27 +20,27 @@ profile finalrd @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/cp rix, - @{bin}/dirname rix, - @{bin}/env rix, - @{bin}/find rix, - @{bin}/grep rix, - @{sbin}/ldconfig{,.real} rix, - @{bin}/ln rix, - @{bin}/mkdir rix, - @{bin}/mount rix, - @{bin}/readlink rix, - @{bin}/realpath rix, - @{bin}/rm rix, - @{bin}/run-parts rix, - @{bin}/sed rix, - @{bin}/touch rix, + @{bin}/cp ix, + @{bin}/dirname ix, + @{bin}/env ix, + @{bin}/find ix, + @{bin}/grep ix, + @{bin}/ln ix, + @{bin}/mkdir ix, + @{bin}/mount ix, + @{bin}/readlink ix, + @{bin}/realpath ix, + @{bin}/rm ix, + @{bin}/run-parts ix, + @{bin}/sed ix, + @{bin}/touch ix, + @{sbin}/ldconfig{,.real} ix, - @{bin}/ldd rCx -> ldd, - @{bin}/systemd-tmpfiles rPx, - @{lib}/@{multiarch}/ld-linux-*so* rCx -> ldd, - @{lib}/systemd/systemd-shutdown rPx, - /usr/share/finalrd/*.finalrd rix, + @{bin}/ldd Cx -> ldd, + @{bin}/systemd-tmpfiles Px, + @{lib}/@{multiarch}/ld-linux-*so* Cx -> ldd, + @{lib}/systemd/systemd-shutdown Px, + /usr/share/finalrd/*.finalrd ix, @{bin}/{,*} r, @{lib}/{,*} r, @@ -65,6 +65,7 @@ profile finalrd @{exec_path} { profile ldd { include + include include @{bin}/* mr, diff --git a/apparmor.d/profiles-g-l/glib-compile-schemas b/apparmor.d/profiles-g-l/glib-compile-schemas index fcabd84c3..59c56bb12 100644 --- a/apparmor.d/profiles-g-l/glib-compile-schemas +++ b/apparmor.d/profiles-g-l/glib-compile-schemas @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/glib-compile-schemas +@{exec_path} = @{bin}/glib-compile-schemas @{lib}/@{multiarch}/glib-2.0/glib-compile-schemas profile glib-compile-schemas @{exec_path} { include include diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo b/apparmor.d/profiles-g-l/landscape-sysinfo index 3b140b2bf..1c3c98d52 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo +++ b/apparmor.d/profiles-g-l/landscape-sysinfo @@ -33,6 +33,7 @@ profile landscape-sysinfo @{exec_path} { /var/log/landscape/{,**} rw, + @{run}/systemd/sessions/{,*} r, @{run}/utmp rwk, @{sys}/class/hwmon/ r, diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate index f74f309fe..8d3dc2171 100644 --- a/apparmor.d/profiles-g-l/logrotate +++ b/apparmor.d/profiles-g-l/logrotate @@ -21,8 +21,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected) { capability setgid, capability setuid, - signal (send) set=(hup), - signal (send) set=(term cont) peer=systemd-tty-ask-password-agent, + signal send set=hup, + signal send set=(term cont) peer=systemd-tty-ask-password-agent, @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/multipathd b/apparmor.d/profiles-m-r/multipathd index a07691a5c..bbb6a87a6 100644 --- a/apparmor.d/profiles-m-r/multipathd +++ b/apparmor.d/profiles-m-r/multipathd @@ -20,7 +20,8 @@ profile multipathd @{exec_path} { network netlink raw, - unix (send, receive, connect) type=stream peer=(addr="@/org/kernel/linux/storage/multipathd"), + unix type=stream peer=(addr="@/org/kernel/linux/storage/multipathd"), + unix type=stream addr=@/org/kernel/linux/storage/multipathd, @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/pycompile b/apparmor.d/profiles-m-r/pycompile index b441d84cd..984fcf03c 100644 --- a/apparmor.d/profiles-m-r/pycompile +++ b/apparmor.d/profiles-m-r/pycompile @@ -31,6 +31,7 @@ profile pycompile @{exec_path} flags=(attach_disconnected,complain) { /usr/share/python3/{,**} r, / r, + @{bin}/ r, profile dpkg { include diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index c6e6ca54e..7fa668a71 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -12,7 +12,7 @@ profile qemu-ga @{exec_path} { @{exec_path} mr, - audit @{bin}/systemctl Cx -> systemctl, + @{bin}/systemctl Cx -> systemctl, /etc/qemu/qemu-ga.conf r, From 4e4f8d8a0e65e356971b0cddf86748196ef3a14c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:15:53 +0200 Subject: [PATCH 0925/1455] build: update sbin.list --- apparmor.d/groups/ubuntu/cron-ubuntu-fan | 2 +- apparmor.d/groups/virt/containerd-shim-runc-v2 | 2 +- apparmor.d/groups/virt/dockerd | 2 +- tests/sbin.list | 5 +++++ 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/ubuntu/cron-ubuntu-fan b/apparmor.d/groups/ubuntu/cron-ubuntu-fan index eb299345c..8f5952d9b 100644 --- a/apparmor.d/groups/ubuntu/cron-ubuntu-fan +++ b/apparmor.d/groups/ubuntu/cron-ubuntu-fan @@ -15,7 +15,7 @@ profile cron-ubuntu-fan @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/fanctl rix, + @{sbin}/fanctl rix, @{bin}/flock rix, @{bin}/grep rix, @{bin}/id rix, diff --git a/apparmor.d/groups/virt/containerd-shim-runc-v2 b/apparmor.d/groups/virt/containerd-shim-runc-v2 index 5a963beac..61898a3e4 100644 --- a/apparmor.d/groups/virt/containerd-shim-runc-v2 +++ b/apparmor.d/groups/virt/containerd-shim-runc-v2 @@ -30,7 +30,7 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{bin}/runc rPUx, + @{sbin}/runc rPx, /tmp/runc-process@{int} rw, /tmp/pty@{int}/ rw, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 6b1e3537a..c4b39ff8c 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -72,7 +72,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { @{bin}/git rCx -> git, @{bin}/kmod rPx, @{bin}/ps rPx, - @{bin}/runc rUx, + @{sbin}/runc rUx, @{bin}/unpigz rix, @{sbin}/xtables-nft-multi rix, diff --git a/tests/sbin.list b/tests/sbin.list index 82596a62a..805ab8bf1 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -46,6 +46,7 @@ arptables-nft-restore arptables-nft-save arptables-restore arptables-save +arptables-translate aspell-autobuildhash atd audisp-af_unix @@ -92,6 +93,7 @@ blogger bluetoothd bpflist-bpfcc bpftool +brctl bridge brltty brltty-setup @@ -241,7 +243,9 @@ f2fscrypt f2fslabel f2fsslower-bpfcc faillock +fanatic fancontrol +fanctl fatlabel fatresize fbtest @@ -767,6 +771,7 @@ rubyflow-bpfcc rubygc-bpfcc rubyobjnew-bpfcc rubystat-bpfcc +runc runlevel runqlat-bpfcc runqlat.bt From e7fb1860939f0c83882c7592e2f356594790fa89 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:19:32 +0200 Subject: [PATCH 0926/1455] feat(profile): update kernerl-install. --- apparmor.d/profiles-g-l/kernel-install | 28 ++++++++++++++++---------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/apparmor.d/profiles-g-l/kernel-install b/apparmor.d/profiles-g-l/kernel-install index 07c058124..614b81aeb 100644 --- a/apparmor.d/profiles-g-l/kernel-install +++ b/apparmor.d/profiles-g-l/kernel-install @@ -11,22 +11,19 @@ include profile kernel-install @{exec_path} { include include + include include + capability sys_resource, + + ptrace read peer=@{p_systemd}, + @{exec_path} r, @{sh_path} rix, - - @{bin}/mountpoint rix, - @{bin}/sort rix, - @{bin}/rm rix, - @{bin}/mkdir rix, - @{bin}/cp rix, - @{bin}/chown rix, - @{bin}/chmod rix, - @{bin}/basename rix, - - @{pager_path} rPx -> child-pager, + @{coreutils_path} rix, @{bin}/kmod rCx -> kmod, + @{bin}/mountpoint rix, + @{pager_path} rPx -> child-pager, @{lib}/kernel/install.d/ r, @{lib}/kernel/install.d/@{int2}-*.install rix, @@ -37,6 +34,7 @@ profile kernel-install @{exec_path} { @{lib}/os-release r, /etc/kernel/cmdline r, /etc/kernel/tries r, + /etc/kernel/entry-token r, /etc/machine-id r, /etc/os-release r, /var/lib/dbus/machine-id r, @@ -50,14 +48,22 @@ profile kernel-install @{exec_path} { owner /boot/loader/entries/ rw, owner /boot/loader/entries/*.conf w, + owner /tmp/kernel-install.staging.@{rand6}/{,**} rw, + owner @{tmp}/sh-thd.* rw, + @{PROC}/1/environ r, @{PROC}/cmdline r, + @{PROC}/sys/kernel/osrelease r, profile kmod { include include + @{lib}/modules/*/modules.* w, + + @{sys}/module/compression r, + include if exists } From 17624b95d8b193a823c1f75a0cffd0a559740b5b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:21:12 +0200 Subject: [PATCH 0927/1455] feat(profile): update ucf profiles. --- apparmor.d/profiles-s-z/ucf | 11 ++++++++++- apparmor.d/profiles-s-z/ucfq | 26 +++++++++++++++++++++++++ apparmor.d/profiles-s-z/ucfr | 37 ++++++++++++++++++++++++++++++++++++ dists/flags/main.flags | 2 ++ 4 files changed, 75 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/profiles-s-z/ucfq create mode 100644 apparmor.d/profiles-s-z/ucfr diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf index 86d94c7a1..0a7b992b6 100644 --- a/apparmor.d/profiles-s-z/ucf +++ b/apparmor.d/profiles-s-z/ucf @@ -39,7 +39,7 @@ profile ucf @{exec_path} { @{bin}/dpkg-divert rPx, @{pager_path} rCx -> child-pager, - /usr/share/debconf/frontend rPx, # TODO: rCx -> debonc-frontend, + /usr/share/debconf/frontend Cx -> debconf, # For md5sum /usr/share/** r, @@ -55,6 +55,15 @@ profile ucf @{exec_path} { owner /tmp/tmp.@{rand10} r, + deny capability sys_admin, # optional: no audit + + profile debconf { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-s-z/ucfq b/apparmor.d/profiles-s-z/ucfq new file mode 100644 index 000000000..b6ca3e7b1 --- /dev/null +++ b/apparmor.d/profiles-s-z/ucfq @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ucfq +profile ucfq @{exec_path} { + include + + @{exec_path} mr, + + @{bin}/md5sum rix, + + /etc/ r, + /etc/default/ r, + /etc/default/grub r, + + /var/lib/ucf/* r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/ucfr b/apparmor.d/profiles-s-z/ucfr new file mode 100644 index 000000000..b38f8aae4 --- /dev/null +++ b/apparmor.d/profiles-s-z/ucfr @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ucfr +profile ucfr @{exec_path} { + include + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/basename ix, + @{bin}/{m,g,}awk ix, + @{bin}/getopt ix, + @{bin}/grep ix, + @{bin}/id ix, + @{bin}/readlink ix, + @{bin}/sed ix, + @{bin}/dirname ix, + + /usr/share/ucf/{,**} r, + + /etc/ucf.conf r, + + / r, + + /var/lib/ucf/ r, + /var/lib/ucf/registry r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 592b681e5..e88409583 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -368,6 +368,8 @@ telegram-desktop complain totem attach_disconnected,complain tracker-writeback complain ucf complain +ucfq complain +ucfr complain udev-ata_id complain udev-bcache-export-cached complain udev-cdrom_id complain From 0a5743fa46cb62d35a1ff622d50a1fa2eaa6666c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:23:26 +0200 Subject: [PATCH 0928/1455] feat(profile): add profile for more update-* tools. --- apparmor.d/profiles-s-z/update-catalog | 26 ++++++++++++++++++ apparmor.d/profiles-s-z/update-info-dir | 24 +++++++++++++++++ apparmor.d/profiles-s-z/update-shells | 36 +++++++++++++++++++++++++ dists/flags/main.flags | 3 +++ 4 files changed, 89 insertions(+) create mode 100644 apparmor.d/profiles-s-z/update-catalog create mode 100644 apparmor.d/profiles-s-z/update-info-dir create mode 100644 apparmor.d/profiles-s-z/update-shells diff --git a/apparmor.d/profiles-s-z/update-catalog b/apparmor.d/profiles-s-z/update-catalog new file mode 100644 index 000000000..feac2d3c5 --- /dev/null +++ b/apparmor.d/profiles-s-z/update-catalog @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/update-catalog +profile update-catalog @{exec_path} { + include + include + + @{exec_path} mr, + + /etc/sgml/ r, + /etc/sgml/* r, + + /var/lib/sgml-base/*catalog rw, + /var/lib/sgml-base/*catalog.new rw, + /var/lib/sgml-base/*catalog.old w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/update-info-dir b/apparmor.d/profiles-s-z/update-info-dir new file mode 100644 index 000000000..7c835023f --- /dev/null +++ b/apparmor.d/profiles-s-z/update-info-dir @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/update-info-dir +profile update-info-dir @{exec_path} { + include + include + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/install-info Px, + @{bin}/find ix, + @{bin}/rm ix, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/update-shells b/apparmor.d/profiles-s-z/update-shells new file mode 100644 index 000000000..46b6699c8 --- /dev/null +++ b/apparmor.d/profiles-s-z/update-shells @@ -0,0 +1,36 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/update-shells +profile update-shells @{exec_path} { + include + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/basename ix, + @{bin}/chmod ix, + @{bin}/chown ix, + @{bin}/dirname ix, + @{bin}/dpkg-realpath ix, + @{bin}/mv ix, + @{bin}/sync ix, + + /usr/share/debianutils/shells r, + /usr/share/debianutils/shells.d/{,**} r, + + /etc/shells r, + /etc/shells.tmp w, + + /var/lib/shells.state r, + /var/lib/shells.state.tmp w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index e88409583..9d0857ad3 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -380,8 +380,11 @@ udev-probe-bcache complain udisksctl complain udisksd attach_disconnected,complain ufw complain +update-catalog complain update-grub complain +update-info-dir complain update-secureboot-policy complain +update-shells complain userdbctl complain utempter attach_disconnected,complain veracrypt complain From a7807408b616c6b7fb51e064887415e83d18ffd7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:25:46 +0200 Subject: [PATCH 0929/1455] feat(profile): update some update-* profiles. --- apparmor.d/groups/freedesktop/update-mime-database | 2 +- apparmor.d/profiles-s-z/update-ca-certificates | 1 + apparmor.d/profiles-s-z/update-dlocatedb | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/freedesktop/update-mime-database b/apparmor.d/groups/freedesktop/update-mime-database index 6f6b39700..9efd9cccc 100644 --- a/apparmor.d/groups/freedesktop/update-mime-database +++ b/apparmor.d/groups/freedesktop/update-mime-database @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/update-mime-database +@{exec_path} = @{bin}/update-mime-database profile update-mime-database @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-s-z/update-ca-certificates b/apparmor.d/profiles-s-z/update-ca-certificates index 4bc88faae..df9c08fe4 100644 --- a/apparmor.d/profiles-s-z/update-ca-certificates +++ b/apparmor.d/profiles-s-z/update-ca-certificates @@ -33,6 +33,7 @@ profile update-ca-certificates @{exec_path} { @{bin}/test rix, @{bin}/trust rix, @{bin}/wc rix, + @{bin}/run-parts rix, @{lib}/ca-certificates/update.d/ r, @{lib}/ca-certificates/update.d/* rix, diff --git a/apparmor.d/profiles-s-z/update-dlocatedb b/apparmor.d/profiles-s-z/update-dlocatedb index 2afe8a22f..e9d92e421 100644 --- a/apparmor.d/profiles-s-z/update-dlocatedb +++ b/apparmor.d/profiles-s-z/update-dlocatedb @@ -26,7 +26,7 @@ profile update-dlocatedb @{exec_path} { /usr/share/dlocate/updatedb rCx -> updatedb, @{bin}/dpkg rPx -> child-dpkg, - owner @{PROC}/@{pid}/fd/2 w, + owner @{PROC}/@{pid}/fd/@{int} w, /var/lib/dlocate/dpkg-list w, From 774106b7e5cd7952850a6a63c49375997c9d4a79 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:28:08 +0200 Subject: [PATCH 0930/1455] feat(profile): update some systemd profiles. --- apparmor.d/groups/systemd/bootctl | 22 +++++++++---------- .../groups/systemd/systemd-generator-sysv | 3 ++- apparmor.d/groups/systemd/systemd-localed | 2 +- apparmor.d/groups/systemd/systemd-logind | 7 ++---- .../groups/systemd/systemd-network-generator | 2 +- apparmor.d/groups/systemd/systemd-networkd | 9 +++++++- apparmor.d/groups/systemd/systemd-remount-fs | 3 +-- apparmor.d/groups/systemd/systemd-timedated | 2 +- 8 files changed, 27 insertions(+), 23 deletions(-) diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index 12fcceaea..9508cfcf2 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -25,17 +25,17 @@ profile bootctl @{exec_path} flags=(attach_disconnected) { @{pager_path} rPx -> child-pager, - /{boot,efi}/ r, - /{boot,efi}/EFI/{,**} r, - /{boot,efi}/EFI/BOOT/.#BOOT*.EFI@{hex} rw, - /{boot,efi}/EFI/BOOT/BOOTX64.EFI w, - /{boot,efi}/EFI/systemd/.#systemd-boot*.efi@{hex} rw, - /{boot,efi}/EFI/systemd/systemd-boot*.efi w, - /{boot,efi}/loader/.#bootctlrandom-seed@{hex} rw, - /{boot,efi}/loader/.#entries.srel* w, - /{boot,efi}/loader/{,**} r, - /{boot,efi}/loader/entries.srel w, - /{boot,efi}/loader/random-seed w, + @{efi}/ r, + @{efi}/EFI/{,**} r, + @{efi}/EFI/BOOT/.#BOOT*.EFI@{hex} rw, + @{efi}/EFI/BOOT/BOOTX64.EFI w, + @{efi}/EFI/systemd/.#systemd-boot*.efi@{hex} rw, + @{efi}/EFI/systemd/systemd-boot*.efi w, + @{efi}/loader/.#bootctlrandom-seed@{hex} rw, + @{efi}/loader/.#entries.srel* w, + @{efi}/loader/{,**} r, + @{efi}/loader/entries.srel w, + @{efi}/loader/random-seed w, /etc/kernel/entry-token r, /etc/machine-id r, diff --git a/apparmor.d/groups/systemd/systemd-generator-sysv b/apparmor.d/groups/systemd/systemd-generator-sysv index 4feb65d51..fc290fca4 100644 --- a/apparmor.d/groups/systemd/systemd-generator-sysv +++ b/apparmor.d/groups/systemd/systemd-generator-sysv @@ -17,9 +17,10 @@ profile systemd-generator-sysv @{exec_path} flags=(attach_disconnected) { /etc/init.d/{,**} r, /etc/rc@{int}.d/{,**} r, - @{run}/systemd/generator.late/* w, + @{run}/systemd/generator.late/** w, @{PROC}/@{pid}/cgroup r, + @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index 205d8a55f..3befcd92a 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -14,7 +14,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { include include - unix (bind) type=stream addr=@@{udbus}/bus/systemd-localed/system, + unix bind type=stream addr=@@{udbus}/bus/systemd-localed/system, #aa:dbus own bus=system name=org.freedesktop.locale1 diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index a56e16298..39192e7e1 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -12,11 +12,11 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { include include include + include include include include include - include capability chown, capability dac_override, @@ -50,8 +50,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { /etc/systemd/sleep.conf.d/{,**} r, / r, - /boot/{,**} r, - /efi/{,**} r, + @{efi}/{,**} r, /swap.img r, /swap/swapfile r, /swapfile r, @@ -140,8 +139,6 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { /dev/dri/card@{int} rw, /dev/input/event@{int} rw, # Input devices (keyboard, mouse, etc) /dev/mqueue/ r, - /dev/tty@{int} rw, - owner @{att}/dev/tty@{int} rw, owner /dev/shm/{,**/} rw, include if exists diff --git a/apparmor.d/groups/systemd/systemd-network-generator b/apparmor.d/groups/systemd/systemd-network-generator index e22d89629..ceebbc5c2 100644 --- a/apparmor.d/groups/systemd/systemd-network-generator +++ b/apparmor.d/groups/systemd/systemd-network-generator @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-network-generator -profile systemd-network-generator @{exec_path} { +profile systemd-network-generator @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index ca5450826..3d6c3a4b7 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -31,6 +31,8 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { unix bind type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network, + signal receive set=usr2 peer=@{p_systemd}, + #aa:dbus own bus=system name=org.freedesktop.network1 dbus send bus=system path=/org/freedesktop/hostname1 @@ -47,14 +49,18 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { /var/lib/dbus/machine-id r, /etc/machine-id r, - /etc/systemd/networkd.conf r, + /etc/systemd/network.conf r, /etc/systemd/network/{,**} r, + /etc/systemd/networkd.conf r, + /etc/systemd/networkd.conf.d/{,**} r, /etc/networkd-dispatcher/carrier.d/{,*} r, @{att}/ r, @{att}/@{run}/systemd/notify rw, + @{run}/mount/utab r, + owner @{att}/var/lib/systemd/network/ r, @{run}/systemd/network/ r, @@ -75,6 +81,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pid}/cgroup r, @{PROC}/pressure/* r, @{PROC}/sys/net/ipv{4,6}/** rw, + @{PROC}/version_signature r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/systemd/systemd-remount-fs b/apparmor.d/groups/systemd/systemd-remount-fs index 750f7e18b..96b182e5f 100644 --- a/apparmor.d/groups/systemd/systemd-remount-fs +++ b/apparmor.d/groups/systemd/systemd-remount-fs @@ -28,8 +28,7 @@ profile systemd-remount-fs @{exec_path} flags=(attach_disconnected) { @{run}/host/container-manager r, @{run}/mount/utab rw, - @{run}/mount/utab.@{rand6} rw, - @{run}/mount/utab.lock rwk, + @{run}/mount/utab.* rwk, @{sys}/devices/virtual/block/dm-@{int}/dm/name r, diff --git a/apparmor.d/groups/systemd/systemd-timedated b/apparmor.d/groups/systemd/systemd-timedated index e070afe4e..ffed031b5 100644 --- a/apparmor.d/groups/systemd/systemd-timedated +++ b/apparmor.d/groups/systemd/systemd-timedated @@ -15,7 +15,7 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) { capability sys_time, - unix (bind) type=stream addr=@@{udbus}/bus/systemd-timedat/system, + unix bind type=stream addr=@@{udbus}/bus/systemd-timedat/system, #aa:dbus own bus=system name=org.freedesktop.timedate1 From 30bbd6d56a7d673b25212727a05e52d818e9a7e4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 01:39:00 +0200 Subject: [PATCH 0931/1455] feat(profile): cron: cleanup direct exec. --- apparmor.d/groups/cron/cron | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index c92441568..778dd2be8 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -38,9 +38,7 @@ profile cron @{exec_path} flags=(attach_disconnected) { @{bin}/run-parts rCx -> run-parts, # could even be rix, as long as we are not # using the run-parts profile we are good - @{lib}/@{multiarch}/e2fsprogs/e2scrub_all_cron rPUx, - @{lib}/sysstat/debian-sa1 rPUx, - /usr/share/rsync/scripts/rrsync rPUx, + @{lib}/sysstat/debian-sa1 rPx, /etc/cron.d/{,*} r, /etc/crontab r, From 8546533ad1ec34df6e709f0ed1ff510af24e5c62 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 14:28:35 +0200 Subject: [PATCH 0932/1455] fix(build): flag generation. --- dists/flags/main.flags | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 9d0857ad3..c0af4fc77 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -193,7 +193,7 @@ kde-systemd-start-condition complain kded complain kdump_mem_estimator complain kdump-config complain -kdump-tools-init complain,attach_disconnected +kdump-tools-init complain,attach_disconnected kernel complain kernel-install complain kernel-postinst-kdump complain From 813758a1e0e58035ba568837623ba4c289db9bec Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 15:07:27 +0200 Subject: [PATCH 0933/1455] feat(profile): add debconf-escape, update dpkg-scripts. --- apparmor.d/groups/apt/debconf-escape | 19 +++++++++++++++++++ apparmor.d/groups/apt/dpkg-scripts | 15 ++++++++++++++- dists/flags/main.flags | 1 + 3 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/groups/apt/debconf-escape diff --git a/apparmor.d/groups/apt/debconf-escape b/apparmor.d/groups/apt/debconf-escape new file mode 100644 index 000000000..c64401bb0 --- /dev/null +++ b/apparmor.d/groups/apt/debconf-escape @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/debconf-escape +profile debconf-escape @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index f1c56bd49..e18ab78de 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -26,11 +26,12 @@ profile dpkg-scripts @{exec_path} { @{coreutils_path} rix, @{bin}/run-parts rix, - @{bin}/setpriv ix, @{bin}/envsubst ix, + @{bin}/file ix, @{bin}/getent ix, @{bin}/gzip ix, @{bin}/helpztags ix, + @{bin}/setpriv ix, @{bin}/tput ix, @{bin}/zcat ix, @{lib}/ubuntu-advantage/cloud-id-shim.sh ix, @@ -97,6 +98,18 @@ profile dpkg-scripts @{exec_path} { capability sys_ptrace, capability sys_resource, + @{bin}/systemd-tty-ask-password-agent Px, + @{pager_path} Px -> child-pager, + + /{run,var}/log/journal/ r, + /{run,var}/log/journal/@{hex32}/ r, + /{run,var}/log/journal/@{hex32}/system.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* r, + @{run}/utmp rk, include if exists diff --git a/dists/flags/main.flags b/dists/flags/main.flags index c0af4fc77..6c29eba15 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -77,6 +77,7 @@ cupsd attach_disconnected,complain ddcutil complain deb-systemd-helper complain deb-systemd-invoke complain +debconf-escape complain decibels complain dino attach_disconnected,complain discord complain From 7361c21c401bfa0cf0c3eb3cb0bbcb9b534b7501 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 15:14:56 +0200 Subject: [PATCH 0934/1455] feat(profile): add mdadm-mkconf. --- apparmor.d/profiles-m-r/mdadm-mkconf | 30 ++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 31 insertions(+) create mode 100644 apparmor.d/profiles-m-r/mdadm-mkconf diff --git a/apparmor.d/profiles-m-r/mdadm-mkconf b/apparmor.d/profiles-m-r/mdadm-mkconf new file mode 100644 index 000000000..8139ac68e --- /dev/null +++ b/apparmor.d/profiles-m-r/mdadm-mkconf @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /usr/share/mdadm/mkconf +profile mdadm-mkconf @{exec_path} { + include + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/date ix, + @{bin}/cat ix, + @{bin}/sed ix, + @{sbin}/mdadm Px, + + /etc/default/mdadm r, + + / r, + + /var/tmp/mkinitramfs_@{rand6}/etc/mdadm/mdadm.conf.tmp rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 6c29eba15..e27c76bc2 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -237,6 +237,7 @@ lvmdump complain lvmpolld complain man complain mate-notification-daemon complain +mdadm-mkconf complain ModemManager attach_disconnected,complain mount attach_disconnected,complain multipath attach_disconnected,complain From b1435dd4914e3828de737e5ba5817ca2ddef8add Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 15:17:38 +0200 Subject: [PATCH 0935/1455] feat(profile): ubuntu: update upgrade process. --- .../groups/ubuntu/package-data-downloader | 2 ++ apparmor.d/groups/ubuntu/ubuntu-report | 2 +- .../groups/ubuntu/update-notifier-crash | 20 +++++++++++++++++++ 3 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/groups/ubuntu/update-notifier-crash diff --git a/apparmor.d/groups/ubuntu/package-data-downloader b/apparmor.d/groups/ubuntu/package-data-downloader index c193bbe0c..37f7f72a5 100644 --- a/apparmor.d/groups/ubuntu/package-data-downloader +++ b/apparmor.d/groups/ubuntu/package-data-downloader @@ -14,6 +14,8 @@ profile package-data-downloader @{exec_path} { include include + capability dac_read_search, + @{exec_path} mr, /var/lib/update-notifier/package-data-downloads/{,**} rw, diff --git a/apparmor.d/groups/ubuntu/ubuntu-report b/apparmor.d/groups/ubuntu/ubuntu-report index 19273f449..65fa3eaa0 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-report +++ b/apparmor.d/groups/ubuntu/ubuntu-report @@ -21,7 +21,7 @@ profile ubuntu-report @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, - owner @{user_cache_dirs}/ubuntu-report/{,*} r, + owner @{user_cache_dirs}/ubuntu-report/{,*} rw, include if exists } diff --git a/apparmor.d/groups/ubuntu/update-notifier-crash b/apparmor.d/groups/ubuntu/update-notifier-crash new file mode 100644 index 000000000..b3cbf7f07 --- /dev/null +++ b/apparmor.d/groups/ubuntu/update-notifier-crash @@ -0,0 +1,20 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/update-notifier/update-notifier-crash +profile update-notifier-crash @{exec_path} { + include + + @{exec_path} mr, + + /usr/share/apport/apport-checkreports Px, + + include if exists +} + +# vim:syntax=apparmor From ca5b4c99bac08f2cf53aa5433d086228dfa40ed2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 16:40:29 +0200 Subject: [PATCH 0936/1455] ci: disable compatibility check with userspace tools. --- .github/workflows/main.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 4593fe78c..229aad415 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -57,11 +57,6 @@ jobs: sudo systemctl restart apparmor.service || true sudo journalctl -xeu apparmor.service - - name: Ensure compatibility with some AppArmor userspace tools - if: matrix.os != 'ubuntu-24.04' - run: | - sudo aa-enforce /etc/apparmor.d/aa-notify - - name: Show AppArmor log and rules run: | sudo aa-log From 931c20708905fd5b48f07aa492749fe178e152eb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 18:24:34 +0200 Subject: [PATCH 0937/1455] feat(profile): simplify needrestart & fix pam-auth-update. --- apparmor.d/profiles-m-r/needrestart | 19 +------------------ apparmor.d/profiles-m-r/pam-auth-update | 2 +- 2 files changed, 2 insertions(+), 19 deletions(-) diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 13838902e..9b731fd64 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -9,11 +9,8 @@ include @{exec_path} = @{sbin}/needrestart profile needrestart @{exec_path} flags=(attach_disconnected) { include - include - include - include + include include - include capability checkpoint_restore, capability dac_read_search, @@ -27,18 +24,13 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/dpkg-query rpx, @{bin}/fail2ban-server rPx, - @{bin}/sed rix, - @{bin}/stty rix, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/udevadm rCx -> udevadm, - @{bin}/who rix, @{lib}/needrestart/* rPx, @{python_path} rix, @{sbin}/unix_chkpwd rPx, - /usr/share/debconf/frontend rCx -> debconf, - /etc/needrestart/hook.d/* rPx, /etc/needrestart/notify.d/* rPx, /etc/needrestart/restart.d/* rPx, @@ -96,15 +88,6 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { include if exists } - profile debconf { - include - include - - @{sbin}/needrestart Px, - - include if exists - } - include if exists } diff --git a/apparmor.d/profiles-m-r/pam-auth-update b/apparmor.d/profiles-m-r/pam-auth-update index aff011389..5e0cbaaf4 100644 --- a/apparmor.d/profiles-m-r/pam-auth-update +++ b/apparmor.d/profiles-m-r/pam-auth-update @@ -12,7 +12,7 @@ profile pam-auth-update @{exec_path} flags=(complain) { include include - @{exec_path} mr, + @{exec_path} mrix, @{bin}/md5sum ix, @{bin}/cp ix, From d575812e2906331f77dfcb7e41da44d2afa273c2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 18:27:30 +0200 Subject: [PATCH 0938/1455] fix(profile): snapd journalctl subprofile. --- apparmor.d/groups/snap/snapd | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index c1b24176e..b65283987 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -204,6 +204,7 @@ profile snapd @{exec_path} { include capability net_admin, + capability sys_resource, network netlink raw, @@ -215,6 +216,8 @@ profile snapd @{exec_path} { /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/{,*} r, + @{run}/systemd/notify w, + include if exists } From acc35c3bd7f2dc31a0de043a660156c1f3aa9e8e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 18:28:56 +0200 Subject: [PATCH 0939/1455] ci: show files installed in sbin. --- .github/workflows/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 229aad415..8d738eac7 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -128,6 +128,7 @@ jobs: - name: Install integration dependencies run: | bash tests/requirements.sh + find /usr/sbin/ -type f - name: Run the integration tests run: | From ead321e07e09b381313f0beeba67403f57b9827d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 23:47:44 +0200 Subject: [PATCH 0940/1455] feat(profile): improve the upgrade stack. --- apparmor.d/groups/cron/cron | 18 ++++++------------ apparmor.d/groups/snap/snapd | 2 +- apparmor.d/profiles-m-r/needrestart | 8 ++++---- apparmor.d/profiles-m-r/needrestart-hook | 2 +- apparmor.d/profiles-m-r/needrestart-notify | 9 ++++++--- apparmor.d/profiles-m-r/needrestart-restart | 2 +- apparmor.d/profiles-m-r/pam-auth-update | 2 ++ 7 files changed, 21 insertions(+), 22 deletions(-) diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 778dd2be8..eba78ac82 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -25,20 +25,14 @@ profile cron @{exec_path} flags=(attach_disconnected) { network netlink raw, - ptrace (read) peer=unconfined, - - unix bind type=stream addr=@@{udbus}/bus/cron/system, - @{exec_path} mr, - @{sh_path} rix, - @{bin}/nice rix, - @{bin}/ionice rix, - @{bin}/exim4 rPx, - @{bin}/run-parts rCx -> run-parts, # could even be rix, as long as we are not - # using the run-parts profile we are good - - @{lib}/sysstat/debian-sa1 rPx, + @{sh_path} rix, + @{bin}/exim4 rPx, + @{bin}/ionice rix, + @{bin}/nice rix, + @{bin}/run-parts rCx -> run-parts, + @{lib}/sysstat/debian-sa1 rPx, /etc/cron.d/{,*} r, /etc/crontab r, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index b65283987..0eb3adb8c 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -50,7 +50,7 @@ profile snapd @{exec_path} { ptrace read peer=@{p_systemd}, ptrace read peer=snap{,.*}, - signal send set=kill peer=journalctl, + signal send set=kill peer=snapd//journalctl, dbus send bus=system path=/org/freedesktop/ interface=org.freedesktop.login1.Manager diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 9b731fd64..f9e2c6ebc 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -14,7 +14,6 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { capability checkpoint_restore, capability dac_read_search, - capability kill, capability sys_ptrace, ptrace read, @@ -27,13 +26,14 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/udevadm rCx -> udevadm, + @{bin}/who rPx, @{lib}/needrestart/* rPx, @{python_path} rix, @{sbin}/unix_chkpwd rPx, - /etc/needrestart/hook.d/* rPx, - /etc/needrestart/notify.d/* rPx, - /etc/needrestart/restart.d/* rPx, + @{etc_ro}/needrestart/hook.d/* rPx, + @{etc_ro}/needrestart/notify.d/* rPx, + @{etc_ro}/needrestart/restart.d/* rPx, /etc/init.d/* r, /etc/needrestart/{,**} r, diff --git a/apparmor.d/profiles-m-r/needrestart-hook b/apparmor.d/profiles-m-r/needrestart-hook index fa77834e8..c8c9a12c4 100644 --- a/apparmor.d/profiles-m-r/needrestart-hook +++ b/apparmor.d/profiles-m-r/needrestart-hook @@ -6,7 +6,7 @@ abi , include -@{exec_path} = /etc/needrestart/hook.d/* +@{exec_path} = @{etc_ro}/needrestart/hook.d/* profile needrestart-hook @{exec_path} { include include diff --git a/apparmor.d/profiles-m-r/needrestart-notify b/apparmor.d/profiles-m-r/needrestart-notify index dc4a30c69..41fa96c4c 100644 --- a/apparmor.d/profiles-m-r/needrestart-notify +++ b/apparmor.d/profiles-m-r/needrestart-notify @@ -6,7 +6,7 @@ abi , include -@{exec_path} = /etc/needrestart/notify.d/* +@{exec_path} = @{etc_ro}/needrestart/notify.d/* profile needrestart-notify @{exec_path} { include @@ -18,8 +18,11 @@ profile needrestart-notify @{exec_path} { @{exec_path} mr, @{sh_path} r, - @{bin}/gettext.sh r, - @{bin}/sed ix, + @{bin}/fold ix, + @{bin}/gettext.sh r, + @{bin}/mail Px, + @{bin}/notify-send Px, + @{bin}/sed ix, /etc/needrestart/notify.conf r, diff --git a/apparmor.d/profiles-m-r/needrestart-restart b/apparmor.d/profiles-m-r/needrestart-restart index 2fc79b70c..b9e648602 100644 --- a/apparmor.d/profiles-m-r/needrestart-restart +++ b/apparmor.d/profiles-m-r/needrestart-restart @@ -6,7 +6,7 @@ abi , include -@{exec_path} = /etc/needrestart/restart.d/* +@{exec_path} = @{etc_ro}/needrestart/restart.d/* profile needrestart-restart @{exec_path} { include diff --git a/apparmor.d/profiles-m-r/pam-auth-update b/apparmor.d/profiles-m-r/pam-auth-update index 5e0cbaaf4..90cc6a4ba 100644 --- a/apparmor.d/profiles-m-r/pam-auth-update +++ b/apparmor.d/profiles-m-r/pam-auth-update @@ -20,7 +20,9 @@ profile pam-auth-update @{exec_path} flags=(complain) { /usr/share/pam{,-configs}/{,*} r, /etc/pam.d/* rw, + /etc/shadow r, + /var/lib/dpkg/info/libpam-runtime.templates r, /var/lib/pam/* rw, include if exists From a8ab6da6f38f659d338c2eb6dee812d45b8cc41b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 25 May 2025 23:53:40 +0200 Subject: [PATCH 0941/1455] feat(profile): add runit-helper. --- apparmor.d/profiles-m-r/runit-helper | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 apparmor.d/profiles-m-r/runit-helper diff --git a/apparmor.d/profiles-m-r/runit-helper b/apparmor.d/profiles-m-r/runit-helper new file mode 100644 index 000000000..94b3816c9 --- /dev/null +++ b/apparmor.d/profiles-m-r/runit-helper @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/runit-helper/runit-helper +profile runit-helper @{exec_path} { + include + + @{exec_path} mr, + + @{bin}/mkdir rix, + + @{run}/runit/ rw, + @{run}/runit/supervise/ w, + + include if exists +} + +# vim:syntax=apparmor From e83a9a60dc146dd78c92e6d7b10e88beeaf1ab0b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 00:18:01 +0200 Subject: [PATCH 0942/1455] feat(profile): finalize upgrade process. --- apparmor.d/groups/apt/dpkg-preconfigure | 1 - apparmor.d/groups/apt/dpkg-scripts | 16 ++++++++-------- apparmor.d/groups/browsers/firefox | 2 +- apparmor.d/groups/snap/snap | 5 +++-- apparmor.d/groups/snap/snapd | 2 ++ apparmor.d/profiles-s-z/which | 2 +- apparmor.d/profiles-s-z/whiptail | 6 ++---- 7 files changed, 17 insertions(+), 17 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index 4dbfae0a8..716cd1dc8 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -30,7 +30,6 @@ profile dpkg-preconfigure @{exec_path} { @{bin}/head ix, @{bin}/locale ix, @{bin}/readlink ix, - @{bin}/readlink ix, @{bin}/realpath ix, @{bin}/sed ix, @{bin}/sort ix, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index e18ab78de..4fb4d04c4 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -47,11 +47,11 @@ profile dpkg-scripts @{exec_path} { @{sbin}/update-rc.d Cx -> rc, # Maintainer scripts can legitimately start/restart anything - @{bin}/** Px, - @{sbin}/** Px, - @{lib}/** Px, - /usr/share/** Px, - /etc/init.d/* Px, + @{bin}/** PUx, + @{sbin}/** PUx, + @{lib}/** PUx, + /usr/share/** PUx, + /etc/init.d/* PUx, # Maintainer's scripts can update a lot of files / r, @@ -76,9 +76,9 @@ profile dpkg-scripts @{exec_path} { include dbus send bus=system path=/ - interface=org.freedesktop.DBus - member=ReloadConfig - peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), + interface=org.freedesktop.DBus + member=ReloadConfig + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), include if exists } diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 7d1be8442..a561954a3 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -39,7 +39,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{bin}/kreadconfig{,5} rPx, @{bin}/plasma-browser-integration-host rPx, @{bin}/speech-dispatcher rPx, - @{sbin}/update-mime-database rPx, + @{bin}/update-mime-database rPx, @{lib}/gvfsd-metadata rPx, @{lib}/mozilla/kmozillahelper rPUx, @{open_path} rPx -> child-open, diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap index 8549d8315..562f49dca 100644 --- a/apparmor.d/groups/snap/snap +++ b/apparmor.d/groups/snap/snap @@ -85,8 +85,9 @@ profile snap @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/kernel/security/apparmor/features/{,**} r, - @{PROC}/@{pids}/cgroup r, - @{PROC}/@{pids}/mountinfo r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/maps r, + @{PROC}/@{pid}/mountinfo r, @{PROC}/cgroups r, @{PROC}/cmdline r, @{PROC}/sys/kernel/random/uuid r, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 0eb3adb8c..0481af5de 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -208,6 +208,8 @@ profile snapd @{exec_path} { network netlink raw, + signal receive set=kill peer=snapd, + @{bin}/journalctl mr, /etc/machine-id r, diff --git a/apparmor.d/profiles-s-z/which b/apparmor.d/profiles-s-z/which index cc95a17f9..df049741f 100644 --- a/apparmor.d/profiles-s-z/which +++ b/apparmor.d/profiles-s-z/which @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/which{.debianutils,} +@{exec_path} = @{bin}/which{,.debianutils} profile which @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-s-z/whiptail b/apparmor.d/profiles-s-z/whiptail index a7b98ebee..f0efad77b 100644 --- a/apparmor.d/profiles-s-z/whiptail +++ b/apparmor.d/profiles-s-z/whiptail @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/whiptail -profile whiptail @{exec_path} flags=(complain) { +profile whiptail @{exec_path} { include include @@ -16,9 +16,7 @@ profile whiptail @{exec_path} flags=(complain) { @{exec_path} mr, - /etc/newt/palette.* r, - - owner @{tmp}/gpm* w, + /usr/share/terminfo/** r, include if exists } From d9430c68c190f26cca9a2291c74b4f9bba4617c0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 00:55:48 +0200 Subject: [PATCH 0943/1455] build: improve error message in the stack direcive. --- pkg/prebuild/directive/stack.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/directive/stack.go b/pkg/prebuild/directive/stack.go index f80689827..a43849228 100644 --- a/pkg/prebuild/directive/stack.go +++ b/pkg/prebuild/directive/stack.go @@ -55,7 +55,10 @@ func (s Stack) Apply(opt *Option, profile string) (string, error) { res := "" for name := range opt.ArgMap { - stackedProfile := prebuild.RootApparmord.Join(name).MustReadFileAsString() + stackedProfile, err := prebuild.RootApparmord.Join(name).ReadFileAsString() + if err != nil { + return "", fmt.Errorf("%s need to stack: %w", name, err) + } m := regRules.FindStringSubmatch(stackedProfile) if len(m) < 2 { return "", fmt.Errorf("no profile found in %s", name) From 780ca65953a726133f412e61020e749ca99d0850 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 00:57:37 +0200 Subject: [PATCH 0944/1455] build(fsp): set stacked variables. --- pkg/prebuild/prepare/fsp.go | 77 ++++++++++++++++++++++++++++--------- 1 file changed, 59 insertions(+), 18 deletions(-) diff --git a/pkg/prebuild/prepare/fsp.go b/pkg/prebuild/prepare/fsp.go index 0d4c23076..f8d3cb17f 100644 --- a/pkg/prebuild/prepare/fsp.go +++ b/pkg/prebuild/prepare/fsp.go @@ -5,11 +5,60 @@ package prepare import ( - "strings" + "regexp" "github.com/roddhjav/apparmor.d/pkg/paths" "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/util" +) + +var ( + tunables = map[string]string{ + // Set systemd profiles name + "sd": "sd", + "sdu": "sdu", + "systemd_user": "systemd-user", + "systemd": "systemd", + + // With FSP on apparmor 4.1+, the dbus profiles don't get stacked as they + "dbus_system": "dbus-system", + "dbus_session": "dbus-session", + + // Update name of stacked profiles + "apt_news": "", + "colord": "", + "e2scrub_all": "", + "e2scrub": "", + "fprintd": "", + "fwupd": "", + "fwupdmgr": "", + "geoclue": "", + "irqbalance": "", + "logrotate": "", + "ModemManager": "", + "nm_priv_helper": "", + "pcscd": "", + "polkitd": "", + "power_profiles_daemon": "", + "rsyslogd": "", + "systemd_coredump": "", + "systemd_homed": "", + "systemd_hostnamed": "", + "systemd_importd": "", + "systemd_initctl": "", + "systemd_journal_remote": "", + "systemd_journald": "", + "systemd_localed": "", + "systemd_logind": "", + "systemd_machined": "", + "systemd_networkd": "", + "systemd_oomd": "", + "systemd_resolved": "", + "systemd_rfkill": "", + "systemd_timedated": "", + "systemd_timesyncd": "", + "systemd_userdbd": "", + "upowerd": "", + } ) type FullSystemPolicy struct { @@ -33,28 +82,20 @@ func (p FullSystemPolicy) Apply() ([]string, error) { return res, err } - // Set systemd profile name + // Set profile name for FSP path := prebuild.RootApparmord.Join("tunables/multiarch.d/profiles") out, err := path.ReadFileAsString() if err != nil { return res, err } - out = strings.ReplaceAll(out, "@{p_systemd}=unconfined", "@{p_systemd}=systemd") - out = strings.ReplaceAll(out, "@{p_systemd_executor}=unconfined", "@{p_systemd_executor}=systemd-executor") - out = strings.ReplaceAll(out, "@{p_systemd_user}=unconfined", "@{p_systemd_user}=systemd-user") - out = strings.ReplaceAll(out, "@{p_systemd_user_executor}=unconfined", "@{p_systemd_user_executor}=systemd-user-executor") - if err := path.WriteFile([]byte(out)); err != nil { - return res, err + for varname, profile := range tunables { + pattern := regexp.MustCompile(`(@\{p_` + varname + `}=)([^\s]+)`) + if profile == "" { + out = pattern.ReplaceAllString(out, `@{p_`+varname+`}={$2,sd//&$2,$2//&sd}`) + } else { + out = pattern.ReplaceAllString(out, `@{p_`+varname+`}=`+profile) + } } - - // Fix conflicting x modifiers in abstractions - FIXME: Temporary solution - path = prebuild.RootApparmord.Join("abstractions/gstreamer") - out, err = path.ReadFileAsString() - if err != nil { - return res, err - } - regFixConflictX := util.ToRegexRepl([]string{`.*gst-plugin-scanner.*`, ``}) - out = regFixConflictX.Replace(out) if err := path.WriteFile([]byte(out)); err != nil { return res, err } From c07c5838e4855d97bf98f65496c302bbd305e71c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 01:00:08 +0200 Subject: [PATCH 0945/1455] build: add RBAC filter to the only/exclude directive. --- pkg/prebuild/cli/cli.go | 1 + pkg/prebuild/directive/filter.go | 4 ++++ pkg/prebuild/directories.go | 3 +++ 3 files changed, 8 insertions(+) diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 779cd5c0c..51636f848 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -80,6 +80,7 @@ func Configure() { if full && paths.New("apparmor.d/groups/_full").Exist() { prepare.Register("fsp") builder.Register("fsp") + prebuild.RBAC = true } else if prebuild.SystemdDir.Exist() { prepare.Register("systemd-early") } diff --git a/pkg/prebuild/directive/filter.go b/pkg/prebuild/directive/filter.go index a6513f37e..b6ec56816 100644 --- a/pkg/prebuild/directive/filter.go +++ b/pkg/prebuild/directive/filter.go @@ -39,6 +39,10 @@ func init() { } func filterRuleForUs(opt *Option) bool { + if prebuild.RBAC && slices.Contains(opt.ArgList, "RBAC") { + return true + } + abiStr := fmt.Sprintf("abi%d", prebuild.ABI) if slices.Contains(opt.ArgList, abiStr) { return true diff --git a/pkg/prebuild/directories.go b/pkg/prebuild/directories.go index d5d5a7266..37cbc69bc 100644 --- a/pkg/prebuild/directories.go +++ b/pkg/prebuild/directories.go @@ -13,6 +13,9 @@ var ( // AppArmor version Version = 4.0 + // Either or not RBAC is enabled + RBAC = false + // Pkgname is the name of the package Pkgname = "apparmor.d" From f717ea7383ea32abde752af3a88dd1bf87709a25 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 01:01:08 +0200 Subject: [PATCH 0946/1455] feat(aa): add a mount flag. --- pkg/aa/mount.go | 2 +- pkg/aa/util.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/aa/mount.go b/pkg/aa/mount.go index bbf66b577..72719414d 100644 --- a/pkg/aa/mount.go +++ b/pkg/aa/mount.go @@ -29,7 +29,7 @@ func init() { "ro", "rw", "acl", "async", "atime", "bind", "dev", "diratime", "dirsync", "exec", "iversion", "loud", "mand", "move", "noacl", "noatime", "nodev", "nodiratime", "noexec", "noiversion", "nomand", - "norelatime", "nosuid", "nouser", "private", "rbind", "relatime", + "norelatime", "nosuid", "nosymfollow", "nouser", "private", "rbind", "relatime", "remount", "rprivate", "rshared", "rslave", "runbindable", "shared", "silent", "slave", "strictatime", "suid", "sync", "unbindable", "user", "verbose", diff --git a/pkg/aa/util.go b/pkg/aa/util.go index 485478fef..5a7049d69 100644 --- a/pkg/aa/util.go +++ b/pkg/aa/util.go @@ -182,7 +182,7 @@ func toValues(kind Kind, key string, input string) ([]string, error) { continue } if !slices.Contains(req, res[idx]) { - return nil, fmt.Errorf("unrecognized %s: %s", key, res[idx]) + return nil, fmt.Errorf("unrecognized %s for rule %s: %s", key, kind, res[idx]) } } slices.SortFunc(res, func(i, j string) int { From 04b6cade644c0adfdb4b0a9bdc4f71bff78bc8ae Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 01:17:14 +0200 Subject: [PATCH 0947/1455] feat(profile): use profile variable in rules such as in dbus, ptrace, unix... --- apparmor.d/abstractions/app/sudo | 4 ++-- apparmor.d/abstractions/base.d/complete | 2 +- .../abstractions/bus/net.hadess.PowerProfiles | 2 +- .../abstractions/bus/net.reactivated.Fprint | 6 +++--- apparmor.d/abstractions/bus/org.a11y | 10 +++++----- apparmor.d/abstractions/bus/org.bluez | 14 +++++++------- .../abstractions/bus/org.freedesktop.Accounts | 10 +++++----- .../abstractions/bus/org.freedesktop.Avahi | 10 +++++----- .../bus/org.freedesktop.ColorManager | 8 ++++---- .../abstractions/bus/org.freedesktop.GeoClue2 | 10 +++++----- .../bus/org.freedesktop.ModemManager1 | 6 +++--- .../abstractions/bus/org.freedesktop.PolicyKit1 | 8 ++++---- .../bus/org.freedesktop.RealtimeKit1 | 6 +++--- .../abstractions/bus/org.freedesktop.UPower | 8 ++++---- .../bus/org.freedesktop.UPower.PowerProfiles | 2 +- .../abstractions/bus/org.freedesktop.hostname1 | 2 +- .../abstractions/bus/org.freedesktop.locale1 | 2 +- .../abstractions/bus/org.freedesktop.login1 | 8 ++++---- .../bus/org.freedesktop.login1.Session | 8 ++++---- .../abstractions/bus/org.freedesktop.network1 | 2 +- .../abstractions/bus/org.freedesktop.resolve1 | 4 ++-- .../abstractions/bus/org.freedesktop.timedate1 | 2 +- .../abstractions/bus/org.gnome.ArchiveManager1 | 4 ++-- apparmor.d/abstractions/mapping/login | 2 +- apparmor.d/abstractions/mapping/sshd | 4 ++-- apparmor.d/groups/avahi/avahi-browse | 2 +- apparmor.d/groups/avahi/avahi-resolve | 4 ++-- apparmor.d/groups/bluetooth/bluetoothctl | 2 +- apparmor.d/groups/bluetooth/obexd | 2 +- apparmor.d/groups/bus/ibus-dconf | 1 + apparmor.d/groups/cups/cups-browsed | 2 +- apparmor.d/groups/filesystem/udisksd | 4 ++-- apparmor.d/groups/flatpak/flatpak | 4 ++-- apparmor.d/groups/freedesktop/pulseaudio | 6 +++--- apparmor.d/groups/freedesktop/upower | 2 +- apparmor.d/groups/freedesktop/xorg | 2 +- apparmor.d/groups/gnome/gdm | 4 ++-- apparmor.d/groups/gnome/gdm-session-worker | 6 +++--- apparmor.d/groups/gnome/gnome-calendar | 2 +- apparmor.d/groups/gnome/gnome-control-center | 16 ++++++++-------- apparmor.d/groups/gnome/gnome-firmware | 4 ++-- apparmor.d/groups/gnome/gnome-keyring-daemon | 2 +- apparmor.d/groups/gnome/gnome-session-binary | 2 +- apparmor.d/groups/gnome/gnome-shell | 12 ++++++------ apparmor.d/groups/gnome/gsd-color | 2 +- apparmor.d/groups/gnome/gsd-housekeeping | 8 ++++---- apparmor.d/groups/gnome/gsd-media-keys | 2 +- apparmor.d/groups/gnome/gsd-power | 2 +- apparmor.d/groups/gnome/gsd-xsettings | 7 +------ apparmor.d/groups/gnome/loupe | 5 +++++ apparmor.d/groups/kde/sddm | 2 +- apparmor.d/groups/network/NetworkManager | 6 +++--- apparmor.d/groups/network/networkd-dispatcher | 2 +- apparmor.d/groups/polkit/polkit-agent-helper | 4 ++-- apparmor.d/groups/snap/snapd | 2 +- apparmor.d/groups/ssh/sshd | 2 +- apparmor.d/groups/systemd/homectl | 2 +- apparmor.d/groups/systemd/hostnamectl | 2 +- apparmor.d/groups/systemd/localectl | 2 +- apparmor.d/groups/systemd/loginctl | 2 +- apparmor.d/groups/systemd/networkctl | 2 +- apparmor.d/groups/systemd/resolvectl | 2 +- apparmor.d/groups/systemd/systemd-inhibit | 2 +- apparmor.d/groups/systemd/systemd-networkd | 2 +- apparmor.d/groups/systemd/systemd-timesyncd | 2 +- .../systemd/systemd-tty-ask-password-agent | 2 +- apparmor.d/groups/utils/chsh | 2 +- apparmor.d/groups/utils/login | 2 +- apparmor.d/profiles-a-f/evince | 2 +- apparmor.d/profiles-a-f/fwupdmgr | 2 +- apparmor.d/profiles-m-r/qemu-ga | 2 +- apparmor.d/tunables/multiarch.d/profiles | 6 +++--- 72 files changed, 152 insertions(+), 151 deletions(-) diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 333cbddbd..1286b1571 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -24,8 +24,8 @@ network netlink raw, # PAM - #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus talk bus=system name=org.freedesktop.home1 label="@{p_systemd_homed}" + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" dbus (send receive) bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd.Manager diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index 230e0c9d5..06b413342 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -18,7 +18,7 @@ signal (receive) set=(term,kill) peer=openbox, signal (receive) set=(term,kill) peer=su, - ptrace (readby) peer=systemd-coredump, + ptrace (readby) peer=@{p_systemd_coredump}, @{etc_rw}/localtime r, /etc/locale.conf r, diff --git a/apparmor.d/abstractions/bus/net.hadess.PowerProfiles b/apparmor.d/abstractions/bus/net.hadess.PowerProfiles index 63f224c42..7e7560992 100644 --- a/apparmor.d/abstractions/bus/net.hadess.PowerProfiles +++ b/apparmor.d/abstractions/bus/net.hadess.PowerProfiles @@ -4,7 +4,7 @@ abi , - #aa:dbus common bus=system name=net.hadess.PowerProfiles label=power-profiles-daemon + #aa:dbus common bus=system name=net.hadess.PowerProfiles label="@{p_power_profiles_daemon}" include if exists diff --git a/apparmor.d/abstractions/bus/net.reactivated.Fprint b/apparmor.d/abstractions/bus/net.reactivated.Fprint index 2f3660082..0241fc889 100644 --- a/apparmor.d/abstractions/bus/net.reactivated.Fprint +++ b/apparmor.d/abstractions/bus/net.reactivated.Fprint @@ -4,12 +4,12 @@ abi , - #aa:dbus common bus=system name=net.reactivated.Fprint label=fprintd + #aa:dbus common bus=system name=net.reactivated.Fprint label="@{p_fprintd}" dbus send bus=system path=/net/reactivated/Fprint/Manager interface=net.reactivated.Fprint.Manager member={GetDevices,GetDefaultDevice} - peer=(name="@{busname}", label=fprintd), + peer=(name="@{busname}", label="@{p_fprintd}"), dbus send bus=system path=/net/reactivated/Fprint/Manager interface=net.reactivated.Fprint.Manager @@ -19,7 +19,7 @@ dbus send bus=system path=/net/reactivated/Fprint/Manager interface=net.reactivated.Fprint.Manager member={GetDevices,GetDefaultDevice} - peer=(name=net.reactivated.Fprint, label=fprintd), + peer=(name=net.reactivated.Fprint, label="@{p_fprintd}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y index 018109a62..ef0e15707 100644 --- a/apparmor.d/abstractions/bus/org.a11y +++ b/apparmor.d/abstractions/bus/org.a11y @@ -9,27 +9,27 @@ dbus receive bus=accessibility path=/org/a11y/atspi/registry interface=org.a11y.atspi.Registry member=EventListenerDeregistered - peer=(name="@{busname}", label=at-spi2-registryd), + peer=(name="@{busname}", label="@{p_at_spi2_registryd}"), dbus send bus=accessibility path=/org/a11y/atspi/registry interface=org.a11y.atspi.Registry member=GetRegisteredEvents - peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd), + peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller interface=org.a11y.atspi.DeviceEventController member={GetKeystrokeListeners,GetDeviceEventListeners} - peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd), + peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root interface=org.freedesktop.DBus.Properties member=Set - peer=(name="@{busname}", label=at-spi2-registryd), + peer=(name="@{busname}", label="@{p_at_spi2_registryd}"), dbus send bus=accessibility path=/org/a11y/atspi/accessible/root interface=org.a11y.atspi.Socket member=Embed - peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd), + peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), # Session bus diff --git a/apparmor.d/abstractions/bus/org.bluez b/apparmor.d/abstractions/bus/org.bluez index 296965691..201d3998c 100644 --- a/apparmor.d/abstractions/bus/org.bluez +++ b/apparmor.d/abstractions/bus/org.bluez @@ -4,37 +4,37 @@ abi , - #aa:dbus common bus=system name=org.bluez label=bluetoothd + #aa:dbus common bus=system name=org.bluez label="@{p_bluetoothd}" dbus receive bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=InterfacesRemoved - peer=(name="{@{busname},org.bluez}", label=bluetoothd), + peer=(name="{@{busname},org.bluez}", label="@{p_bluetoothd}"), dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name="{@{busname},org.bluez}", label=bluetoothd), + peer=(name="{@{busname},org.bluez}", label="@{p_bluetoothd}"), dbus send bus=system path=/org/bluez interface=org.bluez.AgentManager@{int} member={RegisterAgent,RequestDefaultAgent,UnregisterAgent} - peer=(name=org.bluez, label=bluetoothd), + peer=(name=org.bluez, label="@{p_bluetoothd}"), dbus send bus=system path=/org/bluez interface=org.bluez.ProfileManager@{int} member=RegisterProfile - peer=(name=org.bluez, label=bluetoothd), + peer=(name=org.bluez, label="@{p_bluetoothd}"), dbus send bus=system path=/org/bluez/hci@{int} interface=org.bluez.BatteryProviderManager@{int} member=RegisterProfile - peer=(name=org.bluez, label=bluetoothd), + peer=(name=org.bluez, label="@{p_bluetoothd}"), dbus send bus=system path=/org/bluez/hci@{int} interface=org.bluez.Media@{int} member=RegisterApplication - peer=(name=org.bluez, label=bluetoothd), + peer=(name=org.bluez, label="@{p_bluetoothd}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Accounts b/apparmor.d/abstractions/bus/org.freedesktop.Accounts index 2ad151c45..d15288d46 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Accounts +++ b/apparmor.d/abstractions/bus/org.freedesktop.Accounts @@ -4,27 +4,27 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.Accounts label=accounts-daemon + #aa:dbus common bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" dbus send bus=system path=/org/freedesktop/Accounts interface=org.freedesktop.Accounts member={FindUserByName,ListCachedUsers} - peer=(name="@{busname}", label=accounts-daemon), + peer=(name="@{busname}", label="@{p_accounts_daemon}"), dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.Accounts.User member=*Changed - peer=(name="@{busname}", label=accounts-daemon), + peer=(name="@{busname}", label="@{p_accounts_daemon}"), dbus receive bus=system path=/org/freedesktop/Accounts interface=org.freedesktop.Accounts member=UserAdded - peer=(name="@{busname}", label=accounts-daemon), + peer=(name="@{busname}", label="@{p_accounts_daemon}"), dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.DBus.Properties member=*Changed - peer=(name="@{busname}", label=accounts-daemon), + peer=(name="@{busname}", label="@{p_accounts_daemon}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Avahi b/apparmor.d/abstractions/bus/org.freedesktop.Avahi index e3128f984..38e05f48c 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Avahi +++ b/apparmor.d/abstractions/bus/org.freedesktop.Avahi @@ -4,27 +4,27 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.Avahi label=avahi-daemon + #aa:dbus common bus=system name=org.freedesktop.Avahi label="@{p_avahi_daemon}" dbus send bus=system path=/ interface=org.freedesktop.DBus.Peer member=Ping - peer=(name=org.freedesktop.Avahi, label=avahi-daemon), + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), dbus send bus=system path=/ interface=org.freedesktop.Avahi.Server member={GetAPIVersion,GetState,Service*New} - peer=(name=org.freedesktop.Avahi, label=avahi-daemon), + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), dbus send bus=system path=/Client@{int}/ServiceBrowser@{int} interface=org.freedesktop.Avahi.ServiceBrowser member=Free - peer=(name=org.freedesktop.Avahi, label=avahi-daemon), + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} interface=org.freedesktop.Avahi.ServiceBrowser member={ItemNew,AllForNow,CacheExhausted} - peer=(name="@{busname}", label=avahi-daemon), + peer=(name="@{busname}", label="@{p_avahi_daemon}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager index 27776b776..3a63d95dc 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager @@ -4,22 +4,22 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.ColorManager label=colord + #aa:dbus common bus=system name=org.freedesktop.ColorManager label="@{p_colord}" dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member=GetDevices - peer=(name="@{busname}", label=colord), + peer=(name="@{busname}", label="@{p_colord}"), dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member=CreateDevice - peer=(name="@{busname}", label=colord), + peer=(name="@{busname}", label="@{p_colord}"), dbus receive bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member={DeviceAdded,DeviceRemoved} - peer=(name="@{busname}", label=colord), + peer=(name="@{busname}", label="@{p_colord}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 index feaced7c3..9957c7b67 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 +++ b/apparmor.d/abstractions/bus/org.freedesktop.GeoClue2 @@ -4,26 +4,26 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.GeoClue2 label=geoclue + #aa:dbus common bus=system name=org.freedesktop.GeoClue2 label="@{p_geoclue}" dbus send bus=system path=/org/freedesktop/GeoClue2/Agent interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=org.freedesktop.DBus, label=geoclue), + peer=(name=org.freedesktop.DBus, label="@{p_geoclue}"), dbus receive bus=system path=/org/freedesktop/GeoClue2/Agent interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name="@{busname}", label=geoclue), + peer=(name="@{busname}", label="@{p_geoclue}"), dbus send bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name="@{busname}", label=geoclue), + peer=(name="@{busname}", label="@{p_geoclue}"), dbus send bus=system path=/org/freedesktop/GeoClue2/Manager interface=org.freedesktop.GeoClue2.Manager member=AddAgent - peer=(name="@{busname}", label=geoclue), + peer=(name="@{busname}", label="@{p_geoclue}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 b/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 index 41e03f325..4f53ba497 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.ModemManager1 @@ -4,17 +4,17 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.ModemManager1 label=ModemManager + #aa:dbus common bus=system name=org.freedesktop.ModemManager1 label="@{p_ModemManager}" dbus send bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name=org.freedesktop.ModemManager1, label=ModemManager), + peer=(name=org.freedesktop.ModemManager1, label="@{p_ModemManager}"), dbus send bus=system path=/org/freedesktop/ModemManager1 interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name="@{busname}", label=ModemManager), + peer=(name="@{busname}", label="@{p_ModemManager}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 index b770cdbb1..9dfab7481 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 @@ -4,22 +4,22 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.PolicyKit1 label=polkitd + #aa:dbus common bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=Changed - peer=(name="@{busname}", label=polkitd), + peer=(name="@{busname}", label="@{p_polkitd}"), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=CheckAuthorization - peer=(name=org.freedesktop.PolicyKit1, label=polkitd), + peer=(name=org.freedesktop.PolicyKit1, label="@{p_polkitd}"), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=CheckAuthorization - peer=(name="@{busname}", label=polkitd), + peer=(name="@{busname}", label="@{p_polkitd}"), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=CheckAuthorization diff --git a/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 b/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 index 0c6abbdbe..f66fdb20a 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1 @@ -6,7 +6,7 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.RealtimeKit1 label=rtkit-daemon + #aa:dbus common bus=system name=org.freedesktop.RealtimeKit1 label="@{p_rtkit_daemon}" dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.DBus.Properties member=Get @@ -15,12 +15,12 @@ dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.RealtimeKit1 member={MakeThreadHighPriority,MakeThreadRealtime} - peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label=rtkit-daemon), + peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label="@{p_rtkit_daemon}"), dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.RealtimeKit1 member={MakeThreadHighPriorityWithPID,MakeThreadRealtimeWithPID} - peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label=rtkit-daemon), + peer=(name="{@{busname},org.freedesktop.RealtimeKit1}", label="@{p_rtkit_daemon}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower b/apparmor.d/abstractions/bus/org.freedesktop.UPower index ec0a2b15b..69218b619 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower +++ b/apparmor.d/abstractions/bus/org.freedesktop.UPower @@ -4,22 +4,22 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.UPower label=upowerd + #aa:dbus common bus=system name=org.freedesktop.UPower label="@{p_upowerd}" dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower member=EnumerateDevices - peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label="@{p_upowerd}"), dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.DBus.Properties member=GetDisplayDevice - peer=(name=org.freedesktop.UPower, label=upowerd), + peer=(name=org.freedesktop.UPower, label="@{p_upowerd}"), dbus receive bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower member=DeviceAdded - peer=(name="{@{busname},org.freedesktop.UPower}", label=upowerd), + peer=(name="{@{busname},org.freedesktop.UPower}", label="@{p_upowerd}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower.PowerProfiles b/apparmor.d/abstractions/bus/org.freedesktop.UPower.PowerProfiles index 3d3980f81..45e88b103 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower.PowerProfiles +++ b/apparmor.d/abstractions/bus/org.freedesktop.UPower.PowerProfiles @@ -4,7 +4,7 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.UPower.PowerProfiles label=power-profiles-daemon + #aa:dbus common bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon} include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 index e6182bead..0a8d86be1 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 @@ -4,7 +4,7 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed + #aa:dbus common bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}" dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member=Get diff --git a/apparmor.d/abstractions/bus/org.freedesktop.locale1 b/apparmor.d/abstractions/bus/org.freedesktop.locale1 index 511a44dd6..1348c8a39 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.locale1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.locale1 @@ -4,7 +4,7 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.locale1 label=systemd-localed + #aa:dbus common bus=system name=org.freedesktop.locale1 label="@{p_systemd_localed}" dbus send bus=system path=/org/freedesktop/locale1 interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/abstractions/bus/org.freedesktop.login1 b/apparmor.d/abstractions/bus/org.freedesktop.login1 index 7f9fc5fb7..ad368ed98 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.login1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.login1 @@ -4,22 +4,22 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus common bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member={Inhibit,CanHibernate,CanHybridSleep,CanPowerOff,CanReboot,CanSuspend,CreateSession,GetSessionByPID} - peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"), dbus receive bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member={SessionNew,SessionRemoved,UserNew,UserRemoved,SeatNew,PrepareFor*} - peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"), dbus send bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.login1.Session member=PauseDeviceComplete - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.login1.Session b/apparmor.d/abstractions/bus/org.freedesktop.login1.Session index 23ec52c8e..f60c69301 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.login1.Session +++ b/apparmor.d/abstractions/bus/org.freedesktop.login1.Session @@ -4,22 +4,22 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus common bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=GetSession - peer=(name="@{busname}", label=systemd-logind), + peer=(name="@{busname}", label="@{p_systemd_logind}"), dbus send bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.login1.Session member={ReleaseDevice,TakeControl,TakeDevice,SetBrightness,SetLockedHint,SetIdleHint} - peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"), dbus receive bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.login1.Session member={PauseDevice,Unlock} - peer=(name="{@{busname},org.freedesktop.login1}", label=systemd-logind), + peer=(name="{@{busname},org.freedesktop.login1}", label="@{p_systemd_logind}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.network1 b/apparmor.d/abstractions/bus/org.freedesktop.network1 index be11a7ceb..7583a3e9d 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.network1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.network1 @@ -4,7 +4,7 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.network1 label=systemd-networkd + #aa:dbus common bus=system name=org.freedesktop.network1 label="@{p_systemd_networkd}" include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 index 8c7670382..e2c4b3886 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 @@ -4,12 +4,12 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.resolve1 label=systemd-resolved + #aa:dbus common bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" dbus send bus=system path=/org/freedesktop/resolve1 interface=org.freedesktop.resolve1.Manager member={SetLink*,ResolveHostname} - peer=(name="{@{busname},org.freedesktop.resolve1}", label=systemd-resolved), + peer=(name="{@{busname},org.freedesktop.resolve1}", label="@{p_systemd_resolved}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.timedate1 b/apparmor.d/abstractions/bus/org.freedesktop.timedate1 index 83f85c678..8f6118355 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.timedate1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.timedate1 @@ -4,7 +4,7 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.timedate1 label=systemd-timedated + #aa:dbus common bus=system name=org.freedesktop.timedate1 label="@{p_systemd_timedated}" include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 b/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 index ce572e9cd..6bfa6114b 100644 --- a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 +++ b/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 @@ -4,12 +4,12 @@ abi , - #aa:dbus common bus=session name=org.gnome.ArchiveManager1 label=file-roller + #aa:dbus common bus=session name=org.gnome.ArchiveManager1 label="@{p_file_roller}" dbus send bus=session path=/org/gnome/ArchiveManager1 interface=org.gnome.ArchiveManager1 member=GetSupportedTypes - peer=(name="@{busname}", label=file-roller), + peer=(name="@{busname}", label="@{p_file_roller}"), include if exists diff --git a/apparmor.d/abstractions/mapping/login b/apparmor.d/abstractions/mapping/login index 54a8c1c7f..7ccc2d678 100644 --- a/apparmor.d/abstractions/mapping/login +++ b/apparmor.d/abstractions/mapping/login @@ -25,7 +25,7 @@ dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=ReleaseSession - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), @{etc_ro}/security/group.conf r, @{etc_ro}/security/limits.conf r, diff --git a/apparmor.d/abstractions/mapping/sshd b/apparmor.d/abstractions/mapping/sshd index bb0064956..97f0b077e 100644 --- a/apparmor.d/abstractions/mapping/sshd +++ b/apparmor.d/abstractions/mapping/sshd @@ -28,7 +28,7 @@ network inet6 stream, network netlink raw, - signal receive set=exists peer=systemd-journald, + signal receive set=exists peer=@{p_systemd_journald}, signal receive set=hup peer=@{p_systemd}, unix bind type=stream addr=@@{udbus}/bus/sshd/system, @@ -36,7 +36,7 @@ dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), /etc/motd r, /etc/locale.conf r, diff --git a/apparmor.d/groups/avahi/avahi-browse b/apparmor.d/groups/avahi/avahi-browse index 47c22d72d..3ac729baa 100644 --- a/apparmor.d/groups/avahi/avahi-browse +++ b/apparmor.d/groups/avahi/avahi-browse @@ -17,7 +17,7 @@ profile avahi-browse @{exec_path} { dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int} interface=org.freedesktop.Avahi.ServiceTypeBrowser member={ItemNew,AllForNow,CacheExhausted} - peer=(name=:*, label=avahi-daemon), + peer=(name=:*, label="@{p_avahi_daemon}"), @{exec_path} mr, diff --git a/apparmor.d/groups/avahi/avahi-resolve b/apparmor.d/groups/avahi/avahi-resolve index ff2cae183..1a66b4726 100644 --- a/apparmor.d/groups/avahi/avahi-resolve +++ b/apparmor.d/groups/avahi/avahi-resolve @@ -17,12 +17,12 @@ profile avahi-resolve @{exec_path} { dbus send bus=system path=/Client@{int}/AddressResolver@{int} interface=org.freedesktop.Avahi.AddressResolver member={Free,HostNameResolverNew} - peer=(name=:*, label=avahi-daemon), + peer=(name=:*, label="@{p_avahi_daemon}"), dbus receive bus=system path=/Client@{int}/AddressResolver@{int} interface=org.freedesktop.Avahi.AddressResolver member={Failure,Found} - peer=(name=:*, label=avahi-daemon), + peer=(name=:*, label="@{p_avahi_daemon}"), @{exec_path} mr, diff --git a/apparmor.d/groups/bluetooth/bluetoothctl b/apparmor.d/groups/bluetooth/bluetoothctl index e408b94b9..0b075581b 100644 --- a/apparmor.d/groups/bluetooth/bluetoothctl +++ b/apparmor.d/groups/bluetooth/bluetoothctl @@ -15,7 +15,7 @@ profile bluetoothctl @{exec_path} { network bluetooth raw, - #aa:dbus talk bus=system name=org.bluez label=bluetoothd + #aa:dbus talk bus=system name=org.bluez label="@{p_bluetoothd}" @{exec_path} mr, diff --git a/apparmor.d/groups/bluetooth/obexd b/apparmor.d/groups/bluetooth/obexd index 3da9b4f5d..5c1a7633e 100644 --- a/apparmor.d/groups/bluetooth/obexd +++ b/apparmor.d/groups/bluetooth/obexd @@ -22,7 +22,7 @@ profile obexd @{exec_path} { dbus receive bus=system path=/org/bluez/obex/@{uuid} interface=org.bluez.Profile1 member=Release - peer=(name=:*, label=bluetoothd), + peer=(name=:*, label="@{p_bluetoothd}"), @{exec_path} mr, diff --git a/apparmor.d/groups/bus/ibus-dconf b/apparmor.d/groups/bus/ibus-dconf index 6f66ec9b2..817d63175 100644 --- a/apparmor.d/groups/bus/ibus-dconf +++ b/apparmor.d/groups/bus/ibus-dconf @@ -15,6 +15,7 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) { include include + signal receive set=kill peer=@{p_systemd_user}, signal receive set=term peer=ibus-daemon, dbus receive bus=session diff --git a/apparmor.d/groups/cups/cups-browsed b/apparmor.d/groups/cups/cups-browsed index f671ce6e9..78e7883cb 100644 --- a/apparmor.d/groups/cups/cups-browsed +++ b/apparmor.d/groups/cups/cups-browsed @@ -29,7 +29,7 @@ profile cups-browsed @{exec_path} { dbus receive bus=system path=/ interface=org.freedesktop.Avahi.Server member=StateChanged - peer=(name=:*, label=avahi-daemon), + peer=(name=:*, label="@{p_avahi_daemon}"), dbus receive bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.NetworkManager diff --git a/apparmor.d/groups/filesystem/udisksd b/apparmor.d/groups/filesystem/udisksd index 7d4febb1f..1ff219bbe 100644 --- a/apparmor.d/groups/filesystem/udisksd +++ b/apparmor.d/groups/filesystem/udisksd @@ -65,8 +65,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { signal receive set=int peer=@{p_systemd}, #aa:dbus own bus=system name=org.freedesktop.UDisks2 - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind - #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" @{exec_path} mr, diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index c958bd2cd..52e9e32ef 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -41,8 +41,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain signal send peer=flatpak-app, #aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper - #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon - #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd + #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" dbus send bus=session path=/org/freedesktop/portal/documents interface=org.freedesktop.portal.Documents diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 804020b7b..fab642571 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -50,12 +50,12 @@ profile pulseaudio @{exec_path} { dbus receive bus=system path=/Client@{int}/ServiceResolver@{int} interface=org.freedesktop.Avahi.ServiceResolver member=Found - peer=(name=:*, label=avahi-daemon), + peer=(name=:*, label="@{p_avahi_daemon}"), dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} interface=org.freedesktop.Avahi.ServiceBrowser member=ItemRemove - peer=(name=:*, label=avahi-daemon), + peer=(name=:*, label="@{p_avahi_daemon}"), dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager @@ -65,7 +65,7 @@ profile pulseaudio @{exec_path} { dbus send bus=system path=/Client@{int}/ServiceResolver@{int} interface=org.freedesktop.Avahi.ServiceResolver member={Found,Free} - peer=(name=org.freedesktop.Avahi, label=avahi-daemon), + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), @{exec_path} mrix, diff --git a/apparmor.d/groups/freedesktop/upower b/apparmor.d/groups/freedesktop/upower index 931b47509..0f6f9abeb 100644 --- a/apparmor.d/groups/freedesktop/upower +++ b/apparmor.d/groups/freedesktop/upower @@ -13,7 +13,7 @@ profile upower @{exec_path} { include include - #aa:dbus own bus=system name=org.freedesktop.UPower label=upowerd + #aa:dbus own bus=system name=org.freedesktop.UPower label="@{p_upowerd}" @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 00e277f1f..12c82aea3 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -48,7 +48,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/login1/session/* interface=org.freedesktop.login1.Session member=ReleaseControl - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), @{exec_path} mrix, diff --git a/apparmor.d/groups/gnome/gdm b/apparmor.d/groups/gnome/gdm index e35d165a2..435d055fa 100644 --- a/apparmor.d/groups/gnome/gdm +++ b/apparmor.d/groups/gnome/gdm @@ -34,8 +34,8 @@ profile gdm @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=system name=org.gnome.DisplayManager - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind - #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" + #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 1a05892b6..a5dac16fa 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -49,13 +49,13 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { unix bind type=stream addr=@@{udbus}/bus/gdm-session-wor/system, - #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon - #aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label=systemd-homed + #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" + #aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label="@{p_systemd_homed}" dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member={*Session,CreateSessionWithPIDFD} - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), @{exec_path} mrix, diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index c81e591cf..235c0ce9e 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -32,7 +32,7 @@ profile gnome-calendar @{exec_path} { #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Sources@{int} label=evolution-source-registry #aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color - #aa:dbus talk bus=system name=org.freedesktop.GeoClue2 label=geoclue + #aa:dbus talk bus=system name=org.freedesktop.GeoClue2 label="@{p_geoclue}" dbus send bus=session path=/org/gnome/evolution/dataserver/SourceManager{,/**} interface=org.freedesktop.DBus.ObjectManager diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 1f0b6239e..1007d55e2 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -45,18 +45,18 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=system name=com.ubuntu.WhoopsiePreferences label=whoopsie-preferences #aa:dbus talk bus=system name=net.hadess.SwitcherooControl label=switcheroo-control - #aa:dbus talk bus=system name=net.reactivated.Fprint.Manager label=fprintd - #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon + #aa:dbus talk bus=system name=net.reactivated.Fprint.Manager label="@{p_fprintd}" + #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" #aa:dbus talk bus=system name=org.freedesktop.bolt1 label=boltd - #aa:dbus talk bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind - #aa:dbus talk bus=system name=org.freedesktop.ModemManager1 label=ModemManager + #aa:dbus talk bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}" + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" + #aa:dbus talk bus=system name=org.freedesktop.ModemManager1 label="@{p_ModemManager}" #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager - #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" #aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd - #aa:dbus talk bus=system name=org.freedesktop.UPower label=upowerd - #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=power-profiles-daemon + #aa:dbus talk bus=system name=org.freedesktop.UPower label="@{p_upowerd}" + #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon} @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-firmware b/apparmor.d/groups/gnome/gnome-firmware index af44afbec..706c16e87 100644 --- a/apparmor.d/groups/gnome/gnome-firmware +++ b/apparmor.d/groups/gnome/gnome-firmware @@ -20,8 +20,8 @@ profile gnome-firmware @{exec_path} { network inet6 stream, network netlink raw, - #aa:dbus talk bus=system name=org.freedesktop.fwupd label=fwupd path=/ - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus talk bus=system name=org.freedesktop.fwupd label="@{p_fwupd}" path=/ + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" @{exec_path} mr, @{open_path} rPx -> child-open-help, diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index c62175c85..37b3b7892 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -33,7 +33,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=GetSession - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 027a1ab96..dc9b6812e 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -32,7 +32,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { signal (send) set=(term) peer=gsd-*, #aa:dbus own bus=session name=org.gnome.SessionManager - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index bfd695959..6c781e204 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -83,11 +83,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { # Talk with gnome-shell - #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon + #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd - #aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind - #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=power-profiles-daemon + #aa:dbus talk bus=system name=org.freedesktop.ColorManager label="@{p_colord}" + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" + #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon} #aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm #aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding @@ -103,11 +103,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=RegisterAuthenticationAgent - peer=(name=:*, label=polkitd), + peer=(name=:*, label="@{p_polkitd}"), dbus receive bus=system path=/org/freedesktop/PolicyKit1/AuthenticationAgent interface=org.freedesktop.PolicyKit1.AuthenticationAgent member=BeginAuthentication - peer=(name=:*, label=polkitd), + peer=(name=:*, label="@{p_polkitd}"), dbus send bus=system path=/org/freedesktop/NetworkManager/AgentManager interface=org.freedesktop.NetworkManager.AgentManager diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 92cf3fa0a..2fe22305b 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -28,7 +28,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Color - #aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord + #aa:dbus talk bus=system name=org.freedesktop.ColorManager label="@{p_colord}" dbus receive bus=session path=/org/gtk/Settings interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index 9dec92df4..b8da39a4d 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -24,10 +24,10 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Housekeeping - dbus receive bus=session - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*, label=gnome-shell), + dbus send bus=session path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=Subscribe + peer=(name=org.freedesktop.systemd1), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 1ae8e2ada..2a2ea034f 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -38,7 +38,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=PowerOff - peer=(name=:*, label=systemd-logind), + peer=(name=:*, label="@{p_systemd_logind}"), dbus send bus=session path=/ interface=org.freedesktop.DBus diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 0d09a0e9c..a330b76ce 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -43,7 +43,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/UPower/KbdBacklight interface=org.freedesktop.UPower.KbdBacklight member=GetBrightness - peer=(name=:*, label=upowerd), + peer=(name=:*, label="@{p_upowerd}"), dbus receive bus=session path=/org/gtk/Settings interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index e5489c2b4..4fece3366 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -36,12 +36,7 @@ profile gsd-xsettings @{exec_path} { dbus send bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.Accounts.User member=SetInputSources - peer=(name=:*, label=accounts-daemon), - - dbus send bus=session path=/org/freedesktop/DBus - interface=org.freedesktop.DBus - member=GetId - peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + peer=(name=:*, label="@{p_accounts_daemon}"), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index 4ee0d9268..6f783627e 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -21,6 +21,11 @@ profile loupe @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + dbus send bus=system path=/org/freedesktop/hostname1 + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=@{p_systemd_hostnamed}), + @{exec_path} mr, @{bin}/bwrap rCx -> bwrap, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index b4111d6d0..396f256cc 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -58,7 +58,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { dbus receive bus=system path=/org/freedesktop/DisplayManager/Seat@{int} interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=systemd-logind), + peer=(name=:*, label="@{p_systemd_logind}"), dbus send bus=system path=/org/freedesktop/DisplayManager/Seat@{int} interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 008b6bd31..85257c89d 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -46,7 +46,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=system name=fi.w1.wpa_supplicant1 label=wpa-supplicant #aa:dbus talk bus=system name=org.fedoraproject.FirewallD1 label=firewalld #aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher - #aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved + #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" dbus send bus=system path=/org/freedesktop/nm_dispatcher interface=org.freedesktop.nm_dispatcher @@ -60,12 +60,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { dbus receive bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=InterfacesRemoved - peer=(name=:*, label=bluetoothd), + peer=(name=:*, label="@{p_bluetoothd}"), dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name=:*, label=bluetoothd), + peer=(name=:*, label="@{p_bluetoothd}"), dbus send bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager diff --git a/apparmor.d/groups/network/networkd-dispatcher b/apparmor.d/groups/network/networkd-dispatcher index f593db162..8b4d53b1c 100644 --- a/apparmor.d/groups/network/networkd-dispatcher +++ b/apparmor.d/groups/network/networkd-dispatcher @@ -16,7 +16,7 @@ profile networkd-dispatcher @{exec_path} { dbus receive bus=system path=/org/freedesktop/network1{,/link/*} interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=systemd-networkd), + peer=(name=:*, label="@{p_systemd_networkd}"), @{exec_path} mr, diff --git a/apparmor.d/groups/polkit/polkit-agent-helper b/apparmor.d/groups/polkit/polkit-agent-helper index e663c299e..5799ced5b 100644 --- a/apparmor.d/groups/polkit/polkit-agent-helper +++ b/apparmor.d/groups/polkit/polkit-agent-helper @@ -35,12 +35,12 @@ profile polkit-agent-helper @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=polkitd), + peer=(name=:*, label="@{p_polkitd}"), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=AuthenticationAgentResponse2 - peer=(name=:*, label=polkitd), + peer=(name=:*, label="@{p_polkitd}"), @{exec_path} mr, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 0481af5de..1add6c1c4 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -55,7 +55,7 @@ profile snapd @{exec_path} { dbus send bus=system path=/org/freedesktop/ interface=org.freedesktop.login1.Manager member={SetWallMessage,ScheduleShutdown} - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), dbus send bus=system path=/org/freedesktop/timedate1 interface=org.freedesktop.DBus.Properties diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index fe5a6f1cd..4b99aafd6 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -56,7 +56,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} - peer=(name=org.freedesktop.login1, label=systemd-logind), + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), @{exec_path} mrix, diff --git a/apparmor.d/groups/systemd/homectl b/apparmor.d/groups/systemd/homectl index aaae97d64..3a78c531e 100644 --- a/apparmor.d/groups/systemd/homectl +++ b/apparmor.d/groups/systemd/homectl @@ -19,7 +19,7 @@ profile homectl @{exec_path} { signal send peer=child-pager, - #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed + #aa:dbus talk bus=system name=org.freedesktop.home1 label="@{p_systemd_homed}" @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/hostnamectl b/apparmor.d/groups/systemd/hostnamectl index dcbe9a46f..6b29e260d 100644 --- a/apparmor.d/groups/systemd/hostnamectl +++ b/apparmor.d/groups/systemd/hostnamectl @@ -15,7 +15,7 @@ profile hostnamectl @{exec_path} { capability net_admin, - #aa:dbus talk bus=system name=org.freedesktop.hostname1 label=systemd-hostnamed + #aa:dbus talk bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}" dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member=GetAll diff --git a/apparmor.d/groups/systemd/localectl b/apparmor.d/groups/systemd/localectl index b49065fd7..f9a3625ef 100644 --- a/apparmor.d/groups/systemd/localectl +++ b/apparmor.d/groups/systemd/localectl @@ -16,7 +16,7 @@ profile localectl @{exec_path} { signal send set=cont peer=child-pager, - #aa:dbus talk bus=system name=org.freedesktop.locale1 label=systemd-localed + #aa:dbus talk bus=system name=org.freedesktop.locale1 label="@{p_systemd_localed}" @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/loginctl b/apparmor.d/groups/systemd/loginctl index c65bb4edd..f516d16db 100644 --- a/apparmor.d/groups/systemd/loginctl +++ b/apparmor.d/groups/systemd/loginctl @@ -20,7 +20,7 @@ profile loginctl @{exec_path} flags=(attach_disconnected) { signal send set=cont peer=child-pager, - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index 0163f2258..5b4b3e6b5 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -26,7 +26,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { unix (bind) type=stream addr=@@{udbus}/bus/networkctl/system, - #aa:dbus talk bus=system name=org.freedesktop.network1 label=systemd-networkd + #aa:dbus talk bus=system name=org.freedesktop.network1 label="@{p_systemd_networkd}" dbus send bus=system path=/org/freedesktop/network1{,/**} interface=org.freedesktop.DBus.Properties member=Get diff --git a/apparmor.d/groups/systemd/resolvectl b/apparmor.d/groups/systemd/resolvectl index 5c436f6c1..1ef3404d9 100644 --- a/apparmor.d/groups/systemd/resolvectl +++ b/apparmor.d/groups/systemd/resolvectl @@ -15,7 +15,7 @@ profile resolvectl @{exec_path} { signal send set=cont peer=child-pager, - #aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved + #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-inhibit b/apparmor.d/groups/systemd/systemd-inhibit index 2be38e6ba..ae475ff48 100644 --- a/apparmor.d/groups/systemd/systemd-inhibit +++ b/apparmor.d/groups/systemd/systemd-inhibit @@ -14,7 +14,7 @@ profile systemd-inhibit @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_resource, - signal receive set=term peer=packagekitd, + signal receive set=term peer=@{p_packagekitd}, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 3d6c3a4b7..df1e74048 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -42,7 +42,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.hostname1 member=SetHostname - peer=(name=org.freedesktop.hostname1, label=systemd-hostnamed), + peer=(name=org.freedesktop.hostname1, label="@{p_systemd_hostnamed}"), @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-timesyncd b/apparmor.d/groups/systemd/systemd-timesyncd index b603b2411..2ac7f09fb 100644 --- a/apparmor.d/groups/systemd/systemd-timesyncd +++ b/apparmor.d/groups/systemd/systemd-timesyncd @@ -22,7 +22,7 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) { network inet6 stream, unix (bind) type=stream addr=@@{udbus}/bus/systemd-timesyn/bus-api-timesync, - unix (send, receive) type=dgram addr=none peer=(label=@{p_systemd}, addr=none), + unix (send, receive) type=dgram addr=none peer=(label=@{p_sd}, addr=none), #aa:dbus own bus=system name=org.freedesktop.timesync1 diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index bbd4b7438..30d30b295 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -20,7 +20,7 @@ profile systemd-tty-ask-password-agent @{exec_path} { signal receive set=(term cont winch) peer=*//systemctl, signal receive set=(term cont winch) peer=deb-systemd-invoke, signal receive set=(term cont winch) peer=default, - signal receive set=(term cont winch) peer=logrotate, + signal receive set=(term cont winch) peer=@{p_logrotate}, signal receive set=(term cont winch) peer=makepkg//sudo, signal receive set=(term cont winch) peer=role_*, signal receive set=(term cont winch) peer=rpm, diff --git a/apparmor.d/groups/utils/chsh b/apparmor.d/groups/utils/chsh index 73f097a94..e3581be31 100644 --- a/apparmor.d/groups/utils/chsh +++ b/apparmor.d/groups/utils/chsh @@ -24,7 +24,7 @@ profile chsh @{exec_path} { network netlink raw, - #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed + #aa:dbus talk bus=system name=org.freedesktop.home1 label="@{p_systemd_homed}" @{exec_path} mr, diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login index 6968be40e..6227f4fc5 100644 --- a/apparmor.d/groups/utils/login +++ b/apparmor.d/groups/utils/login @@ -34,7 +34,7 @@ profile login @{exec_path} flags=(attach_disconnected) { ptrace read, - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index b7b087309..e07c91f3d 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -30,7 +30,7 @@ profile evince @{exec_path} { #aa:dbus own bus=session name=org.gnome.evince - #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label=gsd-media-keys + #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label="@{p_gsd_media_keys}" #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @{exec_path} rix, diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 6dffac5a6..3c9b0a3a9 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -27,7 +27,7 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network netlink raw, - #aa:dbus talk bus=system name=org.freedesktop.fwupd label=fwupd path=/ + #aa:dbus talk bus=system name=org.freedesktop.fwupd label="@{p_fwupd}" path=/ @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index 7fa668a71..5173c50d8 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -34,7 +34,7 @@ profile qemu-ga @{exec_path} { unix type=stream addr=@@{udbus}/bus/shutdown/system, - #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind + #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" include if exists } diff --git a/apparmor.d/tunables/multiarch.d/profiles b/apparmor.d/tunables/multiarch.d/profiles index ec1eff79c..6868ae87a 100644 --- a/apparmor.d/tunables/multiarch.d/profiles +++ b/apparmor.d/tunables/multiarch.d/profiles @@ -8,10 +8,10 @@ # All variables that refer to a profile name should be prefixed with `p_` # Name of the systemd profiles. Can be `unconfined` or `systemd`, `systemd-user` -@{p_systemd}=unconfined -@{p_systemd_executor}=unconfined +@{p_sd}=unconfined +@{p_sdu}=unconfined @{p_systemd_user}=unconfined -@{p_systemd_user_executor}=unconfined +@{p_systemd}=unconfined # Name of the dbus daemon profiles @{p_dbus_accessibility}=dbus-accessibility From 217448d09a5259492a143f99808bc79213d75eaf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 01:18:11 +0200 Subject: [PATCH 0948/1455] doc: improve documentation on the use of some special abstraction. --- apparmor.d/abstractions/attached/base | 3 ++- apparmor.d/abstractions/attached/consoles | 3 ++- apparmor.d/abstractions/bus/own-accessibility | 3 ++- apparmor.d/abstractions/bus/own-session | 3 ++- apparmor.d/abstractions/bus/own-system | 3 ++- 5 files changed, 10 insertions(+), 5 deletions(-) diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index 6a7486cf8..4c35d915d 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -3,7 +3,8 @@ # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no - # Do not use it manually, it is automatically included in profiles when it is required. + # Do not use it manually, It automatically replaces the base abstraction in a + # profile with the attach_disconnected flag set and the re-attached path enabled. abi , diff --git a/apparmor.d/abstractions/attached/consoles b/apparmor.d/abstractions/attached/consoles index dd2275a03..f306c2273 100644 --- a/apparmor.d/abstractions/attached/consoles +++ b/apparmor.d/abstractions/attached/consoles @@ -3,7 +3,8 @@ # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no - # Do not use it manually, it is automatically included in profiles when it is required. + # Do not use it manually, It automatically replaces the consoles abstraction in a + # profile with the attach_disconnected flag set and the re-attached path enabled. abi , diff --git a/apparmor.d/abstractions/bus/own-accessibility b/apparmor.d/abstractions/bus/own-accessibility index 94968258c..cd8e42e52 100644 --- a/apparmor.d/abstractions/bus/own-accessibility +++ b/apparmor.d/abstractions/bus/own-accessibility @@ -3,7 +3,8 @@ # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no -# Do not use it manually, it is automatically included in a profile when it is required. +# Do not use it manually, It is automatically included in a profile by the +# `aa:dbus own` directive. # Allow owning a name on DBus public bus diff --git a/apparmor.d/abstractions/bus/own-session b/apparmor.d/abstractions/bus/own-session index 8186f34cb..91515adb0 100644 --- a/apparmor.d/abstractions/bus/own-session +++ b/apparmor.d/abstractions/bus/own-session @@ -3,7 +3,8 @@ # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no -# Do not use it manually, it is automatically included in a profile when it is required. +# Do not use it manually, It is automatically included in a profile by the +# `aa:dbus own` directive. # Allow owning a name on DBus public bus diff --git a/apparmor.d/abstractions/bus/own-system b/apparmor.d/abstractions/bus/own-system index f2ee3219c..d48931f4f 100644 --- a/apparmor.d/abstractions/bus/own-system +++ b/apparmor.d/abstractions/bus/own-system @@ -3,7 +3,8 @@ # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no -# Do not use it manually, it is automatically included in a profile when it is required. +# Do not use it manually, It is automatically included in a profile by the +# `aa:dbus own` directive. # Allow owning a name on DBus public bus From 4ffbf84a0094e6c51933070b27a5c58628ec2ea4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 23:20:37 +0200 Subject: [PATCH 0949/1455] feat(fsp): remove the default profiles. --- apparmor.d/groups/_full/bwrap | 56 ------------ apparmor.d/groups/_full/bwrap-app | 36 -------- apparmor.d/groups/_full/default | 122 --------------------------- apparmor.d/groups/_full/default-sudo | 42 --------- dists/flags/main.flags | 4 - 5 files changed, 260 deletions(-) delete mode 100644 apparmor.d/groups/_full/bwrap delete mode 100644 apparmor.d/groups/_full/bwrap-app delete mode 100644 apparmor.d/groups/_full/default delete mode 100644 apparmor.d/groups/_full/default-sudo diff --git a/apparmor.d/groups/_full/bwrap b/apparmor.d/groups/_full/bwrap deleted file mode 100644 index 0a4b9efdf..000000000 --- a/apparmor.d/groups/_full/bwrap +++ /dev/null @@ -1,56 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Default profile for bwrap. - -abi , - -include - -@{exec_path} = @{bin}/bwrap -profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) { - include - include - include - include - include - - capability dac_override, - capability dac_read_search, - capability sys_resource, - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - - ptrace peer=bwrap//&bwrap-app, - - signal peer=bwrap//&bwrap-app, - signal (receive) set=(kill), - - @{bin}/** rm, - @{lib}/** rm, - /opt/*/** rm, - /usr/share/*/* rm, - - @{bin}/** Px -> bwrap//&bwrap-app, - @{bin}/xdg-dbus-proxy Px -> bwrap//&xdg-dbus-proxy, - # @{lib}/** Px -> bwrap//&bwrap-app, - /opt/*/** Px -> bwrap//&bwrap-app, - /usr/share/*/* Px -> bwrap//&bwrap-app, - - /usr/.ref rk, - - /bindfile@{rand6} rw, - - owner /var/cache/ w, - - owner @{run}/ld-so-cache-dir/* rw, - - include if exists - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/_full/bwrap-app b/apparmor.d/groups/_full/bwrap-app deleted file mode 100644 index b6d45478a..000000000 --- a/apparmor.d/groups/_full/bwrap-app +++ /dev/null @@ -1,36 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Default profile for user sandboxed application - -abi , - -include - -profile bwrap-app flags=(attach_disconnected,mediate_deleted) { - include - include - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - network netlink raw, - - ptrace peer=bwrap//&bwrap-app, - - signal peer=bwrap//&bwrap-app, - - @{bin}/** rmix, - @{lib}/** rmix, - /opt/*/** rmix, - /usr/share/*/* rmix, - - owner /var/cache/ w, - - include if exists - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/_full/default b/apparmor.d/groups/_full/default deleted file mode 100644 index acdfc0bff..000000000 --- a/apparmor.d/groups/_full/default +++ /dev/null @@ -1,122 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Default profile for unconfined programs - -abi , - -include - -@{exec_path} = /** -profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) { - include - include - include - include - include - include - include - include - include - include - include - include - include - - capability dac_override, - capability dac_read_search, - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - network netlink dgram, - network netlink raw, - - signal receive set=hup, - - @{bin}/bwrap rPx -> bwrap, - @{bin}/pipewire-pulse rPx -> systemd//&pipewire-pulse, - @{bin}/pulseaudio rPx -> systemd//&pulseaudio, - @{bin}/su rPx -> default-sudo, - @{bin}/sudo rPx -> default-sudo, - @{bin}/systemctl rix, - @{coreutils_path} rix, - @{shells_path} rix, - - @{pager_path} rPx -> child-pager, - -# @{open_path} rPx -> child-open, - - audit @{bin}/** Pix, - audit @{lib}/** Pix, - audit /opt/*/** Pix, - audit /usr/share/*/* Pix, - - @{bin}/{,**} r, - @{lib}/{,**} r, - /usr/share/** r, - - /etc/xdg/** r, - - # Full access to user's data - / r, - /*/ r, - @{MOUNTDIRS}/ r, - @{MOUNTS}/ r, - @{MOUNTS}/** rwl, - owner @{HOME}/{,**} rwlk, - owner @{run}/user/@{uid}/{,**} rw, - owner @{tmp}/{,**} rwk, - owner @{run}/user/@{uid}/{,**} rwlk, - - @{run}/motd.dynamic.new rw, - - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - - @{run}/udev/data/c13:@{int} r, # for /dev/input/* - - @{sys}/ r, - @{sys}/bus/ r, - @{sys}/bus/pci/devices/ r, - @{sys}/class/ r, - @{sys}/class/drm/ r, - @{sys}/class/hidraw/ r, - @{sys}/class/input/ r, - @{sys}/class/power_supply/ r, - @{sys}/devices/**/input@{int}/ r, - @{sys}/devices/**/input@{int}/capabilities/* r, - @{sys}/devices/**/input/input@{int}/ r, - @{sys}/devices/**/uevent r, - @{sys}/devices/virtual/dmi/id/chassis_type r, - @{sys}/firmware/acpi/pm_profile r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r, - - @{PROC}/cmdline r, - @{PROC}/sys/kernel/seccomp/actions_avail r, - @{PROC}/zoneinfo r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/gid_map w, - owner @{PROC}/@{pid}/limits r, - owner @{PROC}/@{pid}/loginuid r, - owner @{PROC}/@{pid}/mem r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/oom_{,score_}adj rw, - owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner @{PROC}/@{pids}/cmdline r, - owner @{PROC}/@{pids}/environ r, - owner @{PROC}/@{pids}/task/ r, - - /dev/ r, - /dev/ptmx rwk, - /dev/tty rwk, - owner /dev/tty@{int} rw, - - include if exists - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/_full/default-sudo b/apparmor.d/groups/_full/default-sudo deleted file mode 100644 index 609191970..000000000 --- a/apparmor.d/groups/_full/default-sudo +++ /dev/null @@ -1,42 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -profile default-sudo { - include - include - - capability chown, - capability mknod, - capability sys_ptrace, - - network inet dgram, - network inet6 dgram, - - ptrace (read), - - @{bin}/su mr, - - @{bin}/** Px, - @{lib}/** Px, - /opt/*/** Px, - - /var/db/sudo/lectured/ r, - /var/lib/extrausers/shadow r, - /var/lib/sudo/lectured/ r, - owner /var/db/sudo/lectured/@{uid} rw, - owner /var/lib/sudo/lectured/* rw, - - owner @{HOME}/.sudo_as_admin_successful rw, - - @{run}/ r, - @{run}/systemd/sessions/* r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index e27c76bc2..a73fee129 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -1,10 +1,6 @@ # Common profile flags definition for all distributions # File format: one profile by line using the format: ' ' -bwrap attach_disconnected,mediate_deleted,complain -bwrap-app attach_disconnected,mediate_deleted,complain -default attach_disconnected,mediate_deleted,complain -default-sudo attach_disconnected,complain systemd attach_disconnected,mediate_deleted,complain systemd-service attach_disconnected,complain systemd-user attach_disconnected,mediate_deleted,complain From 8f3f3816edd40839b0832cc67546b08eae09314e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 23:31:35 +0200 Subject: [PATCH 0950/1455] feat(fsp): systemd drop in files: configure stacked profile It comes as a replacement of old and unsecure config that was disabling the nnp flag. The new solution is: 1. Safe 2. Scalable as hundred of profile could be configured this way --- systemd/full/system/ModemManager.service | 2 +- systemd/full/system/archlinux-keyring-wkd-sync.service | 2 +- systemd/full/system/dbus-org.freedesktop.hostname1.service | 2 +- systemd/full/system/dbus-org.freedesktop.import1.service | 2 +- systemd/full/system/dbus-org.freedesktop.locale1.service | 2 +- systemd/full/system/dbus-org.freedesktop.login1.service | 2 +- systemd/full/system/dbus-org.freedesktop.machine1.service | 2 +- systemd/full/system/dbus-org.freedesktop.timedate1.service | 2 +- systemd/full/system/e2scrub@.service | 2 +- systemd/full/system/e2scrub_reap.service | 2 +- systemd/full/system/fprintd.service | 2 +- systemd/full/system/fwupd-refresh.service | 4 +--- systemd/full/system/geoclue.service | 6 +----- systemd/full/system/irqbalance.service | 2 +- systemd/full/system/nm-priv-helper.service | 2 +- systemd/full/system/polkit.service | 2 +- systemd/full/system/rngd.service | 2 +- systemd/full/system/systemd-homed.service | 2 +- systemd/full/system/systemd-hostnamed.service | 2 +- systemd/full/system/systemd-journald.service | 3 +-- systemd/full/system/systemd-journald@.service | 3 +-- systemd/full/system/systemd-localed.service | 2 +- systemd/full/system/systemd-logind.service | 3 +-- systemd/full/system/systemd-machined.service | 2 +- systemd/full/system/systemd-networkd.service | 2 +- systemd/full/system/systemd-resolved.service | 2 +- systemd/full/system/systemd-timedated.service | 2 +- systemd/full/system/systemd-userdbd.service | 2 +- systemd/full/system/upower.service | 2 +- 29 files changed, 29 insertions(+), 38 deletions(-) diff --git a/systemd/full/system/ModemManager.service b/systemd/full/system/ModemManager.service index 03d352890..2d1593f19 100644 --- a/systemd/full/system/ModemManager.service +++ b/systemd/full/system/ModemManager.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&ModemManager diff --git a/systemd/full/system/archlinux-keyring-wkd-sync.service b/systemd/full/system/archlinux-keyring-wkd-sync.service index 03d352890..b88768556 100644 --- a/systemd/full/system/archlinux-keyring-wkd-sync.service +++ b/systemd/full/system/archlinux-keyring-wkd-sync.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&archlinux-keyring-wkd-sync diff --git a/systemd/full/system/dbus-org.freedesktop.hostname1.service b/systemd/full/system/dbus-org.freedesktop.hostname1.service index 03d352890..6d078aea9 100644 --- a/systemd/full/system/dbus-org.freedesktop.hostname1.service +++ b/systemd/full/system/dbus-org.freedesktop.hostname1.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-hostnamed \ No newline at end of file diff --git a/systemd/full/system/dbus-org.freedesktop.import1.service b/systemd/full/system/dbus-org.freedesktop.import1.service index 03d352890..0ab519541 100644 --- a/systemd/full/system/dbus-org.freedesktop.import1.service +++ b/systemd/full/system/dbus-org.freedesktop.import1.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-importd \ No newline at end of file diff --git a/systemd/full/system/dbus-org.freedesktop.locale1.service b/systemd/full/system/dbus-org.freedesktop.locale1.service index 03d352890..276595080 100644 --- a/systemd/full/system/dbus-org.freedesktop.locale1.service +++ b/systemd/full/system/dbus-org.freedesktop.locale1.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-localed \ No newline at end of file diff --git a/systemd/full/system/dbus-org.freedesktop.login1.service b/systemd/full/system/dbus-org.freedesktop.login1.service index 03d352890..c5728915c 100644 --- a/systemd/full/system/dbus-org.freedesktop.login1.service +++ b/systemd/full/system/dbus-org.freedesktop.login1.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-logind \ No newline at end of file diff --git a/systemd/full/system/dbus-org.freedesktop.machine1.service b/systemd/full/system/dbus-org.freedesktop.machine1.service index 03d352890..315b1b230 100644 --- a/systemd/full/system/dbus-org.freedesktop.machine1.service +++ b/systemd/full/system/dbus-org.freedesktop.machine1.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-machined \ No newline at end of file diff --git a/systemd/full/system/dbus-org.freedesktop.timedate1.service b/systemd/full/system/dbus-org.freedesktop.timedate1.service index 03d352890..ab04c5a45 100644 --- a/systemd/full/system/dbus-org.freedesktop.timedate1.service +++ b/systemd/full/system/dbus-org.freedesktop.timedate1.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-timedated \ No newline at end of file diff --git a/systemd/full/system/e2scrub@.service b/systemd/full/system/e2scrub@.service index 03d352890..7340b7610 100644 --- a/systemd/full/system/e2scrub@.service +++ b/systemd/full/system/e2scrub@.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&e2scrub \ No newline at end of file diff --git a/systemd/full/system/e2scrub_reap.service b/systemd/full/system/e2scrub_reap.service index 03d352890..b903d2f0a 100644 --- a/systemd/full/system/e2scrub_reap.service +++ b/systemd/full/system/e2scrub_reap.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&e2scrub_all \ No newline at end of file diff --git a/systemd/full/system/fprintd.service b/systemd/full/system/fprintd.service index 03d352890..5f1f063fa 100644 --- a/systemd/full/system/fprintd.service +++ b/systemd/full/system/fprintd.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&fprintd \ No newline at end of file diff --git a/systemd/full/system/fwupd-refresh.service b/systemd/full/system/fwupd-refresh.service index fa215b3f0..acd28a5a4 100644 --- a/systemd/full/system/fwupd-refresh.service +++ b/systemd/full/system/fwupd-refresh.service @@ -1,4 +1,2 @@ [Service] -ProtectKernelModules=no -RestrictRealtime=no -ProtectKernelModules=no +AppArmorProfile=&fwupdmgr \ No newline at end of file diff --git a/systemd/full/system/geoclue.service b/systemd/full/system/geoclue.service index 4ba897659..2c10e32f5 100644 --- a/systemd/full/system/geoclue.service +++ b/systemd/full/system/geoclue.service @@ -1,6 +1,2 @@ [Service] -NoNewPrivileges=no -MemoryDenyWriteExecute=no -ProtectKernelTunables=no -ProtectKernelModules=no -RestrictRealtime=no +AppArmorProfile=&geoclue \ No newline at end of file diff --git a/systemd/full/system/irqbalance.service b/systemd/full/system/irqbalance.service index 03d352890..eab67fa44 100644 --- a/systemd/full/system/irqbalance.service +++ b/systemd/full/system/irqbalance.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&irqbalance \ No newline at end of file diff --git a/systemd/full/system/nm-priv-helper.service b/systemd/full/system/nm-priv-helper.service index 03d352890..53f99edd0 100644 --- a/systemd/full/system/nm-priv-helper.service +++ b/systemd/full/system/nm-priv-helper.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&nm-priv-helper diff --git a/systemd/full/system/polkit.service b/systemd/full/system/polkit.service index 03d352890..b21a28baa 100644 --- a/systemd/full/system/polkit.service +++ b/systemd/full/system/polkit.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&polkitd diff --git a/systemd/full/system/rngd.service b/systemd/full/system/rngd.service index 03d352890..c52a85d0c 100644 --- a/systemd/full/system/rngd.service +++ b/systemd/full/system/rngd.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&rngd diff --git a/systemd/full/system/systemd-homed.service b/systemd/full/system/systemd-homed.service index 03d352890..65d4ae62e 100644 --- a/systemd/full/system/systemd-homed.service +++ b/systemd/full/system/systemd-homed.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-homed diff --git a/systemd/full/system/systemd-hostnamed.service b/systemd/full/system/systemd-hostnamed.service index 03d352890..6d078aea9 100644 --- a/systemd/full/system/systemd-hostnamed.service +++ b/systemd/full/system/systemd-hostnamed.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-hostnamed \ No newline at end of file diff --git a/systemd/full/system/systemd-journald.service b/systemd/full/system/systemd-journald.service index 0316a67c8..48f5a0156 100644 --- a/systemd/full/system/systemd-journald.service +++ b/systemd/full/system/systemd-journald.service @@ -1,3 +1,2 @@ [Service] -NoNewPrivileges=no -ProtectClock=no \ No newline at end of file +AppArmorProfile=&systemd-journald \ No newline at end of file diff --git a/systemd/full/system/systemd-journald@.service b/systemd/full/system/systemd-journald@.service index 0316a67c8..48f5a0156 100644 --- a/systemd/full/system/systemd-journald@.service +++ b/systemd/full/system/systemd-journald@.service @@ -1,3 +1,2 @@ [Service] -NoNewPrivileges=no -ProtectClock=no \ No newline at end of file +AppArmorProfile=&systemd-journald \ No newline at end of file diff --git a/systemd/full/system/systemd-localed.service b/systemd/full/system/systemd-localed.service index 03d352890..276595080 100644 --- a/systemd/full/system/systemd-localed.service +++ b/systemd/full/system/systemd-localed.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-localed \ No newline at end of file diff --git a/systemd/full/system/systemd-logind.service b/systemd/full/system/systemd-logind.service index 0316a67c8..c5728915c 100644 --- a/systemd/full/system/systemd-logind.service +++ b/systemd/full/system/systemd-logind.service @@ -1,3 +1,2 @@ [Service] -NoNewPrivileges=no -ProtectClock=no \ No newline at end of file +AppArmorProfile=&systemd-logind \ No newline at end of file diff --git a/systemd/full/system/systemd-machined.service b/systemd/full/system/systemd-machined.service index 03d352890..315b1b230 100644 --- a/systemd/full/system/systemd-machined.service +++ b/systemd/full/system/systemd-machined.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-machined \ No newline at end of file diff --git a/systemd/full/system/systemd-networkd.service b/systemd/full/system/systemd-networkd.service index 03d352890..3f4b60849 100644 --- a/systemd/full/system/systemd-networkd.service +++ b/systemd/full/system/systemd-networkd.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-networkd diff --git a/systemd/full/system/systemd-resolved.service b/systemd/full/system/systemd-resolved.service index 03d352890..fd36871e4 100644 --- a/systemd/full/system/systemd-resolved.service +++ b/systemd/full/system/systemd-resolved.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-resolved diff --git a/systemd/full/system/systemd-timedated.service b/systemd/full/system/systemd-timedated.service index 03d352890..78dd0193d 100644 --- a/systemd/full/system/systemd-timedated.service +++ b/systemd/full/system/systemd-timedated.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-timedated diff --git a/systemd/full/system/systemd-userdbd.service b/systemd/full/system/systemd-userdbd.service index 03d352890..d3771658d 100644 --- a/systemd/full/system/systemd-userdbd.service +++ b/systemd/full/system/systemd-userdbd.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&systemd-userdbd diff --git a/systemd/full/system/upower.service b/systemd/full/system/upower.service index 03d352890..082e8f0fa 100644 --- a/systemd/full/system/upower.service +++ b/systemd/full/system/upower.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&upowerd From 77d2f923b0d5a33dad1d190ea6e04836d3df3577 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 23:45:10 +0200 Subject: [PATCH 0951/1455] feat(profile): pacman: allow landlock to restrict itself See https://docs.kernel.org/userspace-api/landlock.html#c.sys_landlock_restrict_self fix #750 --- apparmor.d/groups/pacman/pacman | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 6af9bae96..def1f2a28 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -27,6 +27,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { capability setfcap, capability setgid, capability setuid, + capability sys_admin, capability sys_chroot, capability sys_ptrace, capability sys_resource, From a08c99dcb77b2df4fdee96de3b4fc6c6ab63b9fb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 23:47:49 +0200 Subject: [PATCH 0952/1455] feat(abs): console: add non owner access to /dev/tty@{u8}. Follow recent addition in attached/consoles fix #751 --- apparmor.d/abstractions/consoles.d/complete | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 apparmor.d/abstractions/consoles.d/complete diff --git a/apparmor.d/abstractions/consoles.d/complete b/apparmor.d/abstractions/consoles.d/complete new file mode 100644 index 000000000..b8b7ad90f --- /dev/null +++ b/apparmor.d/abstractions/consoles.d/complete @@ -0,0 +1,8 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + # There are the common ways to refer to consoles + /dev/tty@{u8} rw, + +# vim:syntax=apparmor From d5002a67740e10096cb3a126b2c467e55459e895 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 23:52:39 +0200 Subject: [PATCH 0953/1455] fix(profile): fwupd fix #752 --- apparmor.d/profiles-a-f/fwupd | 4 +++- apparmor.d/profiles-a-f/fwupdmgr | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 71addde64..a07bb4dba 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -50,6 +50,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /usr/share/fwupd/{,**} r, /usr/share/hwdata/* r, + /usr/share/libdrm/*.ids /usr/share/mime/mime.cache r, /etc/fwupd/{,**} rw, @@ -80,6 +81,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{sys}/**/ r, @{sys}/devices/** r, + @{sys}/**/uevent r, @{sys}/firmware/acpi/** r, @{sys}/firmware/dmi/tables/DMI r, @{sys}/firmware/dmi/tables/smbios_entry_point r, @@ -87,9 +89,9 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} rw, @{sys}/firmware/efi/efivars/BootNext-@{uuid} rw, @{sys}/firmware/efi/efivars/fwupd-* rw, + @{sys}/firmware/efi/efivars/KEK-@{uuid} rw, @{sys}/kernel/security/lockdown r, @{sys}/kernel/security/tpm@{int}/binary_bios_measurements r, - @{sys}/**/uevent r, @{sys}/power/mem_sleep r, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 6dffac5a6..b0a651315 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -34,6 +34,9 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected) { @{bin}/dbus-launch Cx -> bus, @{bin}/pkttyagent Px, + /usr/share/terminfo/** r, + + /etc/inputrc r, /etc/machine-id r, owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc}.* rw, From 7243c18ce2ffd4de6b66c2c390752f079b6e718d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 26 May 2025 23:54:56 +0200 Subject: [PATCH 0954/1455] fix(build): conversion from abi4 to abi3. --- pkg/prebuild/builder/abi.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/prebuild/builder/abi.go b/pkg/prebuild/builder/abi.go index 818edbb76..2e2911f4b 100644 --- a/pkg/prebuild/builder/abi.go +++ b/pkg/prebuild/builder/abi.go @@ -14,6 +14,7 @@ var ( `abi/4.0`, `abi/3.0`, ` userns,`, ` # userns,`, ` mqueue`, ` # mqueue`, + ` deny mqueue`, ` # deny mqueue`, }) ) From 0886c7bc853de38724ebbbccad21832f2bbd4600 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 27 May 2025 00:29:21 +0200 Subject: [PATCH 0955/1455] fix: rule compilation. --- apparmor.d/profiles-a-f/fwupd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index a07bb4dba..5fb948234 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -50,7 +50,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /usr/share/fwupd/{,**} r, /usr/share/hwdata/* r, - /usr/share/libdrm/*.ids + /usr/share/libdrm/*.ids r, /usr/share/mime/mime.cache r, /etc/fwupd/{,**} rw, From 11f3529530aa1710de623c8bb3214637a0047985 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 27 May 2025 00:29:35 +0200 Subject: [PATCH 0956/1455] ci: ensure failing compiling the profile fail the job. --- .github/workflows/main.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 8d738eac7..4baa4a776 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -54,8 +54,10 @@ jobs: - name: Reload AppArmor run: | - sudo systemctl restart apparmor.service || true - sudo journalctl -xeu apparmor.service + if ! sudo systemctl restart apparmor.service; then + sudo journalctl -xeu apparmor.service + exit 1 + fi - name: Show AppArmor log and rules run: | From bf22a7786c39d3b56b87095bfd4479769b88ec1a Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Tue, 27 May 2025 11:44:26 +0000 Subject: [PATCH 0957/1455] Broken login: Update systemd-logind Today I was not able to log into my Arch Linux system. After chrooting into the system, performing aa-log and adding the rule to systemd-logind the problem was fixed. --- apparmor.d/groups/systemd/systemd-logind | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 39192e7e1..64081f326 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -139,6 +139,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { /dev/dri/card@{int} rw, /dev/input/event@{int} rw, # Input devices (keyboard, mouse, etc) /dev/mqueue/ r, + /dev/tty@{int} rw, owner /dev/shm/{,**/} rw, include if exists From 47bafeb67bacc6abb89eb74f9a7044cfdfae0cd4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 15:06:52 +0200 Subject: [PATCH 0958/1455] feat(fsp): rewrite the systemd profile. --- apparmor.d/groups/_full/systemd | 251 +++++++++++--------------------- 1 file changed, 88 insertions(+), 163 deletions(-) diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index e1a9918e1..eec9b33d9 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -11,24 +11,47 @@ # Distributions and other programs can add rules in the usr/systemd.d directory -# TODO: rework this to get a controlled environment: (cf security model) +# Overall architecture of the systemd profiles: +# systemd # PID 1, entrypoint, requires "Early policy" +# ├── systemd # To restart itself +# ├── systemd-generators-* # Systemd system and environment generators +# └── sd # Internal service starter and config handler, handles all services +# ├── Px or px, # Any service with profile +# ├── Px -> # Any service without profile defined in the unit file (see systemd/full/systemd) +# ├── &* # Stacked service as defined in the unit file (see systemd/full/systemd) +# ├── sd-mount # Handles all mounts from services +# ├── sd//systemctl # Internal system systemctl +# └── systemd-user # Profile for 'systemd --user' +# ├── systemd-user # To restart itself +# ├── systemd-user-generators-* # Systemd user and environment generators +# └── sdu # Handles all user services +# ├── Px or px, # Any user service with profile +# ├── Px -> # Any user service without profile defined in the unit file (see systemd/full/systemd) +# ├── &* # Stacked user service as defined in the unit file (see systemd/full/systemd) +# └── sdu//systemctl # Internal user systemctl + +# Advantages: +# - Differentiate systemd (PID 1) and `system --user` +# - Keep `systemd` and systemd-user as mininal as possible, and transition to less privileged profiles. +# - Allow the executor profiles to handled stacked profiles. +# - Most additions need to be done in the `sd`/`sdu` profile, not in `systemd`/`systemd-user`. +# - Dedicated `sd-mount` profile for most mount from the unit services. + + +# TODO: rework this to get a controlled environment: # - No global allow anymore: in high security environments, we must manage the list # of program/service that can be started by systemd and ensure that they are all # listed and confined. Programs not listed will not be able to start. # - Outside common systemd service, the list may have to be automatically # generated at install time, in `/etc/apparmor.d/usr/systemd.d/exec` -# - Stop disabling nnp flags in systemd dropin files. -# - Each systemd services in `systemd-service` (when the service is more complex than foo.service -> Exec=/usr/bin/foo) -# need they own profile, profile name configured as a dropin unit file. -# - When this is done: the fallback profile as root will not be needed. abi , include +@{exec_path} = @{lib}/systemd/systemd profile systemd flags=(attach_disconnected,mediate_deleted) { include - include include include include @@ -43,16 +66,13 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { capability dac_read_search, capability fowner, capability fsetid, - capability mknod, + capability kill, capability net_admin, + capability net_bind_service, capability perfmon, - capability setfcap, - capability setgid, capability setpcap, - capability setuid, capability sys_admin, - capability sys_chroot, - capability sys_nice, + capability sys_boot, capability sys_ptrace, capability sys_resource, capability sys_tty_config, @@ -62,164 +82,82 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { network inet6 dgram, network inet6 stream, network netlink raw, + network vsock stream, mount fstype=autofs systemd-1 -> @{PROC}/sys/fs/binfmt_misc/, - mount fstype=autofs systemd-1 -> /efi/, - mount fstype=binfmt_misc options=(rw nodev noexec nosuid) binfmt_misc -> @{PROC}/sys/fs/binfmt_misc/, - mount fstype=configfs options=(rw nodev noexec nosuid) configfs -> @{sys}/kernel/config/, - mount fstype=debugfs options=(rw nodev noexec nosuid) debugfs -> @{sys}/kernel/debug/, - mount fstype=fusectl options=(rw nodev noexec nosuid) fusectl -> @{sys}/fs/fuse/connections/, - mount fstype=hugetlbfs options=(rw nosuid nodev) hugetlbfs -> /dev/hugepages/, - mount fstype=mqueue options=(rw nodev noexec nosuid) -> /dev/mqueue/, - mount fstype=proc options=(rw nosuid nodev noexec) proc -> @{run}/systemd/namespace-@{rand6}/, - mount fstype=sysfs options=(rw nosuid nodev noexec) sysfs -> @{run}/systemd/namespace-@{rand6}/, - mount fstype=tmpfs tmpfs -> /dev/shm/, + mount fstype=autofs systemd-1 -> @{efi}/, mount fstype=tmpfs tmpfs -> /tmp/, - mount fstype=tmpfs options=(rw nosuid nodev noexec strictatime) tmpfs -> @{run}/systemd/mount-rootfs/@{run}/credentials/, - mount fstype=tmpfs options=(rw nosuid nodev noexec) tmpfs -> /dev/shm/, - mount fstype=tmpfs options=(rw nosuid noexec strictatime) tmpfs -> @{run}/systemd/namespace-@{rand6}/dev/, - mount fstype=tracefs options=(rw nodev noexec nosuid) tracefs -> @{sys}/kernel/tracing/, - mount /dev/** -> /boot/{,efi/}, - mount options=(rw bind) /dev/** -> /tmp/namespace-dev-@{rand6}/**, - mount options=(rw bind) /dev/** -> @{run}/systemd/namespace-@{rand6}/dev/**, - mount options=(rw bind) @{run}/systemd/propagate/*/ -> @{run}/systemd/mount-rootfs/@{run}/systemd/incoming/, - mount options=(rw move) -> @{sys}/fs/fuse/connections/, - mount options=(rw move) -> @{sys}/kernel/config/, - mount options=(rw move) -> @{sys}/kernel/debug/, - mount options=(rw move) -> @{sys}/kernel/tracing/, - mount options=(rw move) -> /dev/hugepages/, - mount options=(rw move) -> /dev/mqueue/, - mount options=(rw move) -> /efi/, - mount options=(rw move) -> /tmp/, - mount options=(rw move) @{run}/systemd/namespace-@{rand6}/{,**} -> @{run}/systemd/mount-rootfs/{,**}, - mount options=(rw rbind) -> @{run}/systemd/mount-rootfs/{,**}, - mount options=(rw rbind) -> @{run}/systemd/unit-root/{,**}, - mount options=(rw rshared) -> /, mount options=(rw rslave) -> /, - mount options=(rw rslave) -> /dev/, - mount options=(rw slave) -> @{run}/systemd/incoming/, remount @{HOME}/{,**}, remount @{HOMEDIRS}/, remount @{MOUNTDIRS}/, remount @{MOUNTS}/{,**}, - remount @{run}/systemd/mount-rootfs/{,**}, - remount @{run}/systemd/unit-root/{,**}, - remount /, remount /snap/{,**}, - remount options=(ro bind) /boot/{,efi/}, - remount options=(ro noexec noatime bind) /var/snap/{,**}, - remount options=(ro nosuid bind) /dev/, - remount options=(ro nosuid nodev bind) /dev/hugepages/, - remount options=(ro nosuid nodev bind) /var/, - remount options=(ro nosuid nodev noexec bind) /boot/, - remount options=(ro nosuid nodev noexec bind) /dev/mqueue/, - remount options=(ro nosuid nodev noexec bind) /efi/, - remount options=(ro nosuid noexec bind) /dev/pts/, + remount options=(ro bind nodev noexec nosuid) /dev/mqueue/, + remount options=(ro bind nodev nosuid) /dev/hugepages/, + remount options=(ro bind noexec nosuid) /dev/pts/, + remount options=(ro bind nosuid) /dev/, + remount options=(ro bind) @{efi}/, + remount options=(ro bind) /, - umount /, - umount /dev/shm/, umount @{PROC}/sys/fs/binfmt_misc/, - umount @{run}/systemd/mount-rootfs/{,**}, - umount @{run}/systemd/namespace-@{rand6}/{,**}, - umount @{run}/systemd/unit-root/{,**}, - - pivot_root oldroot=@{run}/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/, - pivot_root oldroot=@{run}/systemd/unit-root/ @{run}/systemd/unit-root/, + umount @{run}/credentials/*/, mqueue (read getattr) type=posix /, - change_profile, - - signal receive set=(rtmin+23) peer=plymouthd, - signal receive set=(term hup cont), signal send, ptrace (read, readby), - unix send type=dgram, - - unix receive type=dgram peer=(label=systemd-timesyncd), - unix (send, receive, connect) type=stream peer=(label=plymouthd, addr=@/org/freedesktop/plymouthd), + unix type=dgram, + unix type=stream, #aa:dbus own bus=system name=org.freedesktop.systemd1 - # For stacked profiles - #aa:dbus own bus=system name=org.freedesktop.network1 - #aa:dbus own bus=system name=org.freedesktop.oom1 - #aa:dbus own bus=system name=org.freedesktop.resolve1 - #aa:dbus own bus=system name=org.freedesktop.timesync1 + @{exec_path} mrix, + @{sh_path} mr, - @{bin}/** Px, - @{sbin}/** Px, - @{lib}/** Px, - /etc/cron.*/* Px, - /etc/init.d/* Px, - /etc/update-motd.d/* Px, - /usr/share/*/** Px, + # Systemd internal service starter and config handler (sandboxing, namespacing, cgroup, etc.) + @{lib}/systemd/systemd-executor mPx -> sd, - # Systemd internal service started and config handler (sandboxing, namespacing, cgroup, etc.) - @{lib}/systemd/systemd-executor ix, - - # Systemd user: systemd --user - @{lib}/systemd/systemd px -> systemd-user, - - # Unit services using systemctl - @{bin}/systemctl Cx -> systemctl, - - # Unit services - @{bin}/mount ix, - @{bin}/kill ix, - - # Shell based systemd unit services - # TODO: create unit profile for all of them - @{sbin}/ldconfig Px -> systemd-service, - @{bin}/mandb Px -> systemd-service, - @{bin}/savelog Px -> systemd-service, - @{coreutils_path} Px -> systemd-service, - @{sh_path} Px -> systemd-service, - - # Systemd profiles that need be stacked - #aa:stack systemd-networkd systemd-oomd systemd-resolved systemd-timesyncd - @{lib}/systemd/systemd-networkd px -> systemd//&systemd-networkd, - @{lib}/systemd/systemd-oomd px -> systemd//&systemd-oomd, - @{lib}/systemd/systemd-resolved px -> systemd//&systemd-resolved, - @{lib}/systemd/systemd-timesyncd px -> systemd//&systemd-timesyncd, - - @{lib}/ r, - / r, - /*/ r, - /boot/efi/ r, - /snap/*/@{int}/ r, - /var/cache/*/ r, - /var/lib/*/ r, - /var/tmp/ r, + # Systemd system generators. Profiles must exist + @{lib}/netplan/generate mPx, + @{lib}/systemd/system-environment-generators/* mPx, + @{lib}/systemd/system-generators/* mPx, @{etc_ro}/environment r, @{etc_ro}/environment.d/{,**} r, - /etc/acpi/events/{,**} r, /etc/binfmt.d/{,**} r, /etc/conf.d/{,**} r, - /etc/credstore.encrypted/{,**} r, - /etc/credstore/{,**} r, /etc/default/{,**} r, - /etc/machine-id r, /etc/modules-load.d/{,**} r, /etc/networkd-dispatcher/{,**} r, /etc/systemd/{,**} r, + /etc/systemd/system/** w, /etc/udev/hwdb.d/{,**} r, - /etc/systemd/system/multi-user.target.wants/{,*} w, - /var/log/dmesg rw, - /var/lib/systemd/{,**} rw, + #aa:only pacman + # It is unclear why this is needed here and not in sd + /etc/pacman.d/gnupg/S.dirmngr w, + /etc/pacman.d/gnupg/S.gpg-agent w, + /etc/pacman.d/gnupg/S.gpg-agent.browser w, + /etc/pacman.d/gnupg/S.gpg-agent.extra w, + /etc/pacman.d/gnupg/S.gpg-agent.ssh w, + /etc/pacman.d/gnupg/S.keyboxd w, + + @{efi}/ r, + /snap/*/@{int}/ r, + + /tmp/ r, + /var/tmp/ r, + owner /tmp/systemd-private-*/{,**} rw, owner /var/tmp/systemd-private-*/{,**} rw, - /tmp/namespace-dev-@{rand6}/{,**} rw, - /tmp/systemd-private-*/{,**} rw, - - @{att}/@{run}/systemd/journal/socket r, @{att}/@{run}/systemd/journal/dev-log r, + @{att}/@{run}/systemd/journal/socket r, + @{att}/@{run}/systemd/notify r, @{run}/ rw, @{run}/* rw, @@ -228,10 +166,6 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{run}/credentials/{,**} rw, @{run}/systemd/{,**} rw, - @{run}/udev/data/+bluetooth:* r, - @{run}/udev/data/+backlight:* r, - @{run}/udev/data/+leds:*backlight* r, - @{run}/udev/data/+module:configfs r, @{run}/udev/data/+module:fuse r, @{run}/udev/data/c4:@{int} r, # For TTY devices @@ -242,37 +176,28 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{run}/udev/data/n@{int} r, @{run}/udev/tags/systemd/ r, + @{sys}/**/uevent r, @{sys}/bus/ r, @{sys}/class/ r, @{sys}/class/power_supply/ r, - @{sys}/class/sound/ r, - @{sys}/devices/@{pci}/** r, - @{sys}/devices/**/net/** r, - @{sys}/devices/**/uevent r, - @{sys}/devices/virtual/dmi/id/{sys,board,bios}_vendor r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/product_version r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/tty/console/active r, @{sys}/fs/cgroup/{,**} rw, @{sys}/fs/fuse/connections/ r, @{sys}/fs/pstore/ r, @{sys}/kernel/**/ r, - @{sys}/module/**/uevent r, @{sys}/module/apparmor/parameters/enabled r, + @{sys}/module/vt/parameters/default_utf8 r, @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/comm r, - @{PROC}/@{pid}/coredump_filter r, - @{PROC}/@{pid}/environ r, @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/fdinfo/@{int} r, - @{PROC}/@{pid}/gid_map rw, - @{PROC}/@{pid}/loginuid rw, - @{PROC}/@{pid}/mountinfo r, - @{PROC}/@{pid}/setgroups rw, @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/uid_map rw, @{PROC}/cmdline r, @{PROC}/devices r, @{PROC}/pressure/* r, @@ -280,32 +205,32 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{PROC}/sys/fs/binfmt_misc/ r, @{PROC}/sys/fs/nr_open r, @{PROC}/sys/kernel/* r, - @{PROC}/sysvipc/{shm,sem,msg} r, - owner @{PROC}/@{pid}/limits r, - owner @{PROC}/@{pid}/oom_score_adj rw, + @{PROC}/sys/kernel/random/boot_id r, + @{PROC}/sysvipc/msg r, + @{PROC}/sysvipc/sem r, + @{PROC}/sysvipc/shm r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/1/coredump_filter r, + owner @{PROC}/1/fdinfo/@{int} r, + owner @{PROC}/1/gid_map r, + owner @{PROC}/1/oom_score_adj rw, + owner @{PROC}/1/setgroups r, + owner @{PROC}/1/uid_map r, /dev/autofs r, + /dev/dri/card@{int} rw, /dev/input/ r, /dev/kmsg w, + /dev/tty rw, /dev/tty@{int} rw, owner /dev/console rwk, - owner /dev/dri/card@{int} rw, owner /dev/hugepages/ rw, - owner /dev/initctl rw, owner /dev/input/event@{int} rw, owner /dev/mqueue/ rw, owner /dev/rfkill rw, - owner /dev/shm/ rw, + owner /dev/shm/ r, owner /dev/ttyS@{int} rwk, - profile systemctl { - include - include - - include if exists - include if exists - } - include if exists include if exists } From 3dc8a74ec09ceb8f18c6a69e7d6b61f8b40f81f6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 15:16:26 +0200 Subject: [PATCH 0959/1455] feat(fsp): rewrite the systemd-user profile. --- apparmor.d/groups/_full/systemd-user | 85 ++++++---------------------- 1 file changed, 17 insertions(+), 68 deletions(-) diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index b0b3272a1..3b0d01709 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -11,8 +11,6 @@ # Distributions and other programs can add rules in the usr/systemd-user.d directory -# TODO: rework this to get a controlled environment. cf comments in systemd profile. - abi , include @@ -27,76 +25,46 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { network netlink raw, - signal send set=(term, cont, kill), - signal receive set=hup peer=@{p_systemd}, + signal send, - ptrace read peer=@{p_systemd}, + ptrace read, + + unix type=dgram peer=(label=@{p_sdu}), unix bind type=stream addr=@@{udbus}/bus/systemd/bus-system, unix bind type=stream addr=@@{udbus}/bus/systemd/bus-api-user, #aa:dbus own bus=session name=org.freedesktop.systemd1 - @{exec_path} mr, + @{exec_path} mrix, - @{bin}/** Px, - @{lib}/** Px, - /etc/cron.*/* Px, - /opt/*/** Px, - /usr/share/*/** Px, + # Systemd internal service starter and config handler (sandboxing, namespacing, cgroup, etc.) + @{lib}/systemd/systemd-executor mPx -> sdu, - # Systemd internal service started and config handler (sandboxing, namespacing, cgroup, etc.) - @{lib}/systemd/systemd-executor ix, - - # Unit services using systemctl - @{bin}/systemctl Cx -> systemctl, - - # Shell based ystemd unit services - @{coreutils_path} Px -> systemd-user-service, - @{sh_path} Px -> systemd-user-service, - - # Dbus needs to be started without environment scrubbing - @{bin}/dbus-broker px -> dbus-session, - @{bin}/dbus-broker-launch px -> dbus-session, - @{bin}/dbus-daemon px -> dbus-session, - @{lib}/dbus-1.0/dbus-daemon-launch-helper px -> dbus-session, - - # Audio profiles need to be stacked - #aa:stack pipewire pipewire-media-session pipewire-pulse pulseaudio wireplumber - @{bin}/pipewire Px -> systemd-user//&pipewire, - @{bin}/pipewire-media-session Px -> systemd-user//&pipewire-media-session, - @{bin}/pipewire-pulse Px -> systemd-user//&pipewire-pulse, - @{bin}/pulseaudio Px -> systemd-user//&pulseaudio, - @{bin}/wireplumber Px -> systemd-user//&wireplumber, - - /usr/ r, - /usr/share/defaults/**.conf r, + # Systemd user generators. Profiles must exist + @{lib}/systemd/user-environment-generators/* Px, + @{lib}/systemd/user-generators/* Px, + @{etc_ro}/environment r, /etc/systemd/user.conf r, /etc/systemd/user.conf.d/{,**} r, /etc/systemd/user/{,**} r, - / r, - - owner @{HOME}/.local/ w, - owner @{user_config_dirs}/systemd/user/{,**} rw, - @{run}/systemd/users/@{uid} r, owner @{run}/user/@{uid}/ rw, owner @{run}/user/@{uid}/** rwkl, @{run}/mount/utab r, @{run}/systemd/notify w, + @{run}/systemd/oom/io.systemd.ManagedOOM rw, - @{run}/udev/data/+backlight:* r, - @{run}/udev/data/+leds:*backlight* r, @{run}/udev/data/+module:configfs r, @{run}/udev/data/+module:fuse r, - @{run}/udev/data/b254:@{int} r, # for /dev/zram* @{run}/udev/data/c4:@{int} r, # For TTY devices @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features + @{run}/udev/data/c116:@{int} r, # for ALSA @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{run}/udev/data/n@{int} r, @{run}/udev/tags/systemd/ r, @@ -108,14 +76,11 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { @{sys}/devices/**/uevent r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} r, - @{sys}/module/apparmor/parameters/enabled r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw, - @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pids}/cgroup r, - @{PROC}/@{pids}/comm r, - @{PROC}/@{pids}/stat r, - @{PROC}/1/environ r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/stat r, @{PROC}/cmdline r, @{PROC}/pressure/* r, @{PROC}/swaps r, @@ -124,20 +89,14 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { @{PROC}/sys/kernel/overflowgid r, @{PROC}/sys/kernel/overflowuid r, @{PROC}/sys/kernel/pid_max r, + @{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/threads-max r, - owner @{PROC}/@{pid}/coredump_filter r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/gid_map r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/oom_score_adj rw, - owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/uid_map r, owner @{PROC}/@{pids}/fd/ r, - owner @{PROC}/@{pids}/oom_score_adj rw, - - /dev/kmsg w, - /dev/tty rw, deny capability bpf, deny capability dac_override, @@ -149,16 +108,6 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { deny capability sys_boot, deny capability sys_resource, - profile systemctl { - include - include - - deny capability net_admin, - - include if exists - include if exists - } - include if exists include if exists } From dd2187552bf671f0075ae269e14d52bd0f75718e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 22:35:28 +0200 Subject: [PATCH 0960/1455] feat(fsp): remove the now deprecated generic system service profiles. --- apparmor.d/groups/_full/systemd-service | 77 -------------------- apparmor.d/groups/_full/systemd-user-service | 23 ------ dists/flags/main.flags | 1 - 3 files changed, 101 deletions(-) delete mode 100644 apparmor.d/groups/_full/systemd-service delete mode 100644 apparmor.d/groups/_full/systemd-user-service diff --git a/apparmor.d/groups/_full/systemd-service b/apparmor.d/groups/_full/systemd-service deleted file mode 100644 index a53193cc5..000000000 --- a/apparmor.d/groups/_full/systemd-service +++ /dev/null @@ -1,77 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Profile for generic systemd unit services. Only used by tiny systemd services -# that start a shell or use context specific programs. - -# It does not specify an attachment path because it is intended to be used only -# via "Px -> systemd-service" exec transitions from the systemd profile. - -abi , - -include - -profile systemd-service flags=(attach_disconnected) { - include - include - include - - capability dac_read_search, - capability chown, - capability fsetid, - - @{sbin}/ldconfig rix, - @{bin}/savelog rix, - @{bin}/systemctl rix, - @{bin}/gzip rix, - @{coreutils_path} rix, - @{sh_path} rmix, - - # ifup@.service - @{bin}/ifup rPx, - - # shadow.service - @{sbin}/pwck rPx, - @{sbin}/grpck rPx, - - @{bin}/grub-editenv rPx, - @{bin}/ibus-daemon rPx, - - @{bin}/* r, - @{lib}/ r, - - /var/cache/ldconfig/{,**} rw, - - / r, - - /boot/grub/grubenv rw, - /boot/grub/ w, - - /var/spool/cron/atjobs/ r, - - /var/log/ r, - /var/log/dmesg rw, - /var/log/dmesg.* rwl -> /var/log/dmesg, - - # man-db.service - /usr/{,local/}share/man/{,**} r, - /etc/manpath.config r, - /var/cache/man/{,**} rwk, - - # snapd.system-shutdown.service - @{run}/initramfs/shutdown rw, - @{run}/initramfs/ rw, - - # cockpit.socket - @{run}/cockpit/@{rand8} rw, - @{run}/cockpit/motd w, - - @{PROC}/cmdline r, - @{PROC}/sys/kernel/osrelease r, - - include if exists - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/_full/systemd-user-service b/apparmor.d/groups/_full/systemd-user-service deleted file mode 100644 index 0cb9efa49..000000000 --- a/apparmor.d/groups/_full/systemd-user-service +++ /dev/null @@ -1,23 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Profile for generic systemd unit services. Only used by tiny systemd services -# that start a shell or use context specific programs. - -# It does not specify an attachment path because it is intended to be used only -# via "Px -> systemd-user-service" exec transitions from the systemd-user profile. - -abi , - -include - -profile systemd-user-service flags=(attach_disconnected) { - include - include - - include if exists - include if exists -} - -# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index a73fee129..5a6c7c526 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -2,7 +2,6 @@ # File format: one profile by line using the format: ' ' systemd attach_disconnected,mediate_deleted,complain -systemd-service attach_disconnected,complain systemd-user attach_disconnected,mediate_deleted,complain akonadi_akonotes_resource complain From 5940f0117b85538f3f91840a58a7583dbcc579bc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 22:37:56 +0200 Subject: [PATCH 0961/1455] feat(fsp): add the new sdu profile as service and stacked profile manager for user. --- apparmor.d/groups/_full/sdu | 124 ++++++++++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 apparmor.d/groups/_full/sdu diff --git a/apparmor.d/groups/_full/sdu b/apparmor.d/groups/_full/sdu new file mode 100644 index 000000000..5ceb669f0 --- /dev/null +++ b/apparmor.d/groups/_full/sdu @@ -0,0 +1,124 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Part of the systemd-user profile. + +# sdu is a profile for SystemD-executor run as User, it is used to run all services +# files and to encapsulate stacked services profiles (hence the short name). +# It aims at reducing the size of the systemd-user profile. + +# Only use this profile with a fully configured system. Otherwise it **WILL** +# break your computer. See https://apparmor.pujol.io/full-system-policy/. + +# Distributions and other programs can add rules in the usr/sdu.d directory + +abi , + +include + +@{exec_path} = @{bin}/systemd-executor +profile sdu flags=(attach_disconnected,mediate_deleted) { + include + include + include + include + include + + network netlink raw, + + change_profile, + + ptrace read, + + unix type=dgram peer=(label=@{p_systemd_user}), + + dbus bus=session, + + @{exec_path} mr, + + @{bin}/** mPx, + @{sbin}/** mPx, + @{lib}/** Px, + /etc/cron.*/* Px, + /opt/*/** Px, + /usr/share/*/** Px, + + # Unit services using systemctl + @{bin}/systemctl Cx -> systemctl, + + # Shell based user unit services + @{sh_path} Cx -> shell, + + # Dbus needs to be started without environment scrubbing + @{bin}/dbus-broker px -> dbus-session, + @{bin}/dbus-broker-launch px -> dbus-session, + @{bin}/dbus-daemon px -> dbus-session, + @{lib}/dbus-1.0/dbus-daemon-launch-helper px -> dbus-session, + + / r, + @{bin}/* r, + @{sbin}/* r, + /usr/share/** r, + + owner @{desktop_local_dirs}/ w, + owner @{desktop_local_dirs}/state/ w, + owner @{desktop_local_dirs}/state/wireplumber/{,**} rw, + + owner @{run}/user/@{uid}/pipewire-@{int} rw, + owner @{run}/user/@{uid}/pipewire-@{int}-manager rw, + owner @{run}/user/@{uid}/pipewire-@{int}-manager.lock rwk, + owner @{run}/user/@{uid}/pipewire-@{int}.lock rwk, + owner @{run}/user/@{uid}/pulse/pid rw, + + owner @{user_state_dirs}/wireplumber/ r, + owner @{user_state_dirs}/wireplumber/stream-properties rw, + owner @{user_state_dirs}/wireplumber/stream-properties.@{rand6} rw, + + @{run}/systemd/users/@{uid} r, + @{run}/systemd/users/@{int} r, + + @{run}/udev/data/c116:@{int} r, # for ALSA + + @{sys}/bus/ r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{sys}/devices/virtual/sound/seq/uevent r, + @{sys}/devices/virtual/sound/timer/uevent r, + + @{sys}/module/apparmor/parameters/enabled r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/{,**} rw, + + @{PROC}/pressure/* r, + @{PROC}/sys/fs/nr_open r, + owner @{PROC}/@{pid}/attr/apparmor/exec w, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/oom_score_adj rw, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + profile shell flags=(attach_disconnected,mediate_deleted,complain) { + include + + @{sh_path} mr, + @{bin}/systemctl Px -> sdu//systemctl, + + include if exists + } + + profile systemctl flags=(attach_disconnected,mediate_deleted,complain) { + include + include + + audit capability net_admin, + + owner @{run}/user/@{uid}/systemd/private rw, + + include if exists + include if exists + } + + include if exists + include if exists +} + +# vim:syntax=apparmor From 9125686973a11c2a297d16621ec2859a061bf8bb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 22:44:00 +0200 Subject: [PATCH 0962/1455] feat(fsp): add the new sdu profile as service and stacked profile manager for system. --- apparmor.d/groups/_full/sd | 246 +++++++++++++++++++++++++++++++++++++ 1 file changed, 246 insertions(+) create mode 100644 apparmor.d/groups/_full/sd diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd new file mode 100644 index 000000000..974bc3544 --- /dev/null +++ b/apparmor.d/groups/_full/sd @@ -0,0 +1,246 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Part of the systemd (as PID 1) profile. + +# sd is a profile for SystemD-executor run as root, it is used to run all services +# files and to encapsulate stacked services profiles (hence the short name). +# It aims at reducing the size of the systemd profile. + +# Only use this profile with a fully configured system. Otherwise it **WILL** +# break your computer. See https://apparmor.pujol.io/full-system-policy/. + +# Distributions and other programs can add rules in the usr/sd.d directory + +abi , + +include + +@{exec_path} = @{bin}/systemd-executor +profile sd flags=(attach_disconnected,mediate_deleted) { + include + include + include + include + include + include + include + include + + userns, + + capability audit_control, + capability audit_write, + capability bpf, + capability chown, + capability dac_override, + capability dac_read_search, + capability fowner, + capability fsetid, + capability kill, + capability linux_immutable, + capability mknod, + capability net_admin, + capability net_raw, + capability perfmon, + capability setfcap, + capability setgid, + capability setpcap, + capability setuid, + capability sys_admin, + capability sys_nice, + capability sys_ptrace, + capability sys_rawio, + capability sys_resource, + capability sys_time, + capability sys_tty_config, + capability syslog, + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 raw, + network inet6 stream, + network netlink raw, + network packet dgram, + network packet raw, + network qipcrtr dgram, + + mount -> @{run}/systemd/mount-rootfs/{,**}, + mount -> @{run}/systemd/namespace-@{rand6}/{,**}, + mount options=(rw move) /dev/shm/ -> @{run}/credentials/*/, + mount options=(rw rshared) -> /, + mount options=(rw rslave) -> /, + mount options=(rw rslave) -> /dev/, + mount options=(rw slave) -> @{run}/systemd/incoming/, + mount fstype=tmpfs options=(rw nodev noexec nosuid nosymfollow) tmpfs -> /dev/shm/, + mount fstype=tmpfs options=(rw nodev strictatime) tmpfs -> @{run}/systemd/unit-private-tmp/, + + remount /dev/shm/, + remount @{run}/systemd/mount-rootfs/{,**}, + + umount /, + umount /dev/shm/, + umount @{run}/systemd/mount-rootfs/{,**}, + + pivot_root oldroot=/run/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/, + + change_profile, + + mqueue (read getattr) type=posix /, + + signal peer=sd//&*, + signal receive peer=@{p_systemd}, + signal send, + + ptrace read, + + unix type=dgram peer=(label=@{p_systemd}), + unix type=dgram peer=(label=systemd-timesyncd), + unix type=stream, + + dbus bus=system, + + @{exec_path} mr, + + @{bin}/** mPx, + @{sbin}/** mPx, + @{lib}/** Px, + /etc/cron.*/* Px, + /etc/init.d/* Px, + /etc/update-motd.d/* Px, + /usr/share/*/** Px, + + # Systemd user: systemd --user + @{lib}/systemd/systemd px -> systemd-user, + + # Mount operations from services and systemd + @{bin}/mount Px -> sd-mount, + @{bin}/umount Px -> sd-umount, + + # Unit services using systemctl + @{bin}/systemctl Cx -> systemctl, + + # Unit services + @{bin}/kill Cx -> kill, + + # Used by very basic services, ideally should be replaced by a unit profiles + @{sh_path} ix, + @{bin}/false ix, + @{bin}/true ix, + + # Required due to stacked profiles + @{bin}/grpck ix, + @{bin}/gzip ix, + @{bin}/install ix, + @{bin}/pwck ix, + @{bin}/readlink ix, + @{lib}/colord-sane ix, + @{lib}/systemd/systemd-nsresourcework ix, + @{lib}/systemd/systemd-userwork ix, + + / r, + @{att}/ r, + @{bin}/{,**} r, + @{lib}/{,**} r, + @{sbin}/{,*} r, + /usr/share/** r, + /etc/** rk, + /home/ r, + + @{efi}/ r, + @{efi}/** rw, + + @{att}/var/lib/systemd/*/ r, + + /var/cache/*/ rw, + /var/cache/*/** rwk, + /var/lib/*/ rw, + /var/lib/*/** rwk, + /var/lib/systemd/*/ r, + /var/log/** rw, + /var/log/journal/** rwl -> /var/log/journal/**, + + @{desktop_share_dirs}/icc/edid-@{hex32}.icc r, + @{user_share_dirs}/icc/edid-@{hex32}.icc r, + + @{att}/@{run}/systemd/io.systemd.ManagedOOM rw, + @{att}/@{run}/systemd/notify rw, + @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw, + @{att}/@{run}/systemd/userdb/io.systemd.Home rw, + @{att}/@{run}/systemd/userdb/io.systemd.Multiplexer rw, + + @{run}/ rw, + @{run}/* rw, + @{run}/*/ rw, + @{run}/*/* rw, + @{run}/systemd/{,**} rw, + owner @{run}/*/** rw, + + @{run}/udev/**/ r, + @{run}/udev/data/* r, + + @{sys}/** r, + @{sys}/fs/bpf/systemd/{,**} w, + @{sys}/firmware/efi/efivars/** w, + @{sys}/fs/cgroup/{,**} w, + + @{PROC}/@{pid}/attr/apparmor/exec w, + @{PROC}/@{pid}/attr/current r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/environ r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/gid_map w, + @{PROC}/@{pid}/limits r, + @{PROC}/@{pid}/loginuid rw, + @{PROC}/@{pid}/mountinfo r, + @{PROC}/@{pid}/oom_score_adj rw, + @{PROC}/@{pid}/sessionid r, + @{PROC}/@{pid}/setgroups r, + @{PROC}/@{pid}/setgroups w, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/uid_map r, + @{PROC}/@{pid}/uid_map w, + @{PROC}/cmdline r, + @{PROC}/interrupts r, + @{PROC}/irq/@{int}/node r, + @{PROC}/irq/@{int}/smp_affinity r, + @{PROC}/kmsg r, + @{PROC}/modules r, + @{PROC}/pressure/* r, + @{PROC}/swaps r, + @{PROC}/sys/** r, + @{PROC}/sys/kernel/random/write_wakeup_threshold w, + @{PROC}/sys/net/ipv{4,6}/** rw, + @{PROC}/sysvipc/* r, + @{PROC}/version_signature r, + + /dev/** rwk, + + profile systemctl flags=(attach_disconnected,mediate_deleted,complain) { + include + include + + include if exists + include if exists + } + + profile kill flags=(attach_disconnected,mediate_deleted,complain) { + include + + signal send, + + @{bin}/kill mr, + + include if exists + } + + include if exists + include if exists +} + +# vim:syntax=apparmor From a194f28c21f15ee0ffd693eb5612ce198bcc75ab Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 22:59:02 +0200 Subject: [PATCH 0963/1455] feat(fsp): add sd-mount. --- apparmor.d/groups/_full/sd-mount | 71 ++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 apparmor.d/groups/_full/sd-mount diff --git a/apparmor.d/groups/_full/sd-mount b/apparmor.d/groups/_full/sd-mount new file mode 100644 index 000000000..7f7dede60 --- /dev/null +++ b/apparmor.d/groups/_full/sd-mount @@ -0,0 +1,71 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Part of the systemd (as PID 1) profile. + +# sd-mount is a subprofile of sd responsible to handle mounting operation. + +# Only use this profile with a fully configured system. Otherwise it **WILL** +# break your computer. See https://apparmor.pujol.io/full-system-policy/. + +# Distributions and other programs can add rules in the usr/sd-mount.d directory + +abi , + +include + +@{exec_path} = @{bin}/mount +profile sd-mount flags=(complain) { + include + include + + capability dac_read_search, + capability sys_admin, + + mount -> @{efi}/, + mount -> @{HOME}/{,**}, + mount -> @{HOMEDIRS}/, + mount -> @{MOUNTDIRS}/, + mount -> @{MOUNTS}/{,**}, + mount fstype=binfmt_misc options=(rw nodev noexec nosuid) binfmt_misc -> @{PROC}/sys/fs/binfmt_misc/, + mount fstype=configfs options=(rw nodev noexec nosuid) configfs -> @{sys}/kernel/config/, + mount fstype=debugfs options=(rw nodev noexec nosuid) debugfs -> @{sys}/kernel/debug/, + mount fstype=fusectl options=(rw nodev noexec nosuid) fusectl -> @{sys}/fs/fuse/connections/, + mount fstype=hugetlbfs options=(rw nosuid nodev) hugetlbfs -> /dev/hugepages/, + mount fstype=mqueue options=(rw nodev noexec nosuid) -> /dev/mqueue/, + mount fstype=squashfs options=(ro nodev) /dev/loop@{int} -> /snap/*/@{int}/, + mount fstype=tmpfs options=(rw nodev noexec nosuid) tmpfs -> @{run}/lock/, + mount fstype=tmpfs options=(rw nodev nosuid strictatime) tmpfs -> /tmp/, + mount fstype=tracefs options=(rw nodev noexec nosuid) tracefs -> @{sys}/kernel/tracing/, + + mount options=(rw move) -> @{efi}, + mount options=(rw move) -> @{HOME}/{,**}, + mount options=(rw move) -> @{HOMEDIRS}/, + mount options=(rw move) -> @{MOUNTDIRS}/, + mount options=(rw move) -> @{MOUNTS}/{,**}, + mount options=(rw move) -> @{sys}/fs/fuse/connections/, + mount options=(rw move) -> @{sys}/kernel/config/, + mount options=(rw move) -> @{sys}/kernel/debug/, + mount options=(rw move) -> @{sys}/kernel/tracing/, + mount options=(rw move) -> /dev/hugepages/, + mount options=(rw move) -> /dev/mqueue/, + mount options=(rw move) -> /tmp/, + + @{exec_path} mr, + + /var/lib/snapd/snaps/*.snap r, + + @{run}/ r, + owner @{run}/mount/ rw, + owner @{run}/mount/utab{,.*} rwk, + + @{PROC}/@{pid}/mountinfo r, + + /dev/loop-control rw, + + include if exists + include if exists +} + +# vim:syntax=apparmor From 8ff829542d4fea4e9366e7ed03a387637eb24c95 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:13:04 +0200 Subject: [PATCH 0964/1455] feat(profile): add profile for some named minimal systemd service. --- .../cloud-init-hotplugd.service | 22 +++++++ .../systemd-service/debug-shell.service | 19 ++++++ .../groups/systemd-service/dmesg.service | 62 +++++++++++++++++++ .../systemd-service/grub-common.service | 28 +++++++++ .../groups/systemd-service/ldconfig.service | 23 +++++++ .../groups/systemd-service/man-db.service | 39 ++++++++++++ .../systemd-service/secureboot-db.service | 27 ++++++++ .../groups/systemd-service/shadow.service | 23 +++++++ .../snapd.system-shutdown.service | 28 +++++++++ .../system-update-cleanup.service | 22 +++++++ .../systemd-service/usb_modeswitch.service | 17 +++++ 11 files changed, 310 insertions(+) create mode 100644 apparmor.d/groups/systemd-service/cloud-init-hotplugd.service create mode 100644 apparmor.d/groups/systemd-service/debug-shell.service create mode 100644 apparmor.d/groups/systemd-service/dmesg.service create mode 100644 apparmor.d/groups/systemd-service/grub-common.service create mode 100644 apparmor.d/groups/systemd-service/ldconfig.service create mode 100644 apparmor.d/groups/systemd-service/man-db.service create mode 100644 apparmor.d/groups/systemd-service/secureboot-db.service create mode 100644 apparmor.d/groups/systemd-service/shadow.service create mode 100644 apparmor.d/groups/systemd-service/snapd.system-shutdown.service create mode 100644 apparmor.d/groups/systemd-service/system-update-cleanup.service create mode 100644 apparmor.d/groups/systemd-service/usb_modeswitch.service diff --git a/apparmor.d/groups/systemd-service/cloud-init-hotplugd.service b/apparmor.d/groups/systemd-service/cloud-init-hotplugd.service new file mode 100644 index 000000000..1b585c0cc --- /dev/null +++ b/apparmor.d/groups/systemd-service/cloud-init-hotplugd.service @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# /bin/bash -c 'read args <&3; echo "args=$args"; \ +# exec /usr/bin/cloud-init devel hotplug-hook $args; \ +# exit 0' + +abi , + +include + +profile cloud-init-hotplugd.service { + include + + @{sh_path} ix, + @{bin}/cloud-init Px, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/debug-shell.service b/apparmor.d/groups/systemd-service/debug-shell.service new file mode 100644 index 000000000..9f8e235cf --- /dev/null +++ b/apparmor.d/groups/systemd-service/debug-shell.service @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# ExecStart=/usr/bin/bash + +abi , + +include + +profile debug-shell.service { + include + + all, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/dmesg.service b/apparmor.d/groups/systemd-service/dmesg.service new file mode 100644 index 000000000..4c67f680a --- /dev/null +++ b/apparmor.d/groups/systemd-service/dmesg.service @@ -0,0 +1,62 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# ExecStartPre=-/usr/bin/savelog -m640 -q -p -n -c 5 /var/log/dmesg +# ExecStart=/bin/journalctl --boot 0 --dmesg --output short-monotonic --quiet --no-pager --no-hostname +# ExecStartPost=/bin/chgrp adm /var/log/dmesg +# ExecStartPost=/bin/chmod 0640 /var/log/dmesg + +abi , + +include + +profile dmesg.service flags=(attach_disconnected) { + include + include + + capability chown, + capability fsetid, + + ptrace read peer=@{p_systemd}, + + @{sh_path} r, + @{bin}/basename ix, + @{bin}/chgrp rix, + @{bin}/chmod rix, + @{bin}/chown ix, + @{bin}/date ix, + @{bin}/dirname ix, + @{bin}/gzip ix, + @{bin}/gzip ix, + @{bin}/journalctl r, + @{bin}/ln ix, + @{bin}/mv ix, + @{bin}/rm ix, + @{bin}/savelog rix, + @{bin}/touch ix, + + /etc/machine-id r, + + /var/log/ r, + /var/log/dmesg rw, + /var/log/dmesg.* rwl -> /var/log/dmesg, + + /{run,var}/log/journal/ r, + /{run,var}/log/journal/@{hex32}/ r, + /{run,var}/log/journal/@{hex32}/system.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex}-@{hex}.journal* rw, + /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* rw, + /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* rw, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex}-@{hex}.journal* rw, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* rw, + + @{PROC}/1/environ r, + @{PROC}/cmdline r, + @{PROC}/sys/kernel/osrelease r, + @{PROC}/sys/kernel/random/boot_id r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/grub-common.service b/apparmor.d/groups/systemd-service/grub-common.service new file mode 100644 index 000000000..4abd74fb1 --- /dev/null +++ b/apparmor.d/groups/systemd-service/grub-common.service @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# ExecStartPre=/bin/sh -c '[ -s /boot/grub/grubenv ] || rm -f /boot/grub/grubenv; mkdir -p /boot/grub' +# ExecStart=grub-editenv /boot/grub/grubenv unset recordfail +# ExecStartPost=/bin/sh -c 'if grub-editenv /boot/grub/grubenv list | grep -q initrdless_boot_fallback_triggered=1; then echo "grub: GRUB_FORCE_PARTUUID set, initrdless boot paniced, fallback triggered."; fi' + +abi , + +include + +profile grub-common.service { + include + + @{sh_path} rix, + @{bin}/grep ix, + @{bin}/grub-editenv rix, + @{bin}/mkdir ix, + @{bin}/rm ix, + + /boot/grub/ w, + /boot/grub/grubenv rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/ldconfig.service b/apparmor.d/groups/systemd-service/ldconfig.service new file mode 100644 index 000000000..f7d193e9e --- /dev/null +++ b/apparmor.d/groups/systemd-service/ldconfig.service @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# /sbin/ldconfig -X + +abi , + +include + +profile ldconfig.service { + include + + @{lib}/ r, + @{sbin}/ldconfig r, + + /var/cache/ldconfig/aux-cache rw, + /var/cache/ldconfig/aux-cache~ rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/man-db.service b/apparmor.d/groups/systemd-service/man-db.service new file mode 100644 index 000000000..24b34fc25 --- /dev/null +++ b/apparmor.d/groups/systemd-service/man-db.service @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# ExecStart=+/usr/bin/install -d -o man -g man -m 0755 /var/cache/man +# ExecStart=/usr/bin/mandb --quiet + +abi , + +include + +profile man-db.service flags=(attach_disconnected) { + include + include + + @{bin}/install ix, + @{bin}/mandb r, + + /usr/{,local/}share/man/{,**} r, + + /etc/man_db.conf r, + /etc/manpath.config r, + + /usr/share/man/{,**} r, + /usr/local/man/{,**} r, + /usr/local/share/man/{,**} r, + + /usr/{,share/}man/{,**} r, + /usr/local/{,share/}man/{,**} r, + + /usr/share/**/man/man@{u8}/*.@{int}.gz r, + + owner /var/cache/man/ rw, + owner /var/cache/man/** rwk, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/secureboot-db.service b/apparmor.d/groups/systemd-service/secureboot-db.service new file mode 100644 index 000000000..a951747be --- /dev/null +++ b/apparmor.d/groups/systemd-service/secureboot-db.service @@ -0,0 +1,27 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# ExecStartPre=-/usr/bin/chattr -i /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c +# ExecStartPre=-/usr/bin/chattr -i /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f +# ExecStartPre=-/usr/bin/chattr -i /sys/firmware/efi/efivars/dbx-d719b2cb-3d3a-4596-a3bc-dad00e67656f +# ExecStart=/usr/bin/sbkeysync --no-default-keystores --keystore /usr/share/secureboot/updates --verbose + +abi , + +include + +profile secureboot-db.service flags=(complain) { + include + + @{bin}/chattr ix, + @{bin}/sbkeysync PUx, + + @{sys}/firmware/efi/efivars/KEK-@{uuid} rw, + @{sys}/firmware/efi/efivars/db-@{uuid} rw, + @{sys}/firmware/efi/efivars/dbx-@{uuid} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/shadow.service b/apparmor.d/groups/systemd-service/shadow.service new file mode 100644 index 000000000..95f780b89 --- /dev/null +++ b/apparmor.d/groups/systemd-service/shadow.service @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +profile shadow.service flags=(attach_disconnected) { + include + include + + @{sh_path} rix, + @{sbin}/grpck Px -> &grpck, + @{sbin}/pwck Px -> &pwck, + + /etc/machine-id r, + /etc/shadow r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/snapd.system-shutdown.service b/apparmor.d/groups/systemd-service/snapd.system-shutdown.service new file mode 100644 index 000000000..e8939006e --- /dev/null +++ b/apparmor.d/groups/systemd-service/snapd.system-shutdown.service @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# /bin/mount /run -o remount,exec +# /bin/mkdir -p /run/initramfs +# /bin/cp /usr/lib/snapd/system-shutdown /run/initramfs/shutdown + +abi , + +include + +profile snapd.system-shutdown.service { + include + + audit @{bin}/cp ix, + audit @{bin}/mkdir ix, + audit @{bin}/mount ix, + + @{lib}/snapd/system-shutdown r, + + @{run}/initramfs/ rw, + @{run}/initramfs/shutdown rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/system-update-cleanup.service b/apparmor.d/groups/systemd-service/system-update-cleanup.service new file mode 100644 index 000000000..4166cb76c --- /dev/null +++ b/apparmor.d/groups/systemd-service/system-update-cleanup.service @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# ExecStart=rm -fv /system-update /etc/system-update + +abi , + +include + +profile system-update-cleanup.service { + include + + @{bin}/rm ix, + + /etc/system-update w, + /system-update w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-service/usb_modeswitch.service b/apparmor.d/groups/systemd-service/usb_modeswitch.service new file mode 100644 index 000000000..00a62c933 --- /dev/null +++ b/apparmor.d/groups/systemd-service/usb_modeswitch.service @@ -0,0 +1,17 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +profile usb_modeswitch.service { + include + + @{sbin}/usb_modeswitch_dispatcher ix, + + include if exists +} + +# vim:syntax=apparmor From 1aa0142a6aa0b31732fdf286fea14e3600b2f76e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:20:32 +0200 Subject: [PATCH 0965/1455] feat(fsp): add/update systemd drop in files with AppArmorProfile set to the target profile. --- systemd/full/system/apport-coredump-hook@.service | 2 ++ systemd/full/system/apt-news.service | 2 ++ systemd/full/system/bluetooth.service | 2 +- systemd/full/system/cloud-init-hotplugd.service | 2 ++ systemd/full/system/colord.service | 2 ++ systemd/full/system/debug-shell.service | 2 ++ systemd/full/system/dmesg.service | 2 ++ systemd/full/system/fwupd.service | 2 ++ systemd/full/system/grub-common.service | 2 ++ systemd/full/system/ldconfig.service | 2 ++ systemd/full/system/logrotate.service | 2 ++ systemd/full/system/low-memory-monitor.service | 3 --- systemd/full/system/man-db.service | 2 ++ systemd/full/system/paccache.service | 2 -- systemd/full/system/passim.service | 2 -- systemd/full/system/pcscd.service | 2 ++ systemd/full/system/power-profiles-daemon.service | 2 ++ systemd/full/system/reflector.service | 2 -- systemd/full/system/rsyslog.service | 2 ++ systemd/full/system/secureboot-db.service | 2 ++ systemd/full/system/shadow.service | 3 +-- systemd/full/system/snapd.system-shutdown.service | 2 ++ systemd/full/system/system-update-cleanup.service | 2 ++ systemd/full/system/systemd-coredump@.service | 2 ++ systemd/full/system/systemd-initctl.service | 2 ++ systemd/full/system/systemd-journal-remote.service | 2 ++ systemd/full/system/systemd-nsresourced.service | 2 ++ systemd/full/system/systemd-oomd.service | 2 ++ systemd/full/system/systemd-rfkill.service | 2 ++ systemd/full/system/systemd-timesyncd.service | 2 ++ systemd/full/system/usb_modeswitch@.service | 2 ++ 31 files changed, 52 insertions(+), 12 deletions(-) create mode 100644 systemd/full/system/apport-coredump-hook@.service create mode 100644 systemd/full/system/apt-news.service create mode 100644 systemd/full/system/cloud-init-hotplugd.service create mode 100644 systemd/full/system/colord.service create mode 100644 systemd/full/system/debug-shell.service create mode 100644 systemd/full/system/dmesg.service create mode 100644 systemd/full/system/fwupd.service create mode 100644 systemd/full/system/grub-common.service create mode 100644 systemd/full/system/ldconfig.service create mode 100644 systemd/full/system/logrotate.service delete mode 100644 systemd/full/system/low-memory-monitor.service create mode 100644 systemd/full/system/man-db.service delete mode 100644 systemd/full/system/paccache.service delete mode 100644 systemd/full/system/passim.service create mode 100644 systemd/full/system/pcscd.service create mode 100644 systemd/full/system/power-profiles-daemon.service delete mode 100644 systemd/full/system/reflector.service create mode 100644 systemd/full/system/rsyslog.service create mode 100644 systemd/full/system/secureboot-db.service create mode 100644 systemd/full/system/snapd.system-shutdown.service create mode 100644 systemd/full/system/system-update-cleanup.service create mode 100644 systemd/full/system/systemd-coredump@.service create mode 100644 systemd/full/system/systemd-initctl.service create mode 100644 systemd/full/system/systemd-journal-remote.service create mode 100644 systemd/full/system/systemd-nsresourced.service create mode 100644 systemd/full/system/systemd-oomd.service create mode 100644 systemd/full/system/systemd-rfkill.service create mode 100644 systemd/full/system/systemd-timesyncd.service create mode 100644 systemd/full/system/usb_modeswitch@.service diff --git a/systemd/full/system/apport-coredump-hook@.service b/systemd/full/system/apport-coredump-hook@.service new file mode 100644 index 000000000..73bbc99d8 --- /dev/null +++ b/systemd/full/system/apport-coredump-hook@.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&apport \ No newline at end of file diff --git a/systemd/full/system/apt-news.service b/systemd/full/system/apt-news.service new file mode 100644 index 000000000..d7bf885dd --- /dev/null +++ b/systemd/full/system/apt-news.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&apt_news diff --git a/systemd/full/system/bluetooth.service b/systemd/full/system/bluetooth.service index 03d352890..5cccff422 100644 --- a/systemd/full/system/bluetooth.service +++ b/systemd/full/system/bluetooth.service @@ -1,2 +1,2 @@ [Service] -NoNewPrivileges=no \ No newline at end of file +AppArmorProfile=&bluetoothd \ No newline at end of file diff --git a/systemd/full/system/cloud-init-hotplugd.service b/systemd/full/system/cloud-init-hotplugd.service new file mode 100644 index 000000000..a2a121fc3 --- /dev/null +++ b/systemd/full/system/cloud-init-hotplugd.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&cloud-init-hotplugd.service diff --git a/systemd/full/system/colord.service b/systemd/full/system/colord.service new file mode 100644 index 000000000..9a64fbc26 --- /dev/null +++ b/systemd/full/system/colord.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&colord diff --git a/systemd/full/system/debug-shell.service b/systemd/full/system/debug-shell.service new file mode 100644 index 000000000..f895f7941 --- /dev/null +++ b/systemd/full/system/debug-shell.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=debug-shell.service \ No newline at end of file diff --git a/systemd/full/system/dmesg.service b/systemd/full/system/dmesg.service new file mode 100644 index 000000000..d4647117b --- /dev/null +++ b/systemd/full/system/dmesg.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=dmesg.service \ No newline at end of file diff --git a/systemd/full/system/fwupd.service b/systemd/full/system/fwupd.service new file mode 100644 index 000000000..5054a73d6 --- /dev/null +++ b/systemd/full/system/fwupd.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&fwupd \ No newline at end of file diff --git a/systemd/full/system/grub-common.service b/systemd/full/system/grub-common.service new file mode 100644 index 000000000..8520aea76 --- /dev/null +++ b/systemd/full/system/grub-common.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=grub-common.service \ No newline at end of file diff --git a/systemd/full/system/ldconfig.service b/systemd/full/system/ldconfig.service new file mode 100644 index 000000000..1b2a9c287 --- /dev/null +++ b/systemd/full/system/ldconfig.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=ldconfig.service \ No newline at end of file diff --git a/systemd/full/system/logrotate.service b/systemd/full/system/logrotate.service new file mode 100644 index 000000000..bc984e025 --- /dev/null +++ b/systemd/full/system/logrotate.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&logrotate \ No newline at end of file diff --git a/systemd/full/system/low-memory-monitor.service b/systemd/full/system/low-memory-monitor.service deleted file mode 100644 index dabf76f3a..000000000 --- a/systemd/full/system/low-memory-monitor.service +++ /dev/null @@ -1,3 +0,0 @@ -[Service] -NoNewPrivileges=no - diff --git a/systemd/full/system/man-db.service b/systemd/full/system/man-db.service new file mode 100644 index 000000000..d3a78dd80 --- /dev/null +++ b/systemd/full/system/man-db.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=man-db.service \ No newline at end of file diff --git a/systemd/full/system/paccache.service b/systemd/full/system/paccache.service deleted file mode 100644 index 03d352890..000000000 --- a/systemd/full/system/paccache.service +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -NoNewPrivileges=no \ No newline at end of file diff --git a/systemd/full/system/passim.service b/systemd/full/system/passim.service deleted file mode 100644 index 03d352890..000000000 --- a/systemd/full/system/passim.service +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -NoNewPrivileges=no \ No newline at end of file diff --git a/systemd/full/system/pcscd.service b/systemd/full/system/pcscd.service new file mode 100644 index 000000000..8d39f3f26 --- /dev/null +++ b/systemd/full/system/pcscd.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&pcscd diff --git a/systemd/full/system/power-profiles-daemon.service b/systemd/full/system/power-profiles-daemon.service new file mode 100644 index 000000000..45c5ed93b --- /dev/null +++ b/systemd/full/system/power-profiles-daemon.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&power-profiles-daemon \ No newline at end of file diff --git a/systemd/full/system/reflector.service b/systemd/full/system/reflector.service deleted file mode 100644 index 03d352890..000000000 --- a/systemd/full/system/reflector.service +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -NoNewPrivileges=no \ No newline at end of file diff --git a/systemd/full/system/rsyslog.service b/systemd/full/system/rsyslog.service new file mode 100644 index 000000000..6b49a73f0 --- /dev/null +++ b/systemd/full/system/rsyslog.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&rsyslogd diff --git a/systemd/full/system/secureboot-db.service b/systemd/full/system/secureboot-db.service new file mode 100644 index 000000000..722781b8a --- /dev/null +++ b/systemd/full/system/secureboot-db.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=secureboot-db.service diff --git a/systemd/full/system/shadow.service b/systemd/full/system/shadow.service index dabf76f3a..52d2f644c 100644 --- a/systemd/full/system/shadow.service +++ b/systemd/full/system/shadow.service @@ -1,3 +1,2 @@ [Service] -NoNewPrivileges=no - +AppArmorProfile=&shadow.service diff --git a/systemd/full/system/snapd.system-shutdown.service b/systemd/full/system/snapd.system-shutdown.service new file mode 100644 index 000000000..7953d522a --- /dev/null +++ b/systemd/full/system/snapd.system-shutdown.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=snapd.system-shutdown.service \ No newline at end of file diff --git a/systemd/full/system/system-update-cleanup.service b/systemd/full/system/system-update-cleanup.service new file mode 100644 index 000000000..24c914f77 --- /dev/null +++ b/systemd/full/system/system-update-cleanup.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=system-update-cleanup.service \ No newline at end of file diff --git a/systemd/full/system/systemd-coredump@.service b/systemd/full/system/systemd-coredump@.service new file mode 100644 index 000000000..d13624709 --- /dev/null +++ b/systemd/full/system/systemd-coredump@.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&systemd-coredump diff --git a/systemd/full/system/systemd-initctl.service b/systemd/full/system/systemd-initctl.service new file mode 100644 index 000000000..e44c8767f --- /dev/null +++ b/systemd/full/system/systemd-initctl.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&systemd-initctl \ No newline at end of file diff --git a/systemd/full/system/systemd-journal-remote.service b/systemd/full/system/systemd-journal-remote.service new file mode 100644 index 000000000..e08cf75a9 --- /dev/null +++ b/systemd/full/system/systemd-journal-remote.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&systemd-journal-remote \ No newline at end of file diff --git a/systemd/full/system/systemd-nsresourced.service b/systemd/full/system/systemd-nsresourced.service new file mode 100644 index 000000000..2dc668b80 --- /dev/null +++ b/systemd/full/system/systemd-nsresourced.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&systemd-nsresourced diff --git a/systemd/full/system/systemd-oomd.service b/systemd/full/system/systemd-oomd.service new file mode 100644 index 000000000..c384626ee --- /dev/null +++ b/systemd/full/system/systemd-oomd.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&systemd-oomd diff --git a/systemd/full/system/systemd-rfkill.service b/systemd/full/system/systemd-rfkill.service new file mode 100644 index 000000000..4abf222d5 --- /dev/null +++ b/systemd/full/system/systemd-rfkill.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&systemd-rfkill diff --git a/systemd/full/system/systemd-timesyncd.service b/systemd/full/system/systemd-timesyncd.service new file mode 100644 index 000000000..0cd6fefbf --- /dev/null +++ b/systemd/full/system/systemd-timesyncd.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&systemd-timesyncd diff --git a/systemd/full/system/usb_modeswitch@.service b/systemd/full/system/usb_modeswitch@.service new file mode 100644 index 000000000..0eca1db25 --- /dev/null +++ b/systemd/full/system/usb_modeswitch@.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=usb_modeswitch.service \ No newline at end of file From d5a65ba8319d63faa358abfc55c51e5fd77bc3f3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:26:18 +0200 Subject: [PATCH 0966/1455] feat(profile): add a few small profile needed by fsp. --- apparmor.d/profiles-a-f/e2scrub | 18 ++++++++++++++++ .../open-iscsi-net-interface-handler | 19 +++++++++++++++++ apparmor.d/profiles-s-z/u-d-c-print-pci-ids | 19 +++++++++++++++++ .../udev-bridge-network-interface | 21 +++++++++++++++++++ 4 files changed, 77 insertions(+) create mode 100644 apparmor.d/profiles-a-f/e2scrub create mode 100644 apparmor.d/profiles-m-r/open-iscsi-net-interface-handler create mode 100644 apparmor.d/profiles-s-z/u-d-c-print-pci-ids create mode 100644 apparmor.d/profiles-s-z/udev-bridge-network-interface diff --git a/apparmor.d/profiles-a-f/e2scrub b/apparmor.d/profiles-a-f/e2scrub new file mode 100644 index 000000000..2e7e88487 --- /dev/null +++ b/apparmor.d/profiles-a-f/e2scrub @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/e2scrub +profile e2scrub @{exec_path} flags=(complain) { + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/open-iscsi-net-interface-handler b/apparmor.d/profiles-m-r/open-iscsi-net-interface-handler new file mode 100644 index 000000000..2593b78ac --- /dev/null +++ b/apparmor.d/profiles-m-r/open-iscsi-net-interface-handler @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/open-iscsi/net-interface-handler +profile open-iscsi-net-interface-handler @{exec_path} flags=(complain) { + include + + @{exec_path} mr, + @{sh_path} r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/u-d-c-print-pci-ids b/apparmor.d/profiles-s-z/u-d-c-print-pci-ids new file mode 100644 index 000000000..2ae7f66ef --- /dev/null +++ b/apparmor.d/profiles-s-z/u-d-c-print-pci-ids @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/u-d-c-print-pci-ids +profile u-d-c-print-pci-ids @{exec_path} { + include + + @{exec_path} mr, + @{sh_path} r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/udev-bridge-network-interface b/apparmor.d/profiles-s-z/udev-bridge-network-interface new file mode 100644 index 000000000..7e3ba52f9 --- /dev/null +++ b/apparmor.d/profiles-s-z/udev-bridge-network-interface @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/udev/bridge-network-interface +profile udev-bridge-network-interface @{exec_path} { + include + + @{exec_path} mr, + @{sh_path} r, + + /etc/default/bridge-utils r, + + include if exists +} + +# vim:syntax=apparmor From 3984cf8accfaf48badb6f6ad9916a392bde499d5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:27:55 +0200 Subject: [PATCH 0967/1455] feat(profile): initial profile for pollinate. --- apparmor.d/profiles-m-r/pollinate | 48 +++++++++++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 49 insertions(+) create mode 100644 apparmor.d/profiles-m-r/pollinate diff --git a/apparmor.d/profiles-m-r/pollinate b/apparmor.d/profiles-m-r/pollinate new file mode 100644 index 000000000..5a10cc9e2 --- /dev/null +++ b/apparmor.d/profiles-m-r/pollinate @@ -0,0 +1,48 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pollinate +profile pollinate @{exec_path} { + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/curl rix, + @{bin}/dpkg rPx -> child-dpkg, + @{bin}/dpkg-query rpx, + @{bin}/hostname rix, + @{bin}/logger rix, + @{bin}/systemd-detect-virt rPx, + @{bin}/xxd rix, + + /etc/cloud/build.info r, + /etc/default/pollinate r, + /etc/lsb-release r, + /etc/pollinate/{,**} r, + + owner /var/cache/pollinate/seeded w, + + owner /tmp/pollinate.@{rand12}/{,**} rw, + + @{PROC}/uptime r, + + /dev/urandom w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 5a6c7c526..2736540a8 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -266,6 +266,7 @@ plymouth complain plymouth-set-default-theme attach_disconnected,complain plymouthd complain polkit-kde-authentication-agent attach_disconnected,complain,mediate_deleted +pollinate complain ptyxis complain ptyxis-agent complain pycompile complain From 7f684ee5ddd420231cf92381e3e86b9f52468456 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:29:52 +0200 Subject: [PATCH 0968/1455] feat(profile): integrate fsp with apt and ubuntu. --- apparmor.d/groups/apt/apt-methods-http | 5 +++-- apparmor.d/groups/apt/dpkg-script-apparmor | 1 + apparmor.d/groups/apt/dpkg-script-systemd | 3 +++ apparmor.d/groups/apt/dpkg-scripts | 3 +++ apparmor.d/groups/apt/unattended-upgrade | 2 ++ apparmor.d/groups/ubuntu/cron-ubuntu-fan | 8 +------- apparmor.d/groups/ubuntu/update-notifier-crash | 9 +++++++++ 7 files changed, 22 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/apt/apt-methods-http b/apparmor.d/groups/apt/apt-methods-http index 0b375c8f8..7fb3a2cc4 100644 --- a/apparmor.d/groups/apt/apt-methods-http +++ b/apparmor.d/groups/apt/apt-methods-http @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/apt/methods/http{,s} -profile apt-methods-http @{exec_path} { +profile apt-methods-http @{exec_path} flags=(attach_disconnected) { include include include @@ -23,10 +23,11 @@ profile apt-methods-http @{exec_path} { network inet6 stream, network netlink raw, + signal receive peer=@{p_apt_news}, + signal receive peer=@{p_packagekitd}, signal receive peer=apt-get, signal receive peer=apt, signal receive peer=aptitude, - signal receive peer=@{p_packagekitd}, signal receive peer=role_*, signal receive peer=synaptic, signal receive peer=ubuntu-advantage, diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index 73b14390a..e9a03f282 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -30,6 +30,7 @@ profile dpkg-script-apparmor @{exec_path} { /var/lib/dpkg/diversions-old rwl -> /var/lib/dpkg/diversions, /var/lib/dpkg/info/*.list r, + /var/lib/dpkg/info/format r, /var/lib/dpkg/status r, /var/lib/dpkg/triggers/File r, /var/lib/dpkg/triggers/Unincorp r, diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd index 4acafd139..8ca92515c 100644 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -32,6 +32,9 @@ profile dpkg-script-systemd @{exec_path} { /etc/systemd/system/*.wants/ rw, /etc/systemd/system/*.wants/* rw, + /etc/pam.d/sed@{rand6} rw, + /etc/pam.d/common-password rw, + /var/lib/systemd/{,*} rw, /var/log/journal/ rw, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 4fb4d04c4..3102b23bb 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -47,6 +47,7 @@ profile dpkg-scripts @{exec_path} { @{sbin}/update-rc.d Cx -> rc, # Maintainer scripts can legitimately start/restart anything + # PU is only used as a safety fallback. @{bin}/** PUx, @{sbin}/** PUx, @{lib}/** PUx, @@ -75,6 +76,8 @@ profile dpkg-scripts @{exec_path} { include include + capability dac_read_search, + dbus send bus=system path=/ interface=org.freedesktop.DBus member=ReloadConfig diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index 95b8b2760..c2d94e25a 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -30,6 +30,8 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { capability setuid, capability sys_nice, + network inet dgram, + network inet6 dgram, network netlink raw, signal send peer=apt-methods-http, diff --git a/apparmor.d/groups/ubuntu/cron-ubuntu-fan b/apparmor.d/groups/ubuntu/cron-ubuntu-fan index 8f5952d9b..3ca55909d 100644 --- a/apparmor.d/groups/ubuntu/cron-ubuntu-fan +++ b/apparmor.d/groups/ubuntu/cron-ubuntu-fan @@ -15,20 +15,14 @@ profile cron-ubuntu-fan @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{sbin}/fanctl rix, - @{bin}/flock rix, + @{sbin}/fanctl rPx, @{bin}/grep rix, - @{bin}/id rix, @{sbin}/ip rix, @{bin}/mkdir rix, @{bin}/sed rix, - @{bin}/touch rix, /etc/network/fan r, - @{run}/ubuntu-fan/ rw, - @{run}/ubuntu-fan/.lock rwk, - include if exists } diff --git a/apparmor.d/groups/ubuntu/update-notifier-crash b/apparmor.d/groups/ubuntu/update-notifier-crash index b3cbf7f07..3ad03eb05 100644 --- a/apparmor.d/groups/ubuntu/update-notifier-crash +++ b/apparmor.d/groups/ubuntu/update-notifier-crash @@ -12,8 +12,17 @@ profile update-notifier-crash @{exec_path} { @{exec_path} mr, + @{bin}/systemctl Cx -> systemctl, + /usr/share/apport/apport-checkreports Px, + profile systemctl { + include + include + + include if exists + } + include if exists } From 38c6e35a1b0e5af40b06a50484e4b95a86f45581 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:33:37 +0200 Subject: [PATCH 0969/1455] feat(profile): add some ubuntu specific profiles. --- apparmor.d/groups/ubuntu/apt_news | 39 +++++++++++++++++++++++++ apparmor.d/groups/ubuntu/fanctl | 33 +++++++++++++++++++++ apparmor.d/groups/ubuntu/ubuntu-fan-net | 24 +++++++++++++++ dists/flags/ubuntu.flags | 3 ++ 4 files changed, 99 insertions(+) create mode 100644 apparmor.d/groups/ubuntu/apt_news create mode 100644 apparmor.d/groups/ubuntu/fanctl create mode 100644 apparmor.d/groups/ubuntu/ubuntu-fan-net diff --git a/apparmor.d/groups/ubuntu/apt_news b/apparmor.d/groups/ubuntu/apt_news new file mode 100644 index 000000000..faf15dfbe --- /dev/null +++ b/apparmor.d/groups/ubuntu/apt_news @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /usr/lib/ubuntu-advantage/apt_news.py +profile apt_news @{exec_path} flags=(attach_disconnected) { + include + include + include + include + + capability chown, + capability kill, + capability setgid, + capability setuid, + + signal send set=int peer=apt-methods-*, + + @{exec_path} mr, + + @{lib}/apt/methods/* Px, + + /etc/ubuntu-advantage/uaclient.conf r, + + @{run}/ubuntu-advantage/ rw, + @{run}/ubuntu-advantage/apt-news/{,**} rw, + + owner @{run}/ubuntu-advantage/apt-news/** rw, + + @{PROC}/@{pid}/fd/ r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/ubuntu/fanctl b/apparmor.d/groups/ubuntu/fanctl new file mode 100644 index 000000000..ef278da63 --- /dev/null +++ b/apparmor.d/groups/ubuntu/fanctl @@ -0,0 +1,33 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/fanctl +profile fanctl @{exec_path} flags=(attach_disconnected) { + include + + network netlink raw, + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/flock ix, + @{bin}/id ix, + @{bin}/touch ix, + @{bin}/mkdir ix, + @{bin}/ip ix, + @{bin}/sed ix, + + /etc/network/fan r, + + @{run}/ubuntu-fan/ rw, + @{run}/ubuntu-fan/.lock rwk, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/ubuntu/ubuntu-fan-net b/apparmor.d/groups/ubuntu/ubuntu-fan-net new file mode 100644 index 000000000..f9d7c01f5 --- /dev/null +++ b/apparmor.d/groups/ubuntu/ubuntu-fan-net @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/ubuntu-fan/fan-net +profile ubuntu-fan-net @{exec_path} { + include + + @{exec_path} mr, + + @{sh_path} mr, + @{bin}/{m,g,}awk ix, + @{bin}/grep ix, + @{bin}/networkctl Px, + @{sbin}/fanctl Px, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/ubuntu.flags b/dists/flags/ubuntu.flags index a6d6bcc85..7339702a2 100644 --- a/dists/flags/ubuntu.flags +++ b/dists/flags/ubuntu.flags @@ -1,12 +1,14 @@ apport attach_disconnected,complain apport-checkreports complain apport-gtk complain +apt_news attach_disconnected,complain apt-esm-hook complain apt-esm-json-hook complain apt-helper complain check-new-release-gtk complain do-release-upgrade complain dpkg-genbuildinfo complain +fanctl attach_disconnected,complain hwe-support-status complain list-oem-metapackages complain livepatch-notification complain @@ -18,6 +20,7 @@ software-properties-gtk complain ubuntu-advantage complain ubuntu-advantage-notification complain ubuntu-distro-info complain +ubuntu-fan-net attach_disconnected,complain ubuntu-report complain update-manager attach_disconnected,complain update-motd-fsck-at-reboot complain From 28d9d48de457eb5d2db6a065d1341386479bc27f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:39:35 +0200 Subject: [PATCH 0970/1455] feat(profile): small update to systemd profiles. --- apparmor.d/groups/systemd/bootctl | 25 ++++++++----------- apparmor.d/groups/systemd/homectl | 2 +- .../systemd/systemd-generator-ds-identify | 4 +-- apparmor.d/groups/systemd/systemd-logind | 2 +- .../systemd/systemd-networkd-wait-online | 2 +- apparmor.d/groups/systemd/systemd-nsresourced | 7 ++++-- 6 files changed, 20 insertions(+), 22 deletions(-) diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index 9508cfcf2..f7d001c70 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/bootctl -profile bootctl @{exec_path} flags=(attach_disconnected) { +profile bootctl @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include @@ -17,27 +17,22 @@ profile bootctl @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_resource, - signal (send) peer=child-pager, + signal send peer=child-pager, - ptrace (read) peer=unconfined, + ptrace read peer=unconfined, @{exec_path} mr, @{pager_path} rPx -> child-pager, @{efi}/ r, - @{efi}/EFI/{,**} r, - @{efi}/EFI/BOOT/.#BOOT*.EFI@{hex} rw, - @{efi}/EFI/BOOT/BOOTX64.EFI w, - @{efi}/EFI/systemd/.#systemd-boot*.efi@{hex} rw, - @{efi}/EFI/systemd/systemd-boot*.efi w, - @{efi}/loader/.#bootctlrandom-seed@{hex} rw, - @{efi}/loader/.#entries.srel* w, - @{efi}/loader/{,**} r, - @{efi}/loader/entries.srel w, - @{efi}/loader/random-seed w, + @{efi}/@{hex32}/ rw, + @{efi}/EFI/{,**} rwl, + @{efi}/loader/ rw, + @{efi}/loader/** rwl -> @{efi}/loader/#@{int}, - /etc/kernel/entry-token r, + /etc/kernel/.#entry-token@{hex16} rw, + /etc/kernel/entry-token rw, /etc/machine-id r, /etc/machine-info r, @@ -63,7 +58,7 @@ profile bootctl @{exec_path} flags=(attach_disconnected) { @{sys}/firmware/efi/efivars/LoaderFirmwareType-@{uuid} r, @{sys}/firmware/efi/efivars/LoaderImageIdentifier-@{uuid} r, @{sys}/firmware/efi/efivars/LoaderInfo-@{uuid} r, - @{sys}/firmware/efi/efivars/LoaderSystemToken-@{uuid} r, + @{sys}/firmware/efi/efivars/LoaderSystemToken-@{uuid} rw, @{sys}/firmware/efi/efivars/OsIndications-@{uuid} r, @{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, diff --git a/apparmor.d/groups/systemd/homectl b/apparmor.d/groups/systemd/homectl index 3a78c531e..3c962e309 100644 --- a/apparmor.d/groups/systemd/homectl +++ b/apparmor.d/groups/systemd/homectl @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/homectl -profile homectl @{exec_path} { +profile homectl @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-generator-ds-identify b/apparmor.d/groups/systemd/systemd-generator-ds-identify index 346e7d94e..ba6141d86 100644 --- a/apparmor.d/groups/systemd/systemd-generator-ds-identify +++ b/apparmor.d/groups/systemd/systemd-generator-ds-identify @@ -12,16 +12,16 @@ profile systemd-generator-ds-identify @{exec_path} flags=(attach_disconnected) { include include - ptrace (read) peer=@{p_systemd}, + ptrace read peer=@{p_systemd}, @{exec_path} mr, @{sh_path} rix, - @{sbin}/blkid rPx, @{bin}/grep rix, @{bin}/systemd-detect-virt rPx, @{bin}/tr rix, @{bin}/uname rix, + @{sbin}/blkid rPx, /etc/cloud/{,**} r, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 39192e7e1..b1869b16b 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -30,7 +30,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { mqueue getattr type=posix /, mqueue r type=posix /, - unix (bind) type=stream addr=@@{udbus}/bus/systemd-logind/system, + unix bind type=stream addr=@@{udbus}/bus/systemd-logind/system, #aa:dbus own bus=system name=org.freedesktop.login1 diff --git a/apparmor.d/groups/systemd/systemd-networkd-wait-online b/apparmor.d/groups/systemd/systemd-networkd-wait-online index 0d5e40730..c36b5af39 100644 --- a/apparmor.d/groups/systemd/systemd-networkd-wait-online +++ b/apparmor.d/groups/systemd/systemd-networkd-wait-online @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-networkd-wait-online -profile systemd-networkd-wait-online @{exec_path} flags=(complain) { +profile systemd-networkd-wait-online @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/systemd/systemd-nsresourced b/apparmor.d/groups/systemd/systemd-nsresourced index d1beae428..97dcb3b05 100644 --- a/apparmor.d/groups/systemd/systemd-nsresourced +++ b/apparmor.d/groups/systemd/systemd-nsresourced @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-nsresourced -profile systemd-nsresourced @{exec_path} { +profile systemd-nsresourced @{exec_path} flags=(attach_disconnected) { include include @@ -19,7 +19,7 @@ profile systemd-nsresourced @{exec_path} { @{exec_path} mr, - @{lib}/systemd/systemd-nsresourcework Px -> systemd-nsresourced//&systemd-nsresourcework, + @{lib}/systemd/systemd-nsresourcework ix, # no new privs @{run}/systemd/nsresource/ rw, @{run}/systemd/nsresource/** rw, @@ -32,6 +32,9 @@ profile systemd-nsresourced @{exec_path} { @{sys}/kernel/btf/vmlinux r, @{sys}/kernel/security/lsm r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/pressure/* r, + include if exists } From 581a55c7269cccd518baf9f65c5078edecaffcb4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:40:49 +0200 Subject: [PATCH 0971/1455] feat(profile): update systemd-homework/homed as they get stacked. --- apparmor.d/groups/systemd/systemd-homed | 20 ++++++-- apparmor.d/groups/systemd/systemd-homework | 58 +++++++++++++++++++++- 2 files changed, 73 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/systemd/systemd-homed b/apparmor.d/groups/systemd/systemd-homed index a89cd90f8..c53be3a35 100644 --- a/apparmor.d/groups/systemd/systemd-homed +++ b/apparmor.d/groups/systemd/systemd-homed @@ -14,6 +14,8 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { include include + userns, + capability chown, capability dac_override, capability dac_read_search, @@ -24,6 +26,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { capability setpcap, capability setuid, capability sys_admin, + capability sys_ptrace, capability sys_resource, network inet dgram, @@ -32,16 +35,24 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { network inet6 raw, network netlink raw, - mount options=(rw, rslave) -> @{run}/, - mount /dev/dm-@{int} -> @{run}/systemd/user-home-mount/, + mount -> @{run}/systemd/user-home-mount/, + mount options=(rw private) -> @{run}/systemd/user-home-mount/, + mount options=(rw rslave) -> @{run}/, + + umount @{run}/systemd/user-home-mount/, + + signal (send receive) set=kill peer=systemd-homed//&systemd-homework, + + ptrace read peer=systemd-homed//&systemd-homework, unix bind type=stream addr=@@{udbus}/bus/systemd-homed/system, #aa:dbus own bus=system name=org.freedesktop.home1 + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd @{exec_path} mr, - @{lib}/systemd/systemd-homework rPx -> systemd-homed//&systemd-homework, + @{lib}/systemd/systemd-homework rPx -> &systemd-homework, @{sbin}/mkfs.btrfs rPx, @{sbin}/mkfs.fat rPx, @{sbin}/mke2fs rPx, @@ -74,9 +85,12 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pid}/cgroup r, @{PROC}/devices r, @{PROC}/pressure/* r, + @{PROC}/swaps r, + @{PROC}/sys/fs/nr_open r, @{PROC}/sysvipc/{shm,sem,msg} r, owner @{PROC}/@{pid}/gid_map w, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/uid_map w, /dev/loop-control rwk, diff --git a/apparmor.d/groups/systemd/systemd-homework b/apparmor.d/groups/systemd/systemd-homework index f0fe98a16..b81c196f8 100644 --- a/apparmor.d/groups/systemd/systemd-homework +++ b/apparmor.d/groups/systemd/systemd-homework @@ -7,14 +7,68 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-homework -profile systemd-homework @{exec_path} { +profile systemd-homework @{exec_path} flags=(attach_disconnected) { include - include include + include + include + + userns, + + capability chown, + capability fowner, + capability fsetid, + capability setfcap, + capability setgid, + capability setuid, + capability sys_admin, + capability sys_resource, + + network netlink raw, + + mount options=(rw rslave) -> @{run}/, + mount -> @{run}/systemd/user-home-mount/, + + umount @{run}/systemd/user-home-mount/, + + signal (send receive) set=kill peer=systemd-homed//&systemd-homework, + + ptrace read peer=systemd-homed//&systemd-homework, @{exec_path} mr, + @{sbin}/mkfs.btrfs rPx, + @{sbin}/mkfs.fat rPx, + @{sbin}/mke2fs rPx, + /etc/machine-id r, + /etc/skel/{,**} r, + + /var/cache/systemd/home/{,**} rw, + + @{HOMEDIRS}/ r, + @{HOMEDIRS}/.#homework@{user}.* rw, + @{HOMEDIRS}/@{user}.home rw, + + @{run}/ r, + @{run}/cryptsetup/ r, + @{run}/cryptsetup/* rwk, + @{run}/systemd/user-home-mount/ rw, + @{run}/systemd/user-home-mount/@{user}/{,**} rw, + + @{sys}/fs/ r, + + @{PROC}/devices r, + @{PROC}/swaps r, + @{PROC}/sys/fs/nr_open r, + owner @{PROC}/@{pid}/gid_map w, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/uid_map w, + + /dev/loop-control rwk, + /dev/loop@{int} rw, + /dev/mapper/control rw, include if exists } From 9325dd5ca0cb1f37bda1d2abd90333cacb2d9958 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:43:19 +0200 Subject: [PATCH 0972/1455] feat(profile): revisit systemd-udevd and ensure most program get transitionned confined. --- apparmor.d/groups/systemd/systemd-udevd | 66 ++++++++++++++----------- 1 file changed, 36 insertions(+), 30 deletions(-) diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 3861056b8..9c993e0d5 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -37,44 +37,45 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{sh_path} rix, - @{coreutils_path} rix, - @{pager_path} rPx -> child-pager, - @{bin}/*-print-pci-ids rix, - @{sbin}/alsactl rPUx, - @{bin}/ddcutil rPx, - @{sbin}/dmsetup rPx, - @{sbin}/ethtool rix, - @{sbin}/issue-generator rPx, - @{sbin}/kdump-config rPUx, - @{bin}/kmod rPx, - @{bin}/logger rix, - @{bin}/ls rix, - @{sbin}/lvm rPx, - @{bin}/mknod rix, - @{sbin}/multipath rPx, - @{bin}/nfsrahead rix, - @{bin}/nvidia-modprobe rPx -> child-modprobe-nvidia, - @{bin}/setfacl rix, - @{bin}/sg_inq rix, - @{bin}/snap rPx, - @{bin}/systemctl rCx -> systemctl, - @{bin}/systemd-run rix, - @{bin}/unshare rix, - @{bin}/vmmouse_detect rPUx, + @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/logger rix, + @{bin}/ls rix, + @{bin}/mknod rix, + @{bin}/nfsrahead rix, + @{bin}/setfacl rix, + @{bin}/sg_inq rix, + @{bin}/systemd-run rix, # TODO: rCx -> run, + @{bin}/unshare rix, + @{sbin}/ethtool rix, + + @{bin}/ddcutil rPx, + @{bin}/kmod rCx -> kmod, + @{bin}/nvidia-modprobe rPx -> child-modprobe-nvidia, + @{bin}/snap rPx, + @{bin}/systemctl rCx -> systemctl, + @{bin}/vmmouse_detect rPx, + @{pager_path} rPx -> child-pager, + @{sbin}/alsactl rPx, + @{sbin}/dmsetup rPx, + @{sbin}/issue-generator rPx, + @{sbin}/kdump-config rPx, + @{sbin}/lvm rPx, + @{sbin}/multipath rPx, + @{sbin}/u-d-c-print-pci-ids rPx, @{lib}/crda/* rPUx, @{lib}/gdm-runtime-config rPx, @{lib}/nfsrahead rPUx, - @{lib}/open-iscsi/net-interface-handler rPUx, + @{lib}/open-iscsi/net-interface-handler rPx, @{lib}/pm-utils/power.d/* rPUx, @{lib}/snapd/snap-device-helper rPx, @{lib}/systemd/systemd-* rPx, @{lib}/udev/* rPUx, /usr/share/hplip/config_usb_printer.py rPUx, - /etc/console-setup/*.sh rPUx, - /etc/network/cloud-ifupdown-helper rPUx, + /etc/console-setup/*.sh rPUx, + /etc/network/cloud-ifupdown-helper rPUx, /etc/default/* r, /etc/machine-id r, @@ -120,6 +121,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected) { /dev/ rw, /dev/** rwk, + profile kmod flags=(attach_disconnected,complain) { + include + include + + include if exists + } + profile systemctl flags=(attach_disconnected,complain) { include include @@ -127,8 +135,6 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_ptrace, - # / r, - include if exists } From 32a9806219898f6c5a25b7efb3a15320ff7af24a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:52:40 +0200 Subject: [PATCH 0973/1455] feat(fsp): update systemd user drop in files with AppArmorProfile set to the target profile. --- systemd/full/user/filter-chain.service | 2 ++ systemd/full/user/pipewire-media-session.service | 5 ----- systemd/full/user/pipewire-pulse.service | 2 ++ systemd/full/user/pipewire.service | 2 ++ systemd/full/user/wireplumber.service | 2 ++ systemd/full/user/wireplumber@.service | 2 ++ 6 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 systemd/full/user/filter-chain.service delete mode 100644 systemd/full/user/pipewire-media-session.service create mode 100644 systemd/full/user/pipewire-pulse.service create mode 100644 systemd/full/user/pipewire.service create mode 100644 systemd/full/user/wireplumber.service create mode 100644 systemd/full/user/wireplumber@.service diff --git a/systemd/full/user/filter-chain.service b/systemd/full/user/filter-chain.service new file mode 100644 index 000000000..4dd212f51 --- /dev/null +++ b/systemd/full/user/filter-chain.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&pipewire \ No newline at end of file diff --git a/systemd/full/user/pipewire-media-session.service b/systemd/full/user/pipewire-media-session.service deleted file mode 100644 index c392e82fe..000000000 --- a/systemd/full/user/pipewire-media-session.service +++ /dev/null @@ -1,5 +0,0 @@ -[Service] -NoNewPrivileges=no -MemoryDenyWriteExecute=no -LockPersonality=no -RestrictNamespaces=no diff --git a/systemd/full/user/pipewire-pulse.service b/systemd/full/user/pipewire-pulse.service new file mode 100644 index 000000000..1d35a493e --- /dev/null +++ b/systemd/full/user/pipewire-pulse.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&pipewire-pulse \ No newline at end of file diff --git a/systemd/full/user/pipewire.service b/systemd/full/user/pipewire.service new file mode 100644 index 000000000..4dd212f51 --- /dev/null +++ b/systemd/full/user/pipewire.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&pipewire \ No newline at end of file diff --git a/systemd/full/user/wireplumber.service b/systemd/full/user/wireplumber.service new file mode 100644 index 000000000..c47175f40 --- /dev/null +++ b/systemd/full/user/wireplumber.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&wireplumber \ No newline at end of file diff --git a/systemd/full/user/wireplumber@.service b/systemd/full/user/wireplumber@.service new file mode 100644 index 000000000..c47175f40 --- /dev/null +++ b/systemd/full/user/wireplumber@.service @@ -0,0 +1,2 @@ +[Service] +AppArmorProfile=&wireplumber \ No newline at end of file From 60b91279162036a7d1a55df72d40977387fe1336 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 29 May 2025 23:53:47 +0200 Subject: [PATCH 0974/1455] feat(profile): update pipewire profiles. --- apparmor.d/groups/freedesktop/pipewire-pulse | 8 +++++++- apparmor.d/groups/freedesktop/pulseaudio | 6 +++--- apparmor.d/groups/freedesktop/wireplumber | 4 ++++ 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/freedesktop/pipewire-pulse b/apparmor.d/groups/freedesktop/pipewire-pulse index 530fa97db..fddbe02f7 100644 --- a/apparmor.d/groups/freedesktop/pipewire-pulse +++ b/apparmor.d/groups/freedesktop/pipewire-pulse @@ -11,15 +11,18 @@ include profile pipewire-pulse @{exec_path} flags=(attach_disconnected) { include include + include + include include capability sys_ptrace, - ptrace (read), + ptrace read, @{exec_path} mr, @{bin}/pactl rix, + @{bin}/pipewire mr, /usr/share/pipewire/{,**} r, @@ -38,6 +41,9 @@ profile pipewire-pulse @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/dmi/id/board_vendor r, @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/module/apparmor/parameters/enabled r, + + owner @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists } diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index fab642571..05e4c3ec2 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -82,9 +82,9 @@ profile pulseaudio @{exec_path} { owner @{desktop_cache_dirs}/gstreamer-1.0/ rw, owner @{desktop_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, - owner @{desktop_config_dirs}/dconf/user r, - owner @{desktop_config_dirs}/pulse/{,**} rw, - owner @{desktop_config_dirs}/pulse/cookie k, + owner @{desktop_config_dirs}/dconf/user r, + owner @{desktop_config_dirs}/pulse/{,**} rw, + owner @{desktop_config_dirs}/pulse/cookie k, owner @{HOME}/.pulse/{,**} rw, owner @{user_config_dirs}/ w, diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index aa6928298..0925bad91 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -75,6 +75,10 @@ profile wireplumber @{exec_path} { @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{PROC}/1/cgroup r, + @{PROC}/1/cmdline r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/media@{int} rw, From d9cfef3e5d5a0bc035383e82d4cc69a9a25c0435 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 30 May 2025 00:03:11 +0200 Subject: [PATCH 0975/1455] refractor(profile): move systemd generators to their own group --- .../{systemd => systemd-generators}/systemd-generator-bless-boot | 0 .../{systemd => systemd-generators}/systemd-generator-cloud-init | 0 .../{systemd => systemd-generators}/systemd-generator-cryptsetup | 0 .../{systemd => systemd-generators}/systemd-generator-debug | 0 .../{systemd => systemd-generators}/systemd-generator-ds-identify | 0 .../systemd-generator-environment-arch | 0 .../systemd-generator-environment-flatpak | 0 .../systemd-generator-friendly-recovery | 0 .../{systemd => systemd-generators}/systemd-generator-fstab | 0 .../{systemd => systemd-generators}/systemd-generator-getty | 0 .../{systemd => systemd-generators}/systemd-generator-gpt-auto | 0 .../systemd-generator-hibernate-resume | 0 .../systemd-generator-integritysetup | 0 .../{systemd => systemd-generators}/systemd-generator-ostree | 0 .../{systemd => systemd-generators}/systemd-generator-rc-local | 0 .../groups/{systemd => systemd-generators}/systemd-generator-run | 0 .../{systemd => systemd-generators}/systemd-generator-snapd | 0 .../{systemd => systemd-generators}/systemd-generator-sshd-socket | 0 .../systemd-generator-system-update | 0 .../groups/{systemd => systemd-generators}/systemd-generator-sysv | 0 .../systemd-generator-user-autostart | 0 .../systemd-generator-user-environment | 0 .../{systemd => systemd-generators}/systemd-generator-veritysetup | 0 23 files changed, 0 insertions(+), 0 deletions(-) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-bless-boot (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-cloud-init (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-cryptsetup (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-debug (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-ds-identify (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-environment-arch (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-environment-flatpak (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-friendly-recovery (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-fstab (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-getty (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-gpt-auto (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-hibernate-resume (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-integritysetup (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-ostree (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-rc-local (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-run (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-snapd (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-sshd-socket (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-system-update (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-sysv (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-user-autostart (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-user-environment (100%) rename apparmor.d/groups/{systemd => systemd-generators}/systemd-generator-veritysetup (100%) diff --git a/apparmor.d/groups/systemd/systemd-generator-bless-boot b/apparmor.d/groups/systemd-generators/systemd-generator-bless-boot similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-bless-boot rename to apparmor.d/groups/systemd-generators/systemd-generator-bless-boot diff --git a/apparmor.d/groups/systemd/systemd-generator-cloud-init b/apparmor.d/groups/systemd-generators/systemd-generator-cloud-init similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-cloud-init rename to apparmor.d/groups/systemd-generators/systemd-generator-cloud-init diff --git a/apparmor.d/groups/systemd/systemd-generator-cryptsetup b/apparmor.d/groups/systemd-generators/systemd-generator-cryptsetup similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-cryptsetup rename to apparmor.d/groups/systemd-generators/systemd-generator-cryptsetup diff --git a/apparmor.d/groups/systemd/systemd-generator-debug b/apparmor.d/groups/systemd-generators/systemd-generator-debug similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-debug rename to apparmor.d/groups/systemd-generators/systemd-generator-debug diff --git a/apparmor.d/groups/systemd/systemd-generator-ds-identify b/apparmor.d/groups/systemd-generators/systemd-generator-ds-identify similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-ds-identify rename to apparmor.d/groups/systemd-generators/systemd-generator-ds-identify diff --git a/apparmor.d/groups/systemd/systemd-generator-environment-arch b/apparmor.d/groups/systemd-generators/systemd-generator-environment-arch similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-environment-arch rename to apparmor.d/groups/systemd-generators/systemd-generator-environment-arch diff --git a/apparmor.d/groups/systemd/systemd-generator-environment-flatpak b/apparmor.d/groups/systemd-generators/systemd-generator-environment-flatpak similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-environment-flatpak rename to apparmor.d/groups/systemd-generators/systemd-generator-environment-flatpak diff --git a/apparmor.d/groups/systemd/systemd-generator-friendly-recovery b/apparmor.d/groups/systemd-generators/systemd-generator-friendly-recovery similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-friendly-recovery rename to apparmor.d/groups/systemd-generators/systemd-generator-friendly-recovery diff --git a/apparmor.d/groups/systemd/systemd-generator-fstab b/apparmor.d/groups/systemd-generators/systemd-generator-fstab similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-fstab rename to apparmor.d/groups/systemd-generators/systemd-generator-fstab diff --git a/apparmor.d/groups/systemd/systemd-generator-getty b/apparmor.d/groups/systemd-generators/systemd-generator-getty similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-getty rename to apparmor.d/groups/systemd-generators/systemd-generator-getty diff --git a/apparmor.d/groups/systemd/systemd-generator-gpt-auto b/apparmor.d/groups/systemd-generators/systemd-generator-gpt-auto similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-gpt-auto rename to apparmor.d/groups/systemd-generators/systemd-generator-gpt-auto diff --git a/apparmor.d/groups/systemd/systemd-generator-hibernate-resume b/apparmor.d/groups/systemd-generators/systemd-generator-hibernate-resume similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-hibernate-resume rename to apparmor.d/groups/systemd-generators/systemd-generator-hibernate-resume diff --git a/apparmor.d/groups/systemd/systemd-generator-integritysetup b/apparmor.d/groups/systemd-generators/systemd-generator-integritysetup similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-integritysetup rename to apparmor.d/groups/systemd-generators/systemd-generator-integritysetup diff --git a/apparmor.d/groups/systemd/systemd-generator-ostree b/apparmor.d/groups/systemd-generators/systemd-generator-ostree similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-ostree rename to apparmor.d/groups/systemd-generators/systemd-generator-ostree diff --git a/apparmor.d/groups/systemd/systemd-generator-rc-local b/apparmor.d/groups/systemd-generators/systemd-generator-rc-local similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-rc-local rename to apparmor.d/groups/systemd-generators/systemd-generator-rc-local diff --git a/apparmor.d/groups/systemd/systemd-generator-run b/apparmor.d/groups/systemd-generators/systemd-generator-run similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-run rename to apparmor.d/groups/systemd-generators/systemd-generator-run diff --git a/apparmor.d/groups/systemd/systemd-generator-snapd b/apparmor.d/groups/systemd-generators/systemd-generator-snapd similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-snapd rename to apparmor.d/groups/systemd-generators/systemd-generator-snapd diff --git a/apparmor.d/groups/systemd/systemd-generator-sshd-socket b/apparmor.d/groups/systemd-generators/systemd-generator-sshd-socket similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-sshd-socket rename to apparmor.d/groups/systemd-generators/systemd-generator-sshd-socket diff --git a/apparmor.d/groups/systemd/systemd-generator-system-update b/apparmor.d/groups/systemd-generators/systemd-generator-system-update similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-system-update rename to apparmor.d/groups/systemd-generators/systemd-generator-system-update diff --git a/apparmor.d/groups/systemd/systemd-generator-sysv b/apparmor.d/groups/systemd-generators/systemd-generator-sysv similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-sysv rename to apparmor.d/groups/systemd-generators/systemd-generator-sysv diff --git a/apparmor.d/groups/systemd/systemd-generator-user-autostart b/apparmor.d/groups/systemd-generators/systemd-generator-user-autostart similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-user-autostart rename to apparmor.d/groups/systemd-generators/systemd-generator-user-autostart diff --git a/apparmor.d/groups/systemd/systemd-generator-user-environment b/apparmor.d/groups/systemd-generators/systemd-generator-user-environment similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-user-environment rename to apparmor.d/groups/systemd-generators/systemd-generator-user-environment diff --git a/apparmor.d/groups/systemd/systemd-generator-veritysetup b/apparmor.d/groups/systemd-generators/systemd-generator-veritysetup similarity index 100% rename from apparmor.d/groups/systemd/systemd-generator-veritysetup rename to apparmor.d/groups/systemd-generators/systemd-generator-veritysetup From 3d76c98c4b65355203da9ffc4d1693b174d79163 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 30 May 2025 00:05:34 +0200 Subject: [PATCH 0976/1455] feat(profile): add more systemd-generator profiles. --- .../systemd-generator-environment-snapd | 18 +++++++ .../systemd-generator-import | 31 ++++++++++++ .../systemd-generator-openvpn | 27 +++++++++++ .../systemd-generators/systemd-generator-ssh | 48 +++++++++++++++++++ .../systemd-generators/systemd-generator-tpm2 | 30 ++++++++++++ dists/flags/main.flags | 9 +++- 6 files changed, 161 insertions(+), 2 deletions(-) create mode 100644 apparmor.d/groups/systemd-generators/systemd-generator-environment-snapd create mode 100644 apparmor.d/groups/systemd-generators/systemd-generator-import create mode 100644 apparmor.d/groups/systemd-generators/systemd-generator-openvpn create mode 100644 apparmor.d/groups/systemd-generators/systemd-generator-ssh create mode 100644 apparmor.d/groups/systemd-generators/systemd-generator-tpm2 diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-environment-snapd b/apparmor.d/groups/systemd-generators/systemd-generator-environment-snapd new file mode 100644 index 000000000..b18bd6bd5 --- /dev/null +++ b/apparmor.d/groups/systemd-generators/systemd-generator-environment-snapd @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/systemd/system-environment-generators/snapd-env-generator +profile systemd-generator-environment-snapd @{exec_path} flags=(attach_disconnected) { + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-import b/apparmor.d/groups/systemd-generators/systemd-generator-import new file mode 100644 index 000000000..36ff4e5ff --- /dev/null +++ b/apparmor.d/groups/systemd-generators/systemd-generator-import @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/systemd/system-generators/systemd-import-generator +profile systemd-generator-import @{exec_path} flags=(attach_disconnected) { + include + + capability sys_ptrace, + + ptrace read peer=@{p_systemd}, + + @{exec_path} mr, + + @{PROC}/@{pid}/cgroup r, + @{PROC}/1/environ r, + @{PROC}/cmdline r, + @{PROC}/sys/kernel/osrelease r, + + / r, + + /dev/kmsg w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-openvpn b/apparmor.d/groups/systemd-generators/systemd-generator-openvpn new file mode 100644 index 000000000..780c63d56 --- /dev/null +++ b/apparmor.d/groups/systemd-generators/systemd-generator-openvpn @@ -0,0 +1,27 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/systemd/system-generators/openvpn-generator +profile systemd-generator-openvpn @{exec_path} flags=(attach_disconnected) { + include + + @{exec_path} mr, + + @{sh_path} r, + @{bin}/ls ix, + @{bin}/mkdir ix, + + /etc/default/openvpn r, + /etc/openvpn/ r, + + @{run}/systemd/generator/openvpn.service.wants/{,**} w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-ssh b/apparmor.d/groups/systemd-generators/systemd-generator-ssh new file mode 100644 index 000000000..efb56468e --- /dev/null +++ b/apparmor.d/groups/systemd-generators/systemd-generator-ssh @@ -0,0 +1,48 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/systemd/system-generators/systemd-ssh-generator +profile systemd-generator-ssh @{exec_path} flags=(attach_disconnected) { + include + + capability net_admin, + + network vsock stream, + + ptrace read peer=@{p_systemd}, + + @{exec_path} mr, + + @{sbin}/sshd r, + + @{run}/ r, + @{run}/systemd/ r, + @{run}/systemd/generator/ r, + @{run}/systemd/generator/sockets.target.wants/ rw, + @{run}/systemd/generator/sockets.target.wants/*.socket w, + @{run}/systemd/generator/sshd-*.service w, + @{run}/systemd/generator/sshd-*.socket rw, + @{run}/systemd/system/ r, + @{run}/systemd/transient/ r, + + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + + @{PROC}/@{pid}/cgroup r, + @{PROC}/1/cgroup r, + @{PROC}/1/environ r, + @{PROC}/cmdline r, + @{PROC}/sys/kernel/osrelease r, + + /dev/kmsg w, + /dev/vsock r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-tpm2 b/apparmor.d/groups/systemd-generators/systemd-generator-tpm2 new file mode 100644 index 000000000..4d601d0f9 --- /dev/null +++ b/apparmor.d/groups/systemd-generators/systemd-generator-tpm2 @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/systemd/system-generators/systemd-tpm2-generator +profile systemd-generator-tpm2 @{exec_path} flags=(attach_disconnected) { + include + + ptrace read peer=@{p_systemd}, + + @{exec_path} mr, + + @{sys}/class/tpmrm/ r, + + @{PROC}/@{pid}/cgroup r, + @{PROC}/1/cgroup r, + @{PROC}/1/environ r, + @{PROC}/cmdline r, + @{PROC}/sys/kernel/osrelease r, + + /dev/kmsg w, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 2736540a8..6a030fe63 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -329,19 +329,24 @@ systemd-generator-debug attach_disconnected,complain systemd-generator-ds-identify attach_disconnected,complain systemd-generator-environment-arch complain systemd-generator-environment-flatpak complain +systemd-generator-environment-snapd attach_disconnected,complain systemd-generator-friendly-recover attach_disconnected,complain systemd-generator-fstab attach_disconnected,complain systemd-generator-getty attach_disconnected,complain systemd-generator-gpt-auto attach_disconnected,complain systemd-generator-hibernate-resume attach_disconnected,complain +systemd-generator-import attach_disconnected,complain systemd-generator-integritysetup attach_disconnected,complain +systemd-generator-openvpn attach_disconnected,complain systemd-generator-ostree attach_disconnected,complain systemd-generator-rc-local attach_disconnected,complain systemd-generator-run attach_disconnected,complain systemd-generator-snapd attach_disconnected,complain +systemd-generator-ssh attach_disconnected,complain systemd-generator-sshd-socket attach_disconnected,complain systemd-generator-system-update attach_disconnected,complain systemd-generator-sysv attach_disconnected,complain +systemd-generator-tpm2 attach_disconnected,complain systemd-generator-user-autostart attach_disconnected,complain systemd-generator-user-environment attach_disconnected,complain systemd-generator-veritysetup attach_disconnected,complain @@ -350,8 +355,8 @@ systemd-homework complain systemd-inhibit attach_disconnected,complain systemd-journald attach_disconnected,mediate_deleted systemd-mount complain -systemd-network-generator complain -systemd-nsresourced complain +systemd-network-generator attach_disconnected,complain +systemd-nsresourced attach_disconnected,complain systemd-nsresourcework complain systemd-portabled complain systemd-resolve complain From 89a17146103cadf12e83543d1f5cc3504fcca2b0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 30 May 2025 00:14:54 +0200 Subject: [PATCH 0977/1455] fix(profile): a few linting fixes. --- apparmor.d/groups/_full/sd | 4 ++-- apparmor.d/groups/_full/sd-mount | 2 +- apparmor.d/groups/_full/sdu | 2 +- apparmor.d/groups/ubuntu/fanctl | 2 +- apparmor.d/groups/ubuntu/update-notifier-crash | 2 +- apparmor.d/profiles-s-z/wsdd | 2 +- tests/sbin.list | 1 - 7 files changed, 7 insertions(+), 8 deletions(-) diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd index 974bc3544..106e36817 100644 --- a/apparmor.d/groups/_full/sd +++ b/apparmor.d/groups/_full/sd @@ -131,10 +131,10 @@ profile sd flags=(attach_disconnected,mediate_deleted) { @{bin}/true ix, # Required due to stacked profiles - @{bin}/grpck ix, + @{sbin}/grpck ix, @{bin}/gzip ix, @{bin}/install ix, - @{bin}/pwck ix, + @{sbin}/pwck ix, @{bin}/readlink ix, @{lib}/colord-sane ix, @{lib}/systemd/systemd-nsresourcework ix, diff --git a/apparmor.d/groups/_full/sd-mount b/apparmor.d/groups/_full/sd-mount index 7f7dede60..1572a8f6d 100644 --- a/apparmor.d/groups/_full/sd-mount +++ b/apparmor.d/groups/_full/sd-mount @@ -36,7 +36,7 @@ profile sd-mount flags=(complain) { mount fstype=mqueue options=(rw nodev noexec nosuid) -> /dev/mqueue/, mount fstype=squashfs options=(ro nodev) /dev/loop@{int} -> /snap/*/@{int}/, mount fstype=tmpfs options=(rw nodev noexec nosuid) tmpfs -> @{run}/lock/, - mount fstype=tmpfs options=(rw nodev nosuid strictatime) tmpfs -> /tmp/, + mount fstype=tmpfs options=(rw nodev nosuid strictatime) tmpfs -> /tmp/, mount fstype=tracefs options=(rw nodev noexec nosuid) tracefs -> @{sys}/kernel/tracing/, mount options=(rw move) -> @{efi}, diff --git a/apparmor.d/groups/_full/sdu b/apparmor.d/groups/_full/sdu index 5ceb669f0..411a8c3ad 100644 --- a/apparmor.d/groups/_full/sdu +++ b/apparmor.d/groups/_full/sdu @@ -98,7 +98,7 @@ profile sdu flags=(attach_disconnected,mediate_deleted) { profile shell flags=(attach_disconnected,mediate_deleted,complain) { include - + @{sh_path} mr, @{bin}/systemctl Px -> sdu//systemctl, diff --git a/apparmor.d/groups/ubuntu/fanctl b/apparmor.d/groups/ubuntu/fanctl index ef278da63..deee33daf 100644 --- a/apparmor.d/groups/ubuntu/fanctl +++ b/apparmor.d/groups/ubuntu/fanctl @@ -19,7 +19,7 @@ profile fanctl @{exec_path} flags=(attach_disconnected) { @{bin}/id ix, @{bin}/touch ix, @{bin}/mkdir ix, - @{bin}/ip ix, + @{sbin}/ip ix, @{bin}/sed ix, /etc/network/fan r, diff --git a/apparmor.d/groups/ubuntu/update-notifier-crash b/apparmor.d/groups/ubuntu/update-notifier-crash index 3ad03eb05..dee094aa1 100644 --- a/apparmor.d/groups/ubuntu/update-notifier-crash +++ b/apparmor.d/groups/ubuntu/update-notifier-crash @@ -19,7 +19,7 @@ profile update-notifier-crash @{exec_path} { profile systemctl { include include - + include if exists } diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd index 7aa812f79..20575b2a8 100644 --- a/apparmor.d/profiles-s-z/wsdd +++ b/apparmor.d/profiles-s-z/wsdd @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/wsdd +@{exec_path} = @{bin}/wsdd profile wsdd @{exec_path} { include include diff --git a/tests/sbin.list b/tests/sbin.list index 805ab8bf1..676bc4d56 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -1016,7 +1016,6 @@ wpa_supplicant wqlat-bpfcc writeback.bt wrmsr -wsdd xfs_admin xfs_bmap xfs_copy From e771ef77b8c9343f29a07c32c7d3955620a12169 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 30 May 2025 00:18:39 +0200 Subject: [PATCH 0978/1455] tests(packer): update base images content. --- .../cloud-init/archlinux-gnome.user-data.yml | 35 +------- tests/cloud-init/archlinux-kde.user-data.yml | 37 +-------- tests/cloud-init/archlinux.yml | 82 ++++++++++++++++--- tests/cloud-init/debian.yml | 32 ++++++++ tests/cloud-init/debian13-gnome.user-data.yml | 9 ++ tests/cloud-init/ubuntu.yml | 39 ++++++++- 6 files changed, 150 insertions(+), 84 deletions(-) create mode 100644 tests/cloud-init/debian13-gnome.user-data.yml diff --git a/tests/cloud-init/archlinux-gnome.user-data.yml b/tests/cloud-init/archlinux-gnome.user-data.yml index c292993c1..d33f685b6 100644 --- a/tests/cloud-init/archlinux-gnome.user-data.yml +++ b/tests/cloud-init/archlinux-gnome.user-data.yml @@ -1,39 +1,6 @@ #cloud-config -packages: - # Install core packages - - apparmor - - base-devel - - qemu-guest-agent - - rng-tools - - spice-vdagent - - # Install usefull core packages - - bash-completion - - git - - htop - - man - - pass - - python-notify2 - - vim - - wget - - # Install basic services - - networkmanager - - cups - - cups-pdf - - system-config-printer - - # Install Applications - - firefox - - chromium - - terminator - - # Install Graphical Interface - - gnome - - gnome-extra - - seahorse - - alacarte +packages: *gnome-packages runcmd: # Regenerate grub.cfg diff --git a/tests/cloud-init/archlinux-kde.user-data.yml b/tests/cloud-init/archlinux-kde.user-data.yml index c89b3a25c..cb4c4d3b0 100644 --- a/tests/cloud-init/archlinux-kde.user-data.yml +++ b/tests/cloud-init/archlinux-kde.user-data.yml @@ -1,41 +1,6 @@ #cloud-config -packages: - # Install core packages - - apparmor - - base-devel - - qemu-guest-agent - - rng-tools - - spice-vdagent - - # Install usefull core packages - - bash-completion - - git - - htop - - man - - pass - - python-notify2 - - vim - - wget - - # Install basic services - - networkmanager - - cups - - cups-pdf - - system-config-printer - - # Install Applications - - firefox - - chromium - - terminator - - # Install Graphical Interface - - plasma-meta - - sddm - - ark - - dolphin - - konsole - - okular +packages: *kde-packages runcmd: # Regenerate grub.cfg diff --git a/tests/cloud-init/archlinux.yml b/tests/cloud-init/archlinux.yml index d860f1a1e..5299efda0 100644 --- a/tests/cloud-init/archlinux.yml +++ b/tests/cloud-init/archlinux.yml @@ -1,37 +1,93 @@ #cloud-config -# Core packages for Archlinux core-packages: &core-packages - # Install core packages - apparmor - base-devel - - qemu-guest-agent - - rng-tools - - spice-vdagent - - # Install usefull core packages - bash-completion + - docker - git - htop + - just - man - pass - python-notify2 + - qemu-guest-agent + - rng-tools + - spice-vdagent - vim - wget -# Core desktop packages for Archlinux -desktop-packages: &desktop-packages - # Install basic services +gnome-packages: &gnome-packages + # Core packages for Archlinux + - apparmor + - base-devel + - bash-completion + - docker + - git + - htop + - just + - man + - pass + - python-notify2 + - qemu-guest-agent + - rng-tools + - spice-vdagent + - vim + - wget + + # Desktop packages for Archlinux - networkmanager - cups - cups-pdf - system-config-printer - - # Install Applications - - firefox - chromium + - firefox + - spice-vdagent - terminator + # Install Graphical Interface + - alacarte + - gnome + - gnome-extra + - ptyxis + - seahorse + +kde-packages: &kde-packages + # Core packages for Archlinux + - apparmor + - base-devel + - bash-completion + - docker + - git + - htop + - just + - man + - pass + - python-notify2 + - qemu-guest-agent + - rng-tools + - spice-vdagent + - vim + - wget + + # Desktop packages for Archlinux + - networkmanager + - cups + - cups-pdf + - system-config-printer + - chromium + - firefox + - spice-vdagent + - terminator + + # Install Graphical Interface + - plasma-meta + - sddm + - ark + - dolphin + - konsole + - okular + # Enable AppArmor in kernel parameters grub-enable-apparmor: &grub-enable-apparmor path: /etc/default/grub diff --git a/tests/cloud-init/debian.yml b/tests/cloud-init/debian.yml index cead162a4..ea3012ad2 100644 --- a/tests/cloud-init/debian.yml +++ b/tests/cloud-init/debian.yml @@ -3,45 +3,77 @@ # Core packages for Debian core-packages: &core-packages - apparmor-profiles + - apparmor-utils - auditd - build-essential - config-package-dev - debhelper - devscripts + - docker.io - htop + - just + - libpam-apparmor + - lintian - qemu-guest-agent - rsync + - systemd-container + - systemd-coredump + - systemd-homed + - systemd-oomd + - unattended-upgrades - vim gnome-packages: &desktop-packages # Core packages for Debian - apparmor-profiles + - apparmor-utils - auditd - build-essential - config-package-dev - debhelper - devscripts + - docker.io - htop + - just + - libpam-apparmor + - lintian - qemu-guest-agent - rsync + - systemd-container + - systemd-coredump + - systemd-homed + - systemd-oomd + - unattended-upgrades - vim # Gnome packages for Debian - spice-vdagent - task-gnome-desktop - terminator + - loupe + - ptyxis kde-packages: &kubuntu-packages # Core packages for Debian - apparmor-profiles + - apparmor-utils - auditd - build-essential - config-package-dev - debhelper - devscripts + - docker.io - htop + - just + - libpam-apparmor + - lintian - qemu-guest-agent - rsync + - systemd-container + - systemd-coredump + - systemd-homed + - systemd-oomd + - unattended-upgrades - vim # KDE packages for Debian diff --git a/tests/cloud-init/debian13-gnome.user-data.yml b/tests/cloud-init/debian13-gnome.user-data.yml new file mode 100644 index 000000000..0d5adfe17 --- /dev/null +++ b/tests/cloud-init/debian13-gnome.user-data.yml @@ -0,0 +1,9 @@ +#cloud-config + +packages: *gnome-packages + +runcmd: *debian13-runcmd + +write_files: + - *shared-directory # Setup shared directory + - *systemd-netword # Network configuration for server diff --git a/tests/cloud-init/ubuntu.yml b/tests/cloud-init/ubuntu.yml index ba640e3af..14db33251 100644 --- a/tests/cloud-init/ubuntu.yml +++ b/tests/cloud-init/ubuntu.yml @@ -1,50 +1,81 @@ #cloud-config -# Core packages for Ubuntu core-packages: &core-packages - apparmor-profiles + - apparmor-utils - auditd - build-essential - config-package-dev - debhelper - devscripts + - docker.io - golang-go - htop + - just + - libpam-apparmor + - lintian - qemu-guest-agent - rsync + - systemd-container + - systemd-coredump + - systemd-homed + - systemd-oomd + - unattended-upgrades - vim desktop-packages: &desktop-packages # Core packages for Ubuntu - apparmor-profiles + - apparmor-utils - auditd - build-essential - config-package-dev - debhelper - devscripts + - docker.io - golang-go - htop + - just + - libpam-apparmor + - lintian - qemu-guest-agent - rsync + - systemd-container + - systemd-coredump + - systemd-homed + - systemd-oomd + - unattended-upgrades - vim # Desktop packages for Ubuntu - spice-vdagent - terminator - ubuntu-desktop + - loupe + - ptyxis kubuntu-packages: &kubuntu-packages # Core packages for Ubuntu - apparmor-profiles + - apparmor-utils - auditd - build-essential - config-package-dev - debhelper - devscripts + - docker.io - golang-go - htop + - just + - libpam-apparmor + - lintian - qemu-guest-agent - rsync + - systemd-container + - systemd-coredump + - systemd-homed + - systemd-oomd + - unattended-upgrades - vim # Desktop packages for Ubuntu @@ -74,3 +105,9 @@ desktop-runcmd: &desktop-runcmd # Finally, remove things only installed as dependencies of other things # we have already removed. - apt-get -y autoremove + + # Ensure systemd-networkd is disabled + - systemctl disable systemd-networkd-wait-online.service + + # Ensure auditd is enabled + - systemctl enable systemd-journald-audit.socket From d9e6e686e0186d94fab9a9fdecc7d2c48255d3d7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 30 May 2025 01:44:09 +0200 Subject: [PATCH 0979/1455] build: ignore all rule in abi3. --- pkg/prebuild/builder/abi.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/prebuild/builder/abi.go b/pkg/prebuild/builder/abi.go index 818edbb76..5fba837d5 100644 --- a/pkg/prebuild/builder/abi.go +++ b/pkg/prebuild/builder/abi.go @@ -14,6 +14,7 @@ var ( `abi/4.0`, `abi/3.0`, ` userns,`, ` # userns,`, ` mqueue`, ` # mqueue`, + ` all`, ` # all`, }) ) From 2282128cbddc1017740071b8058c54bf7868e90c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 31 May 2025 13:43:57 +0200 Subject: [PATCH 0980/1455] feat(fsp): setup RBAC mapping in auth enabled profiles. --- apparmor.d/groups/ssh/sshd | 15 ++++++++------- apparmor.d/groups/utils/chfn | 1 + apparmor.d/groups/utils/chsh | 1 + apparmor.d/groups/utils/login | 3 ++- apparmor.d/groups/utils/su | 5 +++-- apparmor.d/mappings/sudo/base | 30 ++++++++++++++++++++++++++++++ 6 files changed, 45 insertions(+), 10 deletions(-) create mode 100644 apparmor.d/mappings/sudo/base diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 4b99aafd6..cc12a9eec 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -25,6 +25,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { include include include + include #aa:only RBAC capability audit_write, capability chown, @@ -60,13 +61,13 @@ profile sshd @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{bin}/@{shells} rUx, - @{bin}/false rix, - @{sbin}/nologin rPx, - @{bin}/passwd rPx, - @{lib}/{openssh,ssh}/sftp-server rPx, - @{lib}/{openssh,ssh}/sshd-auth rPx, - @{lib}/{openssh,ssh}/sshd-session rix, + @{bin}/@{shells} Ux, #aa:exclude RBAC + @{bin}/false ix, + @{sbin}/nologin Px, + @{bin}/passwd Px, + @{lib}/{openssh,ssh}/sftp-server Px, + @{lib}/{openssh,ssh}/sshd-auth Px, + @{lib}/{openssh,ssh}/sshd-session ix, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*.conf} r, diff --git a/apparmor.d/groups/utils/chfn b/apparmor.d/groups/utils/chfn index 45b50c7ad..824d92bf4 100644 --- a/apparmor.d/groups/utils/chfn +++ b/apparmor.d/groups/utils/chfn @@ -15,6 +15,7 @@ profile chfn @{exec_path} { include include include + include #aa:only RBAC capability audit_write, capability chown, diff --git a/apparmor.d/groups/utils/chsh b/apparmor.d/groups/utils/chsh index e3581be31..a630a7733 100644 --- a/apparmor.d/groups/utils/chsh +++ b/apparmor.d/groups/utils/chsh @@ -15,6 +15,7 @@ profile chsh @{exec_path} { include include include + include #aa:only RBAC capability audit_write, capability chown, diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login index 6227f4fc5..c35001498 100644 --- a/apparmor.d/groups/utils/login +++ b/apparmor.d/groups/utils/login @@ -14,6 +14,7 @@ profile login @{exec_path} flags=(attach_disconnected) { include include include + include #aa:only RBAC capability audit_write, capability chown, @@ -38,7 +39,7 @@ profile login @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{shells_path} rUx, + @{shells_path} Ux, #aa:exclude RBAC @{etc_ro}/environment r, @{etc_ro}/security/group.conf r, diff --git a/apparmor.d/groups/utils/su b/apparmor.d/groups/utils/su index 81e299d23..c4e83ddfa 100644 --- a/apparmor.d/groups/utils/su +++ b/apparmor.d/groups/utils/su @@ -12,6 +12,7 @@ profile su @{exec_path} { include include include + include #aa:only RBAC capability chown, # pseudo-terminal @@ -21,8 +22,8 @@ profile su @{exec_path} { @{exec_path} mr, - @{bin}/@{shells} rUx, - @{sbin}/nologin rPx, + @{bin}/@{shells} Ux, #aa:exclude RBAC + @{sbin}/nologin Px, @{etc_ro}/default/su r, /etc/default/locale r, diff --git a/apparmor.d/mappings/sudo/base b/apparmor.d/mappings/sudo/base new file mode 100644 index 000000000..95e395501 --- /dev/null +++ b/apparmor.d/mappings/sudo/base @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# It is used by su/sudo to run pre login scripts (as root) such as the motd. +# After the login, Apparmor libpam will transition to the roles defined in +# other files under + + @{shells_path} rCx -> shell, + + profile shell flags=(attach_disconnected) { + include + include + include + + @{shells_path} rix, + @{bin}/env rix, + @{bin}/run-parts rix, #aa:only apt + + #aa:only apt + /etc/update-motd.d/ r, + /etc/update-motd.d/* rPx, + /usr/share/landscape/landscape-sysinfo.wrapper rPx, + + @{run}/motd.dynamic.new rw, #aa:only apt + + include if exists + } + +# vim:syntax=apparmor From 6c6e1c3456fce34164cf54189dc23080db02b54c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 31 May 2025 13:49:16 +0200 Subject: [PATCH 0981/1455] feat(profile): minor fsp related improvment. --- apparmor.d/groups/freedesktop/colord | 5 +++-- apparmor.d/groups/grub/grub-mkconfig | 2 +- apparmor.d/groups/network/tailscaled | 2 +- .../groups/systemd-service/snapd.system-shutdown.service | 6 +++--- apparmor.d/groups/ubuntu/fanctl | 2 +- apparmor.d/profiles-g-l/ischroot | 2 +- 6 files changed, 10 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index 031ba0605..ee2cdf42e 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -23,6 +23,7 @@ profile colord @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=system name=org.freedesktop.ColorManager @{exec_path} mrix, + @{lib}/colord-sane ix, /etc/machine-id r, /etc/sane.d/{,**} r, @@ -44,8 +45,8 @@ profile colord @{exec_path} flags=(attach_disconnected) { owner /var/lib/snmp/mibs/{iana,ietf}/ r, owner /var/lib/snmp/mibs/{iana,ietf}/[A-Z]* r, - @{att}/@{desktop_share_dirs}/icc/edid-*.icc r, - @{att}/@{user_share_dirs}/icc/edid-*.icc r, + @{att}/@{desktop_share_dirs}/icc/edid-@{hex32}.icc r, + @{att}/@{user_share_dirs}/icc/edid-@{hex32}.icc r, @{run}/systemd/sessions/* r, diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index c4c24efc9..de8643100 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -56,7 +56,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { @{bin}/tr rix, @{bin}/umount rPx, @{bin}/uname rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/zfs rPx, @{bin}/zpool rPx, /etc/grub.d/{,**} rix, diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index fa6cd8ddd..bb877ec1a 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -31,7 +31,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) { ptrace (read), - #aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved + #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" @{exec_path} mr, diff --git a/apparmor.d/groups/systemd-service/snapd.system-shutdown.service b/apparmor.d/groups/systemd-service/snapd.system-shutdown.service index e8939006e..ce819a791 100644 --- a/apparmor.d/groups/systemd-service/snapd.system-shutdown.service +++ b/apparmor.d/groups/systemd-service/snapd.system-shutdown.service @@ -13,9 +13,9 @@ include profile snapd.system-shutdown.service { include - audit @{bin}/cp ix, - audit @{bin}/mkdir ix, - audit @{bin}/mount ix, + @{bin}/cp ix, + @{bin}/mkdir ix, + @{bin}/mount ix, @{lib}/snapd/system-shutdown r, diff --git a/apparmor.d/groups/ubuntu/fanctl b/apparmor.d/groups/ubuntu/fanctl index deee33daf..ef278da63 100644 --- a/apparmor.d/groups/ubuntu/fanctl +++ b/apparmor.d/groups/ubuntu/fanctl @@ -19,7 +19,7 @@ profile fanctl @{exec_path} flags=(attach_disconnected) { @{bin}/id ix, @{bin}/touch ix, @{bin}/mkdir ix, - @{sbin}/ip ix, + @{bin}/ip ix, @{bin}/sed ix, /etc/network/fan r, diff --git a/apparmor.d/profiles-g-l/ischroot b/apparmor.d/profiles-g-l/ischroot index c5b848bab..4e087343a 100644 --- a/apparmor.d/profiles-g-l/ischroot +++ b/apparmor.d/profiles-g-l/ischroot @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/ischroot -profile ischroot @{exec_path} { +profile ischroot @{exec_path} flags=(attach_disconnected) { include include From d76bc0b3be0cd9452083ed253d9cb46def7a5541 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 31 May 2025 13:50:20 +0200 Subject: [PATCH 0982/1455] feat(profile): add initial profile for systemd-initctl. --- apparmor.d/groups/systemd/systemd-initctl | 27 +++++++++++++++++++++++ dists/flags/main.flags | 1 + 2 files changed, 28 insertions(+) create mode 100644 apparmor.d/groups/systemd/systemd-initctl diff --git a/apparmor.d/groups/systemd/systemd-initctl b/apparmor.d/groups/systemd/systemd-initctl new file mode 100644 index 000000000..05f32a7f6 --- /dev/null +++ b/apparmor.d/groups/systemd/systemd-initctl @@ -0,0 +1,27 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/systemd/systemd-initctl +profile systemd-initctl @{exec_path} flags=(attach_disconnected) { + include + include + include + + capability net_admin, + + unix type=stream addr=@@{udbus}/bus/systemd-initctl/, + + @{exec_path} mr, + + @{run}/initctl rw, + @{run}/systemd/notify rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 6a030fe63..e73dd4cd5 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -353,6 +353,7 @@ systemd-generator-veritysetup attach_disconnected,complain systemd-homed attach_disconnected,complain systemd-homework complain systemd-inhibit attach_disconnected,complain +systemd-initctl attach_disconnected,complain systemd-journald attach_disconnected,mediate_deleted systemd-mount complain systemd-network-generator attach_disconnected,complain From af82a9caa6358a64d0037761a40e286d6018f283 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 31 May 2025 13:52:42 +0200 Subject: [PATCH 0983/1455] feat(profile): add profiles for whoopsie. --- apparmor.d/profiles-s-z/whoopsie | 31 ++++++++++++++++++ apparmor.d/profiles-s-z/whoopsie-preferences | 34 ++++++++++++++++++++ dists/flags/main.flags | 2 ++ 3 files changed, 67 insertions(+) create mode 100644 apparmor.d/profiles-s-z/whoopsie create mode 100644 apparmor.d/profiles-s-z/whoopsie-preferences diff --git a/apparmor.d/profiles-s-z/whoopsie b/apparmor.d/profiles-s-z/whoopsie new file mode 100644 index 000000000..16a0e5a5e --- /dev/null +++ b/apparmor.d/profiles-s-z/whoopsie @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/whoopsie +profile whoopsie @{exec_path} { + include + include + + capability setgid, + capability setuid, + + @{exec_path} mr, + + /var/crash/ r, + + /var/lib/whoopsie/ rw, + /var/lib/whoopsie/whoopsie-id rw, + /var/lib/whoopsie/whoopsie-id.@{rand6} rw, + + owner @{run}/lock/whoopsie/ rw, + owner @{run}/lock/whoopsie/lock rwk, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/whoopsie-preferences b/apparmor.d/profiles-s-z/whoopsie-preferences new file mode 100644 index 000000000..3b720d0da --- /dev/null +++ b/apparmor.d/profiles-s-z/whoopsie-preferences @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/whoopsie-preferences +profile whoopsie-preferences @{exec_path} { + include + include + include + + #aa:dbus own bus=system name=com.ubuntu.WhoopsiePreferences + + @{exec_path} mr, + + @{bin}/systemctl Cx -> systemctl, + + /etc/whoopsie w, + /etc/whoopsie.@{rand6} rw, + + profile systemctl { + include + include + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index e73dd4cd5..77ea8761f 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -404,6 +404,8 @@ waybar attach_disconnected,complain wechat attach_disconnected,complain wechat-appimage attach_disconnected,complain wg-quick complain +whoopsie complain +whoopsie-preferences complain wsdd complain xdg-dbus-proxy attach_disconnected,complain xdg-desktop-icon complain From 8452eb44f18e96aa9de83c74e0902aabdcad336d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Jun 2025 15:48:38 +0200 Subject: [PATCH 0984/1455] feat(abs): minor improvement & cosmetic. --- apparmor.d/abstractions/app/kmod | 2 +- apparmor.d/abstractions/app/pager | 2 +- apparmor.d/abstractions/app/sudo | 4 +++- apparmor.d/abstractions/base.d/complete | 6 ++++-- apparmor.d/abstractions/bus/org.freedesktop.Avahi | 2 +- apparmor.d/abstractions/consoles.d/complete | 7 +++++++ apparmor.d/abstractions/freedesktop.org.d/complete | 2 +- apparmor.d/abstractions/gnome.d/complete | 2 +- apparmor.d/abstractions/vulkan.d/complete | 1 + apparmor.d/abstractions/webkit | 2 +- apparmor.d/abstractions/zsh | 1 + 11 files changed, 22 insertions(+), 9 deletions(-) create mode 100644 apparmor.d/abstractions/consoles.d/complete diff --git a/apparmor.d/abstractions/app/kmod b/apparmor.d/abstractions/app/kmod index 86bb7d78a..6c889bd60 100644 --- a/apparmor.d/abstractions/app/kmod +++ b/apparmor.d/abstractions/app/kmod @@ -7,9 +7,9 @@ include + @{bin}/kmod mr, @{sbin}/depmod mr, @{sbin}/insmod mr, - @{bin}/kmod mr, @{sbin}/lsmod mr, @{sbin}/modinfo mr, @{sbin}/modprobe mr, diff --git a/apparmor.d/abstractions/app/pager b/apparmor.d/abstractions/app/pager index 3be45b4dd..1557b78ef 100644 --- a/apparmor.d/abstractions/app/pager +++ b/apparmor.d/abstractions/app/pager @@ -12,7 +12,7 @@ capability dac_override, capability dac_read_search, - signal (receive) set=(stop, cont, term, kill), + signal receive set=(stop, cont, term, kill), @{bin}/ r, @{pager_path} mrix, diff --git a/apparmor.d/abstractions/app/sudo b/apparmor.d/abstractions/app/sudo index 1286b1571..1c47490cd 100644 --- a/apparmor.d/abstractions/app/sudo +++ b/apparmor.d/abstractions/app/sudo @@ -3,7 +3,7 @@ # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no -# Minimal set of rules for sudo. Interactive sudo need more rules. +# Minimal set of rules for sudo. abi , @@ -24,6 +24,8 @@ network netlink raw, # PAM + unix type=stream addr=@@{udbus}/bus/sudo/system, + #aa:dbus talk bus=system name=org.freedesktop.home1 label="@{p_systemd_homed}" #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index 06b413342..ecfe09bb5 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -3,14 +3,16 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + # Systemd: allow to receive any signal from the systemd profiles stack + signal receive peer=@{p_systemd}, + signal receive peer=@{p_systemd_user}, + # Allow to receive some signals from new well-known profiles signal (receive) peer=btop, signal (receive) peer=htop, signal (receive) peer=sudo, signal (receive) peer=top, signal (receive) set=(cont,term,kill,stop) peer=systemd-shutdown, - signal (receive) set=(cont,term) peer=@{p_systemd_user}, - signal (receive) set=(cont,term) peer=@{p_systemd}, signal (receive) set=(hup term) peer=login, signal (receive) set=(hup) peer=xinit, signal (receive) set=(term,kill) peer=gnome-shell, diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Avahi b/apparmor.d/abstractions/bus/org.freedesktop.Avahi index 38e05f48c..b002d6fa4 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Avahi +++ b/apparmor.d/abstractions/bus/org.freedesktop.Avahi @@ -9,7 +9,7 @@ dbus send bus=system path=/ interface=org.freedesktop.DBus.Peer member=Ping - peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + peer=(name=org.freedesktop.Avahi), dbus send bus=system path=/ interface=org.freedesktop.Avahi.Server diff --git a/apparmor.d/abstractions/consoles.d/complete b/apparmor.d/abstractions/consoles.d/complete new file mode 100644 index 000000000..ce7bb73ba --- /dev/null +++ b/apparmor.d/abstractions/consoles.d/complete @@ -0,0 +1,7 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + /dev/tty@{u8} rw, + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/freedesktop.org.d/complete b/apparmor.d/abstractions/freedesktop.org.d/complete index 4724c694a..220883c29 100644 --- a/apparmor.d/abstractions/freedesktop.org.d/complete +++ b/apparmor.d/abstractions/freedesktop.org.d/complete @@ -16,7 +16,7 @@ /opt/*/**.{desktop,png} r, /etc/gnome/defaults.list r, - /etc/xfce4/defaults.list r, + /etc/xfce4/defaults.list r, /var/lib/snapd/desktop/applications/{,**} r, /var/lib/snapd/desktop/icons/{,**} r, diff --git a/apparmor.d/abstractions/gnome.d/complete b/apparmor.d/abstractions/gnome.d/complete index 71e76f9da..3dece8578 100644 --- a/apparmor.d/abstractions/gnome.d/complete +++ b/apparmor.d/abstractions/gnome.d/complete @@ -6,7 +6,7 @@ dbus receive bus=session interface=org.freedesktop.DBus.Introspectable - member=Introspect + member=Introspect peer=(name=@{busname}, label=gnome-shell), /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r, diff --git a/apparmor.d/abstractions/vulkan.d/complete b/apparmor.d/abstractions/vulkan.d/complete index 8e5b68c08..67f83516e 100644 --- a/apparmor.d/abstractions/vulkan.d/complete +++ b/apparmor.d/abstractions/vulkan.d/complete @@ -1,4 +1,5 @@ # apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only /etc/glvnd/egl_vendor.d/{,*.json} r, diff --git a/apparmor.d/abstractions/webkit b/apparmor.d/abstractions/webkit index 9481d4fec..c9a275250 100644 --- a/apparmor.d/abstractions/webkit +++ b/apparmor.d/abstractions/webkit @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Minimal set of rules for webkit UI. +# Minimal set of rules for webkit GTK UI. abi , diff --git a/apparmor.d/abstractions/zsh b/apparmor.d/abstractions/zsh index ff90849c0..02eacfb62 100644 --- a/apparmor.d/abstractions/zsh +++ b/apparmor.d/abstractions/zsh @@ -12,6 +12,7 @@ /usr/local/share/zsh/{,**} r, /usr/share/oh-my-zsh/{,**} r, + /usr/share/zsh-theme-*/{,**} r, /usr/share/zsh/{,**} r, /etc/zsh/* r, From 86202b0fbf9502671d5e053da7d55699127501c5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Jun 2025 15:53:37 +0200 Subject: [PATCH 0985/1455] feat(fsp): small fsp improvement. --- apparmor.d/groups/_full/sd | 21 ++++++++++++++++++++- apparmor.d/groups/_full/systemd | 1 + apparmor.d/groups/_full/systemd-user | 1 + apparmor.d/groups/flatpak/flatpak-app | 2 +- 4 files changed, 23 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd index 106e36817..44b3a9b7d 100644 --- a/apparmor.d/groups/_full/sd +++ b/apparmor.d/groups/_full/sd @@ -18,7 +18,7 @@ abi , include @{exec_path} = @{bin}/systemd-executor -profile sd flags=(attach_disconnected,mediate_deleted) { +profile sd flags=(attach_disconnected,mediate_deleted,complain) { include include include @@ -42,6 +42,7 @@ profile sd flags=(attach_disconnected,mediate_deleted) { capability linux_immutable, capability mknod, capability net_admin, + capability net_bind_service, capability net_raw, capability perfmon, capability setfcap, @@ -57,6 +58,8 @@ profile sd flags=(attach_disconnected,mediate_deleted) { capability sys_tty_config, capability syslog, + network alg seqpacket, + network bluetooth, network inet dgram, network inet stream, network inet6 dgram, @@ -84,6 +87,22 @@ profile sd flags=(attach_disconnected,mediate_deleted) { umount /dev/shm/, umount @{run}/systemd/mount-rootfs/{,**}, + # mount tmpfs -> @{run}/lock/, + # mount tmpfs -> @{sys}/fs/cgroup/, + # mount cgroup -> @{sys}/fs/cgroup/systemd/, + # audit mount /dev/** -> /boot/{,efi/}, + # audit mount options=(rw bind) /dev/** -> /tmp/namespace-dev-@{rand6}/**, + # audit mount options=(rw rbind) -> @{run}/systemd/unit-root/{,**}, + + # audit remount @{run}/systemd/unit-root/{,**}, + # audit remount options=(ro noexec noatime bind) /var/snap/{,**}, + # audit remount options=(ro nosuid nodev bind) /var/, + # audit remount options=(ro nosuid nodev noexec bind) /boot/, + + # audit umount @{PROC}/sys/fs/binfmt_misc/, + # audit umount @{run}/systemd/namespace-@{rand6}/{,**}, + # audit umount @{run}/systemd/unit-root/{,**}, + pivot_root oldroot=/run/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/, change_profile, diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index eec9b33d9..b7c12c6bd 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -219,6 +219,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { /dev/autofs r, /dev/dri/card@{int} rw, + /dev/initctl w, /dev/input/ r, /dev/kmsg w, /dev/tty rw, diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index 3b0d01709..ed531c58b 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -91,6 +91,7 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) { @{PROC}/sys/kernel/pid_max r, @{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/threads-max r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/gid_map r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/flatpak/flatpak-app b/apparmor.d/groups/flatpak/flatpak-app index bb824c7cb..a816e58b8 100644 --- a/apparmor.d/groups/flatpak/flatpak-app +++ b/apparmor.d/groups/flatpak/flatpak-app @@ -65,7 +65,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { @{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-app//>k-update-icon-cache, @{bin}/update-desktop-database rPx -> flatpak-app//&update-desktop-database, - @{sbin}/update-mime-database rPx -> flatpak-app//&update-mime-database, + @{bin}/update-mime-database rPx -> flatpak-app//&update-mime-database, @{bin}/xdg-dbus-proxy rPx -> flatpak-app//&xdg-dbus-proxy, @{lib}/kf5/kioslave5 rPx, From eb84df319d1fb40226623307f423af8f553d9816 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Jun 2025 16:00:38 +0200 Subject: [PATCH 0986/1455] feat(profile): update gnome profiles. --- .../freedesktop/xdg-desktop-portal-gnome | 16 ++++++++-- .../groups/freedesktop/xdg-desktop-portal-gtk | 5 --- .../freedesktop/xdg-user-dirs-gtk-update | 4 +-- apparmor.d/groups/gnome/gjs-console | 7 +++-- apparmor.d/groups/gnome/gnome-characters | 1 - apparmor.d/groups/gnome/gnome-control-center | 4 +++ .../groups/gnome/gnome-extension-gsconnect | 3 +- apparmor.d/groups/gnome/gnome-session-binary | 2 ++ apparmor.d/groups/gnome/gnome-shell | 31 ++++++++++--------- apparmor.d/groups/gnome/gsd-color | 4 +-- apparmor.d/groups/gnome/gsd-xsettings | 6 +++- apparmor.d/groups/gnome/loupe | 11 ++++++- apparmor.d/groups/gnome/nautilus | 10 +++++- apparmor.d/groups/gnome/ptyxis | 2 ++ apparmor.d/groups/gnome/ptyxis-agent | 2 +- apparmor.d/groups/gvfs/gvfsd-dnssd | 13 ++++---- apparmor.d/groups/gvfs/gvfsd-network | 12 ++----- 17 files changed, 83 insertions(+), 50 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index ac321fd07..1355aa22b 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/xdg-desktop-portal-gnome profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include - include + include include include include @@ -17,6 +17,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -27,8 +28,8 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { network unix stream, - signal (receive) set=term peer=gdm, - signal (receive) set=(hup term) peer=gdm-session-worker, + signal receive set=term peer=gdm, + signal receive set=(hup term) peer=gdm-session-worker, #aa:dbus own bus=session name=org.freedesktop.impl.portal.desktop.gnome #aa:dbus talk bus=session name=org.freedesktop.impl.portal path=/org/freedesktop/portal/desktop label=xdg-desktop-portal @@ -40,6 +41,11 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { member=RunningApplicationsChanged peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal), + dbus send bus=session path=/org/gtk/Notifications + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=:*, label=gnome-shell), + @{exec_path} mr, / r, @@ -63,12 +69,16 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, + owner @{tmp}/gtkprint_ppd_@{rand6} rw, + owner @{tmp}/gtkprint@{rand6} r, + owner @{tmp}/xdg-desktop-portal-gnome@{rand6} rw, @{run}/mount/utab r, owner @{PROC}/@{pid}/ r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/status r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index b77ad03d7..fc11b0700 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -47,11 +47,6 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { member=GetAll peer=(name=:*, label=gnome-shell), - dbus receive bus=session - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*, label=gnome-shell), - @{exec_path} mr, /usr/share/gdm/greeter-dconf-defaults r, diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update index 224bc2337..641862965 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update @@ -9,9 +9,9 @@ include @{exec_path} = @{bin}/xdg-user-dirs-gtk-update profile xdg-user-dirs-gtk-update @{exec_path} { include + include + include include - include - include include @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index 012ca7ee0..fdaa4e825 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -14,12 +14,13 @@ include @{exec_path} = @{bin}/gjs-console profile gjs-console @{exec_path} flags=(attach_disconnected) { include - include + include include include include include include + include include include include @@ -28,7 +29,9 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { network netlink raw, - signal (receive) set=(term hup) peer=gdm*, + unix type=stream peer=(label=gnome-shell), + + signal receive set=(term hup) peer=gdm*, #aa:dbus own bus=session name=org.freedesktop.Notifications #aa:dbus own bus=session name=org.gnome.ScreenSaver diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 7ee0f835e..a43168866 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -29,7 +29,6 @@ profile gnome-characters @{exec_path} { /usr/share/xml/iso-codes/{,**} r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/status r, owner @{PROC}/@{pid}/task/@{tid}/stat r, include if exists diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 1007d55e2..2f9077d19 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -39,8 +39,12 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.bluez.obex.Agent1 #aa:dbus talk bus=session name=org.bluez.obex label=obexd + #aa:dbus talk bus=session name=org.freedesktop.impl.portal.PermissionStore label=xdg-permission-store #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell + #aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color + #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Power label=gsd-power + #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Rfkill label=gsd-rfkill #aa:dbus talk bus=session name=org.gnome.Shell label=gnome-shell #aa:dbus talk bus=system name=com.ubuntu.WhoopsiePreferences label=whoopsie-preferences diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index ee9c147b6..104d95fb3 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -65,9 +65,10 @@ profile gnome-extension-gsconnect @{exec_path} { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/status r, owner @{PROC}/@{pid}/task/@{tid}/stat r, + deny @{user_share_dirs}/gvfs-metadata/* r, + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index dc9b6812e..8b0ea6307 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -60,6 +60,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { /usr/share/gdm/greeter/autostart/{,*.desktop} r, /usr/share/gnome-session/hardware-compatibility r, /usr/share/gnome-session/sessions/*.session r, + /usr/share/gnome-shell/extensions/ r, /usr/share/gnome-shell/extensions/*/metadata.json r, /usr/share/gnome/autostart/{,*.desktop} r, @@ -69,6 +70,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { owner @{gdm_config_dirs}/dconf/user rw, owner @{gdm_config_dirs}/gnome-session/ rw, owner @{gdm_config_dirs}/gnome-session/saved-session/ rw, + owner @{gdm_config_dirs}/user-dirs.dirs r, owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_share_dirs}/applications/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 6c781e204..1099f254d 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -56,11 +56,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { network netlink raw, network unix stream, - ptrace (read), - ptrace (readby) peer=pipewire, + ptrace read, + ptrace readby peer=pipewire, - signal (receive) set=(term, hup) peer=gdm*, - signal (send), + signal receive set=(term, hup) peer=gdm*, + signal send, unix (send,receive) type=stream addr=none peer=(label=gnome-extension-ding), unix (send,receive) type=stream addr=none peer=(label=xkbcomp), @@ -185,8 +185,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/share/gnome-shell/extensions/*/** rPUx, /opt/**/share/icons/{,**} r, - /snap/*/@{uid}/**.png r, - /usr/share/**.{png,jpg,svg} r, + /snap/*/@{uid}/**.@{image_ext} r, + /usr/share/**.@{image_ext} r, /usr/share/**/icons/{,**} r, /usr/share/backgrounds/{,**} r, /usr/share/byobu/desktop/byobu* r, @@ -241,25 +241,28 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{HOME}/.face r, owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r, - owner @{HOME}/.mozilla/native-messaging-hosts/ r, - owner @{HOME}/.mozilla/native-messaging-hosts/org.gnome.shell.extensions.gsconnect.json rw, - owner @{HOME}/.mozilla/native-messaging-hosts/org.gnome.shell.extensions.gsconnect.json.@{rand6} rw, + owner @{HOME}/.mozilla/native-messaging-hosts/ rw, + owner @{HOME}/.mozilla/native-messaging-hosts/org.gnome.shell.*.json{,.@{rand6}} rw, owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw, - owner @{HOME}/.var/app/**.{png,jpg,svg} r, + owner @{HOME}/.var/app/**.@{image_ext} r, owner @{HOME}/.var/app/**/ r, owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} rw, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} rw, - owner @{user_games_dirs}/**.{png,jpg,svg} r, - owner @{user_music_dirs}/**.{png,jpg,svg} r, + owner @{user_games_dirs}/**.@{image_ext} r, + owner @{user_music_dirs}/**.@{image_ext} r, owner @{user_config_dirs}/.goutputstream{,-@{rand6}} rw, + owner @{user_config_dirs}/**/NativeMessagingHosts/ rw, + owner @{user_config_dirs}/**/NativeMessagingHosts/org.gnome.shell.*.json{,.@{rand6}} rw, owner @{user_config_dirs}/background r, owner @{user_config_dirs}/ibus/ w, owner @{user_config_dirs}/monitors.xml{,~} rwl, owner @{user_config_dirs}/tiling-assistant/{,**} rw, owner @{user_share_dirs}/backgrounds/{,**} rw, + owner @{user_share_dirs}/dbus-1/services/ r, + owner @{user_share_dirs}/dbus-1/services/org.gnome.shell.*.service{,.@{rand6}} rw, owner @{user_share_dirs}/desktop-directories/{,**} r, owner @{user_share_dirs}/gnome-shell/{,**} rw, owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, @@ -267,9 +270,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/icc/ rw, owner @{user_share_dirs}/icc/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw, + owner @{user_share_dirs}/icons/**/org.gnome.shell.*.svg{,.@{rand6}} w, - owner @{user_share_dirs}/applications/org.gnome.Shell.Extensions.GSConnect{,.Preferences}.desktop rw, - owner @{user_share_dirs}/applications/org.gnome.Shell.Extensions.GSConnect{,.Preferences}.desktop.@{rand6} w, + owner @{user_share_dirs}/applications/org.gnome.Shell.*.desktop{,.@{rand6}} rw, owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-* r, owner @{user_cache_dirs}/gnome-boxes/*.png r, owner @{user_cache_dirs}/gnome-photos/{,**} r, diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 2fe22305b..56445aeac 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -45,10 +45,10 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_share_dirs}/icc/ rw, - owner @{gdm_share_dirs}/icc/edid-*.icc rw, + owner @{gdm_share_dirs}/icc/edid-@{hex32}icc rw, owner @{user_share_dirs}/icc/ rw, - owner @{user_share_dirs}/icc/edid-*.icc rw, + owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw, include if exists } diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index 4fece3366..abf30bc40 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -17,6 +17,7 @@ profile gsd-xsettings @{exec_path} { include include include + include include include include @@ -33,16 +34,19 @@ profile gsd-xsettings @{exec_path} { #aa:dbus own bus=session name=org.gnome.SettingsDaemon.XSettings #aa:dbus own bus=session name=org.gtk.Settings + #aa:dbus talk bus=session name=org.gnome.Mutter.X11 label=gnome-shell + dbus send bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.Accounts.User member=SetInputSources peer=(name=:*, label="@{p_accounts_daemon}"), @{exec_path} mr, + @{sh_path} mr, @{bin}/cat rix, @{bin}/sed rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/busctl rPx, @{bin}/pactl rPx, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index 6f783627e..d89d4d6f9 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -9,14 +9,20 @@ include @{exec_path} = @{bin}/loupe profile loupe @{exec_path} flags=(attach_disconnected) { include + include + include + include include include include include + include include include include + unix type=stream peer=(label=loupe//bwrap), + signal send set=kill peer=loupe//bwrap, #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @@ -37,7 +43,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/glycin/{,**} rw, - @{run}/mount/utab r, + @{run}/mount/utab r, + owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, @@ -56,6 +63,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) { include include + unix type=stream peer=(label=loupe), + signal receive set=kill peer=loupe, @{bin}/bwrap mr, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 60bbfb344..ebf975673 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -28,13 +28,21 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { mqueue r type=posix /, + unix type=stream peer=(label=gnome-shell), + #aa:dbus own bus=session name=org.freedesktop.FileManager1 #aa:dbus own bus=session name=org.gnome.Nautilus interface+="org.gtk.{Application,Actions}" #aa:dbus own bus=session name=org.gnome.Nautilus.SearchProvider interface+=org.gnome.Shell.SearchProvider2 + #aa:dbus talk bus=session name=org.gnome.Settings label=gnome-control-center #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell - #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" #aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + + dbus send bus=session path=/org/gnome/Mutter/ServiceChannel + interface=org.gnome.Mutter.ServiceChannel + member=OpenWaylandServiceConnection + peer=(name=@{busname}, label=gnome-shell), dbus (send, receive) bus=session path=/org/gtk/Application/CommandLine interface=org.gtk.private.CommandLine diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis index 2f7dee368..a6f7e5b63 100644 --- a/apparmor.d/groups/gnome/ptyxis +++ b/apparmor.d/groups/gnome/ptyxis @@ -28,6 +28,8 @@ profile ptyxis @{exec_path} { owner @{user_share_dirs}/org.gnome.Ptyxis/ rw, owner @{user_share_dirs}/org.gnome.Ptyxis/** rwlk -> @{user_share_dirs}/org.gnome.Ptyxis/**, + owner /tmp/#@{int} w, + /dev/ptmx rw, include if exists diff --git a/apparmor.d/groups/gnome/ptyxis-agent b/apparmor.d/groups/gnome/ptyxis-agent index 239993f21..ce60a26c3 100644 --- a/apparmor.d/groups/gnome/ptyxis-agent +++ b/apparmor.d/groups/gnome/ptyxis-agent @@ -24,7 +24,7 @@ profile ptyxis-agent @{exec_path} { /usr/share/glib-2.0/schemas/gschemas.compiled r, - owner @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/cmdline r, /dev/ptmx rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-dnssd b/apparmor.d/groups/gvfs/gvfsd-dnssd index fd9b5a22d..9af8be00a 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dnssd +++ b/apparmor.d/groups/gvfs/gvfsd-dnssd @@ -13,14 +13,10 @@ profile gvfsd-dnssd @{exec_path} { include include include + include + include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_dnssd - #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker label=gvfsd - - dbus receive bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name=:*, label=gvfsd-network), dbus receive bus=session path=/org/gtk/vfs/mountable interface=org.gtk.vfs.Mountable @@ -32,6 +28,11 @@ profile gvfsd-dnssd @{exec_path} { member=Spawned peer=(name=:*, label=gvfsd), + dbus send bus=session path=/org/gtk/vfs/mounttracker + interface=org.gtk.vfs.MountTracker + member={MountLocation,LookupMount,RegisterMount} + peer=(name="@{busname}", label=gvfsd), + @{exec_path} mr, owner @{run}/user/@{uid}/gvfsd/ rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-network b/apparmor.d/groups/gvfs/gvfsd-network index adda9b958..cd64d81ad 100644 --- a/apparmor.d/groups/gvfs/gvfsd-network +++ b/apparmor.d/groups/gvfs/gvfsd-network @@ -11,6 +11,8 @@ include profile gvfsd-network @{exec_path} { include include + include + include include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} @@ -30,16 +32,6 @@ profile gvfsd-network @{exec_path} { member={MountLocation,LookupMount,RegisterMount} peer=(name="@{busname}", label=gvfsd), - dbus send bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name="@{busname}", label=gvfsd-dnssd), - - dbus receive bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name="@{busname}", label=gnome-control-center), - @{exec_path} mr, /usr/share/glib-2.0/schemas/gschemas.compiled r, From 55e4b27c2b4b43488edb7b155fd3e5efd0733a18 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Jun 2025 16:02:20 +0200 Subject: [PATCH 0987/1455] feat(tunable): add the archive_path variable. --- apparmor.d/profiles-a-f/atool | 8 ++++---- apparmor.d/profiles-a-f/file-roller | 14 +------------- apparmor.d/profiles-s-z/unmkinitramfs | 6 +----- apparmor.d/profiles-s-z/xarchiver | 13 +------------ apparmor.d/tunables/multiarch.d/paths | 3 +++ apparmor.d/tunables/multiarch.d/programs | 3 +++ 6 files changed, 13 insertions(+), 34 deletions(-) diff --git a/apparmor.d/profiles-a-f/atool b/apparmor.d/profiles-a-f/atool index 99cb0fed6..2782aacc0 100644 --- a/apparmor.d/profiles-a-f/atool +++ b/apparmor.d/profiles-a-f/atool @@ -19,9 +19,9 @@ profile atool @{exec_path} { @{bin}/7z rix, @{bin}/arc rix, @{bin}/arj rix, - @{bin}/bzip2 rix, - @{bin}/bzip2 rix, @{bin}/bzip rix, + @{bin}/bzip2 rix, + @{bin}/bzip2 rix, @{bin}/compress rix, @{bin}/cpio rix, @{bin}/gunzip rix, @@ -30,16 +30,15 @@ profile atool @{exec_path} { @{bin}/jar rix, @{bin}/lha rix, @{bin}/lrunzip rix, + @{bin}/lrz rix, @{bin}/lrzcat rix, @{bin}/lrzip rix, - @{bin}/lrz rix, @{bin}/lrztar rix, @{bin}/lrzuntar rix, @{bin}/lzip rix, @{bin}/lzma rix, @{bin}/lzop rix, @{bin}/lzop rix, - @{lib}/p7zip/7z rix, @{bin}/rar rix, @{bin}/tar rix, @{bin}/unace rix, @@ -48,6 +47,7 @@ profile atool @{exec_path} { @{bin}/unzip rix, @{bin}/xz rix, @{bin}/zip rix, + @{lib}/p7zip/7z rix, /etc/atool.conf r, owner @{HOME}/.atoolrc r, diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index 24610cd8c..e7bfafaac 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -26,19 +26,7 @@ profile file-roller @{exec_path} { @{bin}/rm rix, # Archivers - @{bin}/7z rix, - @{bin}/7zz rix, - @{bin}/ar rix, - @{bin}/bzip2 rix, - @{bin}/cpio rix, - @{bin}/gzip rix, - @{bin}/tar rix, - @{bin}/unrar-nonfree rix, - @{bin}/unzip rix, - @{bin}/xz rix, - @{bin}/zip rix, - @{bin}/zstd rix, - @{lib}/p7zip/7z rix, + @{archive_path} rix, # Full access to user's data @{MOUNTS}/** rw, diff --git a/apparmor.d/profiles-s-z/unmkinitramfs b/apparmor.d/profiles-s-z/unmkinitramfs index 6b5607ed1..3ee530970 100644 --- a/apparmor.d/profiles-s-z/unmkinitramfs +++ b/apparmor.d/profiles-s-z/unmkinitramfs @@ -18,22 +18,18 @@ profile unmkinitramfs @{exec_path} { @{exec_path} r, @{sh_path} rix, + @{archive_path} rix, @{bin}/{,e}grep rix, - @{bin}/bzip2 rix, @{bin}/cat rix, - @{bin}/cpio rix, @{bin}/dd rix, @{bin}/getopt rix, - @{bin}/gzip rix, @{bin}/lz4cat rix, @{bin}/lzma rix, @{bin}/lzop rix, @{bin}/mkdir rix, @{bin}/mktemp rix, @{bin}/rm rix, - @{bin}/xz rix, @{bin}/xzcat rix, - @{bin}/zstd rix, /boot/ r, owner /boot/initrd.img-* r, diff --git a/apparmor.d/profiles-s-z/xarchiver b/apparmor.d/profiles-s-z/xarchiver index 003770008..f38a69224 100644 --- a/apparmor.d/profiles-s-z/xarchiver +++ b/apparmor.d/profiles-s-z/xarchiver @@ -28,18 +28,7 @@ profile xarchiver @{exec_path} { @{bin}/cp rix, # Archivers - @{bin}/7z rix, - @{lib}/p7zip/7z rix, - @{bin}/unrar-nonfree rix, - @{bin}/zip rix, - @{bin}/unzip rix, - @{bin}/tar rix, - @{bin}/xz rix, - @{bin}/bzip2 rix, - @{bin}/cpio rix, - @{bin}/gzip rix, - @{bin}/zstd rix, - # For deb packages + @{archive_path} rix, @{bin}/{,@{multiarch}-}ar rix, @{open_path} rPx -> child-open, diff --git a/apparmor.d/tunables/multiarch.d/paths b/apparmor.d/tunables/multiarch.d/paths index 059f337fd..cca544370 100644 --- a/apparmor.d/tunables/multiarch.d/paths +++ b/apparmor.d/tunables/multiarch.d/paths @@ -72,4 +72,7 @@ # Backup @{backup_path} = @{bin}/@{backup_names} @{lib}/deja-dup/deja-dup-monitor +# Archives +@{archive_path} = @{bin}/@{archive_names} @{lib}/p7zip/7z + # vim:syntax=apparmor diff --git a/apparmor.d/tunables/multiarch.d/programs b/apparmor.d/tunables/multiarch.d/programs index cddb1a7d2..a7cbaf831 100644 --- a/apparmor.d/tunables/multiarch.d/programs +++ b/apparmor.d/tunables/multiarch.d/programs @@ -96,4 +96,7 @@ # Backup @{backup_names} = deja-dup borg +# Archives +@{archive_names} = 7z 7zz ar bzip2 cpio gzip lzip rar tar unrar-nonfree unzip xz zip zstd + # vim:syntax=apparmor From 71a473712c15ee71fe39ce021577b052fea2528f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Jun 2025 23:58:02 +0200 Subject: [PATCH 0988/1455] tests: rewrite and expand the profile check to more files. Rewrite: Speed up the checking by not using grep anymore and only using bash, also make it parallel Revisit the way result are shown. Expand: Also scan for mapping files and abstaction completion. Adapt the scan accordingly. --- tests/check.sh | 378 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 259 insertions(+), 119 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 02ae71812..25c82e3d1 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2024-2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # Usage: make check @@ -8,101 +8,250 @@ set -eu -o pipefail -readonly APPARMORD="apparmor.d" -readonly HEADERS=( - "# apparmor.d - Full set of apparmor profiles" - "# Copyright (C) " - "# SPDX-License-Identifier: GPL-2.0-only" -) - -_die() { - echo -e "\033[1;31m ✗ Error: \033[0m$*" - exit 1 +RES=$(mktemp) +echo "false" >"$RES" +MAX_JOBS=$(nproc) +declare WITH_CHECK +readonly MAX_JOBS APPARMORD="apparmor.d" +readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m" +_msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; } +_warn() { + local type="$1" file="$2" + shift 2 + printf '%bwarning%b %s(%b%s%b): %s\n' "$fgYellow" "$reset" "$type" "$fgWhite" "$file" "$reset" "$*" +} +_err() { + local type="$1" file="$2" + shift 2 + printf ' %berror%b %s(%b%s%b): %s\n' "$fgRed" "$reset" "$type" "$fgWhite" "$file" "$reset" "$*" + echo "true" >"$RES" } -_ensure_header() { - local file="$1" - for header in "${HEADERS[@]}"; do - if ! grep -q "^$header" "$file"; then - _die "$file does not contain '$header'" +_in_array() { + local item needle="$1" + shift + for item in "$@"; do + if [[ "${item}" == "${needle}" ]]; then + return 0 fi done + return 1 } -_ensure_indentation() { +_is_enabled() { + _in_array "$1" "${WITH_CHECK[@]}" +} + +_wait() { + local -n job=$1 + job=$((job + 1)) + if ((job >= MAX_JOBS)); then + wait -n + job=$((job - 1)) + fi +} + +_check() { local file="$1" - local in_profile=false - local first_line_after_profile=true local line_number=0 while IFS= read -r line; do line_number=$((line_number + 1)) - if [[ "$line" =~ $'\t' ]]; then - _die "$file:$line_number: tabs are not allowed." + # Guidelines check + _check_abi + _check_include + _check_profile + _check_subprofiles + + # Style check + if [[ $line_number -lt 10 ]]; then + _check_header fi + _check_tabs + _check_trailing + _check_indentation + _check_vim - if [[ "$line" =~ ^profile ]]; then - in_profile=true - first_line_after_profile=true + done <"$file" - elif [[ "$line" =~ [[:space:]]+$ ]]; then - _die "$file:$line_number: line has trailing whitespace." + # Results + _res_abi + _res_include + _res_profile + _res_subprofiles + _res_header + _res_vim +} - elif $in_profile; then - if $first_line_after_profile; then - local leading_spaces="${line%%[! ]*}" - local num_spaces=${#leading_spaces} - if ((num_spaces != 2)); then - _die "$file: profile must have a two-space indentation." - fi - first_line_after_profile=false +# Guidelines check: https://apparmor.pujol.io/development/guidelines/ - else - local leading_spaces="${line%%[! ]*}" - local num_spaces=${#leading_spaces} +RES_ABI=false +readonly ABI_SYNTAX='abi ,' +_check_abi() { + _is_enabled abi || return 0 + if [[ "$line" =~ ^' '*"$ABI_SYNTAX" ]]; then + RES_ABI=true + fi +} +_res_abi() { + _is_enabled abi || return 0 + if ! $RES_ABI; then + _err guideline "$file" "missing 'abi ,'" + fi +} - if ((num_spaces % 2 != 0)); then - ok=false - for offset in 5 11; do - num_spaces=$((num_spaces - offset)) - if ((num_spaces < 0)); then - break - fi - if ((num_spaces % 2 == 0)); then - ok=true - break - fi - done +RES_INCLUDE=false +_check_include() { + _is_enabled include || return 0 + if [[ "$line" =~ ^.*"${include}"$ ]]; then + RES_INCLUDE=true + fi +} +_res_include() { + _is_enabled include || return 0 + if ! $RES_INCLUDE; then + _err guideline "$file" "missing '$include'" + fi +} - if ! $ok; then - _die "$file:$line_number: invalid indentation." +RES_PROFILE=false +_check_profile() { + _is_enabled profile || return 0 + if [[ "$line" =~ ^"profile $name" ]]; then + RES_PROFILE=true + fi +} +_res_profile() { + _is_enabled profile || return 0 + if ! $RES_PROFILE; then + _err guideline "$file" "missing profile name: 'profile $name'" + fi +} + +# Style check + +readonly HEADERS=( + "# apparmor.d - Full set of apparmor profiles" + "# Copyright (C) " + "# SPDX-License-Identifier: GPL-2.0-only" +) +_RES_HEADER=(false false false) +_check_header() { + _is_enabled header || return 0 + for idx in "${!HEADERS[@]}"; do + if [[ "$line" == "${HEADERS[$idx]}"* ]]; then + _RES_HEADER[idx]=true + break + fi + done +} +_res_header() { + _is_enabled header || return 0 + for idx in "${!_RES_HEADER[@]}"; do + if ${_RES_HEADER[$idx]}; then + continue + fi + _err style "$file" "missing header: '${HEADERS[$idx]}'" + done +} + +_check_tabs() { + _is_enabled tabs || return 0 + if [[ "$line" =~ $'\t' ]]; then + _err style "$file:$line_number" "tabs are not allowed" + fi +} + +_check_trailing() { + _is_enabled trailing || return 0 + if [[ "$line" =~ [[:space:]]+$ ]]; then + _err style "$file:$line_number" "line has trailing whitespace" + fi +} + +_CHECK_IN_PROFILE=false +_CHECK_FIRST_LINE_AFTER_PROFILE=true +_check_indentation() { + _is_enabled indentation || return 0 + if [[ "$line" =~ ^profile ]]; then + _CHECK_IN_PROFILE=true + _CHECK_FIRST_LINE_AFTER_PROFILE=true + + elif $_CHECK_IN_PROFILE; then + if $_CHECK_FIRST_LINE_AFTER_PROFILE; then + local leading_spaces="${line%%[! ]*}" + local num_spaces=${#leading_spaces} + if ((num_spaces != 2)); then + _err style "$file:$line_number" "profile must have a two-space indentation" + fi + _CHECK_FIRST_LINE_AFTER_PROFILE=false + + else + local leading_spaces="${line%%[! ]*}" + local num_spaces=${#leading_spaces} + + if ((num_spaces % 2 != 0)); then + ok=false + for offset in 5 11; do + num_spaces=$((num_spaces - offset)) + if ((num_spaces < 0)); then + break fi + if ((num_spaces % 2 == 0)); then + ok=true + break + fi + done + + if ! $ok; then + _err style "$file:$line_number" "invalid indentation" fi fi fi - done <"$file" -} - -_ensure_include() { - local file="$1" - local include="$2" - if ! grep -q "^ *${include}$" "$file"; then - _die "$file does not contain '$include'" fi } -_ensure_abi() { - local file="$1" - if ! grep -q "^ *abi ," "$file"; then - _die "$file does not contain 'abi ,'" +_CHEK_IN_SUBPROFILE=false +declare -A _RES_SUBPROFILES +_check_subprofiles() { + _is_enabled subprofiles || return 0 + if [[ "$line" =~ ^(' ')+'profile '(.*)' {' ]]; then + indentation="${BASH_REMATCH[1]}" + subprofile="${BASH_REMATCH[2]}" + subprofile="${subprofile%% *}" + include="${indentation}include if exists " + _RES_SUBPROFILES["$subprofile"]="$name//$subprofile does not contain '$include'" + _CHEK_IN_SUBPROFILE=true + elif $_CHEK_IN_SUBPROFILE; then + if [[ "$line" == *"$include" ]]; then + _RES_SUBPROFILES["$subprofile"]=true + + fi fi } +_res_subprofiles() { + _is_enabled subprofiles || return 0 + for msg in "${_RES_SUBPROFILES[@]}"; do + if [[ $msg == true ]]; then + continue + fi + _err guideline "$file" "$msg" + done +} -_ensure_vim() { - local file="$1" - if ! grep -q "^# vim:syntax=apparmor" "$file"; then - _die "$file does not contain '# vim:syntax=apparmor'" +readonly VIM_SYNTAX="# vim:syntax=apparmor" +RES_VIM=false +_check_vim() { + _is_enabled vim || return 0 + if [[ "$line" =~ ^"$VIM_SYNTAX" ]]; then + RES_VIM=true + fi +} +_res_vim() { + _is_enabled vim || return 0 + if ! $RES_VIM; then + _err style "$file" "missing vim syntax: '$VIM_SYNTAX'" fi } @@ -117,69 +266,60 @@ check_sbin() { } check_profiles() { - echo -e "\033[1m â‹… \033[0mChecking if all profiles contain:" - echo " - apparmor.d header & license" - echo " - Check indentation: 2 spaces" - echo " - Check for trailing whitespaces" - echo " - 'abi ,'" - echo " - 'profile '" - echo " - 'include if exists '" - echo " - include if exists local for subprofiles" - echo " - vim:syntax=apparmor" - directories=("$APPARMORD/groups/*" "$APPARMORD/profiles-*-*") - # shellcheck disable=SC2068 - for dir in ${directories[@]}; do - for file in $(find "$dir" -maxdepth 1 -type f); do - case "$file" in */README.md) continue ;; esac + _msg "Checking profiles" + mapfile -t files < <( + find "$APPARMORD" \( -path "$APPARMORD/abstractions" -o -path "$APPARMORD/local" -o -path "$APPARMORD/tunables" -o -path "$APPARMORD/mappings" \) \ + -prune -o -type f -print + ) + jobs=0 + WITH_CHECK=(abi include profile header tabs trailing indentation subprofiles vim) + for file in "${files[@]}"; do + ( name="$(basename "$file")" name="${name/.apparmor.d/}" include="include if exists " - _ensure_header "$file" - _ensure_indentation "$file" - _ensure_include "$file" "$include" - _ensure_abi "$file" - _ensure_vim "$file" - if ! grep -q "^profile $name" "$file"; then - _die "$name does not contain 'profile $name'" - fi - mapfile -t subrofiles < <(grep "^ *profile*" "$file" | awk '{print $2}') - for subprofile in "${subrofiles[@]}"; do - include="include if exists " - if ! grep -q "^ *${include}$" "$file"; then - _die "$name: $name//$subprofile does not contain '$include'" - fi - done - done + _check "$file" + ) & + _wait jobs done + wait } check_abstractions() { - echo -e "\033[1m â‹… \033[0mChecking if all abstractions contain:" - echo " - apparmor.d header & license" - echo " - Check indentation: 2 spaces" - echo " - Check for trailing whitespaces" - echo " - 'abi ,'" - echo " - 'include if exists '" - echo " - vim:syntax=apparmor" - directories=( - "$APPARMORD/abstractions/" "$APPARMORD/abstractions/app/" - "$APPARMORD/abstractions/attached/" - "$APPARMORD/abstractions/bus/" "$APPARMORD/abstractions/common/" - ) - for dir in "${directories[@]}"; do - for file in $(find "$dir" -maxdepth 1 -type f); do + _msg "Checking abstractions" + mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*") + jobs=0 + WITH_CHECK=(abi include header tabs trailing indentation vim) + for file in "${files[@]}"; do + ( name="$(basename "$file")" - root="${dir/${APPARMORD}\/abstractions\//}" - include="include if exists " - _ensure_header "$file" - _ensure_indentation "$file" - _ensure_include "$file" "$include" - _ensure_abi "$file" - _ensure_vim "$file" - done + absdir="${file/${APPARMORD}\//}" + include="include if exists <${absdir}.d>" + _check "$file" + ) & + _wait jobs done + wait + + mapfile -t files < <( + find "$APPARMORD/abstractions" -type f -path "$APPARMORD/abstractions/*.d/*" + find "$APPARMORD/mappings" -type f + ) + # shellcheck disable=SC2034 + jobs=0 + WITH_CHECK=(header tabs trailing indentation vim) + for file in "${files[@]}"; do + _check "$file" & + _wait jobs + done + wait } check_sbin check_profiles check_abstractions + +FAIL=$(cat "$RES") +if [[ "$FAIL" == "true" ]]; then + exit 1 +fi From fff0df39ba61e862e7d62897b0126e0c2eb91835 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 1 Jun 2025 23:59:14 +0200 Subject: [PATCH 0989/1455] tests: add more check for sbin path Also look for path that should not use sbin. --- tests/check.sh | 40 +++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 25c82e3d1..09a2e105b 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -256,13 +256,39 @@ _res_vim() { } check_sbin() { - echo -e "\033[1m â‹… \033[0mEnsuring '@{sbin}' is used in all profiles:" - while IFS= read -r name; do - mapfile -t files < <(grep --files-with-matches --recursive -E "(^|[[:space:]])@{bin}/$name([[:space:]]|$)" apparmor.d) - for file in "${files[@]}"; do - _die "$file contains '@{bin}/$name' instead of '@{sbin}/$name'" - done - done Date: Mon, 2 Jun 2025 20:41:20 +0200 Subject: [PATCH 0990/1455] test: add some security checks. --- tests/check.sh | 81 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 78 insertions(+), 3 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 09a2e105b..59463246e 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -12,7 +12,7 @@ RES=$(mktemp) echo "false" >"$RES" MAX_JOBS=$(nproc) declare WITH_CHECK -readonly MAX_JOBS APPARMORD="apparmor.d" +readonly RES MAX_JOBS APPARMORD="apparmor.d" readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m" _msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; } _warn() { @@ -58,6 +58,12 @@ _check() { while IFS= read -r line; do line_number=$((line_number + 1)) + # Rules checks + _check_abstractions + _check_directory_mark + _check_equivalent + _check_too_wide + # Guidelines check _check_abi _check_include @@ -84,13 +90,82 @@ _check() { _res_vim } +# Rules checks: security, compatibility and rule issues + +readonly ABS="abstractions" +readonly ABS_DANGEROUS=(dbus-session dbus-system dbus-accessibility user-tmp) +declare -A ABS_DEPRECATED=( + ["nameservice"]="nameservice-strict" + ["bash"]="shell" + ["X"]="X-strict" + ["dbus-accessibility-strict"]="bus-accessibility" + ["dbus-network-manager-strict"]="bus/org.freedesktop.NetworkManager" + ["dbus-session-strict"]="bus-session" + ["dbus-system-strict"]="bus-system" +) +_check_abstractions() { + _is_enabled abstractions || return 0 + + local absname + for absname in "${ABS_DANGEROUS[@]}"; do + if [[ "$line" == *"<$ABS/$absname>"* ]]; then + _err security "$file:$line_number" "dangerous abstraction '<$ABS/$absname>'" + fi + done + for absname in "${!ABS_DEPRECATED[@]}"; do + if [[ "$line" == *"<$ABS/$absname>"* ]]; then + _err security "$file:$line_number" "deprecated abstraction '<$ABS/$absname>', use '<$ABS/${ABS_DEPRECATED[$absname]}>' instead" + fi + done +} + +readonly DIRECTORIES=('@{HOME}' '@{MOUNTS}' '@{bin}' '@{sbin}' '@{lib}' '@{tmp}' '_dirs}' '_DIR}') +_check_directory_mark() { + _is_enabled directory_mark || return 0 + for pattern in "${DIRECTORIES[@]}"; do + if [[ "$line" == *"$pattern"* ]]; then + [[ "$line" == *'='* ]] && continue + if [[ ! "$line" == *"$pattern/"* ]]; then + _err issue "$file:$line_number" "missing directory mark: '$pattern' instead of '$pattern/'" + fi + fi + done +} + +declare -A EQUIVALENTS=( + ["awk"]="{m,g,}awk" + ["grep"]="{,e}grep" + ["which"]="which{,.debianutils}" +) +_check_equivalent() { + _is_enabled equivalent || return 0 + local prgmname + for prgmname in "${!EQUIVALENTS[@]}"; do + if [[ "$line" == *"/$prgmname"* ]]; then + if [[ ! "$line" == *"${EQUIVALENTS[$prgmname]}"* ]]; then + _err compatibility "$file:$line_number" "missing equivalent program: '@{bin}/$prgmname' instead of '@{bin}/${EQUIVALENTS[$prgmname]}'" + fi + fi + done +} + +readonly TOOWIDE=('/**' '/tmp/**' '/var/tmp/**' '@{tmp}/**' '/etc/**' '/dev/shm/**' '@{run}/user/@{uid}/**') +_check_too_wide() { + _is_enabled too_wide || return 0 + for pattern in "${TOOWIDE[@]}"; do + if [[ "$line" == *" $pattern "* ]]; then + _err security "$file:$line_number" "rule too wide: '$pattern'" + fi + done +} + # Guidelines check: https://apparmor.pujol.io/development/guidelines/ RES_ABI=false readonly ABI_SYNTAX='abi ,' _check_abi() { _is_enabled abi || return 0 - if [[ "$line" =~ ^' '*"$ABI_SYNTAX" ]]; then + if [[ "$line" == *"$ABI_SYNTAX" ]]; then RES_ABI=true fi } @@ -104,7 +179,7 @@ _res_abi() { RES_INCLUDE=false _check_include() { _is_enabled include || return 0 - if [[ "$line" =~ ^.*"${include}"$ ]]; then + if [[ "$line" == *"${include}"* ]]; then RES_INCLUDE=true fi } From c8f2a435f877367866fa811d4d897238c0d6108b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 2 Jun 2025 23:59:41 +0200 Subject: [PATCH 0991/1455] tests: remove symbolic link from sbin. --- tests/sbin.list | 288 +++++------------------------------------------- 1 file changed, 30 insertions(+), 258 deletions(-) diff --git a/tests/sbin.list b/tests/sbin.list index 676bc4d56..d2b5c44bc 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -21,7 +21,6 @@ acpid acpidump add-shell addgnupghome -addgroup addpart adduser agetty @@ -31,24 +30,15 @@ alsa-info.sh alsa-init alsabat-test alsactl -alternatives anacron +apache2 apparmor_parser apparmor_status applygnupgdefaults aptd argdist-bpfcc -arp arpd -arptables -arptables-nft -arptables-nft-restore -arptables-nft-save -arptables-restore -arptables-save -arptables-translate aspell-autobuildhash -atd audisp-af_unix audisp-filter audisp-syslog @@ -90,26 +80,18 @@ blockdev blogctl blogd blogger -bluetoothd bpflist-bpfcc bpftool brctl bridge -brltty brltty-setup btrfs btrfs-convert +btrfs-find-root btrfs-image -btrfsck btrfsdist-bpfcc btrfsslower-bpfcc btrfstune -cache_check -cache_dump -cache_metadata_size -cache_repair -cache_restore -cache_writeback cachestat-bpfcc cachetop-bpfcc capable-bpfcc @@ -120,7 +102,6 @@ cgdisk chat chcpu check_mail_queue -check-bios-nx checkproc chgpasswd chkstat-polkit @@ -135,7 +116,6 @@ coldreboot compactsnoop-bpfcc complain config.postfix -cpgr cppw cpudist-bpfcc cpuunclaimed-bpfcc @@ -153,17 +133,13 @@ cryptdisks_start cryptdisks_stop cryptsetup ctrlaltdel -ctstat cups-browsed cups-genppd.5.3 cups-genppdupdate cupsaccept cupsctl cupsd -cupsdisable -cupsenable cupsfilter -cupsreject dbslower-bpfcc dbstat-bpfcc dcb @@ -173,14 +149,9 @@ dcstat-bpfcc ddns-confgen deadlock-bpfcc debugfs -debugfs.reiserfs -debugreiserfs decode -defrag.f2fs -delgroup delpart deluser -depmod devlink dhcpcd dirtop-bpfcc @@ -192,7 +163,6 @@ dmfilemapd dmidecode dmraid dmsetup -dmstats dnsmasq dosfsck dosfslabel @@ -213,34 +183,37 @@ e2undo e4crypt e4defrag eapol_test -ebtables -ebtables-nft -ebtables-nft-restore -ebtables-nft-save -ebtables-restore -ebtables-save -ebtables-translate ec_access efibootdump efibootmgr enforce -era_check -era_dump -era_invalidate -era_restore ethtool eventlogadm -exec execsnoop-bpfcc execsnoop.bt exfat2img exfatlabel +exicyclog +exigrep +exim_checkaccess +exim_convert4r4 +exim_dbmbuild +exim_dumpdb +exim_fixdb +exim_id_update +exim_lock +exim_msgdate +exim_tidydb +exim4 +eximstats +exinext +exipick +exiqgrep +exiqsumm exitsnoop-bpfcc +exiwhat ext4dist-bpfcc ext4slower-bpfcc -f2fs_io -f2fscrypt -f2fslabel f2fsslower-bpfcc faillock fanatic @@ -251,7 +224,6 @@ fatresize fbtest fdformat fdisk -fibmap.f2fs filefrag filegone-bpfcc filelife-bpfcc @@ -270,7 +242,6 @@ fsck.exfat fsck.ext2 fsck.ext3 fsck.ext4 -fsck.f2fs fsck.fat fsck.minix fsck.msdos @@ -295,7 +266,6 @@ gethostlatency-bpfcc gethostlatency.bt getpcaps getsysinfo -getty getweb gnome-menus-blacklist gpart @@ -308,7 +278,6 @@ groupmod grpck grpconv grpunconv -grub-bios-setup grub-install grub-macbless grub-mkconfig @@ -328,62 +297,30 @@ grub2-reboot grub2-set-default grub2-sparc64-setup grub2-switch-to-blscfg -halt hardirqs-bpfcc -hc-ifscan hdparm hwclock hwinfo iconvconfig -ifconfig ifrename ifstat import-openSUSE-build-key -init inject-bpfcc inputattach -insmod install_acx100_firmware install_intersil_firmware install-sgmlcatalog installkernel integritysetup invoke-rc.d -ip -ip6tables -ip6tables-apply -ip6tables-legacy ip6tables-legacy-batch -ip6tables-legacy-restore -ip6tables-legacy-save -ip6tables-nft -ip6tables-nft-restore -ip6tables-nft-save -ip6tables-restore -ip6tables-restore-translate -ip6tables-save -ip6tables-translate -ipmaddr ipp-usb ippevepcl ippeveprinter ippeveps ipset -ipset-translate -iptables iptables-apply -iptables-legacy iptables-legacy-batch -iptables-legacy-restore -iptables-legacy-save -iptables-nft -iptables-nft-restore -iptables-nft-save -iptables-restore -iptables-restore-translate -iptables-save -iptables-translate -iptunnel irqbalance irqbalance-ui isadump @@ -397,8 +334,6 @@ isosize ispell-autobuildhash isserial issue-generator -iucode_tool -iucode-tool iw iwconfig iwevent @@ -427,7 +362,6 @@ killsnoop.bt klockstat-bpfcc klogd kpartx -kvm-ok kvmexit-bpfcc ldattach ldconfig @@ -449,29 +383,11 @@ lpadmin lpc lpinfo lpmove -lsmod -lspcmcia luksformat -lvchange -lvconvert -lvcreate -lvdisplay -lvextend lvm lvm_import_vdo -lvmconfig -lvmdevices -lvmdiskscan lvmdump lvmpolld -lvmsadc -lvmsar -lvreduce -lvremove -lvrename -lvresize -lvs -lvscan lwepgen lxc lxd @@ -484,7 +400,6 @@ mdflush-bpfcc mdflush.bt mdmon memleak-bpfcc -mii-tool mk_isdnhwdb mkdict mkdosfs @@ -500,10 +415,6 @@ mkfs.ext4 mkfs.f2fs mkfs.fat mkfs.minix -mkfs.msdos -mkfs.ntfs -mkfs.reiserfs -mkfs.vfat mkfs.xfs mkhomedir_helper mkill @@ -515,8 +426,6 @@ mkreiserfs mksubvolume mkswap ModemManager -modinfo -modprobe mount.cifs mount.ddi mount.fuse @@ -533,12 +442,9 @@ mpathpersist multipath multipathc multipathd -mysqld mysqld_qslower-bpfcc -nameif naptime.bt needrestart -netplan netqtop-bpfcc NetworkManager newusers @@ -574,7 +480,6 @@ opensnoop.bt openvpn overlayroot-chroot ownership -packer pam_extrausers_chkpwd pam_extrausers_update pam_getenv @@ -583,13 +488,11 @@ pam_timestamp_check pam-auth-update pam-config paperconfig -parse.f2fs parted partprobe partx pbl pccardctl -pcilmr pcscd pdata_tools perlcalls-bpfcc @@ -598,11 +501,9 @@ perlstat-bpfcc phpcalls-bpfcc phpflow-bpfcc phpstat-bpfcc -pidofproc pidpersec-bpfcc pidpersec.bt pivot_root -plipconfig pluginviewer plymouth-set-default-theme plymouthd @@ -618,7 +519,7 @@ postmap postmulti postqueue postsuper -poweroff +posttls-finger ppchcalls-bpfcc pppd pppdump @@ -627,15 +528,6 @@ pppstats pptp pptpsetup profile-bpfcc -pvchange -pvck -pvcreate -pvdisplay -pvmove -pvremove -pvresize -pvs -pvscan pwck pwconv pwhistory_helper @@ -647,108 +539,30 @@ pythongc-bpfcc pythonstat-bpfcc qemu-ga qmqp-source -rarp -rcapparmor -rcauditd -rcautofs -rcavahi-daemon -rcavahi-dnsconfd -rcblk-availability -rcbolt -rcbtrfsmaintenance-refresh -rcca-certificates -rcchrony-wait -rcchronyd -rccolord -rccron -rccups -rccups-browsed -rccups-lpd -rcdbus -rcdisplay-manager -rcdm-event -rcdnsmasq -rcfancontrol +qshape rcfirewalld -rcflatpak-system-helper -rcfstrim -rcfwupd -rcfwupd-offline-update -rcfwupd-refresh -rcgpm -rcirqbalance -rcissue-add-ssh-keys -rcissue-generator -rckexec-load -rclm_sensors -rclogrotate -rclvm2-lvmpolld -rclvm2-monitor -rcmariadb -rcmcelog -rcmdmonitor -rcModemManager -rcmultipathd -rcmysql -rcnetwork -rcnfs-client -rcnmb rcopenvpn -rcostree-prepare-root -rcostree-remount -rcpackagekit -rcpackagekit-offline-update rcpcscd -rcpkcs11_eventmgr -rcpostfix -rcrng-tools -rcrpcbind -rcrsyncd -rcrtkit-daemon -rcsddm -rcsmartd -rcsmb -rcsnmpd -rcsnmptrapd -rcspeech-dispatcherd -rcspice-vdagentd -rcsshd -rctuned -rcudisks2 -rcupower -rcusbmuxd -rcwpa_supplicant -rcwsdd rcxdm rcxvnc rdma rdmaucma-bpfcc -rdmsr readahead-bpfcc readprofile -reboot -refresh_initrd +realm regdbdump -reiserfsck -reiserfstune remove-default-ispell remove-default-wordlist remove-shell request-key reset-trace-bpfcc -resize_reiserfs -resize.f2fs resize2fs resizepart -resolvconf rfkill -rmmod -rmt rmt-tar rndc rndc-confgen rngd -route routel rpc.gssd rpc.idmapd @@ -757,7 +571,6 @@ rpc.svcgssd rpcbind rpcctl rpcdebug -rpcinfo rpmconfigcheck rsyncd rsyslogd @@ -765,14 +578,12 @@ rtacct rtcwake rtkitctl rtmon -rtstat rubycalls-bpfcc rubyflow-bpfcc rubygc-bpfcc rubyobjnew-bpfcc rubystat-bpfcc runc -runlevel runqlat-bpfcc runqlat.bt runqlen-bpfcc @@ -792,8 +603,6 @@ sensors-detect service set_polkit_default_privs setcap -setconsole -setpci setuids.bt setup-nsssysinit.sh setvesablank @@ -805,12 +614,9 @@ shim-install shmsnoop-bpfcc showconsole showmount -shutdown skdump sktest slabratetop-bpfcc -slattach -sload.f2fs sm-notify smart_agetty smartctl @@ -828,12 +634,12 @@ spice-vdagentd ss sshd sshd-gen-keys-start +sshd.hmac ssllatency.bt sslsniff-bpfcc sslsnoop.bt sssd stackcount-bpfcc -start_daemon start-statd start-stop-daemon startproc @@ -855,6 +661,7 @@ sysconf_addword syscount-bpfcc syscount.bt sysctl +syslog2eximlog sysusers2shadow tarcat tc @@ -881,33 +688,20 @@ tcpsynbl-bpfcc tcpsynbl.bt tcptop-bpfcc tcptracer-bpfcc -tcptraceroute tcptraceroute.db -telinit thermald -thin_check -thin_delta -thin_dump -thin_ls -thin_metadata_size -thin_repair -thin_restore -thin_rmap -thin_trim threadsnoop-bpfcc threadsnoop.bt tipc tlp tplist-bpfcc trace-bpfcc -traceroute tsig-keygen ttysnoop-bpfcc tune.exfat tune2fs tuned tuned-adm -tunefs.reiserfs tunelp u-d-c-print-pci-ids ucalls @@ -923,21 +717,21 @@ unix_chkpwd unix_update unix2_chkpwd uobjnew -update-bootloader +update-alternatives update-ca-certificates update-catalog update-cracklib -update-default-aspell update-default-ispell update-default-wordlist update-dictcommon-aspell update-dictcommon-hunspell +update-exim4.conf +update-exim4.conf.template update-fonts-alias update-fonts-dir update-fonts-scale update-grub update-grub-gfxpayload -update-grub2 update-gsfontmap update-icon-caches update-ieee-data @@ -973,30 +767,10 @@ vfscount-bpfcc vfscount.bt vfsstat-bpfcc vfsstat.bt -vgcfgbackup -vgcfgrestore -vgchange -vgck -vgconvert -vgcreate -vgdisplay -vgexport -vgextend -vgimport -vgimportclone -vgimportdevices -vgmerge -vgmknodes -vgreduce -vgremove -vgrename -vgs -vgscan -vgsplit vhangup -vigr vipw virt-what +virt-what-cvm virtiostat-bpfcc virtlockd virtlogd @@ -1015,7 +789,6 @@ wpa_passphrase wpa_supplicant wqlat-bpfcc writeback.bt -wrmsr xfs_admin xfs_bmap xfs_copy @@ -1032,6 +805,7 @@ xfs_metadump xfs_mkfile xfs_ncheck xfs_property +xfs_protofile xfs_quota xfs_repair xfs_rtcp @@ -1043,9 +817,7 @@ xfsdist.bt xfsslower-bpfcc xkbctrl xtables-legacy-multi -xtables-monitor xtables-nft-multi -yast yast2 zdump zerofree From 6ed873aad375bea4734ec5321049e597aec02c32 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 5 Jun 2025 00:35:43 +0200 Subject: [PATCH 0992/1455] feat(profile): update sbin list and ensure the profiles use the good variable (sbin or bin). --- apparmor.d/abstractions/app/kmod | 6 ------ apparmor.d/groups/apt/apt-listchanges | 2 +- apparmor.d/groups/apt/debsecan | 2 +- apparmor.d/groups/apt/reportbug | 2 +- apparmor.d/groups/cron/anacron | 2 +- apparmor.d/groups/cron/cron | 2 +- apparmor.d/groups/cron/cron-apt | 4 ++-- apparmor.d/groups/cron/cron-exim4-base | 6 +++--- apparmor.d/groups/cron/crontab | 2 +- apparmor.d/groups/cups/cupsd | 2 +- apparmor.d/groups/filesystem/btrfs-find-root | 2 +- apparmor.d/groups/firewall/firewalld | 4 ++-- apparmor.d/groups/grub/grub-bios-setup | 2 +- apparmor.d/groups/grub/update-grub | 2 +- apparmor.d/groups/kde/sddm-xsession | 2 +- apparmor.d/groups/network/iwctl | 2 +- apparmor.d/groups/network/mullvad-daemon | 2 +- apparmor.d/groups/network/openvpn | 6 +++--- apparmor.d/groups/network/tailscale | 2 +- apparmor.d/groups/network/tailscaled | 2 +- apparmor.d/groups/network/wg-quick | 2 +- apparmor.d/groups/pacman/mkinitcpio | 5 +---- apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/groups/pacman/pacman-hook-depmod | 1 - apparmor.d/groups/ubuntu/cron-ubuntu-fan | 2 +- apparmor.d/groups/ubuntu/subiquity-console-conf | 2 +- apparmor.d/groups/virt/cockpit-bridge | 2 +- apparmor.d/groups/virt/cockpit-update-motd | 2 +- apparmor.d/groups/virt/libvirtd | 2 +- apparmor.d/profiles-a-f/acpi-powerbtn | 1 - apparmor.d/profiles-a-f/adduser | 2 +- apparmor.d/profiles-a-f/adequate | 2 +- apparmor.d/profiles-a-f/atd | 4 ++-- apparmor.d/profiles-a-f/check-bios-nx | 2 +- apparmor.d/profiles-a-f/claws-mail | 2 +- apparmor.d/profiles-a-f/deluser | 4 ++-- apparmor.d/profiles-a-f/dhclient-script | 2 +- apparmor.d/profiles-a-f/exim4 | 2 +- apparmor.d/profiles-a-f/fail2ban-server | 2 +- apparmor.d/profiles-g-l/ifup | 2 +- apparmor.d/profiles-g-l/inxi | 4 ++-- apparmor.d/profiles-g-l/ip | 2 +- apparmor.d/profiles-g-l/ipcalc | 2 +- apparmor.d/profiles-g-l/kernel | 2 +- apparmor.d/profiles-m-r/initramfs-hooks | 2 +- apparmor.d/profiles-m-r/initramfs-scripts | 2 +- apparmor.d/profiles-m-r/modprobed-db | 2 +- apparmor.d/profiles-s-z/setpci | 2 +- apparmor.d/profiles-s-z/syncthing | 2 +- apparmor.d/profiles-s-z/update-alternatives | 2 +- apparmor.d/profiles-s-z/wechat | 2 +- apparmor.d/profiles-s-z/wechat-appimage | 2 +- apparmor.d/profiles-s-z/wpa-action | 2 +- tests/sbin.list | 16 ++++++++++++++++ 54 files changed, 75 insertions(+), 70 deletions(-) diff --git a/apparmor.d/abstractions/app/kmod b/apparmor.d/abstractions/app/kmod index 6c889bd60..b6beeb7f6 100644 --- a/apparmor.d/abstractions/app/kmod +++ b/apparmor.d/abstractions/app/kmod @@ -8,12 +8,6 @@ include @{bin}/kmod mr, - @{sbin}/depmod mr, - @{sbin}/insmod mr, - @{sbin}/lsmod mr, - @{sbin}/modinfo mr, - @{sbin}/modprobe mr, - @{sbin}/rmmod mr, @{lib}/modprobe.d/ r, @{lib}/modprobe.d/*.conf r, diff --git a/apparmor.d/groups/apt/apt-listchanges b/apparmor.d/groups/apt/apt-listchanges index 936d15d42..0ee42f5a4 100644 --- a/apparmor.d/groups/apt/apt-listchanges +++ b/apparmor.d/groups/apt/apt-listchanges @@ -30,7 +30,7 @@ profile apt-listchanges @{exec_path} { @{pager_path} Cx -> pager, @{bin}/dpkg Px -> child-dpkg, - @{bin}/exim4 Px, # Send results using email + @{sbin}/exim4 Px, # Send results using email /usr/share/apt-listchanges/{,**} r, diff --git a/apparmor.d/groups/apt/debsecan b/apparmor.d/groups/apt/debsecan index c9448c7fb..c67b1dfb5 100644 --- a/apparmor.d/groups/apt/debsecan +++ b/apparmor.d/groups/apt/debsecan @@ -27,7 +27,7 @@ profile debsecan @{exec_path} { @{sh_path} rix, # Send results using email - @{bin}/exim4 rPx, + @{sbin}/exim4 rPx, /etc/apt/apt.conf.d/{,*} r, /etc/apt/apt.conf r, diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index dbd02ff6c..ab230a43b 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -40,7 +40,7 @@ profile reportbug @{exec_path} { @{bin}/stty rix, /usr/share/reportbug/handle_bugscript rix, - @{bin}/exim4 rPx, + @{sbin}/exim4 rPx, @{bin}/apt-cache rPx, @{bin}/debconf-show rPx, @{bin}/debsums rPx, diff --git a/apparmor.d/groups/cron/anacron b/apparmor.d/groups/cron/anacron index 1322108d4..3756c1d03 100644 --- a/apparmor.d/groups/cron/anacron +++ b/apparmor.d/groups/cron/anacron @@ -17,7 +17,7 @@ profile anacron @{exec_path} { @{sh_path} rix, @{bin}/run-parts rCx -> run-parts, - @{bin}/exim4 rPx, + @{sbin}/exim4 rPx, / r, /etc/anacrontab r, diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index eba78ac82..e91f9b419 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -28,7 +28,7 @@ profile cron @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, - @{bin}/exim4 rPx, + @{sbin}/exim4 rPx, @{bin}/ionice rix, @{bin}/nice rix, @{bin}/run-parts rCx -> run-parts, diff --git a/apparmor.d/groups/cron/cron-apt b/apparmor.d/groups/cron/cron-apt index 81e5761d7..0d5d5a081 100644 --- a/apparmor.d/groups/cron/cron-apt +++ b/apparmor.d/groups/cron/cron-apt @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/cron-apt +@{exec_path} = @{bin}/cron-apt profile cron-apt @{exec_path} { include include @@ -46,7 +46,7 @@ profile cron-apt @{exec_path} { @{bin}/apt-get rPx, @{bin}/apt-file rPx, @{bin}/aptitude{,-curses} rPx, - @{bin}/exim4 rPx, + @{sbin}/exim4 rPx, /usr/share/cron-apt/{,*} r, diff --git a/apparmor.d/groups/cron/cron-exim4-base b/apparmor.d/groups/cron/cron-exim4-base index 2970f8d42..784dfae19 100644 --- a/apparmor.d/groups/cron/cron-exim4-base +++ b/apparmor.d/groups/cron/cron-exim4-base @@ -34,10 +34,10 @@ profile cron-exim4-base @{exec_path} { @{bin}/hostname rix, @{bin}/xargs rix, @{bin}/find rix, - @{bin}/eximstats rix, + @{sbin}/eximstats rix, - @{bin}/exim4 rPx, - @{bin}/exim_tidydb rix, + @{sbin}/exim4 rPx, + @{sbin}/exim_tidydb rix, @{sbin}/start-stop-daemon rix, @{sbin}/runuser rix, diff --git a/apparmor.d/groups/cron/crontab b/apparmor.d/groups/cron/crontab index 156d5e820..d240454f5 100644 --- a/apparmor.d/groups/cron/crontab +++ b/apparmor.d/groups/cron/crontab @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/crontab +@{exec_path} = @{bin}/crontab profile crontab @{exec_path} { include include diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index 91dd32f51..6eeeaa414 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -54,7 +54,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { @{bin}/gs rix, @{bin}/gsc rix, @{bin}/hostname rix, - @{sbin}/ippfind rix, + @{bin}/ippfind rix, @{bin}/mktemp rix, @{bin}/printenv rix, @{python_path} rix, diff --git a/apparmor.d/groups/filesystem/btrfs-find-root b/apparmor.d/groups/filesystem/btrfs-find-root index eef4b6823..cec2bbb61 100644 --- a/apparmor.d/groups/filesystem/btrfs-find-root +++ b/apparmor.d/groups/filesystem/btrfs-find-root @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/btrfs-find-root +@{exec_path} = @{sbin}/btrfs-find-root profile btrfs-find-root @{exec_path} { include include diff --git a/apparmor.d/groups/firewall/firewalld b/apparmor.d/groups/firewall/firewalld index 01f853c26..57a0baa20 100644 --- a/apparmor.d/groups/firewall/firewalld +++ b/apparmor.d/groups/firewall/firewalld @@ -35,8 +35,8 @@ profile firewalld @{exec_path} flags=(attach_disconnected) { @{bin}/alts ix, @{bin}/false ix, @{bin}/kmod Cx -> kmod, - @{sbin}/ebtables-legacy ix, - @{sbin}/ebtables-legacy-restore ix, + @{bin}/ebtables-legacy ix, + @{bin}/ebtables-legacy-restore ix, @{sbin}/ipset ix, @{sbin}/xtables-legacy-multi ix, @{sbin}/xtables-nft-multi mix, diff --git a/apparmor.d/groups/grub/grub-bios-setup b/apparmor.d/groups/grub/grub-bios-setup index 9ccd02275..b0d606701 100644 --- a/apparmor.d/groups/grub/grub-bios-setup +++ b/apparmor.d/groups/grub/grub-bios-setup @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/grub-bios-setup +@{exec_path} = @{bin}/grub-bios-setup profile grub-bios-setup @{exec_path} { include include diff --git a/apparmor.d/groups/grub/update-grub b/apparmor.d/groups/grub/update-grub index ff17c160a..d4460a3cf 100644 --- a/apparmor.d/groups/grub/update-grub +++ b/apparmor.d/groups/grub/update-grub @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/update-grub{2,} +@{exec_path} = @{sbin}/update-grub profile update-grub @{exec_path} { include include diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession index 0ae174b09..b5cceee95 100644 --- a/apparmor.d/groups/kde/sddm-xsession +++ b/apparmor.d/groups/kde/sddm-xsession @@ -37,7 +37,7 @@ profile sddm-xsession @{exec_path} { @{bin}/sed rix, @{bin}/stat rix, @{bin}/tail rix, - @{sbin}/tcsh rix, + @{bin}/tcsh rix, @{bin}/tempfile rix, @{bin}/touch rix, @{bin}/which{,.*} rix, diff --git a/apparmor.d/groups/network/iwctl b/apparmor.d/groups/network/iwctl index eddcaedf7..0b5bd090e 100644 --- a/apparmor.d/groups/network/iwctl +++ b/apparmor.d/groups/network/iwctl @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/iwctl +@{exec_path} = @{bin}/iwctl profile iwctl @{exec_path} { include diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index ecd23ce53..6c4c41e6c 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -33,7 +33,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{sbin}/ip rix, + @{bin}/ip rix, "/opt/Mullvad VPN/resources/openvpn" rix, "/opt/Mullvad VPN/resources/*.so*" mr, diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index f4fcfa50d..6431ee98a 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -61,7 +61,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { @{run}/openvpn/*.{pid,status} rw, @{run}/systemd/journal/dev-log r, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/systemd-ask-password rPx, @{lib}/nm-openvpn-service-openvpn-helper rPx, /etc/openvpn/force-user-traffic-via-vpn.sh rCx -> force-user-traffic-via-vpn, @@ -83,7 +83,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/cut rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/which rix, @{sbin}/xtables-nft-multi rix, @@ -110,7 +110,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { @{bin}/{,e}grep rix, @{bin}/cut rix, @{bin}/env rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{sbin}/nft rix, @{bin}/sed rix, diff --git a/apparmor.d/groups/network/tailscale b/apparmor.d/groups/network/tailscale index 096fe276c..4e5bba684 100644 --- a/apparmor.d/groups/network/tailscale +++ b/apparmor.d/groups/network/tailscale @@ -23,7 +23,7 @@ profile tailscale @{exec_path} { @{exec_path} mr, - @{sbin}/ip rPx, + @{bin}/ip rPx, owner @{run}/tailscale/tailscaled.sock rw, diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index bb877ec1a..8162dff1e 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -35,7 +35,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/resolvectl rPx, @{sbin}/xtables-nft-multi rix, diff --git a/apparmor.d/groups/network/wg-quick b/apparmor.d/groups/network/wg-quick index e8ece5c88..c89a12a47 100644 --- a/apparmor.d/groups/network/wg-quick +++ b/apparmor.d/groups/network/wg-quick @@ -21,7 +21,7 @@ profile wg-quick @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/cat rix, - @{sbin}/ip rPx, + @{bin}/ip rPx, @{bin}/mv rix, @{sbin}/nft rix, @{bin}/readlink rix, diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index 9eafb72a9..1f1fc66eb 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -42,10 +42,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { @{bin}/zcat rix, @{bin}/zstd rix, - @{bin}/{depmod,insmod} rPx, - @{bin}/{kmod,lsmod} rPx, - @{bin}/{modinfo,rmmod} rPx, - @{sbin}/modprobe rPx, + @{bin}/kmod rPx, @{bin}/plymouth rPx, @{sbin}/plymouth-set-default-theme rPx, @{bin}/sbctl rPx, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 6af9bae96..6cf3b824c 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -97,7 +97,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/update-ca-trust rPx, @{bin}/update-desktop-database rPx, @{sbin}/update-grub rPx, - @{sbin}/update-mime-database rPx, + @{bin}/update-mime-database rPx, @{bin}/vercmp rix, @{bin}/which rix, @{bin}/xmlcatalog rix, diff --git a/apparmor.d/groups/pacman/pacman-hook-depmod b/apparmor.d/groups/pacman/pacman-hook-depmod index fe1bc5781..ce41d6ae8 100644 --- a/apparmor.d/groups/pacman/pacman-hook-depmod +++ b/apparmor.d/groups/pacman/pacman-hook-depmod @@ -16,7 +16,6 @@ profile pacman-hook-depmod @{exec_path} { @{bin}/basename rix, @{bin}/bash rix, - @{sbin}/depmod rPx, @{bin}/kmod rPx, @{bin}/rm rix, @{bin}/rmdir rix, diff --git a/apparmor.d/groups/ubuntu/cron-ubuntu-fan b/apparmor.d/groups/ubuntu/cron-ubuntu-fan index 3ca55909d..9fd065db3 100644 --- a/apparmor.d/groups/ubuntu/cron-ubuntu-fan +++ b/apparmor.d/groups/ubuntu/cron-ubuntu-fan @@ -17,7 +17,7 @@ profile cron-ubuntu-fan @{exec_path} { @{sh_path} rix, @{sbin}/fanctl rPx, @{bin}/grep rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/mkdir rix, @{bin}/sed rix, diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index 575481de2..916279378 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -25,7 +25,7 @@ profile subiquity-console-conf @{exec_path} { @{sh_path} rix, @{bin}/cat rix, @{bin}/grep rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/mkdir rix, @{bin}/mv rix, @{bin}/sleep rix, diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index 87ffb3f4a..b6111750b 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -38,7 +38,7 @@ profile cockpit-bridge @{exec_path} { @{bin}/cat ix, @{bin}/date ix, @{bin}/find ix, - @{sbin}/ip ix, + @{bin}/ip ix, @{python_path} ix, @{bin}/test ix, @{bin}/file ix, diff --git a/apparmor.d/groups/virt/cockpit-update-motd b/apparmor.d/groups/virt/cockpit-update-motd index d71eb9ec1..1de016aea 100644 --- a/apparmor.d/groups/virt/cockpit-update-motd +++ b/apparmor.d/groups/virt/cockpit-update-motd @@ -15,7 +15,7 @@ profile cockpit-update-motd @{exec_path} { @{sh_path} rix, @{bin}/hostname rix, - @{sbin}/ip rPx, + @{bin}/ip rPx, @{bin}/sed rix, @{bin}/systemctl rCx -> systemctl, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 94fa568a3..4d730602d 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -116,7 +116,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{sbin}/virtlogd rPx, @{sh_path} rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{sbin}/nft rix, @{bin}/qemu-img rUx, # TODO: Integration with virt-aa-helper @{bin}/qemu-system* rUx, # TODO: Integration with virt-aa-helper diff --git a/apparmor.d/profiles-a-f/acpi-powerbtn b/apparmor.d/profiles-a-f/acpi-powerbtn index bf7daf85e..fd1d0af03 100644 --- a/apparmor.d/profiles-a-f/acpi-powerbtn +++ b/apparmor.d/profiles-a-f/acpi-powerbtn @@ -17,7 +17,6 @@ profile acpi-powerbtn flags=(attach_disconnected) { @{bin}/pgrep rix, @{bin}/pinky rix, @{bin}/sed rix, - @{sbin}/shutdown rix, /etc/acpi/powerbtn.sh rix, @{bin}/dbus-send Cx -> bus, diff --git a/apparmor.d/profiles-a-f/adduser b/apparmor.d/profiles-a-f/adduser index d971d22f3..039518b51 100644 --- a/apparmor.d/profiles-a-f/adduser +++ b/apparmor.d/profiles-a-f/adduser @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/adduser @{sbin}/group +@{exec_path} = @{sbin}/adduser profile adduser @{exec_path} { include include diff --git a/apparmor.d/profiles-a-f/adequate b/apparmor.d/profiles-a-f/adequate index 6999f5baf..c4741b09a 100644 --- a/apparmor.d/profiles-a-f/adequate +++ b/apparmor.d/profiles-a-f/adequate @@ -34,7 +34,7 @@ profile adequate @{exec_path} flags=(complain) { # shared object file): ignored. @{bin}/dpkg-query rpx, # - @{bin}/update-alternatives rPx, + @{sbin}/update-alternatives rPx, /var/lib/adequate/pending rwk, diff --git a/apparmor.d/profiles-a-f/atd b/apparmor.d/profiles-a-f/atd index aa0a365fd..aea3cbf01 100644 --- a/apparmor.d/profiles-a-f/atd +++ b/apparmor.d/profiles-a-f/atd @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/atd +@{exec_path} = @{bin}/atd profile atd @{exec_path} { include include @@ -28,7 +28,7 @@ profile atd @{exec_path} { @{sh_path} rix, @{sbin}/sendmail rPUx, - @{bin}/exim4 rPx, + @{sbin}/exim4 rPx, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/ r, diff --git a/apparmor.d/profiles-a-f/check-bios-nx b/apparmor.d/profiles-a-f/check-bios-nx index 965e0dc3a..c44b6eaa5 100644 --- a/apparmor.d/profiles-a-f/check-bios-nx +++ b/apparmor.d/profiles-a-f/check-bios-nx @@ -25,7 +25,7 @@ profile check-bios-nx @{exec_path} { @{bin}/kmod rCx -> kmod, - @{sbin}/rdmsr rPx, + @{sbin}/rdmsr rPx, owner @{PROC}/@{pid}/fd/@{int} rw, diff --git a/apparmor.d/profiles-a-f/claws-mail b/apparmor.d/profiles-a-f/claws-mail index cecb0e22d..bb7dfd3b8 100644 --- a/apparmor.d/profiles-a-f/claws-mail +++ b/apparmor.d/profiles-a-f/claws-mail @@ -31,7 +31,7 @@ profile claws-mail @{exec_path} flags=(complain) { @{bin}/gpgconf rCx -> gpg, @{bin}/orage rPUx, - @{bin}/exim4 rPUx, + @{sbin}/exim4 rPUx, @{bin}/geany rPUx, /usr/share/publicsuffix/*.dafsa r, diff --git a/apparmor.d/profiles-a-f/deluser b/apparmor.d/profiles-a-f/deluser index 1f5d6f0a7..3505126ad 100644 --- a/apparmor.d/profiles-a-f/deluser +++ b/apparmor.d/profiles-a-f/deluser @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/deluser @{sbin}/delgroup +@{exec_path} = @{sbin}/deluser profile deluser @{exec_path} { include include @@ -20,7 +20,7 @@ profile deluser @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{sbin}/crontab rPx, + @{bin}/crontab rPx, @{bin}/gpasswd rPx, @{sbin}/groupdel rPx, @{bin}/mount rCx -> mount, diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script index d5505ff86..9a7e77902 100644 --- a/apparmor.d/profiles-a-f/dhclient-script +++ b/apparmor.d/profiles-a-f/dhclient-script @@ -28,7 +28,7 @@ profile dhclient-script @{exec_path} { @{bin}/fold rix, @{bin}/head rix, @{bin}/hostname rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/logger rix, @{bin}/mkdir rix, @{bin}/mv rix, diff --git a/apparmor.d/profiles-a-f/exim4 b/apparmor.d/profiles-a-f/exim4 index 9aaccaa16..3af283014 100644 --- a/apparmor.d/profiles-a-f/exim4 +++ b/apparmor.d/profiles-a-f/exim4 @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/exim4 +@{exec_path} = @{sbin}/exim4 profile exim4 @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-a-f/fail2ban-server b/apparmor.d/profiles-a-f/fail2ban-server index 21d2a1cf8..629208bc6 100644 --- a/apparmor.d/profiles-a-f/fail2ban-server +++ b/apparmor.d/profiles-a-f/fail2ban-server @@ -21,7 +21,7 @@ profile fail2ban-server @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{sbin}/xtables-nft-multi rix, - @{sbin}/iptables rix, + @{bin}/iptables rix, @{bin}/ r, @{python_path} r, diff --git a/apparmor.d/profiles-g-l/ifup b/apparmor.d/profiles-g-l/ifup index 42169dd6d..3c641f8e1 100644 --- a/apparmor.d/profiles-g-l/ifup +++ b/apparmor.d/profiles-g-l/ifup @@ -19,7 +19,7 @@ profile ifup @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{sbin}/route rix, @{bin}/seq rix, @{bin}/sleep rix, diff --git a/apparmor.d/profiles-g-l/inxi b/apparmor.d/profiles-g-l/inxi index 38b2a17a2..e80875ca2 100644 --- a/apparmor.d/profiles-g-l/inxi +++ b/apparmor.d/profiles-g-l/inxi @@ -32,7 +32,7 @@ profile inxi @{exec_path} { @{lib}/llvm-[0-9]*/bin/clang rix, @{bin}/{,@{multiarch}-}gcc-[0-9]* rix, - @{sbin}/ip rCx -> ip, + @{bin}/ip rCx -> ip, @{bin}/kmod rCx -> kmod, @{bin}/systemctl rCx -> systemctl, @{bin}/udevadm rCx -> udevadm, @@ -115,7 +115,7 @@ profile inxi @{exec_path} { network netlink raw, - @{sbin}/ip mr, + @{bin}/ip mr, @{sys}/devices/@{pci}/net/*/{duplex,address,speed,operstate} r, diff --git a/apparmor.d/profiles-g-l/ip b/apparmor.d/profiles-g-l/ip index 3495bcc80..bcb521c01 100644 --- a/apparmor.d/profiles-g-l/ip +++ b/apparmor.d/profiles-g-l/ip @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/ip +@{exec_path} = @{bin}/ip profile ip @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-g-l/ipcalc b/apparmor.d/profiles-g-l/ipcalc index 628728846..c6dfa762a 100644 --- a/apparmor.d/profiles-g-l/ipcalc +++ b/apparmor.d/profiles-g-l/ipcalc @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/ipcalc +@{exec_path} = @{bin}/ipcalc profile ipcalc @{exec_path} { include include diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel index 2382ea062..133cf8ae7 100644 --- a/apparmor.d/profiles-g-l/kernel +++ b/apparmor.d/profiles-g-l/kernel @@ -38,7 +38,7 @@ profile kernel @{exec_path} { @{bin}/apt-config rPx, @{bin}/dpkg rPx -> child-dpkg, @{bin}/systemd-detect-virt rPx, - @{bin}/update-alternatives rPx, + @{sbin}/update-alternatives rPx, @{sbin}/dkms rPx, @{sbin}/update-grub rPx, @{sbin}/update-initramfs rPx, diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index b4f3ac2f4..aeb125ef2 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -18,7 +18,7 @@ profile initramfs-hooks @{exec_path} { @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, @{bin}/plymouth Px, - @{bin}/update-alternatives Px, + @{sbin}/update-alternatives Px, @{sbin}/blkid Px, @{lib}/dracut/dracut-install Px, @{lib}/initramfs-tools/bin/busybox ix, diff --git a/apparmor.d/profiles-m-r/initramfs-scripts b/apparmor.d/profiles-m-r/initramfs-scripts index 85437017b..485520ca0 100644 --- a/apparmor.d/profiles-m-r/initramfs-scripts +++ b/apparmor.d/profiles-m-r/initramfs-scripts @@ -20,7 +20,7 @@ profile initramfs-scripts @{exec_path} { @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, @{bin}/plymouth Px, - @{bin}/update-alternatives Px, + @{sbin}/update-alternatives Px, @{lib}/dracut/dracut-install Px, @{lib}/initramfs-tools/bin/busybox Px, /usr/share/mdadm/mkconf Px, diff --git a/apparmor.d/profiles-m-r/modprobed-db b/apparmor.d/profiles-m-r/modprobed-db index 8b8968464..cd2ddc0e6 100644 --- a/apparmor.d/profiles-m-r/modprobed-db +++ b/apparmor.d/profiles-m-r/modprobed-db @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/modprobed-db +@{exec_path} = @{bin}/modprobed-db profile modprobed-db @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/setpci b/apparmor.d/profiles-s-z/setpci index b45dd3986..019e89e23 100644 --- a/apparmor.d/profiles-s-z/setpci +++ b/apparmor.d/profiles-s-z/setpci @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/setpci +@{exec_path} = @{bin}/setpci profile setpci @{exec_path} flags=(complain) { include include diff --git a/apparmor.d/profiles-s-z/syncthing b/apparmor.d/profiles-s-z/syncthing index 8b66b652f..6ff0fe7e9 100644 --- a/apparmor.d/profiles-s-z/syncthing +++ b/apparmor.d/profiles-s-z/syncthing @@ -23,7 +23,7 @@ profile syncthing @{exec_path} { @{exec_path} mrix, @{open_path} rPx -> child-open, - @{sbin}/ip rix, + @{bin}/ip rix, /usr/share/mime/{,**} r, diff --git a/apparmor.d/profiles-s-z/update-alternatives b/apparmor.d/profiles-s-z/update-alternatives index 8f08b74fa..68ddb97a5 100644 --- a/apparmor.d/profiles-s-z/update-alternatives +++ b/apparmor.d/profiles-s-z/update-alternatives @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/update-alternatives +@{exec_path} = @{sbin}/update-alternatives profile update-alternatives @{exec_path} { include include diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat index d0fc54b7c..e23d4db43 100755 --- a/apparmor.d/profiles-s-z/wechat +++ b/apparmor.d/profiles-s-z/wechat @@ -33,7 +33,7 @@ profile wechat @{exec_path} flags=(attach_disconnected) { @{bin}/mkdir ix, @{bin}/gawk rix, @{bin}/lsblk rPx, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/xdg-user-dir rix, @{open_path} rpx -> child-open-strict, diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage index 6f4c120a0..023644eb0 100755 --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -38,7 +38,7 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) { @{bin}/mkdir ix, @{bin}/gawk rix, @{bin}/lsblk rPx, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/xdg-user-dir rix, @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} ix, @{tmp}/.mount_wechat@{word6}/usr/bin/wechat ix, diff --git a/apparmor.d/profiles-s-z/wpa-action b/apparmor.d/profiles-s-z/wpa-action index b2cfe0091..b6764ba0e 100644 --- a/apparmor.d/profiles-s-z/wpa-action +++ b/apparmor.d/profiles-s-z/wpa-action @@ -24,7 +24,7 @@ profile wpa-action @{exec_path} { @{bin}/cat rix, @{bin}/date rix, @{bin}/ifup rix, - @{sbin}/ip rix, + @{bin}/ip rix, @{bin}/ln rix, @{bin}/logger rix, @{bin}/rm rix, diff --git a/tests/sbin.list b/tests/sbin.list index d2b5c44bc..15373846c 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -37,6 +37,7 @@ apparmor_status applygnupgdefaults aptd argdist-bpfcc +arp arpd aspell-autobuildhash audisp-af_unix @@ -64,6 +65,7 @@ biolatency.bt biolatpcts-bpfcc biopattern-bpfcc biosdecode +biosdecode biosnoop-bpfcc biosnoop.bt biostacks.bt @@ -102,6 +104,7 @@ cgdisk chat chcpu check_mail_queue +check-bios-nx checkproc chgpasswd chkstat-polkit @@ -161,6 +164,7 @@ dmevent_tool dmeventd dmfilemapd dmidecode +dmidecode dmraid dmsetup dnsmasq @@ -236,6 +240,7 @@ flushb fonts-config fsadm fsck +fsck. fsck.btrfs fsck.cramfs fsck.exfat @@ -302,6 +307,7 @@ hdparm hwclock hwinfo iconvconfig +ifconfig ifrename ifstat import-openSUSE-build-key @@ -334,6 +340,7 @@ isosize ispell-autobuildhash isserial issue-generator +iucode_tool iw iwconfig iwevent @@ -362,6 +369,7 @@ killsnoop.bt klockstat-bpfcc klogd kpartx +kvm-ok kvmexit-bpfcc ldattach ldconfig @@ -386,6 +394,7 @@ lpmove luksformat lvm lvm_import_vdo +lvmconfig lvmdump lvmpolld lwepgen @@ -405,6 +414,7 @@ mkdict mkdosfs mke2fs mkfs +mkfs. mkfs.bfs mkfs.btrfs mkfs.cramfs @@ -480,6 +490,7 @@ opensnoop.bt openvpn overlayroot-chroot ownership +ownership pam_extrausers_chkpwd pam_extrausers_update pam_getenv @@ -547,6 +558,7 @@ rcxdm rcxvnc rdma rdmaucma-bpfcc +rdmsr readahead-bpfcc readprofile realm @@ -558,11 +570,13 @@ request-key reset-trace-bpfcc resize2fs resizepart +resolvconf rfkill rmt-tar rndc rndc-confgen rngd +route routel rpc.gssd rpc.idmapd @@ -778,6 +792,7 @@ visudo vmcore-dmesg vncsession vpddecode +vpddecode vpnc vpnc-disconnect wakeuptime-bpfcc @@ -789,6 +804,7 @@ wpa_passphrase wpa_supplicant wqlat-bpfcc writeback.bt +wrmsr xfs_admin xfs_bmap xfs_copy From f0355f36b9fd74725e086790db305de6c25edafa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 5 Jun 2025 00:36:30 +0200 Subject: [PATCH 0993/1455] tests: show error line in sbin check. --- tests/check.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 59463246e..add9b0685 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -338,7 +338,7 @@ check_sbin() { jobs=0 for name in "${sbin[@]}"; do ( - mapfile -t files < <(grep --files-with-matches --recursive -E "(^|[[:space:]])@{bin}/$name([[:space:]]|$)" apparmor.d) + mapfile -t files < <(grep --line-number --recursive -E "(^|[[:space:]])@{bin}/$name([[:space:]]|$)" apparmor.d | cut -d: -f1,2) for file in "${files[@]}"; do _err compatibility "$file" "contains '@{bin}/$name' instead of '@{sbin}/$name'" done @@ -349,7 +349,7 @@ check_sbin() { local pattern='[[:alnum:]_.-]+' # Pattern for valid file names jobs=0 - mapfile -t files < <(grep --files-with-matches --recursive -E "(^|[[:space:]])@{sbin}/$pattern([[:space:]]|$)" apparmor.d) + mapfile -t files < <(grep --line-number --recursive -E "(^|[[:space:]])@{sbin}/$pattern([[:space:]]|$)" apparmor.d | cut -d: -f1,2) for file in "${files[@]}"; do ( while read -r match; do @@ -359,7 +359,7 @@ check_sbin() { _err compatibility "$file" "contains '@{sbin}/$name' but it is not in sbin.list" fi fi - done < <(grep --only-matching -E "@\{sbin\}/$pattern" "$file") + done < <(grep --only-matching -E "@\{sbin\}/$pattern" "${file%%:*}") ) & _wait jobs done From edcbaa1b94f511e4b3db9642718887dc98f93511 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Jun 2025 23:01:24 +0200 Subject: [PATCH 0994/1455] fix: add gpartedbin back to sbin.list. --- tests/sbin.list | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/sbin.list b/tests/sbin.list index 15373846c..a17f15448 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -275,6 +275,7 @@ getweb gnome-menus-blacklist gpart gparted +gpartedbin gpm groupadd groupdel From 65f96447530dccb2928b682d76c37cfb0164a76e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Jun 2025 23:37:59 +0200 Subject: [PATCH 0995/1455] fix: linter check. --- apparmor.d/groups/gvfs/gvfsd-wsdd | 2 +- apparmor.d/groups/steam/steam | 4 ++-- apparmor.d/profiles-g-l/hw-probe | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/gvfs/gvfsd-wsdd b/apparmor.d/groups/gvfs/gvfsd-wsdd index 0064d682b..209971ac2 100644 --- a/apparmor.d/groups/gvfs/gvfsd-wsdd +++ b/apparmor.d/groups/gvfs/gvfsd-wsdd @@ -34,7 +34,7 @@ profile gvfsd-wsdd @{exec_path} { @{exec_path} mr, @{bin}/env r, - @{sbin}/wsdd rPx, + @{bin}/wsdd rPx, @{run}/mount/utab r, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, diff --git a/apparmor.d/groups/steam/steam b/apparmor.d/groups/steam/steam index 11e863972..73c78f2ed 100644 --- a/apparmor.d/groups/steam/steam +++ b/apparmor.d/groups/steam/steam @@ -71,7 +71,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/ldd rix, @{bin}/lsb_release rPx -> lsb_release, @{bin}/lsof rix, - @{sbin}/lspci rCx -> lspci, + @{bin}/lspci rCx -> lspci, @{bin}/tar rix, @{bin}/which{,.debianutils} rix, @{bin}/xdg-icon-resource rPx, @@ -408,7 +408,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { unix receive type=stream, - @{sbin}/lspci mr, + @{bin}/lspci mr, owner @{HOME}/.steam/steam.pipe r, diff --git a/apparmor.d/profiles-g-l/hw-probe b/apparmor.d/profiles-g-l/hw-probe index fc6b8775b..f518a18f0 100644 --- a/apparmor.d/profiles-g-l/hw-probe +++ b/apparmor.d/profiles-g-l/hw-probe @@ -65,7 +65,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/lsb_release rPx -> lsb_release, @{bin}/lsblk rPx, @{bin}/lscpu rPx, - @{sbin}/lspci rPx, + @{bin}/lspci rPx, @{bin}/lsusb rPx, @{bin}/memtester rPx, @{bin}/nmcli rPx, From a4737546f76fe1f4aaa65d2ad7d5663c3a317c5d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 10 Jun 2025 23:58:24 +0200 Subject: [PATCH 0996/1455] tests: update sbin.list --- apparmor.d/profiles-g-l/haveged | 2 +- tests/sbin.list | 43 ++++++++++++++++++++++++++++++--- 2 files changed, 40 insertions(+), 5 deletions(-) diff --git a/apparmor.d/profiles-g-l/haveged b/apparmor.d/profiles-g-l/haveged index 910e9a2f0..5773a73fb 100644 --- a/apparmor.d/profiles-g-l/haveged +++ b/apparmor.d/profiles-g-l/haveged @@ -9,7 +9,7 @@ abi , include -@{exec_path} = @{bin}/haveged +@{exec_path} = @{sbin}/haveged profile haveged @{exec_path} { include diff --git a/tests/sbin.list b/tests/sbin.list index a17f15448..1adc90ee8 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -1,3 +1,5 @@ +a2enmod +a2query aa-audit aa-autodep aa-cleanprof @@ -32,6 +34,7 @@ alsabat-test alsactl anacron apache2 +apache2ctl apparmor_parser apparmor_status applygnupgdefaults @@ -65,7 +68,6 @@ biolatency.bt biolatpcts-bpfcc biopattern-bpfcc biosdecode -biosdecode biosnoop-bpfcc biosnoop.bt biostacks.bt @@ -103,6 +105,7 @@ cfdisk cgdisk chat chcpu +check_forensic check_mail_queue check-bios-nx checkproc @@ -164,7 +167,6 @@ dmevent_tool dmeventd dmfilemapd dmidecode -dmidecode dmraid dmsetup dnsmasq @@ -191,6 +193,8 @@ ec_access efibootdump efibootmgr enforce +ephemeral-disk-warning +escapesrc ethtool eventlogadm execsnoop-bpfcc @@ -264,8 +268,12 @@ g13-syshelp gdisk gdm gdm3 +genccode +gencmn genl +gennorm2 genprof +gensprep getcap gethostlatency-bpfcc gethostlatency.bt @@ -304,10 +312,19 @@ grub2-set-default grub2-sparc64-setup grub2-switch-to-blscfg hardirqs-bpfcc +haveged hdparm +httxt2dbm +hv_fcopy_daemon +hv_get_dhcp_info +hv_get_dns_info +hv_kvp_daemon +hv_set_ifconfig +hv_vss_daemon hwclock hwinfo iconvconfig +icupkg ifconfig ifrename ifstat @@ -321,6 +338,7 @@ installkernel integritysetup invoke-rc.d ip6tables-legacy-batch +ipmaddr ipp-usb ippevepcl ippeveprinter @@ -328,6 +346,7 @@ ippeveps ipset iptables-apply iptables-legacy-batch +iptunnel irqbalance irqbalance-ui isadump @@ -392,6 +411,7 @@ lpadmin lpc lpinfo lpmove +lsvmbus luksformat lvm lvm_import_vdo @@ -410,6 +430,7 @@ mdflush-bpfcc mdflush.bt mdmon memleak-bpfcc +mii-tool mk_isdnhwdb mkdict mkdosfs @@ -453,7 +474,9 @@ mpathpersist multipath multipathc multipathd +mysqld mysqld_qslower-bpfcc +nameif naptime.bt needrestart netqtop-bpfcc @@ -468,6 +491,7 @@ nfsiostat nfsslower-bpfcc nfsstat nft +nginx nmbd nodegc-bpfcc nodestat-bpfcc @@ -480,6 +504,7 @@ ntfscp ntfslabel ntfsresize ntfsundelete +nvme offcputime-bpfcc offwaketime-bpfcc on_ac_power @@ -491,7 +516,6 @@ opensnoop.bt openvpn overlayroot-chroot ownership -ownership pam_extrausers_chkpwd pam_extrausers_update pam_getenv @@ -510,12 +534,17 @@ pdata_tools perlcalls-bpfcc perlflow-bpfcc perlstat-bpfcc +pg_updatedicts +php-fpm8.3 phpcalls-bpfcc +phpenmod phpflow-bpfcc +phpquery phpstat-bpfcc pidpersec-bpfcc pidpersec.bt pivot_root +plipconfig pluginviewer plymouth-set-default-theme plymouthd @@ -552,6 +581,7 @@ pythonstat-bpfcc qemu-ga qmqp-source qshape +rarp rcfirewalld rcopenvpn rcpcscd @@ -632,6 +662,7 @@ showmount skdump sktest slabratetop-bpfcc +slattach sm-notify smart_agetty smartctl @@ -646,6 +677,7 @@ sofdsnoop-bpfcc softirqs-bpfcc solisten-bpfcc spice-vdagentd +split-logfile ss sshd sshd-gen-keys-start @@ -754,6 +786,7 @@ update-inetd update-info-dir update-initramfs update-java-alternatives +update-language update-locale update-mime update-passwd @@ -762,6 +795,9 @@ update-rc.d update-secureboot-policy update-shells update-smart-drivedb +update-texmf +update-texmf-config +update-tl-stacked-conffile update-xmlcatalog upgrade-from-grub-legacy usb_modeswitch @@ -793,7 +829,6 @@ visudo vmcore-dmesg vncsession vpddecode -vpddecode vpnc vpnc-disconnect wakeuptime-bpfcc From e3bd48bd758601e17cef0d6825268e4cad55ead8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Jun 2025 22:55:17 +0200 Subject: [PATCH 0997/1455] build: justfile: add group. --- Justfile | 37 +++++++++++++++++++++++++++++++++++-- 1 file changed, 35 insertions(+), 2 deletions(-) diff --git a/Justfile b/Justfile index 825097a1b..4021b0e5a 100644 --- a/Justfile +++ b/Justfile @@ -64,24 +64,34 @@ help: @just --list --unsorted @echo -e "\nSee https://apparmor.pujol.io/development/ for more information." +[group('build')] [doc('Build the go programs')] build: @go build -o {{build}}/ ./cmd/aa-log @go build -o {{build}}/ ./cmd/prebuild +[group('build')] [doc('Prebuild the profiles in enforced mode')] enforce: build @./{{build}}/prebuild +[group('build')] [doc('Prebuild the profiles in complain mode')] complain: build @./{{build}}/prebuild --complain +[group('build')] [doc('Prebuild the profiles in FSP mode')] fsp: build + @./{{build}}/prebuild --full + +[group('build')] +[doc('Prebuild the profiles in FSP mode (complain)')] +fsp-complain: build @./{{build}}/prebuild --complain --full -[doc('Install the profiles')] +[group('build')] +[doc('Install prebuild profiles')] install: #!/usr/bin/env bash set -eu -o pipefail @@ -108,26 +118,31 @@ install: install -Dm0644 "$file" "{{destdir}}/usr/lib/systemd/user/$service.d/apparmor.conf" done +[group('packages')] [doc('Build & install apparmor.d on Arch based systems')] pkg: @makepkg --syncdeps --install --cleanbuild --force --noconfirm +[group('packages')] [doc('Build & install apparmor.d on Debian based systems')] dpkg: @bash dists/build.sh dpkg @sudo dpkg -i {{pkgdest}}/{{pkgname}}_*.deb +[group('packages')] [doc('Build & install apparmor.d on OpenSUSE based systems')] rpm: @bash dists/build.sh rpm @sudo rpm -ivh --force {{pkgdest}}/{{pkgname}}-*.rpm +[group('tests')] [doc('Run the unit tests')] tests: @go test ./cmd/... -v -cover -coverprofile=coverage.out @go test ./pkg/... -v -cover -coverprofile=coverage.out @go tool cover -func=coverage.out +[group('linter')] [doc('Run the linters')] lint: golangci-lint run @@ -138,18 +153,22 @@ lint: tests/packer/init.sh tests/packer/src/aa-update tests/packer/clean.sh \ debian/{{pkgname}}.postinst debian/{{pkgname}}.postrm +[group('linter')] [doc('Run style checks on the profiles')] check: @bash tests/check.sh +[group('docs')] [doc('Generate the man pages')] man: @pandoc -t man -s -o share/man/man8/aa-log.8 share/man/man8/aa-log.md +[group('docs')] [doc('Build the documentation')] docs: @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=true mkdocs build --strict +[group('docs')] [doc('Serve the documentation')] serve: @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=false mkdocs serve @@ -160,6 +179,7 @@ clean: debian/.debhelper debian/debhelper* debian/*.debhelper debian/{{pkgname}} \ {{pkgdest}}/{{pkgname}}* {{build}} coverage.out +[group('packages')] [doc('Build the package in a clean OCI container')] package dist: #!/usr/bin/env bash @@ -175,6 +195,7 @@ package dist: fi bash dists/docker.sh $dist $version +[group('vm')] [doc('Build the VM image')] img dist flavor: (package dist) @mkdir -p {{base_dir}} @@ -192,6 +213,7 @@ img dist flavor: (package dist) -var output_dir={{output_dir}} \ tests/packer/ +[group('vm')] [doc('Create the machine')] create dist flavor: @cp -f {{base_dir}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 {{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 @@ -211,33 +233,40 @@ create dist flavor: --sound model=ich9 \ --noautoconsole +[group('vm')] [doc('Start a machine')] up dist flavor: @virsh {{c}} start {{prefix}}{{dist}}-{{flavor}} +[group('vm')] [doc('Stops the machine')] halt dist flavor: @virsh {{c}} shutdown {{prefix}}{{dist}}-{{flavor}} +[group('vm')] [doc('Reboot the machine')] reboot dist flavor: @virsh {{c}} reboot {{prefix}}{{dist}}-{{flavor}} +[group('vm')] [doc('Destroy the machine')] destroy dist flavor: @virsh {{c}} destroy {{prefix}}{{dist}}-{{flavor}} || true @virsh {{c}} undefine {{prefix}}{{dist}}-{{flavor}} --nvram @rm -fv {{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 +[group('vm')] [doc('Connect to the machine')] ssh dist flavor: @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` +[group('vm')] [doc('List the machines')] list: @echo -e '\033[1m Id Distribution Flavor State\033[0m' @virsh {{c}} list --all | grep {{prefix}} | sed 's/{{prefix}}//g' +[group('vm')] [doc('List the VM images')] images: #!/usr/bin/env bash @@ -254,6 +283,7 @@ images: } ' +[group('vm')] [doc('List the VM images that can be created')] available: #!/usr/bin/env bash @@ -270,6 +300,8 @@ available: } ' + +[group('tests')] [doc('Run the integration tests on the machine')] integration dist flavor: @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` \ @@ -280,12 +312,13 @@ integration dist flavor: @bats --recursive --timing --print-output-on-failure Projects/integration/ - +[group('internal')] get_ip dist flavor: @virsh --quiet --readonly {{c}} domifaddr {{prefix}}{{dist}}-{{flavor}} | \ head -1 | \ grep -E -o '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}' +[group('internal')] get_osinfo dist: #!/usr/bin/env python3 osinfo = { From 3291d9a370f5972f67ba5d524f90312f7fbd49eb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 11 Jun 2025 22:56:18 +0200 Subject: [PATCH 0998/1455] fix: use mappings/sudo in su. --- apparmor.d/groups/utils/su | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/utils/su b/apparmor.d/groups/utils/su index c4e83ddfa..866da3d6a 100644 --- a/apparmor.d/groups/utils/su +++ b/apparmor.d/groups/utils/su @@ -12,7 +12,7 @@ profile su @{exec_path} { include include include - include #aa:only RBAC + include #aa:only RBAC capability chown, # pseudo-terminal From cdd45bcd608545b4d84ca7826c5cf69e73883b39 Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 11 Jun 2025 17:53:27 +0200 Subject: [PATCH 0999/1455] add xkeyboard-config-2 ressources --- apparmor.d/abstractions/desktop | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 73e533992..e44377ea3 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -77,6 +77,7 @@ /usr/share/desktop-base/{,**} r, /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, + /usr/share/xkeyboard-config-2/{,**} r, include if exists From c947fe6c6cb2a9cf4102f9f951d875c0af33039c Mon Sep 17 00:00:00 2001 From: valoq Date: Thu, 12 Jun 2025 10:48:53 +0200 Subject: [PATCH 1000/1455] complete xkeyboard-config-2 permissions --- apparmor.d/abstractions/X-strict | 1 + apparmor.d/abstractions/desktop | 1 - apparmor.d/groups/systemd/systemd-localed | 1 + apparmor.d/groups/ubuntu/software-properties-gtk | 1 + 4 files changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/X-strict b/apparmor.d/abstractions/X-strict index d3e2cef4f..9330d2223 100644 --- a/apparmor.d/abstractions/X-strict +++ b/apparmor.d/abstractions/X-strict @@ -12,6 +12,7 @@ /usr/share/X11/{,**} r, /usr/share/xsessions/{,*.desktop} r, # Available Xsessions + /usr/share/xkeyboard-config-2/{,**} r, /etc/X11/cursors/{,**} r, diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index e44377ea3..73e533992 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -77,7 +77,6 @@ /usr/share/desktop-base/{,**} r, /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, - /usr/share/xkeyboard-config-2/{,**} r, include if exists diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index 3befcd92a..75d382c40 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -23,6 +23,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { /usr/share/kbd/keymaps/{,**} r, /usr/share/systemd/*-map r, /usr/share/X11/xkb/{,**} r, + /usr/share/xkeyboard-config-2/{,**} r, /etc/.#locale.conf@{hex16} rw, /etc/.#vconsole.conf* rw, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index d5762a84e..64c83f5c8 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -45,6 +45,7 @@ profile software-properties-gtk @{exec_path} { /usr/share/X11/xkb/{,**} r, /usr/share/xml/iso-codes/{,**} r, /usr/share/software-properties/gtkbuilder/* r, + /usr/share/xkeyboard-config-2/{,**} r, /etc/apport/blacklist.d/{,*} r, /etc/default/apport r, From 5216cbdcdefc716848bbf762ea5de92a41c52ce2 Mon Sep 17 00:00:00 2001 From: valoq Date: Thu, 12 Jun 2025 10:54:00 +0200 Subject: [PATCH 1001/1455] add more xkeyboard-config-2 ressources --- apparmor.d/abstractions/desktop | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 73e533992..f53627fcc 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -27,6 +27,7 @@ /usr/{local/,}share/ r, /usr/{local/,}share/glib-@{version}/schemas/** r, /usr/{local/,}share/gvfs/remote-volume-monitors/{,*} r, + /usr/share/xkeyboard-config-2/{,**} r, /etc/gnome/* r, /etc/xdg/{,*-}mimeapps.list r, From 1f7e019500a87027fd03f89e148e52b71946e4c0 Mon Sep 17 00:00:00 2001 From: valoq Date: Thu, 12 Jun 2025 16:23:05 +0200 Subject: [PATCH 1002/1455] clean desktop abstraction --- apparmor.d/abstractions/desktop | 1 - 1 file changed, 1 deletion(-) diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index f53627fcc..73e533992 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -27,7 +27,6 @@ /usr/{local/,}share/ r, /usr/{local/,}share/glib-@{version}/schemas/** r, /usr/{local/,}share/gvfs/remote-volume-monitors/{,*} r, - /usr/share/xkeyboard-config-2/{,**} r, /etc/gnome/* r, /etc/xdg/{,*-}mimeapps.list r, From 8118bf3d23052e3319c73c29f36e376212ccb8b2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 21:48:07 +0200 Subject: [PATCH 1003/1455] fix: pinentry gtk need access to its cmdline. fix #768 --- apparmor.d/profiles-m-r/pinentry-gtk | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/apparmor.d/profiles-m-r/pinentry-gtk b/apparmor.d/profiles-m-r/pinentry-gtk index a0244956d..d07a64a5a 100644 --- a/apparmor.d/profiles-m-r/pinentry-gtk +++ b/apparmor.d/profiles-m-r/pinentry-gtk @@ -11,16 +11,12 @@ include profile pinentry-gtk @{exec_path} { include include - include - include include - include + include @{exec_path} mr, - /usr/share/gtk-@{int}.@{int}/{,**} r, - - owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, + @{PROC}/@{pid}/cmdline r, owner /dev/tty@{int} r, From 4cb6de3d2d440f08766a0dc1aa23df220a913418 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 21:50:22 +0200 Subject: [PATCH 1004/1455] fix(profile): ufw: allow kmod. fix #765 --- apparmor.d/groups/firewall/ufw | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/firewall/ufw b/apparmor.d/groups/firewall/ufw index b7f133641..3b931fb2b 100644 --- a/apparmor.d/groups/firewall/ufw +++ b/apparmor.d/groups/firewall/ufw @@ -32,11 +32,13 @@ profile ufw @{exec_path} flags=(attach_disconnected) { @{python_path} rix, @{bin}/ r, @{bin}/cat rix, + @{bin}/echo rix, @{bin}/env r, + @{bin}/kmod rCx -> kmod, + @{lib}/ufw/ufw-init rix, @{sbin}/sysctl rix, @{sbin}/xtables-legacy-multi rix, @{sbin}/xtables-nft-multi rix, - @{lib}/ufw/ufw-init rix, /etc/default/ufw rw, /etc/ufw/ rw, @@ -56,6 +58,18 @@ profile ufw @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/net/ipv{4,6}/** rw, @{PROC}/sys/kernel/modprobe r, + profile kmod flags=(attach_disconnected) { + include + include + + capability sys_module, + + @{sys}/module/compression r, + @{sys}/module/*/initstate r, + + include if exists + } + include if exists } From d3aa4ae4a12c6a1be645282aacf829be39f8e564 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:01:08 +0200 Subject: [PATCH 1005/1455] fix(abs): ensure generic app can run widevine. fix #764 --- apparmor.d/abstractions/common/app | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 99da31590..efb3c838b 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -54,7 +54,7 @@ @{MOUNTS}/** rwl, owner @{HOME}/ r, owner @{HOME}/.var/app/** rmix, - owner @{HOME}/** rwlk -> @{HOME}/**, + owner @{HOME}/** rwmlk -> @{HOME}/**, owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, owner @{user_games_dirs}/** rmix, @@ -122,6 +122,7 @@ owner @{PROC}/@{pid}/fd/@{int} rw, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/io r, + owner @{PROC}/@{pid}/limits r, owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/mem r, owner @{PROC}/@{pid}/mounts r, From 110f4ea40e7d806790952b2a7451a14f1e70e734 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:01:40 +0200 Subject: [PATCH 1006/1455] feat(abs): mesa: add /var/cache as fallback location. --- apparmor.d/abstractions/mesa.d/complete | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index a19166367..1d718c0b1 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -2,6 +2,20 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + # Fallback location when @{user_cache_dirs} is not available + /var/cache/mesa_shader_cache_db/ rw, + /var/cache/mesa_shader_cache_db/index rw, + /var/cache/mesa_shader_cache_db/marker rw, + /var/cache/mesa_shader_cache_db/part@{int}/ rw, + /var/cache/mesa_shader_cache_db/part@{int}/mesa_cache.db rwk, + /var/cache/mesa_shader_cache_db/part@{int}/mesa_cache.idx rwk, + /var/cache/mesa_shader_cache/ rw, + /var/cache/mesa_shader_cache/@{hex2}/ rw, + /var/cache/mesa_shader_cache/@{hex2}/@{hex38} rw, + /var/cache/mesa_shader_cache/@{hex2}/@{hex38}.tmp rwk, + /var/cache/mesa_shader_cache/index rw, + /var/cache/mesa_shader_cache/marker rw, + # Extra Mesa rules for desktop environments owner @{desktop_cache_dirs}/ w, owner @{desktop_cache_dirs}/mesa_shader_cache_db/ rw, From 2941334b7ccca275cd7dbd409709d452069bd19f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:04:55 +0200 Subject: [PATCH 1007/1455] fix(profile): brave flag & stacked helper. fix #763 --- apparmor.d/groups/browsers/brave | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/browsers/brave b/apparmor.d/groups/browsers/brave index cc3d18b58..0decb0d4b 100644 --- a/apparmor.d/groups/browsers/brave +++ b/apparmor.d/groups/browsers/brave @@ -14,11 +14,13 @@ include @{cache_dirs} = @{user_cache_dirs}/BraveSoftware/Brave-Browser{,-Beta,-Dev} @{exec_path} = @{lib_dirs}/@{name} -profile brave @{exec_path} { +profile brave @{exec_path} flags=(attach_disconnected) { include include - unix (send, receive) type=stream peer=(label=brave-crashpad-handler), + unix (send, receive) type=stream peer=(label=brave//&brave-crashpad-handler), + + signal receive peer=brave//&brave-crashpad-handler, #aa:dbus own bus=session name=org.mpris.MediaPlayer2.brave path=/org/mpris/MediaPlayer2 From 07007f93c4a5a81de933485a931db7377440f949 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:06:55 +0200 Subject: [PATCH 1008/1455] fix(fsp): ignore not yet used mappings. --- apparmor.d/groups/utils/chfn | 1 - apparmor.d/groups/utils/chsh | 1 - 2 files changed, 2 deletions(-) diff --git a/apparmor.d/groups/utils/chfn b/apparmor.d/groups/utils/chfn index 824d92bf4..45b50c7ad 100644 --- a/apparmor.d/groups/utils/chfn +++ b/apparmor.d/groups/utils/chfn @@ -15,7 +15,6 @@ profile chfn @{exec_path} { include include include - include #aa:only RBAC capability audit_write, capability chown, diff --git a/apparmor.d/groups/utils/chsh b/apparmor.d/groups/utils/chsh index a630a7733..e3581be31 100644 --- a/apparmor.d/groups/utils/chsh +++ b/apparmor.d/groups/utils/chsh @@ -15,7 +15,6 @@ profile chsh @{exec_path} { include include include - include #aa:only RBAC capability audit_write, capability chown, From 5ae1cc854da90f275ea6144d60a587e98bec461b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:20:13 +0200 Subject: [PATCH 1009/1455] fix(profile): pacman: add integration witn limine. fix #756 --- apparmor.d/groups/pacman/pacman | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 14753416f..e72c62667 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -81,6 +81,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/killall rix, @{sbin}/ldconfig rix, @{sbin}/locale-gen rPx, + @{bin}/limine-install rPUx, @{bin}/mkinitcpio rPx, @{sbin}/needrestart rPx, @{bin}/pacdiff rPx, From b88cf164ec5c3b8764068911f93cb240c7c19620 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:38:37 +0200 Subject: [PATCH 1010/1455] feat(profile): gnome-shell: allow some basic tools needed by some extensions. fix #705 --- apparmor.d/groups/gnome/gnome-shell | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 1099f254d..b97d6d568 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -170,6 +170,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/gjs-console rPx, @{bin}/glib-compile-schemas rPx, @{bin}/ibus-daemon rPx, + @{bin}/sensors rPx, @{bin}/tecla rPx, @{bin}/Xwayland rPx, @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @@ -386,8 +387,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sh_path} mr, - @{bin}/pmap rix, - @{bin}/grep rix, + @{bin}/cat rix, + @{bin}/grep rix, + @{bin}/kmod rPx -> gnome-shell//lsmod, + @{bin}/pmap rix, @{sys}/devices/system/node/ r, @@ -400,6 +403,15 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include if exists } + profile lsmod flags=(attach_disconnected,mediate_deleted) { + include + include + + @{sys}/module/{,**} r, + + include if exists + } + profile pkexec { include include From 8fa7c49a6512c3e3a3b6171f64159273e894f9b6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:42:11 +0200 Subject: [PATCH 1011/1455] feat(profile): add firefox crashhelper --- apparmor.d/abstractions/app/firefox | 1 + .../groups/browsers/firefox-crashhelper | 26 +++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 apparmor.d/groups/browsers/firefox-crashhelper diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 73cb82070..1ea0c3b86 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -58,6 +58,7 @@ @{lib_dirs}/{,**} r, @{lib_dirs}/*.so mr, + @{lib_dirs}/crashhelper rPx, @{lib_dirs}/crashreporter rPx, @{lib_dirs}/minidump-analyzer rPx, @{lib_dirs}/pingsender rPx, diff --git a/apparmor.d/groups/browsers/firefox-crashhelper b/apparmor.d/groups/browsers/firefox-crashhelper new file mode 100644 index 000000000..55443a330 --- /dev/null +++ b/apparmor.d/groups/browsers/firefox-crashhelper @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{name} = firefox{,.sh,-esr,-bin} +@{lib_dirs} = @{lib}/@{name} /opt/@{name} +@{config_dirs} = @{HOME}/.mozilla/ +@{cache_dirs} = @{user_cache_dirs}/mozilla/ + +@{exec_path} = @{lib_dirs}/crashhelper +profile firefox-crashhelper @{exec_path} { + include + + @{exec_path} mr, + + owner "@{config_dirs}/firefox/Crash Reports/" rw, + owner "@{config_dirs}/firefox/Crash Reports/crash_helper_server.log" rw, + + include if exists +} + +# vim:syntax=apparmor From 011de3c301600addf6cc9ab763f61b378302c0f8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:48:16 +0200 Subject: [PATCH 1012/1455] feat(profile): flatpak: ensure remote can be added/removed. see #690 --- apparmor.d/groups/flatpak/flatpak | 2 ++ apparmor.d/groups/flatpak/flatpak-system-helper | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index 52e9e32ef..c34ae962f 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -96,6 +96,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain owner @{tmp}/#@{int} rw, owner @{tmp}/ostree-gpg-@{rand6}/{,**} rw, + owner @{tmp}/remote-summary-sig.@{rand6} rw, + owner @{tmp}/remote-summary.@{rand6} rw, owner /dev/shm/flatpak*/{,**} rw, @{run}/.userns r, diff --git a/apparmor.d/groups/flatpak/flatpak-system-helper b/apparmor.d/groups/flatpak/flatpak-system-helper index dfaa920ac..1381a1483 100644 --- a/apparmor.d/groups/flatpak/flatpak-system-helper +++ b/apparmor.d/groups/flatpak/flatpak-system-helper @@ -40,7 +40,7 @@ profile flatpak-system-helper @{exec_path} { /etc/flatpak/{,**} r, /etc/machine-id r, - /usr/share/flatpak/remotes.d/ r, + /usr/share/flatpak/remotes.d/{,**} r, /usr/share/flatpak/triggers/ r, /usr/share/mime/mime.cache r, @@ -51,8 +51,8 @@ profile flatpak-system-helper @{exec_path} { owner /{var/,}tmp/ostree-gpg-@{rand6}/ rw, owner @{tmp}/ostree-gpg-@{rand6}/** rwkl -> /tmp/ostree-gpg-@{rand6}/**, - /tmp/remote-summary-sig.@{rand6} r, - /tmp/remote-summary.@{rand6} r, + @{tmp}/remote-summary-sig.@{rand6} r, + @{tmp}/remote-summary.@{rand6} r, @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/fd/ r, From 34f9a53a3bb8e4ab7a20127631765960ef012f29 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 22:53:36 +0200 Subject: [PATCH 1013/1455] ci: start dropping ci tests on ubuntu 22.04. --- .github/workflows/main.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 4baa4a776..cac8fce43 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -23,8 +23,6 @@ jobs: mode: default - os: ubuntu-24.04 mode: full-system-policy - - os: ubuntu-22.04 - mode: default steps: - name: Check out repository code uses: actions/checkout@v4 From eeebcf91f3b374d2ac83fd40b9c5e7d2bace1cdf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 23:05:50 +0200 Subject: [PATCH 1014/1455] feat(abs): add base-strict. For now, it is only a restructuring of the base abstraction with awareness of the apparmor.d architecture. --- apparmor.d/abstractions/base-strict | 131 ++++++++++++++++++++++ apparmor.d/abstractions/crypto.d/complete | 8 ++ apparmor.d/abstractions/glibc | 41 +++++++ apparmor.d/abstractions/ld | 23 ++++ apparmor.d/abstractions/locale | 26 +++++ 5 files changed, 229 insertions(+) create mode 100644 apparmor.d/abstractions/base-strict create mode 100644 apparmor.d/abstractions/glibc create mode 100644 apparmor.d/abstractions/ld create mode 100644 apparmor.d/abstractions/locale diff --git a/apparmor.d/abstractions/base-strict b/apparmor.d/abstractions/base-strict new file mode 100644 index 000000000..0f4382bfe --- /dev/null +++ b/apparmor.d/abstractions/base-strict @@ -0,0 +1,131 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only +# LOGPROF-SUGGEST: no + + # Do not use it manually, It automatically replaces the base abstraction in + # profiles when the re-attached mode is enabled. + + # For now, it is only a restructuring of the base abstraction with awareness + # of the apparmor.d architecture. + + abi , + + include + include + include + include + + # Allow us to signal ourselves + signal peer=@{profile_name}, + + # Checking for PID existence is quite common so add it by default for now + signal (receive, send) set=exists, + + #aa:exclude RBAC + # Allow unconfined processes to send us signals by default + signal receive peer=unconfined, + + # Systemd: allow to receive any signal from the systemd profiles stack + signal receive peer=@{p_systemd}, + signal receive peer=@{p_systemd_user}, + + # Htop like programs can send any signal to any process + signal receive peer=btop, + signal receive peer=htop, + signal receive peer=top, + signal receive set=(cont,term,kill,stop) peer=gnome-system-monitor, + + # Allow to receive termination signal from manager such as sudo, login, shutdown or systemd + signal receive peer=su, + signal receive peer=sudo, + signal receive set=(cont,term,kill,stop) peer=gnome-shell, + signal receive set=(cont,term,kill,stop) peer=login, + signal receive set=(cont,term,kill,stop) peer=openbox, + signal receive set=(cont,term,kill,stop) peer=systemd-shutdown, + signal receive set=(cont,term,kill,stop) peer=xinit, + + # Allow other processes to read our /proc entries, futexes, perf tracing and + # kcmp for now (they will need 'read' in the first place). Administrators can + # override with: + # deny ptrace readby ... + ptrace readby, + + # Allow other processes to trace us by default (they will need 'trace' in + # the first place). Administrators can override with: + # deny ptrace tracedby ... + ptrace tracedby, + + # Allow us to ptrace read ourselves + ptrace read peer=@{profile_name}, + + # Allow us to create and use abstract and anonymous sockets + unix peer=(label=@{profile_name}), + + # Allow unconfined processes to us via unix sockets + unix receive peer=(label=unconfined), + + # Allow communication to children profiles + signal peer=@{profile_name}//*, + unix type=stream peer=(label=@{profile_name}//*), + + # Allow us to create abstract and anonymous sockets + unix create, + + # Allow us to getattr, getopt, setop and shutdown on unix sockets + unix (getattr, getopt, setopt, shutdown), + + # Allow all programs to use common libraries + @{lib}/** r, + @{lib}/**.so* m, + @{lib}/@{multiarch}/**.so* m, + @{lib}/@{multiarch}/** r, + + # Some applications will display license information + /usr/share/common-licenses/** r, + + # Allow access to the uuidd daemon (this daemon is a thin wrapper around + # time and getrandom()/{,u}random and, when available, runs under an + # unprivilged, dedicated user). + @{run}/uuidd/request r, + + # Transparent hugepage support + @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, + + # Systemd's equivalent of /dev/log + @{run}/systemd/journal/dev-log w, + + # Systemd native journal API (see sd_journal_print(4)) + @{run}/systemd/journal/socket w, + + # Nested containers and anything using systemd-cat need this. 'r' shouldn't + # be required but applications fail without it. journald doesn't leak + # anything when reading so this is ok. + @{run}/systemd/journal/stdout rw, + + # Allow determining the highest valid capability of the running kernel + @{PROC}/sys/kernel/cap_last_cap r, + + # Controls how core dump files are named + @{PROC}/sys/kernel/core_pattern r, + + # Sometimes used to determine kernel/user interfaces to use + @{PROC}/sys/kernel/version r, + + # Harmless and frequently used + /dev/null rw, + /dev/random r, + /dev/urandom r, + /dev/zero rw, + + # The __canary_death_handler function writes a time-stamped log + # message to /dev/log for logging by syslogd. So, /dev/log, timezones, + # and localisations of date should be available EVERYWHERE, so + # StackGuard, FormatGuard, etc., alerts can be properly logged. + /dev/log w, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/crypto.d/complete b/apparmor.d/abstractions/crypto.d/complete index a163af66d..8fb84d261 100644 --- a/apparmor.d/abstractions/crypto.d/complete +++ b/apparmor.d/abstractions/crypto.d/complete @@ -4,7 +4,15 @@ include + # FIPS-140-2 versions of some crypto libraries need to access their + # associated integrity verification file, or they will abort. + @{lib}/.lib*.so*.hmac r, + @{lib}/@{multiarch}/.lib*.so*.hmac r, + @{etc_ro}/gnutls/config r, @{etc_ro}/gnutls/pkcs11.conf r, + # Used to determine if Linux is running in FIPS mode + @{PROC}/sys/crypto/fips_enabled r, + # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/glibc b/apparmor.d/abstractions/glibc new file mode 100644 index 000000000..aa6e14416 --- /dev/null +++ b/apparmor.d/abstractions/glibc @@ -0,0 +1,41 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + # Used by Glibc when binding to ephemeral ports + @{etc_ro}/bindresvport.blacklist r, + + # Depending on which Glibc routine uses this file, base may not be the + # best place -- but many profiles require it, and it is quite harmless. + @{PROC}/sys/kernel/ngroups_max r, + + # Glibc's sysconf(3) routine to determine free memory, etc + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/online r, + @{sys}/devices/system/cpu/possible r, + @{PROC}/cpuinfo r, + @{PROC}/meminfo r, + @{PROC}/stat r, + + # Glibc's *printf protections read the maps file + @{PROC}/@{pid}/auxv r, + @{PROC}/@{pid}/maps r, + @{PROC}/@{pid}/status r, + + # Glibc statvfs + @{PROC}/filesystems r, + + # Glibc malloc (man 5 proc) + @{PROC}/sys/vm/overcommit_memory r, + + # Recent glibc uses /dev/full in preference to /dev/null for programs + # that don't have open fds at exec() + /dev/full rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/ld b/apparmor.d/abstractions/ld new file mode 100644 index 000000000..21ac745e2 --- /dev/null +++ b/apparmor.d/abstractions/ld @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + # ld.so.cache and ld are used to load shared libraries. + # As such, they can be used everywhere + + abi , + + /opt/*-linux-uclibc/lib/ld-uClibc*so* mr, + + @{etc_ro}/ld.so.cache mr, + @{etc_ro}/ld.so.conf r, + @{etc_ro}/ld.so.conf.d/ r, + @{etc_ro}/ld.so.conf.d/*.conf r, + @{etc_ro}/ld.so.preload r, + @{etc_ro}/ld-musl-*.path r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/locale b/apparmor.d/abstractions/locale new file mode 100644 index 000000000..873c303f5 --- /dev/null +++ b/apparmor.d/abstractions/locale @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + @{etc_ro}/locale.alias r, + @{etc_ro}/locale.conf r, + @{etc_ro}/locale/** r, + @{etc_ro}/localtime r, + @{etc_rw}/localtime r, + + /usr/share/**/locale/** r, + /usr/share/locale-bundle/** r, + /usr/share/locale-langpack/** r, + /usr/share/locale/ r, + /usr/share/locale/** r, + /usr/share/X11/locale/** r, + /usr/share/zoneinfo{,-icu}/ r, + /usr/share/zoneinfo{,-icu}/** r, + + include if exists + +# vim:syntax=apparmor From 7dd860f2770ea0f7668e891ac7c59e2dc4808cee Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 23:15:07 +0200 Subject: [PATCH 1015/1455] feat(profile): minor update & cosmetic. --- apparmor.d/abstractions/app/firefox | 4 +++- apparmor.d/abstractions/common/game | 4 ++-- apparmor.d/groups/apparmor/aa-log | 2 -- apparmor.d/groups/apparmor/aa-status | 4 ++-- apparmor.d/groups/bluetooth/bluetoothd | 3 ++- apparmor.d/groups/bluetooth/obexd | 2 ++ apparmor.d/groups/gnome/evolution-calendar-factory | 4 ++-- apparmor.d/groups/gnome/gnome-initial-setup | 2 +- apparmor.d/groups/gnome/gsd-color | 2 +- .../groups/gnome/org.gnome.NautilusPreviewer | 1 + apparmor.d/groups/grub/grub-mkconfig | 2 +- apparmor.d/groups/kde/ksmserver-logout-greeter | 1 - apparmor.d/groups/ssh/sshd | 8 +++++--- .../systemd-generators/systemd-generator-ssh | 4 ++++ .../systemd-generators/systemd-generator-tpm2 | 1 + apparmor.d/groups/systemd/systemd-localed | 1 + apparmor.d/groups/utils/lspci | 4 ---- apparmor.d/profiles-a-f/fwupd | 1 + apparmor.d/profiles-g-l/haveged | 7 +++---- apparmor.d/profiles-g-l/linuxqq | 2 +- apparmor.d/profiles-m-r/mandb | 8 ++++---- apparmor.d/profiles-m-r/mimetype | 1 - apparmor.d/profiles-m-r/needrestart-notify | 2 +- apparmor.d/profiles-m-r/pam-auth-update | 3 ++- apparmor.d/profiles-m-r/pcscd | 14 +++++++------- 25 files changed, 47 insertions(+), 40 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 1ea0c3b86..d988f608c 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -26,7 +26,7 @@ include include include - include + include include include include @@ -126,6 +126,8 @@ @{sys}/devices/**/uevent r, @{sys}/devices/power/events/energy-* r, @{sys}/devices/power/type r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/product_sku r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/**/cpu.max r, diff --git a/apparmor.d/abstractions/common/game b/apparmor.d/abstractions/common/game index 3b4a982f1..6b97b014c 100644 --- a/apparmor.d/abstractions/common/game +++ b/apparmor.d/abstractions/common/game @@ -6,9 +6,9 @@ # wine, proton, game launchers should use this abstraction. # This abstraction uses the following tunables: -# - @{XDG_GAMESSTUDIO_DIR} for game studio and game engines specific directories +# - @{XDG_GAMESSTUDIO_DIR}/ for game studio and game engines specific directories # (Default: @{XDG_GAMESSTUDIO_DIR}="unity3d") -# - @{user_games_dirs} for user specific game directories (eg: steam storage dir) +# - @{user_games_dirs}/ for user specific game directories (eg: steam storage dir) abi , diff --git a/apparmor.d/groups/apparmor/aa-log b/apparmor.d/groups/apparmor/aa-log index 03352e8bf..1a3e0aeff 100644 --- a/apparmor.d/groups/apparmor/aa-log +++ b/apparmor.d/groups/apparmor/aa-log @@ -21,8 +21,6 @@ profile aa-log @{exec_path} { /var/log/audit/* r, /var/log/syslog* r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - /dev/tty@{int} rw, profile journalctl { diff --git a/apparmor.d/groups/apparmor/aa-status b/apparmor.d/groups/apparmor/aa-status index 17de74439..9badb78c1 100644 --- a/apparmor.d/groups/apparmor/aa-status +++ b/apparmor.d/groups/apparmor/aa-status @@ -22,8 +22,8 @@ profile aa-status @{exec_path} { @{sys}/module/apparmor/parameters/enabled r, @{PROC}/ r, - @{PROC}/@{pids}/attr/apparmor/current r, - @{PROC}/@{pids}/attr/current r, + @{PROC}/@{pid}/attr/apparmor/current r, + @{PROC}/@{pid}/attr/current r, owner @{PROC}/@{pid}/mounts r, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/bluetooth/bluetoothd b/apparmor.d/groups/bluetooth/bluetoothd index 8ca699aaf..aa84eebd9 100644 --- a/apparmor.d/groups/bluetooth/bluetoothd +++ b/apparmor.d/groups/bluetooth/bluetoothd @@ -45,7 +45,8 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) { @{run}/sdp rw, owner @{run}/systemd/notify w, - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + + @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard @{sys}/devices/@{pci}/rfkill@{int}/name r, @{sys}/devices/@{pci}/**/{uevent,name} r, diff --git a/apparmor.d/groups/bluetooth/obexd b/apparmor.d/groups/bluetooth/obexd index 5c1a7633e..efb5f42e4 100644 --- a/apparmor.d/groups/bluetooth/obexd +++ b/apparmor.d/groups/bluetooth/obexd @@ -31,6 +31,8 @@ profile obexd @{exec_path} { owner @{HOME}/bluetooth/* rw, + @{run}/systemd/users/@{uid} r, + include if exists } diff --git a/apparmor.d/groups/gnome/evolution-calendar-factory b/apparmor.d/groups/gnome/evolution-calendar-factory index 25f8ecc7f..fba734ad4 100644 --- a/apparmor.d/groups/gnome/evolution-calendar-factory +++ b/apparmor.d/groups/gnome/evolution-calendar-factory @@ -71,8 +71,8 @@ profile evolution-calendar-factory @{exec_path} { owner @{user_cache_dirs}/evolution/tasks/{,**} rwk, owner @{user_share_dirs}/evolution/calendar/{,**} rwk, - owner @{user_share_dirs}/evolution/tasks/system/ w, - owner @{user_share_dirs}/evolution/tasks/system/tasks.ics* rw, + owner @{user_share_dirs}/evolution/memos/system/{,**} rw, + owner @{user_share_dirs}/evolution/tasks/system/{,**} rw, owner @{user_share_dirs}/gvfs-metadata/{,*} r, @{PROC}/sys/kernel/osrelease r, diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index 4063fc473..40b8bc9b5 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -42,7 +42,7 @@ profile gnome-initial-setup @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/locale rix, @{bin}/lscpu rPx, - @{bin}/lspci rPx, + @{bin}/lspci rPx, @{bin}/xrandr rPx, @{lib}/gnome-initial-setup-goa-helper rix, diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 56445aeac..1b12a68cd 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -45,7 +45,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_share_dirs}/icc/ rw, - owner @{gdm_share_dirs}/icc/edid-@{hex32}icc rw, + owner @{gdm_share_dirs}/icc/edid-@{hex32}.icc rw, owner @{user_share_dirs}/icc/ rw, owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw, diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index db440bf4c..f084e7b12 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -39,6 +39,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.* r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.NautilusPreviewer.slice/*/memory.* r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r, diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index de8643100..87c3d4104 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/grub-mkconfig +@{exec_path} = @{sbin}/grub-mkconfig @{sbin}/grub2-mkconfig profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/kde/ksmserver-logout-greeter b/apparmor.d/groups/kde/ksmserver-logout-greeter index 01fe51783..67e56c3c6 100644 --- a/apparmor.d/groups/kde/ksmserver-logout-greeter +++ b/apparmor.d/groups/kde/ksmserver-logout-greeter @@ -53,7 +53,6 @@ profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/dev/i915/perf_stream_paranoid r, owner @{PROC}/@{pid}/exe r, - owner @{PROC}/@{pid}/status r, include if exists } diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index cc12a9eec..a514e7c99 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -29,8 +29,8 @@ profile sshd @{exec_path} flags=(attach_disconnected) { capability audit_write, capability chown, - capability dac_read_search, capability dac_override, + capability dac_read_search, capability fowner, capability kill, capability net_bind_service, @@ -50,9 +50,11 @@ profile sshd @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network netlink raw, - signal (receive) set=(hup) peer=@{p_systemd}, + unix type=stream peer=(label=sshd-session), - ptrace (read,trace) peer=@{p_systemd}, + signal receive set=hup peer=@{p_systemd}, + + ptrace (read trace) peer=@{p_systemd}, dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-ssh b/apparmor.d/groups/systemd-generators/systemd-generator-ssh index efb56468e..0f6aa11d9 100644 --- a/apparmor.d/groups/systemd-generators/systemd-generator-ssh +++ b/apparmor.d/groups/systemd-generators/systemd-generator-ssh @@ -30,8 +30,12 @@ profile systemd-generator-ssh @{exec_path} flags=(attach_disconnected) { @{run}/systemd/system/ r, @{run}/systemd/transient/ r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/product_version r, @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{sys}/firmware/dmi/entries/*/raw r, @{PROC}/@{pid}/cgroup r, @{PROC}/1/cgroup r, diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-tpm2 b/apparmor.d/groups/systemd-generators/systemd-generator-tpm2 index 4d601d0f9..ee5d924cc 100644 --- a/apparmor.d/groups/systemd-generators/systemd-generator-tpm2 +++ b/apparmor.d/groups/systemd-generators/systemd-generator-tpm2 @@ -15,6 +15,7 @@ profile systemd-generator-tpm2 @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sys}/class/tpmrm/ r, + @{sys}/devices/**/tpm/tpm@{int}/tpm_version_major r, @{PROC}/@{pid}/cgroup r, @{PROC}/1/cgroup r, diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index 75d382c40..104a141ce 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -21,6 +21,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, /usr/share/kbd/keymaps/{,**} r, + /usr/share/xkeyboard-config-2/{,**} r, /usr/share/systemd/*-map r, /usr/share/X11/xkb/{,**} r, /usr/share/xkeyboard-config-2/{,**} r, diff --git a/apparmor.d/groups/utils/lspci b/apparmor.d/groups/utils/lspci index b390346bb..0ae22a03a 100644 --- a/apparmor.d/groups/utils/lspci +++ b/apparmor.d/groups/utils/lspci @@ -13,12 +13,8 @@ profile lspci @{exec_path} flags=(attach_disconnected) { include include - capability sys_admin, - @{exec_path} mr, - /app/lib/libzypak-preload-host*.so rm, - /usr/share/hwdata/pci.ids r, /usr/share/misc/pci.ids r, /usr/share/misc/pci.ids.gz r, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 5fb948234..961b55c97 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -52,6 +52,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /usr/share/hwdata/* r, /usr/share/libdrm/*.ids r, /usr/share/mime/mime.cache r, + /usr/share/misc/*.ids r, /etc/fwupd/{,**} rw, /etc/lsb-release r, diff --git a/apparmor.d/profiles-g-l/haveged b/apparmor.d/profiles-g-l/haveged index 5773a73fb..527629202 100644 --- a/apparmor.d/profiles-g-l/haveged +++ b/apparmor.d/profiles-g-l/haveged @@ -20,10 +20,9 @@ profile haveged @{exec_path} { @{sys}/devices/system/cpu/cpu@{int}/cache/ r, @{sys}/devices/system/cpu/cpu@{int}/cache/index*/{type,size,level} r, - @{PROC}/sys/kernel/osrelease r, - @{PROC}/sys/kernel/random/poolsize r, - @{PROC}/sys/kernel/random/write_wakeup_threshold w, - owner @{PROC}/@{pid}/status r, + @{PROC}/sys/kernel/osrelease r, + @{PROC}/sys/kernel/random/poolsize r, + @{PROC}/sys/kernel/random/write_wakeup_threshold w, /dev/random w, diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 3f3134400..dd653bd61 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -29,7 +29,7 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, @{sh_path} r, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{lib_dirs}/chrome_crashpad_handler ix, @{lib_dirs}/resources/app/{,**} m, @{open_path} rPx -> child-open-strict, diff --git a/apparmor.d/profiles-m-r/mandb b/apparmor.d/profiles-m-r/mandb index 4826337d0..cd825471d 100644 --- a/apparmor.d/profiles-m-r/mandb +++ b/apparmor.d/profiles-m-r/mandb @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/mandb -profile mandb @{exec_path} flags=(complain) { +profile mandb @{exec_path} { include include include @@ -20,9 +20,6 @@ profile mandb @{exec_path} flags=(complain) { /etc/man_db.conf r, /etc/manpath.config r, - /var/cache/man/ r, - /var/cache/man/** rwk, - /usr/share/man/{,**} r, /usr/local/man/{,**} r, /usr/local/share/man/{,**} r, @@ -32,6 +29,9 @@ profile mandb @{exec_path} flags=(complain) { /usr/share/**/man/man@{u8}/*.@{int}.gz r, + owner /var/cache/man/ rw, + owner /var/cache/man/** rwk, + owner @{user_share_dirs}/man/** rwk, include if exists diff --git a/apparmor.d/profiles-m-r/mimetype b/apparmor.d/profiles-m-r/mimetype index d6823da9b..cf8431c7a 100644 --- a/apparmor.d/profiles-m-r/mimetype +++ b/apparmor.d/profiles-m-r/mimetype @@ -13,7 +13,6 @@ profile mimetype @{exec_path} { include @{exec_path} r, - /usr/bin/perl r, /usr/share/mime/**.xml r, /usr/share/mime/globs r, diff --git a/apparmor.d/profiles-m-r/needrestart-notify b/apparmor.d/profiles-m-r/needrestart-notify index 41fa96c4c..9b3525fa5 100644 --- a/apparmor.d/profiles-m-r/needrestart-notify +++ b/apparmor.d/profiles-m-r/needrestart-notify @@ -13,7 +13,7 @@ profile needrestart-notify @{exec_path} { capability dac_read_search, capability sys_ptrace, - ptrace read peer=unconfined, + ptrace read, @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/pam-auth-update b/apparmor.d/profiles-m-r/pam-auth-update index 90cc6a4ba..947fb2f4e 100644 --- a/apparmor.d/profiles-m-r/pam-auth-update +++ b/apparmor.d/profiles-m-r/pam-auth-update @@ -14,8 +14,9 @@ profile pam-auth-update @{exec_path} flags=(complain) { @{exec_path} mrix, - @{bin}/md5sum ix, @{bin}/cp ix, + @{bin}/md5sum ix, + @{bin}/stty ix, /usr/share/pam{,-configs}/{,*} r, diff --git a/apparmor.d/profiles-m-r/pcscd b/apparmor.d/profiles-m-r/pcscd index 67e0ee74e..d5bcc4293 100644 --- a/apparmor.d/profiles-m-r/pcscd +++ b/apparmor.d/profiles-m-r/pcscd @@ -16,13 +16,13 @@ profile pcscd @{exec_path} { network netlink raw, - ptrace (read) peer=@{p_systemd_user}, - ptrace (read) peer=gsd-smartcard, - ptrace (read) peer=keepassxc, - ptrace (read) peer=pkcs11-register, - ptrace (read) peer=rngd, - ptrace (read) peer=scdaemon, - ptrace (read) peer=veracrypt, + ptrace read peer=@{p_systemd_user}, + ptrace read peer=gsd-smartcard, + ptrace read peer=keepassxc, + ptrace read peer=pkcs11-register, + ptrace read peer=rngd, + ptrace read peer=scdaemon, + ptrace read peer=veracrypt, @{exec_path} mr, From 1118d2ffc5bdde1def44447be76715d55f10bd5a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 23:17:45 +0200 Subject: [PATCH 1016/1455] build: use the base-strict abstraction automatically. --- apparmor.d/abstractions/attached/base | 6 +++--- pkg/prebuild/builder/attach.go | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index 4c35d915d..e394c5b99 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -8,14 +8,14 @@ abi , - include + include @{att}/@{run}/systemd/journal/dev-log w, @{att}/@{run}/systemd/journal/socket w, @{att}/@{run}/systemd/journal/stdout rw, - deny /apparmor/.null rw, - deny @{att}/apparmor/.null rw, + /apparmor/.null rw, + @{att}/apparmor/.null rw, include if exists diff --git a/pkg/prebuild/builder/attach.go b/pkg/prebuild/builder/attach.go index f7f0c9bed..aeafcbf7d 100644 --- a/pkg/prebuild/builder/attach.go +++ b/pkg/prebuild/builder/attach.go @@ -49,6 +49,10 @@ func (b ReAttach) Apply(opt *Option, profile string) (string, error) { } else { insert = "@{att} = /\n" + profile = strings.ReplaceAll(profile, + "include ", + "include ", + ) } return strings.Replace(profile, origin, insert+origin, 1), nil From 390a8b1b011dbb335c1054ea5124a02423925da2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 23:20:03 +0200 Subject: [PATCH 1017/1455] build: add the fsp-debug build command. --- Justfile | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/Justfile b/Justfile index 4021b0e5a..109cfed3b 100644 --- a/Justfile +++ b/Justfile @@ -90,6 +90,11 @@ fsp: build fsp-complain: build @./{{build}}/prebuild --complain --full +[group('build')] +[doc('Prebuild the profiles in FSP mode (debug)')] +fsp-debug: build + @./{{build}}/prebuild --complain --full --debug + [group('build')] [doc('Install prebuild profiles')] install: @@ -312,13 +317,13 @@ integration dist flavor: @bats --recursive --timing --print-output-on-failure Projects/integration/ -[group('internal')] +[private] get_ip dist flavor: @virsh --quiet --readonly {{c}} domifaddr {{prefix}}{{dist}}-{{flavor}} | \ head -1 | \ grep -E -o '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}' -[group('internal')] +[private] get_osinfo dist: #!/usr/bin/env python3 osinfo = { From d01b7ce7d6e0a701e59c9eb3adf780cefb7935b0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 16 Jun 2025 23:42:30 +0200 Subject: [PATCH 1018/1455] chore: cleanup linter issue. --- apparmor.d/abstractions/base-strict | 2 +- pkg/aa/apparmor_test.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/base-strict b/apparmor.d/abstractions/base-strict index 0f4382bfe..818a4937f 100644 --- a/apparmor.d/abstractions/base-strict +++ b/apparmor.d/abstractions/base-strict @@ -8,7 +8,7 @@ # Do not use it manually, It automatically replaces the base abstraction in # profiles when the re-attached mode is enabled. - # For now, it is only a restructuring of the base abstraction with awareness + # For now, it is only a restructuring of the base abstraction with awareness # of the apparmor.d architecture. abi , diff --git a/pkg/aa/apparmor_test.go b/pkg/aa/apparmor_test.go index 71be0ba0a..172cfc2b5 100644 --- a/pkg/aa/apparmor_test.go +++ b/pkg/aa/apparmor_test.go @@ -223,11 +223,11 @@ func TestAppArmorProfileFile_Integration(t *testing.T) { &Include{IfExists: true, IsMagic: true, Path: "local/aa-status"}, &Capability{Names: []string{"dac_read_search"}}, &File{Path: "@{exec_path}", Access: []string{"m", "r"}}, - &File{Path: "@{PROC}/@{pids}/attr/apparmor/current", Access: []string{"r"}}, + &File{Path: "@{PROC}/@{pid}/attr/apparmor/current", Access: []string{"r"}}, &File{Path: "@{PROC}/", Access: []string{"r"}}, &File{Path: "@{sys}/module/apparmor/parameters/enabled", Access: []string{"r"}}, &File{Path: "@{sys}/kernel/security/apparmor/profiles", Access: []string{"r"}}, - &File{Path: "@{PROC}/@{pids}/attr/current", Access: []string{"r"}}, + &File{Path: "@{PROC}/@{pid}/attr/current", Access: []string{"r"}}, &Include{IsMagic: true, Path: "abstractions/consoles"}, &File{Owner: true, Path: "@{PROC}/@{pid}/mounts", Access: []string{"r"}}, &Include{IsMagic: true, Path: "abstractions/base"}, From fc45e5ee66b7b9b2c3d0c15fd095991b591a2313 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 17 Jun 2025 00:18:39 +0200 Subject: [PATCH 1019/1455] feat(fsp): add initial sd-umount. --- apparmor.d/groups/_full/sd-umount | 34 +++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 apparmor.d/groups/_full/sd-umount diff --git a/apparmor.d/groups/_full/sd-umount b/apparmor.d/groups/_full/sd-umount new file mode 100644 index 000000000..e5d67f0a9 --- /dev/null +++ b/apparmor.d/groups/_full/sd-umount @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Part of the systemd (as PID 1) profile. + +# sd-umount is a subprofile of sd responsible to handle unmounting operation. + +# Only use this profile with a fully configured system. Otherwise it **WILL** +# break your computer. See https://apparmor.pujol.io/full-system-policy/. + +# Distributions and other programs can add rules in the usr/sd-umount.d directory + +abi , + +include + +@{exec_path} = @{bin}/umount +profile sd-umount flags=(complain) { + include + + capability sys_admin, + + umount @{efi}, + + @{exec_path} mr, + + @{PROC}/@{pid}/mountinfo r, + + include if exists + include if exists +} + +# vim:syntax=apparmor From 0478e62f56d238d82e873b4174645597249ade77 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 17 Jun 2025 00:19:43 +0200 Subject: [PATCH 1020/1455] feat(fsp): sd/sdu: improve integration with stacked profiles. --- apparmor.d/groups/_full/sd | 5 +++-- apparmor.d/groups/_full/sdu | 16 ++++++++++++++-- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd index 44b3a9b7d..48172638e 100644 --- a/apparmor.d/groups/_full/sd +++ b/apparmor.d/groups/_full/sd @@ -165,6 +165,7 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) { @{lib}/{,**} r, @{sbin}/{,*} r, /usr/share/** r, + /etc/*/ w, /etc/** rk, /home/ r, @@ -181,8 +182,8 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) { /var/log/** rw, /var/log/journal/** rwl -> /var/log/journal/**, - @{desktop_share_dirs}/icc/edid-@{hex32}.icc r, - @{user_share_dirs}/icc/edid-@{hex32}.icc r, + @{att}/@{desktop_share_dirs}/icc/edid-@{hex32}.icc r, + @{att}/@{user_share_dirs}/icc/edid-@{hex32}.icc r, @{att}/@{run}/systemd/io.systemd.ManagedOOM rw, @{att}/@{run}/systemd/notify rw, diff --git a/apparmor.d/groups/_full/sdu b/apparmor.d/groups/_full/sdu index 411a8c3ad..c9338fd22 100644 --- a/apparmor.d/groups/_full/sdu +++ b/apparmor.d/groups/_full/sdu @@ -24,6 +24,7 @@ profile sdu flags=(attach_disconnected,mediate_deleted) { include include include + include network netlink raw, @@ -71,16 +72,27 @@ profile sdu flags=(attach_disconnected,mediate_deleted) { owner @{run}/user/@{uid}/pipewire-@{int}.lock rwk, owner @{run}/user/@{uid}/pulse/pid rw, - owner @{user_state_dirs}/wireplumber/ r, + owner @{user_state_dirs}/wireplumber/ rw, owner @{user_state_dirs}/wireplumber/stream-properties rw, owner @{user_state_dirs}/wireplumber/stream-properties.@{rand6} rw, @{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{int} r, - @{run}/udev/data/c116:@{int} r, # for ALSA + @{run}/udev/data/c14:@{int} r, # Open Sound System (OSS) + @{run}/udev/data/c81:@{int} r, # For video4linux + @{run}/udev/data/c116:@{int} r, # For ALSA + @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/bus/ r, + @{sys}/bus/media/devices/ r, + @{sys}/devices/@{pci}/video4linux/video@{int}/uevent r, + @{sys}/devices/**/device:*/{,**/}path r, + @{sys}/devices/**/sound/**/pcm_class r, + @{sys}/devices/**/sound/**/uevent r, + @{sys}/devices/system/node/ r, + @{sys}/devices/system/node/node@{int}/meminfo r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/sound/seq/uevent r, From e7f25571d0865cd08bceac7c4e5bba845a8805a2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 17 Jun 2025 00:22:34 +0200 Subject: [PATCH 1021/1455] chore(profile): rename netplan.script to netplan. --- apparmor.d/groups/network/{netplan.script => netplan} | 8 ++++---- apparmor.d/groups/ubuntu/subiquity-console-conf | 2 +- dists/flags/main.flags | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) rename apparmor.d/groups/network/{netplan.script => netplan} (81%) diff --git a/apparmor.d/groups/network/netplan.script b/apparmor.d/groups/network/netplan similarity index 81% rename from apparmor.d/groups/network/netplan.script rename to apparmor.d/groups/network/netplan index 094726865..5855131a8 100644 --- a/apparmor.d/groups/network/netplan.script +++ b/apparmor.d/groups/network/netplan @@ -7,7 +7,7 @@ abi , include @{exec_path} = /usr/share/netplan/netplan.script -profile netplan.script @{exec_path} flags=(attach_disconnected) { +profile netplan @{exec_path} flags=(attach_disconnected) { include include include @@ -33,7 +33,7 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) { @{run}/udev/rules.d/90-netplan.rules rw, @{run}/udev/rules.d/90-netplan.rules.@{rand6} rw, - include if exists + include if exists } profile systemctl { @@ -42,10 +42,10 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) { capability net_admin, - include if exists + include if exists } - include if exists + include if exists } # vim:syntax=apparmor diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index 916279378..840e33cdd 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -38,7 +38,7 @@ profile subiquity-console-conf @{exec_path} { @{sbin}/sshd rPx, @{bin}/snap rPUx, /usr/lib/snapd/snap-recovery-chooser rPUx, - /usr/share/netplan/netplan.script rPUx, # TODO: rPx, + /usr/share/netplan/netplan.script rPx, /usr/share/subiquity/{,**} r, /usr/share/subiquity/console-conf-tui rix, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 77ea8761f..71670d4d7 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -240,7 +240,7 @@ multipathd complain needrestart-hook complain needrestart-notify complain needrestart-restart complain -netplan.script attach_disconnected,complain +netplan attach_disconnected,complain networkctl attach_disconnected,complain networkd-dispatcher complain nm-online complain From 0e4cc45a5b19e7503f51914cda745da46732b449 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Jun 2025 20:03:53 +0200 Subject: [PATCH 1022/1455] tests: simplify sbin check. --- tests/check.sh | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index add9b0685..b1783bf8e 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -353,11 +353,9 @@ check_sbin() { for file in "${files[@]}"; do ( while read -r match; do - if [[ $match =~ (@\{sbin\}/($pattern)) ]]; then - name="${BASH_REMATCH[2]}" - if ! _in_array "$name" "${sbin[@]}"; then - _err compatibility "$file" "contains '@{sbin}/$name' but it is not in sbin.list" - fi + name="${match/\@\{sbin\}\//}" + if ! _in_array "$name" "${sbin[@]}"; then + _err compatibility "$file" "contains '@{sbin}/$name' but it is not in sbin.list" fi done < <(grep --only-matching -E "@\{sbin\}/$pattern" "${file%%:*}") ) & From d2dbf771cc7fb08235b8305afb967053c25a38cb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Jun 2025 23:07:17 +0200 Subject: [PATCH 1023/1455] feat(profiles): ensure we use {,e}grep instead of grep. --- apparmor.d/groups/apt/apt-systemd-daily | 2 +- apparmor.d/groups/apt/dpkg-script-apparmor | 2 +- apparmor.d/groups/browsers/torbrowser-launcher | 2 +- apparmor.d/groups/browsers/torbrowser-start | 2 +- apparmor.d/groups/cron/cron-ntp | 2 +- apparmor.d/groups/cron/cron-popularity-contest | 2 +- apparmor.d/groups/cups/cupsd | 2 +- apparmor.d/groups/display-manager/xdm-xsession | 2 +- apparmor.d/groups/filesystem/lvmpolld | 2 +- apparmor.d/groups/freedesktop/plymouth-set-default-theme | 2 +- apparmor.d/groups/gnome/gnome-control-center | 2 +- apparmor.d/groups/gnome/gnome-session | 2 +- apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/kde/kde-powerdevil | 2 +- apparmor.d/groups/kde/startplasma | 2 +- apparmor.d/groups/network/nm-dispatcher | 2 +- apparmor.d/groups/pacman/aurpublish | 2 +- apparmor.d/groups/pacman/pacman-key | 2 +- apparmor.d/groups/ssh/ssh-agent-launch | 2 +- .../groups/systemd-generators/systemd-generator-ds-identify | 2 +- apparmor.d/groups/systemd-service/grub-common.service | 2 +- apparmor.d/groups/systemd/systemd-sleep-grub | 2 +- apparmor.d/groups/ubuntu/cron-ubuntu-fan | 2 +- apparmor.d/groups/ubuntu/subiquity-console-conf | 2 +- apparmor.d/groups/ubuntu/ubuntu-fan-net | 2 +- apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot | 2 +- apparmor.d/groups/whonix/anondate | 2 +- apparmor.d/groups/whonix/pam-info | 2 +- apparmor.d/groups/whonix/rads | 2 +- apparmor.d/groups/whonix/sdwdate | 2 +- apparmor.d/groups/whonix/systemcheck-canary | 2 +- apparmor.d/groups/whonix/torbrowser-wrapper | 2 +- apparmor.d/profiles-a-f/blkdeactivate | 2 +- apparmor.d/profiles-a-f/ddcutil | 2 +- apparmor.d/profiles-a-f/finalrd | 2 +- apparmor.d/profiles-g-l/gpu-manager | 2 +- apparmor.d/profiles-g-l/install-catalog | 2 +- apparmor.d/profiles-g-l/kdump-config | 2 +- apparmor.d/profiles-g-l/landscape-sysinfo.wrapper | 2 +- apparmor.d/profiles-g-l/language-validate | 2 +- apparmor.d/profiles-g-l/libreoffice | 2 +- apparmor.d/profiles-g-l/logrotate | 2 +- apparmor.d/profiles-m-r/modprobed-db | 2 +- apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version | 2 +- apparmor.d/profiles-m-r/pass | 2 +- apparmor.d/profiles-s-z/secure-time-sync | 2 +- apparmor.d/profiles-s-z/spotify | 2 +- apparmor.d/profiles-s-z/syncoid | 2 +- apparmor.d/profiles-s-z/sysstat-sa | 2 +- apparmor.d/profiles-s-z/tlp | 2 +- apparmor.d/profiles-s-z/ucfr | 2 +- apparmor.d/profiles-s-z/update-cracklib | 2 +- apparmor.d/profiles-s-z/veracrypt | 2 +- apparmor.d/profiles-s-z/whatis | 2 +- apparmor.d/profiles-s-z/zed | 2 +- 55 files changed, 55 insertions(+), 55 deletions(-) diff --git a/apparmor.d/groups/apt/apt-systemd-daily b/apparmor.d/groups/apt/apt-systemd-daily index 08e1400b2..bd2f7fbb0 100644 --- a/apparmor.d/groups/apt/apt-systemd-daily +++ b/apparmor.d/groups/apt/apt-systemd-daily @@ -25,7 +25,7 @@ profile apt-systemd-daily @{exec_path} { @{bin}/env rix, @{bin}/find rix, @{bin}/flock rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/gzip rix, @{bin}/ls rix, @{bin}/mv rix, diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index e9a03f282..122e4541e 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -13,7 +13,7 @@ profile dpkg-script-apparmor @{exec_path} { @{exec_path} mrix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/deb-systemd-helper Px, @{bin}/deb-systemd-invoke Px, diff --git a/apparmor.d/groups/browsers/torbrowser-launcher b/apparmor.d/groups/browsers/torbrowser-launcher index 0f6273107..4969a14c3 100644 --- a/apparmor.d/groups/browsers/torbrowser-launcher +++ b/apparmor.d/groups/browsers/torbrowser-launcher @@ -32,7 +32,7 @@ profile torbrowser-launcher @{exec_path} flags=(attach_disconnected) { @{bin}/gpg{,2} Cx -> gpg, @{bin}/gpgconf Cx -> gpg, @{bin}/gpgsm Cx -> gpg, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/sed ix, @{bin}/tail ix, diff --git a/apparmor.d/groups/browsers/torbrowser-start b/apparmor.d/groups/browsers/torbrowser-start index 58bb31ac8..ce6a3678c 100644 --- a/apparmor.d/groups/browsers/torbrowser-start +++ b/apparmor.d/groups/browsers/torbrowser-start @@ -22,7 +22,7 @@ profile torbrowser-start @{exec_path} { @{bin}/expr ix, @{bin}/file ix, @{bin}/getconf ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/id ix, @{bin}/ln ix, @{bin}/mkdir ix, diff --git a/apparmor.d/groups/cron/cron-ntp b/apparmor.d/groups/cron/cron-ntp index 17ab7f745..7221cc6e1 100644 --- a/apparmor.d/groups/cron/cron-ntp +++ b/apparmor.d/groups/cron/cron-ntp @@ -14,7 +14,7 @@ profile cron-ntp @{exec_path} { @{sh_path} rix, @{bin}/cat rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/sed rix, include if exists diff --git a/apparmor.d/groups/cron/cron-popularity-contest b/apparmor.d/groups/cron/cron-popularity-contest index 63a664096..fa6e9874f 100644 --- a/apparmor.d/groups/cron/cron-popularity-contest +++ b/apparmor.d/groups/cron/cron-popularity-contest @@ -18,7 +18,7 @@ profile cron-popularity-contest @{exec_path} { @{bin}/cat rix, @{bin}/date rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/logger rix, @{bin}/mkdir rix, @{bin}/mktemp rix, diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index 6eeeaa414..b3658b738 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -50,7 +50,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { @{bin}/cat rix, @{bin}/chmod rix, @{bin}/cp rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/gs rix, @{bin}/gsc rix, @{bin}/hostname rix, diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index 052180a99..d110fb83b 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -25,7 +25,7 @@ profile xdm-xsession @{exec_path} { @{bin}/fortune rPUx, @{bin}/gpg-agent rPx, @{bin}/gpg-connect-agent rPx, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/locale rix, @{bin}/manpath rix, @{bin}/readlink rix, diff --git a/apparmor.d/groups/filesystem/lvmpolld b/apparmor.d/groups/filesystem/lvmpolld index 4168ad4fe..cce01b0d0 100644 --- a/apparmor.d/groups/filesystem/lvmpolld +++ b/apparmor.d/groups/filesystem/lvmpolld @@ -13,7 +13,7 @@ profile lvmpolld @{exec_path} { include @{exec_path} rm, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/umount rPx, @{run}/lvmpolld.pid rwk, diff --git a/apparmor.d/groups/freedesktop/plymouth-set-default-theme b/apparmor.d/groups/freedesktop/plymouth-set-default-theme index b9b2cfd45..da13572e5 100644 --- a/apparmor.d/groups/freedesktop/plymouth-set-default-theme +++ b/apparmor.d/groups/freedesktop/plymouth-set-default-theme @@ -15,7 +15,7 @@ profile plymouth-set-default-theme @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/{m,g,}awk rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/plymouth rPx, /usr/share/plymouth/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 2f9077d19..85b3268dd 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -67,7 +67,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{bin}/@{shells} rUx, @{bin}/gcm-viewer rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/locale rix, @{bin}/sed rix, @{bin}/tecla rPx, diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index e0ff334db..1f29958d1 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -20,7 +20,7 @@ profile gnome-session @{exec_path} { @{bin}/find rix, @{bin}/gettext rix, @{bin}/gettext.sh r, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/head rix, @{bin}/id rix, @{bin}/locale rix, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index b97d6d568..e977af95e 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -388,7 +388,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sh_path} mr, @{bin}/cat rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/kmod rPx -> gnome-shell//lsmod, @{bin}/pmap rix, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index ebb150ed2..45c382855 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -24,7 +24,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) @{sh_path} rix, @{bin}/find rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/kcminit rPx, @{bin}/sed rix, @{bin}/uname rPx, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index b69d7fdb9..004b89d57 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -21,7 +21,7 @@ profile startplasma @{exec_path} { @{sh_path} rix, @{bin}/env rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/kapplymousetheme rPUx, @{bin}/kdeinit5_shutdown rPUx, @{bin}/ksplashqml rPUx, diff --git a/apparmor.d/groups/network/nm-dispatcher b/apparmor.d/groups/network/nm-dispatcher index 87207e2b7..87a418153 100644 --- a/apparmor.d/groups/network/nm-dispatcher +++ b/apparmor.d/groups/network/nm-dispatcher @@ -42,7 +42,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) { @{bin}/chronyc rPUx, @{bin}/date rix, @{bin}/gawk rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/id rix, @{sbin}/invoke-rc.d rCx -> invoke-rc, @{bin}/logger rix, diff --git a/apparmor.d/groups/pacman/aurpublish b/apparmor.d/groups/pacman/aurpublish index a7a7bf225..df9af9fef 100644 --- a/apparmor.d/groups/pacman/aurpublish +++ b/apparmor.d/groups/pacman/aurpublish @@ -30,7 +30,7 @@ profile aurpublish @{exec_path} { @{bin}/gettext rix, @{bin}/git rPx, @{bin}/gpg{,2} rCx -> gpg, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/makepkg rix, @{bin}/mkdir rix, @{bin}/mktemp rix, diff --git a/apparmor.d/groups/pacman/pacman-key b/apparmor.d/groups/pacman/pacman-key index 287bc026a..025d87b29 100644 --- a/apparmor.d/groups/pacman/pacman-key +++ b/apparmor.d/groups/pacman/pacman-key @@ -22,7 +22,7 @@ profile pacman-key @{exec_path} { @{bin}/chmod rix, @{bin}/gettext rix, @{bin}/gpg{,2} rCx -> gpg, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/ngettext rix, @{bin}/pacman-conf rPx, @{bin}/touch rix, diff --git a/apparmor.d/groups/ssh/ssh-agent-launch b/apparmor.d/groups/ssh/ssh-agent-launch index c9f0c6373..86bd0866f 100644 --- a/apparmor.d/groups/ssh/ssh-agent-launch +++ b/apparmor.d/groups/ssh/ssh-agent-launch @@ -15,7 +15,7 @@ profile ssh-agent-launch @{exec_path} { @{sh_path} rix, @{bin}/dbus-update-activation-environment rCx -> dbus, @{bin}/getopt rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/ssh-agent rPx, /etc/X11/Xsession.options r, diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-ds-identify b/apparmor.d/groups/systemd-generators/systemd-generator-ds-identify index ba6141d86..daa877efe 100644 --- a/apparmor.d/groups/systemd-generators/systemd-generator-ds-identify +++ b/apparmor.d/groups/systemd-generators/systemd-generator-ds-identify @@ -17,7 +17,7 @@ profile systemd-generator-ds-identify @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/systemd-detect-virt rPx, @{bin}/tr rix, @{bin}/uname rix, diff --git a/apparmor.d/groups/systemd-service/grub-common.service b/apparmor.d/groups/systemd-service/grub-common.service index 4abd74fb1..f8cf34f25 100644 --- a/apparmor.d/groups/systemd-service/grub-common.service +++ b/apparmor.d/groups/systemd-service/grub-common.service @@ -14,7 +14,7 @@ profile grub-common.service { include @{sh_path} rix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/grub-editenv rix, @{bin}/mkdir ix, @{bin}/rm ix, diff --git a/apparmor.d/groups/systemd/systemd-sleep-grub b/apparmor.d/groups/systemd/systemd-sleep-grub index b2b42bf44..38be5772f 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-grub +++ b/apparmor.d/groups/systemd/systemd-sleep-grub @@ -14,7 +14,7 @@ profile systemd-sleep-grub @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/uname rix, /etc/sysconfig/bootloader r, diff --git a/apparmor.d/groups/ubuntu/cron-ubuntu-fan b/apparmor.d/groups/ubuntu/cron-ubuntu-fan index 9fd065db3..a80a4f729 100644 --- a/apparmor.d/groups/ubuntu/cron-ubuntu-fan +++ b/apparmor.d/groups/ubuntu/cron-ubuntu-fan @@ -16,7 +16,7 @@ profile cron-ubuntu-fan @{exec_path} { @{sh_path} rix, @{sbin}/fanctl rPx, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/ip rix, @{bin}/mkdir rix, @{bin}/sed rix, diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index 840e33cdd..dc67817ed 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -24,7 +24,7 @@ profile subiquity-console-conf @{exec_path} { @{sh_path} rix, @{bin}/cat rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/ip rix, @{bin}/mkdir rix, @{bin}/mv rix, diff --git a/apparmor.d/groups/ubuntu/ubuntu-fan-net b/apparmor.d/groups/ubuntu/ubuntu-fan-net index f9d7c01f5..74fe83551 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-fan-net +++ b/apparmor.d/groups/ubuntu/ubuntu-fan-net @@ -14,7 +14,7 @@ profile ubuntu-fan-net @{exec_path} { @{sh_path} mr, @{bin}/{m,g,}awk ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/networkctl Px, @{sbin}/fanctl Px, diff --git a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot index 0573f38bf..c244f2902 100644 --- a/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot +++ b/apparmor.d/groups/ubuntu/update-motd-fsck-at-reboot @@ -18,7 +18,7 @@ profile update-motd-fsck-at-reboot @{exec_path} { @{bin}/cat rix, @{bin}/cut rix, @{bin}/date rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/id rix, @{bin}/mount rCx -> mount, @{bin}/stat rix, diff --git a/apparmor.d/groups/whonix/anondate b/apparmor.d/groups/whonix/anondate index 27e4eb594..325535cce 100644 --- a/apparmor.d/groups/whonix/anondate +++ b/apparmor.d/groups/whonix/anondate @@ -19,7 +19,7 @@ profile anondate @{exec_path} { @{bin}/cat rix, @{bin}/cp rix, @{bin}/date rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/minimum-unixtime-show rix, @{bin}/rm rix, @{bin}/systemd-cat rix, diff --git a/apparmor.d/groups/whonix/pam-info b/apparmor.d/groups/whonix/pam-info index 1cc3e7668..23ab3aeb4 100644 --- a/apparmor.d/groups/whonix/pam-info +++ b/apparmor.d/groups/whonix/pam-info @@ -15,7 +15,7 @@ profile pam-info @{exec_path} { @{sh_path} rix, @{sbin}/faillock rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/str_replace rix, @{bin}/wc rix, @{bin}/whoami rix, diff --git a/apparmor.d/groups/whonix/rads b/apparmor.d/groups/whonix/rads index e76570b34..10f30b50b 100644 --- a/apparmor.d/groups/whonix/rads +++ b/apparmor.d/groups/whonix/rads @@ -20,7 +20,7 @@ profile rads @{exec_path} { @{bin}/chvt rix, @{bin}/free rix, @{bin}/gawk rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/mkdir rix, @{bin}/rm rix, @{bin}/sed rix, diff --git a/apparmor.d/groups/whonix/sdwdate b/apparmor.d/groups/whonix/sdwdate index d34f8087c..dbe561ab6 100644 --- a/apparmor.d/groups/whonix/sdwdate +++ b/apparmor.d/groups/whonix/sdwdate @@ -30,7 +30,7 @@ profile sdwdate @{exec_path} flags=(attach_disconnected) { @{bin}/touch rix, @{lib}/helper-scripts/* rix, @{bin}/url_to_unixtime rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{lib}/helper-scripts/ r, @{lib}/sdwdate/ r, diff --git a/apparmor.d/groups/whonix/systemcheck-canary b/apparmor.d/groups/whonix/systemcheck-canary index 4130d9cd9..17bedc43b 100644 --- a/apparmor.d/groups/whonix/systemcheck-canary +++ b/apparmor.d/groups/whonix/systemcheck-canary @@ -14,7 +14,7 @@ profile systemcheck-canary @{exec_path} { @{exec_path} mr, @{bin}/sleep rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/whoami rix, @{bin}/cat rix, @{bin}/date rix, diff --git a/apparmor.d/groups/whonix/torbrowser-wrapper b/apparmor.d/groups/whonix/torbrowser-wrapper index fc20ad0fb..c86d91099 100644 --- a/apparmor.d/groups/whonix/torbrowser-wrapper +++ b/apparmor.d/groups/whonix/torbrowser-wrapper @@ -20,7 +20,7 @@ profile torbrowser-wrapper @{exec_path} { @{bin}/basename ix, @{bin}/cp ix, @{bin}/dirname ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/id ix, @{bin}/mkdir ix, @{bin}/mktemp ix, diff --git a/apparmor.d/profiles-a-f/blkdeactivate b/apparmor.d/profiles-a-f/blkdeactivate index d56782267..83806e753 100644 --- a/apparmor.d/profiles-a-f/blkdeactivate +++ b/apparmor.d/profiles-a-f/blkdeactivate @@ -16,7 +16,7 @@ profile blkdeactivate @{exec_path} flags=(complain) { @{sh_path} rix, @{sbin}/dmsetup rPUx, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/touch rix, @{bin}/lsblk rPx, @{sbin}/lvm rPx, diff --git a/apparmor.d/profiles-a-f/ddcutil b/apparmor.d/profiles-a-f/ddcutil index c752dcbb8..7c353bf65 100644 --- a/apparmor.d/profiles-a-f/ddcutil +++ b/apparmor.d/profiles-a-f/ddcutil @@ -21,7 +21,7 @@ profile ddcutil @{exec_path} { @{bin}/find rix, @{bin}/sed rix, @{bin}/xargs rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, / r, diff --git a/apparmor.d/profiles-a-f/finalrd b/apparmor.d/profiles-a-f/finalrd index d8f2f819e..b22730a27 100644 --- a/apparmor.d/profiles-a-f/finalrd +++ b/apparmor.d/profiles-a-f/finalrd @@ -24,7 +24,7 @@ profile finalrd @{exec_path} { @{bin}/dirname ix, @{bin}/env ix, @{bin}/find ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/ln ix, @{bin}/mkdir ix, @{bin}/mount ix, diff --git a/apparmor.d/profiles-g-l/gpu-manager b/apparmor.d/profiles-g-l/gpu-manager index 795c92f00..779dd8e67 100644 --- a/apparmor.d/profiles-g-l/gpu-manager +++ b/apparmor.d/profiles-g-l/gpu-manager @@ -17,7 +17,7 @@ profile gpu-manager @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, /etc/modprobe.d/{,**} r, /usr/lib/modprobe.d/{,**} r, diff --git a/apparmor.d/profiles-g-l/install-catalog b/apparmor.d/profiles-g-l/install-catalog index b1a56c41d..6a26d4dea 100644 --- a/apparmor.d/profiles-g-l/install-catalog +++ b/apparmor.d/profiles-g-l/install-catalog @@ -16,7 +16,7 @@ profile install-catalog @{exec_path} { @{sh_path} rix, @{bin}/basename rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/mv rix, @{bin}/rm rix, @{bin}/sed rix, diff --git a/apparmor.d/profiles-g-l/kdump-config b/apparmor.d/profiles-g-l/kdump-config index 2b3516202..f8b75f742 100644 --- a/apparmor.d/profiles-g-l/kdump-config +++ b/apparmor.d/profiles-g-l/kdump-config @@ -25,7 +25,7 @@ profile kdump-config @{exec_path} flags=(attach_disconnected) { @{bin}/file ix, @{bin}/find ix, @{bin}/flock ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/hexdump ix, @{bin}/ln ix, @{bin}/logger ix, diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper index aeac3e6a1..056b2d83c 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper +++ b/apparmor.d/profiles-g-l/landscape-sysinfo.wrapper @@ -25,7 +25,7 @@ profile landscape-sysinfo.wrapper @{exec_path} { @{bin}/cut rix, @{bin}/date rix, @{bin}/find rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/landscape-sysinfo rPx, / r, diff --git a/apparmor.d/profiles-g-l/language-validate b/apparmor.d/profiles-g-l/language-validate index bf999b79e..80f914fab 100644 --- a/apparmor.d/profiles-g-l/language-validate +++ b/apparmor.d/profiles-g-l/language-validate @@ -15,7 +15,7 @@ profile language-validate @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, @{sh_path} rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/locale rix, /usr/share/locale-langpack/{,*} r, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 191ac5782..8cc8a65e1 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -43,7 +43,7 @@ profile libreoffice @{exec_path} { @{sh_path} rix, @{bin}/basename rix, @{bin}/dirname rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/ls rix, @{bin}/paperconf rix, @{bin}/sed rix, diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate index 8d3dc2171..0dee9ed6a 100644 --- a/apparmor.d/profiles-g-l/logrotate +++ b/apparmor.d/profiles-g-l/logrotate @@ -30,7 +30,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/cat rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/gzip rix, @{sbin}/invoke-rc.d rix, @{bin}/kill rix, diff --git a/apparmor.d/profiles-m-r/modprobed-db b/apparmor.d/profiles-m-r/modprobed-db index cd2ddc0e6..013143152 100644 --- a/apparmor.d/profiles-m-r/modprobed-db +++ b/apparmor.d/profiles-m-r/modprobed-db @@ -19,7 +19,7 @@ profile modprobed-db @{exec_path} { @{bin}/cut rix, @{bin}/gawk rix, @{bin}/getent rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/logname rix, @{bin}/md5sum rix, @{bin}/rm rix, diff --git a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version index e5ee2fd8f..4474c1bfc 100644 --- a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version +++ b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version @@ -15,7 +15,7 @@ profile needrestart-vmlinuz-get-version @{exec_path} { @{sh_path} rix, @{bin}/bzip2 rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/gunzip rix, @{bin}/gzip rix, @{bin}/lzop rix, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 5ae5df7e6..d13099bc3 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -24,7 +24,7 @@ profile pass @{exec_path} { @{bin}/env r, @{bin}/find ix, @{bin}/getopt ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/head ix, @{bin}/mkdir ix, @{bin}/mktemp ix, diff --git a/apparmor.d/profiles-s-z/secure-time-sync b/apparmor.d/profiles-s-z/secure-time-sync index 51016373d..9c3f6d9df 100644 --- a/apparmor.d/profiles-s-z/secure-time-sync +++ b/apparmor.d/profiles-s-z/secure-time-sync @@ -23,7 +23,7 @@ profile secure-time-sync @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/curl rix, @{bin}/date rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/id rPx, @{bin}/sed rix, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 1a0bd0ea9..dfd488a48 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -28,7 +28,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, @{sh_path} mr, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{open_path} rPx -> child-open-strict, diff --git a/apparmor.d/profiles-s-z/syncoid b/apparmor.d/profiles-s-z/syncoid index 821a3fd63..e275fb764 100644 --- a/apparmor.d/profiles-s-z/syncoid +++ b/apparmor.d/profiles-s-z/syncoid @@ -15,7 +15,7 @@ profile syncoid @{exec_path} flags=(complain) { @{exec_path} mr, @{sh_path} rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/mbuffer rix, @{bin}/perl rix, @{bin}/ps rPx, diff --git a/apparmor.d/profiles-s-z/sysstat-sa b/apparmor.d/profiles-s-z/sysstat-sa index 37f5e3ca1..9dcc199bc 100644 --- a/apparmor.d/profiles-s-z/sysstat-sa +++ b/apparmor.d/profiles-s-z/sysstat-sa @@ -17,7 +17,7 @@ profile sysstat-sa @{exec_path} { @{sh_path} rix, @{bin}/date ix, @{bin}/find ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/rm ix, @{bin}/sar.sysstat ix, @{bin}/xargs ix, diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index c01edd9ec..9faea6e3e 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -32,7 +32,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{bin}/cp rix, @{sbin}/ethtool rix, @{bin}/flock rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{sbin}/hdparm rPx, @{bin}/head rix, @{bin}/id rPx, diff --git a/apparmor.d/profiles-s-z/ucfr b/apparmor.d/profiles-s-z/ucfr index b38f8aae4..add5c5b64 100644 --- a/apparmor.d/profiles-s-z/ucfr +++ b/apparmor.d/profiles-s-z/ucfr @@ -16,7 +16,7 @@ profile ucfr @{exec_path} { @{bin}/basename ix, @{bin}/{m,g,}awk ix, @{bin}/getopt ix, - @{bin}/grep ix, + @{bin}/{,e}grep ix, @{bin}/id ix, @{bin}/readlink ix, @{bin}/sed ix, diff --git a/apparmor.d/profiles-s-z/update-cracklib b/apparmor.d/profiles-s-z/update-cracklib index b7f00b263..8f848b0ad 100644 --- a/apparmor.d/profiles-s-z/update-cracklib +++ b/apparmor.d/profiles-s-z/update-cracklib @@ -21,7 +21,7 @@ profile update-cracklib @{exec_path} { @{bin}/env rix, @{bin}/file rix, @{bin}/find rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/gzip rix, @{bin}/install rix, @{bin}/install rix, diff --git a/apparmor.d/profiles-s-z/veracrypt b/apparmor.d/profiles-s-z/veracrypt index 1e5417b15..b9b92a721 100644 --- a/apparmor.d/profiles-s-z/veracrypt +++ b/apparmor.d/profiles-s-z/veracrypt @@ -30,7 +30,7 @@ profile veracrypt @{exec_path} { @{sh_path} rix, @{open_path} rPx -> child-open-help, @{sbin}/dmsetup rPx, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/kmod rix, @{sbin}/ldconfig rix, @{sbin}/losetup rCx -> losetup, diff --git a/apparmor.d/profiles-s-z/whatis b/apparmor.d/profiles-s-z/whatis index 43fa8ff09..3febd0b0b 100644 --- a/apparmor.d/profiles-s-z/whatis +++ b/apparmor.d/profiles-s-z/whatis @@ -13,7 +13,7 @@ profile whatis @{exec_path} { include @{exec_path} mr, - @{bin}/grep rix, + @{bin}/{,e}grep rix, /usr/{,**/}man/{,**/}{,whatis} r, diff --git a/apparmor.d/profiles-s-z/zed b/apparmor.d/profiles-s-z/zed index bb160a5e5..b131897d4 100644 --- a/apparmor.d/profiles-s-z/zed +++ b/apparmor.d/profiles-s-z/zed @@ -23,7 +23,7 @@ profile zed @{exec_path} { @{bin}/diff rix, @{bin}/expr rix, @{bin}/flock rix, - @{bin}/grep rix, + @{bin}/{,e}grep rix, @{bin}/hostname rix, @{bin}/logger rix, @{bin}/ls rix, From be62e5186f739b2316fc8ac2c22c3a5be37ad163 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Jun 2025 23:16:16 +0200 Subject: [PATCH 1024/1455] feat(profiles): ensure we use which{,.debianutils} instead of which. --- apparmor.d/abstractions/app/editor | 2 +- apparmor.d/groups/apt/apt-systemd-daily | 2 +- apparmor.d/groups/apt/aptitude-create-state-bundle | 2 +- apparmor.d/groups/browsers/brave-wrapper | 2 +- apparmor.d/groups/browsers/chrome-wrapper | 2 +- apparmor.d/groups/browsers/msedge-wrapper | 2 +- apparmor.d/groups/cron/cron-apt-compat | 2 +- apparmor.d/groups/cron/cron-apt-xapian-index | 3 +-- apparmor.d/groups/cron/cron-aptitude | 2 +- apparmor.d/groups/cron/cron-mlocate | 2 +- apparmor.d/groups/cron/cron-plocate | 2 +- apparmor.d/groups/cron/cron-popularity-contest | 2 +- apparmor.d/groups/display-manager/x11-xsession | 2 +- apparmor.d/groups/gnome/gdm-xsession | 2 +- apparmor.d/groups/kde/sddm-xsession | 2 +- apparmor.d/groups/network/openvpn | 2 +- apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/groups/ubuntu/apport-gtk | 2 +- apparmor.d/profiles-a-f/anyremote | 2 +- apparmor.d/profiles-a-f/aspell-autobuildhash | 2 +- apparmor.d/profiles-a-f/claws-mail | 2 +- apparmor.d/profiles-g-l/ganyremote | 2 +- apparmor.d/profiles-g-l/gsmartcontrol-root | 2 +- apparmor.d/profiles-g-l/kanyremote | 2 +- apparmor.d/profiles-g-l/kernel | 2 +- apparmor.d/profiles-m-r/mumble-overlay | 2 +- apparmor.d/profiles-m-r/openbox | 2 +- apparmor.d/profiles-m-r/os-prober | 2 +- apparmor.d/profiles-m-r/pass | 2 +- apparmor.d/profiles-m-r/pokemmo | 2 +- apparmor.d/profiles-m-r/protonmail-bridge-core | 2 +- apparmor.d/profiles-s-z/ucf | 2 +- apparmor.d/profiles-s-z/update-pciids | 2 +- apparmor.d/profiles-s-z/uupdate | 2 +- apparmor.d/profiles-s-z/xinit | 2 +- 35 files changed, 35 insertions(+), 36 deletions(-) diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index f62e36339..2bd14077b 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -13,7 +13,7 @@ @{bin}/nvim mrix, @{bin}/sensible-editor mr, @{bin}/vim{,.*} mrix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, /usr/share/nvim/{,**} r, /usr/share/terminfo/** r, diff --git a/apparmor.d/groups/apt/apt-systemd-daily b/apparmor.d/groups/apt/apt-systemd-daily index bd2f7fbb0..4f0d4e36b 100644 --- a/apparmor.d/groups/apt/apt-systemd-daily +++ b/apparmor.d/groups/apt/apt-systemd-daily @@ -37,7 +37,7 @@ profile apt-systemd-daily @{exec_path} { @{bin}/touch rix, @{bin}/uniq rix, @{bin}/wc rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/xargs rix, @{bin}/apt-config rPx, diff --git a/apparmor.d/groups/apt/aptitude-create-state-bundle b/apparmor.d/groups/apt/aptitude-create-state-bundle index 59f7a54f6..a2f5e2050 100644 --- a/apparmor.d/groups/apt/aptitude-create-state-bundle +++ b/apparmor.d/groups/apt/aptitude-create-state-bundle @@ -16,7 +16,7 @@ profile aptitude-create-state-bundle @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/tar rix, @{bin}/bzip2 rix, @{bin}/gzip rix, diff --git a/apparmor.d/groups/browsers/brave-wrapper b/apparmor.d/groups/browsers/brave-wrapper index 7001da3fe..b4f70689c 100644 --- a/apparmor.d/groups/browsers/brave-wrapper +++ b/apparmor.d/groups/browsers/brave-wrapper @@ -23,7 +23,7 @@ profile brave-wrapper @{exec_path} { @{bin}/mkdir rix, @{bin}/readlink rix, @{bin}/touch rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{lib_dirs}/brave rPx, diff --git a/apparmor.d/groups/browsers/chrome-wrapper b/apparmor.d/groups/browsers/chrome-wrapper index 0a97d4052..709eb79a1 100644 --- a/apparmor.d/groups/browsers/chrome-wrapper +++ b/apparmor.d/groups/browsers/chrome-wrapper @@ -22,7 +22,7 @@ profile chrome-wrapper @{exec_path} flags=(attach_disconnected) { @{bin}/mkdir rix, @{bin}/readlink rix, @{bin}/touch rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{lib_dirs}/chrome rPx, diff --git a/apparmor.d/groups/browsers/msedge-wrapper b/apparmor.d/groups/browsers/msedge-wrapper index 3da31e332..8268db2e1 100644 --- a/apparmor.d/groups/browsers/msedge-wrapper +++ b/apparmor.d/groups/browsers/msedge-wrapper @@ -22,7 +22,7 @@ profile msedge-wrapper @{exec_path} flags=(attach_disconnected) { @{bin}/mkdir rix, @{bin}/readlink rix, @{bin}/touch rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{lib_dirs}/msedge rPx, diff --git a/apparmor.d/groups/cron/cron-apt-compat b/apparmor.d/groups/cron/cron-apt-compat index 1778d4b7e..fcf5e4430 100644 --- a/apparmor.d/groups/cron/cron-apt-compat +++ b/apparmor.d/groups/cron/cron-apt-compat @@ -22,7 +22,7 @@ profile cron-apt-compat @{exec_path} { @{bin}/dd rix, @{bin}/cksum rix, @{bin}/cut rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/sleep rix, include if exists diff --git a/apparmor.d/groups/cron/cron-apt-xapian-index b/apparmor.d/groups/cron/cron-apt-xapian-index index 83eb22428..15f93efec 100644 --- a/apparmor.d/groups/cron/cron-apt-xapian-index +++ b/apparmor.d/groups/cron/cron-apt-xapian-index @@ -14,9 +14,8 @@ profile cron-apt-xapian-index @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/{,e}grep rix, - @{bin}/nice rix, @{bin}/ionice rix, diff --git a/apparmor.d/groups/cron/cron-aptitude b/apparmor.d/groups/cron/cron-aptitude index a471b2844..82b33e8ab 100644 --- a/apparmor.d/groups/cron/cron-aptitude +++ b/apparmor.d/groups/cron/cron-aptitude @@ -17,7 +17,7 @@ profile cron-aptitude @{exec_path} { @{bin}/cp rix, @{bin}/date rix, @{bin}/basename rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/dirname rix, @{bin}/rm rix, @{bin}/mv rix, diff --git a/apparmor.d/groups/cron/cron-mlocate b/apparmor.d/groups/cron/cron-mlocate index ec9690938..f91956bcd 100644 --- a/apparmor.d/groups/cron/cron-mlocate +++ b/apparmor.d/groups/cron/cron-mlocate @@ -15,7 +15,7 @@ profile cron-mlocate @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/true rix, @{bin}/flock rix, @{bin}/nocache rix, diff --git a/apparmor.d/groups/cron/cron-plocate b/apparmor.d/groups/cron/cron-plocate index 0604eba3a..7f52d1a14 100644 --- a/apparmor.d/groups/cron/cron-plocate +++ b/apparmor.d/groups/cron/cron-plocate @@ -15,7 +15,7 @@ profile cron-plocate @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/true rix, @{bin}/flock rix, @{bin}/nocache rix, diff --git a/apparmor.d/groups/cron/cron-popularity-contest b/apparmor.d/groups/cron/cron-popularity-contest index fa6e9874f..44d3a546f 100644 --- a/apparmor.d/groups/cron/cron-popularity-contest +++ b/apparmor.d/groups/cron/cron-popularity-contest @@ -74,7 +74,7 @@ profile cron-popularity-contest @{exec_path} { @{bin}/mv rix, @{bin}/rm rix, @{bin}/touch rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{sh_path} rix, /var/log/ r, diff --git a/apparmor.d/groups/display-manager/x11-xsession b/apparmor.d/groups/display-manager/x11-xsession index 4eb916aab..361a30b26 100644 --- a/apparmor.d/groups/display-manager/x11-xsession +++ b/apparmor.d/groups/display-manager/x11-xsession @@ -34,7 +34,7 @@ profile x11-xsession @{exec_path} { @{bin}/tail rix, @{bin}/tempfile rix, @{bin}/touch rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/dbus-update-activation-environment rCx -> dbus, diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession index 9804ddcb0..03e77816c 100644 --- a/apparmor.d/groups/gnome/gdm-xsession +++ b/apparmor.d/groups/gnome/gdm-xsession @@ -35,7 +35,7 @@ profile gdm-xsession @{exec_path} { @{bin}/tr rix, @{bin}/truncate rix, @{bin}/tty rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/zsh rix, @{bin}/dbus-update-activation-environment rCx -> dbus, diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession index b5cceee95..f27f3dc3c 100644 --- a/apparmor.d/groups/kde/sddm-xsession +++ b/apparmor.d/groups/kde/sddm-xsession @@ -40,7 +40,7 @@ profile sddm-xsession @{exec_path} { @{bin}/tcsh rix, @{bin}/tempfile rix, @{bin}/touch rix, - @{bin}/which{,.*} rix, + @{bin}/which{,.debianutils} rix, @{bin}/zsh rix, @{bin}/dbus-update-activation-environment rCx -> dbus, diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index 6431ee98a..a6ff1a939 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -84,7 +84,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/cut rix, @{bin}/ip rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{sbin}/xtables-nft-multi rix, /etc/iproute2/rt_tables r, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index e72c62667..e9f3bf807 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -101,7 +101,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{sbin}/update-grub rPx, @{bin}/update-mime-database rPx, @{bin}/vercmp rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/xmlcatalog rix, @{lib}/systemd/systemd-* rPx, @{lib}/ghc-@{version}/bin/ghc-pkg-@{version} rPx, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index bb5cd329c..5a4e130a0 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -52,7 +52,7 @@ profile apport-gtk @{exec_path} { @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/uname rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{lib}/{,colord/}colord-sane rPx, @{lib}/@{multiarch}/ld*.so* rix, /usr/share/apport/root_info_wrapper rix, diff --git a/apparmor.d/profiles-a-f/anyremote b/apparmor.d/profiles-a-f/anyremote index 6af2cd38d..43ecdb0cd 100644 --- a/apparmor.d/profiles-a-f/anyremote +++ b/apparmor.d/profiles-a-f/anyremote @@ -41,7 +41,7 @@ profile anyremote @{exec_path} { @{bin}/tail rix, @{bin}/tr rix, @{bin}/wc rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/convert-im6.q16 rCx -> imagemagic, @{bin}/killall rCx -> killall, diff --git a/apparmor.d/profiles-a-f/aspell-autobuildhash b/apparmor.d/profiles-a-f/aspell-autobuildhash index 43edd3233..a10df8394 100644 --- a/apparmor.d/profiles-a-f/aspell-autobuildhash +++ b/apparmor.d/profiles-a-f/aspell-autobuildhash @@ -20,7 +20,7 @@ profile aspell-autobuildhash @{exec_path} flags=(complain) { @{bin}/gzip rix, @{bin}/precat rix, @{bin}/prezip-bin rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/zcat rix, @{bin}/dpkg-trigger rPx, diff --git a/apparmor.d/profiles-a-f/claws-mail b/apparmor.d/profiles-a-f/claws-mail index bb7dfd3b8..263bb5794 100644 --- a/apparmor.d/profiles-a-f/claws-mail +++ b/apparmor.d/profiles-a-f/claws-mail @@ -24,7 +24,7 @@ profile claws-mail @{exec_path} flags=(complain) { @{exec_path} mr, @{sh_path} rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/gpg{,2} rCx -> gpg, @{bin}/gpgsm rCx -> gpg, diff --git a/apparmor.d/profiles-g-l/ganyremote b/apparmor.d/profiles-g-l/ganyremote index b2dc7b92d..727bf8cdf 100644 --- a/apparmor.d/profiles-g-l/ganyremote +++ b/apparmor.d/profiles-g-l/ganyremote @@ -30,7 +30,7 @@ profile ganyremote @{exec_path} { @{bin}/{,e}grep rix, @{bin}/cut rix, @{bin}/id rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/tr rix, @{bin}/{m,g,}awk rix, diff --git a/apparmor.d/profiles-g-l/gsmartcontrol-root b/apparmor.d/profiles-g-l/gsmartcontrol-root index 515d2234c..4fdb1084b 100644 --- a/apparmor.d/profiles-g-l/gsmartcontrol-root +++ b/apparmor.d/profiles-g-l/gsmartcontrol-root @@ -15,7 +15,7 @@ profile gsmartcontrol-root @{exec_path} { @{exec_path} r, @{sh_path} rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/pkexec rCx -> pkexec, diff --git a/apparmor.d/profiles-g-l/kanyremote b/apparmor.d/profiles-g-l/kanyremote index 10e085799..91eb37c58 100644 --- a/apparmor.d/profiles-g-l/kanyremote +++ b/apparmor.d/profiles-g-l/kanyremote @@ -31,7 +31,7 @@ profile kanyremote @{exec_path} { @{bin}/{,e}grep rix, @{bin}/cut rix, @{bin}/id rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/tr rix, @{bin}/{m,g,}awk rix, @{bin}/head rix, diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel index 133cf8ae7..6bc2c8961 100644 --- a/apparmor.d/profiles-g-l/kernel +++ b/apparmor.d/profiles-g-l/kernel @@ -33,7 +33,7 @@ profile kernel @{exec_path} { @{bin}/touch rix, @{bin}/tr rix, @{bin}/uname rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/apt-config rPx, @{bin}/dpkg rPx -> child-dpkg, diff --git a/apparmor.d/profiles-m-r/mumble-overlay b/apparmor.d/profiles-m-r/mumble-overlay index c077f3836..86792860c 100644 --- a/apparmor.d/profiles-m-r/mumble-overlay +++ b/apparmor.d/profiles-m-r/mumble-overlay @@ -16,7 +16,7 @@ profile mumble-overlay @{exec_path} { @{sh_path} rix, @{bin}/file rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/glxgears rPx, diff --git a/apparmor.d/profiles-m-r/openbox b/apparmor.d/profiles-m-r/openbox index e4e8a36e2..899290792 100644 --- a/apparmor.d/profiles-m-r/openbox +++ b/apparmor.d/profiles-m-r/openbox @@ -58,7 +58,7 @@ profile openbox @{exec_path} { @{lib}/@{multiarch}/openbox-xdg-autostart rix, @{sh_path} rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, # Apps allowed to run @{bin}/* rPUx, diff --git a/apparmor.d/profiles-m-r/os-prober b/apparmor.d/profiles-m-r/os-prober index 162c0b743..da853aa9a 100644 --- a/apparmor.d/profiles-m-r/os-prober +++ b/apparmor.d/profiles-m-r/os-prober @@ -51,7 +51,7 @@ profile os-prober @{exec_path} flags=(attach_disconnected) { @{bin}/udevadm rPx, @{bin}/umount rix, @{bin}/uname rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{lib}/newns rix, @{lib}/os-prober/* rix, @{lib}/os-probes/{,**} rix, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index d13099bc3..096f0316a 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -40,7 +40,7 @@ profile pass @{exec_path} { @{bin}/tr ix, @{bin}/tree ix, @{bin}/tty ix, - @{bin}/which ix, + @{bin}/which{,.debianutils} ix, @{bin}/git Cx -> git, @{bin}/gpg{2,} Cx -> gpg, diff --git a/apparmor.d/profiles-m-r/pokemmo b/apparmor.d/profiles-m-r/pokemmo index 111b157c5..324b08f17 100644 --- a/apparmor.d/profiles-m-r/pokemmo +++ b/apparmor.d/profiles-m-r/pokemmo @@ -37,7 +37,7 @@ profile pokemmo @{exec_path} flags=(attach_disconnected) { @{bin}/java ix, @{bin}/perl ix, - @{bin}/which ix, + @{bin}/which{,.debianutils} ix, @{lib}/jvm/java-@{int}-openjdk/bin/java ix, # Installer diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index ee7adab75..45c6766e3 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -72,7 +72,7 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) { @{bin}/tail rix, @{bin}/tree rix, @{bin}/tty rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, owner @{user_passwordstore_dirs}/ r, owner @{user_passwordstore_dirs}/.gpg-id r, diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf index 0a7b992b6..3c3374d85 100644 --- a/apparmor.d/profiles-s-z/ucf +++ b/apparmor.d/profiles-s-z/ucf @@ -33,7 +33,7 @@ profile ucf @{exec_path} { @{bin}/seq rix, @{bin}/stat rix, @{bin}/tr rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/dpkg-query rpx, @{bin}/dpkg-divert rPx, diff --git a/apparmor.d/profiles-s-z/update-pciids b/apparmor.d/profiles-s-z/update-pciids index bba603690..901dae9a0 100644 --- a/apparmor.d/profiles-s-z/update-pciids +++ b/apparmor.d/profiles-s-z/update-pciids @@ -24,7 +24,7 @@ profile update-pciids @{exec_path} { @{bin}/chmod rix, @{bin}/echo rix, @{bin}/cat rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/bunzip2 rix, @{bin}/bzip2 rix, @{bin}/gzip rix, diff --git a/apparmor.d/profiles-s-z/uupdate b/apparmor.d/profiles-s-z/uupdate index eb26a4967..88a6cd406 100644 --- a/apparmor.d/profiles-s-z/uupdate +++ b/apparmor.d/profiles-s-z/uupdate @@ -18,7 +18,7 @@ profile uupdate @{exec_path} flags=(complain) { @{sh_path} rix, @{bin}/basename rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/tr rix, @{bin}/{,e}grep rix, @{bin}/getopt rix, diff --git a/apparmor.d/profiles-s-z/xinit b/apparmor.d/profiles-s-z/xinit index 61151a7db..9abc02350 100644 --- a/apparmor.d/profiles-s-z/xinit +++ b/apparmor.d/profiles-s-z/xinit @@ -35,7 +35,7 @@ profile xinit @{exec_path} { @{bin}/tail rix, @{bin}/tempfile rix, @{bin}/touch rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, /etc/X11/xinit/xinitrc rix, /etc/X11/xinit/xserverrc rix, From 27907e5a17e3720e6b369ea62256eb7d36551b92 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Jun 2025 23:27:34 +0200 Subject: [PATCH 1025/1455] feat(profiles): ensure we use {m,g,}awk instead of awk. --- apparmor.d/groups/network/nm-dispatcher | 2 +- apparmor.d/groups/whonix/rads | 2 +- apparmor.d/profiles-g-l/kernel-postinst-kdump | 2 +- apparmor.d/profiles-m-r/modprobed-db | 2 +- apparmor.d/profiles-s-z/tomb | 3 +-- apparmor.d/profiles-s-z/wechat | 2 +- apparmor.d/profiles-s-z/wechat-appimage | 2 +- 7 files changed, 7 insertions(+), 8 deletions(-) diff --git a/apparmor.d/groups/network/nm-dispatcher b/apparmor.d/groups/network/nm-dispatcher index 87a418153..029a5e39a 100644 --- a/apparmor.d/groups/network/nm-dispatcher +++ b/apparmor.d/groups/network/nm-dispatcher @@ -41,7 +41,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) { @{bin}/chown rix, @{bin}/chronyc rPUx, @{bin}/date rix, - @{bin}/gawk rix, + @{bin}/{m,g,}awk rix, @{bin}/{,e}grep rix, @{bin}/id rix, @{sbin}/invoke-rc.d rCx -> invoke-rc, diff --git a/apparmor.d/groups/whonix/rads b/apparmor.d/groups/whonix/rads index 10f30b50b..8bdeb2c13 100644 --- a/apparmor.d/groups/whonix/rads +++ b/apparmor.d/groups/whonix/rads @@ -19,7 +19,7 @@ profile rads @{exec_path} { @{bin}/cat rix, @{bin}/chvt rix, @{bin}/free rix, - @{bin}/gawk rix, + @{bin}/{m,g,}awk rix, @{bin}/{,e}grep rix, @{bin}/mkdir rix, @{bin}/rm rix, diff --git a/apparmor.d/profiles-g-l/kernel-postinst-kdump b/apparmor.d/profiles-g-l/kernel-postinst-kdump index 91af3a842..e1358ec29 100644 --- a/apparmor.d/profiles-g-l/kernel-postinst-kdump +++ b/apparmor.d/profiles-g-l/kernel-postinst-kdump @@ -14,7 +14,7 @@ profile kernel-postinst-kdump @{exec_path} { @{bin}/du rix, @{bin}/find rix, - @{bin}/gawk rix, + @{bin}/{m,g,}awk rix, @{bin}/mv rix, @{bin}/rm rix, @{bin}/sync rix, diff --git a/apparmor.d/profiles-m-r/modprobed-db b/apparmor.d/profiles-m-r/modprobed-db index 013143152..90bf73cf3 100644 --- a/apparmor.d/profiles-m-r/modprobed-db +++ b/apparmor.d/profiles-m-r/modprobed-db @@ -17,7 +17,7 @@ profile modprobed-db @{exec_path} { @{bin}/cat rix, @{bin}/cp rix, @{bin}/cut rix, - @{bin}/gawk rix, + @{bin}/{m,g,}awk rix, @{bin}/getent rix, @{bin}/{,e}grep rix, @{bin}/logname rix, diff --git a/apparmor.d/profiles-s-z/tomb b/apparmor.d/profiles-s-z/tomb index 508ac6eff..93e29bcfa 100644 --- a/apparmor.d/profiles-s-z/tomb +++ b/apparmor.d/profiles-s-z/tomb @@ -27,7 +27,7 @@ profile tomb @{exec_path} { @{exec_path} mr, @{bin}/{,e,f}grep rix, - @{bin}/awk rix, + @{bin}/{m,g,}awk rix, @{bin}/basename rix, @{bin}/cat rix, @{bin}/chmod rix, @@ -41,7 +41,6 @@ profile tomb @{exec_path} { @{bin}/env rix, @{bin}/file rix, @{bin}/findmnt rix, - @{bin}/gawk rix, @{bin}/getent rix, @{bin}/gettext rix, @{bin}/hostname rix, diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat index e23d4db43..b7ad3a2e8 100755 --- a/apparmor.d/profiles-s-z/wechat +++ b/apparmor.d/profiles-s-z/wechat @@ -31,7 +31,7 @@ profile wechat @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{lib_dirs}/crashpad_handler ix, @{bin}/mkdir ix, - @{bin}/gawk rix, + @{bin}/{m,g,}awk rix, @{bin}/lsblk rPx, @{bin}/ip rix, @{bin}/xdg-user-dir rix, diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage index 023644eb0..55155f2b8 100755 --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -36,7 +36,7 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) { @{lib_dirs}/wechat-appimage.AppImage ix, /tmp/.mount_wechat??????/AppRun ix, @{bin}/mkdir ix, - @{bin}/gawk rix, + @{bin}/{m,g,}awk rix, @{bin}/lsblk rPx, @{bin}/ip rix, @{bin}/xdg-user-dir rix, From 033a7475e08db25afacdeca23f8aab1786d7d70a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Jun 2025 23:35:13 +0200 Subject: [PATCH 1026/1455] tests: enforce equivalent tests. --- tests/check.sh | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index b1783bf8e..801e81114 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -134,6 +134,7 @@ _check_directory_mark() { declare -A EQUIVALENTS=( ["awk"]="{m,g,}awk" + ["gawk"]="{m,g,}awk" ["grep"]="{,e}grep" ["which"]="which{,.debianutils}" ) @@ -371,7 +372,10 @@ check_profiles() { -prune -o -type f -print ) jobs=0 - WITH_CHECK=(abi include profile header tabs trailing indentation subprofiles vim) + WITH_CHECK=( + equivalent + abi include profile header tabs trailing indentation subprofiles vim + ) for file in "${files[@]}"; do ( name="$(basename "$file")" @@ -388,7 +392,10 @@ check_abstractions() { _msg "Checking abstractions" mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*") jobs=0 - WITH_CHECK=(abi include header tabs trailing indentation vim) + WITH_CHECK=( + equivalent + abi include header tabs trailing indentation vim + ) for file in "${files[@]}"; do ( name="$(basename "$file")" @@ -406,7 +413,10 @@ check_abstractions() { ) # shellcheck disable=SC2034 jobs=0 - WITH_CHECK=(header tabs trailing indentation vim) + WITH_CHECK=( + equivalent + header tabs trailing indentation vim + ) for file in "${files[@]}"; do _check "$file" & _wait jobs From f29041576e234e3d4873da2434d4fd3298c2b01d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 19 Jun 2025 23:55:20 +0200 Subject: [PATCH 1027/1455] feat(profile): move away from old or too wide abstractions. --- .../groups/browsers/opera-crashreporter | 2 +- apparmor.d/groups/filesystem/udiskie | 10 ++-- apparmor.d/groups/hyprland/hyprpm | 1 - apparmor.d/groups/network/nm-dhcp-helper | 2 +- apparmor.d/groups/usb/usbguard-applet-qt | 20 +++----- apparmor.d/groups/virt/libvirtd | 3 +- apparmor.d/profiles-a-f/atftpd | 8 +++- apparmor.d/profiles-a-f/dhclient-script | 8 +++- apparmor.d/profiles-a-f/dumpcap | 8 ++-- apparmor.d/profiles-a-f/ffplay | 3 +- apparmor.d/profiles-a-f/fritzing | 46 ++++++++----------- apparmor.d/profiles-g-l/light-locker | 12 ++--- apparmor.d/profiles-m-r/mkvtoolnix-gui | 10 ++-- apparmor.d/profiles-m-r/netstat | 8 +++- apparmor.d/profiles-m-r/pcb-gtk | 8 +--- apparmor.d/profiles-s-z/sing-box | 1 - apparmor.d/profiles-s-z/tftp | 8 +++- apparmor.d/profiles-s-z/vsftpd | 8 +++- apparmor.d/profiles-s-z/youtube-dl | 4 +- 19 files changed, 84 insertions(+), 86 deletions(-) diff --git a/apparmor.d/groups/browsers/opera-crashreporter b/apparmor.d/groups/browsers/opera-crashreporter index 01661215a..eb67ede59 100644 --- a/apparmor.d/groups/browsers/opera-crashreporter +++ b/apparmor.d/groups/browsers/opera-crashreporter @@ -17,7 +17,7 @@ profile opera-crashreporter @{exec_path} { include include include - include + include include ptrace (trace, read) peer=opera, diff --git a/apparmor.d/groups/filesystem/udiskie b/apparmor.d/groups/filesystem/udiskie index a6a2e2ad3..53b726c23 100644 --- a/apparmor.d/groups/filesystem/udiskie +++ b/apparmor.d/groups/filesystem/udiskie @@ -11,16 +11,12 @@ include profile udiskie @{exec_path} { include include - include - include + include include - include - include + include include - include include - include - include + include @{exec_path} r, @{python_path} r, diff --git a/apparmor.d/groups/hyprland/hyprpm b/apparmor.d/groups/hyprland/hyprpm index 3a5878808..149128b1e 100644 --- a/apparmor.d/groups/hyprland/hyprpm +++ b/apparmor.d/groups/hyprland/hyprpm @@ -11,7 +11,6 @@ profile hyprpm @{exec_path} { include include include - include network inet dgram, network inet stream, diff --git a/apparmor.d/groups/network/nm-dhcp-helper b/apparmor.d/groups/network/nm-dhcp-helper index 5e93bdbf5..3e232154e 100644 --- a/apparmor.d/groups/network/nm-dhcp-helper +++ b/apparmor.d/groups/network/nm-dhcp-helper @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/{,NetworkManager/}nm-dhcp-helper profile nm-dhcp-helper @{exec_path} { include - include + include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/groups/usb/usbguard-applet-qt b/apparmor.d/groups/usb/usbguard-applet-qt index a76398dd9..558b9093c 100644 --- a/apparmor.d/groups/usb/usbguard-applet-qt +++ b/apparmor.d/groups/usb/usbguard-applet-qt @@ -10,22 +10,21 @@ include @{exec_path} = @{bin}/usbguard-applet-qt profile usbguard-applet-qt @{exec_path} { include - include - include - include - include - include - include - include - include + include include + include + include include + include # Needed? ptrace (read), @{exec_path} mr, + /var/lib/dbus/machine-id r, + /etc/machine-id r, + owner @{user_config_dirs}/USBGuard/ rw, owner @{user_config_dirs}/USBGuard/* rwkl -> @{user_config_dirs}/USBGuard/#@{int}, @@ -37,11 +36,6 @@ profile usbguard-applet-qt @{exec_path} { owner @{PROC}/@{pid}/cmdline r, - /usr/share/hwdata/pnp.ids r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - include if exists } diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 4d730602d..844af4443 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -17,8 +17,9 @@ include @{exec_path} = @{sbin}/libvirtd profile libvirtd @{exec_path} flags=(attach_disconnected) { include + include + include include - include include include include diff --git a/apparmor.d/profiles-a-f/atftpd b/apparmor.d/profiles-a-f/atftpd index dc7f2bf36..2444bd128 100644 --- a/apparmor.d/profiles-a-f/atftpd +++ b/apparmor.d/profiles-a-f/atftpd @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/atftpd profile atftpd @{exec_path} { include - include + include # For libwrap (TCP Wrapper) support include @@ -18,6 +18,12 @@ profile atftpd @{exec_path} { capability setgid, capability setuid, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + @{exec_path} mr, # FTP dirs (add "w" if you need write permissions and hence upload files) diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script index 9a7e77902..3967512b8 100644 --- a/apparmor.d/profiles-a-f/dhclient-script +++ b/apparmor.d/profiles-a-f/dhclient-script @@ -10,13 +10,19 @@ include @{exec_path} = @{bin}/dhclient-script profile dhclient-script @{exec_path} { include - include + include include capability net_admin, capability sys_admin, audit capability sys_module, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + @{exec_path} mr, @{sh_path} mrix, diff --git a/apparmor.d/profiles-a-f/dumpcap b/apparmor.d/profiles-a-f/dumpcap index 634aebd02..a1050aa94 100644 --- a/apparmor.d/profiles-a-f/dumpcap +++ b/apparmor.d/profiles-a-f/dumpcap @@ -10,16 +10,14 @@ include @{exec_path} = @{bin}/dumpcap profile dumpcap @{exec_path} { include + include + include include - include - include # To capture packekts capability net_raw, capability net_admin, - signal (receive) peer=wireshark, - network inet dgram, network inet6 dgram, network netlink raw, @@ -27,6 +25,8 @@ profile dumpcap @{exec_path} { network packet raw, network bluetooth raw, + signal (receive) peer=wireshark, + dbus (eavesdrop) bus=session, @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/ffplay b/apparmor.d/profiles-a-f/ffplay index a4dec5d34..4152ed49a 100644 --- a/apparmor.d/profiles-a-f/ffplay +++ b/apparmor.d/profiles-a-f/ffplay @@ -11,10 +11,9 @@ include profile ffplay @{exec_path} { include include - include + include include include - include network inet stream, network inet6 stream, diff --git a/apparmor.d/profiles-a-f/fritzing b/apparmor.d/profiles-a-f/fritzing index 18b990bbc..c57323c6a 100644 --- a/apparmor.d/profiles-a-f/fritzing +++ b/apparmor.d/profiles-a-f/fritzing @@ -10,16 +10,13 @@ include @{exec_path} = @{bin}/fritzing{,.real} profile fritzing @{exec_path} { include - include - include - include - include - include - include - include + include include - include + include + include + include include + include network inet dgram, network inet6 dgram, @@ -30,26 +27,25 @@ profile fritzing @{exec_path} { @{exec_path} mrix, + /usr/share/fritzing/{,**} r, + /usr/share/hwdata/pnp.ids r, + + /etc/debian_version r, + /etc/fstab r, + /etc/machine-id r, + /var/lib/dbus/machine-id r, + owner @{user_config_dirs}/Fritzing/ rw, owner @{user_config_dirs}/Fritzing/** rwkl -> @{user_config_dirs}/Fritzing/**, owner @{HOME}/@{XDG_DOCUMENTS_DIR}/Fritzing/ rw, owner @{HOME}/@{XDG_DOCUMENTS_DIR}/Fritzing/** rw, - /usr/share/fritzing/{,**} r, + owner @{run}/lock/LCK..ttyACM[0-9]* rwk, - /usr/share/hwdata/pnp.ids r, - - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - - /etc/fstab r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - /etc/debian_version r, + @{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]* + @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx + @{run}/udev/data/c166:@{int} r, # for /dev/ttyACM[0-9]* @{sys}/bus/ r, @{sys}/class/ r, @@ -57,15 +53,13 @@ profile fritzing @{exec_path} { @{sys}/devices/**/tty*/uevent r, @{sys}/devices/**/tty/**/uevent r, - @{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]* - @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx - @{run}/udev/data/c166:@{int} r, # for /dev/ttyACM[0-9]* + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, /dev/ttyS@{int} rw, /dev/ttyACM@{int} rw, - owner @{run}/lock/LCK..ttyACM[0-9]* rwk, - include if exists } diff --git a/apparmor.d/profiles-g-l/light-locker b/apparmor.d/profiles-g-l/light-locker index 8d2fcdcc8..60189d911 100644 --- a/apparmor.d/profiles-g-l/light-locker +++ b/apparmor.d/profiles-g-l/light-locker @@ -11,19 +11,12 @@ include profile light-locker @{exec_path} { include include - include - include - include + include include - include include - include @{exec_path} mr, - @{PROC}/1/cgroup r, - owner @{PROC}/@{pid}/cgroup r, - # when locking the screen and switching/closing sessions @{run}/systemd/sessions/* r, @@ -33,6 +26,9 @@ profile light-locker @{exec_path} { @{sys}/devices/@{pci}/subsystem_vendor r, @{sys}/devices/@{pci}/subsystem_device r, + @{PROC}/1/cgroup r, + owner @{PROC}/@{pid}/cgroup r, + # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/profiles-m-r/mkvtoolnix-gui b/apparmor.d/profiles-m-r/mkvtoolnix-gui index 835e1a391..4e0ace19a 100644 --- a/apparmor.d/profiles-m-r/mkvtoolnix-gui +++ b/apparmor.d/profiles-m-r/mkvtoolnix-gui @@ -10,19 +10,15 @@ include @{exec_path} = @{bin}/mkvtoolnix-gui profile mkvtoolnix-gui @{exec_path} { include - include + include include - include - include - include - include + include include - include include include + include include include - include signal (send) set=(term, kill) peer=mkvmerge, diff --git a/apparmor.d/profiles-m-r/netstat b/apparmor.d/profiles-m-r/netstat index e19884997..a23a095e9 100644 --- a/apparmor.d/profiles-m-r/netstat +++ b/apparmor.d/profiles-m-r/netstat @@ -13,12 +13,18 @@ include profile netstat @{exec_path} { include include - include + include capability dac_read_search, capability sys_ptrace, capability syslog, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + ptrace (trace,read), @{exec_path} rmix, diff --git a/apparmor.d/profiles-m-r/pcb-gtk b/apparmor.d/profiles-m-r/pcb-gtk index e736299fa..2f057f2a7 100644 --- a/apparmor.d/profiles-m-r/pcb-gtk +++ b/apparmor.d/profiles-m-r/pcb-gtk @@ -10,13 +10,9 @@ include @{exec_path} = @{bin}/pcb-gtk profile pcb-gtk @{exec_path} { include - include - include - include + include include - include - include - include + include include include diff --git a/apparmor.d/profiles-s-z/sing-box b/apparmor.d/profiles-s-z/sing-box index 9f395735e..1890510ae 100644 --- a/apparmor.d/profiles-s-z/sing-box +++ b/apparmor.d/profiles-s-z/sing-box @@ -12,7 +12,6 @@ include profile sing-box @{exec_path} { include include - include capability net_bind_service, diff --git a/apparmor.d/profiles-s-z/tftp b/apparmor.d/profiles-s-z/tftp index 33f6fe6dc..bb0a1c37b 100644 --- a/apparmor.d/profiles-s-z/tftp +++ b/apparmor.d/profiles-s-z/tftp @@ -10,9 +10,15 @@ include @{exec_path} = @{bin}/tftp profile tftp @{exec_path} { include - include + include include + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + @{exec_path} mr, include if exists diff --git a/apparmor.d/profiles-s-z/vsftpd b/apparmor.d/profiles-s-z/vsftpd index 2b6af3561..8fe33af50 100644 --- a/apparmor.d/profiles-s-z/vsftpd +++ b/apparmor.d/profiles-s-z/vsftpd @@ -12,7 +12,7 @@ profile vsftpd @{exec_path} { include include include - include + include include # To be able to listen on ports < 1024 @@ -41,6 +41,12 @@ profile vsftpd @{exec_path} { capability dac_read_search, # If session_support=YES, vsftpd will also try and update utmp and wtmp + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + @{exec_path} mr, # To validate allowed users shells diff --git a/apparmor.d/profiles-s-z/youtube-dl b/apparmor.d/profiles-s-z/youtube-dl index 381e878fa..d0b1c1988 100644 --- a/apparmor.d/profiles-s-z/youtube-dl +++ b/apparmor.d/profiles-s-z/youtube-dl @@ -13,13 +13,11 @@ profile youtube-dl @{exec_path} { include include include - include - include + include include include include include - include network inet dgram, network inet6 dgram, From 3ffff07f3fb386e980d9bb7bc763824bef2e6c5e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 20 Jun 2025 00:00:48 +0200 Subject: [PATCH 1028/1455] tests: enforce abstractions test. --- apparmor.d/profiles-m-r/rsyslogd | 14 +++++--------- tests/check.sh | 10 +++++----- 2 files changed, 10 insertions(+), 14 deletions(-) diff --git a/apparmor.d/profiles-m-r/rsyslogd b/apparmor.d/profiles-m-r/rsyslogd index 599fac88f..80d75a928 100644 --- a/apparmor.d/profiles-m-r/rsyslogd +++ b/apparmor.d/profiles-m-r/rsyslogd @@ -7,15 +7,10 @@ abi , include -# Debugging the syslogger can be difficult if it can't write to the file -# that the kernel is logging denials to. In these cases, you can do the -# following: -# watch -n 1 'dmesg | tail -5' - @{exec_path} = @{sbin}/rsyslogd profile rsyslogd @{exec_path} { include - include + include capability chown, # For creating new log files and changing their owner/group capability net_admin, # For remote logs @@ -24,18 +19,19 @@ profile rsyslogd @{exec_path} { capability sys_nice, capability syslog, + network inet dgram, + network inet6 dgram, + signal receive set=hup peer=@{p_systemd}, @{exec_path} mr, + @{sh_path} mr, @{lib}/@{multiarch}/rsyslog/*.so mr, /etc/rsyslog.conf r, /etc/rsyslog.d/{,**} r, - /etc/CA/*.crt r, - /etc/CA/*.key r, - /var/log/** rw, /var/spool/rsyslog/ r, /var/spool/rsyslog/** rw, diff --git a/tests/check.sh b/tests/check.sh index 801e81114..28adc7710 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -93,7 +93,7 @@ _check() { # Rules checks: security, compatibility and rule issues readonly ABS="abstractions" -readonly ABS_DANGEROUS=(dbus-session dbus-system dbus-accessibility user-tmp) +readonly ABS_DANGEROUS=(dbus dbus-session dbus-system dbus-accessibility user-tmp) declare -A ABS_DEPRECATED=( ["nameservice"]="nameservice-strict" ["bash"]="shell" @@ -142,7 +142,7 @@ _check_equivalent() { _is_enabled equivalent || return 0 local prgmname for prgmname in "${!EQUIVALENTS[@]}"; do - if [[ "$line" == *"/$prgmname"* ]]; then + if [[ "$line" == *"/$prgmname "* ]]; then if [[ ! "$line" == *"${EQUIVALENTS[$prgmname]}"* ]]; then _err compatibility "$file:$line_number" "missing equivalent program: '@{bin}/$prgmname' instead of '@{bin}/${EQUIVALENTS[$prgmname]}'" fi @@ -373,7 +373,7 @@ check_profiles() { ) jobs=0 WITH_CHECK=( - equivalent + abstractions equivalent abi include profile header tabs trailing indentation subprofiles vim ) for file in "${files[@]}"; do @@ -393,7 +393,7 @@ check_abstractions() { mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*") jobs=0 WITH_CHECK=( - equivalent + abstractions equivalent abi include header tabs trailing indentation vim ) for file in "${files[@]}"; do @@ -414,7 +414,7 @@ check_abstractions() { # shellcheck disable=SC2034 jobs=0 WITH_CHECK=( - equivalent + abstractions equivalent header tabs trailing indentation vim ) for file in "${files[@]}"; do From bb6ca01718dad6cd91055c8d2c825143d00ca2f6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:36:23 +0200 Subject: [PATCH 1029/1455] feat(profile): ufw: integrate ufw-init in ufw, use sysctl in subprofile. --- apparmor.d/groups/firewall/ufw | 22 ++++++++++++++++++---- apparmor.d/groups/firewall/ufw-init | 21 +++++++++++++++++++-- 2 files changed, 37 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/firewall/ufw b/apparmor.d/groups/firewall/ufw index 3b931fb2b..39517ee6c 100644 --- a/apparmor.d/groups/firewall/ufw +++ b/apparmor.d/groups/firewall/ufw @@ -30,13 +30,12 @@ profile ufw @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{python_path} rix, - @{bin}/ r, + @{sbin}/ r, @{bin}/cat rix, - @{bin}/echo rix, @{bin}/env r, @{bin}/kmod rCx -> kmod, - @{lib}/ufw/ufw-init rix, - @{sbin}/sysctl rix, + @{lib}/ufw/ufw-init rPx, + @{sbin}/sysctl rCx -> sysctl, @{sbin}/xtables-legacy-multi rix, @{sbin}/xtables-nft-multi rix, @@ -70,6 +69,21 @@ profile ufw @{exec_path} flags=(attach_disconnected) { include if exists } + profile sysctl { + include + include + + capability net_admin, + + @{sbin}/sysctl mr, + + /etc/ufw/sysctl.conf r, + + @{PROC}/sys/net/ipv{4,6}/** rw, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/firewall/ufw-init b/apparmor.d/groups/firewall/ufw-init index 5c0521790..aae80b87d 100644 --- a/apparmor.d/groups/firewall/ufw-init +++ b/apparmor.d/groups/firewall/ufw-init @@ -11,6 +11,7 @@ profile ufw-init @{exec_path} { include include + capability dac_read_search, capability net_admin, network inet dgram, @@ -22,7 +23,8 @@ profile ufw-init @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{sbin}/sysctl rix, + @{bin}/echo rix, + @{sbin}/sysctl rCx -> sysctl, @{sbin}/xtables-legacy-multi rix, @{sbin}/xtables-nft-multi rix, @@ -30,7 +32,22 @@ profile ufw-init @{exec_path} { /etc/ufw/* r, @{PROC}/@{pid}/net/ip_tables_names r, - @{PROC}/sys/net/ipv{4,6}/** rw, + # @{PROC}/sys/net/ipv{4,6}/** rw, + + profile sysctl { + include + include + + capability net_admin, + + @{sbin}/sysctl mr, + + /etc/ufw/sysctl.conf r, + + @{PROC}/sys/net/ipv{4,6}/** rw, + + include if exists + } include if exists } From ea45cec24d5cbf9c66feb859740b802cf46ececf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:43:02 +0200 Subject: [PATCH 1030/1455] feat(fsp): improve fsp profiles. --- apparmor.d/groups/_full/sd | 24 ++++++------------------ apparmor.d/groups/_full/sdu | 2 ++ apparmor.d/groups/_full/systemd | 5 ++++- apparmor.d/groups/_full/systemd-user | 2 +- 4 files changed, 13 insertions(+), 20 deletions(-) diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd index 48172638e..da14cabf3 100644 --- a/apparmor.d/groups/_full/sd +++ b/apparmor.d/groups/_full/sd @@ -86,22 +86,7 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) { umount /, umount /dev/shm/, umount @{run}/systemd/mount-rootfs/{,**}, - - # mount tmpfs -> @{run}/lock/, - # mount tmpfs -> @{sys}/fs/cgroup/, - # mount cgroup -> @{sys}/fs/cgroup/systemd/, - # audit mount /dev/** -> /boot/{,efi/}, - # audit mount options=(rw bind) /dev/** -> /tmp/namespace-dev-@{rand6}/**, - # audit mount options=(rw rbind) -> @{run}/systemd/unit-root/{,**}, - - # audit remount @{run}/systemd/unit-root/{,**}, - # audit remount options=(ro noexec noatime bind) /var/snap/{,**}, - # audit remount options=(ro nosuid nodev bind) /var/, - # audit remount options=(ro nosuid nodev noexec bind) /boot/, - - # audit umount @{PROC}/sys/fs/binfmt_misc/, - # audit umount @{run}/systemd/namespace-@{rand6}/{,**}, - # audit umount @{run}/systemd/unit-root/{,**}, + umount @{run}/systemd/namespace-@{rand6}/{,**}, pivot_root oldroot=/run/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/, @@ -150,20 +135,22 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) { @{bin}/true ix, # Required due to stacked profiles - @{sbin}/grpck ix, + @{bin}/find ix, @{bin}/gzip ix, @{bin}/install ix, - @{sbin}/pwck ix, @{bin}/readlink ix, @{lib}/colord-sane ix, @{lib}/systemd/systemd-nsresourcework ix, @{lib}/systemd/systemd-userwork ix, + @{sbin}/grpck ix, + @{sbin}/pwck ix, / r, @{att}/ r, @{bin}/{,**} r, @{lib}/{,**} r, @{sbin}/{,*} r, + /usr/local/{,**} r, /usr/share/** r, /etc/*/ w, /etc/** rk, @@ -179,6 +166,7 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) { /var/lib/*/ rw, /var/lib/*/** rwk, /var/lib/systemd/*/ r, + /var/log/ r, /var/log/** rw, /var/log/journal/** rwl -> /var/log/journal/**, diff --git a/apparmor.d/groups/_full/sdu b/apparmor.d/groups/_full/sdu index c9338fd22..80d8c1fb9 100644 --- a/apparmor.d/groups/_full/sdu +++ b/apparmor.d/groups/_full/sdu @@ -108,6 +108,8 @@ profile sdu flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/oom_score_adj rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + deny capability net_admin, + profile shell flags=(attach_disconnected,mediate_deleted,complain) { include diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index b7c12c6bd..184084fed 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -50,7 +50,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd -profile systemd flags=(attach_disconnected,mediate_deleted) { +profile systemd flags=(attach_disconnected,mediate_deleted,complain) { include include include @@ -129,9 +129,11 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{etc_ro}/environment r, @{etc_ro}/environment.d/{,**} r, + /etc/acpi/events/{,**} r, /etc/binfmt.d/{,**} r, /etc/conf.d/{,**} r, /etc/default/{,**} r, + /etc/machine-id r, /etc/modules-load.d/{,**} r, /etc/networkd-dispatcher/{,**} r, /etc/systemd/{,**} r, @@ -186,6 +188,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) { @{sys}/devices/virtual/dmi/id/product_version r, @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/tty/console/active r, + @{sys}/firmware/efi/efivars/LoaderSystemToken-@{uuid} rw, @{sys}/fs/cgroup/{,**} rw, @{sys}/fs/fuse/connections/ r, @{sys}/fs/pstore/ r, diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index ed531c58b..a5bb4d926 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -16,7 +16,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd -profile systemd-user flags=(attach_disconnected,mediate_deleted) { +profile systemd-user flags=(attach_disconnected,mediate_deleted,complain) { include include include From cd619d280a5ba23537114e74ed8fa4c294e00559 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:44:43 +0200 Subject: [PATCH 1031/1455] feat(profile): update apt profiles. --- apparmor.d/groups/apt/apt-methods-http | 3 ++- apparmor.d/groups/apt/dpkg-script-systemd | 5 +++++ apparmor.d/groups/apt/dpkg-scripts | 11 +++++++++++ apparmor.d/groups/apt/dpkg-statoverride | 1 + apparmor.d/groups/apt/unattended-upgrade | 2 +- 5 files changed, 20 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/apt/apt-methods-http b/apparmor.d/groups/apt/apt-methods-http index 7fb3a2cc4..61be160dc 100644 --- a/apparmor.d/groups/apt/apt-methods-http +++ b/apparmor.d/groups/apt/apt-methods-http @@ -71,7 +71,8 @@ profile apt-methods-http @{exec_path} flags=(attach_disconnected) { owner @{tmp}/aptitude-root.*/aptitude-download-* rw, owner @{tmp}/apt-changelog-*/*.changelog rw, - @{run}/ubuntu-advantage/aptnews.json rw, + @{run}/ubuntu-advantage/aptnews.json rw, + owner @{run}/ubuntu-advantage/apt-news/aptnews.json rw, @{PROC}/1/cgroup r, @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd index 8ca92515c..722e72c53 100644 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -42,8 +42,13 @@ profile dpkg-script-systemd @{exec_path} { include include + capability dac_read_search, + @{bin}/dpkg mr, + /etc/dpkg/dpkg.cfg r, + /etc/dpkg/dpkg.cfg.d/{,*} r, + include if exists } diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 3102b23bb..e16d25bf2 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -58,7 +58,12 @@ profile dpkg-scripts @{exec_path} { / r, /*/ r, @{bin}/ r, + @{bin}/* w, @{lib}/ r, + @{lib}/@{python_name}/**/__pycache__/ w, + @{lib}/@{python_name}/**/__pycache__/**.pyc w, + @{lib}/@{python_name}/**/__pycache__/**.pyc.@{u64} w, + /etc/ r, /etc/** rw, /usr/share/*/{,**} rw, @@ -71,6 +76,8 @@ profile dpkg-scripts @{exec_path} { /tmp/sed@{rand6} rw, /tmp/tmp.@{rand10} rw, + @{PROC}/@{pid}/fd/ r, + profile bus { include include @@ -104,6 +111,10 @@ profile dpkg-scripts @{exec_path} { @{bin}/systemd-tty-ask-password-agent Px, @{pager_path} Px -> child-pager, + /etc/machine-id r, + + /var/lib/systemd/catalog/database r, + /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/ r, /{run,var}/log/journal/@{hex32}/system.journal* r, diff --git a/apparmor.d/groups/apt/dpkg-statoverride b/apparmor.d/groups/apt/dpkg-statoverride index 34d6412c1..d2e02f613 100644 --- a/apparmor.d/groups/apt/dpkg-statoverride +++ b/apparmor.d/groups/apt/dpkg-statoverride @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/dpkg-statoverride profile dpkg-statoverride @{exec_path} flags=(complain) { include + include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index c2d94e25a..fa6929f35 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -101,7 +101,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /var/crash/*.crash w, /var/lib/apt/periodic/unattended-upgrades-stamp w, - /var/lib/dpkg/info/ r, + /var/lib/dpkg/info/{,*} r, /var/lib/dpkg/lock rwk, /var/lib/dpkg/lock-frontend rwk, /var/lib/dpkg/updates/ r, From 5eb08f8de57803664d700b7d05fa7023f6b499b1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:47:49 +0200 Subject: [PATCH 1032/1455] feat(profile): improve pacman profiles. --- apparmor.d/groups/pacman/pacman-hook-code | 6 +++--- apparmor.d/groups/pacman/pacman-key | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/pacman/pacman-hook-code b/apparmor.d/groups/pacman/pacman-hook-code index 2496d7a9b..ee23781f4 100644 --- a/apparmor.d/groups/pacman/pacman-hook-code +++ b/apparmor.d/groups/pacman/pacman-hook-code @@ -6,7 +6,7 @@ abi , include -@{exec_path} = /usr/share/code-{features,marketplace}/patch.py +@{exec_path} = /usr/share/code-{features,marketplace}{,-insiders}/patch.py profile pacman-hook-code @{exec_path} { include include @@ -20,8 +20,8 @@ profile pacman-hook-code @{exec_path} { @{lib}/code/product.json rw, - /usr/share/code-{features,marketplace}/{,*} r, - /usr/share/code-{features,marketplace}/cache.json rw, + /usr/share/code-{features,marketplace}{,-insiders}/{,*} r, + /usr/share/code-{features,marketplace}{,-insiders}/cache.json rw, include if exists } diff --git a/apparmor.d/groups/pacman/pacman-key b/apparmor.d/groups/pacman/pacman-key index 025d87b29..a5cee6fa9 100644 --- a/apparmor.d/groups/pacman/pacman-key +++ b/apparmor.d/groups/pacman/pacman-key @@ -21,10 +21,10 @@ profile pacman-key @{exec_path} { @{bin}/bash rix, @{bin}/chmod rix, @{bin}/gettext rix, - @{bin}/gpg{,2} rCx -> gpg, + @{bin}/gpg{,2} rCx -> &gpg, @{bin}/{,e}grep rix, @{bin}/ngettext rix, - @{bin}/pacman-conf rPx, + @{bin}/pacman-conf rPx -> &pacman-conf, @{bin}/touch rix, @{bin}/tput rix, @{bin}/vercmp rix, From 03d7ef55896e0d5b7bf5348000fbdcab26737490 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:52:22 +0200 Subject: [PATCH 1033/1455] feat(profile): add profile for sshd session. It is only a first draft as recent update in sshd, split sshd in multiple binaries, it will allow us to also split the confinement in multiple profile. --- apparmor.d/groups/ssh/sshd | 2 +- apparmor.d/groups/ssh/sshd-session | 85 ++++++++++++++++++++++++++++++ 2 files changed, 86 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/groups/ssh/sshd-session diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index a514e7c99..75438c957 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -69,7 +69,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { @{bin}/passwd Px, @{lib}/{openssh,ssh}/sftp-server Px, @{lib}/{openssh,ssh}/sshd-auth Px, - @{lib}/{openssh,ssh}/sshd-session ix, + @{lib}/{openssh,ssh}/sshd-session Px, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*.conf} r, diff --git a/apparmor.d/groups/ssh/sshd-session b/apparmor.d/groups/ssh/sshd-session new file mode 100644 index 000000000..e74696334 --- /dev/null +++ b/apparmor.d/groups/ssh/sshd-session @@ -0,0 +1,85 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/{openssh,ssh}/sshd-session +profile sshd-session @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + include #aa:only RBAC + + capability audit_write, + capability chown, + capability dac_override, + capability dac_read_search, + capability fowner, + capability fsetid, + capability kill, + capability setgid, + capability setuid, + capability sys_chroot, + capability sys_resource, + + # sshd doesn't require net_admin. libpam-systemd tries to + # use it if available to set the send/receive buffers size, + # but will fall back to a non-privileged version if it fails. + deny capability net_admin, + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + network netlink raw, + + unix type=stream peer=(label=sshd), + + dbus send bus=system path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager + member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} + peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), + + @{exec_path} mr, + + @{bin}/@{shells} Ux, #aa:exclude RBAC + @{lib}/{openssh,ssh}/sshd-auth Px, + + @{etc_rw}/motd r, + @{etc_rw}/motd.d/{,**} r, + /etc/machine-id r, + /etc/motd r, + + /var/lib/lastlog/ r, + /var/lib/lastlog/lastlog2.db rwk, + /var/lib/lastlog/lastlog2.db-journal rw, + + /var/lib/wtmpdb/ w, + + owner @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r, + + owner @{user_cache_dirs}/{,motd*} rw, + + @{att}/@{run}/systemd/sessions/@{int}.ref w, + + @{run}/motd.d/{,*} r, + @{run}/motd.dynamic rw, + @{run}/motd.dynamic.new rw, + + @{PROC}/1/limits r, + owner @{PROC}/@{pid}/loginuid rw, + owner @{PROC}/@{pid}/uid_map r, + + /dev/ptmx rw, + + include if exists +} + +# vim:syntax=apparmor From 226cb23073efb628f344c5c1985a543564671ee0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:53:26 +0200 Subject: [PATCH 1034/1455] feat(profile): small improvement to steam. --- apparmor.d/groups/steam/steam | 4 ++++ apparmor.d/groups/steam/steamerrorreporter | 2 -- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/steam/steam b/apparmor.d/groups/steam/steam index 73c78f2ed..151a3e161 100644 --- a/apparmor.d/groups/steam/steam +++ b/apparmor.d/groups/steam/steam @@ -109,6 +109,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-logger rix, @{runtime_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix, + @{runtime_dirs}/pressure-vessel/@{bin}/pv-* rix, @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rcx -> web, @{runtime_dirs}/run{,.sh} rix, @@ -370,6 +371,8 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { /dev/hidraw@{int} rw, /dev/tty rw, + @{att}/dev/dri/renderD128 rw, + include if exists } @@ -380,6 +383,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { capability dac_override, capability dac_read_search, + capability sys_ptrace, unix receive type=stream, diff --git a/apparmor.d/groups/steam/steamerrorreporter b/apparmor.d/groups/steam/steamerrorreporter index b4d5f3e68..d438c604d 100644 --- a/apparmor.d/groups/steam/steamerrorreporter +++ b/apparmor.d/groups/steam/steamerrorreporter @@ -34,8 +34,6 @@ profile steamerrorreporter @{exec_path} flags=(attach_disconnected) { owner @{tmp}/dumps/ r, owner @{tmp}/dumps/*_log.txt rw, - owner @{PROC}/@{pid}/status r, - include if exists } From 6735b8e5f8ffa64a43297a3ff1318ef49376d388 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:55:22 +0200 Subject: [PATCH 1035/1455] feat(profile): zram: move kmod to its own subprofile. --- apparmor.d/groups/systemd/zram-generator | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/systemd/zram-generator b/apparmor.d/groups/systemd/zram-generator index d156d88a4..473848ef3 100644 --- a/apparmor.d/groups/systemd/zram-generator +++ b/apparmor.d/groups/systemd/zram-generator @@ -11,16 +11,13 @@ profile zram-generator @{exec_path} flags=(attach_disconnected) { include include - capability sys_module, - @{exec_path} mr, - @{bin}/kmod rix, + @{bin}/kmod rCx, @{bin}/systemd-detect-virt rPx, @{lib}/systemd/systemd-makefs rPx, /etc/systemd/zram-generator.conf r, - /etc/modprobe.d/{,**} r, owner @{run}/systemd/generator/{,*/}var-cache-makepkg.mount rw, owner @{run}/systemd/generator/dev-zram@{int}.swap rw, @@ -29,12 +26,18 @@ profile zram-generator @{exec_path} flags=(attach_disconnected) { @{sys}/block/zram@{int}/* rw, @{sys}/devices/virtual/block/zram@{int}/* rw, - @{sys}/module/compression r, @{PROC}/crypto r, owner /dev/pts/@{int} rw, + profile kmod { + include + include + + include if exists + } + include if exists } From 0483f476ed72c35993313a7edd4a9f3d2ddb9239 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 19:56:54 +0200 Subject: [PATCH 1036/1455] fix(profile): aa-enforce: ensure looking path in sbin is allowed. --- apparmor.d/groups/apparmor/aa-enforce | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/apparmor/aa-enforce b/apparmor.d/groups/apparmor/aa-enforce index fcf7dc724..1743fd9d0 100644 --- a/apparmor.d/groups/apparmor/aa-enforce +++ b/apparmor.d/groups/apparmor/aa-enforce @@ -16,7 +16,7 @@ profile aa-enforce @{exec_path} { @{exec_path} mr, - @{bin}/ r, + @{sbin}/ r, @{sbin}/apparmor_parser rPx, /usr/share/terminfo/** r, From 24a9da865f9daddc28e73793c9a8a724f9105592 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 20:05:47 +0200 Subject: [PATCH 1037/1455] chore: update sbin.list --- apparmor.d/profiles-a-f/atd | 2 +- tests/sbin.list | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-a-f/atd b/apparmor.d/profiles-a-f/atd index aea3cbf01..783d210fb 100644 --- a/apparmor.d/profiles-a-f/atd +++ b/apparmor.d/profiles-a-f/atd @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/atd +@{exec_path} = @{sbin}/atd profile atd @{exec_path} { include include diff --git a/tests/sbin.list b/tests/sbin.list index 1adc90ee8..1d0eb5b97 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -43,6 +43,7 @@ argdist-bpfcc arp arpd aspell-autobuildhash +atd audisp-af_unix audisp-filter audisp-syslog @@ -313,6 +314,7 @@ grub2-sparc64-setup grub2-switch-to-blscfg hardirqs-bpfcc haveged +hc-ifscan hdparm httxt2dbm hv_fcopy_daemon From e222816d32d5103399dac03651ac2ef222d72647 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 20:08:44 +0200 Subject: [PATCH 1038/1455] feat(profile): virt: move privileged actions to subprofle. --- apparmor.d/groups/virt/containerd | 6 ++-- apparmor.d/groups/virt/dockerd | 42 +++++++++++++++++++++++++-- apparmor.d/groups/virt/libvirtd | 9 +++++- apparmor.d/groups/virt/virt-aa-helper | 1 - 4 files changed, 49 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/virt/containerd b/apparmor.d/groups/virt/containerd index 598ec7ca9..95d332a45 100644 --- a/apparmor.d/groups/virt/containerd +++ b/apparmor.d/groups/virt/containerd @@ -87,10 +87,8 @@ profile containerd @{exec_path} flags=(attach_disconnected) { @{run}/nri/nri.sock rw, @{run}/systemd/notify w, - /tmp/cri-containerd.apparmor.d@{int} rwl, - /tmp/ctd-volume@{int}/{,**} rw, - owner @{tmp}/** rwkl, - owner /var/tmp/** rwkl, + /tmp/cri-containerd.apparmor.d@{int} rwl, + /tmp/ctd-volume@{int}/{,**} rw, @{sys}/fs/cgroup/kubepods/** r, @{sys}/kernel/security/apparmor/profiles r, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index c4b39ff8c..abd6c90ec 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -70,11 +70,12 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { @{lib}/docker/docker-init rCx -> init, @{bin}/docker-proxy rPx, @{bin}/git rCx -> git, - @{bin}/kmod rPx, + @{bin}/kmod rCx -> kmod, @{bin}/ps rPx, @{sbin}/runc rUx, @{bin}/unpigz rix, - @{sbin}/xtables-nft-multi rix, + @{sbin}/xtables-nft-multi rCx -> nft, + @{sbin}/xtables-legacy-multi rCx -> nft, # Docker needs full access of the containers it manages. # TODO: should be in a sub profile started with pivot_root, not supported yet. @@ -128,13 +129,48 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/net/ip_tables_names r, owner @{PROC}/@{pid}/task/@{tid}/mountinfo r, owner @{PROC}/@{pid}/uid_map r, /dev/ r, /dev/**/ r, + profile nft flags=(attach_disconnected) { + include + + capability net_admin, + capability net_raw, + + network inet raw, + network inet6 raw, + network netlink raw, + + @{sbin}/xtables-nft-multi rix, + @{sbin}/xtables-legacy-multi rix, + @{bin}/kmod rPx -> dockerd//kmod, + + @{PROC}/@{pid}/net/ip{,6}_tables_names r, + @{PROC}/sys/kernel/modprobe r, + + @{run}/xtables.lock rwk, + + include if exists + } + + profile kmod { + include + include + + capability sys_module, + + @{run}/xtables.lock r, + + @{sys}/module/compression r, + @{sys}/module/*/initstate r, + + include if exists + } + profile init flags=(attach_disconnected) { include diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 844af4443..a0d636883 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -106,7 +106,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{sbin}/dmidecode rPx, @{sbin}/dnsmasq rPx, - @{bin}/kmod rPx, + @{bin}/kmod rCx -> kmod, @{sbin}/lvm rPUx, @{bin}/mdevctl rPx, @{bin}/swtpm rPx, @@ -245,6 +245,13 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { audit deny @{sys}/kernel/security/apparmor/matching rwxl, audit deny @{sys}/kernel/security/apparmor/.* rwxl, + profile kmod { + include + include + + include if exists + } + profile qemu_bridge_helper { include diff --git a/apparmor.d/groups/virt/virt-aa-helper b/apparmor.d/groups/virt/virt-aa-helper index 81ec217b9..53afe6012 100644 --- a/apparmor.d/groups/virt/virt-aa-helper +++ b/apparmor.d/groups/virt/virt-aa-helper @@ -45,7 +45,6 @@ profile virt-aa-helper @{exec_path} { @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/net/psched r, deny @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/status r, # For gl enabled graphics /dev/dri/{,*} r, From f8250f7e0cc8e70fe679fac2374bad8690e24e09 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 20:22:25 +0200 Subject: [PATCH 1039/1455] feat(profile): move kmod in subprofile. --- apparmor.d/profiles-g-l/hw-probe | 18 +++++++++++++----- apparmor.d/profiles-g-l/kernel | 13 ++++++++----- apparmor.d/profiles-g-l/kmod | 9 +-------- 3 files changed, 22 insertions(+), 18 deletions(-) diff --git a/apparmor.d/profiles-g-l/hw-probe b/apparmor.d/profiles-g-l/hw-probe index f518a18f0..3fbb9b0fd 100644 --- a/apparmor.d/profiles-g-l/hw-probe +++ b/apparmor.d/profiles-g-l/hw-probe @@ -61,7 +61,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{sbin}/iwconfig rCx -> netconfig, @{bin}/journalctl rCx -> journalctl, @{bin}/killall rCx -> killall, - @{bin}/kmod rix, + @{bin}/kmod rCx -> kmod, @{bin}/lsb_release rPx -> lsb_release, @{bin}/lsblk rPx, @{bin}/lscpu rPx, @@ -98,19 +98,27 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/dmi/id/* r, @{sys}/firmware/efi/efivars/ r, @{sys}/firmware/efi/efivars/* r, - @{sys}/module/*/ r, - @{sys}/module/*/{coresize,refcnt} r, - @{sys}/module/*/holders/ r, @{PROC}/bus/input/devices r, @{PROC}/cmdline r, @{PROC}/interrupts r, @{PROC}/ioports r, - @{PROC}/modules r, @{PROC}/scsi/scsi r, /dev/{,**} r, + profile kmod { + include + include + + capability sys_module, + + @{sys}/module/compression r, + + include if exists + } + + profile pacman flags=(attach_disconnected) { include include diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel index 6bc2c8961..d375a1bdd 100644 --- a/apparmor.d/profiles-g-l/kernel +++ b/apparmor.d/profiles-g-l/kernel @@ -13,8 +13,6 @@ profile kernel @{exec_path} { include include - capability sys_module, - @{exec_path} mr, @{sh_path} rix, @@ -24,7 +22,7 @@ profile kernel @{exec_path} { @{bin}/chmod rix, @{bin}/cut rix, @{bin}/dirname rix, - @{bin}/kmod rix, + @{bin}/kmod rCx -> kmod, @{bin}/mv rix, @{bin}/rm rix, @{bin}/rmdir rix, @@ -56,8 +54,6 @@ profile kernel @{exec_path} { /etc/apt/apt.conf.d/ r, /etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw, - /etc/modprobe.d/ r, - /etc/modprobe.d/*.conf r, @{run}/reboot-required w, @{run}/reboot-required.pkgs rw, @@ -65,6 +61,13 @@ profile kernel @{exec_path} { @{PROC}/devices r, @{PROC}/cmdline r, + profile kmod { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index ccc8d6913..a793bf707 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/{kmod,lsmod,depmod,insmod,rmmod,modinfo,modprobe} profile kmod @{exec_path} flags=(attach_disconnected) { include - include + include include capability dac_read_search, @@ -31,14 +31,10 @@ profile kmod @{exec_path} flags=(attach_disconnected) { @{sbin}/sysctl rCx -> sysctl, @{bin}/true rix, - @{lib}/modprobe.d/{,*.conf} r, @{lib}/modules/*/modules.* rw, @{run}/modprobe.d/{,*.conf} r, - /etc/depmod.d/{,**} r, - /etc/modprobe.d/{,*.conf} r, - /tmp/**/*.ko{,.zst} r, /usr/src/*/*.ko r, /var/lib/dkms/**/module/*.ko r, @@ -66,9 +62,6 @@ profile kmod @{exec_path} flags=(attach_disconnected) { @{sys}/module/{,**} r, - @{PROC}/cmdline r, - @{PROC}/modules r, - /dev/tty@{int} rw, deny @{user_share_dirs}/gvfs-metadata/* r, From 0572688c592a181b4b35b7e29573302d3b3718b9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 20:27:06 +0200 Subject: [PATCH 1040/1455] feat(profile): small general upgrade. --- .../groups/systemd-service/dmesg.service | 1 + .../groups/systemd-service/man-db.service | 2 ++ apparmor.d/groups/ubuntu/esm_cache | 19 +++++++++++++++++++ apparmor.d/groups/ubuntu/update-manager | 6 +++--- apparmor.d/groups/usb/lsusb | 2 ++ apparmor.d/groups/whonix/sdwdate | 2 +- apparmor.d/profiles-a-f/e2scrub_all | 1 + apparmor.d/profiles-g-l/gitstatusd | 5 +++++ apparmor.d/profiles-g-l/gpu-manager | 2 +- apparmor.d/profiles-g-l/hddtemp | 18 +++--------------- apparmor.d/profiles-g-l/ischroot | 2 ++ apparmor.d/profiles-g-l/landscape-sysinfo | 6 +++--- apparmor.d/profiles-g-l/libreoffice | 2 +- apparmor.d/profiles-m-r/needrestart-notify | 2 +- apparmor.d/profiles-m-r/pycompile | 9 +++------ apparmor.d/profiles-m-r/rsyslogd | 7 ++++--- apparmor.d/profiles-s-z/update-initramfs | 3 +++ apparmor.d/profiles-s-z/whiptail | 2 ++ 18 files changed, 57 insertions(+), 34 deletions(-) create mode 100644 apparmor.d/groups/ubuntu/esm_cache diff --git a/apparmor.d/groups/systemd-service/dmesg.service b/apparmor.d/groups/systemd-service/dmesg.service index 4c67f680a..0a46f6ed9 100644 --- a/apparmor.d/groups/systemd-service/dmesg.service +++ b/apparmor.d/groups/systemd-service/dmesg.service @@ -17,6 +17,7 @@ profile dmesg.service flags=(attach_disconnected) { capability chown, capability fsetid, + capability sys_admin, ptrace read peer=@{p_systemd}, diff --git a/apparmor.d/groups/systemd-service/man-db.service b/apparmor.d/groups/systemd-service/man-db.service index 24b34fc25..c3bfa7c32 100644 --- a/apparmor.d/groups/systemd-service/man-db.service +++ b/apparmor.d/groups/systemd-service/man-db.service @@ -3,6 +3,7 @@ # SPDX-License-Identifier: GPL-2.0-only # ExecStart=+/usr/bin/install -d -o man -g man -m 0755 /var/cache/man +# ExecStart=/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete # ExecStart=/usr/bin/mandb --quiet abi , @@ -13,6 +14,7 @@ profile man-db.service flags=(attach_disconnected) { include include + @{bin}/find ix, @{bin}/install ix, @{bin}/mandb r, diff --git a/apparmor.d/groups/ubuntu/esm_cache b/apparmor.d/groups/ubuntu/esm_cache new file mode 100644 index 000000000..2596d6c12 --- /dev/null +++ b/apparmor.d/groups/ubuntu/esm_cache @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /usr/lib/ubuntu-advantage/esm_cache.py +profile esm_cache @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index e1636c6d5..0e0dcdb0b 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -51,9 +51,9 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { @{bin}/uname rix, @{lib}/apt/methods/http{,s} rPx, - @{lib}/@{python_name}/dist-packages/UpdateManager/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, - @{lib}/@{python_name}/dist-packages/gi/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, - @{lib}/@{python_name}/dist-packages/uaclient/{,**/}__pycache__/*.cpython-@{int}.pyc.@{int} rw, + @{lib}/@{python_name}/dist-packages/UpdateManager/{,**/}__pycache__/*.cpython-@{int}.pyc.@{u64} rw, + @{lib}/@{python_name}/dist-packages/gi/{,**/}__pycache__/*.cpython-@{int}.pyc.@{u64} rw, + @{lib}/@{python_name}/dist-packages/uaclient/{,**/}__pycache__/*.cpython-@{int}.pyc.@{u64} rw, /usr/share/distro-info/{,**} r, /usr/share/ubuntu-release-upgrader/{,**} r, diff --git a/apparmor.d/groups/usb/lsusb b/apparmor.d/groups/usb/lsusb index f824343d6..b5a24940d 100644 --- a/apparmor.d/groups/usb/lsusb +++ b/apparmor.d/groups/usb/lsusb @@ -21,6 +21,8 @@ profile lsusb @{exec_path} { /etc/udev/hwdb.bin r, + /dev/bus/usb/@{int}/@{int} w, + include if exists } diff --git a/apparmor.d/groups/whonix/sdwdate b/apparmor.d/groups/whonix/sdwdate index dbe561ab6..1e4850e7a 100644 --- a/apparmor.d/groups/whonix/sdwdate +++ b/apparmor.d/groups/whonix/sdwdate @@ -30,7 +30,7 @@ profile sdwdate @{exec_path} flags=(attach_disconnected) { @{bin}/touch rix, @{lib}/helper-scripts/* rix, @{bin}/url_to_unixtime rix, - @{bin}/{,e}grep rix, + @{bin}/{,e}grep rix, @{lib}/helper-scripts/ r, @{lib}/sdwdate/ r, diff --git a/apparmor.d/profiles-a-f/e2scrub_all b/apparmor.d/profiles-a-f/e2scrub_all index 0079053e0..e5d13f1de 100644 --- a/apparmor.d/profiles-a-f/e2scrub_all +++ b/apparmor.d/profiles-a-f/e2scrub_all @@ -12,6 +12,7 @@ profile e2scrub_all @{exec_path} flags=(attach_disconnected) { include include + capability setuid, capability sys_admin, capability sys_rawio, diff --git a/apparmor.d/profiles-g-l/gitstatusd b/apparmor.d/profiles-g-l/gitstatusd index a62ce7fde..8901ade9c 100644 --- a/apparmor.d/profiles-g-l/gitstatusd +++ b/apparmor.d/profiles-g-l/gitstatusd @@ -9,6 +9,9 @@ include @{exec_path} = /usr/share/zsh-theme-powerlevel@{int}k/gitstatus/usrbin/gitstatusd{,-*} profile gitstatusd @{exec_path} { include + include + + signal receive set=term peer=*//shell, @{exec_path} mr, @@ -18,6 +21,8 @@ profile gitstatusd @{exec_path} { owner @{HOME}/.gitconfig r, owner @{user_config_dirs}/git/{,*} r, + owner @{tmp}/gitstatus.POWERLEVEL9K.*.fifo r, + # Silencer deny capability dac_read_search, deny capability dac_override, diff --git a/apparmor.d/profiles-g-l/gpu-manager b/apparmor.d/profiles-g-l/gpu-manager index 779dd8e67..719625dbd 100644 --- a/apparmor.d/profiles-g-l/gpu-manager +++ b/apparmor.d/profiles-g-l/gpu-manager @@ -16,7 +16,7 @@ profile gpu-manager @{exec_path} { @{exec_path} mr, - @{sh_path} rix, + @{sh_path} rix, @{bin}/{,e}grep rix, /etc/modprobe.d/{,**} r, diff --git a/apparmor.d/profiles-g-l/hddtemp b/apparmor.d/profiles-g-l/hddtemp index e96a45237..55d2abb5d 100644 --- a/apparmor.d/profiles-g-l/hddtemp +++ b/apparmor.d/profiles-g-l/hddtemp @@ -10,32 +10,20 @@ include @{exec_path} = @{bin}/hddtemp profile hddtemp @{exec_path} { include + include + include - # To remove the following errors: - # /dev/sda: Permission denied + capability sys_admin, capability sys_rawio, - # There's the following error in strace: - # ioctl(3, HDIO_DRIVE_CMD, 0x7ffdfeafc074) = -1 EACCES (Permission denied) - # This should be covered by CAP_SYS_RAWIO instead. - # (see: https://www.kernel.org/doc/Documentation/ioctl/hdio.rst) - # It looks like hddtemp works just fine without it. - deny capability sys_admin, - network inet stream, network inet6 stream, @{exec_path} mr, - # Monitored hard drives - /dev/sd[a-z]* r, - # Database file that allows hddtemp to recognize supported drives /etc/hddtemp.db r, - # Needed when the hddtemp daemon is started in the TCP/IP mode - /etc/gai.conf r, - include if exists } diff --git a/apparmor.d/profiles-g-l/ischroot b/apparmor.d/profiles-g-l/ischroot index 4e087343a..8c18782f9 100644 --- a/apparmor.d/profiles-g-l/ischroot +++ b/apparmor.d/profiles-g-l/ischroot @@ -13,6 +13,8 @@ profile ischroot @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + /var/lib/update-notifier/tmp.@{rand10} w, + @{PROC}/@{pid}/mountinfo r, include if exists diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo b/apparmor.d/profiles-g-l/landscape-sysinfo index 1c3c98d52..5eb5dac06 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo +++ b/apparmor.d/profiles-g-l/landscape-sysinfo @@ -27,9 +27,9 @@ profile landscape-sysinfo @{exec_path} { @{bin}/who rix, - @{lib}/@{python_name}/dist-packages/landscape/{,**/}__pycache__/ w, - @{lib}/@{python_name}/dist-packages/landscape/{,**/}__pycache__/**.pyc w, - @{lib}/@{python_name}/dist-packages/landscape/{,**/}__pycache__/**.pyc.@{u64} w, + @{lib}/@{python_name}/**/__pycache__/ w, + @{lib}/@{python_name}/**/__pycache__/**.pyc w, + @{lib}/@{python_name}/**/__pycache__/**.pyc.@{u64} w, /var/log/landscape/{,**} rw, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 8cc8a65e1..b21642cf8 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -13,6 +13,7 @@ profile libreoffice @{exec_path} { include include include + include include include include @@ -109,7 +110,6 @@ profile libreoffice @{exec_path} { @{sys}/kernel/mm/hugepages/ r, @{sys}/kernel/mm/transparent_hugepage/enabled r, @{sys}/kernel/mm/transparent_hugepage/shmem_enabled r, - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/{cpu,memory}.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/**/memory.max r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r, diff --git a/apparmor.d/profiles-m-r/needrestart-notify b/apparmor.d/profiles-m-r/needrestart-notify index 9b3525fa5..82465ceb2 100644 --- a/apparmor.d/profiles-m-r/needrestart-notify +++ b/apparmor.d/profiles-m-r/needrestart-notify @@ -9,6 +9,7 @@ include @{exec_path} = @{etc_ro}/needrestart/notify.d/* profile needrestart-notify @{exec_path} { include + include capability dac_read_search, capability sys_ptrace, @@ -27,7 +28,6 @@ profile needrestart-notify @{exec_path} { /etc/needrestart/notify.conf r, @{PROC}/@{pid}/environ r, - @{PROC}/filesystems r, include if exists } diff --git a/apparmor.d/profiles-m-r/pycompile b/apparmor.d/profiles-m-r/pycompile index 984fcf03c..b684c3094 100644 --- a/apparmor.d/profiles-m-r/pycompile +++ b/apparmor.d/profiles-m-r/pycompile @@ -21,12 +21,9 @@ profile pycompile @{exec_path} flags=(attach_disconnected,complain) { @{bin}/dpkg rCx -> dpkg, - @{lib}/@{python_name}/dist-packages/__pycache__/ w, - @{lib}/@{python_name}/dist-packages/__pycache__/*.pyc w, - @{lib}/@{python_name}/dist-packages/__pycache__/*.pyc.* w, - @{lib}/@{python_name}/dist-packages/**/__pycache__/ w, - @{lib}/@{python_name}/dist-packages/**/__pycache__/*.pyc w, - @{lib}/@{python_name}/dist-packages/**/__pycache__/*.pyc.* w, + @{lib}/@{python_name}/**/__pycache__/ w, + @{lib}/@{python_name}/**/__pycache__/*.pyc w, + @{lib}/@{python_name}/**/__pycache__/*.pyc.* w, /usr/share/python3/{,**} r, diff --git a/apparmor.d/profiles-m-r/rsyslogd b/apparmor.d/profiles-m-r/rsyslogd index 80d75a928..ede981f58 100644 --- a/apparmor.d/profiles-m-r/rsyslogd +++ b/apparmor.d/profiles-m-r/rsyslogd @@ -12,11 +12,12 @@ profile rsyslogd @{exec_path} { include include - capability chown, # For creating new log files and changing their owner/group - capability net_admin, # For remote logs - capability setgid, # For downgrading privileges + capability dac_override, + capability dac_read_search, + capability setgid, capability setuid, capability sys_nice, + capability sys_tty_config, capability syslog, network inet dgram, diff --git a/apparmor.d/profiles-s-z/update-initramfs b/apparmor.d/profiles-s-z/update-initramfs index f9e47cb52..472de3343 100644 --- a/apparmor.d/profiles-s-z/update-initramfs +++ b/apparmor.d/profiles-s-z/update-initramfs @@ -28,12 +28,15 @@ profile update-initramfs @{exec_path} { @{bin}/sha1sum rix, @{bin}/sync rix, @{bin}/uname rix, + @{bin}/run-parts rix, @{bin}/dpkg-trigger rPx, @{bin}/ischroot rPx, @{bin}/linux-version rPx, @{sbin}/mkinitramfs rPx, + /etc/initramfs/post-update.d/* rPUx, + /var/lib/initramfs-tools/* w, # For shell pwd diff --git a/apparmor.d/profiles-s-z/whiptail b/apparmor.d/profiles-s-z/whiptail index f0efad77b..a42a63312 100644 --- a/apparmor.d/profiles-s-z/whiptail +++ b/apparmor.d/profiles-s-z/whiptail @@ -18,6 +18,8 @@ profile whiptail @{exec_path} { /usr/share/terminfo/** r, + /etc/newt/palette.* r, + include if exists } From 4d201ea417f3b32bc7e276ef4548f1c128a68301 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 20:35:38 +0200 Subject: [PATCH 1041/1455] feat(profile): add lsb-release Use it instead of lsb_release. --- apparmor.d/abstractions/app/chromium | 5 ++- apparmor.d/abstractions/app/firefox | 2 +- apparmor.d/groups/apt/apt-listbugs | 2 +- apparmor.d/groups/apt/command-not-found | 2 +- apparmor.d/groups/apt/debconf-frontend | 2 +- apparmor.d/groups/apt/reportbug | 2 +- apparmor.d/groups/apt/synaptic | 2 +- apparmor.d/groups/apt/unattended-upgrade | 2 +- apparmor.d/groups/grub/grub-install | 2 +- apparmor.d/groups/grub/grub-mkconfig | 2 +- apparmor.d/groups/grub/grub-probe | 2 +- apparmor.d/groups/kde/dolphin | 2 +- apparmor.d/groups/kde/drkonqi | 2 +- apparmor.d/groups/ubuntu/apport-gtk | 2 +- .../groups/ubuntu/check-new-release-gtk | 2 +- apparmor.d/groups/ubuntu/do-release-upgrade | 2 +- apparmor.d/groups/ubuntu/hwe-support-status | 2 +- .../groups/ubuntu/software-properties-dbus | 2 +- .../groups/ubuntu/software-properties-gtk | 2 +- apparmor.d/groups/ubuntu/update-manager | 2 +- .../ubuntu/update-motd-updates-available | 2 +- apparmor.d/groups/ubuntu/update-notifier | 2 +- apparmor.d/profiles-a-f/adequate | 2 +- apparmor.d/profiles-a-f/aspell-autobuildhash | 2 +- .../profiles-a-f/check-support-status-hook | 2 +- apparmor.d/profiles-a-f/discord | 2 +- apparmor.d/profiles-a-f/dropbox | 2 +- apparmor.d/profiles-a-f/filezilla | 2 +- apparmor.d/profiles-g-l/hardinfo | 2 +- apparmor.d/profiles-g-l/hw-probe | 2 +- apparmor.d/profiles-g-l/kodi | 2 +- apparmor.d/profiles-g-l/lsb-release | 40 +++++++++++++++++++ apparmor.d/profiles-m-r/mumble | 2 +- apparmor.d/profiles-m-r/murmurd | 2 +- apparmor.d/profiles-m-r/psi | 2 +- apparmor.d/profiles-m-r/psi-plus | 2 +- 36 files changed, 77 insertions(+), 36 deletions(-) create mode 100644 apparmor.d/profiles-g-l/lsb-release diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 666387d0a..e555d3475 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -37,7 +37,7 @@ include include include - include + include include include include @@ -78,7 +78,7 @@ @{lib_dirs}/chrome-sandbox rPx, # Desktop integration - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/xdg-desktop-menu rPx, @{bin}/xdg-email rPx, @{bin}/xdg-icon-resource rPx, @@ -202,6 +202,7 @@ owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_{,score_}adj rw, owner @{PROC}/@{pid}/setgroups w, + owner @{PROC}/@{pid}/smaps_rollup r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat r, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index d988f608c..5e3bc15cb 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -65,7 +65,7 @@ @{lib_dirs}/plugin-container rPx, # Desktop integration - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /usr/share/@{name}/{,**} r, /usr/share/doc/{,**} r, diff --git a/apparmor.d/groups/apt/apt-listbugs b/apparmor.d/groups/apt/apt-listbugs index 7ce8961b9..a60457ec8 100644 --- a/apparmor.d/groups/apt/apt-listbugs +++ b/apparmor.d/groups/apt/apt-listbugs @@ -53,7 +53,7 @@ profile apt-listbugs @{exec_path} { include include capability dac_read_search, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/hostname rix, owner @{PROC}/@{pid}/mounts r, @{HOME}/.Xauthority r, diff --git a/apparmor.d/groups/apt/command-not-found b/apparmor.d/groups/apt/command-not-found index 35f8940ee..b42649d7c 100644 --- a/apparmor.d/groups/apt/command-not-found +++ b/apparmor.d/groups/apt/command-not-found @@ -22,7 +22,7 @@ profile command-not-found @{exec_path} { @{exec_path} r, @{python_path} r, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/snap rPx, @{lib}/ r, diff --git a/apparmor.d/groups/apt/debconf-frontend b/apparmor.d/groups/apt/debconf-frontend index a8f7057e7..4660755d6 100644 --- a/apparmor.d/groups/apt/debconf-frontend +++ b/apparmor.d/groups/apt/debconf-frontend @@ -21,7 +21,7 @@ profile debconf-frontend @{exec_path} flags=(complain) { @{exec_path} r, @{bin}/hostname ix, - @{bin}/lsb_release Px -> lsb_release, + @{bin}/lsb_release Px, @{bin}/stty ix, @{sbin}/update-secureboot-policy Px, diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index ab230a43b..e58c9d8b3 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -47,7 +47,7 @@ profile reportbug @{exec_path} { @{bin}/dlocate rPx, @{bin}/dpkg rPx -> child-dpkg, @{bin}/dpkg-query rpx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{pager_path} rPx -> child-pager, @{bin}/systemctl rCx -> systemctl, @{lib}/firefox/firefox rPUx, # App allowed to open diff --git a/apparmor.d/groups/apt/synaptic b/apparmor.d/groups/apt/synaptic index 651fac1ba..36e299a0c 100644 --- a/apparmor.d/groups/apt/synaptic +++ b/apparmor.d/groups/apt/synaptic @@ -47,7 +47,7 @@ profile synaptic @{exec_path} { @{bin}/dpkg rPx, @{sbin}/dpkg-preconfigure rPx, @{bin}/localepurge rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/pkexec rCx -> pkexec, @{bin}/ps rPx, @{bin}/software-properties-gtk rPx, diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index fa6929f35..0d4d2ee33 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -58,7 +58,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { @{bin}/dpkg-divert Px, @{bin}/etckeeper Px, @{bin}/ischroot Px, - @{bin}/lsb_release Px -> lsb_release, + @{bin}/lsb_release Px, @{sbin}/dpkg-preconfigure Px, @{sbin}/on_ac_power Px, @{sbin}/sendmail Px, diff --git a/apparmor.d/groups/grub/grub-install b/apparmor.d/groups/grub/grub-install index f044b0f44..6c45cac39 100644 --- a/apparmor.d/groups/grub/grub-install +++ b/apparmor.d/groups/grub/grub-install @@ -21,7 +21,7 @@ profile grub-install @{exec_path} flags=(complain) { @{sh_path} rix, @{sbin}/efibootmgr rix, @{bin}/kmod rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/udevadm rPx, /usr/share/grub/{,**} r, diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index 87c3d4104..1b5d26125 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -39,7 +39,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { @{bin}/head rix, @{bin}/id rPx, @{bin}/ls rix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/mktemp rix, @{bin}/mount rPx, @{bin}/mountpoint rix, diff --git a/apparmor.d/groups/grub/grub-probe b/apparmor.d/groups/grub/grub-probe index 6d0ec6a72..e1037c6b7 100644 --- a/apparmor.d/groups/grub/grub-probe +++ b/apparmor.d/groups/grub/grub-probe @@ -19,7 +19,7 @@ profile grub-probe @{exec_path} { @{exec_path} mr, /{usr/,}{local/,}{s,}bin/zpool rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{sbin}/lvm rPx, @{bin}/udevadm rPx, diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 802ba0a96..eebade917 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -33,7 +33,7 @@ profile dolphin @{exec_path} { @{lib}/libheif/*.so* mr, @{bin}/ldd rix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{lib}/{,@{multiarch}/}utempter/utempter rPx, @{thunderbird_path} rPx, diff --git a/apparmor.d/groups/kde/drkonqi b/apparmor.d/groups/kde/drkonqi index fbadf053b..e04180ff4 100644 --- a/apparmor.d/groups/kde/drkonqi +++ b/apparmor.d/groups/kde/drkonqi @@ -24,7 +24,7 @@ profile drkonqi @{exec_path} { @{exec_path} mr, @{bin}/plasmashell r, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /usr/share/drkonqi/{,**} r, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 5a4e130a0..4940653a3 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -46,7 +46,7 @@ profile apport-gtk @{exec_path} { @{sbin}/killall5 rix, @{bin}/kmod rPx, @{bin}/ldd rix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/md5sum rix, @{bin}/pkexec rCx -> pkexec, @{bin}/systemctl rCx -> systemctl, diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index bdd2a0f54..65a19e0e0 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -30,7 +30,7 @@ profile check-new-release-gtk @{exec_path} { @{bin}/dpkg rPx, @{bin}/ischroot rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{lib}/@{python_name}/dist-packages/UpdateManager/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, @{lib}/@{python_name}/dist-packages/gi/**/__pycache__/*.cpython-@{int}.pyc.@{int} w, diff --git a/apparmor.d/groups/ubuntu/do-release-upgrade b/apparmor.d/groups/ubuntu/do-release-upgrade index e7d6687d2..2d3eebbc2 100644 --- a/apparmor.d/groups/ubuntu/do-release-upgrade +++ b/apparmor.d/groups/ubuntu/do-release-upgrade @@ -27,7 +27,7 @@ profile do-release-upgrade @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/ischroot rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /usr/share/distro-info/*.csv r, /usr/share/ubuntu-release-upgrader/{,**} r, diff --git a/apparmor.d/groups/ubuntu/hwe-support-status b/apparmor.d/groups/ubuntu/hwe-support-status index 3b4280e33..d5ad6e06c 100644 --- a/apparmor.d/groups/ubuntu/hwe-support-status +++ b/apparmor.d/groups/ubuntu/hwe-support-status @@ -15,7 +15,7 @@ profile hwe-support-status @{exec_path} { @{exec_path} mr, @{bin}/dpkg rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /usr/share/distro-info/{,**} r, diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index c4c795649..8d55ec0b7 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -30,7 +30,7 @@ profile software-properties-dbus @{exec_path} { @{python_path} rix, @{bin}/env rix, @{bin}/apt-key rPx, # Changing trusted keys - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /etc/apt/apt.conf.d/10periodic w, /etc/apt/sources.list{,.save} rw, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 64c83f5c8..bb31d8867 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -33,7 +33,7 @@ profile software-properties-gtk @{exec_path} { @{bin}/apt-key rPx, @{bin}/dpkg rPx -> child-dpkg, @{bin}/ischroot rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/ubuntu-advantage rPx, /usr/share/distro-info/*.csv r, diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 0e0dcdb0b..d69e7a4c4 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -45,7 +45,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { @{bin}/dpkg rPx -> child-dpkg, @{bin}/hwe-support-status rPx, @{bin}/ischroot rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/snap rPUx, @{bin}/software-properties-gtk rPx, @{bin}/uname rix, diff --git a/apparmor.d/groups/ubuntu/update-motd-updates-available b/apparmor.d/groups/ubuntu/update-motd-updates-available index e6a3e7152..88967baf8 100644 --- a/apparmor.d/groups/ubuntu/update-motd-updates-available +++ b/apparmor.d/groups/ubuntu/update-motd-updates-available @@ -27,7 +27,7 @@ profile update-motd-updates-available @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/find rix, @{bin}/ischroot rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/mktemp rix, @{bin}/mv rix, @{bin}/rm rix, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index ea6318156..6c4dc4d77 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -35,7 +35,7 @@ profile update-notifier @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/ischroot rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/pkexec rCx -> pkexec, @{bin}/snap rPUx, @{bin}/software-properties-gtk rPx, diff --git a/apparmor.d/profiles-a-f/adequate b/apparmor.d/profiles-a-f/adequate index c4741b09a..b7a62fc82 100644 --- a/apparmor.d/profiles-a-f/adequate +++ b/apparmor.d/profiles-a-f/adequate @@ -90,7 +90,7 @@ profile adequate @{exec_path} flags=(complain) { include include capability dac_read_search, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/hostname rix, owner @{PROC}/@{pid}/mounts r, @{HOME}/.Xauthority r, diff --git a/apparmor.d/profiles-a-f/aspell-autobuildhash b/apparmor.d/profiles-a-f/aspell-autobuildhash index a10df8394..e8a83892a 100644 --- a/apparmor.d/profiles-a-f/aspell-autobuildhash +++ b/apparmor.d/profiles-a-f/aspell-autobuildhash @@ -62,7 +62,7 @@ profile aspell-autobuildhash @{exec_path} flags=(complain) { include include capability dac_read_search, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/hostname rix, owner @{PROC}/@{pid}/mounts r, @{HOME}/.Xauthority r, diff --git a/apparmor.d/profiles-a-f/check-support-status-hook b/apparmor.d/profiles-a-f/check-support-status-hook index 39f30c5fe..8101b3008 100644 --- a/apparmor.d/profiles-a-f/check-support-status-hook +++ b/apparmor.d/profiles-a-f/check-support-status-hook @@ -84,7 +84,7 @@ profile check-support-status-hook @{exec_path} { include include capability dac_read_search, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/hostname rix, owner @{PROC}/@{pid}/mounts r, @{HOME}/.Xauthority r, diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index 53038a6d7..ddcd99add 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -31,7 +31,7 @@ profile discord @{exec_path} { @{exec_path} mrix, @{sh_path} rix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{lib_dirs}/chrome-sandbox rix, @{lib_dirs}/chrome_crashpad_handler rix, diff --git a/apparmor.d/profiles-a-f/dropbox b/apparmor.d/profiles-a-f/dropbox index b4baf1d0c..15f86bcf5 100644 --- a/apparmor.d/profiles-a-f/dropbox +++ b/apparmor.d/profiles-a-f/dropbox @@ -39,7 +39,7 @@ profile dropbox @{exec_path} { @{bin}/{,@{multiarch}-}objdump rix, @{open_path} rPx -> child-open-strict, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, owner @{HOME}/ r, owner @{config_dirs}/ rw, diff --git a/apparmor.d/profiles-a-f/filezilla b/apparmor.d/profiles-a-f/filezilla index 4463ac581..366c2aed6 100644 --- a/apparmor.d/profiles-a-f/filezilla +++ b/apparmor.d/profiles-a-f/filezilla @@ -38,7 +38,7 @@ profile filezilla @{exec_path} { @{bin}/fzsftp rPx, # When using SFTP protocol @{bin}/fzputtygen rPUx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /usr/share/filezilla/{,**} r, diff --git a/apparmor.d/profiles-g-l/hardinfo b/apparmor.d/profiles-g-l/hardinfo index 97fad1f13..b63a9e5ed 100644 --- a/apparmor.d/profiles-g-l/hardinfo +++ b/apparmor.d/profiles-g-l/hardinfo @@ -46,7 +46,7 @@ profile hardinfo @{exec_path} { @{bin}/valgrind{,.bin} rix, @{lib}/@{multiarch}/valgrind/memcheck-*-linux rix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{open_path} rPx -> child-open, @{bin}/ccache rCx -> ccache, @{bin}/kmod rCx -> kmod, diff --git a/apparmor.d/profiles-g-l/hw-probe b/apparmor.d/profiles-g-l/hw-probe index 3fbb9b0fd..802cb85ae 100644 --- a/apparmor.d/profiles-g-l/hw-probe +++ b/apparmor.d/profiles-g-l/hw-probe @@ -62,7 +62,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/journalctl rCx -> journalctl, @{bin}/killall rCx -> killall, @{bin}/kmod rCx -> kmod, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/lsblk rPx, @{bin}/lscpu rPx, @{bin}/lspci rPx, diff --git a/apparmor.d/profiles-g-l/kodi b/apparmor.d/profiles-g-l/kodi index 016dceae0..5b90dd3ef 100644 --- a/apparmor.d/profiles-g-l/kodi +++ b/apparmor.d/profiles-g-l/kodi @@ -34,7 +34,7 @@ profile kodi @{exec_path} { @{bin}/mv rix, @{bin}/uname rix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /usr/share/kodi/{,**} r, /usr/share/publicsuffix/* r, diff --git a/apparmor.d/profiles-g-l/lsb-release b/apparmor.d/profiles-g-l/lsb-release new file mode 100644 index 000000000..23bada3ec --- /dev/null +++ b/apparmor.d/profiles-g-l/lsb-release @@ -0,0 +1,40 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Note: named "lsb-release" to not conflict with upstreamed "lsb_release" that +# does attach @{bin}/lsb_release. + +abi , + +include + +@{exec_path} = @{bin}/lsb_release +profile lsb-release @{exec_path} flags=(attach_disconnected) { + include + include + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/basename rix, + @{bin}/cat rix, + @{bin}/cut rix, + @{bin}/find rix, + @{bin}/getopt rix, + @{bin}/head rix, + @{bin}/sed rix, + @{bin}/tr rix, + + #aa:only apt + @{bin}/dpkg-query px, + + /etc/ r, + /etc/*-release r, + /etc/lsb-release r, + /etc/lsb-release.d/{,*} r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/mumble b/apparmor.d/profiles-m-r/mumble index 48ed42d84..a85eb6790 100644 --- a/apparmor.d/profiles-m-r/mumble +++ b/apparmor.d/profiles-m-r/mumble @@ -30,7 +30,7 @@ profile mumble @{exec_path} { @{exec_path} mrix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{browsers_path} rPx, @{open_path} rPx -> child-open, diff --git a/apparmor.d/profiles-m-r/murmurd b/apparmor.d/profiles-m-r/murmurd index 9d7663ebb..2065dd814 100644 --- a/apparmor.d/profiles-m-r/murmurd +++ b/apparmor.d/profiles-m-r/murmurd @@ -29,7 +29,7 @@ profile murmurd @{exec_path} { @{exec_path} mr, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, /etc/mumble-server.ini r, diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index 24e0c61dd..02bf3bc56 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -34,7 +34,7 @@ profile psi @{exec_path} { @{bin}/aplay rCx -> aplay, @{bin}/gpg{,2} rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{open_path} rPx -> child-open, @{lib}/firefox/firefox rPUx, diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index 1d3850ba5..a455df0e9 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -34,7 +34,7 @@ profile psi-plus @{exec_path} { @{bin}/aplay rCx -> aplay, @{bin}/gpg{,2} rPx, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{open_path} rPx -> child-open, @{lib}/firefox/firefox rPUx, From 43278aeda277619b5fe24252db8a9eea7dd8b02c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 20:36:52 +0200 Subject: [PATCH 1042/1455] feat(profile): rewrite the profile for hw-probe. --- apparmor.d/groups/utils/lsscsi | 24 ++++++++++++++ apparmor.d/profiles-g-l/hw-probe | 56 ++++++++++---------------------- 2 files changed, 41 insertions(+), 39 deletions(-) create mode 100644 apparmor.d/groups/utils/lsscsi diff --git a/apparmor.d/groups/utils/lsscsi b/apparmor.d/groups/utils/lsscsi new file mode 100644 index 000000000..f0e7b4df2 --- /dev/null +++ b/apparmor.d/groups/utils/lsscsi @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lsscsi +profile lsscsi @{exec_path} { + include + include + + @{exec_path} mr, + + / r, + + /dev/ r, + /dev/** r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-g-l/hw-probe b/apparmor.d/profiles-g-l/hw-probe index 802cb85ae..2b91fc612 100644 --- a/apparmor.d/profiles-g-l/hw-probe +++ b/apparmor.d/profiles-g-l/hw-probe @@ -11,7 +11,6 @@ include profile hw-probe @{exec_path} flags=(attach_disconnected) { include include - include capability sys_admin, @@ -37,28 +36,18 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/acpi rPx, @{bin}/amixer rPx, @{bin}/aplay rPx, - @{sbin}/biosdecode rPx, @{bin}/cpuid rPx, @{bin}/cpupower rPx, @{bin}/curl rCx -> curl, @{bin}/df rPx, - @{sbin}/dkms rPx, @{bin}/dmesg rPx, - @{sbin}/dmidecode rPx, @{bin}/dpkg rPx -> child-dpkg, @{bin}/edid-decode rPx, - @{sbin}/ethtool rCx -> netconfig, - @{sbin}/fdisk rPx, @{bin}/glxgears rPx, @{bin}/glxinfo rPx, @{bin}/hciconfig rPx, - @{sbin}/hdparm rPx, - @{sbin}/hwinfo rPx, @{bin}/i2cdetect rPx, - @{sbin}/ifconfig rCx -> netconfig, @{bin}/inxi rPx, - @{sbin}/iw rCx -> netconfig, - @{sbin}/iwconfig rCx -> netconfig, @{bin}/journalctl rCx -> journalctl, @{bin}/killall rCx -> killall, @{bin}/kmod rCx -> kmod, @@ -66,14 +55,13 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/lsblk rPx, @{bin}/lscpu rPx, @{bin}/lspci rPx, + @{bin}/lsscsi rPx, @{bin}/lsusb rPx, @{bin}/memtester rPx, @{bin}/nmcli rPx, @{bin}/pacman rCx -> pacman, - @{sbin}/rfkill rPx, @{bin}/rpm rCx -> rpm, @{bin}/sensors rPx, - @{sbin}/smartctl rPx, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-analyze rPx, @{bin}/udevadm rCx -> udevadm, @@ -83,12 +71,20 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/xdpyinfo rPx, @{bin}/xinput rPx, @{bin}/xrandr rPx, + @{sbin}/biosdecode rPx, + @{sbin}/dkms rPx, + @{sbin}/dmidecode rPx, + @{sbin}/fdisk rPx, + @{sbin}/hdparm rPx, + @{sbin}/hwinfo rPx, + @{sbin}/rfkill rPx, + @{sbin}/smartctl rPx, /etc/modprobe.d/{,*.conf} r, owner @{HOME}/HW_PROBE/{,**} rw, - audit owner @{tmp}/*/ rw, + owner @{tmp}/@{rand10}/ rw, owner @{tmp}/*/cpu_perf rw, @{sys}/class/drm/ r, @@ -118,6 +114,13 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { include if exists } + profile curl flags=(attach_disconnected) { + include + + @{bin}/curl mr, + + include if exists + } profile pacman flags=(attach_disconnected) { include @@ -199,31 +202,6 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { include if exists } - profile netconfig flags=(attach_disconnected) { - include - - # Not needed - deny capability net_admin, - deny capability net_raw, - - network inet dgram, - network inet6 dgram, - network ipx dgram, - network ax25 dgram, - network appletalk dgram, - network netlink raw, - - @{sbin}/iw mr, - @{sbin}/ifconfig mr, - @{sbin}/iwconfig mr, - @{sbin}/ethtool mr, - - owner @{PROC}/@{pid}/net/if_inet6 r, - owner @{PROC}/@{pid}/net/dev r, - - include if exists - } - profile systemctl flags=(attach_disconnected) { include include From f443c71c7bb2db3f66440d9d230d994dacc3df4e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 21:05:53 +0200 Subject: [PATCH 1043/1455] tests: allow empty abstractions directory. --- tests/check.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 28adc7710..8b847db6f 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -390,7 +390,7 @@ check_profiles() { check_abstractions() { _msg "Checking abstractions" - mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*") + mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*" 2>/dev/null || true) jobs=0 WITH_CHECK=( abstractions equivalent @@ -408,8 +408,8 @@ check_abstractions() { wait mapfile -t files < <( - find "$APPARMORD/abstractions" -type f -path "$APPARMORD/abstractions/*.d/*" - find "$APPARMORD/mappings" -type f + find "$APPARMORD/abstractions" -type f -path "$APPARMORD/abstractions/*.d/*" 2>/dev/null || true + find "$APPARMORD/mappings" -type f 2>/dev/null || true ) # shellcheck disable=SC2034 jobs=0 From 1aee62f52cb02cbdb054c233a350f4f07d828e48 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 21:07:02 +0200 Subject: [PATCH 1044/1455] feat(abs): mappings: add support for role from the sshd-session profile. --- apparmor.d/abstractions/mapping/sshd | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apparmor.d/abstractions/mapping/sshd b/apparmor.d/abstractions/mapping/sshd index 97f0b077e..0f7512710 100644 --- a/apparmor.d/abstractions/mapping/sshd +++ b/apparmor.d/abstractions/mapping/sshd @@ -15,6 +15,8 @@ capability audit_write, capability chown, capability dac_read_search, + capability fowner, + capability fsetid, capability kill, capability setgid, capability setuid, @@ -25,12 +27,14 @@ # but will fall back to a non-privileged version if it fails. deny capability net_admin, + network inet stream, network inet6 stream, network netlink raw, signal receive set=exists peer=@{p_systemd_journald}, signal receive set=hup peer=@{p_systemd}, + unix bind type=stream addr=@@{udbus}/bus/sshd-session/system, unix bind type=stream addr=@@{udbus}/bus/sshd/system, dbus send bus=system path=/org/freedesktop/login1 From 0366543c39cb495e7129aee373055133b2324823 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 21 Jun 2025 21:09:37 +0200 Subject: [PATCH 1045/1455] feat(profile): add console-setup profiles. --- apparmor.d/profiles-a-f/console-setup-cached | 36 +++++++++++++++++++ .../profiles-a-f/console-setup-keyboard | 31 ++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 apparmor.d/profiles-a-f/console-setup-cached create mode 100644 apparmor.d/profiles-a-f/console-setup-keyboard diff --git a/apparmor.d/profiles-a-f/console-setup-cached b/apparmor.d/profiles-a-f/console-setup-cached new file mode 100644 index 000000000..332f05341 --- /dev/null +++ b/apparmor.d/profiles-a-f/console-setup-cached @@ -0,0 +1,36 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /etc/console-setup/cached_setup_font.sh /etc/console-setup/cached_setup_terminal.sh +profile console-setup-cached @{exec_path} { + include + include + + capability sys_tty_config, + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/gzip rix, + @{bin}/ls ix, + @{bin}/mkdir ix, + @{bin}/setfont ix, + + /usr/share/consolefonts/{,**} r, + + @{run}/console-setup/ w, + @{run}/console-setup/font-loaded w, + + /dev/ r, + /dev/tty rw, + /dev/tty@{int} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/console-setup-keyboard b/apparmor.d/profiles-a-f/console-setup-keyboard new file mode 100644 index 000000000..1f4045e2e --- /dev/null +++ b/apparmor.d/profiles-a-f/console-setup-keyboard @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/console-setup/keyboard-setup.sh /etc/console-setup/cached_setup_keyboard.sh +profile console-setup-keyboard @{exec_path} { + include + include + + capability sys_tty_config, + + @{exec_path} mrix, + + @{sh_path} rix, + @{bin}/gzip rix, + @{bin}/kbd_mode rix, + @{bin}/loadkeys rix, + + /etc/console-setup/{,**} r, + + /dev/tty@{int} rw, + /dev/tty rw, + + include if exists +} + +# vim:syntax=apparmor From 9cb74ff384fd8bcdeade0e7eb016fabf79321651 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 2 Jul 2025 23:22:12 +0200 Subject: [PATCH 1046/1455] feat(abs): general update --- apparmor.d/abstractions/app-open | 2 +- apparmor.d/abstractions/app/firefox | 3 ++- apparmor.d/abstractions/bus-session | 2 +- apparmor.d/abstractions/bus/org.freedesktop.NetworkManager | 7 ++++++- apparmor.d/abstractions/disks-read | 6 ++++++ 5 files changed, 16 insertions(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index c7d2a86c8..59724f019 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -39,7 +39,7 @@ @{bin}/extension-manager Px, @{bin}/filezilla Px, @{bin}/flameshot Px, - @{bin}/gimp{,3} Px, + @{bin}/gimp{,-3.0} Px, @{bin}/gnome-calculator Px, @{bin}/gnome-disk-image-mounter Px, @{bin}/gnome-disks Px, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 5e3bc15cb..1dd15f9d8 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -99,7 +99,8 @@ owner @{tmp}/@{name}/* rwk, owner @{tmp}/firefox/ rw, owner @{tmp}/firefox/* rwk, - owner @{tmp}/remote-settings-startup-bundle- w, + owner @{tmp}/remote-settings-startup-bundle- rw, + owner @{tmp}/remote-settings-startup-bundle-.tmp rw, owner @{tmp}/Temp-@{uuid}/ rw, owner @{tmp}/Temp-@{uuid}/* rwk, owner @{tmp}/tmp-*.xpi rw, diff --git a/apparmor.d/abstractions/bus-session b/apparmor.d/abstractions/bus-session index 38d39a489..a1226d8e7 100644 --- a/apparmor.d/abstractions/bus-session +++ b/apparmor.d/abstractions/bus-session @@ -6,7 +6,7 @@ unix bind type=stream addr=@@{udbus}/bus/@{profile_name}/session, - dbus send bus=session path=/org/freedesktop/DBus + dbus send bus=session path=/org/freedesktop/{dbus,DBus} interface=org.freedesktop.DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), diff --git a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager index 0f188e05a..78f0de9de 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager @@ -8,7 +8,7 @@ dbus send bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager - member=GetManagedObjects + member={GetManagedObjects,InterfacesRemoved} peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager @@ -51,6 +51,11 @@ member=Updated peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), + dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/@{int} + interface=org.freedesktop.NetworkManager.Connection.Active + member=StateChanged + peer=(name=@{busname}, label=NetworkManager), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 62e24b70d..e1bf31298 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -44,6 +44,12 @@ @{sys}/devices/virtual/block/loop@{int}/ r, @{sys}/devices/virtual/block/loop@{int}/** r, + # Xen PVH devices + @{sys}/devices/vbd-@{int}/block/** r, + + # Channel subsystem for IBM Z + @{sys}/devices/css@{int}/** r, + # LUKS/LVM (device-mapper) devices /dev/dm-@{int} rk, /dev/mapper/{,*} r, From f47babab8492b9b273da5e985f41cf2a1cddbba2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 15:21:01 +0200 Subject: [PATCH 1047/1455] fix(profile): pci slot adress. --- apparmor.d/abstractions/common/app | 1 + apparmor.d/groups/filesystem/udisksd | 1 + apparmor.d/profiles-s-z/zed | 1 + apparmor.d/profiles-s-z/zpool | 1 + 4 files changed, 4 insertions(+) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index efb3c838b..a3fb2c5ef 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -78,6 +78,7 @@ @{sys}/bus/ r, @{sys}/bus/*/devices/ r, @{sys}/bus/pci/slots/ r, + @{sys}/bus/pci/slots/@{int}-@{int}/address r, @{sys}/bus/pci/slots/@{int}/address r, @{sys}/class/*/ r, @{sys}/devices/** r, diff --git a/apparmor.d/groups/filesystem/udisksd b/apparmor.d/groups/filesystem/udisksd index 1ff219bbe..ab3813973 100644 --- a/apparmor.d/groups/filesystem/udisksd +++ b/apparmor.d/groups/filesystem/udisksd @@ -121,6 +121,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{sys}/bus/ r, @{sys}/bus/pci/slots/ r, + @{sys}/bus/pci/slots/@{int}-@{int}/address r, @{sys}/bus/pci/slots/@{int}/address r, @{sys}/bus/scsi/devices/ r, @{sys}/class/ r, diff --git a/apparmor.d/profiles-s-z/zed b/apparmor.d/profiles-s-z/zed index b131897d4..893cead5b 100644 --- a/apparmor.d/profiles-s-z/zed +++ b/apparmor.d/profiles-s-z/zed @@ -46,6 +46,7 @@ profile zed @{exec_path} { owner @{tmp}/tmp.* rw, @{sys}/bus/pci/slots/ r, + @{sys}/bus/pci/slots/@{int}-@{int}/address r, @{sys}/bus/pci/slots/@{int}/address r, @{sys}/module/zfs/parameters/zfs_zevent_len_max rw, diff --git a/apparmor.d/profiles-s-z/zpool b/apparmor.d/profiles-s-z/zpool index 2cb997fd7..e6033d9d2 100644 --- a/apparmor.d/profiles-s-z/zpool +++ b/apparmor.d/profiles-s-z/zpool @@ -31,6 +31,7 @@ profile zpool @{exec_path} { @{sys}/module/zfs/** r, @{sys}/bus/pci/slots/ r, + @{sys}/bus/pci/slots/@{int}-@{int}/address r, @{sys}/bus/pci/slots/@{int}/address r, @{PROC}/@{pids}/mountinfo r, From e5b6d5dd19e03cb488f748c84b5acb22c7e191ff Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 15:21:50 +0200 Subject: [PATCH 1048/1455] feat(profile): update nvidia tools. --- apparmor.d/profiles-m-r/nvidia-settings | 16 ++++++++++++++-- apparmor.d/profiles-m-r/nvidia-smi | 1 + 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-m-r/nvidia-settings b/apparmor.d/profiles-m-r/nvidia-settings index 9e5944bff..771bbb3b6 100644 --- a/apparmor.d/profiles-m-r/nvidia-settings +++ b/apparmor.d/profiles-m-r/nvidia-settings @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/nvidia-settings -profile nvidia-settings @{exec_path} { +profile nvidia-settings @{exec_path} flags=(attach_disconnected) { include include include @@ -21,8 +21,20 @@ profile nvidia-settings @{exec_path} { @{sys}/bus/pci/devices/ r, @{sys}/devices/@{pci}/config r, + @{sys}/devices/system/node/ r, + @{sys}/devices/system/node/node@{int}/cpumap r, - @{PROC}/devices r, + @{PROC}/devices r, + @{PROC}/driver/nvidia/capabilities/mig/config r, + @{PROC}/driver/nvidia/capabilities/mig/monitor r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 + /dev/nvidia-caps/ rw, + /dev/nvidia-caps/nvidia-cap@{int} r, + /dev/nvidia-uvm rw, + /dev/nvidia-uvm-tools r, include if exists } diff --git a/apparmor.d/profiles-m-r/nvidia-smi b/apparmor.d/profiles-m-r/nvidia-smi index 143808f76..9ea391400 100644 --- a/apparmor.d/profiles-m-r/nvidia-smi +++ b/apparmor.d/profiles-m-r/nvidia-smi @@ -21,6 +21,7 @@ profile nvidia-smi @{exec_path} { @{PROC}/driver/nvidia/capabilities/mig/config r, @{PROC}/driver/nvidia/capabilities/mig/monitor r, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 /dev/nvidia-caps/ rw, From 223f611dfcb92f9cae02e9965491f8580b01a0ba Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 21:53:15 +0200 Subject: [PATCH 1049/1455] feat(abs): nvidia: ensure cuda is supported, cleanup common local path. --- apparmor.d/abstractions/nvidia-strict | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/nvidia-strict b/apparmor.d/abstractions/nvidia-strict index ebaced47f..6fe815773 100644 --- a/apparmor.d/abstractions/nvidia-strict +++ b/apparmor.d/abstractions/nvidia-strict @@ -6,18 +6,21 @@ @{bin}/nvidia-modprobe Px -> child-modprobe-nvidia, + /opt/cuda/targets/@{multiarch}/lib/libOpenCL.so.* mr, + /usr/share/nvidia/nvidia-application-profiles-* r, /etc/nvidia/nvidia-application-profiles-* r, /etc/vdpau_wrapper.cfg r, - owner @{HOME}/.cache/nvidia/ w, - owner @{HOME}/.cache/nvidia/GLCache/ rw, - owner @{HOME}/.cache/nvidia/GLCache/** rwk, + owner @{HOME}/.nv/ w, owner @{HOME}/.nv/ComputeCache/ w, owner @{HOME}/.nv/ComputeCache/** rw, owner @{HOME}/.nv/ComputeCache/index rwk, owner @{HOME}/.nv/nvidia-application-profiles-* r, + owner @{user_cache_dirs}/nvidia/ w, + owner @{user_cache_dirs}/nvidia/GLCache/ rw, + owner @{user_cache_dirs}/nvidia/GLCache/** rwk, @{sys}/devices/system/memory/block_size_bytes r, @{sys}/module/nvidia/version r, From 13680be0a6a0421bdc2a59ec03284b55debd57ff Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 21:53:53 +0200 Subject: [PATCH 1050/1455] feat(fsp): sdu: add consoles --- apparmor.d/groups/_full/sdu | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/_full/sdu b/apparmor.d/groups/_full/sdu index 80d8c1fb9..f9c50b65f 100644 --- a/apparmor.d/groups/_full/sdu +++ b/apparmor.d/groups/_full/sdu @@ -23,6 +23,7 @@ profile sdu flags=(attach_disconnected,mediate_deleted) { include include include + include include include @@ -108,6 +109,8 @@ profile sdu flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/oom_score_adj rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + /dev/kmsg w, + deny capability net_admin, profile shell flags=(attach_disconnected,mediate_deleted,complain) { @@ -123,10 +126,10 @@ profile sdu flags=(attach_disconnected,mediate_deleted) { include include - audit capability net_admin, - owner @{run}/user/@{uid}/systemd/private rw, + deny capability net_admin, + include if exists include if exists } From 3b040aa5ca46513bd7058882c6bcde4b3f5d85dc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 21:54:49 +0200 Subject: [PATCH 1051/1455] feat(profile): improve dpkg-scripts. --- apparmor.d/groups/apt/dpkg-scripts | 4 +++- apparmor.d/groups/apt/unattended-upgrade-shutdown | 4 ++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index e16d25bf2..d3994d0ec 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -11,6 +11,7 @@ profile dpkg-scripts @{exec_path} { include include include + include capability chown, capability dac_read_search, @@ -24,6 +25,7 @@ profile dpkg-scripts @{exec_path} { # Common program found in maintainer scripts @{sh_path} rix, @{coreutils_path} rix, + @{python_path} rix, @{bin}/run-parts rix, @{bin}/envsubst ix, @@ -51,8 +53,8 @@ profile dpkg-scripts @{exec_path} { @{bin}/** PUx, @{sbin}/** PUx, @{lib}/** PUx, + /etc/** PUx, /usr/share/** PUx, - /etc/init.d/* PUx, # Maintainer's scripts can update a lot of files / r, diff --git a/apparmor.d/groups/apt/unattended-upgrade-shutdown b/apparmor.d/groups/apt/unattended-upgrade-shutdown index f36505e7a..1fb667fae 100644 --- a/apparmor.d/groups/apt/unattended-upgrade-shutdown +++ b/apparmor.d/groups/apt/unattended-upgrade-shutdown @@ -20,6 +20,10 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) { @{bin}/ischroot Px, + @{lib}/@{python_name}/**/__pycache__/ w, + @{lib}/@{python_name}/**/__pycache__/**.pyc w, + @{lib}/@{python_name}/**/__pycache__/**.pyc.@{u64} w, + /usr/share/unattended-upgrades/{,*} r, owner /var/log/unattended-upgrades/*.log* rw, From f56163afb184d93df751f2ce571d90cd9b08ecbc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 21:56:24 +0200 Subject: [PATCH 1052/1455] feat(profile): ensure xdg portal can start any sandboxing tool. --- apparmor.d/groups/freedesktop/xdg-document-portal | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index 91a203d3a..93cac619e 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -39,8 +39,9 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/flatpak rPUx, + @{bin}/flatpak rPx, @{bin}/fusermount{,3} rCx -> fusermount, + @{bin}/snap rPx, / r, owner @{att}/ r, @@ -64,6 +65,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { profile fusermount flags=(attach_disconnected) { include + include include capability dac_read_search, From 4f2abda92f0cfd1c2b412a23582c4ac253954d73 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 21:58:20 +0200 Subject: [PATCH 1053/1455] feat(profile): improve gnome programs. --- apparmor.d/groups/gnome/epiphany-search-provider | 1 + apparmor.d/groups/gnome/gnome-extension-gsconnect | 3 +++ apparmor.d/groups/gnome/gnome-shell | 12 +++++++++--- apparmor.d/groups/gnome/gnome-text-editor | 1 + apparmor.d/groups/gnome/tracker-extract | 1 + 5 files changed, 15 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/gnome/epiphany-search-provider b/apparmor.d/groups/gnome/epiphany-search-provider index e66450d09..2168382e0 100644 --- a/apparmor.d/groups/gnome/epiphany-search-provider +++ b/apparmor.d/groups/gnome/epiphany-search-provider @@ -29,6 +29,7 @@ profile epiphany-search-provider @{exec_path} { @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix, owner @{user_cache_dirs}/epiphany/{,**} rwk, + owner @{user_config_dirs}/epiphany/{,**} rw, owner @{user_share_dirs}/epiphany/{,**} rwk, owner @{tmp}/ContentRuleList-@{rand6} rw, diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 104d95fb3..7cb982ca7 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -16,6 +16,7 @@ profile gnome-extension-gsconnect @{exec_path} { include include include + include include include include @@ -29,6 +30,8 @@ profile gnome-extension-gsconnect @{exec_path} { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=org.gnome.Shell.Extensions.GSConnect + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index e977af95e..acae2d601 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -173,6 +173,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/sensors rPx, @{bin}/tecla rPx, @{bin}/Xwayland rPx, + @{bin}/nvidia-smi rPx, # FIXME; for extension only + @{lib}/@{multiarch}/glib-2.0/glib-compile-schemas rPx, @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @{lib}/mutter-x11-frames rPx, #aa:exec polkit-agent-helper @@ -227,6 +229,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{gdm_cache_dirs}/gstreamer-@{int}/registry.*.bin{,.tmp@{rand6}} rw, owner @{gdm_cache_dirs}/ibus/dbus-@{rand8} rw, owner @{gdm_cache_dirs}/libgweather/ r, + owner @{gdm_cache_dirs}/nvidia/GLCache/ rw, + owner @{gdm_cache_dirs}/nvidia/GLCache/** rwk, owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_config_dirs}/ibus/ rw, owner @{gdm_config_dirs}/ibus/bus/ rw, @@ -234,11 +238,13 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{gdm_config_dirs}/pulse/ rw, owner @{gdm_config_dirs}/pulse/client.conf r, owner @{gdm_config_dirs}/pulse/cookie rwk, + owner @{gdm_local_dirs}/ w, + owner @{gdm_share_dirs}/ w, owner @{gdm_share_dirs}/applications/{,**} r, owner @{gdm_share_dirs}/gnome-shell/{,**} rw, owner @{gdm_share_dirs}/icc/ rw, - owner @{gdm_share_dirs}/icc/edid-@{hex32}.icc rw, owner @{gdm_share_dirs}/icc/.goutputstream-@{rand6} rw, + owner @{gdm_share_dirs}/icc/edid-@{hex32}.icc rw, owner @{HOME}/.face r, owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r, @@ -263,7 +269,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/backgrounds/{,**} rw, owner @{user_share_dirs}/dbus-1/services/ r, - owner @{user_share_dirs}/dbus-1/services/org.gnome.shell.*.service{,.@{rand6}} rw, + owner @{user_share_dirs}/dbus-1/services/org.gnome.Shell.*.service{,.@{rand6}} rw, owner @{user_share_dirs}/desktop-directories/{,**} r, owner @{user_share_dirs}/gnome-shell/{,**} rw, owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, @@ -271,7 +277,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/icc/ rw, owner @{user_share_dirs}/icc/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw, - owner @{user_share_dirs}/icons/**/org.gnome.shell.*.svg{,.@{rand6}} w, + owner @{user_share_dirs}/icons/**/org.gnome.Shell.*.svg{,.@{rand6}} w, owner @{user_share_dirs}/applications/org.gnome.Shell.*.desktop{,.@{rand6}} rw, owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-* r, diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index 22823753b..c399eadc7 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -15,6 +15,7 @@ profile gnome-text-editor @{exec_path} { include include + #aa:dbus own bus=session name=org.gnome.TextEditor #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 83bf18b9b..e8612f7b6 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -70,6 +70,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/media@{int} r, From 705eb11510c0d692173368609b1a10f419337800 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 22:04:18 +0200 Subject: [PATCH 1054/1455] feat(profile): improve some dbus rules. --- apparmor.d/groups/bluetooth/bluetoothd | 2 +- apparmor.d/groups/gvfs/gvfsd-dnssd | 5 +++++ apparmor.d/groups/gvfs/gvfsd-http | 4 ++++ apparmor.d/groups/gvfs/gvfsd-trash | 6 +----- apparmor.d/groups/network/mullvad-gui | 3 +++ apparmor.d/groups/ssh/sshd | 5 +++++ apparmor.d/groups/virt/cockpit-wsinstance-factory | 3 +++ apparmor.d/profiles-s-z/virt-manager | 6 ++++++ 8 files changed, 28 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/bluetooth/bluetoothd b/apparmor.d/groups/bluetooth/bluetoothd index aa84eebd9..e5443f505 100644 --- a/apparmor.d/groups/bluetooth/bluetoothd +++ b/apparmor.d/groups/bluetooth/bluetoothd @@ -32,7 +32,7 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager - member=InterfacesRemoved + member={InterfacesRemoved,InterfacesAdded} peer=(name=org.freedesktop.DBus), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-dnssd b/apparmor.d/groups/gvfs/gvfsd-dnssd index 9af8be00a..6c61dbba4 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dnssd +++ b/apparmor.d/groups/gvfs/gvfsd-dnssd @@ -33,6 +33,11 @@ profile gvfsd-dnssd @{exec_path} { member={MountLocation,LookupMount,RegisterMount} peer=(name="@{busname}", label=gvfsd), + dbus receive bus=session path=/ + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, owner @{run}/user/@{uid}/gvfsd/ rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-http b/apparmor.d/groups/gvfs/gvfsd-http index 2fe0a1e2b..92d6fbf64 100644 --- a/apparmor.d/groups/gvfs/gvfsd-http +++ b/apparmor.d/groups/gvfs/gvfsd-http @@ -24,6 +24,10 @@ profile gvfsd-http @{exec_path} { network netlink raw, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_http + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=:*, label=gnome-shell), dbus receive bus=session path=/org/gtk/vfs/mountable interface=org.gtk.vfs.Mountable diff --git a/apparmor.d/groups/gvfs/gvfsd-trash b/apparmor.d/groups/gvfs/gvfsd-trash index 9acfd6c86..e13f870c7 100644 --- a/apparmor.d/groups/gvfs/gvfsd-trash +++ b/apparmor.d/groups/gvfs/gvfsd-trash @@ -11,6 +11,7 @@ include profile gvfsd-trash @{exec_path} { include include + include include include include @@ -21,11 +22,6 @@ profile gvfsd-trash @{exec_path} { #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} - dbus receive bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name="@{busname}", label="{gnome-shell,nautilus}"), - dbus receive bus=session path=/org/gtk/vfs/mountable interface=org.gtk.vfs.Mountable member=Mount diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index 6075f14b2..c36d34e3f 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -14,6 +14,9 @@ include @{exec_path} = @{lib_dirs}/mullvad-gui profile mullvad-gui @{exec_path} flags=(attach_disconnected) { include + include + include + include include network inet stream, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 75438c957..2494dc2c2 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -61,6 +61,11 @@ profile sshd @{exec_path} flags=(attach_disconnected) { member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), + dbus send bus=system path=/org/freedesktop/home1 + interface=org.freedesktop.home1.Manager + member=GetUserRecordByName + peer=(name=org.freedesktop.home1, label="@{p_systemd_homed}"), + @{exec_path} mrix, @{bin}/@{shells} Ux, #aa:exclude RBAC diff --git a/apparmor.d/groups/virt/cockpit-wsinstance-factory b/apparmor.d/groups/virt/cockpit-wsinstance-factory index b14a1e36f..99db4d614 100644 --- a/apparmor.d/groups/virt/cockpit-wsinstance-factory +++ b/apparmor.d/groups/virt/cockpit-wsinstance-factory @@ -9,6 +9,9 @@ include @{exec_path} = @{lib}/cockpit/cockpit-wsinstance-factory profile cockpit-wsinstance-factory @{exec_path} { include + include + + unix bind type=stream addr=@@{udbus}/bus/cockpit-wsinsta/system, capability net_admin, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index 7c0443dae..fa17f5b1b 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -12,6 +12,10 @@ include profile virt-manager @{exec_path} flags=(attach_disconnected) { include include + include + include + include + include include include include @@ -28,6 +32,8 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=org.virt-manager.virt-manager + @{exec_path} rix, @{sh_path} rix, From bfc6c51821b87fdca893c54555bf5ca5a060528b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 22:08:28 +0200 Subject: [PATCH 1055/1455] feat(profile): update some core system profiles. --- apparmor.d/profiles-a-f/dkms | 4 ++-- apparmor.d/profiles-a-f/fprintd | 3 +-- apparmor.d/profiles-a-f/fwupd | 11 +++++++---- apparmor.d/profiles-g-l/hw-probe | 16 +++++++++++----- apparmor.d/profiles-g-l/hwinfo | 6 +++++- apparmor.d/profiles-g-l/i2cdetect | 5 +++++ apparmor.d/profiles-g-l/kernel | 6 ++++-- apparmor.d/profiles-g-l/kernel-install | 3 +++ apparmor.d/profiles-m-r/pycompile | 2 +- apparmor.d/profiles-s-z/sysstat-sadc | 4 +++- 10 files changed, 42 insertions(+), 18 deletions(-) diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 0a01e5db5..a0d5b08f9 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -30,13 +30,14 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{bin}/bc rix, @{bin}/clang-@{version} rix, @{bin}/gcc rix, + @{bin}/g++ rix, @{bin}/getconf rix, @{bin}/kill rix, @{bin}/kmod rCx -> kmod, @{bin}/ld rix, @{bin}/ld.lld rix, @{bin}/llvm-objcopy rix, - @{bin}/lsb_release rPx -> lsb_release, + @{bin}/lsb_release rPx, @{bin}/make rix, @{bin}/objcopy rix, @{bin}/pahole rix, @@ -101,7 +102,6 @@ profile dkms @{exec_path} flags=(attach_disconnected) { owner @{tmp}/sh-thd.* rw, owner @{tmp}/tmp.* rw, - @{PROC}/cpuinfo r, @{PROC}/sys/kernel/osrelease r, @{PROC}/sys/vm/overcommit_memory r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-a-f/fprintd b/apparmor.d/profiles-a-f/fprintd index 182d9013d..1d00dce88 100644 --- a/apparmor.d/profiles-a-f/fprintd +++ b/apparmor.d/profiles-a-f/fprintd @@ -32,8 +32,7 @@ profile fprintd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/class/hidraw/ r, - @{sys}/devices/@{pci}/hidraw/hidraw@{int}/uevent r, - @{sys}/devices/virtual/**/hidraw/hidraw@{int}/uevent r, + @{sys}/devices/**/hidraw/hidraw@{int}/uevent r, include if exists } diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 961b55c97..cf5989227 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -62,12 +62,15 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /etc/machine-id r, /var/lib/dbus/machine-id r, - /boot/{,**} r, - /boot/EFI/*/.goutputstream-@{rand6} rw, - /boot/EFI/*/fw/fwupd-*.cap{,.*} rw, - /boot/EFI/*/fwupdx@{int}.efi rw, + @{efi}/{,**} r, + @{efi}/EFI/*/.goutputstream-@{rand6} rw, + @{efi}/EFI/*/fw/fwupd-*.cap{,.*} rw, + @{efi}/EFI/*/fwupdx@{int}.efi rw, @{lib}/fwupd/efi/fwupdx@{int}.efi{,.signed} r, + @{MOUNTDIRS}/*/{,@{efi}/} r, + @{MOUNTDIRS}/*/{,@{efi}/}EFI/{,**} r, + /var/lib/flatpak/exports/share/mime/mime.cache r, /var/tmp/etilqs_@{sqlhex} rw, owner /var/cache/fwupd/ rw, diff --git a/apparmor.d/profiles-g-l/hw-probe b/apparmor.d/profiles-g-l/hw-probe index 2b91fc612..739073201 100644 --- a/apparmor.d/profiles-g-l/hw-probe +++ b/apparmor.d/profiles-g-l/hw-probe @@ -33,6 +33,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/tar rix, @{bin}/uname rix, + @{bin}/vulkaninfo rPUx, @{bin}/acpi rPx, @{bin}/amixer rPx, @{bin}/aplay rPx, @@ -55,7 +56,6 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{bin}/lsblk rPx, @{bin}/lscpu rPx, @{bin}/lspci rPx, - @{bin}/lsscsi rPx, @{bin}/lsusb rPx, @{bin}/memtester rPx, @{bin}/nmcli rPx, @@ -76,12 +76,15 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{sbin}/dmidecode rPx, @{sbin}/fdisk rPx, @{sbin}/hdparm rPx, + @{bin}/boltctl rPUx, @{sbin}/hwinfo rPx, @{sbin}/rfkill rPx, @{sbin}/smartctl rPx, /etc/modprobe.d/{,*.conf} r, + @{efi}/EFI/{,**} r, + owner @{HOME}/HW_PROBE/{,**} rw, owner @{tmp}/@{rand10}/ rw, @@ -107,9 +110,9 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { include include - capability sys_module, + capability syslog, - @{sys}/module/compression r, + @{sys}/module/{,**} r, include if exists } @@ -169,9 +172,12 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) { @{run}/log/ rw, /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/ r, - /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r, /{run,var}/log/journal/@{hex32}/system.journal* r, - /{run,var}/log/journal/@{hex32}/system@@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* r, owner @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/profiles-g-l/hwinfo b/apparmor.d/profiles-g-l/hwinfo index 4919d2fb2..314975208 100644 --- a/apparmor.d/profiles-g-l/hwinfo +++ b/apparmor.d/profiles-g-l/hwinfo @@ -28,6 +28,7 @@ profile hwinfo @{exec_path} { @{bin}/kmod rCx -> kmod, @{bin}/udevadm rCx -> udevadm, @{sbin}/acpidump rPUx, + @{bin}/lsscsi rPx, @{sbin}/dmraid rPUx, @@ -39,7 +40,7 @@ profile hwinfo @{exec_path} { @{sys}/bus/{,**/} r, @{sys}/class/*/ r, - @{sys}/devices/@{pci}/** r, + @{sys}/devices/@{pci}/{,**} r, @{sys}/devices/**/{modalias,uevent} r, @{sys}/devices/**/input/**/dev r, @{sys}/devices/virtual/net/*/{type,carrier,address} r, @@ -70,9 +71,12 @@ profile hwinfo @{exec_path} { include include + capability sys_module, + owner @{tmp}/hwinfo*.txt rw, @{sys}/devices/@{pci}/drm/card@{int}/ r, + @{sys}/module/compression r, include if exists } diff --git a/apparmor.d/profiles-g-l/i2cdetect b/apparmor.d/profiles-g-l/i2cdetect index 5ce4da0bb..f101c56e6 100644 --- a/apparmor.d/profiles-g-l/i2cdetect +++ b/apparmor.d/profiles-g-l/i2cdetect @@ -13,8 +13,13 @@ profile i2cdetect @{exec_path} { @{exec_path} mr, + @{sys}/class/i2c-dev/ r, + @{sys}/devices/@{pci}/i2c-*/{,**/}name r, + owner @{PROC}/@{pid}/mounts r, + /dev/i2c-@{int} rw, + include if exists } diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel index d375a1bdd..c3155ce75 100644 --- a/apparmor.d/profiles-g-l/kernel +++ b/apparmor.d/profiles-g-l/kernel @@ -34,13 +34,15 @@ profile kernel @{exec_path} { @{bin}/which{,.debianutils} rix, @{bin}/apt-config rPx, + @{bin}/bootctl rPx, @{bin}/dpkg rPx -> child-dpkg, + @{bin}/kernel-install rPx, @{bin}/systemd-detect-virt rPx, - @{sbin}/update-alternatives rPx, + @{lib}/dkms/dkms_autoinstaller rPx, @{sbin}/dkms rPx, + @{sbin}/update-alternatives rPx, @{sbin}/update-grub rPx, @{sbin}/update-initramfs rPx, - @{lib}/dkms/dkms_autoinstaller rPx, @{lib}/modules/*/updates/ w, @{lib}/modules/*/updates/dkms/ w, diff --git a/apparmor.d/profiles-g-l/kernel-install b/apparmor.d/profiles-g-l/kernel-install index 614b81aeb..96d097417 100644 --- a/apparmor.d/profiles-g-l/kernel-install +++ b/apparmor.d/profiles-g-l/kernel-install @@ -41,6 +41,8 @@ profile kernel-install @{exec_path} { @{lib}/modules/*/modules.* w, + @{efi}/@{hex32}/** rw, + owner /boot/{vmlinuz,initrd.img}-* r, owner /boot/[a-f0-9]*/*/ rw, owner /boot/[a-f0-9]*/*/{linux,initrd} w, @@ -52,6 +54,7 @@ profile kernel-install @{exec_path} { owner @{tmp}/sh-thd.* rw, + @{PROC}/@{pid}/mountinfo r, @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, diff --git a/apparmor.d/profiles-m-r/pycompile b/apparmor.d/profiles-m-r/pycompile index b684c3094..c308dcd91 100644 --- a/apparmor.d/profiles-m-r/pycompile +++ b/apparmor.d/profiles-m-r/pycompile @@ -11,7 +11,7 @@ profile pycompile @{exec_path} flags=(attach_disconnected,complain) { include include include - # include + include capability dac_override, capability dac_read_search, diff --git a/apparmor.d/profiles-s-z/sysstat-sadc b/apparmor.d/profiles-s-z/sysstat-sadc index 9a4b5cebe..dfdd00524 100644 --- a/apparmor.d/profiles-s-z/sysstat-sadc +++ b/apparmor.d/profiles-s-z/sysstat-sadc @@ -24,8 +24,10 @@ profile sysstat-sadc @{exec_path} { @{sys}/class/fc_host/ r, @{sys}/class/hwmon/ r, @{sys}/class/i2c-adapter/ r, - @{sys}/devices/@{pci}/i2c-*/name r, + @{sys}/devices/@{pci}/hwmon/hwmon@{int}/ r, + @{sys}/devices/@{pci}/hwmon/hwmon@{int}/name r, @{sys}/devices/@{pci}/net/*/duplex r, + @{sys}/devices/**/i2c-*/name r, @{sys}/devices/**/net/*/duplex r, @{sys}/devices/**/net/*/speed r, @{sys}/devices/virtual/net/*/duplex r, From af8c66e9bf456a5770584bf03019548ee67d5020 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 22:14:25 +0200 Subject: [PATCH 1056/1455] feat(profile): upgrade cockpit profiles. --- apparmor.d/groups/virt/cockpit-certificate-helper | 1 + apparmor.d/groups/virt/cockpit-desktop | 2 ++ apparmor.d/groups/virt/cockpit-tls | 3 +++ apparmor.d/groups/virt/cockpit-ws | 4 +++- 4 files changed, 9 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/virt/cockpit-certificate-helper b/apparmor.d/groups/virt/cockpit-certificate-helper index ac9dd5f6f..303fd074c 100644 --- a/apparmor.d/groups/virt/cockpit-certificate-helper +++ b/apparmor.d/groups/virt/cockpit-certificate-helper @@ -21,6 +21,7 @@ profile cockpit-certificate-helper @{exec_path} { @{bin}/openssl rix, @{bin}/rm rix, @{bin}/sscg rix, + @{bin}/sync rix, @{bin}/tr rix, /etc/machine-id r, diff --git a/apparmor.d/groups/virt/cockpit-desktop b/apparmor.d/groups/virt/cockpit-desktop index c2a7455ce..bb1ba03bf 100644 --- a/apparmor.d/groups/virt/cockpit-desktop +++ b/apparmor.d/groups/virt/cockpit-desktop @@ -10,6 +10,8 @@ include profile cockpit-desktop @{exec_path} { include + userns, + @{exec_path} mr, include if exists diff --git a/apparmor.d/groups/virt/cockpit-tls b/apparmor.d/groups/virt/cockpit-tls index 0037b132c..7bf43ed4a 100644 --- a/apparmor.d/groups/virt/cockpit-tls +++ b/apparmor.d/groups/virt/cockpit-tls @@ -17,6 +17,9 @@ profile cockpit-tls @{exec_path} flags=(attach_disconnected) { /etc/cockpit/ws-certs.d/{,**} r, + @{att}/@{run}/cockpit/wsinstance/https@@{hex64}.sock r, + @{att}/@{run}/cockpit/wsinstance/https-factory.sock rw, + owner @{run}/cockpit/tls/{,**} rw, include if exists diff --git a/apparmor.d/groups/virt/cockpit-ws b/apparmor.d/groups/virt/cockpit-ws index 7b0779119..8e3478072 100644 --- a/apparmor.d/groups/virt/cockpit-ws +++ b/apparmor.d/groups/virt/cockpit-ws @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/cockpit/cockpit-ws -profile cockpit-ws @{exec_path} { +profile cockpit-ws @{exec_path} flags=(attach_disconnected) { include include include @@ -21,6 +21,8 @@ profile cockpit-ws @{exec_path} { /usr/share/pixmaps/{,**} r, /etc/cockpit/ws-certs.d/ r, + @{run}/cockpit/wsinstance/https@@{hex64}.sock r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, From c2740ffe241a13c85c53d7a8d99d4946b5509414 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Jul 2025 22:15:04 +0200 Subject: [PATCH 1057/1455] feat(profile): xwayland: add integration with desktop local paths. --- apparmor.d/groups/freedesktop/xwayland | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland index 03b418684..9b329e06a 100644 --- a/apparmor.d/groups/freedesktop/xwayland +++ b/apparmor.d/groups/freedesktop/xwayland @@ -29,6 +29,11 @@ profile xwayland @{exec_path} flags=(attach_disconnected) { /usr/share/fonts/{,**} r, /usr/share/ghostscript/fonts/{,**} r, + / r, + + owner @{desktop_cache_dirs}/nvidia/GLCache/ rw, + owner @{desktop_cache_dirs}/nvidia/GLCache/** rwk, + owner @{tmp}/server-@{int}.xkm rwk, owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw, owner @{run}/user/@{uid}/server-@{int}.xkm rw, From 8042dd4a348fc3778c107d94a9ef1e70c11ec181 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Jul 2025 00:09:34 +0200 Subject: [PATCH 1058/1455] chore: replace make full by make fsp. --- Makefile | 8 ++++++-- docs/full-system-policy.md | 17 ++++++++--------- 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index 8bc8757bc..854d39f16 100644 --- a/Makefile +++ b/Makefile @@ -22,8 +22,12 @@ build: enforce: build @./${BUILD}/prebuild -.PHONY: full -full: build +.PHONY: fsp +fsp: build + @./${BUILD}/prebuild --full + +.PHONY: fsp-complain +fsp-complain: build @./${BUILD}/prebuild --complain --full .PHONY: install diff --git a/docs/full-system-policy.md b/docs/full-system-policy.md index c747cb739..016ed8ada 100644 --- a/docs/full-system-policy.md +++ b/docs/full-system-policy.md @@ -27,7 +27,6 @@ Particularly: - Every system application will be **blocked** if they do not have a profile. - Any non-standard system app need to be explicitly profiled and allowed to run. For instance, if you want to use your own proxy or VPN software, you need to ensure it is correctly profiled and allowed to run in the `systemd` profile. - Desktop environment must be explicitly supported, your UI will not start otherwise. Again, it is a **feature**. -- FSP mode will run unknown user application into the `default` profile. It might be enough for your application. If not you have to make a profile for it. - In FSP mode, all sandbox managers **must** have a profile. Then user sandboxed applications (flatpak, snap, etc) will work as expected. - PID 1 is the last program that should be confined. It does not make sense to confine only PID. All other programs must be confined first. @@ -47,11 +46,11 @@ Optimize=compress-fast === ":material-arch: Archlinux" - In `PKGBUILD`, replace `make` by `make full`: + In `PKGBUILD`, replace `make` by `make fsp`: ```diff - make - + make full + + make fsp ``` Then, build the package with: `make pkg` @@ -62,7 +61,7 @@ Optimize=compress-fast ```make override_dh_auto_build: - make full + make fsp ``` Then, build the package with: `make dpkg` @@ -73,25 +72,25 @@ Optimize=compress-fast ```make override_dh_auto_build: - make full + make fsp ``` Then, build the package with: `make dpkg` === ":simple-suse: openSUSE" - In `dists/apparmor.d.spec`, replace `%make_build` by `%make_build full` + In `dists/apparmor.d.spec`, replace `%make_build` by `%make_build fsp` ```diff - %make_build - + %make_build full + + %make_build fsp ``` Then, build the package with: `make rpm` === ":material-home: Partial Install" - Use the `make full` command to build instead of `make` + Use the `make fsp` command to build instead of `make` ## Structure @@ -149,7 +148,7 @@ In addition to the `systemd` profiles, a full system policy needs to ensure that The main fallback profile (`default`) is not intended to be used by privileged program or service. Such programs **must** have they dedicated profile and would break otherwise. -Additionally, special user access can be setup using PAM rules set such as a random shell interactively opened (as user or as root). +Additionally, special user access can be setup using PAM rules set such as a random shell interactively opened (as user or as root). [apparmor-wiki]: https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy [full]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/_full From 6b5fad404bc8d979371d9efc7812c4e50d82bd25 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Jul 2025 00:19:35 +0200 Subject: [PATCH 1059/1455] feat(profile): add free --- apparmor.d/groups/procps/free | 19 +++++++++++++++++++ tests/integration/procps/free.bats | 18 ++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 apparmor.d/groups/procps/free create mode 100644 tests/integration/procps/free.bats diff --git a/apparmor.d/groups/procps/free b/apparmor.d/groups/procps/free new file mode 100644 index 000000000..56075ae1c --- /dev/null +++ b/apparmor.d/groups/procps/free @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/free +profile free @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/procps/free.bats b/tests/integration/procps/free.bats new file mode 100644 index 000000000..dcc216bfa --- /dev/null +++ b/tests/integration/procps/free.bats @@ -0,0 +1,18 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "free: Display system memory" { + free +} + +@test "free: Display memory in GB" { + free -g +} + +@test "free: Display memory in human-readable units" { + free -h +} From 771dd9b589e15c66038a28e1d469391f25a962bd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Jul 2025 00:22:26 +0200 Subject: [PATCH 1060/1455] feat(profile): add pidof --- apparmor.d/groups/procps/pidof | 18 ++++++++++++++++++ tests/integration/procps/pidof.bats | 19 +++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 apparmor.d/groups/procps/pidof create mode 100644 tests/integration/procps/pidof.bats diff --git a/apparmor.d/groups/procps/pidof b/apparmor.d/groups/procps/pidof new file mode 100644 index 000000000..3413eb6c3 --- /dev/null +++ b/apparmor.d/groups/procps/pidof @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pidof +profile pidof @{exec_path} { + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/procps/pidof.bats b/tests/integration/procps/pidof.bats new file mode 100644 index 000000000..ec20cbe86 --- /dev/null +++ b/tests/integration/procps/pidof.bats @@ -0,0 +1,19 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "pidof: List all process IDs with given name" { + pidof systemd + pidof bash +} + +@test "pidof: List a single process ID with given name" { + pidof -s bash +} + +@test "pidof: List process IDs including scripts with given name" { + pidof -x bash +} From c85ed58fa98935d9d475496f02347a2319ce4992 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Jul 2025 00:30:21 +0200 Subject: [PATCH 1061/1455] feat(profile): add vmstat --- apparmor.d/groups/procps/vmstat | 27 +++++++++++++++++++++++++++ tests/integration/procps/vmstat.bats | 25 +++++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 apparmor.d/groups/procps/vmstat create mode 100644 tests/integration/procps/vmstat.bats diff --git a/apparmor.d/groups/procps/vmstat b/apparmor.d/groups/procps/vmstat new file mode 100644 index 000000000..1276222a2 --- /dev/null +++ b/apparmor.d/groups/procps/vmstat @@ -0,0 +1,27 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/vmstat +profile vmstat @{exec_path} { + include + include + + @{exec_path} mr, + + @{sys}/block/ r, + @{sys}/devices/system/node/ r, + + @{PROC}/diskstats r, + @{PROC}/slabinfo r, + @{PROC}/uptime r, + @{PROC}/vmstat r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/procps/vmstat.bats b/tests/integration/procps/vmstat.bats new file mode 100644 index 000000000..e5900a324 --- /dev/null +++ b/tests/integration/procps/vmstat.bats @@ -0,0 +1,25 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "vmstat: Display virtual memory statistics" { + vmstat + vmstat --active + vmstat --forks +} + +@test "vmstat: Display disk statistics" { + vmstat --disk + vmstat --disk-sum +} + +@test "vmstat: Display slabinfo" { + sudo vmstat --slabs +} + +@test "vmstat: Display reports every second for 3 times" { + vmstat 1 3 +} From e6939f4968d50bff639882e5bc34d81ea462ff4e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Jul 2025 00:37:07 +0200 Subject: [PATCH 1062/1455] feat(profile): add pgrep. --- apparmor.d/groups/procps/pgrep | 22 ++++++++++++++++++++++ tests/integration/procps/pgrep.bats | 19 +++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 apparmor.d/groups/procps/pgrep create mode 100644 tests/integration/procps/pgrep.bats diff --git a/apparmor.d/groups/procps/pgrep b/apparmor.d/groups/procps/pgrep new file mode 100644 index 000000000..950aeb99e --- /dev/null +++ b/apparmor.d/groups/procps/pgrep @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pgrep +profile pgrep @{exec_path} { + include + include + include + + @{exec_path} mr, + + @{PROC}/tty/drivers r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/procps/pgrep.bats b/tests/integration/procps/pgrep.bats new file mode 100644 index 000000000..9fd6b92f8 --- /dev/null +++ b/tests/integration/procps/pgrep.bats @@ -0,0 +1,19 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "pgrep: Return PIDs of any running processes with a matching command string" { + pgrep systemd +} + +@test "pgrep: Search for processes including their command-line options" { + pgrep --full 'systemd' +} + +@test "pgrep: Search for processes run by a specific user" { + pgrep --euid root systemd-udevd +} + From e30372b729467fdb4aeafd6be6c206354b4077d8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Jul 2025 00:52:29 +0200 Subject: [PATCH 1063/1455] ci: use fsp instead of full command. --- .github/workflows/main.yml | 2 +- .gitlab-ci.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index cac8fce43..973287e72 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -38,7 +38,7 @@ jobs: - name: Build the apparmor.d package run: | if [[ ${{ matrix.mode }} == full-system-policy ]]; then - echo -e "\noverride_dh_auto_build:\n\tmake full" >> debian/rules + echo -e "\noverride_dh_auto_build:\n\tmake fsp" >> debian/rules fi if [[ ${{ matrix.os }} == ubuntu-24.04 ]] && [[ ${{ matrix.mode }} == default ]]; then # Test with Re-attach disconnected path diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index f697637fa..8adab16ab 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -117,7 +117,7 @@ whonix: variables: DISTRIBUTION: whonix before_script: - - echo "\noverride_dh_auto_build:\n\tmake full" >> debian/rules + - echo "\noverride_dh_auto_build:\n\tmake fsp" >> debian/rules opensuse: stage: build From 277bd7f46aa43ad90ca8242cfb823e4ef3f68044 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 7 Jul 2025 00:53:37 +0200 Subject: [PATCH 1064/1455] feat(profile): ensure gtk-query-immodule is not version dependent. --- apparmor.d/groups/pacman/pacman | 2 +- apparmor.d/profiles-g-l/gtk-query-immodules | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index e9f3bf807..ff43e2196 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -71,7 +71,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{bin}/gio-querymodules rPx, @{bin}/glib-compile-schemas rPx, @{sbin}/groupadd rPx, - @{bin}/gtk-query-immodules-{2,3}.0 rPx, + @{bin}/gtk-query-immodules-* rPx, @{bin}/gtk{,4}-update-icon-cache rPx, @{sbin}/iconvconfig rix, @{bin}/install-catalog rPx, diff --git a/apparmor.d/profiles-g-l/gtk-query-immodules b/apparmor.d/profiles-g-l/gtk-query-immodules index 509769698..e6d37db44 100644 --- a/apparmor.d/profiles-g-l/gtk-query-immodules +++ b/apparmor.d/profiles-g-l/gtk-query-immodules @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/gtk-query-immodules-{2,3}.0 @{lib}/@{multiarch}/libgtk-*/gtk-query-immodules-* +@{exec_path} = @{bin}/gtk-query-immodules-* @{lib}/@{multiarch}/libgtk-*/gtk-query-immodules-* profile gtk-query-immodules @{exec_path} { include include From e6b044376f7ef7f2a6850bf0461927b5432eeb0c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:14:24 +0200 Subject: [PATCH 1065/1455] fix(profile): update archlinux-keyring requirements. fix #784 --- apparmor.d/groups/gpg/gpg | 5 ++--- apparmor.d/groups/pacman/pacman-key | 3 ++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 247c6e4ac..f05f6492e 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -33,9 +33,8 @@ profile gpg @{exec_path} { /etc/inputrc r, #aa:only pacman - /etc/pacman.d/gnupg/gpg.conf r, - /etc/pacman.d/gnupg/pubring.gpg r, - /etc/pacman.d/gnupg/trustdb.gpg r, + /etc/pacman.d/gnupg/ rw, + /etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**, #aa:only apt owner /etc/apt/keyrings/ rw, diff --git a/apparmor.d/groups/pacman/pacman-key b/apparmor.d/groups/pacman/pacman-key index a5cee6fa9..9e3bde188 100644 --- a/apparmor.d/groups/pacman/pacman-key +++ b/apparmor.d/groups/pacman/pacman-key @@ -34,7 +34,8 @@ profile pacman-key @{exec_path} { /usr/share/pacman/keyrings/{,*} r, /usr/share/terminfo/** r, - /etc/pacman.d/gnupg/* rw, + /etc/pacman.d/gnupg/ rw, + /etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**, /dev/tty rw, From 51cb732ecaeb6e2c7cf7c9f936c4c26c9b9bf561 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:17:13 +0200 Subject: [PATCH 1066/1455] fix(profile): ensure hyprland can integrate with wine/proton fix #783 --- apparmor.d/groups/hyprland/hyprland | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index c06671b34..9f2e7583d 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -14,6 +14,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { include include include + include capability sys_ptrace, From b754c1134c8be44034893bb4accee769dcc4ea63 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:37:49 +0200 Subject: [PATCH 1067/1455] fix(profile) wechat profile permissions fix #772 --- apparmor.d/profiles-s-z/wechat | 0 apparmor.d/profiles-s-z/wechat-appimage | 0 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 apparmor.d/profiles-s-z/wechat mode change 100755 => 100644 apparmor.d/profiles-s-z/wechat-appimage diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat old mode 100755 new mode 100644 diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage old mode 100755 new mode 100644 From d6f4ff57b65bc641c96775c38aa7bbce55f4aff6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:47:39 +0200 Subject: [PATCH 1068/1455] fix: linter check. --- apparmor.d/groups/gpg/gpg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index f05f6492e..1a3f7f4d9 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -34,7 +34,7 @@ profile gpg @{exec_path} { #aa:only pacman /etc/pacman.d/gnupg/ rw, - /etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**, + /etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**, #aa:only apt owner /etc/apt/keyrings/ rw, From 1b1a4c11ac22ab1aba9fd4bbff3619593a2454b6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:51:18 +0200 Subject: [PATCH 1069/1455] feat(profile): gpg: improve integration with access to gpg-agent. --- apparmor.d/groups/gpg/gpg | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 1a3f7f4d9..7ebb9e3a4 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -68,6 +68,7 @@ profile gpg @{exec_path} { owner /tmp/@{int}@{int} rw, owner @{run}/user/@{uid}/gnupg/d.*/ rw, + owner @{run}/user/@{uid}/gnupg/S.gpg-agent rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, From e9fbc3503636273f0d36697a38f4f061049a38d4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:52:26 +0200 Subject: [PATCH 1070/1455] feat(profile): minor sshd improvement. --- apparmor.d/groups/ssh/sshd-auth | 2 ++ apparmor.d/groups/ssh/sshd-session | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/apparmor.d/groups/ssh/sshd-auth b/apparmor.d/groups/ssh/sshd-auth index cb4defc0f..c1601b813 100644 --- a/apparmor.d/groups/ssh/sshd-auth +++ b/apparmor.d/groups/ssh/sshd-auth @@ -24,6 +24,8 @@ profile sshd-auth @{exec_path} { @{exec_path} mr, @{sbin}/sshd.hmac r, + /etc/gss/mech.d/{,*} r, + include if exists } diff --git a/apparmor.d/groups/ssh/sshd-session b/apparmor.d/groups/ssh/sshd-session index e74696334..5f09af5cc 100644 --- a/apparmor.d/groups/ssh/sshd-session +++ b/apparmor.d/groups/ssh/sshd-session @@ -47,6 +47,11 @@ profile sshd-session @{exec_path} flags=(attach_disconnected) { member={CreateSession,ReleaseSession,CreateSessionWithPIDFD} peer=(name=org.freedesktop.login1, label="@{p_systemd_logind}"), + dbus send bus=system path=/org/freedesktop/home1 + interface=org.freedesktop.home1.Manager + member=GetUserRecordByName + peer=(name=org.freedesktop.home1, label="@{p_systemd_homed}"), + @{exec_path} mr, @{bin}/@{shells} Ux, #aa:exclude RBAC From 51560bbbf562a7e47ffe4776a1092e3aa78709ec Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:53:29 +0200 Subject: [PATCH 1071/1455] feat(profile): update mullvad. --- apparmor.d/groups/network/mullvad-daemon | 13 +++++++++---- apparmor.d/groups/network/mullvad-gui | 2 ++ 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index 6c4c41e6c..9573d7044 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -10,6 +10,7 @@ include @{exec_path} += /opt/Mullvad*/resources/mullvad-daemon profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { include + include include capability dac_override, @@ -39,7 +40,8 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { "/opt/Mullvad VPN/resources/*.so*" mr, "/opt/Mullvad VPN/resources/*" r, - /etc/mullvad-vpn/{,*} r, + /etc/mullvad-vpn/ rw, + /etc/mullvad-vpn/* r, /etc/mullvad-vpn/@{uuid} rw, /etc/mullvad-vpn/*.json rw, @{etc_rw}/resolv.conf rw, @@ -49,16 +51,19 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { owner /var/log/mullvad-vpn/{,*} rw, owner /var/log/private/mullvad-vpn/*.log rw, + owner @{tmp}/@{uuid} rw, + owner @{tmp}/talpid-openvpn-@{uuid} rw, + @{run}/NetworkManager/resolv.conf r, owner @{run}/mullvad-vpn rw, @{sys}/fs/cgroup/net_cls/ w, @{sys}/fs/cgroup/net_cls/mullvad-exclusions/ w, @{sys}/fs/cgroup/net_cls/mullvad-exclusions/net_cls.classid rw, + @{sys}/fs/cgroup/system.slice/cpu.max r, + @{sys}/fs/cgroup/system.slice/mullvad-daemon.service/cpu.max r, - owner @{tmp}/@{uuid} rw, - owner @{tmp}/talpid-openvpn-@{uuid} rw, - + @{PROC}/@{pid}/cgroup r, @{PROC}/sys/net/ipv{4,6}/conf/all/arp_ignore rw, @{PROC}/sys/net/ipv{4,6}/conf/all/src_valid_mark rw, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index c36d34e3f..ae9b4cb7f 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -37,6 +37,8 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/mullvad-vpn rw, + /dev/tty rw, deny @{user_share_dirs}/gvfs-metadata/* r, From 35ae596fd98800f52057f338f214f736aad094e0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 10 Jul 2025 00:56:31 +0200 Subject: [PATCH 1072/1455] feat(profile): general update on some core profiles. --- apparmor.d/profiles-a-f/dkms | 5 +++-- apparmor.d/profiles-g-l/gimp | 4 ++++ apparmor.d/profiles-g-l/libreoffice | 3 ++- apparmor.d/profiles-m-r/initramfs-hooks | 6 +++--- apparmor.d/profiles-m-r/mdadm-mkconf | 1 + apparmor.d/profiles-m-r/nvidia-smi | 2 +- apparmor.d/profiles-m-r/ollama | 7 +++++++ apparmor.d/profiles-m-r/power-profiles-daemon | 3 +++ apparmor.d/profiles-s-z/speech-dispatcher | 6 +++++- apparmor.d/profiles-s-z/terminator | 1 + apparmor.d/profiles-s-z/update-shells | 4 +++- apparmor.d/profiles-s-z/virt-manager | 1 + apparmor.d/profiles-s-z/whoopsie | 2 ++ 13 files changed, 36 insertions(+), 9 deletions(-) diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index a0d5b08f9..5a0885143 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -29,8 +29,8 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{bin}/as rix, @{bin}/bc rix, @{bin}/clang-@{version} rix, - @{bin}/gcc rix, @{bin}/g++ rix, + @{bin}/gcc rix, @{bin}/getconf rix, @{bin}/kill rix, @{bin}/kmod rCx -> kmod, @@ -44,8 +44,9 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{bin}/readelf rix, @{bin}/rpm rPUx, @{bin}/strip rix, - @{sbin}/update-secureboot-policy rPUx, + @{bin}/xz rix, @{bin}/zstd rix, + @{sbin}/update-secureboot-policy rPUx, @{lib}/gcc/@{multiarch}/@{version}/* rix, @{lib}/linux-kbuild-*/scripts/** rix, diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index b335650d8..67b625d62 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -28,6 +28,7 @@ profile gimp @{exec_path} { @{python_path} rix, @{bin}/env rix, + @{bin}/gimp-debug-tool-3.0 rix, @{bin}/gimp-script-fu-interpreter-* rix, @{bin}/gjs-console rix, @{bin}/lua rix, @@ -41,6 +42,7 @@ profile gimp @{exec_path} { /usr/share/gimp/{,**} r, /usr/share/mypaint-data/{,**} r, + /usr/share/poppler/{,**} r, /usr/share/xml/iso-codes/{,**} r, /etc/fstab r, @@ -68,6 +70,8 @@ profile gimp @{exec_path} { owner @{tmp}/gimp/{,**} rw, + @{run}/mount/utab r, + @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index b21642cf8..4bed50f13 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -81,6 +81,7 @@ profile libreoffice @{exec_path} { /etc/papersize r, /etc/xdg/* r, + /var/tmp/ r, owner /var/spool/libreoffice/uno_packages/cache/stamp.sys w, owner @{user_cache_dirs}/libreoffice/{,**} rw, @@ -93,7 +94,7 @@ profile libreoffice @{exec_path} { owner @{user_share_dirs}/#@{int} rw, owner @{user_share_dirs}/user-places.xbel r, - owner @{tmp}/ r, + @{tmp}/ r, owner @{tmp}/.java_pid@{int}{,.tmp} rw, owner @{tmp}/@{hex} rw, owner @{tmp}/@{rand6} rwk, diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index aeb125ef2..5896df049 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -25,10 +25,10 @@ profile initramfs-hooks @{exec_path} { @{lib}/klibc/bin/fstype ix, /usr/share/mdadm/mkconf Px, - @{bin}/* r, - @{sbin}/* r, + @{bin}/* mr, + @{sbin}/* mr, @{lib}/ r, - @{lib}/** r, + @{lib}/** mr, /usr/share/initramfs-tools/{,**} r, /usr/share/plymouth/{,**} r, diff --git a/apparmor.d/profiles-m-r/mdadm-mkconf b/apparmor.d/profiles-m-r/mdadm-mkconf index 8139ac68e..c922942ec 100644 --- a/apparmor.d/profiles-m-r/mdadm-mkconf +++ b/apparmor.d/profiles-m-r/mdadm-mkconf @@ -19,6 +19,7 @@ profile mdadm-mkconf @{exec_path} { @{sbin}/mdadm Px, /etc/default/mdadm r, + /etc/mdadm/mdadm.conf r, / r, diff --git a/apparmor.d/profiles-m-r/nvidia-smi b/apparmor.d/profiles-m-r/nvidia-smi index 9ea391400..1d6d62e2b 100644 --- a/apparmor.d/profiles-m-r/nvidia-smi +++ b/apparmor.d/profiles-m-r/nvidia-smi @@ -25,7 +25,7 @@ profile nvidia-smi @{exec_path} { /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 /dev/nvidia-caps/ rw, - /dev/nvidia-caps/nvidia-cap@{int} r, + /dev/nvidia-caps/nvidia-cap@{int} rw, /dev/nvidia-uvm rw, /dev/nvidia-uvm-tools r, diff --git a/apparmor.d/profiles-m-r/ollama b/apparmor.d/profiles-m-r/ollama index 7b5521802..73447e33e 100644 --- a/apparmor.d/profiles-m-r/ollama +++ b/apparmor.d/profiles-m-r/ollama @@ -38,8 +38,15 @@ profile ollama @{exec_path} flags=(attach_disconnected) { owner @{tmp}/ollama@{int}/{,**} rw, owner @{tmp}/ollama@{int}/runners/{,**} mr, + @{sys}/devices/@{pci}/drm/card@{int}/ r, + @{sys}/devices/@{pci}/drm/card@{int}/*/ r, + @{sys}/devices/@{pci}/mem_info_vram_total r, + @{sys}/devices/@{pci}/mem_info_vram_used r, @{sys}/devices/@{pci}/numa_node r, @{sys}/devices/system/node/node@{int}/cpumap r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/ r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/ r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/properties r, @{PROC}/devices r, @{PROC}/sys/net/core/somaxconn r, diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index 43f27b2fc..636f41754 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -30,10 +30,13 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+platform:* r, @{run}/udev/data/+power_supply:* r, + @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs + @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* @{sys}/bus/ r, @{sys}/bus/platform/devices/ r, @{sys}/class/ r, + @{sys}/class/drm/ r, @{sys}/class/power_supply/ r, @{sys}/devices/**/power_supply/*/scope r, @{sys}/devices/**/uevent r, diff --git a/apparmor.d/profiles-s-z/speech-dispatcher b/apparmor.d/profiles-s-z/speech-dispatcher index 652a7d9ed..0267d6889 100644 --- a/apparmor.d/profiles-s-z/speech-dispatcher +++ b/apparmor.d/profiles-s-z/speech-dispatcher @@ -20,16 +20,20 @@ profile speech-dispatcher @{exec_path} { @{exec_path} mr, @{sh_path} ix, + @{lib}/speech-dispatcher-modules/* ix, @{lib}/speech-dispatcher/** r, @{lib}/speech-dispatcher/speech-dispatcher-modules/* ix, /etc/machine-id r, /etc/speech-dispatcher/{,**} r, + owner @{user_config_dirs}/speech-dispatcher/{,**} r, + owner @{run}/user/@{uid}/speech-dispatcher/ rw, owner @{run}/user/@{uid}/speech-dispatcher/** rwk, - owner @{user_config_dirs}/speech-dispatcher/{,**} r, + owner /dev/shm/sem.@{rand6} rw, + owner /dev/shm/sem.speechd-modules-dummy-@{int} rwl -> /dev/shm/sem.@{rand6}, include if exists } diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index 679a0fd32..5c79d0efe 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/terminator profile terminator @{exec_path} flags=(attach_disconnected) { include + include include include include diff --git a/apparmor.d/profiles-s-z/update-shells b/apparmor.d/profiles-s-z/update-shells index 46b6699c8..5922c1a14 100644 --- a/apparmor.d/profiles-s-z/update-shells +++ b/apparmor.d/profiles-s-z/update-shells @@ -17,12 +17,14 @@ profile update-shells @{exec_path} { @{bin}/chmod ix, @{bin}/chown ix, @{bin}/dirname ix, - @{bin}/dpkg-realpath ix, + @{bin}/dpkg-realpath rix, @{bin}/mv ix, @{bin}/sync ix, + @{bin}/readlink ix, /usr/share/debianutils/shells r, /usr/share/debianutils/shells.d/{,**} r, + /usr/share/dpkg/sh/dpkg-error.sh r, /etc/shells r, /etc/shells.tmp w, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index fa17f5b1b..aed85abe3 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -84,6 +84,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/libvirt/libvirtd.lock rwk, owner @{run}/user/@{uid}/libvirt/virtqemud.lock rwk, + @{run}/libvirt/libvirt-sock rw, @{run}/mount/utab r, @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/profiles-s-z/whoopsie b/apparmor.d/profiles-s-z/whoopsie index 16a0e5a5e..0c03f4a76 100644 --- a/apparmor.d/profiles-s-z/whoopsie +++ b/apparmor.d/profiles-s-z/whoopsie @@ -25,6 +25,8 @@ profile whoopsie @{exec_path} { owner @{run}/lock/whoopsie/ rw, owner @{run}/lock/whoopsie/lock rwk, + @{sys}/devices/virtual/dmi/id/product_uuid r, + include if exists } From 06d23ac72cc646cee3ea0e5417f0b50e3092b1ef Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Wed, 2 Jul 2025 05:29:55 +0200 Subject: [PATCH 1073/1455] Fix strawberry profile --- apparmor.d/profiles-s-z/strawberry | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index 84bbcf1f2..611c8462d 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -69,8 +69,8 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/*= w, owner @{tmp}/#@{int} rw, owner @{tmp}/etilqs_@{sqlhex} rw, - owner @{tmp}/kdsingleapp-daemonspudguy-strawberry w, - owner @{tmp}/kdsingleapp-daemonspudguy-strawberry.lock rwk, + owner @{tmp}/kdsingleapp-*-strawberry w, + owner @{tmp}/kdsingleapp-*-strawberry.lock rwk, owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw, owner @{tmp}/strawberry-cover-@{rand6}.jpg rwl -> @{tmp}/#@{int}, owner @{tmp}/strawberry*[0-9] w, From e92f2fb453ea53d4a6da31bc61f95466e2be47a4 Mon Sep 17 00:00:00 2001 From: valoq Date: Sun, 29 Jun 2025 19:35:08 +0200 Subject: [PATCH 1074/1455] ouch: allow listing archive contents --- apparmor.d/profiles-m-r/ouch | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apparmor.d/profiles-m-r/ouch b/apparmor.d/profiles-m-r/ouch index a5b62ca93..d0bb4a1ed 100644 --- a/apparmor.d/profiles-m-r/ouch +++ b/apparmor.d/profiles-m-r/ouch @@ -17,11 +17,16 @@ profile ouch @{exec_path} { owner @{HOME}/.tmp@{rand6}/{,**} rw, owner @{HOME}/.tmp-ouch@{rand6}/{,**} rw, + owner /tmp/ w, + owner /tmp/.tmp@{rand6}/{,**} rw, + owner /tmp/.tmp-ouch@{rand6}/{,**} rw, + @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r, owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/mountinfo r, include if exists } From 2e9d450fde3d0499762d5961f4f881e81decb105 Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Mon, 23 Jun 2025 17:58:52 +0800 Subject: [PATCH 1075/1455] Fix tlp start issue --- apparmor.d/profiles-s-z/tlp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index 9faea6e3e..7c0a3d2c8 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -16,6 +16,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { include include include + include capability dac_read_search, capability sys_nice, @@ -48,6 +49,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{bin}/tr rix, @{bin}/udevadm rCx -> udevadm, @{bin}/uname rix, + @{bin}/timeout rix, /usr/share/tlp/tlp-readconfs rix, / r, @@ -104,7 +106,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { include include - @{run}/tlp/lock_tlp rw, + @{run}/tlp/lock_tlp rw, # file_inherit include if exists } From d855eeccd746b8ecaeaf3cc7f144715909d5136f Mon Sep 17 00:00:00 2001 From: EricLin0509 Date: Mon, 23 Jun 2025 18:01:31 +0800 Subject: [PATCH 1076/1455] Not use tabs --- apparmor.d/profiles-s-z/tlp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index 7c0a3d2c8..3eb0800f9 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -49,7 +49,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{bin}/tr rix, @{bin}/udevadm rCx -> udevadm, @{bin}/uname rix, - @{bin}/timeout rix, + @{bin}/timeout rix, /usr/share/tlp/tlp-readconfs rix, / r, From 97d5fe3f6865217f16d05876235ce68b4572312d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 11 Jul 2025 19:37:40 +0200 Subject: [PATCH 1077/1455] feat(abs): user-read/write: allow files directly on the home directory. --- apparmor.d/abstractions/user-read-strict | 1 + apparmor.d/abstractions/user-write-strict | 1 + 2 files changed, 2 insertions(+) diff --git a/apparmor.d/abstractions/user-read-strict b/apparmor.d/abstractions/user-read-strict index f7eb186b5..9626bb0bc 100644 --- a/apparmor.d/abstractions/user-read-strict +++ b/apparmor.d/abstractions/user-read-strict @@ -8,6 +8,7 @@ abi , owner @{HOME}/ r, + owner @{HOME}/[^.]* rk, owner @{MOUNTS}/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} rk, diff --git a/apparmor.d/abstractions/user-write-strict b/apparmor.d/abstractions/user-write-strict index 026825b27..88d52203e 100644 --- a/apparmor.d/abstractions/user-write-strict +++ b/apparmor.d/abstractions/user-write-strict @@ -8,6 +8,7 @@ abi , owner @{HOME}/ r, + owner @{HOME}/[^.]* wl, owner @{MOUNTS}/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} wl, From a79e46acdd3768be0ab4f58ac026057a41274ad7 Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 18 Jun 2025 22:27:18 +0200 Subject: [PATCH 1078/1455] add profile for whois --- apparmor.d/profiles-s-z/whois | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 apparmor.d/profiles-s-z/whois diff --git a/apparmor.d/profiles-s-z/whois b/apparmor.d/profiles-s-z/whois new file mode 100644 index 000000000..8353f81d0 --- /dev/null +++ b/apparmor.d/profiles-s-z/whois @@ -0,0 +1,27 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/whois +profile whois @{exec_path} { + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + /etc/whois.conf r, + + include if exists +} + +# vim:syntax=apparmor From 8fc70859aaef7cc20181ac6d115a6ff8ca5a9162 Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 18 Jun 2025 22:35:59 +0200 Subject: [PATCH 1079/1455] fix include --- apparmor.d/profiles-s-z/whois | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/whois b/apparmor.d/profiles-s-z/whois index 8353f81d0..a1549db03 100644 --- a/apparmor.d/profiles-s-z/whois +++ b/apparmor.d/profiles-s-z/whois @@ -21,7 +21,7 @@ profile whois @{exec_path} { /etc/whois.conf r, - include if exists + include if exists } # vim:syntax=apparmor From 2c1d235ef02b11750dd5cc812e24dfc188b173f7 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sat, 21 Jun 2025 12:27:14 +0200 Subject: [PATCH 1080/1455] Hardening kioworker with reagrd to ps See #711 --- apparmor.d/groups/kde/kioworker | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 1d091fd09..61e910c88 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -38,7 +38,7 @@ profile kioworker @{exec_path} { @{lib}/libheif/*.so* rm, @{bin}/wrestool rPUx, - @{bin}/gs rPUx, + @{bin}/gs rix, #aa:exec kio_http_cache_cleaner From cdb64e14bab522751c7cec2b51cdbdb1ebadf05e Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 16 Jul 2025 18:37:52 +0200 Subject: [PATCH 1081/1455] add texstudio --- apparmor.d/profiles-s-z/texstudio | 48 +++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 apparmor.d/profiles-s-z/texstudio diff --git a/apparmor.d/profiles-s-z/texstudio b/apparmor.d/profiles-s-z/texstudio new file mode 100644 index 000000000..836a9a6ab --- /dev/null +++ b/apparmor.d/profiles-s-z/texstudio @@ -0,0 +1,48 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/texstudio +profile texstudio @{exec_path} { + include + include + include + include + include + include + include + + @{exec_path} mr, + + @{bin}/pdflatex ix, + @{bin}/pdftex ix, + @{bin}/kpsewhich ix, + @{bin}/gsettings ix, + @{bin}/which ix, + + /usr/share/texmf-dist/{,**} r, + /usr/share/doc/texstudio/{,**} r, + /usr/share/hunspell/{,**} r, + /usr/share/texstudio/{,**} r, + /usr/share/poppler/{,**} r, + + /etc/texmf/{,**} r, + /etc/machine-id r, + + /var/lib/texmf/{,**} r, + + owner @{user_config_dirs}/texstudio/{,**} rwlk, + owner /tmp/qtsingleapp-TeXstu-** rw, + owner /tmp/qtsingleapp-TeXstu-**-lockfile rwk, + + ## silencer + deny owner /usr/share/hunspell/en_US-large.ign w, + + include if exists +} + +# vim:syntax=apparmor From d120792297b4902b1bc4fb640833c2c619f77796 Mon Sep 17 00:00:00 2001 From: valoq Date: Fri, 18 Jul 2025 11:27:21 +0200 Subject: [PATCH 1082/1455] fix ci --- apparmor.d/profiles-s-z/texstudio | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-s-z/texstudio b/apparmor.d/profiles-s-z/texstudio index 836a9a6ab..4a42a8eff 100644 --- a/apparmor.d/profiles-s-z/texstudio +++ b/apparmor.d/profiles-s-z/texstudio @@ -15,14 +15,14 @@ profile texstudio @{exec_path} { include include include - + @{exec_path} mr, @{bin}/pdflatex ix, @{bin}/pdftex ix, @{bin}/kpsewhich ix, @{bin}/gsettings ix, - @{bin}/which ix, + @{bin}/which{,.debianutils} ix, /usr/share/texmf-dist/{,**} r, /usr/share/doc/texstudio/{,**} r, From 7b6f2353fdbf4f7fce1ef27c1e25d4aa9f3b6bb3 Mon Sep 17 00:00:00 2001 From: valoq Date: Fri, 18 Jul 2025 11:29:42 +0200 Subject: [PATCH 1083/1455] remove white space --- apparmor.d/profiles-s-z/texstudio | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/texstudio b/apparmor.d/profiles-s-z/texstudio index 4a42a8eff..52e9e53e6 100644 --- a/apparmor.d/profiles-s-z/texstudio +++ b/apparmor.d/profiles-s-z/texstudio @@ -41,7 +41,7 @@ profile texstudio @{exec_path} { ## silencer deny owner /usr/share/hunspell/en_US-large.ign w, - + include if exists } From 7a47914542ce3e45e85e759f1e38a9cdee244a00 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Jul 2025 20:07:33 +0200 Subject: [PATCH 1084/1455] tests: add test file for whois. --- tests/integration/whois.bats | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 tests/integration/whois.bats diff --git a/tests/integration/whois.bats b/tests/integration/whois.bats new file mode 100644 index 000000000..fd1cba5fa --- /dev/null +++ b/tests/integration/whois.bats @@ -0,0 +1,19 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load common + +@test "whois: Get information about a domain name" { + whois google.fr +} + +@test "whois: Get information about an IP address" { + whois 8.8.8.8 +} + +@test "whois: Get abuse contact for an IP address" { + whois -b 8.8.8.8 +} + From 8020c2c63d0c578e147b8ee9230010dc4aca44a7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Jul 2025 20:09:41 +0200 Subject: [PATCH 1085/1455] feat(profile): update pacman profiles. --- apparmor.d/groups/pacman/makepkg | 5 +++-- apparmor.d/groups/pacman/paccache | 1 + apparmor.d/groups/pacman/pacman | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 30650d80c..583d0b9c0 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -11,6 +11,7 @@ profile makepkg @{exec_path} { include include include + include include include include @@ -72,8 +73,8 @@ profile makepkg @{exec_path} { owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw, owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/task/@{tid}/comm rw, include if exists } diff --git a/apparmor.d/groups/pacman/paccache b/apparmor.d/groups/pacman/paccache index f537afdb3..8bf1aed6a 100644 --- a/apparmor.d/groups/pacman/paccache +++ b/apparmor.d/groups/pacman/paccache @@ -36,6 +36,7 @@ profile paccache @{exec_path} flags=(attach_disconnected) { /etc/pacman.conf r, /etc/pacman.d/{,**} r, + /etc/pacman.d/gnupg/** rwlk -> /etc/pacman.d/gnupg/**, /var/cache/pacman/pkg/{,*} rw, /var/lib/pacman/{,**} r, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index ff43e2196..01543d63f 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -187,7 +187,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) { include if exists } - profile systemctl { + profile systemctl flags=(attach_disconnected) { include include From 03b174a2d42c6d36e3f979a92e35f06f1f6b1f5c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Jul 2025 20:11:18 +0200 Subject: [PATCH 1086/1455] feat(profile): simplify modprobe-nvidia. --- apparmor.d/groups/children/child-modprobe-nvidia | 3 --- 1 file changed, 3 deletions(-) diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index 9b331a8ce..61191fe9d 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -20,7 +20,6 @@ include profile child-modprobe-nvidia flags=(attach_disconnected) { include include - include capability chown, capability fsetid, @@ -35,8 +34,6 @@ profile child-modprobe-nvidia flags=(attach_disconnected) { @{sys}/bus/pci/devices/ r, @{sys}/devices/@{pci}/config r, - @{PROC}/sys/kernel/modprobe r, - @{PROC}/devices r, @{PROC}/driver/nvidia/capabilities/mig/config r, @{PROC}/driver/nvidia/capabilities/mig/monitor r, From 881402dc2166b735712e40134558568512059ee8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Jul 2025 20:17:26 +0200 Subject: [PATCH 1087/1455] feat(profile): improve some systemd profiles. --- apparmor.d/groups/systemd/systemd-coredump | 2 +- apparmor.d/groups/systemd/systemd-machined | 22 ++++++++++++++++++- .../systemd/systemd-tty-ask-password-agent | 3 ++- 3 files changed, 24 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 52efea3db..2f6d81fdb 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -39,7 +39,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted /etc/systemd/coredump.conf r, /etc/systemd/coredump.conf.d/{,**} r, - owner @{HOME}/**.so r, + owner @{HOME}/**.so* r, /var/lib/systemd/coredump/{,**} rwl, diff --git a/apparmor.d/groups/systemd/systemd-machined b/apparmor.d/groups/systemd/systemd-machined index b37f2300b..b9244ece6 100644 --- a/apparmor.d/groups/systemd/systemd-machined +++ b/apparmor.d/groups/systemd/systemd-machined @@ -10,6 +10,7 @@ include profile systemd-machined @{exec_path} flags=(attach_disconnected) { include include + include include include @@ -21,6 +22,7 @@ profile systemd-machined @{exec_path} flags=(attach_disconnected) { capability kill, capability mknod, capability setgid, + capability setuid, capability sys_admin, capability sys_chroot, capability sys_ptrace, @@ -31,26 +33,44 @@ profile systemd-machined @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network netlink raw, + signal send set=rtmin+6 peer=systemd-nspawn, + + ptrace read peer=systemd-nspawn, + #aa:dbus own bus=system name=org.freedesktop.machine1 #aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" @{exec_path} mr, - /var/lib/machines/{,**} rw, /etc/machine-id r, + / r, + @{att}/ r, + + owner /var/lib/machines/ rw, + owner /var/lib/machines/** rwk, + + owner @{run}/systemd/nspawn/ w, + owner @{run}/systemd/nspawn/locks/ w, + owner @{run}/systemd/nspawn/locks/** rwk, + @{run}/systemd/machine/{,**} rw, @{run}/systemd/machines/{,**} rw, @{run}/systemd/notify w, @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/gid_map r, + @{PROC}/@{pid}/setgroups r, + @{PROC}/@{pid}/uid_map r, @{PROC}/pressure/cpu r, @{PROC}/pressure/io r, @{PROC}/pressure/memory r, /dev/ptmx rw, /dev/pts/@{int} rw, + /dev/pts/ptmx rw, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent index 30d30b295..b318bf3dd 100644 --- a/apparmor.d/groups/systemd/systemd-tty-ask-password-agent +++ b/apparmor.d/groups/systemd/systemd-tty-ask-password-agent @@ -17,10 +17,11 @@ profile systemd-tty-ask-password-agent @{exec_path} { capability net_admin, capability sys_resource, + signal receive set=(term cont winch) peer=@{p_logrotate}, signal receive set=(term cont winch) peer=*//systemctl, signal receive set=(term cont winch) peer=deb-systemd-invoke, signal receive set=(term cont winch) peer=default, - signal receive set=(term cont winch) peer=@{p_logrotate}, + signal receive set=(term cont winch) peer=machinectl, signal receive set=(term cont winch) peer=makepkg//sudo, signal receive set=(term cont winch) peer=role_*, signal receive set=(term cont winch) peer=rpm, From c6030de00ae7566cd0267d2a10bfa6d00858a41a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 12 Jul 2025 20:49:34 +0200 Subject: [PATCH 1088/1455] build: add just command for local and dev install. --- Justfile | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/Justfile b/Justfile index 109cfed3b..7753ad2d1 100644 --- a/Justfile +++ b/Justfile @@ -95,7 +95,7 @@ fsp-complain: build fsp-debug: build @./{{build}}/prebuild --complain --full --debug -[group('build')] +[group('install')] [doc('Install prebuild profiles')] install: #!/usr/bin/env bash @@ -123,6 +123,35 @@ install: install -Dm0644 "$file" "{{destdir}}/usr/lib/systemd/user/$service.d/apparmor.conf" done +[group('install')] +[doc('Locally install prebuild profiles')] +local +args: + #!/usr/bin/env bash + set -eu -o pipefail + install -Dm0755 {{build}}/aa-log {{destdir}}/usr/bin/aa-log + mapfile -t abs < <(find "{{build}}/apparmor.d/abstractions" -type f -printf "%P\n") + for file in "${abs[@]}"; do + install -Dm0644 "{{build}}/apparmor.d/abstractions/$file" "{{destdir}}/etc/apparmor.d/abstractions/$file" + done; + mapfile -t tunables < <(find "{{build}}/apparmor.d/tunables" -type f -printf "%P\n") + for file in "${tunables[@]}"; do + install -Dm0644 "{{build}}/apparmor.d/tunables/$file" "{{destdir}}/etc/apparmor.d/tunables/$file" + done; + echo "Warning: profile dependencies fallback to unconfined." + for file in {{args}}; do + grep -Ei 'rPx|rpx' "{{build}}/apparmor.d/$file" || true + sed -i -e "s/rPx/rPUx/g" "{{build}}/apparmor.d/$file" + install -Dvm0644 "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file" + done; + systemctl restart apparmor || sudo journalctl -xeu apparmor.service + +[group('install')] +[doc('Prebuild, install, and load a dev profile')] +dev name: + go run ./cmd/prebuild --complain --file `find apparmor.d -iname {{name}}` + sudo install -Dm644 {{build}}/apparmor.d/{{name}} /etc/apparmor.d/{{name}} + sudo systemctl restart apparmor || sudo journalctl -xeu apparmor.service + [group('packages')] [doc('Build & install apparmor.d on Arch based systems')] pkg: From 72b136578dd1e5db2efa5b60790fcafd679dd72a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 18 Jul 2025 00:12:46 +0200 Subject: [PATCH 1089/1455] fix(profile): ensure wc is in pacman-hook-perl fix #786 --- apparmor.d/groups/pacman/pacman-hook-perl | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/pacman/pacman-hook-perl b/apparmor.d/groups/pacman/pacman-hook-perl index 07539ae95..aa2be8b09 100644 --- a/apparmor.d/groups/pacman/pacman-hook-perl +++ b/apparmor.d/groups/pacman/pacman-hook-perl @@ -20,6 +20,7 @@ profile pacman-hook-perl @{exec_path} { @{bin}/find rix, @{bin}/pacman rPx, @{bin}/sed rix, + @{bin}/wc rix, /dev/tty rw, /dev/tty@{int} rw, From 38b165ff319da0177f2fc983921fd6c80bbe360e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 18 Jul 2025 00:13:50 +0200 Subject: [PATCH 1090/1455] feat(profile): minor apt improvement. --- apparmor.d/groups/apt/apt | 1 + apparmor.d/groups/apt/apt-methods-sqv | 1 + apparmor.d/groups/apt/dpkg-scripts | 1 + 3 files changed, 3 insertions(+) diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 5be4284f9..9bdabb1c2 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -64,6 +64,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/{,e}grep rix, + @{bin}/cat rix, @{bin}/echo rix, @{bin}/gdbus rix, @{bin}/id rix, diff --git a/apparmor.d/groups/apt/apt-methods-sqv b/apparmor.d/groups/apt/apt-methods-sqv index 416328cd4..0dcd7da0d 100644 --- a/apparmor.d/groups/apt/apt-methods-sqv +++ b/apparmor.d/groups/apt/apt-methods-sqv @@ -18,6 +18,7 @@ profile apt-methods-sqv @{exec_path} { capability setuid, signal receive set=int peer=apt, + signal receive set=int peer=packagekitd, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index d3994d0ec..44e4790c4 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -65,6 +65,7 @@ profile dpkg-scripts @{exec_path} { @{lib}/@{python_name}/**/__pycache__/ w, @{lib}/@{python_name}/**/__pycache__/**.pyc w, @{lib}/@{python_name}/**/__pycache__/**.pyc.@{u64} w, + @{lib}/modules/*/.fresh-install w, /etc/ r, /etc/** rw, From d9d762aaaa939e29048ea75715a71f6f96f675af Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 18 Jul 2025 00:16:29 +0200 Subject: [PATCH 1091/1455] fix(profile): systemd-coredump: also allow sbin --- apparmor.d/groups/systemd/systemd-coredump | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 2f6d81fdb..2bd25ec16 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -33,6 +33,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted @{lib}/** r, / r, @{bin}/* r, + @{sbin}/* r, /opt/** r, @{user_lib_dirs}/** r, From 2f1022dc8de00f29472a0fe1c5c8ed8bd7ed8c78 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 18 Jul 2025 00:19:29 +0200 Subject: [PATCH 1092/1455] feat(profile): general minor update to profiles. --- apparmor.d/profiles-a-f/alacarte | 7 ++++++- apparmor.d/profiles-a-f/birdtray | 2 +- apparmor.d/profiles-a-f/code-extension-git-askpass | 4 ++-- apparmor.d/profiles-a-f/dkms | 1 + apparmor.d/profiles-g-l/git | 3 ++- apparmor.d/profiles-m-r/needrestart-restart | 1 + apparmor.d/profiles-m-r/pass | 2 +- apparmor.d/profiles-s-z/wechat | 2 +- apparmor.d/profiles-s-z/wechat-appimage | 3 ++- apparmor.d/profiles-s-z/wechat-universal | 4 ++-- 10 files changed, 19 insertions(+), 10 deletions(-) diff --git a/apparmor.d/profiles-a-f/alacarte b/apparmor.d/profiles-a-f/alacarte index eed67619d..700c6d517 100644 --- a/apparmor.d/profiles-a-f/alacarte +++ b/apparmor.d/profiles-a-f/alacarte @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/alacarte -profile alacarte @{exec_path} { +profile alacarte @{exec_path} flags=(attach_disconnected) { include include include @@ -30,6 +30,11 @@ profile alacarte @{exec_path} { owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-a-f/birdtray b/apparmor.d/profiles-a-f/birdtray index c63a8de7c..771560c6b 100644 --- a/apparmor.d/profiles-a-f/birdtray +++ b/apparmor.d/profiles-a-f/birdtray @@ -40,7 +40,7 @@ profile birdtray @{exec_path} { owner @{HOME}/.thunderbird/*.*/{Imap,}Mail/**/*.msf r, owner @{user_config_dirs}/ulduzsoft/ rw, - owner @{user_config_dirs}/ulduzsoft/* rwkl -> /home/morfik/.config/ulduzsoft/*, + owner @{user_config_dirs}/ulduzsoft/* rwkl -> @{user_config_dirs}/ulduzsoft/*, owner @{user_config_dirs}/birdtray-config.json rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/birdtray-config.json.* rwl -> @{user_config_dirs}/#@{int}, diff --git a/apparmor.d/profiles-a-f/code-extension-git-askpass b/apparmor.d/profiles-a-f/code-extension-git-askpass index 5a31889b9..674432b2e 100644 --- a/apparmor.d/profiles-a-f/code-extension-git-askpass +++ b/apparmor.d/profiles-a-f/code-extension-git-askpass @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{lib}/code/extensions/git/dist/askpass.sh +@{exec_path} = @{lib}/code/extensions/git/dist/askpass.sh @{lib}/code/extensions/git/dist/ssh-askpass.sh profile code-extension-git-askpass @{exec_path} { include @@ -23,7 +23,7 @@ profile code-extension-git-askpass @{exec_path} { /usr/share/terminfo/** r, - owner @{tmp}/tmp.* rw, + owner @{tmp}/tmp.@{rand10} rw, /dev/tty rw, diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 5a0885143..7c594c900 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -32,6 +32,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{bin}/g++ rix, @{bin}/gcc rix, @{bin}/getconf rix, + @{bin}/hostname rix, @{bin}/kill rix, @{bin}/kmod rCx -> kmod, @{bin}/ld rix, diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 457e79d2a..a0ea6393e 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -133,7 +133,8 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/ssh mr, @{bin}/ksshaskpass ix, - + @{lib}/code/extensions/git/dist/ssh-askpass.sh Px, + @{etc_ro}/ssh/ssh_config.d/{,*} r, @{etc_ro}/ssh/ssh_config r, diff --git a/apparmor.d/profiles-m-r/needrestart-restart b/apparmor.d/profiles-m-r/needrestart-restart index b9e648602..964ff1a74 100644 --- a/apparmor.d/profiles-m-r/needrestart-restart +++ b/apparmor.d/profiles-m-r/needrestart-restart @@ -13,6 +13,7 @@ profile needrestart-restart @{exec_path} { @{exec_path} mr, @{bin}/systemctl Cx -> systemctl, + @{sh_path} r, /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 096f0316a..7e432a838 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -40,7 +40,7 @@ profile pass @{exec_path} { @{bin}/tr ix, @{bin}/tree ix, @{bin}/tty ix, - @{bin}/which{,.debianutils} ix, + @{bin}/which{,.debianutils} rix, @{bin}/git Cx -> git, @{bin}/gpg{2,} Cx -> gpg, diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat index b7ad3a2e8..cb554fc6b 100644 --- a/apparmor.d/profiles-s-z/wechat +++ b/apparmor.d/profiles-s-z/wechat @@ -14,9 +14,9 @@ include @{exec_path} = @{lib_dirs}/wechat profile wechat @{exec_path} flags=(attach_disconnected) { include - include include include + include include network netlink raw, diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage index 55155f2b8..9f8c20338 100644 --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -14,10 +14,11 @@ include @{exec_path} = @{bin}/wechat @{lib_dirs}/wechat-appimage.Appimage /tmp/.mount_wechat??????/user/bin/wechat profile wechat-appimage @{exec_path} flags=(attach_disconnected) { include - include include include + include include + include network netlink raw, network netlink dgram, diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index 21e1eee10..cd8958e8e 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -14,10 +14,10 @@ include @{exec_path} = @{bin}/wechat-universal @{lib_dirs}/wechat profile wechat-universal @{exec_path} flags=(attach_disconnected) { include - include include - include include + include + include include network netlink raw, From f183ae709f4ffeea0443145cfcaf45d34d1dac62 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 18 Jul 2025 00:23:37 +0200 Subject: [PATCH 1093/1455] chore: fix linter issue. --- apparmor.d/profiles-g-l/git | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index a0ea6393e..c9373c7ae 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -134,7 +134,7 @@ profile git @{exec_path} flags=(attach_disconnected) { @{bin}/ssh mr, @{bin}/ksshaskpass ix, @{lib}/code/extensions/git/dist/ssh-askpass.sh Px, - + @{etc_ro}/ssh/ssh_config.d/{,*} r, @{etc_ro}/ssh/ssh_config r, From 033354314f0e98b9f9e00ce240a634b42d731b9c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 19 Jul 2025 17:54:02 +0200 Subject: [PATCH 1094/1455] doc: minor documentation update. --- docs/configuration.md | 2 +- docs/development/roadmap.md | 8 ++++---- docs/development/vm.md | 31 +++++++++++++++++++++++-------- docs/full-system-policy.md | 10 ++++++++++ 4 files changed, 38 insertions(+), 13 deletions(-) diff --git a/docs/configuration.md b/docs/configuration.md index fd8a5d38c..5e1c7992f 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -41,7 +41,7 @@ You can extend any profile with your own rules by creating a file in the `/etc/a **Example** -By default, `nautilus` (and any file browser) only allows access to user files. Thus, your cannot browse system files such as `/etc/`, `/srv/`, `/var/`. You can change this behaviour by creating a local profile addition file for `nautilus`: +By default, `nautilus` (and any file browser) only allows access to user files. Thus, your cannot browse system files such as `/etc/`, `/srv/`, `/var/`. You can change this behavior by creating a local profile addition file for `nautilus`: 1. Create the file `/etc/apparmor.d/local/nautilus` and add the following rules in it: ```sh diff --git a/docs/development/roadmap.md b/docs/development/roadmap.md index 75cbcdd10..b42467e3d 100644 --- a/docs/development/roadmap.md +++ b/docs/development/roadmap.md @@ -22,13 +22,13 @@ This is the current list of features that must be implemented to get to a stable - [ ] **General improvements** - [ ] Provide a proper fix for [#74](https://github.com/roddhjav/apparmor.d/issues/74), [#80](https://github.com/roddhjav/apparmor.d/issues/80) & [#235](https://github.com/roddhjav/apparmor.d/issues/235) - - [ ] The apt/dpkg profiles needs to be reworked + - [x] The apt/dpkg profiles needs to be reworked - [ ] Build system - [ ] Continuous release on the main branch, ~2 releases per week - [ ] Provide packages repo for ubuntu/debian - [ ] Provide complain/enforced packages version - - [ ] Add a `just` target to install the profiles in the right place + - [x] Add a `just` target to install the profiles in the right place - [ ] Fully drop the Makefile in favor of `just` ## Next features @@ -41,9 +41,9 @@ This is the current list of features that must be implemented to get to a stable - [ ] Fully rewrite the way user data is allowed / denied. The current implementation requires too much configuration to be usable by everyone. - [ ] Add a prompt listener to handle the user data access. -- [ ] **[Full System Policy](https://github.com/roddhjav/apparmor.d/issues/252)** +- [x] **[Full System Policy](https://github.com/roddhjav/apparmor.d/issues/252)** - [ ] Debug tool to show the profiles transition tree, and ensure no profile is missing - - [ ] Remove the `default` profile + - [x] Remove the `default` profile ## Done diff --git a/docs/development/vm.md b/docs/development/vm.md index 66630022e..1edddba76 100644 --- a/docs/development/vm.md +++ b/docs/development/vm.md @@ -14,22 +14,42 @@ $ just ``` Available recipes: help # Show this help message + clean # Remove all build artifacts + + [build] build # Build the go programs enforce # Prebuild the profiles in enforced mode complain # Prebuild the profiles in complain mode fsp # Prebuild the profiles in FSP mode - install # Install the profiles + fsp-complain # Prebuild the profiles in FSP mode (complain) + fsp-debug # Prebuild the profiles in FSP mode (debug) + + [install] + install # Install prebuild profiles + local +names # Locally install prebuild profiles + dev name # Prebuild, install, and load a dev profile + + [packages] pkg # Build & install apparmor.d on Arch based systems dpkg # Build & install apparmor.d on Debian based systems rpm # Build & install apparmor.d on OpenSUSE based systems + package dist # Build the package in a clean OCI container + + [tests] tests # Run the unit tests + init dist flavor # Install dependencies for the bats integration tests + integration dist flavor # Run the integration tests on the machine + + [linter] lint # Run the linters check # Run style checks on the profiles + + [docs] man # Generate the man pages docs # Build the documentation serve # Serve the documentation - clean # Remove all build artifacts - package dist # Build the package in a clean OCI container + + [vm] img dist flavor # Build the VM image create dist flavor # Create the machine up dist flavor # Start a machine @@ -40,13 +60,8 @@ Available recipes: list # List the machines images # List the VM images available # List the VM images that can be created - init dist flavor # Install dependencies for the bats integration tests - integration dist flavor # Run the integration tests on the machine - get_ip dist flavor - get_osinfo dist See https://apparmor.pujol.io/development/ for more information. - ``` ## Requirements diff --git a/docs/full-system-policy.md b/docs/full-system-policy.md index 016ed8ada..b523a1c38 100644 --- a/docs/full-system-policy.md +++ b/docs/full-system-policy.md @@ -137,6 +137,16 @@ To work as intended, userland services started by `systemd --user` **should** ha @{lib}/foo rPx -> systemd//&foo, ``` +### Role Based Access Control (RBAC) + +In FSP, interactive shell from the user must be confined. This is done through [pam_apparmor](https://gitlab.com/apparmor/apparmor/-/wikis/pam_apparmor). It provides [Role-based access controls (RBAC)](https://en.wikipedia.org/wiki/Role-based_access_control) that can restrict interactive shell to well-defined role. The role needs to be defined. This project ship with a default set of roles, but you can create your own. The default roles are: + +- **`user`**: This is the default role. It is used for any user that does not have a specific role defined. It has access to the user home directory and other sensitive files. + +- **`admin`**: This role is used for any user that has administrative access. It has access to the system files and directories, but not to the user home directory. + +- **`system`**: This role is used for any user that has system access. It has access to the system files and directories, but not to the user home directory. + ### Fallback In addition to the `systemd` profiles, a full system policy needs to ensure that no programs run in an unconfined state at any time. The fallback profiles consist of a set generic specialized profiles: From ee328ecea8e2b7f071ee25380cb28dd62ca50c98 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 19 Jul 2025 17:58:06 +0200 Subject: [PATCH 1095/1455] fix(profile): ensure gpg has access to pacman public keyring. #788 --- apparmor.d/groups/gpg/gpg | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 7ebb9e3a4..6a01796ff 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -29,6 +29,7 @@ profile gpg @{exec_path} { @{lib}/{,gnupg/}scdaemon rPx, /usr/share/terminfo/** r, + /usr/share/pacman/keyrings/** r, #aa:only pacman /etc/inputrc r, From bba6f253adda95e072e9b92095f2913738d2abcf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 13:22:29 +0200 Subject: [PATCH 1096/1455] doc: add link to the last talk. --- README.md | 4 ++++ docs/overview.md | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/README.md b/README.md index ddb1e79b3..c1c7726c5 100644 --- a/README.md +++ b/README.md @@ -62,6 +62,10 @@ Building the largest set of AppArmor profiles: - [Linux Security Summit North America (LSS-NA 2023)](https://events.linuxfoundation.org/linux-security-summit-north-america/) *([Slide](https://lssna2023.sched.com/event/1K7bI/building-the-largest-working-set-of-apparmor-profiles-alexandre-pujol-the-collaboratory-tudublin), [Video](https://www.youtube.com/watch?v=OzyalrOzxE8))* - [Ubuntu Summit 2023](https://events.canonical.com/event/31/) *([Slide](https://events.canonical.com/event/31/contributions/209/), [Video](https://www.youtube.com/watch?v=GK1J0TlxnFI))* +Lessons learned while making an AppArmor Play machine: + +- [Linux Security Summit North America (LSS-NA 2025)](https://events.linuxfoundation.org/linux-security-summit-north-america/) *([Slide](https://lssna2025.sched.com/event/1zalf/lessons-learned-while-making-an-apparmor-play-machine-alexandre-pujol-linagora), [Video](https://www.youtube.com/watch?v=zCSl8honRI0))* + ## Installation Please see [apparmor.pujol.io/install](https://apparmor.pujol.io/install) diff --git a/docs/overview.md b/docs/overview.md index fb6712a14..20a5a454f 100644 --- a/docs/overview.md +++ b/docs/overview.md @@ -43,6 +43,10 @@ Building the largest set of AppArmor profiles: - [Linux Security Summit North America (LSS-NA 2023)](https://events.linuxfoundation.org/linux-security-summit-north-america/) *([Slide](https://lssna2023.sched.com/event/1K7bI/building-the-largest-working-set-of-apparmor-profiles-alexandre-pujol-the-collaboratory-tudublin), [Video](https://www.youtube.com/watch?v=OzyalrOzxE8))* - [Ubuntu Summit 2023](https://events.canonical.com/event/31/) *([Slide](https://events.canonical.com/event/31/contributions/209/), [Video](https://www.youtube.com/watch?v=GK1J0TlxnFI))* +Lessons learned while making an AppArmor Play machine: + +- [Linux Security Summit North America (LSS-NA 2025)](https://events.linuxfoundation.org/linux-security-summit-north-america/) *([Slide](https://lssna2025.sched.com/event/1zalf/lessons-learned-while-making-an-apparmor-play-machine-alexandre-pujol-linagora), [Video](https://www.youtube.com/watch?v=zCSl8honRI0))* + ### Chat A development chat is available on https://matrix.to/#/#apparmor.d:matrix.org From cf76e2e71411238a48de625334fc8092fc5f9492 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 13:35:53 +0200 Subject: [PATCH 1097/1455] build(arch): sync pkgbuild with the with aur version. --- PKGBUILD | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/PKGBUILD b/PKGBUILD index b48e55153..dfbb46735 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -8,9 +8,9 @@ pkgver=0.001 pkgrel=1 pkgdesc="Full set of apparmor profiles" arch=('x86_64' 'armv6h' 'armv7h' 'aarch64') -url="https://github.com/roddhjav/$pkgname" +url="https://github.com/roddhjav/apparmor.d" license=('GPL-2.0-only') -depends=('apparmor') +depends=('apparmor>=4.1.0' 'apparmor<5.0.0') makedepends=('go' 'git' 'rsync' 'just') conflicts=("$pkgname-git") From 101248b37e235d9176918fc99b23fe370b773ffb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:06:58 +0200 Subject: [PATCH 1098/1455] feat(profile): minor profile update. --- apparmor.d/abstractions/bus/org.freedesktop.systemd1 | 5 +++++ apparmor.d/groups/freedesktop/wireplumber | 2 +- apparmor.d/groups/gnome/gnome-session-check | 5 +++++ apparmor.d/groups/network/dhcpcd | 2 ++ apparmor.d/groups/snap/snapd | 1 + apparmor.d/groups/ssh/sshd | 1 + .../groups/systemd-generators/systemd-generator-import | 4 ++-- apparmor.d/groups/ubuntu/apport | 6 ++++-- apparmor.d/groups/ubuntu/package-system-locked | 2 +- apparmor.d/groups/utils/who | 2 ++ apparmor.d/groups/virt/libvirtd | 1 + 11 files changed, 25 insertions(+), 6 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 index 46297b484..341cf58ce 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 @@ -11,6 +11,11 @@ member={GetUnit,StartUnit,StartTransientUnit} peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=ListUnitsByPatterns + peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), + dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member={GetUnit,StartUnit,StartTransientUnit} diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index 0925bad91..debf19f25 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -52,7 +52,7 @@ profile wireplumber @{exec_path} { owner @{run}/user/@{uid}/pipewire-@{int} rw, owner @{run}/user/@{uid}/pipewire-@{int}-manager rw, - /dev/shm/lttng-ust-wait-@{int} r, + /dev/shm/lttng-ust-wait-@{int} rw, owner /dev/shm/lttng-ust-wait-@{int}-@{uid} rw, owner /dev/shm/lttng-ust-wait-@{int}-@{int} rw, diff --git a/apparmor.d/groups/gnome/gnome-session-check b/apparmor.d/groups/gnome/gnome-session-check index 2a0b4965f..44755aef2 100644 --- a/apparmor.d/groups/gnome/gnome-session-check +++ b/apparmor.d/groups/gnome/gnome-session-check @@ -10,12 +10,17 @@ include profile gnome-session-check @{exec_path} { include include + include @{exec_path} mr, @{lib}/gnome-session-check-accelerated-gl-helper ix, @{lib}/gnome-session-check-accelerated-gles-helper ix, + /usr/share/gnome-session/hardware-compatibility r, + + @{PROC}/cmdline r, + include if exists } diff --git a/apparmor.d/groups/network/dhcpcd b/apparmor.d/groups/network/dhcpcd index 7f47b9975..51cf215f9 100644 --- a/apparmor.d/groups/network/dhcpcd +++ b/apparmor.d/groups/network/dhcpcd @@ -40,6 +40,8 @@ profile dhcpcd @{exec_path} flags=(attach_disconnected) { @{bin}/sed rix, @{lib}/dhcpcd/dhcpcd-run-hooks rix, + /usr/share/dhcpcd/{,**} r, + /etc/dhcpcd.conf r, /etc/resolv.conf rw, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 1add6c1c4..5f0885693 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -110,6 +110,7 @@ profile snapd @{exec_path} { /etc/modprobe.d/{,**/} r, /etc/modules-load.d/{,**/} r, /etc/modules-load.d/*snap* rw, + /etc/polkit-1/rules.d/{,**/} r, /etc/systemd/system/{,**/} r, /etc/systemd/system/snap* rw, /etc/systemd/user/{,**/} rw, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 2494dc2c2..63f2c1370 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -32,6 +32,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { capability dac_override, capability dac_read_search, capability fowner, + capability fsetid, capability kill, capability net_bind_service, capability setgid, diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-import b/apparmor.d/groups/systemd-generators/systemd-generator-import index 36ff4e5ff..de3753aaf 100644 --- a/apparmor.d/groups/systemd-generators/systemd-generator-import +++ b/apparmor.d/groups/systemd-generators/systemd-generator-import @@ -16,13 +16,13 @@ profile systemd-generator-import @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + / r, + @{PROC}/@{pid}/cgroup r, @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, - / r, - /dev/kmsg w, include if exists diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index 8219ef185..9f3fd2999 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -28,8 +28,8 @@ profile apport @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/{,e,f}grep rix, - @{bin}/dpkg rPx -> child-dpkg, - @{bin}/dpkg-divert rPx -> child-dpkg-divert, + @{bin}/dpkg rPx -> &child-dpkg, + @{bin}/dpkg-divert rPx -> &child-dpkg-divert, @{bin}/gdbus rix, @{bin}/md5sum rix, @@ -37,6 +37,8 @@ profile apport @{exec_path} flags=(attach_disconnected) { @{etc_ro}/login.defs r, /etc/apport/report-ignore/{,**} r, + /etc/dpkg/dpkg.cfg r, + /etc/dpkg/dpkg.cfg.d/{,**} r, /var/lib/dpkg/info/ r, /var/lib/dpkg/info/*.list r, diff --git a/apparmor.d/groups/ubuntu/package-system-locked b/apparmor.d/groups/ubuntu/package-system-locked index 7398fc404..8cf3ed885 100644 --- a/apparmor.d/groups/ubuntu/package-system-locked +++ b/apparmor.d/groups/ubuntu/package-system-locked @@ -17,7 +17,7 @@ profile package-system-locked @{exec_path} flags=(attach_disconnected) { network inet dgram, network inet6 dgram, - mqueue r type=posix /, + mqueue (read,getattr) type=posix /, ptrace (read), diff --git a/apparmor.d/groups/utils/who b/apparmor.d/groups/utils/who index 3da07f89d..fd49b2bec 100644 --- a/apparmor.d/groups/utils/who +++ b/apparmor.d/groups/utils/who @@ -18,6 +18,8 @@ profile who @{exec_path} { @{exec_path} mr, + @{run}/systemd/sessions/* r, + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/zed/**/data.mdb rw, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index a0d636883..c90e80af9 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -86,6 +86,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { unix (send, receive) type=stream addr=none peer=(label=libvirtd//qemu_bridge_helper), unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none), unix (send, receive) type=stream addr=none peer=(label=unconfined), + unix (send, receive) type=stream addr=none peer=(label=virt-manager), # Allow changing to our UUID-based named profiles change_profile -> libvirt-@{uuid}, From f364ab5e48296838ce76e2d6368435caf5a6ea5e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:13:40 +0200 Subject: [PATCH 1099/1455] feat(profile): firefox: improve crashreporter. --- apparmor.d/groups/browsers/firefox-crashhelper | 2 +- apparmor.d/groups/browsers/firefox-crashreporter | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox-crashhelper b/apparmor.d/groups/browsers/firefox-crashhelper index 55443a330..55af7c2e2 100644 --- a/apparmor.d/groups/browsers/firefox-crashhelper +++ b/apparmor.d/groups/browsers/firefox-crashhelper @@ -12,7 +12,7 @@ include @{cache_dirs} = @{user_cache_dirs}/mozilla/ @{exec_path} = @{lib_dirs}/crashhelper -profile firefox-crashhelper @{exec_path} { +profile firefox-crashhelper @{exec_path} flags=(attach_disconnected) { include @{exec_path} mr, diff --git a/apparmor.d/groups/browsers/firefox-crashreporter b/apparmor.d/groups/browsers/firefox-crashreporter index 1c418eef4..8feccaa93 100644 --- a/apparmor.d/groups/browsers/firefox-crashreporter +++ b/apparmor.d/groups/browsers/firefox-crashreporter @@ -28,22 +28,23 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, - @{exec_path} mr, + @{exec_path} mrix, @{bin}/curl rix, @{bin}/mv rix, @{lib_dirs}/minidump-analyzer rPx, - @{bin}/mv rix, - owner "@{config_dirs}/firefox/Crash Reports/{,**}" rw, owner @{config_dirs}/firefox/*.*/crashes/{,**} rw, owner @{config_dirs}/firefox/*.*/crashes/events/@{uuid} rw, owner @{config_dirs}/firefox/*.*/extensions/*.xpi r, owner @{config_dirs}/firefox/*.*/minidumps/{,**} rw, owner @{config_dirs}/firefox/*.*/minidumps//@{uuid}.{dmp,extra} r, + owner @{config_dirs}/firefox/*.*/prefs.js r, + owner @{config_dirs}/firefox/*.*/storage-sync-v2.sqlite-shm r, owner @{config_dirs}/firefox/*.*/storage/default/* r, + owner @{config_dirs}/firefox/Profile*/*.sqlite-shm r, owner @{cache_dirs}/firefox/*.*/** r, @@ -54,10 +55,14 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) { owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/mountinfo r, /dev/dri/card@{int} rw, /dev/dri/renderD128 rw, + /dev/nvidia@{int} r, + /dev/nvidiactl r, # Silencer deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, From cba7355142b9bc0a20adae21f129a47e100baa92 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:14:30 +0200 Subject: [PATCH 1100/1455] feat(abs): update nvidia GLCache. --- apparmor.d/abstractions/nvidia-strict | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/abstractions/nvidia-strict b/apparmor.d/abstractions/nvidia-strict index 6fe815773..c3aa8e805 100644 --- a/apparmor.d/abstractions/nvidia-strict +++ b/apparmor.d/abstractions/nvidia-strict @@ -18,6 +18,8 @@ owner @{HOME}/.nv/ComputeCache/** rw, owner @{HOME}/.nv/ComputeCache/index rwk, owner @{HOME}/.nv/nvidia-application-profiles-* r, + + @{user_cache_dirs}/nvidia/GLCache/@{hex32}/ rw, owner @{user_cache_dirs}/nvidia/ w, owner @{user_cache_dirs}/nvidia/GLCache/ rw, owner @{user_cache_dirs}/nvidia/GLCache/** rwk, From e490a11c1a2ecfadd2cbc0759d77f4706bc2ee61 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:25:41 +0200 Subject: [PATCH 1101/1455] feat(profile): add hwclock. --- apparmor.d/groups/utils/hwclock | 30 ++++++++++++++++++++++++++++ tests/integration/utils/hwclock.bats | 6 +++--- tests/requirements.sh | 3 ++- 3 files changed, 35 insertions(+), 4 deletions(-) create mode 100644 apparmor.d/groups/utils/hwclock diff --git a/apparmor.d/groups/utils/hwclock b/apparmor.d/groups/utils/hwclock new file mode 100644 index 000000000..d1433a605 --- /dev/null +++ b/apparmor.d/groups/utils/hwclock @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/hwclock +profile hwclock @{exec_path} { + include + include + + capability audit_write, + capability sys_time, + + network netlink raw, + + @{exec_path} mr, + + /etc/adjtime rw, + + @{sys}/devices/pnp@{int}/*/rtc/rtc@{int}/{,*} r, + + /dev/rtc@{int} r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/utils/hwclock.bats b/tests/integration/utils/hwclock.bats index 88c981c31..4a1bc0f83 100644 --- a/tests/integration/utils/hwclock.bats +++ b/tests/integration/utils/hwclock.bats @@ -6,14 +6,14 @@ load ../common @test "hwclock: Display the current time as reported by the hardware clock" { - hwclock + sudo hwclock } @test "hwclock: Write the current software clock time to the hardware clock (sometimes used during system setup)" { - hwclock --systohc + sudo hwclock --systohc } @test "hwclock: Write the current hardware clock time to the software clock" { - hwclock --hctosys + sudo hwclock --hctosys } diff --git a/tests/requirements.sh b/tests/requirements.sh index 52d7cb36b..085ad8c7c 100644 --- a/tests/requirements.sh +++ b/tests/requirements.sh @@ -21,7 +21,8 @@ debian | ubuntu | whonix) sudo apt update -y sudo apt install -y \ bats bats-support \ - cpuid dfc systemd-userdbd systemd-homed tlp network-manager flatpak + cpuid dfc systemd-userdbd systemd-homed tlp network-manager flatpak \ + util-linux-extra ;; opensuse*) ;; From d4d4f3ae4b4ad994ea633dbebd4b879f8a69621a Mon Sep 17 00:00:00 2001 From: valoq Date: Sun, 27 Jul 2025 17:13:11 +0200 Subject: [PATCH 1102/1455] add xournalpp --- apparmor.d/profiles-s-z/xournalpp | 44 +++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 apparmor.d/profiles-s-z/xournalpp diff --git a/apparmor.d/profiles-s-z/xournalpp b/apparmor.d/profiles-s-z/xournalpp new file mode 100644 index 000000000..7d74ce7da --- /dev/null +++ b/apparmor.d/profiles-s-z/xournalpp @@ -0,0 +1,44 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/xournalpp +profile xournalpp @{exec_path} { + include + include + include + include + include + include + include + include + include + + @{exec_path} mr, + + /usr/share/xournalpp/** r, + + /etc/machine-id r, + /etc/pipewire/jack.conf.d/ r, + + owner @{user_config_dirs}/xournalpp/** rw, + owner @{user_cache_dirs}/xournalpp/** rw, + + /dev/snd/controlC@{int} w, + /dev/snd/pcmC@{rand4} rw, + + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + include if exists +} + +# vim:syntax=apparmor From fc421183a024cb3abb4c3343ed7a1954f53e4511 Mon Sep 17 00:00:00 2001 From: valoq Date: Tue, 29 Jul 2025 14:19:17 +0200 Subject: [PATCH 1103/1455] xournalpp improvements --- apparmor.d/profiles-s-z/xournalpp | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/apparmor.d/profiles-s-z/xournalpp b/apparmor.d/profiles-s-z/xournalpp index 7d74ce7da..6442fe8b9 100644 --- a/apparmor.d/profiles-s-z/xournalpp +++ b/apparmor.d/profiles-s-z/xournalpp @@ -8,11 +8,10 @@ include @{exec_path} = @{bin}/xournalpp profile xournalpp @{exec_path} { - include include + include include include - include include include include @@ -20,16 +19,15 @@ profile xournalpp @{exec_path} { @{exec_path} mr, + @{open_path} rPx -> child-open-browsers, + /usr/share/xournalpp/** r, /etc/machine-id r, /etc/pipewire/jack.conf.d/ r, - owner @{user_config_dirs}/xournalpp/** rw, - owner @{user_cache_dirs}/xournalpp/** rw, - - /dev/snd/controlC@{int} w, - /dev/snd/pcmC@{rand4} rw, + owner @{user_config_dirs}/xournalpp/{,**} rw, + owner @{user_cache_dirs}/xournalpp/{,**} rw, @{sys}/devices/virtual/dmi/id/bios_vendor r, @{sys}/devices/virtual/dmi/id/board_vendor r, @@ -38,6 +36,9 @@ profile xournalpp @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/comm rw, + /dev/snd/controlC@{int} w, + /dev/snd/pcmC@{rand4} rw, + include if exists } From 9e4db4373e89361b65c2009245b3242087eb830d Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 31 Jul 2025 09:22:28 -0600 Subject: [PATCH 1104/1455] Add support for MD RAID devices to the disk-read/write abstractions (#796) --- apparmor.d/abstractions/disks-read | 6 ++++++ apparmor.d/abstractions/disks-write | 3 +++ 2 files changed, 9 insertions(+) diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index e1bf31298..872b0c552 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -81,6 +81,11 @@ # CD-ROM /dev/sr@{int} rk, + # MD RAID devices + /dev/md@{int} rk, + @{sys}/devices/virtual/block/md@{int}/ r, + @{sys}/devices/virtual/block/md@{int}/** r, + # Lookup block device by major:minor numbers # See: https://apparmor.pujol.io/development/internal/#udev-rules @@ -91,6 +96,7 @@ @{run}/udev/data/b2:@{int} r, # for /dev/fd* @{run}/udev/data/b7:@{int} r, # for /dev/loop* @{run}/udev/data/b8:@{int} r, # for /dev/sd* + @{run}/udev/data/b9:@{int} r, # for /dev/md* @{run}/udev/data/b11:@{int} r, # for /dev/sr* @{run}/udev/data/b43:@{int} r, # for /dev/nbd* @{run}/udev/data/b179:@{int} r, # for /dev/mmcblk* diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index ce0a05dd5..a52518042 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -41,6 +41,9 @@ # CD-ROM /dev/sr@{int} w, + # MD RAID devices + /dev/md@{int} w, + include if exists # vim:syntax=apparmor From 8b280b5ef02803eaaf1aeb82173170f0dfe861fd Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 31 Jul 2025 09:00:05 -0600 Subject: [PATCH 1105/1455] Allow sbctl to parse DMI data This path is hard coded in "dmi/dmi.go" --- apparmor.d/profiles-s-z/sbctl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/profiles-s-z/sbctl b/apparmor.d/profiles-s-z/sbctl index 9dbbf0933..ef007a32c 100644 --- a/apparmor.d/profiles-s-z/sbctl +++ b/apparmor.d/profiles-s-z/sbctl @@ -26,6 +26,8 @@ profile sbctl @{exec_path} { @{lib}/fwupd/efi/{,**} rw, @{lib}/systemd/boot/efi/systemd-boot*.efi.signed rw, + @{sys}/devices/virtual/dmi/id/* r, + @{sys}/firmware/efi/efivars/db-@{uuid} rw, @{sys}/firmware/efi/efivars/KEK-@{uuid} rw, @{sys}/firmware/efi/efivars/PK-@{uuid} rw, From ed06dac70239aa8f4eca700ae79c87fe9aa6ef49 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:45:44 +0200 Subject: [PATCH 1106/1455] feat(profile): add lsipc --- apparmor.d/groups/utils/lsipc | 33 ++++++++++++++++++++++++++++++ tests/integration/utils/lsipc.bats | 16 +++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 apparmor.d/groups/utils/lsipc create mode 100644 tests/integration/utils/lsipc.bats diff --git a/apparmor.d/groups/utils/lsipc b/apparmor.d/groups/utils/lsipc new file mode 100644 index 000000000..12c8d333c --- /dev/null +++ b/apparmor.d/groups/utils/lsipc @@ -0,0 +1,33 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lsipc +profile lsipc @{exec_path} { + include + include + + @{exec_path} mr, + + @{PROC}/sys/fs/mqueue/msg_max r, + @{PROC}/sys/fs/mqueue/msgsize_max r, + @{PROC}/sys/fs/mqueue/queues_max r, + @{PROC}/sys/kernel/msgmax r, + @{PROC}/sys/kernel/msgmnb r, + @{PROC}/sys/kernel/msgmni r, + @{PROC}/sys/kernel/sem r, + @{PROC}/sys/kernel/shmall r, + @{PROC}/sys/kernel/shmmax r, + @{PROC}/sys/kernel/shmmni r, + @{PROC}/sysvipc/msg r, + @{PROC}/sysvipc/sem r, + @{PROC}/sysvipc/shm r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/utils/lsipc.bats b/tests/integration/utils/lsipc.bats new file mode 100644 index 000000000..a18126982 --- /dev/null +++ b/tests/integration/utils/lsipc.bats @@ -0,0 +1,16 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "lsipc: Show information about all active IPC facilities" { + lsipc +} + +@test "lsipc: Show information about active shared memory segments, message queues or sempahore sets" { + lsipc --shmems + lsipc --queues + lsipc --semaphores +} From f516e1140a200f13506be2f8720640ef45f1f9cc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:46:22 +0200 Subject: [PATCH 1107/1455] feat(profile): add lsfd --- apparmor.d/groups/utils/lsfd | 59 +++++++++++++++++++++++++++++++ tests/integration/utils/lsfd.bats | 19 ++++++++++ 2 files changed, 78 insertions(+) create mode 100644 apparmor.d/groups/utils/lsfd create mode 100644 tests/integration/utils/lsfd.bats diff --git a/apparmor.d/groups/utils/lsfd b/apparmor.d/groups/utils/lsfd new file mode 100644 index 000000000..6b30f63a9 --- /dev/null +++ b/apparmor.d/groups/utils/lsfd @@ -0,0 +1,59 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lsfd +profile lsfd @{exec_path} flags=(attach_disconnected) { + include + include + + capability checkpoint_restore, + capability dac_read_search, + capability sys_admin, + capability sys_ptrace, + capability sys_resource, + capability syslog, + + network netlink dgram, + network netlink raw, + + ptrace read, + ptrace trace, + + mqueue (read create delete getattr) type=posix /.lsfd-mqueue-nodev-test:@{int}, + + @{exec_path} mr, + + / r, + @{att}/ r, + + owner @{att}/.lsfd-mqueue-nodev-test:@{int} rw, + + @{run}/ r, + @{run}/netns/ r, + + @{sys}/kernel/cpu_byteorder r, + + @{PROC}/ r, + @{PROC}/@{pid}/ r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/mountinfo r, + @{PROC}/@{pid}/net/* r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/task/ r, + @{PROC}/devices r, + @{PROC}/misc r, + @{PROC}/partitions r, + @{PROC}/tty/drivers r, + owner @{PROC}/@{pid}/syscall r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/utils/lsfd.bats b/tests/integration/utils/lsfd.bats new file mode 100644 index 000000000..bf0c4de0c --- /dev/null +++ b/tests/integration/utils/lsfd.bats @@ -0,0 +1,19 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "lsfd: List all open file descriptors" { + lsfd +} + +@test "lsfd: List all files kept open by a specific program" { + sudo lsfd --filter 'PID == 1' +} + +@test "lsfd: List open IPv4 or IPv6 sockets" { + sudo lsfd -i4 + sudo lsfd -i6 +} From 926a6fdcb9047ff8e8c1d9e7b1b309ee09fee1a8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:55:36 +0200 Subject: [PATCH 1108/1455] feat(profile): add lslocks --- apparmor.d/groups/utils/lslocks | 33 ++++++++++++++++++++++++++++ tests/integration/utils/lslocks.bats | 22 +++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 apparmor.d/groups/utils/lslocks create mode 100644 tests/integration/utils/lslocks.bats diff --git a/apparmor.d/groups/utils/lslocks b/apparmor.d/groups/utils/lslocks new file mode 100644 index 000000000..5fbcdbc8f --- /dev/null +++ b/apparmor.d/groups/utils/lslocks @@ -0,0 +1,33 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lslocks +profile lslocks @{exec_path} flags=(attach_disconnected) { + include + + capability dac_read_search, + capability sys_ptrace, + + ptrace read, + + @{exec_path} mr, + + @{PROC}/ r, + @{PROC}/@{pid}/ r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/fdinfo/ r, + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/locks r, + owner @{PROC}/@{pid}/ r, + owner @{PROC}/@{pid}/mountinfo r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/utils/lslocks.bats b/tests/integration/utils/lslocks.bats new file mode 100644 index 000000000..042834cae --- /dev/null +++ b/tests/integration/utils/lslocks.bats @@ -0,0 +1,22 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "lslocks: List all local system locks" { + sudo lslocks +} + +@test "lslocks: List locks producing a raw output (no columns), and without column headers" { + sudo lslocks --raw --noheadings +} + +@test "lslocks: List locks by PID input" { + sudo lslocks --pid "$(sudo lslocks --raw --noheadings --output PID | head -1)" +} + +@test "lslocks: List locks with JSON output to stdout" { + lslocks --json +} From 8b03cff0cfc824a0c1ecd0f8df1b8c715bb2f969 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 14:58:57 +0200 Subject: [PATCH 1109/1455] feat(profile): add lslogins. --- apparmor.d/groups/utils/lslogins | 33 +++++++++++++++++++++++++++ tests/integration/utils/lslogins.bats | 27 ++++++++++++++++++++++ 2 files changed, 60 insertions(+) create mode 100644 apparmor.d/groups/utils/lslogins create mode 100644 tests/integration/utils/lslogins.bats diff --git a/apparmor.d/groups/utils/lslogins b/apparmor.d/groups/utils/lslogins new file mode 100644 index 000000000..7393b47c0 --- /dev/null +++ b/apparmor.d/groups/utils/lslogins @@ -0,0 +1,33 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lslogins +profile lslogins @{exec_path} { + include + include + include + + @{exec_path} mr, + + /etc/.pwd.lock w, + /etc/.pwd.lock wk, + /etc/login.defs r, + /etc/shadow r, + + /var/log/lastlog r, + /var/log/wtmp rk, + + @{run}/systemd/userdb/ r, + + @{PROC}/ r, + @{PROC}/sys/kernel/random/boot_id r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/utils/lslogins.bats b/tests/integration/utils/lslogins.bats new file mode 100644 index 000000000..aa2df69b4 --- /dev/null +++ b/tests/integration/utils/lslogins.bats @@ -0,0 +1,27 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "lslogins: Display users in the system" { + lslogins + sudo lslogins +} + +@test "lslogins: Display user accounts" { + lslogins --user-accs +} + +@test "lslogins: Display last logins" { + lslogins --last +} + +@test "lslogins: Display system accounts" { + lslogins --system-accs +} + +@test "lslogins: Display supplementary groups" { + lslogins --supp-groups +} From 4f265c6d58a21c8dc98f2f65403d189cc24dddbe Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 15:04:37 +0200 Subject: [PATCH 1110/1455] feat(profile): add lsns. --- apparmor.d/groups/utils/lsns | 42 +++++++++++++++++++++++++++++++ tests/integration/utils/lsns.bats | 31 +++++++++++++++++++++++ 2 files changed, 73 insertions(+) create mode 100644 apparmor.d/groups/utils/lsns create mode 100644 tests/integration/utils/lsns.bats diff --git a/apparmor.d/groups/utils/lsns b/apparmor.d/groups/utils/lsns new file mode 100644 index 000000000..3d4d42efc --- /dev/null +++ b/apparmor.d/groups/utils/lsns @@ -0,0 +1,42 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/lsns +profile lsns @{exec_path} flags=(attach_disconnected) { + include + include + include + + capability net_admin, + capability sys_ptrace, + capability dac_read_search, + + network, + + ptrace read, + ptrace trace, + + @{exec_path} mr, + + @{att}/ r, + + @{run}/*/netns/** r, + @{run}/*/ns/** r, + + @{PROC}/ r, + @{PROC}/@{pid}/ r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/tests/integration/utils/lsns.bats b/tests/integration/utils/lsns.bats new file mode 100644 index 000000000..c7e6563e2 --- /dev/null +++ b/tests/integration/utils/lsns.bats @@ -0,0 +1,31 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "lsns: List all namespaces" { + lsns + sudo lsns +} + +@test "lsns: List namespaces in JSON format" { + sudo lsns --json +} + +@test "lsns: List namespaces associated with the specified process" { + sudo lsns --task 1 +} + +@test "lsns: List the specified type of namespaces only" { + sudo lsns --type mnt + sudo lsns --type net + sudo lsns --type ipc + sudo lsns --type user + sudo lsns --type pid + sudo lsns --type uts + sudo lsns --type cgroup + sudo lsns --type time +} + From fd0092d431103e5be29ac9060e1400204d57ece3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 20 Jul 2025 16:34:49 +0200 Subject: [PATCH 1111/1455] fix(profile): fix issues raised in tests. --- apparmor.d/groups/utils/lslocks | 2 ++ apparmor.d/groups/utils/lsns | 2 ++ apparmor.d/profiles-m-r/initramfs-hooks | 2 ++ apparmor.d/profiles-m-r/initramfs-scripts | 1 + apparmor.d/profiles-m-r/mdadm-mkconf | 1 + apparmor.d/profiles-m-r/mkinitramfs | 2 ++ 6 files changed, 10 insertions(+) diff --git a/apparmor.d/groups/utils/lslocks b/apparmor.d/groups/utils/lslocks index 5fbcdbc8f..44d2e1d01 100644 --- a/apparmor.d/groups/utils/lslocks +++ b/apparmor.d/groups/utils/lslocks @@ -17,6 +17,8 @@ profile lslocks @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{sys}/devices/**/block/** r, + @{PROC}/ r, @{PROC}/@{pid}/ r, @{PROC}/@{pid}/comm r, diff --git a/apparmor.d/groups/utils/lsns b/apparmor.d/groups/utils/lsns index 3d4d42efc..7fbf56896 100644 --- a/apparmor.d/groups/utils/lsns +++ b/apparmor.d/groups/utils/lsns @@ -28,6 +28,8 @@ profile lsns @{exec_path} flags=(attach_disconnected) { @{run}/*/netns/** r, @{run}/*/ns/** r, + @{sys}/devices/**/block/** r, + @{PROC}/ r, @{PROC}/@{pid}/ r, @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index 5896df049..15f8f66d6 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -9,6 +9,7 @@ include @{exec_path} = /usr/share/initramfs-tools/hooks/** /etc/initramfs-tools/hooks/** profile initramfs-hooks @{exec_path} { include + include include @{exec_path} mr, @@ -70,6 +71,7 @@ profile initramfs-hooks @{exec_path} { profile ldd { include + include include @{bin}/ldd mr, diff --git a/apparmor.d/profiles-m-r/initramfs-scripts b/apparmor.d/profiles-m-r/initramfs-scripts index 485520ca0..4d38ab9c1 100644 --- a/apparmor.d/profiles-m-r/initramfs-scripts +++ b/apparmor.d/profiles-m-r/initramfs-scripts @@ -9,6 +9,7 @@ include @{exec_path} = /usr/share/initramfs-tools/scripts/** /etc/initramfs-tools/scripts/** profile initramfs-scripts @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/mdadm-mkconf b/apparmor.d/profiles-m-r/mdadm-mkconf index c922942ec..489068ec8 100644 --- a/apparmor.d/profiles-m-r/mdadm-mkconf +++ b/apparmor.d/profiles-m-r/mdadm-mkconf @@ -9,6 +9,7 @@ include @{exec_path} = /usr/share/mdadm/mkconf profile mdadm-mkconf @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index f37029627..e67bb55fe 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -88,6 +88,7 @@ profile mkinitramfs @{exec_path} { owner /boot/initrd.img-*.new rw, /var/tmp/ r, + /var/tmp/mkinitramfs_@{rand6}/** w, /var/tmp/modules_@{rand6} rw, owner /var/tmp/mkinitramfs_@{rand6} rw, owner /var/tmp/mkinitramfs_@{rand6}/ rw, @@ -98,6 +99,7 @@ profile mkinitramfs @{exec_path} { owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** w, owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, From c09b5d85a46b391ad8ee9768f43839cb9a1c584a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 00:21:49 +0200 Subject: [PATCH 1112/1455] feat(profile): update systemd profiles. --- Justfile | 71 +++++++++++++------ apparmor.d/groups/systemd/bootctl | 7 +- apparmor.d/groups/systemd/busctl | 7 ++ apparmor.d/groups/systemd/journalctl | 3 + apparmor.d/groups/systemd/networkctl | 3 + apparmor.d/groups/systemd/systemd-localed | 4 +- apparmor.d/groups/systemd/systemd-machined | 3 + apparmor.d/groups/systemd/systemd-networkd | 4 ++ .../groups/systemd/systemd-nsresourcework | 2 + apparmor.d/groups/systemd/systemd-userwork | 1 + apparmor.d/groups/systemd/userdbctl | 3 +- 11 files changed, 80 insertions(+), 28 deletions(-) diff --git a/Justfile b/Justfile index 7753ad2d1..f9ce13c36 100644 --- a/Justfile +++ b/Justfile @@ -2,18 +2,8 @@ # Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Usage: -# just -# just img ubuntu24 server -# just vm ubuntu24 server -# just up ubuntu24 server -# just ssh ubuntu24 server -# just halt ubuntu24 server -# just destroy ubuntu24 server -# just list -# just images -# just available -# just clean +# Usage: `just` +# See https://apparmor.pujol.io/development/ for more information. # Build setings destdir := "/" @@ -125,7 +115,7 @@ install: [group('install')] [doc('Locally install prebuild profiles')] -local +args: +local +names: #!/usr/bin/env bash set -eu -o pipefail install -Dm0755 {{build}}/aa-log {{destdir}}/usr/bin/aa-log @@ -138,7 +128,7 @@ local +args: install -Dm0644 "{{build}}/apparmor.d/tunables/$file" "{{destdir}}/etc/apparmor.d/tunables/$file" done; echo "Warning: profile dependencies fallback to unconfined." - for file in {{args}}; do + for file in {{names}}; do grep -Ei 'rPx|rpx' "{{build}}/apparmor.d/$file" || true sed -i -e "s/rPx/rPUx/g" "{{build}}/apparmor.d/$file" install -Dvm0644 "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file" @@ -336,15 +326,52 @@ available: [group('tests')] -[doc('Run the integration tests on the machine')] -integration dist flavor: - @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` \ - cp -rf /home/user/Projects/apparmor.d/tests/integration/ /home/user/Projects - @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` \ - sudo umount /home/user/Projects/apparmor.d - @ssh {{sshopt}} user@`just get_ip {{dist}} {{flavor}}` \ - @bats --recursive --timing --print-output-on-failure Projects/integration/ +[doc('Install dependencies for the integration tests')] +init: + @bash tests/requirements.sh +[group('tests')] +[doc('Run the integration tests')] +integration: + bats --recursive --pretty --timing --print-output-on-failure tests/integration + +[group('tests')] +[doc('Install dependencies for the integration tests (machine)')] +tests-init dist flavor: + @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + just --justfile /home/{{username}}/Projects/apparmor.d/Justfile init + +[group('tests')] +[doc('Synchronize the integration tests (machine)')] +tests-sync dist flavor: + @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + rsync -a --delete /home/{{username}}/Projects/apparmor.d/tests/ /home/{{username}}/Projects/tests/ + +[group('tests')] +[doc('Re-synchronize the integration tests (machine)')] +tests-resync dist flavor: (tests-mount dist flavor) \ + (tests-sync dist flavor) \ + (tests-umount dist flavor) + +[group('tests')] +[doc('Unmout the integration tests (machine)')] +tests-umount dist flavor: + @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + sudo umount /home/{{username}}/Projects/apparmor.d + +[group('tests')] +[doc('Run the integration tests (machine)')] +tests-run dist flavor name="": + ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + TERM=xterm \ + bats --recursive --pretty --timing --print-output-on-failure \ + /home/{{username}}/Projects/tests/integration/{{name}} + +[group('tests')] +[doc('Mount integration tests (machine)')] +tests-mount dist flavor: + @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + sudo mount 0a31bc478ef8e2461a4b1cc10a24cc4 [private] get_ip dist flavor: diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index f7d001c70..47e8737fe 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -13,6 +13,7 @@ profile bootctl @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include + capability linux_immutable, capability mknod, capability net_admin, capability sys_resource, @@ -47,8 +48,8 @@ profile bootctl @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/firmware/dmi/entries/*/raw r, @{sys}/firmware/efi/efivars/ r, @{sys}/firmware/efi/efivars/AuditMode-@{uuid} r, - @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} r, - @{sys}/firmware/efi/efivars/BootOrder-@{uuid} r, + @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} rw, + @{sys}/firmware/efi/efivars/BootOrder-@{uuid} rw, @{sys}/firmware/efi/efivars/DeployedMode-@{uuid} r, @{sys}/firmware/efi/efivars/LoaderDevicePartUUID-@{uuid} r, @{sys}/firmware/efi/efivars/LoaderEntries-@{uuid} r, @@ -59,7 +60,7 @@ profile bootctl @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/firmware/efi/efivars/LoaderImageIdentifier-@{uuid} r, @{sys}/firmware/efi/efivars/LoaderInfo-@{uuid} r, @{sys}/firmware/efi/efivars/LoaderSystemToken-@{uuid} rw, - @{sys}/firmware/efi/efivars/OsIndications-@{uuid} r, + @{sys}/firmware/efi/efivars/OsIndications-@{uuid} rw, @{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, @{sys}/firmware/efi/efivars/SetupMode-@{uuid} r, diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index c31b28836..04ed76e72 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -48,6 +48,13 @@ profile busctl @{exec_path} flags=(attach_disconnected) { member={GetConnectionCredentials,ListNames,ListActivatableNames} peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + dbus send bus=system + interface=org.freedesktop.DBus.Introspectable + member=Introspect, + dbus send bus=system + interface=org.freedesktop.DBus.Properties + member={GetAll,Get}, + @{exec_path} mr, @{pager_path} rPx -> child-pager, diff --git a/apparmor.d/groups/systemd/journalctl b/apparmor.d/groups/systemd/journalctl index ef62e37cd..c852b3756 100644 --- a/apparmor.d/groups/systemd/journalctl +++ b/apparmor.d/groups/systemd/journalctl @@ -30,6 +30,9 @@ profile journalctl @{exec_path} flags=(attach_disconnected) { @{pager_path} rPx -> child-pager, + @{bin}/* r, + @{sbin}/* r, + /var/lib/dbus/machine-id r, /etc/machine-id r, diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index 5b4b3e6b5..0fd89c199 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -11,6 +11,7 @@ include profile networkctl @{exec_path} flags=(attach_disconnected) { include include + include capability net_admin, capability sys_module, @@ -52,6 +53,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/netif/io.systemd.Network rw, + @{run}/systemd/netif/links/ r, @{run}/systemd/netif/leases/@{int} r, @{run}/systemd/netif/links/@{int} r, @{run}/systemd/netif/state r, @@ -63,6 +65,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { @{PROC}/1/cgroup r, @{PROC}/cmdline r, + @{PROC}/sys/fs/nr_open r, @{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/random/boot_id r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index 104a141ce..c15eaf5b2 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -33,8 +33,8 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { /etc/default/locale rw, /etc/locale.conf rw, /etc/vconsole.conf rw, - /etc/X11/xorg.conf.d/ r, - /etc/X11/xorg.conf.d/.#*.confd* rw, + /etc/X11/xorg.conf.d/ rw, + /etc/X11/xorg.conf.d/.#*.conf@{hex} rw, /etc/X11/xorg.conf.d/*.conf rw, @{att}/@{run}/systemd/notify rw, diff --git a/apparmor.d/groups/systemd/systemd-machined b/apparmor.d/groups/systemd/systemd-machined index b9244ece6..520080082 100644 --- a/apparmor.d/groups/systemd/systemd-machined +++ b/apparmor.d/groups/systemd/systemd-machined @@ -37,6 +37,8 @@ profile systemd-machined @{exec_path} flags=(attach_disconnected) { ptrace read peer=systemd-nspawn, + unix type=stream addr=@@{udbus}/bus/systemd-machine/system, + #aa:dbus own bus=system name=org.freedesktop.machine1 #aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" @@ -71,6 +73,7 @@ profile systemd-machined @{exec_path} flags=(attach_disconnected) { /dev/ptmx rw, /dev/pts/@{int} rw, /dev/pts/ptmx rw, + /dev/vsock r, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index df1e74048..5105c69b8 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -60,9 +60,13 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/notify rw, @{run}/mount/utab r, + @{run}/systemd/resolve/resolv.conf r, owner @{att}/var/lib/systemd/network/ r, + owner /var/lib/systemd/network/ rw, + owner /var/lib/systemd/network/** rwk, + @{run}/systemd/network/ r, @{run}/systemd/network/*.network r, owner @{run}/systemd/netif/** rw, diff --git a/apparmor.d/groups/systemd/systemd-nsresourcework b/apparmor.d/groups/systemd/systemd-nsresourcework index 734717c44..5b8d53398 100644 --- a/apparmor.d/groups/systemd/systemd-nsresourcework +++ b/apparmor.d/groups/systemd/systemd-nsresourcework @@ -16,6 +16,8 @@ profile systemd-nsresourcework @{exec_path} { @{exec_path} mr, + @{run}/systemd/nsresource/registry/ r, + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-userwork b/apparmor.d/groups/systemd/systemd-userwork index 29641fd74..2521c655e 100644 --- a/apparmor.d/groups/systemd/systemd-userwork +++ b/apparmor.d/groups/systemd/systemd-userwork @@ -18,6 +18,7 @@ profile systemd-userwork @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + /etc/gshadow r, /etc/machine-id r, /etc/shadow r, diff --git a/apparmor.d/groups/systemd/userdbctl b/apparmor.d/groups/systemd/userdbctl index 97625db38..fa7c13297 100644 --- a/apparmor.d/groups/systemd/userdbctl +++ b/apparmor.d/groups/systemd/userdbctl @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/userdbctl -profile userdbctl @{exec_path} { +profile userdbctl @{exec_path} flags=(attach_disconnected) { include include include @@ -29,6 +29,7 @@ profile userdbctl @{exec_path} { @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/gid_map r, + owner @{PROC}/@{pid}/setgroups r, owner @{PROC}/@{pid}/uid_map r, include if exists From a731badeff2b0723aad5b5dba309a2cc2018ca35 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 00:24:15 +0200 Subject: [PATCH 1113/1455] feat(profile): improvement raised by unit tests. --- apparmor.d/groups/ubuntu/apport | 10 +++++++ apparmor.d/groups/utils/fstrim | 2 ++ apparmor.d/groups/utils/uuidd | 6 +++- apparmor.d/groups/utils/zramctl | 4 ++- apparmor.d/profiles-g-l/kdump-config | 15 +++++++--- apparmor.d/profiles-g-l/kernel-postinst-kdump | 28 +++++++++++++++++-- apparmor.d/profiles-m-r/initramfs-hooks | 5 ++-- apparmor.d/profiles-m-r/mdadm-mkconf | 1 + apparmor.d/profiles-m-r/mkinitramfs | 24 ++++++++-------- apparmor.d/profiles-m-r/needrestart | 1 + apparmor.d/profiles-s-z/tlp | 3 ++ 11 files changed, 77 insertions(+), 22 deletions(-) diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index 9f3fd2999..fbc433c05 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -49,7 +49,17 @@ profile apport @{exec_path} flags=(attach_disconnected) { owner /var/cache/apt/pkgcache.bin.@{rand6} rw, owner /var/log/apport.log rw, + /{run,var}/log/journal/ r, + /{run,var}/log/journal/@{hex32}/ r, + /{run,var}/log/journal/@{hex32}/system.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* r, + @{run}/apport.lock rwk, + @{run}/log/journal/ r, @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/environ r, diff --git a/apparmor.d/groups/utils/fstrim b/apparmor.d/groups/utils/fstrim index a6ada04d5..250794671 100644 --- a/apparmor.d/groups/utils/fstrim +++ b/apparmor.d/groups/utils/fstrim @@ -26,6 +26,8 @@ profile fstrim @{exec_path} flags=(attach_disconnected) { /boot/efi/ r, /var/ r, + @{PROC}/@{pid}/mountinfo r, + include if exists } diff --git a/apparmor.d/groups/utils/uuidd b/apparmor.d/groups/utils/uuidd index 787914537..52f52b4a2 100644 --- a/apparmor.d/groups/utils/uuidd +++ b/apparmor.d/groups/utils/uuidd @@ -11,6 +11,8 @@ profile uuidd @{exec_path} flags=(attach_disconnected) { include include + capability dac_override, + network inet dgram, @{exec_path} mr, @@ -18,9 +20,11 @@ profile uuidd @{exec_path} flags=(attach_disconnected) { owner /var/lib/libuuid/clock.txt rwk, owner /var/lib/libuuid/clock-cont.txt rwk, - @{run}/uuidd/request rw, @{att}/@{run}/uuidd/request rw, + @{run}/uuidd/request rw, + @{run}/uuidd/uuidd.pid rwk, + include if exists } diff --git a/apparmor.d/groups/utils/zramctl b/apparmor.d/groups/utils/zramctl index 91697be73..a5fa2eb75 100644 --- a/apparmor.d/groups/utils/zramctl +++ b/apparmor.d/groups/utils/zramctl @@ -13,8 +13,10 @@ profile zramctl @{exec_path} { @{exec_path} mr, + @{sys}/devices/virtual/block/zram{int}/disksize w, + @{sys}/devices/virtual/block/zram{int}/reset w, @{sys}/devices/virtual/block/zram@{int}/ r, - @{sys}/devices/virtual/block/zram@{int}/comp_algorithm r, + @{sys}/devices/virtual/block/zram@{int}/comp_algorithm rw, @{sys}/devices/virtual/block/zram@{int}/disksize r, @{sys}/devices/virtual/block/zram@{int}/max_comp_streams r, @{sys}/devices/virtual/block/zram@{int}/mm_stat r, diff --git a/apparmor.d/profiles-g-l/kdump-config b/apparmor.d/profiles-g-l/kdump-config index f8b75f742..b6f915024 100644 --- a/apparmor.d/profiles-g-l/kdump-config +++ b/apparmor.d/profiles-g-l/kdump-config @@ -17,6 +17,7 @@ profile kdump-config @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, + @{bin}/{,e}grep ix, @{bin}/basename ix, @{bin}/cat ix, @{bin}/cmp ix, @@ -25,13 +26,13 @@ profile kdump-config @{exec_path} flags=(attach_disconnected) { @{bin}/file ix, @{bin}/find ix, @{bin}/flock ix, - @{bin}/{,e}grep ix, @{bin}/hexdump ix, @{bin}/ln ix, @{bin}/logger ix, @{bin}/plymouth Px, @{bin}/readlink ix, @{bin}/rev ix, + @{bin}/rm ix, @{bin}/run-parts ix, @{bin}/sed ix, @{bin}/systemctl Cx -> systemctl, @@ -48,9 +49,15 @@ profile kdump-config @{exec_path} flags=(attach_disconnected) { / r, @{efi}/ r, - /var/crash/kdump_lock wk, - /var/crash/kexec_cmd w, - owner /var/lib/kdump/{,**} rw, + /var/crash/kdump_lock wk, + /var/crash/kexec_cmd w, + /var/lib/kdump/{,**} rw, + + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**, + owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, + owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, @{sys}/firmware/efi/efivars/ r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, diff --git a/apparmor.d/profiles-g-l/kernel-postinst-kdump b/apparmor.d/profiles-g-l/kernel-postinst-kdump index e1358ec29..4790c5cb7 100644 --- a/apparmor.d/profiles-g-l/kernel-postinst-kdump +++ b/apparmor.d/profiles-g-l/kernel-postinst-kdump @@ -12,15 +12,32 @@ profile kernel-postinst-kdump @{exec_path} { @{exec_path} mr, + @{sh_path} r, + @{bin}/{,e}grep rix, + @{bin}/{m,g,}awk rix, + @{bin}/cp rix, @{bin}/du rix, @{bin}/find rix, - @{bin}/{m,g,}awk rix, + @{bin}/kmod rCx -> kmod, + @{bin}/ischroot rPx, + @{bin}/linux-version rPx, + @{bin}/mkdir rix, + @{bin}/mktemp rix, @{bin}/mv rix, @{bin}/rm rix, @{bin}/sync rix, + @{bin}/cut rix, @{sbin}/mkinitramfs rPx, - owner /var/lib/kdump/* w, + / r, + + /etc/initramfs-tools/conf.d/{,**} r, + /etc/initramfs-tools/initramfs.conf r, + + owner /var/lib/kdump/** rw, + + owner /tmp/tmp.@{rand10}/ rw, + owner /tmp/tmp.@{rand10}/modules_@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, @@ -28,6 +45,13 @@ profile kernel-postinst-kdump @{exec_path} { owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, + profile kmod { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index 15f8f66d6..14a83ffbb 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -16,14 +16,15 @@ profile initramfs-hooks @{exec_path} { @{sh_path} rix, @{coreutils_path} rix, + @{bin}/fc-cache ix, @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, @{bin}/plymouth Px, - @{sbin}/update-alternatives Px, - @{sbin}/blkid Px, + @{bin}/update-alternatives Px, @{lib}/dracut/dracut-install Px, @{lib}/initramfs-tools/bin/busybox ix, @{lib}/klibc/bin/fstype ix, + @{sbin}/blkid Px, /usr/share/mdadm/mkconf Px, @{bin}/* mr, diff --git a/apparmor.d/profiles-m-r/mdadm-mkconf b/apparmor.d/profiles-m-r/mdadm-mkconf index 489068ec8..120138905 100644 --- a/apparmor.d/profiles-m-r/mdadm-mkconf +++ b/apparmor.d/profiles-m-r/mdadm-mkconf @@ -25,6 +25,7 @@ profile mdadm-mkconf @{exec_path} { / r, /var/tmp/mkinitramfs_@{rand6}/etc/mdadm/mdadm.conf.tmp rw, + /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/etc/mdadm/mdadm.conf.tmp rw, include if exists } diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index e67bb55fe..df76eb4ad 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -47,13 +47,16 @@ profile mkinitramfs @{exec_path} { @{bin}/rmdir rix, @{bin}/sed rix, @{bin}/sort rix, + @{bin}/stat rix, @{bin}/touch rix, @{bin}/tr rix, @{bin}/tsort rix, + @{bin}/uname rix, @{bin}/uniq rix, @{bin}/xargs rix, @{bin}/xz rix, @{bin}/zstd rix, + @{sbin}/blkid rPx, @{lib}/dracut/dracut-install rix, @{bin}/find rCx -> find, @@ -87,6 +90,9 @@ profile mkinitramfs @{exec_path} { owner /boot/config-* r, owner /boot/initrd.img-*.new rw, + owner /var/lib/kdump/initramfs-tools/** rw, + owner /var/lib/kdump/initrd.* rw, + /var/tmp/ r, /var/tmp/mkinitramfs_@{rand6}/** w, /var/tmp/modules_@{rand6} rw, @@ -102,13 +108,17 @@ profile mkinitramfs @{exec_path} { owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** w, owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, + owner /tmp/tmp.@{rand10}/modules_@{rand6} rw, + @{sys}/bus/ r, + @{sys}/bus/*/drivers/ r, @{sys}/devices/platform/ r, @{sys}/devices/platform/**/ r, @{sys}/devices/platform/**/modalias r, @{sys}/module/compression r, @{sys}/module/firmware_class/parameters/path r, + @{PROC}/@{pid}/mounts r, @{PROC}/cmdline r, @{PROC}/modules r, owner @{PROC}/@{pid}/fd/ r, @@ -143,18 +153,8 @@ profile mkinitramfs @{exec_path} { @{sh_path} rix, @{sbin}/ldconfig.real rix, - owner /var/tmp/mkinitramfs_@{rand6}/etc/ld.so.conf r, - owner /var/tmp/mkinitramfs_@{rand6}/etc/ld.so.conf.d/{,*.conf} r, - - owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/ r, - owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/@{multiarch}/ r, - owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/@{multiarch}/*.so* rw, - owner /var/tmp/mkinitramfs_@{rand6}/@{lib}/*.so* rw, - - owner /var/tmp/mkinitramfs_@{rand6}/etc/ld.so.cache{,~} rw, - - owner /var/tmp/mkinitramfs_@{rand6}/var/cache/ldconfig/ rw, - owner /var/tmp/mkinitramfs_@{rand6}/var/cache/ldconfig/aux-cache{,~} rw, + owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**, include if exists } diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index f9e2c6ebc..ceac5436b 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -23,6 +23,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/dpkg-query rpx, @{bin}/fail2ban-server rPx, + @{bin}/stty rix, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/udevadm rCx -> udevadm, diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index 3eb0800f9..0dccf1a23 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -71,6 +71,8 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+platform:* r, @{sys}/bus/pci/devices/ r, + @{sys}/bus/pci/drivers/*/ r, + @{sys}/bus/platform/devices/ r, @{sys}/class/drm/ r, @{sys}/class/net/ r, @{sys}/class/power_supply/ r, @@ -80,6 +82,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/class r, @{sys}/devices/**/net/**/uevent r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw, + @{sys}/devices/virtual/dmi/id/chassis_type r, @{sys}/devices/virtual/dmi/id/product_version r, @{sys}/devices/virtual/net/**/uevent r, @{sys}/firmware/acpi/platform_profile* rw, From 0c2385fef902c6838a69a83953b70bd5b5beaf64 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 00:25:28 +0200 Subject: [PATCH 1114/1455] tests: update tests dependencies. --- tests/requirements.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/requirements.sh b/tests/requirements.sh index 085ad8c7c..efc357ad4 100644 --- a/tests/requirements.sh +++ b/tests/requirements.sh @@ -16,13 +16,16 @@ DISTRIBUTION="$(_lsb_release)" case "$DISTRIBUTION" in arch) + sudo pacman -Syu --noconfirm \ + bats bats-support \ + pacman-contrib tlp flatpak networkmanager ;; debian | ubuntu | whonix) sudo apt update -y sudo apt install -y \ bats bats-support \ - cpuid dfc systemd-userdbd systemd-homed tlp network-manager flatpak \ - util-linux-extra + cpuid dfc systemd-boot systemd-userdbd systemd-homed systemd-container tlp \ + network-manager systemd-container flatpak util-linux-extra ;; opensuse*) ;; From d579b330117b5e11d42b11a87f9e342e1b0b609a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 00:32:27 +0200 Subject: [PATCH 1115/1455] tests: add a few integration tests. --- tests/integration/apt/apt.bats | 18 +++++++++-- tests/integration/apt/dpkg-query.bats | 27 ++++++++++++++++ tests/integration/apt/dpkg-reconfigure.bats | 12 ++++++++ tests/integration/pacman/paccache.bats | 22 +++++++++++++ tests/integration/pacman/pacman-key.bats | 34 +++++++++++++++++++++ tests/integration/pacman/pacman.bats | 34 +++++++++++++++++++++ tests/integration/procps/sysctl.bats | 4 +-- tests/integration/procps/uptime.bats | 18 +++++++++++ tests/integration/systemd/bootctl.bats | 22 +++++++++++++ tests/integration/systemd/busctl.bats | 27 ++++++++++++++++ tests/integration/systemd/homectl.bats | 2 +- tests/integration/systemd/journalctl.bats | 30 ++++++++++++++++++ tests/integration/systemd/localectl.bats | 23 ++++++++++++++ tests/integration/systemd/machinectl.bats | 26 ++++++++++++++++ tests/integration/systemd/networkctl.bats | 18 +++++++++++ tests/integration/utils/fstrim.bats | 14 +++++++++ 16 files changed, 325 insertions(+), 6 deletions(-) create mode 100644 tests/integration/apt/dpkg-query.bats create mode 100644 tests/integration/apt/dpkg-reconfigure.bats create mode 100644 tests/integration/pacman/paccache.bats create mode 100644 tests/integration/pacman/pacman-key.bats create mode 100644 tests/integration/pacman/pacman.bats create mode 100644 tests/integration/procps/uptime.bats create mode 100644 tests/integration/systemd/bootctl.bats create mode 100644 tests/integration/systemd/busctl.bats create mode 100644 tests/integration/systemd/journalctl.bats create mode 100644 tests/integration/systemd/localectl.bats create mode 100644 tests/integration/systemd/machinectl.bats create mode 100644 tests/integration/systemd/networkctl.bats create mode 100644 tests/integration/utils/fstrim.bats diff --git a/tests/integration/apt/apt.bats b/tests/integration/apt/apt.bats index a436f6e9f..4be0edd8d 100644 --- a/tests/integration/apt/apt.bats +++ b/tests/integration/apt/apt.bats @@ -25,14 +25,26 @@ setup_file() { sudo apt install -y pass } -@test "apt: Remove a package (using 'purge' instead also removes its configuration files)" { - sudo apt remove -y pass +@test "apt: Remove a package and its configuration files" { + sudo apt purge -y pass } @test "apt: Upgrade all installed packages to their newest available versions" { sudo apt upgrade -y } +@test "apt: Upgrade installed packages, but remove obsolete packages and install additional packages to meet new dependencies" { + sudo apt dist-upgrade -y +} + +@test "apt: Clean the local repository - removing package files (.deb) from interrupted downloads that can no longer be downloaded" { + sudo apt autoclean +} + +@test "apt: Remove all packages that are no longer needed" { + sudo apt autoremove +} + @test "apt: List all packages" { apt list } @@ -41,6 +53,6 @@ setup_file() { apt list --installed } -@test "apt-moo: Print a cow easter egg" { +@test "apt: Print a cow easter egg" { apt moo } diff --git a/tests/integration/apt/dpkg-query.bats b/tests/integration/apt/dpkg-query.bats new file mode 100644 index 000000000..39259e0a0 --- /dev/null +++ b/tests/integration/apt/dpkg-query.bats @@ -0,0 +1,27 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "dpkg-query: List all installed packages" { + dpkg-query --list +} + +@test "dpkg-query: List installed packages matching a pattern" { + dpkg-query --list 'libc6*' +} + +@test "dpkg-query: List all files installed by a package" { + dpkg-query --listfiles libc6 +} + +@test "dpkg-query: Show information about a package" { + dpkg-query --status libc6 +} + +@test "dpkg-query: Search for packages that own files matching a pattern" { + dpkg-query --search /etc/ld.so.conf.d +} + diff --git a/tests/integration/apt/dpkg-reconfigure.bats b/tests/integration/apt/dpkg-reconfigure.bats new file mode 100644 index 000000000..f6aec98ea --- /dev/null +++ b/tests/integration/apt/dpkg-reconfigure.bats @@ -0,0 +1,12 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "dpkg-reconfigure: Reconfigure one or more packages" { + sudo apt install -y pass + sudo dpkg-reconfigure pass +} + diff --git a/tests/integration/pacman/paccache.bats b/tests/integration/pacman/paccache.bats new file mode 100644 index 000000000..b2e1369e2 --- /dev/null +++ b/tests/integration/pacman/paccache.bats @@ -0,0 +1,22 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "paccache: Perform a dry-run and show the number of candidate packages for deletion" { + sudo paccache -d +} + +@test "paccache: Move candidate packages to a directory instead of deleting them" { + sudo paccache -m "$USER_BUILD_DIRS" +} + +@test "paccache: Remove all but the 3 most recent package versions from the `pacman` cache" { + sudo paccache -r +} + +@test "paccache: Set the number of package versions to keep" { + sudo paccache -rk 3 +} diff --git a/tests/integration/pacman/pacman-key.bats b/tests/integration/pacman/pacman-key.bats new file mode 100644 index 000000000..82e34a379 --- /dev/null +++ b/tests/integration/pacman/pacman-key.bats @@ -0,0 +1,34 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "pacman-key: Initialize the 'pacman' keyring" { + sudo pacman-key --init +} + +@test "pacman-key: Add the default Arch Linux keys" { + sudo pacman-key --populate +} + +@test "pacman-key: List keys from the public keyring" { + pacman-key --list-keys +} + +@test "pacman-key: Receive a key from a key server" { + sudo pacman-key --recv-keys 06A26D531D56C42D66805049C5469996F0DF68EC +} + +@test "pacman-key: Print the fingerprint of a specific key" { + pacman-key --finger 06A26D531D56C42D66805049C5469996F0DF68EC +} + +@test "pacman-key: Sign an imported key locally" { + sudo pacman-key --lsign-key 06A26D531D56C42D66805049C5469996F0DF68EC +} + +@test "pacman-key: Remove a specific key" { + sudo pacman-key --delete 06A26D531D56C42D66805049C5469996F0DF68EC +} diff --git a/tests/integration/pacman/pacman.bats b/tests/integration/pacman/pacman.bats new file mode 100644 index 000000000..575a65bc1 --- /dev/null +++ b/tests/integration/pacman/pacman.bats @@ -0,0 +1,34 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "pacman: Synchronize and update all packages" { + sudo pacman -Syu --noconfirm +} + +@test "pacman: Install a new package" { + sudo pacman -S --noconfirm pass pass-otp +} + +@test "pacman: Remove a package and its dependencies" { + sudo pacman -Rs --noconfirm pass-otp +} + +@test "pacman: List installed packages and versions" { + pacman -Q +} + +@test "pacman: List only the explicitly installed packages and versions" { + pacman -Qe +} + +@test "pacman: List orphan packages (installed as dependencies but not actually required by any package)" { + pacman -Qtdq +} + +@test "pacman: Empty the entire 'pacman' cache" { + sudo pacman -Scc --noconfirm +} diff --git a/tests/integration/procps/sysctl.bats b/tests/integration/procps/sysctl.bats index 2f284070a..66720c434 100644 --- a/tests/integration/procps/sysctl.bats +++ b/tests/integration/procps/sysctl.bats @@ -21,6 +21,6 @@ load ../common sysctl fs.file-max } -@test "sysctl: Apply changes from `/etc/sysctl.conf`" { - sysctl -p +@test "sysctl: Apply changes from '/etc/sysctl.conf'" { + sudo sysctl -p } diff --git a/tests/integration/procps/uptime.bats b/tests/integration/procps/uptime.bats new file mode 100644 index 000000000..7d9361d5a --- /dev/null +++ b/tests/integration/procps/uptime.bats @@ -0,0 +1,18 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "uptime: Print current time, uptime, number of logged-in users and other information" { + uptime +} + +@test "uptime: Show only the amount of time the system has been booted for" { + uptime --pretty +} + +@test "uptime: Print the date and time the system booted up at" { + uptime --since +} diff --git a/tests/integration/systemd/bootctl.bats b/tests/integration/systemd/bootctl.bats new file mode 100644 index 000000000..2dfb39a7f --- /dev/null +++ b/tests/integration/systemd/bootctl.bats @@ -0,0 +1,22 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "bootctl: Show information about the system firmware and the bootloaders" { + sudo bootctl status +} + +@test "bootctl: Show all available bootloader entries" { + sudo bootctl list +} + +@test "bootctl: Install 'systemd-boot' into the EFI system partition" { + sudo bootctl install +} + +@test "bootctl: Remove all installed versions of 'systemd-boot' from the EFI system partition" { + sudo bootctl remove +} diff --git a/tests/integration/systemd/busctl.bats b/tests/integration/systemd/busctl.bats new file mode 100644 index 000000000..ef3e973e9 --- /dev/null +++ b/tests/integration/systemd/busctl.bats @@ -0,0 +1,27 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "busctl: Show all peers on the bus, by their service names" { + busctl list +} + +@test "busctl: Show process information and credentials of a bus service, a process, or the owner of the bus (if no parameter is specified)" { + busctl status 1 + busctl status org.freedesktop.DBus +} + +@test "busctl: Show an object tree of one or more services (or all services if no service is specified)" { + busctl tree org.freedesktop.DBus +} + +@test "busctl: Show interfaces, methods, properties and signals of the specified object on the specified service" { + busctl introspect org.freedesktop.login1 /org/freedesktop/login1 +} + +@test "busctl: Retrieve the current value of one or more object properties" { + busctl get-property org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager Docked +} diff --git a/tests/integration/systemd/homectl.bats b/tests/integration/systemd/homectl.bats index 0bdd625c4..bb3b38227 100644 --- a/tests/integration/systemd/homectl.bats +++ b/tests/integration/systemd/homectl.bats @@ -16,7 +16,7 @@ setup_file() { } @test "homectl: Create a user account and their associated home directory" { - sudo homectl create user2 + printf "user2\nuser2" | sudo homectl create user2 } @test "homectl: List user accounts and their associated home directories" { diff --git a/tests/integration/systemd/journalctl.bats b/tests/integration/systemd/journalctl.bats new file mode 100644 index 000000000..9eeb7c9fe --- /dev/null +++ b/tests/integration/systemd/journalctl.bats @@ -0,0 +1,30 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "journalctl: Show all messages with priority level 3 (errors) from this boot" { + sudo journalctl -b --priority=3 +} + +@test "journalctl: Show only the last N lines of the journal" { + sudo journalctl --lines 100 +} + +@test "journalctl: Show all messages by a specific [u]nit" { + sudo journalctl --unit apparmor.service +} + +@test "journalctl: Show all messages by a specific process" { + sudo journalctl _PID=1 +} + +@test "journalctl: Show all messages by a specific executable" { + sudo journalctl /usr/bin/bootctl +} + +@test "journalctl: Delete journal logs which are older than 10 seconds" { + sudo journalctl --vacuum-time=10s +} diff --git a/tests/integration/systemd/localectl.bats b/tests/integration/systemd/localectl.bats new file mode 100644 index 000000000..5d82683a2 --- /dev/null +++ b/tests/integration/systemd/localectl.bats @@ -0,0 +1,23 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "localectl: Show the current settings of the system locale and keyboard mapping" { + localectl +} + +@test "localectl: List available locales" { + localectl list-locales +} + +@test "localectl: Set a system locale variable" { + sudo localectl set-locale LANG=en_US.UTF-8 +} + +@test "localectl: Set the system keyboard mapping for the console and X11" { + sudo localectl set-keymap uk +} + diff --git a/tests/integration/systemd/machinectl.bats b/tests/integration/systemd/machinectl.bats new file mode 100644 index 000000000..d9ba38444 --- /dev/null +++ b/tests/integration/systemd/machinectl.bats @@ -0,0 +1,26 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "importctl: Import an image as a machine" { + sudo importctl pull-tar --force --class=machine -N https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64-root.tar.xz noble +} + +@test "machinectl: Display a list of available images" { + sudo machinectl list-images +} + +@test "machinectl: Start a machine as a service using systemd-nspawn" { + sudo machinectl start noble +} + +@test "machinectl: Display a list of running machines" { + sudo machinectl list +} + +@test "machinectl: Stop a running machine" { + sudo machinectl stop noble +} diff --git a/tests/integration/systemd/networkctl.bats b/tests/integration/systemd/networkctl.bats new file mode 100644 index 000000000..81418ba01 --- /dev/null +++ b/tests/integration/systemd/networkctl.bats @@ -0,0 +1,18 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "networkctl: List existing links with their status" { + sudo networkctl list +} + +@test "networkctl: Show an overall network status" { + sudo networkctl status +} + +@test "networkctl: Reload configuration files (.netdev and .network)" { + sudo networkctl reload +} diff --git a/tests/integration/utils/fstrim.bats b/tests/integration/utils/fstrim.bats new file mode 100644 index 000000000..dff1083e2 --- /dev/null +++ b/tests/integration/utils/fstrim.bats @@ -0,0 +1,14 @@ +#!/usr/bin/env bats +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +load ../common + +@test "fstrim: Trim unused blocks on all mounted partitions that support it" { + sudo fstrim --all +} + +@test "fstrim: Trim unused blocks on a specified partition" { + sudo fstrim --verbose / +} From ac3e0fea59923648b75f46684702632d5d29bf80 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 00:34:31 +0200 Subject: [PATCH 1116/1455] fix: profile compilation issue. --- apparmor.d/groups/utils/zramctl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/utils/zramctl b/apparmor.d/groups/utils/zramctl index a5fa2eb75..29428a96f 100644 --- a/apparmor.d/groups/utils/zramctl +++ b/apparmor.d/groups/utils/zramctl @@ -13,13 +13,13 @@ profile zramctl @{exec_path} { @{exec_path} mr, - @{sys}/devices/virtual/block/zram{int}/disksize w, - @{sys}/devices/virtual/block/zram{int}/reset w, @{sys}/devices/virtual/block/zram@{int}/ r, @{sys}/devices/virtual/block/zram@{int}/comp_algorithm rw, @{sys}/devices/virtual/block/zram@{int}/disksize r, + @{sys}/devices/virtual/block/zram@{int}/disksize w, @{sys}/devices/virtual/block/zram@{int}/max_comp_streams r, @{sys}/devices/virtual/block/zram@{int}/mm_stat r, + @{sys}/devices/virtual/block/zram@{int}/reset w, @{PROC}/swaps r, owner @{PROC}/@{pid}/mounts r, From b878ce1ea23b6287ea6875e7aced36d13a10104c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 01:04:37 +0200 Subject: [PATCH 1117/1455] chore: fix linter issues. --- apparmor.d/profiles-g-l/kernel-postinst-kdump | 4 ++-- apparmor.d/profiles-m-r/initramfs-hooks | 2 +- apparmor.d/profiles-m-r/needrestart | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/profiles-g-l/kernel-postinst-kdump b/apparmor.d/profiles-g-l/kernel-postinst-kdump index 4790c5cb7..50606695a 100644 --- a/apparmor.d/profiles-g-l/kernel-postinst-kdump +++ b/apparmor.d/profiles-g-l/kernel-postinst-kdump @@ -18,7 +18,7 @@ profile kernel-postinst-kdump @{exec_path} { @{bin}/cp rix, @{bin}/du rix, @{bin}/find rix, - @{bin}/kmod rCx -> kmod, + @{bin}/kmod rCx -> kmod, @{bin}/ischroot rPx, @{bin}/linux-version rPx, @{bin}/mkdir rix, @@ -49,7 +49,7 @@ profile kernel-postinst-kdump @{exec_path} { include include - include if exists + include if exists } include if exists diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index 14a83ffbb..18610de27 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -20,7 +20,7 @@ profile initramfs-hooks @{exec_path} { @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, @{bin}/plymouth Px, - @{bin}/update-alternatives Px, + @{sbin}/update-alternatives Px, @{lib}/dracut/dracut-install Px, @{lib}/initramfs-tools/bin/busybox ix, @{lib}/klibc/bin/fstype ix, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index ceac5436b..5a65b40a9 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -23,7 +23,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{bin}/dpkg-query rpx, @{bin}/fail2ban-server rPx, - @{bin}/stty rix, + @{bin}/stty rix, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/udevadm rCx -> udevadm, From f6914a87302f9026215234ea36d6dfcf10d6607e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 22:17:03 +0200 Subject: [PATCH 1118/1455] fix(profile): various fixes from issue raised by the CI. --- apparmor.d/groups/apt/dpkg-script-systemd | 7 ++++++- apparmor.d/groups/systemd/bootctl | 1 + apparmor.d/groups/systemd/localectl | 4 ++++ apparmor.d/groups/systemd/systemd-localed | 4 ++++ apparmor.d/groups/systemd/systemd-userdbd | 1 + apparmor.d/groups/virt/dockerd | 1 + apparmor.d/profiles-g-l/kernel-install | 1 + 7 files changed, 18 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd index 722e72c53..6c76e6f70 100644 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ b/apparmor.d/groups/apt/dpkg-script-systemd @@ -11,6 +11,8 @@ profile dpkg-script-systemd @{exec_path} { include include + capability dac_read_search, + @{exec_path} mrix, @{coreutils_path} rix, @@ -21,7 +23,7 @@ profile dpkg-script-systemd @{exec_path} { @{bin}/dpkg-divert Px, @{bin}/dpkg-maintscript-helper Px, @{bin}/journalctl Px, - @{bin}/kernel-install Px, + @{bin}/kernel-install mrPx, @{bin}/systemctl Cx -> systemctl, @{bin}/systemd-machine-id-setup Px, @{bin}/systemd-sysusers Px, @@ -35,11 +37,14 @@ profile dpkg-script-systemd @{exec_path} { /etc/pam.d/sed@{rand6} rw, /etc/pam.d/common-password rw, + @{efi}/ r, + /var/lib/systemd/{,*} rw, /var/log/journal/ rw, profile dpkg { include + include include capability dac_read_search, diff --git a/apparmor.d/groups/systemd/bootctl b/apparmor.d/groups/systemd/bootctl index 47e8737fe..70a91197f 100644 --- a/apparmor.d/groups/systemd/bootctl +++ b/apparmor.d/groups/systemd/bootctl @@ -16,6 +16,7 @@ profile bootctl @{exec_path} flags=(attach_disconnected,mediate_deleted) { capability linux_immutable, capability mknod, capability net_admin, + capability sys_rawio, capability sys_resource, signal send peer=child-pager, diff --git a/apparmor.d/groups/systemd/localectl b/apparmor.d/groups/systemd/localectl index f9a3625ef..0d46dbfed 100644 --- a/apparmor.d/groups/systemd/localectl +++ b/apparmor.d/groups/systemd/localectl @@ -17,6 +17,10 @@ profile localectl @{exec_path} { signal send set=cont peer=child-pager, #aa:dbus talk bus=system name=org.freedesktop.locale1 label="@{p_systemd_localed}" + dbus send bus=system path=/org/freedesktop/locale1 + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=org.freedesktop.locale1), @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index c15eaf5b2..e98bef009 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -17,6 +17,10 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { unix bind type=stream addr=@@{udbus}/bus/systemd-localed/system, #aa:dbus own bus=system name=org.freedesktop.locale1 + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=Reload + peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-userdbd b/apparmor.d/groups/systemd/systemd-userdbd index 20e940b1d..f9fad3693 100644 --- a/apparmor.d/groups/systemd/systemd-userdbd +++ b/apparmor.d/groups/systemd/systemd-userdbd @@ -33,6 +33,7 @@ profile systemd-userdbd @{exec_path} flags=(attach_disconnected,mediate_deleted) @{att}/@{run}/systemd/notify w, @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw, @{att}/@{run}/systemd/userdb/io.systemd.Home rw, + @{att}/@{run}/systemd/userdb/io.systemd.Machine rw, @{run}/systemd/userdb/{,**} rw, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index abd6c90ec..c21fa2788 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -73,6 +73,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { @{bin}/kmod rCx -> kmod, @{bin}/ps rPx, @{sbin}/runc rUx, + @{bin}/runc rUx, #aa:lint ignore @{bin}/unpigz rix, @{sbin}/xtables-nft-multi rCx -> nft, @{sbin}/xtables-legacy-multi rCx -> nft, diff --git a/apparmor.d/profiles-g-l/kernel-install b/apparmor.d/profiles-g-l/kernel-install index 96d097417..be5d877a9 100644 --- a/apparmor.d/profiles-g-l/kernel-install +++ b/apparmor.d/profiles-g-l/kernel-install @@ -14,6 +14,7 @@ profile kernel-install @{exec_path} { include include + capability sys_rawio, capability sys_resource, ptrace read peer=@{p_systemd}, From b2910ae59329af14143c384c307cbe7f42a47665 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 22:22:13 +0200 Subject: [PATCH 1119/1455] tests(check): add support for '#aa:lint ignore' inline directive to disable linting. --- pkg/prebuild/directive/core.go | 3 +++ tests/check.sh | 17 ++++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/directive/core.go b/pkg/prebuild/directive/core.go index 6138eec0c..cde9470dc 100644 --- a/pkg/prebuild/directive/core.go +++ b/pkg/prebuild/directive/core.go @@ -106,6 +106,9 @@ func Run(file *paths.Path, profile string) (string, error) { opt := NewOption(file, match) drtv, ok := Directives[opt.Name] if !ok { + if opt.Name == "lint" { + continue + } return "", fmt.Errorf("unknown directive '%s' in %s", opt.Name, opt.File) } profile, err = drtv.Apply(opt, profile) diff --git a/tests/check.sh b/tests/check.sh index 8b847db6f..39d7f8158 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -51,12 +51,24 @@ _wait() { fi } +readonly _IGNORE_LINT="#aa:lint ignore" +_ignore_lint() { + local line="$1" + if [[ "$line" == *"$_IGNORE_LINT"* ]]; then + return 0 + fi + return 1 +} + _check() { local file="$1" local line_number=0 while IFS= read -r line; do line_number=$((line_number + 1)) + if _ignore_lint "$line"; then + continue + fi # Rules checks _check_abstractions @@ -339,7 +351,10 @@ check_sbin() { jobs=0 for name in "${sbin[@]}"; do ( - mapfile -t files < <(grep --line-number --recursive -E "(^|[[:space:]])@{bin}/$name([[:space:]]|$)" apparmor.d | cut -d: -f1,2) + mapfile -t files < <( + grep --line-number --recursive -P "(^|[[:space:]])@{bin}/$name([[:space:]]|$)(?!.*$_IGNORE_LINT)" apparmor.d | + cut -d: -f1,2 + ) for file in "${files[@]}"; do _err compatibility "$file" "contains '@{bin}/$name' instead of '@{sbin}/$name'" done From ef9b93b866109751be1f00d308190dd923e06698 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 23:00:48 +0200 Subject: [PATCH 1120/1455] tests(check): enable more linter rule. --- tests/check.sh | 58 +++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 55 insertions(+), 3 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 39d7f8158..708b2fe99 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -75,6 +75,8 @@ _check() { _check_directory_mark _check_equivalent _check_too_wide + _check_transition + _check_useless # Guidelines check _check_abi @@ -137,6 +139,7 @@ _check_directory_mark() { for pattern in "${DIRECTORIES[@]}"; do if [[ "$line" == *"$pattern"* ]]; then [[ "$line" == *'='* ]] && continue + [[ "$line" =~ ^[[:space:]]*# ]] && continue if [[ ! "$line" == *"$pattern/"* ]]; then _err issue "$file:$line_number" "missing directory mark: '$pattern' instead of '$pattern/'" fi @@ -172,6 +175,55 @@ _check_too_wide() { done } +readonly TRANSITION_MUST_CI=( # Must transition to 'ix' or 'Cx' + chgrp chmod chown cp find head install link ln ls mkdir mktemp mv rm rmdir + sed shred stat tail tee test timeout touch truncate unlink +) +readonly TRANSITION_MUST_PC=( # Must transition to 'Px' + ischroot +) +readonly TRANSITION_MUST_C=( # Must transition to 'Cx' + sysctl kmod pgrep pkexec sudo systemctl udevadm + fusermount fusermount3 fusermount{,3} + nvim vim sensible-editor +) +_check_transition() { + _is_enabled transition || return 0 + for prgmname in "${!TRANSITION_MUST_CI[@]}"; do + if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_CI[$prgmname]} ".*([uU]x|[pP][uU]x|[pP]x) ]]; then + _err security "$file:$line_number" \ + "@{bin}/${TRANSITION_MUST_CI[$prgmname]} should be used inherited: 'ix' | 'Cx'" + fi + done + for prgmname in "${!TRANSITION_MUST_PC[@]}"; do + if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_PC[$prgmname]} ".*(Pix|ix) ]]; then + _err security "$file:$line_number" \ + "@{bin}/${TRANSITION_MUST_PC[$prgmname]} should transition to another (sub)profile with 'Px' or 'Cx'" + fi + done + for prgmname in "${!TRANSITION_MUST_C[@]}"; do + if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_C[$prgmname]} ".*([pP]ix|[uU]x|[pP][uU]x|ix) ]]; then + _warn security "$file:$line_number" \ + "@{bin}/${TRANSITION_MUST_C[$prgmname]} should transition to a subprofile with 'Cx'" + fi + done +} + +readonly USELESS=( + '@{PROC}/filesystems' '@{PROC}/sys/kernel/cap_last_cap' + '@{PROC}/meminfo' '@{PROC}/stat' '@{PROC}/cpuinfo' + '@{sys}/devices/system/cpu/online' '@{sys}/devices/system/cpu/possible' + '/usr/share/locale/' +) +_check_useless() { + _is_enabled useless || return 0 + for rule in "${!USELESS[@]}"; do + if [[ "$line" == *"${USELESS[$rule]}"* ]]; then + _err issue "$file:$line_number" "rule already included in the base abstraction, remove it" + fi + done +} + # Guidelines check: https://apparmor.pujol.io/development/guidelines/ RES_ABI=false @@ -388,7 +440,7 @@ check_profiles() { ) jobs=0 WITH_CHECK=( - abstractions equivalent + abstractions directory_mark equivalent useless transition abi include profile header tabs trailing indentation subprofiles vim ) for file in "${files[@]}"; do @@ -408,7 +460,7 @@ check_abstractions() { mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*" 2>/dev/null || true) jobs=0 WITH_CHECK=( - abstractions equivalent + abstractions directory_mark equivalent too_wide abi include header tabs trailing indentation vim ) for file in "${files[@]}"; do @@ -429,7 +481,7 @@ check_abstractions() { # shellcheck disable=SC2034 jobs=0 WITH_CHECK=( - abstractions equivalent + abstractions directory_mark equivalent too_wide header tabs trailing indentation vim ) for file in "${files[@]}"; do From 85383ed361d80027f1527891dda1463a4e112cfc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 23:08:55 +0200 Subject: [PATCH 1121/1455] fix: newly detected linter issues. --- apparmor.d/abstractions/common/app | 6 +++--- apparmor.d/groups/browsers/epiphany | 1 - apparmor.d/groups/gpg/scdaemon | 2 +- apparmor.d/profiles-a-f/adequate | 2 -- apparmor.d/profiles-g-l/kernel-install | 3 +++ 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index a3fb2c5ef..15b730fb2 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -56,11 +56,11 @@ owner @{HOME}/.var/app/** rmix, owner @{HOME}/** rwmlk -> @{HOME}/**, owner @{run}/user/@{uid}/ r, - owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, + owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, #aa:lint ignore owner @{user_games_dirs}/** rmix, - owner @{tmp}/** rmwk, - owner /dev/shm/** rwlk -> /dev/shm/**, + owner @{tmp}/** rmwk, #aa:lint ignore + owner /dev/shm/** rwlk -> /dev/shm/**, #aa:lint ignore owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, owner /var/tmp/etilqs_@{sqlhex} rw, diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany index 636bbf9d3..86b293e8d 100644 --- a/apparmor.d/groups/browsers/epiphany +++ b/apparmor.d/groups/browsers/epiphany @@ -51,7 +51,6 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { owner @{tmp}/WebKit-Media-@{rand6} rw, @{sys}/devices/virtual/dmi/id/chassis_type r, - @{sys}/firmware/acpi/pm_profile r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-org.gnome.Epiphany-@{int}.scope/memory.* r, @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/gpg/scdaemon b/apparmor.d/groups/gpg/scdaemon index 5d2cafd95..729455f7f 100644 --- a/apparmor.d/groups/gpg/scdaemon +++ b/apparmor.d/groups/gpg/scdaemon @@ -25,7 +25,7 @@ profile scdaemon @{exec_path} { owner /etc/pacman.d/gnupg/S.scdaemon rw, owner @{HOME}/@{XDG_GPG_DIR}/scdaemon.conf r, - owner @{HOME}/@{XDG_GPG_DIR}common.conf r, + owner @{HOME}/@{XDG_GPG_DIR}/common.conf r, owner @{HOME}/@{XDG_GPG_DIR}/reader_@{int}.status rw, owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, diff --git a/apparmor.d/profiles-a-f/adequate b/apparmor.d/profiles-a-f/adequate index b7a62fc82..da8f64bc2 100644 --- a/apparmor.d/profiles-a-f/adequate +++ b/apparmor.d/profiles-a-f/adequate @@ -54,14 +54,12 @@ profile adequate @{exec_path} flags=(complain) { @{bin}/* mr, /usr/games/* mr, - @{lib}{,x}/** mr, @{lib}/@{multiarch}/** mr, /usr/share/** r, /opt/google/chrome{,-beta,-unstable}/google-chrome{,-beta,-unstable} mr, @{lib}/@{multiarch}/ld-*.so rix, - @{lib}{,x}32/ld-*.so rix, include if exists } diff --git a/apparmor.d/profiles-g-l/kernel-install b/apparmor.d/profiles-g-l/kernel-install index be5d877a9..bd1438f96 100644 --- a/apparmor.d/profiles-g-l/kernel-install +++ b/apparmor.d/profiles-g-l/kernel-install @@ -42,7 +42,10 @@ profile kernel-install @{exec_path} { @{lib}/modules/*/modules.* w, + / r, + @{efi}/@{hex32}/** rw, + @{efi}/loader/entries.srel r, owner /boot/{vmlinuz,initrd.img}-* r, owner /boot/[a-f0-9]*/*/ rw, From f1a96db3172334c50303024aeb07fbd6f821ce18 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 23:11:20 +0200 Subject: [PATCH 1122/1455] feat(profile): add missing update-alternatives & mdadm profiles. --- apparmor.d/profiles-a-f/dracut-install | 26 +++++++++++++++++ apparmor.d/profiles-m-r/mdadm | 39 ++++++++++++++++++++++++++ dists/flags/main.flags | 2 ++ 3 files changed, 67 insertions(+) create mode 100644 apparmor.d/profiles-a-f/dracut-install create mode 100644 apparmor.d/profiles-m-r/mdadm diff --git a/apparmor.d/profiles-a-f/dracut-install b/apparmor.d/profiles-a-f/dracut-install new file mode 100644 index 000000000..2000635d3 --- /dev/null +++ b/apparmor.d/profiles-a-f/dracut-install @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/dracut/dracut-install +profile dracut-install @{exec_path} { + include + + @{exec_path} mr, + + /etc/modprobe.d/{,**} r, + + @{sys}/devices/platform/{,**/} r, + @{sys}/devices/platform/**/modalias r, + @{sys}/module/compression r, + + @{PROC}/cmdline r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm new file mode 100644 index 000000000..7601f16df --- /dev/null +++ b/apparmor.d/profiles-m-r/mdadm @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{sbin}/mdadm +profile mdadm @{exec_path} { + include + include + + capability sys_admin, + + mqueue (read getattr) type=posix /, + + @{exec_path} mr, + + @{run}/initctl r, + + /var/tmp/mkinitramfs_@{rand6}/etc/mdadm/mdadm.conf.tmp rw, + + @{sys}/bus/pci/drivers/*/ r, + @{sys}/devices/@{pci}/class r, + @{sys}/devices/@{pci}/device r, + @{sys}/devices/@{pci}/vendor r, + + @{PROC}/@{pid}/fd/ r, + @{PROC}/cmdline r, + @{PROC}/kcore r, + @{PROC}/partitions r, + + /dev/**/ r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 71670d4d7..3aeab3192 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -90,6 +90,7 @@ dpkg-script-kmod complain dpkg-script-linux complain dpkg-script-systemd complain dpkg-scripts complain +dracut-install complain drkonqi complain drkonqi-coredump-cleanup complain drkonqi-coredump-processor complain @@ -232,6 +233,7 @@ lvmdump complain lvmpolld complain man complain mate-notification-daemon complain +mdadm complain mdadm-mkconf complain ModemManager attach_disconnected,complain mount attach_disconnected,complain From 8f7e373f6270b172ffdd09b325c4228952cdcb51 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 21 Jul 2025 23:21:53 +0200 Subject: [PATCH 1123/1455] fix: update-alternatives is **not** installed in sbin. --- apparmor.d/profiles-a-f/adequate | 2 +- apparmor.d/profiles-g-l/kernel | 2 +- apparmor.d/profiles-m-r/initramfs-hooks | 2 +- apparmor.d/profiles-m-r/initramfs-scripts | 2 +- apparmor.d/profiles-s-z/update-alternatives | 2 +- tests/sbin.list | 1 - 6 files changed, 5 insertions(+), 6 deletions(-) diff --git a/apparmor.d/profiles-a-f/adequate b/apparmor.d/profiles-a-f/adequate index da8f64bc2..7025f9787 100644 --- a/apparmor.d/profiles-a-f/adequate +++ b/apparmor.d/profiles-a-f/adequate @@ -34,7 +34,7 @@ profile adequate @{exec_path} flags=(complain) { # shared object file): ignored. @{bin}/dpkg-query rpx, # - @{sbin}/update-alternatives rPx, + @{bin}/update-alternatives rPx, /var/lib/adequate/pending rwk, diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel index c3155ce75..b718f7d18 100644 --- a/apparmor.d/profiles-g-l/kernel +++ b/apparmor.d/profiles-g-l/kernel @@ -38,9 +38,9 @@ profile kernel @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/kernel-install rPx, @{bin}/systemd-detect-virt rPx, + @{bin}/update-alternatives rPx, @{lib}/dkms/dkms_autoinstaller rPx, @{sbin}/dkms rPx, - @{sbin}/update-alternatives rPx, @{sbin}/update-grub rPx, @{sbin}/update-initramfs rPx, diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index 18610de27..14a83ffbb 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -20,7 +20,7 @@ profile initramfs-hooks @{exec_path} { @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, @{bin}/plymouth Px, - @{sbin}/update-alternatives Px, + @{bin}/update-alternatives Px, @{lib}/dracut/dracut-install Px, @{lib}/initramfs-tools/bin/busybox ix, @{lib}/klibc/bin/fstype ix, diff --git a/apparmor.d/profiles-m-r/initramfs-scripts b/apparmor.d/profiles-m-r/initramfs-scripts index 4d38ab9c1..d280c145a 100644 --- a/apparmor.d/profiles-m-r/initramfs-scripts +++ b/apparmor.d/profiles-m-r/initramfs-scripts @@ -21,7 +21,7 @@ profile initramfs-scripts @{exec_path} { @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, @{bin}/plymouth Px, - @{sbin}/update-alternatives Px, + @{bin}/update-alternatives Px, @{lib}/dracut/dracut-install Px, @{lib}/initramfs-tools/bin/busybox Px, /usr/share/mdadm/mkconf Px, diff --git a/apparmor.d/profiles-s-z/update-alternatives b/apparmor.d/profiles-s-z/update-alternatives index 68ddb97a5..8f08b74fa 100644 --- a/apparmor.d/profiles-s-z/update-alternatives +++ b/apparmor.d/profiles-s-z/update-alternatives @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{sbin}/update-alternatives +@{exec_path} = @{bin}/update-alternatives profile update-alternatives @{exec_path} { include include diff --git a/tests/sbin.list b/tests/sbin.list index 1d0eb5b97..a8b439478 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -766,7 +766,6 @@ unix_chkpwd unix_update unix2_chkpwd uobjnew -update-alternatives update-ca-certificates update-catalog update-cracklib From 18212c9ff7a0fe96d3ae6299d76503ca3a32dad2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Jul 2025 00:03:06 +0200 Subject: [PATCH 1124/1455] tests: re-enable apt tests. --- tests/integration/apt/apt.bats | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/tests/integration/apt/apt.bats b/tests/integration/apt/apt.bats index 4be0edd8d..3f13d4ea4 100644 --- a/tests/integration/apt/apt.bats +++ b/tests/integration/apt/apt.bats @@ -5,10 +5,6 @@ load ../common -setup_file() { - skip -} - @test "apt: Update the list of available packages and versions" { sudo apt update } @@ -38,11 +34,11 @@ setup_file() { } @test "apt: Clean the local repository - removing package files (.deb) from interrupted downloads that can no longer be downloaded" { - sudo apt autoclean + sudo apt autoclean -y } @test "apt: Remove all packages that are no longer needed" { - sudo apt autoremove + sudo apt autoremove -y } @test "apt: List all packages" { From 5a08ffc9ba485878eba448366459f2ef55625274 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Jul 2025 00:19:35 +0200 Subject: [PATCH 1125/1455] fix(profile): apply fixes raised by tests --- apparmor.d/abstractions/bus/org.freedesktop.Avahi | 5 +++++ .../abstractions/bus/org.freedesktop.systemd1 | 2 +- apparmor.d/abstractions/common/electron | 2 +- .../groups/freedesktop/xdg-user-dirs-gtk-update | 7 ++++++- .../groups/systemd/systemd-machine-id-setup | 1 + apparmor.d/groups/ubuntu/update-notifier | 1 - apparmor.d/groups/ubuntu/update-notifier-crash | 15 +++++++++++++-- apparmor.d/profiles-a-f/dracut-install | 1 + apparmor.d/profiles-m-r/mdadm | 1 + 9 files changed, 29 insertions(+), 6 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Avahi b/apparmor.d/abstractions/bus/org.freedesktop.Avahi index b002d6fa4..b683cf128 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Avahi +++ b/apparmor.d/abstractions/bus/org.freedesktop.Avahi @@ -26,6 +26,11 @@ member={ItemNew,AllForNow,CacheExhausted} peer=(name="@{busname}", label="@{p_avahi_daemon}"), + dbus receive bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=StateChanged + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 index 341cf58ce..4fb1764bc 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 @@ -8,7 +8,7 @@ dbus send bus=session path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager - member={GetUnit,StartUnit,StartTransientUnit} + member={GetUnit,GetUnitByPIDFD,StartUnit,StartTransientUnit} peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), dbus send bus=system path=/org/freedesktop/systemd1 diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 8134f8681..6216ec939 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -75,6 +75,7 @@ @{PROC}/ r, @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/task/@{tid}/status r, @{PROC}/sys/fs/inotify/max_user_watches r, @{PROC}/sys/kernel/yama/ptrace_scope r, owner @{PROC}/@{pid}/cgroup r, @@ -88,7 +89,6 @@ owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/stat r, - owner @{PROC}/@{pid}/task/@{tid}/status r, owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1 deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update index 641862965..b2ae65450 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update @@ -12,14 +12,19 @@ profile xdg-user-dirs-gtk-update @{exec_path} { include include include - include + include + include @{exec_path} mr, + @{bin}/xdg-user-dirs-update Px, + owner @{user_config_dirs}/gtk-3.0/bookmarks* rw, owner @{user_config_dirs}/user-dirs.dirs r, owner @{user_config_dirs}/user-dirs.locale r, + owner @{tmp}/dirs-@{rand6} rw, + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-machine-id-setup b/apparmor.d/groups/systemd/systemd-machine-id-setup index f3f27b523..c791e6375 100644 --- a/apparmor.d/groups/systemd/systemd-machine-id-setup +++ b/apparmor.d/groups/systemd/systemd-machine-id-setup @@ -31,6 +31,7 @@ profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) { /etc/machine-id rw, /var/ r, + @{PROC}/@{pid}/fdinfo/@{int} r, @{PROC}/1/environ r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 6c4dc4d77..361290980 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -85,7 +85,6 @@ profile update-notifier @{exec_path} { profile systemctl { include include - include dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager diff --git a/apparmor.d/groups/ubuntu/update-notifier-crash b/apparmor.d/groups/ubuntu/update-notifier-crash index dee094aa1..d65c77a08 100644 --- a/apparmor.d/groups/ubuntu/update-notifier-crash +++ b/apparmor.d/groups/ubuntu/update-notifier-crash @@ -9,17 +9,28 @@ include @{exec_path} = @{lib}/update-notifier/update-notifier-crash profile update-notifier-crash @{exec_path} { include + include @{exec_path} mr, - @{bin}/systemctl Cx -> systemctl, - + @{bin}/{,e}grep ix, + @{bin}/groups Px, + @{bin}/systemctl Cx -> systemctl, + @{bin}/which{,.debianutils} ix, + @{sh_path} mr, /usr/share/apport/apport-checkreports Px, + owner @{HOME}/ r, + profile systemctl { include include + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=GetUnitFileState + peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), + include if exists } diff --git a/apparmor.d/profiles-a-f/dracut-install b/apparmor.d/profiles-a-f/dracut-install index 2000635d3..6deb06eb6 100644 --- a/apparmor.d/profiles-a-f/dracut-install +++ b/apparmor.d/profiles-a-f/dracut-install @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/dracut/dracut-install profile dracut-install @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm index 7601f16df..15adcb9e6 100644 --- a/apparmor.d/profiles-m-r/mdadm +++ b/apparmor.d/profiles-m-r/mdadm @@ -9,6 +9,7 @@ include @{exec_path} = @{sbin}/mdadm profile mdadm @{exec_path} { include + include include capability sys_admin, From 4a3a98c77d3fefb403a1bb775bca51a088006451 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Jul 2025 18:46:17 +0200 Subject: [PATCH 1126/1455] fix(profile): fixes for issues raised by newly enabled tests. --- apparmor.d/groups/apt/dpkg-preconfigure | 1 + apparmor.d/groups/apt/dpkg-script-linux | 12 +++++++++++- apparmor.d/groups/apt/dpkg-scripts | 1 + apparmor.d/groups/network/netplan-generate | 1 + apparmor.d/profiles-s-z/ucf | 12 ++---------- 5 files changed, 16 insertions(+), 11 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index 716cd1dc8..66131c6e7 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -36,6 +36,7 @@ profile dpkg-preconfigure @{exec_path} { @{bin}/stty ix, @{bin}/tr ix, @{bin}/uniq ix, + @{bin}/which{,.debianutils} ix, @{bin}/apt-extracttemplates Px, @{bin}/dpkg Px -> child-dpkg, diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux index d6a8db473..24c6c74df 100644 --- a/apparmor.d/groups/apt/dpkg-script-linux +++ b/apparmor.d/groups/apt/dpkg-script-linux @@ -19,11 +19,14 @@ profile dpkg-script-linux @{exec_path} { @{bin}/run-parts ix, @{bin}/stty ix, + @{bin}/deb-systemd-helper Px, + @{bin}/deb-systemd-invoke Px, + @{bin}/dpkg-maintscript-helper Px, @{bin}/dpkg-trigger Px, @{bin}/kmod Px, @{bin}/linux-check-removal Px, @{bin}/linux-update-symlinks Px, - @{bin}/dpkg-maintscript-helper Px, + @{bin}/systemctl Cx -> systemctl, /usr/share/{update,reboot}-notifier/notify-reboot-required Px, /etc/kernel/{,header_}postinst.d/* Px, @@ -36,6 +39,13 @@ profile dpkg-script-linux @{exec_path} { @{lib}/linux/triggers/* w, @{lib}/modules/*/.fresh-install w, + profile systemctl { + include + include + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 44e4790c4..5743ab904 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -80,6 +80,7 @@ profile dpkg-scripts @{exec_path} { /tmp/tmp.@{rand10} rw, @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/mountinfo r, profile bus { include diff --git a/apparmor.d/groups/network/netplan-generate b/apparmor.d/groups/network/netplan-generate index 64f8399e1..74ed20aaf 100644 --- a/apparmor.d/groups/network/netplan-generate +++ b/apparmor.d/groups/network/netplan-generate @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/netplan/generate profile netplan-generate @{exec_path} flags=(attach_disconnected) { include + include include capability chown, diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf index 3c3374d85..9e459f261 100644 --- a/apparmor.d/profiles-s-z/ucf +++ b/apparmor.d/profiles-s-z/ucf @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/ucf profile ucf @{exec_path} { include + include include include @@ -17,11 +18,11 @@ profile ucf @{exec_path} { @{sh_path} rix, @{bin}/{,e}grep rix, + @{bin}/{m,g,}awk rix, @{bin}/basename rix, @{bin}/cat rix, @{bin}/cp rix, @{bin}/dirname rix, - @{bin}/{m,g,}awk rix, @{bin}/getopt rix, @{bin}/id rix, @{bin}/md5sum rix, @@ -39,8 +40,6 @@ profile ucf @{exec_path} { @{bin}/dpkg-divert rPx, @{pager_path} rCx -> child-pager, - /usr/share/debconf/frontend Cx -> debconf, - # For md5sum /usr/share/** r, @@ -57,13 +56,6 @@ profile ucf @{exec_path} { deny capability sys_admin, # optional: no audit - profile debconf { - include - include - - include if exists - } - include if exists } From 7d2229cd05134f491a671f4f2e61b9216dc07420 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Jul 2025 23:18:00 +0200 Subject: [PATCH 1127/1455] build: fully replace make by just. --- .github/workflows/main.yml | 17 +-- .gitlab-ci.yml | 11 +- Justfile | 6 +- Makefile | 100 ------------------ debian/apparmor.d.hide | 2 +- debian/control | 1 + debian/rules | 8 +- dists/apparmor.d.spec | 5 +- dists/build.sh | 2 +- dists/ignore/main.ignore | 2 +- docs/development/build.md | 2 +- docs/development/roadmap.md | 2 +- docs/development/tests.md | 6 +- docs/development/workflow.md | 14 +-- docs/enforce.md | 44 ++++---- docs/full-system-policy.md | 42 ++++---- docs/install.md | 19 ++-- tests/check.sh | 2 +- .../cloud-init/archlinux-cosmic.user-data.yml | 1 + tests/cloud-init/archlinux-xfce.user-data.yml | 1 + tests/cloud-init/opensuse.yml | 2 +- tests/packer/src/aa-update | 6 +- 22 files changed, 113 insertions(+), 182 deletions(-) delete mode 100644 Makefile diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 973287e72..a3d7b3266 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -9,9 +9,14 @@ jobs: - name: Check out repository code uses: actions/checkout@v4 + - name: Install linter dependencies + run: | + sudo apt-get update -q + sudo apt-get install -y just + - name: Run basic profile linter check run: | - make check + just check build: runs-on: ${{ matrix.os }} @@ -32,13 +37,13 @@ jobs: sudo apt-get update -q sudo apt-get install -y \ devscripts debhelper config-package-dev \ - auditd apparmor-profiles apparmor-utils + auditd apparmor-profiles apparmor-utils just sudo rm /etc/apparmor.d/usr.lib.snapd.snap-confine.real - name: Build the apparmor.d package run: | if [[ ${{ matrix.mode }} == full-system-policy ]]; then - echo -e "\noverride_dh_auto_build:\n\tmake fsp" >> debian/rules + sed -e "s/just complain/just fsp-complain/" -i debian/rules fi if [[ ${{ matrix.os }} == ubuntu-24.04 ]] && [[ ${{ matrix.mode }} == default ]]; then # Test with Re-attach disconnected path @@ -95,7 +100,7 @@ jobs: sudo apt-get update -q sudo apt-get install -y \ apparmor-profiles apparmor-utils \ - bats bats-support + bats bats-support just - name: Install apparmor.d run: | @@ -127,12 +132,12 @@ jobs: - name: Install integration dependencies run: | - bash tests/requirements.sh + just init find /usr/sbin/ -type f - name: Run the integration tests run: | - make integration + just integration - name: Show final AppArmor logs if: always() diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 8adab16ab..7b4c13519 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -66,7 +66,7 @@ check: stage: test image: registry.gitlab.com/roddhjav/builders/archlinux script: - - make check + - just check # Package Build # ------------- @@ -84,13 +84,12 @@ archlinux: debian: stage: build - image: registry.gitlab.com/roddhjav/builders/debian:12 + image: registry.gitlab.com/roddhjav/builders/debian:trixie script: - sudo chown -R build:build /builds/ - git config --global --add safe.directory $CI_PROJECT_DIR - mkdir -p "$PKGDEST" - - sudo apt-get update -q && sudo apt-get install -y config-package-dev lsb-release - - sudo apt-get install -y -t bookworm-backports golang-go + - sudo apt-get update -q && sudo apt-get install -y config-package-dev golang-go lsb-release libdistro-info-perl - bash dists/build.sh dpkg artifacts: expire_in: 1 day @@ -105,7 +104,7 @@ ubuntu: script: - git config --global --add safe.directory $CI_PROJECT_DIR - mkdir -p "$PKGDEST" - - sudo apt-get update -q && sudo apt-get install -y config-package-dev golang-go lsb-release + - sudo apt-get update -q && sudo apt-get install -y config-package-dev golang-go lsb-release libdistro-info-perl - bash dists/build.sh dpkg artifacts: expire_in: 1 day @@ -117,7 +116,7 @@ whonix: variables: DISTRIBUTION: whonix before_script: - - echo "\noverride_dh_auto_build:\n\tmake fsp" >> debian/rules + - sed -e "s/just complain/just fsp-complain/" -i debian/rules opensuse: stage: build diff --git a/Justfile b/Justfile index f9ce13c36..7a84af1be 100644 --- a/Justfile +++ b/Justfile @@ -157,7 +157,7 @@ dpkg: [doc('Build & install apparmor.d on OpenSUSE based systems')] rpm: @bash dists/build.sh rpm - @sudo rpm -ivh --force {{pkgdest}}/{{pkgname}}-*.rpm + @sudo rpm -ivh --force {{pkgdest}}/{{pkgname}}-*.rpm [group('tests')] [doc('Run the unit tests')] @@ -213,8 +213,8 @@ package dist: if [[ $dist =~ ubuntu([0-9]+) ]]; then version="${BASH_REMATCH[1]}.04" dist="ubuntu" - elif [[ $dist =~ debian([0-9]+) ]]; then - version="${BASH_REMATCH[1]}" + elif [[ $dist == debian ]]; then + version="trixie" dist="debian" fi bash dists/docker.sh $dist $version diff --git a/Makefile b/Makefile deleted file mode 100644 index 854d39f16..000000000 --- a/Makefile +++ /dev/null @@ -1,100 +0,0 @@ -#!/usr/bin/make -f -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2022-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -DESTDIR ?= / -BUILD ?= .build -PKGDEST ?= ${PWD}/.pkg -PKGNAME := apparmor.d -PROFILES = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*))) - -.PHONY: all -all: build - @./${BUILD}/prebuild --complain - -.PHONY: build -build: - @go build -o ${BUILD}/ ./cmd/aa-log - @go build -o ${BUILD}/ ./cmd/prebuild - -.PHONY: enforce -enforce: build - @./${BUILD}/prebuild - -.PHONY: fsp -fsp: build - @./${BUILD}/prebuild --full - -.PHONY: fsp-complain -fsp-complain: build - @./${BUILD}/prebuild --complain --full - -.PHONY: install -install: - @install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log - @for file in $(shell find "${BUILD}/share" -type f -not -name "*.md" -printf "%P\n"); do \ - install -Dm0644 "${BUILD}/share/$${file}" "${DESTDIR}/usr/share/$${file}"; \ - done; - @for file in $(shell find "${BUILD}/apparmor.d" -type f -printf "%P\n"); do \ - install -Dm0644 "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \ - done; - @for file in $(shell find "${BUILD}/apparmor.d" -type l -printf "%P\n"); do \ - mkdir -p "${DESTDIR}/etc/apparmor.d/disable"; \ - cp -d "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \ - done; - @for file in ${BUILD}/systemd/system/*; do \ - service="$$(basename "$$file")"; \ - install -Dm0644 "$${file}" "${DESTDIR}/usr/lib/systemd/system/$${service}.d/apparmor.conf"; \ - done; - @for file in ${BUILD}/systemd/user/*; do \ - service="$$(basename "$$file")"; \ - install -Dm0644 "$${file}" "${DESTDIR}/usr/lib/systemd/user/$${service}.d/apparmor.conf"; \ - done - - -.PHONY: $(PROFILES) -$(PROFILES): - @install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log - @for file in $(shell find ${BUILD}/apparmor.d/abstractions/ -type f -printf "%P\n"); do \ - install -Dm0644 "${BUILD}/apparmor.d/abstractions/$${file}" "${DESTDIR}/etc/apparmor.d/abstractions/$${file}"; \ - done; - @for file in $(shell find ${BUILD}/apparmor.d/tunables/ -type f -printf "%P\n"); do \ - install -Dm0644 "${BUILD}/apparmor.d/tunables/$${file}" "${DESTDIR}/etc/apparmor.d/tunables/$${file}"; \ - done; - @echo "Warning: profile dependencies fallback to unconfined." - @for file in ${@}; do \ - grep 'rPx' "${BUILD}/apparmor.d/$${file}"; \ - sed -i -e "s/rPx/rPUx/g" "${BUILD}/apparmor.d/$${file}"; \ - install -Dvm0644 "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \ - done; - @systemctl restart apparmor || sudo journalctl -xeu apparmor.service - -.PHONY: dev -name ?= -dev: - @go run ./cmd/prebuild --complain --file $(shell find apparmor.d -iname ${name}) - @sudo install -Dm644 ${BUILD}/apparmor.d/${name} /etc/apparmor.d/${name} - @sudo systemctl restart apparmor || sudo journalctl -xeu apparmor.service - -.PHONY: pkg -pkg: - @makepkg --syncdeps --install --cleanbuild --force --noconfirm - -.PHONY: dpkg -dpkg: - @bash dists/build.sh dpkg - @sudo dpkg -i ${PKGDEST}/${PKGNAME}_*.deb - -.PHONY: rpm -rpm: - @bash dists/build.sh rpm - @sudo rpm -ivh --force ${PKGDEST}/${PKGNAME}-*.rpm - -.PHONY: check -check: - @bash tests/check.sh - -.PHONY: integration -integration: - @bats --recursive --timing --print-output-on-failure tests/integration/ diff --git a/debian/apparmor.d.hide b/debian/apparmor.d.hide index 20725a133..8fc1d019d 100644 --- a/debian/apparmor.d.hide +++ b/debian/apparmor.d.hide @@ -1 +1 @@ -# This file is generated by "make", all edit will be lost. +# This file is generated by "just", all edit will be lost. diff --git a/debian/control b/debian/control index 7f2028b0e..56ad928ba 100644 --- a/debian/control +++ b/debian/control @@ -6,6 +6,7 @@ Build-Depends: debhelper (>= 13.4), debhelper-compat (= 13), golang-any, config-package-dev, + just, Homepage: https://github.com/roddhjav/apparmor.d Vcs-Browser: https://github.com/roddhjav/apparmor.d Vcs-Git: https://github.com/roddhjav/apparmor.d.git diff --git a/debian/rules b/debian/rules index a30a693df..d78e652ca 100755 --- a/debian/rules +++ b/debian/rules @@ -9,5 +9,9 @@ # golang/1.19 compresses debug symbols itself. override_dh_dwz: -# do not run 'make check' by default as it can be long for dev package -override_dh_auto_test: +override_dh_auto_build: + just complain + +override_dh_auto_install: + just destdir="${CURDIR}/debian/apparmor.d" install + diff --git a/dists/apparmor.d.spec b/dists/apparmor.d.spec index 339d88036..bf97705a6 100644 --- a/dists/apparmor.d.spec +++ b/dists/apparmor.d.spec @@ -15,6 +15,7 @@ URL: https://github.com/roddhjav/apparmor.d Source0: %{name}-%{version}.tar.gz Requires: apparmor-profiles BuildRequires: distribution-release +BuildRequires: just BuildRequires: golang-packaging BuildRequires: apparmor-profiles @@ -25,10 +26,10 @@ AppArmor.d is a set of over 1500 AppArmor profiles whose aim is to confine most %autosetup %build -%make_build +just complain %install -%make_install +just destdir="%{buildroot}" install %posttrans rm -f /var/cache/apparmor/* 2>/dev/null diff --git a/dists/build.sh b/dists/build.sh index 1f2e204c2..9b9f9e765 100644 --- a/dists/build.sh +++ b/dists/build.sh @@ -3,7 +3,7 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Usage: make [ dpkg | pkg | rpm ] +# Usage: just [ dpkg | pkg | rpm ] set -eu -o pipefail diff --git a/dists/ignore/main.ignore b/dists/ignore/main.ignore index 3cccf4c05..0665edf85 100644 --- a/dists/ignore/main.ignore +++ b/dists/ignore/main.ignore @@ -2,7 +2,7 @@ # File format: one ignore by line, it can be a profile name or a directory to ignore # Contains profiles and configuration for full system confinement, only included -# when built with 'make full' +# when built with 'just fsp' apparmor.d/groups/_full # Provided by other packages diff --git a/docs/development/build.md b/docs/development/build.md index 5145a8416..eaa2487a2 100644 --- a/docs/development/build.md +++ b/docs/development/build.md @@ -2,7 +2,7 @@ title: Building the profiles --- -The profiles in `apparmor.d` must not be used directly. They need to be prebuilt (by running `make`). This page documents all possibles prebuild tasks. It is not intended to be read by end user, and it is only targeted at developers and maintainers. +The profiles in `apparmor.d` must not be used directly. They need to be prebuilt (by running `just complain`). This page documents all possibles prebuild tasks. It is not intended to be read by end user, and it is only targeted at developers and maintainers. The build system is fully configurable, general usage can be seen with: ```sh diff --git a/docs/development/roadmap.md b/docs/development/roadmap.md index b42467e3d..2585208e5 100644 --- a/docs/development/roadmap.md +++ b/docs/development/roadmap.md @@ -29,7 +29,7 @@ This is the current list of features that must be implemented to get to a stable - [ ] Provide packages repo for ubuntu/debian - [ ] Provide complain/enforced packages version - [x] Add a `just` target to install the profiles in the right place - - [ ] Fully drop the Makefile in favor of `just` + - [x] Fully drop the Makefile in favor of `just` ## Next features diff --git a/docs/development/tests.md b/docs/development/tests.md index df614b4fe..4bf421d92 100644 --- a/docs/development/tests.md +++ b/docs/development/tests.md @@ -6,12 +6,12 @@ Misconfigured AppArmor profiles is one of the most effective ways to break someo **Current** -- [x] **[Build:](https://gitlab.com/roddhjav/apparmor.d/-/pipelines)** `make` +- [x] **[Build:](https://gitlab.com/roddhjav/apparmor.d/-/pipelines)** `just complain` - Build the profiles for all supported distributions. - All CI jobs validate the profiles syntax and ensure they can be safely loaded into a kernel. - Ensure the profile entry point (`@{exec_path}`) is defined. -- [x] **[Checks:](https://github.com/roddhjav/apparmor.d/blob/main/tests/check.sh)** `make check` checks basic style of profiles: +- [x] **[Checks:](https://github.com/roddhjav/apparmor.d/blob/main/tests/check.sh)** `just check` checks basic style of profiles: - Ensure apparmor.d header & licence - Ensure 2 spaces indentation - Ensure local include for profile and subprofiles @@ -19,7 +19,7 @@ Misconfigured AppArmor profiles is one of the most effective ways to break someo - Ensure modern profile naming - Ensure `vim:syntax=apparmor` -- [x] **[Integration Tests:](integration.md)** `just integration ` +- [x] **[Integration Tests:](integration.md)** `just test-run ` - Run simple CLI commands to ensure no logs are raised. - Uses the [bats](https://github.com/bats-core/bats-core) test system. - Run in the Github Action as well as in all local [test VM](vm.md). diff --git a/docs/development/workflow.md b/docs/development/workflow.md index 7737e3775..786d77c93 100644 --- a/docs/development/workflow.md +++ b/docs/development/workflow.md @@ -57,7 +57,7 @@ profile foo @{exec_path} { ## Development Install -It is not recommended installing the full project *"manually"* (with `make`, `sudo make install`). The distribution specific packages are intended to be used in development as they include additional rule to ensure compatibility with upstream (see `debian/`, `PKGBUILD` and `dists/apparmor.d.spec`). +It is not recommended installing the full project *"manually"* (with `just complain`, `sudo just install`). The distribution specific packages are intended to be used in development as they include additional rule to ensure compatibility with upstream (see `debian/`, `PKGBUILD` and `dists/apparmor.d.spec`). Instead, install an individual profile or the development package, the following way. @@ -66,25 +66,25 @@ Instead, install an individual profile or the development package, the following === ":material-arch: Archlinux" ```sh - make pkg + just pkg ``` === ":material-ubuntu: Ubuntu" ```sh - make dpkg + just dpkg ``` === ":material-debian: Debian" ```sh - make dpkg + just dpkg ``` === ":simple-suse: openSUSE" ```sh - make rpm + just rpm ``` === ":material-docker: Docker" @@ -102,7 +102,7 @@ Instead, install an individual profile or the development package, the following **Format** ```sh -make dev name= +just dev ``` **Exampe** @@ -110,7 +110,7 @@ make dev name= : Testing the profile `pass` ``` - make dev name=pass + just dev pass ``` This: diff --git a/docs/enforce.md b/docs/enforce.md index 692cbd1e3..51eec0980 100644 --- a/docs/enforce.md +++ b/docs/enforce.md @@ -13,50 +13,56 @@ The default package configuration installs all profiles in *complain* mode. This === ":material-arch: Archlinux" - In the `PKGBUILD`, replace `make` by `make enforce`: + In the `PKGBUILD`, replace `just complain` by `just enforce`: ```diff - - make DISTRIBUTION=arch - + make enforce DISTRIBUTION=arch + - just complain + + just enforce ``` - Then, build the package with: `make pkg` + Then, build the package with: `just pkg` === ":material-ubuntu: Ubuntu" - In `debian/rules`, add the following lines: + In `debian/rules`, replace `just complain` by `just enforce`: - ```make - override_dh_auto_build: - make enforce + ```diff + override_dh_auto_build: + - just complain + override_dh_auto_build: + + just enforce ``` - Then, build the package with: `make dpkg` + Then, build the package with: `just dpkg` === ":material-debian: Debian" - In `debian/rules`, add the following lines: + In `debian/rules`, replace `just complain` by `just enforce`: - ```make - override_dh_auto_build: - make enforce + ```diff + override_dh_auto_build: + - just complain + override_dh_auto_build: + + just enforce ``` - Then, build the package with: `make dpkg` + Then, build the package with: `just dpkg` === ":simple-suse: openSUSE" - In `dists/apparmor.d.spec`, replace `%make_build` by `%make_build enforce` + In `dists/apparmor.d.spec`, replace `just complain` by `just enforce`: ```diff - - %make_build - + %make_build enforce + %build + - just complain + %build + + just enforce ``` - Then, build the package with: `make rpm` + Then, build the package with: `just rpm` === ":material-home: Partial Install" - Use the `make enforce` command to build instead of `make` + Use the `just enforce` command to build instead of `just complain` [aur]: https://aur.archlinux.org/packages/apparmor.d-git diff --git a/docs/full-system-policy.md b/docs/full-system-policy.md index b523a1c38..a5ac57f11 100644 --- a/docs/full-system-policy.md +++ b/docs/full-system-policy.md @@ -35,7 +35,7 @@ Particularly: ## Installation -This feature is only enabled when the project is built with `make full`. [Early policy](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorInSystemd#early-policy-loads) load **must** also be enabled. Once `apparmor.d` has been installed in FSP mode, it is required to reboot to apply the changes. +This feature is only enabled when the project is built with `just fsp`. [Early policy](https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorInSystemd#early-policy-loads) load **must** also be enabled. Once `apparmor.d` has been installed in FSP mode, it is required to reboot to apply the changes. In `/etc/apparmor/parser.conf` ensure you have: ``` @@ -46,51 +46,57 @@ Optimize=compress-fast === ":material-arch: Archlinux" - In `PKGBUILD`, replace `make` by `make fsp`: + In `PKGBUILD`, replace `just complain` by `just fsp-complain`: ```diff - - make - + make fsp + - just complain + + just fsp-complain ``` - Then, build the package with: `make pkg` + Then, build the package with: `just pkg` === ":material-ubuntu: Ubuntu" - In `debian/rules`, add the following lines: + In `debian/rules`, replace `just complain` by `just fsp-complain`: ```make - override_dh_auto_build: - make fsp + override_dh_auto_build: + - just complain + override_dh_auto_build: + + just fsp-complain ``` - Then, build the package with: `make dpkg` + Then, build the package with: `just dpkg` === ":material-debian: Debian" - In `debian/rules`, add the following lines: + In `debian/rules`, replace `just complain` by `just fsp-complain`: ```make - override_dh_auto_build: - make fsp + override_dh_auto_build: + - just complain + override_dh_auto_build: + + just fsp-complain ``` - Then, build the package with: `make dpkg` + Then, build the package with: `just dpkg` === ":simple-suse: openSUSE" - In `dists/apparmor.d.spec`, replace `%make_build` by `%make_build fsp` + In `dists/apparmor.d.spec`, replace `just complain` by `just fsp-complain`: ```diff - - %make_build - + %make_build fsp + %build + - just complain + %build + + just fsp-complain ``` - Then, build the package with: `make rpm` + Then, build the package with: `just rpm` === ":material-home: Partial Install" - Use the `make fsp` command to build instead of `make` + Use the `just fsp-complain` command to build instead of `just complain` ## Structure diff --git a/docs/install.md b/docs/install.md index a18185fbf..416ad0f15 100644 --- a/docs/install.md +++ b/docs/install.md @@ -84,7 +84,7 @@ echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf If you have `devscripts` installed, you can use the one liner: ```sh - make dpkg + just dpkg ``` !!! warning @@ -110,19 +110,26 @@ echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf If you have `devscripts` installed, you can use the one liner: ```sh - make dpkg + just dpkg ``` !!! note - You may need golang from the backports repository to build: + **Debian 12 user will need to:** + 1. Install Golang from the backports repository: ```sh echo 'deb http://deb.debian.org/debian bookworm-backports main contrib non-free' | sudo tee -a /etc/apt/sources.list sudo apt update sudo apt install -t bookworm-backports golang-go ``` + 2. Install [just](https://github.com/casey/just) locally, and ignore the dependence. E.g: + ```sh + pipx install rust-just + sed '/just/d' -i debian/control + ``` + !!! warning **Beware**: do not install a `.deb` made for Ubuntu on Debian as the packages are different. @@ -144,15 +151,15 @@ echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf For test purposes, you can install specific profiles with the following commands. Abstractions, tunable, and most of the OS dependent post-processing is managed. ```sh - make - sudo make profile-names... + just complain + sudo just local profile-names... ``` !!! warning Partial installation is discouraged because profile dependencies are not fetched. To prevent some AppArmor issues, the dependencies are automatically switched to unconfined (`rPx` -> `rPUx`). The installation process warns on the missing profiles so that you can easily install them if desired. (PR is welcome see [#77](https://github.com/roddhjav/apparmor.d/issues/77)) - For instance, `sudo make pass` gives: + For instance, `sudo just local pass` gives: ```sh Warning: profile dependencies fallback to unconfined. @{bin}/wl-{copy,paste} rPx, diff --git a/tests/check.sh b/tests/check.sh index 708b2fe99..f00d8aec1 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -3,7 +3,7 @@ # Copyright (C) 2024-2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Usage: make check +# Usage: just check # shellcheck disable=SC2044 set -eu -o pipefail diff --git a/tests/cloud-init/archlinux-cosmic.user-data.yml b/tests/cloud-init/archlinux-cosmic.user-data.yml index be623e625..9ed6c1d92 100644 --- a/tests/cloud-init/archlinux-cosmic.user-data.yml +++ b/tests/cloud-init/archlinux-cosmic.user-data.yml @@ -10,6 +10,7 @@ packages: # Install usefull core packages - bash-completion + - just - git - htop - man diff --git a/tests/cloud-init/archlinux-xfce.user-data.yml b/tests/cloud-init/archlinux-xfce.user-data.yml index 54329bfb8..5bab9bf08 100644 --- a/tests/cloud-init/archlinux-xfce.user-data.yml +++ b/tests/cloud-init/archlinux-xfce.user-data.yml @@ -11,6 +11,7 @@ packages: # Install usefull core packages - bash-completion - git + - just - htop - man - pass diff --git a/tests/cloud-init/opensuse.yml b/tests/cloud-init/opensuse.yml index 1adf2b6eb..57c633678 100644 --- a/tests/cloud-init/opensuse.yml +++ b/tests/cloud-init/opensuse.yml @@ -9,7 +9,7 @@ core-packages: &core-packages - go - golang-packaging - htop - - make + - just - rpmbuild - rsync - vim diff --git a/tests/packer/src/aa-update b/tests/packer/src/aa-update index 48267d2f0..bdbd6ed00 100644 --- a/tests/packer/src/aa-update +++ b/tests/packer/src/aa-update @@ -13,15 +13,15 @@ DISTRIBUTION="$(_lsb_release)" cd "$HOME/Projects/apparmor.d" case "$DISTRIBUTION" in arch) - make pkg + just pkg ;; debian | ubuntu | whonix) sudo rm -rf debian/.debhelper/ - make dpkg + just dpkg sudo rm -rf debian/.debhelper/ ;; opensuse*) - make rpm + just rpm ;; *) ;; esac From 94bae18c2cabb0bfc88fb13fd3db794032e817ae Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Jul 2025 23:31:14 +0200 Subject: [PATCH 1128/1455] build: justfile: simplify test orchestration. --- Justfile | 31 +++++++------- docs/development/integration.md | 36 +++++++++++++++-- docs/development/vm.md | 72 ++++++++++++++++++--------------- docs/install.md | 1 + 4 files changed, 87 insertions(+), 53 deletions(-) diff --git a/Justfile b/Justfile index 7a84af1be..13a4a2d9e 100644 --- a/Justfile +++ b/Justfile @@ -284,6 +284,18 @@ destroy dist flavor: ssh dist flavor: @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` +[group('vm')] +[doc('Mount the shared directory on the machine')] +mount dist flavor: + @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + sh -c 'mount | grep 0a31bc478ef8e2461a4b1cc10a24cc4 || sudo mount 0a31bc478ef8e2461a4b1cc10a24cc4' + +[group('vm')] +[doc('Unmout the shared directory on the machine')] +umount dist flavor: + @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + sh -c 'true; sudo umount /home/{{username}}/Projects/apparmor.d || true' + [group('vm')] [doc('List the machines')] list: @@ -324,7 +336,6 @@ available: } ' - [group('tests')] [doc('Install dependencies for the integration tests')] init: @@ -349,30 +360,18 @@ tests-sync dist flavor: [group('tests')] [doc('Re-synchronize the integration tests (machine)')] -tests-resync dist flavor: (tests-mount dist flavor) \ +tests-resync dist flavor: (mount dist flavor) \ (tests-sync dist flavor) \ - (tests-umount dist flavor) - -[group('tests')] -[doc('Unmout the integration tests (machine)')] -tests-umount dist flavor: - @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ - sudo umount /home/{{username}}/Projects/apparmor.d + (umount dist flavor) [group('tests')] [doc('Run the integration tests (machine)')] -tests-run dist flavor name="": +tests-run dist flavor name="": (tests-resync dist flavor) ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ TERM=xterm \ bats --recursive --pretty --timing --print-output-on-failure \ /home/{{username}}/Projects/tests/integration/{{name}} -[group('tests')] -[doc('Mount integration tests (machine)')] -tests-mount dist flavor: - @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ - sudo mount 0a31bc478ef8e2461a4b1cc10a24cc4 - [private] get_ip dist flavor: @virsh --quiet --readonly {{c}} domifaddr {{prefix}}{{dist}}-{{flavor}} | \ diff --git a/docs/development/integration.md b/docs/development/integration.md index de60c8c47..b5c740f78 100644 --- a/docs/development/integration.md +++ b/docs/development/integration.md @@ -14,15 +14,43 @@ Although the integration test suite is intended to be run in a [Development VM]( ## Getting started -Prepare the test environment: +**Prepare the test environment:** ```sh just img -just vm +just create ``` -Run the integration tests on the test VM: +Example: ```sh -just integration +just img ubuntu25 desktop +just create ubuntu25 desktop +``` + +**Install dependencies for the integration tests** +```sh +just tests-init +``` + +Example: +```sh +just tests-init ubuntu25 desktop +``` + +**Run the integration tests** + +It: synchronizes the tests, unmount the shared directory, then run the tests. +```sh +just tests-run +``` + +Example: +```sh +just tests-run ubuntu25 desktop +``` + +Partial tests can also be run. For example the following command will only run the tests in the `tests/integration/apt` directory on the `ubuntu25` `desktop` machine: +```sh +just tests-run ubuntu25 desktop apt ``` ## Create integration tests diff --git a/docs/development/vm.md b/docs/development/vm.md index 1edddba76..1091f7d5e 100644 --- a/docs/development/vm.md +++ b/docs/development/vm.md @@ -13,53 +13,59 @@ $ just ``` Available recipes: - help # Show this help message - clean # Remove all build artifacts + help # Show this help message + clean # Remove all build artifacts [build] - build # Build the go programs - enforce # Prebuild the profiles in enforced mode - complain # Prebuild the profiles in complain mode - fsp # Prebuild the profiles in FSP mode - fsp-complain # Prebuild the profiles in FSP mode (complain) - fsp-debug # Prebuild the profiles in FSP mode (debug) + build # Build the go programs + enforce # Prebuild the profiles in enforced mode + complain # Prebuild the profiles in complain mode + fsp # Prebuild the profiles in FSP mode + fsp-complain # Prebuild the profiles in FSP mode (complain) + fsp-debug # Prebuild the profiles in FSP mode (debug) [install] - install # Install prebuild profiles - local +names # Locally install prebuild profiles - dev name # Prebuild, install, and load a dev profile + install # Install prebuild profiles + local +names # Locally install prebuild profiles + dev name # Prebuild, install, and load a dev profile [packages] - pkg # Build & install apparmor.d on Arch based systems - dpkg # Build & install apparmor.d on Debian based systems - rpm # Build & install apparmor.d on OpenSUSE based systems - package dist # Build the package in a clean OCI container + pkg # Build & install apparmor.d on Arch based systems + dpkg # Build & install apparmor.d on Debian based systems + rpm # Build & install apparmor.d on OpenSUSE based systems + package dist # Build the package in a clean OCI container [tests] - tests # Run the unit tests - init dist flavor # Install dependencies for the bats integration tests - integration dist flavor # Run the integration tests on the machine + tests # Run the unit tests + init # Install dependencies for the integration tests + integration # Run the integration tests + tests-init dist flavor # Install dependencies for the integration tests (machine) + tests-sync dist flavor # Synchronize the integration tests (machine) + tests-resync dist flavor # Re-synchronize the integration tests (machine) + tests-run dist flavor name="" # Run the integration tests (machine) [linter] - lint # Run the linters - check # Run style checks on the profiles + lint # Run the linters + check # Run style checks on the profiles [docs] - man # Generate the man pages - docs # Build the documentation - serve # Serve the documentation + man # Generate the man pages + docs # Build the documentation + serve # Serve the documentation [vm] - img dist flavor # Build the VM image - create dist flavor # Create the machine - up dist flavor # Start a machine - halt dist flavor # Stops the machine - reboot dist flavor # Reboot the machine - destroy dist flavor # Destroy the machine - ssh dist flavor # Connect to the machine - list # List the machines - images # List the VM images - available # List the VM images that can be created + img dist flavor # Build the VM image + create dist flavor # Create the machine + up dist flavor # Start a machine + halt dist flavor # Stops the machine + reboot dist flavor # Reboot the machine + destroy dist flavor # Destroy the machine + ssh dist flavor # Connect to the machine + mount dist flavor # Mount the shared directory on the machine + umount dist flavor # Unmout the shared directory on the machine + list # List the machines + images # List the VM images + available # List the VM images that can be created See https://apparmor.pujol.io/development/ for more information. ``` diff --git a/docs/install.md b/docs/install.md index 416ad0f15..ee18e7819 100644 --- a/docs/install.md +++ b/docs/install.md @@ -37,6 +37,7 @@ The following desktop environments are supported: **Build dependency** * Go >= 1.23 +* [just](https://github.com/casey/just) ## Configure AppArmor From 5adc29087031c8f63930434d5e50a1fca5670089 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Jul 2025 23:54:40 +0200 Subject: [PATCH 1129/1455] fix(profile): fixes some issues raised by tests. --- apparmor.d/abstractions/base.d/complete | 1 + apparmor.d/groups/utils/lsfd | 38 ++++++++++++++++--------- apparmor.d/groups/utils/lsipc | 2 ++ apparmor.d/profiles-m-r/mkinitramfs | 16 +++++------ 4 files changed, 35 insertions(+), 22 deletions(-) diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index ecfe09bb5..ad3945eb9 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -10,6 +10,7 @@ # Allow to receive some signals from new well-known profiles signal (receive) peer=btop, signal (receive) peer=htop, + signal (receive) peer=pkill, signal (receive) peer=sudo, signal (receive) peer=top, signal (receive) set=(cont,term,kill,stop) peer=systemd-shutdown, diff --git a/apparmor.d/groups/utils/lsfd b/apparmor.d/groups/utils/lsfd index 6b30f63a9..96e497ea6 100644 --- a/apparmor.d/groups/utils/lsfd +++ b/apparmor.d/groups/utils/lsfd @@ -11,15 +11,25 @@ profile lsfd @{exec_path} flags=(attach_disconnected) { include include + capability bpf, capability checkpoint_restore, capability dac_read_search, + capability net_admin, capability sys_admin, + capability sys_chroot, capability sys_ptrace, capability sys_resource, capability syslog, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 raw, + network inet6 stream, + network inet6 stream, network netlink dgram, network netlink raw, + network packet dgram, ptrace read, ptrace trace, @@ -38,20 +48,20 @@ profile lsfd @{exec_path} flags=(attach_disconnected) { @{sys}/kernel/cpu_byteorder r, - @{PROC}/ r, - @{PROC}/@{pid}/ r, - @{PROC}/@{pid}/comm r, - @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/fdinfo/@{int} r, - @{PROC}/@{pid}/mountinfo r, - @{PROC}/@{pid}/net/* r, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/task/ r, - @{PROC}/devices r, - @{PROC}/misc r, - @{PROC}/partitions r, - @{PROC}/tty/drivers r, - owner @{PROC}/@{pid}/syscall r, + @{PROC}/ r, + @{PROC}/@{pid}/ r, + @{PROC}/@{pid}/comm r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/mountinfo r, + @{PROC}/@{pid}/net/* r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/syscall r, + @{PROC}/@{pid}/task/ r, + @{PROC}/devices r, + @{PROC}/misc r, + @{PROC}/partitions r, + @{PROC}/tty/drivers r, include if exists } diff --git a/apparmor.d/groups/utils/lsipc b/apparmor.d/groups/utils/lsipc index 12c8d333c..7677a8a03 100644 --- a/apparmor.d/groups/utils/lsipc +++ b/apparmor.d/groups/utils/lsipc @@ -27,6 +27,8 @@ profile lsipc @{exec_path} { @{PROC}/sysvipc/sem r, @{PROC}/sysvipc/shm r, + /dev/mqueue/ r, + include if exists } diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index df76eb4ad..a7f046c55 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -93,14 +93,14 @@ profile mkinitramfs @{exec_path} { owner /var/lib/kdump/initramfs-tools/** rw, owner /var/lib/kdump/initrd.* rw, - /var/tmp/ r, - /var/tmp/mkinitramfs_@{rand6}/** w, - /var/tmp/modules_@{rand6} rw, - owner /var/tmp/mkinitramfs_@{rand6} rw, - owner /var/tmp/mkinitramfs_@{rand6}/ rw, - owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**, - owner /var/tmp/mkinitramfs-@{rand6} rw, - owner /var/tmp/mkinitramfs-*_@{rand6} rw, + /var/tmp/ r, + /var/tmp/mkinitramfs_@{rand6}/** w, + /var/tmp/modules_@{rand6} rw, + /var/tmp/mkinitramfs_@{rand6} rw, + /var/tmp/mkinitramfs_@{rand6}/ rw, + /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**, + /var/tmp/mkinitramfs-@{rand6} rw, + /var/tmp/mkinitramfs-*_@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, From cd15178c81789c4bd65cc2c370d9a3ed893186a2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 22 Jul 2025 23:55:46 +0200 Subject: [PATCH 1130/1455] tests(check): globally ignore check in commented lines. --- tests/check.sh | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index f00d8aec1..977846e62 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -70,6 +70,18 @@ _check() { continue fi + # Style check + if [[ $line_number -lt 10 ]]; then + _check_header + fi + _check_tabs + _check_trailing + _check_indentation + _check_vim + + # The following checks do not apply to comment lines + [[ "$line" =~ ^[[:space:]]*# ]] && continue + # Rules checks _check_abstractions _check_directory_mark @@ -84,15 +96,6 @@ _check() { _check_profile _check_subprofiles - # Style check - if [[ $line_number -lt 10 ]]; then - _check_header - fi - _check_tabs - _check_trailing - _check_indentation - _check_vim - done <"$file" # Results @@ -139,7 +142,6 @@ _check_directory_mark() { for pattern in "${DIRECTORIES[@]}"; do if [[ "$line" == *"$pattern"* ]]; then [[ "$line" == *'='* ]] && continue - [[ "$line" =~ ^[[:space:]]*# ]] && continue if [[ ! "$line" == *"$pattern/"* ]]; then _err issue "$file:$line_number" "missing directory mark: '$pattern' instead of '$pattern/'" fi From 2721cf6253dda72a37ab644ac78ca338496f3636 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 23 Jul 2025 00:59:12 +0200 Subject: [PATCH 1131/1455] build: ensure just compatibility with ubuntu 24.04 --- .github/workflows/main.yml | 12 ++++++++---- .gitlab-ci.yml | 2 +- docs/install.md | 11 ++++++++++- 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index a3d7b3266..bcb817338 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -11,8 +11,8 @@ jobs: - name: Install linter dependencies run: | - sudo apt-get update -q - sudo apt-get install -y just + pipx install rust-just + echo "$HOME/.local/bin" >> $GITHUB_PATH - name: Run basic profile linter check run: | @@ -37,7 +37,9 @@ jobs: sudo apt-get update -q sudo apt-get install -y \ devscripts debhelper config-package-dev \ - auditd apparmor-profiles apparmor-utils just + auditd apparmor-profiles apparmor-utils + pipx install rust-just + echo "$HOME/.local/bin" >> $GITHUB_PATH sudo rm /etc/apparmor.d/usr.lib.snapd.snap-confine.real - name: Build the apparmor.d package @@ -100,7 +102,9 @@ jobs: sudo apt-get update -q sudo apt-get install -y \ apparmor-profiles apparmor-utils \ - bats bats-support just + bats bats-support + pipx install rust-just + echo "$HOME/.local/bin" >> $GITHUB_PATH - name: Install apparmor.d run: | diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 7b4c13519..c07695b25 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -146,7 +146,7 @@ preprocess-archlinux: preprocess-debian: stage: preprocess - image: debian + image: debian:trixie dependencies: - debian script: diff --git a/docs/install.md b/docs/install.md index ee18e7819..a56599c22 100644 --- a/docs/install.md +++ b/docs/install.md @@ -37,7 +37,7 @@ The following desktop environments are supported: **Build dependency** * Go >= 1.23 -* [just](https://github.com/casey/just) +* [just](https://github.com/casey/just) >= 1.40.0 ## Configure AppArmor @@ -88,6 +88,15 @@ echo 'Optimize=compress-fast' | sudo tee -a /etc/apparmor/parser.conf just dpkg ``` + !!! note + + **Ubuntu 24.04 user will need to:** + + Install [just](https://github.com/casey/just). E.g: + ```sh + pipx install rust-just + ``` + !!! warning **Beware**: do not install a `.deb` made for Debian on Ubuntu as the packages are different. From 3db6d073599294d278b3b21c4a7304e5e754a6cd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 23 Jul 2025 01:03:40 +0200 Subject: [PATCH 1132/1455] fix(test): running integration tests in ci. --- Justfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Justfile b/Justfile index 13a4a2d9e..db23ad587 100644 --- a/Justfile +++ b/Justfile @@ -344,7 +344,7 @@ init: [group('tests')] [doc('Run the integration tests')] integration: - bats --recursive --pretty --timing --print-output-on-failure tests/integration + TERM=xterm bats --recursive --pretty --timing --print-output-on-failure tests/integration [group('tests')] [doc('Install dependencies for the integration tests (machine)')] @@ -368,7 +368,6 @@ tests-resync dist flavor: (mount dist flavor) \ [doc('Run the integration tests (machine)')] tests-run dist flavor name="": (tests-resync dist flavor) ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ - TERM=xterm \ bats --recursive --pretty --timing --print-output-on-failure \ /home/{{username}}/Projects/tests/integration/{{name}} From 9c55d62b85c4d806b33813993d5831c8c3d3b72b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 25 Jul 2025 00:56:31 +0200 Subject: [PATCH 1133/1455] fix: small ci fixes. --- Justfile | 2 +- apparmor.d/groups/apt/dpkg-preconfigure | 2 +- apparmor.d/groups/apt/dpkg-script-linux | 2 ++ apparmor.d/groups/apt/dpkg-scripts | 6 ++---- apparmor.d/profiles-g-l/gtk-update-icon-cache | 2 ++ apparmor.d/profiles-s-z/ucf | 2 +- apparmor.d/profiles-s-z/ucfr | 9 +++++---- 7 files changed, 14 insertions(+), 11 deletions(-) diff --git a/Justfile b/Justfile index db23ad587..e640a5a98 100644 --- a/Justfile +++ b/Justfile @@ -344,7 +344,7 @@ init: [group('tests')] [doc('Run the integration tests')] integration: - TERM=xterm bats --recursive --pretty --timing --print-output-on-failure tests/integration + bats --recursive --timing --print-output-on-failure tests/integration [group('tests')] [doc('Install dependencies for the integration tests (machine)')] diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index 66131c6e7..2e32af979 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -36,7 +36,7 @@ profile dpkg-preconfigure @{exec_path} { @{bin}/stty ix, @{bin}/tr ix, @{bin}/uniq ix, - @{bin}/which{,.debianutils} ix, + @{bin}/which{,.debianutils} rix, @{bin}/apt-extracttemplates Px, @{bin}/dpkg Px -> child-dpkg, diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux index 24c6c74df..b294b928b 100644 --- a/apparmor.d/groups/apt/dpkg-script-linux +++ b/apparmor.d/groups/apt/dpkg-script-linux @@ -43,6 +43,8 @@ profile dpkg-script-linux @{exec_path} { include include + capability net_admin, + include if exists } diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 5743ab904..b262040f7 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -62,10 +62,8 @@ profile dpkg-scripts @{exec_path} { @{bin}/ r, @{bin}/* w, @{lib}/ r, - @{lib}/@{python_name}/**/__pycache__/ w, - @{lib}/@{python_name}/**/__pycache__/**.pyc w, - @{lib}/@{python_name}/**/__pycache__/**.pyc.@{u64} w, - @{lib}/modules/*/.fresh-install w, + @{lib}/** w, + /opt/*/** rw, /etc/ r, /etc/** rw, diff --git a/apparmor.d/profiles-g-l/gtk-update-icon-cache b/apparmor.d/profiles-g-l/gtk-update-icon-cache index b1a6779ae..b709511e2 100644 --- a/apparmor.d/profiles-g-l/gtk-update-icon-cache +++ b/apparmor.d/profiles-g-l/gtk-update-icon-cache @@ -12,6 +12,8 @@ profile gtk-update-icon-cache @{exec_path} flags=(attach_disconnected) { include include + capability fowner, + @{exec_path} mr, @{system_share_dirs}/icons/{,**/} r, diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf index 9e459f261..59f2d40aa 100644 --- a/apparmor.d/profiles-s-z/ucf +++ b/apparmor.d/profiles-s-z/ucf @@ -14,7 +14,7 @@ profile ucf @{exec_path} { include include - @{exec_path} r, + @{exec_path} rix, @{sh_path} rix, @{bin}/{,e}grep rix, diff --git a/apparmor.d/profiles-s-z/ucfr b/apparmor.d/profiles-s-z/ucfr index add5c5b64..4cc149a28 100644 --- a/apparmor.d/profiles-s-z/ucfr +++ b/apparmor.d/profiles-s-z/ucfr @@ -9,18 +9,19 @@ include @{exec_path} = @{bin}/ucfr profile ucfr @{exec_path} { include + include @{exec_path} mr, @{sh_path} r, - @{bin}/basename ix, - @{bin}/{m,g,}awk ix, - @{bin}/getopt ix, @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{bin}/basename ix, + @{bin}/dirname ix, + @{bin}/getopt ix, @{bin}/id ix, @{bin}/readlink ix, @{bin}/sed ix, - @{bin}/dirname ix, /usr/share/ucf/{,**} r, From 031e1b2b0764c5a81d67f10295405a454a7e641f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 16:54:02 +0200 Subject: [PATCH 1134/1455] feat: apply new linter recommendations. --- apparmor.d/abstractions/app/open | 2 +- apparmor.d/abstractions/ibus.d/complete | 4 ++-- apparmor.d/groups/cron/cron-debtags | 4 ++-- apparmor.d/groups/filesystem/udiskie-info | 3 ++- apparmor.d/groups/filesystem/udiskie-mount | 3 ++- apparmor.d/groups/filesystem/udiskie-umount | 3 ++- apparmor.d/groups/gnome/gdm-session-worker | 6 +++--- apparmor.d/groups/gpg/gpgsm | 4 ++-- apparmor.d/groups/grub/grub-multi-install | 2 +- apparmor.d/groups/kde/sddm | 2 +- apparmor.d/groups/network/mullvad-daemon | 2 +- apparmor.d/groups/pacman/archlinux-java | 2 +- apparmor.d/groups/pacman/paccache | 2 +- apparmor.d/groups/pacman/pacman-hook-dconf | 2 +- apparmor.d/groups/pacman/pacman-hook-depmod | 4 ++-- apparmor.d/groups/pacman/pacman-hook-fontconfig | 2 +- apparmor.d/groups/pacman/pacman-hook-gio | 4 ++-- apparmor.d/groups/pacman/pacman-hook-gtk | 2 +- apparmor.d/groups/pacman/pacman-hook-mkinitcpio | 2 +- apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove | 2 +- apparmor.d/groups/pacman/pacman-key | 4 ++-- apparmor.d/groups/procps/sysctl | 2 +- apparmor.d/groups/systemd/systemd-binfmt | 3 ++- apparmor.d/groups/systemd/systemd-sysctl | 2 +- apparmor.d/groups/systemd/systemd-sysusers | 2 +- apparmor.d/groups/systemd/systemd-tmpfiles | 4 ++-- apparmor.d/groups/ubuntu/apt_news | 2 +- apparmor.d/groups/ubuntu/esm_cache | 2 +- apparmor.d/groups/ubuntu/subiquity-console-conf | 2 +- apparmor.d/groups/virt/containerd-shim-runc-v2 | 4 ++-- apparmor.d/groups/virt/dockerd | 4 ++-- apparmor.d/profiles-a-f/aspell | 2 +- apparmor.d/profiles-a-f/aspell-autobuildhash | 4 ++-- apparmor.d/profiles-g-l/gajim | 2 +- apparmor.d/profiles-g-l/gpu-manager | 2 +- apparmor.d/profiles-g-l/hardinfo | 7 +++---- apparmor.d/profiles-g-l/hwinfo | 4 ++-- apparmor.d/profiles-g-l/ip | 4 ++-- apparmor.d/profiles-g-l/kmod | 2 +- apparmor.d/profiles-m-r/mkinitramfs | 5 +++-- apparmor.d/profiles-m-r/needrestart-iucode-scan-versions | 6 +++--- apparmor.d/profiles-m-r/pcb-gtk | 2 +- apparmor.d/profiles-m-r/resolvconf | 2 +- 43 files changed, 67 insertions(+), 63 deletions(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index 2a43affcf..9d0da2199 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -36,7 +36,7 @@ /etc/xdg/menus/ r, - owner @{run}/user//@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, @{PROC}/sys/kernel/random/boot_id r, diff --git a/apparmor.d/abstractions/ibus.d/complete b/apparmor.d/abstractions/ibus.d/complete index 5c53b9fa1..8132d38a9 100644 --- a/apparmor.d/abstractions/ibus.d/complete +++ b/apparmor.d/abstractions/ibus.d/complete @@ -15,11 +15,11 @@ # peer=(addr="@@{user_cache_dirs}/ibus/dbus-????????"), unix (connect, receive, send) type=stream - peer=(addr="@/home/*/.cache/ibus/dbus-????????"), + peer=(addr="@/home/*/.cache/ibus/dbus-????????"), #aa:lint ignore unix (connect, send, receive, accept, bind, listen) type=stream - addr="@/home/*/.cache/ibus/dbus-????????", + addr="@/home/*/.cache/ibus/dbus-????????", #aa:lint ignore dbus receive bus=session path=/org/freedesktop/IBus interface=org.freedesktop.DBus.Peer diff --git a/apparmor.d/groups/cron/cron-debtags b/apparmor.d/groups/cron/cron-debtags index 3e6c182a7..ea9086948 100644 --- a/apparmor.d/groups/cron/cron-debtags +++ b/apparmor.d/groups/cron/cron-debtags @@ -12,9 +12,9 @@ profile cron-debtags @{exec_path} { include @{exec_path} r, - @{sh_path} rix, - /usr/bin/debtags rPx, + @{sh_path} rix, + @{bin}/debtags rPx, include if exists } diff --git a/apparmor.d/groups/filesystem/udiskie-info b/apparmor.d/groups/filesystem/udiskie-info index 0b39fd3dc..b59b91472 100644 --- a/apparmor.d/groups/filesystem/udiskie-info +++ b/apparmor.d/groups/filesystem/udiskie-info @@ -15,7 +15,8 @@ profile udiskie-info @{exec_path} { @{exec_path} r, @{python_path} r, - /usr/bin/ r, + @{bin}/ r, + @{sbin}/ r, owner @{user_config_dirs}/udiskie/ r, owner @{user_config_dirs}/udiskie/config.yml r, diff --git a/apparmor.d/groups/filesystem/udiskie-mount b/apparmor.d/groups/filesystem/udiskie-mount index 0513a8c35..3ec9e422a 100644 --- a/apparmor.d/groups/filesystem/udiskie-mount +++ b/apparmor.d/groups/filesystem/udiskie-mount @@ -15,7 +15,8 @@ profile udiskie-mount @{exec_path} { @{exec_path} r, @{python_path} r, - /usr/bin/ r, + @{bin}/ r, + @{sbin}/ r, owner @{user_config_dirs}/udiskie/ r, owner @{user_config_dirs}/udiskie/config.yml r, diff --git a/apparmor.d/groups/filesystem/udiskie-umount b/apparmor.d/groups/filesystem/udiskie-umount index cf147b875..01271bdc6 100644 --- a/apparmor.d/groups/filesystem/udiskie-umount +++ b/apparmor.d/groups/filesystem/udiskie-umount @@ -15,7 +15,8 @@ profile udiskie-umount @{exec_path} { @{exec_path} r, @{python_path} r, - /usr/bin/ r, + @{bin}/ r, + @{sbin}/ r, owner @{user_config_dirs}/udiskie/ r, owner @{user_config_dirs}/udiskie/config.yml r, diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index a5dac16fa..2e4a44c4e 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -100,9 +100,9 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { owner /.fscrypt/protectors/@{hex16} r, /home/ r, - /home/.fscrypt/policies/ r, - owner /home/.fscrypt/policies/@{hex32} r, - owner /home/.fscrypt/protectors/@{hex16}.link r, + /home/.fscrypt/policies/ r, #aa:lint ignore + owner /home/.fscrypt/policies/@{hex32} r, #aa:lint ignore + owner /home/.fscrypt/protectors/@{hex16}.link r, #aa:lint ignore owner @{HOME}/.pam_environment r, diff --git a/apparmor.d/groups/gpg/gpgsm b/apparmor.d/groups/gpg/gpgsm index bfa71cf53..2ef1a9d4a 100644 --- a/apparmor.d/groups/gpg/gpgsm +++ b/apparmor.d/groups/gpg/gpgsm @@ -23,11 +23,11 @@ profile gpgsm @{exec_path} { /etc/gcrypt/hwf.deny r, - deny /usr/bin/.gnupg/ w, + owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, - owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**, + deny @{bin}/.gnupg/ w, include if exists } diff --git a/apparmor.d/groups/grub/grub-multi-install b/apparmor.d/groups/grub/grub-multi-install index ba7956438..e671d32fb 100644 --- a/apparmor.d/groups/grub/grub-multi-install +++ b/apparmor.d/groups/grub/grub-multi-install @@ -26,7 +26,7 @@ profile grub-multi-install @{exec_path} { @{bin}/udevadm rPx, /usr/share/debconf/frontend rix, - /usr/lib/terminfo/x/xterm-256color r, + @{lib}/terminfo/x/xterm-256color r, /usr/share/debconf/confmodule r, /boot/grub/grub.cfg rw, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 396f256cc..143df5c9e 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -114,7 +114,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{etc_ro}/sddm/Xsession rPx, @{etc_ro}/X11/xdm/Xsession rPx, - /usr/etc/X11/xdm/Xsetup rix, + @{etc_ro}/X11/xdm/Xsetup rix, /usr/share/sddm/scripts/wayland-session rix, /usr/share/sddm/scripts/Xsession rix, /usr/share/sddm/scripts/Xsetup rix, diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index 9573d7044..735154b7e 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -30,7 +30,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { network netlink raw, network netlink dgram, - mount fstype=cgroup -> /sys/fs/cgroup/net_cls/, + mount fstype=cgroup -> @{sys}/fs/cgroup/net_cls/, @{exec_path} mr, diff --git a/apparmor.d/groups/pacman/archlinux-java b/apparmor.d/groups/pacman/archlinux-java index fe83e168d..38cd95d0a 100644 --- a/apparmor.d/groups/pacman/archlinux-java +++ b/apparmor.d/groups/pacman/archlinux-java @@ -14,8 +14,8 @@ profile archlinux-java @{exec_path} { @{exec_path} mr, + @{sh_path} rix, @{bin}/basename rix, - @{bin}/bash rix, @{bin}/dirname rix, @{bin}/find rix, @{bin}/id rix, diff --git a/apparmor.d/groups/pacman/paccache b/apparmor.d/groups/pacman/paccache index 8bf1aed6a..8331951e7 100644 --- a/apparmor.d/groups/pacman/paccache +++ b/apparmor.d/groups/pacman/paccache @@ -16,8 +16,8 @@ profile paccache @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{sh_path} rix, @{bin}/{m,g,}awk rix, - @{bin}/bash rix, @{bin}/cat rix, @{bin}/gettext rix, @{bin}/gpg{,2} rix, diff --git a/apparmor.d/groups/pacman/pacman-hook-dconf b/apparmor.d/groups/pacman/pacman-hook-dconf index b5a330d75..c49eb08e9 100644 --- a/apparmor.d/groups/pacman/pacman-hook-dconf +++ b/apparmor.d/groups/pacman/pacman-hook-dconf @@ -14,7 +14,7 @@ profile pacman-hook-dconf @{exec_path} { @{exec_path} mr, - @{bin}/bash rix, + @{sh_path} rix, @{bin}/rm rix, @{bin}/dconf rPx, diff --git a/apparmor.d/groups/pacman/pacman-hook-depmod b/apparmor.d/groups/pacman/pacman-hook-depmod index ce41d6ae8..0dae14351 100644 --- a/apparmor.d/groups/pacman/pacman-hook-depmod +++ b/apparmor.d/groups/pacman/pacman-hook-depmod @@ -14,13 +14,13 @@ profile pacman-hook-depmod @{exec_path} { @{exec_path} mr, + @{sh_path} rix, @{bin}/basename rix, - @{bin}/bash rix, @{bin}/kmod rPx, @{bin}/rm rix, @{bin}/rmdir rix, - /usr/lib/modules/*/{,**} rw, + @{lib}/modules/*/{,**} rw, /dev/tty rw, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/pacman/pacman-hook-fontconfig b/apparmor.d/groups/pacman/pacman-hook-fontconfig index de0d33e16..3b29e01ea 100644 --- a/apparmor.d/groups/pacman/pacman-hook-fontconfig +++ b/apparmor.d/groups/pacman/pacman-hook-fontconfig @@ -14,7 +14,7 @@ profile pacman-hook-fontconfig @{exec_path} { @{exec_path} mr, - @{bin}/bash rix, + @{sh_path} rix, @{bin}/ln rix, @{bin}/rm rix, diff --git a/apparmor.d/groups/pacman/pacman-hook-gio b/apparmor.d/groups/pacman/pacman-hook-gio index 5aa612a3c..17218158e 100644 --- a/apparmor.d/groups/pacman/pacman-hook-gio +++ b/apparmor.d/groups/pacman/pacman-hook-gio @@ -14,14 +14,14 @@ profile pacman-hook-gio @{exec_path} { @{exec_path} mr, - @{bin}/bash rix, + @{sh_path} rix, @{bin}/rmdir rix, @{bin}/gio-querymodules rPx, @{lib}/gio/modules/giomodule.cache{,.[0-9A-Z]*} rw, @{lib}/gtk-{3,4}.0/**/*/ rw, - /usr/lib/gio/modules/ rw, + @{lib}/gio/modules/ rw, /dev/tty rw, diff --git a/apparmor.d/groups/pacman/pacman-hook-gtk b/apparmor.d/groups/pacman/pacman-hook-gtk index ce7b931ca..e6aa28627 100644 --- a/apparmor.d/groups/pacman/pacman-hook-gtk +++ b/apparmor.d/groups/pacman/pacman-hook-gtk @@ -14,7 +14,7 @@ profile pacman-hook-gtk @{exec_path} { @{exec_path} mr, - @{bin}/bash rix, + @{sh_path} rix, @{bin}/rm rix, @{bin}/rmdir rix, diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio index a9bf40360..68c958f4b 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio @@ -16,7 +16,7 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/bash rix, + @{sh_path} rix, @{bin}/cmp rix, @{bin}/compgen rix, @{bin}/env rix, diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove index 7c0006153..d30cf1342 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove @@ -15,7 +15,7 @@ profile pacman-hook-mkinitcpio-remove @{exec_path} { @{exec_path} mr, - @{bin}/bash rix, + @{sh_path} rix, @{bin}/cmp rix, @{bin}/mv rix, @{bin}/rm rix, diff --git a/apparmor.d/groups/pacman/pacman-key b/apparmor.d/groups/pacman/pacman-key index 9e3bde188..1e1204c27 100644 --- a/apparmor.d/groups/pacman/pacman-key +++ b/apparmor.d/groups/pacman/pacman-key @@ -16,9 +16,9 @@ profile pacman-key @{exec_path} { @{exec_path} mr, + @{sh_path} rix, @{bin}/{m,g,}awk rix, @{bin}/basename rix, - @{bin}/bash rix, @{bin}/chmod rix, @{bin}/gettext rix, @{bin}/gpg{,2} rCx -> &gpg, @@ -60,7 +60,7 @@ profile pacman-key @{exec_path} { /etc/pacman.d/gnupg/ rw, /etc/pacman.d/gnupg/** rwkl, - @{HOME}/.gnupg/gpg.conf r, + @{HOME}/@{XDG_GPG_DIR}/gpg.conf r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/groups/procps/sysctl b/apparmor.d/groups/procps/sysctl index 3131befeb..9275c7054 100644 --- a/apparmor.d/groups/procps/sysctl +++ b/apparmor.d/groups/procps/sysctl @@ -22,7 +22,7 @@ profile sysctl @{exec_path} { /etc/sysctl.conf r, /etc/sysctl.d/{,**} r, - /usr/lib/sysctl.d/{,**} r, + @{lib}/sysctl.d/{,**} r, /etc/ufw/sysctl.conf r, # Add support for ufw diff --git a/apparmor.d/groups/systemd/systemd-binfmt b/apparmor.d/groups/systemd/systemd-binfmt index d34bbe4cb..5e3406ea9 100644 --- a/apparmor.d/groups/systemd/systemd-binfmt +++ b/apparmor.d/groups/systemd/systemd-binfmt @@ -16,11 +16,12 @@ profile systemd-binfmt @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/* r, + @{sbin}/* r, # Config file locations /etc/binfmt.d/{,*.conf} r, @{run}/binfmt.d/{,*.conf} r, - /usr/lib/binfmt.d/{,*.conf} r, + @{lib}/binfmt.d/{,*.conf} r, @{PROC}/sys/fs/binfmt_misc/register w, @{PROC}/sys/fs/binfmt_misc/status w, diff --git a/apparmor.d/groups/systemd/systemd-sysctl b/apparmor.d/groups/systemd/systemd-sysctl index 454105011..87e0ede5c 100644 --- a/apparmor.d/groups/systemd/systemd-sysctl +++ b/apparmor.d/groups/systemd/systemd-sysctl @@ -25,7 +25,7 @@ profile systemd-sysctl @{exec_path} flags=(attach_disconnected) { @{run}/sysctl.d/{,*.conf} r, /etc/sysctl.conf r, /etc/sysctl.d/{,*.conf} r, - /usr/lib/sysctl.d/{,*.conf} r, + @{lib}/sysctl.d/{,*.conf} r, @{PROC}/sys/** rw, diff --git a/apparmor.d/groups/systemd/systemd-sysusers b/apparmor.d/groups/systemd/systemd-sysusers index 254faeca0..2d250f63c 100644 --- a/apparmor.d/groups/systemd/systemd-sysusers +++ b/apparmor.d/groups/systemd/systemd-sysusers @@ -25,7 +25,7 @@ profile systemd-sysusers @{exec_path} flags=(attach_disconnected) { # Config file locations /etc/sysusers.d/{,*.conf} r, @{run}/sysusers.d/{,*.conf} r, - /usr/lib/sysusers.d/{,*.conf} r, + @{lib}/sysusers.d/{,*.conf} r, # Where the users can be created, /home/{,*} rw, diff --git a/apparmor.d/groups/systemd/systemd-tmpfiles b/apparmor.d/groups/systemd/systemd-tmpfiles index e37073f47..0e1e404ab 100644 --- a/apparmor.d/groups/systemd/systemd-tmpfiles +++ b/apparmor.d/groups/systemd/systemd-tmpfiles @@ -30,7 +30,7 @@ profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) { # Config file locations /etc/tmpfiles.d/{,*.conf} r, @{run}/tmpfiles.d/{,*.conf} r, - /usr/lib/tmpfiles.d/{,*.conf} r, + @{lib}/tmpfiles.d/{,*.conf} r, @{user_config_dirs}/user-tmpfiles.d/{,*.conf} r, @{run}/user/@{uid}/user-tmpfiles.d/{,*.conf} r, @{user_share_dirs}/user-tmpfiles.d/{,*.conf} r, @@ -42,7 +42,7 @@ profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) { /etc/{,**} rw, /home/ rw, /opt/{,**} rw, - /run/{,**} rw, + @{run}/{,**} rw, /srv/{,**} rw, /tmp/{,**} rwk, /usr/{,**} rw, diff --git a/apparmor.d/groups/ubuntu/apt_news b/apparmor.d/groups/ubuntu/apt_news index faf15dfbe..7f4e8fbe2 100644 --- a/apparmor.d/groups/ubuntu/apt_news +++ b/apparmor.d/groups/ubuntu/apt_news @@ -6,7 +6,7 @@ abi , include -@{exec_path} = /usr/lib/ubuntu-advantage/apt_news.py +@{exec_path} = @{lib}/ubuntu-advantage/apt_news.py profile apt_news @{exec_path} flags=(attach_disconnected) { include include diff --git a/apparmor.d/groups/ubuntu/esm_cache b/apparmor.d/groups/ubuntu/esm_cache index 2596d6c12..53238564a 100644 --- a/apparmor.d/groups/ubuntu/esm_cache +++ b/apparmor.d/groups/ubuntu/esm_cache @@ -6,7 +6,7 @@ abi , include -@{exec_path} = /usr/lib/ubuntu-advantage/esm_cache.py +@{exec_path} = @{lib}/ubuntu-advantage/esm_cache.py profile esm_cache @{exec_path} { include include diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index dc67817ed..a5b65f5b3 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -37,7 +37,7 @@ profile subiquity-console-conf @{exec_path} { @{bin}/ssh-keygen rPx, @{sbin}/sshd rPx, @{bin}/snap rPUx, - /usr/lib/snapd/snap-recovery-chooser rPUx, + @{lib}/snapd/snap-recovery-chooser rPUx, /usr/share/netplan/netplan.script rPx, /usr/share/subiquity/{,**} r, diff --git a/apparmor.d/groups/virt/containerd-shim-runc-v2 b/apparmor.d/groups/virt/containerd-shim-runc-v2 index 61898a3e4..04b355a48 100644 --- a/apparmor.d/groups/virt/containerd-shim-runc-v2 +++ b/apparmor.d/groups/virt/containerd-shim-runc-v2 @@ -25,8 +25,8 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) { signal (send) set=kill peer=cri-containerd.apparmor.d, signal (receive) set=kill peer=containerd, - mount -> /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/, - umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/, + mount -> @{run}/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/, + umount @{run}/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/, @{exec_path} mrix, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index c21fa2788..c57f7a9f8 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -38,7 +38,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { mount /tmp/containerd-mount@{int}/, mount /var/lib/docker/**/, - mount options=(rw bind) -> /run/docker/netns/*, + mount options=(rw bind) -> @{run}/docker/netns/*, mount options=(rw rprivate) -> /.pivot_root@{int}/, mount options=(rw rslave) -> /, @@ -46,7 +46,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { remount /var/lib/docker/**/, umount /.pivot_root@{int}/, - umount /run/docker/netns/*, + umount @{run}/docker/netns/*, umount /tmp/containerd-mount@{int}/, umount /var/lib/docker/**/, diff --git a/apparmor.d/profiles-a-f/aspell b/apparmor.d/profiles-a-f/aspell index 16b5b6f6d..629caca10 100644 --- a/apparmor.d/profiles-a-f/aspell +++ b/apparmor.d/profiles-a-f/aspell @@ -16,7 +16,7 @@ profile aspell @{exec_path} flags=(complain) { /usr/share/aspell/{,*} r, - /usr/lib/aspell/{,*} r, + @{lib}/aspell/{,*} r, /var/lib/aspell/{,*} r, /var/lib/aspell/*.rws rw, diff --git a/apparmor.d/profiles-a-f/aspell-autobuildhash b/apparmor.d/profiles-a-f/aspell-autobuildhash index e8a83892a..14feb75df 100644 --- a/apparmor.d/profiles-a-f/aspell-autobuildhash +++ b/apparmor.d/profiles-a-f/aspell-autobuildhash @@ -32,8 +32,8 @@ profile aspell-autobuildhash @{exec_path} flags=(complain) { /usr/share/aspell/{,*} r, - /usr/lib/aspell/{,*} r, - /usr/lib/aspell/*.rws rw, + @{lib}/aspell/{,*} r, + @{lib}/aspell/*.rws rw, /var/lib/aspell/ r, /var/lib/aspell/* rw, diff --git a/apparmor.d/profiles-g-l/gajim b/apparmor.d/profiles-g-l/gajim index 1dcdf8042..561e1af61 100644 --- a/apparmor.d/profiles-g-l/gajim +++ b/apparmor.d/profiles-g-l/gajim @@ -73,7 +73,7 @@ profile gajim @{exec_path} { owner @{user_cache_dirs}/gajim/** rwk, owner @{user_cache_dirs}/farstream/ rw, - owner @{user_cache_dirs}/farstream/codecs.audio.x86_64.cache{,.tmp@{rand6}} rw, + owner @{user_cache_dirs}/farstream/codecs.audio.@{arch}.cache{,.tmp@{rand6}} rw, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-g-l/gpu-manager b/apparmor.d/profiles-g-l/gpu-manager index 719625dbd..0ad848c50 100644 --- a/apparmor.d/profiles-g-l/gpu-manager +++ b/apparmor.d/profiles-g-l/gpu-manager @@ -20,7 +20,7 @@ profile gpu-manager @{exec_path} { @{bin}/{,e}grep rix, /etc/modprobe.d/{,**} r, - /usr/lib/modprobe.d/{,**} r, + @{lib}/modprobe.d/{,**} r, /var/lib/ubuntu-drivers-common/* rw, diff --git a/apparmor.d/profiles-g-l/hardinfo b/apparmor.d/profiles-g-l/hardinfo index b63a9e5ed..5d78a90e3 100644 --- a/apparmor.d/profiles-g-l/hardinfo +++ b/apparmor.d/profiles-g-l/hardinfo @@ -58,7 +58,7 @@ profile hardinfo @{exec_path} { @{bin}/netstat rPx, @{bin}/qtchooser rPx, - @{lib}/jvm/java-[0-9]*-openjdk-amd64/bin/javac rCx -> javac, + @{lib}/jvm/java-[0-9]*-openjdk-@{arch}/bin/javac rCx -> javac, /usr/share/gdb/python/ r, /usr/share/gdb/python/** r, @@ -132,9 +132,8 @@ profile hardinfo @{exec_path} { include include - @{lib}/jvm/java-[0-9]*-openjdk-amd64/bin/* mr, - - @{lib}/jvm/java-[0-9]*-openjdk-amd64/lib/** mr, + @{lib}/jvm/java-[0-9]*-openjdk-@{arch}/bin/* mr, + @{lib}/jvm/java-[0-9]*-openjdk-@{arch}/lib/** mr, /etc/java-[0-9]*-openjdk/** r, diff --git a/apparmor.d/profiles-g-l/hwinfo b/apparmor.d/profiles-g-l/hwinfo index 314975208..04a1d8f57 100644 --- a/apparmor.d/profiles-g-l/hwinfo +++ b/apparmor.d/profiles-g-l/hwinfo @@ -13,9 +13,9 @@ profile hwinfo @{exec_path} { include capability net_raw, # Needed for network related options - capability sys_admin, # Needed for /proc/ioports + capability sys_admin, # Needed for @{PROC}/ioports capability sys_rawio, # Needed for disk related options - capability syslog, # Needed for /proc/kmsg + capability syslog, # Needed for @{PROC}/kmsg network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-g-l/ip b/apparmor.d/profiles-g-l/ip index bcb521c01..0a27c4b59 100644 --- a/apparmor.d/profiles-g-l/ip +++ b/apparmor.d/profiles-g-l/ip @@ -20,7 +20,7 @@ profile ip @{exec_path} flags=(attach_disconnected) { network netlink raw, - mount fstype=sysfs -> /sys/, + mount fstype=sysfs -> @{sys}, mount options=(rw bind) / -> @{run}/netns/*, mount options=(rw rbind) @{run}/netns/ -> @{run}/netns/, mount options=(rw, bind) @{att}/ -> @{run}/netns/*, @@ -29,7 +29,7 @@ profile ip @{exec_path} flags=(attach_disconnected) { mount options=(rw, rslave) -> /, umount @{run}/netns/*, - umount /sys/, + umount @{sys}, @{exec_path} mrix, diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index a793bf707..5099c53f3 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -74,7 +74,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) { /etc/sysctl.conf r, /etc/sysctl.d/{,**} r, - /usr/lib/sysctl.d/{,**} r, + @{lib}/sysctl.d/{,**} r, include if exists } diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index a7f046c55..7d1394e2a 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -69,10 +69,11 @@ profile mkinitramfs @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/linux-version rPx, - /usr/share/initramfs-tools/hooks/** rPx, - /usr/share/initramfs-tools/scripts/** rPx, + @{lib}/initramfs-tools/hooks/** rPx, /etc/initramfs-tools/hooks/** rPx, /etc/initramfs-tools/scripts/** rPx, + /usr/share/initramfs-tools/hooks/** rPx, + /usr/share/initramfs-tools/scripts/** rPx, /usr/share/initramfs-tools/{,**} r, /etc/initramfs-tools/{,**} r, diff --git a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions index d75301fc6..a8189694e 100644 --- a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions +++ b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions @@ -19,14 +19,14 @@ profile needrestart-iucode-scan-versions @{exec_path} { @{sbin}/iucode_tool rix, /usr/share/misc/ r, - /usr/share/misc/amd64-microcode* r, + /usr/share/misc/amd-microcode* r /usr/share/misc/intel-microcode* r, - /etc/default/amd64-microcode r, + /etc/default/amd-microcode r, /etc/default/intel-microcode r, /etc/needrestart/iucode.sh r, - /boot/amd64-ucode.img r, + /boot/amd-ucode.img r, /boot/intel-ucode.img r, /boot/early_ucode.cpio r, diff --git a/apparmor.d/profiles-m-r/pcb-gtk b/apparmor.d/profiles-m-r/pcb-gtk index 2f057f2a7..2923f70cd 100644 --- a/apparmor.d/profiles-m-r/pcb-gtk +++ b/apparmor.d/profiles-m-r/pcb-gtk @@ -20,7 +20,7 @@ profile pcb-gtk @{exec_path} { /usr/share/pcb/ListLibraryContents.sh rix, - @{bin}/dash rix, + @{sh_path} rix, @{bin}/cat rix, @{bin}/tr rix, diff --git a/apparmor.d/profiles-m-r/resolvconf b/apparmor.d/profiles-m-r/resolvconf index a83c867fa..8e39c7620 100644 --- a/apparmor.d/profiles-m-r/resolvconf +++ b/apparmor.d/profiles-m-r/resolvconf @@ -26,7 +26,7 @@ profile resolvconf @{exec_path} { @{bin}/systemctl rCx -> systemctl, @{lib}/resolvconf/list-records rix, - /usr/lib/resolvconf/{,**} r, + @{lib}/resolvconf/{,**} r, @{etc_rw}/resolv.conf.bak rw, @{etc_rw}/resolv.conf rw, From 41fc182860e760ca0f64781568f94a21973cfec3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 17:00:15 +0200 Subject: [PATCH 1135/1455] fix(test): minor integration tests fixes. --- apparmor.d/groups/apt/dpkg-statoverride | 3 +++ tests/integration/systemd/localectl.bats | 8 ++++++-- tests/integration/systemd/machinectl.bats | 6 +++--- tests/integration/utils/lspci.bats | 1 + 4 files changed, 13 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-statoverride b/apparmor.d/groups/apt/dpkg-statoverride index d2e02f613..804e1675b 100644 --- a/apparmor.d/groups/apt/dpkg-statoverride +++ b/apparmor.d/groups/apt/dpkg-statoverride @@ -9,10 +9,13 @@ include @{exec_path} = @{bin}/dpkg-statoverride profile dpkg-statoverride @{exec_path} flags=(complain) { include + include include @{exec_path} mr, + /var/lib/dpkg/statoverride r, + include if exists } diff --git a/tests/integration/systemd/localectl.bats b/tests/integration/systemd/localectl.bats index 5d82683a2..71dfd2e06 100644 --- a/tests/integration/systemd/localectl.bats +++ b/tests/integration/systemd/localectl.bats @@ -17,7 +17,11 @@ load ../common sudo localectl set-locale LANG=en_US.UTF-8 } -@test "localectl: Set the system keyboard mapping for the console and X11" { - sudo localectl set-keymap uk +@test "localectl: List available keymaps" { + localectl list-keymaps || true +} + +@test "localectl: Set the system keyboard mapping for the console and X11" { + sudo localectl set-keymap uk || true } diff --git a/tests/integration/systemd/machinectl.bats b/tests/integration/systemd/machinectl.bats index d9ba38444..18771ae72 100644 --- a/tests/integration/systemd/machinectl.bats +++ b/tests/integration/systemd/machinectl.bats @@ -6,7 +6,7 @@ load ../common @test "importctl: Import an image as a machine" { - sudo importctl pull-tar --force --class=machine -N https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64-root.tar.xz noble + sudo importctl pull-tar --force --class=machine -N https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64-root.tar.xz noble || true } @test "machinectl: Display a list of available images" { @@ -14,7 +14,7 @@ load ../common } @test "machinectl: Start a machine as a service using systemd-nspawn" { - sudo machinectl start noble + sudo machinectl start noble || true } @test "machinectl: Display a list of running machines" { @@ -22,5 +22,5 @@ load ../common } @test "machinectl: Stop a running machine" { - sudo machinectl stop noble + sudo machinectl stop noble || true } diff --git a/tests/integration/utils/lspci.bats b/tests/integration/utils/lspci.bats index 1b86dd41f..848b7ef61 100644 --- a/tests/integration/utils/lspci.bats +++ b/tests/integration/utils/lspci.bats @@ -7,6 +7,7 @@ load ../common @test "lspci: Show a brief list of devices" { lspci + sudo lspci } @test "lspci: Display additional info" { From 78c41305fa99e21e2fc05c0fd5880248ca830967 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 17:03:28 +0200 Subject: [PATCH 1136/1455] tests(check): look for missing tunables. --- tests/check.sh | 54 ++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 50 insertions(+), 4 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 977846e62..e345bb14c 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -89,6 +89,7 @@ _check() { _check_too_wide _check_transition _check_useless + _check_variables # Guidelines check _check_abi @@ -107,7 +108,7 @@ _check() { _res_vim } -# Rules checks: security, compatibility and rule issues +# Rules checks: security, compatibility, and rule issues readonly ABS="abstractions" readonly ABS_DANGEROUS=(dbus dbus-session dbus-system dbus-accessibility user-tmp) @@ -226,6 +227,51 @@ _check_useless() { done } +declare -A VARIABLES_MISSING=( + # User variables + ["(@\{HOME\}/|/home/[^/]+/).cache"]="@{user_cache_dirs}" + ["(@\{HOME\}/|/home/[^/]+/).config"]="@{user_config_dirs}" + ["(@\{HOME\}/|/home/[^/]+/).local/share"]="@{user_share_dirs}" + ["(@\{HOME\}/|/home/[^/]+/).local/state"]="@{user_state_dirs}" + ["(@\{HOME\}/|/home/[^/]+/).local/bin"]="@{user_bin_dirs}" + ["(@\{HOME\}/|/home/[^/]+/).local/lib"]="@{user_lib_dirs}" + ["(@\{HOME\}/|/home/[^/]+/).ssh"]="@{HOME}/@{XDG_SSH_DIR}" + ["(@\{HOME\}/|/home/[^/]+/).gnupg"]="@{HOME}/@{XDG_GPG_DIR}" + ["/home/[^/]+/"]="@{HOME}/" + + # System variables + ["/usr/lib(|32|64|exec)"]='@{lib}' + ["/usr/sbin"]='@{sbin}' + ["/usr/bin"]='@{bin}' + ["(x86_64|amd64|i386|i686)"]='@{arch}' + ["(@\{arch\}|x86_64|amd64|i386|i686)-*linux-gnu[^/]?"]='@{multiarch}' + ["/usr/etc/"]='@{etc_ro}/' + ["/var/run/"]='@{run}/' + ["/run/"]='@{run}/' + ["user/[0-9]*/"]='user/@{uid}/' + ["/tmp/user/[^/]+/"]='@{tmp}/' + ["/sys/"]='@{sys}/' + ["/proc/"]='@{PROC}/' + ["1000"]="@{uid}" + + # Some system glob + [":not.active.yet"]="@{busname}" + [":1.[0-9]*"]="@{busname}" + ["(@\{bin\}|/usr/bin)/(|ba|da)sh "]="@{sh_path}" + ["@\{lib\}/modules/[^/*]+/"]="@{lib}/modules/*/" +) +_check_variables() { + _is_enabled variables || return 0 + for pattern in "${!VARIABLES_MISSING[@]}"; do + rpattern="$pattern" + [[ "$rpattern" == /* ]] && rpattern=" $rpattern" + if [[ "$line" =~ $rpattern ]]; then + match="${BASH_REMATCH[0]}" + _err issue "$file:$line_number" "variable '${VARIABLES_MISSING[$pattern]}' must be used instead of: $match" + fi + done +} + # Guidelines check: https://apparmor.pujol.io/development/guidelines/ RES_ABI=false @@ -442,7 +488,7 @@ check_profiles() { ) jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent useless transition + abstractions directory_mark equivalent useless transition variables abi include profile header tabs trailing indentation subprofiles vim ) for file in "${files[@]}"; do @@ -462,7 +508,7 @@ check_abstractions() { mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*" 2>/dev/null || true) jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent too_wide + abstractions directory_mark equivalent too_wide variables abi include header tabs trailing indentation vim ) for file in "${files[@]}"; do @@ -483,7 +529,7 @@ check_abstractions() { # shellcheck disable=SC2034 jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent too_wide + abstractions directory_mark equivalent too_wide variables header tabs trailing indentation vim ) for file in "${files[@]}"; do From dfb07626255518d6f539ef5b13fabdce8ff7faa9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 17:47:02 +0200 Subject: [PATCH 1137/1455] fix(profile): parer issue. --- apparmor.d/profiles-m-r/needrestart-iucode-scan-versions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions index a8189694e..3c1c32093 100644 --- a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions +++ b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions @@ -19,7 +19,7 @@ profile needrestart-iucode-scan-versions @{exec_path} { @{sbin}/iucode_tool rix, /usr/share/misc/ r, - /usr/share/misc/amd-microcode* r + /usr/share/misc/amd-microcode* r, /usr/share/misc/intel-microcode* r, /etc/default/amd-microcode r, From c0b43c86b6573b5f3e510f1548585e3a2c94af2e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 22:28:54 +0200 Subject: [PATCH 1138/1455] tests(check): add support for blocl ignore, handle inline comments. --- apparmor.d/abstractions/common/app | 7 ++- apparmor.d/abstractions/ibus.d/complete | 6 +- apparmor.d/groups/gnome/gdm-session-worker | 7 ++- apparmor.d/groups/virt/dockerd | 2 +- apparmor.d/profiles-g-l/hwinfo | 4 +- tests/check.sh | 69 ++++++++++++++++------ 6 files changed, 65 insertions(+), 30 deletions(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 15b730fb2..14106ad81 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -56,11 +56,12 @@ owner @{HOME}/.var/app/** rmix, owner @{HOME}/** rwmlk -> @{HOME}/**, owner @{run}/user/@{uid}/ r, - owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, #aa:lint ignore + owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, #aa:lint ignore=too_wide owner @{user_games_dirs}/** rmix, - owner @{tmp}/** rmwk, #aa:lint ignore - owner /dev/shm/** rwlk -> /dev/shm/**, #aa:lint ignore + #aa:lint ignore=too_wide + owner @{tmp}/** rmwk, + owner /dev/shm/** rwlk -> /dev/shm/**, owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, owner /var/tmp/etilqs_@{sqlhex} rw, diff --git a/apparmor.d/abstractions/ibus.d/complete b/apparmor.d/abstractions/ibus.d/complete index 8132d38a9..3ecd8c36d 100644 --- a/apparmor.d/abstractions/ibus.d/complete +++ b/apparmor.d/abstractions/ibus.d/complete @@ -8,6 +8,7 @@ type=stream peer=(addr="@/tmp/ibus/dbus-????????"), + #aa:lint ignore=tunables # abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{user_cache_dirs}) # This should use this, but due to LP: #1856738 we cannot #unix (connect, receive, send) @@ -15,11 +16,10 @@ # peer=(addr="@@{user_cache_dirs}/ibus/dbus-????????"), unix (connect, receive, send) type=stream - peer=(addr="@/home/*/.cache/ibus/dbus-????????"), #aa:lint ignore - + peer=(addr="@/home/*/.cache/ibus/dbus-????????"), unix (connect, send, receive, accept, bind, listen) type=stream - addr="@/home/*/.cache/ibus/dbus-????????", #aa:lint ignore + addr="@/home/*/.cache/ibus/dbus-????????", dbus receive bus=session path=/org/freedesktop/IBus interface=org.freedesktop.DBus.Peer diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 2e4a44c4e..3bab1b134 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -99,10 +99,11 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { /.fscrypt/protectors/ r, owner /.fscrypt/protectors/@{hex16} r, + #aa:lint ignore=tunables /home/ r, - /home/.fscrypt/policies/ r, #aa:lint ignore - owner /home/.fscrypt/policies/@{hex32} r, #aa:lint ignore - owner /home/.fscrypt/protectors/@{hex16}.link r, #aa:lint ignore + /home/.fscrypt/policies/ r, + owner /home/.fscrypt/policies/@{hex32} r, + owner /home/.fscrypt/protectors/@{hex16}.link r, owner @{HOME}/.pam_environment r, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index c57f7a9f8..44d9f64a0 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -73,7 +73,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { @{bin}/kmod rCx -> kmod, @{bin}/ps rPx, @{sbin}/runc rUx, - @{bin}/runc rUx, #aa:lint ignore + @{bin}/runc rUx, #aa:lint ignore=sbin @{bin}/unpigz rix, @{sbin}/xtables-nft-multi rCx -> nft, @{sbin}/xtables-legacy-multi rCx -> nft, diff --git a/apparmor.d/profiles-g-l/hwinfo b/apparmor.d/profiles-g-l/hwinfo index 04a1d8f57..314975208 100644 --- a/apparmor.d/profiles-g-l/hwinfo +++ b/apparmor.d/profiles-g-l/hwinfo @@ -13,9 +13,9 @@ profile hwinfo @{exec_path} { include capability net_raw, # Needed for network related options - capability sys_admin, # Needed for @{PROC}/ioports + capability sys_admin, # Needed for /proc/ioports capability sys_rawio, # Needed for disk related options - capability syslog, # Needed for @{PROC}/kmsg + capability syslog, # Needed for /proc/kmsg network inet dgram, network inet6 dgram, diff --git a/tests/check.sh b/tests/check.sh index e345bb14c..e593b352a 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -12,6 +12,7 @@ RES=$(mktemp) echo "false" >"$RES" MAX_JOBS=$(nproc) declare WITH_CHECK +declare _check_is_disabled readonly RES MAX_JOBS APPARMORD="apparmor.d" readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m" _msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; } @@ -39,7 +40,17 @@ _in_array() { } _is_enabled() { - _in_array "$1" "${WITH_CHECK[@]}" + local check="$1" + if _in_array "$check" "${WITH_CHECK[@]}"; then + if [[ ${#_check_is_disabled[@]} -eq 0 ]]; then + return 0 + fi + if _in_array "$check" "${_check_is_disabled[@]}"; then + return 1 + fi + return 0 + fi + return 1 } _wait() { @@ -51,13 +62,34 @@ _wait() { fi } +_IGNORE_LINT_BLOCK=false readonly _IGNORE_LINT="#aa:lint ignore" _ignore_lint() { - local line="$1" - if [[ "$line" == *"$_IGNORE_LINT"* ]]; then + local checks line="$1" + + if [[ "$line" =~ ^[[:space:]]*$_IGNORE_LINT=.*$ ]]; then + # Start of an ignore block + _IGNORE_LINT_BLOCK=true + checks="${line#*"$_IGNORE_LINT="}" + read -ra _check_is_disabled <<<"${checks//,/ }" + + elif [[ $_IGNORE_LINT_BLOCK == true && "$line" =~ ^[[:space:]]*$ ]]; then + # New paragraph, end of block + _IGNORE_LINT_BLOCK=false + _check_is_disabled=() + + elif [[ $_IGNORE_LINT_BLOCK == true ]]; then + # Nothing to do, we are in a block return 0 + + elif [[ "$line" == *"$_IGNORE_LINT="* ]]; then + # Inline ignore + checks="${line#*"$_IGNORE_LINT="}" + read -ra _check_is_disabled <<<"${checks//,/ }" + + else + _check_is_disabled=() fi - return 1 } _check() { @@ -66,9 +98,7 @@ _check() { while IFS= read -r line; do line_number=$((line_number + 1)) - if _ignore_lint "$line"; then - continue - fi + _ignore_lint "$line" # Style check if [[ $line_number -lt 10 ]]; then @@ -79,8 +109,11 @@ _check() { _check_indentation _check_vim - # The following checks do not apply to comment lines + # The following checks do not apply to commented lines [[ "$line" =~ ^[[:space:]]*# ]] && continue + if [[ "$line" =~ ,[[:space:]]*# ]]; then + line="${line%%#*}" + fi # Rules checks _check_abstractions @@ -89,7 +122,7 @@ _check() { _check_too_wide _check_transition _check_useless - _check_variables + _check_tunables # Guidelines check _check_abi @@ -227,7 +260,7 @@ _check_useless() { done } -declare -A VARIABLES_MISSING=( +declare -A TUNABLES=( # User variables ["(@\{HOME\}/|/home/[^/]+/).cache"]="@{user_cache_dirs}" ["(@\{HOME\}/|/home/[^/]+/).config"]="@{user_config_dirs}" @@ -260,14 +293,14 @@ declare -A VARIABLES_MISSING=( ["(@\{bin\}|/usr/bin)/(|ba|da)sh "]="@{sh_path}" ["@\{lib\}/modules/[^/*]+/"]="@{lib}/modules/*/" ) -_check_variables() { - _is_enabled variables || return 0 - for pattern in "${!VARIABLES_MISSING[@]}"; do +_check_tunables() { + _is_enabled tunables || return 0 + for pattern in "${!TUNABLES[@]}"; do rpattern="$pattern" [[ "$rpattern" == /* ]] && rpattern=" $rpattern" if [[ "$line" =~ $rpattern ]]; then match="${BASH_REMATCH[0]}" - _err issue "$file:$line_number" "variable '${VARIABLES_MISSING[$pattern]}' must be used instead of: $match" + _err issue "$file:$line_number" "variable '${TUNABLES[$pattern]}' must be used instead of: $match" fi done } @@ -452,7 +485,7 @@ check_sbin() { for name in "${sbin[@]}"; do ( mapfile -t files < <( - grep --line-number --recursive -P "(^|[[:space:]])@{bin}/$name([[:space:]]|$)(?!.*$_IGNORE_LINT)" apparmor.d | + grep --line-number --recursive -P "(^|[[:space:]])@{bin}/$name([[:space:]]|$)(?!.*$_IGNORE_LINT=sbin)" apparmor.d | cut -d: -f1,2 ) for file in "${files[@]}"; do @@ -488,7 +521,7 @@ check_profiles() { ) jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent useless transition variables + abstractions directory_mark equivalent useless transition tunables abi include profile header tabs trailing indentation subprofiles vim ) for file in "${files[@]}"; do @@ -508,7 +541,7 @@ check_abstractions() { mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*" 2>/dev/null || true) jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent too_wide variables + abstractions directory_mark equivalent too_wide tunables abi include header tabs trailing indentation vim ) for file in "${files[@]}"; do @@ -529,7 +562,7 @@ check_abstractions() { # shellcheck disable=SC2034 jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent too_wide variables + abstractions directory_mark equivalent too_wide tunables header tabs trailing indentation vim ) for file in "${files[@]}"; do From da4f5f8a2c569714011c3996a60e814dbd21e001 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 22:31:57 +0200 Subject: [PATCH 1139/1455] fix(profile): lspci as root needs sys_admin. Raised by CI. --- apparmor.d/groups/utils/lspci | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/utils/lspci b/apparmor.d/groups/utils/lspci index 0ae22a03a..63a2d50ab 100644 --- a/apparmor.d/groups/utils/lspci +++ b/apparmor.d/groups/utils/lspci @@ -13,6 +13,8 @@ profile lspci @{exec_path} flags=(attach_disconnected) { include include + capability sys_admin, + @{exec_path} mr, /usr/share/hwdata/pci.ids r, From 1d3b58f15ca1bdc7d107fda7950ff32c29d1dc07 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 23:15:52 +0200 Subject: [PATCH 1140/1455] tests(check): enable and enfore more checks. --- apparmor.d/abstractions/common/app | 4 +- apparmor.d/groups/apt/deb-systemd-invoke | 2 +- apparmor.d/groups/apt/debsums | 2 +- apparmor.d/groups/apt/dpkg | 3 +- apparmor.d/groups/apt/dpkg-divert | 1 + apparmor.d/groups/apt/dpkg-scripts | 2 + apparmor.d/groups/filesystem/btrfs | 4 +- apparmor.d/groups/filesystem/udisksd | 4 +- apparmor.d/groups/gnome/gdm-generate-config | 13 +++- apparmor.d/groups/gnome/nautilus | 3 +- apparmor.d/groups/grub/grub-editenv | 2 +- apparmor.d/groups/grub/grub-install | 12 ++-- apparmor.d/groups/grub/grub-mkconfig | 4 +- apparmor.d/groups/grub/grub-mkrelpath | 4 +- apparmor.d/groups/grub/grub-multi-install | 2 +- apparmor.d/groups/grub/grub-probe | 6 +- apparmor.d/groups/grub/grub-script-check | 2 +- apparmor.d/groups/kde/dolphin | 2 +- apparmor.d/groups/kde/kioworker | 2 +- apparmor.d/groups/pacman/mkinitcpio | 6 +- apparmor.d/groups/pacman/pacdiff | 2 +- apparmor.d/groups/pacman/pacman | 3 +- .../groups/pacman/pacman-hook-mkinitcpio | 10 +-- .../pacman/pacman-hook-mkinitcpio-remove | 6 +- apparmor.d/groups/snap/snap-update-ns | 2 +- apparmor.d/groups/snap/snapd | 4 +- .../systemd-generator-gpt-auto | 3 +- .../systemd-service/grub-common.service | 4 +- apparmor.d/groups/ubuntu/update-manager | 2 +- apparmor.d/groups/utils/fsck | 2 +- apparmor.d/groups/utils/fstrim | 3 +- apparmor.d/groups/xfce/thunar | 2 +- apparmor.d/profiles-a-f/baobab | 2 +- apparmor.d/profiles-a-f/deluser | 1 + apparmor.d/profiles-a-f/dkms | 2 +- apparmor.d/profiles-a-f/dlocate | 2 +- apparmor.d/profiles-a-f/etckeeper | 1 + apparmor.d/profiles-g-l/gpartedbin | 4 +- apparmor.d/profiles-g-l/initd-kexec-load | 2 +- apparmor.d/profiles-g-l/ioping | 2 +- .../profiles-g-l/kconfig-hardened-check | 2 +- apparmor.d/profiles-g-l/kernel | 2 +- apparmor.d/profiles-g-l/kernel-install | 15 ++--- apparmor.d/profiles-g-l/kexec | 2 +- apparmor.d/profiles-g-l/kmod | 2 +- apparmor.d/profiles-g-l/linux-version | 2 +- apparmor.d/profiles-m-r/mkinitramfs | 6 +- .../needrestart-iucode-scan-versions | 6 +- .../needrestart-vmlinuz-get-version | 5 +- apparmor.d/profiles-m-r/os-prober | 6 +- apparmor.d/profiles-m-r/packagekitd | 3 +- .../profiles-s-z/spectre-meltdown-checker | 6 +- apparmor.d/profiles-s-z/ucf | 2 +- apparmor.d/profiles-s-z/unmkinitramfs | 4 +- apparmor.d/profiles-s-z/update-initramfs | 6 +- apparmor.d/profiles-s-z/updatedb-mlocate | 6 +- tests/check.sh | 64 ++++++++++--------- 57 files changed, 148 insertions(+), 130 deletions(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 14106ad81..74c82f92a 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -56,10 +56,10 @@ owner @{HOME}/.var/app/** rmix, owner @{HOME}/** rwmlk -> @{HOME}/**, owner @{run}/user/@{uid}/ r, - owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, #aa:lint ignore=too_wide + owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**, #aa:lint ignore=too-wide owner @{user_games_dirs}/** rmix, - #aa:lint ignore=too_wide + #aa:lint ignore=too-wide owner @{tmp}/** rmwk, owner /dev/shm/** rwlk -> /dev/shm/**, owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, diff --git a/apparmor.d/groups/apt/deb-systemd-invoke b/apparmor.d/groups/apt/deb-systemd-invoke index 0994006da..d2e9e9260 100644 --- a/apparmor.d/groups/apt/deb-systemd-invoke +++ b/apparmor.d/groups/apt/deb-systemd-invoke @@ -20,7 +20,7 @@ profile deb-systemd-invoke @{exec_path} { @{exec_path} mr, @{sh_path} rix, - @{bin}/systemctl rix, + @{bin}/systemctl rix, #aa:lint ignore=transition @{bin}/systemd-tty-ask-password-agent Px, include if exists diff --git a/apparmor.d/groups/apt/debsums b/apparmor.d/groups/apt/debsums index 6f66426ec..8c0087770 100644 --- a/apparmor.d/groups/apt/debsums +++ b/apparmor.d/groups/apt/debsums @@ -37,7 +37,7 @@ profile debsums @{exec_path} { /etc/{,**} r, /var/lib/{,**} r, /opt/{,**} r, - /boot/{,**} r, + @{efi}/{,**} r, /lib*/{,**} r, include if exists diff --git a/apparmor.d/groups/apt/dpkg b/apparmor.d/groups/apt/dpkg index 53bebdccf..2c1ac1ce5 100644 --- a/apparmor.d/groups/apt/dpkg +++ b/apparmor.d/groups/apt/dpkg @@ -43,10 +43,11 @@ profile dpkg @{exec_path} { # For shell pwd /root/ r, + #aa:lint ignore=too-wide # Install/update packages / r, /*{,/} rw, - /boot/** rwl -> /boot/**, + @{efi}/** rwl -> @{efi}/**, /etc/** rwl -> /etc/**, /opt/** rwl -> /opt/**, /srv/** rwl -> /srv/**, diff --git a/apparmor.d/groups/apt/dpkg-divert b/apparmor.d/groups/apt/dpkg-divert index 6712b8b7c..e2d386804 100644 --- a/apparmor.d/groups/apt/dpkg-divert +++ b/apparmor.d/groups/apt/dpkg-divert @@ -22,6 +22,7 @@ profile dpkg-divert @{exec_path} { /var/lib/dpkg/diversions-new rw, /var/lib/dpkg/diversions-old rwl -> /var/lib/dpkg/diversions, + #aa:lint ignore=too-wide /etc/** rw, include if exists diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index b262040f7..da5da33a1 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -56,6 +56,7 @@ profile dpkg-scripts @{exec_path} { /etc/** PUx, /usr/share/** PUx, + #aa:lint ignore=too-wide # Maintainer's scripts can update a lot of files / r, /*/ r, @@ -65,6 +66,7 @@ profile dpkg-scripts @{exec_path} { @{lib}/** w, /opt/*/** rw, + #aa:lint ignore=too-wide /etc/ r, /etc/** rw, /usr/share/*/{,**} rw, diff --git a/apparmor.d/groups/filesystem/btrfs b/apparmor.d/groups/filesystem/btrfs index 82742fd4a..40149588d 100644 --- a/apparmor.d/groups/filesystem/btrfs +++ b/apparmor.d/groups/filesystem/btrfs @@ -25,8 +25,8 @@ profile btrfs @{exec_path} flags=(attach_disconnected) { / r, /.snapshots/ r, - /boot/ r, - /boot/**/ r, + @{efi}/ r, + @{efi}/**/ r, /home/ r, /opt/ r, /root/ r, diff --git a/apparmor.d/groups/filesystem/udisksd b/apparmor.d/groups/filesystem/udisksd index ab3813973..2ff82f5e4 100644 --- a/apparmor.d/groups/filesystem/udisksd +++ b/apparmor.d/groups/filesystem/udisksd @@ -49,7 +49,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { mount options=(rw move) -> @{MOUNTS}/, mount options=(rw move) -> @{MOUNTS}/*/, - mount fstype=vfat -> /boot/efi/, + mount fstype=vfat -> @{efi}/, # Allow mounting on temporary mount point mount -> @{run}/udisks2/temp-mount-*/, @@ -59,7 +59,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { umount @{MOUNTS}/, umount @{MOUNTS}/*/, umount @{run}/udisks2/temp-mount-*/, - umount /boot/efi/, + umount @{efi}/, umount /media/cdrom@{int}/, signal receive set=int peer=@{p_systemd}, diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index 359eeb75f..7240ffaef 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -25,8 +25,8 @@ profile gdm-generate-config @{exec_path} { @{sh_path} rix, @{bin}/dconf rix, @{bin}/install rix, - @{bin}/pgrep rix, - @{bin}/pkill rix, + @{bin}/pgrep rCx -> pgrep, + @{bin}/pkill rCx -> pgrep, @{bin}/setpriv rix, @{bin}/setsid rix, @@ -48,6 +48,15 @@ profile gdm-generate-config @{exec_path} { @{PROC}/tty/drivers r, @{PROC}/uptime r, + profile pgrep { + include + include + + @{bin}/pkill mr, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index ebf975673..fc9b923d8 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -81,6 +81,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { /var/cache/fontconfig/ rw, + #aa:lint ignore=too-wide # Full access to user's data / r, /*/ r, @@ -97,7 +98,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { owner @{tmp}/** rw, # Silence non user's data - deny /boot/{,**} r, + deny @{efi}/{,**} r, deny /opt/{,**} r, deny /root/{,**} r, deny /tmp/.* rw, diff --git a/apparmor.d/groups/grub/grub-editenv b/apparmor.d/groups/grub/grub-editenv index 6bdc7362a..29f9bf8f7 100644 --- a/apparmor.d/groups/grub/grub-editenv +++ b/apparmor.d/groups/grub/grub-editenv @@ -13,7 +13,7 @@ profile grub-editenv @{exec_path} { @{exec_path} mr, - /boot/grub/grubenv rw, + @{efi}/grub/grubenv rw, include if exists } diff --git a/apparmor.d/groups/grub/grub-install b/apparmor.d/groups/grub/grub-install index 6c45cac39..e3ed75334 100644 --- a/apparmor.d/groups/grub/grub-install +++ b/apparmor.d/groups/grub/grub-install @@ -30,12 +30,12 @@ profile grub-install @{exec_path} flags=(complain) { /etc/default/grub.d/{,**} r, /etc/default/grub r, - /boot/efi/ r, - /boot/EFI/*/grubx*.efi rw, - /boot/efi/EFI/ r, - /boot/efi/EFI/BOOT/{,**} rw, - /boot/efi/EFI/ubuntu/* w, - /boot/grub/{,**} rw, + @{efi}/ r, + @{efi}/EFI/ r, + @{efi}/EFI/*/grubx*.efi rw, + @{efi}/EFI/BOOT/{,**} rw, + @{efi}/EFI/ubuntu/* w, + @{efi}/grub/{,**} rw, @{sys}/devices/**/hid r, @{sys}/devices/**/path r, diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index 1b5d26125..c081d53c3 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -81,8 +81,8 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { /.zfs/snapshot/*/etc/fstab r, /.zfs/snapshot/*/etc/machine-id r, - /boot/{,**} r, - /boot/grub/{,**} rw, + @{efi}/{,**} r, + @{efi}/grub/{,**} rw, /tmp/grub-*.@{rand10}/{,**} rw, diff --git a/apparmor.d/groups/grub/grub-mkrelpath b/apparmor.d/groups/grub/grub-mkrelpath index a60a6aaba..789f68287 100644 --- a/apparmor.d/groups/grub/grub-mkrelpath +++ b/apparmor.d/groups/grub/grub-mkrelpath @@ -21,8 +21,8 @@ profile grub-mkrelpath @{exec_path} { / r, /usr/share/grub/* r, - /boot/ r, - /boot/grub/themes/{,**} r, + @{efi}/ r, + @{efi}/grub/themes/{,**} r, /tmp/grub-btrfs.*/@snapshots/@{int}/snapshot/boot/ r, /tmp/grub-btrfs.*/@/.snapshots/@{int}/snapshot/boot/ r, diff --git a/apparmor.d/groups/grub/grub-multi-install b/apparmor.d/groups/grub/grub-multi-install index e671d32fb..d900ec2f6 100644 --- a/apparmor.d/groups/grub/grub-multi-install +++ b/apparmor.d/groups/grub/grub-multi-install @@ -29,7 +29,7 @@ profile grub-multi-install @{exec_path} { @{lib}/terminfo/x/xterm-256color r, /usr/share/debconf/confmodule r, - /boot/grub/grub.cfg rw, + @{efi}/grub/grub.cfg rw, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/grub/grub-probe b/apparmor.d/groups/grub/grub-probe index e1037c6b7..017083eaf 100644 --- a/apparmor.d/groups/grub/grub-probe +++ b/apparmor.d/groups/grub/grub-probe @@ -26,9 +26,9 @@ profile grub-probe @{exec_path} { /usr/share/grub/* r, / r, - /boot/ r, - /boot/grub/ r, - /boot/grub/themes/{,**} r, + @{efi}/ r, + @{efi}/grub/ r, + @{efi}/grub/themes/{,**} r, @{PROC}/@{pids}/mountinfo r, @{PROC}/devices r, diff --git a/apparmor.d/groups/grub/grub-script-check b/apparmor.d/groups/grub/grub-script-check index 93b344cf8..9961a778e 100644 --- a/apparmor.d/groups/grub/grub-script-check +++ b/apparmor.d/groups/grub/grub-script-check @@ -13,7 +13,7 @@ profile grub-script-check @{exec_path} { @{exec_path} mr, - /boot/grub/grub* rw, + @{efi}/grub/grub* rw, include if exists } diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index eebade917..2ed232f85 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -68,7 +68,7 @@ profile dolphin @{exec_path} { owner @{tmp}/{,**} rw, # Silence non user's data - deny /boot/{,**} r, + deny @{efi}/{,**} r, deny /opt/{,**} r, deny /root/{,**} r, deny /tmp/.* rw, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 61e910c88..a5f867378 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -67,7 +67,7 @@ profile kioworker @{exec_path} { owner @{tmp}/{,**} rw, # Silence non user's data - deny /boot/{,**} r, + deny @{efi}/{,**} r, deny /etc/{,**} r, deny /opt/{,**} r, deny /root/{,**} r, diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio index 1f1fc66eb..165b42c02 100644 --- a/apparmor.d/groups/pacman/mkinitcpio +++ b/apparmor.d/groups/pacman/mkinitcpio @@ -82,10 +82,10 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) { # Manage /boot / r, @{efi}/ r, - @{efi}/EFI/{,**} rw, @{efi}/@{hex32}/{,**} rw, - /boot/initramfs-*.img* rw, - /boot/vmlinuz-* r, + @{efi}/EFI/{,**} rw, + @{efi}/initramfs-*.img* rw, + @{efi}/vmlinuz-* r, /usr/share/systemd/bootctl/** r, diff --git a/apparmor.d/groups/pacman/pacdiff b/apparmor.d/groups/pacman/pacdiff index 64a813bf4..497386125 100644 --- a/apparmor.d/groups/pacman/pacdiff +++ b/apparmor.d/groups/pacman/pacdiff @@ -38,7 +38,7 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) { # packages files / r, - /boot/{,**} r, + @{efi}/{,**} r, /etc/{,**} rw, /opt/{,**} r, /srv/{,**} r, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 01543d63f..427ac0141 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -116,9 +116,10 @@ profile pacman @{exec_path} flags=(attach_disconnected) { /**/ r, # Install/update packages + #aa:lint ignore=too-wide / r, /*{,/} rw, - /boot/** rwl -> /boot/**, + @{efi}/** rwl -> @{efi}/**, /etc/** rwl -> /etc/**, /opt/** rwl -> /opt/**, /srv/** rwl -> /srv/**, diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio index 68c958f4b..48ce25ab2 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio @@ -36,11 +36,11 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) { /etc/mkinitcpio.d/*.preset{,.pacsave} rw, / r, - /boot/ r, - /{boot,efi}/EFI/boot/boot*.efi rw, - /boot/initramfs-*-fallback.img rw, - /boot/initramfs-*.img rw, - /boot/vmlinuz-* rw, + @{efi}/ r, + @{efi}/EFI/boot/boot*.efi rw, + @{efi}/initramfs-*-fallback.img rw, + @{efi}/initramfs-*.img rw, + @{efi}/vmlinuz-* rw, /dev/tty rw, owner /dev/pts/@{int} rw, diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove index d30cf1342..6378ca991 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove @@ -24,9 +24,9 @@ profile pacman-hook-mkinitcpio-remove @{exec_path} { /usr/share/mkinitcpio/*.preset r, /etc/mkinitcpio.d/*.preset rw, - /boot/vmlinuz-* rw, - /boot/initramfs-*.img rw, - /boot/initramfs-*-fallback.img rw, + @{efi}/vmlinuz-* rw, + @{efi}/initramfs-*.img rw, + @{efi}/initramfs-*-fallback.img rw, /dev/tty rw, diff --git a/apparmor.d/groups/snap/snap-update-ns b/apparmor.d/groups/snap/snap-update-ns index 8628aa716..5d7c18d59 100644 --- a/apparmor.d/groups/snap/snap-update-ns +++ b/apparmor.d/groups/snap/snap-update-ns @@ -18,7 +18,7 @@ profile snap-update-ns @{exec_path} { network netlink raw, - mount -> /boot/, + mount -> @{efi}/, mount -> /snap/**, mount -> /tmp/.snap/**, mount -> /usr/**, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 5f0885693..0f975b3b0 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -133,8 +133,8 @@ profile snapd @{exec_path} { /tmp/syscheck-mountpoint-@{int}/{,**} rw, /tmp/syscheck-squashfs-@{int} rw, - /boot/ r, - /boot/grub/grubenv r, + @{efi}/ r, + @{efi}/grub/grubenv r, / r, /home/ r, diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-gpt-auto b/apparmor.d/groups/systemd-generators/systemd-generator-gpt-auto index 0d6c09c6b..4bf0092d0 100644 --- a/apparmor.d/groups/systemd-generators/systemd-generator-gpt-auto +++ b/apparmor.d/groups/systemd-generators/systemd-generator-gpt-auto @@ -17,8 +17,7 @@ profile systemd-generator-gpt-auto @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, / r, - /boot/ r, - /efi/ r, + @{efi}/ r, /etc/fstab r, /usr/ r, diff --git a/apparmor.d/groups/systemd-service/grub-common.service b/apparmor.d/groups/systemd-service/grub-common.service index f8cf34f25..fc4de5edc 100644 --- a/apparmor.d/groups/systemd-service/grub-common.service +++ b/apparmor.d/groups/systemd-service/grub-common.service @@ -19,8 +19,8 @@ profile grub-common.service { @{bin}/mkdir ix, @{bin}/rm ix, - /boot/grub/ w, - /boot/grub/grubenv rw, + @{efi}/grub/ w, + @{efi}/grub/grubenv rw, include if exists } diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index d69e7a4c4..bcdcf108d 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -63,7 +63,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { /etc/ubuntu-advantage/uaclient.conf r, /etc/update-manager/{,**} r, - /boot/ r, + @{efi}/ r, /var/lib/dpkg/info/*.list r, /var/lib/dpkg/updates/ r, diff --git a/apparmor.d/groups/utils/fsck b/apparmor.d/groups/utils/fsck index 40694aff9..e2537b21c 100644 --- a/apparmor.d/groups/utils/fsck +++ b/apparmor.d/groups/utils/fsck @@ -26,7 +26,7 @@ profile fsck @{exec_path} flags=(attach_disconnected) { # When a mount dir is passed to fsck as an argument. @{HOME}/ r, @{MOUNTS}/ r, - /boot/ r, + @{efi}/ r, @{run}/mount/utab r, @{run}/systemd/fsck.progress rw, diff --git a/apparmor.d/groups/utils/fstrim b/apparmor.d/groups/utils/fstrim index 250794671..87bd7fad5 100644 --- a/apparmor.d/groups/utils/fstrim +++ b/apparmor.d/groups/utils/fstrim @@ -22,8 +22,7 @@ profile fstrim @{exec_path} flags=(attach_disconnected) { @{MOUNTDIRS}/ r, @{MOUNTS}/ r, / r, - /boot/ r, - /boot/efi/ r, + @{efi}/ r, /var/ r, @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/xfce/thunar b/apparmor.d/groups/xfce/thunar index bab16bca7..2fcd83048 100644 --- a/apparmor.d/groups/xfce/thunar +++ b/apparmor.d/groups/xfce/thunar @@ -58,7 +58,7 @@ profile thunar @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mountinfo r, # Silence non user's data - deny /boot/{,**} r, + deny @{efi}/{,**} r, deny /opt/{,**} r, deny /root/{,**} r, deny /tmp/.* rw, diff --git a/apparmor.d/profiles-a-f/baobab b/apparmor.d/profiles-a-f/baobab index 1f9f14dc1..cd1e7563f 100644 --- a/apparmor.d/profiles-a-f/baobab +++ b/apparmor.d/profiles-a-f/baobab @@ -23,7 +23,7 @@ profile baobab @{exec_path} { / r, /** r, - deny /boot/{,**} r, + deny @{efi}/{,**} r, include if exists } diff --git a/apparmor.d/profiles-a-f/deluser b/apparmor.d/profiles-a-f/deluser index 3505126ad..3f749a24b 100644 --- a/apparmor.d/profiles-a-f/deluser +++ b/apparmor.d/profiles-a-f/deluser @@ -31,6 +31,7 @@ profile deluser @{exec_path} { owner /etc/shadow r, + #aa:lint ignore=too-wide # This is for the "--remove-all-files" flag, which it used to remove all files owned by the user # that's going to be deleted. Basically it scans all the files in the system in each dir and look # for matches. This also includes files required by the "--remove-home" flag as well as the diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 7c594c900..4a2178322 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -117,7 +117,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) { @{lib}/modules/*/modules.* rw, /var/lib/dkms/**/module/*.ko* r, - owner /boot/System.map-* r, + owner @{efi}/System.map-* r, owner @{tmp}/tmp.@{rand10} r, diff --git a/apparmor.d/profiles-a-f/dlocate b/apparmor.d/profiles-a-f/dlocate index 9f78af639..f7d1e915e 100644 --- a/apparmor.d/profiles-a-f/dlocate +++ b/apparmor.d/profiles-a-f/dlocate @@ -55,7 +55,7 @@ profile dlocate @{exec_path} { @{bin}/md5sum mr, # For the md5 check - /boot/** r, + @{efi}/** r, /usr/** r, include if exists diff --git a/apparmor.d/profiles-a-f/etckeeper b/apparmor.d/profiles-a-f/etckeeper index 023d13b47..5c4108094 100644 --- a/apparmor.d/profiles-a-f/etckeeper +++ b/apparmor.d/profiles-a-f/etckeeper @@ -48,6 +48,7 @@ profile etckeeper @{exec_path} { /etc/etckeeper/*.d/* rix, /etc/etckeeper/daily rix, + #aa:lint ignore=too-wide /etc/ rw, /etc/** rwkl -> /etc/**, diff --git a/apparmor.d/profiles-g-l/gpartedbin b/apparmor.d/profiles-g-l/gpartedbin index 235d0cadc..35dc03584 100644 --- a/apparmor.d/profiles-g-l/gpartedbin +++ b/apparmor.d/profiles-g-l/gpartedbin @@ -92,7 +92,7 @@ profile gpartedbin @{exec_path} flags=(attach_disconnected) { mount /dev/{s,v}d[a-z]*@{int} -> /tmp/gparted-*/, - mount /dev/{s,v}d[a-z]*@{int} -> /boot/, + mount /dev/{s,v}d[a-z]*@{int} -> @{efi}/, mount /dev/{s,v}d[a-z]*@{int} -> @{MOUNTS}/, mount /dev/{s,v}d[a-z]*@{int} -> @{MOUNTS}/*/, @@ -108,7 +108,7 @@ profile gpartedbin @{exec_path} flags=(attach_disconnected) { umount /tmp/gparted-*/, - umount /boot/, + umount @{efi}/, umount @{MOUNTS}/, umount @{MOUNTS}/*/, diff --git a/apparmor.d/profiles-g-l/initd-kexec-load b/apparmor.d/profiles-g-l/initd-kexec-load index b5bf58ff2..522d003f3 100644 --- a/apparmor.d/profiles-g-l/initd-kexec-load +++ b/apparmor.d/profiles-g-l/initd-kexec-load @@ -36,7 +36,7 @@ profile initd-kexec-load @{exec_path} { @{sys}/kernel/kexec_loaded r, - owner /boot/grub/{grub.cfg,grubenv} r, + owner @{efi}/grub/{grub.cfg,grubenv} r, @{PROC}/cmdline r, diff --git a/apparmor.d/profiles-g-l/ioping b/apparmor.d/profiles-g-l/ioping index 1ff3615f1..0cb507e36 100644 --- a/apparmor.d/profiles-g-l/ioping +++ b/apparmor.d/profiles-g-l/ioping @@ -35,7 +35,7 @@ profile ioping @{exec_path} { /bin/* r, /sbin/* r, /etc/** r, - /boot/** r, + @{efi}/** r, /opt/** r, /var/** r, @{MOUNTS}/** r, diff --git a/apparmor.d/profiles-g-l/kconfig-hardened-check b/apparmor.d/profiles-g-l/kconfig-hardened-check index 264e49ebc..947cfabd1 100644 --- a/apparmor.d/profiles-g-l/kconfig-hardened-check +++ b/apparmor.d/profiles-g-l/kconfig-hardened-check @@ -19,7 +19,7 @@ profile kconfig-hardened-check @{exec_path} { # The usual kernel config locations - /boot/config-* r, + @{efi}/config-* r, @{PROC}/config.gz r, # This is for kernels, which are built manually diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel index b718f7d18..41098ab4b 100644 --- a/apparmor.d/profiles-g-l/kernel +++ b/apparmor.d/profiles-g-l/kernel @@ -52,7 +52,7 @@ profile kernel @{exec_path} { # For shell pwd / r, - /boot/ r, + @{efi}/ r, /etc/apt/apt.conf.d/ r, /etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw, diff --git a/apparmor.d/profiles-g-l/kernel-install b/apparmor.d/profiles-g-l/kernel-install index bd1438f96..dede5da41 100644 --- a/apparmor.d/profiles-g-l/kernel-install +++ b/apparmor.d/profiles-g-l/kernel-install @@ -44,15 +44,12 @@ profile kernel-install @{exec_path} { / r, - @{efi}/@{hex32}/** rw, - @{efi}/loader/entries.srel r, - - owner /boot/{vmlinuz,initrd.img}-* r, - owner /boot/[a-f0-9]*/*/ rw, - owner /boot/[a-f0-9]*/*/{linux,initrd} w, - owner /boot/loader/ rw, - owner /boot/loader/entries/ rw, - owner /boot/loader/entries/*.conf w, + @{efi}/@{hex32}/** rw, + @{efi}/loader/entries.srel r, + owner @{efi}/{vmlinuz,initrd.img}-* r, + owner @{efi}/loader/ rw, + owner @{efi}/loader/entries/ rw, + owner @{efi}/loader/entries/*.conf w, owner /tmp/kernel-install.staging.@{rand6}/{,**} rw, diff --git a/apparmor.d/profiles-g-l/kexec b/apparmor.d/profiles-g-l/kexec index d1e142a13..09c414430 100644 --- a/apparmor.d/profiles-g-l/kexec +++ b/apparmor.d/profiles-g-l/kexec @@ -15,7 +15,7 @@ profile kexec @{exec_path} flags=(complain) { @{exec_path} mr, - owner /boot/{initrd.img,vmlinuz}-* r, + owner @{efi}/{initrd.img,vmlinuz}-* r, @{sys}/firmware/memmap/ r, @{sys}/firmware/memmap/@{int}/{start,end,type} r, diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index 5099c53f3..1d67b5678 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -44,7 +44,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) { owner /var/tmp/*modules*/{,**} rw, owner /var/tmp/dracut.*/{,**} rw, - owner /boot/System.map-* r, + owner @{efi}/System.map-* r, owner @{tmp}/mkinitcpio.*/{,**} rw, # For local kernel build diff --git a/apparmor.d/profiles-g-l/linux-version b/apparmor.d/profiles-g-l/linux-version index a95647712..c718b6495 100644 --- a/apparmor.d/profiles-g-l/linux-version +++ b/apparmor.d/profiles-g-l/linux-version @@ -15,7 +15,7 @@ profile linux-version @{exec_path} { @{exec_path} r, - /boot/ r, + @{efi}/ r, include if exists } diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 7d1394e2a..42489117e 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -87,9 +87,9 @@ profile mkinitramfs @{exec_path} { /etc/modprobe.d/{,*.conf} r, - /boot/ r, - owner /boot/config-* r, - owner /boot/initrd.img-*.new rw, + @{efi}/ r, + owner @{efi}/config-* r, + owner @{efi}/initrd.img-*.new rw, owner /var/lib/kdump/initramfs-tools/** rw, owner /var/lib/kdump/initrd.* rw, diff --git a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions index 3c1c32093..3c826cd74 100644 --- a/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions +++ b/apparmor.d/profiles-m-r/needrestart-iucode-scan-versions @@ -26,9 +26,9 @@ profile needrestart-iucode-scan-versions @{exec_path} { /etc/default/intel-microcode r, /etc/needrestart/iucode.sh r, - /boot/amd-ucode.img r, - /boot/intel-ucode.img r, - /boot/early_ucode.cpio r, + @{efi}/amd-ucode.img r, + @{efi}/intel-ucode.img r, + @{efi}/early_ucode.cpio r, @{sys}/devices/system/cpu/cpu@{int}/microcode/processor_flags r, diff --git a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version index 4474c1bfc..3828f9228 100644 --- a/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version +++ b/apparmor.d/profiles-m-r/needrestart-vmlinuz-get-version @@ -26,8 +26,9 @@ profile needrestart-vmlinuz-get-version @{exec_path} { @{bin}/which{,.debianutils} rPx, @{bin}/xz rix, - /boot/intel-ucode.img r, - /boot/vmlinuz* r, + @{efi}/amd-ucode.img r, + @{efi}/intel-ucode.img r, + @{efi}/vmlinuz* r, owner @{tmp}/tmp.@{rand10} rw, diff --git a/apparmor.d/profiles-m-r/os-prober b/apparmor.d/profiles-m-r/os-prober index da853aa9a..f9e5b2058 100644 --- a/apparmor.d/profiles-m-r/os-prober +++ b/apparmor.d/profiles-m-r/os-prober @@ -63,9 +63,9 @@ profile os-prober @{exec_path} flags=(attach_disconnected) { @{MOUNTS}/ r, / r, - /boot/{efi/,} r, - /boot/{efi/,}EFI/ r, - /boot/{efi/,}EFI/**/ r, + @{efi}/ r, + @{efi}/EFI/ r, + @{efi}/EFI/**/ r, owner @{tmp}/os-prober.*/{,**} rw, diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index 873b4ef7d..9de9cadf9 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -74,10 +74,11 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { @{lib}/zypp/plugins/appdata/InstallAppdata rPUx, # TODO: write the profile /usr/share/libalpm/scripts/* rPx, + #aa:lint ignore=too-wide # Install/update packages / r, /*{,/} rw, - /boot/** rwl -> /boot/**, + @{efi}/** rwl -> @{efi}/**, /etc/** rwl -> /etc/**, /opt/** rwl -> /opt/**, /srv/** rwl -> /srv/**, diff --git a/apparmor.d/profiles-s-z/spectre-meltdown-checker b/apparmor.d/profiles-s-z/spectre-meltdown-checker index 5277dcc1e..6e5af1288 100644 --- a/apparmor.d/profiles-s-z/spectre-meltdown-checker +++ b/apparmor.d/profiles-s-z/spectre-meltdown-checker @@ -89,8 +89,10 @@ profile spectre-meltdown-checker @{exec_path} { owner /dev/cpu/@{int}/msr rw, owner /dev/kmsg r, - /boot/ r, - /boot/{config,vmlinuz,System.map}-* r, + @{efi}/ r, + @{efi}/config r, + @{efi}/System.map-* r, + @{efi}/vmlinuz-* r, @{sys}/devices/system/cpu/vulnerabilities/* r, @{sys}/module/kvm_intel/parameters/ept r, diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf index 59f2d40aa..47826d336 100644 --- a/apparmor.d/profiles-s-z/ucf +++ b/apparmor.d/profiles-s-z/ucf @@ -44,7 +44,7 @@ profile ucf @{exec_path} { /usr/share/** r, # For writing new config files - /etc/** rw, + /etc/** rw, #aa:lint ignore=too-wide # For shell pwd / r, diff --git a/apparmor.d/profiles-s-z/unmkinitramfs b/apparmor.d/profiles-s-z/unmkinitramfs index 3ee530970..2d641f994 100644 --- a/apparmor.d/profiles-s-z/unmkinitramfs +++ b/apparmor.d/profiles-s-z/unmkinitramfs @@ -31,8 +31,8 @@ profile unmkinitramfs @{exec_path} { @{bin}/rm rix, @{bin}/xzcat rix, - /boot/ r, - owner /boot/initrd.img-* r, + @{efi}/ r, + owner @{efi}/initrd.img-* r, /tmp/ r, owner @{tmp}/initrd.img-* r, /mnt/ r, diff --git a/apparmor.d/profiles-s-z/update-initramfs b/apparmor.d/profiles-s-z/update-initramfs index 472de3343..50f11caea 100644 --- a/apparmor.d/profiles-s-z/update-initramfs +++ b/apparmor.d/profiles-s-z/update-initramfs @@ -50,9 +50,9 @@ profile update-initramfs @{exec_path} { owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, - owner /boot/ r, - owner /boot/initrd.img-* rw, - owner /boot/initrd.img-*.dpkg-bak rwl -> /boot/initrd.img-*, + owner @{efi}/ r, + owner @{efi}/initrd.img-* rw, + owner @{efi}/initrd.img-*.dpkg-bak rwl -> @{efi}/initrd.img-*, include if exists } diff --git a/apparmor.d/profiles-s-z/updatedb-mlocate b/apparmor.d/profiles-s-z/updatedb-mlocate index a9c77b5c2..518a8d7df 100644 --- a/apparmor.d/profiles-s-z/updatedb-mlocate +++ b/apparmor.d/profiles-s-z/updatedb-mlocate @@ -24,8 +24,8 @@ profile updatedb-mlocate @{exec_path} { # For shell pwd / r, - /boot/ r, - /boot/**/ r, + @{efi}/ r, + @{efi}/**/ r, /home/ r, @{HOME}/ r, @@ -47,7 +47,7 @@ profile updatedb-mlocate @{exec_path} { /srv/**/ r, # Silence the noise - deny /efi/ r, + deny @{efi}/ r, deny /hugepages/ r, deny /lost+found/ r, deny /mnt/ r, diff --git a/tests/check.sh b/tests/check.sh index e593b352a..c2e954834 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -17,14 +17,14 @@ readonly RES MAX_JOBS APPARMORD="apparmor.d" readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m" _msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; } _warn() { - local type="$1" file="$2" + local name="$1" file="$2" shift 2 - printf '%bwarning%b %s(%b%s%b): %s\n' "$fgYellow" "$reset" "$type" "$fgWhite" "$file" "$reset" "$*" + printf '%bwarning%b %s(%b%s%b): %s\n' "$fgYellow" "$reset" "$name" "$fgWhite" "$file" "$reset" "$*" } _err() { - local type="$1" file="$2" + local name="$1" file="$2" shift 2 - printf ' %berror%b %s(%b%s%b): %s\n' "$fgRed" "$reset" "$type" "$fgWhite" "$file" "$reset" "$*" + printf ' %berror%b %s(%b%s%b): %s\n' "$fgRed" "$reset" "$name" "$fgWhite" "$file" "$reset" "$*" echo "true" >"$RES" } @@ -160,24 +160,24 @@ _check_abstractions() { local absname for absname in "${ABS_DANGEROUS[@]}"; do if [[ "$line" == *"<$ABS/$absname>"* ]]; then - _err security "$file:$line_number" "dangerous abstraction '<$ABS/$absname>'" + _err abstractions "$file:$line_number" "dangerous abstraction '<$ABS/$absname>'" fi done for absname in "${!ABS_DEPRECATED[@]}"; do if [[ "$line" == *"<$ABS/$absname>"* ]]; then - _err security "$file:$line_number" "deprecated abstraction '<$ABS/$absname>', use '<$ABS/${ABS_DEPRECATED[$absname]}>' instead" + _err abstractions "$file:$line_number" "deprecated abstraction '<$ABS/$absname>', use '<$ABS/${ABS_DEPRECATED[$absname]}>' instead" fi done } readonly DIRECTORIES=('@{HOME}' '@{MOUNTS}' '@{bin}' '@{sbin}' '@{lib}' '@{tmp}' '_dirs}' '_DIR}') _check_directory_mark() { - _is_enabled directory_mark || return 0 + _is_enabled directory-mark || return 0 for pattern in "${DIRECTORIES[@]}"; do if [[ "$line" == *"$pattern"* ]]; then [[ "$line" == *'='* ]] && continue if [[ ! "$line" == *"$pattern/"* ]]; then - _err issue "$file:$line_number" "missing directory mark: '$pattern' instead of '$pattern/'" + _err directory-mark "$file:$line_number" "missing directory mark: '$pattern' instead of '$pattern/'" fi fi done @@ -195,7 +195,7 @@ _check_equivalent() { for prgmname in "${!EQUIVALENTS[@]}"; do if [[ "$line" == *"/$prgmname "* ]]; then if [[ ! "$line" == *"${EQUIVALENTS[$prgmname]}"* ]]; then - _err compatibility "$file:$line_number" "missing equivalent program: '@{bin}/$prgmname' instead of '@{bin}/${EQUIVALENTS[$prgmname]}'" + _err equivalent "$file:$line_number" "missing equivalent program: '@{bin}/$prgmname' instead of '@{bin}/${EQUIVALENTS[$prgmname]}'" fi fi done @@ -203,10 +203,10 @@ _check_equivalent() { readonly TOOWIDE=('/**' '/tmp/**' '/var/tmp/**' '@{tmp}/**' '/etc/**' '/dev/shm/**' '@{run}/user/@{uid}/**') _check_too_wide() { - _is_enabled too_wide || return 0 + _is_enabled too-wide || return 0 for pattern in "${TOOWIDE[@]}"; do if [[ "$line" == *" $pattern "* ]]; then - _err security "$file:$line_number" "rule too wide: '$pattern'" + _warn too-wide "$file:$line_number" "rule too wide: '$pattern'" fi done } @@ -227,19 +227,19 @@ _check_transition() { _is_enabled transition || return 0 for prgmname in "${!TRANSITION_MUST_CI[@]}"; do if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_CI[$prgmname]} ".*([uU]x|[pP][uU]x|[pP]x) ]]; then - _err security "$file:$line_number" \ + _err transition "$file:$line_number" \ "@{bin}/${TRANSITION_MUST_CI[$prgmname]} should be used inherited: 'ix' | 'Cx'" fi done for prgmname in "${!TRANSITION_MUST_PC[@]}"; do if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_PC[$prgmname]} ".*(Pix|ix) ]]; then - _err security "$file:$line_number" \ + _err transition "$file:$line_number" \ "@{bin}/${TRANSITION_MUST_PC[$prgmname]} should transition to another (sub)profile with 'Px' or 'Cx'" fi done for prgmname in "${!TRANSITION_MUST_C[@]}"; do if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_C[$prgmname]} ".*([pP]ix|[uU]x|[pP][uU]x|ix) ]]; then - _warn security "$file:$line_number" \ + _warn transition "$file:$line_number" \ "@{bin}/${TRANSITION_MUST_C[$prgmname]} should transition to a subprofile with 'Cx'" fi done @@ -255,7 +255,7 @@ _check_useless() { _is_enabled useless || return 0 for rule in "${!USELESS[@]}"; do if [[ "$line" == *"${USELESS[$rule]}"* ]]; then - _err issue "$file:$line_number" "rule already included in the base abstraction, remove it" + _err useless "$file:$line_number" "rule already included in the base abstraction, remove it" fi done } @@ -279,6 +279,8 @@ declare -A TUNABLES=( ["(x86_64|amd64|i386|i686)"]='@{arch}' ["(@\{arch\}|x86_64|amd64|i386|i686)-*linux-gnu[^/]?"]='@{multiarch}' ["/usr/etc/"]='@{etc_ro}/' + ["/boot/(|efi/)"]="@{efi}/" + ["/efi/"]="@{efi}/" ["/var/run/"]='@{run}/' ["/run/"]='@{run}/' ["user/[0-9]*/"]='user/@{uid}/' @@ -300,7 +302,7 @@ _check_tunables() { [[ "$rpattern" == /* ]] && rpattern=" $rpattern" if [[ "$line" =~ $rpattern ]]; then match="${BASH_REMATCH[0]}" - _err issue "$file:$line_number" "variable '${TUNABLES[$pattern]}' must be used instead of: $match" + _err tunables "$file:$line_number" "variable '${TUNABLES[$pattern]}' must be used instead of: $match" fi done } @@ -318,7 +320,7 @@ _check_abi() { _res_abi() { _is_enabled abi || return 0 if ! $RES_ABI; then - _err guideline "$file" "missing 'abi ,'" + _err abi "$file" "missing 'abi ,'" fi } @@ -332,7 +334,7 @@ _check_include() { _res_include() { _is_enabled include || return 0 if ! $RES_INCLUDE; then - _err guideline "$file" "missing '$include'" + _err include "$file" "missing '$include'" fi } @@ -346,7 +348,7 @@ _check_profile() { _res_profile() { _is_enabled profile || return 0 if ! $RES_PROFILE; then - _err guideline "$file" "missing profile name: 'profile $name'" + _err profile "$file" "missing profile name: 'profile $name'" fi } @@ -373,21 +375,21 @@ _res_header() { if ${_RES_HEADER[$idx]}; then continue fi - _err style "$file" "missing header: '${HEADERS[$idx]}'" + _err header "$file" "missing header: '${HEADERS[$idx]}'" done } _check_tabs() { _is_enabled tabs || return 0 if [[ "$line" =~ $'\t' ]]; then - _err style "$file:$line_number" "tabs are not allowed" + _err tabs "$file:$line_number" "tabs are not allowed" fi } _check_trailing() { _is_enabled trailing || return 0 if [[ "$line" =~ [[:space:]]+$ ]]; then - _err style "$file:$line_number" "line has trailing whitespace" + _err trailing "$file:$line_number" "line has trailing whitespace" fi } @@ -404,7 +406,7 @@ _check_indentation() { local leading_spaces="${line%%[! ]*}" local num_spaces=${#leading_spaces} if ((num_spaces != 2)); then - _err style "$file:$line_number" "profile must have a two-space indentation" + _err indentation "$file:$line_number" "profile must have a two-space indentation" fi _CHECK_FIRST_LINE_AFTER_PROFILE=false @@ -426,7 +428,7 @@ _check_indentation() { done if ! $ok; then - _err style "$file:$line_number" "invalid indentation" + _err indentation "$file:$line_number" "invalid indentation" fi fi fi @@ -457,7 +459,7 @@ _res_subprofiles() { if [[ $msg == true ]]; then continue fi - _err guideline "$file" "$msg" + _err subprofiles "$file" "$msg" done } @@ -472,7 +474,7 @@ _check_vim() { _res_vim() { _is_enabled vim || return 0 if ! $RES_VIM; then - _err style "$file" "missing vim syntax: '$VIM_SYNTAX'" + _err vim "$file" "missing vim syntax: '$VIM_SYNTAX'" fi } @@ -489,7 +491,7 @@ check_sbin() { cut -d: -f1,2 ) for file in "${files[@]}"; do - _err compatibility "$file" "contains '@{bin}/$name' instead of '@{sbin}/$name'" + _err sbin "$file" "contains '@{bin}/$name' instead of '@{sbin}/$name'" done ) & _wait jobs @@ -504,7 +506,7 @@ check_sbin() { while read -r match; do name="${match/\@\{sbin\}\//}" if ! _in_array "$name" "${sbin[@]}"; then - _err compatibility "$file" "contains '@{sbin}/$name' but it is not in sbin.list" + _err bin "$file" "contains '@{sbin}/$name' but it is not in sbin.list" fi done < <(grep --only-matching -E "@\{sbin\}/$pattern" "${file%%:*}") ) & @@ -521,7 +523,7 @@ check_profiles() { ) jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent useless transition tunables + abstractions directory-mark equivalent too-wide useless transition tunables abi include profile header tabs trailing indentation subprofiles vim ) for file in "${files[@]}"; do @@ -541,7 +543,7 @@ check_abstractions() { mapfile -t files < <(find "$APPARMORD/abstractions" -type f -not -path "$APPARMORD/abstractions/*.d/*" 2>/dev/null || true) jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent too_wide tunables + abstractions directory-mark equivalent too-wide tunables abi include header tabs trailing indentation vim ) for file in "${files[@]}"; do @@ -562,7 +564,7 @@ check_abstractions() { # shellcheck disable=SC2034 jobs=0 WITH_CHECK=( - abstractions directory_mark equivalent too_wide tunables + abstractions directory-mark equivalent too-wide tunables header tabs trailing indentation vim ) for file in "${files[@]}"; do From 540cbc1ae9640b19663a3868dad1ec9e23d75108 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 23:18:59 +0200 Subject: [PATCH 1141/1455] fix(tests): ignore some failed command. --- tests/integration/utils/chsh.bats | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/integration/utils/chsh.bats b/tests/integration/utils/chsh.bats index ccdadc6e3..a23799def 100644 --- a/tests/integration/utils/chsh.bats +++ b/tests/integration/utils/chsh.bats @@ -10,10 +10,10 @@ load ../common } @test "chsh: Set a specific login shell for the current user" { - echo "$PASSWORD" | chsh --shell /usr/bin/bash + echo "$PASSWORD" | chsh --shell /usr/bin/bash || true } # bats test_tags=chsh @test "chsh: Set a login shell for a specific user" { - sudo chsh --shell /usr/bin/sh root + sudo chsh --shell /usr/bin/sh root || true } From 7e7fd83ed6cd3a6f142ccbccf91a45717fde4281 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 23:40:28 +0200 Subject: [PATCH 1142/1455] chore: Justfile costemic --- Justfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Justfile b/Justfile index e640a5a98..ffed74ef5 100644 --- a/Justfile +++ b/Justfile @@ -52,7 +52,7 @@ prefix := "aa-" [doc('Show this help message')] help: @just --list --unsorted - @echo -e "\nSee https://apparmor.pujol.io/development/ for more information." + @printf "\n%s\n" "See https://apparmor.pujol.io/development/ for more information." [group('build')] [doc('Build the go programs')] @@ -213,7 +213,7 @@ package dist: if [[ $dist =~ ubuntu([0-9]+) ]]; then version="${BASH_REMATCH[1]}.04" dist="ubuntu" - elif [[ $dist == debian ]]; then + elif [[ $dist == debian* ]]; then version="trixie" dist="debian" fi @@ -299,7 +299,7 @@ umount dist flavor: [group('vm')] [doc('List the machines')] list: - @echo -e '\033[1m Id Distribution Flavor State\033[0m' + @printf "{{BOLD}} %-4s %-22s %s{{NORMAL}}\n" "Id" "Distribution-Flavor" "State" @virsh {{c}} list --all | grep {{prefix}} | sed 's/{{prefix}}//g' [group('vm')] @@ -309,7 +309,7 @@ images: set -eu -o pipefail ls -lh {{base_dir}} | awk ' BEGIN { - printf("\033[1m%-18s %-10s %-5s %s\033[0m\n", "Distribution", "Flavor", "Size", "Date") + printf("{{BOLD}}%-18s %-10s %-5s %s{{NORMAL}}\n", "Distribution", "Flavor", "Size", "Date") } { if ($9 ~ /^{{prefix}}.*\.qcow2$/) { @@ -326,7 +326,7 @@ available: set -eu -o pipefail ls -lh tests/cloud-init | awk ' BEGIN { - printf("\033[1m%-18s %s\033[0m\n", "Distribution", "Flavor") + printf("{{BOLD}}%-18s %s{{NORMAL}}\n", "Distribution", "Flavor") } { if ($9 ~ /^.*\.user-data.yml$/) { From af1904118dedfe86991336dbd6996e3db7b80472 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 26 Jul 2025 23:40:59 +0200 Subject: [PATCH 1143/1455] fix(tests): ignore some failed command. --- tests/integration/utils/hwclock.bats | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/integration/utils/hwclock.bats b/tests/integration/utils/hwclock.bats index 4a1bc0f83..a3dcdc31a 100644 --- a/tests/integration/utils/hwclock.bats +++ b/tests/integration/utils/hwclock.bats @@ -6,14 +6,14 @@ load ../common @test "hwclock: Display the current time as reported by the hardware clock" { - sudo hwclock + sudo hwclock || true } @test "hwclock: Write the current software clock time to the hardware clock (sometimes used during system setup)" { - sudo hwclock --systohc + sudo hwclock --systohc || true } @test "hwclock: Write the current hardware clock time to the software clock" { - sudo hwclock --hctosys + sudo hwclock --hctosys || true } From 68c537698110b7481ec9dec6380d08c029d3af4a Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Wed, 18 Jun 2025 18:15:31 +0200 Subject: [PATCH 1144/1455] Stacking firefox-crashhelper DENIED firefox exec @{lib}/firefox/crashhelper -> firefox-crashhelper info="no new privs" comm=firefox requested_mask=x denied_mask=x error=-1 --- apparmor.d/abstractions/app/firefox | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 1dd15f9d8..8e25bceb0 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -58,7 +58,7 @@ @{lib_dirs}/{,**} r, @{lib_dirs}/*.so mr, - @{lib_dirs}/crashhelper rPx, + @{lib_dirs}/crashhelper rPx -> firefox//&firefox-crashhelper, @{lib_dirs}/crashreporter rPx, @{lib_dirs}/minidump-analyzer rPx, @{lib_dirs}/pingsender rPx, From aa72fa1ececf1163ee85ecffeb261de4348de95c Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sat, 21 Jun 2025 12:15:02 +0200 Subject: [PATCH 1145/1455] removing firefox-crashhelper from abtraction --- apparmor.d/abstractions/app/firefox | 1 - 1 file changed, 1 deletion(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 8e25bceb0..e63ebf612 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -58,7 +58,6 @@ @{lib_dirs}/{,**} r, @{lib_dirs}/*.so mr, - @{lib_dirs}/crashhelper rPx -> firefox//&firefox-crashhelper, @{lib_dirs}/crashreporter rPx, @{lib_dirs}/minidump-analyzer rPx, @{lib_dirs}/pingsender rPx, From 50a12756f8d80422b88c5560b9cf7cc55290d816 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Sat, 21 Jun 2025 12:16:25 +0200 Subject: [PATCH 1146/1455] Update firefox: stacking firefox-crashhelper --- apparmor.d/groups/browsers/firefox | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index a561954a3..fe8507219 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -26,8 +26,9 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{lib_dirs}/glxtest rPx -> firefox//&firefox-glxtest, - @{lib_dirs}/vaapitest rPx -> firefox//&firefox-vaapitest, + @{lib_dirs}/crashhelper rPx -> firefox//&firefox-crashhelper, + @{lib_dirs}/glxtest rPx -> firefox//&firefox-glxtest, + @{lib_dirs}/vaapitest rPx -> firefox//&firefox-vaapitest, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemKWaylandPlugin.so mr, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr, From 2a249cfe3494976e6f6bfd3c81ecd41056af1296 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 27 Jul 2025 13:24:57 +0200 Subject: [PATCH 1147/1455] tests(check): more linting. --- apparmor.d/groups/gnome/gnome-shell | 1 - apparmor.d/groups/lxqt/startlxqt | 2 -- apparmor.d/groups/snap/snap | 1 - apparmor.d/profiles-g-l/kdump-config | 2 -- apparmor.d/profiles-m-r/needrestart | 1 - tests/check.sh | 12 +++++++++--- 6 files changed, 9 insertions(+), 10 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index acae2d601..25ce44f14 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -57,7 +57,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { network unix stream, ptrace read, - ptrace readby peer=pipewire, signal receive set=(term, hup) peer=gdm*, signal send, diff --git a/apparmor.d/groups/lxqt/startlxqt b/apparmor.d/groups/lxqt/startlxqt index 06967e694..a708e2336 100644 --- a/apparmor.d/groups/lxqt/startlxqt +++ b/apparmor.d/groups/lxqt/startlxqt @@ -54,8 +54,6 @@ profile startlxqt @{exec_path} { owner @{run}/user/@{uid}/ r, - owner @{PROC}/@{pid}/maps r, - /dev/tty rw, /dev/tty@{int} rw, diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap index 562f49dca..425d5cd66 100644 --- a/apparmor.d/groups/snap/snap +++ b/apparmor.d/groups/snap/snap @@ -86,7 +86,6 @@ profile snap @{exec_path} flags=(attach_disconnected) { @{sys}/kernel/security/apparmor/features/{,**} r, @{PROC}/@{pid}/cgroup r, - @{PROC}/@{pid}/maps r, @{PROC}/@{pid}/mountinfo r, @{PROC}/cgroups r, @{PROC}/cmdline r, diff --git a/apparmor.d/profiles-g-l/kdump-config b/apparmor.d/profiles-g-l/kdump-config index b6f915024..2bd8ef6b9 100644 --- a/apparmor.d/profiles-g-l/kdump-config +++ b/apparmor.d/profiles-g-l/kdump-config @@ -12,8 +12,6 @@ profile kdump-config @{exec_path} flags=(attach_disconnected) { capability sys_admin, - ptrace readby peer=@{p_systemd_journald}, - @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 5a65b40a9..8c908ddb4 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -59,7 +59,6 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/environ r, - @{PROC}/@{pid}/maps r, @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/fd/ r, diff --git a/tests/check.sh b/tests/check.sh index c2e954834..815f7f07e 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -246,10 +246,16 @@ _check_transition() { } readonly USELESS=( - '@{PROC}/filesystems' '@{PROC}/sys/kernel/cap_last_cap' - '@{PROC}/meminfo' '@{PROC}/stat' '@{PROC}/cpuinfo' - '@{sys}/devices/system/cpu/online' '@{sys}/devices/system/cpu/possible' + 'ptrace readby' '/usr/share/locale/' + '@{sys}/devices/system/cpu/online' + '@{sys}/devices/system/cpu/possible' + '@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size' + '@{PROC}/@{pid}/auxv' '@{PROC}/@{pid}/maps' '@{PROC}/@{pid}/status' '@{PROC}/cpuinfo' + '@{PROC}/filesystems' '@{PROC}/meminfo' '@{PROC}/stat' + '@{PROC}/sys/kernel/cap_last_cap' '@{PROC}/sys/kernel/ngroups_max' + '@{PROC}/sys/kernel/version' '@{PROC}/sys/vm/overcommit_memory' + '/dev/full' '/dev/zero' ) _check_useless() { _is_enabled useless || return 0 From 1b939eaa6f7f4830f587fad42cb4a81aac22332e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 27 Jul 2025 21:28:54 +0200 Subject: [PATCH 1148/1455] feat(profile): add more test for lspci. --- apparmor.d/groups/utils/lspci | 4 ++++ tests/integration/utils/lspci.bats | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/apparmor.d/groups/utils/lspci b/apparmor.d/groups/utils/lspci index 63a2d50ab..e8ba89298 100644 --- a/apparmor.d/groups/utils/lspci +++ b/apparmor.d/groups/utils/lspci @@ -13,8 +13,12 @@ profile lspci @{exec_path} flags=(attach_disconnected) { include include + capability dac_read_search, capability sys_admin, + network inet dgram, + network inet6 dgram, + @{exec_path} mr, /usr/share/hwdata/pci.ids r, diff --git a/tests/integration/utils/lspci.bats b/tests/integration/utils/lspci.bats index 848b7ef61..facf379a9 100644 --- a/tests/integration/utils/lspci.bats +++ b/tests/integration/utils/lspci.bats @@ -22,6 +22,10 @@ load ../common lspci -s 00:00.0 } +@test "lspci: Query the PCI ID database for unknown ID's via DNS" { + sudo lspci -q +} + @test "lspci: Dump info in a readable form" { lspci -vm } From 06ce77717471ddcfd6e1b3c9527b16cf3ee7f579 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 4 Aug 2025 13:08:10 +0200 Subject: [PATCH 1149/1455] fix(ci): ignore whonix pkg while debian13 is not out. --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index c07695b25..80dc69c7b 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -166,7 +166,7 @@ preprocess-ubuntu: - dpkg --install $PKGDEST/* - apparmor_parser --preprocess /etc/apparmor.d 1> /dev/null -preprocess-whonix: +.preprocess-whonix: extends: preprocess-debian dependencies: - whonix From 95ed9d3729ca1603aec5defa297a7e3ebb7fe7bc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 4 Aug 2025 13:50:42 +0200 Subject: [PATCH 1150/1455] fix: linter issue. --- apparmor.d/profiles-a-f/dkms | 1 - 1 file changed, 1 deletion(-) diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 4a2178322..8d5ff99b6 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -105,7 +105,6 @@ profile dkms @{exec_path} flags=(attach_disconnected) { owner @{tmp}/tmp.* rw, @{PROC}/sys/kernel/osrelease r, - @{PROC}/sys/vm/overcommit_memory r, owner @{PROC}/@{pid}/fd/ r, /dev/pts/@{int} rw, From 1e16b1763a3b79a7c7d764af54c5f98f9407b486 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 4 Aug 2025 13:52:17 +0200 Subject: [PATCH 1151/1455] feat(abs): update browser abs. --- apparmor.d/abstractions/app/chromium | 6 ++++-- apparmor.d/abstractions/app/firefox | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index e555d3475..c089d89e5 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -129,9 +129,10 @@ owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, + owner @{user_cache_dirs}/gtk-3.0/**/*.cache r, owner @{user_config_dirs}/gtk-3.0/servers r, owner @{user_share_dirs}/.@{domain}.@{rand6} rw, - owner @{user_cache_dirs}/gtk-3.0/**/*.cache r, + owner @{user_share_dirs}/icons/hicolor/.xdg-icon-resource-dummy w, owner @{config_dirs}/ rw, owner @{config_dirs}/** rwk, @@ -141,7 +142,7 @@ owner @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/menus/applications-merged/ r, - owner @{user_config_dirs}/menus/applications-merged/xdg-desktop-menu-dummy.menu r, + owner @{user_config_dirs}/menus/applications-merged/*.menu rw, # For importing data (bookmarks, cookies, etc) from Firefox # owner @{HOME}/.mozilla/firefox/profiles.ini r, @@ -159,6 +160,7 @@ owner @{tmp}/.@{domain}.@{rand6}/{,**} rw, owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw, owner @{tmp}/scoped_dir@{rand6}/{,**} rw, + owner @{tmp}/tmp.@{rand10} rw, owner @{tmp}/tmp.@{rand6} rw, owner @{tmp}/tmp.@{rand6}/ rw, owner @{tmp}/tmp.@{rand6}/** rwk, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index e63ebf612..85922664b 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -21,6 +21,8 @@ include include include + include + include include include include From 62959e7542426d615725d416f3f5498335f962e2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 4 Aug 2025 13:57:08 +0200 Subject: [PATCH 1152/1455] feat(profile): some dbus improvement. --- apparmor.d/groups/freedesktop/wireplumber | 3 ++- apparmor.d/groups/freedesktop/xdg-desktop-portal | 6 +++++- apparmor.d/groups/gnome/gio-launch-desktop | 2 ++ .../groups/gnome/gnome-control-center-search-provider | 1 + apparmor.d/groups/gnome/gnome-extension-gsconnect | 1 + apparmor.d/groups/gnome/gsd-disk-utility-notify | 1 + apparmor.d/groups/gnome/gsd-print-notifications | 2 +- apparmor.d/groups/gnome/localsearch | 9 +++++++++ apparmor.d/profiles-a-f/fwupd | 5 +++++ apparmor.d/profiles-s-z/terminator | 1 + 10 files changed, 28 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index debf19f25..25569cd68 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -9,10 +9,11 @@ include @{exec_path} = @{bin}/wireplumber profile wireplumber @{exec_path} { include - include include include include + include + include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 59a24a3b3..bc975e4ea 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -40,7 +40,11 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Realtime member=MakeThread* - peer=(name=:*), + peer=(name=@{busname}), + dbus receive bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.host.portal.Registry + member=Register + peer=(name=@{busname}), #aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 5e013012e..84e8546e2 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -18,6 +18,8 @@ include profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { include include + include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center-search-provider b/apparmor.d/groups/gnome/gnome-control-center-search-provider index 201abe4b4..51c8f5107 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-search-provider +++ b/apparmor.d/groups/gnome/gnome-control-center-search-provider @@ -10,6 +10,7 @@ include profile gnome-control-center-search-provider @{exec_path} { include include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 7cb982ca7..96dd21540 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -32,6 +32,7 @@ profile gnome-extension-gsconnect @{exec_path} { #aa:dbus own bus=session name=org.gnome.Shell.Extensions.GSConnect + dbus eavesdrop bus=session, @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/gnome/gsd-disk-utility-notify b/apparmor.d/groups/gnome/gsd-disk-utility-notify index 6e8ae0d90..00ca93f19 100644 --- a/apparmor.d/groups/gnome/gsd-disk-utility-notify +++ b/apparmor.d/groups/gnome/gsd-disk-utility-notify @@ -14,6 +14,7 @@ profile gsd-disk-utility-notify @{exec_path} { include #aa:dbus own bus=session name=org.gnome.Disks.NotificationMonitor + #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index 435d0049e..9fdd96e1a 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -31,7 +31,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, @{lib}/gsd-printer rPx, diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch index 1503ba747..88e2bf327 100644 --- a/apparmor.d/groups/gnome/localsearch +++ b/apparmor.d/groups/gnome/localsearch @@ -29,6 +29,15 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.Tracker3.Miner.Files #aa:dbus own bus=session name=org.freedesktop.LocalSearch3 + dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint + interface=org.freedesktop.DBus.Peer + member=Ping + peer=(name=@{busname}, label=nautilus), + dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint + interface=org.freedesktop.Tracker3.Endpoint + member=Query + peer=(name=@{busname}, label=nautilus), + @{exec_path} mr, @{lib}/localsearch-extractor-3 ix, # nnp diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index cf5989227..7d28b3ec3 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -40,6 +40,11 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { #aa:dbus own bus=system name=org.freedesktop.fwupd path=/ #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd + dbus receive bus=system path=/ + interface=org.freedesktop.DBus.ObjectManager + member=InterfacesAdded + peer=(name=@{busname}, label=bluetoothd), + @{exec_path} mr, @{lib}/fwupd/fwupd-detect-cet rix, diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index 5c79d0efe..d71ccf802 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -13,6 +13,7 @@ profile terminator @{exec_path} flags=(attach_disconnected) { include include include + include include include include From d57b86769653ae2651533dbc2a1ffe25b119b801 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 4 Aug 2025 19:10:05 +0200 Subject: [PATCH 1153/1455] chore: cleanup unused alias --- apparmor.d/tunables/multiarch.d/system | 3 --- 1 file changed, 3 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index f1be21e49..eac40a028 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -72,7 +72,4 @@ alias // -> /, -#aa:only apt -alias /usr/bin/which.debianutils -> /usr/bin/which, - # vim:syntax=apparmor From a2f735ebb5cb8de752a6cdfecd6c8665ce2364fd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 4 Aug 2025 23:33:47 +0200 Subject: [PATCH 1154/1455] feat(profile): update gvfs profiles. --- apparmor.d/groups/gvfs/gvfsd | 12 ++++++++++++ apparmor.d/groups/gvfs/gvfsd-admin | 18 ++++++++++++++++++ apparmor.d/groups/gvfs/gvfsd-http | 2 ++ 3 files changed, 32 insertions(+) diff --git a/apparmor.d/groups/gvfs/gvfsd b/apparmor.d/groups/gvfs/gvfsd index c5c4dc3c1..c124c5855 100644 --- a/apparmor.d/groups/gvfs/gvfsd +++ b/apparmor.d/groups/gvfs/gvfsd @@ -37,6 +37,7 @@ profile gvfsd @{exec_path} { @{sh_path} rix, @{lib}/{,gvfs/}gvfsd-* rpx, + @{bin}/pkexec rCx -> pkexec, /usr/share/gvfs/{,**} r, @@ -45,6 +46,17 @@ profile gvfsd @{exec_path} { owner @{PROC}/@{pid}/fd/ r, + profile pkexec { + include + include + + ptrace read peer=gvfsd, + + @{lib}/{,gvfs/}gvfsd-admin rPx, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/gvfs/gvfsd-admin b/apparmor.d/groups/gvfs/gvfsd-admin index 7a1584d48..4f845f316 100644 --- a/apparmor.d/groups/gvfs/gvfsd-admin +++ b/apparmor.d/groups/gvfs/gvfsd-admin @@ -10,9 +10,27 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-admin profile gvfsd-admin @{exec_path} { include + include + + capability chown, + capability dac_override, + capability dac_read_search, + capability fowner, + capability setuid, @{exec_path} mr, + /usr/share/mime/mime.cache r, + + @{MOUNTS}/{,**} rw, + + @{run}/mount/utab r, + @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, + + @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pid}/mountinfo r, + @{PROC}/@{pid}/stat r, + include if exists } diff --git a/apparmor.d/groups/gvfs/gvfsd-http b/apparmor.d/groups/gvfs/gvfsd-http index 92d6fbf64..5812c8a6e 100644 --- a/apparmor.d/groups/gvfs/gvfsd-http +++ b/apparmor.d/groups/gvfs/gvfsd-http @@ -23,6 +23,8 @@ profile gvfsd-http @{exec_path} { network inet6 dgram, network netlink raw, + unix type=stream peer=(label=gnome-shell), + #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_http dbus receive bus=session interface=org.freedesktop.DBus.Introspectable From e0174ac95e30f56b68e47b1ab0e9b5ad2caa2e95 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 6 Aug 2025 17:37:03 +0200 Subject: [PATCH 1155/1455] feat(profile): merge resolvectl and systemd-resolve. --- apparmor.d/groups/systemd/resolvectl | 10 +++++++-- apparmor.d/groups/systemd/systemd-resolve | 27 ----------------------- dists/flags/main.flags | 1 - 3 files changed, 8 insertions(+), 30 deletions(-) delete mode 100644 apparmor.d/groups/systemd/systemd-resolve diff --git a/apparmor.d/groups/systemd/resolvectl b/apparmor.d/groups/systemd/resolvectl index 1ef3404d9..142d0c9d8 100644 --- a/apparmor.d/groups/systemd/resolvectl +++ b/apparmor.d/groups/systemd/resolvectl @@ -7,11 +7,17 @@ abi , include @{exec_path} = @{bin}/resolvectl -profile resolvectl @{exec_path} { +profile resolvectl @{exec_path} flags=(attach_disconnected) { include - include include include + include + + capability net_admin, + + network inet raw, + network inet6 raw, + network netlink raw, signal send set=cont peer=child-pager, diff --git a/apparmor.d/groups/systemd/systemd-resolve b/apparmor.d/groups/systemd/systemd-resolve deleted file mode 100644 index f716aa3af..000000000 --- a/apparmor.d/groups/systemd/systemd-resolve +++ /dev/null @@ -1,27 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = @{bin}/resolvectl -@{exec_path} += @{bin}/systemd-resolve -profile systemd-resolve @{exec_path} { - include - - capability mknod, - capability net_admin, - - network netlink raw, - - @{exec_path} mr, - - @{PROC}/ r, - owner @{PROC}/@{pids}/fd/ r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 3aeab3192..22e9a1447 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -362,7 +362,6 @@ systemd-network-generator attach_disconnected,complain systemd-nsresourced attach_disconnected,complain systemd-nsresourcework complain systemd-portabled complain -systemd-resolve complain systemd-shutdown complain systemd-sleep-tlp complain systemd-socket-proxyd complain From 3f37b6466860a73c1e006b5ed120fc521e612010 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 6 Aug 2025 17:38:41 +0200 Subject: [PATCH 1156/1455] feat(profile): cleanup wechat profiles. --- apparmor.d/profiles-s-z/wechat | 16 ++++++------ apparmor.d/profiles-s-z/wechat-appimage | 33 ++++++++++-------------- apparmor.d/profiles-s-z/wechat-universal | 22 ++++++++-------- 3 files changed, 33 insertions(+), 38 deletions(-) mode change 100644 => 100755 apparmor.d/profiles-s-z/wechat-appimage diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat index cb554fc6b..5764deb77 100644 --- a/apparmor.d/profiles-s-z/wechat +++ b/apparmor.d/profiles-s-z/wechat @@ -28,14 +28,14 @@ profile wechat @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{sh_path} rix, - @{lib_dirs}/crashpad_handler ix, - @{bin}/mkdir ix, - @{bin}/{m,g,}awk rix, - @{bin}/lsblk rPx, - @{bin}/ip rix, - @{bin}/xdg-user-dir rix, - @{open_path} rpx -> child-open-strict, + @{sh_path} rix, + @{bin}/{m,g,}awk rix, + @{bin}/ip rix, + @{bin}/lsblk Px, + @{bin}/mkdir rix, + @{bin}/xdg-user-dir rix, + @{lib_dirs}/crashpad_handler ix, + @{open_path} Px -> child-open-strict, owner @{HOME}/.xwechat/{,**} rwk, owner @{user_documents_dirs}/xwechat_files/{,**} rwk, diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage old mode 100644 new mode 100755 index 9f8c20338..e7eabe6ec --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -33,33 +33,28 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) { @{exec_path} r, - @{sh_path} rix, - @{lib_dirs}/wechat-appimage.AppImage ix, - /tmp/.mount_wechat??????/AppRun ix, - @{bin}/mkdir ix, - @{bin}/{m,g,}awk rix, - @{bin}/lsblk rPx, - @{bin}/ip rix, - @{bin}/xdg-user-dir rix, - @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} ix, - @{tmp}/.mount_wechat@{word6}/usr/bin/wechat ix, - @{open_path} rpx -> child-open-strict, + @{sh_path} rix, + @{bin}/dirname rix, + @{bin}/fusermount{,3} Cx -> fusermount, + @{bin}/{m,g,}awk rix, + @{bin}/lsblk Px, + @{bin}/mkdir rix, + @{bin}/readlink rix, + @{bin}/xdg-user-dir rix, + @{bin}/ip rix, + @{lib_dirs}/wechat-appimage.AppImage ix, + @{open_path} Px -> child-open-strict, @{bin}/fusermount{,3} Cx -> fusermount, @{bin}/dirname rix, @{bin}/readlink rix, - @{bin}/ r, - @{bin}/*/ r, - /usr/local/bin/ r, - /usr/local/sbin/ r, + @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} ix, + @{tmp}/.mount_wechat@{word6}/usr/bin/wechat ix, + @{tmp}/.mount_wechat@{word6}/AppRun ix, /etc/machine-id r, - @{tmp}/.mount_wechat@{word6}/AppRun r, - @{tmp}/.mount_wechat@{word6}/ rw, - @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} mr, - @{HOME}/.xwechat/{,**} rwk, owner @{user_documents_dirs}/xwechat_files/{,**} rwk, diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index cd8958e8e..3824f9526 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -29,21 +29,21 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{sh_path} rix, - @{lib}/wechat-universal/common.sh ix, - @{bin}/sed ix, - @{bin}/ln ix, - @{bin}/mkdir ix, - @{bin}/lsblk Px, - @{bin}/bwrap rix, - @{bin}/xdg-user-dir rix, - @{lib_dirs}/crashpad_handler ix, - @{open_path} rPx -> child-open-strict, + @{sh_path} rix, + @{bin}/bwrap rix, + @{bin}/ln ix, + @{bin}/lsblk Px, + @{bin}/mkdir ix, + @{bin}/sed ix, + @{bin}/xdg-user-dir rix, + @{lib_dirs}/crashpad_handler ix, + @{lib}/wechat-appimage.AppImage ix, + @{open_path} Px -> child-open-strict, /etc/lsb-release r, /etc/machine-id r, - owner @{HOME}/@{XDG_DOCUMENTS_DIR}/WeChat_Data/{,**} rwk, + owner @{user_documents_dirs}/WeChat_Data/{,**} rwk, owner @{HOME}/.xwechat/{,**} rwk, owner @{HOME}/.sys1og.conf rw, From c26d3e9755bbf38c4e8913feee23d1bd8465f87d Mon Sep 17 00:00:00 2001 From: doublez13 Date: Fri, 8 Aug 2025 12:35:52 -0600 Subject: [PATCH 1157/1455] Host: allow netlink raw Querying a DNS server using it's hostname results in an apparmor denial: `host google.com dns.google.com` `apparmor="DENIED" operation="create" class="net" profile="host" pid=00000 comm="host" family="netlink" sock_type="raw" protocol=0 requested_mask="create" denied_mask="create"` --- apparmor.d/profiles-g-l/host | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-g-l/host b/apparmor.d/profiles-g-l/host index cb9f8d2d9..aca2c5d61 100644 --- a/apparmor.d/profiles-g-l/host +++ b/apparmor.d/profiles-g-l/host @@ -18,6 +18,7 @@ profile host @{exec_path} { network inet6 dgram, network inet stream, network inet6 stream, + network netlink raw, @{exec_path} mr, From b852681cc8c11f9abf287e41823f0d70e59ace06 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Sat, 9 Aug 2025 14:55:43 +0200 Subject: [PATCH 1158/1455] Fix hyprpicker --- apparmor.d/groups/hyprland/hyprpicker | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/hyprland/hyprpicker b/apparmor.d/groups/hyprland/hyprpicker index 78375c8b2..a46d53f4c 100644 --- a/apparmor.d/groups/hyprland/hyprpicker +++ b/apparmor.d/groups/hyprland/hyprpicker @@ -17,6 +17,7 @@ profile hyprpicker @{exec_path} { owner @{run}/user/@{uid}/.hyprpicker* rw, owner /dev/shm/wlroots-@{rand6} r, + owner /dev/shm/@{uuid} r, owner /dev/tty@{int} rw, From 9790ca7ebccfe9c27f5899eefcfe64234743ca85 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 18:21:56 +0200 Subject: [PATCH 1159/1455] fix(profile): minor linter fix. --- apparmor.d/groups/systemd/resolvectl | 2 +- apparmor.d/profiles-g-l/landscape-sysinfo | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/systemd/resolvectl b/apparmor.d/groups/systemd/resolvectl index 142d0c9d8..dd5bdb3d4 100644 --- a/apparmor.d/groups/systemd/resolvectl +++ b/apparmor.d/groups/systemd/resolvectl @@ -17,7 +17,7 @@ profile resolvectl @{exec_path} flags=(attach_disconnected) { network inet raw, network inet6 raw, - network netlink raw, + network netlink raw, signal send set=cont peer=child-pager, diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo b/apparmor.d/profiles-g-l/landscape-sysinfo index 5eb5dac06..2370271ec 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo +++ b/apparmor.d/profiles-g-l/landscape-sysinfo @@ -25,7 +25,7 @@ profile landscape-sysinfo @{exec_path} { @{exec_path} mr, - @{bin}/who rix, + @{bin}/who rPx, @{lib}/@{python_name}/**/__pycache__/ w, @{lib}/@{python_name}/**/__pycache__/**.pyc w, From a724af9dedaa86a5a7dccb191c0a54bd0aade9b3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 18:24:29 +0200 Subject: [PATCH 1160/1455] tests: improve check.sh --- tests/check.sh | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 815f7f07e..e30f21e19 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -153,6 +153,8 @@ declare -A ABS_DEPRECATED=( ["dbus-network-manager-strict"]="bus/org.freedesktop.NetworkManager" ["dbus-session-strict"]="bus-session" ["dbus-system-strict"]="bus-system" + ["gnome"]="gnome-strict" + ["kde"]="kde-strict" ) _check_abstractions() { _is_enabled abstractions || return 0 @@ -216,7 +218,7 @@ readonly TRANSITION_MUST_CI=( # Must transition to 'ix' or 'Cx' sed shred stat tail tee test timeout touch truncate unlink ) readonly TRANSITION_MUST_PC=( # Must transition to 'Px' - ischroot + ischroot who ) readonly TRANSITION_MUST_C=( # Must transition to 'Cx' sysctl kmod pgrep pkexec sudo systemctl udevadm @@ -226,19 +228,19 @@ readonly TRANSITION_MUST_C=( # Must transition to 'Cx' _check_transition() { _is_enabled transition || return 0 for prgmname in "${!TRANSITION_MUST_CI[@]}"; do - if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_CI[$prgmname]} ".*([uU]x|[pP][uU]x|[pP]x) ]]; then + if [[ "$line" =~ "/${TRANSITION_MUST_CI[$prgmname]} ".*([uU]x|[pP][uU]x|[pP]x) ]]; then _err transition "$file:$line_number" \ "@{bin}/${TRANSITION_MUST_CI[$prgmname]} should be used inherited: 'ix' | 'Cx'" fi done for prgmname in "${!TRANSITION_MUST_PC[@]}"; do - if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_PC[$prgmname]} ".*(Pix|ix) ]]; then + if [[ "$line" =~ "/${TRANSITION_MUST_PC[$prgmname]} ".*(Pix|ix) ]]; then _err transition "$file:$line_number" \ "@{bin}/${TRANSITION_MUST_PC[$prgmname]} should transition to another (sub)profile with 'Px' or 'Cx'" fi done for prgmname in "${!TRANSITION_MUST_C[@]}"; do - if [[ "$line" =~ "@{bin}/${TRANSITION_MUST_C[$prgmname]} ".*([pP]ix|[uU]x|[pP][uU]x|ix) ]]; then + if [[ "$line" =~ "/${TRANSITION_MUST_C[$prgmname]} ".*([pP]ix|[uU]x|[pP][uU]x|ix) ]]; then _warn transition "$file:$line_number" \ "@{bin}/${TRANSITION_MUST_C[$prgmname]} should transition to a subprofile with 'Cx'" fi @@ -455,7 +457,6 @@ _check_subprofiles() { elif $_CHEK_IN_SUBPROFILE; then if [[ "$line" == *"$include" ]]; then _RES_SUBPROFILES["$subprofile"]=true - fi fi } From 4210db4faade72baba69434134bd75b7f0a9e0bb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 18:53:47 +0200 Subject: [PATCH 1161/1455] feat(profile): add more dbus interface base abs & improve dbus integration. --- apparmor.d/abstractions/bus/org.a11y | 5 +++ apparmor.d/abstractions/bus/org.bluez | 2 +- .../abstractions/bus/org.freedesktop.Avahi | 10 ++++++ .../bus/org.freedesktop.NetworkManager | 2 +- .../abstractions/bus/org.freedesktop.UPower | 2 +- ...rg.freedesktop.impl.portal.PermissionStore | 5 +++ .../bus/org.freedesktop.portal.Desktop | 11 ++++--- .../bus/org.gnome.Shell.SearchProvider | 0 .../abstractions/bus/org.gtk.Notifications | 16 ++++++++++ .../bus/org.mpris.MediaPlayer2.Player | 31 +++++++++++++++++++ apparmor.d/groups/cups/cups-browsed | 5 +++ apparmor.d/groups/cups/cups-notifier-dbus | 2 ++ apparmor.d/groups/cups/cupsd | 9 ++++++ .../freedesktop/xdg-desktop-portal-gnome | 6 ++++ .../groups/gnome/evolution-source-registry | 1 + apparmor.d/groups/gnome/gio-launch-desktop | 1 + apparmor.d/groups/gnome/gnome-characters | 2 +- .../groups/gnome/gnome-extension-gsconnect | 6 ++++ apparmor.d/groups/gnome/gnome-keyring-daemon | 1 + .../groups/gnome/gsd-print-notifications | 5 +++ apparmor.d/groups/network/NetworkManager | 4 +-- apparmor.d/profiles-a-f/fwupd | 4 +-- apparmor.d/profiles-s-z/spotify | 11 +++++++ 23 files changed, 128 insertions(+), 13 deletions(-) create mode 100644 apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider create mode 100644 apparmor.d/abstractions/bus/org.gtk.Notifications create mode 100644 apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y index ef0e15707..2677d2f61 100644 --- a/apparmor.d/abstractions/bus/org.a11y +++ b/apparmor.d/abstractions/bus/org.a11y @@ -33,6 +33,11 @@ # Session bus + dbus send bus=session path=/org/a11y/bus + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label="@{p_dbus_accessibility}"), + dbus send bus=session path=/org/a11y/bus interface=org.a11y.Bus member=Get diff --git a/apparmor.d/abstractions/bus/org.bluez b/apparmor.d/abstractions/bus/org.bluez index 201d3998c..461ad9f94 100644 --- a/apparmor.d/abstractions/bus/org.bluez +++ b/apparmor.d/abstractions/bus/org.bluez @@ -8,7 +8,7 @@ dbus receive bus=system path=/ interface=org.freedesktop.DBus.ObjectManager - member=InterfacesRemoved + member={InterfacesAdded,InterfacesRemoved} peer=(name="{@{busname},org.bluez}", label="@{p_bluetoothd}"), dbus send bus=system path=/ diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Avahi b/apparmor.d/abstractions/bus/org.freedesktop.Avahi index b683cf128..aa48e69b1 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Avahi +++ b/apparmor.d/abstractions/bus/org.freedesktop.Avahi @@ -31,6 +31,16 @@ member=StateChanged peer=(name=@{busname}, label="@{p_avahi_daemon}"), + dbus receive bus=system path=/Client@{int}/ServiceResolver@{int} + interface=org.freedesktop.Avahi.ServiceResolver + member=Found + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/ServiceResolver@{int} + interface=org.freedesktop.Avahi.ServiceResolver + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager index 78f0de9de..a22a235fb 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.NetworkManager @@ -28,7 +28,7 @@ dbus receive bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager - member=InterfacesAdded + member={InterfacesAdded,InterfacesRemoved} peer=(name="{@{busname},org.freedesktop.NetworkManager}", label=NetworkManager), dbus receive bus=system path=/org/freedesktop/NetworkManager diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower b/apparmor.d/abstractions/bus/org.freedesktop.UPower index 69218b619..d82fbdef0 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower +++ b/apparmor.d/abstractions/bus/org.freedesktop.UPower @@ -18,7 +18,7 @@ dbus receive bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower - member=DeviceAdded + member={DeviceAdded,DeviceRemoved} peer=(name="{@{busname},org.freedesktop.UPower}", label="@{p_upowerd}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore b/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore index 8461bb047..22886c8a5 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore +++ b/apparmor.d/abstractions/bus/org.freedesktop.impl.portal.PermissionStore @@ -11,6 +11,11 @@ member=Lookup peer=(name="@{busname}", label=xdg-permission-store), + dbus send bus=session path=/org/freedesktop/impl/portal/PermissionStore + interface=org.freedesktop.impl.portal.PermissionStore + member=Lookup + peer=(name=org.freedesktop.impl.portal.PermissionStore, label=xdg-permission-store), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop index 7b19a675a..5e5967a1a 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop +++ b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop @@ -4,11 +4,7 @@ abi , - #aa:dbus common bus=session name=org.freedesktop.portal.Desktop label=xdg-desktop-portal - dbus send bus=session path=/org/freedesktop/portal/desktop - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=@{busname}, label=xdg-desktop-portal), + #aa:dbus common bus=session name=org.freedesktop.portal.{d,D}esktop label=xdg-desktop-portal dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.DBus.Properties @@ -35,6 +31,11 @@ member={Read,ReadAll} peer=(name="@{busname}", label=xdg-desktop-portal), + dbus send bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.host.portal.Registry + member=Register + peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider b/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider new file mode 100644 index 000000000..e69de29bb diff --git a/apparmor.d/abstractions/bus/org.gtk.Notifications b/apparmor.d/abstractions/bus/org.gtk.Notifications new file mode 100644 index 000000000..b9229f204 --- /dev/null +++ b/apparmor.d/abstractions/bus/org.gtk.Notifications @@ -0,0 +1,16 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + #aa:dbus common bus=session name=org.gtk.Notifications label=gnome-shell + + dbus send bus=session path=/org/gtk/Notifications + interface=org.gtk.Notifications + member=RemoveNotification + peer=(name=org.gtk.Notifications, label=gnome-shell), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player b/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player new file mode 100644 index 000000000..d8581be07 --- /dev/null +++ b/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + #aa-dbus common bus=session name=org.mpris.MediaPlayer2.Player label=unconfined + + dbus receive bus=session path=/org/mpris/MediaPlayer2 + interface=org.freedesktop.DBus.Properties + member=PropertiesChanged + peer=(name=@{busname}), + + dbus receive bus=session path=/org/mpris/MediaPlayer2 + interface=org.mpris.MediaPlayer2.Player + member=Seeked + peer=(name=@{busname}), + + dbus send bus=session path=/org/mpris/MediaPlayer2 + interface=org.freedesktop.DBus.Properties + member=Get + peer=(name=@{busname}), + + dbus send bus=session path=/org/mpris/MediaPlayer2 + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/cups/cups-browsed b/apparmor.d/groups/cups/cups-browsed index 78e7883cb..745337a8d 100644 --- a/apparmor.d/groups/cups/cups-browsed +++ b/apparmor.d/groups/cups/cups-browsed @@ -36,6 +36,11 @@ profile cups-browsed @{exec_path} { member=CheckPermissions peer=(name=:*, label=NetworkManager), + dbus receive bus=system path=/org/cups/cupsd/Notifier + interface=org.cups.cupsd.Notifier + member=PrinterDeleted + peer=(name=@{busname}, label=cups-notifier-dbus), + @{exec_path} mr, /usr/share/cups/locale/{,**} r, diff --git a/apparmor.d/groups/cups/cups-notifier-dbus b/apparmor.d/groups/cups/cups-notifier-dbus index 6e3b38490..fa31b726d 100644 --- a/apparmor.d/groups/cups/cups-notifier-dbus +++ b/apparmor.d/groups/cups/cups-notifier-dbus @@ -16,6 +16,8 @@ profile cups-notifier-dbus @{exec_path} { signal (receive) set=(term) peer=cupsd, + #aa:dbus own bus=system name=org.cups.cupsd.Notifier + @{exec_path} mr, owner /var/spool/cups/tmp/cups-dbus-notifier-lockfile rw, diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index b3658b738..f9b70ae4d 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -44,6 +44,15 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { signal (send) set=(term) peer=cups-notifier-dbus, + dbus send bus=system path=/org/freedesktop/ColorManager + interface=org.freedesktop.ColorManager + member=DeleteDevice + peer=(name=org.freedesktop.ColorManager, label="@{p_colord}"), + dbus send bus=system path=/org/freedesktop/ColorManager + interface=org.freedesktop.ColorManager + member=FindDeviceById + peer=(name=org.freedesktop.ColorManager, label="@{p_colord}"), + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 1355aa22b..6ee4cab6d 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -34,6 +34,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.impl.portal.desktop.gnome #aa:dbus talk bus=session name=org.freedesktop.impl.portal path=/org/freedesktop/portal/desktop label=xdg-desktop-portal #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell + #aa:dbus talk bus=session name=org.gnome.Settings.GlobalShortcutsProvider label=gnome-control-center-global-shortcuts-provider #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell dbus send bus=session path=/org/freedesktop/portal/desktop @@ -46,6 +47,11 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { member=GetAll peer=(name=:*, label=gnome-shell), + dbus receive bus=session path=/org/gnome/Shell + interface=org.freedesktop.DBus.Properties + member=PropertiesChanged + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, / r, diff --git a/apparmor.d/groups/gnome/evolution-source-registry b/apparmor.d/groups/gnome/evolution-source-registry index 379ea5bef..a5a1bd414 100644 --- a/apparmor.d/groups/gnome/evolution-source-registry +++ b/apparmor.d/groups/gnome/evolution-source-registry @@ -10,6 +10,7 @@ include profile evolution-source-registry @{exec_path} { include include + include include include include diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index 84e8546e2..a3d285e94 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -18,6 +18,7 @@ include profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { include include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index a43168866..9af2b7d5f 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -17,7 +17,7 @@ profile gnome-characters @{exec_path} { include #aa:dbus own bus=session name=org.gnome.Characters - #aa-dbus own bus=session name=org.gnome.Characters.SearchProvider interface+=org.gnome.Shell.SearchProvider2 + #aa-dbus talk bus=session name=org.gnome.Shell.SearchProvider2 label=gnome-shell @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 96dd21540..3cf92d613 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -17,6 +17,12 @@ profile gnome-extension-gsconnect @{exec_path} { include include include + include + include + include + include + include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index 37b3b7892..6752f54d4 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -24,6 +24,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.keyring #aa:dbus own bus=session name=org.freedesktop.{S,s}ecret{,s} + #aa:dbus own bus=session name=org.freedesktop.impl.portal.Secret dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index 9fdd96e1a..f8d4280a0 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -28,6 +28,11 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { # dbus receive bus=system path=/org/cups/cupsd/Notifier # interface=org.cups.cupsd.Notifier, + dbus receive bus=system path=/org/cups/cupsd/Notifier + interface=org.cups.cupsd.Notifier + member=ServerStarted + peer=(name=@{busname}, label=cups-notifier-dbus), + dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 85257c89d..fc5c39ea7 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -69,8 +69,8 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager - member=InterfacesAdded - peer=(name=org.freedesktop.DBus, label=nm-online), + member={InterfacesAdded,InterfacesRemoved} + peer=(name=org.freedesktop.DBus), @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 7d28b3ec3..019aec5a9 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -14,8 +14,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { include include include - include - include include include include @@ -38,7 +36,9 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { network netlink raw, #aa:dbus own bus=system name=org.freedesktop.fwupd path=/ + #aa:dbus talk bus=system name=org.bluez.GattCharacteristic1 label=bluetoothd #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd + #aa:dbus talk bus=system name=org.freedesktop.UPower label=upowerd dbus receive bus=system path=/ interface=org.freedesktop.DBus.ObjectManager diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index dfd488a48..b619a8720 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -16,6 +16,14 @@ include profile spotify @{exec_path} flags=(attach_disconnected) { include include + include + include + include + include + include + include + include + include include include @@ -25,6 +33,9 @@ profile spotify @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=org.mpris.MediaPlayer2.spotify + #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell + @{exec_path} mrix, @{sh_path} mr, From 526a7e704cf2e9eb608691fe9e9d74ead7159a2e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 18:55:08 +0200 Subject: [PATCH 1162/1455] feat(tunable): improve the definition of some tunables. --- apparmor.d/tunables/multiarch.d/system | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index eac40a028..359d1b878 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -38,7 +38,7 @@ @{udbus}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} # Universally unique identifier -@{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} +@{uuid}=@{hex8}[-_]@{hex4}[-_]@{hex4}[-_]@{hex4}[-_]@{hex12} # Username & group valid characters @{user}=[a-zA-Z_]{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} @@ -47,8 +47,9 @@ # Semantic version @{version}=@{u16}{.@{u16},}{.@{u16},}{{-,_}@{rand},} +#aa:only opensuse # OpenSUSE does not have the same multiarch structure -@{multiarch}+=*-suse-linux* #aa:only opensuse +@{multiarch}+=*-suse-linux* # System Internal @@ -58,11 +59,12 @@ @{sqlhex}=@{hex12} @{hex12}@{h} @{hex12}@{hex2} @{hex15} @{hex16} # Shortcut for PCI device -@{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h} -@{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h} +@{pci_id}=@{hex}:@{hex2}:@{hex2}.@{h} +@{pci_bus}=pci@{hex4}:@{hex2} @{pci}=@{pci_bus}/**/ # Udev data dynamic assignment ranges +# See https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 From 67c9e86d832c144d70e4d1e1d49d79ac007a8472 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 19:00:42 +0200 Subject: [PATCH 1163/1455] feat(profile): improve integration with ubuntu. --- apparmor.d/groups/apt/dpkg-script-apparmor | 7 +++++++ apparmor.d/groups/cups/cups-browsed | 6 ++++-- apparmor.d/groups/cups/cupsd | 3 +++ apparmor.d/groups/gnome/gdm-generate-config | 4 ++-- apparmor.d/groups/gnome/gnome-terminal-server | 2 ++ apparmor.d/groups/gnome/papers | 1 + apparmor.d/groups/systemd/systemd-coredump | 1 + apparmor.d/groups/systemd/systemd-logind | 10 +++++----- apparmor.d/groups/systemd/systemd-sleep-hdparm | 1 + apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders | 6 ++++-- apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer | 2 ++ apparmor.d/profiles-g-l/git | 5 ++++- apparmor.d/profiles-g-l/gitstatusd | 4 +++- apparmor.d/profiles-g-l/host | 5 +++-- apparmor.d/profiles-g-l/language-validate | 1 - apparmor.d/profiles-m-r/on-ac-power | 1 + apparmor.d/profiles-m-r/pass | 1 + apparmor.d/profiles-s-z/spotify | 2 +- apparmor.d/profiles-s-z/sysstat-sadc | 5 ++--- apparmor.d/profiles-s-z/thermald | 3 +-- 20 files changed, 48 insertions(+), 22 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index 122e4541e..38a068ac0 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -11,6 +11,8 @@ profile dpkg-script-apparmor @{exec_path} { include include + capability dac_read_search, + @{exec_path} mrix, @{bin}/{,e}grep ix, @@ -43,11 +45,16 @@ profile dpkg-script-apparmor @{exec_path} { capability net_admin, capability sys_resource, + capability dac_override, + capability dac_read_search, signal send set=(cont term) peer=systemd-tty-ask-password-agent, @{bin}/systemd-tty-ask-password-agent rix, + @{run}/user/@{uid}/systemd/ask-password/ rw, + @{run}/user/@{uid}/systemd/ask-password-block/{,*} rw, + owner @{run}/systemd/ask-password/ rw, owner @{run}/systemd/ask-password-block/{,*} rw, diff --git a/apparmor.d/groups/cups/cups-browsed b/apparmor.d/groups/cups/cups-browsed index 745337a8d..9498f245a 100644 --- a/apparmor.d/groups/cups/cups-browsed +++ b/apparmor.d/groups/cups/cups-browsed @@ -16,9 +16,9 @@ profile cups-browsed @{exec_path} { include include - capability net_admin, +# capability net_admin, capability net_bind_service, - capability sys_nice, +# capability sys_nice, network inet dgram, network inet6 dgram, @@ -43,6 +43,8 @@ profile cups-browsed @{exec_path} { @{exec_path} mr, + @{bin}/ippfind rPx, + /usr/share/cups/locale/{,**} r, /etc/cups/{,**} r, diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index f9b70ae4d..acae9b7a1 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -29,7 +29,9 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { capability setuid, capability wake_alarm, + network inet dgram, network inet stream, + network inet6 dgram, network inet6 stream, network appletalk dgram, @@ -99,6 +101,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { @{run}/cups/{,**} rw, @{run}/systemd/notify w, + @{run}/avahi-daemon/socket rw, @{sys}/module/apparmor/parameters/enabled r, diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index 7240ffaef..d48b9eff6 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -25,8 +25,8 @@ profile gdm-generate-config @{exec_path} { @{sh_path} rix, @{bin}/dconf rix, @{bin}/install rix, - @{bin}/pgrep rCx -> pgrep, - @{bin}/pkill rCx -> pgrep, + @{bin}/pgrep rCx -> &pgrep, + @{bin}/pkill rCx -> &pgrep, @{bin}/setpriv rix, @{bin}/setsid rix, diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index 837f00f68..cda4568c1 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -38,6 +38,8 @@ profile gnome-terminal-server @{exec_path} { @{exec_path} mr, + @{lib}/gnome-terminal-preferences ix, + # The shell is not confined on purpose. @{bin}/@{shells} Ux, diff --git a/apparmor.d/groups/gnome/papers b/apparmor.d/groups/gnome/papers index 87820376c..27000b93a 100644 --- a/apparmor.d/groups/gnome/papers +++ b/apparmor.d/groups/gnome/papers @@ -26,6 +26,7 @@ profile papers @{exec_path} { owner @{user_share_dirs}/gvfs-metadata/{,*} r, owner @{tmp}/.goutputstream-@{rand6} rw, + owner @{tmp}/papers-@{int}/{,**} rw, owner @{tmp}/gtkprint_@{rand6} rw, owner @{tmp}/gtkprint@{rand6} rw, diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 2bd25ec16..54f366c2f 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -35,6 +35,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted @{bin}/* r, @{sbin}/* r, /opt/** r, + /usr/share/*/** r, @{user_lib_dirs}/** r, /etc/systemd/coredump.conf r, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 7bd5c88de..1fb3f6cb3 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -136,11 +136,11 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{PROC}/sysvipc/{shm,sem,msg} r, owner @{PROC}/@{pid}/fdinfo/@{int} r, - /dev/dri/card@{int} rw, - /dev/input/event@{int} rw, # Input devices (keyboard, mouse, etc) - /dev/mqueue/ r, - /dev/tty@{int} rw, - owner /dev/shm/{,**/} rw, + /dev/dri/card@{int} rw, + /dev/input/event@{int} rw, # Input devices (keyboard, mouse, etc) + /dev/mqueue/ r, + /dev/tty@{int} rw, + /dev/shm/{,**/} rw, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-sleep-hdparm b/apparmor.d/groups/systemd/systemd-sleep-hdparm index 71008c96d..4cbe61755 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-hdparm +++ b/apparmor.d/groups/systemd/systemd-sleep-hdparm @@ -11,6 +11,7 @@ profile systemd-sleep-hdparm @{exec_path} { include @{exec_path} mr, + @{sh_path} r, include if exists } diff --git a/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders b/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders index b64c34a4b..04c9a33f2 100644 --- a/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders +++ b/apparmor.d/profiles-g-l/gdk-pixbuf-query-loaders @@ -18,8 +18,10 @@ profile gdk-pixbuf-query-loaders @{exec_path} { @{exec_path} mr, - @{lib}/gdk-pixbuf-[0-9].@{int}/{,*}/loaders.cache.* rw, - @{lib}/gdk-pixbuf-[0-9].@{int}/*/loaders.cache rw, + @{lib}/@{multiarch}/gdk-pixbuf-@{version}/@{version}/ w, + @{lib}/@{multiarch}/gdk-pixbuf-@{version}/@{version}/loaders.cache w, + @{lib}/gdk-pixbuf-@{version}/{,*}/loaders.cache.* rw, + @{lib}/gdk-pixbuf-@{version}/@{version}/loaders.cache rw, /usr/share/gvfs/remote-volume-monitors/{,**} r, diff --git a/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer b/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer index 6ec661d31..d3df6f5f3 100644 --- a/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer +++ b/apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer @@ -10,6 +10,8 @@ include profile gdk-pixbuf-thumbnailer @{exec_path} { include + @{exec_path} mr, + include if exists } diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index c9373c7ae..425fe2f14 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -115,6 +115,8 @@ profile git @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.git_vtag_tmp@{rand6} r, + owner @{run}/user/@{uid}/gnupg/S.gpg-agent rw, + deny @{user_share_dirs}/gvfs-metadata/* r, include if exists @@ -138,13 +140,14 @@ profile git @{exec_path} flags=(attach_disconnected) { @{etc_ro}/ssh/ssh_config.d/{,*} r, @{etc_ro}/ssh/ssh_config r, - owner @{HOME}/@{XDG_SSH_DIR}/* r, + owner @{HOME}/@{XDG_SSH_DIR}/{,*} r, owner @{HOME}/@{XDG_SSH_DIR}/known_hosts.old rwl, owner @{HOME}/@{XDG_SSH_DIR}/known_hosts{,.*} rw, owner @{HOME}/@{XDG_SSH_DIR}/ssh_control_* rwl, owner @{tmp}/git@*:@{int} rwl -> @{tmp}/git@*:@{int}.*, owner @{tmp}/ssh-*/agent.@{int} rw, + owner @{run}/user/@{uid}/keyring/ssh rw, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-g-l/gitstatusd b/apparmor.d/profiles-g-l/gitstatusd index 8901ade9c..579536674 100644 --- a/apparmor.d/profiles-g-l/gitstatusd +++ b/apparmor.d/profiles-g-l/gitstatusd @@ -6,12 +6,14 @@ abi , include -@{exec_path} = /usr/share/zsh-theme-powerlevel@{int}k/gitstatus/usrbin/gitstatusd{,-*} +@{exec_path} = @{user_cache_dirs}/gitstatus/gitstatusd{,-*} +@{exec_path} += /usr/share/zsh-theme-powerlevel{9,10}k/gitstatus/usrbin/gitstatusd{,-*} profile gitstatusd @{exec_path} { include include signal receive set=term peer=*//shell, + signal receive set=term peer=vscode, @{exec_path} mr, diff --git a/apparmor.d/profiles-g-l/host b/apparmor.d/profiles-g-l/host index aca2c5d61..ab0cf0cba 100644 --- a/apparmor.d/profiles-g-l/host +++ b/apparmor.d/profiles-g-l/host @@ -22,10 +22,11 @@ profile host @{exec_path} { @{exec_path} mr, - owner @{PROC}/@{pids}/task/@{tid}/comm rw, - @{sys}/kernel/mm/transparent_hugepage/enabled r, + @{PROC}/version_signature r, + owner @{PROC}/@{pids}/task/@{tid}/comm rw, + include if exists } diff --git a/apparmor.d/profiles-g-l/language-validate b/apparmor.d/profiles-g-l/language-validate index 80f914fab..3d7383aef 100644 --- a/apparmor.d/profiles-g-l/language-validate +++ b/apparmor.d/profiles-g-l/language-validate @@ -18,7 +18,6 @@ profile language-validate @{exec_path} flags=(attach_disconnected) { @{bin}/{,e}grep rix, @{bin}/locale rix, - /usr/share/locale-langpack/{,*} r, /usr/share/language-tools/{,*} r, include if exists diff --git a/apparmor.d/profiles-m-r/on-ac-power b/apparmor.d/profiles-m-r/on-ac-power index ffe3d4119..16ccfd9da 100644 --- a/apparmor.d/profiles-m-r/on-ac-power +++ b/apparmor.d/profiles-m-r/on-ac-power @@ -18,6 +18,7 @@ profile on-ac-power @{exec_path} { @{bin}/cat rix, @{sys}/class/power_supply/ r, + @{sys}/class/typec/ r, @{sys}/devices/**/power_supply/**/{online,type} r, @{PROC}/pmu/info r, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index 7e432a838..30f92c964 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -146,6 +146,7 @@ profile pass @{exec_path} { owner @{user_passwordstore_dirs}/** rwkl -> @{HOME}/.password-store/**, owner /dev/shm/pass.@{rand}/* rw, owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature + owner @{run}/user/@{uid}/gnupg/S.gpg-agent rw, owner /dev/pts/@{int} rw, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index b619a8720..1ec4eeea3 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -8,7 +8,7 @@ abi , include @{name} = spotify -@{lib_dirs} = /opt/spotify/ +@{lib_dirs} = /opt/@{name}/ /usr/share/@{name}/ @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/sysstat-sadc b/apparmor.d/profiles-s-z/sysstat-sadc index dfdd00524..7d9143938 100644 --- a/apparmor.d/profiles-s-z/sysstat-sadc +++ b/apparmor.d/profiles-s-z/sysstat-sadc @@ -24,10 +24,9 @@ profile sysstat-sadc @{exec_path} { @{sys}/class/fc_host/ r, @{sys}/class/hwmon/ r, @{sys}/class/i2c-adapter/ r, - @{sys}/devices/@{pci}/hwmon/hwmon@{int}/ r, - @{sys}/devices/@{pci}/hwmon/hwmon@{int}/name r, @{sys}/devices/@{pci}/net/*/duplex r, - @{sys}/devices/**/i2c-*/name r, + @{sys}/devices/**/hwmon@{int}/ r, + @{sys}/devices/**/name r, @{sys}/devices/**/net/*/duplex r, @{sys}/devices/**/net/*/speed r, @{sys}/devices/virtual/net/*/duplex r, diff --git a/apparmor.d/profiles-s-z/thermald b/apparmor.d/profiles-s-z/thermald index 101310df1..b663865e8 100644 --- a/apparmor.d/profiles-s-z/thermald +++ b/apparmor.d/profiles-s-z/thermald @@ -24,8 +24,7 @@ profile thermald @{exec_path} flags=(attach_disconnected) { /etc/thermald/{,*} r, owner @{run}/thermald/ rw, - owner @{run}/thermald/thd_preference.conf rw, - owner @{run}/thermald/thd_preference.conf.save w, + owner @{run}/thermald/** rw, owner @{run}/thermald/thermald.pid rwk, @{sys}/class/hwmon/ r, From 90e962dabbbb57be3ff927c02320dda8002cf0de Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 19:02:15 +0200 Subject: [PATCH 1164/1455] feat(profile): chromium: cleanup shell exe. Needed to installing/remove extensions, applications, and stacked xdg menus --- apparmor.d/abstractions/app/chromium | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index c089d89e5..a971ca5a0 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -86,16 +86,11 @@ @{bin}/xdg-open rPx -> child-open, @{bin}/xdg-settings rPx, - # Installing/removing extensions & applications - @{bin}/{,e}grep rix, - @{bin}/basename rix, - @{bin}/cat rix, - @{bin}/cut rix, - @{bin}/mkdir rix, - @{bin}/mktemp rix, - @{bin}/rm rix, - @{bin}/sed rix, - @{bin}/touch rix, + # Installing/removing extensions, applications, and stacked xdg menus + @{sh_path} rix, + @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{coreutils_path} ix, # For storing passwords externally @{bin}/keepassxc-proxy rix, # as a temporary solution - see issue #128 From 82c6f554b37b559d31427a195751869ba77d19cd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 19:03:16 +0200 Subject: [PATCH 1165/1455] feat(abs): update list of app allowed to be openned. --- apparmor.d/abstractions/app-open | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/abstractions/app-open b/apparmor.d/abstractions/app-open index 59724f019..e0c8d3d59 100644 --- a/apparmor.d/abstractions/app-open +++ b/apparmor.d/abstractions/app-open @@ -35,6 +35,7 @@ @{bin}/discord{,-ptb} Px, @{bin}/draw.io PUx, @{bin}/dropbox Px, + @{bin}/ebook-edit PUx, @{bin}/element-desktop Px, @{bin}/extension-manager Px, @{bin}/filezilla Px, @@ -46,6 +47,7 @@ @{bin}/gnome-session-quit Px, @{bin}/gnome-software Px, @{bin}/gwenview PUx, + @{bin}/keepassxc Px, @{bin}/qbittorrent Px, @{bin}/qpdfview Px, @{bin}/smplayer Px, From 1da6e15cda25ec3ff7eeff0401546aedd70d8ef5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 19:04:26 +0200 Subject: [PATCH 1166/1455] cosmetic: cleanup usage of bash abs. --- apparmor.d/abstractions/bash-strict | 2 +- apparmor.d/abstractions/fish | 2 +- apparmor.d/abstractions/zsh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/bash-strict b/apparmor.d/abstractions/bash-strict index 9ea35f8c2..cd4a7c8a7 100644 --- a/apparmor.d/abstractions/bash-strict +++ b/apparmor.d/abstractions/bash-strict @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# This abstraction is only required when an interactive shell is started. +# This abstraction is only required when .bashrc is loaded (e.g. interactive shell). # Classic shell scripts do not need it. abi , diff --git a/apparmor.d/abstractions/fish b/apparmor.d/abstractions/fish index 2ae6ab93d..65f97f9f2 100644 --- a/apparmor.d/abstractions/fish +++ b/apparmor.d/abstractions/fish @@ -2,7 +2,7 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# This abstraction is only required when an interactive shell is started. +# This abstraction is only required when zshrc is loaded (e.g. interactive shell). # Classic shell scripts do not need it. abi , diff --git a/apparmor.d/abstractions/zsh b/apparmor.d/abstractions/zsh index 02eacfb62..7c734a45b 100644 --- a/apparmor.d/abstractions/zsh +++ b/apparmor.d/abstractions/zsh @@ -3,7 +3,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# This abstraction is only required when an interactive shell is started. +# This abstraction is only required when zshrc is loaded (e.g. interactive shell). # Classic shell scripts do not need it. abi , From ece81aa6cbe0d0660db978b81cb20d140e408188 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 10 Aug 2025 19:05:15 +0200 Subject: [PATCH 1167/1455] feat(abs): audio: add jack.conf.d --- apparmor.d/abstractions/audio-client | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index 166229a09..826191309 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -21,6 +21,7 @@ /etc/openal/alsoft.conf r, /etc/pipewire/client{,-rt}.conf r, /etc/pipewire/client{,-rt}.conf.d/{,**} r, + /etc/pipewire/jack.conf.d/{,**} r, /etc/pulse/client.conf r, /etc/pulse/client.conf.d/{,**} r, /etc/wildmidi/wildmidi.cfg r, From eb642993d88ad2ca8204e0640a7c69bfa35a7ab4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Aug 2025 10:56:20 +0200 Subject: [PATCH 1168/1455] feat(profile): revisit the monitorix profile. --- apparmor.d/profiles-m-r/monitorix | 105 +++++++++++++++--------------- 1 file changed, 51 insertions(+), 54 deletions(-) diff --git a/apparmor.d/profiles-m-r/monitorix b/apparmor.d/profiles-m-r/monitorix index c708b587c..6cbef400b 100644 --- a/apparmor.d/profiles-m-r/monitorix +++ b/apparmor.d/profiles-m-r/monitorix @@ -10,10 +10,11 @@ include @{exec_path} = @{bin}/monitorix profile monitorix @{exec_path} { include - include - include - include + include include + include + include + include capability net_admin, capability chown, @@ -28,80 +29,76 @@ profile monitorix @{exec_path} { network inet stream, network inet6 stream, - ptrace (read), + ptrace read, - signal (receive) set=(hup) peer=logroate, + signal receive set=(hup) peer=logroate, @{exec_path} mr, @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/df rix, - @{bin}/cat rix, - @{bin}/tail rix, - @{bin}/{m,g,}awk rix, - @{bin}/free rix, - @{sbin}/ss rix, - @{bin}/who rix, - @{sbin}/lvm rix, - @{sbin}/xtables-nft-multi rix, - @{bin}/sensors rix, - @{bin}/getconf rix, - @{bin}/ps rix, + @{bin}/{,e}grep ix, + @{bin}/{m,g,}awk ix, + @{bin}/cat ix, + @{bin}/df ix, + @{bin}/free ix, + @{bin}/getconf ix, + @{bin}/ps Px, + @{bin}/sensors Px, + @{bin}/tail ix, + @{bin}/who Px, + @{sbin}/lvm Px, + @{sbin}/ss Px, + @{sbin}/xtables-nft-multi ix, - /etc/monitorix/monitorix.conf r, - /etc/monitorix/conf.d/ r, - /etc/monitorix/conf.d/@{int2}-*.conf r, + /var/lib/monitorix/www/cgi/monitorix.cgi ix, + + /etc/monitorix/{,**} r, + + /var/lib/monitorix/ rw, + /var/lib/monitorix/** rwk, /var/log/monitorix w, /var/log/monitorix-* w, - owner @{run}/monitorix.pid w, - - /var/lib/monitorix/*.rrd* rwk, - /var/lib/monitorix/www/** rw, - /var/lib/monitorix/www/cgi/monitorix.cgi rwix, + /srv/http/monitorix/ rw, + /srv/http/monitorix/** rwk, / r, /tmp/ r, - /etc/shadow r, - /dev/tty r, + owner @{run}/monitorix.pid w, @{run}/utmp rk, - @{PROC}/ r, - @{PROC}/swaps r, - @{PROC}/diskstats r, - @{PROC}/loadavg r, - @{PROC}/sys/kernel/random/entropy_avail r, - @{PROC}/uptime r, - @{PROC}/interrupts r, - @{PROC}/sys/fs/dentry-state r, - @{PROC}/sys/fs/file-nr r, - @{PROC}/sys/fs/inode-nr r, - @{PROC}/sys/kernel/osrelease r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/net/dev r, - owner @{PROC}/@{pid}/net/ip_tables_names r, - owner @{PROC}/@{pid}/net/ip6_tables_names r, - @{PROC}/@{pid}/net/udp{,6} r, - @{PROC}/@{pid}/net/tcp{,6} r, - @{PROC}/sys/kernel/pid_max r, - @{PROC}/@{pids}/stat r, - @{PROC}/@{pids}/cmdline r, - @{PROC}/@{pids}/fdinfo/ r, - @{PROC}/@{pids}/io r, - @{sys}/class/i2c-adapter/ r, @{sys}/devices/@{pci}/i2c-*/{,**/}name r, @{sys}/class/hwmon/ r, @{sys}/devices/**/thermal*/{,**} r, @{sys}/devices/**/hwmon*/{,**} r, - /etc/sensors3.conf r, - /etc/sensors.d/ r, + @{PROC}/ r, + @{PROC}/@{pid}/net/dev r, + @{PROC}/@{pid}/net/tcp{,6} r, + @{PROC}/@{pid}/net/udp{,6} r, + @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/fdinfo/ r, + @{PROC}/@{pids}/io r, + @{PROC}/@{pids}/stat r, + @{PROC}/diskstats r, + @{PROC}/interrupts r, + @{PROC}/loadavg r, + @{PROC}/swaps r, + @{PROC}/sys/fs/dentry-state r, + @{PROC}/sys/fs/file-nr r, + @{PROC}/sys/fs/inode-nr r, + @{PROC}/sys/kernel/osrelease r, + @{PROC}/sys/kernel/pid_max r, + @{PROC}/sys/kernel/random/entropy_avail r, + @{PROC}/uptime r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/net/ip_tables_names r, + owner @{PROC}/@{pid}/net/ip6_tables_names r, include if exists } From caee95ff9edc4e8f970a41c4a289af9d83ee714f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Aug 2025 11:18:21 +0200 Subject: [PATCH 1169/1455] fix(test): checks.sh: allow empty disabled array. --- tests/check.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/check.sh b/tests/check.sh index e30f21e19..9ecd809bf 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -42,7 +42,7 @@ _in_array() { _is_enabled() { local check="$1" if _in_array "$check" "${WITH_CHECK[@]}"; then - if [[ ${#_check_is_disabled[@]} -eq 0 ]]; then + if [[ -z "${_check_is_disabled+x}" || ${#_check_is_disabled[@]} -eq 0 ]]; then return 0 fi if _in_array "$check" "${_check_is_disabled[@]}"; then From 73afa5835eb4e8ea5a201a8f44bb194f01c09dc2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Aug 2025 11:23:05 +0200 Subject: [PATCH 1170/1455] fix(abs): dbus: SearchProvider -> SearchProvider2 --- .../abstractions/bus/org.gnome.Shell.SearchProvider | 0 .../abstractions/bus/org.gnome.Shell.SearchProvider2 | 12 ++++++++++++ 2 files changed, 12 insertions(+) delete mode 100644 apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider create mode 100644 apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 diff --git a/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider b/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider deleted file mode 100644 index e69de29bb..000000000 diff --git a/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 b/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 new file mode 100644 index 000000000..baa96cc78 --- /dev/null +++ b/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 @@ -0,0 +1,12 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + #aa:dbus common bus=session name=org.gnome.Shell.SearchProvider2 label=gnome-shell + + include if exists + +# vim:syntax=apparmor + From 175e2c3dc3ff1dc8bce2ed312141cec5f2065dfd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Aug 2025 16:16:35 +0200 Subject: [PATCH 1171/1455] feat(profile): ensure all access to udev/data is documented. Cleanup some rule to wide in udev/data --- apparmor.d/abstractions/devices-usb-read | 6 ++--- apparmor.d/abstractions/disks-read | 6 ++--- apparmor.d/abstractions/gstreamer | 2 +- apparmor.d/groups/_full/systemd | 5 ++-- apparmor.d/groups/_full/systemd-user | 5 ++-- apparmor.d/groups/bluetooth/bluetoothd | 2 +- .../groups/browsers/firefox-kmozillahelper | 2 +- apparmor.d/groups/filesystem/udisksd | 8 +++--- apparmor.d/groups/freedesktop/boltd | 2 +- .../groups/freedesktop/iio-sensor-proxy | 2 +- apparmor.d/groups/freedesktop/upowerd | 12 ++++----- apparmor.d/groups/freedesktop/xorg | 10 +++---- apparmor.d/groups/gnome/gnome-control-center | 2 +- apparmor.d/groups/gnome/gnome-shell | 12 ++++----- apparmor.d/groups/gnome/gsd-power | 4 +-- apparmor.d/groups/hyprland/hyprland | 8 +++--- apparmor.d/groups/kde/baloo | 4 +-- apparmor.d/groups/kde/baloorunner | 4 +-- apparmor.d/groups/kde/dolphin | 4 +-- apparmor.d/groups/kde/kwin_wayland | 8 +++--- apparmor.d/groups/lxqt/lxqt-panel | 3 ++- apparmor.d/groups/network/ModemManager | 14 +++++----- apparmor.d/groups/network/NetworkManager | 6 ++--- apparmor.d/groups/network/dhcpcd | 2 +- apparmor.d/groups/network/nmcli | 2 +- apparmor.d/groups/steam/steam | 2 +- apparmor.d/groups/systemd/networkctl | 2 +- apparmor.d/groups/systemd/systemd-backlight | 4 +-- apparmor.d/groups/systemd/systemd-journald | 26 +++++++++---------- apparmor.d/groups/systemd/systemd-logind | 12 ++++----- apparmor.d/groups/systemd/systemd-networkd | 2 +- apparmor.d/groups/systemd/systemd-rfkill | 2 +- .../groups/ubuntu/subiquity-console-conf | 8 +++--- apparmor.d/groups/virt/libvirtd | 6 ++--- apparmor.d/groups/virt/virtnodedevd | 16 ++++++------ apparmor.d/profiles-a-f/cheese | 3 ++- apparmor.d/profiles-a-f/fwupd | 4 ++- apparmor.d/profiles-g-l/kodi | 3 ++- apparmor.d/profiles-g-l/labwc | 7 +++-- apparmor.d/profiles-m-r/power-profiles-daemon | 4 +-- apparmor.d/profiles-s-z/tlp | 2 +- 41 files changed, 120 insertions(+), 118 deletions(-) diff --git a/apparmor.d/abstractions/devices-usb-read b/apparmor.d/abstractions/devices-usb-read index 6bd0c8015..836a5f3c7 100644 --- a/apparmor.d/abstractions/devices-usb-read +++ b/apparmor.d/abstractions/devices-usb-read @@ -20,9 +20,9 @@ @{sys}/devices/**/usb@{int}/{,**} r, # Udev data about usb devices (~equal to content of lsusb -v) - @{run}/udev/data/+usb:* r, - @{run}/udev/data/c16[6,7]:@{int} r, # USB modems - @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters + @{run}/udev/data/+usb:* r, # Identifies all USB devices + @{run}/udev/data/c16[6,7]:@{int} r, # USB modems + @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters include if exists diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 872b0c552..e33ec2c3f 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -101,13 +101,13 @@ @{run}/udev/data/b43:@{int} r, # for /dev/nbd* @{run}/udev/data/b179:@{int} r, # for /dev/mmcblk* @{run}/udev/data/b230:@{int} r, # for /dev/zvol* - @{run}/udev/data/b24[0-9]:@{int} r, # for dynamic assignment range 240 to 254 - @{run}/udev/data/b25[0-4]:@{int} r, + @{run}/udev/data/b24[0-9]:@{int} r, # for dynamic assignment range 240 + @{run}/udev/data/b25[0-4]:@{int} r, # to 254 @{run}/udev/data/b259:@{int} r, # Block Extended Major @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** - @{run}/udev/data/+usb:* r, # for disk over usb hub + @{run}/udev/data/+usb:* r, # Identifies all USB devices include if exists diff --git a/apparmor.d/abstractions/gstreamer b/apparmor.d/abstractions/gstreamer index 7fc20c293..5a14b6f7a 100644 --- a/apparmor.d/abstractions/gstreamer +++ b/apparmor.d/abstractions/gstreamer @@ -36,7 +36,7 @@ #owner @{HOME}/orcexec.* mrw, @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs - @{run}/udev/data/+usb:* r, # For /dev/bus/usb/** + @{run}/udev/data/+usb:* r, # Identifies all USB devices @{run}/udev/data/c81:@{int} r, # For video4linux @{run}/udev/data/c189:@{int} r, # For USB serial converters diff --git a/apparmor.d/groups/_full/systemd b/apparmor.d/groups/_full/systemd index 184084fed..d1ee8fd1f 100644 --- a/apparmor.d/groups/_full/systemd +++ b/apparmor.d/groups/_full/systemd @@ -168,14 +168,13 @@ profile systemd flags=(attach_disconnected,mediate_deleted,complain) { @{run}/credentials/{,**} rw, @{run}/systemd/{,**} rw, - @{run}/udev/data/+module:configfs r, - @{run}/udev/data/+module:fuse r, + @{run}/udev/data/+module:* r, # Identifies kernel modules loaded by udev @{run}/udev/data/c4:@{int} r, # For TTY devices @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features @{run}/udev/data/c116:@{int} r, # For ALSA @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{run}/udev/tags/systemd/ r, @{sys}/**/uevent r, diff --git a/apparmor.d/groups/_full/systemd-user b/apparmor.d/groups/_full/systemd-user index a5bb4d926..b3d751be1 100644 --- a/apparmor.d/groups/_full/systemd-user +++ b/apparmor.d/groups/_full/systemd-user @@ -59,14 +59,13 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted,complain) { @{run}/systemd/notify w, @{run}/systemd/oom/io.systemd.ManagedOOM rw, - @{run}/udev/data/+module:configfs r, - @{run}/udev/data/+module:fuse r, + @{run}/udev/data/+module:* r, # Identifies kernel modules loaded by udev @{run}/udev/data/c4:@{int} r, # For TTY devices @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features @{run}/udev/data/c116:@{int} r, # for ALSA @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{run}/udev/tags/systemd/ r, @{sys}/devices/virtual/dmi/id/bios_vendor r, diff --git a/apparmor.d/groups/bluetooth/bluetoothd b/apparmor.d/groups/bluetooth/bluetoothd index e5443f505..2800a4124 100644 --- a/apparmor.d/groups/bluetooth/bluetoothd +++ b/apparmor.d/groups/bluetooth/bluetoothd @@ -46,7 +46,7 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) { @{run}/sdp rw, owner @{run}/systemd/notify w, - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) @{sys}/devices/@{pci}/rfkill@{int}/name r, @{sys}/devices/@{pci}/**/{uevent,name} r, diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index efcad72f8..8e86ee126 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -44,7 +44,7 @@ profile firefox-kmozillahelper @{exec_path} { owner @{run}/user/@{uid}/kmozillahelper@{rand6}.@{int}.kioworker.socket wl, owner @{run}/user/@{uid}/xauth_@{rand6} rl, - @{run}/udev/data/+usb:* r, # For /dev/bus/usb/** + @{run}/udev/data/+usb:* r, # Identifies all USB devices @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** diff --git a/apparmor.d/groups/filesystem/udisksd b/apparmor.d/groups/filesystem/udisksd index 2ff82f5e4..91d4a8569 100644 --- a/apparmor.d/groups/filesystem/udisksd +++ b/apparmor.d/groups/filesystem/udisksd @@ -112,11 +112,11 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { @{run}/cryptsetup/ r, @{run}/cryptsetup/L* rwk, - @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+scsi:* r, - @{run}/udev/data/+vmbus:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) + @{run}/udev/data/+scsi:* r, # For SCSI devices. Block-storage for SATA, SAS, USB, iSCSI + @{run}/udev/data/+vmbus:* r, # For Hyper-V devices, (network adapters, storage controllers, and other virtual devices) @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{sys}/bus/ r, diff --git a/apparmor.d/groups/freedesktop/boltd b/apparmor.d/groups/freedesktop/boltd index 8f55bb375..5b72f8427 100644 --- a/apparmor.d/groups/freedesktop/boltd +++ b/apparmor.d/groups/freedesktop/boltd @@ -27,7 +27,7 @@ profile boltd @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/notify w, - @{run}/udev/data/+thunderbolt:* r, + @{run}/udev/data/+thunderbolt:* r, # For Thunderbolt devices, such as docks, external GPUs, and storage devices. @{sys}/bus/ r, @{sys}/bus/thunderbolt/devices/ r, diff --git a/apparmor.d/groups/freedesktop/iio-sensor-proxy b/apparmor.d/groups/freedesktop/iio-sensor-proxy index d7122bdbb..1201e1277 100644 --- a/apparmor.d/groups/freedesktop/iio-sensor-proxy +++ b/apparmor.d/groups/freedesktop/iio-sensor-proxy @@ -18,7 +18,7 @@ profile iio-sensor-proxy @{exec_path} { @{exec_path} mr, - @{run}/udev/data/+platform:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/c13:@{int} r, # For /dev/input/* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index 4061af4c8..d58385831 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -28,15 +28,15 @@ profile upowerd @{exec_path} flags=(attach_disconnected) { /var/lib/upower/ r, /var/lib/upower/history-*.dat{,.*} rw, - @{run}/udev/data/ r, - @{run}/udev/data/+acpi:* r, # for acpi - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard - @{run}/udev/data/+i2c:* r, + @{run}/udev/data/ r, # Lists all udev data files + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) + @{run}/udev/data/+i2c:* r, # For Inter-Integrated Circuit, low-speed peripherals (sensors, EEPROMs, etc.) @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+serio:* r, # for serial mice - @{run}/udev/data/+power_supply* r, + @{run}/udev/data/+power_supply:* r, # For power supply devices (batteries, AC adapters, USB chargers) @{run}/udev/data/+sound:card@{int} r, # for sound card @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features @{run}/udev/data/c13:@{int} r, # for /dev/input/* diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index 12c82aea3..c14af6d6e 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -92,17 +92,17 @@ profile xorg @{exec_path} flags=(attach_disconnected) { owner @{tmp}/server-* rwk, owner @{tmp}/serverauth.* r, - @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+dmi* r, # for motherboard info @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard - @{run}/udev/data/+i2c:* r, + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) + @{run}/udev/data/+i2c:* r, # For Inter-Integrated Circuit, low-speed peripherals (sensors, EEPROMs, etc.) @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, # for ? + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+serio:* r, # for touchpad? @{run}/udev/data/+sound:card@{int} r, # for sound card - @{run}/udev/data/+usb* r, # for USB mouse and keyboard + @{run}/udev/data/+usb:* r, # Identifies all USB devices @{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]* @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 85b3268dd..41b62df09 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -159,7 +159,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/bus/ r, @{sys}/class/ r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 25ce44f14..d4c8b1ba2 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -315,19 +315,19 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{run}/udev/tags/seat/ r, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+platform:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+dmi:id r, # for motherboard info - @{run}/udev/data/+acpi* r, + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+sound:card@{int} r, # for sound card - @{run}/udev/data/+usb* r, # for USB mouse and keyboard - @{run}/udev/data/+i2c:* r, - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+usb:* r, # Identifies all USB devices + @{run}/udev/data/+i2c:* r, # For Inter-Integrated Circuit, low-speed peripherals (sensors, EEPROMs, etc.) + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/**/uevent r, @{sys}/bus/ r, diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index a330b76ce..2fa0b0b1f 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -58,9 +58,9 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, - @{run}/udev/data/+backlight:* r, + @{run}/udev/data/+backlight:* r, # For display backlights on laptops, monitors, and other screens. @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs - @{run}/udev/data/+leds:* r, + @{run}/udev/data/+leds:* r, # Identifies all LEDs (keyboard, mouse, etc.) @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 9f2e7583d..8c8c32da0 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -42,15 +42,15 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { @{run}/systemd/sessions/@{int} r, - @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+dmi:id r, # for motherboard info @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+sound:card@{int} r, # for sound card - @{run}/udev/data/+usb* r, # for USB mouse and keyboard + @{run}/udev/data/+usb:* r, # Identifies all USB devices @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** @{run}/udev/data/c226:@{int} r, # for /dev/dri/card* diff --git a/apparmor.d/groups/kde/baloo b/apparmor.d/groups/kde/baloo index e53bf4039..29447e22a 100644 --- a/apparmor.d/groups/kde/baloo +++ b/apparmor.d/groups/kde/baloo @@ -44,8 +44,8 @@ profile baloo @{exec_path} { @{run}/mount/utab r, - @{run}/udev/data/+*:* r, - @{run}/udev/data/c@{int}:@{int} r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/bus/ r, @{sys}/bus/*/devices/ r, diff --git a/apparmor.d/groups/kde/baloorunner b/apparmor.d/groups/kde/baloorunner index 8410408b3..702288a1f 100644 --- a/apparmor.d/groups/kde/baloorunner +++ b/apparmor.d/groups/kde/baloorunner @@ -28,8 +28,8 @@ profile baloorunner @{exec_path} { /tmp/ r, - @{run}/udev/data/+*:* r, - @{run}/udev/data/c@{int}:@{int} r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/bus/ r, @{sys}/bus/*/devices/ r, diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 2ed232f85..5d51f8c4d 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -105,8 +105,8 @@ profile dolphin @{exec_path} { owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/dolphin@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, - @{run}/udev/data/+*:* r, - @{run}/udev/data/c@{int}:@{int} r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/bus/ r, @{sys}/bus/*/devices/ r, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 101affd8c..afaac3bd0 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -110,15 +110,15 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, - @{run}/udev/data/+acpi:* r, # for ACPI + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+dmi:* r, # for motherboard info - @{run}/udev/data/+hid:* r, # for HID subsystem + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, # for ? + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+serio:* r, # for touchpad @{run}/udev/data/+sound:card@{int} r, # for sound card - @{run}/udev/data/+usb:* r, + @{run}/udev/data/+usb:* r, # Identifies all USB devices @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features @{run}/udev/data/c13:@{int} r, # for /dev/input/* diff --git a/apparmor.d/groups/lxqt/lxqt-panel b/apparmor.d/groups/lxqt/lxqt-panel index 650a7e402..f817be69d 100644 --- a/apparmor.d/groups/lxqt/lxqt-panel +++ b/apparmor.d/groups/lxqt/lxqt-panel @@ -63,7 +63,8 @@ profile lxqt-panel @{exec_path} { owner @{user_config_dirs}/lxqt/panel.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int}, owner @{user_config_dirs}/pulse/{,**} rwk, - @{run}/udev/data/* r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/class/i2c-adapter/ r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{cur,min,max}_freq r, diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index 59efc3201..8220516bf 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -25,18 +25,18 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{run}/udev/data/+acpi:* r, # for acpi + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+pnp:* r, - @{run}/udev/data/+serial*:* r, - @{run}/udev/data/+usb:* r, - @{run}/udev/data/+vmbus:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) + @{run}/udev/data/+pnp:* r, # For Plug and Play devices (legacy hardware, sound cards, etc.) + @{run}/udev/data/+serial*:* r, # For serial devices (modems, serial ports, etc.) + @{run}/udev/data/+usb:* r, # Identifies all USB devices + @{run}/udev/data/+vmbus:* r, # For Hyper-V devices, (network adapters, storage controllers, and other virtual devices) @{run}/udev/data/c16[6,7]:@{int} r, # USB modems @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters @{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]* @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index fc5c39ea7..f7c0dd084 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -125,9 +125,9 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{run}/nscd/db* rwl, @{run}/systemd/users/@{uid} r, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+rfkill:* r, - @{run}/udev/data/n@{int} r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) + @{run}/udev/data/+rfkill:* r, # Kill switch for wireless devices (Wi-Fi, Bluetooth, NFC) to save power + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/devices/@{pci}/net/*/{,**} r, @{sys}/devices/@{pci}/usb@{int}/**/net/{,**} r, diff --git a/apparmor.d/groups/network/dhcpcd b/apparmor.d/groups/network/dhcpcd index 51cf215f9..7bcd9efba 100644 --- a/apparmor.d/groups/network/dhcpcd +++ b/apparmor.d/groups/network/dhcpcd @@ -49,7 +49,7 @@ profile dhcpcd @{exec_path} flags=(attach_disconnected) { @{run}/dhcpcd/** rwk, - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/devices/@{pci}/uevent r, @{sys}/devices/virtual/dmi/id/product_uuid r, diff --git a/apparmor.d/groups/network/nmcli b/apparmor.d/groups/network/nmcli index 43a9d0dca..6065a12da 100644 --- a/apparmor.d/groups/network/nmcli +++ b/apparmor.d/groups/network/nmcli @@ -25,7 +25,7 @@ profile nmcli @{exec_path} { owner @{HOME}/.cert/nm-openvpn/*.pem rw, @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/devices/virtual/net/{,**} r, @{sys}/devices/@{pci}/net/*/{,**} r, diff --git a/apparmor.d/groups/steam/steam b/apparmor.d/groups/steam/steam index 151a3e161..5009b970d 100644 --- a/apparmor.d/groups/steam/steam +++ b/apparmor.d/groups/steam/steam @@ -190,7 +190,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/c13:@{int} r, # for /dev/input/* - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/ r, @{sys}/bus/ r, diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl index 0fd89c199..a0d1471f9 100644 --- a/apparmor.d/groups/systemd/networkctl +++ b/apparmor.d/groups/systemd/networkctl @@ -59,7 +59,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) { @{run}/systemd/netif/state r, @{run}/systemd/notify w, - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/devices/**/net/**/uevent r, diff --git a/apparmor.d/groups/systemd/systemd-backlight b/apparmor.d/groups/systemd/systemd-backlight index 374e9c4ae..b5a966f37 100644 --- a/apparmor.d/groups/systemd/systemd-backlight +++ b/apparmor.d/groups/systemd/systemd-backlight @@ -18,8 +18,8 @@ profile systemd-backlight @{exec_path} flags=(attach_disconnected) { /var/lib/systemd/backlight/*backlight* rw, - @{run}/udev/data/+backlight:* r, - @{run}/udev/data/+leds:*backlight* r, + @{run}/udev/data/+backlight:* r, # For display backlights on laptops, monitors, and other screens. + @{run}/udev/data/+leds:*backlight* r, # For keyboard backlights, mouse LEDs, etc. @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{sys}/bus/ r, diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index b0a646f66..ad3d96990 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -46,20 +46,20 @@ profile systemd-journald @{exec_path} flags=(attach_disconnected,mediate_deleted @{run}/host/container-manager r, @{run}/utmp rk, - @{run}/udev/data/+acpi:* r, - @{run}/udev/data/+bluetooth:* r, - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard - @{run}/udev/data/+ieee80211:* r, + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) + @{run}/udev/data/+bluetooth:* r, # For bluetooth adapters, controllers, and active connections. + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) + @{run}/udev/data/+ieee80211:* r, # For Wi-Fi devices, such as wireless network cards and access points. @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+mdio_bus:* r, - @{run}/udev/data/+pci:* r, - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+scsi:* r, - @{run}/udev/data/+sdio:* r, - @{run}/udev/data/+thunderbolt:* r, - @{run}/udev/data/+usb-serial:* r, - @{run}/udev/data/+usb:* r, - @{run}/udev/data/+virtio:* r, + @{run}/udev/data/+mdio_bus:* r, # For Management Data Input/Output (Ethernet PHY (physical layer) devices) + @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) + @{run}/udev/data/+scsi:* r, # For SCSI devices. Block-storage for SATA, SAS, USB, iSCSI + @{run}/udev/data/+sdio:* r, # For Secure Digital Input Output devices, such as Wi-Fi, Bluetooth cards, GPS and NFC modules. + @{run}/udev/data/+thunderbolt:* r, # For Thunderbolt devices, such as docks, external GPUs, and storage devices. + @{run}/udev/data/+usb-serial:* r, # For USB to serial adapters + @{run}/udev/data/+usb:* r, # Identifies all USB devices + @{run}/udev/data/+virtio:* r, # For paravirtualized devices (network interfaces, block devices, console) @{run}/udev/data/b254:@{int} r, # for /dev/zram* @{run}/udev/data/b259:@{int} r, # Block Extended Major @{run}/udev/data/c1:@{int} r, # For RAM disk diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 1fb3f6cb3..271354633 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -68,15 +68,15 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{run}/udev/tags/uaccess/ r, @{run}/udev/static_node-tags/uaccess/ r, - @{run}/udev/data/+backlight:* r, - @{run}/udev/data/+drivers:* r, + @{run}/udev/data/+backlight:* r, # For display backlights on laptops, monitors, and other screens. + @{run}/udev/data/+drivers:* r, # For drivers loaded in the system @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs - @{run}/udev/data/+hid:* r, - @{run}/udev/data/+i2c:* r, + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) + @{run}/udev/data/+i2c:* r, # For Inter-Integrated Circuit, low-speed peripherals (sensors, EEPROMs, etc.) @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+leds:* r, + @{run}/udev/data/+leds:* r, # Identifies all LEDs (keyboard, mouse, etc.) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+wakeup:* r, + @{run}/udev/data/+wakeup:* r, # For wakeup events (e.g., from sleep or hibernation) @{run}/udev/data/c1:@{int} r, # For RAM disk @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features @{run}/udev/data/c13:@{int} r, # For /dev/input/* diff --git a/apparmor.d/groups/systemd/systemd-networkd b/apparmor.d/groups/systemd/systemd-networkd index 5105c69b8..ccb6d9629 100644 --- a/apparmor.d/groups/systemd/systemd-networkd +++ b/apparmor.d/groups/systemd/systemd-networkd @@ -71,7 +71,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) { @{run}/systemd/network/*.network r, owner @{run}/systemd/netif/** rw, - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/devices/@{pci}/ r, @{sys}/devices/@{pci}/rfkill@{int}/* r, diff --git a/apparmor.d/groups/systemd/systemd-rfkill b/apparmor.d/groups/systemd/systemd-rfkill index 552bd9996..bf983ea7a 100644 --- a/apparmor.d/groups/systemd/systemd-rfkill +++ b/apparmor.d/groups/systemd/systemd-rfkill @@ -22,7 +22,7 @@ profile systemd-rfkill @{exec_path} flags=(attach_disconnected) { /var/lib/systemd/rfkill/* rw, @{run}/systemd/notify rw, - @{run}/udev/data/+rfkill:* r, + @{run}/udev/data/+rfkill:* r, # Kill switch for wireless devices (Wi-Fi, Bluetooth, NFC) to save power @{sys}/devices/**/rfkill@{int}/{uevent,name} r, diff --git a/apparmor.d/groups/ubuntu/subiquity-console-conf b/apparmor.d/groups/ubuntu/subiquity-console-conf index a5b65f5b3..8f673e261 100644 --- a/apparmor.d/groups/ubuntu/subiquity-console-conf +++ b/apparmor.d/groups/ubuntu/subiquity-console-conf @@ -53,13 +53,13 @@ profile subiquity-console-conf @{exec_path} { @{run}/snapd-recovery-chooser-triggered r, @{run}/snapd.socket rw, - @{run}/udev/data/+acpi:* r, + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+dmi:* r, # For motherboard info @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+leds:* r, + @{run}/udev/data/+leds:* r, # Identifies all LEDs (keyboard, mouse, etc.) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+sound:card@{int} r, # For sound card @{run}/udev/data/c1:@{int} r, # For RAM disk @@ -74,7 +74,7 @@ profile subiquity-console-conf @{exec_path} { @{run}/udev/data/c116:@{int} r, # For ALSA @{run}/udev/data/c226:@{int} r, # For /dev/dri/card* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/**/devices/ r, @{sys}/*/*/ r, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index c90e80af9..fa3005a65 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -164,9 +164,9 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{run}/systemd/notify w, @{run}/utmp rk, - @{run}/udev/data/+*:* r, - @{run}/udev/data/c@{int}:@{int} r, - @{run}/udev/data/n@{int} r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/bus/[a-z]*/devices/ r, @{sys}/bus/pci/drivers_probe w, diff --git a/apparmor.d/groups/virt/virtnodedevd b/apparmor.d/groups/virt/virtnodedevd index 957164e85..fb593068e 100644 --- a/apparmor.d/groups/virt/virtnodedevd +++ b/apparmor.d/groups/virt/virtnodedevd @@ -44,18 +44,18 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { @{run}/utmp rk, - @{run}/udev/data/+backlight:* r, - @{run}/udev/data/+bluetooth:* r, + @{run}/udev/data/+backlight:* r, # For display backlights on laptops, monitors, and other screens. + @{run}/udev/data/+bluetooth:* r, # For bluetooth adapters, controllers, and active connections. @{run}/udev/data/+dmi:* r, # for motherboard info @{run}/udev/data/+drm:card@{int}-* r, # for screen outputs @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/+leds:* r, + @{run}/udev/data/+leds:* r, # Identifies all LEDs (keyboard, mouse, etc.) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+power_supply:* r, - @{run}/udev/data/+rfkill:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) + @{run}/udev/data/+power_supply:* r, # For power supply devices (batteries, AC adapters, USB chargers) + @{run}/udev/data/+rfkill:* r, # Kill switch for wireless devices (Wi-Fi, Bluetooth, NFC) to save power @{run}/udev/data/+sound:card@{int} r, # For sound card - @{run}/udev/data/+thunderbolt:* r, + @{run}/udev/data/+thunderbolt:* r, # For Thunderbolt devices, such as docks, external GPUs, and storage devices. @{run}/udev/data/c1:@{int} r, # For RAM disk @{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features @@ -71,7 +71,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c203:@{int} r, # CPU CPUID information @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - @{run}/udev/data/n@{int} r, + @{run}/udev/data/n@{int} r, # For network interfaces @{sys}/**/ r, @{sys}/devices/@{pci}/net/{,**} r, diff --git a/apparmor.d/profiles-a-f/cheese b/apparmor.d/profiles-a-f/cheese index cadd1beab..b308439c3 100644 --- a/apparmor.d/profiles-a-f/cheese +++ b/apparmor.d/profiles-a-f/cheese @@ -36,10 +36,11 @@ profile cheese @{exec_path} { owner @{user_cache_dirs}/gnome-desktop-thumbnailer/gstreamer-1.0/ r, - @{run}/udev/data/c@{dynamic}:@{int} r, owner @{tmp}/flatpak-seccomp-@{rand6} rw, owner @{tmp}/gnome-desktop-thumbnailer-@{rand6}/{,**} rw, + @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,product_name,sys_vendor} r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 019aec5a9..ff9af895d 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -109,7 +109,9 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{run}/motd.d/@{int}-fwupd* rw, @{run}/motd.d/fwupd/{,**} rw, @{run}/mount/utab r, - @{run}/udev/data/* r, + + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{PROC}/@{pids}/fd/ r, @{PROC}/@{pids}/mountinfo r, diff --git a/apparmor.d/profiles-g-l/kodi b/apparmor.d/profiles-g-l/kodi index 5b90dd3ef..9d6c9d1c2 100644 --- a/apparmor.d/profiles-g-l/kodi +++ b/apparmor.d/profiles-g-l/kodi @@ -50,7 +50,8 @@ profile kodi @{exec_path} { owner @{HOME}/core w, owner @{HOME}/kodi_crashlog-@{int}_@{int}.log w, - @{run}/udev/data/* r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/**/ r, @{sys}/devices/@{pci}/usb@{int}/{bDeviceClass,idProduct,idVendor} r, diff --git a/apparmor.d/profiles-g-l/labwc b/apparmor.d/profiles-g-l/labwc index 93234bf52..ab624f099 100644 --- a/apparmor.d/profiles-g-l/labwc +++ b/apparmor.d/profiles-g-l/labwc @@ -38,12 +38,11 @@ profile labwc @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/boot_vga r, @{sys}/devices/**/uevent r, - @{run}/udev/data/+acpi:* r, # for ? + @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+drm:card@{int}-* r, # for screen outputs - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard - @{run}/udev/data/+hid:* r, # for HID-Compliant Keyboard + @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) - @{run}/udev/data/+platform:* r, # for ? + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{run}/udev/data/+serio:* r, # for touchpad? @{run}/udev/data/+sound:card@{int} r, # for sound card @{run}/udev/data/c13:@{int} r, # for /dev/input/* diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index 636f41754..b8f50ff7c 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -28,8 +28,8 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { /var/lib/power-profiles-daemon/{,**} rw, - @{run}/udev/data/+platform:* r, - @{run}/udev/data/+power_supply:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) + @{run}/udev/data/+power_supply:* r, # For power supply devices (batteries, AC adapters, USB chargers) @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs @{run}/udev/data/c226:@{int} r, # For /dev/dri/card[0-9]* diff --git a/apparmor.d/profiles-s-z/tlp b/apparmor.d/profiles-s-z/tlp index 0dccf1a23..1592d3aee 100644 --- a/apparmor.d/profiles-s-z/tlp +++ b/apparmor.d/profiles-s-z/tlp @@ -68,7 +68,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) { owner @{run}/tlp/{,**} rw, owner @{run}/tlp/lock_tlp rwk, - @{run}/udev/data/+platform:* r, + @{run}/udev/data/+platform:* r, # Identifies onboard devices (laptop/board model, power controllers, thermal sensors) @{sys}/bus/pci/devices/ r, @{sys}/bus/pci/drivers/*/ r, From 616486d5bad36719f8096ec9a4d540f199a603ad Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Aug 2025 16:18:58 +0200 Subject: [PATCH 1172/1455] tests(check): add a check to ensure all udev/data access are documented. --- tests/check.sh | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 9ecd809bf..9bafd5104 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -108,6 +108,7 @@ _check() { _check_trailing _check_indentation _check_vim + _check_udev # The following checks do not apply to commented lines [[ "$line" =~ ^[[:space:]]*# ]] && continue @@ -485,6 +486,15 @@ _res_vim() { fi } +_check_udev() { + _is_enabled udev || return 0 + if [[ "$line" == *"@{run}/udev/data/"* ]]; then + if [[ "$line" != *"#"* ]]; then + _err udev "$file:$line_number" "udev data path without a description comment" + fi + fi +} + check_sbin() { local file name jobs mapfile -t sbin Date: Mon, 11 Aug 2025 19:38:24 +0200 Subject: [PATCH 1173/1455] feat(profile): fwupd: allow access to dbx --- apparmor.d/profiles-a-f/fwupd | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index ff9af895d..7a00455a6 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -83,7 +83,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { owner /var/lib/fwupd/ rw, owner /var/lib/fwupd/** rwk, - # In order to get to this file, the attach_disconnected flag has to be set + @{att}/@{user_cache_dirs}/gnome-software/fwupd/{,**} r, owner @{user_cache_dirs}/fwupd/lvfs-metadata.xml.gz r, owner @{user_cache_dirs}/gnome-software/fwupd/{,**} r, @@ -97,6 +97,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{sys}/firmware/efi/** r, @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} rw, @{sys}/firmware/efi/efivars/BootNext-@{uuid} rw, + @{sys}/firmware/efi/efivars/dbx-@{uuid} rw, @{sys}/firmware/efi/efivars/fwupd-* rw, @{sys}/firmware/efi/efivars/KEK-@{uuid} rw, @{sys}/kernel/security/lockdown r, From f35b64bcaec3dd23c11ab55c1b0fd3f0a21d849b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 11 Aug 2025 22:27:08 +0200 Subject: [PATCH 1174/1455] fix(profile): missing documented udev/data --- apparmor.d/abstractions/app/udevadm | 3 ++- apparmor.d/groups/_full/sd | 3 ++- apparmor.d/groups/systemd/systemd-analyze | 3 ++- apparmor.d/profiles-a-f/ddcutil | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/app/udevadm b/apparmor.d/abstractions/app/udevadm index e8414d026..d659143d6 100644 --- a/apparmor.d/abstractions/app/udevadm +++ b/apparmor.d/abstractions/app/udevadm @@ -11,7 +11,8 @@ /etc/udev/udev.conf r, - @{run}/udev/data/* r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/** r, diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd index da14cabf3..13864f2dd 100644 --- a/apparmor.d/groups/_full/sd +++ b/apparmor.d/groups/_full/sd @@ -187,7 +187,8 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) { owner @{run}/*/** rw, @{run}/udev/**/ r, - @{run}/udev/data/* r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/** r, @{sys}/fs/bpf/systemd/{,**} w, diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze index 7310586e8..3ae0a7143 100644 --- a/apparmor.d/groups/systemd/systemd-analyze +++ b/apparmor.d/groups/systemd/systemd-analyze @@ -47,7 +47,8 @@ profile systemd-analyze @{exec_path} { @{run}/systemd/system/ r, @{run}/systemd/transient/ r, @{run}/systemd/userdb/io.systemd.DynamicUser w, - @{run}/udev/data/* r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{run}/udev/tags/systemd/ r, @{sys}/devices/**/uevent r, diff --git a/apparmor.d/profiles-a-f/ddcutil b/apparmor.d/profiles-a-f/ddcutil index 7c353bf65..d8cb23a5c 100644 --- a/apparmor.d/profiles-a-f/ddcutil +++ b/apparmor.d/profiles-a-f/ddcutil @@ -28,7 +28,8 @@ profile ddcutil @{exec_path} { owner @{user_cache_dirs}/ddcutil/ rw, owner @{user_cache_dirs}/ddcutil/** rwlk, - @{run}/udev/data/* r, + @{run}/udev/data/+*:* r, # Identifies all subsystems + @{run}/udev/data/c@{int}:@{int} r, # Identifies all character devices @{sys}/ r, @{sys}/bus/ r, From 8b64d7dd46364e84e435564f7e9d474d1c7c9154 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Aug 2025 09:27:12 +0200 Subject: [PATCH 1175/1455] feat(abs): electron: add cgroup memory data. --- apparmor.d/abstractions/common/electron | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 6216ec939..cd7e9e8f1 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -73,6 +73,13 @@ @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/tty/tty@{int}/active r, + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.high r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, + @{PROC}/ r, @{PROC}/@{pid}/stat r, @{PROC}/@{pid}/task/@{tid}/status r, From aab12e6948e27fcb9351ae3f5beb5ff49e4db619 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Aug 2025 11:07:08 +0200 Subject: [PATCH 1176/1455] fix(profile): dockerd can be installed in both bin or sbin depending of the package source. --- apparmor.d/groups/virt/dockerd | 2 +- tests/sbin.list | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index 44d9f64a0..aa0a9ed58 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/dockerd +@{exec_path} = @{bin}/dockerd @{sbin}/dockerd #aa:lint ignore=sbin profile dockerd @{exec_path} flags=(attach_disconnected) { include include diff --git a/tests/sbin.list b/tests/sbin.list index a8b439478..8ee14fd21 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -171,6 +171,7 @@ dmidecode dmraid dmsetup dnsmasq +dockerd dosfsck dosfslabel dpkg-preconfigure From 2aa0d89f84ac2ad51b021568ce52243c9fc595a8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Aug 2025 12:45:55 +0200 Subject: [PATCH 1177/1455] feat(profile): update firefox stack. --- apparmor.d/groups/browsers/firefox-glxtest | 2 +- apparmor.d/groups/browsers/torbrowser-glxtest | 4 +++- apparmor.d/profiles-s-z/thunderbird | 6 +++--- apparmor.d/profiles-s-z/thunderbird-glxtest | 4 +++- 4 files changed, 10 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest index 97e5645b9..30281f2f4 100644 --- a/apparmor.d/groups/browsers/firefox-glxtest +++ b/apparmor.d/groups/browsers/firefox-glxtest @@ -16,8 +16,8 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) { include include include - include include + include @{exec_path} mr, diff --git a/apparmor.d/groups/browsers/torbrowser-glxtest b/apparmor.d/groups/browsers/torbrowser-glxtest index 4939edfbf..2d8697259 100644 --- a/apparmor.d/groups/browsers/torbrowser-glxtest +++ b/apparmor.d/groups/browsers/torbrowser-glxtest @@ -17,11 +17,13 @@ profile torbrowser-glxtest @{exec_path} flags=(attach_disconnected) { include include include - include include + include @{exec_path} mr, + / r, + owner @{PROC}/@{pid}/cmdline r, deny @{config_dirs}/.parentlock rw, diff --git a/apparmor.d/profiles-s-z/thunderbird b/apparmor.d/profiles-s-z/thunderbird index 02046580c..da163c2ae 100644 --- a/apparmor.d/profiles-s-z/thunderbird +++ b/apparmor.d/profiles-s-z/thunderbird @@ -13,7 +13,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name}/ @{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name} -profile thunderbird @{exec_path} { +profile thunderbird @{exec_path} flags=(attach_disconnected) { include include include @@ -23,8 +23,8 @@ profile thunderbird @{exec_path} { @{exec_path} mrix, - @{lib_dirs}/glxtest rPx, - @{lib_dirs}/vaapitest rPx, + @{lib_dirs}/glxtest rPx -> thunderbird//&thunderbird-glxtest, + @{lib_dirs}/vaapitest rPx -> thunderbird//&thunderbird-vaapitest, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemKWaylandPlugin.so mr, @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr, diff --git a/apparmor.d/profiles-s-z/thunderbird-glxtest b/apparmor.d/profiles-s-z/thunderbird-glxtest index 626896a09..4f25e0862 100644 --- a/apparmor.d/profiles-s-z/thunderbird-glxtest +++ b/apparmor.d/profiles-s-z/thunderbird-glxtest @@ -15,11 +15,13 @@ profile thunderbird-glxtest @{exec_path} { include include include - include include + include @{exec_path} mr, + / r, + owner @{config_dirs}/*/.parentlock rw, owner @{tmp}/thunderbird/.parentlock rw, From a5aa13923b657c9dee16d11c378d80215b14d949 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Aug 2025 16:11:10 +0200 Subject: [PATCH 1178/1455] build: add support for building multiple version of the package. --- Justfile | 10 +++++----- pkg/prebuild/cli/cli.go | 28 +++++++++++++++++++++------- 2 files changed, 26 insertions(+), 12 deletions(-) diff --git a/Justfile b/Justfile index ffed74ef5..3e16a75e8 100644 --- a/Justfile +++ b/Justfile @@ -63,27 +63,27 @@ build: [group('build')] [doc('Prebuild the profiles in enforced mode')] enforce: build - @./{{build}}/prebuild + @./{{build}}/prebuild --buildir {{build}} [group('build')] [doc('Prebuild the profiles in complain mode')] complain: build - @./{{build}}/prebuild --complain + ./{{build}}/prebuild --buildir {{build}} --complain [group('build')] [doc('Prebuild the profiles in FSP mode')] fsp: build - @./{{build}}/prebuild --full + @./{{build}}/prebuild --buildir {{build}} --full [group('build')] [doc('Prebuild the profiles in FSP mode (complain)')] fsp-complain: build - @./{{build}}/prebuild --complain --full + @./{{build}}/prebuild --buildir {{build}} --complain --full [group('build')] [doc('Prebuild the profiles in FSP mode (debug)')] fsp-debug: build - @./{{build}}/prebuild --complain --full --debug + @./{{build}}/prebuild --buildir {{build}} --complain --full --debug [group('install')] [doc('Install prebuild profiles')] diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 51636f848..000aa65f9 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -26,13 +26,15 @@ const ( internal built-in directives. Options: - -h, --help Show this help message and exit. - -c, --complain Set complain flag on all profiles. - -e, --enforce Set enforce flag on all profiles. - -a, --abi ABI Target apparmor ABI. - -v, --version V Target apparmor version. - -f, --full Set AppArmor for full system policy. - -F, --file Only prebuild a given file. + -h, --help Show this help message and exit. + -c, --complain Set complain flag on all profiles. + -e, --enforce Set enforce flag on all profiles. + -a, --abi ABI Target apparmor ABI. + -v, --version V Target apparmor version. + -f, --full Set AppArmor for full system policy. + -b, --buildir DIR Root build directory. + -F, --file Only prebuild a given file. + --debug Enable debug mode. ` ) @@ -41,9 +43,11 @@ var ( complain bool enforce bool full bool + debug bool abi int version float64 file string + buildir string ) func init() { @@ -61,6 +65,9 @@ func init() { flag.Float64Var(&version, "version", nilVer, "Target apparmor version.") flag.StringVar(&file, "F", "", "Only prebuild a given file.") flag.StringVar(&file, "file", "", "Only prebuild a given file.") + flag.StringVar(&buildir, "b", "", "Root build directory.") + flag.StringVar(&buildir, "buildir", "", "Root build directory.") + flag.BoolVar(&debug, "debug", false, "Enable debug mode.") } func Configure() { @@ -87,6 +94,9 @@ func Configure() { if complain { builder.Register("complain") + if debug { + builder.Register("debug") + } } else if enforce { builder.Register("enforce") } @@ -106,6 +116,10 @@ func Configure() { if version != nilVer { prebuild.Version = version } + if buildir != "" { + prebuild.Root = paths.New(buildir) + prebuild.RootApparmord = prebuild.Root.Join("apparmor.d") + } if file != "" { sync, _ := prepare.Tasks["synchronise"].(*prepare.Synchronise) sync.Paths = []string{file} From 5c8c5029e085cc2ba88a28eb5df3c26229f4b49f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Aug 2025 18:12:51 +0200 Subject: [PATCH 1179/1455] tests(packer): add lxqt test image, update xfce. --- tests/cloud-init/archlinux-lxqt.user-data.yml | 28 ++++++++ tests/cloud-init/archlinux-xfce.user-data.yml | 36 +--------- tests/cloud-init/archlinux.yml | 67 +++++++++++++++++++ 3 files changed, 96 insertions(+), 35 deletions(-) create mode 100644 tests/cloud-init/archlinux-lxqt.user-data.yml diff --git a/tests/cloud-init/archlinux-lxqt.user-data.yml b/tests/cloud-init/archlinux-lxqt.user-data.yml new file mode 100644 index 000000000..208f7dab5 --- /dev/null +++ b/tests/cloud-init/archlinux-lxqt.user-data.yml @@ -0,0 +1,28 @@ +#cloud-config + +packages: *lxqt-packages + +# lxqt-wayland-session kwin + +runcmd: + # Regenerate grub.cfg + - grub-mkconfig -o /boot/grub/grub.cfg + + # Remove swapfile + - swapoff -a + - rm -rf /swap/ + - sed -e "/swap/d" -i /etc/fstab + + # Enable core services + - systemctl enable apparmor + - systemctl enable auditd + - systemctl enable sddm + - systemctl enable NetworkManager + - systemctl enable rngd + - systemctl enable avahi-daemon + - systemctl enable systemd-timesyncd.service + +write_files: + - *grub-enable-apparmor # Enable AppArmor in kernel parameters + - *setup-bash-aliases # Set some bash aliases + - *shared-directory # Setup shared directory diff --git a/tests/cloud-init/archlinux-xfce.user-data.yml b/tests/cloud-init/archlinux-xfce.user-data.yml index 5bab9bf08..afba57519 100644 --- a/tests/cloud-init/archlinux-xfce.user-data.yml +++ b/tests/cloud-init/archlinux-xfce.user-data.yml @@ -1,40 +1,6 @@ #cloud-config -packages: - # Install core packages - - apparmor - - base-devel - - qemu-guest-agent - - rng-tools - - spice-vdagent - - # Install usefull core packages - - bash-completion - - git - - just - - htop - - man - - pass - - python-notify2 - - vim - - wget - - # Install basic services - - networkmanager - - cups - - cups-pdf - - system-config-printer - - # Install Applications - - firefox - - chromium - - terminator - - # Install Graphical Interface - - xfce4 - - xfce4-goodies - - lightdm - - lightdm-gtk-greeter +packages: *xfce-packages runcmd: # Regenerate grub.cfg diff --git a/tests/cloud-init/archlinux.yml b/tests/cloud-init/archlinux.yml index 5299efda0..629de7d02 100644 --- a/tests/cloud-init/archlinux.yml +++ b/tests/cloud-init/archlinux.yml @@ -88,6 +88,73 @@ kde-packages: &kde-packages - konsole - okular +lxqt-packages: &lxqt-packages + # Core packages for Archlinux + - apparmor + - base-devel + - bash-completion + - docker + - git + - htop + - just + - man + - pass + - python-notify2 + - qemu-guest-agent + - rng-tools + - spice-vdagent + - vim + - wget + + # Desktop packages for Archlinux + - networkmanager + - cups + - cups-pdf + - system-config-printer + - chromium + - firefox + - spice-vdagent + - terminator + + # Install Graphical Interface + - lxqt + - breeze-icons + - sddm + +xfce-packages: &xfce-packages + # Core packages for Archlinux + - apparmor + - base-devel + - bash-completion + - docker + - git + - htop + - just + - man + - pass + - python-notify2 + - qemu-guest-agent + - rng-tools + - spice-vdagent + - vim + - wget + + # Desktop packages for Archlinux + - networkmanager + - cups + - cups-pdf + - system-config-printer + - chromium + - firefox + - spice-vdagent + - terminator + + # Install Graphical Interface + - xfce4 + - xfce4-goodies + - lightdm + - lightdm-gtk-greeter + # Enable AppArmor in kernel parameters grub-enable-apparmor: &grub-enable-apparmor path: /etc/default/grub From d8875ab8260f500175d5030c90142a94a4e324e5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 12 Aug 2025 18:51:39 +0200 Subject: [PATCH 1180/1455] build: minor build system improvement. --- Justfile | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/Justfile b/Justfile index 3e16a75e8..e434586c4 100644 --- a/Justfile +++ b/Justfile @@ -5,7 +5,7 @@ # Usage: `just` # See https://apparmor.pujol.io/development/ for more information. -# Build setings +# Build settings destdir := "/" build := ".build" pkgdest := `pwd` / ".pkg" @@ -251,7 +251,7 @@ create dist flavor: --memorybacking source.type=memfd,access.mode=shared \ --disk path={{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2,format=qcow2,bus=virtio \ --filesystem "`pwd`,0a31bc478ef8e2461a4b1cc10a24cc4",accessmode=passthrough,driver.type=virtiofs \ - --os-variant "`just get_osinfo {{dist}}`" \ + --os-variant "`just _get_osinfo {{dist}}`" \ --graphics spice \ --audio id=1,type=spice \ --sound model=ich9 \ @@ -282,18 +282,18 @@ destroy dist flavor: [group('vm')] [doc('Connect to the machine')] ssh dist flavor: - @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` + @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` [group('vm')] [doc('Mount the shared directory on the machine')] mount dist flavor: - @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ sh -c 'mount | grep 0a31bc478ef8e2461a4b1cc10a24cc4 || sudo mount 0a31bc478ef8e2461a4b1cc10a24cc4' [group('vm')] [doc('Unmout the shared directory on the machine')] umount dist flavor: - @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ sh -c 'true; sudo umount /home/{{username}}/Projects/apparmor.d || true' [group('vm')] @@ -307,6 +307,7 @@ list: images: #!/usr/bin/env bash set -eu -o pipefail + mkdir -p {{base_dir}} ls -lh {{base_dir}} | awk ' BEGIN { printf("{{BOLD}}%-18s %-10s %-5s %s{{NORMAL}}\n", "Distribution", "Flavor", "Size", "Date") @@ -343,19 +344,19 @@ init: [group('tests')] [doc('Run the integration tests')] -integration: - bats --recursive --timing --print-output-on-failure tests/integration +integration name="": + bats --recursive --timing --print-output-on-failure tests/integration/{{name}} [group('tests')] [doc('Install dependencies for the integration tests (machine)')] tests-init dist flavor: - @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ just --justfile /home/{{username}}/Projects/apparmor.d/Justfile init [group('tests')] [doc('Synchronize the integration tests (machine)')] tests-sync dist flavor: - @ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ rsync -a --delete /home/{{username}}/Projects/apparmor.d/tests/ /home/{{username}}/Projects/tests/ [group('tests')] @@ -367,18 +368,16 @@ tests-resync dist flavor: (mount dist flavor) \ [group('tests')] [doc('Run the integration tests (machine)')] tests-run dist flavor name="": (tests-resync dist flavor) - ssh {{sshopt}} {{username}}@`just get_ip {{dist}} {{flavor}}` \ + ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ bats --recursive --pretty --timing --print-output-on-failure \ /home/{{username}}/Projects/tests/integration/{{name}} -[private] -get_ip dist flavor: +_get_ip dist flavor: @virsh --quiet --readonly {{c}} domifaddr {{prefix}}{{dist}}-{{flavor}} | \ head -1 | \ grep -E -o '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}' -[private] -get_osinfo dist: +_get_osinfo dist: #!/usr/bin/env python3 osinfo = { "archlinux": "archlinux", From 38ac0f580d10b6e0950e9505095e669bd69529d1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 14 Aug 2025 15:40:52 +0200 Subject: [PATCH 1181/1455] feat(profile): revisit electron based profiles. - cleanup and enforce signal - fix discord fix #773 #777 --- apparmor.d/abstractions/common/electron | 1 + apparmor.d/groups/freedesktop/xdg-settings | 2 +- apparmor.d/groups/network/mullvad-gui | 4 ++-- apparmor.d/profiles-a-f/discord | 7 +++++-- apparmor.d/profiles-a-f/element-desktop | 4 +--- apparmor.d/profiles-a-f/freetube | 3 +-- apparmor.d/profiles-g-l/linuxqq | 1 - apparmor.d/profiles-m-r/protonmail | 10 +++++----- apparmor.d/profiles-s-z/signal-desktop | 23 +++++----------------- apparmor.d/profiles-s-z/wechat | 1 - apparmor.d/profiles-s-z/wechat-appimage | 1 - apparmor.d/profiles-s-z/wechat-universal | 1 - dists/flags/main.flags | 4 +--- 13 files changed, 22 insertions(+), 40 deletions(-) diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index cd7e9e8f1..175fa8b2d 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -16,6 +16,7 @@ include include + include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index 870d4cfe4..cb7edf822 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -15,7 +15,7 @@ profile xdg-settings @{exec_path} { @{exec_path} r, - @{sh_path} rix, + @{sh_path} r, @{bin}/{,e}grep rix, @{bin}/basename rix, @{bin}/cat ix, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index ae9b4cb7f..e4d2e9a2c 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -26,9 +26,9 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) { network netlink raw, @{exec_path} mrix, - @{sh_path} rix, + @{sh_path} rix, - @{bin}/gsettings rix, + @{bin}/gsettings rPx, @{open_path} rPx -> child-open-browsers, owner @{user_cache_dirs}/dconf/user rw, diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index ddcd99add..8765084ff 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -13,7 +13,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{bin}/discord{,-ptb} @{lib_dirs}/Discord{,PTB} -profile discord @{exec_path} { +profile discord @{exec_path} flags=(attach_disconnected) { include include include @@ -31,13 +31,15 @@ profile discord @{exec_path} { @{exec_path} mrix, @{sh_path} rix, - @{bin}/lsb_release rPx, @{lib_dirs}/chrome-sandbox rix, @{lib_dirs}/chrome_crashpad_handler rix, + @{bin}/lsb_release rPx, + @{bin}/xdg-mime rPx, @{open_path} rPx -> child-open-strict, + /etc/ r, /etc/lsb-release r, owner @{user_videos_dirs}/{,**} rwl, @@ -52,6 +54,7 @@ profile discord @{exec_path} { owner @{run}/user/@{uid}/discord-ipc-@{int} rw, + owner @{PROC}/@{pid}/mem r, owner @{PROC}/@{pid}/task/@{tid}/comm r, include if exists diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index 05a900889..91de37e58 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -30,11 +30,9 @@ profile element-desktop @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{sh_path} r, - @{open_path} rPx -> child-open-strict, - #aa:stack X xdg-settings @{bin}/xdg-settings rPx -> element-desktop//&xdg-settings, + @{open_path} Px -> child-open-strict, /usr/share/webapps/element/{,**} r, diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index 8250cf8aa..f4284873d 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -34,10 +34,9 @@ profile freetube @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{open_path} rPx -> child-open-strict, - #aa:stack X xdg-settings @{bin}/xdg-settings rPx -> freetube//&xdg-settings, + @{open_path} rPx -> child-open-strict, deny @{sys}/devices/@{pci}/usb@{int}/** r, deny /dev/ r, diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index dd653bd61..08b8cf7a1 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -17,7 +17,6 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) { include include include - include network netlink raw, network netlink dgram, diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index c6d309a94..c2c81d4da 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -13,7 +13,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{bin}/proton-mail /opt/proton-mail/Proton* -profile protonmail @{exec_path} flags=(complain) { +profile protonmail @{exec_path} flags=(attach_disconnected) { include include include @@ -24,12 +24,13 @@ profile protonmail @{exec_path} flags=(complain) { network inet6 dgram, network netlink raw, - ptrace read peer=xdg-settings, + ptrace read peer=protonmail//&xdg-settings, @{exec_path} mrix, - @{bin}/xdg-settings Px, - @{open_path} Px -> child-open, + #aa:stack X xdg-settings + @{bin}/xdg-settings rPx -> protonmail//&xdg-settings, + @{open_path} Px -> child-open, owner @{user_config_dirs}/ibus/bus/ r, @@ -38,7 +39,6 @@ profile protonmail @{exec_path} flags=(complain) { owner @{tmp}/gtkprint_ppd_@{rand6} rw, include if exists - } # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index b6a477707..0bedb90e1 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -21,7 +21,6 @@ profile signal-desktop @{exec_path} { include include include - include include include @@ -31,31 +30,19 @@ profile signal-desktop @{exec_path} { network inet6 stream, network netlink raw, + ptrace read peer=signal-desktop//&xdg-settings, + @{exec_path} mrix, - @{bin}/getconf rix, - @{open_path} rPx -> child-open-strict, + @{lib_dirs}/chrome_crashpad_handler rix, + @{lib_dirs}/chrome-sandbox rPx, #aa:stack X xdg-settings @{bin}/xdg-settings rPx -> signal-desktop//&xdg-settings, - - audit @{lib_dirs}/chrome-sandbox rPx, - @{lib_dirs}/chrome_crashpad_handler rix, + @{open_path} rPx -> child-open-strict, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, - @{sys}/fs/cgroup/user.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/memory.high r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/memory.max r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, - owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, - - @{PROC}/@{pid}/fd/ r, - @{PROC}/vmstat r, - - /dev/tty rw, - include if exists } diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat index 5764deb77..ccff2f95f 100644 --- a/apparmor.d/profiles-s-z/wechat +++ b/apparmor.d/profiles-s-z/wechat @@ -17,7 +17,6 @@ profile wechat @{exec_path} flags=(attach_disconnected) { include include include - include network netlink raw, network netlink dgram, diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage index e7eabe6ec..07f67fb59 100755 --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -17,7 +17,6 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) { include include include - include include network netlink raw, diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index 3824f9526..b1c8aded2 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -18,7 +18,6 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) { include include include - include network netlink raw, network netlink dgram, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 22e9a1447..a62a6847d 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -75,7 +75,7 @@ deb-systemd-invoke complain debconf-escape complain decibels complain dino attach_disconnected,complain -discord complain +discord attach_disconnected,complain discord-chrome-sandbox complain DiscoverNotifier complain dkms attach_disconnected,complain @@ -281,8 +281,6 @@ sddm attach_disconnected,mediate_deleted,complain sddm-greeter complain secure-time-sync attach_disconnected,complain sftp-server complain -signal-desktop attach_disconnected,complain -signal-desktop-chrome-sandbox complain sing-box complain slirp4netns attach_disconnected,complain snap complain From ba35a7933c9f5acceb37066d11be61eef4bf433b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 14 Aug 2025 15:41:53 +0200 Subject: [PATCH 1182/1455] fix(profile): comment problematic rule Fix #769 --- apparmor.d/groups/browsers/brave | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/browsers/brave b/apparmor.d/groups/browsers/brave index 0decb0d4b..4c38e0ce5 100644 --- a/apparmor.d/groups/browsers/brave +++ b/apparmor.d/groups/browsers/brave @@ -18,7 +18,7 @@ profile brave @{exec_path} flags=(attach_disconnected) { include include - unix (send, receive) type=stream peer=(label=brave//&brave-crashpad-handler), + # unix (send, receive) type=stream peer=(label=brave//&brave-crashpad-handler), signal receive peer=brave//&brave-crashpad-handler, From eda29668ae75d8b42412f35e3737230c6a626c09 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 14 Aug 2025 18:23:30 +0200 Subject: [PATCH 1183/1455] fix(profile): ensure signal-desktop has the attach_disconnected flag. Fix 812 --- apparmor.d/profiles-s-z/signal-desktop | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index 0bedb90e1..dc0bc381e 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -13,7 +13,7 @@ include @{cache_dirs} = @{user_cache_dirs}/@{name} @{exec_path} = @{lib_dirs}/@{name} -profile signal-desktop @{exec_path} { +profile signal-desktop @{exec_path} flags=(attach_disconnected) { include include include From 10e57f01a64eb821dcecc03a7298cf049454253e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:27:44 +0200 Subject: [PATCH 1184/1455] feat(abs): add /etc/xdg/menus and session files to kde-strict. See #811 --- apparmor.d/abstractions/desktop | 7 +++++++ apparmor.d/abstractions/kde-strict | 7 +++++++ apparmor.d/groups/browsers/firefox-kmozillahelper | 5 ----- apparmor.d/groups/kde/dolphin | 6 ------ 4 files changed, 14 insertions(+), 11 deletions(-) diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 73e533992..878f6f794 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -49,6 +49,8 @@ /etc/xdg/kcminputrc r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, + /etc/xdg/menus/ r, + /etc/xdg/menus/applications-merged/ r, owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -63,6 +65,11 @@ owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kwinrc r, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/session/ rw, + owner @{user_config_dirs}/session/@{profile_name}* rwlk, + owner @{user_config_dirs}/session/#@{int} rw, owner @{user_config_dirs}/trashrc r, # else if @{DE} == xfce diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 56aa88798..428aa93f3 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -25,6 +25,8 @@ /etc/xdg/kcminputrc r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, + /etc/xdg/menus/ r, + /etc/xdg/menus/applications-merged/ r, owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -39,6 +41,11 @@ owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kwinrc r, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/session/ rw, + owner @{user_config_dirs}/session/@{profile_name}* rwlk, + owner @{user_config_dirs}/session/#@{int} rw, owner @{user_config_dirs}/trashrc r, owner @{user_share_dirs}/#@{int} rw, diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper index 8e86ee126..ade169f25 100644 --- a/apparmor.d/groups/browsers/firefox-kmozillahelper +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -27,16 +27,11 @@ profile firefox-kmozillahelper @{exec_path} { /usr/share/kservices{5,6}/{,**} r, - /etc/xdg/menus/ r, - /etc/xdg/menus/applications-merged/ r, - owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r, owner @{user_config_dirs}/kmozillahelperrc r, owner @{user_config_dirs}/kmozillahelperrc.@{rand6} rwl, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_share_dirs}/kservices5/ r, owner @{user_share_dirs}/kservices5/searchproviders/ r, diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 5d51f8c4d..3879fa6a5 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -51,8 +51,6 @@ profile dolphin @{exec_path} { /etc/machine-id r, /etc/xdg/arkrc r, /etc/xdg/dolphinrc r, - /etc/xdg/menus/ r, - /etc/xdg/menus/applications-merged/ r, /etc/xdg/ui/ui_standards.rc r, # Full access to user's data @@ -89,10 +87,6 @@ profile dolphin @{exec_path} { owner @{user_config_dirs}/knfsshare.{,.@{rand6}} rwk, owner @{user_config_dirs}/knfsshare.lock rwk, - owner @{user_config_dirs}/session/ rw, - owner @{user_config_dirs}/session/#@{int} rw, - owner @{user_config_dirs}/session/dolphin_* rwlk -> @{user_config_dirs}/session/#@{int}, - owner @{user_cache_dirs}/ksplash/qmlcache/*.qmlc rwl -> @{user_cache_dirs}/dolphin/qmlcache/#@{int}, owner @{user_cache_dirs}/ksplash/qmlcache/*.qmlc.@{rand6} rwl -> @{user_cache_dirs}/dolphin/qmlcache/#@{int}, From e09586e01dd015c26462c410bc0caee9a00e8e8d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:30:43 +0200 Subject: [PATCH 1185/1455] feat(abs): freedesktop: add more path for recently-used files. see #811 --- apparmor.d/abstractions/freedesktop.org.d/complete | 5 +++++ apparmor.d/groups/gnome/gnome-tweaks | 1 - apparmor.d/groups/gnome/gsd-media-keys | 2 -- apparmor.d/groups/kde/dolphin | 1 - apparmor.d/groups/kde/kactivitymanagerd | 1 - apparmor.d/groups/kde/okular | 2 -- 6 files changed, 5 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/freedesktop.org.d/complete b/apparmor.d/abstractions/freedesktop.org.d/complete index 220883c29..df445cef5 100644 --- a/apparmor.d/abstractions/freedesktop.org.d/complete +++ b/apparmor.d/abstractions/freedesktop.org.d/complete @@ -23,4 +23,9 @@ owner @{HOME}/.icons/{,**} r, + owner @{user_share_dirs}/#@{int} rw, + owner @{user_share_dirs}/recently-used.xbel rw, + owner @{user_share_dirs}/recently-used.xbel.@{rand6} rwl, + owner @{user_share_dirs}/recently-used.xbel.lock rwk, + # vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-tweaks b/apparmor.d/groups/gnome/gnome-tweaks index 96e83b846..7f93b7864 100644 --- a/apparmor.d/groups/gnome/gnome-tweaks +++ b/apparmor.d/groups/gnome/gnome-tweaks @@ -36,7 +36,6 @@ profile gnome-tweaks @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/gtk-{3,4}.0/settings.ini* rw, owner @{user_share_dirs}/backgrounds/{,**} r, owner @{user_share_dirs}/gnome-shell/extensions/**/schemas/* r, - owner @{user_share_dirs}/recently-used.xbel* rw, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/c13:@{int} r, # for /dev/input/* diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 2a2ea034f..6cae2d49b 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -71,8 +71,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, - owner @{user_share_dirs}/recently-used.xbel{,.*} rw, - @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/udev/data/+sound:card@{int} r, # For sound card diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 3879fa6a5..2d3b099d7 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -74,7 +74,6 @@ profile dolphin @{exec_path} { owner @{user_share_dirs}/dolphin/ rw, owner @{user_share_dirs}/dolphin/** rwkl -> @{user_share_dirs}/dolphin/#@{int}, - owner @{user_share_dirs}/recently-used.xbel{,.*} rwlk, owner @{user_state_dirs}/dolphinstaterc{,.*} rwlk, owner @{user_config_dirs}/#@{int} rw, diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index fdc0730c4..1ee022dc6 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -38,7 +38,6 @@ profile kactivitymanagerd @{exec_path} { owner @{user_share_dirs}/kactivitymanagerd/{,**} rwlk, owner @{user_share_dirs}/kservices{5,6}/{,**} r, - owner @{user_share_dirs}/recently-used.xbel r, owner @{user_share_dirs}/user-places.xbel r, owner @{run}/user/@{uid}/#@{int} rw, diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index 7618a10d4..7cd628b09 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -69,8 +69,6 @@ profile okular @{exec_path} { owner @{user_share_dirs}/kxmlgui{5,6}/okular/{,*} r, owner @{user_share_dirs}/okular/ rw, owner @{user_share_dirs}/okular/** rwlk -> @{user_share_dirs}/okular/**, - owner @{user_share_dirs}/recently-used.xbel.@{rand6} rwl -> @{user_share_dirs}/#@{int}, - owner @{user_share_dirs}/recently-used.xbel.lock rk, owner @{user_share_dirs}/user-places.xbel r, owner @{user_state_dirs}/#@{int} rw, From c02674593d00754b54f3329d1ac75ab0c44af571 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:34:48 +0200 Subject: [PATCH 1186/1455] feat(profile): update kde profiles see #811 --- .../groups/freedesktop/xdg-desktop-portal-kde | 16 ++++++++++++++++ apparmor.d/groups/kde/kalendarac | 5 +++++ apparmor.d/groups/kde/kded | 1 + apparmor.d/groups/kde/kglobalacceld | 4 ---- apparmor.d/groups/kde/ksmserver | 3 --- apparmor.d/groups/kde/kwalletmanager | 3 --- apparmor.d/groups/kde/kwin_x11 | 5 +++-- apparmor.d/groups/kde/okular | 14 +++++--------- .../groups/kde/plasma-browser-integration-host | 6 ------ apparmor.d/groups/kde/plasma_session | 1 - apparmor.d/groups/kde/systemsettings | 3 --- apparmor.d/profiles-m-r/pinentry-qt | 2 ++ 12 files changed, 32 insertions(+), 31 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde index 8c1c1686f..bd5981dcf 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-kde @@ -11,6 +11,7 @@ include profile xdg-desktop-portal-kde @{exec_path} { include include + include include include include @@ -30,6 +31,12 @@ profile xdg-desktop-portal-kde @{exec_path} { #aa:exec kioworker /usr/share/plasma/look-and-feel/** r, + /usr/share/thumbnailers/{,**} r, + + /etc/fstab r, + /etc/xdg/dolphinrc r, + + / r, owner @{HOME}/ r, @@ -39,12 +46,21 @@ profile xdg-desktop-portal-kde @{exec_path} { owner @{user_config_dirs}/autostart/org.kde.*.desktop r, owner @{user_config_dirs}/breezerc r, + owner @{user_config_dirs}/kioslaverc r, + owner @{user_config_dirs}/kservicemenurc r, owner @{user_config_dirs}/xdg-desktop-portal-kderc{,.*} rwlk, + owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/xdg-desktop-portal-kdestaterc rw, + owner @{user_state_dirs}/xdg-desktop-portal-kdestaterc.@{rand6} rwlk, + owner @{user_state_dirs}/xdg-desktop-portal-kdestaterc.lock rwk, + + owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/xdg-desktop-portal-kde@{rand6}.*.socket rw, owner @{PROC}/@{pid}/mountinfo r, + /dev/shm/ r, /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index a45652c7b..e9ae78457 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -34,6 +34,11 @@ profile kalendarac @{exec_path} { owner @{user_config_dirs}/kalendaracrc.lock rwk, owner @{user_config_dirs}/kmail2rc r, + owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/kalendaracstaterc rw, + owner @{user_state_dirs}/kalendaracstaterc.@{rand6} rwl, + owner @{user_state_dirs}/kalendaracstaterc.lock rwk, + /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index c9fa538df..2ef26836d 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -84,6 +84,7 @@ profile kded @{exec_path} { /var/lib/dbus/machine-id r, / r, + @{efi}/ r, owner @{HOME}/ r, owner @{HOME}/.gtkrc-2.0 rw, diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index 9da19046d..0e8ba3395 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -18,15 +18,11 @@ profile kglobalacceld @{exec_path} { /usr/share/kglobalaccel/{,**} r, /etc/machine-id r, - /etc/xdg/menus/ r, - /etc/xdg/menus/applications-merged/ r, owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/kglobalshortcutsrc.lock rwk, owner @{user_config_dirs}/kglobalshortcutsrc* rwl, owner @{user_config_dirs}/khotkeysrc r, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, @{PROC}/sys/kernel/random/boot_id r, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index eb53bc078..6d515fb18 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -49,9 +49,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_config_dirs}/ksmserverrc rw, owner @{user_config_dirs}/ksmserverrc.@{rand6} rwl, owner @{user_config_dirs}/ksmserverrc.lock rwk, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, - owner @{user_config_dirs}/session/*_[0-9]*_[0-9]*_[0-9]* rw, owner @{user_share_dirs}/kservices{5,6}/ r, owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r, diff --git a/apparmor.d/groups/kde/kwalletmanager b/apparmor.d/groups/kde/kwalletmanager index dc64cbb9e..5ffcafd4f 100644 --- a/apparmor.d/groups/kde/kwalletmanager +++ b/apparmor.d/groups/kde/kwalletmanager @@ -36,9 +36,6 @@ profile kwalletmanager @{exec_path} { owner @{user_config_dirs}/kwalletrc rw, owner @{user_config_dirs}/kwalletrc.* rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/kwalletrc.lock rwk, - owner @{user_config_dirs}/session/#@{int} rw, - owner @{user_config_dirs}/session/kwalletmanager5_* rwl -> @{user_config_dirs}/session/#@{int}, - owner @{user_config_dirs}/session/kwalletmanager5_*.lock rwk, @{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index e05e443ff..8400c8cb6 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -25,10 +25,12 @@ profile kwin_x11 @{exec_path} { @{exec_path} mrix, @{sh_path} rix, + @{bin}/kdialog rix, @{lib}/kwin_killer_helper rix, #aa:exec drkonqi + /usr/share/kwin-x11/{,**} r, /usr/share/kwin/{,**} r, /usr/share/plasma/desktoptheme/{,**} r, @@ -47,6 +49,7 @@ profile kwin_x11 @{exec_path} { owner @{user_cache_dirs}/session/#@{int} rw, owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/kaccessrc r, owner @{user_config_dirs}/kdedefaults/plasmarc r, owner @{user_config_dirs}/kwinoutputconfig.json rw, owner @{user_config_dirs}/kwinrc.lock rwk, @@ -54,8 +57,6 @@ profile kwin_x11 @{exec_path} { owner @{user_config_dirs}/kwinrulesrc r, owner @{user_config_dirs}/kxkbrc r, owner @{user_config_dirs}/plasmarc r, - owner @{user_config_dirs}/session/#@{int} rw, - owner @{user_config_dirs}/session/kwin_* rwk, owner @{user_share_dirs}/kwin/scripts/ r, diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index 7cd628b09..acd9b7430 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -42,8 +42,6 @@ profile okular @{exec_path} { /etc/fstab r, /etc/xdg/dolphinrc r, - /etc/xdg/menus/ r, - /etc/xdg/menus/applications-merged/ r, / r, @{MOUNTS}/ r, @@ -51,19 +49,17 @@ profile okular @{exec_path} { owner @{user_cache_dirs}/okular/{,**} rw, owner @{user_config_dirs}/#@{int} rw, + owner @{user_config_dirs}/KDE/*.conf r, + owner @{user_config_dirs}/kioslaverc r, + owner @{user_config_dirs}/kservicemenurc r, + owner @{user_config_dirs}/kwalletrc r, + owner @{user_config_dirs}/okular-generator-popplerrc r, owner @{user_config_dirs}/okularpartrc rw, owner @{user_config_dirs}/okularpartrc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/okularpartrc.lock rwk, owner @{user_config_dirs}/okularrc rw, owner @{user_config_dirs}/okularrc.@{rand6} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/okularrc.lock rwk, - owner @{user_config_dirs}/okular-generator-popplerrc r, - owner @{user_config_dirs}/KDE/*.conf r, - owner @{user_config_dirs}/kioslaverc r, - owner @{user_config_dirs}/kservicemenurc r, - owner @{user_config_dirs}/kwalletrc r, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_share_dirs}/#@{int} rw, owner @{user_share_dirs}/kxmlgui{5,6}/okular/{,*} r, diff --git a/apparmor.d/groups/kde/plasma-browser-integration-host b/apparmor.d/groups/kde/plasma-browser-integration-host index dce3545f7..e17d4c5f1 100644 --- a/apparmor.d/groups/kde/plasma-browser-integration-host +++ b/apparmor.d/groups/kde/plasma-browser-integration-host @@ -21,16 +21,10 @@ profile plasma-browser-integration-host @{exec_path} { @{exec_path} mr, - /etc/xdg/menus/applications-merged/ r, - /usr/share/kservices{5,6}/{,**} r, - /etc/xdg/menus/ r, /etc/xdg/taskmanagerrulesrc r, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, - owner @{user_share_dirs}/kservices{5,6}/ r, owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r, diff --git a/apparmor.d/groups/kde/plasma_session b/apparmor.d/groups/kde/plasma_session index 1fbeda384..5d3812594 100644 --- a/apparmor.d/groups/kde/plasma_session +++ b/apparmor.d/groups/kde/plasma_session @@ -36,7 +36,6 @@ profile plasma_session @{exec_path} { /etc/xdg/autostart/ r, /etc/xdg/autostart/*.desktop r, - /etc/xdg/menus/ r, owner @{user_config_dirs}/kdedefaults/ksplashrc r, owner @{user_config_dirs}/plasma-welcomerc r, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index e68d248b6..b41dac08a 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -57,7 +57,6 @@ profile systemsettings @{exec_path} { /etc/fstab r, /etc/machine-id r, - /etc/xdg/menus/{,applications-merged/} r, /etc/xdg/plasmanotifyrc r, /etc/xdg/ui/ui_standards.rc r, /var/lib/dbus/machine-id r, @@ -90,8 +89,6 @@ profile systemsettings @{exec_path} { owner @{user_config_dirs}/kinfocenterrc* rwlk, owner @{user_config_dirs}/libaccounts-glib/ rw, owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_config_dirs}/session/ rw, owner @{user_config_dirs}/session/** rwlk, owner @{user_config_dirs}/systemsettingsrc.lock rwk, diff --git a/apparmor.d/profiles-m-r/pinentry-qt b/apparmor.d/profiles-m-r/pinentry-qt index 3c5ec0a94..66729769f 100644 --- a/apparmor.d/profiles-m-r/pinentry-qt +++ b/apparmor.d/profiles-m-r/pinentry-qt @@ -17,6 +17,8 @@ profile pinentry-qt @{exec_path} { include include + ptrace read peer=gpg-agent, + @{exec_path} mr, /etc/machine-id r, From ace53f3002531730a262245b27d62c16a65efc7c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:35:19 +0200 Subject: [PATCH 1187/1455] feat(profile): openvpn need to load module. See #811 --- apparmor.d/groups/network/openvpn | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index a6ff1a939..b5a6b83ef 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -27,17 +27,12 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { include include - # Needed to remove the following errors: - # ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1) - # Exiting due to fatal error - capability net_admin, - - # These are needed when user/group are set in a OpenVPN config file - capability setuid, - capability setgid, - - capability dac_read_search, capability dac_override, + capability dac_read_search, + capability net_admin, # create tun + capability setgid, # when user/group are set in a OpenVPN config file + capability setuid, + capability sys_module, network inet dgram, network inet6 dgram, From d51b386d13540c6ff55317cc588734451a6e0f4c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:36:05 +0200 Subject: [PATCH 1188/1455] feat(abs): pager: improve integration with opensuse. See #811 --- apparmor.d/abstractions/app/pager | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/abstractions/app/pager b/apparmor.d/abstractions/app/pager index 1557b78ef..30acc5612 100644 --- a/apparmor.d/abstractions/app/pager +++ b/apparmor.d/abstractions/app/pager @@ -21,6 +21,8 @@ /usr/share/file/misc/** r, /usr/share/nvim/{,**} r, + @{etc_ro}/lesskey.bin r, + @{HOME}/.lesshst r, owner @{HOME}/ r, From b1b3ee8321d2a269ef2e3e24ff8a367cbed46adc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:38:15 +0200 Subject: [PATCH 1189/1455] feat(abs): add tty/drivers to pgrrep/pkill subprofiles. see #811 --- apparmor.d/abstractions/app/pgrep | 1 + apparmor.d/groups/kde/kded | 2 -- apparmor.d/groups/procps/pgrep | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/app/pgrep b/apparmor.d/abstractions/app/pgrep index d6b7ba8a7..0ec14bea0 100644 --- a/apparmor.d/abstractions/app/pgrep +++ b/apparmor.d/abstractions/app/pgrep @@ -24,6 +24,7 @@ @{PROC}/@{pids}/environ r, @{PROC}/@{pids}/stat r, @{PROC}/sys/kernel/osrelease r, + @{PROC}/tty/drivers r, @{PROC}/uptime r, include if exists diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 2ef26836d..ef81b95d1 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -160,8 +160,6 @@ profile kded @{exec_path} { include include - @{PROC}/tty/drivers r, - include if exists } diff --git a/apparmor.d/groups/procps/pgrep b/apparmor.d/groups/procps/pgrep index 950aeb99e..489f55bd7 100644 --- a/apparmor.d/groups/procps/pgrep +++ b/apparmor.d/groups/procps/pgrep @@ -14,8 +14,6 @@ profile pgrep @{exec_path} { @{exec_path} mr, - @{PROC}/tty/drivers r, - include if exists } From e15bd7bea03e25b4b27423a3e36e3530be89f21d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:40:17 +0200 Subject: [PATCH 1190/1455] feat(abs): improve vim integration with common editors. see #811 --- apparmor.d/abstractions/app/editor | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor index 2bd14077b..b33dbc7f4 100644 --- a/apparmor.d/abstractions/app/editor +++ b/apparmor.d/abstractions/app/editor @@ -12,9 +12,10 @@ @{sh_path} rix, @{bin}/nvim mrix, @{bin}/sensible-editor mr, - @{bin}/vim{,.*} mrix, + @{bin}/vim* mrix, @{bin}/which{,.debianutils} rix, + /usr/share/doc/{,**} r, /usr/share/nvim/{,**} r, /usr/share/terminfo/** r, /usr/share/vim/{,**} r, @@ -24,8 +25,9 @@ /etc/xdg/nvim/* r, owner @{HOME}/.selected_editor r, - owner @{HOME}/.viminf@{c}{,.tmp} rw, owner @{HOME}/.vim/{after/,}spell/{,**} rw, + owner @{HOME}/.vim/** r, + owner @{HOME}/.viminf@{c}{,.tmp} rw, owner @{HOME}/.vimrc r, owner @{HOME}/ r, From e2b1547bf11bf305b49881fa12fa0688fb5d88db Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:41:26 +0200 Subject: [PATCH 1191/1455] feat(profile): ssh: add ssh.hmac Similar to newest version of sshd with sshd.hmac see #811 --- apparmor.d/groups/ssh/ssh | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 43fbddc63..75a25771f 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -26,6 +26,7 @@ profile ssh @{exec_path} { @{exec_path} mrix, @{bin}/@{shells} rUx, + @{bin}/ssh.hmac r, @{lib}/{,ssh/}ssh-sk-helper rix, From 44a6bc86e6cf25b344d76ab36a345d1181aaab20 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:43:15 +0200 Subject: [PATCH 1192/1455] feat(tunable): add `bin` to XDG_BIN_DIR. So it can get allowed/denied by profile using user_bin_dirs. see #811 --- apparmor.d/tunables/home.d/apparmor.d | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index c791f5376..398fe20f4 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -16,7 +16,7 @@ @{XDG_CONFIG_DIR}=".config" @{XDG_DATA_DIR}=".local/share" @{XDG_STATE_DIR}=".local/state" -@{XDG_BIN_DIR}=".local/bin" +@{XDG_BIN_DIR}="bin" ".local/bin" @{XDG_LIB_DIR}=".local/lib" # Define extended user directories not defined in the XDG standard but commonly From b90a2a89fe095d3de5be2d139eeaaaa1065815be Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:44:10 +0200 Subject: [PATCH 1193/1455] feat(abs): app-open: kde opener need system id. see #811 --- apparmor.d/abstractions/app/open | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index 9d0da2199..243d18261 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -33,8 +33,7 @@ include include include - - /etc/xdg/menus/ r, + include owner @{run}/user/@{uid}/#@{int} rw, owner @{run}/user/@{uid}/kioclient@{rand6}.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int}, From d09f5d055f5f0d91e7dc1e64dda621e62aea4a1e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:51:16 +0200 Subject: [PATCH 1194/1455] feat(profile): improve dbus definitions. --- .../bus/org.freedesktop.ScreenSaver | 5 +++++ .../bus/org.freedesktop.portal.Desktop | 5 +++++ .../abstractions/bus/org.freedesktop.systemd1 | 2 +- .../gnome/evolution-addressbook-factory | 1 + .../groups/gnome/gnome-extension-gsconnect | 4 +++- apparmor.d/groups/gnome/gnome-shell | 1 + apparmor.d/groups/network/NetworkManager | 20 +++++-------------- apparmor.d/groups/systemd/resolvectl | 1 + apparmor.d/profiles-s-z/spotify | 1 + apparmor.d/profiles-s-z/terminator | 5 +++++ 10 files changed, 28 insertions(+), 17 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver b/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver index 43ed93af6..f73768e9f 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver +++ b/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver @@ -9,6 +9,11 @@ member={Inhibit,UnInhibit} peer=(name=org.freedesktop.ScreenSaver), + dbus receive bus=session path=/org/gnome/ScreenSaver + interface=org.gnome.ScreenSaver + member={ActiveChanged,WakeUpScreen} + peer=(name=@{busname}, label=gjs-console), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop index 5e5967a1a..2753a6602 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop +++ b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop @@ -36,6 +36,11 @@ member=Register peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal), + dbus receive bus=session path=/org/freedesktop/portal/desktop/** + interface=org.freedesktop.portal.Request + member=Response + peer=(name=@{busname}, label=xdg-desktop-portal), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 index 4fb1764bc..167e66d65 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.systemd1 @@ -6,7 +6,7 @@ #aa:dbus common bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" - dbus send bus=session path=/org/freedesktop/systemd1 + dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member={GetUnit,GetUnitByPIDFD,StartUnit,StartTransientUnit} peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index 9f18395f2..3d83232e1 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -26,6 +26,7 @@ profile evolution-addressbook-factory @{exec_path} { network netlink raw, #aa:dbus own bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} + #aa:dbus own bus=session name=org.gnome.evolution.dataserver.AddressBookFactory dbus (send, receive) bus=session path=/org/gnome/evolution/dataserver/** interface=org.gnome.evolution.dataserver.* diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 3cf92d613..64568eab0 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -17,6 +17,7 @@ profile gnome-extension-gsconnect @{exec_path} { include include include + include include include include @@ -36,9 +37,10 @@ profile gnome-extension-gsconnect @{exec_path} { network inet6 stream, network netlink raw, - #aa:dbus own bus=session name=org.gnome.Shell.Extensions.GSConnect + #aa:dbus own bus=session name=org.gnome.Shell.Extensions.GSConnect interface+=org.gtk.{Actions,Menus} dbus eavesdrop bus=session, + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index d4c8b1ba2..95874290f 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -18,6 +18,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include include diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index f7c0dd084..01de67a18 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -50,22 +50,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/nm_dispatcher interface=org.freedesktop.nm_dispatcher + member=Action peer=(name=org.freedesktop.nm_dispatcher), - - dbus receive bus=system path=/org/freedesktop - interface=org.freedesktop.DBus.ObjectManager - member=GetManagedObjects - peer=(name=:*), - - dbus receive bus=system path=/ - interface=org.freedesktop.DBus.ObjectManager - member=InterfacesRemoved - peer=(name=:*, label="@{p_bluetoothd}"), - - dbus send bus=system path=/ - interface=org.freedesktop.DBus.ObjectManager - member=GetManagedObjects - peer=(name=:*, label="@{p_bluetoothd}"), + dbus send bus=system path=/uk/org/thekelleys/dnsmasq + interface=org.freedesktop.NetworkManager.dnsmasq + member=SetServersEx + peer=(name=@{busname}, label=dnsmasq), dbus send bus=system path=/org/freedesktop interface=org.freedesktop.DBus.ObjectManager diff --git a/apparmor.d/groups/systemd/resolvectl b/apparmor.d/groups/systemd/resolvectl index dd5bdb3d4..58f2d88f8 100644 --- a/apparmor.d/groups/systemd/resolvectl +++ b/apparmor.d/groups/systemd/resolvectl @@ -22,6 +22,7 @@ profile resolvectl @{exec_path} flags=(attach_disconnected) { signal send set=cont peer=child-pager, #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" + #aa:dbus talk bus=system name=org.freedesktop.network1 label="@{p_systemd_networkd}" @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 1ec4eeea3..a3a093c85 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -35,6 +35,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.mpris.MediaPlayer2.spotify #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell + #aa:dbus talk bus=session name=org.freedesktop.portal.{d,D}esktop label=xdg-desktop-portal @{exec_path} mrix, diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index d71ccf802..59c78396d 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -29,6 +29,11 @@ profile terminator @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=net.tenshu.Terminator@{hex} + dbus send bus=session path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=StartTransientUnit + peer=(name=org.freedesktop.systemd1, label="@{p_systemd_user}"), + @{exec_path} mr, @{bin}/ r, From 20546d37a0f7aa3bb26c01659e64187a8bf22f49 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:51:48 +0200 Subject: [PATCH 1195/1455] feat(profile): fprintd needs sys_admin see #811 --- apparmor.d/profiles-a-f/fprintd | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-a-f/fprintd b/apparmor.d/profiles-a-f/fprintd index 1d00dce88..8a5f9c01a 100644 --- a/apparmor.d/profiles-a-f/fprintd +++ b/apparmor.d/profiles-a-f/fprintd @@ -15,6 +15,7 @@ profile fprintd @{exec_path} flags=(attach_disconnected) { include capability net_admin, + capability sys_admin, capability sys_nice, network netlink raw, From 112d54907ec106665dbd3e9660b43e132879add9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:53:52 +0200 Subject: [PATCH 1196/1455] feat(profile): thunderbird/firefox: move rules needed in both programs. --- apparmor.d/abstractions/app/firefox | 3 +++ apparmor.d/groups/browsers/firefox | 3 --- apparmor.d/profiles-s-z/thunderbird-glxtest | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 85922664b..68fb14887 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -100,6 +100,9 @@ owner @{tmp}/@{name}/* rwk, owner @{tmp}/firefox/ rw, owner @{tmp}/firefox/* rwk, + owner @{tmp}/mozilla* rw, + owner @{tmp}/mozilla*/ rw, + owner @{tmp}/mozilla*/* rwk, owner @{tmp}/remote-settings-startup-bundle- rw, owner @{tmp}/remote-settings-startup-bundle-.tmp rw, owner @{tmp}/Temp-@{uuid}/ rw, diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index fe8507219..bac81c847 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -64,9 +64,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) { owner @{tmp}/@{rand8}.* rw, # file downloads (to anywhere) owner @{tmp}/@{uuid}.zip{,.tmp} rw, owner @{tmp}/Mozilla@{uuid}-cachePurge-{@{hex15},@{hex16}} rwk, - owner @{tmp}/mozilla* rw, - owner @{tmp}/mozilla*/ rw, - owner @{tmp}/mozilla*/* rwk, owner @{tmp}/Mozilla\{@{uuid}\}-cachePurge-{@{hex15},@{hex16}} rwk, owner @{tmp}/MozillaBackgroundTask-{@{hex15},@{hex16}}-removeDirectory/.parentlock k, owner @{tmp}/MozillaBackgroundTask-{@{hex15},@{hex16}}-removeDirectory/{**,} rw, diff --git a/apparmor.d/profiles-s-z/thunderbird-glxtest b/apparmor.d/profiles-s-z/thunderbird-glxtest index 4f25e0862..4dc891361 100644 --- a/apparmor.d/profiles-s-z/thunderbird-glxtest +++ b/apparmor.d/profiles-s-z/thunderbird-glxtest @@ -11,7 +11,7 @@ include @{config_dirs} = @{HOME}/.@{name}/ @{exec_path} = @{lib_dirs}/glxtest -profile thunderbird-glxtest @{exec_path} { +profile thunderbird-glxtest @{exec_path} flags=(attach_disconnected) { include include include From 9c9af1d821a7eb85547484ce4563cce0d7909743 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 10:59:20 +0200 Subject: [PATCH 1197/1455] feat(profile): improve integration with ubuntu. --- apparmor.d/groups/gpg/gpg | 1 + apparmor.d/groups/grub/grub-mkconfig | 2 +- apparmor.d/groups/grub/grub-probe | 2 ++ apparmor.d/groups/network/NetworkManager | 1 + apparmor.d/profiles-a-f/blkdeactivate | 2 +- apparmor.d/profiles-m-r/initramfs-hooks | 5 +++++ 6 files changed, 11 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 6a01796ff..b65823520 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -29,6 +29,7 @@ profile gpg @{exec_path} { @{lib}/{,gnupg/}scdaemon rPx, /usr/share/terminfo/** r, + /usr/share/keyrings/** rw, #aa:only apt /usr/share/pacman/keyrings/** r, #aa:only pacman /etc/inputrc r, diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig index c081d53c3..5b62fa30c 100644 --- a/apparmor.d/groups/grub/grub-mkconfig +++ b/apparmor.d/groups/grub/grub-mkconfig @@ -27,7 +27,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { @{bin}/cut rix, @{bin}/date rix, @{bin}/dirname rix, - @{sbin}/dmsetup rPUx, + @{sbin}/dmsetup rPx, @{bin}/dpkg rPx, @{bin}/find rix, @{bin}/findmnt rPx, diff --git a/apparmor.d/groups/grub/grub-probe b/apparmor.d/groups/grub/grub-probe index 017083eaf..c767d2f02 100644 --- a/apparmor.d/groups/grub/grub-probe +++ b/apparmor.d/groups/grub/grub-probe @@ -36,6 +36,8 @@ profile grub-probe @{exec_path} { /dev/**/ r, /dev/mapper/control w, + deny mqueue (read, getattr) type=posix /, + include if exists } diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 01de67a18..6b444093c 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -71,6 +71,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{bin}/kmod rPx, @{bin}/netconfig rPUx, @{sbin}/resolvconf rPx, + @{bin}/resolvectl rPx, @{bin}/systemctl rCx -> systemctl, @{lib}/{,NetworkManager/}nm-daemon-helper rPx, @{lib}/{,NetworkManager/}nm-dhcp-helper rPx, diff --git a/apparmor.d/profiles-a-f/blkdeactivate b/apparmor.d/profiles-a-f/blkdeactivate index 83806e753..bff816339 100644 --- a/apparmor.d/profiles-a-f/blkdeactivate +++ b/apparmor.d/profiles-a-f/blkdeactivate @@ -15,7 +15,7 @@ profile blkdeactivate @{exec_path} flags=(complain) { @{exec_path} rm, @{sh_path} rix, - @{sbin}/dmsetup rPUx, + @{sbin}/dmsetup rPx, @{bin}/{,e}grep rix, @{bin}/touch rix, @{bin}/lsblk rPx, diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index 14a83ffbb..a4fc278f0 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -16,6 +16,8 @@ profile initramfs-hooks @{exec_path} { @{sh_path} rix, @{coreutils_path} rix, + @{bin}/cpio ix, + @{bin}/dpkg Cx -> child-dpkg, @{bin}/fc-cache ix, @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, @@ -25,6 +27,9 @@ profile initramfs-hooks @{exec_path} { @{lib}/initramfs-tools/bin/busybox ix, @{lib}/klibc/bin/fstype ix, @{sbin}/blkid Px, + @{sbin}/cryptsetup PUx, + @{sbin}/dmsetup Px, + @{sbin}/iucode_tool ix, /usr/share/mdadm/mkconf Px, @{bin}/* mr, From 5f368403b343df0dd3d23d10a2b58896c6b7c2f9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 11:27:34 +0200 Subject: [PATCH 1198/1455] Revert "feat(tunable): add `bin` to XDG_BIN_DIR." This reverts commit 44a6bc86e6cf25b344d76ab36a345d1181aaab20. --- apparmor.d/tunables/home.d/apparmor.d | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index 398fe20f4..c791f5376 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -16,7 +16,7 @@ @{XDG_CONFIG_DIR}=".config" @{XDG_DATA_DIR}=".local/share" @{XDG_STATE_DIR}=".local/state" -@{XDG_BIN_DIR}="bin" ".local/bin" +@{XDG_BIN_DIR}=".local/bin" @{XDG_LIB_DIR}=".local/lib" # Define extended user directories not defined in the XDG standard but commonly From 753d36cfa337a37a3aead1cf1e9781553a5cbd22 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 11:29:54 +0200 Subject: [PATCH 1199/1455] fix(profile): manually deny path in git Needed as 44a6bc86e6cf25b344d76ab36a345d1181aaab20 raise merged rule with conflicting x modifiers errors. --- apparmor.d/profiles-g-l/git | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 425fe2f14..0538f5da0 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -38,6 +38,7 @@ profile git @{exec_path} flags=(attach_disconnected) { deny /usr/local/games/ r, deny /var/lib/flatpak/exports/bin/ r, deny owner @{HOME}/.go/bin/ r, + deny owner @{HOME}/bin/ r, deny owner @{user_bin_dirs}/ r, # These are needed for "git submodule update" From 7d49a1628e1c67457780d8f5b372bc804d021917 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 11:32:27 +0200 Subject: [PATCH 1200/1455] fix(abs): avahi socket path. --- apparmor.d/abstractions/common/app | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 74c82f92a..3029fb80b 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -67,7 +67,7 @@ @{att}/@{run}/systemd/inhibit/@{int}.ref rw, - @{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket. + @{run}/avahi-daemon/socket rw, # Allow access to avahi-daemon socket. @{run}/host/{,**} r, @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket. @{run}/utmp rk, From 6739b238cef5bf052371ad4fe67f31c65dd107f2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 11:33:29 +0200 Subject: [PATCH 1201/1455] feat(abs): base-strict: allow communication to children and stacked profiles. --- apparmor.d/abstractions/base-strict | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/base-strict b/apparmor.d/abstractions/base-strict index 818a4937f..22ca5ec5e 100644 --- a/apparmor.d/abstractions/base-strict +++ b/apparmor.d/abstractions/base-strict @@ -67,8 +67,9 @@ # Allow unconfined processes to us via unix sockets unix receive peer=(label=unconfined), - # Allow communication to children profiles + # Allow communication to children and stacked profiles signal peer=@{profile_name}//*, + signal peer=@{profile_name}//&*, unix type=stream peer=(label=@{profile_name}//*), # Allow us to create abstract and anonymous sockets From 3d329fdef8801c3fc892e33fa3876bf96ed37d70 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 11:39:35 +0200 Subject: [PATCH 1202/1455] feat(profile): minor profiles improvement. --- apparmor.d/groups/freedesktop/colord | 4 +++- apparmor.d/groups/freedesktop/pipewire | 2 ++ apparmor.d/groups/kde/kscreenlocker_greet | 2 ++ apparmor.d/groups/ssh/sshd-session | 1 + apparmor.d/groups/systemd/systemd-delta | 4 ++-- apparmor.d/groups/systemd/systemd-detect-virt | 7 +++++++ apparmor.d/profiles-a-f/cheese | 6 +++++- 7 files changed, 22 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index ee2cdf42e..81d0c9f6b 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -59,7 +59,9 @@ profile colord @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/{vendor,model,type} r, @{sys}/devices/@{pci}/drm/card@{int}/**/{enabled,edid} r, @{sys}/devices/@{pci}/uevent r, - @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/product_version r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, @{PROC}/sys/dev/parport/ r, @{PROC}/sys/dev/parport/parport@{int}/base-addr r, diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index ad4eb57c5..97e3c6119 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -47,6 +47,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { owner @{tmp}/librnnoise-@{int}.so rm, + @{run}/snapd.socket rw, owner @{run}/user/@{uid}/pipewire-@{int} rw, owner @{run}/user/@{uid}/pipewire-@{int}-manager.lock rwk, owner @{run}/user/@{uid}/pipewire-@{int}.lock rwk, @@ -62,6 +63,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name,bios_vendor,board_vendor} r, @{sys}/module/apparmor/parameters/enabled r, + owner @{PROC}/@{pid}/attr/apparmor/current r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/media@{int} rw, diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index dd3a6b42b..ddd14b5c2 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -25,6 +25,8 @@ profile kscreenlocker_greet @{exec_path} { network netlink raw, + ptrace read peer=ksmserver, + signal (receive) set=(term) peer=kwin_wayland, signal (receive) set=(usr1, term) peer=ksmserver, signal (send) peer=kcheckpass, diff --git a/apparmor.d/groups/ssh/sshd-session b/apparmor.d/groups/ssh/sshd-session index 5f09af5cc..e953834a7 100644 --- a/apparmor.d/groups/ssh/sshd-session +++ b/apparmor.d/groups/ssh/sshd-session @@ -74,6 +74,7 @@ profile sshd-session @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/sessions/@{int}.ref w, + @{run}/cockpit/active.issue r, @{run}/motd.d/{,*} r, @{run}/motd.dynamic rw, @{run}/motd.dynamic.new rw, diff --git a/apparmor.d/groups/systemd/systemd-delta b/apparmor.d/groups/systemd/systemd-delta index 7cf546a56..311636d95 100644 --- a/apparmor.d/groups/systemd/systemd-delta +++ b/apparmor.d/groups/systemd/systemd-delta @@ -10,11 +10,11 @@ include profile systemd-delta @{exec_path} { include - signal (send) peer=child-pager, + signal send peer=child-pager, @{exec_path} mr, - @{bin}/less rPx -> child-pager, + @{pager_path} rPx -> child-pager, /etc/binfmt.d/{,**} r, /etc/modprobe.d/{,**} r, diff --git a/apparmor.d/groups/systemd/systemd-detect-virt b/apparmor.d/groups/systemd/systemd-detect-virt index 35f4afbc4..01e49025f 100644 --- a/apparmor.d/groups/systemd/systemd-detect-virt +++ b/apparmor.d/groups/systemd/systemd-detect-virt @@ -21,6 +21,7 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) { @{run}/cloud-init/ds-identify.log w, @{run}/host/container-manager r, + @{run}/systemd/container r, @{run}/systemd/notify w, @{sys}/devices/virtual/dmi/id/bios_vendor r, @@ -29,6 +30,12 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/dmi/id/product_version r, @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/firmware/dmi/entries/*/raw r, + @{sys}/firmware/uv/prot_virt_guest r, + @{sys}/hypervisor/properties/features r, + + @{PROC}/xen/capabilities r, + + /dev/cpu/@{int}/msr r, include if exists } diff --git a/apparmor.d/profiles-a-f/cheese b/apparmor.d/profiles-a-f/cheese index b308439c3..b89fa42f2 100644 --- a/apparmor.d/profiles-a-f/cheese +++ b/apparmor.d/profiles-a-f/cheese @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2025 Roman Beslik +# Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -41,7 +42,10 @@ profile cheese @{exec_path} { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - @{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,product_name,sys_vendor} r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, From aafcd1c861c4ea9afdf0bc535b2bc10e50fa81ef Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 17:21:24 +0200 Subject: [PATCH 1203/1455] feat(profile): simplify ssh home path. --- apparmor.d/groups/ssh/ssh | 4 +--- apparmor.d/groups/ssh/ssh-keygen | 8 ++++---- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 75a25771f..03236196c 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -36,9 +36,7 @@ profile ssh @{exec_path} { @{etc_ro}/ssh/sshd_config.d/{,*} r, /etc/machine-id r, - owner @{HOME}/@{XDG_SSH_DIR}/ r, - owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r, - owner @{HOME}/@{XDG_SSH_DIR}/config r, + owner @{HOME}/@{XDG_SSH_DIR}/{,*} r, owner @{HOME}/@{XDG_SSH_DIR}/known_hosts{,.*} rwl, owner @{HOME}/@{XDG_SSH_DIR}/ssh_control_*_*_* wl, diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index 397ffdcd6..b55824e58 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -15,13 +15,13 @@ profile ssh-keygen @{exec_path} { @{exec_path} mr, + /etc/ssh/moduli rw, /etc/ssh/ssh_host_*_key* rw, - owner @{HOME}/@{XDG_SSH_DIR}/ w, - owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw, + owner @{HOME}/@{XDG_SSH_DIR}/{,*} rw, - /tmp/snapd@{int}/*_*{,.pub} w, - /tmp/snapd@{int}/*.key{,.pub} w, + owner /tmp/snapd@{int}/*_*{,.pub} w, + owner /tmp/snapd@{int}/*.key{,.pub} w, /dev/tty@{int} rw, /dev/ttyS@{int} rw, From c29b4ba536ba0b625955d85f912ece0ef12f2318 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 18:03:36 +0200 Subject: [PATCH 1204/1455] feat(profile): various security/linter improvement - Ignore some rule from the linter - Move some bin to subprofile --- apparmor.d/groups/apt/dpkg-scripts | 1 + apparmor.d/groups/apt/reportbug | 2 +- apparmor.d/groups/pacman/pacdiff | 6 +----- apparmor.d/profiles-a-f/baobab | 1 + apparmor.d/profiles-a-f/file-roller | 1 + apparmor.d/profiles-m-r/mimetype | 6 +++--- apparmor.d/profiles-s-z/tomb | 2 +- apparmor.d/profiles-s-z/xarchiver | 11 ++++------- tests/check.sh | 5 ++++- tests/sbin.list | 1 + 10 files changed, 18 insertions(+), 18 deletions(-) diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index da5da33a1..9be1f3258 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -48,6 +48,7 @@ profile dpkg-scripts @{exec_path} { @{sbin}/ldconfig.real Cx -> ldconfig, @{sbin}/update-rc.d Cx -> rc, + #aa:lint ignore=too-wide # Maintainer scripts can legitimately start/restart anything # PU is only used as a safety fallback. @{bin}/** PUx, diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index e58c9d8b3..a814eaaa9 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -61,8 +61,8 @@ profile reportbug @{exec_path} { /usr/share/bug/*/{control,presubj} r, + #aa:lint ignore=too-wide /etc/** r, - /etc/reportbug.conf r, owner @{HOME}/ r, # For shell pwd owner @{HOME}/.reportbugrc{,~} rw, diff --git a/apparmor.d/groups/pacman/pacdiff b/apparmor.d/groups/pacman/pacdiff index 497386125..cab9eed4b 100644 --- a/apparmor.d/groups/pacman/pacdiff +++ b/apparmor.d/groups/pacman/pacdiff @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/pacdiff profile pacdiff @{exec_path} flags=(attach_disconnected) { include + include capability dac_read_search, capability mknod, @@ -30,11 +31,6 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) { @{bin}/rm rix, @{bin}/sed rix, @{bin}/tput rix, - @{bin}/vim rix, - - owner @{HOME}/.viminfo{,.tmp} rw, - - owner @{user_cache_dirs}/vim/{,**} rw, # packages files / r, diff --git a/apparmor.d/profiles-a-f/baobab b/apparmor.d/profiles-a-f/baobab index cd1e7563f..654e40117 100644 --- a/apparmor.d/profiles-a-f/baobab +++ b/apparmor.d/profiles-a-f/baobab @@ -19,6 +19,7 @@ profile baobab @{exec_path} { @{open_path} rPx -> child-open-help, + #aa:lint ignore=too-wide # As a directory tree analyzer it needs full access to the filesystem / r, /** r, diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index e7bfafaac..5ec394807 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -28,6 +28,7 @@ profile file-roller @{exec_path} { # Archivers @{archive_path} rix, + #aa:lint ignore=too-wide # Full access to user's data @{MOUNTS}/** rw, owner @{HOME}/** rw, diff --git a/apparmor.d/profiles-m-r/mimetype b/apparmor.d/profiles-m-r/mimetype index cf8431c7a..91d021fae 100644 --- a/apparmor.d/profiles-m-r/mimetype +++ b/apparmor.d/profiles-m-r/mimetype @@ -19,14 +19,14 @@ profile mimetype @{exec_path} { /usr/share/mime/aliases r, /usr/share/mime/magic r, + # To read files + owner /** r, #aa:lint ignore=too-wide + owner @{user_share_dirs}/mime/**.xml r, owner @{user_share_dirs}/mime/globs r, owner @{user_share_dirs}/mime/aliases r, owner @{user_share_dirs}/mime/magic r, - # To read files - /** r, - include if exists } diff --git a/apparmor.d/profiles-s-z/tomb b/apparmor.d/profiles-s-z/tomb index 93e29bcfa..9b0912bd9 100644 --- a/apparmor.d/profiles-s-z/tomb +++ b/apparmor.d/profiles-s-z/tomb @@ -67,7 +67,7 @@ profile tomb @{exec_path} { @{sbin}/btrfs rPx, @{sbin}/cryptsetup rPUx, - @{bin}/e2fsc rPUx, + @{sbin}/e2fsck rPx, @{sbin}/fsck rPx, @{bin}/gpg{,2} rPx, @{bin}/lsblk rPx, diff --git a/apparmor.d/profiles-s-z/xarchiver b/apparmor.d/profiles-s-z/xarchiver index f38a69224..4d2766101 100644 --- a/apparmor.d/profiles-s-z/xarchiver +++ b/apparmor.d/profiles-s-z/xarchiver @@ -40,13 +40,10 @@ profile xarchiver @{exec_path} { owner @{HOME}/.bz2 rw, - / r, - /home/ r, - #owner @{HOME}/ r, - #owner @{HOME}/** rw, - @{MOUNTS}/ r, - @{MOUNTS}/** rw, - /tmp/ r, + #aa:lint ignore=too-wide + # Full access to user's data + @{MOUNTS}/** rw, + owner @{HOME}/** rw, owner @{tmp}/** rw, @{PROC}/@{pid}/mountinfo r, diff --git a/tests/check.sh b/tests/check.sh index 9bafd5104..60e23c694 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -171,6 +171,9 @@ _check_abstractions() { _err abstractions "$file:$line_number" "deprecated abstraction '<$ABS/$absname>', use '<$ABS/${ABS_DEPRECATED[$absname]}>' instead" fi done + if [[ "$line" == *"<$ABS/ubuntu-"*">"* ]]; then + _err abstractions "$file:$line_number" "deprecated, ubuntu only abstraction '<$ABS/$absname>'" + fi } readonly DIRECTORIES=('@{HOME}' '@{MOUNTS}' '@{bin}' '@{sbin}' '@{lib}' '@{tmp}' '_dirs}' '_DIR}') @@ -222,7 +225,7 @@ readonly TRANSITION_MUST_PC=( # Must transition to 'Px' ischroot who ) readonly TRANSITION_MUST_C=( # Must transition to 'Cx' - sysctl kmod pgrep pkexec sudo systemctl udevadm + sysctl kmod pgrep pkill pkexec sudo systemctl udevadm fusermount fusermount3 fusermount{,3} nvim vim sensible-editor ) diff --git a/tests/sbin.list b/tests/sbin.list index 8ee14fd21..16073f0d2 100644 --- a/tests/sbin.list +++ b/tests/sbin.list @@ -761,6 +761,7 @@ ugc umount.nfs umount.nfs4 umount.udisks2 +unbound unconfined undump.bt unix_chkpwd From c51943934ed4a99105a75eda382a5df6959ad6b4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 18:04:35 +0200 Subject: [PATCH 1205/1455] feat(tunable): add x64 to @{arch} --- apparmor.d/tunables/multiarch.d/system | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 359d1b878..0eae0fde3 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -20,6 +20,7 @@ @{lib}=/{,usr/}lib{,exec,32,64} # Common places for temporary files +# /tmp/user/@{uid}/ is needed when using .... (default on Debian) @{tmp}=/tmp/ /tmp/user/@{uid}/ # Common places for EFI @@ -29,7 +30,7 @@ # ---------------- # Common architecture names -@{arch}=x86_64 amd64 i386 i686 +@{arch}=x86_64 x64 amd64 i386 i686 # Dbus unique name @{busname}=:1.@{u16} :not.active.yet From 483c0c107d611502578e12d9355004644f715e0f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 18:22:07 +0200 Subject: [PATCH 1206/1455] build: enable re-attach disconnected path by default Ignored on Ubuntu 25.04 and abi3.0 --- apparmor.d/tunables/multiarch.d/system | 5 ++-- pkg/prebuild/cli/cli.go | 11 +++++++- pkg/prebuild/prepare/attach.go | 37 ++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 3 deletions(-) create mode 100644 pkg/prebuild/prepare/attach.go diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 0eae0fde3..06cb42000 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -69,8 +69,9 @@ @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 -# Attachment path for attach_disconnected.path flag. -# Automatically generated and set in profile preamble on ABI4. Disabled on ABI3. +# Default attachment path when re-attached path disconnected path is ignored. +# Disabled on abi3 and Ubuntu 25.04+ +# See https://apparmor.pujol.io/development/internal/#re-attached-path @{att}=/ alias // -> /, diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 000aa65f9..237b0f0f8 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -108,7 +108,16 @@ func Configure() { case 3: builder.Register("abi3") // Convert all profiles from abi 4.0 to abi 3.0 case 4: - // builder.Register("attach") // Re-attach disconnected path + // Re-attach disconnected path, ignored on ubuntu 25.04+ due to a memory leak + // that fully prevent profiles compilation with re-attached paths. + // See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2098730 + if prebuild.Distribution != "ubuntu" { + builder.Register("attach") + prepare.Register("attach") + } else if prebuild.Release["VERSION_CODENAME"] == "noble" { + builder.Register("attach") + prepare.Register("attach") + } default: logging.Fatal("Invalid ABI version: %d", prebuild.ABI) } diff --git a/pkg/prebuild/prepare/attach.go b/pkg/prebuild/prepare/attach.go new file mode 100644 index 000000000..a87ff9071 --- /dev/null +++ b/pkg/prebuild/prepare/attach.go @@ -0,0 +1,37 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2021-2025 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package prepare + +import ( + "strings" + + "github.com/roddhjav/apparmor.d/pkg/prebuild" +) + +type ReAttach struct { + prebuild.Base +} + +func init() { + RegisterTask(&ReAttach{ + Base: prebuild.Base{ + Keyword: "attach", + Msg: "Configure tunable for re-attached path", + }, + }) +} + +func (p ReAttach) Apply() ([]string, error) { + res := []string{} + + // Remove the @{att} tunable that is going to be defined in profile header + path := prebuild.RootApparmord.Join("tunables/multiarch.d/system") + out, err := path.ReadFileAsString() + if err != nil { + return res, err + } + out = strings.ReplaceAll(out, "@{att}=/", "# @{att}=/") + return res, path.WriteFile([]byte(out)) +} From b0c661931af5b376f79d1dadff684e3d165b4f64 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 18:23:05 +0200 Subject: [PATCH 1207/1455] fix(build): fsp regex. --- pkg/prebuild/builder/fsp.go | 2 +- pkg/prebuild/cli/cli.go | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/builder/fsp.go b/pkg/prebuild/builder/fsp.go index ed2285de5..8f7fb4202 100644 --- a/pkg/prebuild/builder/fsp.go +++ b/pkg/prebuild/builder/fsp.go @@ -11,7 +11,7 @@ import ( var ( regFullSystemPolicy = util.ToRegexRepl([]string{ - `r(PU|U)x,`, `rPx,`, + `(PU|U)x,`, `Px,`, }) ) diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 237b0f0f8..ab221e485 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -139,6 +139,9 @@ func Configure() { func Prebuild() { logging.Step("Building apparmor.d profiles for %s on ABI%d.", prebuild.Distribution, prebuild.ABI) + if full { + logging.Success("Full system policy enabled") + } if prebuild.Version != nilVer { logging.Success("AppArmor version targeted: %.1f", prebuild.Version) } From c0de5ff71d9a2aec1b3c778cc31261a2961f54c3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 18:38:46 +0200 Subject: [PATCH 1208/1455] ci: also run the integration tests on manual run. --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index bcb817338..9f2addf88 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -83,7 +83,7 @@ jobs: tests: runs-on: ubuntu-24.04 needs: build - if: github.ref == 'refs/heads/dev' + if: github.ref_name == 'dev' || github.event_name == 'workflow_dispatch' steps: - name: Check out repository code uses: actions/checkout@v4 From be341a4ca8c48c03823609d143ea98e2a5c7b860 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 18:43:21 +0200 Subject: [PATCH 1209/1455] feat(profile): syncthing 2.0 uses sqlite. --- apparmor.d/profiles-s-z/syncthing | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/profiles-s-z/syncthing b/apparmor.d/profiles-s-z/syncthing index 6ff0fe7e9..4553ac1e9 100644 --- a/apparmor.d/profiles-s-z/syncthing +++ b/apparmor.d/profiles-s-z/syncthing @@ -35,6 +35,9 @@ profile syncthing @{exec_path} { /home/ r, @{user_sync_dirs}/{,**} rw, + owner /var/tmp/etilqs_@{sqlhex} rw, + owner @{tmp}/etilqs_@{sqlhex} rw, + @{PROC}/@{pids}/net/route r, @{PROC}/bus/pci/devices r, @{PROC}/modules r, From e8055098033abd1f3f73d2a1578f2dc07f7b1ce8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 19:42:44 +0200 Subject: [PATCH 1210/1455] build: opensuse: improve post install script. --- dists/apparmor.d.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dists/apparmor.d.spec b/dists/apparmor.d.spec index bf97705a6..d60841581 100644 --- a/dists/apparmor.d.spec +++ b/dists/apparmor.d.spec @@ -32,8 +32,8 @@ just complain just destdir="%{buildroot}" install %posttrans -rm -f /var/cache/apparmor/* 2>/dev/null -systemctl is-active -q apparmor && systemctl reload apparmor ||: +apparmor_parser --purge-cache +%restart_on_update apparmor %files %license LICENSE From ca24da7a2a4e11def29652d27c49e1ec11539e7e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 15 Aug 2025 19:49:43 +0200 Subject: [PATCH 1211/1455] build(debian): improve post install scripts. --- debian/apparmor.d.postinst | 5 ++++- debian/apparmor.d.postrm | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/debian/apparmor.d.postinst b/debian/apparmor.d.postinst index 4e659173c..fd0ffeb33 100644 --- a/debian/apparmor.d.postinst +++ b/debian/apparmor.d.postinst @@ -7,6 +7,9 @@ set -e #DEBHELPER# -systemctl is-active -q apparmor && systemctl reload apparmor ||: +apparmor_parser --purge-cache +if systemctl is-active -q apparmor; then + systemctl reload apparmor +fi exit 0 diff --git a/debian/apparmor.d.postrm b/debian/apparmor.d.postrm index 4e659173c..fd0ffeb33 100644 --- a/debian/apparmor.d.postrm +++ b/debian/apparmor.d.postrm @@ -7,6 +7,9 @@ set -e #DEBHELPER# -systemctl is-active -q apparmor && systemctl reload apparmor ||: +apparmor_parser --purge-cache +if systemctl is-active -q apparmor; then + systemctl reload apparmor +fi exit 0 From f5a4acd37e374f1036addc7c2425e578982f6a05 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 16 Aug 2025 19:13:59 +0200 Subject: [PATCH 1212/1455] feat(abs): graphics: add cpu_capacity --- apparmor.d/abstractions/graphics | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/graphics b/apparmor.d/abstractions/graphics index 37f6be70e..79872ceb4 100644 --- a/apparmor.d/abstractions/graphics +++ b/apparmor.d/abstractions/graphics @@ -14,6 +14,7 @@ @{sys}/bus/pci/devices/ r, @{sys}/devices/system/cpu/cpu@{int}/cache/index@{int}/* r, + @{sys}/devices/system/cpu/cpu@{int}/cpu_capacity r, @{sys}/devices/system/cpu/cpu@{int}/online r, @{sys}/devices/system/cpu/cpu@{int}/topology/* r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/* r, From 5ee999536ca2f5ae5cfbb999bb20bc7334d278ff Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 16 Aug 2025 19:23:33 +0200 Subject: [PATCH 1213/1455] feat(abs): reorganize the electron & chromium abs. --- apparmor.d/abstractions/app/chromium | 32 ++----------------- apparmor.d/abstractions/common/chromium | 25 +++++++++++---- apparmor.d/abstractions/common/electron | 39 ++--------------------- apparmor.d/groups/network/mullvad-gui | 5 +-- apparmor.d/groups/steam/steam | 8 +++-- apparmor.d/profiles-a-f/deltachat-desktop | 1 + apparmor.d/profiles-a-f/discord | 4 ++- apparmor.d/profiles-a-f/freetube | 2 +- apparmor.d/profiles-g-l/linuxqq | 1 + apparmor.d/profiles-m-r/protonmail | 1 + apparmor.d/profiles-s-z/session-desktop | 1 + apparmor.d/profiles-s-z/signal-desktop | 1 + apparmor.d/profiles-s-z/spotify | 3 +- apparmor.d/profiles-s-z/superproductivity | 1 + apparmor.d/profiles-s-z/vesktop | 2 +- apparmor.d/profiles-s-z/wechat | 1 + apparmor.d/profiles-s-z/wechat-appimage | 1 + apparmor.d/profiles-s-z/wechat-universal | 1 + apparmor.d/profiles-s-z/wemeet | 2 ++ 19 files changed, 46 insertions(+), 85 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index a971ca5a0..8f991c230 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -33,6 +33,7 @@ include include include + include include include include @@ -46,14 +47,6 @@ include include - userns, - - capability setgid, - capability setuid, - capability sys_admin, - capability sys_chroot, - capability sys_ptrace, - network inet dgram, network inet6 dgram, network inet stream, @@ -112,21 +105,12 @@ /etc/fstab r, /etc/{,opensc/}opensc.conf r, - /var/lib/dbus/machine-id r, - /etc/machine-id r, - / r, owner @{HOME}/ r, - owner @{HOME}/.pki/ rw, - owner @{HOME}/.pki/nssdb/ rw, - owner @{HOME}/.pki/nssdb/pkcs11.txt rw, - owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, - owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, - owner @{user_cache_dirs}/gtk-3.0/**/*.cache r, owner @{user_config_dirs}/gtk-3.0/servers r, - owner @{user_share_dirs}/.@{domain}.@{rand6} rw, + owner @{user_share_dirs}/icons/hicolor/.xdg-icon-resource-dummy w, owner @{config_dirs}/ rw, @@ -151,10 +135,7 @@ /tmp/ r, /var/tmp/ r, - owner @{tmp}/.@{domain}.@{rand6} rw, - owner @{tmp}/.@{domain}.@{rand6}/{,**} rw, owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw, - owner @{tmp}/scoped_dir@{rand6}/{,**} rw, owner @{tmp}/tmp.@{rand10} rw, owner @{tmp}/tmp.@{rand6} rw, owner @{tmp}/tmp.@{rand6}/ rw, @@ -163,9 +144,6 @@ owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw, owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw, - /dev/shm/ r, - owner /dev/shm/.@{domain}.@{rand6} rw, - @{run}/udev/data/c13:@{int} r, # for /dev/input/* @{sys}/bus/ r, @@ -175,10 +153,7 @@ @{sys}/devices/@{pci}/boot_vga r, @{sys}/devices/@{pci}/report_descriptor r, @{sys}/devices/**/uevent r, - @{sys}/devices/system/cpu/kernel_max r, @{sys}/devices/virtual/**/report_descriptor r, - @{sys}/devices/virtual/dmi/id/{sys_vendor,product_name} r, - @{sys}/devices/virtual/tty/tty@{int}/active r, @{PROC}/ r, @{PROC}/@{pid}/fd/ r, @@ -192,18 +167,15 @@ owner @{PROC}/@{pid}/clear_refs w, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/environ r, - owner @{PROC}/@{pid}/gid_map w, owner @{PROC}/@{pid}/limits r, owner @{PROC}/@{pid}/mem r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/oom_{,score_}adj rw, - owner @{PROC}/@{pid}/setgroups w, owner @{PROC}/@{pid}/smaps_rollup r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat r, - owner @{PROC}/@{pid}/uid_map w, /dev/ r, /dev/hidraw@{int} rw, diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index 9fba7b8bb..78441fe08 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -4,7 +4,13 @@ # SPDX-License-Identifier: GPL-2.0-only # This abstraction is for chromium based application. Chromium based browsers -# need to use abstractions/chromium instead. +# need to use abstractions/app/chromium instead. + +# It works as a *function* and requires a variable to be provided as *arguments* +# and set in the header of the calling profile. Example: +# +# @{domain} = org.chromium.Chromium +# abi , @@ -22,19 +28,24 @@ owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, - owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw, + owner @{user_share_dirs}/.@{domain}.@{rand6} rw, - /tmp/ r, - /var/tmp/ r, - owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, - owner @{tmp}/.org.chromium.Chromium.@{rand6}/{,**} rw, + owner @{tmp}/.@{domain}.@{rand6} rw, + owner @{tmp}/.@{domain}.@{rand6}/ rw, + owner @{tmp}/.@{domain}.@{rand6}/SingletonCookie w, + owner @{tmp}/.@{domain}.@{rand6}/SingletonSocket w, owner @{tmp}/scoped_dir@{rand6}/ rw, owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w, owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w, owner @{tmp}/scoped_dir@{rand6}/SS w, /dev/shm/ r, - owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + owner /dev/shm/.@{domain}.@{rand6} rw, + + @{sys}/devices/system/cpu/kernel_max r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{sys}/devices/virtual/tty/tty@{int}/active r, # If kernel.unprivileged_userns_clone = 1 owner @{PROC}/@{pid}/setgroups w, diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 175fa8b2d..b581c9073 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -7,13 +7,15 @@ # in the header of the calling profile. Example: # # @{name} = spotify -# @{lib_dirs} = /opt/@{name} +# @{domain} = org.chromium.chromium +# @{lib_dirs} = /opt/@{name}/ /usr/share/@{name}/ # @{config_dirs} = @{user_config_dirs}/@{name} # @{cache_dirs} = @{user_cache_dirs}/@{name} # abi , + include include include include @@ -21,14 +23,6 @@ include include - userns, - - capability setgid, # If kernel.unprivileged_userns_clone = 1 - capability setuid, # If kernel.unprivileged_userns_clone = 1 - capability sys_admin, - capability sys_chroot, - capability sys_ptrace, - @{bin}/electron rix, @{bin}/electron@{int} rix, @{lib}/electron@{int}/{,**} r, @@ -48,31 +42,7 @@ owner @{cache_dirs}/ rw, owner @{cache_dirs}/** rwlk -> @{cache_dirs}/**, - owner @{HOME}/.pki/ rw, - owner @{HOME}/.pki/nssdb/ rw, - owner @{HOME}/.pki/nssdb/pkcs11.txt rw, - owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, - owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, - owner @{user_config_dirs}/electron-flags.conf r, - owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw, - - owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, - owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw, - owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonCookie w, - owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonSocket w, - owner @{tmp}/scoped_dir@{rand6}/ rw, - owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w, - owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w, - owner @{tmp}/scoped_dir@{rand6}/SS w, - - /dev/shm/ r, - owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, - - @{sys}/devices/system/cpu/kernel_max r, - @{sys}/devices/virtual/dmi/id/product_name r, - @{sys}/devices/virtual/dmi/id/sys_vendor r, - @{sys}/devices/virtual/tty/tty@{int}/active r, @{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, @@ -89,15 +59,12 @@ owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/gid_map w, # If kernel.unprivileged_userns_clone = 1 owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/oom_score_adj rw, - owner @{PROC}/@{pid}/setgroups w, # If kernel.unprivileged_userns_clone = 1 owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/stat r, - owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1 deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index e4d2e9a2c..639d3ce4b 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -7,6 +7,7 @@ abi , include @{name} = Mullvad?VPN +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} @@ -31,10 +32,6 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) { @{bin}/gsettings rPx, @{open_path} rPx -> child-open-browsers, - owner @{user_cache_dirs}/dconf/user rw, - - owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw, - @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/mullvad-vpn rw, diff --git a/apparmor.d/groups/steam/steam b/apparmor.d/groups/steam/steam index 5009b970d..abfab75d7 100644 --- a/apparmor.d/groups/steam/steam +++ b/apparmor.d/groups/steam/steam @@ -21,10 +21,12 @@ abi , include -@{runtime} = SteamLinuxRuntime_{sniper,soldier} +@{domain} = org.chromium.Chromium +@{runtime_name} = sniper soldier +@{runtime} = SteamLinuxRuntime_@{runtime_name} steam-runtime-steamrt @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation -@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} -@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} steamrt64 +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} @{lib_dirs}/steam-runtime-steamrt @{app_dirs} = @{share_dirs}/steamapps/common/ @{exec_path} = @{share_dirs}/steam.sh diff --git a/apparmor.d/profiles-a-f/deltachat-desktop b/apparmor.d/profiles-a-f/deltachat-desktop index 4f60099a9..87c2bbaba 100644 --- a/apparmor.d/profiles-a-f/deltachat-desktop +++ b/apparmor.d/profiles-a-f/deltachat-desktop @@ -7,6 +7,7 @@ abi , include +@{domain} = org.chromium.Chromium @{lib_dirs} = @{lib}/deltachat-desktop @{lib}/deltachat /opt/DeltaChat/ @{exec_path} = @{bin}/deltachat-desktop @{lib_dirs}/deltachat-desktop diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index 8765084ff..3b34d5055 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -8,6 +8,7 @@ abi , include @{name} = discord +@{domain} = org.chromium.Chromium @{lib_dirs} = /usr/share/@{name} /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{user_config_dirs}/discordptb @{cache_dirs} = @{user_cache_dirs}/@{name} @@ -48,7 +49,6 @@ profile discord @{exec_path} flags=(attach_disconnected) { owner @{config_dirs}/@{version}/modules/** m, owner "@{tmp}/Discord Crashes/" rw, - owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw, owner @{tmp}/discord.sock rw, owner @{tmp}/net-export/ rw, @@ -57,6 +57,8 @@ profile discord @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mem r, owner @{PROC}/@{pid}/task/@{tid}/comm r, + deny ptrace read, + include if exists } diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index f4284873d..95e37b4d6 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -8,6 +8,7 @@ abi , include @{name} = {F,f}ree{T,t}ube{,-vue} +@{domain} = org.chromium.Chromium @{lib_dirs} = @{lib}/@{name} /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} @@ -39,7 +40,6 @@ profile freetube @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open-strict, deny @{sys}/devices/@{pci}/usb@{int}/** r, - deny /dev/ r, include if exists } diff --git a/apparmor.d/profiles-g-l/linuxqq b/apparmor.d/profiles-g-l/linuxqq index 08b8cf7a1..ff2ffe6b8 100644 --- a/apparmor.d/profiles-g-l/linuxqq +++ b/apparmor.d/profiles-g-l/linuxqq @@ -7,6 +7,7 @@ abi , include @{name} = QQ +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/QQ/ @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index c2c81d4da..0ac23267b 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -8,6 +8,7 @@ abi , include @{name} = proton-mail "Proton Mail" +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/session-desktop b/apparmor.d/profiles-s-z/session-desktop index 4817f330a..dc190b787 100644 --- a/apparmor.d/profiles-s-z/session-desktop +++ b/apparmor.d/profiles-s-z/session-desktop @@ -7,6 +7,7 @@ abi , include @{name} = {S,s}ession +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index dc0bc381e..bf0740919 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -8,6 +8,7 @@ abi , include @{name} = signal-desktop{,-beta} +@{domain} = org.chromium.Chromium @{lib_dirs} = @{lib}/signal-desktop /opt/Signal{,?Beta} @{config_dirs} = @{user_config_dirs}/Signal{,?Beta} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index a3a093c85..3c18059a9 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -8,6 +8,7 @@ abi , include @{name} = spotify +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/@{name}/ /usr/share/@{name}/ @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} @@ -57,8 +58,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) { owner @{cache_dirs}/WidevineCdm/**/libwidevinecdm.so rm, owner @{config_dirs}/*/WidevineCdm/**/libwidevinecdm.so rm, - owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw, - @{PROC}/@{pid}/net/unix r, @{PROC}/pressure/* r, owner @{PROC}/@{pid}/clear_refs w, diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index c0b940478..c49a96621 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -7,6 +7,7 @@ abi , include @{name} = super{p,P}roductivity +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/vesktop b/apparmor.d/profiles-s-z/vesktop index b4b63fe74..4f4432650 100644 --- a/apparmor.d/profiles-s-z/vesktop +++ b/apparmor.d/profiles-s-z/vesktop @@ -8,6 +8,7 @@ abi , include @{name} = vesktop +@{domain} = org.chromium.Chromium @{lib_dirs} = @{lib}/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} @@ -33,7 +34,6 @@ profile vesktop @{exec_path} flags=(attach_disconnected) { @{bin}/speech-dispatcher rPx, @{open_path} rPx -> child-open, - owner /tmp/.org.chromium.Chromium.@{rand6} mr, owner @{run}/user/@{uid}/discord-ipc-@{int} rw, @{sys}/devices/@{pci}/usb@{int}/**/interface r, diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat index ccff2f95f..00fe0a8c5 100644 --- a/apparmor.d/profiles-s-z/wechat +++ b/apparmor.d/profiles-s-z/wechat @@ -7,6 +7,7 @@ abi , include @{name} = wechat +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/wechat/ @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage index 07f67fb59..98ce53f07 100755 --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -7,6 +7,7 @@ abi , include @{name} = wechat-appimage +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/wechat-appimage/ @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal index b1c8aded2..94da6c60e 100644 --- a/apparmor.d/profiles-s-z/wechat-universal +++ b/apparmor.d/profiles-s-z/wechat-universal @@ -7,6 +7,7 @@ abi , include @{name} = wechat-universal +@{domain} = org.chromium.Chromium @{lib_dirs} = /opt/wechat-universal/ @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/apparmor.d/profiles-s-z/wemeet b/apparmor.d/profiles-s-z/wemeet index 4f40ef746..3606533d7 100644 --- a/apparmor.d/profiles-s-z/wemeet +++ b/apparmor.d/profiles-s-z/wemeet @@ -6,6 +6,8 @@ abi , include +@{domain} = org.chromium.Chromium + @{exec_path} = @{bin}/wemeet @{exec_path} += /opt/wemeet/bin/wemeetapp @{exec_path} += /opt/wemeet/bin/QtWebEngineProcess From e55ace4e0a5646fd1e9ad786a4356689bb668d90 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 00:07:53 +0200 Subject: [PATCH 1214/1455] fix(profile): issue with re-attached paths - Add missing att on some profiles - Fix alias / -> // - Fix aa-log att variable resolution fix #813 #814 --- apparmor.d/abstractions/attached/base | 2 ++ apparmor.d/abstractions/common/bwrap | 4 +++- apparmor.d/groups/flatpak/flatpak | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal | 6 +++--- apparmor.d/groups/freedesktop/xwayland | 4 +--- apparmor.d/groups/hyprland/hyprland | 3 +++ apparmor.d/tunables/multiarch.d/system | 2 +- pkg/logs/logs.go | 3 +-- 8 files changed, 15 insertions(+), 11 deletions(-) diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index e394c5b99..29c685f55 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -14,6 +14,8 @@ @{att}/@{run}/systemd/journal/socket w, @{att}/@{run}/systemd/journal/stdout rw, + @{att}/dev/null rw, + /apparmor/.null rw, @{att}/apparmor/.null rw, diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index f4630475d..da73b8217 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -38,12 +38,14 @@ pivot_root oldroot=/newroot/ /newroot/, pivot_root oldroot=/tmp/oldroot/ /tmp/, - owner / r, owner /newroot/{,**} w, owner /tmp/newroot/ w, owner /tmp/oldroot/ w, + @{att}/ r, + @{att}/@{run}/.userns r, + @{PROC}/sys/kernel/overflowgid r, @{PROC}/sys/kernel/overflowuid r, @{PROC}/sys/user/max_user_namespaces r, diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index c34ae962f..fca84002a 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -66,7 +66,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain /etc/flatpak/{,**} r, /etc/pulse/client.conf r, - / r, + @{att}/ r, /var/lib/flatpak/{,**} rwlk, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index bc975e4ea..5c62b0771 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -64,9 +64,9 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { @{lib}/xdg-desktop-portal-validate-icon rPx, @{open_path} rPx -> child-open, - / r, - @{att}/.flatpak-info r, - owner @{att}/ r, + / r, + @{att}/ r, + @{att}/.flatpak-info r, /usr/share/dconf/profile/gdm r, /usr/share/xdg-desktop-portal/** r, diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland index 9b329e06a..e8c94916d 100644 --- a/apparmor.d/groups/freedesktop/xwayland +++ b/apparmor.d/groups/freedesktop/xwayland @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/Xwayland profile xwayland @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -41,9 +42,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/cmdline r, - @{att}/dev/tty@{int} rw, - /dev/tty rw, - include if exists } diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index 8c8c32da0..c1e6da4d8 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -62,6 +62,9 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/environ r, + @{att}/dev/dri/card@{int} rw, + @{att}/dev/input/event@{int} rw, + /dev/input/event@{int} rw, /dev/tty r, owner /dev/tty@{int} rw, diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 06cb42000..e2f297045 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -74,6 +74,6 @@ # See https://apparmor.pujol.io/development/internal/#re-attached-path @{att}=/ -alias // -> /, +alias / -> //, # vim:syntax=apparmor diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go index 2443eaace..b0ae58702 100644 --- a/pkg/logs/logs.go +++ b/pkg/logs/logs.go @@ -64,7 +64,7 @@ var ( `/home/[^/]+/`, `@{HOME}/`, // Resolve system variables - `/att/[^/@]+`, `@{att}/`, + `/att/[^/]+/`, `@{att}/`, `/usr/lib(32|64|exec)`, `@{lib}`, `/usr/lib`, `@{lib}`, `/usr/sbin`, `@{sbin}`, @@ -86,7 +86,6 @@ var ( `pci` + strings.Repeat(h, 4) + `:` + strings.Repeat(h, 2), `@{pci_bus}`, `@{pci_bus}/[0-9a-f:*./]*/`, `@{pci}/`, `1000`, `@{uid}`, - `@{att}//`, `@{att}/`, // Some system glob `:not.active.yet`, `@{busname}`, // dbus unique bus name From d3507e24b94336e8ca5e1ba50887ed0755a7e341 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 00:09:28 +0200 Subject: [PATCH 1215/1455] fix(build): ensure post install script do not fail. --- debian/apparmor.d.postinst | 2 +- debian/apparmor.d.postrm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/apparmor.d.postinst b/debian/apparmor.d.postinst index fd0ffeb33..2f8c90ae0 100644 --- a/debian/apparmor.d.postinst +++ b/debian/apparmor.d.postinst @@ -7,7 +7,7 @@ set -e #DEBHELPER# -apparmor_parser --purge-cache +apparmor_parser --purge-cache || true if systemctl is-active -q apparmor; then systemctl reload apparmor fi diff --git a/debian/apparmor.d.postrm b/debian/apparmor.d.postrm index fd0ffeb33..2f8c90ae0 100644 --- a/debian/apparmor.d.postrm +++ b/debian/apparmor.d.postrm @@ -7,7 +7,7 @@ set -e #DEBHELPER# -apparmor_parser --purge-cache +apparmor_parser --purge-cache || true if systemctl is-active -q apparmor; then systemctl reload apparmor fi From 7c427aaae6252ee42e316f83b0faae97cb7a1268 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 00:10:34 +0200 Subject: [PATCH 1216/1455] build: do not overwrite steam. --- dists/overwrite | 1 - 1 file changed, 1 deletion(-) diff --git a/dists/overwrite b/dists/overwrite index 5bc00f9fe..c8769ba54 100644 --- a/dists/overwrite +++ b/dists/overwrite @@ -20,7 +20,6 @@ os-prober plasmashell signal-desktop slirp4netns -steam systemd-coredump thunderbird virtiofsd From 9110a7012441a1f57566361cc05c65d11a189fb7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 00:16:31 +0200 Subject: [PATCH 1217/1455] tests: add debian/ubuntu based tests images. Also some cleanup of tests resources. --- .gitignore | 1 + tests/cloud-init/debian.yml | 5 +++-- tests/cloud-init/debian13-kde.user-data.yml | 9 +++++++++ tests/cloud-init/ubuntu.yml | 1 + tests/cloud-init/ubuntu24-kubuntu.user-data.yml | 1 + tests/cloud-init/ubuntu25-kubuntu.user-data.yml | 9 +++++++++ tests/packer/clean.sh | 1 - tests/packer/init.sh | 5 +++-- tests/packer/variables.pkr.hcl | 4 ++-- tests/requirements.sh | 2 +- 10 files changed, 30 insertions(+), 8 deletions(-) create mode 100644 tests/cloud-init/debian13-kde.user-data.yml create mode 100644 tests/cloud-init/ubuntu25-kubuntu.user-data.yml diff --git a/.gitignore b/.gitignore index d888d6d5c..077d62cbf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ # Build .build .logs +.pkg tests/tldr tests/tldr.tar.gz diff --git a/tests/cloud-init/debian.yml b/tests/cloud-init/debian.yml index ea3012ad2..b96bb5880 100644 --- a/tests/cloud-init/debian.yml +++ b/tests/cloud-init/debian.yml @@ -23,7 +23,7 @@ core-packages: &core-packages - unattended-upgrades - vim -gnome-packages: &desktop-packages +gnome-packages: &gnome-packages # Core packages for Debian - apparmor-profiles - apparmor-utils @@ -53,7 +53,7 @@ gnome-packages: &desktop-packages - loupe - ptyxis -kde-packages: &kubuntu-packages +kde-packages: &kde-packages # Core packages for Debian - apparmor-profiles - apparmor-utils @@ -79,6 +79,7 @@ kde-packages: &kubuntu-packages # KDE packages for Debian - spice-vdagent - task-kde-desktop + - plasma-workspace-wayland - terminator debian12-runcmd: &debian12-runcmd diff --git a/tests/cloud-init/debian13-kde.user-data.yml b/tests/cloud-init/debian13-kde.user-data.yml new file mode 100644 index 000000000..5a4d33bf5 --- /dev/null +++ b/tests/cloud-init/debian13-kde.user-data.yml @@ -0,0 +1,9 @@ +#cloud-config + +packages: *kde-packages + +runcmd: *debian13-runcmd + +write_files: + - *shared-directory # Setup shared directory + - *systemd-netword # Network configuration for server diff --git a/tests/cloud-init/ubuntu.yml b/tests/cloud-init/ubuntu.yml index 14db33251..1f3563750 100644 --- a/tests/cloud-init/ubuntu.yml +++ b/tests/cloud-init/ubuntu.yml @@ -82,6 +82,7 @@ kubuntu-packages: &kubuntu-packages - spice-vdagent - terminator - kubuntu-desktop + - plasma-workspace-wayland desktop-runcmd: &desktop-runcmd # Add missing snap packages diff --git a/tests/cloud-init/ubuntu24-kubuntu.user-data.yml b/tests/cloud-init/ubuntu24-kubuntu.user-data.yml index d4139c2f7..bea74af3a 100644 --- a/tests/cloud-init/ubuntu24-kubuntu.user-data.yml +++ b/tests/cloud-init/ubuntu24-kubuntu.user-data.yml @@ -6,3 +6,4 @@ runcmd: *desktop-runcmd write_files: - *shared-directory # Setup shared directory + - *systemd-netword # Network configuration for server diff --git a/tests/cloud-init/ubuntu25-kubuntu.user-data.yml b/tests/cloud-init/ubuntu25-kubuntu.user-data.yml new file mode 100644 index 000000000..bea74af3a --- /dev/null +++ b/tests/cloud-init/ubuntu25-kubuntu.user-data.yml @@ -0,0 +1,9 @@ +#cloud-config + +packages: *kubuntu-packages + +runcmd: *desktop-runcmd + +write_files: + - *shared-directory # Setup shared directory + - *systemd-netword # Network configuration for server diff --git a/tests/packer/clean.sh b/tests/packer/clean.sh index b7650a1d5..f7518a2f6 100644 --- a/tests/packer/clean.sh +++ b/tests/packer/clean.sh @@ -55,7 +55,6 @@ clean_apt() { clean_pacman() { _msg "Cleaning pacman cache" - pacman -Syu --noconfirm pacman -Scc --noconfirm } diff --git a/tests/packer/init.sh b/tests/packer/init.sh index 4e4e1ec99..bf75c0e1e 100644 --- a/tests/packer/init.sh +++ b/tests/packer/init.sh @@ -3,7 +3,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -set -eu +set -eux _lsb_release() { # shellcheck source=/dev/null @@ -31,7 +31,8 @@ main() { ;; debian | ubuntu) - dpkg -i $SRC/*.deb + apt install -y apparmor-profiles + dpkg -i $SRC/*.deb || true ;; opensuse*) diff --git a/tests/packer/variables.pkr.hcl b/tests/packer/variables.pkr.hcl index 073544f59..a44f98412 100644 --- a/tests/packer/variables.pkr.hcl +++ b/tests/packer/variables.pkr.hcl @@ -98,8 +98,8 @@ variable "DM" { img_checksum = "https://cdimage.debian.org/images/cloud/bookworm/latest/SHA512SUMS" } "debian13" : { - img_url = "https://cdimage.debian.org/images/cloud/trixie/daily/latest/debian-13-genericcloud-amd64-daily.qcow2" - img_checksum = "https://cdimage.debian.org/images/cloud/trixie/daily/latest/SHA512SUMS" + img_url = "https://cdimage.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.qcow2" + img_checksum = "https://cdimage.debian.org/images/cloud/trixie/latest/SHA512SUMS" } "ubuntu22" : { img_url = "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img" diff --git a/tests/requirements.sh b/tests/requirements.sh index efc357ad4..0801ff27d 100644 --- a/tests/requirements.sh +++ b/tests/requirements.sh @@ -5,7 +5,7 @@ # Dependencies for the bats integration tests -set -eu +set -eu -o pipefail # shellcheck source=/dev/null _lsb_release() { From 52e9ae9fd621997113f2284b9500a511df9c285f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 00:29:21 +0200 Subject: [PATCH 1218/1455] fix(profile): define missing domain. --- apparmor.d/profiles-a-f/element-desktop | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index 91de37e58..7891b67e1 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -7,6 +7,7 @@ abi , include @{name} = {E,e}lement +@{domain} = org.chromium.Chromium @{lib_dirs} = @{lib}/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} From 4e70cb4c918013914b2bc4bef750374879ad615d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 11:57:36 +0200 Subject: [PATCH 1219/1455] fix(profile): workaround in apparmor issue for attached path. See https://gitlab.com/apparmor/apparmor/-/issues/450 Fix #815 --- apparmor.d/abstractions/common/app | 2 ++ apparmor.d/groups/flatpak/flatpak-app | 1 - apparmor.d/groups/flatpak/flatpak-portal | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal | 2 +- apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk | 2 +- apparmor.d/groups/freedesktop/xdg-document-portal | 2 +- apparmor.d/tunables/multiarch.d/system | 1 - pkg/prebuild/prepare/attach.go | 1 + 8 files changed, 7 insertions(+), 6 deletions(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 3029fb80b..3b425e505 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -135,6 +135,8 @@ owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{att}/dev/shm/@{uuid} r, + /dev/hidraw@{int} rw, /dev/input/ r, /dev/input/event@{int} rw, diff --git a/apparmor.d/groups/flatpak/flatpak-app b/apparmor.d/groups/flatpak/flatpak-app index a816e58b8..4199e92b1 100644 --- a/apparmor.d/groups/flatpak/flatpak-app +++ b/apparmor.d/groups/flatpak/flatpak-app @@ -83,7 +83,6 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { /var/lib/flatpak/app/{,**} r, /var/lib/flatpak/exports/** rw, - @{run}/.userns r, @{run}/parent/** r, @{run}/parent/app/.ref rk, @{run}/parent/usr/.ref rk, diff --git a/apparmor.d/groups/flatpak/flatpak-portal b/apparmor.d/groups/flatpak/flatpak-portal index 8a8d2b901..84e2d7964 100644 --- a/apparmor.d/groups/flatpak/flatpak-portal +++ b/apparmor.d/groups/flatpak/flatpak-portal @@ -31,7 +31,7 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { /var/lib/flatpak/exports/share/mime/mime.cache r, - owner @{att}/ r, + owner /att/**/ r, owner @{att}/.flatpak-info r, owner @{HOME}/.var/app/*/**/.ref rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 5c62b0771..5e27ac845 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -65,8 +65,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open, / r, - @{att}/ r, @{att}/.flatpak-info r, + owner /att/**/ r, /usr/share/dconf/profile/gdm r, /usr/share/xdg-desktop-portal/** r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index fc11b0700..c9585e2ab 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -52,7 +52,7 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { /usr/share/gdm/greeter-dconf-defaults r, / r, - owner @{att}/ r, + owner /att/**/ r, owner /var/lib/xkb/server-@{int}.xkm rw, diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index 93cac619e..d2db2612e 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -44,7 +44,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { @{bin}/snap rPx, / r, - owner @{att}/ r, + owner /att/**/ r, owner @{att}/.flatpak-info r, owner @{HOME}/ r, diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index e2f297045..288665770 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -73,7 +73,6 @@ # Disabled on abi3 and Ubuntu 25.04+ # See https://apparmor.pujol.io/development/internal/#re-attached-path @{att}=/ - alias / -> //, # vim:syntax=apparmor diff --git a/pkg/prebuild/prepare/attach.go b/pkg/prebuild/prepare/attach.go index a87ff9071..3331c73dc 100644 --- a/pkg/prebuild/prepare/attach.go +++ b/pkg/prebuild/prepare/attach.go @@ -33,5 +33,6 @@ func (p ReAttach) Apply() ([]string, error) { return res, err } out = strings.ReplaceAll(out, "@{att}=/", "# @{att}=/") + out = strings.ReplaceAll(out, "alias / -> //,", "#alias / -> //,") return res, path.WriteFile([]byte(out)) } From 58aea2b00d2975372a89db7c32deb6e7d3f35705 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 11:59:06 +0200 Subject: [PATCH 1220/1455] build: update flag manifest. --- dists/flags/main.flags | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index a62a6847d..057c7c298 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -46,7 +46,7 @@ cockpit-desktop complain cockpit-session attach_disconnected,complain cockpit-ssh complain cockpit-tls attach_disconnected,complain -cockpit-ws complain +cockpit-ws attach_disconnected,complain cockpit-wsinstance-factory complain cups-backend-beh complain cups-backend-bluetooth complain @@ -110,11 +110,9 @@ flameshot complain flatpak attach_disconnected,mediate_deleted,complain flatpak-app attach_disconnected,mediate_deleted,complain flatpak-oci-authenticator complain -flatpak-portal attach_disconnected,complain flatpak-session-helper attach_disconnected,complain flatpak-system-helper complain flatpak-validate-icon complain -fstrim complain fuse-overlayfs complain gdk-pixbuf-thumbnailer complain gdm-generate-config complain @@ -159,7 +157,6 @@ grub-set-default complain grub-syslinux2cfg complain gsd-printer attach_disconnected,complain gsd-wwan complain -gsettings complain gvfsd-dav complain gvfsd-wsdd complain hostnamectl complain @@ -189,7 +186,7 @@ kde-powerdevil attach_disconnected,mediate_deleted,complain kde-systemd-start-condition complain kded complain kdump_mem_estimator complain -kdump-config complain +kdump-config attach_disconnected,complain kdump-tools-init complain,attach_disconnected kernel complain kernel-install complain @@ -283,11 +280,11 @@ secure-time-sync attach_disconnected,complain sftp-server complain sing-box complain slirp4netns attach_disconnected,complain -snap complain +snap attach_disconnected,complain snap-device-helper complain snap-discard-ns complain snap-failure complain -snap-seccomp complain +snap-seccomp attach_disconnected,complain snap-update-ns complain snapd complain snapd-apparmor complain @@ -388,7 +385,7 @@ update-grub complain update-info-dir complain update-secureboot-policy complain update-shells complain -userdbctl complain +userdbctl attach_disconnected,complain utempter attach_disconnected,complain veracrypt complain virt-manager attach_disconnected,complain From edc2755d615b64b8a05607e62bfe248f58704fde Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 17:03:17 +0200 Subject: [PATCH 1221/1455] feat(profile): kde: add initial dbus definition. --- apparmor.d/groups/kde/DiscoverNotifier | 8 +++++ apparmor.d/groups/kde/gmenudbusmenuproxy | 3 ++ apparmor.d/groups/kde/kaccess | 5 +++ apparmor.d/groups/kde/kactivitymanagerd | 4 +++ apparmor.d/groups/kde/kauth-backlighthelper | 2 ++ .../groups/kde/kauth-chargethresholdhelper | 5 +++ apparmor.d/groups/kde/kauth-discretegpuhelper | 4 +++ apparmor.d/groups/kde/kauth-kded-smart-helper | 6 +++- apparmor.d/groups/kde/kcminit | 3 ++ apparmor.d/groups/kde/kde-powerdevil | 15 +++++++++ apparmor.d/groups/kde/kded | 31 +++++++++++++++++-- apparmor.d/groups/kde/kglobalacceld | 3 ++ apparmor.d/groups/kde/kioworker | 3 ++ apparmor.d/groups/kde/konsole | 3 ++ .../groups/kde/kscreen_backend_launcher | 8 ++++- apparmor.d/groups/kde/ksmserver | 11 +++++++ apparmor.d/groups/kde/ksplashqml | 4 +++ apparmor.d/groups/kde/kwalletd | 6 ++++ apparmor.d/groups/kde/kwin_wayland | 12 +++++++ apparmor.d/groups/kde/kwin_wayland_wrapper | 3 ++ apparmor.d/groups/kde/kwin_x11 | 8 +++++ apparmor.d/groups/kde/plasma_waitforname | 1 + apparmor.d/groups/kde/plasmashell | 21 +++++++++++++ apparmor.d/groups/kde/sddm | 15 ++------- apparmor.d/groups/kde/sddm-greeter | 5 +++ apparmor.d/groups/kde/sddm-xsession | 10 ++++++ apparmor.d/groups/kde/startplasma | 5 +++ apparmor.d/groups/kde/systemsettings | 5 +++ apparmor.d/groups/kde/xembedsniproxy | 3 ++ apparmor.d/groups/network/NetworkManager | 3 +- apparmor.d/groups/network/nm-online | 4 +-- apparmor.d/groups/polkit/polkitd | 5 +++ apparmor.d/profiles-m-r/packagekitd | 2 +- 33 files changed, 206 insertions(+), 20 deletions(-) diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 3ec36976d..861132887 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -10,6 +10,10 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}DiscoverNotifier profile DiscoverNotifier @{exec_path} { include + include + include + include + include include include include @@ -23,6 +27,10 @@ profile DiscoverNotifier @{exec_path} { network netlink dgram, network netlink raw, + #aa:dbus own bus=session name=org.kde.discover.notifier + + #aa:dbus talk bus=system name=org.freedesktop.PackageKit label=packagekitd + @{exec_path} mr, @{bin}/apt-config rPx, diff --git a/apparmor.d/groups/kde/gmenudbusmenuproxy b/apparmor.d/groups/kde/gmenudbusmenuproxy index d9879941b..b30e39cdc 100644 --- a/apparmor.d/groups/kde/gmenudbusmenuproxy +++ b/apparmor.d/groups/kde/gmenudbusmenuproxy @@ -9,6 +9,9 @@ include @{exec_path} = @{bin}/gmenudbusmenuproxy profile gmenudbusmenuproxy @{exec_path} { include + include + include + include include include include diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index 42c1400ef..65582d1ba 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -10,10 +10,15 @@ include profile kaccess @{exec_path} { include include + include + include + include include include include + #aa:dbus own bus=session name=org.kde.kaccess + @{exec_path} mr, @{bin}/gsettings rPx, diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index 1ee022dc6..1cc6b41d1 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}kactivitymanagerd profile kactivitymanagerd @{exec_path} { include + include include include include @@ -18,6 +19,9 @@ profile kactivitymanagerd @{exec_path} { include include + #aa:dbus own bus=session name=org.kde.ActivityManager path=/ActivityManager + #aa:dbus own bus=session name=org.kde.runners.activities + @{exec_path} mr, /etc/xdg/menus/{,*/} r, diff --git a/apparmor.d/groups/kde/kauth-backlighthelper b/apparmor.d/groups/kde/kauth-backlighthelper index 61308e83b..cc844ce17 100644 --- a/apparmor.d/groups/kde/kauth-backlighthelper +++ b/apparmor.d/groups/kde/kauth-backlighthelper @@ -16,6 +16,8 @@ profile kauth-backlighthelper @{exec_path} { capability net_admin, + #aa:dbus own bus=system name=org.kde.powerdevil.backlighthelper + @{exec_path} mr, /usr/share/icu/@{int}.@{int}/*.dat r, diff --git a/apparmor.d/groups/kde/kauth-chargethresholdhelper b/apparmor.d/groups/kde/kauth-chargethresholdhelper index 8ed8bf82e..119b5508d 100644 --- a/apparmor.d/groups/kde/kauth-chargethresholdhelper +++ b/apparmor.d/groups/kde/kauth-chargethresholdhelper @@ -9,7 +9,12 @@ include @{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}chargethresholdhelper profile kauth-chargethresholdhelper @{exec_path} { include + include include + include + + #aa:dbus own bus=system name=org.kde.powerdevil.chargethresholdhelper + #aa:dbus talk bus=system name=org.kde.kf5auth path=/ label=kde-powerdevil @{exec_path} mr, diff --git a/apparmor.d/groups/kde/kauth-discretegpuhelper b/apparmor.d/groups/kde/kauth-discretegpuhelper index f03dfb007..8fcec5a2c 100644 --- a/apparmor.d/groups/kde/kauth-discretegpuhelper +++ b/apparmor.d/groups/kde/kauth-discretegpuhelper @@ -9,8 +9,12 @@ include @{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}discretegpuhelper profile kauth-discretegpuhelper @{exec_path} { include + include + include include + #aa:dbus own bus=system name=org.kde.powerdevil.discretegpuhelper + @{exec_path} mr, /usr/share/icu/@{int}.@{int}/*.dat r, diff --git a/apparmor.d/groups/kde/kauth-kded-smart-helper b/apparmor.d/groups/kde/kauth-kded-smart-helper index cf0caffeb..2e60e6a0a 100644 --- a/apparmor.d/groups/kde/kauth-kded-smart-helper +++ b/apparmor.d/groups/kde/kauth-kded-smart-helper @@ -15,10 +15,14 @@ profile kauth-kded-smart-helper @{exec_path} { #aa:dbus own bus=system name=org.kde.kded.smart + dbus receive bus=system path=/ + interface=org.kde.kf5auth + member=performAction + peer=(name=@{busname}, label=kded), dbus send bus=system path=/ interface=org.kde.kf5auth member=remoteSignal - peer=(name=org.freedesktop.DBus, label=kded5), + peer=(name=org.freedesktop.DBus, label=kded), @{exec_path} mr, diff --git a/apparmor.d/groups/kde/kcminit b/apparmor.d/groups/kde/kcminit index e11de6a48..bd01bf3c8 100644 --- a/apparmor.d/groups/kde/kcminit +++ b/apparmor.d/groups/kde/kcminit @@ -10,9 +10,12 @@ include profile kcminit @{exec_path} { include include + include include include + #aa:dbus own bus=session name=org.kde.{KCM,kcm}init path=/kcminit + @{exec_path} mr, @{bin}/xrdb rPx, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 45c382855..c961ed7a3 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -11,6 +11,13 @@ include profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) { include include + include + include + include + include + include + include + include include include include @@ -20,6 +27,14 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) network netlink raw, + #aa:dbus own bus=system name=org.freedesktop.Policy.Power + + #aa:dbus own bus=session name=local.org_kde_powerdevil + #aa:dbus own bus=session name=org.freedesktop.PowerManagement + #aa:dbus own bus=session name=org.kde.Solid.PowerManagement + + #aa:dbus talk bus=session name=org.kde.KWin path=/ label="kwin_{wayland,x11}" + @{exec_path} mrix, @{sh_path} rix, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index ef81b95d1..e729ec78b 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -10,9 +10,14 @@ include profile kded @{exec_path} { include include + include + include include + include include + include include + include include include include @@ -35,19 +40,41 @@ profile kded @{exec_path} { signal send set=hup peer=xsettingsd, signal send set=term peer=kioworker, + # Owned by KDE + #aa:dbus own bus=system name=com.redhat.NewPrinterNotification + + #aa:dbus own bus=session name=org.gtk.Settings + #aa:dbus own bus=session name=org.kde.DistroReleaseNotifier + #aa:dbus own bus=session name=org.kde.GtkConfig + #aa:dbus own bus=session name=org.kde.kappmenu + #aa:dbus own bus=session name=org.kde.kcookiejar5 + #aa:dbus own bus=session name=org.kde.kded5 + #aa:dbus own bus=session name=org.kde.keyboard + #aa:dbus own bus=session name=org.kde.KeyboardLayouts + #aa:dbus own bus=session name=org.kde.plasmanetworkmanagement + #aa:dbus own bus=session name=org.kde.plasmashell.accentColor + #aa:dbus own bus=session name=org.kde.StatusNotifierWatcher + #aa:dbus own bus=session name=org.kde.Wacom + #aa:dbus own bus=session name=org.kubuntu.NotificationHelper + #aa:dbus own bus=session name=org.kubuntu.restrictedInstall + + # Talk with KDE + #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd + #aa:dbus talk bus=session name=org.kde.KGlobalAccel path=/ label="{kglobalacceld,kwin_wayland}" + dbus receive bus=system path=/ interface=org.kde.kf5auth member=remoteSignal - peer=(name=:*, label=kauth-kded-smart-helper), + peer=(name=@{busname}, label=kauth-kded-smart-helper), dbus send bus=system path=/ interface=org.kde.kf5auth member=performAction - peer=(name="{:*,org.kde.kded.smart}", label=kauth-kded-smart-helper), + peer=(name="{@{busname},org.kde.kded.smart}", label=kauth-kded-smart-helper), @{exec_path} mrix, diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index 0e8ba3395..156bdf928 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -9,8 +9,11 @@ include @{exec_path} = @{bin}/kglobalaccel5 @{lib}/kglobalacceld profile kglobalacceld @{exec_path} { include + include include + #aa:dbus own bus=session name=org.kde.KGlobalAccel path=/kglobalaccel + @{exec_path} mr, @{bin}/kstart rPx, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index a5f867378..69b735310 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -10,6 +10,7 @@ include @{exec_path} += @{lib}/kf5/kioslave5 @{lib}/@{multiarch}/{,libexec/}kf5/kioslave5 profile kioworker @{exec_path} { include + include include include include @@ -32,6 +33,8 @@ profile kioworker @{exec_path} { signal receive set=term peer=plasmashell, signal receive set=term peer=xdg-desktop-portal-kde, + #aa:dbus talk bus=session name=org.kde.kded5 path=/kded label=kded + @{exec_path} mr, @{lib}/libheif/ r, diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 8f9ff48dd..057a23d70 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -13,6 +13,7 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include include @@ -22,6 +23,8 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { signal (send) set=(hup), + #aa:dbus own bus=session name=org.kde.konsole-@{int} + @{exec_path} mr, @{bin}/@{shells} rUx, @{browsers_path} rPx, diff --git a/apparmor.d/groups/kde/kscreen_backend_launcher b/apparmor.d/groups/kde/kscreen_backend_launcher index d4b547c7c..7df07f64b 100644 --- a/apparmor.d/groups/kde/kscreen_backend_launcher +++ b/apparmor.d/groups/kde/kscreen_backend_launcher @@ -10,8 +10,14 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kscreen_backend_launcher profile kscreen_backend_launcher @{exec_path} { include - include + include + include + include include + include + + #aa:dbus own bus=session name=org.kde.KScreen + #aa:dbus talk bus=system name=org.kde.kf5auth path=/ label=kde-powerdevil @{exec_path} mr, diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index 6d515fb18..f4d54c295 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -11,6 +11,9 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include + include + include include include include @@ -20,6 +23,14 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { ptrace (read) peer=kbuildsycoca5, + #aa:dbus own bus=session name=org.freedesktop.ScreenSaver + #aa:dbus own bus=session name=org.kde.ksmserver path=/KSMServer + #aa:dbus own bus=session name=org.kde.KSMServerInterface path=/KSMServer + #aa:dbus own bus=session name=org.kde.screensaver + + #aa:dbus talk bus=session name=org.kde.KGlobalAccel path=/ label=kglobalacceld + #aa:dbus talk bus=session name=org.kde.KWin.Session path=/Session label=kwin_wayland + @{exec_path} mr, @{bin}/rm rix, diff --git a/apparmor.d/groups/kde/ksplashqml b/apparmor.d/groups/kde/ksplashqml index 13f1216a5..e1d5d7394 100644 --- a/apparmor.d/groups/kde/ksplashqml +++ b/apparmor.d/groups/kde/ksplashqml @@ -9,6 +9,8 @@ include @{exec_path} = @{bin}/ksplashqml profile ksplashqml @{exec_path} { include + include + include include include include @@ -16,6 +18,8 @@ profile ksplashqml @{exec_path} { ptrace read peer=startplasma, + #aa:dbus own bus=session name=org.kde.KSplash path=/KSplash + @{exec_path} mr, @{lib}/libheif/ r, diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index c4e25e9ff..23737f14e 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -11,6 +11,9 @@ include profile kwalletd @{exec_path} { include include + include + include + include include include include @@ -19,6 +22,9 @@ profile kwalletd @{exec_path} { include include + #aa:dbus own bus=session name=org.freedesktop.secrets + #aa:dbus own bus=session name=org.kde.kwalletd5 + @{exec_path} mr, @{bin}/gpgconf rCx -> gpg, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index afaac3bd0..a8dc97d53 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -10,6 +10,10 @@ include profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { include include + include + include + include + include include include include @@ -27,6 +31,14 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { network netlink raw, + #aa:dbus own bus=session name=org.freedesktop.ScreenSaver + #aa:dbus own bus=session name=org.kde.kglobalaccel + #aa:dbus own bus=session name=org.kde.KWin + #aa:dbus own bus=session name=org.kde.NightColor path=/ColorCorrect + #aa:dbus own bus=session name=org.kde.screensaver + + #aa:dbus talk bus=session name=org.kde.ActivityManager path=/ActivityManager label=kactivitymanagerd + @{exec_path} mr, /etc/xdg/Xwayland-session.d/00-at-spi Cx -> at-spi, diff --git a/apparmor.d/groups/kde/kwin_wayland_wrapper b/apparmor.d/groups/kde/kwin_wayland_wrapper index 1a7573d77..a7ce4c2fe 100644 --- a/apparmor.d/groups/kde/kwin_wayland_wrapper +++ b/apparmor.d/groups/kde/kwin_wayland_wrapper @@ -9,11 +9,14 @@ include @{exec_path} = @{bin}/kwin_wayland_wrapper profile kwin_wayland_wrapper @{exec_path} { include + include include include signal (send) set=(term, kill) peer=kwin_wayland, + #aa:dbus own bus=session name=org.kde.KWinWrapper + @{exec_path} mr, @{bin}/kwin_wayland rPx, diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index 8400c8cb6..f4f955a4f 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -9,6 +9,8 @@ include @{exec_path} = @{bin}/kwin_x11 profile kwin_x11 @{exec_path} { include + include + include include include include @@ -22,6 +24,12 @@ profile kwin_x11 @{exec_path} { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=org.kde.KWin + #aa:dbus own bus=session name=org.kde.NightColor path=/ColorCorrect + + #aa:dbus talk bus=session name=org.kde.ActivityManager label=kactivitymanagerd + #aa:dbus talk bus=session name=org.kde.KGlobalAccel path=/kglobalaccel label=kglobalacceld + @{exec_path} mrix, @{sh_path} rix, diff --git a/apparmor.d/groups/kde/plasma_waitforname b/apparmor.d/groups/kde/plasma_waitforname index a509135af..d32122a8a 100644 --- a/apparmor.d/groups/kde/plasma_waitforname +++ b/apparmor.d/groups/kde/plasma_waitforname @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/plasma_waitforname profile plasma_waitforname @{exec_path} { include + include include include diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 07fbc8e14..19106cfa9 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -11,9 +11,13 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { include include include + include include include + include + include include + include include include include @@ -43,6 +47,23 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { signal send, + #aa:dbus own bus=session name=com.canonical.Unity + #aa:dbus own bus=session name=org.freedesktop.Notifications + #aa:dbus own bus=session name=org.kde.JobViewServer + #aa:dbus own bus=session name=org.kde.klipper + #aa:dbus own bus=session name=org.kde.kuiserver + #aa:dbus own bus=session name=org.kde.plasmashell path=/PlasmaShell + #aa:dbus own bus=session name=org.kde.StatusNotifierHost-@{int} + + #aa:dbus talk bus=session name=org.kde.kdeconnect path=/ label=kdeconnectd + #aa:dbus talk bus=session name=org.kde.KeyboardLayouts path=/Layouts label=kded + #aa:dbus talk bus=session name=org.kde.KGlobalAccel path=/kglobalaccel label="{kglobalacceld,kwin_wayland}" + #aa:dbus talk bus=session name=org.kde.KSplash path=/KSplash label=ksplashqml + #aa:dbus talk bus=session name=org.kde.KWin path=/ label="kwin_{wayland,x11}" + #aa:dbus talk bus=session name=org.kde.NightColor path=/ColorCorrect label="kwin_{wayland,x11}" + #aa:dbus talk bus=session name=org.kde.Solid.PowerManagement label=kde-powerdevil + #aa:dbus talk bus=session name=org.kde.StatusNotifierWatcher path=/StatusNotifierWatcher label=kded + @{exec_path} mr, @{lib}/libheif/ r, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 143df5c9e..9884e2145 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -50,20 +50,11 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { signal (send) set=(term) peer=startplasma-wayland, signal (send) set=(term) peer=startlxqtwayland, - dbus receive bus=system path=/org/freedesktop/DisplayManager/Seat@{int} - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=:*, label=kscreenlocker-greet), + unix type=stream addr=@@{udbus}/bus/sddm-helper/system, - dbus receive bus=system path=/org/freedesktop/DisplayManager/Seat@{int} - interface=org.freedesktop.DBus.Properties - member=PropertiesChanged - peer=(name=:*, label="@{p_systemd_logind}"), + #aa:dbus own bus=system name=org.freedesktop.DisplayManager - dbus send bus=system path=/org/freedesktop/DisplayManager/Seat@{int} - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=org.freedesktop.DBus, label=kscreenlocker-greet), + #aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label="@{p_systemd_homed}" @{exec_path} mr, diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index f2c133cec..c9aca546a 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -23,6 +23,11 @@ profile sddm-greeter @{exec_path} { network netlink raw, + dbus send bus=system path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member=ListActivatableNames + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), + @{exec_path} mr, @{lib}/libheif/ r, diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession index f27f3dc3c..f4256d3d4 100644 --- a/apparmor.d/groups/kde/sddm-xsession +++ b/apparmor.d/groups/kde/sddm-xsession @@ -90,6 +90,16 @@ profile sddm-xsession @{exec_path} { profile dbus { include + include + + dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member=UpdateActivationEnvironment + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + dbus send bus=session path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=SetEnvironment + peer=(name=org.freedesktop.systemd1, label="@{p_systemd_user}"), @{bin}/dbus-update-activation-environment mr, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index 004b89d57..651061aa9 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -11,12 +11,17 @@ profile startplasma @{exec_path} { include include include + include + include include include signal (receive) set=(hup) peer=@{p_systemd}, signal (receive) set=(term) peer=sddm, + #aa:dbus talk bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}" + #aa:dbus talk bus=session name=org.kde.KSplash path=/KSplash label=ksplashqml + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index b41dac08a..aab520a72 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -10,7 +10,9 @@ include profile systemsettings @{exec_path} { include include + include include + include include include include @@ -23,6 +25,9 @@ profile systemsettings @{exec_path} { signal send set=term peer=kioworker, + #aa:dbus own bus=session name=org.kde.internal.KSettingsWidget_kcm_networkmanagement + #aa:dbus own bus=session name=org.kde.systemsettings + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index 6cb93163c..b768e2630 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -9,6 +9,9 @@ include @{exec_path} = @{bin}/xembedsniproxy profile xembedsniproxy @{exec_path} { include + include + include + include include include include diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 6b444093c..f27449e77 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -50,8 +50,9 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/nm_dispatcher interface=org.freedesktop.nm_dispatcher - member=Action + member=Action2 peer=(name=org.freedesktop.nm_dispatcher), + dbus send bus=system path=/uk/org/thekelleys/dnsmasq interface=org.freedesktop.NetworkManager.dnsmasq member=SetServersEx diff --git a/apparmor.d/groups/network/nm-online b/apparmor.d/groups/network/nm-online index 189afd74d..710d3115b 100644 --- a/apparmor.d/groups/network/nm-online +++ b/apparmor.d/groups/network/nm-online @@ -16,12 +16,12 @@ profile nm-online @{exec_path} { dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/@{int} interface=org.freedesktop.NetworkManager.Connection.Active member=StateChanged - peer=(name=:*, label=NetworkManager), + peer=(name=@{busname}, label=NetworkManager), dbus send bus=system path=/org/freedesktop/NetworkManager/Settings/@{int} interface=org.freedesktop.NetworkManager.Settings.Connection member=GetSettings - peer=(name=:*, label=NetworkManager), + peer=(name=@{busname}, label=NetworkManager), @{exec_path} mr, diff --git a/apparmor.d/groups/polkit/polkitd b/apparmor.d/groups/polkit/polkitd index 4dc1380c0..c2de7f8b6 100644 --- a/apparmor.d/groups/polkit/polkitd +++ b/apparmor.d/groups/polkit/polkitd @@ -24,6 +24,11 @@ profile polkitd @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=system name=org.freedesktop.PolicyKit1 + dbus send bus=system path=/org/kde/PolicyKit1/AuthenticationAgent + interface=org.freedesktop.PolicyKit1.AuthenticationAgent + member=BeginAuthentication + peer=(name=@{busname}, label=polkit-kde-authentication-agent), + @{exec_path} mr, @{bin}/pkla-check-authorization rPx, diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index 9de9cadf9..19f6a515e 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -38,7 +38,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { signal send set=int peer=apt-methods-*, signal send set=term peer=systemd-inhibit, - #aa:dbus own bus=system name=org.freedesktop.PackageKit + #aa:dbus own bus=system name=org.freedesktop.PackageKit path=/** @{exec_path} mr, From 523522dd1d2fd75efdd5c07e0b91de897be4cf4b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 17:05:38 +0200 Subject: [PATCH 1222/1455] feat(profile): improve kde profiles. --- .../polkit-kde-authentication-agent | 5 ++++ .../groups/kde/drkonqi-coredump-cleanup | 3 ++- apparmor.d/groups/kde/kded | 21 +++++++++++++--- apparmor.d/groups/kde/konsole | 4 ++- apparmor.d/groups/kde/kwalletd | 2 ++ apparmor.d/groups/kde/kwin_wayland | 15 ++++++----- apparmor.d/groups/kde/plasmashell | 1 + apparmor.d/groups/kde/sddm | 9 ++++++- apparmor.d/groups/kde/sddm-xsession | 13 +++++++--- apparmor.d/groups/kde/startplasma | 1 + apparmor.d/groups/kde/systemsettings | 1 + apparmor.d/groups/kde/wayland-session | 25 +++++++++++++++---- apparmor.d/groups/kde/xembedsniproxy | 1 + apparmor.d/groups/kde/xsettingsd | 1 + 14 files changed, 81 insertions(+), 21 deletions(-) diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index f53f4d164..8a08f02d0 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -11,6 +11,8 @@ include @{exec_path} += @{lib}/polkit-kde-authentication-agent-[0-9] profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected,mediate_deleted) { include + include + include include include include @@ -26,6 +28,9 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected, signal (send) set=(term, kill) peer=polkit-agent-helper, + #aa:dbus own bus=session name=org.kde.polkit-kde-authentication-agent-@{int} + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd + @{exec_path} mr, @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx, diff --git a/apparmor.d/groups/kde/drkonqi-coredump-cleanup b/apparmor.d/groups/kde/drkonqi-coredump-cleanup index c74276b95..199dd9c8f 100644 --- a/apparmor.d/groups/kde/drkonqi-coredump-cleanup +++ b/apparmor.d/groups/kde/drkonqi-coredump-cleanup @@ -14,7 +14,8 @@ profile drkonqi-coredump-cleanup @{exec_path} { @{exec_path} mr, @{user_cache_dirs}/kcrash-metadata/ r, - owner @{user_cache_dirs}/kcrash-metadata/plasmashell.@{hex32}.@{int4}.ini w, + owner @{user_cache_dirs}/kcrash-metadata/plasmashell.@{hex32}.@{int4}.ini rw, + owner @{user_cache_dirs}/kcrash-metadata/@{int}.ini rw, include if exists } diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index e729ec78b..f2f2489ab 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -18,6 +18,7 @@ profile kded @{exec_path} { include include include + include #aa:only apt include include include @@ -26,16 +27,19 @@ profile kded @{exec_path} { include include include + include include capability sys_ptrace, network inet dgram, + network inet stream, network inet6 dgram, - network netlink raw, + network inet6 stream, network netlink dgram, + network netlink raw, - ptrace (read), + ptrace read, signal send set=hup peer=xsettingsd, signal send set=term peer=kioworker, @@ -78,11 +82,13 @@ profile kded @{exec_path} { @{exec_path} mrix, + @{python_path} rix, + @{bin}/dpkg rPx -> child-dpkg, + @{bin}/flatpak rPx, @{bin}/kcminit rPx, + @{bin}/lsb_release rPx, @{bin}/pgrep rCx -> pgrep, @{bin}/plasma-welcome rPUx, - @{python_path} rix, - @{bin}/flatpak rPx, @{bin}/setxkbmap rix, @{bin}/xmodmap rPUx, @{bin}/xrdb rPx, @@ -94,18 +100,22 @@ profile kded @{exec_path} { #aa:exec kconf_update /usr/share/color-schemes/{,**} r, + /usr/share/distro-info/{,**} r, + /usr/share/distro-release-notifier/{,**} r, /usr/share/kconf_update/ r, /usr/share/kded{5,6}/{,**} r, /usr/share/kf{5,6}/kcookiejar/* r, /usr/share/khotkeys/{,**} r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,**} r, + /usr/share/ubuntu-release-upgrader/{,*} r, /etc/fstab r, /etc/xdg/accept-languages.codes r, /etc/xdg/kde* r, /etc/xdg/kioslaverc r, /etc/xdg/menus/{,**} r, + /etc/update-manager/{,**} r, /etc/machine-id r, /var/lib/dbus/machine-id r, @@ -113,6 +123,8 @@ profile kded @{exec_path} { / r, @{efi}/ r, + owner /var/lib/update-manager/meta-release-lts rw, + owner @{HOME}/ r, owner @{HOME}/.gtkrc-2.0 rw, @@ -125,6 +137,7 @@ profile kded @{exec_path} { @{user_cache_dirs}/ksycoca{5,6}_* rwlk -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/plasmashell/ rw, owner @{user_cache_dirs}/plasmashell/** rwlk -> @{user_cache_dirs}/plasmashell/**, + owner @{user_cache_dirs}/update-manager-core/meta-release-lts rw, @{user_config_dirs}/kcookiejarrc.lock rwk, @{user_config_dirs}/kcookiejarrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index 057a23d70..fa55e177d 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -56,7 +56,9 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/kbookmarkrc r, owner @{user_config_dirs}/konsole.notifyrc r, - owner @{user_config_dirs}/konsolerc{,*} rwlk, + owner @{user_config_dirs}/konsolerc rwl, + owner @{user_config_dirs}/konsolerc.@{rand6} rwl, + owner @{user_config_dirs}/konsolerc.lock rwk, owner @{user_config_dirs}/konsolesshconfig rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/konsolesshconfig.@{rand6} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/konsolesshconfig.lock rwk, diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index 23737f14e..ad96cb512 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -45,6 +45,8 @@ profile kwalletd @{exec_path} { owner @{user_share_dirs}/kwalletd/ rw, owner @{user_share_dirs}/kwalletd/** rwkl -> @{user_share_dirs}/kwalletd/#@{int}, + owner @{run}/user/@{uid}/kwallet{5,6}.socket r, + owner @{tmp}/kwalletd5.* rw, owner @{PROC}/@{pid}/cmdline r, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index a8dc97d53..243e0adfe 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -23,14 +23,17 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { capability sys_nice, capability sys_ptrace, - ptrace (read), - - signal (receive) set=term peer=sddm, - signal (receive) set=(kill, term) peer=kwin_wayland_wrapper, - signal (send) set=(kill, term) peer=xwayland, - network netlink raw, + ptrace read, + + signal receive set=term peer=sddm, + signal receive set=(kill, term) peer=kwin_wayland_wrapper, + signal send set=(kill, term) peer=xwayland, + + unix type=stream peer=(label=xkbcomp), + unix type=stream peer=(label=xwayland), + #aa:dbus own bus=session name=org.freedesktop.ScreenSaver #aa:dbus own bus=session name=org.kde.kglobalaccel #aa:dbus own bus=session name=org.kde.KWin diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 19106cfa9..68ea4fc0c 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -80,6 +80,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { /opt/**/share/icons/{,**} r, /opt/*/**/*.desktop r, /opt/*/**/*.png r, + /snap/*/@{uid}/**.@{image_ext} r, /usr/share/*/icons/{,**} r, /usr/share/akonadi/{,**} r, /usr/share/desktop-directories/kf5-*.directory r, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 9884e2145..b62116704 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -66,20 +66,26 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{lib}/{,sddm/}sddm-helper-start-x11user rix, @{shells_path} rix, + @{bin}/{,e}grep rix, + @{bin}/basename rix, @{bin}/cat rix, - @{sbin}/checkproc rix, + @{bin}/date rix, + @{bin}/dirname rix, @{bin}/disable-paste rix, + @{bin}/id rix, @{bin}/locale rix, @{bin}/manpath rix, @{bin}/mktemp rix, @{bin}/pidof rix, @{bin}/readlink rix, @{bin}/realpath rix, + @{bin}/sed rix, @{bin}/tr rix, @{bin}/tty rix, @{bin}/uname rix, @{bin}/xdm r, @{bin}/xmodmap rix, + @{sbin}/checkproc rix, @{bin}/dbus-run-session rPx -> dbus-session, @{bin}/dbus-update-activation-environment rPx -> dbus-session, @@ -98,6 +104,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/systemctl rCx -> systemctl, @{bin}/xauth rCx -> xauth, @{bin}/Xorg rPx, + @{bin}/xrandr rPx, @{bin}/xrdb rPx, @{bin}/xset rPx, @{bin}/xsetroot rPx, diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession index f4256d3d4..0e9290d53 100644 --- a/apparmor.d/groups/kde/sddm-xsession +++ b/apparmor.d/groups/kde/sddm-xsession @@ -25,9 +25,11 @@ profile sddm-xsession @{exec_path} { @{bin}/chmod rix, @{bin}/csh rix, @{bin}/date rix, + @{bin}/dpkg-query rpx, @{bin}/fish rix, + @{bin}/gettext rix, @{bin}/gettext.sh r, - @{bin}/gpgconf rCx -> gpg, + @{bin}/gpgconf rCx -> gpg, @{bin}/id rix, @{bin}/locale rix, @{bin}/locale-check rix, @@ -40,12 +42,13 @@ profile sddm-xsession @{exec_path} { @{bin}/tcsh rix, @{bin}/tempfile rix, @{bin}/touch rix, + @{bin}/tr rix, @{bin}/which{,.debianutils} rix, - @{bin}/zsh rix, @{bin}/dbus-update-activation-environment rCx -> dbus, @{bin}/flatpak rPx, @{bin}/numlockx rPx, + @{bin}/xbrlapi rPx, @{bin}/xhost rPx, @{bin}/xrdb rPx, /etc/X11/Xsession rPx, @@ -60,7 +63,9 @@ profile sddm-xsession @{exec_path} { @{system_share_dirs}/im-config/data/{,*} r, @{system_share_dirs}/im-config/xinputrc.common r, + @{system_share_dirs}/libdebuginfod-common/debuginfod.sh r, + /etc/debuginfod/{,**} r, /etc/default/{,*} r, /etc/X11/{,**} r, @@ -71,7 +76,7 @@ profile sddm-xsession @{exec_path} { owner @{tmp}/xsess-env-* rw, owner @{tmp}/file* rw, - audit owner @{tmp}/tmp.* rw, + owner @{tmp}/tmp.@{rand10} rw, owner @{PROC}/@{pid}/loginuid r, @@ -133,6 +138,8 @@ profile sddm-xsession @{exec_path} { @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{HOME}/.xsession-errors w, + /dev/tty@{int} rw, owner /dev/pts/@{int} rw, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index 651061aa9..5db93719c 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -36,6 +36,7 @@ profile startplasma @{exec_path} { @{lib}/@{multiarch}/libexec/plasma-sourceenv.sh r, + /usr/share/byobu/desktop/{,**} r, /usr/share/color-schemes/{,**} r, /usr/share/desktop-directories/{,**} r, /usr/share/kservices{5,6}/{,**} r, diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index aab520a72..a78225b67 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -80,6 +80,7 @@ profile systemsettings @{exec_path} { owner @{user_cache_dirs}/ksvg-elements.@{rand6} rwlk -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/ksvg-elements.lock rwlk, owner @{user_cache_dirs}/plasma_theme_*.kcache rw, + owner @{user_cache_dirs}/plasma-svgelements r, owner @{user_cache_dirs}/systemsettings/ rw, owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**, diff --git a/apparmor.d/groups/kde/wayland-session b/apparmor.d/groups/kde/wayland-session index 124cf2fda..56914137b 100644 --- a/apparmor.d/groups/kde/wayland-session +++ b/apparmor.d/groups/kde/wayland-session @@ -13,14 +13,29 @@ profile wayland-session @{exec_path} { @{exec_path} mr, - @{shells_path} rix, - @{bin}/id rix, + @{shells_path} rix, + @{bin}/cat ix, + @{bin}/dpkg-query px, + @{bin}/gettext ix, + @{bin}/gettext.sh r, + @{bin}/id ix, + @{bin}/locale ix, + @{bin}/locale-check ix, + @{bin}/sed ix, + @{bin}/tr ix, - @{lib}/plasma-dbus-run-session-if-needed rix, - @{lib}/@{multiarch}/libexec/plasma-dbus-run-session-if-needed rix, - @{bin}/startplasma-wayland rPx, + @{bin}/startplasma-wayland Px, + @{lib}/@{multiarch}/libexec/plasma-dbus-run-session-if-needed ix, + @{lib}/plasma-dbus-run-session-if-needed ix, + /usr/share/im-config/{,**} r, + /usr/share/libdebuginfod-common/debuginfod.sh r, + + /etc/debuginfod/{,**} r, + /etc/default/im-config r, /etc/machine-id r, + /etc/X11/xinit/xinputrc r, + /etc/X11/Xsession.d/*im-config_launch r, owner @{user_share_dirs}/sddm/wayland-session.log rw, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index b768e2630..93259822e 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -16,6 +16,7 @@ profile xembedsniproxy @{exec_path} { include include include + include @{exec_path} mr, diff --git a/apparmor.d/groups/kde/xsettingsd b/apparmor.d/groups/kde/xsettingsd index 7cebbb43c..1adbf1d9f 100644 --- a/apparmor.d/groups/kde/xsettingsd +++ b/apparmor.d/groups/kde/xsettingsd @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/xsettingsd profile xsettingsd @{exec_path} { include + include signal (receive) set=hup peer=kded, From 7e79d5abefa13bd226d4b1f5671b238d168590b2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 17:15:24 +0200 Subject: [PATCH 1223/1455] feat(profile): improve support for ubuntu & kubuntu. --- apparmor.d/abstractions/bus/org.a11y | 10 ++++++++++ apparmor.d/abstractions/graphics-full | 4 ++++ apparmor.d/abstractions/kde-strict | 3 ++- apparmor.d/abstractions/mesa.d/complete | 2 ++ apparmor.d/groups/apt/dpkg-script-linux | 2 ++ apparmor.d/groups/apt/dpkg-scripts | 1 + apparmor.d/groups/apt/unattended-upgrade | 12 ++++++----- apparmor.d/groups/bluetooth/blueman-mechanism | 1 + apparmor.d/groups/bluetooth/obexd | 3 ++- apparmor.d/groups/browsers/chromium-wrapper | 1 + apparmor.d/groups/browsers/firefox-glxtest | 2 ++ apparmor.d/groups/bus/dbus-accessibility | 7 ++++--- apparmor.d/groups/bus/ibus-memconf | 3 +-- apparmor.d/groups/freedesktop/wireplumber | 6 ++---- .../groups/freedesktop/xdg-desktop-portal | 4 ++++ .../freedesktop/xdg-desktop-portal-gnome | 4 ++++ apparmor.d/groups/freedesktop/xrandr | 4 ++++ apparmor.d/groups/freedesktop/xwayland | 3 ++- apparmor.d/groups/gnome/deja-dup-monitor | 6 ++++++ apparmor.d/groups/gnome/gdm-generate-config | 3 +-- apparmor.d/groups/gnome/gjs-console | 11 +++++++++- apparmor.d/groups/gnome/yelp | 6 ++++-- apparmor.d/groups/snap/snap | 6 +++++- apparmor.d/groups/snap/snap-seccomp | 2 +- apparmor.d/groups/snap/snapd | 1 - apparmor.d/groups/ssh/sshd-session | 1 + apparmor.d/groups/ubuntu/apport-gtk | 20 +++++++++++++++++-- apparmor.d/groups/ubuntu/apt_news | 1 + apparmor.d/groups/ubuntu/ubuntu-fan-net | 12 +++++++++++ apparmor.d/groups/ubuntu/update-notifier | 2 +- .../groups/ubuntu/update-notifier-crash | 2 +- apparmor.d/groups/utils/login | 1 + apparmor.d/groups/virt/cockpit-tls | 2 +- .../groups/virt/cockpit-wsinstance-factory | 15 ++++++++++++-- apparmor.d/profiles-a-f/dhclient-script | 19 +++++++++++++----- apparmor.d/profiles-a-f/dracut-install | 2 ++ apparmor.d/profiles-g-l/kernel | 4 ++++ apparmor.d/profiles-g-l/lsb-release | 1 + apparmor.d/profiles-m-r/initramfs-hooks | 2 +- apparmor.d/profiles-m-r/motd | 10 +++++++++- apparmor.d/profiles-m-r/power-profiles-daemon | 2 +- apparmor.d/profiles-m-r/qdbus | 1 + apparmor.d/profiles-s-z/switcheroo-control | 1 + apparmor.d/profiles-s-z/update-info-dir | 2 ++ apparmor.d/profiles-s-z/whoopsie | 10 ++++++++++ apparmor.d/profiles-s-z/wsdd | 1 + apparmor.d/profiles-s-z/xbrlapi | 2 ++ 47 files changed, 180 insertions(+), 40 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y index 2677d2f61..c99f5f8bd 100644 --- a/apparmor.d/abstractions/bus/org.a11y +++ b/apparmor.d/abstractions/bus/org.a11y @@ -31,6 +31,11 @@ member=Embed peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), + dbus send bus=accessibility path=/org/a11y/atspi/accessible/root + interface=org.a11y.atspi.Socket + member=Embed + peer=(name=org.a11y.atspi.Registry), + # Session bus dbus send bus=session path=/org/a11y/bus @@ -38,6 +43,11 @@ member=GetAll peer=(name=@{busname}, label="@{p_dbus_accessibility}"), + dbus send bus=session path=/org/a11y/bus + interface=org.freedesktop.DBus.Properties + member=Get + peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"), + dbus send bus=session path=/org/a11y/bus interface=org.a11y.Bus member=Get diff --git a/apparmor.d/abstractions/graphics-full b/apparmor.d/abstractions/graphics-full index 1f2b0ffd2..eb60edb4d 100644 --- a/apparmor.d/abstractions/graphics-full +++ b/apparmor.d/abstractions/graphics-full @@ -6,6 +6,10 @@ include + @{sys}/devices/@{pci}/numa_node r, + + @{PROC}/devices r, + /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 /dev/nvidia-uvm rw, /dev/nvidia-uvm-tools rw, diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 428aa93f3..fd994d12d 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -20,6 +20,7 @@ /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/knotifications{5,6}/*.notifyrc r, + /usr/share/kubuntu-default-settings/{,**} r, #aa:only ubuntu /etc/xdg/baloofilerc r, /etc/xdg/kcminputrc r, @@ -44,7 +45,7 @@ owner @{user_config_dirs}/menus/ r, owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_config_dirs}/session/ rw, - owner @{user_config_dirs}/session/@{profile_name}* rwlk, + owner @{user_config_dirs}/session/*_@{hex}_@{int}_@{int} rwlk, owner @{user_config_dirs}/session/#@{int} rw, owner @{user_config_dirs}/trashrc r, diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete index 1d718c0b1..02a48114c 100644 --- a/apparmor.d/abstractions/mesa.d/complete +++ b/apparmor.d/abstractions/mesa.d/complete @@ -42,4 +42,6 @@ @{PROC}/sys/dev/xe/observation_paranoid r, + /dev/udmabuf rw, # In upstream, but not released yet + # vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux index b294b928b..af578be50 100644 --- a/apparmor.d/groups/apt/dpkg-script-linux +++ b/apparmor.d/groups/apt/dpkg-script-linux @@ -11,6 +11,8 @@ profile dpkg-script-linux @{exec_path} { include include + capability dac_read_search, + @{exec_path} mrix, @{bin}/cat ix, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 9be1f3258..7d2073768 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -168,6 +168,7 @@ profile dpkg-scripts @{exec_path} { /usr/local/ r, /usr/local/lib/ r, + /var/cache/ldconfig/ rw, owner /var/cache/ldconfig/aux-cache* rw, include if exists diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index 0d4d2ee33..d501a325f 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -52,9 +52,11 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { @{bin}/touch ix, @{bin}/uname ix, - @{bin}/dpkg-deb px, @{bin}/apt-listchanges Px, + @{bin}/df Px, + @{bin}/dmesg Px, @{bin}/dpkg Px, + @{bin}/dpkg-deb px, @{bin}/dpkg-divert Px, @{bin}/etckeeper Px, @{bin}/ischroot Px, @@ -90,7 +92,8 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /etc/pki/fwupd/{,**} r, /etc/profile.d/* r, /etc/ssh/moduli r, - /etc/ssh/ssh_config r, + @{etc_ro}/ssh/sshd_config r, + @{etc_ro}/ssh/sshd_config.d/{,*} r, /etc/ufw/{,**} r, /etc/update-manager/{,**} r, /etc/update-motd.d/{,**} r, @@ -98,7 +101,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /etc/vmware-tools/{,**} r, /var/log/unattended-upgrades/{,**} rw, - /var/crash/*.crash w, + /var/crash/*.crash rw, /var/lib/apt/periodic/unattended-upgrades-stamp w, /var/lib/dpkg/info/{,*} r, @@ -112,8 +115,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { /var/lib/apt/lists/ rw, /var/lib/apt/lists/partial/ rw, /var/lib/apt/periodic/ w, - /var/log/apt/{term,history}.log w, - /var/log/apt/eipp.log.xz w, + /var/log/apt/*.log* rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/unattended-upgrades.lock rwk, diff --git a/apparmor.d/groups/bluetooth/blueman-mechanism b/apparmor.d/groups/bluetooth/blueman-mechanism index ffdda336e..9b4800210 100644 --- a/apparmor.d/groups/bluetooth/blueman-mechanism +++ b/apparmor.d/groups/bluetooth/blueman-mechanism @@ -11,6 +11,7 @@ include profile blueman-mechanism @{exec_path} flags=(attach_disconnected) { include include + include include include diff --git a/apparmor.d/groups/bluetooth/obexd b/apparmor.d/groups/bluetooth/obexd index efb5f42e4..65ad4c0e5 100644 --- a/apparmor.d/groups/bluetooth/obexd +++ b/apparmor.d/groups/bluetooth/obexd @@ -10,8 +10,9 @@ include @{exec_path} = @{lib}/bluetooth/obexd profile obexd @{exec_path} { include - include include + include + include include network bluetooth stream, diff --git a/apparmor.d/groups/browsers/chromium-wrapper b/apparmor.d/groups/browsers/chromium-wrapper index dea35ae1a..d29dcc630 100644 --- a/apparmor.d/groups/browsers/chromium-wrapper +++ b/apparmor.d/groups/browsers/chromium-wrapper @@ -45,6 +45,7 @@ profile chromium-wrapper @{exec_path} flags=(attach_disconnected) { # Silencer deny @{user_share_dirs}/gvfs-metadata/* r, + deny @{user_share_dirs}/gnome-shell/session.gvdb rw, include if exists } diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest index 30281f2f4..f9470a59b 100644 --- a/apparmor.d/groups/browsers/firefox-glxtest +++ b/apparmor.d/groups/browsers/firefox-glxtest @@ -21,6 +21,8 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + / r, + owner @{cache_dirs}/firefox/*/startupCache/scriptCache-* r, owner @{cache_dirs}/firefox/*/startupCache/startupCache* r, diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index ee787e4e1..f876d1210 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -23,8 +23,9 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, - signal (receive) set=(term hup kill) peer=dbus-session, - signal (receive) set=(term hup kill) peer=gdm{,-session-worker}, + signal receive set=(term hup kill) peer=dbus-session, + signal receive set=(term hup kill) peer=gdm{,-session-worker}, + signal receive set=(term hup kill) peer=gnome-session-binary, unix type=stream addr=none peer=(label=xorg, addr=@/tmp/.X11-unix/X0), @@ -71,10 +72,10 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { @{sys}/kernel/security/apparmor/features/dbus/mask r, @{sys}/module/apparmor/parameters/enabled r, + @{PROC}/@{pid}/cmdline r, @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/attr/apparmor/current r, owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/bus/ibus-memconf b/apparmor.d/groups/bus/ibus-memconf index 803f28a4a..5233f8603 100644 --- a/apparmor.d/groups/bus/ibus-memconf +++ b/apparmor.d/groups/bus/ibus-memconf @@ -11,6 +11,7 @@ profile ibus-memconf @{exec_path} flags=(attach_disconnected) { include include include + include include include @@ -27,8 +28,6 @@ profile ibus-memconf @{exec_path} flags=(attach_disconnected) { owner @{desktop_config_dirs}/ibus/bus/ r, owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, - owner /dev/tty@{int} rw, - include if exists } diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index 25569cd68..80c3135f5 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -76,10 +76,8 @@ profile wireplumber @{exec_path} { @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, - @{PROC}/1/cgroup r, - @{PROC}/1/cmdline r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/media@{int} rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 5e27ac845..35c81f0bc 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -45,6 +45,10 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { interface=org.freedesktop.host.portal.Registry member=Register peer=(name=@{busname}), + dbus receive bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.portal.NetworkMonitor + member=GetStatus + peer=(name=@{busname}, label=snap.*), #aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 6ee4cab6d..bed83627a 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -47,6 +47,10 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { member=GetAll peer=(name=:*, label=gnome-shell), + dbus send bus=session path=/org/gnome/Shell + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=gnome-shell), dbus receive bus=session path=/org/gnome/Shell interface=org.freedesktop.DBus.Properties member=PropertiesChanged diff --git a/apparmor.d/groups/freedesktop/xrandr b/apparmor.d/groups/freedesktop/xrandr index fc1935c4b..ed9e7a030 100644 --- a/apparmor.d/groups/freedesktop/xrandr +++ b/apparmor.d/groups/freedesktop/xrandr @@ -12,8 +12,12 @@ profile xrandr @{exec_path} { include include + capability dac_read_search, + @{exec_path} mr, + @{run}/sddm/xauth_@{rand6} r, + owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland index e8c94916d..a8950dbc6 100644 --- a/apparmor.d/groups/freedesktop/xwayland +++ b/apparmor.d/groups/freedesktop/xwayland @@ -20,7 +20,8 @@ profile xwayland @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term hup) peer=kwin_wayland, signal (receive) set=(term hup) peer=login, - unix type=stream addr=none peer=(label=gnome-shell, addr=none), + unix type=stream peer=(label=gnome-shell), + unix type=stream peer=(label=kwin_wayland), @{exec_path} mrix, diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor index af7fa51b0..ac5d6af81 100644 --- a/apparmor.d/groups/gnome/deja-dup-monitor +++ b/apparmor.d/groups/gnome/deja-dup-monitor @@ -33,10 +33,16 @@ profile deja-dup-monitor @{exec_path} { member=GetAll peer=(name=:*, label=NetworkManager), + dbus send bus=system path=/org/freedesktop/UPower/PowerProfiles + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=power-profiles-daemon), + @{exec_path} mr, @{bin}/chrt rix, @{bin}/ionice rix, + @{bin}/deja-dup Px, /usr/share/glib-2.0/schemas/gschemas.compiled r, diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index d48b9eff6..9d910cdd2 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -18,7 +18,7 @@ profile gdm-generate-config @{exec_path} { capability setgid, capability setuid, - ptrace read, + # ptrace read, @{exec_path} mr, @@ -45,7 +45,6 @@ profile gdm-generate-config @{exec_path} { @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/stat r, - @{PROC}/tty/drivers r, @{PROC}/uptime r, profile pgrep { diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index fdaa4e825..0cfd4c420 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -64,6 +64,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, /usr/share/gnome-shell/{,**} r, + /usr/share/thumbnailers/{,**} r, /tmp/ r, /var/tmp/ r, @@ -76,9 +77,15 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { owner @{HOME}/ r, - owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, owner @{user_cache_dirs}/gstreamer-1.0/ rw, owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, + owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, + owner @{user_share_dirs}/nautilus/scripts/ r, + + owner @{user_desktop_dirs}/ r, + owner @{user_templates_dirs}/ r, + + owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, @@ -91,6 +98,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { /dev/ r, /dev/tty rw, + deny @{user_share_dirs}/gvfs-metadata/* r, + include if exists } diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp index 058b9697a..1f2fc39d3 100644 --- a/apparmor.d/groups/gnome/yelp +++ b/apparmor.d/groups/gnome/yelp @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/yelp @{bin}/gnome-help -profile yelp @{exec_path} { +profile yelp @{exec_path} flags=(attach_disconnected) { include include include @@ -30,7 +30,9 @@ profile yelp @{exec_path} { /etc/xml/{,**} r, - @{sys}/devices/virtual/dmi/id/chassis_type r, + @{sys}/firmware/acpi/pm_profile r, + @{sys}/devices/virtual/dmi/id/chassis_type r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-yelp-*.scope/memory.* r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*.slice/*/memory.* r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.current r, diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap index 425d5cd66..ef0a086a8 100644 --- a/apparmor.d/groups/snap/snap +++ b/apparmor.d/groups/snap/snap @@ -68,9 +68,13 @@ profile snap @{exec_path} flags=(attach_disconnected) { /var/cache/snapd/names r, @{DESKTOP_HOME}/snap/{,**} rw, - @{HOME}/snap/{,**} rw, /snap/{,**} rw, + @{HOME}/snap/{,**} rw, + owner @{HOME}/ r, + owner @{HOME}/.snap.mkdir-new/ rw, + owner @{HOME}/.snap/{,**} rw, + owner @{tmp}/snapd-auto-import-mount-@{int}/ rw, @{run}/user/@{uid}/bus rw, diff --git a/apparmor.d/groups/snap/snap-seccomp b/apparmor.d/groups/snap/snap-seccomp index 7857bcc6a..9605c544a 100644 --- a/apparmor.d/groups/snap/snap-seccomp +++ b/apparmor.d/groups/snap/snap-seccomp @@ -9,7 +9,7 @@ include @{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snap-seccomp -profile snap-seccomp @{exec_path} { +profile snap-seccomp @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 0f975b3b0..7e2c288b6 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -34,7 +34,6 @@ profile snapd @{exec_path} { capability setuid, capability sys_admin, capability sys_ptrace, - capability sys_resource, network inet stream, network inet6 stream, diff --git a/apparmor.d/groups/ssh/sshd-session b/apparmor.d/groups/ssh/sshd-session index e953834a7..ab86f3ad1 100644 --- a/apparmor.d/groups/ssh/sshd-session +++ b/apparmor.d/groups/ssh/sshd-session @@ -55,6 +55,7 @@ profile sshd-session @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{bin}/@{shells} Ux, #aa:exclude RBAC + @{bin}/userdbctl Px, @{lib}/{openssh,ssh}/sshd-auth Px, @{etc_rw}/motd r, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 4940653a3..271ff23e4 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -29,10 +29,12 @@ profile apport-gtk @{exec_path} { network inet6 stream, network inet dgram, network inet6 dgram, + network netlink raw, @{exec_path} mr, @{sh_path} rix, + @{python_path} rix, @{bin}/{f,}grep rix, @{bin}/apt-cache rPx, @{bin}/cut rix, @@ -43,20 +45,24 @@ profile apport-gtk @{exec_path} { @{bin}/gsettings rPx, @{bin}/ischroot rPx, @{bin}/journalctl rPx, - @{sbin}/killall5 rix, @{bin}/kmod rPx, @{bin}/ldd rix, @{bin}/lsb_release rPx, @{bin}/md5sum rix, @{bin}/pkexec rCx -> pkexec, + @{bin}/readlink rix, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-detect-virt rPx, @{bin}/uname rix, @{bin}/which{,.debianutils} rix, + @{sbin}/killall5 rix, @{lib}/{,colord/}colord-sane rPx, @{lib}/@{multiarch}/ld*.so* rix, /usr/share/apport/root_info_wrapper rix, + @{bin}/* r, + @{sbin}/* r, + /usr/share/apport/{,**} r, /usr/share/apport/general-hooks/*.py r, @@ -79,9 +85,10 @@ profile apport-gtk @{exec_path} { /var/crash/ rw, owner /var/crash/*.@{uid}.{crash,upload} rw, + @{run}/cloud-init/cloud.cfg r, @{run}/snapd.socket rw, - owner @{tmp}/@{rand8} rw, + owner @{tmp}/@{word8} rw, owner @{tmp}/apport_core_@{rand8} rw, owner @{tmp}/launchpadlib.cache.@{rand8}/ rw, owner @{tmp}/tmp@{rand8}/{,**} rw, @@ -135,6 +142,15 @@ profile apport-gtk @{exec_path} { include include + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.DBus.Properties + member=Get + peer=(name=org.freedesktop.systemd1, label=unconfined), + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=GetUnitFileState + peer=(name=org.freedesktop.systemd1, label=unconfined), + include if exists } diff --git a/apparmor.d/groups/ubuntu/apt_news b/apparmor.d/groups/ubuntu/apt_news index 7f4e8fbe2..9734803e4 100644 --- a/apparmor.d/groups/ubuntu/apt_news +++ b/apparmor.d/groups/ubuntu/apt_news @@ -14,6 +14,7 @@ profile apt_news @{exec_path} flags=(attach_disconnected) { include capability chown, + capability fowner, capability kill, capability setgid, capability setuid, diff --git a/apparmor.d/groups/ubuntu/ubuntu-fan-net b/apparmor.d/groups/ubuntu/ubuntu-fan-net index 74fe83551..ab83ebed4 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-fan-net +++ b/apparmor.d/groups/ubuntu/ubuntu-fan-net @@ -14,10 +14,22 @@ profile ubuntu-fan-net @{exec_path} { @{sh_path} mr, @{bin}/{m,g,}awk ix, + @{bin}/kmod Cx -> kmod, @{bin}/{,e}grep ix, @{bin}/networkctl Px, @{sbin}/fanctl Px, + profile kmod { + include + include + + capability sys_module, + + @{sys}/module/compression r, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 361290980..9754aa231 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -25,7 +25,7 @@ profile update-notifier @{exec_path} { unix (bind) type=stream addr=@@{udbus}/bus/systemd/bus-api-user, #aa:dbus talk bus=system name=org.debian.apt label=apt - #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell + #aa:dbus talk bus=session name=org.ayatana.NotificationItem interface+=org.kde.StatusNotifierItem label=gnome-shell @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/update-notifier-crash b/apparmor.d/groups/ubuntu/update-notifier-crash index d65c77a08..4926c0b1c 100644 --- a/apparmor.d/groups/ubuntu/update-notifier-crash +++ b/apparmor.d/groups/ubuntu/update-notifier-crash @@ -16,7 +16,7 @@ profile update-notifier-crash @{exec_path} { @{bin}/{,e}grep ix, @{bin}/groups Px, @{bin}/systemctl Cx -> systemctl, - @{bin}/which{,.debianutils} ix, + @{bin}/which{,.debianutils} rix, @{sh_path} mr, /usr/share/apport/apport-checkreports Px, diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login index c35001498..cf9663e8e 100644 --- a/apparmor.d/groups/utils/login +++ b/apparmor.d/groups/utils/login @@ -54,6 +54,7 @@ profile login @{exec_path} flags=(attach_disconnected) { /etc/shells r, /var/lib/faillock/@{user} rwk, + /var/lib/lastlog/ r, /var/log/btmp{,.@{int}} r, owner @{user_cache_dirs}/motd.legal-displayed rw, diff --git a/apparmor.d/groups/virt/cockpit-tls b/apparmor.d/groups/virt/cockpit-tls index 7bf43ed4a..8a345588a 100644 --- a/apparmor.d/groups/virt/cockpit-tls +++ b/apparmor.d/groups/virt/cockpit-tls @@ -17,7 +17,7 @@ profile cockpit-tls @{exec_path} flags=(attach_disconnected) { /etc/cockpit/ws-certs.d/{,**} r, - @{att}/@{run}/cockpit/wsinstance/https@@{hex64}.sock r, + @{att}/@{run}/cockpit/wsinstance/https@@{hex64}.sock rw, @{att}/@{run}/cockpit/wsinstance/https-factory.sock rw, owner @{run}/cockpit/tls/{,**} rw, diff --git a/apparmor.d/groups/virt/cockpit-wsinstance-factory b/apparmor.d/groups/virt/cockpit-wsinstance-factory index 99db4d614..248ca43e8 100644 --- a/apparmor.d/groups/virt/cockpit-wsinstance-factory +++ b/apparmor.d/groups/virt/cockpit-wsinstance-factory @@ -11,12 +11,23 @@ profile cockpit-wsinstance-factory @{exec_path} { include include - unix bind type=stream addr=@@{udbus}/bus/cockpit-wsinsta/system, - capability net_admin, + unix bind type=stream addr=@@{udbus}/bus/cockpit-wsinsta/system, + + dbus receive bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=JobRemoved + peer=(name=@{busname}, label="@{p_systemd}"), + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=StartUnit + peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), + @{exec_path} mr, + @{run}/cockpit/wsinstance/https-factory.sock w, + include if exists } diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script index 3967512b8..9d84a4065 100644 --- a/apparmor.d/profiles-a-f/dhclient-script +++ b/apparmor.d/profiles-a-f/dhclient-script @@ -46,18 +46,18 @@ profile dhclient-script @{exec_path} { @{bin}/rm rix, @{bin}/run-parts rCx -> run-parts, @{bin}/sed rix, - @{sbin}/sysctl rix, + @{sbin}/sysctl rCx -> sysctl, @{bin}/tr rix, @{bin}/xxd rix, + @{etc_rw}/resolv.conf rw, + @{etc_rw}/resolv.conf.dhclient-new.@{pid} rw, + @{etc_rw}/samba/dhcp.conf{,.new} rw, /etc/default/ddclient r, /etc/dhcp/{,**} r, /etc/fstab r, /etc/iproute2/rt_tables r, /etc/iproute2/rt_tables.d/{,*} r, - @{etc_rw}/resolv.conf rw, - @{etc_rw}/resolv.conf.dhclient-new.@{pid} rw, - @{etc_rw}/samba/dhcp.conf{,.new} rw, /var/lib/dhcp/dhclient.leases r, /var/lib/samba/dhcp.conf{,.new} rw, @@ -71,7 +71,16 @@ profile dhclient-script @{exec_path} { @{sys}/devices/virtual/dmi/id/board_vendor r, owner @{PROC}/@{pid}/loginuid r, - @{PROC}/sys/net/ipv6/conf/*/stable_secret w, + + profile sysctl { + include + + @{sbin}/sysctl mr, + + @{PROC}/sys/net/ipv6/conf/*/stable_secret w, + + include if exists + } profile run-parts { include diff --git a/apparmor.d/profiles-a-f/dracut-install b/apparmor.d/profiles-a-f/dracut-install index 6deb06eb6..e99760a73 100644 --- a/apparmor.d/profiles-a-f/dracut-install +++ b/apparmor.d/profiles-a-f/dracut-install @@ -13,6 +13,8 @@ profile dracut-install @{exec_path} { @{exec_path} mr, + @{bin}/cp rix, + /etc/modprobe.d/{,**} r, @{sys}/devices/platform/{,**/} r, diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel index 41098ab4b..c46b5556e 100644 --- a/apparmor.d/profiles-g-l/kernel +++ b/apparmor.d/profiles-g-l/kernel @@ -67,6 +67,10 @@ profile kernel @{exec_path} { include include + capability sys_module, + + @{sys}/module/compression r, + include if exists } diff --git a/apparmor.d/profiles-g-l/lsb-release b/apparmor.d/profiles-g-l/lsb-release index 23bada3ec..d2d52d362 100644 --- a/apparmor.d/profiles-g-l/lsb-release +++ b/apparmor.d/profiles-g-l/lsb-release @@ -17,6 +17,7 @@ profile lsb-release @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, + @{bin}/ r, @{bin}/basename rix, @{bin}/cat rix, @{bin}/cut rix, diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index a4fc278f0..cae5c1c3d 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -17,7 +17,7 @@ profile initramfs-hooks @{exec_path} { @{sh_path} rix, @{coreutils_path} rix, @{bin}/cpio ix, - @{bin}/dpkg Cx -> child-dpkg, + @{bin}/dpkg Px, @{bin}/fc-cache ix, @{bin}/ischroot Px, @{bin}/ldd Cx -> ldd, diff --git a/apparmor.d/profiles-m-r/motd b/apparmor.d/profiles-m-r/motd index 67f216212..6cdb0fbf8 100644 --- a/apparmor.d/profiles-m-r/motd +++ b/apparmor.d/profiles-m-r/motd @@ -9,9 +9,13 @@ include @{exec_path} = /etc/update-motd.d/* profile motd @{exec_path} { include + include capability net_admin, + network inet6 stream, + network inet6 stream, + @{exec_path} mr, @{bin}/ r, @@ -44,7 +48,7 @@ profile motd @{exec_path} { /var/lib/ubuntu-advantage/messages/motd-esm-announce r, /var/lib/cloud/instances/nocloud/cloud-config.txt r, - # /tmp/tmp.@{rand10} rw, + /tmp/tmp.@{rand10} rw, @{run}/cloud-init/cloud.cfg r, @{run}/motd.d/{,*} r, @@ -62,6 +66,8 @@ profile motd @{exec_path} { include include + capability net_admin, + network inet dgram, network inet stream, network inet6 dgram, @@ -70,6 +76,8 @@ profile motd @{exec_path} { @{bin}/wget mr, + /etc/wgetrc r, + /tmp/tmp.@{rand10} rw, include if exists diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index b8f50ff7c..178bf28c6 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -38,10 +38,10 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { @{sys}/class/ r, @{sys}/class/drm/ r, @{sys}/class/power_supply/ r, + @{sys}/devices/**/status r, @{sys}/devices/**/power_supply/*/scope r, @{sys}/devices/**/uevent r, @{sys}/devices/system/cpu/*_pstate/{no_turbo,turbo_pct} r, - @{sys}/devices/system/cpu/*_pstate/status r, @{sys}/devices/system/cpu/cpu@{int}/power/energy_perf_bias rw, @{sys}/devices/system/cpu/cpufreq/ r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/* rw, diff --git a/apparmor.d/profiles-m-r/qdbus b/apparmor.d/profiles-m-r/qdbus index fa67bad97..6816079ac 100644 --- a/apparmor.d/profiles-m-r/qdbus +++ b/apparmor.d/profiles-m-r/qdbus @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/qdbus @{lib}/qt{5,6}/bin/qdbus profile qdbus @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/switcheroo-control b/apparmor.d/profiles-s-z/switcheroo-control index e1b9ab7de..eecb98b28 100644 --- a/apparmor.d/profiles-s-z/switcheroo-control +++ b/apparmor.d/profiles-s-z/switcheroo-control @@ -12,6 +12,7 @@ profile switcheroo-control @{exec_path} flags=(attach_disconnected) { include capability net_admin, + capability sys_admin, capability sys_nice, network netlink raw, diff --git a/apparmor.d/profiles-s-z/update-info-dir b/apparmor.d/profiles-s-z/update-info-dir index 7c835023f..fe06b32af 100644 --- a/apparmor.d/profiles-s-z/update-info-dir +++ b/apparmor.d/profiles-s-z/update-info-dir @@ -18,6 +18,8 @@ profile update-info-dir @{exec_path} { @{bin}/find ix, @{bin}/rm ix, + /etc/environment r, + include if exists } diff --git a/apparmor.d/profiles-s-z/whoopsie b/apparmor.d/profiles-s-z/whoopsie index 0c03f4a76..8a2c83904 100644 --- a/apparmor.d/profiles-s-z/whoopsie +++ b/apparmor.d/profiles-s-z/whoopsie @@ -10,10 +10,17 @@ include profile whoopsie @{exec_path} { include include + include capability setgid, capability setuid, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 dgram, + network netlink raw, + @{exec_path} mr, /var/crash/ r, @@ -22,6 +29,9 @@ profile whoopsie @{exec_path} { /var/lib/whoopsie/whoopsie-id rw, /var/lib/whoopsie/whoopsie-id.@{rand6} rw, + /var/crash/*.@{uid}.crash r, + owner /var/crash/*.@{uid}.uploaded rw, + owner @{run}/lock/whoopsie/ rw, owner @{run}/lock/whoopsie/lock rwk, diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd index 20575b2a8..fc6955793 100644 --- a/apparmor.d/profiles-s-z/wsdd +++ b/apparmor.d/profiles-s-z/wsdd @@ -27,6 +27,7 @@ profile wsdd @{exec_path} { owner /var/lib/libuuid/clock.txt rw, + @{run}/uuidd/request rw, owner @{run}/user/@{uid}/gvfsd/wsdd w, include if exists diff --git a/apparmor.d/profiles-s-z/xbrlapi b/apparmor.d/profiles-s-z/xbrlapi index 4ce252e10..b2f94975f 100644 --- a/apparmor.d/profiles-s-z/xbrlapi +++ b/apparmor.d/profiles-s-z/xbrlapi @@ -16,6 +16,8 @@ profile xbrlapi @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + owner @{HOME}/.xsession-errors w, + include if exists } From 4dba131fb38418b898a02aaec92e977fe7a0a4c7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 17:16:24 +0200 Subject: [PATCH 1224/1455] feat(profile): parser: move sysctl to its own subprofile. --- apparmor.d/groups/apparmor/apparmor.systemd | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/apparmor/apparmor.systemd b/apparmor.d/groups/apparmor/apparmor.systemd index cb862ff48..f58512a02 100644 --- a/apparmor.d/groups/apparmor/apparmor.systemd +++ b/apparmor.d/groups/apparmor/apparmor.systemd @@ -26,7 +26,7 @@ profile apparmor.systemd @{exec_path} { @{bin}/sed rix, @{bin}/cat rix, @{bin}/sort rix, - @{sbin}/sysctl rix, + @{sbin}/sysctl rCx -> sysctl, @{bin}/systemd-detect-virt rPx, @{bin}/xargs rix, @@ -43,10 +43,19 @@ profile apparmor.systemd @{exec_path} { @{PROC}/@{pids}/maps r, @{PROC}/@{pids}/mounts r, @{PROC}/mounts r, - @{PROC}/sys/kernel/apparmor_restrict_unprivileged_userns r, /dev/tty rw, + profile sysctl { + include + + @{sbin}/sysctl mr, + + @{PROC}/sys/kernel/apparmor_restrict_unprivileged_userns r, + + include if exists + } + include if exists } From ba16e3c3405d8d801dfbe332e1a77507be3ea879 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 17:20:08 +0200 Subject: [PATCH 1225/1455] feat(profile): cleanup log from well known programs. --- apparmor.d/groups/freedesktop/xdg-mime | 6 ++++++ apparmor.d/groups/utils/blkid | 5 +++-- apparmor.d/groups/utils/lspci | 4 +++- apparmor.d/profiles-g-l/gsettings | 8 ++++++++ 4 files changed, 20 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index 15b73a2d1..9e6dbc2e0 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -59,6 +59,12 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { /dev/tty rw, + # file_inherit + deny /opt/*/** r, + deny owner @{user_config_dirs}/*/** rw, + deny owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, + deny owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + profile bus flags=(complain) { include include diff --git a/apparmor.d/groups/utils/blkid b/apparmor.d/groups/utils/blkid index 3eee035fe..4105a7419 100644 --- a/apparmor.d/groups/utils/blkid +++ b/apparmor.d/groups/utils/blkid @@ -34,8 +34,6 @@ profile blkid @{exec_path} flags=(attach_disconnected) { @{run}/blkid/blkid.tab{,-@{rand6}} rw, @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab, - @{run}/cloud-init/ds-identify.log w, # file_inherit - @{PROC}/@{pid}/mounts r, @{PROC}/partitions r, @{PROC}/swaps r, @@ -47,6 +45,9 @@ profile blkid @{exec_path} flags=(attach_disconnected) { owner /dev/tty@{int} rw, + # file_inherit + deny @{run}/cloud-init/ds-identify.log w, + include if exists } diff --git a/apparmor.d/groups/utils/lspci b/apparmor.d/groups/utils/lspci index e8ba89298..c6ac0fdcd 100644 --- a/apparmor.d/groups/utils/lspci +++ b/apparmor.d/groups/utils/lspci @@ -45,7 +45,9 @@ profile lspci @{exec_path} flags=(attach_disconnected) { @{PROC}/cmdline r, @{PROC}/ioports r, - deny @{user_share_dirs}/gvfs-metadata/* r, + # file_inherit + deny owner @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_cache_dirs}/*/** rw, include if exists } diff --git a/apparmor.d/profiles-g-l/gsettings b/apparmor.d/profiles-g-l/gsettings index bbdb3da62..849599977 100644 --- a/apparmor.d/profiles-g-l/gsettings +++ b/apparmor.d/profiles-g-l/gsettings @@ -23,6 +23,14 @@ profile gsettings @{exec_path} flags=(attach_disconnected) { owner @{desktop_config_dirs}/dconf/user rw, owner @{DESKTOP_HOME}/greeter-dconf-defaults r, + # file_inherit + deny network netlink raw, + deny /etc/nsswitch.conf r, + deny /etc/passwd r, + deny /opt/*/** r, + deny owner @{user_config_dirs}/[^d]*/** rw, # all but dconf + deny owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + include if exists } From 7f9664c51f0aec674bee24a6460323b78e08735e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 17:51:10 +0200 Subject: [PATCH 1226/1455] feat(profile): add profile for mpris-proxy. --- apparmor.d/profiles-m-r/mpris-proxy | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 apparmor.d/profiles-m-r/mpris-proxy diff --git a/apparmor.d/profiles-m-r/mpris-proxy b/apparmor.d/profiles-m-r/mpris-proxy new file mode 100644 index 000000000..2f31aea79 --- /dev/null +++ b/apparmor.d/profiles-m-r/mpris-proxy @@ -0,0 +1,28 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/mpris-proxy +profile mpris-proxy @{exec_path} { + include + include + include + include + include + + #aa:dbus own bus=session name=org.mpris.MediaPlayer2 + dbus receive bus=session path=/ + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From 952c4e91a118d8a92f15fef49024665482a8f23d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 20:50:00 +0200 Subject: [PATCH 1227/1455] feat(aa): add aa --enforce and aa --complain. These are small dev tools, not installed by default. --- cmd/aa/main.go | 131 +++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 122 insertions(+), 9 deletions(-) diff --git a/cmd/aa/main.go b/cmd/aa/main.go index 5d32e9331..b0737de77 100644 --- a/cmd/aa/main.go +++ b/cmd/aa/main.go @@ -8,6 +8,9 @@ import ( "flag" "fmt" "os" + "os/exec" + "regexp" + "slices" "strings" "github.com/roddhjav/apparmor.d/pkg/aa" @@ -15,12 +18,14 @@ import ( "github.com/roddhjav/apparmor.d/pkg/paths" ) -const usage = `aa [-h] [--lint | --format | --tree] [-s] [-F file] [profiles...] +const usage = `aa [-h] [--lint | --format | --tree | --complain | --enfore] [-s] [-F file] [profiles...] Various AppArmor profiles development tools Options: -h, --help Show this help message and exit. + -e, --enforce Switch the given profile(s) to enforce mode. + -c, --complain Switch the given profile(s) to complain mode. -f, --format Format the AppArmor profiles. -l, --lint Lint the AppArmor profiles. -t, --tree Generate a tree of visited profiles. @@ -31,12 +36,19 @@ Options: // Command line options var ( - help bool - path string - systemd bool - lint bool - format bool - tree bool + help bool + path string + systemd bool + enforce bool + complain bool + lint bool + format bool + tree bool +) + +var ( + regFlags = regexp.MustCompile(`flags=\(([^)]+)\) `) + regProfileHeader = regexp.MustCompile(` {\n`) ) type kind uint8 @@ -60,6 +72,10 @@ func init() { flag.StringVar(&path, "file", "", "Set a logfile or a suffix to the default log file.") flag.BoolVar(&systemd, "s", false, "Parse systemd logs from journalctl.") flag.BoolVar(&systemd, "systemd", false, "Parse systemd logs from journalctl.") + flag.BoolVar(&enforce, "e", false, "Switch the given profile to enforce mode.") + flag.BoolVar(&enforce, "enforce", false, "Switch the given profile to enforce mode.") + flag.BoolVar(&complain, "c", false, "Switch the given profile to complain mode.") + flag.BoolVar(&complain, "complain", false, "Switch the given profile to complain mode.") } func getIndentationLevel(input string) int { @@ -111,7 +127,7 @@ func formatFile(kind kind, profile string) (string, error) { for idx, rules := range rulesByParagraph { aa.IndentationLevel = getIndentationLevel(paragraphs[idx]) rules = rules.Merge().Sort().Format() - profile = strings.ReplaceAll(profile, paragraphs[idx], rules.String()+"\n") + fmt.Printf(rules.String() + "\n") } return profile, nil } @@ -152,17 +168,95 @@ func aaFormat(files paths.PathList) error { return nil } +func aaLint(files paths.PathList) error { + for _, file := range files { + fmt.Printf("wip: %v\n", file) + } + return nil +} + +func setFlag(profile string, flag string) (string, error) { + f := aa.DefaultTunables() + if _, err := f.Parse(profile); err != nil { + return profile, err + } + + flags := f.GetDefaultProfile().Flags + switch flag { + case "enforce": + if len(flags) == 0 || slices.Contains(flags, "enforce") { + return profile, nil // Nothing to do + } + idx := slices.Index(flags, "complain") + if idx == -1 { + return profile, nil // No complain flag, nothing to do + } + flags = slices.Delete(flags, idx, idx+1) + + case "complain": + if slices.Contains(flags, "complain") { + return profile, nil // Nothing to do + } + flags = append(flags, "complain") + + default: + return profile, fmt.Errorf("unknown flag: %s", flag) + } + strFlags := " flags=(" + strings.Join(flags, ",") + ") {\n" + + // Remove all flags definition, then the new flags + profile = regFlags.ReplaceAllLiteralString(profile, "") + if len(flags) > 0 { + profile = regProfileHeader.ReplaceAllLiteralString(profile, strFlags) + } + return profile, nil +} + +func aaSetFlag(files paths.PathList, flag string) error { + for _, file := range files { + profile, err := file.ReadFileAsString() + if err != nil { + return err + } + profile, err = setFlag(profile, flag) + if err != nil { + return err + } + if err = file.WriteFile([]byte(profile)); err != nil { + return err + } + if err = reloadProfile(file); err != nil { + return err + } + } + return nil +} + func aaTree() error { return nil } +func reloadProfile(file *paths.Path) error { + cmd := exec.Command("apparmor_parser", "--replace", file.String()) + cmd.Stdout = os.Stdout + cmd.Stderr = os.Stderr + if err := cmd.Run(); err != nil { + return fmt.Errorf("apparmor_parser failed: %w", err) + } + return nil +} + func pathsFromArgs() (paths.PathList, error) { res := paths.PathList{} for _, arg := range flag.Args() { path := paths.New(arg) switch { case !path.Exist(): - return nil, fmt.Errorf("file %s not found", path) + if aa.MagicRoot.Join(arg).Exist() { + res = append(res, aa.MagicRoot.Join(arg)) + } else { + return nil, fmt.Errorf("file %s not found", path) + } case path.IsDir(): files, err := path.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories(), @@ -190,7 +284,26 @@ func main() { var err error var files paths.PathList switch { + case enforce: + files, err = pathsFromArgs() + if err != nil { + logging.Fatal("%s", err.Error()) + } + err = aaSetFlag(files, "enforce") + + case complain: + files, err = pathsFromArgs() + if err != nil { + logging.Fatal("%s", err.Error()) + } + err = aaSetFlag(files, "complain") + case lint: + files, err = pathsFromArgs() + if err != nil { + logging.Fatal("%s", err.Error()) + } + err = aaLint(files) case format: files, err = pathsFromArgs() From 24f629d326692965d2a17fe948f9500c04e5122b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 17 Aug 2025 21:43:23 +0200 Subject: [PATCH 1228/1455] fix(profile): few fixes related to reattached paths. See #816 --- apparmor.d/abstractions/common/app | 5 +++++ apparmor.d/groups/flatpak/flatpak | 1 + apparmor.d/groups/flatpak/flatpak-app | 2 ++ apparmor.d/groups/hyprland/hyprland | 2 +- 4 files changed, 9 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 3b425e505..b6e6734e6 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -114,6 +114,7 @@ @{PROC}/sys/kernel/sched_autogroup_enabled r, @{PROC}/sys/kernel/yama/ptrace_scope r, @{PROC}/sys/net/core/bpf_jit_enable r, + @{PROC}/sys/net/core/somaxconn r, @{PROC}/uptime r, @{PROC}/version r, @{PROC}/zoneinfo r, @@ -131,10 +132,14 @@ owner @{PROC}/@{pid}/net/if_inet6 r, owner @{PROC}/@{pid}/oom_score_adj rw, owner @{PROC}/@{pid}/pagemap r, + owner @{PROC}/@{pid}/smaps_rollup r, owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + @{att}/dev/dri/card@{int} rw, + @{att}/dev/dri/renderD128 rw, + @{att}/dev/dri/renderD129 rw, owner @{att}/dev/shm/@{uuid} r, /dev/hidraw@{int} rw, diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index fca84002a..6b671f0e0 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -85,6 +85,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain owner @{user_games_dirs}/{,**/} w, owner @{user_documents_dirs}/ w, + @{user_config_dirs}/dconf/user r, owner @{user_cache_dirs}/flatpak/{,**} rw, owner @{user_config_dirs}/pulse/client.conf r, owner @{user_config_dirs}/user-dirs.dirs r, diff --git a/apparmor.d/groups/flatpak/flatpak-app b/apparmor.d/groups/flatpak/flatpak-app index 4199e92b1..f2cd0295a 100644 --- a/apparmor.d/groups/flatpak/flatpak-app +++ b/apparmor.d/groups/flatpak/flatpak-app @@ -83,6 +83,8 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { /var/lib/flatpak/app/{,**} r, /var/lib/flatpak/exports/** rw, + owner @{att}/@{HOME}/.var/app/** rwlkmix, + @{run}/parent/** r, @{run}/parent/app/.ref rk, @{run}/parent/usr/.ref rk, diff --git a/apparmor.d/groups/hyprland/hyprland b/apparmor.d/groups/hyprland/hyprland index c1e6da4d8..cd3270e49 100644 --- a/apparmor.d/groups/hyprland/hyprland +++ b/apparmor.d/groups/hyprland/hyprland @@ -38,7 +38,7 @@ profile hyprland @{exec_path} flags=(attach_disconnected) { owner @{run}/user/@{uid}/.hyprpaper_* rw, owner @{run}/user/@{uid}/.hyprpicker_* rw, owner @{run}/user/@{uid}/hypr/{,**} rw, - owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + owner @{att}/dev/shm/.org.chromium.Chromium.@{rand6} rw, @{run}/systemd/sessions/@{int} r, From 5e5fde7741402aac6648f6ee6fa4f7bf531e9004 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Aug 2025 21:43:20 +0200 Subject: [PATCH 1229/1455] feat(abs): add the sqlite abstraction. --- apparmor.d/abstractions/common/app | 2 +- apparmor.d/abstractions/sqlite | 23 +++++++++++++++++++ apparmor.d/groups/gnome/gnome-music | 3 +-- apparmor.d/groups/gnome/localsearch | 4 +--- apparmor.d/groups/gnome/tracker-miner | 4 +--- apparmor.d/profiles-a-f/dropbox | 3 +-- apparmor.d/profiles-a-f/fractal | 2 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-g-l/gpo | 8 +++---- apparmor.d/profiles-g-l/gpodder | 4 +--- .../profiles-m-r/protonmail-bridge-core | 3 +-- apparmor.d/profiles-m-r/psi | 2 +- apparmor.d/profiles-m-r/psi-plus | 2 +- apparmor.d/profiles-m-r/quiterss | 3 +-- apparmor.d/profiles-s-z/strawberry | 2 +- apparmor.d/profiles-s-z/syncthing | 4 +--- apparmor.d/profiles-s-z/wechat-appimage | 4 +--- apparmor.d/tunables/multiarch.d/system | 3 --- 18 files changed, 41 insertions(+), 37 deletions(-) create mode 100644 apparmor.d/abstractions/sqlite diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index b6e6734e6..5072cadfd 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -28,6 +28,7 @@ include include include + include include include @@ -63,7 +64,6 @@ owner @{tmp}/** rmwk, owner /dev/shm/** rwlk -> /dev/shm/**, owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**, - owner /var/tmp/etilqs_@{sqlhex} rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/abstractions/sqlite b/apparmor.d/abstractions/sqlite new file mode 100644 index 000000000..690417f87 --- /dev/null +++ b/apparmor.d/abstractions/sqlite @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# SQlite temporary files (hexadecimal from 12 to 16 characters) + + abi , + + owner /var/tmp/etilqs_@{hex12} rw, + owner /var/tmp/etilqs_@{hex12}@{h} rw, + owner /var/tmp/etilqs_@{hex12}@{hex2} rw, + owner /var/tmp/etilqs_@{hex15} rw, + owner /var/tmp/etilqs_@{hex16} rw, + + owner @{tmp}/etilqs_@{hex12} rw, + owner @{tmp}/etilqs_@{hex12}@{h} rw, + owner @{tmp}/etilqs_@{hex12}@{hex2} rw, + owner @{tmp}/etilqs_@{hex15} rw, + owner @{tmp}/etilqs_@{hex16} rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-music b/apparmor.d/groups/gnome/gnome-music index 511a48987..2f9795ceb 100644 --- a/apparmor.d/groups/gnome/gnome-music +++ b/apparmor.d/groups/gnome/gnome-music @@ -17,6 +17,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { include include include + include include network inet stream, @@ -51,8 +52,6 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) { @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch index 88e2bf327..049b3c402 100644 --- a/apparmor.d/groups/gnome/localsearch +++ b/apparmor.d/groups/gnome/localsearch @@ -23,6 +23,7 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { include include include + include network netlink raw, @@ -56,9 +57,6 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/tracker3/files/ rw, owner @{user_cache_dirs}/tracker3/files/** rwk, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, - @{run}/mount/utab r, @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index d35f6467f..6b358c8b0 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -21,6 +21,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { include include include + include network netlink raw, @@ -63,9 +64,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_share_dirs}/applications/ r, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, - # Allow to search user files owner @{HOME}/{,**} r, owner @{MOUNTS}/{,**} r, diff --git a/apparmor.d/profiles-a-f/dropbox b/apparmor.d/profiles-a-f/dropbox index 15f86bcf5..f40d69799 100644 --- a/apparmor.d/profiles-a-f/dropbox +++ b/apparmor.d/profiles-a-f/dropbox @@ -23,6 +23,7 @@ profile dropbox @{exec_path} { include include include + include include @{exec_path} mr, @@ -61,8 +62,6 @@ profile dropbox @{exec_path} { # Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead owner @{tmp}/dropbox-antifreeze-* rw, owner @{tmp}/#@{int} rw, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, @{run}/systemd/users/@{uid} r, diff --git a/apparmor.d/profiles-a-f/fractal b/apparmor.d/profiles-a-f/fractal index 40001da68..a7222a664 100644 --- a/apparmor.d/profiles-a-f/fractal +++ b/apparmor.d/profiles-a-f/fractal @@ -13,6 +13,7 @@ profile fractal @{exec_path} flags=(attach_disconnected) { include include include + include include network inet dgram, @@ -34,7 +35,6 @@ profile fractal @{exec_path} flags=(attach_disconnected) { owner @{tmp}/.@{rand6} rw, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/@{rand6} rw, - owner @{tmp}/etilqs_@{sqlhex} rw, owner @{run}/user/@{uid}/fractal/{,**} rw, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 7a00455a6..58ba493cc 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -18,6 +18,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { include include include + include capability dac_override, capability dac_read_search, @@ -77,7 +78,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{MOUNTDIRS}/*/{,@{efi}/}EFI/{,**} r, /var/lib/flatpak/exports/share/mime/mime.cache r, - /var/tmp/etilqs_@{sqlhex} rw, owner /var/cache/fwupd/ rw, owner /var/cache/fwupd/** rwk, owner /var/lib/fwupd/ rw, diff --git a/apparmor.d/profiles-g-l/gpo b/apparmor.d/profiles-g-l/gpo index cebfc955f..46ff3eec5 100644 --- a/apparmor.d/profiles-g-l/gpo +++ b/apparmor.d/profiles-g-l/gpo @@ -11,10 +11,11 @@ include profile gpo @{exec_path} { include include - include include - include + include + include include + include network inet dgram, network inet6 dgram, @@ -36,9 +37,6 @@ profile gpo @{exec_path} { owner @{HOME}/gPodder/ rw, owner @{HOME}/gPodder/** rwk, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, - owner @{PROC}/@{pid}/fd/ r, include if exists diff --git a/apparmor.d/profiles-g-l/gpodder b/apparmor.d/profiles-g-l/gpodder index dd7a20eb7..e60034172 100644 --- a/apparmor.d/profiles-g-l/gpodder +++ b/apparmor.d/profiles-g-l/gpodder @@ -14,6 +14,7 @@ profile gpodder @{exec_path} { include include include + include include include @@ -47,9 +48,6 @@ profile gpodder @{exec_path} { owner @{HOME}/gPodder/ rw, owner @{HOME}/gPodder/** rwk, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, - owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index 45c6766e3..ca9680aea 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -17,6 +17,7 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) { include include include + include network inet dgram, network inet6 dgram, @@ -43,8 +44,6 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) { owner "@{user_config_dirs}/autostart/Proton Mail Bridge.desktop" rw, owner @{tmp}/bridge@{int} rw, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, @{PROC}/ r, @{PROC}/1/cgroup r, diff --git a/apparmor.d/profiles-m-r/psi b/apparmor.d/profiles-m-r/psi index 02bf3bc56..2ff7b4e71 100644 --- a/apparmor.d/profiles-m-r/psi +++ b/apparmor.d/profiles-m-r/psi @@ -18,6 +18,7 @@ profile psi @{exec_path} { include include include + include include include include @@ -54,7 +55,6 @@ profile psi @{exec_path} { owner @{user_share_dirs}/psi/** rwk, owner @{tmp}/#@{int} rw, - owner @{tmp}/etilqs_@{sqlhex} rw, owner @{tmp}/Psi.* rwl -> /tmp/#@{int}, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/profiles-m-r/psi-plus b/apparmor.d/profiles-m-r/psi-plus index a455df0e9..f72147cc6 100644 --- a/apparmor.d/profiles-m-r/psi-plus +++ b/apparmor.d/profiles-m-r/psi-plus @@ -18,6 +18,7 @@ profile psi-plus @{exec_path} { include include include + include include include include @@ -54,7 +55,6 @@ profile psi-plus @{exec_path} { owner @{user_share_dirs}/psi+/** rwk, owner @{tmp}/#@{int} rw, - owner @{tmp}/etilqs_@{sqlhex} rw, owner @{tmp}/Psi+.* rwl -> /tmp/#@{int}, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, diff --git a/apparmor.d/profiles-m-r/quiterss b/apparmor.d/profiles-m-r/quiterss index d1194abf5..73b8f7488 100644 --- a/apparmor.d/profiles-m-r/quiterss +++ b/apparmor.d/profiles-m-r/quiterss @@ -18,6 +18,7 @@ profile quiterss @{exec_path} { include include include + include include include @@ -47,8 +48,6 @@ profile quiterss @{exec_path} { owner @{tmp}/qtsingleapp-quiter-@{int}-@{int} rw, owner @{tmp}/qtsingleapp-quiter-@{int}-@{int}-lockfile rwk, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, @{PROC}/sys/kernel/random/boot_id r, owner @{PROC}/@{pid}/cmdline r, diff --git a/apparmor.d/profiles-s-z/strawberry b/apparmor.d/profiles-s-z/strawberry index 611c8462d..ae22e1f1d 100644 --- a/apparmor.d/profiles-s-z/strawberry +++ b/apparmor.d/profiles-s-z/strawberry @@ -21,6 +21,7 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include @@ -68,7 +69,6 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{tmp}/.*/s rw, owner @{tmp}/*= w, owner @{tmp}/#@{int} rw, - owner @{tmp}/etilqs_@{sqlhex} rw, owner @{tmp}/kdsingleapp-*-strawberry w, owner @{tmp}/kdsingleapp-*-strawberry.lock rwk, owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw, diff --git a/apparmor.d/profiles-s-z/syncthing b/apparmor.d/profiles-s-z/syncthing index 4553ac1e9..83e1b2f45 100644 --- a/apparmor.d/profiles-s-z/syncthing +++ b/apparmor.d/profiles-s-z/syncthing @@ -12,6 +12,7 @@ profile syncthing @{exec_path} { include include include + include include network inet dgram, @@ -35,9 +36,6 @@ profile syncthing @{exec_path} { /home/ r, @{user_sync_dirs}/{,**} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, - owner @{tmp}/etilqs_@{sqlhex} rw, - @{PROC}/@{pids}/net/route r, @{PROC}/bus/pci/devices r, @{PROC}/modules r, diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage index 98ce53f07..335860d07 100755 --- a/apparmor.d/profiles-s-z/wechat-appimage +++ b/apparmor.d/profiles-s-z/wechat-appimage @@ -19,6 +19,7 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) { include include include + include network netlink raw, network netlink dgram, @@ -59,9 +60,6 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) { owner @{user_documents_dirs}/xwechat_files/{,**} rwk, - owner @{tmp}/etilqs_@{sqlhex} rw, - owner /var/tmp/etilqs_@{sqlhex} rw, - /dev/fuse rw, /dev/tty rw, diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index 288665770..cf8575db0 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -56,9 +56,6 @@ # System Internal # --------------- -# SQlite temporary files (hexadecimal from 12 to 16 characters) -@{sqlhex}=@{hex12} @{hex12}@{h} @{hex12}@{hex2} @{hex15} @{hex16} - # Shortcut for PCI device @{pci_id}=@{hex}:@{hex2}:@{hex2}.@{h} @{pci_bus}=pci@{hex4}:@{hex2} From c806ec44eb43bd494672f990e49e29426eb087b1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Aug 2025 22:56:07 +0200 Subject: [PATCH 1230/1455] feat(profile): update virt profiles. --- apparmor.d/groups/virt/cockpit-bridge | 7 +++++++ apparmor.d/groups/virt/cockpit-session | 7 +++++++ apparmor.d/groups/virt/cockpit-ws | 4 +++- apparmor.d/groups/virt/dockerd | 9 +++++++++ apparmor.d/groups/virt/libvirt-dbus | 9 ++++++--- apparmor.d/groups/virt/libvirtd | 14 ++++++++++---- apparmor.d/groups/virt/virt-aa-helper | 24 ++++++++++++++++++++++-- apparmor.d/groups/virt/virtiofsd | 4 ++-- 8 files changed, 66 insertions(+), 12 deletions(-) diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index b6111750b..bf3d48204 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -9,6 +9,8 @@ include @{exec_path} = @{bin}/cockpit-bridge profile cockpit-bridge @{exec_path} { include + include + include include include include @@ -33,6 +35,9 @@ profile cockpit-bridge @{exec_path} { signal send set=term peer=unconfined, signal (send receive) set=term peer=cockpit-bridge//sudo, + #aa:dbus talk bus=session name=org.libvirt label=libvirt-dbus + #aa:dbus talk bus=system name=org.freedesktop.PackageKit path=/** label=packagekitd + @{exec_path} mr, @{bin}/cat ix, @@ -126,6 +131,8 @@ profile cockpit-bridge @{exec_path} { include include + @{run}/udev/data/n@{int} r, # For network interfaces + include if exists } diff --git a/apparmor.d/groups/virt/cockpit-session b/apparmor.d/groups/virt/cockpit-session index 8eafd25a0..3fbefadb7 100644 --- a/apparmor.d/groups/virt/cockpit-session +++ b/apparmor.d/groups/virt/cockpit-session @@ -14,10 +14,12 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) { include capability audit_write, + capability chown, capability dac_read_search, capability net_admin, capability setgid, capability setuid, + capability sys_resource, network netlink raw, @@ -26,6 +28,7 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) { @{shells_path} rix, @{bin}/cockpit-bridge rPx, @{lib}/cockpit/cockpit-pcp rPx, + @{bin}/ssh-agent rPx, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*.conf} r, @@ -47,6 +50,10 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) { /var/log/lastlog rw, /var/log/wtmp rwk, + /var/lib/lastlog/ r, + /var/lib/lastlog/lastlog2.db rwk, + /var/lib/lastlog/lastlog2.db-journal rw, + owner @{PROC}/@{pid}/loginuid rw, owner @{PROC}/@{pid}/uid_map r, @{PROC}/@{pids}/fd/ r, diff --git a/apparmor.d/groups/virt/cockpit-ws b/apparmor.d/groups/virt/cockpit-ws index 8e3478072..d4fb299fe 100644 --- a/apparmor.d/groups/virt/cockpit-ws +++ b/apparmor.d/groups/virt/cockpit-ws @@ -18,9 +18,11 @@ profile cockpit-ws @{exec_path} flags=(attach_disconnected) { @{lib}/cockpit/cockpit-session rPx, /usr/share/cockpit/{,**} r, + /etc/cockpit/ws-certs.d/{,**} r, /usr/share/pixmaps/{,**} r, - /etc/cockpit/ws-certs.d/ r, + /usr/share/plymouth/{,**} r, + @{run}/cockpit/session rw, @{run}/cockpit/wsinstance/https@@{hex64}.sock r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/virt/dockerd b/apparmor.d/groups/virt/dockerd index aa0a9ed58..0a214ccd1 100644 --- a/apparmor.d/groups/virt/dockerd +++ b/apparmor.d/groups/virt/dockerd @@ -69,6 +69,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { @{bin}/docker-init rCx -> init, @{lib}/docker/docker-init rCx -> init, @{bin}/docker-proxy rPx, + @{bin}/tini-static rCx -> tini, @{bin}/git rCx -> git, @{bin}/kmod rCx -> kmod, @{bin}/ps rPx, @@ -172,6 +173,14 @@ profile dockerd @{exec_path} flags=(attach_disconnected) { include if exists } + profile tini { + include + + @{bin}/tini-static mr, + + include if exists + } + profile init flags=(attach_disconnected) { include diff --git a/apparmor.d/groups/virt/libvirt-dbus b/apparmor.d/groups/virt/libvirt-dbus index 303e906c2..f3bbaf019 100644 --- a/apparmor.d/groups/virt/libvirt-dbus +++ b/apparmor.d/groups/virt/libvirt-dbus @@ -25,9 +25,12 @@ profile libvirt-dbus @{exec_path} { owner @{user_cache_dirs}/libvirt/libvirtd.lock rwk, - @{run}/user/@{uid}/libvirt/ rw, - @{run}/user/@{uid}/libvirt/libvirtd.lock rwk, - @{run}/user/@{uid}/libvirt/virtqemud.lock rwk, + @{run}/libvirt/libvirt-sock rw, + + @{run}/user/@{uid}/libvirt/ rw, + @{run}/user/@{uid}/libvirt/libvirtd.lock rwk, + @{run}/user/@{uid}/libvirt/virtqemud.lock rwk, + owner @{run}/user/@{uid}/libvirt/libvirt-sock rw, @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node*/meminfo r, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index fa3005a65..44d6962f5 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -19,6 +19,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -47,12 +48,12 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { capability sys_pacct, capability sys_ptrace, capability sys_rawio, - capability sys_resource, + capability sys_resource, # Needed for vfio - network inet stream, network inet dgram, - network inet6 stream, + network inet stream, network inet6 dgram, + network inet6 stream, network netlink raw, network packet dgram, network packet raw, @@ -146,7 +147,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { /etc/xml/catalog r, /var/cache/libvirt/{,**} rw, - /var/lib/libvirt/{,**} rwk, + /var/lib/libvirt/ rw, + /var/lib/libvirt/** rwk, /var/log/swtpm/libvirt/{,**} rw, # User VM images and share @@ -155,6 +157,9 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{user_vm_dirs}/{,**} rwk, @{user_publicshare_dirs}/{,**} rwk, + owner @{run}/user/@{uid}/libvirt/ rw, + owner @{run}/user/@{uid}/libvirt/** rwk, + @{att}/@{run}/systemd/inhibit/@{int}.ref rw, @{run}/libvirt/ rw, @@ -223,6 +228,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{PROC}/devices r, @{PROC}/mtrr w, @{PROC}/sys/net/ipv{4,6}/** rw, + @{PROC}/uptime r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/groups/virt/virt-aa-helper b/apparmor.d/groups/virt/virt-aa-helper index 53afe6012..b49368f07 100644 --- a/apparmor.d/groups/virt/virt-aa-helper +++ b/apparmor.d/groups/virt/virt-aa-helper @@ -21,14 +21,34 @@ profile virt-aa-helper @{exec_path} { @{sbin}/apparmor_parser rPx, - /etc/apparmor.d/libvirt/* r, + @{etc_rw}/apparmor.d/libvirt/* r, @{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} rw, + @{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid}.files rw, /etc/libnl{,-3}/classid r, # Allow reading libnl's classid file # System VM images /var/lib/libvirt/images/{,**} r, - /var/lib/nova/instances/_base/* r, + + # Openstack Nova base images & snapshots (LP: #907269 #1244694 #1644507) + /var/lib/nova/images/{,**} r, + /var/lib/nova/instances/_base/{,**} r, + /var/lib/nova/instances/snapshots/{,**} r, + /var/snap/nova-hypervisor/common/instances/_base/{,**} r, + /var/snap/nova-hypervisor/common/instances/snapshots/{,**} r, + + # Eucalyptus disks & loader (LP: #564914 #637544) + /var/lib/eucalyptus/instances/**/disk* r, + /var/lib/eucalyptus/instances/**/loader* r, + + # For uvtool + /var/lib/uvtool/libvirt/images/{,**} r, + + # For multipass + /var/snap/multipass/common/data/multipassd/vault/instances/{,**} r, + + # Common mount directories + @{MOUNTDIRS}/{,**} r, # User VM images @{user_share_dirs}/ r, diff --git a/apparmor.d/groups/virt/virtiofsd b/apparmor.d/groups/virt/virtiofsd index 899ecae04..ae7ac5fa9 100644 --- a/apparmor.d/groups/virt/virtiofsd +++ b/apparmor.d/groups/virt/virtiofsd @@ -6,8 +6,8 @@ abi , include -@{exec_path} = @{lib}/{,qemu/}virtiofsd @{bin}/virtiofsd -profile virtiofsd @{exec_path} { +@{exec_path} = @{lib}/virtiofsd @{lib}/qemu/virtiofsd @{bin}/virtiofsd +profile virtiofsd @{exec_path} flags=(attach_disconnected) { include userns, From f3d209e42a0abaabb0a34491b645f653fc035f16 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 19 Aug 2025 22:58:46 +0200 Subject: [PATCH 1231/1455] feat(profile): ensure nautilus can access root files. --- apparmor.d/groups/gvfs/gvfsd-admin | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/apparmor.d/groups/gvfs/gvfsd-admin b/apparmor.d/groups/gvfs/gvfsd-admin index 4f845f316..e1b16cac3 100644 --- a/apparmor.d/groups/gvfs/gvfsd-admin +++ b/apparmor.d/groups/gvfs/gvfsd-admin @@ -22,14 +22,15 @@ profile gvfsd-admin @{exec_path} { /usr/share/mime/mime.cache r, - @{MOUNTS}/{,**} rw, - - @{run}/mount/utab r, - @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, - - @{PROC}/@{pid}/fdinfo/@{int} r, - @{PROC}/@{pid}/mountinfo r, - @{PROC}/@{pid}/stat r, + #aa:lint ignore=too-wide + # Full access to system's data, but no write access to sensitive system directories + / r, + /*/ r, + /*/** rw, + deny @{sys}/** w, + deny @{PROC}/** w, + deny @{efi}/** w, + deny /dev/** w, include if exists } From 5d7646d9ccfe75becdb2276f77c03088b4cb8616 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Fri, 22 Aug 2025 14:05:34 +0200 Subject: [PATCH 1232/1455] Update mandb ALLOWED mandb exec @{bin}/bzip2 -> mandb//null-@{bin}/bzip2 comm=mandb requested_mask=x denied_mask=x ALLOWED mandb//null-@{bin}/bzip2 file_inherit /usr/share/man/man8/grub-btrfsd.8.bz2 comm=bzip2 requested_mask=r denied_mask=r ALLOWED mandb//null-@{bin}/bzip2 file_inherit /var/cache/man/52062 comm=bzip2 requested_mask=wr denied_mask=wr ALLOWED mandb//null-@{bin}/bzip2 file_mmap @{bin}/bzip2 comm=bzip2 requested_mask=r denied_mask=r ALLOWED mandb//null-@{bin}/bzip2 getattr /usr/share/man/man8/grub-btrfsd.8.bz2 comm=bzip2 requested_mask=r denied_mask=r ALLOWED mandb//null-@{bin}/bzip2 file_inherit /usr/share/man/man8/grub-btrfs.8.bz2 comm=bzip2 requested_mask=r denied_mask=r ALLOWED mandb//null-@{bin}/bzip2 getattr /usr/share/man/man8/grub-btrfs.8.bz2 comm=bzip2 requested_mask=r denied_mask=r --- apparmor.d/profiles-m-r/mandb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/profiles-m-r/mandb b/apparmor.d/profiles-m-r/mandb index cd825471d..551a6fec0 100644 --- a/apparmor.d/profiles-m-r/mandb +++ b/apparmor.d/profiles-m-r/mandb @@ -17,6 +17,8 @@ profile mandb @{exec_path} { @{exec_path} mr, + @{bin}/bzip2 rix, + /etc/man_db.conf r, /etc/manpath.config r, From 4d15570ff1dd23566ab4a9a79f84424791ef86e1 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Fri, 22 Aug 2025 14:20:06 +0200 Subject: [PATCH 1233/1455] Update grub-mkrelpath ALLOWED grub-mkrelpath open /tmp/grub-btrfs.byRQTjiteL/@_backup_2025-08-20T16:43@{busname}.488Z/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r ALLOWED grub-mkrelpath open /tmp/grub-btrfs.byRQTjiteL/@_backup_2025-08-18T13:49@{busname}.739Z/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r ALLOWED grub-mkrelpath open /tmp/grub-btrfs.byRQTjiteL/@_backup_2025-04-11T11@{busname}:58.643Z/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r ALLOWED grub-mkrelpath open /tmp/grub-btrfs.byRQTjiteL/@_backup_@{int16}5/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r ALLOWED grub-mkrelpath open /tmp/grub-btrfs.Xj00SFNAa3/@_backup_2025-08-20T16:43@{busname}.488Z/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r ALLOWED grub-mkrelpath open /tmp/grub-btrfs.Xj00SFNAa3/@_backup_2025-08-18T13:49@{busname}.739Z/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r ALLOWED grub-mkrelpath open /tmp/grub-btrfs.Xj00SFNAa3/@_backup_2025-04-11T11@{busname}:58.643Z/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r ALLOWED grub-mkrelpath open /tmp/grub-btrfs.Xj00SFNAa3/@_backup_@{int16}5/boot/ comm=grub-mkrelpath requested_mask=r denied_mask=r --- apparmor.d/groups/grub/grub-mkrelpath | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/grub/grub-mkrelpath b/apparmor.d/groups/grub/grub-mkrelpath index 789f68287..7b5f7eaa1 100644 --- a/apparmor.d/groups/grub/grub-mkrelpath +++ b/apparmor.d/groups/grub/grub-mkrelpath @@ -26,7 +26,7 @@ profile grub-mkrelpath @{exec_path} { /tmp/grub-btrfs.*/@snapshots/@{int}/snapshot/boot/ r, /tmp/grub-btrfs.*/@/.snapshots/@{int}/snapshot/boot/ r, - /tmp/grub-btrfs.*/@_backup_@{int}/boot/ r, + /tmp/grub-btrfs.*/@_backup_**/boot/ r, /tmp/grub-btrfs.*/ r, @{PROC}/@{pids}/mountinfo r, From 2c64ab91cb58f56590dd9b8a4cfb878da05769ba Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Fri, 22 Aug 2025 15:33:55 +0200 Subject: [PATCH 1234/1455] Update grub-mkrelpath --- apparmor.d/groups/grub/grub-mkrelpath | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/grub/grub-mkrelpath b/apparmor.d/groups/grub/grub-mkrelpath index 7b5f7eaa1..d4508b4c5 100644 --- a/apparmor.d/groups/grub/grub-mkrelpath +++ b/apparmor.d/groups/grub/grub-mkrelpath @@ -26,7 +26,7 @@ profile grub-mkrelpath @{exec_path} { /tmp/grub-btrfs.*/@snapshots/@{int}/snapshot/boot/ r, /tmp/grub-btrfs.*/@/.snapshots/@{int}/snapshot/boot/ r, - /tmp/grub-btrfs.*/@_backup_**/boot/ r, + /tmp/grub-btrfs.*/@_backup_*/boot/ r, /tmp/grub-btrfs.*/ r, @{PROC}/@{pids}/mountinfo r, From b3dd09ce0198d0724d1f43b099b4e205a5ec9b5b Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Fri, 22 Aug 2025 14:13:22 +0200 Subject: [PATCH 1235/1455] Update gnome-boxes ALLOWED gnome-boxes open /usr/share/ladspa/rdf/ comm=gst-plugin-scan requested_mask=r denied_mask=r ALLOWED gnome-boxes open /usr/share/ladspa/rdf/ladspa.rdfs comm=gst-plugin-scan requested_mask=r denied_mask=r ALLOWED gnome-boxes open /usr/share/ladspa/rdf/ladspa-rubberband.rdf comm=gst-plugin-scan requested_mask=r denied_mask=r ALLOWED gnome-boxes open @{sys}/devices/@{pci}/usb2/2-3/bConfigurationValue comm=gnome-boxes requested_mask=r denied_mask=r ALLOWED gnome-boxes open @{sys}/devices/@{pci}/usb1/1-6/1-6.2/bConfigurationValue comm=gnome-boxes requested_mask=r denied_mask=r ALLOWED gnome-boxes open @{sys}/devices/@{pci}/usb1/1-14/bConfigurationValue comm=gnome-boxes requested_mask=r denied_mask=r ALLOWED gnome-boxes open @{sys}/devices/@{pci}/usb1/1-13/bConfigurationValue comm=gnome-boxes requested_mask=r denied_mask=r --- apparmor.d/groups/gnome/gnome-boxes | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes index 2462c2071..16aa4e862 100644 --- a/apparmor.d/groups/gnome/gnome-boxes +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -36,6 +36,7 @@ profile gnome-boxes @{exec_path} { @{bin}/virsh rCx -> virsh, @{bin}/virtqemud rPUx, + /usr/share/ladspa/rdf/{,*} r, /usr/share/osinfo/{,**} r, /usr/share/gnome-boxes/{,**} r, @@ -55,6 +56,8 @@ profile gnome-boxes @{exec_path} { owner @{user_config_dirs}/gnome-boxes/ rw, owner @{user_config_dirs}/gnome-boxes/** rwk, + owner @{user_share_dirs}/gnome-boxes/images/ rw, + owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/*.iso-@{rand6} rw, owner @{tmp}/*.svg-@{rand6} rw, @@ -66,6 +69,7 @@ profile gnome-boxes @{exec_path} { @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + @{sys}/devices/@{pci}/usb@{int}/** r, owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-dbus*org.gnome.Boxes.slice/*/memory.* r, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, From ddee0512797143a1b31dbdf41c965234fc61f8b2 Mon Sep 17 00:00:00 2001 From: curiosityseeker <60518106+curiosityseeker@users.noreply.github.com> Date: Fri, 22 Aug 2025 15:35:42 +0200 Subject: [PATCH 1236/1455] Update gnome-boxes --- apparmor.d/groups/gnome/gnome-boxes | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes index 16aa4e862..1447715b7 100644 --- a/apparmor.d/groups/gnome/gnome-boxes +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -56,7 +56,8 @@ profile gnome-boxes @{exec_path} { owner @{user_config_dirs}/gnome-boxes/ rw, owner @{user_config_dirs}/gnome-boxes/** rwk, - owner @{user_share_dirs}/gnome-boxes/images/ rw, + owner @{user_share_dirs}/gnome-boxes/ rw, + owner @{user_share_dirs}/gnome-boxes/** rwk, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/*.iso-@{rand6} rw, From 8b49f9ebf5c85f2ca94a8e111b1161e2ebc258ff Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 17:52:57 +0200 Subject: [PATCH 1237/1455] feat(profile): update telegram path fix #821 --- apparmor.d/profiles-s-z/telegram-desktop | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-s-z/telegram-desktop b/apparmor.d/profiles-s-z/telegram-desktop index d967f4229..c1544af72 100644 --- a/apparmor.d/profiles-s-z/telegram-desktop +++ b/apparmor.d/profiles-s-z/telegram-desktop @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/telegram-desktop +@{exec_path} = @{bin}/telegram-desktop @{bin}/Telegram profile telegram-desktop @{exec_path} { include include @@ -35,10 +35,11 @@ profile telegram-desktop @{exec_path} { network netlink dgram, network netlink raw, - @{exec_path} mr, + @{exec_path} mrix, @{sh_path} rix, @{open_path} rPx -> child-open-strict, + @{bin}/systemd-detect-virt rPx, owner @{user_share_dirs}/TelegramDesktop/ rw, owner @{user_share_dirs}/TelegramDesktop/** rwlk -> @{user_share_dirs}/TelegramDesktop/**, From 0f017048e445cb21f764e480d332f64d79b0907d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 17:57:40 +0200 Subject: [PATCH 1238/1455] fix(profile): fix att path in flatpak fix #820 --- apparmor.d/groups/flatpak/flatpak | 2 ++ apparmor.d/groups/flatpak/flatpak-portal | 4 ++-- apparmor.d/groups/freedesktop/xdg-dbus-proxy | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index 6b671f0e0..4122e8055 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -77,6 +77,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain owner @{HOME}/.var/ w, owner @{HOME}/.var/app/{,**} rw, + owner @{att}/@{HOME}/.var/app/*/.local/share/*/logs/* rw, + owner @{att}/@{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, # Can create dotfile directories for any app owner @{user_cache_dirs}/*/ w, diff --git a/apparmor.d/groups/flatpak/flatpak-portal b/apparmor.d/groups/flatpak/flatpak-portal index 84e2d7964..ac1e41894 100644 --- a/apparmor.d/groups/flatpak/flatpak-portal +++ b/apparmor.d/groups/flatpak/flatpak-portal @@ -34,8 +34,8 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { owner /att/**/ r, owner @{att}/.flatpak-info r, - owner @{HOME}/.var/app/*/**/.ref rw, - owner @{HOME}/.var/app/*/**/logs/* rw, + owner @{att}/@{HOME}/.var/app/*/.local/share/*/logs/* rw, + owner @{att}/@{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, owner @{user_config_dirs}/user-dirs.dirs r, owner @{user_share_dirs}/mime/mime.cache r, diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index c6efaf360..be66f7484 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -29,8 +29,8 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, owner @{att}/@{HOME}/.var/app/** r, - owner @{HOME}/.var/app/*/.local/share/*/logs/* rw, - owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, + owner @{att}/@{HOME}/.var/app/*/.local/share/*/logs/* rw, + owner @{att}/@{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw, From e7a91b307e025498c37b15302f5c8e63d027938d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:01:31 +0200 Subject: [PATCH 1239/1455] fix(profile): fusermount with fsarchiver fix #817 --- apparmor.d/groups/filesystem/ntfs-3g | 2 ++ apparmor.d/profiles-a-f/fusermount | 1 + 2 files changed, 3 insertions(+) diff --git a/apparmor.d/groups/filesystem/ntfs-3g b/apparmor.d/groups/filesystem/ntfs-3g index d94d7a0f2..e4749177c 100644 --- a/apparmor.d/groups/filesystem/ntfs-3g +++ b/apparmor.d/groups/filesystem/ntfs-3g @@ -34,6 +34,8 @@ profile ntfs-3g @{exec_path} flags=(attach_disconnected) { mount fstype=fuseblk /dev/dm-[0-9]* -> @{MOUNTS}/, mount fstype=fuseblk /dev/dm-[0-9]* -> @{MOUNTS}/*/, + mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> /tmp/fsa/*/, # fsarchiver + umount @{MOUNTDIRS}/, umount @{MOUNTS}/, umount @{MOUNTS}/*/, diff --git a/apparmor.d/profiles-a-f/fusermount b/apparmor.d/profiles-a-f/fusermount index 3df041e64..a84b85322 100644 --- a/apparmor.d/profiles-a-f/fusermount +++ b/apparmor.d/profiles-a-f/fusermount @@ -30,6 +30,7 @@ profile fusermount @{exec_path} { umount /tmp/.mount_*/, umount @{run}/user/@{uid}/*/, umount /var/tmp/flatpak-cache-*/*/, + umount /tmp/fsa/*/, # fsarchiver @{exec_path} mr, From ec73d8349e1461995817bfeb5303dd85ea165543 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:05:05 +0200 Subject: [PATCH 1240/1455] fix(profile): gnome access to chromium shared. fix #806 --- apparmor.d/groups/gnome/gnome-shell | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 95874290f..0f91b7283 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -303,6 +303,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /tmp/.X@{int}-lock rw, /tmp/dbus-@{rand8} rw, owner @{tmp}/.org.chromium.Chromium.@{rand6} r, + owner @{tmp}/.org.chromium.Chromium.@{rand6}/ r, + owner @{tmp}/.org.chromium.Chromium.@{rand6}/status_icon_@{int}.png r, owner @{tmp}/@{rand6}.shell-extension.zip rw, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, From ba217a261ed39ad0ec20e909a89ac3618c8fd180 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:15:38 +0200 Subject: [PATCH 1241/1455] feat(profile): update flatpak profiles. --- apparmor.d/groups/flatpak/flatpak | 9 ++++----- apparmor.d/groups/flatpak/flatpak-app | 4 ++++ apparmor.d/groups/flatpak/flatpak-portal | 6 ++++++ 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index 4122e8055..c540b9db8 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -40,14 +40,12 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain signal send peer=flatpak-app, - #aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" + #aa:dbus talk bus=system name=org.freedesktop.Flatpak.SystemHelper label=flatpak-system-helper #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" - dbus send bus=session path=/org/freedesktop/portal/documents - interface=org.freedesktop.portal.Documents - member=GetMountPoint - peer=(name=org.freedesktop.portal.Documents, label="{xdg-document-portal,unconfined}"), + #aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper + #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal @{exec_path} mr, @@ -138,6 +136,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain @{bin}/gpgconf mr, @{bin}/gpgsm mr, @{bin}/gpg-agent rix, + @{lib}/gnupg/scdaemon rix, @{HOME}/@{XDG_GPG_DIR}/*.conf r, diff --git a/apparmor.d/groups/flatpak/flatpak-app b/apparmor.d/groups/flatpak/flatpak-app index f2cd0295a..e8fe195fb 100644 --- a/apparmor.d/groups/flatpak/flatpak-app +++ b/apparmor.d/groups/flatpak/flatpak-app @@ -48,6 +48,10 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { signal receive set=(int term) peer=flatpak-portal, signal receive set=(int term) peer=flatpak-session-helper, + unix type=seqpacket peer=(label=dbus-session), + # unix type=seqpacket peer=(label=unconfined), + unix type=seqpacket peer=(label=xdg-dbus-proxy), + @{bin}/** rmix, @{lib}/** rmix, /app/** rmix, diff --git a/apparmor.d/groups/flatpak/flatpak-portal b/apparmor.d/groups/flatpak/flatpak-portal index ac1e41894..b86f0a4fd 100644 --- a/apparmor.d/groups/flatpak/flatpak-portal +++ b/apparmor.d/groups/flatpak/flatpak-portal @@ -10,6 +10,7 @@ include profile flatpak-portal @{exec_path} flags=(attach_disconnected) { include include + include include capability sys_ptrace, @@ -22,6 +23,11 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.portal.Flatpak + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, @{bin}/flatpak rPx, From 2d3831221af1662619f74f10a208aff01c599665 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:16:43 +0200 Subject: [PATCH 1242/1455] feat(profile): update cups profiles. --- apparmor.d/groups/cups/cups-browsed | 5 ++++- apparmor.d/groups/cups/ippfind | 22 ++++++++++++++++++++++ apparmor.d/groups/cups/print-backends-cups | 19 +++++++++++++++++++ 3 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 apparmor.d/groups/cups/ippfind create mode 100644 apparmor.d/groups/cups/print-backends-cups diff --git a/apparmor.d/groups/cups/cups-browsed b/apparmor.d/groups/cups/cups-browsed index 9498f245a..a7773a57f 100644 --- a/apparmor.d/groups/cups/cups-browsed +++ b/apparmor.d/groups/cups/cups-browsed @@ -38,7 +38,7 @@ profile cups-browsed @{exec_path} { dbus receive bus=system path=/org/cups/cupsd/Notifier interface=org.cups.cupsd.Notifier - member=PrinterDeleted + member={PrinterDeleted,PrinterStopped} peer=(name=@{busname}, label=cups-notifier-dbus), @{exec_path} mr, @@ -52,7 +52,10 @@ profile cups-browsed @{exec_path} { /var/cache/cups/{,**} rw, /var/log/cups/{,**} rw, + owner @{tmp}/@{hex} rw, + @{run}/cups/certs/* r, + @{run}/avahi-daemon/socket rw, # TODO: in abs 'avahi' ? @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, diff --git a/apparmor.d/groups/cups/ippfind b/apparmor.d/groups/cups/ippfind new file mode 100644 index 000000000..c2a944b11 --- /dev/null +++ b/apparmor.d/groups/cups/ippfind @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ippfind +profile ippfind @{exec_path} { + include + include + include + + @{exec_path} mr, + + @{bin}/echo rix, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/cups/print-backends-cups b/apparmor.d/groups/cups/print-backends-cups new file mode 100644 index 000000000..6ab6007cb --- /dev/null +++ b/apparmor.d/groups/cups/print-backends-cups @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{lib}/@{multiarch}/print-backends/cups +profile print-backends-cups @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} + +# vim:syntax=apparmor From 46d4207d716dc895d2ec2405f80ea04fbc2bf336 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:22:59 +0200 Subject: [PATCH 1243/1455] feat(profile): makepkg: handle lsb_release and pager. --- apparmor.d/groups/pacman/makepkg | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg index 583d0b9c0..84136638c 100644 --- a/apparmor.d/groups/pacman/makepkg +++ b/apparmor.d/groups/pacman/makepkg @@ -29,9 +29,11 @@ profile makepkg @{exec_path} { file, + @{pager_path} Px -> child-pager, @{bin}/gpg{,2} Cx -> gpg, @{bin}/gpgconf Cx -> gpg, @{bin}/gpgsm Cx -> gpg, + @{bin}/lsb_release Px, @{bin}/sudo Cx -> sudo, deny capability sys_ptrace, From fb82d8d0d60f9c0bc7726c1084bbad3b1b2f26b2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:27:22 +0200 Subject: [PATCH 1244/1455] feat(profile): small gnome related improvement. --- apparmor.d/groups/gnome/evolution-addressbook-factory | 8 ++++---- apparmor.d/groups/gnome/gdm | 1 + apparmor.d/groups/gnome/gnome-extension-gsconnect | 1 + apparmor.d/groups/gnome/gnome-software | 1 + apparmor.d/groups/gnome/gsd-print-notifications | 4 ++-- apparmor.d/groups/gnome/papers | 4 ++++ apparmor.d/groups/network/ModemManager | 1 + apparmor.d/groups/network/mullvad-daemon | 1 + 8 files changed, 15 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index 3d83232e1..98c94c79e 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -30,7 +30,7 @@ profile evolution-addressbook-factory @{exec_path} { dbus (send, receive) bus=session path=/org/gnome/evolution/dataserver/** interface=org.gnome.evolution.dataserver.* - peer=(name=:*), + peer=(name=@{busname}), dbus send bus=session path=/org/gnome/evolution/dataserver/** interface=org.gnome.evolution.dataserver.* @@ -38,12 +38,12 @@ profile evolution-addressbook-factory @{exec_path} { dbus (send, receive) bus=session path=/org/gnome/evolution/dataserver/** interface=org.freedesktop.DBus.Properties - peer=(name=:*, label=evolution-*), + peer=(name=@{busname}, label=evolution-*), dbus send bus=session path=/org/gnome/evolution/dataserver/SourceManager interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name=:*, label=evolution-source-registry), + peer=(name=@{busname}, label=evolution-source-registry), dbus send bus=session path=/org/gnome/evolution/dataserver/** interface=org.freedesktop.DBus.Properties @@ -53,7 +53,7 @@ profile evolution-addressbook-factory @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, @{exec_path}-subprocess rix, diff --git a/apparmor.d/groups/gnome/gdm b/apparmor.d/groups/gnome/gdm index 435d055fa..4c84fe822 100644 --- a/apparmor.d/groups/gnome/gdm +++ b/apparmor.d/groups/gnome/gdm @@ -20,6 +20,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) { capability fsetid, capability kill, capability net_admin, + capability sys_admin, capability sys_nice, capability sys_tty_config, diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 64568eab0..8887ce797 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -72,6 +72,7 @@ profile gnome-extension-gsconnect @{exec_path} { owner @{tmp}/.org.chromium.Chromium.@{rand6} r, owner @{run}/user/@{uid}/gsconnect/{,**} rw, + owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, @{sys}/devices/virtual/dmi/id/chassis_type r, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index c10261c02..7e817f490 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -37,6 +37,7 @@ profile gnome-software @{exec_path} { /usr/share/app-info/{,**} r, /usr/share/appdata/{,**} r, + /usr/share/byobu/desktop/{,**} r, /usr/share/flatpak/remotes.d/ r, /usr/share/metainfo/{,**} r, /usr/share/swcatalog/{,**} r, diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index f8d4280a0..af5ff2f05 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -20,8 +20,8 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { network inet stream, network inet6 stream, - signal (receive) set=(term, hup) peer=gdm*, - signal (send) set=(hup) peer=gsd-printer, + signal receive set=(term, hup) peer=gdm*, + signal send set=(hup) peer=gsd-printer, #aa:dbus own bus=session name=org.gnome.SettingsDaemon.PrintNotifications diff --git a/apparmor.d/groups/gnome/papers b/apparmor.d/groups/gnome/papers index 27000b93a..6f5a137a3 100644 --- a/apparmor.d/groups/gnome/papers +++ b/apparmor.d/groups/gnome/papers @@ -25,6 +25,10 @@ profile papers @{exec_path} { owner @{user_share_dirs}/gvfs-metadata/{,*} r, + owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk, + owner @{HOME}/.mozilla/firefox/*/pkcs11.txt rw, + owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db-journal rw, + owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/papers-@{int}/{,**} rw, owner @{tmp}/gtkprint_@{rand6} rw, diff --git a/apparmor.d/groups/network/ModemManager b/apparmor.d/groups/network/ModemManager index 8220516bf..22b94effd 100644 --- a/apparmor.d/groups/network/ModemManager +++ b/apparmor.d/groups/network/ModemManager @@ -17,6 +17,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) { include capability net_admin, + capability sys_admin, network qipcrtr dgram, network netlink raw, diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index 735154b7e..d5c93fc5c 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -62,6 +62,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/net_cls/mullvad-exclusions/net_cls.classid rw, @{sys}/fs/cgroup/system.slice/cpu.max r, @{sys}/fs/cgroup/system.slice/mullvad-daemon.service/cpu.max r, + @{sys}/fs/cgroup/system.slice/mullvad-early-boot-blocking.service/cpu.max r, @{PROC}/@{pid}/cgroup r, @{PROC}/sys/net/ipv{4,6}/conf/all/arp_ignore rw, From b53e0b7d395ee15c7a79c6ce896e4d871d4103d4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:30:44 +0200 Subject: [PATCH 1245/1455] feat(abs): add the oneapi abs. --- apparmor.d/abstractions/oneapi | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 apparmor.d/abstractions/oneapi diff --git a/apparmor.d/abstractions/oneapi b/apparmor.d/abstractions/oneapi new file mode 100644 index 000000000..17225ef03 --- /dev/null +++ b/apparmor.d/abstractions/oneapi @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Intel oneAPI compiler libraries + + abi , + + /opt/intel/oneapi/{compiler,lib,mkl}/**/ r, + /opt/intel/oneapi/{compiler,lib,mkl}/**.so* mr, + + include if exists + +# vim:syntax=apparmor From 81636262f18b65bc1bf0b09a48fce1df6d9f7b0a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:42:38 +0200 Subject: [PATCH 1246/1455] feat(abs): add the java abstraction. --- apparmor.d/abstractions/java | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 apparmor.d/abstractions/java diff --git a/apparmor.d/abstractions/java b/apparmor.d/abstractions/java new file mode 100644 index 000000000..91472d21e --- /dev/null +++ b/apparmor.d/abstractions/java @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + /usr/share/java/{,**} r, + + /etc/java/{,**} r, + /etc/java-*/{,**} r, + + include if exists + +# vim:syntax=apparmor From fbb1768aa699b3f68c4d682b7dacfd362a1d091c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:46:26 +0200 Subject: [PATCH 1247/1455] feat(abs): add the amdgpu abstraction. --- apparmor.d/abstractions/amdgpu | 30 +++++++++++++++++++++++++++ apparmor.d/abstractions/graphics-full | 2 ++ 2 files changed, 32 insertions(+) create mode 100644 apparmor.d/abstractions/amdgpu diff --git a/apparmor.d/abstractions/amdgpu b/apparmor.d/abstractions/amdgpu new file mode 100644 index 000000000..181d86864 --- /dev/null +++ b/apparmor.d/abstractions/amdgpu @@ -0,0 +1,30 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Kernel Fusion Driver for AMD GPUs + + abi , + + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/ r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/properties r, + + @{sys}/devices/virtual/kfd/kfd/dev r, + @{sys}/devices/virtual/kfd/kfd/topology/ r, + @{sys}/devices/virtual/kfd/kfd/topology/generation_id r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/ r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/ r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/caches/@{int}/properties r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/gpu_id r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/io_links/@{int}/properties r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/mem_banks/@{int}/properties r, + @{sys}/devices/virtual/kfd/kfd/topology/nodes/@{int}/properties r, + @{sys}/devices/virtual/kfd/kfd/topology/system_properties r, + @{sys}/devices/virtual/kfd/kfd/uevent r, + @{sys}/module/amdgpu/initstate r, + + /dev/kfd rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/graphics-full b/apparmor.d/abstractions/graphics-full index eb60edb4d..1e2c97224 100644 --- a/apparmor.d/abstractions/graphics-full +++ b/apparmor.d/abstractions/graphics-full @@ -4,7 +4,9 @@ abi , + include include + include @{sys}/devices/@{pci}/numa_node r, From 0817911b579fa417a46fd03f9dbec5398bc3180e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 18:48:36 +0200 Subject: [PATCH 1248/1455] feat(abs): add more core abstractions They will at term replace the freedesktop abstraction. --- apparmor.d/abstractions/desktop-files | 22 ++++++++++++++++++++++ apparmor.d/abstractions/gsettings | 13 +++++++++++++ apparmor.d/abstractions/icons | 26 ++++++++++++++++++++++++++ apparmor.d/abstractions/mime | 17 +++++++++++++++++ 4 files changed, 78 insertions(+) create mode 100644 apparmor.d/abstractions/desktop-files create mode 100644 apparmor.d/abstractions/gsettings create mode 100644 apparmor.d/abstractions/icons create mode 100644 apparmor.d/abstractions/mime diff --git a/apparmor.d/abstractions/desktop-files b/apparmor.d/abstractions/desktop-files new file mode 100644 index 000000000..d616dad83 --- /dev/null +++ b/apparmor.d/abstractions/desktop-files @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2009 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + @{system_share_dirs}/applications/{,**} r, + @{system_share_dirs}/*ubuntu/applications/{,**} r, + @{system_share_dirs}/gnome/applications/{,**} r, + @{system_share_dirs}/xfce4/applications/{,**} r, + + /etc/gnome/defaults.list r, + /etc/xfce4/defaults.list r, + + /var/lib/snapd/desktop/applications/{,**} r, + + owner @{user_share_dirs}/applications/{,**} r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/gsettings b/apparmor.d/abstractions/gsettings new file mode 100644 index 000000000..788b14486 --- /dev/null +++ b/apparmor.d/abstractions/gsettings @@ -0,0 +1,13 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2009 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + @{system_share_dirs}/glib-2.0/schemas/ r, + @{system_share_dirs}/glib-2.0/schemas/gschemas.compiled r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/icons b/apparmor.d/abstractions/icons new file mode 100644 index 000000000..0dd44e33c --- /dev/null +++ b/apparmor.d/abstractions/icons @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2009 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + @{system_share_dirs}/icons/{,**} r, + @{system_share_dirs}/pixmaps/{,**} r, + + /opt/**/share/icons/{,**} r, + /opt/*/**.desktop r, + /opt/*/**/*.png r, + + /var/lib/snapd/desktop/icons/{,**} r, + + owner @{HOME}/.icons/{,**} r, + + owner @{user_config_dirs}/mimeapps.list r, + + owner @{user_share_dirs}/icons/{,**} r, + owner @{user_share_dirs}/mime/{,**} r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/mime b/apparmor.d/abstractions/mime new file mode 100644 index 000000000..6622c99dd --- /dev/null +++ b/apparmor.d/abstractions/mime @@ -0,0 +1,17 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2009 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + @{system_share_dirs}/ r, + @{system_share_dirs}/mime/{,**} r, + + /etc/mime.types r, + + owner @{user_share_dirs}/mime/mime.cache r, + + include if exists + +# vim:syntax=apparmor From 3b2f745bcaa126150e8f3f8f4bda6150a63e950c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 19:25:00 +0200 Subject: [PATCH 1249/1455] feat(abs): use the new core abs in desktop. --- apparmor.d/abstractions/desktop | 21 ++++++++------------- apparmor.d/abstractions/desktop-files | 5 +++++ apparmor.d/abstractions/gnome-strict | 14 +++++++------- apparmor.d/abstractions/gsettings | 1 + apparmor.d/abstractions/icons | 3 --- apparmor.d/abstractions/kde-strict | 10 +++++----- apparmor.d/abstractions/mime | 7 ++++++- apparmor.d/abstractions/recently-used | 21 +++++++++++++++++++++ 8 files changed, 53 insertions(+), 29 deletions(-) create mode 100644 apparmor.d/abstractions/recently-used diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 878f6f794..4a32a1aa7 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -9,10 +9,14 @@ abi , + include include - include + include include + include + include include + include include include include @@ -24,16 +28,11 @@ member=Introspect peer=(name=@{busname}, label=gnome-shell), - /usr/{local/,}share/ r, - /usr/{local/,}share/glib-@{version}/schemas/** r, - /usr/{local/,}share/gvfs/remote-volume-monitors/{,*} r, + @{system_share_dirs}/gvfs/remote-volume-monitors/{,*} r, /etc/gnome/* r, - /etc/xdg/{,*-}mimeapps.list r, - /var/cache/gio-@{version}/gnome-mimeapps.list r, - - / r, # deny? + / r, owner @{user_share_dirs}/gnome-shell/session.gvdb rw, @@ -49,8 +48,6 @@ /etc/xdg/kcminputrc r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, - /etc/xdg/menus/ r, - /etc/xdg/menus/applications-merged/ r, owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -65,8 +62,6 @@ owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kwinrc r, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_config_dirs}/session/ rw, owner @{user_config_dirs}/session/@{profile_name}* rwlk, owner @{user_config_dirs}/session/#@{int} rw, @@ -82,7 +77,7 @@ # end /usr/share/desktop-base/{,**} r, - /usr/share/hwdata/*.ids r, + /usr/share/hwdata/*.ids r, # FIXME: a bit too wide /usr/share/icu/@{int}.@{int}/*.dat r, include if exists diff --git a/apparmor.d/abstractions/desktop-files b/apparmor.d/abstractions/desktop-files index d616dad83..9c0a8b941 100644 --- a/apparmor.d/abstractions/desktop-files +++ b/apparmor.d/abstractions/desktop-files @@ -12,11 +12,16 @@ /etc/gnome/defaults.list r, /etc/xfce4/defaults.list r, + /etc/xdg/menus/ r, + /etc/xdg/menus/applications-merged/{,**} r, /var/lib/snapd/desktop/applications/{,**} r, owner @{user_share_dirs}/applications/{,**} r, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/{,**} r, + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index fadaedcbf..445c62e6b 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -4,9 +4,14 @@ abi , + include include - include + include include + include + include + include + include include include include @@ -20,14 +25,9 @@ /usr/share/hwdata/*.ids r, /usr/share/icu/@{int}.@{int}/*.dat r, - /usr/{local/,}share/ r, - /usr/{local/,}share/glib-@{int}.@{int}/schemas/** r, - /usr/{local/,}share/gvfs/remote-volume-monitors/{,*} r, + @{system_share_dirs}/gvfs/remote-volume-monitors/{,*} r, /etc/gnome/* r, - /etc/xdg/{,*-}mimeapps.list r, - - /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r, / r, diff --git a/apparmor.d/abstractions/gsettings b/apparmor.d/abstractions/gsettings index 788b14486..4d22f080b 100644 --- a/apparmor.d/abstractions/gsettings +++ b/apparmor.d/abstractions/gsettings @@ -5,6 +5,7 @@ abi , + @{system_share_dirs}/ r, @{system_share_dirs}/glib-2.0/schemas/ r, @{system_share_dirs}/glib-2.0/schemas/gschemas.compiled r, diff --git a/apparmor.d/abstractions/icons b/apparmor.d/abstractions/icons index 0dd44e33c..6a721b837 100644 --- a/apparmor.d/abstractions/icons +++ b/apparmor.d/abstractions/icons @@ -16,10 +16,7 @@ owner @{HOME}/.icons/{,**} r, - owner @{user_config_dirs}/mimeapps.list r, - owner @{user_share_dirs}/icons/{,**} r, - owner @{user_share_dirs}/mime/{,**} r, include if exists diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index fd994d12d..5fbdd7869 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -4,10 +4,14 @@ abi , + include include - include + include include + include + include include + include include include include @@ -26,8 +30,6 @@ /etc/xdg/kcminputrc r, /etc/xdg/kdeglobals r, /etc/xdg/kwinrc r, - /etc/xdg/menus/ r, - /etc/xdg/menus/applications-merged/ r, owner @{user_cache_dirs}/#@{int} rw, owner @{user_cache_dirs}/icon-cache.kcache rw, @@ -42,8 +44,6 @@ owner @{user_config_dirs}/kdedefaults/kwinrc r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kwinrc r, - owner @{user_config_dirs}/menus/ r, - owner @{user_config_dirs}/menus/applications-merged/ r, owner @{user_config_dirs}/session/ rw, owner @{user_config_dirs}/session/*_@{hex}_@{int}_@{int} rwlk, owner @{user_config_dirs}/session/#@{int} rw, diff --git a/apparmor.d/abstractions/mime b/apparmor.d/abstractions/mime index 6622c99dd..9a70edaf8 100644 --- a/apparmor.d/abstractions/mime +++ b/apparmor.d/abstractions/mime @@ -9,8 +9,13 @@ @{system_share_dirs}/mime/{,**} r, /etc/mime.types r, + /etc/xdg/{,*-}mimeapps.list r, - owner @{user_share_dirs}/mime/mime.cache r, + /var/cache/gio-@{version}/{,*-}-mimeapps.list r, + + owner @{user_config_dirs}/mimeapps.list r, + + owner @{user_share_dirs}/mime/{,**} r, include if exists diff --git a/apparmor.d/abstractions/recently-used b/apparmor.d/abstractions/recently-used new file mode 100644 index 000000000..d3a7ec289 --- /dev/null +++ b/apparmor.d/abstractions/recently-used @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2009 Canonical Ltd. +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + owner @{HOME}/.recently-used.xbel rw, + owner @{HOME}/.recently-used.xbel.@{rand6} rwl, + owner @{HOME}/.recently-used.xbel.lock rwk, + + owner @{user_share_dirs}/#@{int} rw, + owner @{user_share_dirs}/recently-used.xbel rw, + owner @{user_share_dirs}/recently-used.xbel.@{rand6} rwl, + owner @{user_share_dirs}/recently-used.xbel.lock rwk, + + owner @{user_config_dirs}/user-dirs.dirs r, # FIXME: not here? + + include if exists + +# vim:syntax=apparmor From 1506ae04d8c24763cc83779c14ff321afef458a2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 20:03:19 +0200 Subject: [PATCH 1250/1455] fix(profile): /att/**/ instead of @{att}/ --- apparmor.d/groups/freedesktop/pipewire | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index 97e3c6119..02a370cdc 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -40,7 +40,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { /etc/pipewire/{,**} r, / r, - @{att}/ r, + /att/**/ r, owner @{att}/.flatpak-info r, owner @{user_config_dirs}/pipewire/{,**} r, From cea9fd56141484f5bf3a2b6bf16970789f563e38 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 20:37:48 +0200 Subject: [PATCH 1251/1455] feat(profile): improve kde integration see #559 --- apparmor.d/groups/kde/DiscoverNotifier | 1 + apparmor.d/groups/kde/kded | 3 +++ apparmor.d/groups/kde/kioworker | 1 + .../groups/kde/kscreen_backend_launcher | 2 +- .../groups/kde/ksmserver-logout-greeter | 2 +- apparmor.d/groups/kde/kwalletd | 2 +- apparmor.d/groups/kde/kwin_wayland | 19 ++++++++++++++++++- apparmor.d/groups/kde/plasmashell | 7 ++++--- apparmor.d/groups/kde/sddm | 1 + apparmor.d/groups/kde/wayland-session | 3 +-- 10 files changed, 32 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 861132887..2307c709f 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -39,6 +39,7 @@ profile DiscoverNotifier @{exec_path} { @{bin}/gpgconf rCx -> gpg, @{bin}/gpgsm rCx -> gpg, + /usr/share/flatpak/remotes.d/{,**} r, /usr/share/metainfo/{,**} r, /etc/machine-id r, diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index f2f2489ab..e8be8a0dd 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -182,6 +182,9 @@ profile kded @{exec_path} { @{sys}/class/leds/ r, + @{run}/udev/data/b8:@{int} r, # for /dev/sd* + @{run}/udev/data/b259:@{int} r, # Block Extended Major + @{PROC}/ r, @{PROC}/@{pids}/cmdline/ r, @{PROC}/@{pids}/fd/ r, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 69b735310..71465df97 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -49,6 +49,7 @@ profile kioworker @{exec_path} { /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes{5,6}/*.desktop r, /usr/share/remoteview/* r, + /usr/share/thumbnailers/{,**} r, /etc/fstab r, /etc/xdg/kioslaverc r, diff --git a/apparmor.d/groups/kde/kscreen_backend_launcher b/apparmor.d/groups/kde/kscreen_backend_launcher index 7df07f64b..00b4c9630 100644 --- a/apparmor.d/groups/kde/kscreen_backend_launcher +++ b/apparmor.d/groups/kde/kscreen_backend_launcher @@ -13,8 +13,8 @@ profile kscreen_backend_launcher @{exec_path} { include include include + include include - include #aa:dbus own bus=session name=org.kde.KScreen #aa:dbus talk bus=system name=org.kde.kf5auth path=/ label=kde-powerdevil diff --git a/apparmor.d/groups/kde/ksmserver-logout-greeter b/apparmor.d/groups/kde/ksmserver-logout-greeter index 67e56c3c6..e5ea15c29 100644 --- a/apparmor.d/groups/kde/ksmserver-logout-greeter +++ b/apparmor.d/groups/kde/ksmserver-logout-greeter @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/ksmserver-logout-greeter @{exec_path} += @{lib}/@{multiarch}/{,libexec/}ksmserver-logout-greeter -profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected) { +profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index ad96cb512..de175635a 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -45,7 +45,7 @@ profile kwalletd @{exec_path} { owner @{user_share_dirs}/kwalletd/ rw, owner @{user_share_dirs}/kwalletd/** rwkl -> @{user_share_dirs}/kwalletd/#@{int}, - owner @{run}/user/@{uid}/kwallet{5,6}.socket r, + owner @{run}/user/@{uid}/kwallet{5,6}.socket rw, owner @{tmp}/kwalletd5.* rw, diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 243e0adfe..c11f951be 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/kwin_wayland -profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { +profile kwin_wayland @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include @@ -46,6 +46,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { /etc/xdg/Xwayland-session.d/00-at-spi Cx -> at-spi, /etc/xdg/Xwayland-session.d/00-pulseaudio-x11 Cx -> pulseaudio, + /etc/xdg/Xwayland-session.d/10-ibus-x11 Cx -> ibus, #aa:exec kscreenlocker_greet /usr/share/color-schemes/*.colors r, @@ -53,6 +54,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { /usr/share/kglobalaccel/{,**} r, /usr/share/kservices{5,6}/{,**} r, /usr/share/kservicetypes5/{,*.desktop} r, + /usr/share/kwin-wayland/{,**} r, /usr/share/kwin/{,**} r, /usr/share/libinput-*/{,**} r, /usr/share/libinput/{,**} r, @@ -179,6 +181,21 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) { include if exists } + profile ibus { + include + include + + @{sh_path} r, + @{lib}/{,ibus/}ibus-x11 rPx, + + /etc/xdg/Xwayland-session.d/10-ibus-x11 r, + + /home/ r, + owner @{HOME}/ r, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 68ea4fc0c..e767d7bb5 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -70,7 +70,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { @{lib}/libheif/{,**} mr, @{bin}/dolphin rPx, - @{bin}/ksysguardd rix, + @{bin}/ksysguardd rPUx, @{bin}/plasma-discover rPUx, @{bin}/xrdb rPx, @{lib}/kf{5,6}/kdesu{,d} rix, @@ -104,7 +104,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { /etc/appstream.conf r, /etc/fstab r, - /etc/ksysguarddrc r, /etc/machine-id r, /etc/os-release r, /etc/sensors.d/ r, @@ -166,6 +165,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_config_dirs}/klaunchrc r, owner @{user_config_dirs}/klipperrc r, owner @{user_config_dirs}/kmail2.notifyrc r, + owner @{user_config_dirs}/knfsshare r, owner @{user_config_dirs}/korganizerrc r, owner @{user_config_dirs}/krunnerrc r, owner @{user_config_dirs}/ksmserverrc r, @@ -200,9 +200,10 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_share_dirs}/wallpapers/{,**} rw, owner @{user_state_dirs}/#@{int} rw, + owner @{user_state_dirs}/plasma/* r, owner @{user_state_dirs}/plasmashellstaterc rw, - owner @{user_state_dirs}/plasmashellstaterc.lock rwk, owner @{user_state_dirs}/plasmashellstaterc.@{rand6} rwl, + owner @{user_state_dirs}/plasmashellstaterc.lock rwk, /tmp/.mount_nextcl@{rand6}/{,*} r, owner @{tmp}/#@{int} rw, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index b62116704..b9d07e380 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -92,6 +92,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/flatpak rPx, @{bin}/gnome-keyring-daemon rPx, @{bin}/Hyprland rPx, + @{bin}/ksecretd rPUx, @{bin}/kwalletd{5,6} rPx, @{bin}/kwin_wayland rPx, @{bin}/labwc rPx, diff --git a/apparmor.d/groups/kde/wayland-session b/apparmor.d/groups/kde/wayland-session index 56914137b..c07b06815 100644 --- a/apparmor.d/groups/kde/wayland-session +++ b/apparmor.d/groups/kde/wayland-session @@ -9,6 +9,7 @@ include @{exec_path} = @{etc_ro}/sddm/wayland-session profile wayland-session @{exec_path} { include + include include @{exec_path} mr, @@ -39,8 +40,6 @@ profile wayland-session @{exec_path} { owner @{user_share_dirs}/sddm/wayland-session.log rw, - /dev/tty rw, - include if exists } From f18fc88253b82ca04bb92c2b68f2efb75afc55b7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 20:39:18 +0200 Subject: [PATCH 1252/1455] feat(profile): kde: improve dbus rules. --- apparmor.d/groups/kde/baloorunner | 3 +++ apparmor.d/groups/kde/kaccess | 1 + apparmor.d/groups/kde/kactivitymanagerd | 1 + apparmor.d/groups/kde/kde-powerdevil | 1 + apparmor.d/groups/kde/kded | 1 + apparmor.d/groups/kde/kglobalacceld | 2 ++ apparmor.d/groups/kde/ksmserver-logout-greeter | 9 +++++++++ apparmor.d/groups/kde/ksplashqml | 1 + apparmor.d/groups/kde/kwin_wayland | 2 +- apparmor.d/groups/kde/sddm | 1 + 10 files changed, 21 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/kde/baloorunner b/apparmor.d/groups/kde/baloorunner index 702288a1f..64372f497 100644 --- a/apparmor.d/groups/kde/baloorunner +++ b/apparmor.d/groups/kde/baloorunner @@ -10,6 +10,9 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}baloorunner profile baloorunner @{exec_path} { include + include + include + include include include include diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index 65582d1ba..4b1e734ed 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -18,6 +18,7 @@ profile kaccess @{exec_path} { include #aa:dbus own bus=session name=org.kde.kaccess + #aa:dbus talk bus=session name=org.kde.kglobalaccel path=/kglobalaccel label=kglobalacceld @{exec_path} mr, diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index 1cc6b41d1..ead285e5f 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -11,6 +11,7 @@ include profile kactivitymanagerd @{exec_path} { include include + include include include include diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index c961ed7a3..01706e649 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -28,6 +28,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) network netlink raw, #aa:dbus own bus=system name=org.freedesktop.Policy.Power + #aa:dbus own bus=system name=org.kde.kf5auth path=/ #aa:dbus own bus=session name=local.org_kde_powerdevil #aa:dbus own bus=session name=org.freedesktop.PowerManagement diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index e8be8a0dd..93c70329e 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -68,6 +68,7 @@ profile kded @{exec_path} { #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd + #aa:dbus talk bus=session name=org.kde.NightColor path=/ColorCorrect label="{kwin_wayland,kwin_x11}" #aa:dbus talk bus=session name=org.kde.KGlobalAccel path=/ label="{kglobalacceld,kwin_wayland}" dbus receive bus=system path=/ diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index 156bdf928..b9c09d0c6 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -9,7 +9,9 @@ include @{exec_path} = @{bin}/kglobalaccel5 @{lib}/kglobalacceld profile kglobalacceld @{exec_path} { include + include include + include include #aa:dbus own bus=session name=org.kde.KGlobalAccel path=/kglobalaccel diff --git a/apparmor.d/groups/kde/ksmserver-logout-greeter b/apparmor.d/groups/kde/ksmserver-logout-greeter index e5ea15c29..e46237c2a 100644 --- a/apparmor.d/groups/kde/ksmserver-logout-greeter +++ b/apparmor.d/groups/kde/ksmserver-logout-greeter @@ -11,6 +11,10 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}ksmserver-logout-greeter profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected,mediate_deleted) { include + include + include + include + include include include include @@ -18,6 +22,11 @@ profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected,mediate include include + #aa:dbus own bus=session name=org.kde.LogoutPrompt path=/LogoutPrompt + + #aa:dbus talk bus=session name=org.kde.LogoutPrompt path=/Shutdown label=plasma-shutdown + #aa:dbus talk bus=session name=org.kde.KWin label=kwin_wayland + @{exec_path} mr, @{lib}/os-release r, diff --git a/apparmor.d/groups/kde/ksplashqml b/apparmor.d/groups/kde/ksplashqml index e1d5d7394..ea80e28cd 100644 --- a/apparmor.d/groups/kde/ksplashqml +++ b/apparmor.d/groups/kde/ksplashqml @@ -11,6 +11,7 @@ profile ksplashqml @{exec_path} { include include include + include include include include diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index c11f951be..51f09c8c4 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -35,7 +35,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected,mediate_deleted) { unix type=stream peer=(label=xwayland), #aa:dbus own bus=session name=org.freedesktop.ScreenSaver - #aa:dbus own bus=session name=org.kde.kglobalaccel + #aa:dbus own bus=session name=org.kde.kglobalaccel path=/kglobalaccel #aa:dbus own bus=session name=org.kde.KWin #aa:dbus own bus=session name=org.kde.NightColor path=/ColorCorrect #aa:dbus own bus=session name=org.kde.screensaver diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index b9d07e380..08835eaf0 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -55,6 +55,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus own bus=system name=org.freedesktop.DisplayManager #aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label="@{p_systemd_homed}" + #aa:dbus talk bus=system name=org.freedesktop.login1 interface=org.freedesktop.login1.Manager label="@{p_systemd_logind}" @{exec_path} mr, From 53df40b8ac3b95eab40ed8e4ffe41f9c4f52d2eb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 20:40:36 +0200 Subject: [PATCH 1253/1455] feat(profile) gvfs: more dbus integration. --- apparmor.d/groups/gvfs/gvfsd-dnssd | 5 +++++ apparmor.d/groups/gvfs/gvfsd-http | 1 + apparmor.d/groups/gvfs/gvfsd-network | 10 ++++++++++ apparmor.d/groups/gvfs/gvfsd-recent | 5 +++++ apparmor.d/groups/gvfs/gvfsd-sftp | 26 ++++++++++++++++++++++++++ apparmor.d/groups/gvfs/gvfsd-wsdd | 13 ++++++++++++- 6 files changed, 59 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/gvfs/gvfsd-dnssd b/apparmor.d/groups/gvfs/gvfsd-dnssd index 6c61dbba4..ab786106c 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dnssd +++ b/apparmor.d/groups/gvfs/gvfsd-dnssd @@ -38,6 +38,11 @@ profile gvfsd-dnssd @{exec_path} { member=Introspect peer=(name=@{busname}, label=gnome-shell), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, owner @{run}/user/@{uid}/gvfsd/ rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-http b/apparmor.d/groups/gvfs/gvfsd-http index 5812c8a6e..f51ef2afe 100644 --- a/apparmor.d/groups/gvfs/gvfsd-http +++ b/apparmor.d/groups/gvfs/gvfsd-http @@ -11,6 +11,7 @@ include profile gvfsd-http @{exec_path} { include include + include include include include diff --git a/apparmor.d/groups/gvfs/gvfsd-network b/apparmor.d/groups/gvfs/gvfsd-network index cd64d81ad..1af0a2b37 100644 --- a/apparmor.d/groups/gvfs/gvfsd-network +++ b/apparmor.d/groups/gvfs/gvfsd-network @@ -32,6 +32,16 @@ profile gvfsd-network @{exec_path} { member={MountLocation,LookupMount,RegisterMount} peer=(name="@{busname}", label=gvfsd), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + + dbus send bus=session path=/org/gtk/vfs/Daemon + interface=org.gtk.vfs.Daemon + member=GetConnection + peer=(name=@{busname}), + @{exec_path} mr, /usr/share/glib-2.0/schemas/gschemas.compiled r, diff --git a/apparmor.d/groups/gvfs/gvfsd-recent b/apparmor.d/groups/gvfs/gvfsd-recent index 042b66a68..1219c8cbd 100644 --- a/apparmor.d/groups/gvfs/gvfsd-recent +++ b/apparmor.d/groups/gvfs/gvfsd-recent @@ -33,6 +33,11 @@ profile gvfsd-recent @{exec_path} { member=RegisterMount peer=(name="@{busname}", label=gvfsd), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, # Full access to user's data diff --git a/apparmor.d/groups/gvfs/gvfsd-sftp b/apparmor.d/groups/gvfs/gvfsd-sftp index 157af621c..76bb55e98 100644 --- a/apparmor.d/groups/gvfs/gvfsd-sftp +++ b/apparmor.d/groups/gvfs/gvfsd-sftp @@ -10,10 +10,36 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-sftp profile gvfsd-sftp @{exec_path} { include + include + include include include include + #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} + + dbus receive bus=session path=/org/gtk/vfs/Daemon + interface=org.gtk.vfs.Daemon + member=GetConnection + peer=(name=@{busname}, label=gnome-extension-gsconnect), + dbus receive bus=session path=/org/gtk/vfs/Daemon + interface=org.gtk.vfs.Daemon + member=GetConnection + peer=(name=@{busname}, label=nautilus), + + dbus receive bus=session path=/org/gtk/vfs/mountable + interface=org.gtk.vfs.Mountable + member=Mount + peer=(name=:*, label=gvfsd), + dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} + interface=org.gtk.vfs.Spawner + member=Spawned + peer=(name=:*, label=gvfsd), + dbus send bus=session path=/org/gtk/vfs/mounttracker + interface=org.gtk.vfs.MountTracker + member=RegisterMount + peer=(name=:*, label=gvfsd), + @{exec_path} mr, @{bin}/ssh rPx, diff --git a/apparmor.d/groups/gvfs/gvfsd-wsdd b/apparmor.d/groups/gvfs/gvfsd-wsdd index 209971ac2..0dee4e73b 100644 --- a/apparmor.d/groups/gvfs/gvfsd-wsdd +++ b/apparmor.d/groups/gvfs/gvfsd-wsdd @@ -13,6 +13,7 @@ profile gvfsd-wsdd @{exec_path} { include include include + include network netlink raw, @@ -31,9 +32,19 @@ profile gvfsd-wsdd @{exec_path} { member=RegisterMount peer=(name="@{busname}", label=gvfsd), + dbus receive bus=session path=/org/gtk/vfs/Daemon + interface=org.gtk.vfs.Daemon + member=GetConnection + peer=(name=@{busname}, label=gvfsd-network), + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, - @{bin}/env r, + @{bin}/env mr, @{bin}/wsdd rPx, @{run}/mount/utab r, From 15b8a6cea4dbdbd34a103f643ea13b085e424987 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 22 Aug 2025 21:22:25 +0200 Subject: [PATCH 1254/1455] fix: linter issue. --- apparmor.d/groups/kde/kwin_wayland | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index 51f09c8c4..e2e3ecfe0 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -184,7 +184,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected,mediate_deleted) { profile ibus { include include - + @{sh_path} r, @{lib}/{,ibus/}ibus-x11 rPx, From bfe35f254e31557bdc75f08a6c0f02f005291b75 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 23 Aug 2025 17:40:48 +0200 Subject: [PATCH 1255/1455] feat(profile): small improvement for snap. --- apparmor.d/groups/snap/snap | 16 +++++++++++----- apparmor.d/groups/snap/snap-seccomp | 6 +++++- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap index ef0a086a8..564fd9151 100644 --- a/apparmor.d/groups/snap/snap +++ b/apparmor.d/groups/snap/snap @@ -18,6 +18,8 @@ profile snap @{exec_path} flags=(attach_disconnected) { include include + capability chown, + capability dac_override, capability dac_read_search, capability setuid, capability sys_admin, @@ -70,10 +72,10 @@ profile snap @{exec_path} flags=(attach_disconnected) { @{DESKTOP_HOME}/snap/{,**} rw, /snap/{,**} rw, - @{HOME}/snap/{,**} rw, - owner @{HOME}/ r, - owner @{HOME}/.snap.mkdir-new/ rw, - owner @{HOME}/.snap/{,**} rw, + @{HOME}/ r, + @{HOME}/.snap.mkdir-new/ rw, + @{HOME}/.snap/{,**} rw, + @{HOME}/snap/{,**} rw, owner @{tmp}/snapd-auto-import-mount-@{int}/ rw, @@ -102,7 +104,11 @@ profile snap @{exec_path} flags=(attach_disconnected) { /dev/tty@{int} rw, /dev/ttyS@{int} rw, - deny @{user_share_dirs}/gvfs-metadata/* r, + /apparmor/.null rw, + + # file_inherit, safe to deny + deny owner @{user_share_dirs}/gvfs-metadata/* r, + deny owner @{user_share_dirs}/gnome-shell/session.gvdb rw, profile gpg { include diff --git a/apparmor.d/groups/snap/snap-seccomp b/apparmor.d/groups/snap/snap-seccomp index 9605c544a..2a14fd583 100644 --- a/apparmor.d/groups/snap/snap-seccomp +++ b/apparmor.d/groups/snap/snap-seccomp @@ -27,7 +27,11 @@ profile snap-seccomp @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pids}/mountinfo r, - deny @{user_share_dirs}/gvfs-metadata/* r, + /apparmor/.null rw, + + # file_inherit, safe to deny + deny owner @{user_share_dirs}/gnome-shell/session.gvdb rw, + deny owner @{user_share_dirs}/gvfs-metadata/* r, include if exists } From 7b0a78b1f13743eae7f59efbaf501654955e7372 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 23 Aug 2025 17:42:49 +0200 Subject: [PATCH 1256/1455] feat(abs): improve dbus core abstractions --- apparmor.d/abstractions/bus/org.freedesktop.Accounts | 4 ++-- apparmor.d/abstractions/bus/org.freedesktop.Avahi | 2 +- .../abstractions/bus/org.freedesktop.portal.Desktop | 10 +++++----- apparmor.d/abstractions/bus/org.freedesktop.secrets | 4 ++-- .../abstractions/bus/org.gnome.Mutter.IdleMonitor | 4 ++-- apparmor.d/abstractions/bus/org.gnome.SessionManager | 5 +++++ apparmor.d/abstractions/bus/org.gtk.Notifications | 2 +- apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker | 2 +- 8 files changed, 19 insertions(+), 14 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Accounts b/apparmor.d/abstractions/bus/org.freedesktop.Accounts index d15288d46..e77f17b88 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Accounts +++ b/apparmor.d/abstractions/bus/org.freedesktop.Accounts @@ -8,8 +8,8 @@ dbus send bus=system path=/org/freedesktop/Accounts interface=org.freedesktop.Accounts - member={FindUserByName,ListCachedUsers} - peer=(name="@{busname}", label="@{p_accounts_daemon}"), + member={FindUserByName,ListCachedUsers,FindUserById} + peer=(name="{@{busname},org.freedesktop.Accounts}", label="@{p_accounts_daemon}"), dbus receive bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.Accounts.User diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Avahi b/apparmor.d/abstractions/bus/org.freedesktop.Avahi index aa48e69b1..4ddf95af3 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.Avahi +++ b/apparmor.d/abstractions/bus/org.freedesktop.Avahi @@ -23,7 +23,7 @@ dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} interface=org.freedesktop.Avahi.ServiceBrowser - member={ItemNew,AllForNow,CacheExhausted} + member={ItemNew,ItemRemove,AllForNow,CacheExhausted} peer=(name="@{busname}", label="@{p_avahi_daemon}"), dbus receive bus=system path=/ diff --git a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop index 2753a6602..4d4faf688 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop +++ b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop @@ -14,22 +14,22 @@ dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Settings member={Read,ReadAll} - peer=(name="@{busname}", label=xdg-desktop-portal), + peer=(name=@{busname}, label=xdg-desktop-portal), dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Settings member=SettingChanged - peer=(name="@{busname}", label=xdg-desktop-portal), + peer=(name=@{busname}, label=xdg-desktop-portal), - dbus receive bus=session path=/org/freedesktop/portal/desktop + dbus receive bus=session path=/org/freedesktop/portal/desktop{,/**} interface=org.freedesktop.DBus.Properties member={Get,GetAll} - peer=(name="@{busname}", label=xdg-desktop-portal), + peer=(name=@{busname}, label=xdg-desktop-portal), dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.impl.portal.Settings member={Read,ReadAll} - peer=(name="@{busname}", label=xdg-desktop-portal), + peer=(name=@{busname}, label=xdg-desktop-portal), dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.host.portal.Registry diff --git a/apparmor.d/abstractions/bus/org.freedesktop.secrets b/apparmor.d/abstractions/bus/org.freedesktop.secrets index a2389a68a..e30e7b1c2 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.secrets +++ b/apparmor.d/abstractions/bus/org.freedesktop.secrets @@ -8,8 +8,8 @@ dbus send bus=session path=/org/freedesktop/secrets interface=org.freedesktop.Secret.Service - member={OpenSession,GetSecrets,SearchItems,ReadAlias} - peer=(name="@{busname}", label=gnome-keyring-daemon), + member={OpenSession,GetSecrets,SearchItems,Unlock,ReadAlias} + peer=(name="{@{busname},org.freedesktop.secrets}", label=gnome-keyring-daemon), dbus send bus=session path=/org/freedesktop/secrets/aliases/default interface=org.freedesktop.Secret.Collection diff --git a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor index 3eb301f18..8eb573f7e 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor +++ b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor @@ -13,8 +13,8 @@ dbus send bus=session path=/org/gnome/Mutter/IdleMonitor/Core interface=org.gnome.Mutter.IdleMonitor - member={AddIdleWatch,AddUserActiveWatch,RemoveWatch} - peer=(name="@{busname}", label=gnome-shell), + member={AddIdleWatch,AddUserActiveWatch,RemoveWatch,GetIdletime} + peer=(name="@{busname},org.gnome.Mutter.IdleMonitor", label=gnome-shell), dbus receive bus=session path=/org/gnome/Mutter/IdleMonitor/Core interface=org.gnome.Mutter.IdleMonitor diff --git a/apparmor.d/abstractions/bus/org.gnome.SessionManager b/apparmor.d/abstractions/bus/org.gnome.SessionManager index 0683a98fb..a532b67f2 100644 --- a/apparmor.d/abstractions/bus/org.gnome.SessionManager +++ b/apparmor.d/abstractions/bus/org.gnome.SessionManager @@ -13,6 +13,11 @@ member={RegisterClient,IsSessionRunning} peer=(name="@{busname}", label=gnome-session-binary), + dbus send bus=session path=/org/gnome/SessionManager + interface=org.gnome.SessionManager + member={Inhibit,Uninhibit} + peer=(name="@{busname}", label=gnome-session-binary), + dbus send bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={Setenv,IsSessionRunning} diff --git a/apparmor.d/abstractions/bus/org.gtk.Notifications b/apparmor.d/abstractions/bus/org.gtk.Notifications index b9229f204..ad1a1ffad 100644 --- a/apparmor.d/abstractions/bus/org.gtk.Notifications +++ b/apparmor.d/abstractions/bus/org.gtk.Notifications @@ -8,7 +8,7 @@ dbus send bus=session path=/org/gtk/Notifications interface=org.gtk.Notifications - member=RemoveNotification + member={AddNotification,RemoveNotification} peer=(name=org.gtk.Notifications, label=gnome-shell), include if exists diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker b/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker index d88afd0ee..c455d4f18 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker @@ -21,7 +21,7 @@ dbus receive bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker - member=Mounted + member={Mounted,Unmounted} peer=(name="@{busname}", label=gvfsd), include if exists From e9f0b77f2d00d748841dd78832368671a3549936 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 23 Aug 2025 18:59:08 +0200 Subject: [PATCH 1257/1455] feat(profile): update btop. --- apparmor.d/profiles-a-f/btop | 42 ++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/apparmor.d/profiles-a-f/btop b/apparmor.d/profiles-a-f/btop index bab483dde..4910629ce 100644 --- a/apparmor.d/profiles-a-f/btop +++ b/apparmor.d/profiles-a-f/btop @@ -10,15 +10,16 @@ include profile btop @{exec_path} { include include - include include + capability kill, + capability perfmon, capability sys_ptrace, network netlink raw, - signal (send), - ptrace (read), + signal send, + ptrace read, @{exec_path} mr, @@ -27,33 +28,42 @@ profile btop @{exec_path} { /etc/fstab r, owner @{user_config_dirs}/btop/{,**} rw, + owner @{user_state_dirs}/btop.log rw, @{sys}/bus/pci/devices/ r, @{sys}/class/hwmon/ r, @{sys}/class/power_supply/ r, - @{sys}/devices/@{pci}/**/stat r, + @{sys}/devices/@{pci}/ r, + @{sys}/devices/@{pci}/{,**}/ r, @{sys}/devices/@{pci}/net/*/{,**} r, + @{sys}/devices/@{pci}/nvme/nvme@{int}/ r, + @{sys}/devices/@{pci}/stat r, @{sys}/devices/@{pci}/usb@{int}/**/power_supply/** r, @{sys}/devices/**/hwmon@{int}/{,*} r, @{sys}/devices/**/power_supply/{AC,BAT@{int}}/{,**} r, + @{sys}/devices/*/events/{,*} r, + @{sys}/devices/platform/*/ r, + @{sys}/devices/power/{,**} r, @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{cur,min,max}_freq r, @{sys}/devices/system/node/node@{int}/cpumap r, @{sys}/devices/virtual/block/dm-@{int}/stat r, @{sys}/devices/virtual/net/{,**} r, @{sys}/devices/virtual/thermal/thermal_zone@{int}/{,} r, - @{PROC} r, - @{PROC}/@{pid}/statm r, - @{PROC}/@{pids}/cmdline r, - @{PROC}/@{pids}/comm r, - @{PROC}/@{pids}/io r, - @{PROC}/@{pids}/stat r, - @{PROC}/devices r, - @{PROC}/driver/nvidia/capabilities/mig/monitor r, - @{PROC}/loadavg r, - @{PROC}/spl/kstat/zfs/arcstats r, - @{PROC}/uptime r, - owner @{PROC}/@{pid}/mounts r, + @{PROC} r, + @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/comm r, + @{PROC}/@{pids}/io r, + @{PROC}/@{pids}/mounts r, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/statm r, + @{PROC}/@{pids}/task/@{tid}/comm rw, + @{PROC}/devices r, + @{PROC}/driver/nvidia/capabilities/mig/config r, + @{PROC}/driver/nvidia/capabilities/mig/monitor r, + @{PROC}/loadavg r, + @{PROC}/spl/kstat/zfs/arcstats r, + @{PROC}/uptime r, /dev/nvidia-caps/ rw, /dev/nvidia-caps/nvidia-cap@{int} rw, From d6885803cbfe3d420b1eb15b9562aae68228ad9a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 21:32:51 +0200 Subject: [PATCH 1258/1455] fear(abs): update dbus core abs. --- .../bus/org.freedesktop.ColorManager | 7 ++++ .../bus/org.freedesktop.FileManager1 | 5 +++ .../abstractions/bus/org.freedesktop.UPower | 10 ++++- .../bus/org.freedesktop.hostname1 | 1 + .../bus/org.freedesktop.portal.Desktop | 15 +++++++ .../abstractions/bus/org.freedesktop.resolve1 | 6 +-- .../bus/org.gnome.Mutter.IdleMonitor | 2 +- .../bus/org.gnome.Shell.SearchProvider2 | 10 +++++ .../abstractions/bus/org.gtk.vfs.Daemon | 2 +- .../bus/org.kde.StatusNotifierItem | 24 +++++++++++ .../bus/org.kde.StatusNotifierWatcher | 42 ++++++++++++++++++- .../bus/org.mpris.MediaPlayer2.Player | 31 ++++++++------ 12 files changed, 135 insertions(+), 20 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager index 3a63d95dc..e23092429 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Allow for color managed applications to communicate with colord + abi , #aa:dbus common bus=system name=org.freedesktop.ColorManager label="@{p_colord}" @@ -21,6 +23,11 @@ member={DeviceAdded,DeviceRemoved} peer=(name="@{busname}", label="@{p_colord}"), + dbus (receive, send) bus=system path=/org/freedesktop/ColorManager + interface=org.freedesktop.ColorManager + member=FindDeviceByProperty + peer=(name="@{busname}", label="@{p_colord}"), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 b/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 index 76095edaf..a08c98b26 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.FileManager1 @@ -6,6 +6,11 @@ #aa:dbus common bus=session name=org.freedesktop.FileManager1 label=nautilus + dbus send bus=session path=/org/freedesktop/FileManager1 + interface=org.freedesktop.FileManager1 + member=ShowItems + peer=(name=org.freedesktop.FileManager1, label=nautilus), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower b/apparmor.d/abstractions/bus/org.freedesktop.UPower index d82fbdef0..64b400a3e 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower +++ b/apparmor.d/abstractions/bus/org.freedesktop.UPower @@ -2,10 +2,13 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Can query UPower for power devices, history and statistics. + abi , #aa:dbus common bus=system name=org.freedesktop.UPower label="@{p_upowerd}" + # Find all devices monitored by UPower dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.UPower member=EnumerateDevices @@ -13,7 +16,12 @@ dbus send bus=system path=/org/freedesktop/UPower interface=org.freedesktop.DBus.Properties - member=GetDisplayDevice + member={GetDisplayDevice,GetCriticalAction} + peer=(name=org.freedesktop.UPower, label="@{p_upowerd}"), + + dbus send bus=system path=/org/freedesktop/UPower/devices/** + interface=org.freedesktop.UPower.Device + member={GetHistory,Refresh} peer=(name=org.freedesktop.UPower, label="@{p_upowerd}"), dbus receive bus=system path=/org/freedesktop/UPower diff --git a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 index 0a8d86be1..165e3ae6e 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.hostname1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.hostname1 @@ -5,6 +5,7 @@ abi , #aa:dbus common bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}" + dbus send bus=system path=/org/freedesktop/hostname1 interface=org.freedesktop.DBus.Properties member=Get diff --git a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop index 4d4faf688..4778dd6dc 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop +++ b/apparmor.d/abstractions/bus/org.freedesktop.portal.Desktop @@ -11,6 +11,11 @@ member=Read peer=(name="{@{busname},org.freedesktop.portal.Desktop}", label=xdg-desktop-portal), + dbus send bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=xdg-desktop-portal), + dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Settings member={Read,ReadAll} @@ -41,6 +46,16 @@ member=Response peer=(name=@{busname}, label=xdg-desktop-portal), + dbus receive bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.portal.Inhibit + member={StateChanged,CreateMonitor} + peer=(name=@{busname}, label=xdg-desktop-portal), + + dbus receive bus=session path=/org/freedesktop/portal/desktop/session/** + interface=org.freedesktop.impl.portal.Session + member=Close + peer=(name=@{busname}, label=xdg-desktop-portal), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 index e2c4b3886..fe6d52dc6 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 @@ -4,12 +4,12 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" + #aa-dbus common bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" dbus send bus=system path=/org/freedesktop/resolve1 interface=org.freedesktop.resolve1.Manager - member={SetLink*,ResolveHostname} - peer=(name="{@{busname},org.freedesktop.resolve1}", label="@{p_systemd_resolved}"), + member={ResolveAddress,ResolveHostname,ResolveRecord,ResolveService} + peer=(name=org.freedesktop.resolve1, label="@{p_systemd_resolved}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor index 8eb573f7e..d1ff350fc 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor +++ b/apparmor.d/abstractions/bus/org.gnome.Mutter.IdleMonitor @@ -14,7 +14,7 @@ dbus send bus=session path=/org/gnome/Mutter/IdleMonitor/Core interface=org.gnome.Mutter.IdleMonitor member={AddIdleWatch,AddUserActiveWatch,RemoveWatch,GetIdletime} - peer=(name="@{busname},org.gnome.Mutter.IdleMonitor", label=gnome-shell), + peer=(name="{@{busname},org.gnome.Mutter.IdleMonitor}", label=gnome-shell), dbus receive bus=session path=/org/gnome/Mutter/IdleMonitor/Core interface=org.gnome.Mutter.IdleMonitor diff --git a/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 b/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 index baa96cc78..ae8b68448 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 +++ b/apparmor.d/abstractions/bus/org.gnome.Shell.SearchProvider2 @@ -6,6 +6,16 @@ #aa:dbus common bus=session name=org.gnome.Shell.SearchProvider2 label=gnome-shell + dbus receive bus=session path=/org/gnome/Characters/SearchProvider + interface=org.gnome.Shell.SearchProvider2 + member={GetInitialResultSet,GetSubsearchResultSet,GetResultMetas} + peer=(name=@{busname}, label=gnome-shell), + + dbus receive bus=session path=/org/gnome/Characters/SearchProvider + interface=org.gnome.Shell.SearchProvider2 + member=*Cancel + peer=(name=@{busname}, label=gnome-shell), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon b/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon index 66910007b..93ad35fe5 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon +++ b/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon @@ -7,7 +7,7 @@ dbus send bus=session path=/org/gtk/vfs/Daemon interface=org.gtk.vfs.Daemon member={GetConnection,ListMonitorImplementations,ListMountableInfo} - peer=(name="@{busname}", label=gvfsd), + peer=(name=@{busname}, label=gvfsd), dbus receive bus=session path=/org/gtk/vfs/Daemon interface=org.gtk.vfs.Daemon diff --git a/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem b/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem index 43947d52a..87fd06727 100644 --- a/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem +++ b/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem @@ -4,6 +4,30 @@ abi , + include + + dbus bind bus=session name=org.kde.StatusNotifierItem-@{int}, + + dbus send bus=session path=/StatusNotifierWatcher + interface=org.kde.StatusNotifierWatcher + member=RegisterStatusNotifierItem + peer=(name=org.kde.StatusNotifierWatcher, label="@{pp_app_indicator}"), + + dbus send bus=session path=/StatusNotifierItem + interface=org.freedesktop.DBus.Properties + member=PropertiesChanged + peer=(name=org.freedesktop.DBus, label="@{pp_app_indicator}"), + + dbus send bus=session path=/{StatusNotifierItem,org/ayatana/NotificationItem/*} + interface=org.kde.StatusNotifierItem + member={NewAttentionIcon,NewIcon,NewIconThemePath,NewOverlayIcon,NewStatus,NewTitle,NewToolTip} + peer=(name=org.freedesktop.DBus, label="@{pp_app_indicator}"), + + dbus send bus=session path=/StatusNotifierWatcher + interface=org.freedesktop.DBus.Properties + member=Get + peer=(name=org.kde.StatusNotifierWatcher, label=gnome-shell), + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher b/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher index d9ca82881..90a78d2ed 100644 --- a/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher +++ b/apparmor.d/abstractions/bus/org.kde.StatusNotifierWatcher @@ -2,14 +2,52 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Allow to display Status Notifier Items in the KDE Plasma systray + abi , - #aa:dbus common bus=session name=org.kde.StatusNotifierWatcher label=gnome-shell + #aa-dbus common bus=session name=org.kde.StatusNotifierWatcher label=gnome-shell + + dbus send bus=session path=/StatusNotifierWatcher + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=org.kde.StatusNotifierWatcher, label="@{pp_app_indicator}"), + + dbus send bus=session path=/StatusNotifierWatcher + interface=org.freedesktop.DBus.Properties + member=Get + peer=(name=org.kde.StatusNotifierWatcher, label="@{pp_app_indicator}"), + + dbus receive bus=session path=/StatusNotifierItem + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(label="@{pp_app_indicator}"), + + + dbus send bus=session path=/{StatusNotifierItem/menu,org/ayatana/NotificationItem/*/Menu} + interface=com.canonical.dbusmenu + member={LayoutUpdated,ItemsPropertiesUpdated} + peer=(name=org.freedesktop.DBus, label="@{pp_app_indicator}"), + + dbus receive bus=session path=/{StatusNotifierItem,StatusNotifierItem/menu,org/ayatana/NotificationItem/**} + interface={org.freedesktop.DBus.Properties,com.canonical.dbusmenu} + member={Get*,AboutTo*,Event*} + peer=(label="@{pp_app_indicator}"), dbus send bus=session path=/StatusNotifierWatcher interface=org.kde.StatusNotifierWatcher member=RegisterStatusNotifierItem - peer=(name="{:*,org.kde.StatusNotifierWatcher}", label=gnome-shell), + peer=(label="@{pp_app_indicator}"), + + dbus receive bus=session path=/StatusNotifierItem + interface=org.kde.StatusNotifierItem + member={ProvideXdgActivationToken,Activate} + peer=(label="@{pp_app_indicator}"), + + dbus receive bus=session path=/MenuBar + interface=com.canonical.dbusmenu + member={AboutToShow,GetLayout,Event} + peer=(label="@{pp_app_indicator}"), include if exists diff --git a/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player b/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player index d8581be07..d71b7ac1e 100644 --- a/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player +++ b/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player @@ -4,27 +4,34 @@ abi , - #aa-dbus common bus=session name=org.mpris.MediaPlayer2.Player label=unconfined + # DBus.Properties: read all properties from the interface + dbus send bus=system path=/org/mpris/MediaPlayer2 + interface=org.freedesktop.DBus.Properties + member={Get,GetAll} + peer=(name=@{busname}), + # DBus.Properties: receive property changed events dbus receive bus=session path=/org/mpris/MediaPlayer2 interface=org.freedesktop.DBus.Properties member=PropertiesChanged peer=(name=@{busname}), + # DBus.Introspectable: allow clients to introspect the service + dbus send bus=system path=/org/mpris/MediaPlayer2 + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}), + dbus receive bus=session path=/org/mpris/MediaPlayer2 + interface=org.mpris.MediaPlayer2.Player + member={Seeked,Next,PlayPause} + peer=(name=@{busname}), + + # https://specifications.freedesktop.org/mpris-spec/latest/Player_Interface.html#Signal:Seeked + dbus send bus=session path=/org/mpris/MediaPlayer2 interface=org.mpris.MediaPlayer2.Player member=Seeked - peer=(name=@{busname}), - - dbus send bus=session path=/org/mpris/MediaPlayer2 - interface=org.freedesktop.DBus.Properties - member=Get - peer=(name=@{busname}), - - dbus send bus=session path=/org/mpris/MediaPlayer2 - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=@{busname}), + peer=(name=org.freedesktop.DBus), include if exists From eb2def65a1900c681bfc43fd9d4dbb450fc4f4be Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 21:47:00 +0200 Subject: [PATCH 1259/1455] feat(abs): move some dbus abs to the session subfolder. --- .../{own-accessibility => accessibility/own} | 2 +- .../bus/org.freedesktop.systemd1-session | 16 ------------ .../bus/session/org.freedesktop.systemd1 | 26 +++++++++++++++++++ .../bus/{own-session => session/own} | 2 +- .../bus/{own-system => system/own} | 2 +- apparmor.d/groups/gnome/gdm-session | 2 +- apparmor.d/groups/gnome/gnome-session-binary | 2 +- apparmor.d/groups/gnome/gsd-housekeeping | 2 +- apparmor.d/groups/kde/kcminit | 2 +- apparmor.d/profiles-s-z/spotify | 1 + pkg/prebuild/directive/dbus.go | 2 +- 11 files changed, 35 insertions(+), 24 deletions(-) rename apparmor.d/abstractions/bus/{own-accessibility => accessibility/own} (93%) delete mode 100644 apparmor.d/abstractions/bus/org.freedesktop.systemd1-session create mode 100644 apparmor.d/abstractions/bus/session/org.freedesktop.systemd1 rename apparmor.d/abstractions/bus/{own-session => session/own} (93%) rename apparmor.d/abstractions/bus/{own-system => system/own} (93%) diff --git a/apparmor.d/abstractions/bus/own-accessibility b/apparmor.d/abstractions/bus/accessibility/own similarity index 93% rename from apparmor.d/abstractions/bus/own-accessibility rename to apparmor.d/abstractions/bus/accessibility/own index cd8e42e52..d1eab1ce7 100644 --- a/apparmor.d/abstractions/bus/own-accessibility +++ b/apparmor.d/abstractions/bus/accessibility/own @@ -20,6 +20,6 @@ member={GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials} peer=(name=org.freedesktop.DBus, label="@{p_dbus_accessibility}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session b/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session deleted file mode 100644 index 577cc3ed9..000000000 --- a/apparmor.d/abstractions/bus/org.freedesktop.systemd1-session +++ /dev/null @@ -1,16 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - - abi , - - #aa:dbus common bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}" - - dbus send bus=session path=/org/freedesktop/systemd1 - interface=org.freedesktop.systemd1.Manager - member=GetUnit - peer=(name="{@{busname},org.freedesktop.systemd1}", label="@{p_systemd_user}"), - - include if exists - -# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.systemd1 b/apparmor.d/abstractions/bus/session/org.freedesktop.systemd1 new file mode 100644 index 000000000..0c8185be6 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.freedesktop.systemd1 @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + #aa:dbus common bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}" + + dbus send bus=session path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=GetUnit + peer=(name="{@{busname},org.freedesktop.systemd1}", label="@{p_systemd_user}"), + + dbus send bus=session path=/org/freedesktop/systemd1/unit/app_* + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=org.freedesktop.systemd1, label="@{p_systemd_user}"), + + dbus send bus=session path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member=StartTransientUnit + peer=(name=org.freedesktop.systemd1, label="@{p_systemd_user}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/own-session b/apparmor.d/abstractions/bus/session/own similarity index 93% rename from apparmor.d/abstractions/bus/own-session rename to apparmor.d/abstractions/bus/session/own index 91515adb0..d975ebb48 100644 --- a/apparmor.d/abstractions/bus/own-session +++ b/apparmor.d/abstractions/bus/session/own @@ -20,6 +20,6 @@ member={GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials} peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/own-system b/apparmor.d/abstractions/bus/system/own similarity index 93% rename from apparmor.d/abstractions/bus/own-system rename to apparmor.d/abstractions/bus/system/own index d48931f4f..2b1130b32 100644 --- a/apparmor.d/abstractions/bus/own-system +++ b/apparmor.d/abstractions/bus/system/own @@ -20,6 +20,6 @@ member={GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials} peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gdm-session b/apparmor.d/groups/gnome/gdm-session index 4e3440656..9a42bcdf1 100644 --- a/apparmor.d/groups/gnome/gdm-session +++ b/apparmor.d/groups/gnome/gdm-session @@ -11,8 +11,8 @@ profile gdm-session @{exec_path} { include include include - include include + include signal (receive) set=(hup term) peer=gdm-session-worker, signal (receive) set=(term) peer=gdm, diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 8b0ea6307..447c030d6 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -14,7 +14,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index b8da39a4d..35f43a93e 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -11,7 +11,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/kde/kcminit b/apparmor.d/groups/kde/kcminit index bd01bf3c8..4f8b10a32 100644 --- a/apparmor.d/groups/kde/kcminit +++ b/apparmor.d/groups/kde/kcminit @@ -10,7 +10,7 @@ include profile kcminit @{exec_path} { include include - include + include include include diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 3c18059a9..0eb5eab43 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -25,6 +25,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include include include diff --git a/pkg/prebuild/directive/dbus.go b/pkg/prebuild/directive/dbus.go index 06fedffb5..891eb9e1d 100644 --- a/pkg/prebuild/directive/dbus.go +++ b/pkg/prebuild/directive/dbus.go @@ -111,7 +111,7 @@ func (d Dbus) own(rules map[string]string) aa.Rules { res := aa.Rules{ &aa.Include{ - IsMagic: true, Path: "abstractions/bus/own-" + rules["bus"], + IsMagic: true, Path: "abstractions/bus/" + rules["bus"] + "/own", }, &aa.Dbus{ Access: []string{"bind"}, Bus: rules["bus"], Name: rules["name"], From 30618828097267ced9833cdf16de350eac1b05b1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 22:04:07 +0200 Subject: [PATCH 1260/1455] feat(profile): update dbus rules for Ubuntu. --- apparmor.d/groups/freedesktop/dconf | 1 + apparmor.d/groups/freedesktop/pipewire-pulse | 3 +++ .../polkit-kde-authentication-agent | 2 ++ apparmor.d/groups/freedesktop/wireplumber | 5 +++++ .../groups/freedesktop/xdg-desktop-portal | 2 ++ .../groups/freedesktop/xdg-document-portal | 3 ++- .../gnome/evolution-addressbook-factory | 5 +++++ apparmor.d/groups/gnome/gjs-console | 2 ++ apparmor.d/groups/gnome/gnome-calendar | 2 +- apparmor.d/groups/gnome/gnome-characters | 2 +- apparmor.d/groups/gnome/gnome-control-center | 5 ++--- .../groups/gnome/gnome-extension-gsconnect | 2 ++ apparmor.d/groups/gnome/gnome-shell | 4 ++-- apparmor.d/groups/gnome/gnome-software | 11 ++++++++++ apparmor.d/groups/gnome/gnome-system-monitor | 4 ++++ apparmor.d/groups/gnome/gsd-media-keys | 14 +++++-------- apparmor.d/groups/gnome/gsd-power | 1 + .../groups/gnome/gsd-print-notifications | 20 ++++++++++++++++++- apparmor.d/groups/gnome/gsd-xsettings | 12 ++++++++++- apparmor.d/groups/gnome/loupe | 2 ++ apparmor.d/groups/gnome/nautilus | 8 +++++++- apparmor.d/groups/gnome/papers | 1 + apparmor.d/groups/gnome/ptyxis | 1 + apparmor.d/groups/gnome/ptyxis-agent | 5 ++++- apparmor.d/groups/network/wg-quick | 1 + apparmor.d/groups/polkit/polkit-agent-helper | 4 ++-- apparmor.d/groups/systemd/resolvectl | 7 +++++++ .../groups/ubuntu/software-properties-gtk | 6 +++++- apparmor.d/groups/ubuntu/update-notifier | 1 + apparmor.d/profiles-a-f/alacarte | 3 +++ apparmor.d/profiles-a-f/element-desktop | 1 + apparmor.d/profiles-g-l/libreoffice | 2 ++ apparmor.d/profiles-m-r/pinentry-gnome3 | 4 +++- apparmor.d/profiles-s-z/spotify | 11 ++++++++++ apparmor.d/profiles-s-z/superproductivity | 11 +++++++++- 35 files changed, 142 insertions(+), 26 deletions(-) diff --git a/apparmor.d/groups/freedesktop/dconf b/apparmor.d/groups/freedesktop/dconf index be4972f04..20b453df4 100644 --- a/apparmor.d/groups/freedesktop/dconf +++ b/apparmor.d/groups/freedesktop/dconf @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/dconf profile dconf @{exec_path} flags=(attach_disconnected) { include + include include capability sys_nice, diff --git a/apparmor.d/groups/freedesktop/pipewire-pulse b/apparmor.d/groups/freedesktop/pipewire-pulse index fddbe02f7..e6e6e59c5 100644 --- a/apparmor.d/groups/freedesktop/pipewire-pulse +++ b/apparmor.d/groups/freedesktop/pipewire-pulse @@ -13,12 +13,15 @@ profile pipewire-pulse @{exec_path} flags=(attach_disconnected) { include include include + include include capability sys_ptrace, ptrace read, + #aa:dbus own bus=session name=org.pulseaudio.Server + @{exec_path} mr, @{bin}/pactl rix, diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index 8a08f02d0..5e7a75a8d 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -11,8 +11,10 @@ include @{exec_path} += @{lib}/polkit-kde-authentication-agent-[0-9] profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected,mediate_deleted) { include + include include include + include include include include diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index 80c3135f5..7aff8bdd2 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -32,6 +32,11 @@ profile wireplumber @{exec_path} { member=Introspect peer=(name=:*, label=gnome-shell), + dbus receive bus=system path=/midi{,server@{int}} + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name=@{busname}, label="@{p_bluetoothd}"), + @{exec_path} mr, /opt/intel/oneapi/{compiler,lib,mkl}/**/ r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 35c81f0bc..89acacd34 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -52,6 +52,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor + #aa:dbus talk bus=session name=org.freedesktop.FileManager1 label=nautilus + #aa:dbus talk bus=session name=org.freedesktop.impl.portal.FileChooser label=xdg-desktop-portal-gnome #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal dbus receive bus=session diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index d2db2612e..84c0fce42 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -30,7 +30,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { unix (send receive) type=stream peer=(label=xdg-document-portal//fusermount), - #aa:dbus own bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents + #aa:dbus own bus=session name=org.freedesktop.portal.{Documents,FileTransfer} path=/org/freedesktop/portal/documents + #aa:dbus talk bus=session name=org.freedesktop.impl.portal.PermissionStore label=xdg-permission-store dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index 98c94c79e..c9a9d72c9 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -55,6 +55,11 @@ profile evolution-addressbook-factory @{exec_path} { member=Introspect peer=(name=@{busname}, label=gnome-shell), + dbus receive bus=session path=/org/gnome/evolution/dataserver/** + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=obexd), + @{exec_path} mr, @{exec_path}-subprocess rix, diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console index 0cfd4c420..6d6d6ea85 100644 --- a/apparmor.d/groups/gnome/gjs-console +++ b/apparmor.d/groups/gnome/gjs-console @@ -17,8 +17,10 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) { include include include + include include include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index 235c0ce9e..7d6d5246d 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -23,7 +23,6 @@ profile gnome-calendar @{exec_path} { network netlink raw, #aa:dbus own bus=session name=org.gnome.Calendar - #aa-dbus own bus=session name=org.gnome.Calendar.SearchProvider interface+=org.gnome.Shell.SearchProvider2 #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} label=evolution-addressbook-factory #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Calendar@{int} label=evolution-calendar-factory @@ -32,6 +31,7 @@ profile gnome-calendar @{exec_path} { #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Sources@{int} label=evolution-source-registry #aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color + #aa:dbus talk bus=session name=org.gnome.Shell.SearchProvider2 path=/org/gnome/Calendar/SearchProvider label=gnome-shell #aa:dbus talk bus=system name=org.freedesktop.GeoClue2 label="@{p_geoclue}" dbus send bus=session path=/org/gnome/evolution/dataserver/SourceManager{,/**} diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 9af2b7d5f..7ce936e52 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -11,13 +11,13 @@ profile gnome-characters @{exec_path} { include include include + include include include include include #aa:dbus own bus=session name=org.gnome.Characters - #aa-dbus talk bus=session name=org.gnome.Shell.SearchProvider2 label=gnome-shell @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 41b62df09..1c35a8ec1 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -14,6 +14,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -42,9 +43,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.freedesktop.impl.portal.PermissionStore label=xdg-permission-store #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell #aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary - #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color - #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Power label=gsd-power - #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Rfkill label=gsd-rfkill + #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label="gsd-*" #aa:dbus talk bus=session name=org.gnome.Shell label=gnome-shell #aa:dbus talk bus=system name=com.ubuntu.WhoopsiePreferences label=whoopsie-preferences diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 8887ce797..3f57b3035 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -17,6 +17,8 @@ profile gnome-extension-gsconnect @{exec_path} { include include include + include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 0f91b7283..b7706ccf4 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -25,7 +25,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include @@ -87,7 +86,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd #aa:dbus talk bus=system name=org.freedesktop.ColorManager label="@{p_colord}" #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" - #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon} + #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager + #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label="@{p_power_profiles_daemon}" #aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm #aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 7e817f490..71141595b 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -9,6 +9,12 @@ include @{exec_path} = @{bin}/gnome-software profile gnome-software @{exec_path} { include + include + include + include + include + include + include include include include @@ -24,6 +30,11 @@ profile gnome-software @{exec_path} { mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/, umount /var/tmp/flatpak-cache-*/*/, + #aa:dbus own bus=session name=org.freedesktop.PackageKit + #aa:dbus own bus=session name=org.gnome.Software interface+=org.freedesktop.Application + + #aa:dbus talk bus=system name=org.freedesktop.PackageKit path=/ label="@{p_packagekitd}" + @{exec_path} mr, @{bin}/baobab rPUx, diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index a3d039dea..a99d566c0 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -9,6 +9,10 @@ include @{exec_path} = @{bin}/gnome-system-monitor profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { include + include + include + include + include include include diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 6cae2d49b..7f02d8bf4 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -9,7 +9,6 @@ include @{exec_path} = @{lib}/gsd-media-keys profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include - include include include include @@ -21,6 +20,8 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include include include + include + include include include include @@ -38,7 +39,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=PowerOff - peer=(name=:*, label="@{p_systemd_logind}"), + peer=(name=@{busname}, label="@{p_systemd_logind}"), dbus send bus=session path=/ interface=org.freedesktop.DBus @@ -48,17 +49,12 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { dbus send bus=session path=/org/gnome/SettingsDaemon/Power interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label=gsd-power), + peer=(name=@{busname}, label=gsd-power), dbus receive bus=session path=/org/gnome/SettingsDaemon/Power interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gsd-power), - - dbus send bus=session path=/org/mpris/MediaPlayer2 - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=:*), + peer=(name=@{busname}, label=gsd-power), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 2fa0b0b1f..379f7b814 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -18,6 +18,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index af5ff2f05..59123f485 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -30,7 +30,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { dbus receive bus=system path=/org/cups/cupsd/Notifier interface=org.cups.cupsd.Notifier - member=ServerStarted + member={ServerStarted,PrinterDeleted,PrinterStopped} peer=(name=@{busname}, label=cups-notifier-dbus), dbus receive bus=session @@ -38,6 +38,24 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { member=Introspect peer=(name=@{busname}, label=gnome-shell), + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=RecordBrowserNew + peer=(name=org.freedesktop.Avahi, label=avahi-daemon), + dbus send bus=system path=/Client@{int}/RecordBrowser@{int} + interface=org.freedesktop.Avahi.RecordBrowser + member=Free + peer=(name=org.freedesktop.Avahi, label=avahi-daemon), + + dbus receive bus=system path=/Client@{int}/RecordBrowser@{int} + interface=org.freedesktop.Avahi.RecordBrowser + member={CacheExhausted,ItemNew} + peer=(name=@{busname}, label=avahi-daemon), + dbus receive bus=system path=/Client4/RecordBrowser3 + interface=org.freedesktop.Avahi.RecordBrowser + member=ItemNew + peer=(name=@{busname}, label=avahi-daemon), + @{exec_path} mr, @{lib}/gsd-printer rPx, diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index abf30bc40..2e21750b9 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -36,10 +36,20 @@ profile gsd-xsettings @{exec_path} { #aa:dbus talk bus=session name=org.gnome.Mutter.X11 label=gnome-shell + dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member=GetId + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + + dbus receive bus=system path=/org/freedesktop/Accounts + interface=org.freedesktop.Accounts + member=UserAdded + peer=(name=@{busname}, label="@{p_accounts_daemon}"), + dbus send bus=system path=/org/freedesktop/Accounts/User@{uid} interface=org.freedesktop.Accounts.User member=SetInputSources - peer=(name=:*, label="@{p_accounts_daemon}"), + peer=(name=@{busname}, label="@{p_accounts_daemon}"), @{exec_path} mr, @{sh_path} mr, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index d89d4d6f9..398b2b679 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -12,6 +12,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) { include include include + include + include include include include diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index fc9b923d8..17bdc5f13 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -31,9 +31,10 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { unix type=stream peer=(label=gnome-shell), #aa:dbus own bus=session name=org.freedesktop.FileManager1 - #aa:dbus own bus=session name=org.gnome.Nautilus interface+="org.gtk.{Application,Actions}" + #aa:dbus own bus=session name=org.gnome.Nautilus interface+=org.gtk.{Application,Actions} #aa:dbus own bus=session name=org.gnome.Nautilus.SearchProvider interface+=org.gnome.Shell.SearchProvider2 + #aa:dbus talk bus=session name=org.freedesktop.Application path=/ label="*" #aa:dbus talk bus=session name=org.gnome.Settings label=gnome-control-center #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell #aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell @@ -49,6 +50,11 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { member=Print peer=(name=@{busname}, label=nautilus), + dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=ListActivatableNames diff --git a/apparmor.d/groups/gnome/papers b/apparmor.d/groups/gnome/papers index 6f5a137a3..9a22e3de8 100644 --- a/apparmor.d/groups/gnome/papers +++ b/apparmor.d/groups/gnome/papers @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/papers profile papers @{exec_path} { include + include include include include diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis index a6f7e5b63..a0a57d516 100644 --- a/apparmor.d/groups/gnome/ptyxis +++ b/apparmor.d/groups/gnome/ptyxis @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/ptyxis profile ptyxis @{exec_path} { include + include include include diff --git a/apparmor.d/groups/gnome/ptyxis-agent b/apparmor.d/groups/gnome/ptyxis-agent index ce60a26c3..7a05b2254 100644 --- a/apparmor.d/groups/gnome/ptyxis-agent +++ b/apparmor.d/groups/gnome/ptyxis-agent @@ -9,9 +9,12 @@ include @{exec_path} = @{lib}/ptyxis-agent profile ptyxis-agent @{exec_path} { include + include + include include - include include + include + include signal send set=hup peer=unconfined, diff --git a/apparmor.d/groups/network/wg-quick b/apparmor.d/groups/network/wg-quick index c89a12a47..33de68147 100644 --- a/apparmor.d/groups/network/wg-quick +++ b/apparmor.d/groups/network/wg-quick @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/wg-quick profile wg-quick @{exec_path} flags=(attach_disconnected) { include + include include include diff --git a/apparmor.d/groups/polkit/polkit-agent-helper b/apparmor.d/groups/polkit/polkit-agent-helper index 5799ced5b..f761ecf29 100644 --- a/apparmor.d/groups/polkit/polkit-agent-helper +++ b/apparmor.d/groups/polkit/polkit-agent-helper @@ -35,12 +35,12 @@ profile polkit-agent-helper @{exec_path} flags=(attach_disconnected) { dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.DBus.Properties member=GetAll - peer=(name=:*, label="@{p_polkitd}"), + peer=(name=@{busname}, label="@{p_polkitd}"), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority member=AuthenticationAgentResponse2 - peer=(name=:*, label="@{p_polkitd}"), + peer=(name=@{busname}, label="@{p_polkitd}"), @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/resolvectl b/apparmor.d/groups/systemd/resolvectl index 58f2d88f8..3013d8ae6 100644 --- a/apparmor.d/groups/systemd/resolvectl +++ b/apparmor.d/groups/systemd/resolvectl @@ -21,8 +21,15 @@ profile resolvectl @{exec_path} flags=(attach_disconnected) { signal send set=cont peer=child-pager, + unix bind type=stream addr=@@{udbus}/bus/resolvconf/system, + #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" + #aa:dbus talk bus=system name=org.freedesktop.network1 label="@{p_systemd_networkd}" + dbus send bus=system path=/org/freedesktop/network1 + interface=org.freedesktop.network1.Manager + member=SetLinkDNSEx + peer=(name=org.freedesktop.network1), @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index bb31d8867..15a49066c 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -9,19 +9,23 @@ include @{exec_path} = @{bin}/software-properties-gtk profile software-properties-gtk @{exec_path} { include - include + include include include include include include + include + include include include include include #aa:dbus own bus=session name=com.ubuntu.SoftwareProperties + #aa:dbus talk bus=system name=com.canonical.UbuntuAdvantage label=ubuntu-advantage-desktop-daemon + #aa:dbus talk bus=system name=com.ubuntu.SoftwareProperties path=/ label=software-properties-dbus @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 9754aa231..8e9cddd54 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -14,6 +14,7 @@ profile update-notifier @{exec_path} { include include include + include include include include diff --git a/apparmor.d/profiles-a-f/alacarte b/apparmor.d/profiles-a-f/alacarte index 700c6d517..b4cfb56e6 100644 --- a/apparmor.d/profiles-a-f/alacarte +++ b/apparmor.d/profiles-a-f/alacarte @@ -9,6 +9,9 @@ include @{exec_path} = @{bin}/alacarte profile alacarte @{exec_path} flags=(attach_disconnected) { include + include + include + include include include include diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index 7891b67e1..ec7ee9c65 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -17,6 +17,7 @@ profile element-desktop @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 4bed50f13..0a9e6dfc2 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -18,6 +18,8 @@ profile libreoffice @{exec_path} { include include include + include + include include include include diff --git a/apparmor.d/profiles-m-r/pinentry-gnome3 b/apparmor.d/profiles-m-r/pinentry-gnome3 index a955a9c6d..f4a61b07b 100644 --- a/apparmor.d/profiles-m-r/pinentry-gnome3 +++ b/apparmor.d/profiles-m-r/pinentry-gnome3 @@ -10,9 +10,11 @@ include profile pinentry-gnome3 @{exec_path} { include include + include + include include - signal (receive) set=(int) peer=gpg-agent, + signal receive set=int, @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 0eb5eab43..f245e4312 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -21,10 +21,13 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include include include + include include include + include include include include @@ -36,8 +39,16 @@ profile spotify @{exec_path} flags=(attach_disconnected) { network netlink raw, #aa:dbus own bus=session name=org.mpris.MediaPlayer2.spotify + #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell #aa:dbus talk bus=session name=org.freedesktop.portal.{d,D}esktop label=xdg-desktop-portal + #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label=gsd-media-keys + + dbus send bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.portal.Secret + member=RetrieveSecret + peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal), + @{exec_path} mrix, diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index c49a96621..73a86672f 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -6,7 +6,7 @@ abi , include -@{name} = super{p,P}roductivity +@{name} = super{p,P}roductivity Super?Productivity @{domain} = org.chromium.Chromium @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @@ -16,7 +16,16 @@ include profile superproductivity @{exec_path} flags=(attach_disconnected) { include include + include include + include + include + include + include + include + include + include + include include network inet stream, From 0fccbef52b1e0d8b713c76d71220ae03bce8fb1a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 22:06:34 +0200 Subject: [PATCH 1261/1455] feat(profile): improve firefox profiles. --- apparmor.d/abstractions/app/firefox | 4 +++- apparmor.d/groups/browsers/firefox | 8 ++++++-- apparmor.d/groups/browsers/firefox-crashhelper | 5 +++++ apparmor.d/profiles-s-z/thunderbird-glxtest | 2 ++ 4 files changed, 16 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 68fb14887..238bf9e8b 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -21,8 +21,9 @@ include include include - include + include include + include include include include @@ -98,6 +99,7 @@ /var/tmp/ r, owner @{tmp}/@{name}/ rw, owner @{tmp}/@{name}/* rwk, + owner @{tmp}/@{rand6}.tmp rw, owner @{tmp}/firefox/ rw, owner @{tmp}/firefox/* rwk, owner @{tmp}/mozilla* rw, diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index bac81c847..f9ba190a3 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -21,6 +21,9 @@ profile firefox @{exec_path} flags=(attach_disconnected) { signal send set=(term, kill) peer=firefox//&keepassxc-proxy, + unix type=seqpacket addr=@gecko-crash-helper-pipe.@{int}, + unix type=seqpacket peer=(label=firefox-crashhelper), + #aa:dbus own bus=session name=org.mozilla.firefox #aa:dbus own bus=session name=org.mpris.MediaPlayer2.firefox path=/org/mpris/MediaPlayer2 @@ -46,9 +49,10 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open, # Common extensions + @{bin}/browserpass rPx, + @{bin}/keepassxc-proxy rPx -> firefox//&keepassxc-proxy, + @{lib}/browserpass/browserpass-native rPx, /opt/net.downloadhelper.coapp/bin/net.downloadhelper.coapp* rPx, - @{bin}/browserpass rPx, - @{bin}/keepassxc-proxy rPx -> firefox//&keepassxc-proxy, owner @{user_config_dirs}/gtk-{3,4}.0/assets/*.svg r, owner @{user_config_dirs}/ibus/bus/ r, diff --git a/apparmor.d/groups/browsers/firefox-crashhelper b/apparmor.d/groups/browsers/firefox-crashhelper index 55af7c2e2..8ffdccb67 100644 --- a/apparmor.d/groups/browsers/firefox-crashhelper +++ b/apparmor.d/groups/browsers/firefox-crashhelper @@ -15,11 +15,16 @@ include profile firefox-crashhelper @{exec_path} flags=(attach_disconnected) { include + unix type=seqpacket peer=(label=firefox), + @{exec_path} mr, owner "@{config_dirs}/firefox/Crash Reports/" rw, owner "@{config_dirs}/firefox/Crash Reports/crash_helper_server.log" rw, + # file_inherit + deny owner @{user_share_dirs}/gnome-shell/session.gvdb rw, + include if exists } diff --git a/apparmor.d/profiles-s-z/thunderbird-glxtest b/apparmor.d/profiles-s-z/thunderbird-glxtest index 4dc891361..53fdb1ffd 100644 --- a/apparmor.d/profiles-s-z/thunderbird-glxtest +++ b/apparmor.d/profiles-s-z/thunderbird-glxtest @@ -18,6 +18,8 @@ profile thunderbird-glxtest @{exec_path} flags=(attach_disconnected) { include include + network netlink raw, + @{exec_path} mr, / r, From f21fecc25a60abd0a5d7921112e226c8745c4ce5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 22:07:09 +0200 Subject: [PATCH 1262/1455] feat(profile): update possible path for browserpass. --- apparmor.d/profiles-a-f/browserpass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-a-f/browserpass b/apparmor.d/profiles-a-f/browserpass index ee7ff958c..c896e96f8 100644 --- a/apparmor.d/profiles-a-f/browserpass +++ b/apparmor.d/profiles-a-f/browserpass @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{bin}/browserpass +@{exec_path} = @{bin}/browserpass @{lib}/browserpass/browserpass-native profile browserpass @{exec_path} flags=(attach_disconnected) { include include From 1724040229186e798f0fd443a22e747e9f3d5b93 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 22:15:51 +0200 Subject: [PATCH 1263/1455] feat(profile): various ubuntu based improvements. --- .../freedesktop/xdg-desktop-portal-gnome | 2 + apparmor.d/groups/freedesktop/xkbcomp | 1 + .../groups/gnome/evolution-alarm-notify | 2 + apparmor.d/groups/gnome/gnome-system-monitor | 1 + apparmor.d/groups/gnome/mutter-x11-frames | 2 +- apparmor.d/groups/gnome/nautilus | 4 +- apparmor.d/groups/gnome/ptyxis | 7 ++- apparmor.d/groups/gnome/ptyxis-agent | 8 +++- apparmor.d/groups/snap/snap | 48 ++++++++++++++++++- apparmor.d/groups/snap/snap-update-ns | 1 + apparmor.d/groups/ssh/ssh | 4 +- apparmor.d/groups/systemd/systemd-coredump | 4 ++ apparmor.d/groups/systemd/systemd-udevd | 2 + apparmor.d/groups/ubuntu/apport | 5 ++ .../groups/ubuntu/software-properties-gtk | 7 ++- apparmor.d/groups/ubuntu/ubuntu-advantage | 2 + apparmor.d/groups/utils/who | 2 + apparmor.d/profiles-a-f/fwupdmgr | 1 + apparmor.d/profiles-m-r/mkinitramfs | 7 +++ apparmor.d/profiles-m-r/motd | 1 + apparmor.d/profiles-m-r/on-ac-power | 1 + apparmor.d/profiles-s-z/swtpm_setup | 6 +-- 22 files changed, 107 insertions(+), 11 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index bed83627a..ca5f62f82 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -65,11 +65,13 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, + /usr/share/gdm/greeter/applications/{,**} r, /usr/share/thumbnailers/{,**} r, owner @{desktop_cache_dirs}/dconf/user r, owner @{desktop_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rw, owner @{desktop_config_dirs}/dconf/user r, + owner @{desktop_share_dirs}/applications/{,**} r, owner @{DESKTOP_HOME}/greeter-dconf-defaults r, owner @{HOME}/ r, diff --git a/apparmor.d/groups/freedesktop/xkbcomp b/apparmor.d/groups/freedesktop/xkbcomp index 325d444f5..a99e12b7a 100644 --- a/apparmor.d/groups/freedesktop/xkbcomp +++ b/apparmor.d/groups/freedesktop/xkbcomp @@ -17,6 +17,7 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) { unix (send,receive) type=stream addr=none peer=(label=gnome-shell), unix (send,receive) type=stream addr=none peer=(label=xwayland), + unix (send,receive) type=stream addr=none peer=(label=kwin_wayland), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/evolution-alarm-notify b/apparmor.d/groups/gnome/evolution-alarm-notify index ce8f799bb..174cb323f 100644 --- a/apparmor.d/groups/gnome/evolution-alarm-notify +++ b/apparmor.d/groups/gnome/evolution-alarm-notify @@ -37,6 +37,8 @@ profile evolution-alarm-notify @{exec_path} { /etc/timezone r, + owner @{user_share_dirs}/evolution/datetime-formats.ini r, + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index a99d566c0..e4ac12011 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -36,6 +36,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { @{bin}/sed rix, @{bin}/tr rix, + /usr/share/byobu/desktop/{,**} r, /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r, / r, diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index 2ad89fe0a..ae225aa65 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -29,7 +29,7 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { /usr/share/gdm/greeter-dconf-defaults r, owner @{GDM_HOME}/greeter-dconf-defaults r, - owner @{gdm_cache_dirs}/fontconfig/@{hex32}-*.cache-?{,.NEW,.LCK,.TMP-@{rand6}} rw, + owner @{gdm_cache_dirs}/fontconfig/@{hex32}-*.cache-?{,.NEW,.LCK,.TMP-@{rand6}} rwl, owner @{gdm_config_dirs}/dconf/user r, @{sys}/devices/@{pci}/boot_vga r, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 17bdc5f13..5ad6bb7b5 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -72,7 +72,9 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { @{bin}/file-roller rPx, @{bin}/firejail rPUx, @{bin}/net rPUx, - @{bin}/tracker3 rPUx, + + @{bin}/* r, + @{lib}/@{multiarch}/glib-2.0/gio-launch-desktop m, @{open_path} rPx -> child-open, diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis index a0a57d516..838dc940c 100644 --- a/apparmor.d/groups/gnome/ptyxis +++ b/apparmor.d/groups/gnome/ptyxis @@ -13,6 +13,10 @@ profile ptyxis @{exec_path} { include include + unix type=stream peer=(label=ptyxis-agent), + + #aa:dbus own bus=session name=org.gnome.Ptyxis + @{exec_path} mr, @{lib}/ptyxis-agent Px, @@ -25,11 +29,12 @@ profile ptyxis @{exec_path} { owner @{user_config_dirs}/org.gnome.Ptyxis/ rw, owner @{user_config_dirs}/org.gnome.Ptyxis/** rwlk -> @{user_config_dirs}/org.gnome.Ptyxis/**, + owner @{user_config_dirs}/ubuntu-xdg-terminals.list r, owner @{user_share_dirs}/org.gnome.Ptyxis/ rw, owner @{user_share_dirs}/org.gnome.Ptyxis/** rwlk -> @{user_share_dirs}/org.gnome.Ptyxis/**, - owner /tmp/#@{int} w, + owner /tmp/#@{int} rw, /dev/ptmx rw, diff --git a/apparmor.d/groups/gnome/ptyxis-agent b/apparmor.d/groups/gnome/ptyxis-agent index 7a05b2254..cf497e39f 100644 --- a/apparmor.d/groups/gnome/ptyxis-agent +++ b/apparmor.d/groups/gnome/ptyxis-agent @@ -25,7 +25,9 @@ profile ptyxis-agent @{exec_path} { @{bin}/podman Px, @{bin}/systemd-run Cx -> shell, - /usr/share/glib-2.0/schemas/gschemas.compiled r, + owner @{user_share_dirs}/containers/ w, + owner @{user_share_dirs}/containers/storage/ w, + owner @{user_share_dirs}/containers/storage/overlay-containers/ w, @{PROC}/@{pid}/cmdline r, @@ -37,9 +39,13 @@ profile ptyxis-agent @{exec_path} { signal send, + unix bind type=stream addr=@@{udbus}/bus/systemd-run/, + @{bin}/systemd-run mr, @{bin}/@{shells} Ux, + owner @{run}/user/@{uid}/systemd/private rw, + include if exists } diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap index 564fd9151..927d7a3da 100644 --- a/apparmor.d/groups/snap/snap +++ b/apparmor.d/groups/snap/snap @@ -52,11 +52,14 @@ profile snap @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, + @{sh_path} mr, @{bin}/mount rix, @{bin}/getent rix, @{bin}/gpg{,2} rCx -> gpg, @{bin}/systemctl rCx -> systemctl, + @{bin}/systemd-run rCx -> run, # Start snap from the cli + @{bin}/xdg-settings rCx -> xdg-settings, @{lib_dirs}/** mr, @{lib_dirs}/snapd/snap-confine rPx, @@ -98,7 +101,7 @@ profile snap @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/kernel/random/uuid r, @{PROC}/sys/kernel/seccomp/actions_avail r, @{PROC}/version r, - owner @{PROC}/@{pid}/attr/apparmor/current r, + @{PROC}/@{pid}/attr/apparmor/current r, owner @{PROC}/@{pid}/mounts r, /dev/tty@{int} rw, @@ -125,6 +128,49 @@ profile snap @{exec_path} flags=(attach_disconnected) { include if exists } + profile xdg-settings { + include + include + + @{bin}/xdg-settings mr, + + @{sh_path} r, + @{bin}/{,e}grep rix, + @{bin}/basename rix, + @{bin}/cat ix, + @{bin}/cut rix, + @{bin}/head ix, + @{bin}/mkdir ix, + @{bin}/mktemp ix, + @{bin}/mv ix, + @{bin}/readlink ix, + @{bin}/realpath rix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/sleep ix, + @{bin}/sort ix, + @{bin}/touch ix, + @{bin}/tr ix, + @{bin}/uname ix, + @{bin}/wc ix, + + @{bin}/xdg-mime Px, + + include if exists + } + + profile run { + include + + unix bind type=stream addr=@@{udbus}/bus/systemd-run/, + + @{bin}/systemd-run mr, + + owner @{run}/user/@{uid}/systemd/private rw, + + include if exists + } + profile systemctl { include include diff --git a/apparmor.d/groups/snap/snap-update-ns b/apparmor.d/groups/snap/snap-update-ns index 5d7c18d59..157651ac3 100644 --- a/apparmor.d/groups/snap/snap-update-ns +++ b/apparmor.d/groups/snap/snap-update-ns @@ -61,6 +61,7 @@ profile snap-update-ns @{exec_path} { @{sys}/fs/cgroup/{,**/} r, @{sys}/fs/cgroup/system.slice/snap.*.service/cgroup.freeze rw, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.scope/cgroup.freeze rw, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.freeze rw, @{PROC}/@{pids}/cgroup r, diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 03236196c..bf71a8463 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -45,8 +45,8 @@ profile ssh @{exec_path} { audit owner @{tmp}/ssh-*/{,agent.@{int}} rwkl, - owner @{run}/user/@{uid}/gvfsd-sftp/@{hex} wl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand}, - owner @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand} wl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand}, + owner @{run}/user/@{uid}/gvfsd-sftp/@{hex} rwl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand}, + owner @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand} rwl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand}, owner @{run}/user/@{uid}/keyring/ssh rw, @{sys}/ r, diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 54f366c2f..db1854f1f 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -37,6 +37,8 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted /opt/** r, /usr/share/*/** r, @{user_lib_dirs}/** r, + /snap/*/@{int}/opt/** r, + /snap/*/@{int}/usr/** r, /etc/systemd/coredump.conf r, /etc/systemd/coredump.conf.d/{,**} r, @@ -45,6 +47,8 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted /var/lib/systemd/coredump/{,**} rwl, + owner @{run}/user/@{uid}/snap.*/.org.chromium.Chromium.@{rand6} r, + @{att}/@{run}/systemd/coredump rw, @{run}/systemd/coredump rw, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 9c993e0d5..62bada2a8 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -35,6 +35,8 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network netlink raw, + unix type=stream addr=@@{udbus}/bus/udevadm/, + @{exec_path} mrix, @{sh_path} rix, diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index fbc433c05..2fa7bb92a 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -43,6 +43,11 @@ profile apport @{exec_path} flags=(attach_disconnected) { /var/lib/dpkg/info/ r, /var/lib/dpkg/info/*.list r, /var/lib/dpkg/info/*.md5sums r, + /var/lib/dpkg/diversions r, + /var/lib/dpkg/triggers/* r, + /var/lib/dpkg/updates/ r, + + /var/lib/systemd/coredump/*.zst r, /var/crash/ rw, /var/crash/*.@{uid}.crash rw, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 15a49066c..440ef4117 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/software-properties-gtk -profile software-properties-gtk @{exec_path} { +profile software-properties-gtk @{exec_path} flags=(attach_disconnected) { include include include @@ -62,6 +62,10 @@ profile software-properties-gtk @{exec_path} { owner @{tmp}/tmp@{word8}/ rw, owner @{tmp}/tmp@{word8}/apt.conf rw, + /dev/shm/ r, + owner /dev/shm/sem.@{rand6} rwl -> /dev/shm/sem.@{rand6}, + owner /dev/shm/sem.mp-@{rand8} rw, + owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, @{sys}/devices/ r, @@ -75,6 +79,7 @@ profile software-properties-gtk @{exec_path} { owner @{PROC}/@{pid}/environ r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, # Silencer deny @{user_share_dirs}/gvfs-metadata/* r, diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index 34b697732..e8d847e92 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -52,6 +52,8 @@ profile ubuntu-advantage @{exec_path} { /etc/machine-id r, + owner @{user_cache_dirs}/ubuntu-pro/{,**} rw, + owner @{tmp}/tmp[0-9a-z]*/apt.conf r, owner @{tmp}/[0-9a-z]*{,/} rw, owner @{tmp}/[0-9a-z]*/apt-helper-output rw, diff --git a/apparmor.d/groups/utils/who b/apparmor.d/groups/utils/who index fd49b2bec..d951bfe03 100644 --- a/apparmor.d/groups/utils/who +++ b/apparmor.d/groups/utils/who @@ -20,6 +20,8 @@ profile who @{exec_path} { @{run}/systemd/sessions/* r, + # file_inherit + deny owner @{user_share_dirs}/gnome-shell/session.gvdb rw, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/zed/**/data.mdb rw, diff --git a/apparmor.d/profiles-a-f/fwupdmgr b/apparmor.d/profiles-a-f/fwupdmgr index 5df66e6bd..2d781a734 100644 --- a/apparmor.d/profiles-a-f/fwupdmgr +++ b/apparmor.d/profiles-a-f/fwupdmgr @@ -42,6 +42,7 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected) { owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc}.* rw, owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc} rw, + owner /var/lib/fwupd/ w, owner /var/lib/fwupd/.cache/ w, @{user_cache_dirs}/dconf/user rw, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 42489117e..c6caf364f 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -174,6 +174,7 @@ profile mkinitramfs @{exec_path} { /usr/share/initramfs-tools/scripts/{,**/} r, /etc/initramfs-tools/scripts/{,**/} r, + owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/{,**/} r, owner /var/tmp/mkinitramfs_@{rand6}/{,**/} r, include if exists @@ -189,6 +190,12 @@ profile mkinitramfs @{exec_path} { owner /var/tmp/mkinitramfs_@{rand6}/usr/lib/modules/*/kernel/{,**/} r, owner /var/tmp/mkinitramfs_@{rand6}/usr/lib/modules/*/kernel/**/*.ko* r, + owner /tmp/tmp.@{rand10}/usr/lib/modules/*/ r, + owner /tmp/tmp.@{rand10}/usr/lib/modules/*/modules.* rw, + owner /tmp/tmp.@{rand10}/usr/lib/modules/*/updates/{,**} r, + owner /tmp/tmp.@{rand10}/usr/lib/modules/*/kernel/{,**/} r, + owner /tmp/tmp.@{rand10}/usr/lib/modules/*/kernel/**/*.ko* r, + @{sys}/module/compression r, include if exists diff --git a/apparmor.d/profiles-m-r/motd b/apparmor.d/profiles-m-r/motd index 6cdb0fbf8..de742b2c9 100644 --- a/apparmor.d/profiles-m-r/motd +++ b/apparmor.d/profiles-m-r/motd @@ -10,6 +10,7 @@ include profile motd @{exec_path} { include include + include capability net_admin, diff --git a/apparmor.d/profiles-m-r/on-ac-power b/apparmor.d/profiles-m-r/on-ac-power index 16ccfd9da..d6426f717 100644 --- a/apparmor.d/profiles-m-r/on-ac-power +++ b/apparmor.d/profiles-m-r/on-ac-power @@ -14,6 +14,7 @@ profile on-ac-power @{exec_path} { @{exec_path} r, @{sh_path} rix, + @{bin}/{,e}grep rix, @{bin}/{m,g,}awk rix, @{bin}/cat rix, diff --git a/apparmor.d/profiles-s-z/swtpm_setup b/apparmor.d/profiles-s-z/swtpm_setup index 08ee1532e..5795ddfcc 100644 --- a/apparmor.d/profiles-s-z/swtpm_setup +++ b/apparmor.d/profiles-s-z/swtpm_setup @@ -21,9 +21,9 @@ profile swtpm_setup @{exec_path} { /var/log/swtpm/{,**} w, /var/lib/libvirt/swtpm/@{uuid}/tpm2/ r, - owner @{tmp}/swtpm_setup.certs.*/ w, - owner @{tmp}/swtpm_setup.certs.*/*.cert rw, - owner @{tmp}/.swtpm_setup.pidfile* rw, + owner @{tmp}/.swtpm_setup.pidfile.@{rand6} rw, + owner @{tmp}/swtpm_setup.certs.@{rand6}/ w, + owner @{tmp}/swtpm_setup.certs.@{rand6}/*.cert rw, include if exists } From 9b7c1acb1bbad1465159935a0274991637d069c0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 22:52:08 +0200 Subject: [PATCH 1264/1455] build: cosmetic on build task name. --- pkg/prebuild/builder/abi.go | 2 +- pkg/prebuild/builder/attach.go | 2 +- pkg/prebuild/builder/complain.go | 2 +- pkg/prebuild/builder/enforce.go | 2 +- pkg/prebuild/builder/fsp.go | 2 +- pkg/prebuild/builder/hotfix.go | 2 +- pkg/prebuild/builder/userspace.go | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkg/prebuild/builder/abi.go b/pkg/prebuild/builder/abi.go index 492e3cc31..b0052d13f 100644 --- a/pkg/prebuild/builder/abi.go +++ b/pkg/prebuild/builder/abi.go @@ -27,7 +27,7 @@ func init() { RegisterBuilder(&ABI3{ Base: prebuild.Base{ Keyword: "abi3", - Msg: "Convert all profiles from abi 4.0 to abi 3.0", + Msg: "Build: convert all profiles from abi 4.0 to abi 3.0", }, }) } diff --git a/pkg/prebuild/builder/attach.go b/pkg/prebuild/builder/attach.go index aeafcbf7d..d27908129 100644 --- a/pkg/prebuild/builder/attach.go +++ b/pkg/prebuild/builder/attach.go @@ -18,7 +18,7 @@ func init() { RegisterBuilder(&ReAttach{ Base: prebuild.Base{ Keyword: "attach", - Msg: "Re-attach disconnected path", + Msg: "Feat: re-attach disconnected path", }, }) } diff --git a/pkg/prebuild/builder/complain.go b/pkg/prebuild/builder/complain.go index dbd9b3478..8ee205564 100644 --- a/pkg/prebuild/builder/complain.go +++ b/pkg/prebuild/builder/complain.go @@ -25,7 +25,7 @@ func init() { RegisterBuilder(&Complain{ Base: prebuild.Base{ Keyword: "complain", - Msg: "Set complain flag on all profiles", + Msg: "Build: set complain flag on all profiles", }, }) } diff --git a/pkg/prebuild/builder/enforce.go b/pkg/prebuild/builder/enforce.go index a7ce90a7a..3d3d218c6 100644 --- a/pkg/prebuild/builder/enforce.go +++ b/pkg/prebuild/builder/enforce.go @@ -19,7 +19,7 @@ func init() { RegisterBuilder(&Enforce{ Base: prebuild.Base{ Keyword: "enforce", - Msg: "All profiles have been enforced", + Msg: "Build: all profiles have been enforced", }, }) } diff --git a/pkg/prebuild/builder/fsp.go b/pkg/prebuild/builder/fsp.go index 8f7fb4202..12dab15cd 100644 --- a/pkg/prebuild/builder/fsp.go +++ b/pkg/prebuild/builder/fsp.go @@ -23,7 +23,7 @@ func init() { RegisterBuilder(&FullSystemPolicy{ Base: prebuild.Base{ Keyword: "fsp", - Msg: "Prevent unconfined transitions in profile rules", + Msg: "Feat: prevent unconfined transitions in profile rules", }, }) } diff --git a/pkg/prebuild/builder/hotfix.go b/pkg/prebuild/builder/hotfix.go index f7e6143b1..be8750f26 100644 --- a/pkg/prebuild/builder/hotfix.go +++ b/pkg/prebuild/builder/hotfix.go @@ -26,7 +26,7 @@ func init() { RegisterBuilder(&Hotfix{ Base: prebuild.Base{ Keyword: "hotfix", - Msg: "Temporary fix for #74, #80 & #235", + Msg: "Fix: temporary solution for #74, #80 & #235", }, }) } diff --git a/pkg/prebuild/builder/userspace.go b/pkg/prebuild/builder/userspace.go index 37bb3a978..70dff8ec9 100644 --- a/pkg/prebuild/builder/userspace.go +++ b/pkg/prebuild/builder/userspace.go @@ -27,7 +27,7 @@ func init() { RegisterBuilder(&Userspace{ Base: prebuild.Base{ Keyword: "userspace", - Msg: "Resolve variable in profile attachments", + Msg: "Fix: resolve variable in profile attachments", }, }) } From bfcf9f846cd5eee8500413ae785d389266070657 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 22:52:35 +0200 Subject: [PATCH 1265/1455] build: support for unconfined flag. --- pkg/prebuild/builder/complain.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/prebuild/builder/complain.go b/pkg/prebuild/builder/complain.go index 8ee205564..0d6a48f37 100644 --- a/pkg/prebuild/builder/complain.go +++ b/pkg/prebuild/builder/complain.go @@ -38,6 +38,9 @@ func (b Complain) Apply(opt *Option, profile string) (string, error) { if slices.Contains(flags, "complain") { return profile, nil } + if slices.Contains(flags, "unconfined") { + return profile, nil + } } flags = append(flags, "complain") strFlags := " flags=(" + strings.Join(flags, ",") + ") {\n" From 3a17dd33106a8e83d96c50e0522a7373967a6a0f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:08:41 +0200 Subject: [PATCH 1266/1455] feat(aa): add support for advanced network rule. --- pkg/aa/network.go | 68 +++++++++++++++++++++----------- pkg/aa/rule_test.go | 11 ++++++ pkg/aa/templates/rule/network.j2 | 16 ++++++++ 3 files changed, 73 insertions(+), 22 deletions(-) diff --git a/pkg/aa/network.go b/pkg/aa/network.go index d5a2af70b..15dd4385e 100644 --- a/pkg/aa/network.go +++ b/pkg/aa/network.go @@ -33,34 +33,54 @@ func init() { } } -type AddressExpr struct { - Source string - Destination string - Port string +type LocalAddress struct { + IP string + Port string } -func newAddressExprFromLog(log map[string]string) AddressExpr { - return AddressExpr{ - Source: log["laddr"], - Destination: log["faddr"], - Port: log["lport"], +func newLocalAddressFromLog(log map[string]string) LocalAddress { + return LocalAddress{ + IP: log["laddr"], + Port: log["lport"], } } -func (r AddressExpr) Compare(other AddressExpr) int { - if res := compare(r.Source, other.Source); res != 0 { - return res - } - if res := compare(r.Destination, other.Destination); res != 0 { +func (r LocalAddress) Compare(other LocalAddress) int { + if res := compare(r.IP, other.IP); res != 0 { return res } return compare(r.Port, other.Port) } +type PeerAddress struct { + IP string + Port string + Src string +} + +func newPeerAddressFromLog(log map[string]string) PeerAddress { + return PeerAddress{ + IP: log["faddr"], + Port: log["fport"], + Src: log["saddr"], + } +} + +func (r PeerAddress) Compare(other PeerAddress) int { + if res := compare(r.IP, other.IP); res != 0 { + return res + } + if res := compare(r.Port, other.Port); res != 0 { + return res + } + return compare(r.Src, other.Src) +} + type Network struct { Base Qualifier - AddressExpr + LocalAddress + PeerAddress Domain string Type string Protocol string @@ -90,12 +110,13 @@ func newNetwork(q Qualifier, rule rule) (Rule, error) { func newNetworkFromLog(log map[string]string) Rule { return &Network{ - Base: newBaseFromLog(log), - Qualifier: newQualifierFromLog(log), - AddressExpr: newAddressExprFromLog(log), - Domain: log["family"], - Type: log["sock_type"], - Protocol: log["protocol"], + Base: newBaseFromLog(log), + Qualifier: newQualifierFromLog(log), + LocalAddress: newLocalAddressFromLog(log), + PeerAddress: newPeerAddressFromLog(log), + Domain: log["family"], + Type: log["sock_type"], + Protocol: log["protocol"], } } @@ -135,7 +156,10 @@ func (r *Network) Compare(other Rule) int { if res := compare(r.Protocol, o.Protocol); res != 0 { return res } - if res := r.AddressExpr.Compare(o.AddressExpr); res != 0 { + if res := r.LocalAddress.Compare(o.LocalAddress); res != 0 { + return res + } + if res := r.PeerAddress.Compare(o.PeerAddress); res != 0 { return res } return r.Qualifier.Compare(o.Qualifier) diff --git a/pkg/aa/rule_test.go b/pkg/aa/rule_test.go index ee50532a9..ed6e7043d 100644 --- a/pkg/aa/rule_test.go +++ b/pkg/aa/rule_test.go @@ -216,6 +216,17 @@ var ( wMerge: false, wString: "network netlink raw,", }, + { + name: "network3", + fromLog: newNetworkFromLog, + log: network3Log, + rule: network3, + wValidErr: true, + other: network1, + wCompare: -7, + wMerge: false, + wString: "network dgram ip=127.0.0.1 port=57007 peer=(ip=127.0.0.53, port=53), # failed af match", + }, { name: "mount", fromLog: newMountFromLog, diff --git a/pkg/aa/templates/rule/network.j2 b/pkg/aa/templates/rule/network.j2 index 6f2503a8b..3694442be 100644 --- a/pkg/aa/templates/rule/network.j2 +++ b/pkg/aa/templates/rule/network.j2 @@ -15,6 +15,22 @@ {{ " " }}{{ . }} {{- end -}} {{- end -}} + {{- with .LocalAddress.IP -}} + {{ " ip=" }}{{ . }} + {{- end -}} + {{- with .LocalAddress.Port -}} + {{ " port=" }}{{ . }} + {{- end -}} + {{- if and .PeerAddress.IP .PeerAddress.Port -}} + {{ " peer=(ip=" }}{{ .PeerAddress.IP }}{{ ", port="}}{{ .PeerAddress.Port }}{{ ")" }} + {{- else -}} + {{- with .PeerAddress.IP -}} + {{ " peer=(ip=" }}{{ . }}{{ ")" }} + {{- end -}} + {{- with .PeerAddress.Port -}} + {{ " peer=(port=" }}{{ . }}{{ ")" }} + {{- end -}} + {{- end -}} {{- "," -}} {{- template "comment" . -}} {{- end -}} \ No newline at end of file From 43f30333c6edd648c71789d1755a27b2c4381ac9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:14:52 +0200 Subject: [PATCH 1267/1455] feat(aa): add support for prompt and priority rule. --- pkg/aa/base.go | 6 +++++- pkg/aa/parse.go | 8 +++++++- pkg/aa/templates/rule/qualifier.j2 | 3 +++ 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/pkg/aa/base.go b/pkg/aa/base.go index eaf69f71c..a712a5899 100644 --- a/pkg/aa/base.go +++ b/pkg/aa/base.go @@ -99,6 +99,7 @@ func (r Base) addLine(other Rule) bool { } type Qualifier struct { + Priority string Audit bool AccessType string } @@ -109,6 +110,9 @@ func newQualifierFromLog(log map[string]string) Qualifier { } func (r Qualifier) Compare(o Qualifier) int { + if r := compare(r.Priority, o.Priority); r != 0 { + return r + } if r := compare(r.Audit, o.Audit); r != 0 { return r } @@ -116,7 +120,7 @@ func (r Qualifier) Compare(o Qualifier) int { } func (r Qualifier) Equal(o Qualifier) bool { - return r.Audit == o.Audit && r.AccessType == o.AccessType + return r.Priority == o.Priority && r.Audit == o.Audit && r.AccessType == o.AccessType } func (r Qualifier) getLenAudit() int { diff --git a/pkg/aa/parse.go b/pkg/aa/parse.go index e01696d74..3b737abfd 100644 --- a/pkg/aa/parse.go +++ b/pkg/aa/parse.go @@ -15,6 +15,8 @@ const ( tokALLOW = "allow" tokAUDIT = "audit" tokDENY = "deny" + tokPROMPT = "prompt" + tokPRIORITY = "priority" tokARROW = "->" tokEQUAL = "=" tokLESS = "<" @@ -524,7 +526,11 @@ func newRules(rules []rule) (Rules, error) { rule = rule[1:] goto qualifier // Qualifier - case tokALLOW, tokDENY: + case tokPRIORITY: + q.Priority = rule.GetValues(tokPRIORITY).GetString() + rule = rule[1:] + goto qualifier + case tokALLOW, tokDENY, tokPROMPT: q.AccessType = rule.Get(0) rule = rule[1:] goto qualifier diff --git a/pkg/aa/templates/rule/qualifier.j2 b/pkg/aa/templates/rule/qualifier.j2 index a0ff554ec..69181051a 100644 --- a/pkg/aa/templates/rule/qualifier.j2 +++ b/pkg/aa/templates/rule/qualifier.j2 @@ -3,6 +3,9 @@ {{- /* SPDX-License-Identifier: GPL-2.0-only */ -}} {{- define "qualifier" -}} + {{- with .Priority -}} + {{- "priority=" -}}{{ . }}{{ " " }} + {{- end -}} {{- if .Audit -}} {{- "audit " -}} {{- end -}} From 7d1f8852098deaaabbc29697d0111a44fb83e557 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:15:21 +0200 Subject: [PATCH 1268/1455] test(aa): add testdata for network rule. --- pkg/aa/data_test.go | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/pkg/aa/data_test.go b/pkg/aa/data_test.go index b96fd865f..28aa703d6 100644 --- a/pkg/aa/data_test.go +++ b/pkg/aa/data_test.go @@ -65,8 +65,34 @@ var ( "denied_mask": "create", "comm": "sddm-greeter", } + network3Log = map[string]string{ + "apparmor": "ALLOWED", + "class": "net", + "operation": "sendmsg", + "info": "failed af match", + "error": "-13", + "profile": "unattended-upgrade", + "comm": "unattended-upgr", + "laddr": "127.0.0.1", + "lport": "57007", + "faddr": "127.0.0.53", + "saddr": "127.0.0.1", + "src": "57007", + "fport": "53", + "sock_type": "dgram", + "protocol": "17", + "requested": "send", + "denied": "send", + } network1 = &Network{Domain: "netlink", Type: "raw", Protocol: "15"} network2 = &Network{Domain: "inet", Type: "dgram"} + network3 = &Network{ + Base: Base{Comment: " failed af match"}, + LocalAddress: LocalAddress{IP: "127.0.0.1", Port: "57007"}, + PeerAddress: PeerAddress{IP: "127.0.0.53", Port: "53", Src: "127.0.0.1"}, + Type: "dgram", + Protocol: "17", + } // Mount mount1Log = map[string]string{ From 157c365b261a8600404ee7c917b02d194725a6c1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:17:10 +0200 Subject: [PATCH 1269/1455] fix(aa): ensure tokenization helper cleanup data. --- pkg/aa/util.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/aa/util.go b/pkg/aa/util.go index 5a7049d69..523eb99fe 100644 --- a/pkg/aa/util.go +++ b/pkg/aa/util.go @@ -148,9 +148,10 @@ func validateValues(kind Kind, key string, values []string) error { func tokenToSlice(token string) []string { res := []string{} - token = strings.Trim(token, "()\n") + token = strings.Trim(token, "()\n ") if strings.ContainsAny(token, ", ") { var sep string + token = strings.ReplaceAll(token, " ", " ") switch { case strings.Contains(token, ","): sep = "," From 107820975ded704279b68a40909a980c222a3da1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:18:41 +0200 Subject: [PATCH 1270/1455] feat(aa): add file kind. --- pkg/aa/apparmor.go | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/pkg/aa/apparmor.go b/pkg/aa/apparmor.go index 6119a0c91..94e232c81 100644 --- a/pkg/aa/apparmor.go +++ b/pkg/aa/apparmor.go @@ -5,12 +5,39 @@ package aa import ( + "strings" + "github.com/roddhjav/apparmor.d/pkg/paths" ) // MagicRoot is the default Apparmor magic directory: /etc/apparmor.d/. var MagicRoot = paths.New("/etc/apparmor.d") +// FileKind represents an AppArmor file kind. +type FileKind uint8 + +const ( + ProfileKind FileKind = iota + AbstractionKind + TunableKind +) + +func KindFromPath(file *paths.Path) FileKind { + dirname := file.Parent().String() + switch { + case strings.Contains(dirname, "abstractions"): + return AbstractionKind + case strings.Contains(dirname, "tunables"): + return TunableKind + case strings.Contains(dirname, "local"): + return AbstractionKind + case strings.Contains(dirname, "mappings"): + return AbstractionKind + default: + return ProfileKind + } +} + // AppArmorProfileFiles represents a full set of apparmor profiles type AppArmorProfileFiles map[string]*AppArmorProfileFile From 7aae9f0dd7a14bfd37246992f1c11a4c96bd8e21 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:30:54 +0200 Subject: [PATCH 1271/1455] build: add stacked-dbus builder Resolve peer label variable in dbus rules. It create a full dbus rule by item in a variable when it is used a peer label. For ubuntu with apparmor 4.1+ See https://gitlab.com/apparmor/apparmor/-/issues/537#note_2699570190 --- pkg/prebuild/builder/stacked-dbus.go | 105 +++++++++++++++++++++++++++ pkg/prebuild/cli/cli.go | 18 +++-- 2 files changed, 116 insertions(+), 7 deletions(-) create mode 100644 pkg/prebuild/builder/stacked-dbus.go diff --git a/pkg/prebuild/builder/stacked-dbus.go b/pkg/prebuild/builder/stacked-dbus.go new file mode 100644 index 000000000..d572e9d31 --- /dev/null +++ b/pkg/prebuild/builder/stacked-dbus.go @@ -0,0 +1,105 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2021-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package builder + +import ( + "slices" + "strings" + + "github.com/roddhjav/apparmor.d/pkg/aa" + "github.com/roddhjav/apparmor.d/pkg/prebuild" +) + +var ( + resolve = map[string][]string{ + `"@{p_dbus_system}"`: {"dbus-system", "dbus-system//&unconfined"}, + `"@{p_dbus_session}"`: {"dbus-session", "dbus-session//&unconfined"}, + } +) + +// Fix for https://gitlab.com/apparmor/apparmor/-/issues/537#note_2699570190 +type StackedDbus struct { + prebuild.Base +} + +func init() { + RegisterBuilder(&StackedDbus{ + Base: prebuild.Base{ + Keyword: "stacked-dbus", + Msg: "Fix: resolve peer label variable in dbus rules", + }, + }) +} + +func parse(kind aa.FileKind, profile string) (aa.ParaRules, []string, error) { + var raw string + paragraphs := []string{} + rulesByParagraph := aa.ParaRules{} + + switch kind { + case aa.ProfileKind: + f := &aa.AppArmorProfileFile{} + nb, err := f.Parse(profile) + if err != nil { + return nil, nil, err + } + lines := strings.Split(profile, "\n") + raw = strings.Join(lines[nb:], "\n") + + case aa.AbstractionKind, aa.TunableKind: + raw = profile + } + raw = profile + + r, par, err := aa.ParseRules(raw) + if err != nil { + return nil, nil, err + } + rulesByParagraph = append(rulesByParagraph, r...) + paragraphs = append(paragraphs, par...) + return rulesByParagraph, paragraphs, nil +} + +func (b StackedDbus) Apply(opt *Option, profile string) (string, error) { + kind := aa.KindFromPath(opt.File) + if kind == aa.TunableKind { + return profile, nil + } + + toResolve := []string{} + for k := range resolve { + toResolve = append(toResolve, k) + } + + rulesByParagraph, paragraphs, err := parse(kind, profile) // + if err != nil { + return "", err + } + for idx, rules := range rulesByParagraph { + changed := false + newRules := aa.Rules{} + for _, rule := range rules { + switch rule := rule.(type) { + case *aa.Dbus: + if slices.Contains(toResolve, rule.PeerLabel) { + changed = true + for _, label := range resolve[rule.PeerLabel] { + newRule := *rule + newRule.PeerLabel = label + newRules = append(newRules, &newRule) + } + } else { + newRules = append(newRules, rule) + } + default: + newRules = append(newRules, rule) + } + } + if changed { + profile = strings.ReplaceAll(profile, paragraphs[idx], newRules.String()+"\n") + } + } + return profile, nil +} diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index ab221e485..8abfb4323 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -108,16 +108,20 @@ func Configure() { case 3: builder.Register("abi3") // Convert all profiles from abi 4.0 to abi 3.0 case 4: - // Re-attach disconnected path, ignored on ubuntu 25.04+ due to a memory leak - // that fully prevent profiles compilation with re-attached paths. - // See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2098730 - if prebuild.Distribution != "ubuntu" { - builder.Register("attach") - prepare.Register("attach") - } else if prebuild.Release["VERSION_CODENAME"] == "noble" { + // Re-attach disconnected path + if prebuild.Distribution == "ubuntu" && prebuild.Version >= 4.1 { + // Ignored on ubuntu 25.04+ due to a memory leak that fully prevent + // profiles compilation with re-attached paths. + // See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2098730 + + // Use stacked-dbus builder to resolve dbus rules + builder.Register("stacked-dbus") + + } else { builder.Register("attach") prepare.Register("attach") } + default: logging.Fatal("Invalid ABI version: %d", prebuild.ABI) } From 2fcf4c50119de50de5498f30ee7a7a2aff9b5cd6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:38:15 +0200 Subject: [PATCH 1272/1455] ci(github): remove test now enabled by default. --- .github/workflows/main.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9f2addf88..90b709a31 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -47,11 +47,6 @@ jobs: if [[ ${{ matrix.mode }} == full-system-policy ]]; then sed -e "s/just complain/just fsp-complain/" -i debian/rules fi - if [[ ${{ matrix.os }} == ubuntu-24.04 ]] && [[ ${{ matrix.mode }} == default ]]; then - # Test with Re-attach disconnected path - sed -e 's;// builder.Register("attach");builder.Register("attach");' -i pkg/prebuild/cli/cli.go - sed -e '/@{att}/d' -i apparmor.d/tunables/multiarch.d/system - fi bash dists/build.sh dpkg - name: Install apparmor.d From bc270954d49993374b14bc2af6b89bb37d7d45ce Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 24 Aug 2025 23:53:12 +0200 Subject: [PATCH 1273/1455] feat(abs): add missing bus abs. --- .../bus/org.gnome.SettingsDaemon.MediaKeys | 23 ++++++++++++++++ .../bus/org.gnome.keyring.internal.Prompter | 26 +++++++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 apparmor.d/abstractions/bus/org.gnome.SettingsDaemon.MediaKeys create mode 100644 apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter diff --git a/apparmor.d/abstractions/bus/org.gnome.SettingsDaemon.MediaKeys b/apparmor.d/abstractions/bus/org.gnome.SettingsDaemon.MediaKeys new file mode 100644 index 000000000..3a461a85a --- /dev/null +++ b/apparmor.d/abstractions/bus/org.gnome.SettingsDaemon.MediaKeys @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow requesting interest in receiving media key events. This tells Gnome +# settings that our application should be notified when key events we are +# interested in are pressed, and allows us to receive those events. + + abi , + + # DBus.Properties: read all properties from the interface + dbus send bus=session path=/org/gnome/SettingsDaemon/MediaKeys + interface=org.freedesktop.DBus.Properties + member={Get,GetAll} + peer=(name="{@{busname},org.gnome.SettingsDaemon.MediaKeys}", label=gsd-media-keys), + + dbus (receive, send) bus=session path=/org/gnome/SettingsDaemon/MediaKeys + interface=org.gnome.SettingsDaemon.MediaKeys + peer=(name="{@{busname},org.gnome.SettingsDaemon.MediaKeys}", label=gsd-media-keys), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter b/apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter new file mode 100644 index 000000000..1c3e8f760 --- /dev/null +++ b/apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow accessing the GNOME crypto services prompt APIs as used by +# applications using libgcr (such as pinentry-gnome3) for secure pin +# entry to unlock GPG keys etc. See: +# https://developer.gnome.org/gcr/unstable/GcrPrompt.html +# https://developer.gnome.org/gcr/unstable/GcrSecretExchange.html +# https://github.com/snapcore/snapd/pull/7673#issuecomment-592229711 + + abi , + + dbus send bus=session path=/org/gnome/keyring/Prompter + interface=org.gnome.keyring.internal.Prompter + member={BeginPrompting,PerformPrompt,StopPrompting} + peer=(name=@{busname}, label=pinentry-*), + + dbus receive bus=session path=/org/gnome/keyring/Prompt/p@{int} + interface=org.gnome.keyring.internal.Prompter.Callback + member={PromptReady,PromptDone} + peer=(name=@{busname}, label=pinentry-*), + + include if exists + +# vim:syntax=apparmor From 068d205e13b333f077371bd4af37637902f29e7e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 25 Aug 2025 00:02:12 +0200 Subject: [PATCH 1274/1455] fix(prebuild): removce ineffectual assignment. --- pkg/prebuild/builder/stacked-dbus.go | 1 - 1 file changed, 1 deletion(-) diff --git a/pkg/prebuild/builder/stacked-dbus.go b/pkg/prebuild/builder/stacked-dbus.go index d572e9d31..33af33df7 100644 --- a/pkg/prebuild/builder/stacked-dbus.go +++ b/pkg/prebuild/builder/stacked-dbus.go @@ -51,7 +51,6 @@ func parse(kind aa.FileKind, profile string) (aa.ParaRules, []string, error) { case aa.AbstractionKind, aa.TunableKind: raw = profile } - raw = profile r, par, err := aa.ParseRules(raw) if err != nil { From 7ecc84d3b0e13f5d346a906dceda14321fddae1a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 25 Aug 2025 00:04:15 +0200 Subject: [PATCH 1275/1455] feat(tunable): add pp tunable, improve dbus tunables. --- apparmor.d/tunables/multiarch.d/profiles | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/profiles b/apparmor.d/tunables/multiarch.d/profiles index 6868ae87a..d4fefb0b0 100644 --- a/apparmor.d/tunables/multiarch.d/profiles +++ b/apparmor.d/tunables/multiarch.d/profiles @@ -16,8 +16,8 @@ # Name of the dbus daemon profiles @{p_dbus_accessibility}=dbus-accessibility #aa:only apparmor4.1 -@{p_dbus_system}={dbus-system,dbus-system//&unconfined} -@{p_dbus_session}={dbus-session,dbus-session//&unconfined} +@{p_dbus_system}={dbus-system,unconfined} +@{p_dbus_session}={dbus-session,unconfined} #aa:exclude apparmor4.1 @{p_dbus_system}=dbus-system @@ -68,5 +68,12 @@ @{p_upowerd}=upowerd @{p_xdg_desktop_portal}=xdg-desktop-portal +# Profiles Patterns +# Fit to an action that can be handled by multiple profiles depending on the software installed and the distribution + +# Notification +@{pp_notification}={plasmashell,gjs-console} +@{pp_app_indicator}={plasmashell,gnome-shell} +@{pp_dbusmenu}={plasmashell,nautilus} # vim:syntax=apparmor From 1d51b1436da8c64232cebe31317bdbebc870bded Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Wed, 27 Aug 2025 06:08:52 +0200 Subject: [PATCH 1276/1455] Small documentation improvements --- docs/development/workflow.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/development/workflow.md b/docs/development/workflow.md index 786d77c93..7cc7c5616 100644 --- a/docs/development/workflow.md +++ b/docs/development/workflow.md @@ -36,7 +36,7 @@ title: Workflow Here is the bare minimum for the program `foo`: ``` sh # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2024 You +# Copyright (C) 2025 You # SPDX-License-Identifier: GPL-2.0-only abi , @@ -130,7 +130,7 @@ For this individual profile installation to work, the full package needs to be i To discover the access needed by a program, you can use the following tools: -1. Star the program in *complain* mode, let it initialize itself, then close it. +1. Start the program in *complain* mode, let it initialize itself, then close it. 1. Run **[`aa-log -r`](../usage.md#apparmor-log)**. It will: - Convert the logs to AppArmor rules. From 98034784e92400fd2241094f5ca8d85104f8b2f7 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Wed, 27 Aug 2025 06:02:10 +0200 Subject: [PATCH 1277/1455] Add cider profile --- apparmor.d/profiles-a-f/cider | 61 +++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 apparmor.d/profiles-a-f/cider diff --git a/apparmor.d/profiles-a-f/cider b/apparmor.d/profiles-a-f/cider new file mode 100644 index 000000000..f534a0034 --- /dev/null +++ b/apparmor.d/profiles-a-f/cider @@ -0,0 +1,61 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{domain} = sh.cider.genten org.chromium.Chromium +@{lib_dirs} = @{lib}/cider + +@{exec_path} = @{bin}/cider @{bin}/Cider @{lib_dirs}/Cider +profile cider @{exec_path} { + include + include + include + include + include + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mrix, + + @{lib_dirs}/ r, + @{lib_dirs}/** r, + @{lib_dirs}/libffmpeg.so mr, + @{lib_dirs}/chrome-sandbox rpx, + + @{bin}/xdg-settings rpx, + + owner @{user_config_dirs}/sh.cider.genten/ rw, + owner @{user_config_dirs}/sh.cider.genten/** rwk, + owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/_platform_specific/linux_x64/libwidevinecdm.so mr, + owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/manifest.json r, + owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/latest-component-updated-widevine-cdm r, + + @{PROC}/ r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/task/ r, + @{PROC}/@{pid}/task/@{tid}/status r, + @{PROC}/sys/fs/inotify/max_user_watches r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/oom_{,score_}adj rw, + owner @{PROC}/@{pid}/statm r, + + /usr/share/xkeyboard-config-2/** r, + + include if exists +} + +# vim:syntax=apparmor From f5970fcc6741419ea96ef5c9c36a321da532e127 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Wed, 27 Aug 2025 06:12:18 +0200 Subject: [PATCH 1278/1455] Remove tabs --- apparmor.d/profiles-a-f/cider | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/apparmor.d/profiles-a-f/cider b/apparmor.d/profiles-a-f/cider index f534a0034..71b27bce5 100644 --- a/apparmor.d/profiles-a-f/cider +++ b/apparmor.d/profiles-a-f/cider @@ -42,11 +42,11 @@ profile cider @{exec_path} { owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/manifest.json r, owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/latest-component-updated-widevine-cdm r, - @{PROC}/ r, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/task/ r, - @{PROC}/@{pid}/task/@{tid}/status r, - @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/ r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/task/ r, + @{PROC}/@{pid}/task/@{tid}/status r, + @{PROC}/sys/fs/inotify/max_user_watches r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, From eedbc2223c1bc84e2e12deb2fd1e041422c5994d Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Wed, 27 Aug 2025 15:52:00 +0200 Subject: [PATCH 1279/1455] cider-review-fixes --- apparmor.d/profiles-a-f/cider | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/apparmor.d/profiles-a-f/cider b/apparmor.d/profiles-a-f/cider index 71b27bce5..2b203e989 100644 --- a/apparmor.d/profiles-a-f/cider +++ b/apparmor.d/profiles-a-f/cider @@ -6,10 +6,13 @@ abi , include +@{name} = {C,c}ider sh.cider.genten @{domain} = sh.cider.genten org.chromium.Chromium @{lib_dirs} = @{lib}/cider +@{cache_dirs} = @{user_cache_dirs}/@{name} +@{config_dirs} = @{user_config_dirs}/@{name} -@{exec_path} = @{bin}/cider @{bin}/Cider @{lib_dirs}/Cider +@{exec_path} = @{bin}/{C,c}ider @{lib_dirs}/Cider profile cider @{exec_path} { include include @@ -18,8 +21,9 @@ profile cider @{exec_path} { include include include - include + include include + include network inet dgram, network inet6 dgram, @@ -32,15 +36,13 @@ profile cider @{exec_path} { @{lib_dirs}/ r, @{lib_dirs}/** r, @{lib_dirs}/libffmpeg.so mr, - @{lib_dirs}/chrome-sandbox rpx, + @{lib_dirs}/chrome-sandbox rPx, - @{bin}/xdg-settings rpx, + @{bin}/xdg-settings rPx, owner @{user_config_dirs}/sh.cider.genten/ rw, owner @{user_config_dirs}/sh.cider.genten/** rwk, - owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/_platform_specific/linux_x64/libwidevinecdm.so mr, - owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/manifest.json r, - owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/latest-component-updated-widevine-cdm r, + owner @{user_config_dirs}/sh.cider.genten/WidevineCdm/*/_platform_specific/linux_@{arch}/libwidevinecdm.so mr, @{PROC}/ r, @{PROC}/@{pid}/stat r, @@ -53,8 +55,6 @@ profile cider @{exec_path} { owner @{PROC}/@{pid}/oom_{,score_}adj rw, owner @{PROC}/@{pid}/statm r, - /usr/share/xkeyboard-config-2/** r, - include if exists } From aec7d41a25647f9da3f0b13ddbe53d048bec3ee2 Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 6 Aug 2025 14:03:31 +0200 Subject: [PATCH 1280/1455] add profiles for wayland screen capture tools --- apparmor.d/profiles-g-l/grim | 21 +++++++++++++++++++++ apparmor.d/profiles-s-z/slurp | 23 +++++++++++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 apparmor.d/profiles-g-l/grim create mode 100644 apparmor.d/profiles-s-z/slurp diff --git a/apparmor.d/profiles-g-l/grim b/apparmor.d/profiles-g-l/grim new file mode 100644 index 000000000..0ded3d315 --- /dev/null +++ b/apparmor.d/profiles-g-l/grim @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/grim +profile grim @{exec_path} { + include + include + + @{exec_path} mr, + + owner /dev/shm/grim-@{rand6} rw, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/slurp b/apparmor.d/profiles-s-z/slurp new file mode 100644 index 000000000..8d5bcc217 --- /dev/null +++ b/apparmor.d/profiles-s-z/slurp @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/slurp +profile slurp @{exec_path} { + include + + @{exec_path} mr, + + /usr/share/icons/{,**} r, + +# often used in combination with grim screen cature tool + owner /dev/shm/grim-@{rand6} rw, + + include if exists +} + +# vim:syntax=apparmor From 06f1c0538e9bca4ac1af6862c4553931b33ad108 Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 6 Aug 2025 14:15:04 +0200 Subject: [PATCH 1281/1455] remove whitespace --- apparmor.d/profiles-s-z/slurp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-s-z/slurp b/apparmor.d/profiles-s-z/slurp index 8d5bcc217..c4250275e 100644 --- a/apparmor.d/profiles-s-z/slurp +++ b/apparmor.d/profiles-s-z/slurp @@ -9,12 +9,12 @@ include @{exec_path} = @{bin}/slurp profile slurp @{exec_path} { include - + @{exec_path} mr, /usr/share/icons/{,**} r, -# often used in combination with grim screen cature tool + # often used in combination with grim screen cature tool owner /dev/shm/grim-@{rand6} rw, include if exists From 9a302147bd3b2d6f02d715bcaa0e645f1680295b Mon Sep 17 00:00:00 2001 From: valoq Date: Wed, 6 Aug 2025 14:26:43 +0200 Subject: [PATCH 1282/1455] fix typo --- apparmor.d/profiles-g-l/grim | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/grim b/apparmor.d/profiles-g-l/grim index 0ded3d315..9f18db07b 100644 --- a/apparmor.d/profiles-g-l/grim +++ b/apparmor.d/profiles-g-l/grim @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/grim profile grim @{exec_path} { include - include + include @{exec_path} mr, From ec2c0b1c8e34273069a86caf5b7af3444d4a8e7c Mon Sep 17 00:00:00 2001 From: valoq Date: Sun, 24 Aug 2025 17:32:04 +0200 Subject: [PATCH 1283/1455] add default path for plain use --- apparmor.d/profiles-g-l/grim | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apparmor.d/profiles-g-l/grim b/apparmor.d/profiles-g-l/grim index 9f18db07b..9e40a8aca 100644 --- a/apparmor.d/profiles-g-l/grim +++ b/apparmor.d/profiles-g-l/grim @@ -13,6 +13,10 @@ profile grim @{exec_path} { @{exec_path} mr, + owner @{user_config_dirs}/user-dirs.dirs r, + + owner @{HOME}/@{int8}_**_grim.png w, + owner /dev/shm/grim-@{rand6} rw, include if exists From 749ae318fca8bc9a8bed97bedeb883a326d95c13 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 00:35:35 +0200 Subject: [PATCH 1284/1455] feat(profile): aa uses word8 as bug files. --- apparmor.d/groups/apparmor/aa-enforce | 2 +- apparmor.d/groups/apparmor/aa-notify | 2 +- apparmor.d/groups/apparmor/aa-unconfined | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/apparmor/aa-enforce b/apparmor.d/groups/apparmor/aa-enforce index 1743fd9d0..1f8368045 100644 --- a/apparmor.d/groups/apparmor/aa-enforce +++ b/apparmor.d/groups/apparmor/aa-enforce @@ -31,7 +31,7 @@ profile aa-enforce @{exec_path} { owner /var/lib/snapd/apparmor/{,**} rw, owner @{tmp}/@{rand8} rw, - owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, + owner @{tmp}/apparmor-bugreport-@{word8}.txt rw, @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/apparmor/aa-notify b/apparmor.d/groups/apparmor/aa-notify index 7cb64af80..07706d052 100644 --- a/apparmor.d/groups/apparmor/aa-notify +++ b/apparmor.d/groups/apparmor/aa-notify @@ -45,7 +45,7 @@ profile aa-notify @{exec_path} { owner @{HOME}/.terminfo/@{int}/dumb r, owner @{tmp}/@{word8} rw, - owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, + owner @{tmp}/apparmor-bugreport-@{word8}.txt rw, @{PROC}/ r, @{PROC}/@{pid}/stat r, diff --git a/apparmor.d/groups/apparmor/aa-unconfined b/apparmor.d/groups/apparmor/aa-unconfined index 68729b7fe..7308a5ef0 100644 --- a/apparmor.d/groups/apparmor/aa-unconfined +++ b/apparmor.d/groups/apparmor/aa-unconfined @@ -29,7 +29,7 @@ profile aa-unconfined @{exec_path} flags=(attach_disconnected) { @{etc_ro}/inputrc r, owner @{tmp}/@{rand8} rw, - owner @{tmp}/apparmor-bugreport-@{rand8}.txt rw, + owner @{tmp}/apparmor-bugreport-@{word8}.txt rw, owner /var/tmp/@{rand8} rw, @{PROC}/ r, From cf96e7b1d0d37d050fba5a0e758190dc2059443f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 00:39:28 +0200 Subject: [PATCH 1285/1455] feat(profile): smal snap improvements. --- apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/snap/snap-update-ns | 5 +++++ apparmor.d/groups/snap/snapd | 7 ++++++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index b7706ccf4..b34d18c00 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -294,7 +294,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{run}/user/@{uid}/gnome-shell-disable-extensions rw, owner @{run}/user/@{uid}/gnome-shell/{,**} rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, - owner @{run}/user/@{uid}/snap.snap*/wayland-cursor-shared-* rw, + owner @{run}/user/@{uid}/snap.*/wayland-cursor-shared-@{rand6} rw, owner @{run}/user/@{uid}/systemd/notify rw, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, diff --git a/apparmor.d/groups/snap/snap-update-ns b/apparmor.d/groups/snap/snap-update-ns index 157651ac3..98ee0e5e7 100644 --- a/apparmor.d/groups/snap/snap-update-ns +++ b/apparmor.d/groups/snap/snap-update-ns @@ -40,11 +40,16 @@ profile snap-update-ns @{exec_path} { / r, /tmp/ r, + @{lib}/ r, /usr/ r, /usr/local/ r, /usr/local/share/ r, /usr/local/share/doc/ rw, /usr/local/share/fonts/ rw, + /usr/share/ r, + /usr/share/drirc.d w, + /usr/share/X11/ r, + /usr/share/X11/XErrorDB w, owner /snap/{,**} rw, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 7e2c288b6..06de56063 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -99,7 +99,8 @@ profile snapd @{exec_path} { /usr/share/bash-completion/{,**} r, /usr/share/dbus-1/{system,session}.d/{,snapd*} rw, /usr/share/dbus-1/services/*snap* r, - /usr/share/polkit-1/actions/{,**/} r, + /usr/share/polkit-1/actions/{,**} r, + /usr/share/polkit-1/actions/snap.*.policy r, @{etc_ro}/environment r, /etc/apparmor.d/*snapd.snap* r, @@ -147,6 +148,7 @@ profile snapd @{exec_path} { @{run}/user/ r, @{run}/user/@{uid}/ r, + @{run}/user/@{uid}/snap.*/{,**} rw, @{run}/user/@{uid}/snapd-session-agent.socket rw, @{run}/user/snap.*/{,**} rw, @@ -227,6 +229,9 @@ profile snapd @{exec_path} { include @{sbin}/runuser mr, + @{bin}/tar ix, + + owner @{HOME}/snap/*/common/.cache/{,**} r, include if exists } From 81d020173d4f0336a95cc6562c161336685abb51 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 21:09:09 +0200 Subject: [PATCH 1286/1455] feat(profile): general update. --- apparmor.d/groups/bus/dbus-accessibility | 6 +++--- apparmor.d/groups/children/child-open-strict | 2 ++ apparmor.d/groups/gnome/gnome-software | 7 ++++++- apparmor.d/groups/gnome/loupe | 2 ++ apparmor.d/groups/gnome/nautilus | 1 + apparmor.d/groups/gnome/papers | 4 +++- apparmor.d/groups/gpg/gpg | 3 ++- apparmor.d/groups/pacman/paccache | 3 +++ apparmor.d/groups/pacman/pacman-hook-code | 1 + .../systemd-generator-user-autostart | 3 +-- apparmor.d/groups/systemd/systemd-sleep | 2 ++ apparmor.d/groups/systemd/systemd-udevd | 1 + apparmor.d/groups/ubuntu/software-properties-gtk | 2 +- apparmor.d/groups/usb/lsusb | 1 + apparmor.d/groups/utils/dmesg | 1 + apparmor.d/groups/utils/lsblk | 1 + apparmor.d/groups/virt/cockpit-bridge | 5 +++++ apparmor.d/groups/virt/cockpit-session | 4 +++- apparmor.d/groups/virt/libvirt-dbus | 5 +++++ apparmor.d/groups/virt/libvirtd | 7 +++++++ apparmor.d/profiles-a-f/borg | 1 + apparmor.d/profiles-a-f/btop | 2 +- apparmor.d/profiles-a-f/console-setup | 2 +- apparmor.d/profiles-a-f/deltachat-desktop | 6 +++--- apparmor.d/profiles-g-l/gitstatusd | 4 ++-- apparmor.d/profiles-g-l/homebank | 2 +- apparmor.d/profiles-g-l/landscape-sysinfo | 2 +- apparmor.d/profiles-g-l/libreoffice | 2 ++ apparmor.d/profiles-g-l/linux-check-removal | 2 ++ apparmor.d/profiles-g-l/lsb-release | 14 ++++++++++---- apparmor.d/profiles-m-r/initramfs-hooks | 1 + apparmor.d/profiles-m-r/mdadm | 2 +- apparmor.d/profiles-m-r/protonmail-bridge-core | 1 + apparmor.d/profiles-s-z/spotify | 4 ++++ apparmor.d/profiles-s-z/syncthing | 5 +---- apparmor.d/profiles-s-z/tomb | 4 +++- apparmor.d/profiles-s-z/udev-fido_id | 1 + apparmor.d/profiles-s-z/virt-manager | 1 - apparmor.d/profiles-s-z/wemeet | 2 +- apparmor.d/profiles-s-z/which | 1 + 40 files changed, 89 insertions(+), 31 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index f876d1210..a8c13b3fd 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -9,12 +9,13 @@ include @{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { include - include include include include include + include include + include include network inet dgram, @@ -39,7 +40,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mrix, @@ -53,7 +54,6 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/defaults/at-spi2/{,**} r, /usr/share/gdm/greeter-dconf-defaults r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /etc/machine-id r, /var/lib/dbus/machine-id r, diff --git a/apparmor.d/groups/children/child-open-strict b/apparmor.d/groups/children/child-open-strict index 7faf52185..4296f03af 100644 --- a/apparmor.d/groups/children/child-open-strict +++ b/apparmor.d/groups/children/child-open-strict @@ -18,6 +18,8 @@ profile child-open-strict flags=(attach_disconnected,mediate_deleted) { @{browsers_path} Px, @{file_explorers_path} Px, + @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop mrix, + include if exists include if exists } diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 71141595b..f3845daef 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -33,7 +33,12 @@ profile gnome-software @{exec_path} { #aa:dbus own bus=session name=org.freedesktop.PackageKit #aa:dbus own bus=session name=org.gnome.Software interface+=org.freedesktop.Application - #aa:dbus talk bus=system name=org.freedesktop.PackageKit path=/ label="@{p_packagekitd}" + #aa:dbus talk bus=system name=org.freedesktop.PackageKit path=/@{int}_@{hex8} label="@{p_packagekitd}" + + dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority + interface=org.freedesktop.PolicyKit1.Authority + member=Changed + peer=(name=@{busname}, label=polkitd), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index 398b2b679..cabcca062 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -27,6 +27,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) { signal send set=kill peer=loupe//bwrap, + #aa:dbus own bus=session name=org.gnome.Loupe interface+=org.freedesktop.Application + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" dbus send bus=system path=/org/freedesktop/hostname1 diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 5ad6bb7b5..d8e7c3341 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -35,6 +35,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.Nautilus.SearchProvider interface+=org.gnome.Shell.SearchProvider2 #aa:dbus talk bus=session name=org.freedesktop.Application path=/ label="*" + #aa:dbus talk bus=session name=org.freedesktop.impl.portal.FileChooser label=xdg-desktop-portal-gnome #aa:dbus talk bus=session name=org.gnome.Settings label=gnome-control-center #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell #aa:dbus talk bus=session name=org.gtk.Notifications label=gnome-shell diff --git a/apparmor.d/groups/gnome/papers b/apparmor.d/groups/gnome/papers index 9a22e3de8..0318c7265 100644 --- a/apparmor.d/groups/gnome/papers +++ b/apparmor.d/groups/gnome/papers @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/papers -profile papers @{exec_path} { +profile papers @{exec_path} flags=(attach_disconnected) { include include include @@ -16,6 +16,8 @@ profile papers @{exec_path} { include include + #aa:dbus own bus=session name=org.gnome.Papers interface+=org.freedesktop.Application + #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @{exec_path} mr, diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index b65823520..40c23b660 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -29,7 +29,7 @@ profile gpg @{exec_path} { @{lib}/{,gnupg/}scdaemon rPx, /usr/share/terminfo/** r, - /usr/share/keyrings/** rw, #aa:only apt + /usr/share/keyrings/** rw, #aa:only apt /usr/share/pacman/keyrings/** r, #aa:only pacman /etc/inputrc r, @@ -39,6 +39,7 @@ profile gpg @{exec_path} { /etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**, #aa:only apt + /etc/apt/trusted.gpg.d/{,*} r, owner /etc/apt/keyrings/ rw, owner /etc/apt/keyrings/** rwkl -> /etc/apt/keyrings/**, diff --git a/apparmor.d/groups/pacman/paccache b/apparmor.d/groups/pacman/paccache index 8331951e7..d68c0b832 100644 --- a/apparmor.d/groups/pacman/paccache +++ b/apparmor.d/groups/pacman/paccache @@ -41,6 +41,9 @@ profile paccache @{exec_path} flags=(attach_disconnected) { /var/cache/pacman/pkg/{,*} rw, /var/lib/pacman/{,**} r, + @{HOME}/@{XDG_GPG_DIR}/gpg.conf r, + @{HOME}/@{XDG_GPG_DIR}/gpgsm.conf r, + owner @{PROC}/@{pid}/fd/ r, /dev/tty rw, diff --git a/apparmor.d/groups/pacman/pacman-hook-code b/apparmor.d/groups/pacman/pacman-hook-code index ee23781f4..3e916efe3 100644 --- a/apparmor.d/groups/pacman/pacman-hook-code +++ b/apparmor.d/groups/pacman/pacman-hook-code @@ -19,6 +19,7 @@ profile pacman-hook-code @{exec_path} { @{python_path} rix, @{lib}/code/product.json rw, + @{lib}/code/out/vs/code/electron-utility/sharedProcess/sharedProcessMain.js w, /usr/share/code-{features,marketplace}{,-insiders}/{,*} r, /usr/share/code-{features,marketplace}{,-insiders}/cache.json rw, diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-user-autostart b/apparmor.d/groups/systemd-generators/systemd-generator-user-autostart index 8e3ebb6b3..ff4c74664 100644 --- a/apparmor.d/groups/systemd-generators/systemd-generator-user-autostart +++ b/apparmor.d/groups/systemd-generators/systemd-generator-user-autostart @@ -10,14 +10,13 @@ include profile systemd-generator-user-autostart @{exec_path} flags=(attach_disconnected) { include include + include include capability net_admin, @{exec_path} mr, - @{system_share_dirs}/applications/*.desktop r, - @{etc_ro}/xdg/autostart/{,*.desktop} r, owner @{user_config_dirs}/autostart/{,*.desktop} r, diff --git a/apparmor.d/groups/systemd/systemd-sleep b/apparmor.d/groups/systemd/systemd-sleep index d7c61e336..a55bf752d 100644 --- a/apparmor.d/groups/systemd/systemd-sleep +++ b/apparmor.d/groups/systemd/systemd-sleep @@ -19,6 +19,8 @@ profile systemd-sleep @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{sh_path} mr, + @{lib}/systemd/system-sleep/grub2.sleep rPx, @{lib}/systemd/system-sleep/hdparm rPx, @{lib}/systemd/system-sleep/nvidia rPx, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 62bada2a8..640e48f3f 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -98,6 +98,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected) { @{run}/systemd/network/ r, @{run}/systemd/network/*.link rw, @{run}/systemd/notify rw, + @{run}/systemd/private rw, @{run}/systemd/seats/seat@{int} r, @{att}/@{run}/systemd/notify w, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 440ef4117..af91c7eaa 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -64,7 +64,7 @@ profile software-properties-gtk @{exec_path} flags=(attach_disconnected) { /dev/shm/ r, owner /dev/shm/sem.@{rand6} rwl -> /dev/shm/sem.@{rand6}, - owner /dev/shm/sem.mp-@{rand8} rw, + owner /dev/shm/sem.mp-@{rand8} rwl -> /dev/shm/sem.@{rand6}, owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, diff --git a/apparmor.d/groups/usb/lsusb b/apparmor.d/groups/usb/lsusb index b5a24940d..a10659292 100644 --- a/apparmor.d/groups/usb/lsusb +++ b/apparmor.d/groups/usb/lsusb @@ -14,6 +14,7 @@ profile lsusb @{exec_path} { include capability net_admin, + capability sys_admin, network netlink raw, diff --git a/apparmor.d/groups/utils/dmesg b/apparmor.d/groups/utils/dmesg index 14ace0dea..2976d1316 100644 --- a/apparmor.d/groups/utils/dmesg +++ b/apparmor.d/groups/utils/dmesg @@ -13,6 +13,7 @@ profile dmesg @{exec_path} flags=(attach_disconnected) { include capability dac_read_search, + capability sys_admin, capability syslog, @{exec_path} mr, diff --git a/apparmor.d/groups/utils/lsblk b/apparmor.d/groups/utils/lsblk index 7559e4e48..6fc1d5bb2 100644 --- a/apparmor.d/groups/utils/lsblk +++ b/apparmor.d/groups/utils/lsblk @@ -27,6 +27,7 @@ profile lsblk @{exec_path} flags=(attach_disconnected) { # File Inherit deny network inet stream, deny network inet6 stream, + deny owner @{user_share_dirs}/gnome-shell/session.gvdb rw, include if exists } diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index bf3d48204..d8c71803d 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -11,7 +11,10 @@ profile cockpit-bridge @{exec_path} { include include include + include + include include + include include include @@ -37,6 +40,8 @@ profile cockpit-bridge @{exec_path} { #aa:dbus talk bus=session name=org.libvirt label=libvirt-dbus #aa:dbus talk bus=system name=org.freedesktop.PackageKit path=/** label=packagekitd + #aa:dbus talk bus=system name=org.freedesktop.systemd1 label=@{p_systemd} + #aa:dbus talk bus=system name=org.libvirt label=libvirt-dbus @{exec_path} mr, diff --git a/apparmor.d/groups/virt/cockpit-session b/apparmor.d/groups/virt/cockpit-session index 3fbefadb7..ba51fc8a5 100644 --- a/apparmor.d/groups/virt/cockpit-session +++ b/apparmor.d/groups/virt/cockpit-session @@ -10,6 +10,7 @@ include profile cockpit-session @{exec_path} flags=(attach_disconnected) { include include + include include include @@ -28,7 +29,8 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) { @{shells_path} rix, @{bin}/cockpit-bridge rPx, @{lib}/cockpit/cockpit-pcp rPx, - @{bin}/ssh-agent rPx, + @{bin}/ssh-agent rPx, + @{bin}/ssh-add rix, @{etc_ro}/environment r, @{etc_ro}/security/limits.d/{,*.conf} r, diff --git a/apparmor.d/groups/virt/libvirt-dbus b/apparmor.d/groups/virt/libvirt-dbus index f3bbaf019..971cdf55e 100644 --- a/apparmor.d/groups/virt/libvirt-dbus +++ b/apparmor.d/groups/virt/libvirt-dbus @@ -16,6 +16,11 @@ profile libvirt-dbus @{exec_path} { #aa:dbus own bus=session name=org.libvirt #aa:dbus own bus=system name=org.libvirt + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, @{sbin}/libvirtd rPx, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 44d6962f5..f10da1798 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -92,6 +92,11 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { # Allow changing to our UUID-based named profiles change_profile -> libvirt-@{uuid}, + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, @{lib}/libvirt/libvirt_iohelper rix, @@ -157,6 +162,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{user_vm_dirs}/{,**} rwk, @{user_publicshare_dirs}/{,**} rwk, + owner @{user_config_dirs}/libvirt/{,**} rwk, + owner @{run}/user/@{uid}/libvirt/ rw, owner @{run}/user/@{uid}/libvirt/** rwk, diff --git a/apparmor.d/profiles-a-f/borg b/apparmor.d/profiles-a-f/borg index 6d2683ade..544be3be0 100644 --- a/apparmor.d/profiles-a-f/borg +++ b/apparmor.d/profiles-a-f/borg @@ -33,6 +33,7 @@ profile borg @{exec_path} { @{bin}/cat rix, @{sbin}/ldconfig rix, @{bin}/uname rix, + @{bin}/ip rix, @{bin}/ccache rCx -> ccache, @{bin}/fusermount{,3} rCx -> fusermount, diff --git a/apparmor.d/profiles-a-f/btop b/apparmor.d/profiles-a-f/btop index 4910629ce..bac8aea75 100644 --- a/apparmor.d/profiles-a-f/btop +++ b/apparmor.d/profiles-a-f/btop @@ -48,7 +48,7 @@ profile btop @{exec_path} { @{sys}/devices/system/node/node@{int}/cpumap r, @{sys}/devices/virtual/block/dm-@{int}/stat r, @{sys}/devices/virtual/net/{,**} r, - @{sys}/devices/virtual/thermal/thermal_zone@{int}/{,} r, + @{sys}/devices/virtual/thermal/thermal_zone@{int}/{,*} r, @{PROC} r, @{PROC}/@{pids}/cmdline r, diff --git a/apparmor.d/profiles-a-f/console-setup b/apparmor.d/profiles-a-f/console-setup index 7a11e407f..aa0a56648 100644 --- a/apparmor.d/profiles-a-f/console-setup +++ b/apparmor.d/profiles-a-f/console-setup @@ -13,7 +13,7 @@ profile console-setup @{exec_path} { @{exec_path} mr, @{sh_path} r, - @{bin}/uname rPx, + @{bin}/uname rix, @{bin}/mkdir rix, @{run}/console-setup/ rw, diff --git a/apparmor.d/profiles-a-f/deltachat-desktop b/apparmor.d/profiles-a-f/deltachat-desktop index 87c2bbaba..2e7723995 100644 --- a/apparmor.d/profiles-a-f/deltachat-desktop +++ b/apparmor.d/profiles-a-f/deltachat-desktop @@ -13,16 +13,16 @@ include @{exec_path} = @{bin}/deltachat-desktop @{lib_dirs}/deltachat-desktop profile deltachat-desktop @{exec_path} { include + include include include - include - include include + include include + include include include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-g-l/gitstatusd b/apparmor.d/profiles-g-l/gitstatusd index 579536674..aabde9cef 100644 --- a/apparmor.d/profiles-g-l/gitstatusd +++ b/apparmor.d/profiles-g-l/gitstatusd @@ -13,12 +13,12 @@ profile gitstatusd @{exec_path} { include signal receive set=term peer=*//shell, - signal receive set=term peer=vscode, + signal receive set=term peer={,vs}code, @{exec_path} mr, owner @{user_projects_dirs}/{,**} r, - owner @{user_projects_dirs}/**/.git/.gitstatus.@{rand6}/{,**} rw, + owner @{user_projects_dirs}/**/.git/{,**/}.gitstatus.@{rand6}/{,**} rw, owner @{HOME}/.gitconfig r, owner @{user_config_dirs}/git/{,*} r, diff --git a/apparmor.d/profiles-g-l/homebank b/apparmor.d/profiles-g-l/homebank index cb459919f..7fbe74040 100644 --- a/apparmor.d/profiles-g-l/homebank +++ b/apparmor.d/profiles-g-l/homebank @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/homebank -profile homebank @{exec_path} { +profile homebank @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/profiles-g-l/landscape-sysinfo b/apparmor.d/profiles-g-l/landscape-sysinfo index 2370271ec..47cbb22a2 100644 --- a/apparmor.d/profiles-g-l/landscape-sysinfo +++ b/apparmor.d/profiles-g-l/landscape-sysinfo @@ -38,7 +38,7 @@ profile landscape-sysinfo @{exec_path} { @{sys}/class/hwmon/ r, @{sys}/class/thermal/ r, - @{sys}/devices/virtual/thermal/thermal_zone@{int}/temp r, + @{sys}/devices/virtual/thermal/thermal_zone@{int}/{,*} r, @{PROC}/ r, @{PROC}/@{pids}/cmdline r, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 0a9e6dfc2..dfb9361f3 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -27,6 +27,7 @@ profile libreoffice @{exec_path} { include include include + include include include include @@ -107,6 +108,7 @@ profile libreoffice @{exec_path} { owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} rw, owner @{run}/user/@{uid}/#@{int} rw, + owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, @{sys}/devices/system/cpu/cpu@{int}/microcode/version r, @{sys}/devices/virtual/block/**/queue/rotational r, diff --git a/apparmor.d/profiles-g-l/linux-check-removal b/apparmor.d/profiles-g-l/linux-check-removal index 04d2f0330..f2895299f 100644 --- a/apparmor.d/profiles-g-l/linux-check-removal +++ b/apparmor.d/profiles-g-l/linux-check-removal @@ -16,6 +16,8 @@ profile linux-check-removal @{exec_path} { @{bin}/stty rix, + /etc/shadow r, + include if exists } diff --git a/apparmor.d/profiles-g-l/lsb-release b/apparmor.d/profiles-g-l/lsb-release index d2d52d362..5214632dc 100644 --- a/apparmor.d/profiles-g-l/lsb-release +++ b/apparmor.d/profiles-g-l/lsb-release @@ -30,10 +30,16 @@ profile lsb-release @{exec_path} flags=(attach_disconnected) { #aa:only apt @{bin}/dpkg-query px, - /etc/ r, - /etc/*-release r, - /etc/lsb-release r, - /etc/lsb-release.d/{,*} r, + @{etc_ro}/ r, + @{etc_ro}/*-release r, + @{etc_ro}/lsb-release r, + @{etc_ro}/lsb-release.d/{,*} r, + + # file_inherit + deny /opt/*/** r, + deny owner @{user_config_dirs}/*/** r, + deny owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, + deny owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, include if exists } diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index cae5c1c3d..136536764 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -68,6 +68,7 @@ profile initramfs-hooks @{exec_path} { owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**, owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw, + owner /tmp/tmp.@{rand10}/modules_@{rand6} rw, @{sys}/firmware/efi/efivars/ r, diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm index 15adcb9e6..4cc5fc9fb 100644 --- a/apparmor.d/profiles-m-r/mdadm +++ b/apparmor.d/profiles-m-r/mdadm @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{sbin}/mdadm -profile mdadm @{exec_path} { +profile mdadm @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core index ca9680aea..a9bd819e3 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge-core +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -33,6 +33,7 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) { /etc/lsb-release r, /etc/machine-id r, + /etc/os-release r, owner @{user_passwordstore_dirs}/docker-credential-helpers/{,**} r, owner @{user_passwordstore_dirs}/protonmail-credentials/{,**} r, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index f245e4312..ed1ccfe1c 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -57,6 +57,8 @@ profile spotify @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open-strict, + /usr/local/lib/spotify-adblock.so mr, + /etc/machine-id r, /etc/spotify-adblock/* r, /var/lib/dbus/machine-id r, @@ -70,6 +72,8 @@ profile spotify @{exec_path} flags=(attach_disconnected) { owner @{cache_dirs}/WidevineCdm/**/libwidevinecdm.so rm, owner @{config_dirs}/*/WidevineCdm/**/libwidevinecdm.so rm, + owner @{tmp}/.@{domain}.@{rand6}/{,**} rw, + @{PROC}/@{pid}/net/unix r, @{PROC}/pressure/* r, owner @{PROC}/@{pid}/clear_refs w, diff --git a/apparmor.d/profiles-s-z/syncthing b/apparmor.d/profiles-s-z/syncthing index 83e1b2f45..d504b0c15 100644 --- a/apparmor.d/profiles-s-z/syncthing +++ b/apparmor.d/profiles-s-z/syncthing @@ -11,6 +11,7 @@ include profile syncthing @{exec_path} { include include + include include include include @@ -26,10 +27,6 @@ profile syncthing @{exec_path} { @{open_path} rPx -> child-open, @{bin}/ip rix, - /usr/share/mime/{,**} r, - - /etc/mime.types r, - @{HOME}/ r, @{HOME}/** rwk, diff --git a/apparmor.d/profiles-s-z/tomb b/apparmor.d/profiles-s-z/tomb index 9b0912bd9..df4258b8c 100644 --- a/apparmor.d/profiles-s-z/tomb +++ b/apparmor.d/profiles-s-z/tomb @@ -21,6 +21,7 @@ profile tomb @{exec_path} { capability sys_rawio, signal send set=cont peer=gpg, + signal send set=cont peer=pinentry-*, ptrace read peer=@{p_systemd_user}, @@ -43,11 +44,11 @@ profile tomb @{exec_path} { @{bin}/findmnt rix, @{bin}/getent rix, @{bin}/gettext rix, + @{bin}/head rix, @{bin}/hostname rix, @{bin}/id rix, @{bin}/kill rix, @{bin}/locate rix, - @{sbin}/losetup rix, @{bin}/ls rix, @{bin}/lsof rix, @{bin}/mkdir rix, @@ -64,6 +65,7 @@ profile tomb @{exec_path} { @{bin}/touch rix, @{bin}/tr rix, @{bin}/zsh rix, + @{sbin}/losetup rix, @{sbin}/btrfs rPx, @{sbin}/cryptsetup rPUx, diff --git a/apparmor.d/profiles-s-z/udev-fido_id b/apparmor.d/profiles-s-z/udev-fido_id index 76ec27b68..9c686b19d 100644 --- a/apparmor.d/profiles-s-z/udev-fido_id +++ b/apparmor.d/profiles-s-z/udev-fido_id @@ -16,6 +16,7 @@ profile udev-fido_id @{exec_path} { /etc/udev/udev.conf r, @{sys}/devices/@{pci}/report_descriptor r, + @{sys}/devices/platform/**/report_descriptor r, @{sys}/devices/virtual/**/report_descriptor r, include if exists diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index aed85abe3..8a1b5f355 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -51,7 +51,6 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open, - /usr/share/gtksourceview-4/{,**} r, /usr/share/ladspa/rdf/{,ladspa.rdfs} r, /usr/share/misc/*.ids r, /usr/share/osinfo/{,**} r, diff --git a/apparmor.d/profiles-s-z/wemeet b/apparmor.d/profiles-s-z/wemeet index 3606533d7..0b83e44c8 100644 --- a/apparmor.d/profiles-s-z/wemeet +++ b/apparmor.d/profiles-s-z/wemeet @@ -13,10 +13,10 @@ include @{exec_path} += /opt/wemeet/bin/QtWebEngineProcess profile wemeet @{exec_path} flags=(attach_disconnected) { include - include include include include + include include include include diff --git a/apparmor.d/profiles-s-z/which b/apparmor.d/profiles-s-z/which index df049741f..c4de427ff 100644 --- a/apparmor.d/profiles-s-z/which +++ b/apparmor.d/profiles-s-z/which @@ -33,6 +33,7 @@ profile which @{exec_path} flags=(attach_disconnected) { owner /dev/tty@{int} rw, + deny @{user_share_dirs}/gnome-shell/session.gvdb rw, deny @{user_share_dirs}/gvfs-metadata/* r, include if exists From 4db65834a402444b18a10fc7e43b879dc79f5ff5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 21:15:42 +0200 Subject: [PATCH 1287/1455] feat(abs): glibc: restrict auxv maps and statux to owner. --- apparmor.d/abstractions/glibc | 12 +++++++++--- apparmor.d/groups/apt/apt-overlay | 1 - apparmor.d/groups/polkit/polkitd | 3 ++- apparmor.d/groups/procps/ps | 1 + apparmor.d/groups/systemd/systemd-journald | 1 + apparmor.d/groups/virt/libvirtd | 2 +- apparmor.d/profiles-m-r/mdevctl | 2 -- apparmor.d/profiles-s-z/syncoid | 2 -- 8 files changed, 14 insertions(+), 10 deletions(-) diff --git a/apparmor.d/abstractions/glibc b/apparmor.d/abstractions/glibc index aa6e14416..8536470bd 100644 --- a/apparmor.d/abstractions/glibc +++ b/apparmor.d/abstractions/glibc @@ -22,9 +22,15 @@ @{PROC}/stat r, # Glibc's *printf protections read the maps file - @{PROC}/@{pid}/auxv r, - @{PROC}/@{pid}/maps r, - @{PROC}/@{pid}/status r, + owner @{PROC}/@{pid}/auxv r, + owner @{PROC}/@{pid}/maps r, + owner @{PROC}/@{pid}/status r, + + # @{PROC}/@{pid}/map_files/ contains the same info than @{PROC}/@{pid}/maps, + # but in a format that is simpler to manage, because it doesn't require to + # parse the text data inside a file, but just reading the contents of + # a directory. + owner @{PROC}/@{pid}/map_files/ r, # Glibc statvfs @{PROC}/filesystems r, diff --git a/apparmor.d/groups/apt/apt-overlay b/apparmor.d/groups/apt/apt-overlay index 4ba9e57d7..7f59635eb 100644 --- a/apparmor.d/groups/apt/apt-overlay +++ b/apparmor.d/groups/apt/apt-overlay @@ -30,7 +30,6 @@ profile apt-overlay @{exec_path} { /root/ r, owner @{PROC}/@{pids}/loginuid r, - owner @{PROC}/@{pids}/maps r, include if exists } diff --git a/apparmor.d/groups/polkit/polkitd b/apparmor.d/groups/polkit/polkitd index c2de7f8b6..fa00311cd 100644 --- a/apparmor.d/groups/polkit/polkitd +++ b/apparmor.d/groups/polkit/polkitd @@ -65,8 +65,9 @@ profile polkitd @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cmdline r, - @{PROC}/@{pid}/fdinfo/@{int} r, + @{PROC}/@{pids}/fdinfo/@{int} r, @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, @{PROC}/@{pids}/task/@{tid}/stat r, @{PROC}/1/environ r, @{PROC}/cmdline r, diff --git a/apparmor.d/groups/procps/ps b/apparmor.d/groups/procps/ps index 1d9ae50cb..7663cbf5d 100644 --- a/apparmor.d/groups/procps/ps +++ b/apparmor.d/groups/procps/ps @@ -34,6 +34,7 @@ profile ps @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/loginuid r, @{PROC}/@{pids}/stat r, @{PROC}/@{pids}/statm r, + @{PROC}/@{pids}/status r, @{PROC}/@{pids}/task/ r, @{PROC}/@{pids}/task/@{tid}/cmdline r, @{PROC}/@{pids}/task/@{tid}/stat r, diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index ad3d96990..2765d8f10 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -82,6 +82,7 @@ profile systemd-journald @{exec_path} flags=(attach_disconnected,mediate_deleted @{PROC}/@{pids}/comm r, @{PROC}/@{pids}/loginuid r, @{PROC}/@{pids}/sessionid r, + @{PROC}/@{pids}/status r, @{PROC}/pressure/* r, @{PROC}/sys/kernel/hostname r, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index f10da1798..2b0530ef5 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -284,7 +284,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { /etc/qemu/{,**} r, - owner @{PROC}/@{pids}/status r, + @{PROC}/@{pids}/status r, /dev/net/tun rw, diff --git a/apparmor.d/profiles-m-r/mdevctl b/apparmor.d/profiles-m-r/mdevctl index 906dcf512..408947c83 100644 --- a/apparmor.d/profiles-m-r/mdevctl +++ b/apparmor.d/profiles-m-r/mdevctl @@ -19,8 +19,6 @@ profile mdevctl @{exec_path} { @{sys}/class/mdev_bus/ r, @{sys}/devices/@{pci}/mdev_supported_types/{,**} r, - @{PROC}/@{pids}/maps r, - include if exists } diff --git a/apparmor.d/profiles-s-z/syncoid b/apparmor.d/profiles-s-z/syncoid index e275fb764..fc30c5fd6 100644 --- a/apparmor.d/profiles-s-z/syncoid +++ b/apparmor.d/profiles-s-z/syncoid @@ -25,8 +25,6 @@ profile syncoid @{exec_path} flags=(complain) { /etc/mbuffer.rc r, - @{PROC}/@{pids}/maps r, - include if exists } From 544204e511ce6938fb2da2b9f01d28fd3ce34338 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 21:22:22 +0200 Subject: [PATCH 1288/1455] feat(abs): add the user-dirs abstraction. --- apparmor.d/abstractions/desktop | 1 + apparmor.d/abstractions/gnome-strict | 1 + apparmor.d/abstractions/kde-strict | 1 + apparmor.d/abstractions/user-dirs | 14 ++++++++++++++ .../groups/freedesktop/xdg-user-dirs-gtk-update | 2 +- apparmor.d/groups/freedesktop/xdg-user-dirs-update | 4 +--- apparmor.d/groups/systemd/systemd-path | 3 +-- apparmor.d/profiles-g-l/grim | 3 +-- apparmor.d/profiles-s-z/spice-vdagent | 8 ++++---- 9 files changed, 25 insertions(+), 12 deletions(-) create mode 100644 apparmor.d/abstractions/user-dirs diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 4a32a1aa7..1bb4c20ea 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -17,6 +17,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 445c62e6b..72d09126e 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -12,6 +12,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 5fbdd7869..02a0bc9c5 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -12,6 +12,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/user-dirs b/apparmor.d/abstractions/user-dirs new file mode 100644 index 000000000..189f8eb38 --- /dev/null +++ b/apparmor.d/abstractions/user-dirs @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + /etc/xdg/user-dirs.conf r, + /etc/xdg/user-dirs.defaults r, + + owner @{user_config_dirs}/user-dirs.dirs r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update index b2ae65450..cf488af63 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update @@ -14,13 +14,13 @@ profile xdg-user-dirs-gtk-update @{exec_path} { include include include + include @{exec_path} mr, @{bin}/xdg-user-dirs-update Px, owner @{user_config_dirs}/gtk-3.0/bookmarks* rw, - owner @{user_config_dirs}/user-dirs.dirs r, owner @{user_config_dirs}/user-dirs.locale r, owner @{tmp}/dirs-@{rand6} rw, diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-update index 7177703a9..09c66d6ac 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-update @@ -9,13 +9,11 @@ include @{exec_path} = @{bin}/xdg-user-dirs-update profile xdg-user-dirs-update @{exec_path} { include + include include @{exec_path} mr, - /etc/xdg/user-dirs.conf r, - /etc/xdg/user-dirs.defaults r, - owner @{desktop_config_dirs}/ rw, owner @{desktop_config_dirs}/user-dirs.dirs{,*} rw, owner @{desktop_config_dirs}/user-dirs.locale rw, diff --git a/apparmor.d/groups/systemd/systemd-path b/apparmor.d/groups/systemd/systemd-path index 747527776..0d061d845 100644 --- a/apparmor.d/groups/systemd/systemd-path +++ b/apparmor.d/groups/systemd/systemd-path @@ -10,11 +10,10 @@ include profile systemd-path @{exec_path} { include include + include @{exec_path} mr, - owner @{user_config_dirs}/user-dirs.dirs r, - include if exists } diff --git a/apparmor.d/profiles-g-l/grim b/apparmor.d/profiles-g-l/grim index 9e40a8aca..5717837ec 100644 --- a/apparmor.d/profiles-g-l/grim +++ b/apparmor.d/profiles-g-l/grim @@ -9,12 +9,11 @@ include @{exec_path} = @{bin}/grim profile grim @{exec_path} { include + include include @{exec_path} mr, - owner @{user_config_dirs}/user-dirs.dirs r, - owner @{HOME}/@{int8}_**_grim.png w, owner /dev/shm/grim-@{rand6} rw, diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index c73f5f678..158ea6a7f 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/spice-vdagent profile spice-vdagent @{exec_path} flags=(attach_disconnected) { include - include include include include @@ -20,10 +19,12 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { include include include - include - include + include include + include + include include + include dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Realtime @@ -38,7 +39,6 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, owner @{desktop_config_dirs}/user-dirs.dirs r, - owner @{user_config_dirs}/user-dirs.dirs r, @{run}/spice-vdagentd/spice-vdagent-sock rw, From e50e87bd618543d9a638b4512bf8d72b82eb9524 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 21:23:14 +0200 Subject: [PATCH 1289/1455] feat(abs): update base additions. --- apparmor.d/abstractions/base.d/complete | 28 +++++++++++++------------ 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index ad3945eb9..d89688b70 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -8,20 +8,20 @@ signal receive peer=@{p_systemd_user}, # Allow to receive some signals from new well-known profiles - signal (receive) peer=btop, - signal (receive) peer=htop, - signal (receive) peer=pkill, - signal (receive) peer=sudo, - signal (receive) peer=top, - signal (receive) set=(cont,term,kill,stop) peer=systemd-shutdown, - signal (receive) set=(hup term) peer=login, - signal (receive) set=(hup) peer=xinit, - signal (receive) set=(term,kill) peer=gnome-shell, - signal (receive) set=(term,kill) peer=gnome-system-monitor, - signal (receive) set=(term,kill) peer=openbox, - signal (receive) set=(term,kill) peer=su, + signal receive peer=btop, + signal receive peer=htop, + signal receive peer=pkill, + signal receive peer=sudo, + signal receive peer=top, + signal receive set=(cont,term,kill,stop) peer=systemd-shutdown, + signal receive set=(hup term) peer=login, + signal receive set=(hup) peer=xinit, + signal receive set=(term,kill) peer=gnome-shell, + signal receive set=(term,kill) peer=gnome-system-monitor, + signal receive set=(term,kill) peer=openbox, + signal receive set=(term,kill) peer=su, - ptrace (readby) peer=@{p_systemd_coredump}, + ptrace readby peer=@{p_systemd_coredump}, @{etc_rw}/localtime r, /etc/locale.conf r, @@ -30,4 +30,6 @@ @{PROC}/sys/kernel/core_pattern r, + /apparmor/.null rw, + # vim:syntax=apparmor From 5faca8461df97d62d065ca8a7430405621d39e54 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 21:23:59 +0200 Subject: [PATCH 1290/1455] feat(abs): remove user-dirs from recently-used abs. --- apparmor.d/abstractions/recently-used | 2 -- 1 file changed, 2 deletions(-) diff --git a/apparmor.d/abstractions/recently-used b/apparmor.d/abstractions/recently-used index d3a7ec289..66a80867b 100644 --- a/apparmor.d/abstractions/recently-used +++ b/apparmor.d/abstractions/recently-used @@ -14,8 +14,6 @@ owner @{user_share_dirs}/recently-used.xbel.@{rand6} rwl, owner @{user_share_dirs}/recently-used.xbel.lock rwk, - owner @{user_config_dirs}/user-dirs.dirs r, # FIXME: not here? - include if exists # vim:syntax=apparmor From c9813dc34f241e392d055234d754b76a0e803102 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 21:26:17 +0200 Subject: [PATCH 1291/1455] feat(abs): improve dbus rules in open & common gnome abs. --- apparmor.d/abstractions/app/open | 3 ++- apparmor.d/abstractions/common/gnome | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index 243d18261..3d91de235 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -7,6 +7,8 @@ abi , + include + include include # We cannot use `@{open_path} mrix,` here because it includes: @@ -30,7 +32,6 @@ include include - include include include include diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index 056f6581b..f0dd20f47 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -9,6 +9,8 @@ include include include + include + include include include include From 61d8cee932d7671302f786f8f7f2b84d0d057bdf Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 28 Aug 2025 21:27:58 +0200 Subject: [PATCH 1292/1455] feat(profile): ssh: cleanup. --- apparmor.d/groups/ssh/ssh-agent | 1 + apparmor.d/groups/ssh/ssh-keygen | 3 ++- apparmor.d/groups/ssh/sshd | 2 +- apparmor.d/groups/ssh/sshfs | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/ssh/ssh-agent b/apparmor.d/groups/ssh/ssh-agent index f6732b1cf..9fc2900b4 100644 --- a/apparmor.d/groups/ssh/ssh-agent +++ b/apparmor.d/groups/ssh/ssh-agent @@ -13,6 +13,7 @@ profile ssh-agent @{exec_path} { include signal receive set=term peer=cockpit-bridge, + signal receive set=term peer=cockpit-session, signal receive set=term peer=gnome-keyring-daemon, @{exec_path} mr, diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index b55824e58..1b6dd5e98 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -18,7 +18,8 @@ profile ssh-keygen @{exec_path} { /etc/ssh/moduli rw, /etc/ssh/ssh_host_*_key* rw, - owner @{HOME}/@{XDG_SSH_DIR}/{,*} rw, + owner @{HOME}/@{XDG_SSH_DIR}/ rw, + owner @{HOME}/@{XDG_SSH_DIR}/* rwl -> @{HOME}/@{XDG_SSH_DIR}/*, owner /tmp/snapd@{int}/*_*{,.pub} w, owner /tmp/snapd@{int}/*.key{,.pub} w, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 63f2c1370..40cf0bca2 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -102,7 +102,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) { owner @{user_download_dirs}/{,**} rwl, owner @{user_sync_dirs}/{,**} rwl, - @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r, + @{HOME}/@{XDG_SSH_DIR}/authorized_keys* r, owner @{user_cache_dirs}/{,motd*} rw, @{att}/@{run}/systemd/sessions/@{int}.ref rw, diff --git a/apparmor.d/groups/ssh/sshfs b/apparmor.d/groups/ssh/sshfs index 12e7d8930..ee6a2f903 100644 --- a/apparmor.d/groups/ssh/sshfs +++ b/apparmor.d/groups/ssh/sshfs @@ -18,7 +18,7 @@ profile sshfs @{exec_path} flags=(complain) { mount fstype=fuse.sshfs -> @{MOUNTS}/*/, mount fstype=fuse.sshfs -> @{MOUNTS}/*/*/, - unix (connect, send, receive) type=stream peer=(label="sshfs//fusermount",addr=none), + unix (connect, send, receive) type=stream peer=(label="sshfs//fusermount"), @{exec_path} mr, From 5d1ef4087741d3acf84fe50b26c5669ade291f10 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 29 Aug 2025 19:55:42 +0200 Subject: [PATCH 1293/1455] feat(profile): add some missing proc access. Due to recent changes in base-strict. --- apparmor.d/abstractions/app/pgrep | 1 + apparmor.d/groups/gnome/gdm-generate-config | 7 ++++--- apparmor.d/groups/procps/htop | 1 + 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/app/pgrep b/apparmor.d/abstractions/app/pgrep index 0ec14bea0..f563712ca 100644 --- a/apparmor.d/abstractions/app/pgrep +++ b/apparmor.d/abstractions/app/pgrep @@ -19,6 +19,7 @@ @{sys}/devices/system/node/node@{int}/meminfo r, @{PROC}/ r, + @{PROC}/@{pid}/status r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/environ r, diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index 9d910cdd2..6e67866f5 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -42,9 +42,10 @@ profile gdm-generate-config @{exec_path} { @{sys}/devices/system/node/node@{int}/meminfo r, @{PROC}/ r, - @{PROC}/@{pid}/cgroup r, - @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pid}/stat r, + @{PROC}/@{pids}/cgroup r, + @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/status r, + @{PROC}/@{pids}/stat r, @{PROC}/uptime r, profile pgrep { diff --git a/apparmor.d/groups/procps/htop b/apparmor.d/groups/procps/htop index d59fde5e5..4937f6875 100644 --- a/apparmor.d/groups/procps/htop +++ b/apparmor.d/groups/procps/htop @@ -105,6 +105,7 @@ profile htop @{exec_path} { @{PROC}/@{pids}/comm r, @{PROC}/@{pids}/environ r, @{PROC}/@{pids}/io r, + @{PROC}/@{pids}/maps r, @{PROC}/@{pids}/mounts r, @{PROC}/@{pids}/net/dev r, @{PROC}/@{pids}/oom_{,score_}adj r, From be0d481068929ddd1787bbf8cb16a9cf4619deed Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 29 Aug 2025 19:56:41 +0200 Subject: [PATCH 1294/1455] feat(profile): remove common/systemd from systemd-detect-virt. --- apparmor.d/groups/systemd/systemd-detect-virt | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/systemd/systemd-detect-virt b/apparmor.d/groups/systemd/systemd-detect-virt index 01e49025f..9b78b7c04 100644 --- a/apparmor.d/groups/systemd/systemd-detect-virt +++ b/apparmor.d/groups/systemd/systemd-detect-virt @@ -11,11 +11,10 @@ include profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) { include include - include - capability net_admin, + capability sys_ptrace, - network netlink raw, + ptrace read peer=@{p_systemd}, @{exec_path} mr, @@ -32,7 +31,14 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) { @{sys}/firmware/dmi/entries/*/raw r, @{sys}/firmware/uv/prot_virt_guest r, @{sys}/hypervisor/properties/features r, + @{sys}/hypervisor/type r, + @{PROC}/1/environ r, + @{PROC}/device-tree/ r, + @{PROC}/device-tree/compatible r, + @{PROC}/device-tree/hypervisor/compatible r, + @{PROC}/sys/kernel/osrelease r, + @{PROC}/sysinfo r, @{PROC}/xen/capabilities r, /dev/cpu/@{int}/msr r, From 2bb42bfca21bf7b372fccdeb763c33ef0f8875b6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 29 Aug 2025 20:14:12 +0200 Subject: [PATCH 1295/1455] build: add support for apparmor 5.0 (current master branch) --- dists/overwrite | 3 +++ pkg/prebuild/prepare/configure.go | 35 ++++++++++++++++++++++++------- 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/dists/overwrite b/dists/overwrite index c8769ba54..16f8f4a19 100644 --- a/dists/overwrite +++ b/dists/overwrite @@ -38,3 +38,6 @@ openvpn remmina transmission wg-quick +systemd-detect-virt # Missing integration with @{p_systemd} +hostname # Has @{bin} denied in header, would conflict with apparmor.d's @{bin} tunables + diff --git a/pkg/prebuild/prepare/configure.go b/pkg/prebuild/prepare/configure.go index a6e954485..cf16f5b8e 100644 --- a/pkg/prebuild/prepare/configure.go +++ b/pkg/prebuild/prepare/configure.go @@ -23,6 +23,15 @@ func init() { }) } +func removeFiles(files []string) error { + for _, name := range files { + if err := prebuild.RootApparmord.Join(name).RemoveAll(); err != nil { + return err + } + } + return nil +} + func (p Configure) Apply() ([]string, error) { res := []string{} @@ -57,19 +66,31 @@ func (p Configure) Apply() ([]string, error) { } - if prebuild.Version == 4.1 { - // Remove files upstreamed in 4.1 + if prebuild.Version >= 4.1 { remove := []string{ + // Remove files upstreamed in 4.1 "abstractions/devices-usb-read", "abstractions/devices-usb", "abstractions/nameservice-strict", "tunables/multiarch.d/base", - "wg", // Upstream version is identical + + // Direct upstream contributed profiles, similar to ours + "wg", } - for _, name := range remove { - if err := prebuild.RootApparmord.Join(name).RemoveAll(); err != nil { - return res, err - } + if err := removeFiles(remove); err != nil { + return res, err + } + } + if prebuild.Version >= 5.0 { + remove := []string{ + // Direct upstrem contributed profiles, similar to ours + "dig", + "free", + "nslookup", + "who", + } + if err := removeFiles(remove); err != nil { + return res, err } } return res, nil From 57251820e1bafa211deef302d907a21213a1b523 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 29 Aug 2025 20:48:01 +0200 Subject: [PATCH 1296/1455] build: improve support for aa 5.0 --- dists/overwrite | 5 +++-- pkg/prebuild/prepare/configure.go | 10 ++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/dists/overwrite b/dists/overwrite index 16f8f4a19..70ee1cc41 100644 --- a/dists/overwrite +++ b/dists/overwrite @@ -6,6 +6,7 @@ brave chrome chromium +cockpit-desktop element-desktop epiphany firefox @@ -29,8 +30,8 @@ unix-chkpwd # Overwrite some profiles recently added in apparmor while being already present in apparmor.d for a while # They can be multiple justification for keeping our profiles here, or or the contrary using upstream ones: -# - Keep ours: If they use abstractions, tunable, rules, and integration with apparmor.d that would break if using the upstream profile -# - Drop ours: when upstream profiles is better +# - Keep ours: If we/they use abstractions, tunable, rules, and integration with apparmor.d that would break if using the upstream profile +# - Drop ours: when upstream profiles is better (see pkg/prebuild/prepare/configure.go) fusermount3 lsblk lsusb diff --git a/pkg/prebuild/prepare/configure.go b/pkg/prebuild/prepare/configure.go index cf16f5b8e..9ca3b14d3 100644 --- a/pkg/prebuild/prepare/configure.go +++ b/pkg/prebuild/prepare/configure.go @@ -6,6 +6,7 @@ package prepare import ( "fmt" + "strings" "github.com/roddhjav/apparmor.d/pkg/prebuild" ) @@ -92,6 +93,15 @@ func (p Configure) Apply() ([]string, error) { if err := removeFiles(remove); err != nil { return res, err } + + // @{pci_bus} was upstreamed in 5.0 + path := prebuild.RootApparmord.Join("tunables/multiarch.d/system") + out, err := path.ReadFileAsString() + if err != nil { + return res, err + } + out = strings.ReplaceAll(out, "@{pci_bus}=pci@{hex4}:@{hex2}", "") + return res, path.WriteFile([]byte(out)) } return res, nil } From a3fde24b3deb9ecbd0ddebdf920315b24af46182 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 29 Aug 2025 23:58:39 +0200 Subject: [PATCH 1297/1455] feat: add aliases for all coreutils. --- apparmor.d/tunables/alias.d/coreutils | 112 ++++++++++++++++++++++++++ 1 file changed, 112 insertions(+) create mode 100644 apparmor.d/tunables/alias.d/coreutils diff --git a/apparmor.d/tunables/alias.d/coreutils b/apparmor.d/tunables/alias.d/coreutils new file mode 100644 index 000000000..9fed4fefc --- /dev/null +++ b/apparmor.d/tunables/alias.d/coreutils @@ -0,0 +1,112 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# In ubuntu 25.10, to make room for the coming rust utils, classic coreutils has +# moved to /usr/bin/gnu* names. To avoid breaking existing profiles, we +# provide aliases for all the coreutils names to their gnu* counterpart. + + alias /{,usr/}bin/dd -> /usr/bin/gnudd, + alias /{,usr/}bin/tee -> /usr/bin/gnutee, + alias /{,usr/}bin/paste -> /usr/bin/gnupaste, + alias /{,usr/}bin/sha256sum -> /usr/bin/gnusha256sum, + alias /{,usr/}bin/env -> /usr/bin/gnuenv, + alias /{,usr/}bin/expr -> /usr/bin/gnuexpr, + alias /{,usr/}bin/sleep -> /usr/bin/gnusleep, + alias /{,usr/}bin/shred -> /usr/bin/gnushred, + alias /{,usr/}bin/dircolors -> /usr/bin/gnudircolors, + alias /{,usr/}bin/nohup -> /usr/bin/gnunohup, + alias /{,usr/}bin/stty -> /usr/bin/gnustty, + alias /{,usr/}bin/sha384sum -> /usr/bin/gnusha384sum, + alias /{,usr/}bin/pr -> /usr/bin/gnupr, + alias /{,usr/}bin/nice -> /usr/bin/gnunice, + alias /{,usr/}bin/basenc -> /usr/bin/gnubasenc, + alias /{,usr/}bin/sha224sum -> /usr/bin/gnusha224sum, + alias /{,usr/}bin/unexpand -> /usr/bin/gnuunexpand, + alias /{,usr/}bin/logname -> /usr/bin/gnulogname, + alias /{,usr/}bin/uniq -> /usr/bin/gnuuniq, + alias /{,usr/}bin/chown -> /usr/bin/gnuchown, + alias /{,usr/}bin/vdir -> /usr/bin/gnuvdir, + alias /{,usr/}bin/printf -> /usr/bin/gnuprintf, + alias /{,usr/}bin/true -> /usr/bin/gnutrue, + alias /{,usr/}bin/groups -> /usr/bin/gnugroups, + alias /{,usr/}bin/printenv -> /usr/bin/gnuprintenv, + alias /{,usr/}bin/truncate -> /usr/bin/gnutruncate, + alias /{,usr/}bin/md5sum -> /usr/bin/gnumd5sum, + alias /{,usr/}bin/pinky -> /usr/bin/gnupinky, + alias /{,usr/}bin/rm -> /usr/bin/gnurm, + alias /{,usr/}bin/cat -> /usr/bin/gnucat, + alias /{,usr/}bin/tac -> /usr/bin/gnutac, + alias /{,usr/}bin/b2sum -> /usr/bin/gnub2sum, + alias /{,usr/}bin/seq -> /usr/bin/gnuseq, + alias /{,usr/}bin/cut -> /usr/bin/gnucut, + alias /{,usr/}bin/csplit -> /usr/bin/gnucsplit, + alias /{,usr/}bin/split -> /usr/bin/gnusplit, + alias /{,usr/}bin/realpath -> /usr/bin/gnurealpath, + alias /{,usr/}bin/ptx -> /usr/bin/gnuptx, + alias /{,usr/}bin/who -> /usr/bin/gnuwho, + alias /{,usr/}bin/whoami -> /usr/bin/gnuwhoami, + alias /{,usr/}bin/cksum -> /usr/bin/gnucksum, + alias /{,usr/}bin/ls -> /usr/bin/gnuls, + alias /{,usr/}bin/runcon -> /usr/bin/gnuruncon, + alias /{,usr/}bin/arch -> /usr/bin/gnuarch, + alias /{,usr/}bin/head -> /usr/bin/gnuhead, + alias /{,usr/}bin/date -> /usr/bin/gnudate, + alias /{,usr/}bin/wc -> /usr/bin/gnuwc, + alias /{,usr/}bin/mktemp -> /usr/bin/gnumktemp, + alias /{,usr/}bin/pathchk -> /usr/bin/gnupathchk, + alias /{,usr/}bin/mkfifo -> /usr/bin/gnumkfifo, + alias /{,usr/}bin/du -> /usr/bin/gnudu, + alias /{,usr/}bin/cp -> /usr/bin/gnucp, + alias /{,usr/}bin/tty -> /usr/bin/gnutty, + alias /{,usr/}bin/sync -> /usr/bin/gnusync, + alias /{,usr/}bin/fold -> /usr/bin/gnufold, + alias /{,usr/}bin/users -> /usr/bin/gnuusers, + alias /{,usr/}bin/dirname -> /usr/bin/gnudirname, + alias /{,usr/}bin/nproc -> /usr/bin/gnunproc, + alias /{,usr/}bin/sort -> /usr/bin/gnusort, + alias /{,usr/}bin/[ -> /usr/bin/gnu[, + alias /{,usr/}bin/base64 -> /usr/bin/gnubase64, + alias /{,usr/}bin/od -> /usr/bin/gnuod, + alias /{,usr/}bin/tr -> /usr/bin/gnutr, + alias /{,usr/}bin/join -> /usr/bin/gnujoin, + alias /{,usr/}bin/sha512sum -> /usr/bin/gnusha512sum, + alias /{,usr/}bin/false -> /usr/bin/gnufalse, + alias /{,usr/}bin/expand -> /usr/bin/gnuexpand, + alias /{,usr/}bin/base32 -> /usr/bin/gnubase32, + alias /{,usr/}bin/chmod -> /usr/bin/gnuchmod, + alias /{,usr/}bin/rmdir -> /usr/bin/gnurmdir, + alias /{,usr/}bin/factor -> /usr/bin/gnufactor, + alias /{,usr/}bin/mknod -> /usr/bin/gnumknod, + alias /{,usr/}bin/chcon -> /usr/bin/gnuchcon, + alias /{,usr/}bin/basename -> /usr/bin/gnubasename, + alias /{,usr/}bin/chgrp -> /usr/bin/gnuchgrp, + alias /{,usr/}bin/sha1sum -> /usr/bin/gnusha1sum, + alias /{,usr/}bin/ln -> /usr/bin/gnuln, + alias /{,usr/}bin/tsort -> /usr/bin/gnutsort, + alias /{,usr/}bin/echo -> /usr/bin/gnuecho, + alias /{,usr/}bin/timeout -> /usr/bin/gnutimeout, + alias /{,usr/}bin/dir -> /usr/bin/gnudir, + alias /{,usr/}bin/numfmt -> /usr/bin/gnunumfmt, + alias /{,usr/}bin/touch -> /usr/bin/gnutouch, + alias /{,usr/}bin/mv -> /usr/bin/gnumv, + alias /{,usr/}bin/sum -> /usr/bin/gnusum, + alias /{,usr/}bin/stat -> /usr/bin/gnustat, + alias /{,usr/}bin/yes -> /usr/bin/gnuyes, + alias /{,usr/}bin/install -> /usr/bin/gnuinstall, + alias /{,usr/}bin/readlink -> /usr/bin/gnureadlink, + alias /{,usr/}bin/pwd -> /usr/bin/gnupwd, + alias /{,usr/}bin/tail -> /usr/bin/gnutail, + alias /{,usr/}bin/stdbuf -> /usr/bin/gnustdbuf, + alias /{,usr/}bin/comm -> /usr/bin/gnucomm, + alias /{,usr/}bin/shuf -> /usr/bin/gnushuf, + alias /{,usr/}bin/uname -> /usr/bin/gnuuname, + alias /{,usr/}bin/test -> /usr/bin/gnutest, + alias /{,usr/}bin/mkdir -> /usr/bin/gnumkdir, + alias /{,usr/}bin/link -> /usr/bin/gnulink, + alias /{,usr/}bin/df -> /usr/bin/gnudf, + alias /{,usr/}bin/unlink -> /usr/bin/gnuunlink, + alias /{,usr/}bin/hostid -> /usr/bin/gnuhostid, + alias /{,usr/}bin/fmt -> /usr/bin/gnufmt, + alias /{,usr/}bin/id -> /usr/bin/gnuid, + alias /{,usr/}bin/nl -> /usr/bin/gnunl, From 2bae05d30940d14ad09a86c5b666257e43c17058 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 11:05:19 +0200 Subject: [PATCH 1298/1455] feat(abs): add varianttable to apt common. --- apparmor.d/abstractions/common/apt | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/common/apt b/apparmor.d/abstractions/common/apt index 5dd8b26bc..a267fd909 100644 --- a/apparmor.d/abstractions/common/apt +++ b/apparmor.d/abstractions/common/apt @@ -7,6 +7,7 @@ /usr/share/dpkg/cputable r, /usr/share/dpkg/tupletable r, + /usr/share/dpkg/varianttable r, /etc/apt/apt.conf r, /etc/apt/apt.conf.d/{,*} r, From 1122f28cacf84e4cfea8796d73d90a0a37b7fb6f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 11:46:40 +0200 Subject: [PATCH 1299/1455] tests(packer): cleanup package install process. - apparmor restart is handled by the package - it is a dev version, so it could fail. --- tests/packer/init.sh | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/tests/packer/init.sh b/tests/packer/init.sh index bf75c0e1e..630da6b0f 100644 --- a/tests/packer/init.sh +++ b/tests/packer/init.sh @@ -27,27 +27,21 @@ main() { case "$DISTRIBUTION" in arch) rm -f $SRC/*.sig # Ignore signature files - pacman --noconfirm -U $SRC/*.pkg.tar.zst + rm -f $SRC/*enforced* # Ignore enforced package + pacman --noconfirm -U $SRC/*.pkg.tar.zst || true ;; debian | ubuntu) - apt install -y apparmor-profiles + apt-get install -y apparmor-profiles dpkg -i $SRC/*.deb || true ;; opensuse*) mv "/home/$SUDO_USER/.bash_aliases" "/home/$SUDO_USER/.alias" - rpm -i $SRC/*.rpm + rpm -i $SRC/*.rpm || true ;; esac - - verb="start" - rm -rf /var/cache/apparmor/* || true - if systemctl is-active -q apparmor; then - verb="reload" - fi - systemctl "$verb" apparmor.service || journalctl -xeu apparmor.service } main "$@" From 94f01c68f696fd858ec65195113cad95f8d514fa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 11:48:11 +0200 Subject: [PATCH 1300/1455] feat(tunable): update home dir for gdm & add desktop_state_dirs. --- apparmor.d/tunables/multiarch.d/system-users | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apparmor.d/tunables/multiarch.d/system-users b/apparmor.d/tunables/multiarch.d/system-users index 885913da3..73a3267a0 100644 --- a/apparmor.d/tunables/multiarch.d/system-users +++ b/apparmor.d/tunables/multiarch.d/system-users @@ -5,11 +5,12 @@ # Define some extra paths for some commonly used system user # Full path of the GDM configuration directories -@{GDM_HOME}=/var/lib/gdm{,3}/ +@{GDM_HOME}=/var/lib/gdm{,3}/ @{run}/gdm{,3}/home/{,gdm-}greeter/ @{gdm_cache_dirs}=@{GDM_HOME}/.cache/ @{gdm_config_dirs}=@{GDM_HOME}/.config/ @{gdm_local_dirs}=@{GDM_HOME}/.local/ @{gdm_share_dirs}=@{GDM_HOME}/.local/share/ +@{gdm_state_dirs}=@{GDM_HOME}/.local/state/ # Full path of the SDDM configuration directories @{SDDM_HOME}=/var/lib/sddm/ @@ -17,6 +18,7 @@ @{sddm_config_dirs}=@{SDDM_HOME}/.config/ @{sddm_local_dirs}=@{SDDM_HOME}/.local/ @{sddm_share_dirs}=@{SDDM_HOME}/.local/share/ +@{sddm_state_dirs}=@{SDDM_HOME}/.local/state/ # Full path of the LIGHTDM configuration directories @{LIGHTDM_HOME}=/var/lib/lightdm/ @@ -31,5 +33,6 @@ @{desktop_config_dirs}=@{gdm_config_dirs} @{sddm_config_dirs} @{lightdm_config_dirs} @{desktop_local_dirs}=@{gdm_local_dirs} @{sddm_local_dirs} @{lightdm_local_dirs} @{desktop_share_dirs}=@{gdm_share_dirs} @{sddm_share_dirs} @{lightdm_share_dirs} +@{desktop_state_dirs}=@{gdm_state_dirs} @{sddm_state_dirs} @{lightdm_state_dirs} # vim:syntax=apparmor From b5020eac891099c023aad7e3b51375fbe663e0ef Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 12:22:01 +0200 Subject: [PATCH 1301/1455] tests(packer): remobe sudo alias --- tests/packer/src/.bash_aliases | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/packer/src/.bash_aliases b/tests/packer/src/.bash_aliases index 27e05bf80..2580556fd 100644 --- a/tests/packer/src/.bash_aliases +++ b/tests/packer/src/.bash_aliases @@ -8,7 +8,6 @@ for nb in $(seq "$1"); do done } -alias sudo='sudo -E' alias aa-log='sudo aa-log' alias aa-status='sudo aa-status' alias c='clear' From 0ada92da328c830fddf1550352c02405d89f9ef8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 12:35:04 +0200 Subject: [PATCH 1302/1455] refractor(abs): gsettings -> gschemas. --- apparmor.d/abstractions/desktop | 2 +- apparmor.d/abstractions/gnome-strict | 2 +- apparmor.d/abstractions/{gsettings => gschemas} | 2 +- apparmor.d/abstractions/kde-strict | 2 +- apparmor.d/groups/bus/dbus-accessibility | 2 +- apparmor.d/groups/gnome/ptyxis-agent | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) rename apparmor.d/abstractions/{gsettings => gschemas} (88%) diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 1bb4c20ea..3bfbcc887 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -11,7 +11,7 @@ include include - include + include include include include diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 72d09126e..4d2d390ee 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -6,7 +6,7 @@ include include - include + include include include include diff --git a/apparmor.d/abstractions/gsettings b/apparmor.d/abstractions/gschemas similarity index 88% rename from apparmor.d/abstractions/gsettings rename to apparmor.d/abstractions/gschemas index 4d22f080b..21a4d860c 100644 --- a/apparmor.d/abstractions/gsettings +++ b/apparmor.d/abstractions/gschemas @@ -9,6 +9,6 @@ @{system_share_dirs}/glib-2.0/schemas/ r, @{system_share_dirs}/glib-2.0/schemas/gschemas.compiled r, - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 02a0bc9c5..a06a29da4 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -6,7 +6,7 @@ include include - include + include include include include diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index a8c13b3fd..c254fcd2d 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -15,7 +15,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { include include include - include + include include network inet dgram, diff --git a/apparmor.d/groups/gnome/ptyxis-agent b/apparmor.d/groups/gnome/ptyxis-agent index cf497e39f..982afd90d 100644 --- a/apparmor.d/groups/gnome/ptyxis-agent +++ b/apparmor.d/groups/gnome/ptyxis-agent @@ -13,7 +13,7 @@ profile ptyxis-agent @{exec_path} { include include include - include + include include signal send set=hup peer=unconfined, From d6ddbf104cdfc07615b8f32c306d9db766a9ce77 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 12:56:05 +0200 Subject: [PATCH 1303/1455] refractor(profile): always use the gschemas abstraction. --- apparmor.d/groups/display-manager/xdm-xsession | 2 +- apparmor.d/groups/freedesktop/geoclue | 5 ++--- apparmor.d/groups/gnome/chrome-gnome-shell | 3 +-- apparmor.d/groups/gnome/deja-dup-monitor | 3 +-- apparmor.d/groups/gnome/evolution-addressbook-factory | 2 +- apparmor.d/groups/gnome/evolution-calendar-factory | 3 +-- apparmor.d/groups/gnome/evolution-source-registry | 3 +-- apparmor.d/groups/gnome/gdm-xsession | 2 +- apparmor.d/groups/gnome/gnome-browser-connector-host | 3 +-- apparmor.d/groups/gnome/gnome-shell-calendar-server | 2 -- apparmor.d/groups/gnome/gsd-a11y-settings | 4 ++-- apparmor.d/groups/gnome/gsd-datetime | 4 ++-- apparmor.d/groups/gnome/gsd-sharing | 4 ++-- apparmor.d/groups/gnome/gsd-smartcard | 2 +- apparmor.d/groups/gnome/gsd-sound | 2 +- apparmor.d/groups/gnome/gsd-usb-protection | 3 +-- apparmor.d/groups/gnome/session-migration | 4 ++-- apparmor.d/groups/gvfs/gvfsd-network | 3 +-- apparmor.d/groups/gvfs/gvfsd-smb-browse | 3 +-- apparmor.d/groups/ubuntu/apport-gtk | 1 - apparmor.d/profiles-g-l/gsettings | 3 ++- apparmor.d/profiles-m-r/mission-control | 2 +- 22 files changed, 26 insertions(+), 37 deletions(-) diff --git a/apparmor.d/groups/display-manager/xdm-xsession b/apparmor.d/groups/display-manager/xdm-xsession index d110fb83b..df17e0d9f 100644 --- a/apparmor.d/groups/display-manager/xdm-xsession +++ b/apparmor.d/groups/display-manager/xdm-xsession @@ -10,6 +10,7 @@ include profile xdm-xsession @{exec_path} { include include + include include include include @@ -58,7 +59,6 @@ profile xdm-xsession @{exec_path} { @{HOME}/.xinitrc rPix, # TODO: rCx @{lib}/xinit/xinitrc rix, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/mc/mc.sh r, /usr/share/terminfo/{,**} r, diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index 6332f49e2..fbc7a7582 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -9,12 +9,13 @@ include @{exec_path} = @{lib}/geoclue @{lib}/geoclue-2.0/demos/agent profile geoclue @{exec_path} flags=(attach_disconnected) { include - include include include include include include + include + include include include include @@ -29,8 +30,6 @@ profile geoclue @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - /etc/geoclue/{,**} r, /etc/sysconfig/proxy r, diff --git a/apparmor.d/groups/gnome/chrome-gnome-shell b/apparmor.d/groups/gnome/chrome-gnome-shell index 8c6372ba5..944d5e1d5 100644 --- a/apparmor.d/groups/gnome/chrome-gnome-shell +++ b/apparmor.d/groups/gnome/chrome-gnome-shell @@ -10,6 +10,7 @@ include profile chrome-gnome-shell @{exec_path} { include include + include include include include @@ -23,8 +24,6 @@ profile chrome-gnome-shell @{exec_path} { @{exec_path} mr, @{bin}/ r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - owner @{PROC}/@{pid}/mounts r, deny @{HOME}/.* r, diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor index ac5d6af81..fcafbda5f 100644 --- a/apparmor.d/groups/gnome/deja-dup-monitor +++ b/apparmor.d/groups/gnome/deja-dup-monitor @@ -17,6 +17,7 @@ profile deja-dup-monitor @{exec_path} { include include include + include network netlink raw, @@ -44,8 +45,6 @@ profile deja-dup-monitor @{exec_path} { @{bin}/ionice rix, @{bin}/deja-dup Px, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - /var/tmp/ r, /tmp/ r, diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index c9a9d72c9..b56af123d 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -15,6 +15,7 @@ profile evolution-addressbook-factory @{exec_path} { include include include + include include include include @@ -63,7 +64,6 @@ profile evolution-addressbook-factory @{exec_path} { @{exec_path} mr, @{exec_path}-subprocess rix, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/icu/@{int}.@{int}/*.dat r, owner @{user_share_dirs}/evolution/{,**} rwk, diff --git a/apparmor.d/groups/gnome/evolution-calendar-factory b/apparmor.d/groups/gnome/evolution-calendar-factory index fba734ad4..3d1d00f28 100644 --- a/apparmor.d/groups/gnome/evolution-calendar-factory +++ b/apparmor.d/groups/gnome/evolution-calendar-factory @@ -14,6 +14,7 @@ profile evolution-calendar-factory @{exec_path} { include include include + include include include include @@ -65,8 +66,6 @@ profile evolution-calendar-factory @{exec_path} { @{exec_path} mr, @{exec_path}-subprocess rix, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - owner @{user_cache_dirs}/evolution/calendar/{,**} rwk, owner @{user_cache_dirs}/evolution/tasks/{,**} rwk, diff --git a/apparmor.d/groups/gnome/evolution-source-registry b/apparmor.d/groups/gnome/evolution-source-registry index a5a1bd414..299d0738b 100644 --- a/apparmor.d/groups/gnome/evolution-source-registry +++ b/apparmor.d/groups/gnome/evolution-source-registry @@ -13,6 +13,7 @@ profile evolution-source-registry @{exec_path} { include include include + include include include include @@ -47,8 +48,6 @@ profile evolution-source-registry @{exec_path} { @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - owner @{user_cache_dirs}/evolution/{,**} rwk, owner @{user_config_dirs}/evolution/sources/{,*} rw, owner @{user_share_dirs}/evolution/{,**} r, diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession index 03e77816c..2882c3d9e 100644 --- a/apparmor.d/groups/gnome/gdm-xsession +++ b/apparmor.d/groups/gnome/gdm-xsession @@ -11,6 +11,7 @@ profile gdm-xsession @{exec_path} { include include include + include include include @@ -51,7 +52,6 @@ profile gdm-xsession @{exec_path} { @{etc_ro}/X11/xdm/Xsession rPx, @{lib}/gnome-session-binary rPx, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/im-config/data/{,*} r, /usr/share/im-config/xinputrc.common r, diff --git a/apparmor.d/groups/gnome/gnome-browser-connector-host b/apparmor.d/groups/gnome/gnome-browser-connector-host index 95af09ed6..e95762b6a 100644 --- a/apparmor.d/groups/gnome/gnome-browser-connector-host +++ b/apparmor.d/groups/gnome/gnome-browser-connector-host @@ -11,6 +11,7 @@ profile gnome-browser-connector-host @{exec_path} { include include include + include @{exec_path} mr, @@ -19,8 +20,6 @@ profile gnome-browser-connector-host @{exec_path} { @{lib}/@{python_name}/site-packages/gnome_browser_connector/__pycache__/{,**} rw, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - owner @{PROC}/@{pid}/mounts r, include if exists diff --git a/apparmor.d/groups/gnome/gnome-shell-calendar-server b/apparmor.d/groups/gnome/gnome-shell-calendar-server index 2f3e51670..6ddbd4b4c 100644 --- a/apparmor.d/groups/gnome/gnome-shell-calendar-server +++ b/apparmor.d/groups/gnome/gnome-shell-calendar-server @@ -35,8 +35,6 @@ profile gnome-shell-calendar-server @{exec_path} { @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - /etc/sysconfig/clock r, /etc/timezone r, diff --git a/apparmor.d/groups/gnome/gsd-a11y-settings b/apparmor.d/groups/gnome/gsd-a11y-settings index 5f05c21da..34ce2884d 100644 --- a/apparmor.d/groups/gnome/gsd-a11y-settings +++ b/apparmor.d/groups/gnome/gsd-a11y-settings @@ -9,10 +9,11 @@ include @{exec_path} = @{lib}/gsd-a11y-settings profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) { include - include include include + include include + include signal (receive) set=(term, hup) peer=gdm*, @@ -27,7 +28,6 @@ profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, @{gdm_config_dirs}/dconf/user r, @{GDM_HOME}/greeter-dconf-defaults r, diff --git a/apparmor.d/groups/gnome/gsd-datetime b/apparmor.d/groups/gnome/gsd-datetime index 0190ad9b3..af1784e68 100644 --- a/apparmor.d/groups/gnome/gsd-datetime +++ b/apparmor.d/groups/gnome/gsd-datetime @@ -9,10 +9,11 @@ include @{exec_path} = @{lib}/gsd-datetime profile gsd-datetime @{exec_path} flags=(attach_disconnected) { include - include include include + include include + include include network inet dgram, @@ -34,7 +35,6 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/gnome-settings-daemon/datetime/backward r, owner @{GDM_HOME}/greeter-dconf-defaults r, diff --git a/apparmor.d/groups/gnome/gsd-sharing b/apparmor.d/groups/gnome/gsd-sharing index 45b3ea1b9..7b47b0676 100644 --- a/apparmor.d/groups/gnome/gsd-sharing +++ b/apparmor.d/groups/gnome/gsd-sharing @@ -9,12 +9,13 @@ include @{exec_path} = @{lib}/gsd-sharing profile gsd-sharing @{exec_path} flags=(attach_disconnected) { include - include include include include include + include include + include signal (receive) set=(term, hup) peer=gdm*, @@ -34,7 +35,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index bdacbfd00..98ce848ba 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -15,6 +15,7 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { include include include + include signal (receive) set=(term, hup) peer=gdm*, @@ -29,7 +30,6 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /etc/{,opensc/}opensc.conf r, /etc/tpm2-tss/* rk, diff --git a/apparmor.d/groups/gnome/gsd-sound b/apparmor.d/groups/gnome/gsd-sound index 871203e6c..2b64ddf06 100644 --- a/apparmor.d/groups/gnome/gsd-sound +++ b/apparmor.d/groups/gnome/gsd-sound @@ -15,6 +15,7 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) { include include include + include signal receive set=(term, hup) peer=gdm*, @@ -29,7 +30,6 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, diff --git a/apparmor.d/groups/gnome/gsd-usb-protection b/apparmor.d/groups/gnome/gsd-usb-protection index 2359c9f39..3bfffdb6a 100644 --- a/apparmor.d/groups/gnome/gsd-usb-protection +++ b/apparmor.d/groups/gnome/gsd-usb-protection @@ -11,13 +11,12 @@ profile gsd-usb-protection @{exec_path} { include include include + include #aa:dbus own bus=session name=org.gnome.SettingsDaemon.UsbProtection @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - include if exists } diff --git a/apparmor.d/groups/gnome/session-migration b/apparmor.d/groups/gnome/session-migration index aeb46f6c0..b31532cae 100644 --- a/apparmor.d/groups/gnome/session-migration +++ b/apparmor.d/groups/gnome/session-migration @@ -9,8 +9,9 @@ include @{exec_path} = @{bin}/session-migration profile session-migration @{exec_path} { include - include include + include + include include @{exec_path} mr, @@ -21,7 +22,6 @@ profile session-migration @{exec_path} { @{bin}/gsettings rPx, /usr/share/session-migration/scripts/* rix, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/session-migration/{,**} r, owner @{gdm_share_dirs}/ w, diff --git a/apparmor.d/groups/gvfs/gvfsd-network b/apparmor.d/groups/gvfs/gvfsd-network index 1af0a2b37..46f543fa4 100644 --- a/apparmor.d/groups/gvfs/gvfsd-network +++ b/apparmor.d/groups/gvfs/gvfsd-network @@ -14,6 +14,7 @@ profile gvfsd-network @{exec_path} { include include include + include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} @@ -44,8 +45,6 @@ profile gvfsd-network @{exec_path} { @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - owner @{run}/user/@{uid}/gvfsd/ rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-smb-browse b/apparmor.d/groups/gvfs/gvfsd-smb-browse index 59d778133..a90cddc50 100644 --- a/apparmor.d/groups/gvfs/gvfsd-smb-browse +++ b/apparmor.d/groups/gvfs/gvfsd-smb-browse @@ -13,6 +13,7 @@ profile gvfsd-smb-browse @{exec_path} { include include include + include include network netlink raw, @@ -35,8 +36,6 @@ profile gvfsd-smb-browse @{exec_path} { @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, - /etc/samba/* r, /var/cache/samba/ rw, diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 271ff23e4..3d2cbd63d 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -117,7 +117,6 @@ profile apport-gtk @{exec_path} { /usr/share/gdb/python/{,**/}__pycache__/{,**} rw, /usr/share/gdb/{,**} r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/gnome-shell/{,**} r, /usr/share/terminfo/** r, /usr/share/themes/{,**} r, diff --git a/apparmor.d/profiles-g-l/gsettings b/apparmor.d/profiles-g-l/gsettings index 849599977..2e0eb2cf7 100644 --- a/apparmor.d/profiles-g-l/gsettings +++ b/apparmor.d/profiles-g-l/gsettings @@ -9,9 +9,10 @@ include @{exec_path} = @{bin}/gsettings profile gsettings @{exec_path} flags=(attach_disconnected) { include - include include + include include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/mission-control b/apparmor.d/profiles-m-r/mission-control index b8e79c0dc..bf6c55093 100644 --- a/apparmor.d/profiles-m-r/mission-control +++ b/apparmor.d/profiles-m-r/mission-control @@ -10,13 +10,13 @@ include profile mission-control @{exec_path} flags=(attach_disconnected) { include include + include network netlink raw, @{exec_path} mr, /usr/share/telepathy/{,**} r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, owner @{user_share_dirs}/telepathy/ rw, owner @{user_share_dirs}/telepathy/mission-control/ rw, From 4f1fddd2fb38dfc5a36bdf0ef32cd815fd380cfb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 14:25:43 +0200 Subject: [PATCH 1304/1455] feat(profile): use natural transition instead of systemd drop in config when possible. As we can transition to the good profile naturally, do not use systemd for it. This bypass the apparmor error: `change_profile unprivileged unconfined converted to stacking`. Note: we cannot do the same for dbus-system and dbus-session are they have the same binary. --- systemd/default/user/at-spi-dbus-bus.service | 2 -- systemd/default/user/org.freedesktop.IBus.session.GNOME.service | 2 -- 2 files changed, 4 deletions(-) delete mode 100644 systemd/default/user/at-spi-dbus-bus.service delete mode 100644 systemd/default/user/org.freedesktop.IBus.session.GNOME.service diff --git a/systemd/default/user/at-spi-dbus-bus.service b/systemd/default/user/at-spi-dbus-bus.service deleted file mode 100644 index 9c1fad533..000000000 --- a/systemd/default/user/at-spi-dbus-bus.service +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -AppArmorProfile=dbus-accessibility diff --git a/systemd/default/user/org.freedesktop.IBus.session.GNOME.service b/systemd/default/user/org.freedesktop.IBus.session.GNOME.service deleted file mode 100644 index 818d5cdf3..000000000 --- a/systemd/default/user/org.freedesktop.IBus.session.GNOME.service +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -AppArmorProfile=ibus-daemon From f5e2572457acd411e3b0b7ec0f7725e4a64d0f99 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 19:37:47 +0200 Subject: [PATCH 1305/1455] feat(profile): cleanup usage of icons abs. --- apparmor.d/groups/freedesktop/xsetroot | 5 +---- apparmor.d/groups/gnome/gnome-control-center | 1 - apparmor.d/groups/gnome/gnome-shell | 1 - apparmor.d/groups/hyprland/hyprpaper | 3 +-- apparmor.d/groups/hyprland/hyprpicker | 3 +-- apparmor.d/groups/kde/kaccess | 2 -- apparmor.d/groups/kde/kiod | 1 - apparmor.d/groups/kde/plasmashell | 3 --- apparmor.d/groups/lxqt/lxqt-runner | 1 - 9 files changed, 3 insertions(+), 17 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xsetroot b/apparmor.d/groups/freedesktop/xsetroot index bc1291ef4..c0ddcb359 100644 --- a/apparmor.d/groups/freedesktop/xsetroot +++ b/apparmor.d/groups/freedesktop/xsetroot @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xsetroot profile xsetroot @{exec_path} { include + include include capability dac_read_search, @@ -18,10 +19,6 @@ profile xsetroot @{exec_path} { @{exec_path} mr, - /usr/share/icons/{,**} r, - - owner @{HOME}/.icons/** r, - owner @{user_share_dirs}/sddm/xorg-session.log w, owner @{user_share_dirs}/sddm/wayland-session.log w, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 1c35a8ec1..fde43420a 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -88,7 +88,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{open_path} rPx -> child-open-any, - /opt/**/share/icons/{,**} r, /snap/*/@{int}/**.png r, /usr/share/backgrounds/{,**} r, /usr/share/cups/data/testprint r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index b34d18c00..5eb78d8bb 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -187,7 +187,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{user_share_dirs}/gnome-shell/extensions/*/** rPUx, /usr/share/gnome-shell/extensions/*/** rPUx, - /opt/**/share/icons/{,**} r, /snap/*/@{uid}/**.@{image_ext} r, /usr/share/**.@{image_ext} r, /usr/share/**/icons/{,**} r, diff --git a/apparmor.d/groups/hyprland/hyprpaper b/apparmor.d/groups/hyprland/hyprpaper index 3cb8dca92..6d0674d9f 100644 --- a/apparmor.d/groups/hyprland/hyprpaper +++ b/apparmor.d/groups/hyprland/hyprpaper @@ -9,12 +9,11 @@ include @{exec_path} = @{bin}/hyprpaper profile hyprpaper @{exec_path} flags=(attach_disconnected) { include + include include @{exec_path} mr, - /usr/share/icons/** r, - owner @{HOME}/@{XDG_WALLPAPERS_DIR}/** r, owner @{user_config_dirs}/hypr/hyprpaper.conf r, diff --git a/apparmor.d/groups/hyprland/hyprpicker b/apparmor.d/groups/hyprland/hyprpicker index a46d53f4c..7becc5fb6 100644 --- a/apparmor.d/groups/hyprland/hyprpicker +++ b/apparmor.d/groups/hyprland/hyprpicker @@ -9,12 +9,11 @@ include @{exec_path} = @{bin}/hyprpicker profile hyprpicker @{exec_path} { include + include @{exec_path} mr, @{bin}/wl-copy Px, - /usr/share/icons/** r, - owner @{run}/user/@{uid}/.hyprpicker* rw, owner /dev/shm/wlroots-@{rand6} r, owner /dev/shm/@{uuid} r, diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index 4b1e734ed..b70d50666 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -24,8 +24,6 @@ profile kaccess @{exec_path} { @{bin}/gsettings rPx, - /usr/share/icons/{,**} r, - /etc/machine-id r, owner @{user_config_dirs}/breezerc r, diff --git a/apparmor.d/groups/kde/kiod b/apparmor.d/groups/kde/kiod index cf9646051..4560427ad 100644 --- a/apparmor.d/groups/kde/kiod +++ b/apparmor.d/groups/kde/kiod @@ -20,7 +20,6 @@ profile kiod @{exec_path} { @{exec_path} mr, - /usr/share/icons/breeze/index.theme r, /usr/share/mime/{,**} r, owner @{user_config_dirs}/#@{int} rw, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index e767d7bb5..45f0d43e9 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -77,9 +77,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { #aa:exec kioworker - /opt/**/share/icons/{,**} r, - /opt/*/**/*.desktop r, - /opt/*/**/*.png r, /snap/*/@{uid}/**.@{image_ext} r, /usr/share/*/icons/{,**} r, /usr/share/akonadi/{,**} r, diff --git a/apparmor.d/groups/lxqt/lxqt-runner b/apparmor.d/groups/lxqt/lxqt-runner index 9477c1bda..5783c1fa0 100644 --- a/apparmor.d/groups/lxqt/lxqt-runner +++ b/apparmor.d/groups/lxqt/lxqt-runner @@ -14,7 +14,6 @@ profile lxqt-runner @{exec_path} { @{exec_path} mr, - /usr/share/icons/ r, /usr/share/desktop-directories/ r, /usr/share/desktop-directories/{,**} r, From ac6eac13334224bc5c0273fcef673e6bcbf41a1a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 19:47:07 +0200 Subject: [PATCH 1306/1455] feat(profile): cleanup usage of mime abs. --- apparmor.d/groups/flatpak/flatpak-portal | 5 +---- apparmor.d/groups/flatpak/flatpak-system-helper | 2 +- apparmor.d/groups/freedesktop/colord | 4 +--- apparmor.d/groups/gnome/gnome-photos-thumbnailer | 3 +-- apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer | 3 +-- apparmor.d/groups/gvfs/gvfsd-admin | 3 +-- apparmor.d/groups/kde/kaccess | 2 -- apparmor.d/groups/kde/kiod | 2 -- apparmor.d/groups/kde/startplasma | 2 -- apparmor.d/groups/lxqt/lxqt-session | 1 - apparmor.d/groups/lxqt/startlxqt | 1 - apparmor.d/groups/virt/cni-calico | 3 +-- apparmor.d/groups/virt/k3s | 1 - apparmor.d/groups/virt/libvirtd | 2 +- apparmor.d/profiles-a-f/evince-thumbnailer | 2 +- apparmor.d/profiles-a-f/fwupd | 3 +-- apparmor.d/profiles-g-l/hugo | 2 +- apparmor.d/profiles-m-r/mimetype | 11 +---------- 18 files changed, 12 insertions(+), 40 deletions(-) diff --git a/apparmor.d/groups/flatpak/flatpak-portal b/apparmor.d/groups/flatpak/flatpak-portal index b86f0a4fd..fdbdb9189 100644 --- a/apparmor.d/groups/flatpak/flatpak-portal +++ b/apparmor.d/groups/flatpak/flatpak-portal @@ -11,6 +11,7 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { include include include + include include capability sys_ptrace, @@ -32,11 +33,8 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { @{bin}/flatpak rPx, - /usr/share/mime/mime.cache r, /usr/share/xdg-desktop-portal/portals/{,*.portal} r, - /var/lib/flatpak/exports/share/mime/mime.cache r, - owner /att/**/ r, owner @{att}/.flatpak-info r, @@ -44,7 +42,6 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { owner @{att}/@{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, owner @{user_config_dirs}/user-dirs.dirs r, - owner @{user_share_dirs}/mime/mime.cache r, owner @{run}/user/@{uid}/.flatpak/@{int}/* r, owner @{run}/user/@{uid}/.flatpak/@{int}-private/* r, diff --git a/apparmor.d/groups/flatpak/flatpak-system-helper b/apparmor.d/groups/flatpak/flatpak-system-helper index 1381a1483..0ca01d01d 100644 --- a/apparmor.d/groups/flatpak/flatpak-system-helper +++ b/apparmor.d/groups/flatpak/flatpak-system-helper @@ -11,6 +11,7 @@ profile flatpak-system-helper @{exec_path} { include include include + include include include include @@ -42,7 +43,6 @@ profile flatpak-system-helper @{exec_path} { /usr/share/flatpak/remotes.d/{,**} r, /usr/share/flatpak/triggers/ r, - /usr/share/mime/mime.cache r, /var/lib/flatpak/{,**} rwkl, /var/tmp/flatpak-cache-*/{,**} rw, diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index 81d0c9f6b..b3cda6307 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -14,6 +14,7 @@ profile colord @{exec_path} flags=(attach_disconnected) { include include include + include include network inet dgram, @@ -31,11 +32,8 @@ profile colord @{exec_path} flags=(attach_disconnected) { /etc/udev/hwdb.bin r, /usr/share/color/icc/{,**} r, - /usr/share/mime/mime.cache r, /usr/share/snmp/mibs/{,*} r, - @{system_share_dirs}/mime/mime.cache r, - owner /var/lib/colord/.cache/ rw, owner /var/lib/colord/.cache/** rw, owner /var/lib/colord/{mapping,storage}.db{,-journal} rwk, diff --git a/apparmor.d/groups/gnome/gnome-photos-thumbnailer b/apparmor.d/groups/gnome/gnome-photos-thumbnailer index 0182e9dad..31d9b7987 100644 --- a/apparmor.d/groups/gnome/gnome-photos-thumbnailer +++ b/apparmor.d/groups/gnome/gnome-photos-thumbnailer @@ -9,12 +9,11 @@ include @{exec_path} = @{lib}/gnome-photos-thumbnailer profile gnome-photos-thumbnailer @{exec_path} { include + include include @{exec_path} mr, - /usr/share/mime/mime.cache r, - owner @{user_pictures_dirs}/{,**} r, owner @{user_cache_dirs}/babl/{,**} r, diff --git a/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer b/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer index 51d5b43cf..56e448fd8 100644 --- a/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer +++ b/apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer @@ -10,11 +10,10 @@ include profile gnome-shell-hotplug-sniffer @{exec_path} { include include + include @{exec_path} mr, - /usr/share/mime/mime.cache r, - @{MOUNTS}/**/ r, @{MOUNTS}/** r, diff --git a/apparmor.d/groups/gvfs/gvfsd-admin b/apparmor.d/groups/gvfs/gvfsd-admin index e1b16cac3..44248cbe3 100644 --- a/apparmor.d/groups/gvfs/gvfsd-admin +++ b/apparmor.d/groups/gvfs/gvfsd-admin @@ -10,6 +10,7 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-admin profile gvfsd-admin @{exec_path} { include + include include capability chown, @@ -20,8 +21,6 @@ profile gvfsd-admin @{exec_path} { @{exec_path} mr, - /usr/share/mime/mime.cache r, - #aa:lint ignore=too-wide # Full access to system's data, but no write access to sensitive system directories / r, diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index b70d50666..8258d1bde 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -29,8 +29,6 @@ profile kaccess @{exec_path} { owner @{user_config_dirs}/breezerc r, owner @{user_config_dirs}/kaccessrc r, - owner @{user_share_dirs}/mime/generic-icons r, - /dev/tty r, include if exists diff --git a/apparmor.d/groups/kde/kiod b/apparmor.d/groups/kde/kiod index 4560427ad..571581059 100644 --- a/apparmor.d/groups/kde/kiod +++ b/apparmor.d/groups/kde/kiod @@ -20,8 +20,6 @@ profile kiod @{exec_path} { @{exec_path} mr, - /usr/share/mime/{,**} r, - owner @{user_config_dirs}/#@{int} rw, owner @{user_config_dirs}/ksslcertificatemanager rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/ksslcertificatemanager.lock rwk, diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index 5db93719c..a8c8cbd13 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -48,8 +48,6 @@ profile startplasma @{exec_path} { /etc/xdg/plasma-workspace/env/{,*} r, /etc/xdg/plasmarc r, - /var/lib/flatpak/exports/share/mime/ r, - @{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int}, owner @{user_cache_dirs}/#@{int} rwk, owner @{user_cache_dirs}/kcrash-metadata/ rw, diff --git a/apparmor.d/groups/lxqt/lxqt-session b/apparmor.d/groups/lxqt/lxqt-session index 3a4a6cd61..085b444b1 100644 --- a/apparmor.d/groups/lxqt/lxqt-session +++ b/apparmor.d/groups/lxqt/lxqt-session @@ -47,7 +47,6 @@ profile lxqt-session @{exec_path} flags=(attach_disconnected) { @{bin}/xdg-user-dirs-update rPx, /usr/share/ r, - /usr/share/mime/ r, /usr/share/cursors/ r, /usr/share/backintime/common/* r, /usr/share/desktop-directories/* r, diff --git a/apparmor.d/groups/lxqt/startlxqt b/apparmor.d/groups/lxqt/startlxqt index a708e2336..3ae907116 100644 --- a/apparmor.d/groups/lxqt/startlxqt +++ b/apparmor.d/groups/lxqt/startlxqt @@ -31,7 +31,6 @@ profile startlxqt @{exec_path} { /usr/share/color-schemes/{,**} r, /usr/share/desktop-directories/{,**} r, /usr/share/kservices5/{,**} r, - /usr/share/mime/{,**} r, /etc/machine-id r, /etc/xdg/menus/{,**} r, diff --git a/apparmor.d/groups/virt/cni-calico b/apparmor.d/groups/virt/cni-calico index a6c9149d2..9015d2157 100644 --- a/apparmor.d/groups/virt/cni-calico +++ b/apparmor.d/groups/virt/cni-calico @@ -9,6 +9,7 @@ include @{exec_path} = @{lib}/cni/calico /opt/cni/bin/calico profile cni-calico @{exec_path} flags=(attach_disconnected) { include + include capability sys_admin, capability net_admin, @@ -32,8 +33,6 @@ profile cni-calico @{exec_path} flags=(attach_disconnected) { /var/log/calico/cni/ r, /var/log/calico/cni/*.log rw, - /usr/share/mime/globs2 r, - @{run}/calico/ rw, @{run}/calico/ipam.lock rwk, @{run}/netns/cni-@{uuid} r, diff --git a/apparmor.d/groups/virt/k3s b/apparmor.d/groups/virt/k3s index 2142e28b9..59c4b9473 100644 --- a/apparmor.d/groups/virt/k3s +++ b/apparmor.d/groups/virt/k3s @@ -68,7 +68,6 @@ profile k3s @{exec_path} flags=(attach_disconnected) { /var/lib/rancher/k3s/data/@{hex}/bin/* rix, @{lib}/kubernetes/kubelet-plugins/volume/exec/{,**} r, - /usr/share/mime/globs2 r, /etc/machine-id r, /etc/rancher/{,**} rw, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 2b0530ef5..23e8e20d1 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -23,6 +23,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { include include include + include include capability audit_write, @@ -141,7 +142,6 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { /usr/share/hwdata/* r, /usr/share/iproute2/{,**} r, /usr/share/libvirt/{,**} r, - /usr/share/mime/mime.cache r, /usr/share/misc/pci.ids r, /usr/share/qemu/{,**} r, diff --git a/apparmor.d/profiles-a-f/evince-thumbnailer b/apparmor.d/profiles-a-f/evince-thumbnailer index 95fdba512..6fbabaf28 100644 --- a/apparmor.d/profiles-a-f/evince-thumbnailer +++ b/apparmor.d/profiles-a-f/evince-thumbnailer @@ -9,10 +9,10 @@ include @{exec_path} = @{bin}/evince-thumbnailer profile evince-thumbnailer @{exec_path} flags=(attach_disconnected) { include + include @{exec_path} mr, - /usr/share/mime/mime.cache r, /usr/share/poppler/{,**} r, owner @{tmp}/gnome-desktop-file-to-thumbnail.pdf r, diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 58ba493cc..d7a72c236 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -17,6 +17,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { include include include + include include include @@ -57,7 +58,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /usr/share/fwupd/{,**} r, /usr/share/hwdata/* r, /usr/share/libdrm/*.ids r, - /usr/share/mime/mime.cache r, /usr/share/misc/*.ids r, /etc/fwupd/{,**} rw, @@ -77,7 +77,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { @{MOUNTDIRS}/*/{,@{efi}/} r, @{MOUNTDIRS}/*/{,@{efi}/}EFI/{,**} r, - /var/lib/flatpak/exports/share/mime/mime.cache r, owner /var/cache/fwupd/ rw, owner /var/cache/fwupd/** rwk, owner /var/lib/fwupd/ rw, diff --git a/apparmor.d/profiles-g-l/hugo b/apparmor.d/profiles-g-l/hugo index ed62f48f1..fd9c3dfa0 100644 --- a/apparmor.d/profiles-g-l/hugo +++ b/apparmor.d/profiles-g-l/hugo @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/hugo profile hugo @{exec_path} { include + include include include @@ -26,7 +27,6 @@ profile hugo @{exec_path} { @{lib}/go/bin/go rix, /usr/share/git{,-core}/{,**} r, - /usr/share/mime/{,**} r, /usr/share/terminfo/** r, /etc/mime.types r, diff --git a/apparmor.d/profiles-m-r/mimetype b/apparmor.d/profiles-m-r/mimetype index 91d021fae..1576050b5 100644 --- a/apparmor.d/profiles-m-r/mimetype +++ b/apparmor.d/profiles-m-r/mimetype @@ -11,22 +11,13 @@ include profile mimetype @{exec_path} { include include + include @{exec_path} r, - /usr/share/mime/**.xml r, - /usr/share/mime/globs r, - /usr/share/mime/aliases r, - /usr/share/mime/magic r, - # To read files owner /** r, #aa:lint ignore=too-wide - owner @{user_share_dirs}/mime/**.xml r, - owner @{user_share_dirs}/mime/globs r, - owner @{user_share_dirs}/mime/aliases r, - owner @{user_share_dirs}/mime/magic r, - include if exists } From 45faf0eee06759b5a9213f65f51519b377a2a1ae Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 30 Aug 2025 19:57:09 +0200 Subject: [PATCH 1307/1455] fix(tunable): add missing lightdm_state_dirs tunable. --- apparmor.d/tunables/multiarch.d/system-users | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/tunables/multiarch.d/system-users b/apparmor.d/tunables/multiarch.d/system-users index 73a3267a0..1513aae2f 100644 --- a/apparmor.d/tunables/multiarch.d/system-users +++ b/apparmor.d/tunables/multiarch.d/system-users @@ -26,6 +26,7 @@ @{lightdm_config_dirs}=@{LIGHTDM_HOME}/.config/ @{lightdm_local_dirs}=@{LIGHTDM_HOME}/.local/ @{lightdm_share_dirs}=@{LIGHTDM_HOME}/.local/share/ +@{lightdm_state_dirs}=@{LIGHTDM_HOME}/.local/state/ # Full path of all DE configuration directories @{DESKTOP_HOME}=@{GDM_HOME} @{SDDM_HOME} @{LIGHTDM_HOME} From a3426fef8cedc0a5b46a6184b2309d40598ecb30 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 13:23:48 +0200 Subject: [PATCH 1308/1455] feat: precise nvidia devices number. --- apparmor.d/abstractions/nvidia-strict | 2 +- apparmor.d/abstractions/nvidia.d/complete | 2 +- apparmor.d/groups/children/child-modprobe-nvidia | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/nvidia-strict b/apparmor.d/abstractions/nvidia-strict index c3aa8e805..a7529eb9a 100644 --- a/apparmor.d/abstractions/nvidia-strict +++ b/apparmor.d/abstractions/nvidia-strict @@ -35,7 +35,7 @@ owner @{PROC}/@{pid}/comm r, owner @{PROC}/@{pid}/task/@{tid}/comm r, - /dev/char/195:@{int} w, # Nvidia graphics devices + /dev/char/195:@{u8} w, # Nvidia graphics devices /dev/nvidia-modeset rw, /dev/nvidia@{int} rw, /dev/nvidiactl rw, diff --git a/apparmor.d/abstractions/nvidia.d/complete b/apparmor.d/abstractions/nvidia.d/complete index ef9d0c40d..e00385efd 100644 --- a/apparmor.d/abstractions/nvidia.d/complete +++ b/apparmor.d/abstractions/nvidia.d/complete @@ -8,6 +8,6 @@ /etc/nvidia/nvidia-application-profiles* r, - /dev/char/195:@{int} rw, # Nvidia graphics devices + /dev/char/195:@{u8} rw, # Nvidia graphics devices # vim:syntax=apparmor diff --git a/apparmor.d/groups/children/child-modprobe-nvidia b/apparmor.d/groups/children/child-modprobe-nvidia index 61191fe9d..8e991cee7 100644 --- a/apparmor.d/groups/children/child-modprobe-nvidia +++ b/apparmor.d/groups/children/child-modprobe-nvidia @@ -41,7 +41,7 @@ profile child-modprobe-nvidia flags=(attach_disconnected) { @{PROC}/modules r, owner /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 - owner /dev/char/195:@{int} w, # Nvidia graphics devices + owner /dev/char/195:@{u8} w, # Nvidia graphics devices /dev/nvidia-modeset w, /dev/nvidia-uvm w, From 9ee26050261c69e4f0654ec0e87e6d26d958b8e4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 13:29:11 +0200 Subject: [PATCH 1309/1455] tests(packer): simplify pkg install script. --- tests/packer/init.sh | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/tests/packer/init.sh b/tests/packer/init.sh index 630da6b0f..44a86220f 100644 --- a/tests/packer/init.sh +++ b/tests/packer/init.sh @@ -3,16 +3,11 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -set -eux +set -eux -o pipefail -_lsb_release() { - # shellcheck source=/dev/null - . /etc/os-release - echo "$ID" -} -DISTRIBUTION="$(_lsb_release)" +# shellcheck source=/dev/null +source /etc/os-release || exit 1 readonly SRC=/tmp/ -readonly DISTRIBUTION main() { install -dm0750 -o "$SUDO_USER" -g "$SUDO_USER" "/home/$SUDO_USER/Projects/" "/home/$SUDO_USER/Projects/apparmor.d" "/home/$SUDO_USER/.config/" @@ -24,7 +19,7 @@ main() { install -Dm0755 $SRC/aa-clean /usr/bin/aa-clean chown -R "$SUDO_USER:$SUDO_USER" "/home/$SUDO_USER/.config/" - case "$DISTRIBUTION" in + case "$ID" in arch) rm -f $SRC/*.sig # Ignore signature files rm -f $SRC/*enforced* # Ignore enforced package @@ -32,8 +27,10 @@ main() { ;; debian | ubuntu) - apt-get install -y apparmor-profiles - dpkg -i $SRC/*.deb || true + # Do not install apparmor.d on the current development version + if [[ $VERSION_ID != "25.10" ]]; then + dpkg -i $SRC/*.deb || true + fi ;; opensuse*) From 9a4d878557b814fbeac1c3636b3cfb29550aa24a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 17:38:00 +0200 Subject: [PATCH 1310/1455] refractor(abs): add screensaver abs, move bus screensaver abs. --- apparmor.d/abstractions/app/chromium | 3 +-- .../abstractions/bus/org.gnome.ScreenSaver | 21 --------------- .../bus/session/org.freedesktop.ScreenSaver | 26 +++++++++++++++++++ .../org.gnome.ScreenSaver} | 12 +++++---- apparmor.d/abstractions/screensaver | 14 ++++++++++ apparmor.d/groups/gnome/gnome-session-binary | 4 +-- apparmor.d/groups/gnome/gsd-power | 2 +- apparmor.d/profiles-a-f/discord | 2 +- apparmor.d/profiles-a-f/element-desktop | 2 +- apparmor.d/profiles-a-f/freetube | 2 +- apparmor.d/profiles-m-r/pinentry-gnome3 | 2 +- apparmor.d/profiles-s-z/signal-desktop | 2 +- apparmor.d/profiles-s-z/spotify | 2 +- apparmor.d/profiles-s-z/totem | 2 +- apparmor.d/profiles-s-z/vlc | 2 +- 15 files changed, 59 insertions(+), 39 deletions(-) delete mode 100644 apparmor.d/abstractions/bus/org.gnome.ScreenSaver create mode 100644 apparmor.d/abstractions/bus/session/org.freedesktop.ScreenSaver rename apparmor.d/abstractions/bus/{org.freedesktop.ScreenSaver => session/org.gnome.ScreenSaver} (51%) create mode 100644 apparmor.d/abstractions/screensaver diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 8f991c230..dad131d64 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -26,11 +26,9 @@ include include include - include include include include - include include include include @@ -40,6 +38,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/bus/org.gnome.ScreenSaver b/apparmor.d/abstractions/bus/org.gnome.ScreenSaver deleted file mode 100644 index 46d1a1006..000000000 --- a/apparmor.d/abstractions/bus/org.gnome.ScreenSaver +++ /dev/null @@ -1,21 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - - abi , - - #aa:dbus common bus=session name=org.gnome.ScreenSaver label=gjs-console - - dbus send bus=session path=/org/gnome/ScreenSaver - interface=org.gnome.ScreenSaver - member=GetActive - peer=(name="@{busname}", label=gjs-console), - - dbus receive bus=session path=/org/gnome/ScreenSaver - interface=org.gnome.ScreenSaver - member={ActiveChanged,WakeUpScreen} - peer=(name="@{busname}", label=gjs-console), - - include if exists - -# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.ScreenSaver b/apparmor.d/abstractions/bus/session/org.freedesktop.ScreenSaver new file mode 100644 index 000000000..ee837b886 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.freedesktop.ScreenSaver @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow checking status, activating and locking the screensaver + + abi , + + dbus send bus=session path=/ScreenSaver + interface=org.freedesktop.ScreenSaver + member={Inhibit,UnInhibit} + peer=(name=org.freedesktop.ScreenSaver), + + dbus send bus=session path=/{,org/freedesktop/}ScreenSaver + interface=org.freedesktop.ScreenSaver + member={GetActive,GetActiveTime,Lock,SetActive} + peer=(name=@{busname}, label="{gsd-screensaver-proxy,ksmserver,kwin_wayland}"), + + dbus receive bus=session path=/org/freedesktop/ScreenSaver + interface=org.freedesktop.ScreenSaver + member={ActiveChanged,WakeUpScreen} + peer=(name=@{busname}, label="{gsd-screensaver-proxy,ksmserver,kwin_wayland}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver b/apparmor.d/abstractions/bus/session/org.gnome.ScreenSaver similarity index 51% rename from apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver rename to apparmor.d/abstractions/bus/session/org.gnome.ScreenSaver index f73768e9f..27c456637 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ScreenSaver +++ b/apparmor.d/abstractions/bus/session/org.gnome.ScreenSaver @@ -2,18 +2,20 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Allow checking status, activating and locking the screensaver (GNOME version) + abi , - dbus send bus=session path=/ScreenSaver - interface=org.freedesktop.ScreenSaver - member={Inhibit,UnInhibit} - peer=(name=org.freedesktop.ScreenSaver), + dbus send bus=session path=/{,org/gnome/}ScreenSaver + interface=org.gnome.ScreenSaver + member={GetActive,GetActiveTime,Lock,SetActive} + peer=(name=@{busname}, label=gjs-console), dbus receive bus=session path=/org/gnome/ScreenSaver interface=org.gnome.ScreenSaver member={ActiveChanged,WakeUpScreen} peer=(name=@{busname}, label=gjs-console), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/screensaver b/apparmor.d/abstractions/screensaver new file mode 100644 index 000000000..1a9369091 --- /dev/null +++ b/apparmor.d/abstractions/screensaver @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow checking status, activating and locking the screensaver + + abi , + + include if exists + include if exists + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 447c030d6..b011935ae 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -14,13 +14,13 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { include include include - include include - include + include include include include include + include network inet stream, network inet6 stream, diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 379f7b814..39cf990ca 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -23,7 +23,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -31,6 +30,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include + include network inet stream, network netlink raw, diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index 3b34d5055..e12c25b9d 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -18,9 +18,9 @@ profile discord @{exec_path} flags=(attach_disconnected) { include include include - include include include + include include include diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index ec7ee9c65..f87486af3 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -18,10 +18,10 @@ profile element-desktop @{exec_path} flags=(attach_disconnected) { include include include - include include include include + include include network inet dgram, diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index 95e37b4d6..958f9b5ee 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -18,10 +18,10 @@ profile freetube @{exec_path} flags=(attach_disconnected) { include include include - include include include include + include include include diff --git a/apparmor.d/profiles-m-r/pinentry-gnome3 b/apparmor.d/profiles-m-r/pinentry-gnome3 index f4a61b07b..b60d929e2 100644 --- a/apparmor.d/profiles-m-r/pinentry-gnome3 +++ b/apparmor.d/profiles-m-r/pinentry-gnome3 @@ -11,8 +11,8 @@ profile pinentry-gnome3 @{exec_path} { include include include - include include + include signal receive set=int, diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index bf0740919..d91285558 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -18,10 +18,10 @@ profile signal-desktop @{exec_path} flags=(attach_disconnected) { include include include - include include include include + include include include diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index ed1ccfe1c..659d650fe 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -22,7 +22,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -31,6 +30,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index fc582cae2..d8b464956 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -10,10 +10,10 @@ include profile totem @{exec_path} flags=(attach_disconnected) { include include - include include include include + include include include diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index d572ce9b8..ccf1abb61 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -14,7 +14,6 @@ profile vlc @{exec_path} { include include include - include include include include @@ -27,6 +26,7 @@ profile vlc @{exec_path} { include include include + include include include From 5cc5a019d4b875ebb283b31848bf9413a8d8e76d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 17:40:42 +0200 Subject: [PATCH 1311/1455] feat(profile): snap: add support for dev version. --- apparmor.d/groups/snap/snap | 4 ++-- apparmor.d/groups/snap/snap-discard-ns | 2 +- apparmor.d/groups/snap/snap-failure | 2 +- apparmor.d/groups/snap/snap-seccomp | 2 +- apparmor.d/groups/snap/snap-update-ns | 2 +- apparmor.d/groups/snap/snapd | 4 ++-- apparmor.d/groups/snap/snapd-aa-prompt-listener | 2 +- apparmor.d/groups/snap/snapd-aa-prompt-ui | 2 +- apparmor.d/groups/snap/snapd-apparmor | 2 +- 9 files changed, 11 insertions(+), 11 deletions(-) diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap index 927d7a3da..0d38fc055 100644 --- a/apparmor.d/groups/snap/snap +++ b/apparmor.d/groups/snap/snap @@ -6,8 +6,8 @@ abi , include -@{bin_dirs} = @{bin}/ /snap/{snapd,core}/@{int}@{bin} -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{bin_dirs} = @{bin}/ /snap/{snapd,core}/{,x}@{int}@{bin} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{bin_dirs}/snap profile snap @{exec_path} flags=(attach_disconnected) { diff --git a/apparmor.d/groups/snap/snap-discard-ns b/apparmor.d/groups/snap/snap-discard-ns index 38396f3eb..0ccb3f1c7 100644 --- a/apparmor.d/groups/snap/snap-discard-ns +++ b/apparmor.d/groups/snap/snap-discard-ns @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snap-discard-ns profile snap-discard-ns @{exec_path} { diff --git a/apparmor.d/groups/snap/snap-failure b/apparmor.d/groups/snap/snap-failure index edc9845e8..bed3a2d12 100644 --- a/apparmor.d/groups/snap/snap-failure +++ b/apparmor.d/groups/snap/snap-failure @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snap-failure profile snap-failure @{exec_path} { diff --git a/apparmor.d/groups/snap/snap-seccomp b/apparmor.d/groups/snap/snap-seccomp index 2a14fd583..90c1724be 100644 --- a/apparmor.d/groups/snap/snap-seccomp +++ b/apparmor.d/groups/snap/snap-seccomp @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snap-seccomp profile snap-seccomp @{exec_path} flags=(attach_disconnected) { diff --git a/apparmor.d/groups/snap/snap-update-ns b/apparmor.d/groups/snap/snap-update-ns index 98ee0e5e7..e831cc90c 100644 --- a/apparmor.d/groups/snap/snap-update-ns +++ b/apparmor.d/groups/snap/snap-update-ns @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snap-update-ns profile snap-update-ns @{exec_path} { diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 06de56063..4a928e6d4 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -6,8 +6,8 @@ abi , include -@{bin_dirs} = @{bin}/ /snap/{snapd,core}/@{int}@{bin} -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{bin_dirs} = @{bin}/ /snap/{snapd,core}/{,x}@{int}@{bin} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snapd profile snapd @{exec_path} { diff --git a/apparmor.d/groups/snap/snapd-aa-prompt-listener b/apparmor.d/groups/snap/snapd-aa-prompt-listener index 7b9adced7..37730ba6f 100644 --- a/apparmor.d/groups/snap/snapd-aa-prompt-listener +++ b/apparmor.d/groups/snap/snapd-aa-prompt-listener @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snapd-aa-prompt-listener profile snapd-aa-prompt-listener @{exec_path} { diff --git a/apparmor.d/groups/snap/snapd-aa-prompt-ui b/apparmor.d/groups/snap/snapd-aa-prompt-ui index 0d26f42d3..99dc98efe 100644 --- a/apparmor.d/groups/snap/snapd-aa-prompt-ui +++ b/apparmor.d/groups/snap/snapd-aa-prompt-ui @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snapd-aa-prompt-ui profile snapd-aa-prompt-ui @{exec_path} { diff --git a/apparmor.d/groups/snap/snapd-apparmor b/apparmor.d/groups/snap/snapd-apparmor index 63251a976..47b939fa0 100644 --- a/apparmor.d/groups/snap/snapd-apparmor +++ b/apparmor.d/groups/snap/snapd-apparmor @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{lib_dirs}/snapd/snapd-apparmor profile snapd-apparmor @{exec_path} { From 458126e7d7fea79a92b84fef53a455f79b8c0445 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 18:14:32 +0200 Subject: [PATCH 1312/1455] refractor(profile): add notification abs, move bus notifications. --- apparmor.d/abstractions/app/chromium | 2 +- .../bus/org.freedesktop.Notifications | 26 ------------------- .../bus/session/org.freedesktop.Notifications | 21 +++++++++++++++ .../bus/{ => session}/org.gtk.Notifications | 0 apparmor.d/abstractions/notifications | 12 +++++++++ apparmor.d/groups/gnome/gnome-extension-ding | 2 +- apparmor.d/groups/gnome/gnome-shell | 3 +-- apparmor.d/groups/gnome/gnome-software | 2 +- apparmor.d/groups/gnome/gsd-power | 2 +- apparmor.d/groups/ubuntu/update-notifier | 2 +- apparmor.d/profiles-a-f/dropbox | 2 +- apparmor.d/profiles-a-f/filezilla | 2 +- apparmor.d/profiles-m-r/remmina | 2 +- apparmor.d/profiles-s-z/session-desktop | 2 +- apparmor.d/profiles-s-z/spotify | 4 ++- apparmor.d/profiles-s-z/transmission | 2 +- 16 files changed, 47 insertions(+), 39 deletions(-) delete mode 100644 apparmor.d/abstractions/bus/org.freedesktop.Notifications create mode 100644 apparmor.d/abstractions/bus/session/org.freedesktop.Notifications rename apparmor.d/abstractions/bus/{ => session}/org.gtk.Notifications (100%) create mode 100644 apparmor.d/abstractions/notifications diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index dad131d64..f08a096ca 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -25,7 +25,6 @@ include include include - include include include include @@ -38,6 +37,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/bus/org.freedesktop.Notifications b/apparmor.d/abstractions/bus/org.freedesktop.Notifications deleted file mode 100644 index 6962bf7ec..000000000 --- a/apparmor.d/abstractions/bus/org.freedesktop.Notifications +++ /dev/null @@ -1,26 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - - abi , - - #aa:dbus common bus=session name=org.freedesktop.Notifications label=gjs-console - - dbus send bus=session path=/org/freedesktop/Notifications - interface=org.freedesktop.DBus.Properties - member={GetCapabilities,GetServerInformation,Notify} - peer=(name="@{busname}", label=gjs-console), - - dbus receive bus=session path=/org/freedesktop/Notifications - interface=org.freedesktop.DBus.Properties - member={NotificationClosed,CloseNotification} - peer=(name="@{busname}", label=gjs-console), - - dbus receive bus=session path=/org/freedesktop/Notifications - interface=org.freedesktop.DBus.Properties - member=Notify - peer=(name=org.freedesktop.DBus, label=gjs-console), - - include if exists - -# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.Notifications b/apparmor.d/abstractions/bus/session/org.freedesktop.Notifications new file mode 100644 index 000000000..5c10a9eae --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.freedesktop.Notifications @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + #aa:dbus common bus=session name=org.freedesktop.Notifications label="@{pp_notification}" + + dbus send bus=session path=/org/freedesktop/Notifications + interface=org.freedesktop.Notifications + member={GetCapabilities,GetServerInformation,Notify,CloseNotification} + peer=(name="{@{busname},org.freedesktop.Notifications}", label="@{pp_notification}"), + + dbus receive bus=session path=/org/freedesktop/Notifications + interface=org.freedesktop.Notifications + member={ActionInvoked,NotificationClosed,NotificationReplied} + peer=(name="{@{busname},org.freedesktop.Notifications}", label="@{pp_notification}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gtk.Notifications b/apparmor.d/abstractions/bus/session/org.gtk.Notifications similarity index 100% rename from apparmor.d/abstractions/bus/org.gtk.Notifications rename to apparmor.d/abstractions/bus/session/org.gtk.Notifications diff --git a/apparmor.d/abstractions/notifications b/apparmor.d/abstractions/notifications new file mode 100644 index 000000000..8232b54b5 --- /dev/null +++ b/apparmor.d/abstractions/notifications @@ -0,0 +1,12 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + include + include + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index 695be9f0d..e47cc66a3 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -19,7 +19,6 @@ profile gnome-extension-ding @{exec_path} { include include include - include include include include @@ -29,6 +28,7 @@ profile gnome-extension-ding @{exec_path} { include include include + include unix (send,receive) type=stream addr=none peer=(label=gnome-shell), diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 5eb78d8bb..0876b90d1 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -25,9 +25,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include - include include include include @@ -41,6 +39,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index f3845daef..baaac245f 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -13,11 +13,11 @@ profile gnome-software @{exec_path} { include include include - include include include include include + include include include diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 39cf990ca..63ab49c5e 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -18,7 +18,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -30,6 +29,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include + include include network inet stream, diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 8e9cddd54..0de63ac64 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -14,13 +14,13 @@ profile update-notifier @{exec_path} { include include include - include include include include include include include + include include unix (bind) type=stream addr=@@{udbus}/bus/systemd/bus-api-user, diff --git a/apparmor.d/profiles-a-f/dropbox b/apparmor.d/profiles-a-f/dropbox index f40d69799..57487b15c 100644 --- a/apparmor.d/profiles-a-f/dropbox +++ b/apparmor.d/profiles-a-f/dropbox @@ -16,11 +16,11 @@ include profile dropbox @{exec_path} { include include - include include include include include + include include include include diff --git a/apparmor.d/profiles-a-f/filezilla b/apparmor.d/profiles-a-f/filezilla index 366c2aed6..78781ba28 100644 --- a/apparmor.d/profiles-a-f/filezilla +++ b/apparmor.d/profiles-a-f/filezilla @@ -11,12 +11,12 @@ include profile filezilla @{exec_path} { include include - include include include include include include + include include include include diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index c2bc95465..17ca1ec5a 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -16,7 +16,6 @@ profile remmina @{exec_path} { include include include - include include include include @@ -25,6 +24,7 @@ profile remmina @{exec_path} { include include include + include include include include diff --git a/apparmor.d/profiles-s-z/session-desktop b/apparmor.d/profiles-s-z/session-desktop index dc190b787..cafccd791 100644 --- a/apparmor.d/profiles-s-z/session-desktop +++ b/apparmor.d/profiles-s-z/session-desktop @@ -17,9 +17,9 @@ profile session-desktop @{exec_path} { include include include - include include include + include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 659d650fe..56f5e91b8 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -19,8 +19,9 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include include - include + include include include include @@ -30,6 +31,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include include network inet dgram, diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission index ad219f1ab..78d67787d 100644 --- a/apparmor.d/profiles-s-z/transmission +++ b/apparmor.d/profiles-s-z/transmission @@ -12,12 +12,12 @@ profile transmission @{exec_path} flags=(attach_disconnected) { include include include - include include include include include include + include include include include From bd295d2a9d2fe0afc6361ca8528eb531051e9f0c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 21:23:04 +0200 Subject: [PATCH 1313/1455] refractor: move gtk dbus to they own abs. --- .../abstractions/bus/session/org.gtk.Actions | 22 +++++++++++++++++++ .../abstractions/bus/session/org.gtk.Settings | 18 +++++++++++++++ apparmor.d/abstractions/gtk.d/complete | 19 ++-------------- 3 files changed, 42 insertions(+), 17 deletions(-) create mode 100644 apparmor.d/abstractions/bus/session/org.gtk.Actions create mode 100644 apparmor.d/abstractions/bus/session/org.gtk.Settings diff --git a/apparmor.d/abstractions/bus/session/org.gtk.Actions b/apparmor.d/abstractions/bus/session/org.gtk.Actions new file mode 100644 index 000000000..899f244a8 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.gtk.Actions @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus receive bus=session + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=gnome-shell), + + dbus receive bus=session + interface=org.gtk.Actions + member={Activate,DescribeAll,SetState}, + + dbus send bus=session + interface=org.gtk.Actions + member=Changed, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.gtk.Settings b/apparmor.d/abstractions/bus/session/org.gtk.Settings new file mode 100644 index 000000000..9d2dd282a --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.gtk.Settings @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus send bus=session path=/org/gtk/Settings + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=gsd-xsettings), + dbus receive bus=session path=/org/gtk/Settings + interface=org.freedesktop.DBus.Properties + member=PropertiesChanged + peer=(name=@{busname}, label=gsd-xsettings), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/gtk.d/complete b/apparmor.d/abstractions/gtk.d/complete index 99cf70d97..356e97705 100644 --- a/apparmor.d/abstractions/gtk.d/complete +++ b/apparmor.d/abstractions/gtk.d/complete @@ -2,23 +2,8 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - dbus receive bus=session - interface=org.gtk.Actions - member={Activate,DescribeAll,SetState} - peer=(name=@{busname}), - - dbus send bus=session - interface=org.gtk.Actions - member=Changed, - - dbus send bus=session path=/org/gtk/Settings - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=@{busname}, label=gsd-xsettings), - dbus receive bus=session path=/org/gtk/Settings - interface=org.freedesktop.DBus.Properties - member=PropertiesChanged - peer=(name=@{busname}, label=gsd-xsettings), + include + include @{lib}/{,@{multiarch}/}gtk*/** mr, From bd7ae9bb56badbb168d88dc0de859f59a1ad7344 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 21:23:40 +0200 Subject: [PATCH 1314/1455] chore: improve comment in type definition. --- pkg/prebuild/builder/stacked-dbus.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/prebuild/builder/stacked-dbus.go b/pkg/prebuild/builder/stacked-dbus.go index 33af33df7..e33ecf4b7 100644 --- a/pkg/prebuild/builder/stacked-dbus.go +++ b/pkg/prebuild/builder/stacked-dbus.go @@ -19,7 +19,7 @@ var ( } ) -// Fix for https://gitlab.com/apparmor/apparmor/-/issues/537#note_2699570190 +// StackedDbus is a fix for https://gitlab.com/apparmor/apparmor/-/issues/537#note_2699570190 type StackedDbus struct { prebuild.Base } From eee8241eb7649a302b65f6e840018755dd308b04 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 21:28:53 +0200 Subject: [PATCH 1315/1455] chore: cosmetic fixes. --- .../abstractions/bus/session/org.freedesktop.Notifications | 2 +- apparmor.d/abstractions/bus/session/org.gtk.Notifications | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.Notifications b/apparmor.d/abstractions/bus/session/org.freedesktop.Notifications index 5c10a9eae..b51c4bdcb 100644 --- a/apparmor.d/abstractions/bus/session/org.freedesktop.Notifications +++ b/apparmor.d/abstractions/bus/session/org.freedesktop.Notifications @@ -16,6 +16,6 @@ member={ActionInvoked,NotificationClosed,NotificationReplied} peer=(name="{@{busname},org.freedesktop.Notifications}", label="@{pp_notification}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.gtk.Notifications b/apparmor.d/abstractions/bus/session/org.gtk.Notifications index ad1a1ffad..151c642a8 100644 --- a/apparmor.d/abstractions/bus/session/org.gtk.Notifications +++ b/apparmor.d/abstractions/bus/session/org.gtk.Notifications @@ -11,6 +11,6 @@ member={AddNotification,RemoveNotification} peer=(name=org.gtk.Notifications, label=gnome-shell), - include if exists + include if exists # vim:syntax=apparmor From 7eaae9e68c701e24710784c52e9db9fd2d44da87 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 22:25:57 +0200 Subject: [PATCH 1316/1455] fix(profile): wrong path in abstraction. --- apparmor.d/abstractions/notifications | 4 ++-- apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk | 5 +++-- apparmor.d/groups/gnome/gnome-extension-gsconnect | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/apparmor.d/abstractions/notifications b/apparmor.d/abstractions/notifications index 8232b54b5..81d5cc94c 100644 --- a/apparmor.d/abstractions/notifications +++ b/apparmor.d/abstractions/notifications @@ -4,8 +4,8 @@ abi , - include - include + include + include include if exists diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index c9585e2ab..92e6c9484 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -9,7 +9,6 @@ include @{exec_path} = @{lib}/xdg-desktop-portal-gtk profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include - include include include include @@ -17,15 +16,17 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include include include - include include include include + include include include include include include + include + include include include diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 3f57b3035..22c02a97f 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -21,7 +21,6 @@ profile gnome-extension-gsconnect @{exec_path} { include include include - include include include include @@ -29,6 +28,7 @@ profile gnome-extension-gsconnect @{exec_path} { include include include + include include include include From 7cfff26ee273fca78aaea077cf63166d4883e2cb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 22:46:52 +0200 Subject: [PATCH 1317/1455] fix(profile): abstraction not updated. --- apparmor.d/profiles-s-z/superproductivity | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index 73a86672f..f7abf758b 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -20,13 +20,13 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) { include include include - include include include include include include include + include network inet stream, network inet6 stream, From a1ba00bec3e964e11cae0dd94346f8aebdffc188 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 31 Aug 2025 23:00:13 +0200 Subject: [PATCH 1318/1455] feat(profile): general profile update. --- apparmor.d/groups/apparmor/apparmor_parser | 4 ++-- apparmor.d/groups/apt/debconf-frontend | 4 +++- apparmor.d/groups/apt/dpkg-scripts | 1 + apparmor.d/groups/bluetooth/obexd | 5 +++++ apparmor.d/groups/cron/anacron | 3 +++ apparmor.d/groups/cups/cups-browsed | 4 +++- apparmor.d/groups/flatpak/flatpak | 3 +++ apparmor.d/groups/flatpak/flatpak-system-helper | 8 +++++++- apparmor.d/groups/freedesktop/wireplumber | 8 +++++--- apparmor.d/groups/freedesktop/xdg-desktop-portal | 2 +- apparmor.d/groups/gnome/deja-dup-monitor | 13 +++++++++++++ apparmor.d/groups/gnome/gdm-session | 11 ++++++----- apparmor.d/groups/gnome/gnome-calculator | 1 + apparmor.d/groups/gnome/gnome-control-center | 3 ++- apparmor.d/groups/gnome/gnome-session | 3 +++ apparmor.d/groups/gnome/gnome-session-binary | 5 +++-- apparmor.d/groups/gnome/gnome-shell-calendar-server | 1 + apparmor.d/groups/gnome/gnome-system-monitor | 5 +++-- apparmor.d/groups/gnome/gnome-text-editor | 1 + apparmor.d/groups/gnome/gsd-housekeeping | 1 + apparmor.d/groups/gnome/gsd-usb-protection | 1 + apparmor.d/groups/gnome/gsd-wwan | 7 +++++++ apparmor.d/groups/gnome/gsd-xsettings | 2 +- apparmor.d/groups/gnome/ptyxis | 1 + apparmor.d/groups/kde/DiscoverNotifier | 1 + apparmor.d/groups/procps/htop | 1 + apparmor.d/groups/ssh/sshd | 2 ++ apparmor.d/groups/systemd/systemd-coredump | 3 +++ apparmor.d/groups/systemd/systemd-detect-virt | 3 +++ apparmor.d/groups/systemd/systemd-remount-fs | 3 ++- apparmor.d/groups/systemd/systemd-udevd | 8 ++++++++ apparmor.d/groups/systemd/zram-generator | 8 ++++++-- apparmor.d/groups/ubuntu/apport-gtk | 1 + apparmor.d/groups/utils/who | 2 +- apparmor.d/profiles-a-f/finalrd | 1 + apparmor.d/profiles-g-l/gsettings | 1 - apparmor.d/profiles-g-l/issue-generator | 3 ++- apparmor.d/profiles-m-r/mimetype | 2 +- apparmor.d/profiles-s-z/signal-desktop | 1 + apparmor.d/profiles-s-z/udev-fido_id | 1 + apparmor.d/profiles-s-z/update-info-dir | 3 ++- apparmor.d/profiles-s-z/wsdd | 8 +++++++- apparmor.d/profiles-s-z/xournalpp | 2 +- 43 files changed, 121 insertions(+), 30 deletions(-) diff --git a/apparmor.d/groups/apparmor/apparmor_parser b/apparmor.d/groups/apparmor/apparmor_parser index 0a9f9fcaf..a5769931c 100644 --- a/apparmor.d/groups/apparmor/apparmor_parser +++ b/apparmor.d/groups/apparmor/apparmor_parser @@ -6,7 +6,7 @@ abi , include -@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib} +@{lib_dirs} = @{lib}/ /snap/{snapd,core}/{,x}@{int}@{lib} @{exec_path} = @{sbin}/apparmor_parser @{lib_dirs}/snapd/apparmor_parser profile apparmor_parser @{exec_path} flags=(attach_disconnected) { @@ -46,7 +46,7 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, deny network netlink raw, # file_inherit - deny /apparmor/.null rw, + /opt/Mullvad*/resources/apparmor_mullvad r, # FIXME: WTF you thing you are doing mullvad? include if exists } diff --git a/apparmor.d/groups/apt/debconf-frontend b/apparmor.d/groups/apt/debconf-frontend index 4660755d6..6e80839fe 100644 --- a/apparmor.d/groups/apt/debconf-frontend +++ b/apparmor.d/groups/apt/debconf-frontend @@ -25,7 +25,7 @@ profile debconf-frontend @{exec_path} flags=(complain) { @{bin}/stty ix, @{sbin}/update-secureboot-policy Px, - # debconf apps + # Debconf apps @{bin}/adequate Px, @{bin}/debconf-apt-progress Px, @{bin}/linux-check-removal Px, @@ -49,6 +49,8 @@ profile debconf-frontend @{exec_path} flags=(complain) { @{lib}/dkms/dkms-* rPUx, @{lib}/dkms/dkms_* rPUx, + /etc/libpaper.d/texlive-base rPUx, + /usr/share/debconf/{,**} r, /etc/inputrc r, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 7d2073768..8ae76e706 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -76,6 +76,7 @@ profile dpkg-scripts @{exec_path} { @{run}/** rw, @{efi}/grub/* rw, + /tmp/fmtutil.@{rand8} rw, /tmp/grub.@{rand10} rw, /tmp/sed@{rand6} rw, /tmp/tmp.@{rand10} rw, diff --git a/apparmor.d/groups/bluetooth/obexd b/apparmor.d/groups/bluetooth/obexd index 65ad4c0e5..3ea17a4e5 100644 --- a/apparmor.d/groups/bluetooth/obexd +++ b/apparmor.d/groups/bluetooth/obexd @@ -25,6 +25,11 @@ profile obexd @{exec_path} { member=Release peer=(name=:*, label="@{p_bluetoothd}"), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, owner @{user_cache_dirs}/ rw, diff --git a/apparmor.d/groups/cron/anacron b/apparmor.d/groups/cron/anacron index 3756c1d03..3acfc14fd 100644 --- a/apparmor.d/groups/cron/anacron +++ b/apparmor.d/groups/cron/anacron @@ -28,6 +28,7 @@ profile anacron @{exec_path} { @{tmp}/file@{rand6} rw, /tmp/anacron-@{rand6} rw, + /tmp/anacron-@{rand6}@{c} rw, profile run-parts { include @@ -39,7 +40,9 @@ profile anacron @{exec_path} { owner @{tmp}/#@{int} rw, owner @{tmp}/file@{rand6} rw, + /tmp/anacron-@{rand6} rw, + /tmp/anacron-@{rand6}@{c} rw, include if exists } diff --git a/apparmor.d/groups/cups/cups-browsed b/apparmor.d/groups/cups/cups-browsed index a7773a57f..7330d67c9 100644 --- a/apparmor.d/groups/cups/cups-browsed +++ b/apparmor.d/groups/cups/cups-browsed @@ -49,9 +49,11 @@ profile cups-browsed @{exec_path} { /etc/cups/{,**} r, - /var/cache/cups/{,**} rw, /var/log/cups/{,**} rw, + /var/cache/cups/{,**} rw, + owner /var/cache/cups-browsed/{,**} rw, + owner @{tmp}/@{hex} rw, @{run}/cups/certs/* r, diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index c540b9db8..e73408a0a 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -154,6 +154,9 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain capability setuid, + unix type=seqpacket peer=(label=flatpak-system-helper), + unix type=stream peer=(label=flatpak), + mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/, umount /var/tmp/flatpak-cache-*/*/, diff --git a/apparmor.d/groups/flatpak/flatpak-system-helper b/apparmor.d/groups/flatpak/flatpak-system-helper index 0ca01d01d..cdfef1bad 100644 --- a/apparmor.d/groups/flatpak/flatpak-system-helper +++ b/apparmor.d/groups/flatpak/flatpak-system-helper @@ -28,6 +28,11 @@ profile flatpak-system-helper @{exec_path} { ptrace read, + unix type=seqpacket peer=(label=dbus-system), + unix type=seqpacket peer=(label=flatpak), + unix type=seqpacket peer=(label=flatpak//fusermount), + unix type=seqpacket peer=(label=unconfined), + #aa:dbus own bus=system name=org.freedesktop.Flatpak.SystemHelper @{exec_path} mr, @@ -54,7 +59,8 @@ profile flatpak-system-helper @{exec_path} { @{tmp}/remote-summary-sig.@{rand6} r, @{tmp}/remote-summary.@{rand6} r, - @{PROC}/@{pid}/stat r, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fdinfo/@{int} r, diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index 7aff8bdd2..aefdc339d 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -47,8 +47,8 @@ profile wireplumber @{exec_path} { /usr/share/wireplumber/{,**} r, owner @{desktop_local_dirs}/ w, - owner @{desktop_local_dirs}/state/ w, - owner @{desktop_local_dirs}/state/wireplumber/{,**} rw, + owner @{desktop_state_dirs}/ w, + owner @{desktop_state_dirs}/wireplumber/{,**} rw, owner @{HOME}/.local/ w, owner @{user_state_dirs}/ w, @@ -81,8 +81,10 @@ profile wireplumber @{exec_path} { @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, - @{PROC}/@{pid}/cgroup r, + @{PROC}/1/cgroup r, + @{PROC}/1/status r, @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/media@{int} rw, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 89acacd34..21c99827b 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -68,7 +68,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { @{bin}/kreadconfig{,5} rPx, @{lib}/xdg-desktop-portal-validate-icon rPx, - @{open_path} rPx -> child-open, + @{open_path} mrPx -> child-open, / r, @{att}/.flatpak-info r, diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor index fcafbda5f..a0fb366ab 100644 --- a/apparmor.d/groups/gnome/deja-dup-monitor +++ b/apparmor.d/groups/gnome/deja-dup-monitor @@ -18,6 +18,8 @@ profile deja-dup-monitor @{exec_path} { include include include + include + include network netlink raw, @@ -39,15 +41,26 @@ profile deja-dup-monitor @{exec_path} { member=GetAll peer=(name=@{busname}, label=power-profiles-daemon), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, @{bin}/chrt rix, @{bin}/ionice rix, @{bin}/deja-dup Px, + /usr/share/gvfs/remote-volume-monitors/{,**} r, + /var/tmp/ r, /tmp/ r, + @{run}/mount/utab r, + + owner @{PROC}/@{pid}/mountinfo r, + include if exists } diff --git a/apparmor.d/groups/gnome/gdm-session b/apparmor.d/groups/gnome/gdm-session index 9a42bcdf1..c08d12a07 100644 --- a/apparmor.d/groups/gnome/gdm-session +++ b/apparmor.d/groups/gnome/gdm-session @@ -14,11 +14,12 @@ profile gdm-session @{exec_path} { include include - signal (receive) set=(hup term) peer=gdm-session-worker, - signal (receive) set=(term) peer=gdm, - signal (send) set=(term) peer=dbus-session, - signal (send) set=(term) peer=gnome-session-binary, - signal (send) set=(term) peer=xorg, + signal receive set=(hup term) peer=gdm-session-worker, + signal receive set=(term) peer=gdm, + signal send set=(term) peer=dbus-session, + signal send set=(term) peer=gnome-session-binary, + signal send set=(term) peer=xorg, + signal send set=term peer=gnome-session, dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gnome/gnome-calculator b/apparmor.d/groups/gnome/gnome-calculator index 2e553d9f4..4e83bfb76 100644 --- a/apparmor.d/groups/gnome/gnome-calculator +++ b/apparmor.d/groups/gnome/gnome-calculator @@ -10,6 +10,7 @@ include profile gnome-calculator @{exec_path} { include include + include include # Needed to get currency exchange rates diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index fde43420a..111facf64 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -130,7 +130,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/gnome-control-center/{,**} rw, owner @{user_config_dirs}/ibus/bus/ r, owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, - owner @{user_config_dirs}/mimeapps.list{,.@{rand6}} rw, + owner @{user_config_dirs}/mimeapps.list w, + owner @{user_config_dirs}/mimeapps.list.@{rand6} rw, owner @{user_config_dirs}/rygel.conf{,.@{rand6}} rw, owner @{user_games_dirs}/**.png r, diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index 1f29958d1..7bcf80431 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -9,7 +9,10 @@ include @{exec_path} = @{bin}/gnome-session profile gnome-session @{exec_path} { include + include include + include + include include include diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index b011935ae..f4c61c5c6 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -28,8 +28,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network netlink raw, - signal (receive) set=(term, hup) peer=gdm*, - signal (send) set=(term) peer=gsd-*, + signal receive set=(term, hup) peer=gdm*, + signal send set=(term) peer=gsd-*, #aa:dbus own bus=session name=org.gnome.SessionManager #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" @@ -67,6 +67,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { @{etc_ro}/xdg/autostart/{,*.desktop} r, owner @{gdm_cache_dirs}/gdm/Xauthority r, + owner @{gdm_config_dirs}/ rw, owner @{gdm_config_dirs}/dconf/user rw, owner @{gdm_config_dirs}/gnome-session/ rw, owner @{gdm_config_dirs}/gnome-session/saved-session/ rw, diff --git a/apparmor.d/groups/gnome/gnome-shell-calendar-server b/apparmor.d/groups/gnome/gnome-shell-calendar-server index 6ddbd4b4c..37bb7b374 100644 --- a/apparmor.d/groups/gnome/gnome-shell-calendar-server +++ b/apparmor.d/groups/gnome/gnome-shell-calendar-server @@ -11,6 +11,7 @@ profile gnome-shell-calendar-server @{exec_path} { include include include + include include #aa:dbus own bus=session name=org.gnome.Shell.CalendarServer diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index e4ac12011..8bcb629a9 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -22,9 +22,9 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { network inet6 dgram, network netlink raw, - ptrace (read), + ptrace read, - signal (send) set=(kill term cont stop), + signal send set=(kill term cont stop), #aa:dbus own bus=session name=org.gnome.SystemMonitor @@ -75,6 +75,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/smaps r, @{PROC}/@{pids}/stat r, @{PROC}/@{pids}/statm r, + @{PROC}/@{pids}/status r, @{PROC}/@{pids}/wchan r, @{PROC}/diskstats r, @{PROC}/vmstat r, diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index c399eadc7..5c8ab7c8a 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -12,6 +12,7 @@ profile gnome-text-editor @{exec_path} { include include include + include include include diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index 35f43a93e..83fcbd7c6 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -17,6 +17,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { include include include + include include signal (receive) set=(term, hup) peer=gdm*, diff --git a/apparmor.d/groups/gnome/gsd-usb-protection b/apparmor.d/groups/gnome/gsd-usb-protection index 3bfffdb6a..7f03d9fc5 100644 --- a/apparmor.d/groups/gnome/gsd-usb-protection +++ b/apparmor.d/groups/gnome/gsd-usb-protection @@ -12,6 +12,7 @@ profile gsd-usb-protection @{exec_path} { include include include + include #aa:dbus own bus=session name=org.gnome.SettingsDaemon.UsbProtection diff --git a/apparmor.d/groups/gnome/gsd-wwan b/apparmor.d/groups/gnome/gsd-wwan index ab2b2b089..3a5ee53df 100644 --- a/apparmor.d/groups/gnome/gsd-wwan +++ b/apparmor.d/groups/gnome/gsd-wwan @@ -10,10 +10,17 @@ include profile gsd-wwan @{exec_path} { include include + include include + include #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Wwan + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, include if exists diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index 2e21750b9..7618dc3b6 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -43,7 +43,7 @@ profile gsd-xsettings @{exec_path} { dbus receive bus=system path=/org/freedesktop/Accounts interface=org.freedesktop.Accounts - member=UserAdded + member={UserAdded,UserDeleted} peer=(name=@{busname}, label="@{p_accounts_daemon}"), dbus send bus=system path=/org/freedesktop/Accounts/User@{uid} diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis index 838dc940c..b0239f404 100644 --- a/apparmor.d/groups/gnome/ptyxis +++ b/apparmor.d/groups/gnome/ptyxis @@ -12,6 +12,7 @@ profile ptyxis @{exec_path} { include include include + include unix type=stream peer=(label=ptyxis-agent), diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 2307c709f..0965396ab 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -34,6 +34,7 @@ profile DiscoverNotifier @{exec_path} { @{exec_path} mr, @{bin}/apt-config rPx, + @{bin}/plasma-discover rPx, @{bin}/gpg{,2} rCx -> gpg, @{bin}/gpgconf rCx -> gpg, diff --git a/apparmor.d/groups/procps/htop b/apparmor.d/groups/procps/htop index 4937f6875..ef14d9ca9 100644 --- a/apparmor.d/groups/procps/htop +++ b/apparmor.d/groups/procps/htop @@ -112,6 +112,7 @@ profile htop @{exec_path} { @{PROC}/@{pids}/oom_score r, @{PROC}/@{pids}/stat r, @{PROC}/@{pids}/statm r, + @{PROC}/@{pids}/status r, @{PROC}/@{pids}/wchan r, @{PROC}/@{pids}/task/ r, diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd index 40cf0bca2..633076ad6 100644 --- a/apparmor.d/groups/ssh/sshd +++ b/apparmor.d/groups/ssh/sshd @@ -69,6 +69,8 @@ profile sshd @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, + @{sbin}/sshd.hmac r, + @{bin}/@{shells} Ux, #aa:exclude RBAC @{bin}/false ix, @{sbin}/nologin Px, diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index db1854f1f..061b93ffd 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -52,6 +52,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted @{att}/@{run}/systemd/coredump rw, @{run}/systemd/coredump rw, + @{PROC}/@{pids}/auxv r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/comm r, @@ -59,9 +60,11 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted @{PROC}/@{pids}/fd/ r, @{PROC}/@{pids}/fdinfo/@{int} r, @{PROC}/@{pids}/limits r, + @{PROC}/@{pids}/maps r, @{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/ns/ r, @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, owner @{PROC}/@{pid}/setgroups r, include if exists diff --git a/apparmor.d/groups/systemd/systemd-detect-virt b/apparmor.d/groups/systemd/systemd-detect-virt index 9b78b7c04..ca6eae3ad 100644 --- a/apparmor.d/groups/systemd/systemd-detect-virt +++ b/apparmor.d/groups/systemd/systemd-detect-virt @@ -43,6 +43,9 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) { /dev/cpu/@{int}/msr r, + deny capability net_admin, + deny capability perfmon, + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-remount-fs b/apparmor.d/groups/systemd/systemd-remount-fs index 96b182e5f..73213160b 100644 --- a/apparmor.d/groups/systemd/systemd-remount-fs +++ b/apparmor.d/groups/systemd/systemd-remount-fs @@ -23,7 +23,8 @@ profile systemd-remount-fs @{exec_path} flags=(attach_disconnected) { @{bin}/mount rix, - /etc/blkid.conf r, + @{etc_ro}/blkid.conf r, + @{etc_ro}/blkid.conf.d/{,**} r, /etc/fstab r, @{run}/host/container-manager r, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index 640e48f3f..cb9592d47 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -128,6 +128,14 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected) { include include + capability sys_module, + + @{sh_path} rix, + @{bin}/kmod ix, + + @{sys}/module/*/initstate r, + @{sys}/module/compression r, + include if exists } diff --git a/apparmor.d/groups/systemd/zram-generator b/apparmor.d/groups/systemd/zram-generator index 473848ef3..193bfc9b6 100644 --- a/apparmor.d/groups/systemd/zram-generator +++ b/apparmor.d/groups/systemd/zram-generator @@ -13,7 +13,7 @@ profile zram-generator @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{bin}/kmod rCx, + @{bin}/kmod rCx -> kmod, @{bin}/systemd-detect-virt rPx, @{lib}/systemd/systemd-makefs rPx, @@ -31,10 +31,14 @@ profile zram-generator @{exec_path} flags=(attach_disconnected) { owner /dev/pts/@{int} rw, - profile kmod { + profile kmod flags=(attach_disconnected) { include include + capability sys_module, + + @{sys}/module/compression r, + include if exists } diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 3d2cbd63d..d7480a212 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -17,6 +17,7 @@ profile apport-gtk @{exec_path} { include include include + include include include include diff --git a/apparmor.d/groups/utils/who b/apparmor.d/groups/utils/who index d951bfe03..d9ca9e164 100644 --- a/apparmor.d/groups/utils/who +++ b/apparmor.d/groups/utils/who @@ -7,7 +7,7 @@ abi , include -@{exec_path} = @{bin}/who +@{exec_path} = @{bin}/{,gnu}who profile who @{exec_path} { include include diff --git a/apparmor.d/profiles-a-f/finalrd b/apparmor.d/profiles-a-f/finalrd index b22730a27..7ce69ab64 100644 --- a/apparmor.d/profiles-a-f/finalrd +++ b/apparmor.d/profiles-a-f/finalrd @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/finalrd profile finalrd @{exec_path} { include + include capability dac_read_search, capability sys_admin, diff --git a/apparmor.d/profiles-g-l/gsettings b/apparmor.d/profiles-g-l/gsettings index 2e0eb2cf7..9b8eca8ee 100644 --- a/apparmor.d/profiles-g-l/gsettings +++ b/apparmor.d/profiles-g-l/gsettings @@ -16,7 +16,6 @@ profile gsettings @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, diff --git a/apparmor.d/profiles-g-l/issue-generator b/apparmor.d/profiles-g-l/issue-generator index 7783c8005..093cd7100 100644 --- a/apparmor.d/profiles-g-l/issue-generator +++ b/apparmor.d/profiles-g-l/issue-generator @@ -19,6 +19,7 @@ profile issue-generator @{exec_path} { @{bin}/cat rix, @{bin}/chmod rix, @{bin}/cmp rix, + @{bin}/mkdir rix, @{bin}/mktemp rix, @{bin}/mv rix, @{bin}/rm rix, @@ -30,7 +31,7 @@ profile issue-generator @{exec_path} { @{run}/agetty.reload w, @{run}/issue rw, @{run}/issue.@{rand10} rw, - @{run}/issue.d/{,**} r, + @{run}/issue.d/{,**} rw, /dev/tty rw, diff --git a/apparmor.d/profiles-m-r/mimetype b/apparmor.d/profiles-m-r/mimetype index 1576050b5..32950dbc4 100644 --- a/apparmor.d/profiles-m-r/mimetype +++ b/apparmor.d/profiles-m-r/mimetype @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/mimetype @{bin}/*_perl/mimetype profile mimetype @{exec_path} { include - include + include include @{exec_path} r, diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index d91285558..001f8605a 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -21,6 +21,7 @@ profile signal-desktop @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/profiles-s-z/udev-fido_id b/apparmor.d/profiles-s-z/udev-fido_id index 9c686b19d..453e0093a 100644 --- a/apparmor.d/profiles-s-z/udev-fido_id +++ b/apparmor.d/profiles-s-z/udev-fido_id @@ -14,6 +14,7 @@ profile udev-fido_id @{exec_path} { @{exec_path} mr, /etc/udev/udev.conf r, + /etc/udev/udev.conf.d/{,**} r, @{sys}/devices/@{pci}/report_descriptor r, @{sys}/devices/platform/**/report_descriptor r, diff --git a/apparmor.d/profiles-s-z/update-info-dir b/apparmor.d/profiles-s-z/update-info-dir index fe06b32af..dc2a0d7aa 100644 --- a/apparmor.d/profiles-s-z/update-info-dir +++ b/apparmor.d/profiles-s-z/update-info-dir @@ -14,8 +14,9 @@ profile update-info-dir @{exec_path} { @{exec_path} mr, @{sh_path} r, - @{bin}/install-info Px, + @{bin}/cp ix, @{bin}/find ix, + @{bin}/install-info Px, @{bin}/rm ix, /etc/environment r, diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd index fc6955793..b72cff3c4 100644 --- a/apparmor.d/profiles-s-z/wsdd +++ b/apparmor.d/profiles-s-z/wsdd @@ -9,9 +9,14 @@ include @{exec_path} = @{bin}/wsdd profile wsdd @{exec_path} { include + include include include + # wsdd can create its own chroot as a built-in security mechanism. + # This is used by default in the systemd wsdd-server service. + capability sys_chroot, + network inet dgram, network inet stream, network inet6 dgram, @@ -28,7 +33,8 @@ profile wsdd @{exec_path} { owner /var/lib/libuuid/clock.txt rw, @{run}/uuidd/request rw, - owner @{run}/user/@{uid}/gvfsd/wsdd w, + owner @{run}/user/@{uid}/wsdd w, + owner @{run}/user/@{uid}/*/wsdd w, include if exists } diff --git a/apparmor.d/profiles-s-z/xournalpp b/apparmor.d/profiles-s-z/xournalpp index 6442fe8b9..0d6c4d65f 100644 --- a/apparmor.d/profiles-s-z/xournalpp +++ b/apparmor.d/profiles-s-z/xournalpp @@ -37,7 +37,7 @@ profile xournalpp @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/snd/controlC@{int} w, - /dev/snd/pcmC@{rand4} rw, + /dev/snd/pcmC@{int}D@{int}[cp] w, include if exists } From 4f9d2703d4851a196b0e4af88d549f4b24bdc2b4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 1 Sep 2025 15:07:01 +0200 Subject: [PATCH 1319/1455] build: separate the base-strict abs from the re-attach builder. Enable the use of the base-strict abs on all setup. --- apparmor.d/abstractions/attached/base | 2 +- cmd/prebuild/main.go | 5 +++-- pkg/prebuild/builder/attach.go | 5 +---- pkg/prebuild/builder/base-strict.go | 32 +++++++++++++++++++++++++++ 4 files changed, 37 insertions(+), 7 deletions(-) create mode 100644 pkg/prebuild/builder/base-strict.go diff --git a/apparmor.d/abstractions/attached/base b/apparmor.d/abstractions/attached/base index 29c685f55..8741942ff 100644 --- a/apparmor.d/abstractions/attached/base +++ b/apparmor.d/abstractions/attached/base @@ -8,7 +8,7 @@ abi , - include + include @{att}/@{run}/systemd/journal/dev-log w, @{att}/@{run}/systemd/journal/socket w, diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 62685202f..5eb1ab2f2 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -32,8 +32,9 @@ func init() { // Build tasks applied by default builder.Register( - "userspace", // Resolve variable in profile attachments - "hotfix", // Temporary fix for #74, #80 & #235 + "userspace", // Resolve variable in profile attachments + "hotfix", // Temporary fix for #74, #80 & #235 + "base-strict", // Use base-strict as base abstraction ) // Matrix of ABI/Apparmor version to integrate with diff --git a/pkg/prebuild/builder/attach.go b/pkg/prebuild/builder/attach.go index d27908129..66ef18aef 100644 --- a/pkg/prebuild/builder/attach.go +++ b/pkg/prebuild/builder/attach.go @@ -49,10 +49,7 @@ func (b ReAttach) Apply(opt *Option, profile string) (string, error) { } else { insert = "@{att} = /\n" - profile = strings.ReplaceAll(profile, - "include ", - "include ", - ) + } return strings.Replace(profile, origin, insert+origin, 1), nil diff --git a/pkg/prebuild/builder/base-strict.go b/pkg/prebuild/builder/base-strict.go new file mode 100644 index 000000000..29a065629 --- /dev/null +++ b/pkg/prebuild/builder/base-strict.go @@ -0,0 +1,32 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2021-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package builder + +import ( + "strings" + + "github.com/roddhjav/apparmor.d/pkg/prebuild" +) + +type BaseStrict struct { + prebuild.Base +} + +func init() { + RegisterBuilder(&BaseStrict{ + Base: prebuild.Base{ + Keyword: "base-strict", + Msg: "Feat: use 'base-strict' as base abstraction", + }, + }) +} + +func (b BaseStrict) Apply(opt *Option, profile string) (string, error) { + profile = strings.ReplaceAll(profile, + "include ", + "include ", + ) + return profile, nil +} From 7c6f7767575b2a0b6ed7870c6bd38483c42e1fb1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 1 Sep 2025 15:12:30 +0200 Subject: [PATCH 1320/1455] build: set default att to "" when not enabled. It fixes various issues with multiple / that are not collapsed in they canonical form in file rules See https://gitlab.com/apparmor/apparmor/-/issues/450#note_2158840105 --- apparmor.d/tunables/multiarch.d/system | 3 +-- pkg/prebuild/prepare/attach.go | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/apparmor.d/tunables/multiarch.d/system b/apparmor.d/tunables/multiarch.d/system index cf8575db0..b29be3f0c 100644 --- a/apparmor.d/tunables/multiarch.d/system +++ b/apparmor.d/tunables/multiarch.d/system @@ -69,7 +69,6 @@ # Default attachment path when re-attached path disconnected path is ignored. # Disabled on abi3 and Ubuntu 25.04+ # See https://apparmor.pujol.io/development/internal/#re-attached-path -@{att}=/ -alias / -> //, +@{att}="" # vim:syntax=apparmor diff --git a/pkg/prebuild/prepare/attach.go b/pkg/prebuild/prepare/attach.go index 3331c73dc..4523382d8 100644 --- a/pkg/prebuild/prepare/attach.go +++ b/pkg/prebuild/prepare/attach.go @@ -32,7 +32,6 @@ func (p ReAttach) Apply() ([]string, error) { if err != nil { return res, err } - out = strings.ReplaceAll(out, "@{att}=/", "# @{att}=/") - out = strings.ReplaceAll(out, "alias / -> //,", "#alias / -> //,") + out = strings.ReplaceAll(out, `@{att}=""`, `# @{att}=""`) return res, path.WriteFile([]byte(out)) } From 09c1f61bb7aab8f9aff5e7c87cee66d9d9104b83 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 1 Sep 2025 15:54:28 +0200 Subject: [PATCH 1321/1455] build(debian): use deb-systemd-invoke and minor lintian fixes. --- debian/apparmor.d.postinst | 4 +--- debian/apparmor.d.postrm | 4 +--- debian/control | 6 +++--- 3 files changed, 5 insertions(+), 9 deletions(-) diff --git a/debian/apparmor.d.postinst b/debian/apparmor.d.postinst index 2f8c90ae0..361af7b91 100644 --- a/debian/apparmor.d.postinst +++ b/debian/apparmor.d.postinst @@ -8,8 +8,6 @@ set -e #DEBHELPER# apparmor_parser --purge-cache || true -if systemctl is-active -q apparmor; then - systemctl reload apparmor -fi +deb-systemd-invoke reload apparmor.service exit 0 diff --git a/debian/apparmor.d.postrm b/debian/apparmor.d.postrm index 2f8c90ae0..361af7b91 100644 --- a/debian/apparmor.d.postrm +++ b/debian/apparmor.d.postrm @@ -8,8 +8,6 @@ set -e #DEBHELPER# apparmor_parser --purge-cache || true -if systemctl is-active -q apparmor; then - systemctl reload apparmor -fi +deb-systemd-invoke reload apparmor.service exit 0 diff --git a/debian/control b/debian/control index 56ad928ba..85c4d3786 100644 --- a/debian/control +++ b/debian/control @@ -18,6 +18,6 @@ Architecture: any Depends: apparmor-profiles Conflicts: apparmor-profiles-extra Provides: apparmor-profiles-extra -Description: Full set of AppArmor profiles (~ 1500 profiles) - apparmor.d is a set of over 1500 AppArmor profiles whose aim is to confine - most Linux based applications and processes. +Description: Full set of AppArmor profiles (~ 2000 profiles) + apparmor.d is a set of over 2000 AppArmor profiles whose aim is to confine + most Linux based applications and processes. From 2b07398cef01bf511fafd8c66d631598baae1e8d Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Wed, 3 Sep 2025 03:28:16 +0200 Subject: [PATCH 1322/1455] flatpak-app ntsync --- apparmor.d/groups/flatpak/flatpak-app | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/flatpak/flatpak-app b/apparmor.d/groups/flatpak/flatpak-app index e8fe195fb..e6be7ef4f 100644 --- a/apparmor.d/groups/flatpak/flatpak-app +++ b/apparmor.d/groups/flatpak/flatpak-app @@ -98,6 +98,8 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) { owner @{run}/ld-so-cache-dir/* rw, owner @{run}/user/ r, + /dev/ntsync r, + include if exists include if exists } From 2c0b5405db7242b8d0b6704fc9998927bee30c9c Mon Sep 17 00:00:00 2001 From: Jose Maldonado aka Yukiteru Date: Fri, 29 Aug 2025 19:06:48 -0400 Subject: [PATCH 1323/1455] firewall-applet: update profile --- apparmor.d/groups/firewall/firewall-applet | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/groups/firewall/firewall-applet b/apparmor.d/groups/firewall/firewall-applet index 280bd9d04..bd144b7e2 100644 --- a/apparmor.d/groups/firewall/firewall-applet +++ b/apparmor.d/groups/firewall/firewall-applet @@ -21,6 +21,9 @@ profile firewall-applet @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/cgroup r, + + owner @{user_config_dirs}/firewall/applet.conf rwkl, include if exists } From 237622f3efd6c7c8b11482086f2ca31fa47cc915 Mon Sep 17 00:00:00 2001 From: Jose Maldonado aka Yukiteru Date: Fri, 29 Aug 2025 13:54:42 -0400 Subject: [PATCH 1324/1455] rpcbind: update profile rpcbind: update profile --- apparmor.d/groups/network/rpcbind | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/apparmor.d/groups/network/rpcbind b/apparmor.d/groups/network/rpcbind index 1d81292fd..0650470ac 100644 --- a/apparmor.d/groups/network/rpcbind +++ b/apparmor.d/groups/network/rpcbind @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2023 Jeroen Rijken +# Copyright (C) 2025 Jose Maldonado # SPDX-License-Identifier: GPL-2.0-only abi , @@ -9,9 +10,18 @@ include @{exec_path} = @{sbin}/rpcbind profile rpcbind @{exec_path} flags=(complain) { include + include + + capability setgid, + capability setuid, @{exec_path} rm, + /etc/netconfig r, + + @{run}/rpcbind.lock rwkl, + @{run}/rpcbind/*.xdr rwkl, + include if exists } From 4c84b572cda4433a664b1488e980034886652629 Mon Sep 17 00:00:00 2001 From: JND94 <149390116+JND94@users.noreply.github.com> Date: Tue, 2 Sep 2025 05:12:04 +0200 Subject: [PATCH 1325/1455] glxgears can't access X cookie --- apparmor.d/profiles-g-l/glxgears | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-g-l/glxgears b/apparmor.d/profiles-g-l/glxgears index 1e27790df..cfd9f0dac 100644 --- a/apparmor.d/profiles-g-l/glxgears +++ b/apparmor.d/profiles-g-l/glxgears @@ -25,6 +25,7 @@ profile glxgears @{exec_path} { @{exec_path} mr, owner @{HOME}/.Xauthority r, + owner @{run}/user/@{uid}/xauth_@{rand6} r, include if exists } From e43d9078089c4b46c8f48d08ebacacf83327b3f1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 2 Sep 2025 00:06:57 +0200 Subject: [PATCH 1326/1455] chore: cosmetic. --- Justfile | 78 ++++++++++++++++++++++++++++---------------------------- 1 file changed, 39 insertions(+), 39 deletions(-) diff --git a/Justfile b/Justfile index e434586c4..2c4c0e8d4 100644 --- a/Justfile +++ b/Justfile @@ -49,44 +49,44 @@ c := "--connect=qemu:///system" # VM prefix prefix := "aa-" -[doc('Show this help message')] +# Show this help message help: @just --list --unsorted @printf "\n%s\n" "See https://apparmor.pujol.io/development/ for more information." +# Build the go programs [group('build')] -[doc('Build the go programs')] build: @go build -o {{build}}/ ./cmd/aa-log @go build -o {{build}}/ ./cmd/prebuild +# Prebuild the profiles in enforced mode [group('build')] -[doc('Prebuild the profiles in enforced mode')] enforce: build @./{{build}}/prebuild --buildir {{build}} +# Prebuild the profiles in complain mode [group('build')] -[doc('Prebuild the profiles in complain mode')] complain: build ./{{build}}/prebuild --buildir {{build}} --complain +# Prebuild the profiles in FSP mode [group('build')] -[doc('Prebuild the profiles in FSP mode')] fsp: build @./{{build}}/prebuild --buildir {{build}} --full +# Prebuild the profiles in FSP mode (complain) [group('build')] -[doc('Prebuild the profiles in FSP mode (complain)')] fsp-complain: build @./{{build}}/prebuild --buildir {{build}} --complain --full +# Prebuild the profiles in FSP mode (debug) [group('build')] -[doc('Prebuild the profiles in FSP mode (debug)')] fsp-debug: build @./{{build}}/prebuild --buildir {{build}} --complain --full --debug +# Install prebuild profiles [group('install')] -[doc('Install prebuild profiles')] install: #!/usr/bin/env bash set -eu -o pipefail @@ -113,8 +113,8 @@ install: install -Dm0644 "$file" "{{destdir}}/usr/lib/systemd/user/$service.d/apparmor.conf" done +# Locally install prebuild profiles [group('install')] -[doc('Locally install prebuild profiles')] local +names: #!/usr/bin/env bash set -eu -o pipefail @@ -135,39 +135,39 @@ local +names: done; systemctl restart apparmor || sudo journalctl -xeu apparmor.service +# Prebuild, install, and load a dev profile [group('install')] -[doc('Prebuild, install, and load a dev profile')] dev name: go run ./cmd/prebuild --complain --file `find apparmor.d -iname {{name}}` sudo install -Dm644 {{build}}/apparmor.d/{{name}} /etc/apparmor.d/{{name}} sudo systemctl restart apparmor || sudo journalctl -xeu apparmor.service +# Build & install apparmor.d on Arch based systems [group('packages')] -[doc('Build & install apparmor.d on Arch based systems')] pkg: @makepkg --syncdeps --install --cleanbuild --force --noconfirm +# Build & install apparmor.d on Debian based systems [group('packages')] -[doc('Build & install apparmor.d on Debian based systems')] dpkg: @bash dists/build.sh dpkg @sudo dpkg -i {{pkgdest}}/{{pkgname}}_*.deb +# Build & install apparmor.d on OpenSUSE based systems [group('packages')] -[doc('Build & install apparmor.d on OpenSUSE based systems')] rpm: @bash dists/build.sh rpm @sudo rpm -ivh --force {{pkgdest}}/{{pkgname}}-*.rpm +# Run the unit tests [group('tests')] -[doc('Run the unit tests')] tests: @go test ./cmd/... -v -cover -coverprofile=coverage.out @go test ./pkg/... -v -cover -coverprofile=coverage.out @go tool cover -func=coverage.out +# Run the linters [group('linter')] -[doc('Run the linters')] lint: golangci-lint run packer fmt tests/packer/ @@ -177,34 +177,34 @@ lint: tests/packer/init.sh tests/packer/src/aa-update tests/packer/clean.sh \ debian/{{pkgname}}.postinst debian/{{pkgname}}.postrm +# Run style checks on the profiles [group('linter')] -[doc('Run style checks on the profiles')] check: @bash tests/check.sh +# Generate the man pages [group('docs')] -[doc('Generate the man pages')] man: @pandoc -t man -s -o share/man/man8/aa-log.8 share/man/man8/aa-log.md +# Build the documentation [group('docs')] -[doc('Build the documentation')] docs: @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=true mkdocs build --strict +# Serve the documentation [group('docs')] -[doc('Serve the documentation')] serve: @ENABLED_GIT_REVISION_DATE=false MKDOCS_OFFLINE=false mkdocs serve -[doc('Remove all build artifacts')] +# Remove all build artifacts clean: @rm -rf \ debian/.debhelper debian/debhelper* debian/*.debhelper debian/{{pkgname}} \ {{pkgdest}}/{{pkgname}}* {{build}} coverage.out +# Build the package in a clean OCI container [group('packages')] -[doc('Build the package in a clean OCI container')] package dist: #!/usr/bin/env bash set -eu -o pipefail @@ -219,8 +219,8 @@ package dist: fi bash dists/docker.sh $dist $version +# Build the VM image [group('vm')] -[doc('Build the VM image')] img dist flavor: (package dist) @mkdir -p {{base_dir}} packer build -force \ @@ -237,8 +237,8 @@ img dist flavor: (package dist) -var output_dir={{output_dir}} \ tests/packer/ +# Create the machine [group('vm')] -[doc('Create the machine')] create dist flavor: @cp -f {{base_dir}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 {{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 @virt-install {{c}} \ @@ -257,53 +257,53 @@ create dist flavor: --sound model=ich9 \ --noautoconsole +# Start a machine [group('vm')] -[doc('Start a machine')] up dist flavor: @virsh {{c}} start {{prefix}}{{dist}}-{{flavor}} +# Stops the machine [group('vm')] -[doc('Stops the machine')] halt dist flavor: @virsh {{c}} shutdown {{prefix}}{{dist}}-{{flavor}} +# Reboot the machine [group('vm')] -[doc('Reboot the machine')] reboot dist flavor: @virsh {{c}} reboot {{prefix}}{{dist}}-{{flavor}} +# Destroy the machine [group('vm')] -[doc('Destroy the machine')] destroy dist flavor: @virsh {{c}} destroy {{prefix}}{{dist}}-{{flavor}} || true @virsh {{c}} undefine {{prefix}}{{dist}}-{{flavor}} --nvram @rm -fv {{vm}}/{{prefix}}{{dist}}-{{flavor}}.qcow2 +# Connect to the machine [group('vm')] -[doc('Connect to the machine')] ssh dist flavor: @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` +# Mount the shared directory on the machine [group('vm')] -[doc('Mount the shared directory on the machine')] mount dist flavor: @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ sh -c 'mount | grep 0a31bc478ef8e2461a4b1cc10a24cc4 || sudo mount 0a31bc478ef8e2461a4b1cc10a24cc4' +# Unmout the shared directory on the machine [group('vm')] -[doc('Unmout the shared directory on the machine')] umount dist flavor: @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ sh -c 'true; sudo umount /home/{{username}}/Projects/apparmor.d || true' +# List the machines [group('vm')] -[doc('List the machines')] list: @printf "{{BOLD}} %-4s %-22s %s{{NORMAL}}\n" "Id" "Distribution-Flavor" "State" @virsh {{c}} list --all | grep {{prefix}} | sed 's/{{prefix}}//g' +# List the VM images [group('vm')] -[doc('List the VM images')] images: #!/usr/bin/env bash set -eu -o pipefail @@ -320,8 +320,8 @@ images: } ' +# List the VM images that can be created [group('vm')] -[doc('List the VM images that can be created')] available: #!/usr/bin/env bash set -eu -o pipefail @@ -337,36 +337,36 @@ available: } ' +# Install dependencies for the integration tests [group('tests')] -[doc('Install dependencies for the integration tests')] init: @bash tests/requirements.sh +# Run the integration tests [group('tests')] -[doc('Run the integration tests')] integration name="": bats --recursive --timing --print-output-on-failure tests/integration/{{name}} +# Install dependencies for the integration tests (machine) [group('tests')] -[doc('Install dependencies for the integration tests (machine)')] tests-init dist flavor: @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ just --justfile /home/{{username}}/Projects/apparmor.d/Justfile init +# Synchronize the integration tests (machine) [group('tests')] -[doc('Synchronize the integration tests (machine)')] tests-sync dist flavor: @ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ rsync -a --delete /home/{{username}}/Projects/apparmor.d/tests/ /home/{{username}}/Projects/tests/ +# Re-synchronize the integration tests (machine) [group('tests')] -[doc('Re-synchronize the integration tests (machine)')] tests-resync dist flavor: (mount dist flavor) \ (tests-sync dist flavor) \ (umount dist flavor) +# Run the integration tests (machine) [group('tests')] -[doc('Run the integration tests (machine)')] tests-run dist flavor name="": (tests-resync dist flavor) ssh {{sshopt}} {{username}}@`just _get_ip {{dist}} {{flavor}}` \ bats --recursive --pretty --timing --print-output-on-failure \ From 7963479dbc944ea2fa18da16ad5a4224f73cc8fa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 13:21:34 +0200 Subject: [PATCH 1327/1455] build: various cleanup --- dists/build.sh | 2 +- dists/docker.sh | 4 ++-- dists/flags/main.flags | 4 ++-- dists/flags/ubuntu.flags | 1 + 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/dists/build.sh b/dists/build.sh index 9b9f9e765..e33c48695 100644 --- a/dists/build.sh +++ b/dists/build.sh @@ -16,7 +16,7 @@ readonly VERSION main() { case "$COMMAND" in pkg) - PKGDEST="$OUTPUT" makepkg --syncdeps --force --cleanbuild --noconfirm --noprogressbar + PKGDEST="$OUTPUT" BUILDDIR=/tmp/makepkg makepkg --syncdeps --force --cleanbuild --noconfirm --noprogressbar ;; dpkg) diff --git a/dists/docker.sh b/dists/docker.sh index 2e581883c..45191adb8 100644 --- a/dists/docker.sh +++ b/dists/docker.sh @@ -25,7 +25,7 @@ readonly VERSION PACKAGER _start() { local img="$1" - docker start "$img" + docker start "$img" || return 1 } _is_running() { @@ -65,7 +65,7 @@ build_in_docker_makepkg() { --env PKGDEST="$BUILDIR" --env PACKAGER="$PACKAGER" \ --env BUILDDIR=/tmp/build \ "$BASEIMAGE/$dist" - docker exec "$img" sudo pacman -Syu --noconfirm --noprogressbar + docker exec "$img" sudo pacman -Sy --noconfirm --noprogressbar fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh pkg diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 057c7c298..2c01d9553 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -230,7 +230,7 @@ lvmdump complain lvmpolld complain man complain mate-notification-daemon complain -mdadm complain +mdadm attach_disconnected,complain mdadm-mkconf complain ModemManager attach_disconnected,complain mount attach_disconnected,complain @@ -327,7 +327,7 @@ systemd-generator-ds-identify attach_disconnected,complain systemd-generator-environment-arch complain systemd-generator-environment-flatpak complain systemd-generator-environment-snapd attach_disconnected,complain -systemd-generator-friendly-recover attach_disconnected,complain +systemd-generator-friendly-recovery attach_disconnected,complain systemd-generator-fstab attach_disconnected,complain systemd-generator-getty attach_disconnected,complain systemd-generator-gpt-auto attach_disconnected,complain diff --git a/dists/flags/ubuntu.flags b/dists/flags/ubuntu.flags index 7339702a2..125575ce1 100644 --- a/dists/flags/ubuntu.flags +++ b/dists/flags/ubuntu.flags @@ -8,6 +8,7 @@ apt-helper complain check-new-release-gtk complain do-release-upgrade complain dpkg-genbuildinfo complain +esm_cache complain fanctl attach_disconnected,complain hwe-support-status complain list-oem-metapackages complain From d9df02f3f860f94d91d85862205adf872d75b9a7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 13:22:39 +0200 Subject: [PATCH 1328/1455] tests(packer): update opensuse images. --- tests/cloud-init/opensuse-gnome.user-data.yml | 18 ++++++- tests/cloud-init/opensuse-kde.user-data.yml | 14 ++++- .../cloud-init/opensuse-server.user-data.yml | 7 +++ tests/cloud-init/opensuse.yml | 54 +++++++++++++++++++ 4 files changed, 91 insertions(+), 2 deletions(-) diff --git a/tests/cloud-init/opensuse-gnome.user-data.yml b/tests/cloud-init/opensuse-gnome.user-data.yml index 3ab5a6c08..b59d66af3 100644 --- a/tests/cloud-init/opensuse-gnome.user-data.yml +++ b/tests/cloud-init/opensuse-gnome.user-data.yml @@ -1,6 +1,22 @@ #cloud-config -packages: *core-packages +packages: *gnome-packages + +runcmd: + # Replace SELinux by AppArmor in kernel parameters + - sed -i 's/security=selinux selinux=1/apparmor=1 apparmor.debug=1/g' /etc/default/grub + + # Regenerate grub.cfg + - grub2-mkconfig -o /boot/grub2/grub.cfg + + # Ensure auditd is enabled + - systemctl enable systemd-journald-audit.socket write_files: - *shared-directory # Setup shared directory + + - path: /etc/sysconfig/displaymanager + append: true + content: | + DISPLAYMANAGER="gdm" + diff --git a/tests/cloud-init/opensuse-kde.user-data.yml b/tests/cloud-init/opensuse-kde.user-data.yml index 3ab5a6c08..2058846dd 100644 --- a/tests/cloud-init/opensuse-kde.user-data.yml +++ b/tests/cloud-init/opensuse-kde.user-data.yml @@ -1,6 +1,18 @@ #cloud-config -packages: *core-packages +packages: *kde-packages + +# apparmor.debug=1 +runcmd: + # Replace SELinux by AppArmor in kernel parameters + - sed -i 's/security=selinux selinux=1/apparmor=1/g' /etc/default/grub + + # Regenerate grub.cfg + - grub2-mkconfig -o /boot/grub2/grub.cfg write_files: - *shared-directory # Setup shared directory + - path: /etc/sysconfig/displaymanager + append: true + content: | + DISPLAYMANAGER="sddm" diff --git a/tests/cloud-init/opensuse-server.user-data.yml b/tests/cloud-init/opensuse-server.user-data.yml index 98b78ec80..b6d35cd68 100644 --- a/tests/cloud-init/opensuse-server.user-data.yml +++ b/tests/cloud-init/opensuse-server.user-data.yml @@ -2,6 +2,13 @@ packages: *core-packages +runcmd: + # Replace SELinux by AppArmor in kernel parameters + - sed -i 's/security=selinux selinux=1/apparmor=1 apparmor.debug=1/g' /etc/default/grub + + # Regenerate grub.cfg + - grub2-mkconfig -o /boot/grub2/grub.cfg + write_files: - *shared-directory # Setup shared directory - *systemd-netword # Network configuration for server diff --git a/tests/cloud-init/opensuse.yml b/tests/cloud-init/opensuse.yml index 57c633678..ab0954c6a 100644 --- a/tests/cloud-init/opensuse.yml +++ b/tests/cloud-init/opensuse.yml @@ -2,9 +2,11 @@ # Core packages for OpenSUSE core-packages: &core-packages + - pattern:apparmor - apparmor-profiles - bash-completion - distribution-release + - docker - git - go - golang-packaging @@ -12,5 +14,57 @@ core-packages: &core-packages - just - rpmbuild - rsync + - systemd-container + - systemd-homed - vim +gnome-packages: &gnome-packages + # Core packages for OpenSUSE + - pattern:apparmor + - apparmor-profiles + - bash-completion + - distribution-release + - docker + - git + - go + - golang-packaging + - htop + - just + - rpmbuild + - rsync + - systemd-container + - systemd-homed + - vim + + # Gnome packages for OpenSUSE + - pattern:gnome + - gdm + - spice-vdagent + - terminator + - loupe + - ptyxis + +kde-packages: &kde-packages + # Core packages for OpenSUSE + - pattern:apparmor + - apparmor-profiles + - bash-completion + - distribution-release + - docker + - git + - go + - golang-packaging + - htop + - just + - rpmbuild + - rsync + - systemd-container + - systemd-homed + - vim + + # KDE packages for OpenSUSE + - pattern:kde_plasma + - pattern:kde + - sddm + - spice-vdagent + - terminator From 5795114328ad8952c826b8e82e475500d84eb94a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 13:23:49 +0200 Subject: [PATCH 1329/1455] tests(packer): success on cloud-init failure. --- tests/packer/builds.pkr.hcl | 4 ++-- tests/packer/clean.sh | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/tests/packer/builds.pkr.hcl b/tests/packer/builds.pkr.hcl index 48a5fafb6..98e923fd9 100644 --- a/tests/packer/builds.pkr.hcl +++ b/tests/packer/builds.pkr.hcl @@ -71,10 +71,10 @@ build { "while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for Cloud-Init...'; sleep 20; done", # Ensure cloud-init is successful - # "cloud-init status", + "cloud-init status || cloud-init collect-logs --tarfile /root/cloud-init.tar.gz", # Remove logs and artifacts so cloud-init can re-run - # "cloud-init clean", + "cloud-init clean || true", # Install local files and config "bash /tmp/init.sh", diff --git a/tests/packer/clean.sh b/tests/packer/clean.sh index f7518a2f6..23c587d4f 100644 --- a/tests/packer/clean.sh +++ b/tests/packer/clean.sh @@ -60,8 +60,7 @@ clean_pacman() { clean_zypper() { _msg "Cleaning zypper cache" - zypper update -y - zypper clean -y + zypper clean --all } # Make the image as impersonal as possible. From a0f1c55ab475a9c3f6d9ad26bf8d91b7d53036d2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 15:12:40 +0200 Subject: [PATCH 1330/1455] doc: update roadmap. --- docs/development/roadmap.md | 49 ++++++++++++++++++++++++++++--------- 1 file changed, 38 insertions(+), 11 deletions(-) diff --git a/docs/development/roadmap.md b/docs/development/roadmap.md index 2585208e5..379241a49 100644 --- a/docs/development/roadmap.md +++ b/docs/development/roadmap.md @@ -6,11 +6,18 @@ title: Roadmap This is the current list of features that must be implemented to get to a stable release -- [x] **Play machine** +- [x] **[Play machine](https://github.com/roddhjav/play)** -- [ ] **[Sub packages](https://github.com/roddhjav/apparmor.d/issues/464)** - - [x] Move most profiles into groups such that - - [ ] New simplified build system to generate the packages with profile dependencies check +- [ ] **[Sub packages](https://github.com/roddhjav/apparmor.d/issues/464)** + - [x] Move most profiles into groups + - [ ] Provide complain/enforced packages version + - [ ] normal/FSP/server packages variants + +- [ ] **Build system** + - [ ] Continuous release on the main branch, ~2 releases per week + - [ ] Provide packages repo for ubuntu/debian + - [x] Add a `just` target to install the profiles in the right place + - [x] Fully drop the Makefile in favor of `just` - [ ] **Tests** - [x] Tests VM for all supported targets (see [tests/vm](vm.md)) @@ -22,14 +29,26 @@ This is the current list of features that must be implemented to get to a stable - [ ] **General improvements** - [ ] Provide a proper fix for [#74](https://github.com/roddhjav/apparmor.d/issues/74), [#80](https://github.com/roddhjav/apparmor.d/issues/80) & [#235](https://github.com/roddhjav/apparmor.d/issues/235) - - [x] The apt/dpkg profiles needs to be reworked -- [ ] Build system - - [ ] Continuous release on the main branch, ~2 releases per week - - [ ] Provide packages repo for ubuntu/debian - - [ ] Provide complain/enforced packages version - - [x] Add a `just` target to install the profiles in the right place - - [x] Fully drop the Makefile in favor of `just` +- [ ] **Abstractions** + - [ ] Document all abstractions + - [ ] Split and reorganize some big abs into set of smaller abstractions. + Strictly follow the new abstractions guidelines (layer 0, layer 1, etc.) + - [ ] Abstraction based profiles: + Most of the accesses needed by GUI based application are commons. As such 80-90% of the profile content should be handled by abstractions (internally they will have conditions). + - [ ] Test new interface like abstractions + - notifications + - audio-bluetooth + - secrets-service + - media-keys + - ... + - [ ] Rewrite the desktop abstraction to only contains other abs. No direct rules in it. + - [ ] Rewrite the DE specific abstraction to be a layer 1 abs + +- [ ] **Security improvements** + - [ ] Limit the use of `abstractions/common/systemd` + - [ ] Ensure systemctl restart/stop/reload is always confined and filtered by unit (dbus only) + - [ ] Revisit the usae of `systemd-tty-ask-password-agent` ## Next features @@ -45,8 +64,16 @@ This is the current list of features that must be implemented to get to a stable - [ ] Debug tool to show the profiles transition tree, and ensure no profile is missing - [x] Remove the `default` profile +- [ ] **Define roles** + - [ ] Unrestricted shell role without FSP enabled + - [ ] Define the roles when FSP is enabled + ## Done +**General improvements** + +- [x] The apt/dpkg profiles has been rewritten + **Abstractions** - [x] New `audio-client` and `audio-server` abstractions From d86cf03dabfe1ba614341278ea42cb0a078df52e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 15:13:25 +0200 Subject: [PATCH 1331/1455] build(debian): post script must not fail. --- debian/apparmor.d.postinst | 2 +- debian/apparmor.d.postrm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/apparmor.d.postinst b/debian/apparmor.d.postinst index 361af7b91..840f3196b 100644 --- a/debian/apparmor.d.postinst +++ b/debian/apparmor.d.postinst @@ -8,6 +8,6 @@ set -e #DEBHELPER# apparmor_parser --purge-cache || true -deb-systemd-invoke reload apparmor.service +deb-systemd-invoke reload apparmor.service || true exit 0 diff --git a/debian/apparmor.d.postrm b/debian/apparmor.d.postrm index 361af7b91..840f3196b 100644 --- a/debian/apparmor.d.postrm +++ b/debian/apparmor.d.postrm @@ -8,6 +8,6 @@ set -e #DEBHELPER# apparmor_parser --purge-cache || true -deb-systemd-invoke reload apparmor.service +deb-systemd-invoke reload apparmor.service || true exit 0 From c7177eedde336a0bbef70e8fcc4413eaf07d88f1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 15:16:25 +0200 Subject: [PATCH 1332/1455] doc: update documentation. --- docs/development/abstractions.md | 9 +++++++++ docs/issues.md | 30 +++++++++++++----------------- 2 files changed, 22 insertions(+), 17 deletions(-) diff --git a/docs/development/abstractions.md b/docs/development/abstractions.md index f1ac6e18e..cd82f5d21 100644 --- a/docs/development/abstractions.md +++ b/docs/development/abstractions.md @@ -217,6 +217,14 @@ Minimal set of rules for sandboxed programs using `bwrap`. A profile using this A minimal set of rules for chromium based application. Handle access for internal sandbox. +It works as a *function* and requires some variables to be provided as *arguments* and set in the header of the calling profile: + +!!! note "" + + [apparmor.d/profile-s-z/spotify](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/steam/steam#L24-L25) + ``` sh linenums="24" + @{domain} = org.chromium.Chromium + ``` ### **`common/electron`** @@ -227,6 +235,7 @@ A minimal set of rules for all electron based UI applications. It works as a *fu [apparmor.d/profile-s-z/spotify](https://github.com/roddhjav/apparmor.d/blob/7d1380530aa56f31589ccc6a360a8144f3601731/apparmor.d/profiles-s-z/spotify#L10-L13) ``` sh linenums="10" @{name} = spotify + @{domain} = org.chromium.Chromium @{lib_dirs} = /opt/@{name} @{config_dirs} = @{user_config_dirs}/@{name} @{cache_dirs} = @{user_cache_dirs}/@{name} diff --git a/docs/issues.md b/docs/issues.md index 1db3b195a..2f38f4c5a 100644 --- a/docs/issues.md +++ b/docs/issues.md @@ -6,6 +6,19 @@ title: Known issues Known bugs are tracked on the meta issue **[#75](https://github.com/roddhjav/apparmor.d/issues/74)**. +## Ubuntu + +### Dbus + +Ubuntu fully supports dbus mediation with apparmor. If it is a value added by Ubuntu from other distributions, it can also lead to some breakage if you enforce some profiles. *Do not enforce the rules on Ubuntu Desktop.* + +Note: Ubuntu server has been more tested and will work without issues with enforced rules. + +### Snap + +Apparmor.d needs to be fully integrated with snap, otherwise your snap applications may not work properly. As of today, it is a work in progress. + + ## Complain mode A profile in *complain* mode cannot break the program it confines. However, there are some **major exceptions**: @@ -14,20 +27,3 @@ A profile in *complain* mode cannot break the program it confines. However, ther 2. `attach_disconnected` (and `mediate_deleted`) will break the program if they are required and missing in the profile, 3. If AppArmor does not find the profile to transition `rPx`. -## Pacman "could not get current working directory" - -```sh -$ sudo pacman -Syu -... -error: could not get current working directory -:: Processing package changes... -... -``` - -This is **a feature, not a bug!** It can safely be ignored. Pacman tries to get your current directory. You will only get this error when you run pacman in your home directory. - -According to the Arch Linux guideline, on Arch Linux, packages cannot install files under `/home/`. Therefore, the [`pacman`][pacman] profile purposely does not allow access of your home directory. - -This provides a basic protection against some packages (on the AUR) that may have rogue install script. - -[pacman]: https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/pacman/pacman From 470025c09025861a4fbee72a3f424ff7b0219044 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 19:39:18 +0200 Subject: [PATCH 1333/1455] build(debian): update list of profile to hide. Nb: we cannot use these profiles as they would break with apparmor.d profiles (they don't expect confined peer). --- pkg/prebuild/files.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/files.go b/pkg/prebuild/files.go index 504f05c1c..d9879570b 100644 --- a/pkg/prebuild/files.go +++ b/pkg/prebuild/files.go @@ -11,9 +11,12 @@ import ( ) // Hide is the default content of debian/apparmor.d.hide. Whonix has special addition. -var Hide = `# This file is generated by "make", all edit will be lost. +var Hide = `# This file is generated by "just", all edit will be lost. /etc/apparmor.d/usr.bin.firefox +/etc/apparmor.d/usr.bin.swtpm +/etc/apparmor.d/usr.bin.wsdd +/etc/apparmor.d/usr.libexec.geoclue /etc/apparmor.d/usr.sbin.cups-browsed /etc/apparmor.d/usr.sbin.cupsd /etc/apparmor.d/usr.sbin.rsyslogd From 2aead7e93b0dce022401c5f42b8eeb23cb3e01a9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 22:01:20 +0200 Subject: [PATCH 1334/1455] build(arch): initial pkbuild for splited packages. Note: it is not enabled yet. --- PKGBUILD | 111 ++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 102 insertions(+), 9 deletions(-) diff --git a/PKGBUILD b/PKGBUILD index dfbb46735..a68ba817d 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -3,8 +3,15 @@ # Warning: for development only, use https://aur.archlinux.org/packages/apparmor.d-git for production use. -pkgname=apparmor.d -pkgver=0.001 +pkgbase=apparmor.d +pkgname=( + apparmor.d + # apparmor.d.enforced + # apparmor.d.fsp apparmor.d.fsp.enforced + # apparmor.d.server apparmor.d.server.enforced + # apparmor.d.server.fsp apparmor.d.server.fsp.enforced +) +pkgver=0.0001 pkgrel=1 pkgdesc="Full set of apparmor profiles" arch=('x86_64' 'armv6h' 'armv7h' 'aarch64') @@ -12,10 +19,9 @@ url="https://github.com/roddhjav/apparmor.d" license=('GPL-2.0-only') depends=('apparmor>=4.1.0' 'apparmor<5.0.0') makedepends=('go' 'git' 'rsync' 'just') -conflicts=("$pkgname-git") pkgver() { - cd "$srcdir/$pkgname" + cd "$srcdir/$pkgbase" echo "0.$(git rev-list --count HEAD)" } @@ -24,17 +30,104 @@ prepare() { } build() { - cd "$srcdir/$pkgname" + cd "$srcdir/$pkgbase" export CGO_CPPFLAGS="${CPPFLAGS}" export CGO_CFLAGS="${CFLAGS}" export CGO_CXXFLAGS="${CXXFLAGS}" export CGO_LDFLAGS="${LDFLAGS}" + export GOPATH="${srcdir}" export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw" export DISTRIBUTION=arch - just complain + local -A modes=( + # Mapping of modes to just build target. + [default]=complain + # [enforced]=enforce + # [fsp]=fsp-complain + # [fsp.enforced]=fsp + # [server]=server-complain + # [server.enforced]=server + # [server.fsp]=server-fsp-complain + # [server.fsp.enforced]=server-fsp + ) + for mode in "${!modes[@]}"; do + just build=".build/$mode" "${modes[$mode]}" + done } -package() { - cd "$srcdir/$pkgname" - just destdir="$pkgdir" install +_conflicts() { + local mode="$1" + local pattern=".$mode" + if [[ "$mode" == "default" ]]; then + pattern="" + else + echo "$pkgbase" + fi + for pkg in "${pkgname[@]}"; do + if [[ "$pkg" == "${pkgbase}${pattern}" ]]; then + continue + fi + echo "$pkg" + done +} + +_install() { + local mode="${1:?}" + cd "$srcdir/$pkgbase" + just build=".build/$mode" destdir="$pkgdir" install +} + +package_apparmor.d() { + mode=default + pkgdesc="$pkgdesc (complain mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode +} + +package_apparmor.d.enforced() { + mode=enforced + pkgdesc="$pkgdesc (enforced mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode +} + +package_apparmor.d.fsp() { + mode="fsp" + pkgdesc="$pkgdesc (FSP mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode +} + +package_apparmor.d.fsp.enforced() { + mode="fsp.enforced" + pkgdesc="$pkgdesc (FSP enforced mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode +} + +package_apparmor.d.server() { + mode="server" + pkgdesc="$pkgdesc (server complain mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode +} + +package_apparmor.d.server.enforced() { + mode="server.enforced" + pkgdesc="$pkgdesc (server enforced mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode +} + +package_apparmor.d.server.fsp() { + mode="server.fsp" + pkgdesc="$pkgdesc (server FSP complain mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode +} + +package_apparmor.d.server.fsp.enforced() { + mode="server.fsp.enforced" + pkgdesc="$pkgdesc (server FSP enforced mode)" + mapfile -t conflicts < <(_conflicts $mode) + _install $mode } From ab7cba2da6e283f6f7e2eed1b746271b3bbda512 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 22:16:40 +0200 Subject: [PATCH 1335/1455] build: add early support for server version of the package. --- docs/development/build.md | 44 ++++++++++++++++++++++++++------------- pkg/prebuild/cli/cli.go | 27 +++++++++++++++++++++--- 2 files changed, 54 insertions(+), 17 deletions(-) diff --git a/docs/development/build.md b/docs/development/build.md index eaa2487a2..b767e4e4e 100644 --- a/docs/development/build.md +++ b/docs/development/build.md @@ -10,18 +10,22 @@ go run ./cmd/prebuild -h ``` ``` -aa-prebuild [-h] [--complain | --enforce] [--full] [--abi 3|4] +aa-prebuild [-h] [--complain | --enforce] [--full] [--server] [--abi 3|4] [--version V] [--file FILE] Prebuild apparmor.d profiles for a given distribution and apply internal built-in directives. Options: - -h, --help Show this help message and exit. - -c, --complain Set complain flag on all profiles. - -e, --enforce Set enforce flag on all profiles. - -a, --abi ABI Target apparmor ABI. - -f, --full Set AppArmor for full system policy. - -F, --file Only prebuild a given file. + -h, --help Show this help message and exit. + -c, --complain Set complain flag on all profiles. + -e, --enforce Set enforce flag on all profiles. + -a, --abi ABI Target apparmor ABI. + -v, --version V Target apparmor version. + -f, --full Set AppArmor for full system policy. + -s, --server Set AppArmor for server. + -b, --buildir DIR Root build directory. + -F, --file Only prebuild a given file. + --debug Enable debug mode. Prepare tasks: configure - Set distribution specificities @@ -31,21 +35,27 @@ Prepare tasks: overwrite - Overwrite dummy upstream profiles synchronise - Initialize a new clean apparmor.d build directory ignore - Ignore profiles and files from: + server - Configure AppArmor for server systemd-default - Configure systemd unit drop in files to a profile for some units systemd-early - Configure systemd unit drop in files to ensure some service start after apparmor + attach - Configure tunable for re-attached path Build tasks: - abi3 - Convert all profiles from abi 4.0 to abi 3.0 - attach - Re-attach disconnected path - complain - Set complain flag on all profiles - enforce - All profiles have been enforced - fsp - Prevent unconfined transitions in profile rules - hotfix - Temporary fix for #74, #80 & #235 - userspace - Resolve variable in profile attachments + userspace - Fix: resolve variable in profile attachments + abi3 - Build: convert all profiles from abi 4.0 to abi 3.0 + attach - Feat: re-attach disconnected path + base-strict - Feat: use 'base-strict' as base abstraction + complain - Build: set complain flag on all profiles + debug - Build: debug mode enabled + enforce - Build: all profiles have been enforced + fsp - Feat: prevent unconfined transitions in profile rules + hotfix - Fix: temporary solution for #74, #80 & #235 + stacked-dbus - Fix: resolve peer label variable in dbus rules Directive: #aa:dbus own bus= name= [interface=AARE] [path=AARE] #aa:dbus talk bus= name= label= [interface=AARE] [path=AARE] + #aa:dbus common bus= name= label= #aa:exec [P|U|p|u|PU|pu|] profiles... #aa:only filters... #aa:exclude filters... @@ -66,6 +76,12 @@ Ignore profiles and files as defined in the `dist/ignore` directory. See [workfl *Enabled by default. Can be disabled in `cmd/prebuild/main.go`* +### **`server`** + +Configure AppArmor for server. Desktop related groups and profiles that use desktop abstraction are not included. [hotfix](#hotfix) is also disabled, as it is only needed on desktop system. It is mostly intended to be used on server with FSP enabled. E.g: [the play machine](https://github.com/roddhjav/play). + +*Enable with the `--server` option in the prebuild command.* + ### **`merge`** Merge profiles from `apparmor.d/group/`, `apparmor.d/profiles-*-*/` to a unified directory in `.build/apparmor.d` that AppArmor can parse. diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 8abfb4323..981331edd 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -7,6 +7,8 @@ package cli import ( "flag" "fmt" + "os" + "slices" "strings" "github.com/roddhjav/apparmor.d/pkg/logging" @@ -20,7 +22,7 @@ import ( const ( nilABI = 0 nilVer = 0.0 - usage = `aa-prebuild [-h] [--complain | --enforce] [--full] [--abi 3|4] [--version V] [--file FILE] + usage = `aa-prebuild [-h] [--complain | --enforce] [--full] [--server] [--abi 3|4] [--version V] [--file FILE] Prebuild apparmor.d profiles for a given distribution and apply internal built-in directives. @@ -32,7 +34,8 @@ Options: -a, --abi ABI Target apparmor ABI. -v, --version V Target apparmor version. -f, --full Set AppArmor for full system policy. - -b, --buildir DIR Root build directory. + -s, --server Set AppArmor for server. + -b, --buildir DIR Root build directory. -F, --file Only prebuild a given file. --debug Enable debug mode. ` @@ -43,6 +46,7 @@ var ( complain bool enforce bool full bool + server bool debug bool abi int version float64 @@ -55,6 +59,8 @@ func init() { flag.BoolVar(&help, "help", false, "Show this help message and exit.") flag.BoolVar(&full, "f", false, "Set AppArmor for full system policy.") flag.BoolVar(&full, "full", false, "Set AppArmor for full system policy.") + flag.BoolVar(&server, "s", false, "Set AppArmor for server.") + flag.BoolVar(&server, "server", false, "Set AppArmor for server.") flag.BoolVar(&complain, "c", false, "Set complain flag on all profiles.") flag.BoolVar(&complain, "complain", false, "Set complain flag on all profiles.") flag.BoolVar(&enforce, "e", false, "Set enforce flag on all profiles.") @@ -81,7 +87,22 @@ func Configure() { flag.Parse() if help { flag.Usage() - return + os.Exit(0) + } + + if server { + idx := slices.Index(prepare.Prepares, prepare.Tasks["merge"]) + if idx == -1 { + prepare.Register("server") + } else { + prepare.Prepares = slices.Insert(prepare.Prepares, idx, prepare.Tasks["server"]) + } + + // Remove hotfix task as it is not needed on server + idx = slices.Index(prepare.Prepares, prepare.Tasks["hotfix"]) + if idx != -1 { + prepare.Prepares = slices.Delete(prepare.Prepares, idx, idx+1) + } } if full && paths.New("apparmor.d/groups/_full").Exist() { From ec88fcbfcb2a928bb543bdc0497946ff6fe840cc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 23:18:31 +0200 Subject: [PATCH 1336/1455] feat(abs): add the camera abstraction --- apparmor.d/abstractions/app/chromium | 2 +- apparmor.d/abstractions/camera | 35 +++++++++++++++++++ apparmor.d/abstractions/common/app | 2 +- apparmor.d/groups/browsers/epiphany | 3 +- apparmor.d/groups/freedesktop/pipewire | 2 +- .../groups/freedesktop/pipewire-media-session | 2 +- apparmor.d/groups/freedesktop/pulseaudio | 3 +- apparmor.d/groups/freedesktop/wireplumber | 3 +- apparmor.d/profiles-s-z/signal-desktop | 1 + apparmor.d/profiles-s-z/vlc | 2 +- 10 files changed, 44 insertions(+), 11 deletions(-) create mode 100644 apparmor.d/abstractions/camera diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index f08a096ca..725b57fca 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -30,6 +30,7 @@ include include include + include include include include @@ -44,7 +45,6 @@ include include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/abstractions/camera b/apparmor.d/abstractions/camera new file mode 100644 index 000000000..0f5cff363 --- /dev/null +++ b/apparmor.d/abstractions/camera @@ -0,0 +1,35 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allows access to all cameras + + abi , + + # Allow detection of cameras. Leaks plugged in USB device info + @{sys}/bus/usb/devices/ r, + @{sys}/devices/@{pci}/usb@{int}/**/busnum r, + @{sys}/devices/@{pci}/usb@{int}/**/devnum r, + @{sys}/devices/@{pci}/usb@{int}/**/idProduct r, + @{sys}/devices/@{pci}/usb@{int}/**/idVendor r, + @{sys}/devices/@{pci}/usb@{int}/**/interface r, + @{sys}/devices/@{pci}/usb@{int}/**/modalias r, + @{sys}/devices/@{pci}/usb@{int}/**/speed r, + + @{sys}/class/video4linux/ r, + @{sys}/devices/**/video4linux/** r, + @{sys}/devices/**/video4linux/video@{int}/ r, + @{sys}/devices/**/video4linux/video@{int}/uevent r, + + @{run}/udev/data/+usb:* r, # Identifies all USB devices + @{run}/udev/data/c81:@{int} r, # For video4linux + + # VideoCore cameras (shared device with VideoCore/EGL) + /dev/vchiq rw, + + # Access to video /dev devices + /dev/video@{int} rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 5072cadfd..d0b36188b 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -16,6 +16,7 @@ include include include + include include include include @@ -30,7 +31,6 @@ include include include - include dbus bus=accessibility, dbus bus=session, diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany index 86b293e8d..45a32868e 100644 --- a/apparmor.d/groups/browsers/epiphany +++ b/apparmor.d/groups/browsers/epiphany @@ -12,6 +12,7 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -61,8 +62,6 @@ profile epiphany @{exec_path} flags=(attach_disconnected) { deny @{user_share_dirs}/gvfs-metadata/* r, - /dev/video@{int} rw, - include if exists } diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index 02a370cdc..c8c89ac13 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -14,8 +14,8 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { include include include + include include - include capability sys_ptrace, diff --git a/apparmor.d/groups/freedesktop/pipewire-media-session b/apparmor.d/groups/freedesktop/pipewire-media-session index af6f30e9c..83ee32baa 100644 --- a/apparmor.d/groups/freedesktop/pipewire-media-session +++ b/apparmor.d/groups/freedesktop/pipewire-media-session @@ -14,9 +14,9 @@ profile pipewire-media-session @{exec_path} { include include include + include include include - include network bluetooth raw, network bluetooth seqpacket, diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 05e4c3ec2..28d8b9d31 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -18,6 +18,7 @@ profile pulseaudio @{exec_path} { include include include + include include include include @@ -105,7 +106,6 @@ profile pulseaudio @{exec_path} { @{sys}/devices/**/sound/**/{uevent,pcm_class} r, @{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r, - @{sys}/devices/virtual/video4linux/video@{int}/uevent r, deny @{sys}/module/apparmor/parameters/enabled r, @@ -114,7 +114,6 @@ profile pulseaudio @{exec_path} { owner @{PROC}/@{pids}/cmdline r, /dev/media@{int} r, - /dev/video@{int} rw, # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index aefdc339d..708e5a6e8 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -16,9 +16,9 @@ profile wireplumber @{exec_path} { include include include + include include include - include network bluetooth raw, network bluetooth seqpacket, @@ -71,7 +71,6 @@ profile wireplumber @{exec_path} { @{sys}/bus/ r, @{sys}/bus/media/devices/ r, - @{sys}/devices/@{pci}/video4linux/video@{int}/uevent r, @{sys}/devices/**/device:*/{,**/}path r, @{sys}/devices/**/sound/**/pcm_class r, @{sys}/devices/**/sound/**/uevent r, diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index 001f8605a..4abe053f6 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -19,6 +19,7 @@ profile signal-desktop @{exec_path} flags=(attach_disconnected) { include include include + include include include include diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index ccf1abb61..3a3a77313 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -17,6 +17,7 @@ profile vlc @{exec_path} { include include include + include include include include @@ -85,7 +86,6 @@ profile vlc @{exec_path} { /dev/shm/#@{int} rw, /dev/snd/ r, /dev/tty r, - /dev/video@{int} rw, owner /dev/tty@{int} rw, # Silencer From c2ecc756b2e424926b7d0ac79b99b8f20c911de2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 23:30:52 +0200 Subject: [PATCH 1337/1455] feat(abs): add the media-control abstraction --- apparmor.d/abstractions/media-control | 20 +++++++++++++++++++ apparmor.d/groups/freedesktop/pipewire | 3 +-- apparmor.d/groups/freedesktop/pulseaudio | 3 +-- apparmor.d/groups/freedesktop/wireplumber | 3 +-- apparmor.d/groups/gnome/gnome-boxes | 5 ++--- apparmor.d/groups/gnome/gnome-control-center | 4 ++-- apparmor.d/groups/gnome/gnome-shell | 5 ++--- apparmor.d/groups/gnome/localsearch | 3 --- .../groups/gnome/org.gnome.NautilusPreviewer | 5 ++--- apparmor.d/profiles-a-f/cheese | 5 ++--- apparmor.d/profiles-s-z/v4l2-ctl | 6 ++---- apparmor.d/profiles-s-z/virt-manager | 5 ++--- 12 files changed, 37 insertions(+), 30 deletions(-) create mode 100644 apparmor.d/abstractions/media-control diff --git a/apparmor.d/abstractions/media-control b/apparmor.d/abstractions/media-control new file mode 100644 index 000000000..1cdcf66f2 --- /dev/null +++ b/apparmor.d/abstractions/media-control @@ -0,0 +1,20 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Canonical Ltd +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allows access to media controller such as microphones, and video capture hardware. +# See: https://www.kernel.org/doc/Documentation/userspace-api/media/mediactl/media-controller-intro.rst + + abi , + + # Control of media devices + /dev/media@{int} rwk, + + # Access to V4L subnodes configuration + # See https://www.kernel.org/doc/html/v4.12/media/uapi/v4l/dev-subdev.html + /dev/v4l-subdev@{int} rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index c8c89ac13..04b08ecc4 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -15,6 +15,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { include include include + include include capability sys_ptrace, @@ -66,8 +67,6 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/attr/apparmor/current r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/media@{int} rw, - include if exists } diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 28d8b9d31..5c7c49c3d 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -26,6 +26,7 @@ profile pulseaudio @{exec_path} { include include include + include include ptrace (trace) peer=@{profile_name}, @@ -113,8 +114,6 @@ profile pulseaudio @{exec_path} { owner @{PROC}/@{pids}/stat r, owner @{PROC}/@{pids}/cmdline r, - /dev/media@{int} r, - # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index 708e5a6e8..aa78d9667 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -18,6 +18,7 @@ profile wireplumber @{exec_path} { include include include + include include network bluetooth raw, @@ -65,7 +66,6 @@ profile wireplumber @{exec_path} { @{run}/systemd/users/@{uid} r, @{run}/udev/data/c14:@{int} r, # Open Sound System (OSS) - @{run}/udev/data/c81:@{int} r, # For video4linux @{run}/udev/data/c116:@{int} r, # For ALSA @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @@ -86,7 +86,6 @@ profile wireplumber @{exec_path} { owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/media@{int} rw, /dev/udmabuf rw, include if exists diff --git a/apparmor.d/groups/gnome/gnome-boxes b/apparmor.d/groups/gnome/gnome-boxes index 1447715b7..cd46dd069 100644 --- a/apparmor.d/groups/gnome/gnome-boxes +++ b/apparmor.d/groups/gnome/gnome-boxes @@ -13,10 +13,12 @@ profile gnome-boxes @{exec_path} { include include include + include include include include include + include include include include @@ -80,9 +82,6 @@ profile gnome-boxes @{exec_path} { owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/stat r, - /dev/media@{int} rw, - /dev/video@{int} rw, - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, profile virsh { diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 111facf64..10f310232 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -17,11 +17,13 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { include include include + include include include include include include + include include include include @@ -191,8 +193,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/task/*/comm rw, /dev/ r, - /dev/media@{int} r, - /dev/video@{int} rw, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 0876b90d1..7344b735b 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -32,18 +32,19 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include include include include include + include include include include include include - include capability sys_nice, capability sys_ptrace, @@ -321,7 +322,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{run}/udev/data/+acpi:* r, # Exposes ACPI objects (power buttons, batteries, thermal) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+sound:card@{int} r, # for sound card - @{run}/udev/data/+usb:* r, # Identifies all USB devices @{run}/udev/data/+i2c:* r, # For Inter-Integrated Circuit, low-speed peripherals (sensors, EEPROMs, etc.) @{run}/udev/data/+hid:* r, # For Human Interface Device (mice, controllers, drawing tablets, scanners) @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features @@ -379,7 +379,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/stat r, - /dev/media@{int} rw, /dev/tty@{int} rw, @{att}/dev/dri/card@{int} rw, @{att}/dev/input/event@{int} rw, diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch index 049b3c402..d5700db7c 100644 --- a/apparmor.d/groups/gnome/localsearch +++ b/apparmor.d/groups/gnome/localsearch @@ -68,9 +68,6 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/media@{int} rw, - /dev/video@{int} rw, - include if exists } diff --git a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer index f084e7b12..e1bde2238 100644 --- a/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer +++ b/apparmor.d/groups/gnome/org.gnome.NautilusPreviewer @@ -10,14 +10,15 @@ include profile org.gnome.NautilusPreviewer @{exec_path} flags=(attach_disconnected) { include include + include include include include include include + include include include - include network netlink raw, @@ -52,8 +53,6 @@ profile org.gnome.NautilusPreviewer @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/task/@{tid}/comm w, owner @{PROC}/@{pid}/task/@{tid}/stat r, - /dev/media@{int} r, - include if exists } diff --git a/apparmor.d/profiles-a-f/cheese b/apparmor.d/profiles-a-f/cheese index b89fa42f2..33b933be2 100644 --- a/apparmor.d/profiles-a-f/cheese +++ b/apparmor.d/profiles-a-f/cheese @@ -11,10 +11,12 @@ include profile cheese @{exec_path} { include include + include include include include include + include include include @@ -49,9 +51,6 @@ profile cheese @{exec_path} { owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/media@{int} rw, - /dev/video@{int} rw, - include if exists } diff --git a/apparmor.d/profiles-s-z/v4l2-ctl b/apparmor.d/profiles-s-z/v4l2-ctl index e398049de..ddb86b9a2 100644 --- a/apparmor.d/profiles-s-z/v4l2-ctl +++ b/apparmor.d/profiles-s-z/v4l2-ctl @@ -9,14 +9,12 @@ include @{exec_path} = @{bin}/v4l2-ctl profile v4l2-ctl @{exec_path} { include + include include - include + include @{exec_path} mr, - /dev/media@{int} rw, - /dev/video@{int} rw, - include if exists } diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index 8a1b5f355..f820d2953 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -16,12 +16,14 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { include include include + include include include include include include include + include include include include @@ -101,9 +103,6 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/stat r, - /dev/media@{int} r, - /dev/video@{int} rw, - # Silence the noise deny /usr/share/virt-manager/{,**} w, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, From 5484f84764d2f1bc9c5ccf28494fdec5ada382aa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 23:32:06 +0200 Subject: [PATCH 1338/1455] tests(build): add tests for the stacked-dbus build task. --- pkg/prebuild/builder/core_test.go | 24 ++++++++++++++++++++++++ pkg/prebuild/builder/stacked-dbus.go | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/builder/core_test.go b/pkg/prebuild/builder/core_test.go index 06ceb1d28..c6c493472 100644 --- a/pkg/prebuild/builder/core_test.go +++ b/pkg/prebuild/builder/core_test.go @@ -231,6 +231,30 @@ func TestBuilder_Apply(t *testing.T) { want: "", wantErr: true, }, + { + name: "stacked-dbus-1", + b: Builders["stacked-dbus"], + profile: ` +profile foo { + dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + +}`, + want: ` +profile foo { +dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus, label=dbus-session), +dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus, label=dbus-session//&unconfined), + +}`, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/pkg/prebuild/builder/stacked-dbus.go b/pkg/prebuild/builder/stacked-dbus.go index e33ecf4b7..eca8122c6 100644 --- a/pkg/prebuild/builder/stacked-dbus.go +++ b/pkg/prebuild/builder/stacked-dbus.go @@ -72,7 +72,7 @@ func (b StackedDbus) Apply(opt *Option, profile string) (string, error) { toResolve = append(toResolve, k) } - rulesByParagraph, paragraphs, err := parse(kind, profile) // + rulesByParagraph, paragraphs, err := parse(kind, profile) if err != nil { return "", err } From 64d71ffb6e762b5ba51302087731bbeb8577631d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 23:45:08 +0200 Subject: [PATCH 1339/1455] build: attach: ensure we don't recursivelly call ourself. --- pkg/prebuild/builder/attach.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/builder/attach.go b/pkg/prebuild/builder/attach.go index 66ef18aef..1ec5e06b1 100644 --- a/pkg/prebuild/builder/attach.go +++ b/pkg/prebuild/builder/attach.go @@ -31,6 +31,9 @@ func init() { func (b ReAttach) Apply(opt *Option, profile string) (string, error) { var insert string var origin = "profile " + opt.Name + if opt.File.HasSuffix("attached/base") { + return profile, nil // Do not re-attach twice + } if strings.Contains(profile, "attach_disconnected") { insert = "@{att} = /att/" + opt.Name + "/\n" @@ -42,13 +45,17 @@ func (b ReAttach) Apply(opt *Option, profile string) (string, error) { "include ", "include ", ) + profile = strings.ReplaceAll(profile, + "include ", + "include ", + ) profile = strings.ReplaceAll(profile, "include ", "include ", ) } else { - insert = "@{att} = /\n" + insert = "@{att} = \"\"\n" } From 8c33125b5ec251c6c8996ea23f24c5380c597a8c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 23:46:12 +0200 Subject: [PATCH 1340/1455] build: add missing server build task. --- pkg/prebuild/prepare/server.go | 105 +++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 pkg/prebuild/prepare/server.go diff --git a/pkg/prebuild/prepare/server.go b/pkg/prebuild/prepare/server.go new file mode 100644 index 000000000..85f98e75d --- /dev/null +++ b/pkg/prebuild/prepare/server.go @@ -0,0 +1,105 @@ +// apparmor.d - Full set of apparmor profiles +// Copyright (C) 2021-2024 Alexandre Pujol +// SPDX-License-Identifier: GPL-2.0-only + +package prepare + +import ( + "fmt" + "strings" + + "github.com/roddhjav/apparmor.d/pkg/paths" + "github.com/roddhjav/apparmor.d/pkg/prebuild" +) + +var ( + serverIgnorePatterns = []string{ + "include ", + "include ", + "include ", + "include ", + "include ", + "include ", + "include ", + "include ", + "include ", + "include ", + "include ", + } + serverIgnoreGroups = []string{ + "akonadi", + "avahi", + "bluetooth", + "browsers", + "cosmic", + "cups", + "display-manager", + "flatpak", + "freedesktop", + "gnome", + "gvfs", + "hyprland", + "kde", + "lxqt", + "steam", + "xfce", + "zed", + } +) + +type Server struct { + prebuild.Base +} + +func init() { + RegisterTask(&Server{ + Base: prebuild.Base{ + Keyword: "server", + Msg: "Configure AppArmor for server", + }, + }) +} + +func (p Server) Apply() ([]string, error) { + res := []string{} + + // Ignore desktop related groups + groupNb := 0 + for _, group := range serverIgnoreGroups { + path := prebuild.RootApparmord.Join("groups", group) + if path.IsDir() { + if err := path.RemoveAll(); err != nil { + return res, err + } + groupNb++ + } else { + res = append(res, fmt.Sprintf("Group %s not found, ignoring", path)) + } + } + + // Ignore profiles using a desktop related abstraction + fileNb := 0 + files, _ := prebuild.RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories()) + for _, file := range files { + if !file.Exist() { + continue + } + profile, err := file.ReadFileAsString() + if err != nil { + return res, err + } + for _, pattern := range serverIgnorePatterns { + if strings.Contains(profile, pattern) { + if err := file.RemoveAll(); err != nil { + return res, err + } + fileNb++ + break + } + } + } + + res = append(res, fmt.Sprintf("%d groups ignored", groupNb)) + res = append(res, fmt.Sprintf("%d profiles ignored", fileNb)) + return res, nil +} From e2f11d46b0a81322bfef9394d440a30edfc67958 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 23:48:59 +0200 Subject: [PATCH 1341/1455] tests(check): make the script configurable. Such that it can be used in downstream project with different folder structure. --- tests/check.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 60e23c694..861ca84fa 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -11,9 +11,11 @@ set -eu -o pipefail RES=$(mktemp) echo "false" >"$RES" MAX_JOBS=$(nproc) +APPARMORD=${CHECK_APPARMORD:-apparmor.d} +SBIN_LIST=${CHECK_SBIN_LIST:-tests/sbin.list} declare WITH_CHECK declare _check_is_disabled -readonly RES MAX_JOBS APPARMORD="apparmor.d" +readonly APPARMORD SBIN_LIST RES MAX_JOBS readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m" _msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; } _warn() { @@ -500,14 +502,14 @@ _check_udev() { check_sbin() { local file name jobs - mapfile -t sbin Date: Sat, 6 Sep 2025 23:51:12 +0200 Subject: [PATCH 1342/1455] tests(check): add support for global exclusion. --- tests/check.sh | 42 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 34 insertions(+), 8 deletions(-) diff --git a/tests/check.sh b/tests/check.sh index 861ca84fa..5b35f8816 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -15,6 +15,8 @@ APPARMORD=${CHECK_APPARMORD:-apparmor.d} SBIN_LIST=${CHECK_SBIN_LIST:-tests/sbin.list} declare WITH_CHECK declare _check_is_disabled +declare _check_is_disabled_global +_FILE_IGNORE_ALL=false readonly APPARMORD SBIN_LIST RES MAX_JOBS readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m" _msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; } @@ -44,6 +46,11 @@ _in_array() { _is_enabled() { local check="$1" if _in_array "$check" "${WITH_CHECK[@]}"; then + if [[ -n "${_check_is_disabled_global+x}" && ${#_check_is_disabled_global[@]} -gt 0 ]]; then + if _in_array "$check" "${_check_is_disabled_global[@]}"; then + return 1 + fi + fi if [[ -z "${_check_is_disabled+x}" || ${#_check_is_disabled[@]} -eq 0 ]]; then return 0 fi @@ -70,10 +77,18 @@ _ignore_lint() { local checks line="$1" if [[ "$line" =~ ^[[:space:]]*$_IGNORE_LINT=.*$ ]]; then - # Start of an ignore block - _IGNORE_LINT_BLOCK=true + # Start of an ignore block (or file-wide if in header) checks="${line#*"$_IGNORE_LINT="}" - read -ra _check_is_disabled <<<"${checks//,/ }" + read -ra _parsed <<<"${checks//,/ }" + if (( line_number <= 10 )); then + # Treat as file-wide ignore + _check_is_disabled_global=("${_parsed[@]}") + _FILE_IGNORE_ALL=true + _IGNORE_LINT_BLOCK=false + return 0 + fi + _IGNORE_LINT_BLOCK=true + _check_is_disabled=("${_parsed[@]}") elif [[ $_IGNORE_LINT_BLOCK == true && "$line" =~ ^[[:space:]]*$ ]]; then # New paragraph, end of block @@ -81,22 +96,33 @@ _ignore_lint() { _check_is_disabled=() elif [[ $_IGNORE_LINT_BLOCK == true ]]; then - # Nothing to do, we are in a block + # Nothing to do, we are in a block/paragraph return 0 elif [[ "$line" == *"$_IGNORE_LINT="* ]]; then - # Inline ignore + # Inline ignore (or file-wide if in header) checks="${line#*"$_IGNORE_LINT="}" - read -ra _check_is_disabled <<<"${checks//,/ }" + read -ra _parsed <<<"${checks//,/ }" + if (( line_number <= 10 )); then + _check_is_disabled_global=("${_parsed[@]}") + _FILE_IGNORE_ALL=true + return 0 + fi + _check_is_disabled=("${_parsed[@]}") else - _check_is_disabled=() + # Do not clear if file-wide ignore is set + if ! $_FILE_IGNORE_ALL; then + _check_is_disabled=() + fi fi } _check() { local file="$1" - local line_number=0 + line_number=0 + _FILE_IGNORE_ALL=false + _check_is_disabled_global=() while IFS= read -r line; do line_number=$((line_number + 1)) From c239203e724df124cd0c0e4a35794e661a84b065 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 6 Sep 2025 23:55:42 +0200 Subject: [PATCH 1343/1455] feat(abs): add the tpm abstraction. --- apparmor.d/abstractions/tpm | 16 ++++++++++++++++ apparmor.d/profiles-a-f/fwupd | 3 +-- apparmor.d/profiles-s-z/sbctl | 4 +--- 3 files changed, 18 insertions(+), 5 deletions(-) create mode 100644 apparmor.d/abstractions/tpm diff --git a/apparmor.d/abstractions/tpm b/apparmor.d/abstractions/tpm new file mode 100644 index 000000000..ef7b30a2b --- /dev/null +++ b/apparmor.d/abstractions/tpm @@ -0,0 +1,16 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2016-2017 Canonical Ltd +# Copyright (C) 2021-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Communication to the system TPM chip over /dev/tpm@{int} and kernel TPM +# resource manager /dev/tpmrm@{int} + + abi , + + /dev/tpm@{int} rw, + /dev/tpmrm@{int} rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index d7a72c236..8447bff3e 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -20,6 +20,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { include include include + include capability dac_override, capability dac_read_search, @@ -133,8 +134,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) { /dev/mei@{int} rw, /dev/mem r, /dev/mtd@{int} rw, - /dev/tpm@{int} rw, - /dev/tpmrm@{int} rw, /dev/wmi/* r, profile gpg flags=(attach_disconnected,complain) { diff --git a/apparmor.d/profiles-s-z/sbctl b/apparmor.d/profiles-s-z/sbctl index ef007a32c..a4fdbac88 100644 --- a/apparmor.d/profiles-s-z/sbctl +++ b/apparmor.d/profiles-s-z/sbctl @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/sbctl profile sbctl @{exec_path} { include + include capability dac_read_search, capability linux_immutable, @@ -34,9 +35,6 @@ profile sbctl @{exec_path} { @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r, @{sys}/firmware/efi/efivars/SetupMode-@{uuid} r, - /dev/pts/@{int} rw, - /dev/tpmrm@{int} rw, - # File Inherit deny network inet stream, deny network inet6 stream, From 2efdd6f5274af00e48adc4da0ab77e03805191f4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 19:43:44 +0200 Subject: [PATCH 1344/1455] feat(profile): improve ufw-init fix #843 --- apparmor.d/groups/firewall/ufw-init | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/firewall/ufw-init b/apparmor.d/groups/firewall/ufw-init index aae80b87d..fcb9d8b6c 100644 --- a/apparmor.d/groups/firewall/ufw-init +++ b/apparmor.d/groups/firewall/ufw-init @@ -11,8 +11,10 @@ profile ufw-init @{exec_path} { include include + capability dac_override, capability dac_read_search, capability net_admin, + capability net_raw, network inet dgram, network inet raw, @@ -27,12 +29,29 @@ profile ufw-init @{exec_path} { @{sbin}/sysctl rCx -> sysctl, @{sbin}/xtables-legacy-multi rix, @{sbin}/xtables-nft-multi rix, + @{bin}/kmod rCx -> kmod, /etc/default/ufw r, /etc/ufw/* r, + @{run}/xtables.lock rwk, + @{PROC}/@{pid}/net/ip_tables_names r, - # @{PROC}/sys/net/ipv{4,6}/** rw, + @{PROC}/sys/kernel/modprobe r, + + profile kmod { + include + include + + capability sys_module, + + @{run}/xtables.lock r, + + @{sys}/module/compression r, + @{sys}/module/x_tables/initstate r, + + include if exists + } profile sysctl { include From 1defbbc416b3fcb74acc8a35707c3c6c1a68ae49 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 19:47:24 +0200 Subject: [PATCH 1345/1455] fix(abs): tmp path for wine tmp data. fix #836 --- apparmor.d/abstractions/wine | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/wine b/apparmor.d/abstractions/wine index 28d15cf76..145cd763a 100644 --- a/apparmor.d/abstractions/wine +++ b/apparmor.d/abstractions/wine @@ -9,9 +9,9 @@ owner @{user_share_dirs}/applications/wine/ rw, owner @{user_share_dirs}/applications/wine/**/ rw, - owner @{tmp}/.wine-@{uid}/ rw, - owner @{tmp}/.wine-@{uid}/** rwk, - owner @{tmp}/.wine-@{uid}/server-fd@{int2}-@{hex}/tmpmap-@{hex8} m, + owner @{att}/@{tmp}/.wine-@{uid}/ rw, + owner @{att}/@{tmp}/.wine-@{uid}/** rwk, + owner @{att}/@{tmp}/.wine-@{uid}/server-fd@{int2}-@{hex}/tmpmap-@{hex8} m, owner /dev/shm/wine-@{hex6}-fsync rw, owner /dev/shm/wine-@{hex6}@{h}-fsync rw, From 06d476ccaa5eca22a6c70f1d39c13f8d061b6590 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 19:48:54 +0200 Subject: [PATCH 1346/1455] fix(profile): att on logind fix #833 --- apparmor.d/groups/systemd/systemd-logind | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 271354633..05c812b18 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -136,7 +136,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{PROC}/sysvipc/{shm,sem,msg} r, owner @{PROC}/@{pid}/fdinfo/@{int} r, - /dev/dri/card@{int} rw, + @{att}/dev/dri/card@{int} rw, /dev/input/event@{int} rw, # Input devices (keyboard, mouse, etc) /dev/mqueue/ r, /dev/tty@{int} rw, From 4771e56d88d2e30032cb2de3e71247eee3210ddd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 19:49:59 +0200 Subject: [PATCH 1347/1455] feat(profile): git: allow transition to github cli. fix #829 --- apparmor.d/profiles-g-l/git | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 0538f5da0..01b491b98 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -65,6 +65,7 @@ profile git @{exec_path} flags=(attach_disconnected) { @{pager_path} rPx -> child-pager, + @{bin}/gh rPUx, @{bin}/man rPx, @{bin}/meld rPUx, @{lib}/code/extensions/git/dist/askpass.sh rPx, From 5fe9e0ee9e88984b01006fd797e1a386ade091bd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 19:52:40 +0200 Subject: [PATCH 1348/1455] feat(profile): support for Tumbleweed gs path. see #828 --- apparmor.d/groups/cups/cupsd | 2 +- apparmor.d/groups/kde/kioworker | 2 +- tests/check.sh | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index acae9b7a1..642d7ef5c 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -62,7 +62,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { @{bin}/chmod rix, @{bin}/cp rix, @{bin}/{,e}grep rix, - @{bin}/gs rix, + @{bin}/gs{,.bin} rix, @{bin}/gsc rix, @{bin}/hostname rix, @{bin}/ippfind rix, diff --git a/apparmor.d/groups/kde/kioworker b/apparmor.d/groups/kde/kioworker index 71465df97..0fc81a764 100644 --- a/apparmor.d/groups/kde/kioworker +++ b/apparmor.d/groups/kde/kioworker @@ -41,7 +41,7 @@ profile kioworker @{exec_path} { @{lib}/libheif/*.so* rm, @{bin}/wrestool rPUx, - @{bin}/gs rix, + @{bin}/gs{,.bin} rix, #aa:exec kio_http_cache_cleaner diff --git a/tests/check.sh b/tests/check.sh index 5b35f8816..b54bc157a 100644 --- a/tests/check.sh +++ b/tests/check.sh @@ -221,6 +221,7 @@ declare -A EQUIVALENTS=( ["awk"]="{m,g,}awk" ["gawk"]="{m,g,}awk" ["grep"]="{,e}grep" + ["gs"]="gs{,.bin}" ["which"]="which{,.debianutils}" ) _check_equivalent() { From a87449268b227f1242445a9d66f52b62279dac94 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 20:05:19 +0200 Subject: [PATCH 1349/1455] feat(profile): various improvement for Tumbleweed fix #828 --- apparmor.d/abstractions/kde-strict | 2 +- apparmor.d/groups/kde/dolphin | 9 +++++++-- apparmor.d/groups/kde/kwin_x11 | 1 + apparmor.d/groups/kde/okular | 5 ++++- apparmor.d/profiles-g-l/libreoffice | 9 ++++++--- 5 files changed, 19 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index a06a29da4..b448c542d 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -46,7 +46,7 @@ owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kwinrc r, owner @{user_config_dirs}/session/ rw, - owner @{user_config_dirs}/session/*_@{hex}_@{int}_@{int} rwlk, + owner @{user_config_dirs}/session/*_* rwlk, owner @{user_config_dirs}/session/#@{int} rw, owner @{user_config_dirs}/trashrc r, diff --git a/apparmor.d/groups/kde/dolphin b/apparmor.d/groups/kde/dolphin index 2d3b099d7..022c0beec 100644 --- a/apparmor.d/groups/kde/dolphin +++ b/apparmor.d/groups/kde/dolphin @@ -25,7 +25,11 @@ profile dolphin @{exec_path} { network netlink raw, - signal (send) set=(term) peer=kioworker, + signal send set=hup peer=@{p_systemd}, + signal send set=term peer=kioworker, + + ptrace read peer=@{p_systemd}, + ptrace read peer=okular, @{exec_path} mr, @@ -109,10 +113,11 @@ profile dolphin @{exec_path} { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, @{sys}/devices/virtual/block/dm-@{int}/uevent r, - /dev/tty r, + /dev/tty rw, include if exists } diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index f4f955a4f..ac80b3b18 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -41,6 +41,7 @@ profile kwin_x11 @{exec_path} { /usr/share/kwin-x11/{,**} r, /usr/share/kwin/{,**} r, /usr/share/plasma/desktoptheme/{,**} r, + /usr/share/sounds/*/stereo/*.oga r, /etc/machine-id r, /etc/xdg/plasmarc r, diff --git a/apparmor.d/groups/kde/okular b/apparmor.d/groups/kde/okular index acd9b7430..a2ffad26f 100644 --- a/apparmor.d/groups/kde/okular +++ b/apparmor.d/groups/kde/okular @@ -23,6 +23,8 @@ profile okular @{exec_path} { network netlink raw, + ptrace read peer=@{p_systemd}, + signal send set=term peer=kioworker, @{exec_path} mr, @@ -69,7 +71,7 @@ profile okular @{exec_path} { owner @{user_state_dirs}/#@{int} rw, owner @{user_state_dirs}/okularstaterc rw, - owner @{user_state_dirs}/okularstaterc.@{rand6} rwl -> @{user_state_dirs}/#@{int}, + owner @{user_state_dirs}/okularstaterc.@{rand6} rwlk -> @{user_state_dirs}/#@{int}, owner @{user_state_dirs}/okularstaterc.lock rwk, owner @{tmp}/#@{int} rw, @@ -82,6 +84,7 @@ profile okular @{exec_path} { owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, profile gpg { include diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index dfb9361f3..de1c4a856 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -78,21 +78,24 @@ profile libreoffice @{exec_path} { /usr/share/mythes/{,**} r, /usr/share/thumbnailers/{,**} r, + /etc/cups/ppd/*.ppd r, /etc/java{,-}{,@{version}}-openjdk/{,**} r, /etc/libreoffice/{,**} r, - /etc/paperspecs r, /etc/papersize r, + /etc/paperspecs r, /etc/xdg/* r, /var/tmp/ r, owner /var/spool/libreoffice/uno_packages/cache/stamp.sys w, owner @{user_cache_dirs}/libreoffice/{,**} rw, + + owner @{user_config_dirs}/kservicemenurc r, owner @{user_config_dirs}/libreoffice/ rw, owner @{user_config_dirs}/libreoffice/** rwk, - owner @{user_config_dirs}/soffice.*.lock rwk, owner @{user_config_dirs}/plasma_workspace.notifyrc r, - owner @{user_config_dirs}/kservicemenurc r, + owner @{user_config_dirs}/soffice.*.lock rwk, + owner @{user_config_dirs}/soffice.binrc r, owner @{user_share_dirs}/#@{int} rw, owner @{user_share_dirs}/user-places.xbel r, From e370a66c5be6193117a75e3e7c3f3b0d72564495 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 20:10:51 +0200 Subject: [PATCH 1350/1455] fix(profile): issues with stacking fix #819 --- apparmor.d/groups/freedesktop/xdg-settings | 2 +- apparmor.d/groups/gnome/gnome-calculator | 2 +- apparmor.d/groups/procps/pgrep | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index cb7edf822..840500c52 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/xdg-settings -profile xdg-settings @{exec_path} { +profile xdg-settings @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/gnome/gnome-calculator b/apparmor.d/groups/gnome/gnome-calculator index 4e83bfb76..2f1cc0e89 100644 --- a/apparmor.d/groups/gnome/gnome-calculator +++ b/apparmor.d/groups/gnome/gnome-calculator @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/gnome-calculator -profile gnome-calculator @{exec_path} { +profile gnome-calculator @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/procps/pgrep b/apparmor.d/groups/procps/pgrep index 489f55bd7..d10c1e772 100644 --- a/apparmor.d/groups/procps/pgrep +++ b/apparmor.d/groups/procps/pgrep @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/pgrep -profile pgrep @{exec_path} { +profile pgrep @{exec_path} flags=(attach_disconnected) { include include include From fda63da65e42a19f2216ecff92783cfa7675e3bd Mon Sep 17 00:00:00 2001 From: sbrantler Date: Wed, 3 Sep 2025 13:17:58 +0200 Subject: [PATCH 1351/1455] Add xfce-clipman --- apparmor.d/groups/xfce/xfce-clipman | 31 +++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 apparmor.d/groups/xfce/xfce-clipman diff --git a/apparmor.d/groups/xfce/xfce-clipman b/apparmor.d/groups/xfce/xfce-clipman new file mode 100644 index 000000000..270f7266f --- /dev/null +++ b/apparmor.d/groups/xfce/xfce-clipman @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2025 Sighy Brantler +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/xfce4-clipman +profile xfce-clipman @{exec_path} { + include + include + include + include + + @{exec_path} mr, + + /etc/xdg/xfce4/panel/xfce4-clipman-actions.xml r, + + owner @{user_cache_dirs}/xfce4/clipman/ r, + owner @{user_cache_dirs}/xfce4/clipman/* rw, + + owner @{user_config_dirs}/autostart/ r, + owner @{user_config_dirs}/autostart/xfce4-clipman-plugin-autostart.desktop rw, + owner @{user_config_dirs}/autostart/xfce4-clipman-plugin-autostart.desktop.@{rand6} rw, + + include if exists +} + +# vim:syntax=apparmor From 0f0082fd5b5fa2bb10244651f4ab81dacb6146c7 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Mon, 11 Aug 2025 10:27:07 -0600 Subject: [PATCH 1352/1455] Add profile for kinit --- apparmor.d/profiles-g-l/kinit | 39 +++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 apparmor.d/profiles-g-l/kinit diff --git a/apparmor.d/profiles-g-l/kinit b/apparmor.d/profiles-g-l/kinit new file mode 100644 index 000000000..26cdcbd18 --- /dev/null +++ b/apparmor.d/profiles-g-l/kinit @@ -0,0 +1,39 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Zane Zakraisek +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/kinit +profile kinit @{exec_path} { + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + #Config Files + /etc/krb5.conf r, + /etc/krb5.conf.d/{,**} r, + + #Host keytab file + /etc/krb5.keytab r, + + #User keytab file + /var/lib/krb5/user/*/client.keytab r, + + #Credentials cache + /tmp/krb5cc_* rwk, + /tmp/tkt* rwk, + + include if exists +} + +# vim:syntax=apparmor From 4f4f5c464e7b0fb9b2392a0cbaec15b321c379a2 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Mon, 11 Aug 2025 10:27:57 -0600 Subject: [PATCH 1353/1455] Add profile for kdestroy --- apparmor.d/profiles-g-l/kdestroy | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 apparmor.d/profiles-g-l/kdestroy diff --git a/apparmor.d/profiles-g-l/kdestroy b/apparmor.d/profiles-g-l/kdestroy new file mode 100644 index 000000000..1e34b0193 --- /dev/null +++ b/apparmor.d/profiles-g-l/kdestroy @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Zane Zakraisek +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/kdestroy +profile kdestroy @{exec_path} { + include + + @{exec_path} mr, + + #Allow root to destroy other users' creds cache + capability dac_override, + + #Config Files + /etc/krb5.conf r, + /etc/krb5.conf.d/{,**} r, + + #Credentials cache + /tmp/krb5cc_* rwk, + /tmp/tkt* rwk, + + include if exists +} + +# vim:syntax=apparmor From a4798a2f383f205584a8cf11f715d4b0b3ea6ceb Mon Sep 17 00:00:00 2001 From: doublez13 Date: Mon, 11 Aug 2025 10:28:50 -0600 Subject: [PATCH 1354/1455] Add profile for klist --- apparmor.d/profiles-g-l/klist | 36 +++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 apparmor.d/profiles-g-l/klist diff --git a/apparmor.d/profiles-g-l/klist b/apparmor.d/profiles-g-l/klist new file mode 100644 index 000000000..0dc0c89ba --- /dev/null +++ b/apparmor.d/profiles-g-l/klist @@ -0,0 +1,36 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Zane Zakraisek +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/klist +profile klist @{exec_path} { + include + + @{exec_path} mr, + + #Allow root to list other users' creds cache + capability dac_override, + capability dac_read_search, + + #Config Files + /etc/krb5.conf r, + /etc/krb5.conf.d/{,**} r, + + #Host keytab file + /etc/krb5.keytab r, + + #User keytab file + /var/lib/krb5/user/*/client.keytab rk, + + #Credentials cache + /tmp/krb5cc_* rk, + /tmp/tkt* rk, + + include if exists +} + +# vim:syntax=apparmor From 7a610bb5fa9ad2ae370a71170c4142c0cdc8cdbe Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 07:37:53 -0600 Subject: [PATCH 1355/1455] Formatting Fix --- apparmor.d/profiles-g-l/kdestroy | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-g-l/kdestroy b/apparmor.d/profiles-g-l/kdestroy index 1e34b0193..0a4ed9ab5 100644 --- a/apparmor.d/profiles-g-l/kdestroy +++ b/apparmor.d/profiles-g-l/kdestroy @@ -10,11 +10,11 @@ include profile kdestroy @{exec_path} { include - @{exec_path} mr, - #Allow root to destroy other users' creds cache capability dac_override, + @{exec_path} mr, + #Config Files /etc/krb5.conf r, /etc/krb5.conf.d/{,**} r, From 00f63f77e1881067c3ff447ac2b5dbbaa6fe2db1 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 07:39:34 -0600 Subject: [PATCH 1356/1455] Formatting Fix --- apparmor.d/profiles-g-l/klist | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-g-l/klist b/apparmor.d/profiles-g-l/klist index 0dc0c89ba..9deeeedd8 100644 --- a/apparmor.d/profiles-g-l/klist +++ b/apparmor.d/profiles-g-l/klist @@ -10,12 +10,12 @@ include profile klist @{exec_path} { include - @{exec_path} mr, - #Allow root to list other users' creds cache capability dac_override, capability dac_read_search, + @{exec_path} mr, + #Config Files /etc/krb5.conf r, /etc/krb5.conf.d/{,**} r, From c51f189ca0f6723475a0db2d860f58c28ccc8496 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 07:46:04 -0600 Subject: [PATCH 1357/1455] Use abstractions where possible --- apparmor.d/profiles-g-l/kdestroy | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/apparmor.d/profiles-g-l/kdestroy b/apparmor.d/profiles-g-l/kdestroy index 0a4ed9ab5..ccc0a2b25 100644 --- a/apparmor.d/profiles-g-l/kdestroy +++ b/apparmor.d/profiles-g-l/kdestroy @@ -9,16 +9,13 @@ include @{exec_path} = @{bin}/kdestroy profile kdestroy @{exec_path} { include + include #Allow root to destroy other users' creds cache capability dac_override, @{exec_path} mr, - #Config Files - /etc/krb5.conf r, - /etc/krb5.conf.d/{,**} r, - #Credentials cache /tmp/krb5cc_* rwk, /tmp/tkt* rwk, From 415bd4aa445e587e1e7df523af998c49dcd14758 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 07:48:57 -0600 Subject: [PATCH 1358/1455] Use abstractions where possible --- apparmor.d/profiles-g-l/kinit | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/apparmor.d/profiles-g-l/kinit b/apparmor.d/profiles-g-l/kinit index 26cdcbd18..067886f89 100644 --- a/apparmor.d/profiles-g-l/kinit +++ b/apparmor.d/profiles-g-l/kinit @@ -10,6 +10,7 @@ include profile kinit @{exec_path} { include include + include network inet dgram, network inet6 dgram, @@ -19,13 +20,6 @@ profile kinit @{exec_path} { @{exec_path} mr, - #Config Files - /etc/krb5.conf r, - /etc/krb5.conf.d/{,**} r, - - #Host keytab file - /etc/krb5.keytab r, - #User keytab file /var/lib/krb5/user/*/client.keytab r, From e86f77fa4bfd8a46fea4555f8829231737fcad51 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 07:50:41 -0600 Subject: [PATCH 1359/1455] Use abstractions where possible --- apparmor.d/profiles-g-l/klist | 7 ------- 1 file changed, 7 deletions(-) diff --git a/apparmor.d/profiles-g-l/klist b/apparmor.d/profiles-g-l/klist index 9deeeedd8..c9e30b775 100644 --- a/apparmor.d/profiles-g-l/klist +++ b/apparmor.d/profiles-g-l/klist @@ -16,13 +16,6 @@ profile klist @{exec_path} { @{exec_path} mr, - #Config Files - /etc/krb5.conf r, - /etc/krb5.conf.d/{,**} r, - - #Host keytab file - /etc/krb5.keytab r, - #User keytab file /var/lib/krb5/user/*/client.keytab rk, From cbc4f19b8bdf264e56e138e36c16b4f3b7bdcc6c Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 08:10:11 -0600 Subject: [PATCH 1360/1455] Be more specific on client keytab path --- apparmor.d/profiles-g-l/kinit | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/kinit b/apparmor.d/profiles-g-l/kinit index 067886f89..706a11c10 100644 --- a/apparmor.d/profiles-g-l/kinit +++ b/apparmor.d/profiles-g-l/kinit @@ -21,7 +21,7 @@ profile kinit @{exec_path} { @{exec_path} mr, #User keytab file - /var/lib/krb5/user/*/client.keytab r, + /var/lib/krb5/user/@{uid}/client.keytab r, #Credentials cache /tmp/krb5cc_* rwk, From 9cac4eeb901cfd4b5ce3633c26525ade4ff1afbe Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 08:11:43 -0600 Subject: [PATCH 1361/1455] Be more specific on client keytab path --- apparmor.d/profiles-g-l/klist | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-g-l/klist b/apparmor.d/profiles-g-l/klist index c9e30b775..71411ccc9 100644 --- a/apparmor.d/profiles-g-l/klist +++ b/apparmor.d/profiles-g-l/klist @@ -17,7 +17,7 @@ profile klist @{exec_path} { @{exec_path} mr, #User keytab file - /var/lib/krb5/user/*/client.keytab rk, + /var/lib/krb5/user/@{uid}/client.keytab rk, #Credentials cache /tmp/krb5cc_* rk, From b1c0cfdab5ec66b3806117ed0be4d00a701a69e2 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 08:20:53 -0600 Subject: [PATCH 1362/1455] Use abstractions where possible --- apparmor.d/profiles-g-l/klist | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-g-l/klist b/apparmor.d/profiles-g-l/klist index 71411ccc9..f21f34295 100644 --- a/apparmor.d/profiles-g-l/klist +++ b/apparmor.d/profiles-g-l/klist @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/klist profile klist @{exec_path} { include + include #Allow root to list other users' creds cache capability dac_override, From 5c3c1522571432c0d5398959962974d7410de9ba Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 4 Sep 2025 08:35:36 -0600 Subject: [PATCH 1363/1455] Run kerberos utils in complain mode --- dists/flags/main.flags | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 2c01d9553..cd9a0e5a6 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -185,6 +185,7 @@ kconf_update complain kde-powerdevil attach_disconnected,mediate_deleted,complain kde-systemd-start-condition complain kded complain +kdestroy complain kdump_mem_estimator complain kdump-config attach_disconnected,complain kdump-tools-init complain,attach_disconnected @@ -193,9 +194,11 @@ kernel-install complain kernel-postinst-kdump complain keyboxd complain kglobalacceld complain +kinit complain kio_http_cache_cleaner complain kiod complain kioworker complain +klist complain konsole attach_disconnected,mediate_deleted,complain kscreen_backend_launcher complain kscreen_osd_service complain From 0ffc8f9fa6bbfa0af350019a1420c23fdbded7fd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 20:56:44 +0200 Subject: [PATCH 1364/1455] fix: self raised linter issue. --- apparmor.d/groups/cups/cups-backend-pdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/cups/cups-backend-pdf b/apparmor.d/groups/cups/cups-backend-pdf index 6f658b064..21da6bf93 100644 --- a/apparmor.d/groups/cups/cups-backend-pdf +++ b/apparmor.d/groups/cups/cups-backend-pdf @@ -25,7 +25,7 @@ profile cups-backend-pdf @{exec_path} { @{sh_path} rix, @{bin}/cp rix, - @{bin}/gs rix, + @{bin}/gs{,.bin} rix, @{bin}/gsc rix, @{lib}/ghostscript/** mr, From 6400bc725c78d569dc70804e0f9c92d4fb35d787 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 21:20:32 +0200 Subject: [PATCH 1365/1455] tests: update some unit tests to the last changes. --- pkg/prebuild/builder/core_test.go | 48 ++++++++++++++++++++++++++++- pkg/prebuild/directive/dbus.go | 17 +++++++--- pkg/prebuild/directive/dbus_test.go | 8 +++-- 3 files changed, 64 insertions(+), 9 deletions(-) diff --git a/pkg/prebuild/builder/core_test.go b/pkg/prebuild/builder/core_test.go index c6c493472..6bcf74647 100644 --- a/pkg/prebuild/builder/core_test.go +++ b/pkg/prebuild/builder/core_test.go @@ -253,12 +253,58 @@ dbus send bus=session path=/org/freedesktop/DBus member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} peer=(name=org.freedesktop.DBus, label=dbus-session//&unconfined), +}`, + }, + { + name: "base-strict-1", + b: Builders["base-strict"], + profile: ` +profile foo { + include +}`, + want: ` +profile foo { + include +}`, + }, + { + name: "attach-1", + b: Builders["attach"], + profile: ` +profile attach-1 flags=(attach_disconnected) { + include + include + include +}`, + want: ` +@{att} = /att/attach-1/ +profile attach-1 flags=(attach_disconnected,attach_disconnected.path=@{att}) { + include + include + include +}`, + }, + { + name: "attach-2", + b: Builders["attach"], + profile: ` +profile attach-2 flags=(complain) { + include + include + include +}`, + want: ` +@{att} = "" +profile attach-2 flags=(complain) { + include + include + include }`, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - opt := &Option{File: prebuild.RootApparmord.Join(tt.name)} + opt := &Option{File: prebuild.RootApparmord.Join(tt.name), Name: tt.name} got, err := tt.b.Apply(opt, tt.profile) if (err != nil) != tt.wantErr { t.Errorf("Builder.Apply() error = %v, wantErr %v", err, tt.wantErr) diff --git a/pkg/prebuild/directive/dbus.go b/pkg/prebuild/directive/dbus.go index 891eb9e1d..4862597bb 100644 --- a/pkg/prebuild/directive/dbus.go +++ b/pkg/prebuild/directive/dbus.go @@ -135,7 +135,7 @@ func (d Dbus) own(rules map[string]string) aa.Rules { } res = append(res, - // DBus.Properties + // DBus.Properties: reply to properties request from anyone &aa.Dbus{ Access: []string{"send", "receive"}, Bus: rules["bus"], Path: rules["path"], Interface: "org.freedesktop.DBus.Properties", @@ -143,7 +143,7 @@ func (d Dbus) own(rules map[string]string) aa.Rules { PeerName: `"{@{busname},org.freedesktop.DBus}"`, }, - // DBus.Introspectable + // DBus.Introspectable: allow clients to introspect the service &aa.Dbus{ Access: []string{"receive"}, Bus: rules["bus"], Path: rules["path"], Interface: "org.freedesktop.DBus.Introspectable", @@ -151,7 +151,7 @@ func (d Dbus) own(rules map[string]string) aa.Rules { PeerName: `"@{busname}"`, }, - // DBus.ObjectManager + // DBus.ObjectManager: allow clients to enumerate sources &aa.Dbus{ Access: []string{"receive"}, Bus: rules["bus"], Path: rules["path"], Interface: "org.freedesktop.DBus.ObjectManager", @@ -170,7 +170,14 @@ func (d Dbus) own(rules map[string]string) aa.Rules { func (d Dbus) talk(rules map[string]string) aa.Rules { interfaces := getInterfaces(rules) - res := aa.Rules{} + res := aa.Rules{ + &aa.Unix{ + Type: "stream", + Address: "none", + PeerLabel: rules["label"], + PeerAddr: "none", + }, + } // Interfaces for _, iface := range interfaces { @@ -198,7 +205,7 @@ func (d Dbus) talk(rules map[string]string) aa.Rules { PeerName: `"{@{busname},` + rules["name"] + `}"`, PeerLabel: rules["label"], }, - // DBus.ObjectManager + // DBus.ObjectManager: allow clients to enumerate sources &aa.Dbus{ Access: []string{"send"}, Bus: rules["bus"], Path: rules["path"], Interface: "org.freedesktop.DBus.ObjectManager", diff --git a/pkg/prebuild/directive/dbus_test.go b/pkg/prebuild/directive/dbus_test.go index 0844fd745..d6e90bb99 100644 --- a/pkg/prebuild/directive/dbus_test.go +++ b/pkg/prebuild/directive/dbus_test.go @@ -8,7 +8,7 @@ import ( "testing" ) -const dbusOwnSystemd1 = ` include +const dbusOwnSystemd1 = ` include dbus bind bus=system name=org.freedesktop.systemd1{,.*}, dbus receive bus=system path=/org/freedesktop/systemd1{,/**} @@ -73,7 +73,7 @@ func TestDbus_Apply(t *testing.T) { Raw: " #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions", }, profile: " #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions", - want: ` include + want: ` include dbus bind bus=session name=com.rastersoft.ding{,.*}, dbus receive bus=session path=/com/rastersoft/ding{,/**} @@ -120,7 +120,9 @@ func TestDbus_Apply(t *testing.T) { Raw: " #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon", }, profile: " #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon", - want: ` dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} + want: ` unix type=stream addr=none peer=(label=accounts-daemon, addr=none), + + dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} interface=org.freedesktop.Accounts{,.*} peer=(name="{@{busname},org.freedesktop.Accounts{,.*}}", label=accounts-daemon), dbus (send receive) bus=system path=/org/freedesktop/Accounts{,/**} From c4ebf8903e30ec49a16c7d5aeea74b726aeab8f1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 21:43:06 +0200 Subject: [PATCH 1366/1455] tests(builder): cleanup build settings between tests. --- cmd/prebuild/main_test.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cmd/prebuild/main_test.go b/cmd/prebuild/main_test.go index d3c28f025..7bf2c0e1a 100644 --- a/cmd/prebuild/main_test.go +++ b/cmd/prebuild/main_test.go @@ -10,6 +10,8 @@ import ( "testing" "github.com/roddhjav/apparmor.d/pkg/prebuild" + "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" + "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" ) func chdirGitRoot() { @@ -49,6 +51,8 @@ func Test_main(t *testing.T) { chdirGitRoot() for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { + prepare.Prepares = []prepare.Task{} + builder.Builds = []builder.Builder{} prebuild.Distribution = tt.dist main() }) From 237daecedb362bf405b19b5402b5221d78f1f533 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 22:07:03 +0200 Subject: [PATCH 1367/1455] tests: remove prebuild main test. - the same is tested in the build process - unit test is done in the prebuild pkg --- cmd/prebuild/main_test.go | 60 --------------------------------------- 1 file changed, 60 deletions(-) delete mode 100644 cmd/prebuild/main_test.go diff --git a/cmd/prebuild/main_test.go b/cmd/prebuild/main_test.go deleted file mode 100644 index 7bf2c0e1a..000000000 --- a/cmd/prebuild/main_test.go +++ /dev/null @@ -1,60 +0,0 @@ -// apparmor.d - Full set of apparmor profiles -// Copyright (C) 2023-2024 Alexandre Pujol -// SPDX-License-Identifier: GPL-2.0-only - -package main - -import ( - "os" - "os/exec" - "testing" - - "github.com/roddhjav/apparmor.d/pkg/prebuild" - "github.com/roddhjav/apparmor.d/pkg/prebuild/builder" - "github.com/roddhjav/apparmor.d/pkg/prebuild/prepare" -) - -func chdirGitRoot() { - cmd := exec.Command("git", "rev-parse", "--show-toplevel") - out, err := cmd.Output() - if err != nil { - panic(err) - } - root := string(out[0 : len(out)-1]) - if err := os.Chdir(root); err != nil { - panic(err) - } -} - -func Test_main(t *testing.T) { - tests := []struct { - name string - dist string - }{ - { - name: "Build for Archlinux", - dist: "arch", - }, - { - name: "Build for Ubuntu", - dist: "ubuntu", - }, - { - name: "Build for Debian", - dist: "debian", - }, - { - name: "Build for OpenSUSE Tumbleweed", - dist: "opensuse", - }, - } - chdirGitRoot() - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - prepare.Prepares = []prepare.Task{} - builder.Builds = []builder.Builder{} - prebuild.Distribution = tt.dist - main() - }) - } -} From 627700a152bbea3fdfd10c4c97009c92b4933bfb Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 22:07:31 +0200 Subject: [PATCH 1368/1455] build: set config for ubuntu 25.10 --- cmd/prebuild/main.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/cmd/prebuild/main.go b/cmd/prebuild/main.go index 5eb1ab2f2..455621e5b 100644 --- a/cmd/prebuild/main.go +++ b/cmd/prebuild/main.go @@ -49,6 +49,9 @@ func init() { case "noble": prebuild.ABI = 4 prebuild.Version = 4.0 + case "questing": + prebuild.ABI = 4 + prebuild.Version = 5.0 } case "debian": From b45e1f36fee6fc038b8867f9ffc62a2ab866e433 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 22:59:00 +0200 Subject: [PATCH 1369/1455] build: add support for downstream project in some prepare tasks. --- pkg/prebuild/cli/cli.go | 5 ++++- pkg/prebuild/directories.go | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index 981331edd..bf768c050 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -139,8 +139,11 @@ func Configure() { builder.Register("stacked-dbus") } else { + if !prebuild.DownStream { + prepare.Register("attach") + } builder.Register("attach") - prepare.Register("attach") + } default: diff --git a/pkg/prebuild/directories.go b/pkg/prebuild/directories.go index 37cbc69bc..201d8c841 100644 --- a/pkg/prebuild/directories.go +++ b/pkg/prebuild/directories.go @@ -13,6 +13,9 @@ var ( // AppArmor version Version = 4.0 + // Tells the build we are a downstream project using apparmor.d as dependency + DownStream = false + // Either or not RBAC is enabled RBAC = false From f61f200427be4032873d39add37cf1f3f6796ca8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 23:52:11 +0200 Subject: [PATCH 1370/1455] build: ignore more abstraction for the server edition. --- pkg/prebuild/prepare/server.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/prebuild/prepare/server.go b/pkg/prebuild/prepare/server.go index 85f98e75d..fb9a1f602 100644 --- a/pkg/prebuild/prepare/server.go +++ b/pkg/prebuild/prepare/server.go @@ -14,6 +14,9 @@ import ( var ( serverIgnorePatterns = []string{ + "include ", + "include ", + "include ", "include ", "include ", "include ", From ca1827ea1207242018ba604c7a789b6beb0992e9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 Sep 2025 23:53:02 +0200 Subject: [PATCH 1371/1455] fix: missing attach_disconnected in parrent profile while subprofile was using it. --- apparmor.d/groups/utils/su | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/utils/su b/apparmor.d/groups/utils/su index 866da3d6a..e5293021c 100644 --- a/apparmor.d/groups/utils/su +++ b/apparmor.d/groups/utils/su @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{bin}/su -profile su @{exec_path} { +profile su @{exec_path} flags=(attach_disconnected) { include include include From aec8e413b36e0a8845ace7483a2299a9b957dc66 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Thu, 4 Sep 2025 16:58:49 +0200 Subject: [PATCH 1372/1455] fix slurp --- apparmor.d/profiles-s-z/slurp | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-s-z/slurp b/apparmor.d/profiles-s-z/slurp index c4250275e..c795ee08e 100644 --- a/apparmor.d/profiles-s-z/slurp +++ b/apparmor.d/profiles-s-z/slurp @@ -16,6 +16,7 @@ profile slurp @{exec_path} { # often used in combination with grim screen cature tool owner /dev/shm/grim-@{rand6} rw, + owner /dev/shm/@{uuid} r, include if exists } From d9ecbdbe4b87418e6ed2e4432240eaadc5bad8ad Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Mon, 8 Sep 2025 16:14:44 +0200 Subject: [PATCH 1373/1455] slurp review fixes --- apparmor.d/profiles-s-z/slurp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-s-z/slurp b/apparmor.d/profiles-s-z/slurp index c795ee08e..740af9b7b 100644 --- a/apparmor.d/profiles-s-z/slurp +++ b/apparmor.d/profiles-s-z/slurp @@ -9,6 +9,8 @@ include @{exec_path} = @{bin}/slurp profile slurp @{exec_path} { include + include + include @{exec_path} mr, @@ -16,7 +18,6 @@ profile slurp @{exec_path} { # often used in combination with grim screen cature tool owner /dev/shm/grim-@{rand6} rw, - owner /dev/shm/@{uuid} r, include if exists } From b569d447031d6a8fe31cdfc1fd0a3540e71f1ded Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 22:09:38 +0200 Subject: [PATCH 1374/1455] feat(profile): update apt profiles. --- apparmor.d/abstractions/common/apt | 6 +++++- apparmor.d/groups/apt/apt | 4 +++- apparmor.d/groups/apt/apt-helper | 2 ++ apparmor.d/groups/apt/apt-methods-http | 2 ++ apparmor.d/groups/apt/deb-systemd-invoke | 2 ++ apparmor.d/groups/apt/dpkg | 3 +++ apparmor.d/groups/apt/dpkg-buildflags | 5 ++++- apparmor.d/groups/apt/dpkg-checkbuilddeps | 11 ++++++++--- apparmor.d/groups/apt/dpkg-script-apparmor | 7 +++++++ apparmor.d/groups/apt/dpkg-scripts | 4 ++++ apparmor.d/groups/apt/unattended-upgrade | 4 ++++ 11 files changed, 44 insertions(+), 6 deletions(-) diff --git a/apparmor.d/abstractions/common/apt b/apparmor.d/abstractions/common/apt index a267fd909..bec8d9a20 100644 --- a/apparmor.d/abstractions/common/apt +++ b/apparmor.d/abstractions/common/apt @@ -6,6 +6,7 @@ abi , /usr/share/dpkg/cputable r, + /usr/share/dpkg/ostable r, /usr/share/dpkg/tupletable r, /usr/share/dpkg/varianttable r, @@ -19,6 +20,9 @@ /etc/apt/sources.list.d/ r, /etc/apt/sources.list.d/*.{sources,list} r, + /etc/apt/trusted.gpg r, + /etc/apt/trusted.gpg.d/{,*} r, + /var/lib/apt/lists/{,**} r, /var/lib/apt/extended_states r, @@ -26,7 +30,7 @@ /var/cache/apt/srcpkgcache.bin r, /var/lib/dpkg/status r, - /var/lib/ubuntu-advantage/apt-esm/{,**} r, + /var/lib/ubuntu-advantage/apt-esm/{,**} r, #aa:only ubuntu owner @{tmp}/#@{int} rw, owner @{tmp}/clearsigned.message.* rw, diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 9bdabb1c2..ade8bee61 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -147,6 +147,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { /tmp/ r, /tmp/apt-changelog-*/ w, /tmp/apt-changelog-*/*.changelog w, + /tmp/apt-tmp-index.@{rand6} rw, owner @{tmp}/apt-changelog-*/.apt-acquire-privs-test.* rw, owner @{tmp}/apt-dpkg-install-*/ rw, owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w, @@ -190,6 +191,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{bin}/bunzip2 rix, @{bin}/chmod rix, + @{bin}/bzip2 rix, @{bin}/gunzip rix, @{bin}/gzip rix, @{bin}/patch rix, @@ -197,7 +199,7 @@ profile apt @{exec_path} flags=(attach_disconnected) { @{bin}/tar rix, @{bin}/xz rix, - /etc/dpkg/origins/debian r, + /etc/dpkg/origins/* r, owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, owner @{HOME}/** rwkl -> @{HOME}/**, diff --git a/apparmor.d/groups/apt/apt-helper b/apparmor.d/groups/apt/apt-helper index 5a2d7dd55..f16e98d2f 100644 --- a/apparmor.d/groups/apt/apt-helper +++ b/apparmor.d/groups/apt/apt-helper @@ -25,6 +25,8 @@ profile apt-helper @{exec_path} { capability net_admin, + ptrace read peer=@{p_systemd}, + include if exists } diff --git a/apparmor.d/groups/apt/apt-methods-http b/apparmor.d/groups/apt/apt-methods-http index 61be160dc..77a418b07 100644 --- a/apparmor.d/groups/apt/apt-methods-http +++ b/apparmor.d/groups/apt/apt-methods-http @@ -74,6 +74,8 @@ profile apt-methods-http @{exec_path} flags=(attach_disconnected) { @{run}/ubuntu-advantage/aptnews.json rw, owner @{run}/ubuntu-advantage/apt-news/aptnews.json rw, + @{run}/systemd/resolve/io.systemd.Resolve rw, + @{PROC}/1/cgroup r, @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/apt/deb-systemd-invoke b/apparmor.d/groups/apt/deb-systemd-invoke index d2e9e9260..824d3b4dd 100644 --- a/apparmor.d/groups/apt/deb-systemd-invoke +++ b/apparmor.d/groups/apt/deb-systemd-invoke @@ -15,6 +15,8 @@ profile deb-systemd-invoke @{exec_path} { capability net_admin, capability sys_resource, + ptrace read peer=@{p_systemd}, + signal send set=(cont term) peer=systemd-tty-ask-password-agent, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/dpkg b/apparmor.d/groups/apt/dpkg index 2c1ac1ce5..986c6f188 100644 --- a/apparmor.d/groups/apt/dpkg +++ b/apparmor.d/groups/apt/dpkg @@ -18,6 +18,9 @@ profile dpkg @{exec_path} { capability fowner, capability fsetid, capability setgid, + capability sys_ptrace, + + ptrace read peer=apt, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/dpkg-buildflags b/apparmor.d/groups/apt/dpkg-buildflags index 467d0d50e..1a4055f77 100644 --- a/apparmor.d/groups/apt/dpkg-buildflags +++ b/apparmor.d/groups/apt/dpkg-buildflags @@ -14,10 +14,13 @@ profile dpkg-buildflags @{exec_path} flags=(complain) { @{exec_path} r, - /etc/dpkg/origins/debian r, + /usr/share/lto-disabled-list/lto-disabled-list r, /usr/share/dpkg/cputable r, /usr/share/dpkg/tupletable r, + /usr/share/dpkg/abitable r, + + /etc/dpkg/origins/* r, owner @{user_config_dirs}/dpkg/buildflags.conf r, diff --git a/apparmor.d/groups/apt/dpkg-checkbuilddeps b/apparmor.d/groups/apt/dpkg-checkbuilddeps index 6f54d3967..712a74e8c 100644 --- a/apparmor.d/groups/apt/dpkg-checkbuilddeps +++ b/apparmor.d/groups/apt/dpkg-checkbuilddeps @@ -11,16 +11,21 @@ include profile dpkg-checkbuilddeps @{exec_path} flags=(complain) { include include + include @{exec_path} r, - /etc/dpkg/origins/debian r, - - /var/lib/dpkg/status r, + @{bin}/dpkg rPx, + @{bin}/@{multiarch}gcc-@{int} mrix, + /usr/share/dpkg/ostable r, /usr/share/dpkg/cputable r, /usr/share/dpkg/tupletable r, + /etc/dpkg/origins/* r, + + /var/lib/dpkg/status r, + # For package building owner @{user_build_dirs}/**/debian/control r, diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor index 38a068ac0..73a4f6c46 100644 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ b/apparmor.d/groups/apt/dpkg-script-apparmor @@ -2,6 +2,8 @@ # Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# TODO: merge with dpkg-scripts + abi , include @@ -16,8 +18,13 @@ profile dpkg-script-apparmor @{exec_path} { @{exec_path} mrix, @{bin}/{,e}grep ix, + @{bin}/cat ix, + @{bin}/chmod ix, + @{bin}/mkdir ix, @{bin}/deb-systemd-helper Px, + @{bin}/dpkg-maintscript-helper Px, + @{bin}/dpkg Px -> child-dpkg, @{bin}/deb-systemd-invoke Px, @{bin}/dpkg-divert ix, @{bin}/systemctl Cx -> systemctl, diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index 8ae76e706..acde577de 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -114,6 +114,10 @@ profile dpkg-scripts @{exec_path} { capability sys_ptrace, capability sys_resource, + signal send set=(cont term) peer=systemd-tty-ask-password-agent, + + ptrace read peer=@{p_systemd}, + @{bin}/systemd-tty-ask-password-agent Px, @{pager_path} Px -> child-pager, diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index d501a325f..ebdc88d08 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -38,6 +38,8 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { unix type=stream addr=@@{udbus}/bus/unattended-upgr/system, + #aa:dbus own bus=system name=com.ubuntu.UnattendedUpgrade + @{exec_path} mr, @{bin}/ r, @@ -70,6 +72,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { @{lib}/zsys-system-autosnapshot Px, /usr/share/distro-info/* r, + /usr/share/dbus-1/interfaces/*UnattendedUpgrade*.xml r, @{etc_ro}/login.defs r, @{etc_ro}/security/capability.conf r, @@ -127,6 +130,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pid}/attr/current r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/environ r, + @{PROC}/@{pid}/mounts r, @{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/stat r, owner @{PROC}/@{pids}/fd/ r, From 394dc54ceb7ff80bbbde064992f1580eee64e0ac Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 22:13:12 +0200 Subject: [PATCH 1375/1455] feat(profile): update snap profiles. --- apparmor.d/groups/snap/snap | 33 ++++++++++++++++++++++++--- apparmor.d/groups/snap/snap-update-ns | 4 +++- apparmor.d/groups/snap/snapd | 14 ++++++++---- 3 files changed, 43 insertions(+), 8 deletions(-) diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap index 0d38fc055..9530b8594 100644 --- a/apparmor.d/groups/snap/snap +++ b/apparmor.d/groups/snap/snap @@ -17,13 +17,19 @@ profile snap @{exec_path} flags=(attach_disconnected) { include include include + include capability chown, capability dac_override, capability dac_read_search, capability setuid, capability sys_admin, + capability sys_ptrace, + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, network netlink raw, ptrace read peer=snap.*, @@ -36,7 +42,7 @@ profile snap @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=io.snapcraft.SessionAgent #aa:dbus own bus=session name=io.snapcraft.Settings - #aa:dbus talk bus=session name=io.snapcraft.PrivilegedDesktopLauncher label=snap.snap-store.snap-store + #aa:dbus talk bus=session name=io.snapcraft.PrivilegedDesktopLauncher label=snap.snap-store.* #aa:dbus talk bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}" #aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}" @@ -59,9 +65,11 @@ profile snap @{exec_path} flags=(attach_disconnected) { @{bin}/gpg{,2} rCx -> gpg, @{bin}/systemctl rCx -> systemctl, @{bin}/systemd-run rCx -> run, # Start snap from the cli + @{bin}/unsquashfs rCx -> unsquashfs, @{bin}/xdg-settings rCx -> xdg-settings, - @{lib_dirs}/** mr, + @{bin_dirs}/xdelta3 ix, + @{lib_dirs}/** mr, @{lib_dirs}/snapd/snap-confine rPx, @{lib_dirs}/snapd/snap-seccomp rPx, @{lib_dirs}/snapd/snapd rPx, @@ -80,6 +88,9 @@ profile snap @{exec_path} flags=(attach_disconnected) { @{HOME}/.snap/{,**} rw, @{HOME}/snap/{,**} rw, + @{user_pkg_dirs}/** r, + + owner @{tmp}/read-file@{int}/unpack/{,**} w, owner @{tmp}/snapd-auto-import-mount-@{int}/ rw, @{run}/user/@{uid}/bus rw, @@ -176,14 +187,30 @@ profile snap @{exec_path} flags=(attach_disconnected) { include include - network unix stream, + capability net_admin, + network unix stream, + network (send receive) netlink raw, + + @{run}/systemd/notify w, owner @{run}/user/@{uid}/systemd/notify rw, owner @{run}/user/@{uid}/systemd/private rw, include if exists } + profile unsquashfs { + include + + @{bin}/unsquashfs mr, + + /**.snap r, + + owner /tmp/read-file@{int}/unpack/{,**} w, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/snap/snap-update-ns b/apparmor.d/groups/snap/snap-update-ns index e831cc90c..5d08a4240 100644 --- a/apparmor.d/groups/snap/snap-update-ns +++ b/apparmor.d/groups/snap/snap-update-ns @@ -34,7 +34,9 @@ profile snap-update-ns @{exec_path} { @{lib_dirs}/**.so* mr, @{lib}/@{multiarch}/webkit2gtk-@{version}/ w, - /usr/share/xml/iso-codes/ w, + + /usr/share/xml/ r, + /usr/share/xml/iso-codes/ rw, /var/lib/snapd/mount/{,*} r, diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd index 4a928e6d4..87e535b3f 100644 --- a/apparmor.d/groups/snap/snapd +++ b/apparmor.d/groups/snap/snapd @@ -97,10 +97,11 @@ profile snapd @{exec_path} { @{lib_dirs}/snapd/snap-update-ns rPx, /usr/share/bash-completion/{,**} r, - /usr/share/dbus-1/{system,session}.d/{,snapd*} rw, + /usr/share/dbus-1/{system,session}.d/ rw, + /usr/share/dbus-1/{system,session}.d/snapd* rw, /usr/share/dbus-1/services/*snap* r, /usr/share/polkit-1/actions/{,**} r, - /usr/share/polkit-1/actions/snap.*.policy r, + /usr/share/polkit-1/actions/snap.*.policy* rw, @{etc_ro}/environment r, /etc/apparmor.d/*snapd.snap* r, @@ -190,6 +191,8 @@ profile snapd @{exec_path} { network netlink raw, + ptrace read peer=@{p_systemd}, + /etc/systemd/system/{,**/} r, /etc/systemd/system/snap* rw, /etc/systemd/user/{,**/} rw, @@ -229,9 +232,12 @@ profile snapd @{exec_path} { include @{sbin}/runuser mr, - @{bin}/tar ix, - owner @{HOME}/snap/*/common/.cache/{,**} r, + @{sh_path} ix, + @{bin}/gzip ix, + @{bin}/tar ix, + + owner @{HOME}/snap/*/{,**} r, include if exists } From f69a7e7213d81ddd0c3c760400edfdc025be05e0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:04:36 +0200 Subject: [PATCH 1376/1455] feat(profile): update gnome profiles. --- .../bus/org.gnome.keyring.internal.Prompter | 2 + .../gnome/evolution-addressbook-factory | 2 + .../groups/gnome/evolution-calendar-factory | 1 + apparmor.d/groups/gnome/gdm | 23 +++++----- apparmor.d/groups/gnome/gdm-generate-config | 3 +- apparmor.d/groups/gnome/gio-launch-desktop | 2 + apparmor.d/groups/gnome/gnome-calculator | 2 + apparmor.d/groups/gnome/gnome-calendar | 15 +++---- apparmor.d/groups/gnome/gnome-control-center | 9 +++- .../groups/gnome/gnome-disk-image-mounter | 7 +++ apparmor.d/groups/gnome/gnome-extension-ding | 4 +- .../groups/gnome/gnome-extension-gsconnect | 1 + apparmor.d/groups/gnome/gnome-keyring-daemon | 9 ++-- apparmor.d/groups/gnome/gnome-session | 10 +++++ apparmor.d/groups/gnome/gnome-shell | 44 ++++++++++--------- apparmor.d/groups/gnome/gnome-software | 1 + apparmor.d/groups/gnome/gnome-text-editor | 1 + apparmor.d/groups/gnome/gsd-housekeeping | 2 +- apparmor.d/groups/gnome/gsd-power | 10 ++++- .../groups/gnome/gsd-print-notifications | 2 +- apparmor.d/groups/gnome/gsd-sharing | 5 +++ apparmor.d/groups/gnome/gsd-usb-protection | 5 +++ apparmor.d/groups/gnome/kgx | 1 + apparmor.d/groups/gnome/localsearch | 7 +++ apparmor.d/groups/gnome/mutter-x11-frames | 1 + apparmor.d/groups/gnome/nautilus | 9 ++++ apparmor.d/groups/gnome/papers | 9 ++++ apparmor.d/groups/gnome/ptyxis | 2 +- apparmor.d/groups/gnome/ptyxis-agent | 11 ++++- apparmor.d/groups/gnome/tracker-extract | 5 +-- apparmor.d/groups/gnome/tracker-miner | 4 +- apparmor.d/tunables/multiarch.d/system-users | 2 +- 32 files changed, 153 insertions(+), 58 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter b/apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter index 1c3e8f760..0816b046f 100644 --- a/apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter +++ b/apparmor.d/abstractions/bus/org.gnome.keyring.internal.Prompter @@ -11,6 +11,8 @@ abi , + unix type=stream peer=(label=gnome-keyring-daemon), + dbus send bus=session path=/org/gnome/keyring/Prompter interface=org.gnome.keyring.internal.Prompter member={BeginPrompting,PerformPrompt,StopPrompting} diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index b56af123d..56fd3ce3f 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -27,7 +27,9 @@ profile evolution-addressbook-factory @{exec_path} { network netlink raw, #aa:dbus own bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} + #aa:dbus own bus=session name=org.gnome.evolution.dataserver.AddressBookCursor #aa:dbus own bus=session name=org.gnome.evolution.dataserver.AddressBookFactory + #aa:dbus own bus=session name=org.gnome.evolution.dataserver.AddressBookView dbus (send, receive) bus=session path=/org/gnome/evolution/dataserver/** interface=org.gnome.evolution.dataserver.* diff --git a/apparmor.d/groups/gnome/evolution-calendar-factory b/apparmor.d/groups/gnome/evolution-calendar-factory index 3d1d00f28..2ee416bd9 100644 --- a/apparmor.d/groups/gnome/evolution-calendar-factory +++ b/apparmor.d/groups/gnome/evolution-calendar-factory @@ -12,6 +12,7 @@ profile evolution-calendar-factory @{exec_path} { include include include + include include include include diff --git a/apparmor.d/groups/gnome/gdm b/apparmor.d/groups/gnome/gdm index 4c84fe822..3f958cb7e 100644 --- a/apparmor.d/groups/gnome/gdm +++ b/apparmor.d/groups/gnome/gdm @@ -17,6 +17,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) { capability chown, capability dac_override, capability dac_read_search, + capability fowner, capability fsetid, capability kill, capability net_admin, @@ -54,6 +55,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) { /usr/share/wayland-sessions/*.desktop r, /usr/share/xsessions/*.desktop r, + /etc/.pwd.lock rwk, /etc/default/locale r, /etc/gdm{3,}/custom.conf r, /etc/gdm{3,}/daemon.conf r, @@ -66,18 +68,17 @@ profile gdm @{exec_path} flags=(attach_disconnected) { /var/log/gdm{3,}/ rw, - owner @{GDM_HOME}/block-initial-setup rw, + @{GDM_HOME}/ rw, + @{GDM_HOME}/** rw, - @{run}/gdm{3,}/greeter/ rw, - @{run}/systemd/seats/seat@{int} r, - @{run}/systemd/sessions/* r, - @{run}/systemd/users/@{uid} r, - owner @{run}/gdm{3,}.pid rw, - owner @{run}/gdm{3,}/ rw, - owner @{run}/gdm{3,}/custom.conf r, - owner @{run}/gdm{3,}/dbus/ w, - owner @{run}/gdm{3,}/dbus/dbus-@{rand8} w, - owner @{run}/gdm{3,}/gdm.pid rw, + @{run}/gdm{,3}/ rw, + owner @{run}/gdm{,3}.pid rw, + owner @{run}/gdm{,3}/dbus/ rw, + owner @{run}/gdm{,3}/dbus/dbus-@{rand8} rw, + + @{run}/systemd/seats/seat@{int} r, + @{run}/systemd/sessions/* r, + @{run}/systemd/users/@{uid} r, @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index 6e67866f5..c5e6d4cd5 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -44,8 +44,9 @@ profile gdm-generate-config @{exec_path} { @{PROC}/ r, @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cmdline r, - @{PROC}/@{pids}/status r, @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, + @{PROC}/tty/drivers r, @{PROC}/uptime r, profile pgrep { diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index a3d285e94..eb76f1207 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -33,6 +33,8 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { @{bin}/gnome-terminal rPUx, @{lib}/gio-launch-desktop rix, + @{lib}/*/** rPx, + @{lib}/* rPx, owner @{HOME}/{,**} rw, diff --git a/apparmor.d/groups/gnome/gnome-calculator b/apparmor.d/groups/gnome/gnome-calculator index 2f1cc0e89..4ab9b165f 100644 --- a/apparmor.d/groups/gnome/gnome-calculator +++ b/apparmor.d/groups/gnome/gnome-calculator @@ -20,6 +20,8 @@ profile gnome-calculator @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, + #aa:dbus own bus=session name=org.gnome.Calculator + @{exec_path} mr, @{open_path} rPx -> child-open-help, diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index 7d6d5246d..872fc6858 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -24,20 +24,19 @@ profile gnome-calendar @{exec_path} { #aa:dbus own bus=session name=org.gnome.Calendar + #aa:dbus talk bus=system name=org.freedesktop.GeoClue2 label="@{p_geoclue}" + #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} label=evolution-addressbook-factory + #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Calendar path=/org/gnome/evolution/dataserver/ label=evolution-calendar-factory #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Calendar@{int} label=evolution-calendar-factory + #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.CalendarFactory label=evolution-calendar-factory #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.CalendarView label=evolution-calendar-factory - #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Source label=evolution-source-registry - #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Sources@{int} label=evolution-source-registry + #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Source path=/org/gnome/evolution/dataserver/ label=evolution-source-registry + #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.SourceManager label=evolution-source-registry + #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Subprocess label=evolution-calendar-factory #aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.Color label=gsd-color #aa:dbus talk bus=session name=org.gnome.Shell.SearchProvider2 path=/org/gnome/Calendar/SearchProvider label=gnome-shell - #aa:dbus talk bus=system name=org.freedesktop.GeoClue2 label="@{p_geoclue}" - - dbus send bus=session path=/org/gnome/evolution/dataserver/SourceManager{,/**} - interface=org.freedesktop.DBus.ObjectManager - member=GetManagedObjects - peer=(name=:*, label=evolution-source-registry), @{exec_path} mr, @{open_path} rPx -> child-open-help, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 10f310232..8ef24e9ce 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -41,10 +41,11 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.Settings #aa:dbus own bus=session name=org.bluez.obex.Agent1 + #aa:dbus talk bus=session name=org.bluez.AgentManager1 label=bluetoothd #aa:dbus talk bus=session name=org.bluez.obex label=obexd #aa:dbus talk bus=session name=org.freedesktop.impl.portal.PermissionStore label=xdg-permission-store #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell - #aa:dbus talk bus=session name=org.gnome.SessionManager label=gnome-session-binary + #aa:dbus talk bus=session name=org.gnome.SessionManager label="{gnome-session-binary,gnome-session-service}" #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label="gsd-*" #aa:dbus talk bus=session name=org.gnome.Shell label=gnome-shell @@ -53,6 +54,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=system name=net.reactivated.Fprint.Manager label="@{p_fprintd}" #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" #aa:dbus talk bus=system name=org.freedesktop.bolt1 label=boltd + #aa:dbus talk bus=system name=org.freedesktop.ColorManager label=colord #aa:dbus talk bus=system name=org.freedesktop.hostname1 label="@{p_systemd_hostnamed}" #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" #aa:dbus talk bus=system name=org.freedesktop.ModemManager1 label="@{p_ModemManager}" @@ -63,6 +65,11 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=system name=org.freedesktop.UPower label="@{p_upowerd}" #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label=@{p_power_profiles_daemon} + dbus send bus=system path=/org/freedesktop + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name=@{busname}, label=NetworkManager), + @{exec_path} mr, @{bin}/@{shells} rUx, diff --git a/apparmor.d/groups/gnome/gnome-disk-image-mounter b/apparmor.d/groups/gnome/gnome-disk-image-mounter index 379a887b3..519a248d8 100644 --- a/apparmor.d/groups/gnome/gnome-disk-image-mounter +++ b/apparmor.d/groups/gnome/gnome-disk-image-mounter @@ -9,10 +9,17 @@ include @{exec_path} = @{bin}/gnome-disk-image-mounter profile gnome-disk-image-mounter @{exec_path} { include + include + include + include + include + include include include include + #aa:dbus talk bus=system name=org.freedesktop.UDisks2 label=udisksd + @{exec_path} mr, # Allow to mount user files diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index e47cc66a3..be7edcd79 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -58,8 +58,8 @@ profile gnome-extension-ding @{exec_path} { @{share_dirs}/{,**} r, /usr/share/thumbnailers/{,*.thumbnailer} r, - owner @{HOME}/@{XDG_TEMPLATES_DIR}/ r, - owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, + owner @{user_desktop_dirs}/ r, + owner @{user_templates_dirs}/ r, owner @{user_share_dirs}/nautilus/scripts/ r, diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 22c02a97f..7af7b8b2f 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -75,6 +75,7 @@ profile gnome-extension-gsconnect @{exec_path} { owner @{run}/user/@{uid}/gsconnect/{,**} rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, + owner @{run}/user/@{uid}/keyring/ssh rw, @{sys}/devices/virtual/dmi/id/chassis_type r, diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index 6752f54d4..595b3fd48 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -19,12 +19,15 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { capability ipc_lock, - signal (receive) set=(term) peer=gdm, - signal (send) set=(term) peer=ssh-agent, + signal receive set=(term) peer=gdm, + signal send set=(term) peer=ssh-agent, + + unix type=stream peer=(label=snap.*), #aa:dbus own bus=session name=org.gnome.keyring #aa:dbus own bus=session name=org.freedesktop.{S,s}ecret{,s} - #aa:dbus own bus=session name=org.freedesktop.impl.portal.Secret + #aa:dbus own bus=session name=org.freedesktop.impl.portal.Secret path=/org/freedesktop/portal/desktop + #aa:dbus talk bus=session name=org.freedesktop.impl.portal.Request path=/org/freedesktop/portal/desktop/ label=xdg-desktop-portal dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gnome/gnome-session b/apparmor.d/groups/gnome/gnome-session index 7bcf80431..257e91c0a 100644 --- a/apparmor.d/groups/gnome/gnome-session +++ b/apparmor.d/groups/gnome/gnome-session @@ -16,6 +16,14 @@ profile gnome-session @{exec_path} { include include + signal receive set=term peer=gdm, + signal receive set=term peer=gdm-session, + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mrix, @{shells_path} rix, @@ -64,6 +72,8 @@ profile gnome-session @{exec_path} { owner @{HOME}/ r, + owner @{run}/user/@{uid}/gnome-session-leader-fifo rw, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 7344b735b..8278ac648 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -24,13 +24,13 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include include include include + include include include include @@ -72,6 +72,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus own bus=session name=org.gnome.Shell #aa:dbus own bus=session name=com.canonical.{U,u}nity + #aa:dbus own bus=session name=com.canonical.dbusmenu path=/{,com/canonical/dbusmenu} #aa:dbus own bus=session name=com.rastersoft.dingextension #aa:dbus own bus=session name=org.ayatana.NotificationItem #aa:dbus own bus=session name=org.freedesktop.a11y.Manager @@ -79,6 +80,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus own bus=session name=org.gtk.MountOperationHandler #aa:dbus own bus=session name=org.gtk.Notifications #aa:dbus own bus=session name=org.kde.StatusNotifierWatcher path=/StatusNotifierWatcher + #aa:dbus own bus=session name=com.canonical.Shell.PermissionPrompting # Talk with gnome-shell @@ -87,32 +89,19 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus talk bus=system name=org.freedesktop.ColorManager label="@{p_colord}" #aa:dbus talk bus=system name=org.freedesktop.login1 label="@{p_systemd_logind}" #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager + #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" #aa:dbus talk bus=system name=org.freedesktop.UPower.PowerProfiles label="@{p_power_profiles_daemon}" #aa:dbus talk bus=system name=org.gnome.DisplayManager label=gdm #aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding + #aa:dbus talk bus=session name=org.freedesktop.Notifications label=gjs #aa:dbus talk bus=session name=org.gnome.* label=gnome-* - #aa:dbus talk bus=session name=org.gnome.*.SearchProvider interface+=org.gnome.Shell.SearchProvider2 label="*" + #aa:dbus talk bus=session name=org.gnome.*.SearchProvider interface+=org.gnome.Shell.SearchProvider2 label=* #aa:dbus talk bus=session name=org.gnome.Nautilus label=nautilus #aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-* #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" - # System bus - - dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority - interface=org.freedesktop.PolicyKit1.Authority - member=RegisterAuthenticationAgent - peer=(name=:*, label="@{p_polkitd}"), - dbus receive bus=system path=/org/freedesktop/PolicyKit1/AuthenticationAgent - interface=org.freedesktop.PolicyKit1.AuthenticationAgent - member=BeginAuthentication - peer=(name=:*, label="@{p_polkitd}"), - - dbus send bus=system path=/org/freedesktop/NetworkManager/AgentManager - interface=org.freedesktop.NetworkManager.AgentManager - member={RegisterWithCapabilities,Unregister} - peer=(name=:*, label=NetworkManager), # Session bus @@ -156,7 +145,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { dbus send bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*), + peer=(name=@{busname}), dbus send bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect @@ -181,8 +170,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sh_path} rCx -> shell, @{bin}/pkexec rCx -> pkexec, - @{lib}/gio-launch-desktop rCx -> open, @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rCx -> open, + @{lib}/gio-launch-desktop rCx -> open, + @{python_path} rCx -> python, @{user_share_dirs}/gnome-shell/extensions/*/** rPUx, /usr/share/gnome-shell/extensions/*/** rPUx, @@ -278,15 +268,16 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/icc/edid-@{hex32}.icc rw, owner @{user_share_dirs}/icons/**/org.gnome.Shell.*.svg{,.@{rand6}} w, - owner @{user_share_dirs}/applications/org.gnome.Shell.*.desktop{,.@{rand6}} rw, owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-* r, owner @{user_cache_dirs}/gnome-boxes/*.png r, owner @{user_cache_dirs}/gnome-photos/{,**} r, owner @{user_cache_dirs}/gnome-screenshot/{,**} rw, owner @{user_cache_dirs}/gnome-software/icons/{,**} r, + owner @{user_cache_dirs}/gsconnect/@{hex32} r, owner @{user_cache_dirs}/libgweather/{,**} rw, owner @{user_cache_dirs}/media-art/{,**} r, owner @{user_cache_dirs}/vlc/**/*.jpg r, + owner @{user_share_dirs}/applications/org.gnome.Shell.*.desktop{,.@{rand6}} rw, @{run}/gdm{3,}/dbus/dbus-@{rand8} rw, owner @{run}/user/@{uid}/app/*/*.@{rand6} r, @@ -337,7 +328,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/class/net/ r, @{sys}/class/power_supply/ r, @{sys}/devices/@{pci}/boot_vga r, + @{sys}/devices/@{pci}/gpu_busy_percent r, @{sys}/devices/@{pci}/input@{int}/{properties,name} r, + @{sys}/devices/@{pci}/mem_info_vram_* r, @{sys}/devices/@{pci}/net/*/statistics/collisions r, @{sys}/devices/@{pci}/net/*/statistics/rx_{bytes,errors,packets} r, @{sys}/devices/@{pci}/net/*/statistics/tx_{bytes,errors,packets} r, @@ -351,6 +344,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/devices/**/power_supply/{,**} r, @{sys}/devices/platform/**/input@{int}/{properties,name} r, @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/net/*/statistics/collisions r, @{sys}/devices/virtual/net/*/statistics/rx_{bytes,errors,packets} r, @{sys}/devices/virtual/net/*/statistics/tx_{bytes,errors,packets} r, @@ -431,6 +426,15 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include if exists } + profile python { + include + include + + # /usr/share/gnome-shell/extensions/{,**} + + include if exists + } + profile open flags=(attach_disconnected,mediate_deleted,complain) { include include diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index baaac245f..247436318 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -45,6 +45,7 @@ profile gnome-software @{exec_path} { @{bin}/baobab rPUx, @{bin}/bwrap rPx -> flatpak-app, @{bin}/fusermount{,3} rCx -> fusermount, + @{bin}/gnome-control-center rPx, @{bin}/gpg{,2} rCx -> gpg, @{bin}/gpgconf rCx -> gpg, @{bin}/gpgsm rCx -> gpg, diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index 5c8ab7c8a..8aa950e2c 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -10,6 +10,7 @@ include profile gnome-text-editor @{exec_path} { include include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index 83fcbd7c6..35714fa0b 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -11,9 +11,9 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { include include include - include include include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 63ab49c5e..0f77b023e 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -40,16 +40,22 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Power #aa:dbus talk bus=session name=org.gnome.Mutter.DisplayConfig label=gnome-shell + #aa:dbus talk bus=session name=org.gnome.Shell.Brightness label=gnome-shell dbus send bus=system path=/org/freedesktop/UPower/KbdBacklight interface=org.freedesktop.UPower.KbdBacklight member=GetBrightness - peer=(name=:*, label="@{p_upowerd}"), + peer=(name=@{busname}, label="@{p_upowerd}"), dbus receive bus=session path=/org/gtk/Settings interface=org.freedesktop.DBus.Properties member=PropertiesChanged - peer=(name=:*, label=gsd-xsettings), + peer=(name=@{busname}, label=gsd-xsettings), + + dbus send bus=system path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager + member=Suspend + peer=(name=@{busname}, label="@{p_systemd_logind}"), @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index 59123f485..c5be27f27 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -30,7 +30,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { dbus receive bus=system path=/org/cups/cupsd/Notifier interface=org.cups.cupsd.Notifier - member={ServerStarted,PrinterDeleted,PrinterStopped} + member={ServerStarted,PrinterDeleted,PrinterStateChanged,PrinterStopped,PrinterAdded} peer=(name=@{busname}, label=cups-notifier-dbus), dbus receive bus=session diff --git a/apparmor.d/groups/gnome/gsd-sharing b/apparmor.d/groups/gnome/gsd-sharing index 7b47b0676..b6d90d5e3 100644 --- a/apparmor.d/groups/gnome/gsd-sharing +++ b/apparmor.d/groups/gnome/gsd-sharing @@ -31,6 +31,11 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) { member=Introspect peer=(name=:*, label=gnome-shell), + dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/3 + interface=org.freedesktop.NetworkManager.VPN.Connection + member=VpnStateChanged + peer=(name=@{busname}, label=NetworkManager), + @{exec_path} mr, /usr/share/dconf/profile/gdm r, diff --git a/apparmor.d/groups/gnome/gsd-usb-protection b/apparmor.d/groups/gnome/gsd-usb-protection index 7f03d9fc5..59e67d9bf 100644 --- a/apparmor.d/groups/gnome/gsd-usb-protection +++ b/apparmor.d/groups/gnome/gsd-usb-protection @@ -16,6 +16,11 @@ profile gsd-usb-protection @{exec_path} { #aa:dbus own bus=session name=org.gnome.SettingsDaemon.UsbProtection + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, include if exists diff --git a/apparmor.d/groups/gnome/kgx b/apparmor.d/groups/gnome/kgx index a32a3d8c3..f843d6c14 100644 --- a/apparmor.d/groups/gnome/kgx +++ b/apparmor.d/groups/gnome/kgx @@ -39,6 +39,7 @@ profile kgx @{exec_path} { @{PROC}/ r, @{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch index d5700db7c..c041cdf99 100644 --- a/apparmor.d/groups/gnome/localsearch +++ b/apparmor.d/groups/gnome/localsearch @@ -47,6 +47,8 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { /usr/share/osinfo/{,**} r, /usr/share/poppler/{,**} r, + /etc/fstab r, + # Allow to search user files owner @{HOME}/ r, owner @{HOME}/{,**} r, @@ -57,6 +59,11 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/tracker3/files/ rw, owner @{user_cache_dirs}/tracker3/files/** rwk, + owner @{GDM_HOME}/ r, + owner @{GDM_HOME}/*/ r, + owner @{gdm_cache_dirs}/tracker3/{,**} rwk, + owner @{gdm_config_dirs}/user-dirs.dirs r, + @{run}/mount/utab r, @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index ae225aa65..92e619e5c 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -29,6 +29,7 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { /usr/share/gdm/greeter-dconf-defaults r, owner @{GDM_HOME}/greeter-dconf-defaults r, + owner @{gdm_cache_dirs}//fontconfig/ rw, owner @{gdm_cache_dirs}/fontconfig/@{hex32}-*.cache-?{,.NEW,.LCK,.TMP-@{rand6}} rwl, owner @{gdm_config_dirs}/dconf/user r, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index d8e7c3341..a91a154a7 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -66,6 +66,15 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { member=NameHasOwner peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + dbus send bus=session + interface=org.freedesktop.Application + member=Open, + + dbus send bus=session path=/org/gnome/Nautilus + interface=org.gtk.Application + member={CommandLine,DescribeAll} + peer=(name=org.gnome.Nautilus, label=nautilus), + @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/gnome/papers b/apparmor.d/groups/gnome/papers index 0318c7265..6c4fe6f12 100644 --- a/apparmor.d/groups/gnome/papers +++ b/apparmor.d/groups/gnome/papers @@ -20,18 +20,27 @@ profile papers @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" + dbus send bus=session path=/org/freedesktop/portal/desktop/session/1_4509/gtk1155412026 + interface=org.freedesktop.portal.Session + member=Close + peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal), + @{exec_path} mr, @{open_path} Cx -> open, /usr/share/poppler/{,**} r, + /etc/passwd r, + owner @{user_share_dirs}/gvfs-metadata/{,*} r, owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk, owner @{HOME}/.mozilla/firefox/*/pkcs11.txt rw, owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db-journal rw, + /tmp/ r, + /var/tmp/ r, owner @{tmp}/.goutputstream-@{rand6} rw, owner @{tmp}/papers-@{int}/{,**} rw, owner @{tmp}/gtkprint_@{rand6} rw, diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis index b0239f404..ac47b5460 100644 --- a/apparmor.d/groups/gnome/ptyxis +++ b/apparmor.d/groups/gnome/ptyxis @@ -16,7 +16,7 @@ profile ptyxis @{exec_path} { unix type=stream peer=(label=ptyxis-agent), - #aa:dbus own bus=session name=org.gnome.Ptyxis + #aa:dbus own bus=session name=org.gnome.Ptyxis interface+=org.freedesktop.Application @{exec_path} mr, diff --git a/apparmor.d/groups/gnome/ptyxis-agent b/apparmor.d/groups/gnome/ptyxis-agent index 982afd90d..2735e0c5d 100644 --- a/apparmor.d/groups/gnome/ptyxis-agent +++ b/apparmor.d/groups/gnome/ptyxis-agent @@ -16,10 +16,12 @@ profile ptyxis-agent @{exec_path} { include include - signal send set=hup peer=unconfined, + signal send set=hup peer=@{p_systemd}, ptrace read, + unix type=stream peer=(label=ptyxis), + @{exec_path} mr, @{bin}/podman Px, @@ -42,8 +44,15 @@ profile ptyxis-agent @{exec_path} { unix bind type=stream addr=@@{udbus}/bus/systemd-run/, @{bin}/systemd-run mr, + + # The shell is not confined on purpose. @{bin}/@{shells} Ux, + # Some CLI program can be launched directly from Gnome Shell + @{bin}/htop Px, + @{bin}/micro PUx, + @{bin}/nvtop Px, + owner @{run}/user/@{uid}/systemd/private rw, include if exists diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index e8612f7b6..3f9f49281 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -13,6 +13,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -20,6 +21,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { include include include + include include network netlink raw, @@ -73,9 +75,6 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/media@{int} r, - /dev/video@{int} rw, - # file_inherit owner /dev/tty@{int} rw, diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index 6b358c8b0..7f7a3a8e4 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -15,11 +15,13 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { include include include + include include include include include include + include include include @@ -86,8 +88,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/media@{int} rw, - /dev/video@{int} rw, owner /dev/tty@{int} rw, include if exists diff --git a/apparmor.d/tunables/multiarch.d/system-users b/apparmor.d/tunables/multiarch.d/system-users index 1513aae2f..07450efff 100644 --- a/apparmor.d/tunables/multiarch.d/system-users +++ b/apparmor.d/tunables/multiarch.d/system-users @@ -5,7 +5,7 @@ # Define some extra paths for some commonly used system user # Full path of the GDM configuration directories -@{GDM_HOME}=/var/lib/gdm{,3}/ @{run}/gdm{,3}/home/{,gdm-}greeter/ +@{GDM_HOME}=/var/lib/gdm{,3}/ @{run}/gdm{,3}/{,home/}{,gdm-}greeter/ @{gdm_cache_dirs}=@{GDM_HOME}/.cache/ @{gdm_config_dirs}=@{GDM_HOME}/.config/ @{gdm_local_dirs}=@{GDM_HOME}/.local/ From 009fb9285d497eae14b08032b43f44e81c862823 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:05:34 +0200 Subject: [PATCH 1377/1455] feat(profile): update gvfsd profiles. --- apparmor.d/groups/gvfs/gvfsd-fuse | 12 ++++++++++-- apparmor.d/groups/gvfs/gvfsd-sftp | 20 +++++++++----------- apparmor.d/groups/gvfs/gvfsd-wsdd | 2 ++ 3 files changed, 21 insertions(+), 13 deletions(-) diff --git a/apparmor.d/groups/gvfs/gvfsd-fuse b/apparmor.d/groups/gvfs/gvfsd-fuse index 2695a1bf7..4741b0f31 100644 --- a/apparmor.d/groups/gvfs/gvfsd-fuse +++ b/apparmor.d/groups/gvfs/gvfsd-fuse @@ -23,17 +23,25 @@ profile gvfsd-fuse @{exec_path} { dbus send bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker member=RegisterFuse - peer=(name=:*, label=gvfsd), + peer=(name=@{busname}, label=gvfsd), dbus receive bus=session path=/ interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), + + dbus send bus=session path=/org/gtk/vfs/Daemon + interface=org.gtk.vfs.Daemon + member=GetConnection + peer=(name=@{busname}, label=gvfsd-sftp), @{exec_path} mr, @{bin}/fusermount{,3} rCx -> fusermount, + owner @{run}/user/@{uid}/gvfsd-fuse/ rw, + owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} w, + @{PROC}/sys/fs/pipe-max-size r, /dev/fuse rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-sftp b/apparmor.d/groups/gvfs/gvfsd-sftp index 76bb55e98..1019a1525 100644 --- a/apparmor.d/groups/gvfs/gvfsd-sftp +++ b/apparmor.d/groups/gvfs/gvfsd-sftp @@ -17,28 +17,26 @@ profile gvfsd-sftp @{exec_path} { include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} + #aa:dbus talk bus=session name=org.gtk.vfs.{M,m}ountTracker label=gvfsd dbus receive bus=session path=/org/gtk/vfs/Daemon interface=org.gtk.vfs.Daemon member=GetConnection - peer=(name=@{busname}, label=gnome-extension-gsconnect), - dbus receive bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name=@{busname}, label=nautilus), + peer=(name=@{busname}), dbus receive bus=session path=/org/gtk/vfs/mountable interface=org.gtk.vfs.Mountable member=Mount - peer=(name=:*, label=gvfsd), + peer=(name=@{busname}, label=gvfsd), dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} interface=org.gtk.vfs.Spawner member=Spawned - peer=(name=:*, label=gvfsd), - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=RegisterMount - peer=(name=:*, label=gvfsd), + peer=(name=@{busname}, label=gvfsd), + + dbus send bus=session path=/org/gtk/gvfs/mountop/@{int} + interface=org.gtk.vfs.MountOperation + member={AskQuestion,AskPassword} + peer=(name=@{busname}), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-wsdd b/apparmor.d/groups/gvfs/gvfsd-wsdd index 0dee4e73b..7f4c20718 100644 --- a/apparmor.d/groups/gvfs/gvfsd-wsdd +++ b/apparmor.d/groups/gvfs/gvfsd-wsdd @@ -15,6 +15,7 @@ profile gvfsd-wsdd @{exec_path} { include include + network inet dgram, # ip=127.0.0.1 peer=(ip=127.0.0.*, port=53), network netlink raw, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd @@ -47,6 +48,7 @@ profile gvfsd-wsdd @{exec_path} { @{bin}/env mr, @{bin}/wsdd rPx, + @{run}/avahi-daemon/socket rw, @{run}/mount/utab r, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, owner @{run}/user/@{uid}/gvfsd/wsdd rw, From fecb4dbca6645341359e367e80d70a5e222f13be Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:06:35 +0200 Subject: [PATCH 1378/1455] feat(profile): update flatpak profiles. --- apparmor.d/groups/flatpak/flatpak | 13 +++++++++++++ apparmor.d/groups/flatpak/flatpak-portal | 1 + apparmor.d/groups/flatpak/flatpak-session-helper | 5 +++++ apparmor.d/groups/flatpak/flatpak-system-helper | 1 + 4 files changed, 20 insertions(+) diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index e73408a0a..bd749db40 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -40,6 +40,9 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain signal send peer=flatpak-app, + unix type=seqpacket peer=(label=flatpak-system-helper), + unix type=stream peer=(label=flatpak//fusermount), + #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" #aa:dbus talk bus=system name=org.freedesktop.Flatpak.SystemHelper label=flatpak-system-helper #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" @@ -47,6 +50,16 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain #aa:dbus talk bus=session name=org.freedesktop.Flatpak.SessionHelper label=flatpak-session-helper #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal + dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member=ReloadConfig + peer=(name=org.freedesktop.DBus, label=dbus-session//&unconfined), + + dbus send bus=system path=/org/freedesktop/Flatpak/SystemHelper + interface=org.freedesktop.Flatpak.SystemHelper + member=GetRevokefsFd + peer=(name=org.freedesktop.Flatpak.SystemHelper), + @{exec_path} mr, @{bin}/bwrap rPx -> flatpak-app, diff --git a/apparmor.d/groups/flatpak/flatpak-portal b/apparmor.d/groups/flatpak/flatpak-portal index fdbdb9189..97f9f4911 100644 --- a/apparmor.d/groups/flatpak/flatpak-portal +++ b/apparmor.d/groups/flatpak/flatpak-portal @@ -11,6 +11,7 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { include include include + include include include diff --git a/apparmor.d/groups/flatpak/flatpak-session-helper b/apparmor.d/groups/flatpak/flatpak-session-helper index 162e3b448..8a8f5afb7 100644 --- a/apparmor.d/groups/flatpak/flatpak-session-helper +++ b/apparmor.d/groups/flatpak/flatpak-session-helper @@ -21,6 +21,11 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.Flatpak + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, @{shells_path} rUx -> user_unconfined, diff --git a/apparmor.d/groups/flatpak/flatpak-system-helper b/apparmor.d/groups/flatpak/flatpak-system-helper index cdfef1bad..0bd74bdcb 100644 --- a/apparmor.d/groups/flatpak/flatpak-system-helper +++ b/apparmor.d/groups/flatpak/flatpak-system-helper @@ -34,6 +34,7 @@ profile flatpak-system-helper @{exec_path} { unix type=seqpacket peer=(label=unconfined), #aa:dbus own bus=system name=org.freedesktop.Flatpak.SystemHelper + #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon @{exec_path} mr, From d0657d2c26644a386bc0078ec6f83ffebaa1a03e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:10:19 +0200 Subject: [PATCH 1379/1455] feat(profile): update network profiles. --- apparmor.d/groups/network/NetworkManager | 30 ++++++++++++++++++++++ apparmor.d/groups/network/netplan | 9 +++++++ apparmor.d/groups/network/netplan-generate | 2 ++ apparmor.d/groups/network/nmcli | 14 ++++++++++ apparmor.d/groups/network/openvpn | 2 ++ 5 files changed, 57 insertions(+) diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index f27449e77..2959441c4 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -48,6 +48,23 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher #aa:dbus talk bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" + + dbus receive bus=system path=/org/freedesktop + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name=@{busname}), + + dbus receive bus=system path=/org/freedesktop + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name=@{busname}, label=gnome-control-center), + + + dbus receive bus=system path=/org/freedesktop + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name=@{busname}, label=nm-online), + dbus send bus=system path=/org/freedesktop/nm_dispatcher interface=org.freedesktop.nm_dispatcher member=Action2 @@ -63,6 +80,11 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { member={InterfacesAdded,InterfacesRemoved} peer=(name=org.freedesktop.DBus), + dbus receive bus=system path=/ + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=cockpit-bridge), + @{exec_path} mr, @{sh_path} rix, @@ -84,9 +106,14 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{lib}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx, /usr/share/netplan/netplan.script rPx, + @{lib}/netplan/@{int2}-network-manager-all.yaml w, + /usr/share/gvfs/remote-volume-monitors/{,*.monitor} r, /usr/share/iproute2/{,**} r, + /etc/netplan/ r, + /etc/netplan/90-NM-@{uuid}.yaml r, + @{att}/ r, /etc/ r, @@ -110,7 +137,9 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { @{sys}/class/rfkill/ r, @{att}/@{run}/systemd/inhibit/@{int}.ref rw, + @{run}/systemd/resolve/io.systemd.Resolve rw, + @{run}/netplan/ r, @{run}/network/ifstate r, @{run}/NetworkManager/{,**} rw, @{run}/nm-*.pid rw, @@ -135,6 +164,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, + /dev/net/tun rw, /dev/rfkill rw, profile systemctl { diff --git a/apparmor.d/groups/network/netplan b/apparmor.d/groups/network/netplan index 5855131a8..a0fad0a93 100644 --- a/apparmor.d/groups/network/netplan +++ b/apparmor.d/groups/network/netplan @@ -9,9 +9,12 @@ include @{exec_path} = /usr/share/netplan/netplan.script profile netplan @{exec_path} flags=(attach_disconnected) { include + include include include + #aa;dbus owb bus=system name=io.netplan.Netplan + @{exec_path} mr, @{lib}/netplan/generate rPx, @@ -20,6 +23,8 @@ profile netplan @{exec_path} flags=(attach_disconnected) { /usr/share/netplan/{,**} r, + /etc/netplan/{,*} r, + @{run}/netplan/ r, profile udevadm { @@ -42,6 +47,10 @@ profile netplan @{exec_path} flags=(attach_disconnected) { capability net_admin, + ptrace read peer=@{p_systemd}, + + @{run}/udev/control rw, + include if exists } diff --git a/apparmor.d/groups/network/netplan-generate b/apparmor.d/groups/network/netplan-generate index 74ed20aaf..cea17b81c 100644 --- a/apparmor.d/groups/network/netplan-generate +++ b/apparmor.d/groups/network/netplan-generate @@ -26,6 +26,8 @@ profile netplan-generate @{exec_path} flags=(attach_disconnected) { @{run}/NetworkManager/conf.d/ rw, @{run}/NetworkManager/conf.d/@{int}-globally-managed-devices.conf rw, @{run}/NetworkManager/conf.d/@{int}-globally-managed-devices.conf.@{rand6} rw, + @{run}/NetworkManager/conf.d/netplan.conf rw, + @{run}/NetworkManager/conf.d/netplan.conf.@{rand6} rw, @{run}/NetworkManager/system-connections/ rw, @{run}/NetworkManager/system-connections/* rw, diff --git a/apparmor.d/groups/network/nmcli b/apparmor.d/groups/network/nmcli index 6065a12da..b4da14960 100644 --- a/apparmor.d/groups/network/nmcli +++ b/apparmor.d/groups/network/nmcli @@ -16,11 +16,25 @@ profile nmcli @{exec_path} { capability sys_nice, #aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager + dbus receive bus=system path=/org/freedesktop + interface=org.freedesktop.DBus.ObjectManager + member=InterfacesAdded + peer=(name=@{busname}, label=NetworkManager), + dbus receive bus=system path=/org/freedesktop + interface=org.freedesktop.DBus.ObjectManager + member=InterfacesRemoved + peer=(name=@{busname}, label=NetworkManager), + dbus send bus=system path=/org/freedesktop + interface=org.freedesktop.DBus.ObjectManager + member=GetManagedObjects + peer=(name=@{busname}, label=NetworkManager), @{exec_path} mr, @{pager_path} rPx -> child-pager, + /etc/netplan/* r, + owner @{HOME}/.nm-vpngate/*.ovpn r, owner @{HOME}/.cert/nm-openvpn/*.pem rw, diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index b5a6b83ef..2a513b84e 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -66,6 +66,8 @@ profile openvpn @{exec_path} flags=(attach_disconnected) { owner @{PROC}/@{pid}/net/route r, + /dev/net/tun rw, + profile update-resolv { include include From ff8efaecd209909a48bc7cd6677763fb4cd7e19b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:11:25 +0200 Subject: [PATCH 1380/1455] feat(profile): update arch profiles. --- apparmor.d/groups/pacman/pacdiff | 33 +++++++++++++------- apparmor.d/groups/pacman/pacman-hook-systemd | 2 ++ 2 files changed, 23 insertions(+), 12 deletions(-) diff --git a/apparmor.d/groups/pacman/pacdiff b/apparmor.d/groups/pacman/pacdiff index cab9eed4b..eef992666 100644 --- a/apparmor.d/groups/pacman/pacdiff +++ b/apparmor.d/groups/pacman/pacdiff @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/pacdiff profile pacdiff @{exec_path} flags=(attach_disconnected) { include - include capability dac_read_search, capability mknod, @@ -20,17 +19,18 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{sh_path} rix, - @{bin}/{m,g,}awk rix, - @{bin}/cat rix, - @{bin}/cmp rix, - @{bin}/find rix, - @{bin}/locate rix, - @{bin}/pacman rix, - @{bin}/pacman-conf rPx, - @{bin}/pacsort rix, - @{bin}/rm rix, - @{bin}/sed rix, - @{bin}/tput rix, + @{bin}/{m,g,}awk ix, + @{bin}/cat ix, + @{bin}/cmp ix, + @{bin}/find ix, + @{bin}/locate ix, + @{bin}/pacman ix, + @{bin}/pacman-conf Px, + @{bin}/pacsort ix, + @{bin}/rm ix, + @{bin}/sed ix, + @{bin}/tput ix, + @{editor_path} Cx -> editor, # packages files / r, @@ -44,6 +44,15 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) { /dev/tty rw, /dev/pts/@{int} rw, + profile editor { + include + include + + /etc/** rw, + + include if exists + } + include if exists } diff --git a/apparmor.d/groups/pacman/pacman-hook-systemd b/apparmor.d/groups/pacman/pacman-hook-systemd index 0878385c5..860fb34ea 100644 --- a/apparmor.d/groups/pacman/pacman-hook-systemd +++ b/apparmor.d/groups/pacman/pacman-hook-systemd @@ -46,6 +46,8 @@ profile pacman-hook-systemd @{exec_path} { capability net_admin, capability sys_resource, + ptrace read peer=@{p_systemd}, + signal send set=(cont, term) peer=systemd-tty-ask-password-agent, @{bin}/systemd-tty-ask-password-agent Px, From 98063fa7711c03f624a149227b2ef3672b866469 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:15:42 +0200 Subject: [PATCH 1381/1455] feat(profile): rewrite the pacman profile. --- apparmor.d/groups/pacman/pacman | 165 +++++++++++++++++++------------- 1 file changed, 100 insertions(+), 65 deletions(-) diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 427ac0141..41b45c9d0 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -46,71 +46,49 @@ profile pacman @{exec_path} flags=(attach_disconnected) { @{exec_path} mrix, - @{bin}/gpg{,2} rCx -> gpg, - @{bin}/gpgconf rCx -> gpg, - @{bin}/gpgsm rCx -> gpg, + # Pacman's keyring + @{bin}/gpg{,2} Cx -> gpg, + @{bin}/gpgconf Cx -> gpg, + @{bin}/gpgsm Cx -> gpg, - # Pacman hooks & install scripts - @{sh_path} rix, - @{coreutils_path} rix, - @{bin}/appstreamcli rPx, - @{bin}/arch-audit rPx, - @{bin}/archlinux-java rPx, - @{bin}/bootctl rPx, - @{bin}/cert-sync rPx, - @{bin}/checkrebuild rPUx, - @{bin}/dconf rPx, - @{bin}/dot rix, - @{bin}/fc-cache{,-32} rPx, - @{bin}/filecap rix, - @{bin}/gdbus rix, - @{bin}/gdk-pixbuf-query-loaders rPx, - @{bin}/getent rix, - @{bin}/gettext rix, - @{bin}/ghc-pkg-@{version} rPx, - @{bin}/gio-querymodules rPx, - @{bin}/glib-compile-schemas rPx, - @{sbin}/groupadd rPx, - @{bin}/gtk-query-immodules-* rPx, - @{bin}/gtk{,4}-update-icon-cache rPx, - @{sbin}/iconvconfig rix, - @{bin}/install-catalog rPx, - @{bin}/install-info rPx, - @{sbin}/iscsi-iname rix, - @{bin}/journalctl rPx, - @{bin}/killall rix, - @{sbin}/ldconfig rix, - @{sbin}/locale-gen rPx, - @{bin}/limine-install rPUx, - @{bin}/mkinitcpio rPx, - @{sbin}/needrestart rPx, - @{bin}/pacdiff rPx, - @{bin}/pacman-key rPx, - @{bin}/pkgfile rPUx, - @{bin}/pkill rix, - @{bin}/rsync rix, - @{bin}/sbctl rPx, - @{sbin}/setcap rix, - @{bin}/setfacl rix, - @{sbin}/sysctl rPx, - @{bin}/systemctl rCx -> systemctl, - @{bin}/systemd-* rPx, - @{bin}/tput rix, - @{bin}/update-ca-trust rPx, - @{bin}/update-desktop-database rPx, - @{sbin}/update-grub rPx, - @{bin}/update-mime-database rPx, - @{bin}/vercmp rix, - @{bin}/which{,.debianutils} rix, - @{bin}/xmlcatalog rix, - @{lib}/systemd/systemd-* rPx, - @{lib}/ghc-@{version}/bin/ghc-pkg-@{version} rPx, - @{lib}/vlc/vlc-cache-gen rPx, - /opt/Mullvad*/resources/mullvad-setup rPx, - /usr/share/code-features/patch.py rPx, - /usr/share/code-marketplace/patch.py rPx, - /usr/share/libalpm/scripts/* rPUx, - /usr/share/texmf-dist/scripts/texlive/mktexlsr rPUx, + # Common program found in hooks & install scripts + @{sh_path} rix, + @{coreutils_path} rix, + @{bin}/dot ix, + @{bin}/filecap ix, + @{bin}/getent ix, + @{bin}/gettext ix, + @{bin}/gzip ix, + @{bin}/rsync ix, + @{bin}/setfacl ix, + @{bin}/tput ix, + @{bin}/vercmp ix, + @{bin}/which{,.debianutils} ix, + @{bin}/xmlcatalog ix, + @{sbin}/iconvconfig ix, + @{sbin}/iscsi-iname ix, + @{sbin}/setcap ix, + + @{bin}/dbus-send Cx -> bus, + @{bin}/gdbus Cx -> bus, + @{bin}/killall Cx -> pkill, + @{bin}/kmod Cx -> kmod, + @{bin}/pkill Cx -> pkill, + @{bin}/systemctl Cx -> systemctl, + @{sbin}/ldconfig Cx -> ldconfig, + + #aa:lint ignore=too-wide + # Hooks & install scripts can legitimately start/restart anything + # PU is only used as a safety fallback. + @{bin}/** PUx, + @{sbin}/** PUx, + /opt/*/** PUx, + /etc/** PUx, + /usr/share/** PUx, + + @{lib}/ghc-@{version}/bin/ghc-pkg-@{version} Px, + @{lib}/systemd/systemd-* Px, + @{lib}/vlc/vlc-cache-gen Px, # For shell pwd, keept as it can annoy users to see error in pacman output /**/ r, @@ -196,6 +174,8 @@ profile pacman @{exec_path} flags=(attach_disconnected) { capability dac_read_search, capability sys_resource, + ptrace read peer=@{p_systemd}, + signal send set=cont peer=child-pager, signal send set=(cont term) peer=systemd-tty-ask-password-agent, signal receive set=(term winch) peer=makepkg//sudo, @@ -207,11 +187,66 @@ profile pacman @{exec_path} flags=(attach_disconnected) { /{run,var}/log/journal/ r, /{run,var}/log/journal/@{hex32}/ r, - /{run,var}/log/journal/@{hex32}/*.journal* r, + /{run,var}/log/journal/@{hex32}/system.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex}-@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* r, include if exists } + profile bus { + include + include + include + + @{bin}/gdbus rix, + + include if exists + } + + profile pkill { + include + include + + @{bin}/killall mr, + @{bin}/pkill mr, + + include if exists + } + + profile kmod { + include + include + + include if exists + } + + profile ldconfig { + include + include + + @{sh_path} rix, + @{sbin}/ldconfig mrix, + + @{lib}/ r, + /usr/local/ r, + /usr/local/lib/ r, + + /opt/cuda/**/@{lib}/ r, + /opt/cuda/**/@{lib}/@{multiarch}/ r, + + /etc/ld.so.cache rw, + /etc/ld.so.cache~ rw, + + /var/cache/ldconfig/ rw, + owner /var/cache/ldconfig/aux-cache* rw, + + include if exists + } + include if exists include if exists } From e549863d4adf82147f9c17763cfe367d5ebf746c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:20:27 +0200 Subject: [PATCH 1382/1455] feat(profile): update systemd profiles. --- .../systemd-generator-system-update | 3 ++- apparmor.d/groups/systemd/coredumpctl | 2 +- apparmor.d/groups/systemd/localectl | 2 +- apparmor.d/groups/systemd/systemd-detect-virt | 1 + apparmor.d/groups/systemd/systemd-dissect | 2 +- apparmor.d/groups/systemd/systemd-hostnamed | 2 ++ apparmor.d/groups/systemd/systemd-journald | 2 +- apparmor.d/groups/systemd/systemd-localed | 14 +++++++++++++- apparmor.d/groups/systemd/systemd-logind | 13 +++++++------ apparmor.d/groups/systemd/systemd-machine-id-setup | 2 +- apparmor.d/groups/systemd/systemd-rfkill | 1 + apparmor.d/groups/systemd/systemd-sleep-hdparm | 2 ++ apparmor.d/groups/systemd/systemd-sleep-sysstat | 3 +++ apparmor.d/groups/systemd/systemd-sleep-upgrades | 1 + apparmor.d/groups/systemd/systemd-timedated | 8 ++++++++ 15 files changed, 45 insertions(+), 13 deletions(-) diff --git a/apparmor.d/groups/systemd-generators/systemd-generator-system-update b/apparmor.d/groups/systemd-generators/systemd-generator-system-update index 557e4ab6e..9767a2e72 100644 --- a/apparmor.d/groups/systemd-generators/systemd-generator-system-update +++ b/apparmor.d/groups/systemd-generators/systemd-generator-system-update @@ -13,7 +13,8 @@ profile systemd-generator-system-update @{exec_path} flags=(attach_disconnected) @{exec_path} mr, - @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pids}/cgroup r, + @{PROC}/@{pids}/status r, include if exists } diff --git a/apparmor.d/groups/systemd/coredumpctl b/apparmor.d/groups/systemd/coredumpctl index d1ee1141c..06969ef47 100644 --- a/apparmor.d/groups/systemd/coredumpctl +++ b/apparmor.d/groups/systemd/coredumpctl @@ -68,7 +68,7 @@ profile coredumpctl @{exec_path} flags=(complain) { @{PROC}/@{pids}/fd/ r, - include if exists + include if exists } include if exists diff --git a/apparmor.d/groups/systemd/localectl b/apparmor.d/groups/systemd/localectl index 0d46dbfed..9792fb75f 100644 --- a/apparmor.d/groups/systemd/localectl +++ b/apparmor.d/groups/systemd/localectl @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{bin}/localectl -profile localectl @{exec_path} { +profile localectl @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/systemd/systemd-detect-virt b/apparmor.d/groups/systemd/systemd-detect-virt index ca6eae3ad..9b49c20fc 100644 --- a/apparmor.d/groups/systemd/systemd-detect-virt +++ b/apparmor.d/groups/systemd/systemd-detect-virt @@ -45,6 +45,7 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) { deny capability net_admin, deny capability perfmon, + deny network (send receive) netlink raw, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-dissect b/apparmor.d/groups/systemd/systemd-dissect index 0381b93b1..1bbb91858 100644 --- a/apparmor.d/groups/systemd/systemd-dissect +++ b/apparmor.d/groups/systemd/systemd-dissect @@ -27,7 +27,7 @@ profile systemd-dissect @{exec_path} flags=(attach_disconnected) { signal send set=cont peer=child-pager, - ptrace read peer=unconfined, + ptrace read peer=@{p_systemd}, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-hostnamed b/apparmor.d/groups/systemd/systemd-hostnamed index 01d04989b..8fae34b29 100644 --- a/apparmor.d/groups/systemd/systemd-hostnamed +++ b/apparmor.d/groups/systemd/systemd-hostnamed @@ -44,6 +44,8 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/dmi/id/board_vendor r, @{sys}/devices/virtual/dmi/id/chassis_type r, @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/product_serial r, + @{sys}/devices/virtual/dmi/id/product_uuid r, @{sys}/devices/virtual/dmi/id/product_version r, @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/dmi/id/uevent r, diff --git a/apparmor.d/groups/systemd/systemd-journald b/apparmor.d/groups/systemd/systemd-journald index 2765d8f10..e0a8a2e47 100644 --- a/apparmor.d/groups/systemd/systemd-journald +++ b/apparmor.d/groups/systemd/systemd-journald @@ -28,7 +28,7 @@ profile systemd-journald @{exec_path} flags=(attach_disconnected,mediate_deleted network netlink raw, - ptrace (read), + ptrace read, @{exec_path} mr, diff --git a/apparmor.d/groups/systemd/systemd-localed b/apparmor.d/groups/systemd/systemd-localed index e98bef009..cefab3890 100644 --- a/apparmor.d/groups/systemd/systemd-localed +++ b/apparmor.d/groups/systemd/systemd-localed @@ -24,18 +24,30 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, + @{bin}/cat ix, + @{bin}/gzip ix, + @{bin}/localedef ix, + @{bin}/rm ix, + @{bin}/sort ix, + @{sbin}/locale-gen rPx, + + /usr/share/i18n/{,**} r, /usr/share/kbd/keymaps/{,**} r, - /usr/share/xkeyboard-config-2/{,**} r, /usr/share/systemd/*-map r, /usr/share/X11/xkb/{,**} r, /usr/share/xkeyboard-config-2/{,**} r, + /etc/ r, /etc/.#locale.conf@{hex16} rw, + /etc/.#locale.gen@{hex16} rw, /etc/.#vconsole.conf* rw, /etc/default/.#locale* rw, /etc/default/keyboard r, /etc/default/locale rw, /etc/locale.conf rw, + /etc/locale.gen rw, + /etc/nsswitch.conf r, + /etc/passwd r, /etc/vconsole.conf rw, /etc/X11/xorg.conf.d/ rw, /etc/X11/xorg.conf.d/.#*.conf@{hex} rw, diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index 05c812b18..c5e87b3e2 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -124,12 +124,13 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{sys}/module/vt/parameters/default_utf8 r, @{sys}/power/{state,resume_offset,resume,disk} r, - @{PROC}/@{pid}/cgroup r, - @{PROC}/@{pid}/comm r, - @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/mountinfo r, - @{PROC}/@{pid}/sessionid r, - @{PROC}/@{pid}/stat r, + @{PROC}/@{pids}/cgroup r, + @{PROC}/@{pids}/comm r, + @{PROC}/@{pids}/fd/ r, + @{PROC}/@{pids}/mountinfo r, + @{PROC}/@{pids}/sessionid r, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, @{PROC}/1/cmdline r, @{PROC}/pressure/* r, @{PROC}/swaps r, diff --git a/apparmor.d/groups/systemd/systemd-machine-id-setup b/apparmor.d/groups/systemd/systemd-machine-id-setup index c791e6375..a2115a926 100644 --- a/apparmor.d/groups/systemd/systemd-machine-id-setup +++ b/apparmor.d/groups/systemd/systemd-machine-id-setup @@ -17,7 +17,7 @@ profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) { capability sys_admin, capability sys_chroot, - ptrace (read), + ptrace read, mount options=(rw rshared) -> /, mount options=(rw rslave) -> /, diff --git a/apparmor.d/groups/systemd/systemd-rfkill b/apparmor.d/groups/systemd/systemd-rfkill index bf983ea7a..34e7255ab 100644 --- a/apparmor.d/groups/systemd/systemd-rfkill +++ b/apparmor.d/groups/systemd/systemd-rfkill @@ -13,6 +13,7 @@ profile systemd-rfkill @{exec_path} flags=(attach_disconnected) { include capability net_admin, + capability sys_admin, capability sys_ptrace, network netlink raw, diff --git a/apparmor.d/groups/systemd/systemd-sleep-hdparm b/apparmor.d/groups/systemd/systemd-sleep-hdparm index 4cbe61755..5b9c51dbe 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-hdparm +++ b/apparmor.d/groups/systemd/systemd-sleep-hdparm @@ -13,6 +13,8 @@ profile systemd-sleep-hdparm @{exec_path} { @{exec_path} mr, @{sh_path} r, + @{lib}/pm-utils/power.d/*hdparm-apm ix, + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-sleep-sysstat b/apparmor.d/groups/systemd/systemd-sleep-sysstat index 94e2e8daf..e29a41a7a 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-sysstat +++ b/apparmor.d/groups/systemd/systemd-sleep-sysstat @@ -12,6 +12,9 @@ profile systemd-sleep-sysstat @{exec_path} { @{exec_path} mr, + @{lib}/sysstat/sa{1,2} Px, + @{lib}/sysstat/debian-sa{1,2} Px, + include if exists } diff --git a/apparmor.d/groups/systemd/systemd-sleep-upgrades b/apparmor.d/groups/systemd/systemd-sleep-upgrades index 4f2cce637..c2c107b1f 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-upgrades +++ b/apparmor.d/groups/systemd/systemd-sleep-upgrades @@ -11,6 +11,7 @@ profile systemd-sleep-upgrades @{exec_path} { include @{exec_path} mr, + @{sh_path} r, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-timedated b/apparmor.d/groups/systemd/systemd-timedated index ffed031b5..b65f2b7af 100644 --- a/apparmor.d/groups/systemd/systemd-timedated +++ b/apparmor.d/groups/systemd/systemd-timedated @@ -23,6 +23,14 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) { interface=org.freedesktop.DBus.Properties member=GetAll peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member={DisableUnitFiles,EnableUnitFiles} + peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), + dbus send bus=system path=/org/freedesktop/systemd1 + interface=org.freedesktop.systemd1.Manager + member={JobRemoved,Reload,StartUnit,StopUnit} + peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"), @{exec_path} mr, From 43175387474acabd2e877e78f709c13e9643e999 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:21:34 +0200 Subject: [PATCH 1383/1455] feat(profile): update ubuntu profiles. --- apparmor.d/groups/ubuntu/software-properties-dbus | 9 +++++++-- apparmor.d/groups/ubuntu/software-properties-gtk | 2 -- apparmor.d/groups/ubuntu/ubuntu-advantage | 3 ++- apparmor.d/groups/ubuntu/update-notifier | 13 +++++++++++++ 4 files changed, 22 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index 8d55ec0b7..cc7387709 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -19,11 +19,16 @@ profile software-properties-dbus @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), dbus receive bus=system interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=software-properties-gtk), + peer=(name=@{busname}, label=software-properties-gtk), + + dbus receive bus=system path=/ + interface=com.ubuntu.SoftwareProperties + member=Reload + peer=(name=@{busname}, label=software-properties-gtk), @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index af91c7eaa..cd858737b 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -44,12 +44,10 @@ profile software-properties-gtk @{exec_path} flags=(attach_disconnected) { /usr/share/pixmaps/ r, /usr/share/python-apt/{,**} r, /usr/share/software-properties/{,**} r, - /usr/share/themes/{,**} r, /usr/share/ubuntu-drivers-common/detect/{,**} r, /usr/share/X11/xkb/{,**} r, /usr/share/xml/iso-codes/{,**} r, /usr/share/software-properties/gtkbuilder/* r, - /usr/share/xkeyboard-config-2/{,**} r, /etc/apport/blacklist.d/{,*} r, /etc/default/apport r, diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index e8d847e92..ea9742d4c 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -60,9 +60,10 @@ profile ubuntu-advantage @{exec_path} { @{run}/ubuntu-advantage/{,**} rw, - @{PROC}/version_signature r, @{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/mounts r, + @{PROC}/1/cgroup r, + @{PROC}/version_signature r, owner @{PROC}/@{pid}/fd/ r, profile systemctl { diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 0de63ac64..4c60b4aaf 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -28,6 +28,11 @@ profile update-notifier @{exec_path} { #aa:dbus talk bus=system name=org.debian.apt label=apt #aa:dbus talk bus=session name=org.ayatana.NotificationItem interface+=org.kde.StatusNotifierItem label=gnome-shell + dbus receive bus=system path=/com/ubuntu/UnattendedUpgrade/Pending + interface=com.ubuntu.UnattendedUpgrade.Pending + member=Finished + peer=(name=@{busname}, label=unattended-upgrade), + @{exec_path} mr, @{sh_path} rix, @@ -49,6 +54,7 @@ profile update-notifier @{exec_path} { @{lib}/update-notifier/package-system-locked rPx, /usr/share/apport/apport-checkreports rPx, /usr/share/apport/apport-gtk rPx, + @{open_path} Cx -> open, @{lib}/@{python_name}/dist-packages/{apt,gi}/**/__pycache__/{,**} rw, @@ -95,6 +101,13 @@ profile update-notifier @{exec_path} { include if exists } + profile open { + include + include + + include if exists + } + include if exists } From c7b99bb84e9098e57a368c1a237838f11095116d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:26:31 +0200 Subject: [PATCH 1384/1455] feat(profile): update some core profiles. --- apparmor.d/profiles-g-l/kdump-config | 2 + apparmor.d/profiles-g-l/kdump-tools-init | 2 + apparmor.d/profiles-g-l/kdump_mem_estimator | 2 + apparmor.d/profiles-g-l/kernel-postinst-kdump | 8 +++- apparmor.d/profiles-g-l/logrotate | 2 + apparmor.d/profiles-m-r/initramfs-hooks | 6 ++- apparmor.d/profiles-m-r/mdadm | 1 + apparmor.d/profiles-m-r/mkinitramfs | 48 ++++++------------- apparmor.d/profiles-m-r/needrestart | 2 + apparmor.d/profiles-m-r/rsyslogd | 1 + 10 files changed, 37 insertions(+), 37 deletions(-) diff --git a/apparmor.d/profiles-g-l/kdump-config b/apparmor.d/profiles-g-l/kdump-config index 2bd8ef6b9..75c536612 100644 --- a/apparmor.d/profiles-g-l/kdump-config +++ b/apparmor.d/profiles-g-l/kdump-config @@ -72,6 +72,8 @@ profile kdump-config @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_ptrace, + ptrace read peer=@{p_systemd}, + include if exists } diff --git a/apparmor.d/profiles-g-l/kdump-tools-init b/apparmor.d/profiles-g-l/kdump-tools-init index b5af4dcc9..7767831a8 100644 --- a/apparmor.d/profiles-g-l/kdump-tools-init +++ b/apparmor.d/profiles-g-l/kdump-tools-init @@ -29,6 +29,8 @@ profile kdump-tools-init @{exec_path} flags=(attach_disconnected) { capability net_admin, + ptrace read peer=@{p_systemd}, + include if exists } diff --git a/apparmor.d/profiles-g-l/kdump_mem_estimator b/apparmor.d/profiles-g-l/kdump_mem_estimator index b80a89343..5f85af3fe 100644 --- a/apparmor.d/profiles-g-l/kdump_mem_estimator +++ b/apparmor.d/profiles-g-l/kdump_mem_estimator @@ -27,6 +27,8 @@ profile kdump_mem_estimator @{exec_path} { capability net_admin, + ptrace read peer=@{p_systemd}, + include if exists } diff --git a/apparmor.d/profiles-g-l/kernel-postinst-kdump b/apparmor.d/profiles-g-l/kernel-postinst-kdump index 50606695a..eb17c5355 100644 --- a/apparmor.d/profiles-g-l/kernel-postinst-kdump +++ b/apparmor.d/profiles-g-l/kernel-postinst-kdump @@ -31,8 +31,7 @@ profile kernel-postinst-kdump @{exec_path} { / r, - /etc/initramfs-tools/conf.d/{,**} r, - /etc/initramfs-tools/initramfs.conf r, + /etc/initramfs-tools/{,**} r, owner /var/lib/kdump/** rw, @@ -49,6 +48,11 @@ profile kernel-postinst-kdump @{exec_path} { include include + @{sys}/module/*/ r, + @{sys}/module/*/coresize r, + @{sys}/module/*/holders/ r, + @{sys}/module/*/refcnt r, + include if exists } diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate index 0dee9ed6a..781a01a27 100644 --- a/apparmor.d/profiles-g-l/logrotate +++ b/apparmor.d/profiles-g-l/logrotate @@ -80,6 +80,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected) { capability net_admin, capability sys_ptrace, + ptrace read peer=@{p_systemd}, + dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=KillUnit diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks index 136536764..89a57310f 100644 --- a/apparmor.d/profiles-m-r/initramfs-hooks +++ b/apparmor.d/profiles-m-r/initramfs-hooks @@ -10,6 +10,7 @@ include profile initramfs-hooks @{exec_path} { include include + include include @{exec_path} mr, @@ -37,9 +38,9 @@ profile initramfs-hooks @{exec_path} { @{lib}/ r, @{lib}/** mr, + /usr/share/*/initramfs/{,**} r, /usr/share/initramfs-tools/{,**} r, /usr/share/plymouth/{,**} r, - /usr/share/cryptsetup/initramfs/{,**} r, /etc/console-setup/{,**} r, /etc/cryptsetup-initramfs/{,**} r, @@ -81,8 +82,9 @@ profile initramfs-hooks @{exec_path} { include include - @{bin}/ldd mr, @{bin}/* mr, + @{sbin}/* mr, + @{lib}/@{multiarch}/ld-linux-*so* mrix, @{lib}/ld-linux.so* mr, diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm index 4cc5fc9fb..e40f6b1e3 100644 --- a/apparmor.d/profiles-m-r/mdadm +++ b/apparmor.d/profiles-m-r/mdadm @@ -12,6 +12,7 @@ profile mdadm @{exec_path} flags=(attach_disconnected) { include include + capability dac_read_search, capability sys_admin, mqueue (read getattr) type=posix /, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index c6caf364f..d94e5aa44 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -33,6 +33,7 @@ profile mkinitramfs @{exec_path} { @{bin}/cpio rix, @{bin}/dirname rix, @{bin}/env rix, + @{bin}/find rix, @{bin}/getopt rix, @{bin}/gzip rix, @{bin}/id rix, @@ -56,10 +57,9 @@ profile mkinitramfs @{exec_path} { @{bin}/xargs rix, @{bin}/xz rix, @{bin}/zstd rix, - @{sbin}/blkid rPx, @{lib}/dracut/dracut-install rix, + @{sbin}/blkid rPx, - @{bin}/find rCx -> find, @{bin}/kmod rCx -> kmod, @{sbin}/ldconfig rCx -> ldconfig, @{bin}/ldd rCx -> ldd, @@ -113,11 +113,16 @@ profile mkinitramfs @{exec_path} { @{sys}/bus/ r, @{sys}/bus/*/drivers/ r, - @{sys}/devices/platform/ r, - @{sys}/devices/platform/**/ r, - @{sys}/devices/platform/**/modalias r, + @{sys}/devices/ r, + @{sys}/devices/**/ r, + @{sys}/devices/**/modalias r, + @{sys}/devices/**/uevent r, @{sys}/module/compression r, @{sys}/module/firmware_class/parameters/path r, + @{sys}/class/ r, + @{sys}/class/*/ r, + + @{sys}/bus/platform/drivers/simple-framebuffer/ r, @{PROC}/@{pid}/mounts r, @{PROC}/cmdline r, @@ -129,17 +134,14 @@ profile mkinitramfs @{exec_path} { include include - @{bin}/ldd mr, - @{lib}/@{multiarch}/ld-linux-*so* mr, - @{lib}/ld-linux.so* mr, - - @{sh_path} rix, - @{bin}/kmod mr, - @{lib}/initramfs-tools/bin/* mr, - + @{sh_path} rix, @{lib}/@{multiarch}/ld-*.so* rix, @{lib}/ld-*.so{,.2} rix, + @{bin}/* mr, + @{sbin}/* mr, + @{lib}/** mr, + include if exists } @@ -160,26 +162,6 @@ profile mkinitramfs @{exec_path} { include if exists } - profile find { - include - include - - @{bin}/find mr, - - # pwd dir - / r, - /etc/ r, - /root/ r, - - /usr/share/initramfs-tools/scripts/{,**/} r, - /etc/initramfs-tools/scripts/{,**/} r, - - owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/{,**/} r, - owner /var/tmp/mkinitramfs_@{rand6}/{,**/} r, - - include if exists - } - profile kmod { include include diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index 8c908ddb4..c55393753 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -59,7 +59,9 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/environ r, + @{PROC}/@{pid}/maps r, @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/status r, owner @{PROC}/@{pid}/fd/ r, /dev/ r, diff --git a/apparmor.d/profiles-m-r/rsyslogd b/apparmor.d/profiles-m-r/rsyslogd index ede981f58..c5e5ac051 100644 --- a/apparmor.d/profiles-m-r/rsyslogd +++ b/apparmor.d/profiles-m-r/rsyslogd @@ -45,6 +45,7 @@ profile rsyslogd @{exec_path} { @{PROC}/cmdline r, @{PROC}/kmsg r, @{PROC}/sys/kernel/osrelease r, + @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, include if exists } From 1b97efa21595f170d2a9466b91f2ee8a611f5d0e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:27:15 +0200 Subject: [PATCH 1385/1455] feat(abs): add org.gtk.Menus. --- .../abstractions/bus/session/org.gtk.Menus | 18 ++++++++++++++++++ apparmor.d/abstractions/gtk.d/complete | 1 + 2 files changed, 19 insertions(+) create mode 100644 apparmor.d/abstractions/bus/session/org.gtk.Menus diff --git a/apparmor.d/abstractions/bus/session/org.gtk.Menus b/apparmor.d/abstractions/bus/session/org.gtk.Menus new file mode 100644 index 000000000..b21c08067 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.gtk.Menus @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus receive bus=session + interface=org.gtk.Menus + member={Start,End} + peer=(name=@{busname}), + + dbus send bus=session + interface=org.gtk.Menus + member=Changed, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/gtk.d/complete b/apparmor.d/abstractions/gtk.d/complete index 356e97705..0b69d8ee1 100644 --- a/apparmor.d/abstractions/gtk.d/complete +++ b/apparmor.d/abstractions/gtk.d/complete @@ -3,6 +3,7 @@ # SPDX-License-Identifier: GPL-2.0-only include + include include @{lib}/{,@{multiarch}/}gtk*/** mr, From 17eac0b62c0ee7dccb0c0c3642b41ce2df238aa7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:30:02 +0200 Subject: [PATCH 1386/1455] feat(abs): add missing dbus rule on org.freedesktop.DBus --- apparmor.d/groups/bus/dbus-session | 6 +++--- apparmor.d/groups/bus/dbus-system | 6 ++++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/bus/dbus-session b/apparmor.d/groups/bus/dbus-session index cc6b33f61..27e228e2c 100644 --- a/apparmor.d/groups/bus/dbus-session +++ b/apparmor.d/groups/bus/dbus-session @@ -31,10 +31,10 @@ profile dbus-session flags=(attach_disconnected) { signal (send) set=(term hup kill) peer=xdg-*, #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/{dBus,DBus,dbus}} - dbus receive bus=session path=/org/freedesktop/DBus + dbus receive bus=session interface=org.freedesktop.DBus - member=Hello - peer=(name=@{busname}), + member={GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials} + peer=(name="{@{busname},org.freedesktop.DBus}"), @{exec_path} mrix, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index 4dec1d407..235c44cd4 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -36,8 +36,8 @@ profile dbus-system flags=(attach_disconnected) { #aa:dbus own bus=system name=org.freedesktop.DBus path=/{,org/freedesktop/DBus} dbus receive bus=system path=/org/freedesktop/DBus interface=org.freedesktop.DBus - member=Hello - peer=(name=@{busname}), + member={GetConnectionUnixProcessID,GetConnectionUnixUser,GetConnectionCredentials} + peer=(name="{@{busname},org.freedesktop.DBus}"), dbus receive bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Activator @@ -82,6 +82,7 @@ profile dbus-system flags=(attach_disconnected) { @{PROC}/@{pid}/environ r, @{PROC}/@{pid}/mounts r, @{PROC}/@{pid}/oom_score_adj r, + @{PROC}/@{pid}/status r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, owner @{PROC}/@{pid}/fd/ r, @@ -91,6 +92,7 @@ profile dbus-system flags=(attach_disconnected) { @{att}/dev/dri/card@{int} rw, @{att}/dev/input/event@{int} rw, + @{att}/dev/pts/ptmx rw, include if exists } From d32fd036503bd197d649ba85657eaf079854b2c1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:30:30 +0200 Subject: [PATCH 1387/1455] feat(profile): improve ibus-portal. --- apparmor.d/groups/bus/ibus-portal | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/bus/ibus-portal b/apparmor.d/groups/bus/ibus-portal index 53edb4b00..6ea4891a7 100644 --- a/apparmor.d/groups/bus/ibus-portal +++ b/apparmor.d/groups/bus/ibus-portal @@ -15,11 +15,12 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) { signal (receive) set=(term, hup) peer=gdm*, #aa:dbus own bus=session name=org.freedesktop.portal.IBus + #aa:dbus own bus=session name=org.freedesktop.IBus dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, From c7e999fe30e5cb43e61cdca01eea3e18fa5fb0c7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:32:29 +0200 Subject: [PATCH 1388/1455] feat(profile): update freedesktop profiles. --- apparmor.d/groups/freedesktop/pulseaudio | 2 +- apparmor.d/groups/freedesktop/wireplumber | 2 ++ apparmor.d/groups/freedesktop/xdg-dbus-proxy | 3 +++ apparmor.d/groups/freedesktop/xdg-desktop-portal | 2 ++ .../groups/freedesktop/xdg-desktop-portal-gnome | 10 +++++----- apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk | 12 +++--------- apparmor.d/groups/freedesktop/xdg-settings | 2 +- apparmor.d/groups/freedesktop/xorg | 3 ++- 8 files changed, 19 insertions(+), 17 deletions(-) diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 5c7c49c3d..ce1dffd58 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -21,9 +21,9 @@ profile pulseaudio @{exec_path} { include include include + include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index aa78d9667..84d6675de 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -27,6 +27,7 @@ profile wireplumber @{exec_path} { network netlink raw, #aa:dbus own bus=session name=org.freedesktop.ReserveDevice1.Audio@{int} + #aa:dbus own bus=session name=org.pipewire.Telephony dbus receive bus=session interface=org.freedesktop.DBus.Introspectable @@ -77,6 +78,7 @@ profile wireplumber @{exec_path} { @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node@{int}/meminfo r, @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/board_vendor r, @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index be66f7484..c1f255c75 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -21,6 +21,9 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { network unix stream, + #aa:dbus talk bus=session name=org.freedesktop.portal.Flatpak label=flatpak-portal + #aa:dbus talk bus=session name=org.freedesktop.portal.Request path=/org/freedesktop/portal/desktop label=xdg-desktop-portal + dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.portal.Realtime member=MakeThread* diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 21c99827b..ec2cc86be 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -52,6 +52,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor + #aa:dbus talk bus=session name=org.freedesktop.impl.portal.Inhibit label=xdg-desktop-portal-gtk #aa:dbus talk bus=session name=org.freedesktop.FileManager1 label=nautilus #aa:dbus talk bus=session name=org.freedesktop.impl.portal.FileChooser label=xdg-desktop-portal-gnome #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal @@ -101,6 +102,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { @{sys}/devices/virtual/dmi/id/sys_vendor r, @{PROC}/ r, + @{PROC}/@{pids}/status r, @{PROC}/*/ r, @{PROC}/1/cgroup r, @{PROC}/cmdline r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index ca5f62f82..b6c77f336 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -16,6 +16,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -24,6 +25,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include include include + include include network unix stream, @@ -36,17 +38,13 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell #aa:dbus talk bus=session name=org.gnome.Settings.GlobalShortcutsProvider label=gnome-control-center-global-shortcuts-provider #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell + #aa:dbus talk bus=session name=org.gtk.Private.RemoteVolumeMonitor label="gvfs-*-volume-monitor" dbus send bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.impl.portal.Background member=RunningApplicationsChanged peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal), - dbus send bus=session path=/org/gtk/Notifications - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=:*, label=gnome-shell), - dbus send bus=session path=/org/gnome/Shell interface=org.freedesktop.DBus.Properties member=GetAll @@ -85,6 +83,8 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { owner @{tmp}/gtkprint@{rand6} r, owner @{tmp}/xdg-desktop-portal-gnome@{rand6} rw, + owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, + @{run}/mount/utab r, owner @{PROC}/@{pid}/ r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index 92e6c9484..9688df798 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -35,18 +35,12 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { #aa:dbus own bus=session name=org.freedesktop.impl.portal.desktop.gtk + #aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs + #aa:dbus talk bus=session name=org.freedesktop.impl.portal.Settings label=xdg-desktop-portal + dbus receive bus=session path=/org/freedesktop/portal/desktop interface=org.freedesktop.impl.portal.Settings peer=(name=:*), - dbus send bus=session path=/org/freedesktop/portal/desktop - interface=org.freedesktop.impl.portal.Settings - member=SettingChanged - peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal), - - dbus send bus=session path=/org/gtk/Notifications - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=:*, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index 840500c52..fd05bcee9 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -15,7 +15,7 @@ profile xdg-settings @{exec_path} flags=(attach_disconnected) { @{exec_path} r, - @{sh_path} r, + @{sh_path} mr, @{bin}/{,e}grep rix, @{bin}/basename rix, @{bin}/cat ix, diff --git a/apparmor.d/groups/freedesktop/xorg b/apparmor.d/groups/freedesktop/xorg index c14af6d6e..bfec4405c 100644 --- a/apparmor.d/groups/freedesktop/xorg +++ b/apparmor.d/groups/freedesktop/xorg @@ -133,8 +133,9 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{PROC}/ioports r, @{PROC}/mtrr rw, + /dev/ r, /dev/fb@{int} rw, - /dev/input/event@{int} rw, + @{att}/dev/input/event@{int} rw, /dev/input/mouse@{int} rw, /dev/shm/#@{int} rw, /dev/shm/shmfd-* rw, From 4d7e03a9e2f743fc32661c1741ce50f0d99cddd6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:34:44 +0200 Subject: [PATCH 1389/1455] feat(profile): add missing grep to locale-gen. --- apparmor.d/groups/utils/locale-gen | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/utils/locale-gen b/apparmor.d/groups/utils/locale-gen index 3620018a7..5366f1403 100644 --- a/apparmor.d/groups/utils/locale-gen +++ b/apparmor.d/groups/utils/locale-gen @@ -18,6 +18,7 @@ profile locale-gen @{exec_path} { @{exec_path} mr, @{sh_path} rix, + @{bin}/{e,}grep rix, @{bin}/cat rix, @{bin}/gzip rix, @{bin}/localedef rix, From e5012e381efa8eefb028f661606aa159e0cd46a1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:39:13 +0200 Subject: [PATCH 1390/1455] chore: pids means all pid. --- apparmor.d/groups/_full/sd | 39 +++++++++++++++-------------- apparmor.d/groups/bus/dbus-system | 12 ++++----- apparmor.d/profiles-m-r/needrestart | 12 ++++----- 3 files changed, 32 insertions(+), 31 deletions(-) diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd index 13864f2dd..ccdbf338b 100644 --- a/apparmor.d/groups/_full/sd +++ b/apparmor.d/groups/_full/sd @@ -195,25 +195,26 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) { @{sys}/firmware/efi/efivars/** w, @{sys}/fs/cgroup/{,**} w, - @{PROC}/@{pid}/attr/apparmor/exec w, - @{PROC}/@{pid}/attr/current r, - @{PROC}/@{pid}/cgroup r, - @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pid}/comm r, - @{PROC}/@{pid}/environ r, - @{PROC}/@{pid}/fd/ r, - @{PROC}/@{pid}/fdinfo/@{int} r, - @{PROC}/@{pid}/gid_map w, - @{PROC}/@{pid}/limits r, - @{PROC}/@{pid}/loginuid rw, - @{PROC}/@{pid}/mountinfo r, - @{PROC}/@{pid}/oom_score_adj rw, - @{PROC}/@{pid}/sessionid r, - @{PROC}/@{pid}/setgroups r, - @{PROC}/@{pid}/setgroups w, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/uid_map r, - @{PROC}/@{pid}/uid_map w, + @{PROC}/@{pids}/attr/apparmor/exec w, + @{PROC}/@{pids}/attr/current r, + @{PROC}/@{pids}/cgroup r, + @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/comm r, + @{PROC}/@{pids}/environ r, + @{PROC}/@{pids}/fd/ r, + @{PROC}/@{pids}/fdinfo/@{int} r, + @{PROC}/@{pids}/gid_map w, + @{PROC}/@{pids}/limits r, + @{PROC}/@{pids}/loginuid rw, + @{PROC}/@{pids}/mountinfo r, + @{PROC}/@{pids}/oom_score_adj rw, + @{PROC}/@{pids}/sessionid r, + @{PROC}/@{pids}/setgroups r, + @{PROC}/@{pids}/setgroups w, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, + @{PROC}/@{pids}/uid_map r, + @{PROC}/@{pids}/uid_map w, @{PROC}/cmdline r, @{PROC}/interrupts r, @{PROC}/irq/@{int}/node r, diff --git a/apparmor.d/groups/bus/dbus-system b/apparmor.d/groups/bus/dbus-system index 235c44cd4..1b62a1086 100644 --- a/apparmor.d/groups/bus/dbus-system +++ b/apparmor.d/groups/bus/dbus-system @@ -77,12 +77,12 @@ profile dbus-system flags=(attach_disconnected) { @{sys}/kernel/security/apparmor/features/dbus/mask r, @{sys}/module/apparmor/parameters/enabled r, - @{PROC}/@{pid}/attr/apparmor/current r, - @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pid}/environ r, - @{PROC}/@{pid}/mounts r, - @{PROC}/@{pid}/oom_score_adj r, - @{PROC}/@{pid}/status r, + @{PROC}/@{pids}/attr/apparmor/current r, + @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/environ r, + @{PROC}/@{pids}/mounts r, + @{PROC}/@{pids}/oom_score_adj r, + @{PROC}/@{pids}/status r, @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart index c55393753..a09008ac3 100644 --- a/apparmor.d/profiles-m-r/needrestart +++ b/apparmor.d/profiles-m-r/needrestart @@ -56,12 +56,12 @@ profile needrestart @{exec_path} flags=(attach_disconnected) { /tmp/@{word10}/ rw, @{PROC}/ r, - @{PROC}/@{pid}/cgroup r, - @{PROC}/@{pid}/cmdline r, - @{PROC}/@{pid}/environ r, - @{PROC}/@{pid}/maps r, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/status r, + @{PROC}/@{pids}/cgroup r, + @{PROC}/@{pids}/cmdline r, + @{PROC}/@{pids}/environ r, + @{PROC}/@{pids}/maps r, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/status r, owner @{PROC}/@{pid}/fd/ r, /dev/ r, From 69fcef01b7b5d9003f902512be3d7c2543da5ce8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:50:23 +0200 Subject: [PATCH 1391/1455] feat(profile): add a large profile for mkosi. --- apparmor.d/profiles-m-r/mkosi | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 apparmor.d/profiles-m-r/mkosi diff --git a/apparmor.d/profiles-m-r/mkosi b/apparmor.d/profiles-m-r/mkosi new file mode 100644 index 000000000..f6489a501 --- /dev/null +++ b/apparmor.d/profiles-m-r/mkosi @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# This profile is large on purpose: +# - It is required to have a profile for mkosi to allow userns. +# - Mkosi uses a lot of different binaries and scripts inside sandbox. +# - Using the unconfined flag would Pix everything, we do not want that as the +# transitioned profile would have to account for mkosi paths too. + +abi , + +include + +@{exec_path} = @{bin}/mkosi @{user_share_dirs}/pipx/venvs/*/bin/mkosi +profile mkosi @{exec_path} flags=(attach_disconnected,mediate_deleted) { + include + + all, + userns, + + include if exists +} + +# vim:syntax=apparmor From e09251d2669a0161aef2eb75e5d92c1c74a86f56 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:53:00 +0200 Subject: [PATCH 1392/1455] feat(abs): update org.freedesktop.PolicyKit1 --- .../abstractions/bus/org.freedesktop.PolicyKit1 | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 index 9dfab7481..2a4e8c1e5 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 +++ b/apparmor.d/abstractions/bus/org.freedesktop.PolicyKit1 @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Can talk to polkitd's CheckAuthorization API + abi , #aa:dbus common bus=system name=org.freedesktop.PolicyKit1 label="@{p_polkitd}" @@ -13,17 +15,13 @@ dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority - member=CheckAuthorization - peer=(name=org.freedesktop.PolicyKit1, label="@{p_polkitd}"), + member={CheckAuthorization,CancelCheckAuthorization} + peer=(name="{@{busname},org.freedesktop.PolicyKit1}", label="@{p_polkitd}"), dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority interface=org.freedesktop.PolicyKit1.Authority - member=CheckAuthorization - peer=(name="@{busname}", label="@{p_polkitd}"), - dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority - interface=org.freedesktop.PolicyKit1.Authority - member=CheckAuthorization - peer=(name=org.freedesktop.PolicyKit1), + member=RegisterAuthenticationAgentWithOptions + peer=(name="{@{busname},org.freedesktop.PolicyKit1}", label="@{p_polkitd}"), include if exists From fce5de8d198df15219422e0b6867609a3f3ee85d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:55:29 +0200 Subject: [PATCH 1393/1455] feat(abs): update org.freedesktop.PackageKit --- .../abstractions/bus/org.freedesktop.PackageKit | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.PackageKit b/apparmor.d/abstractions/bus/org.freedesktop.PackageKit index f6cde2030..a4f9ba9b9 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.PackageKit +++ b/apparmor.d/abstractions/bus/org.freedesktop.PackageKit @@ -2,6 +2,9 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Allow communication with PackageKit transactions. Transactions are exported +# with random object paths that currently take the form /@{int}_@{hex8}. + abi , #aa:dbus common bus=system name=org.freedesktop.PackageKit label=packagekitd @@ -16,6 +19,14 @@ member=StateHasChanged peer=(name=org.freedesktop.PackageKit), + dbus send bus=system path=/@{int}_@{hex8} + interface=org.freedesktop.PackageKit.Transaction + peer=(label=packagekitd), + + dbus receive bus=system path=/@{int}_@{hex8} + interface=org.freedesktop.PackageKit.Transaction + peer=(label=packagekitd), + include if exists # vim:syntax=apparmor From 93c94836e292a2e4b39cea261e6891e30b74d6a6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:56:14 +0200 Subject: [PATCH 1394/1455] feat(abs): add snapcraft dbus reference call. --- .../bus/session/io.snapcraft.Launcher | 21 +++++++++++++++++++ .../io.snapcraft.PrivilegedDesktopLauncher | 16 ++++++++++++++ .../bus/session/io.snapcraft.Settings | 16 ++++++++++++++ 3 files changed, 53 insertions(+) create mode 100644 apparmor.d/abstractions/bus/session/io.snapcraft.Launcher create mode 100644 apparmor.d/abstractions/bus/session/io.snapcraft.PrivilegedDesktopLauncher create mode 100644 apparmor.d/abstractions/bus/session/io.snapcraft.Settings diff --git a/apparmor.d/abstractions/bus/session/io.snapcraft.Launcher b/apparmor.d/abstractions/bus/session/io.snapcraft.Launcher new file mode 100644 index 000000000..ca2bf92c8 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/io.snapcraft.Launcher @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow use of snapd's internal xdg-open + + abi , + + dbus send bus=session path=/ + interface=com.canonical.SafeLauncher + member=OpenURL + peer=(name=@{busname}, label=snap), + + dbus send bus=session path=/io/snapcraft/Launcher + interface=io.snapcraft.Launcher + member={OpenURL,OpenFile} + peer=(name=@{busname}, label=snap), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/io.snapcraft.PrivilegedDesktopLauncher b/apparmor.d/abstractions/bus/session/io.snapcraft.PrivilegedDesktopLauncher new file mode 100644 index 000000000..704d9010d --- /dev/null +++ b/apparmor.d/abstractions/bus/session/io.snapcraft.PrivilegedDesktopLauncher @@ -0,0 +1,16 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Can identify and launch other snaps. + + abi , + + dbus send bus=session path=/io/snapcraft/PrivilegedDesktopLauncher + interface=io.snapcraft.PrivilegedDesktopLauncher + member=OpenDesktopEntry + peer=(name=io.snapcraft.Launcher, label=snap), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/io.snapcraft.Settings b/apparmor.d/abstractions/bus/session/io.snapcraft.Settings new file mode 100644 index 000000000..c50753cd6 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/io.snapcraft.Settings @@ -0,0 +1,16 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow use of snapd's internal 'xdg-settings' + + abi , + + dbus send bus=session path=/io/snapcraft/Settings + interface=io.snapcraft.Settings + member={Check,CheckSub,Get,GetSub,Set,SetSub} + peer=(name=io.snapcraft.Settings, label=snap), + + include if exists + +# vim:syntax=apparmor From 8f0ee240007ba41dee39f721bc22fff6163171ba Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:57:10 +0200 Subject: [PATCH 1395/1455] feat(abs): add org.gtk.vfs.MountOperation --- .../bus/session/org.gtk.vfs.MountOperation | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation diff --git a/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation b/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation new file mode 100644 index 000000000..ff8c928f8 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus receive bus=session path=/org/gtk/gvfs/mountop/@{int} + interface=org.gtk.vfs.MountOperation + member={AskQuestion,AskPassword} + peer=(name=@{busname}, label=gvfsd-*), + + include if exists + +# vim:syntax=apparmor From 76c5586688218983fe9203fd894e8cc794a895e2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:58:11 +0200 Subject: [PATCH 1396/1455] feat(abs): add org.freedesktop.IBus.Portal --- .../bus/session/org.freedesktop.IBus.Portal | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 apparmor.d/abstractions/bus/session/org.freedesktop.IBus.Portal diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.IBus.Portal b/apparmor.d/abstractions/bus/session/org.freedesktop.IBus.Portal new file mode 100644 index 000000000..e7c0f9cef --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.freedesktop.IBus.Portal @@ -0,0 +1,24 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow access to the IBus portal + + abi , + + dbus send bus=session path=/org/freedesktop/IBus + interface=org.freedesktop.IBus.Portal + member=CreateInputContext + peer=(name=org.freedesktop.portal.IBus), + + dbus send bus=session path=/org/freedesktop/IBus/InputContext_@{int} + interface=org.freedesktop.IBus.InputContext + peer=(label=ibus-daemon), + + dbus receive bus=session path=/org/freedesktop/IBus/InputContext_@{int} + interface=org.freedesktop.IBus.InputContext + peer=(label=ibus-daemon), + + include if exists + +# vim:syntax=apparmor From 865bac4cc6a2c7d79a37503b5d02985655a29532 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Thu, 11 Sep 2025 23:59:07 +0200 Subject: [PATCH 1397/1455] feat(abs): update org.freedesktop.ColorManager. --- apparmor.d/abstractions/bus/org.freedesktop.ColorManager | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager index e23092429..13d186898 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager @@ -16,17 +16,17 @@ dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member=CreateDevice - peer=(name="@{busname}", label="@{p_colord}"), + peer=(name="@{busname},org.freedesktop.ColorManager", label="@{p_colord}"), dbus receive bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member={DeviceAdded,DeviceRemoved} - peer=(name="@{busname}", label="@{p_colord}"), + peer=(name="@{busname},org.freedesktop.ColorManager", label="@{p_colord}"), dbus (receive, send) bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager - member=FindDeviceByProperty - peer=(name="@{busname}", label="@{p_colord}"), + member={FindDeviceByProperty,FindDeviceById} + peer=(name="@{busname},org.freedesktop.ColorManager", label="@{p_colord}"), include if exists From 0c90adb24d81bab5f241c853be367e62f8fea01f Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 11 Sep 2025 17:04:37 -0600 Subject: [PATCH 1398/1455] Update mdadm There were lots of missing components of mdadm. I have a few scripts that create and tear down MD RAID arrays. I've ran them all and added the missing entries. Note that mdadm has the ability to run in daemon mode and send mail when an array fails. That's why it requires all the network entries. --- apparmor.d/profiles-m-r/mdadm | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm index e40f6b1e3..94a178ce7 100644 --- a/apparmor.d/profiles-m-r/mdadm +++ b/apparmor.d/profiles-m-r/mdadm @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2025 Alexandre Pujol +# Copyright (C) 2025 Zane Zakraisek # SPDX-License-Identifier: GPL-2.0-only abi , @@ -14,12 +15,22 @@ profile mdadm @{exec_path} flags=(attach_disconnected) { capability dac_read_search, capability sys_admin, + capability mknod, + capability net_admin, + + network netlink raw, mqueue (read getattr) type=posix /, @{exec_path} mr, + @{sh_path} rix, + @{bin}/sendmail rPUx, + + /etc/mdadm.conf r, + @{run}/initctl r, + @{run}/mdadm/* rwk, /var/tmp/mkinitramfs_@{rand6}/etc/mdadm/mdadm.conf.tmp rw, @@ -27,13 +38,17 @@ profile mdadm @{exec_path} flags=(attach_disconnected) { @{sys}/devices/@{pci}/class r, @{sys}/devices/@{pci}/device r, @{sys}/devices/@{pci}/vendor r, + @{sys}/devices/virtual/block/md*/** rw, + @{sys}/module/md_mod/** rw, @{PROC}/@{pid}/fd/ r, @{PROC}/cmdline r, @{PROC}/kcore r, @{PROC}/partitions r, + @{PROC}/mdstat rw, /dev/**/ r, + /dev/.tmp.md.* rw, include if exists } From c4bad04fed083d93c51c7040266f2a7bd179b550 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Thu, 11 Sep 2025 17:15:32 -0600 Subject: [PATCH 1399/1455] mdadm Make the linter happy :) --- apparmor.d/profiles-m-r/mdadm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm index 94a178ce7..a3fba9479 100644 --- a/apparmor.d/profiles-m-r/mdadm +++ b/apparmor.d/profiles-m-r/mdadm @@ -24,8 +24,8 @@ profile mdadm @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, - @{sh_path} rix, - @{bin}/sendmail rPUx, + @{sh_path} rix, + @{sbin}/sendmail rPUx, /etc/mdadm.conf r, From 1540315d5caab3d5e6a87dd4c5ea4c31114d1058 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Fri, 12 Sep 2025 07:38:44 -0600 Subject: [PATCH 1400/1455] mdadm: include all config file locations pulled from strings --- apparmor.d/profiles-m-r/mdadm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm index a3fba9479..b0397eb8d 100644 --- a/apparmor.d/profiles-m-r/mdadm +++ b/apparmor.d/profiles-m-r/mdadm @@ -27,7 +27,8 @@ profile mdadm @{exec_path} flags=(attach_disconnected) { @{sh_path} rix, @{sbin}/sendmail rPUx, - /etc/mdadm.conf r, + /etc/{,mdadm/}mdadm.conf r, + /etc/{,mdadm/}mdadm.conf.d/* r, @{run}/initctl r, @{run}/mdadm/* rwk, From 1d2b271dfcf96c739a79d7909161da2396cfc943 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Fri, 12 Sep 2025 10:26:41 -0600 Subject: [PATCH 1401/1455] ssh-keygen: allow execution of ssh-sk-helper The ssh-sk-helper profile was added last year but never hooked into the ssh-keygen profile. This is needed for generating SSH keys that live on a yubikey. --- apparmor.d/groups/ssh/ssh-keygen | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index 1b6dd5e98..738268b0a 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -15,6 +15,8 @@ profile ssh-keygen @{exec_path} { @{exec_path} mr, + @{lib}/{,ssh/}ssh-sk-helper rPx -> ssh-sk-helper, + /etc/ssh/moduli rw, /etc/ssh/ssh_host_*_key* rw, From c67773947ec9951c18fd511093be9bea78aa79de Mon Sep 17 00:00:00 2001 From: doublez13 Date: Fri, 12 Sep 2025 08:09:04 -0600 Subject: [PATCH 1402/1455] ssh: allow ssh to authenticate to remote hosts using kerberos tickets --- apparmor.d/groups/ssh/ssh | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index bf71a8463..c2926a3a4 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -12,6 +12,7 @@ profile ssh @{exec_path} { include include include + include include network inet stream, From 53501d8bf4bcf462c643e0c4fd81f4fd82865b79 Mon Sep 17 00:00:00 2001 From: doublez13 Date: Fri, 12 Sep 2025 12:25:55 -0600 Subject: [PATCH 1403/1455] ssh: allow ssh to write to the kerberos CC when it picks up a ticket --- apparmor.d/groups/ssh/ssh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index c2926a3a4..0d6826490 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -44,6 +44,8 @@ profile ssh @{exec_path} { owner @{user_projects_dirs}/**/ssh/{,*} r, owner @{user_projects_dirs}/**/config r, + owner @{tmp}/krb5cc_* rwk, + audit owner @{tmp}/ssh-*/{,agent.@{int}} rwkl, owner @{run}/user/@{uid}/gvfsd-sftp/@{hex} rwl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{rand}, From fda74f574f4c3ec693c20eaaf6a19a737ddee178 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:02:35 +0200 Subject: [PATCH 1404/1455] chore(abs): add some device description. --- apparmor.d/abstractions/dri | 3 +++ apparmor.d/abstractions/nvidia-strict | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/apparmor.d/abstractions/dri b/apparmor.d/abstractions/dri index dd8f7b55a..128da00d0 100644 --- a/apparmor.d/abstractions/dri +++ b/apparmor.d/abstractions/dri @@ -28,8 +28,11 @@ @{sys}/devices/@{pci}/uevent r, @{sys}/devices/@{pci}/vendor r, + # Allow access to all cards /dev/dri/ r, /dev/dri/card@{int} rw, + + # Video Acceleration API /dev/dri/renderD128 rw, /dev/dri/renderD129 rw, diff --git a/apparmor.d/abstractions/nvidia-strict b/apparmor.d/abstractions/nvidia-strict index a7529eb9a..8fd78a702 100644 --- a/apparmor.d/abstractions/nvidia-strict +++ b/apparmor.d/abstractions/nvidia-strict @@ -36,8 +36,14 @@ owner @{PROC}/@{pid}/task/@{tid}/comm r, /dev/char/195:@{u8} w, # Nvidia graphics devices + + # Nvidia proprietary modset driver /dev/nvidia-modeset rw, + + # Nvidia graphics devices /dev/nvidia@{int} rw, + + # Nvidia's control device /dev/nvidiactl rw, deny owner @{HOME}/.nv/.local/share/gvfs-metadata/* r, From 56948a54eb1461ad4dd8e78a42185bb8e5de4819 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:03:20 +0200 Subject: [PATCH 1405/1455] feat(abs): reorganise the audio abstractions. --- apparmor.d/abstractions/audio-client | 6 ++++++ apparmor.d/abstractions/audio-server | 5 ----- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index 826191309..1ebdf4c76 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -57,12 +57,18 @@ owner @{run}/user/@{uid}/pulse/ rw, owner @{run}/user/@{uid}/pulse/native rw, + @{run}/udev/data/c116:@{int} r, # For ALSA + @{run}/udev/data/+sound:card@{int} r, # For sound card + + @{sys}/class/ r, @{sys}/class/sound/ r, /dev/shm/ r, owner /dev/shm/pulse-shm-@{int} rw, /dev/snd/controlC@{int} r, + /dev/snd/pcmC@{int}D@{int}[cp] r, + /dev/snd/timer r, include if exists diff --git a/apparmor.d/abstractions/audio-server b/apparmor.d/abstractions/audio-server index 10bcef426..a7f89b91b 100644 --- a/apparmor.d/abstractions/audio-server +++ b/apparmor.d/abstractions/audio-server @@ -9,11 +9,6 @@ include - @{run}/udev/data/+sound:card@{int} r, # for sound card - - @{sys}/class/ r, - @{sys}/class/sound/ r, - @{PROC}/asound/** rw, /dev/admmidi* rw, From 122b004c2e6be12d64f0eb0a3e3835cd0e8fef35 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:29:29 +0200 Subject: [PATCH 1406/1455] feat(abs): aff the uinput abs. --- apparmor.d/abstractions/uinput | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 apparmor.d/abstractions/uinput diff --git a/apparmor.d/abstractions/uinput b/apparmor.d/abstractions/uinput new file mode 100644 index 000000000..b97d1eb8a --- /dev/null +++ b/apparmor.d/abstractions/uinput @@ -0,0 +1,16 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2020 Canonical Ltd +# Copyright (C) 2021-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow write access to the uinput device for emulating input devices from +# userspace for sending input events. + + abi , + + /dev/uinput rw, + /dev/input/uinput rw, + + include if exists + +# vim:syntax=apparmor From 7cf4719728569dc207122236ff5a187ff2375a8f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:35:07 +0200 Subject: [PATCH 1407/1455] feat(abs): add the secrets-service abs. --- .../bus/session/org.freedesktop.Secret | 49 +++++++++++++++++++ apparmor.d/abstractions/secrets-service | 33 +++++++++++++ 2 files changed, 82 insertions(+) create mode 100644 apparmor.d/abstractions/bus/session/org.freedesktop.Secret create mode 100644 apparmor.d/abstractions/secrets-service diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.Secret b/apparmor.d/abstractions/bus/session/org.freedesktop.Secret new file mode 100644 index 000000000..8ded1b6d7 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.freedesktop.Secret @@ -0,0 +1,49 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2017 Canonical Ltd +# Copyright (C) 2021-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Provide full access to the secret-service API: +# - https://standards.freedesktop.org/secret-service/) +# +# The secret-service allows managing (add/delete/lock/etc) collections and +# (add/delete/etc) items within collections. The API also has the concept of +# aliases for collections which is typically used to access the default +# collection. While it would be possible for an application developer to use a +# snap-specific collection and mediate by object path, application developers +# are meant to instead to treat collections (typically the default collection) +# as a database of key/value attributes each with an associated secret that +# applications may query. Because AppArmor does not mediate member data, +# typical and recommended usage of the API does not allow for application +# isolation. For details, see: +# - https://standards.freedesktop.org/secret-service/ch03.html +# + + abi , + + #aa:dbus common bus=session name=org.freedesktop.{S,s}ecret label=gnome-keyring-daemon + + dbus send bus=session path=/org/freedesktop/secrets{,/**} + interface=org.freedesktop.Secret.{Collection,Item,Prompt,Service,Session} + peer=(name="{@{busname},org.freedesktop.secrets}", label=gnome-keyring-daemon), + + dbus receive bus=session path=/org/freedesktop/secrets{,/**} + interface=org.freedesktop.Secret.{Collection,Item,Prompt,Service,Session} + peer=(name="{@{busname},org.freedesktop.secrets}", label=gnome-keyring-daemon), + + dbus send bus=session path=/org/freedesktop/secrets + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=gnome-keyring-daemon), + dbus send bus=session path=/org/freedesktop/secrets + interface=org.freedesktop.Secret.Service + member=ReadAlias + peer=(name=org.freedesktop.secrets, label=gnome-keyring-daemon), + dbus send bus=session path=/org/freedesktop/secrets + interface=org.freedesktop.Secret.Service + member=SearchItems + peer=(name=@{busname}, label=gnome-keyring-daemon), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/secrets-service b/apparmor.d/abstractions/secrets-service new file mode 100644 index 000000000..71b7c7d82 --- /dev/null +++ b/apparmor.d/abstractions/secrets-service @@ -0,0 +1,33 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2017 Canonical Ltd +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Provide full access to the secret-service API: +# - https://standards.freedesktop.org/secret-service/) +# +# The secret-service allows managing (add/delete/lock/etc) collections and +# (add/delete/etc) items within collections. The API also has the concept of +# aliases for collections which is typically used to access the default +# collection. While it would be possible for an application developer to use a +# snap-specific collection and mediate by object path, application developers +# are meant to instead to treat collections (typically the default collection) +# as a database of key/value attributes each with an associated secret that +# applications may query. Because AppArmor does not mediate member data, +# typical and recommended usage of the API does not allow for application +# isolation. For details, see: +# - https://standards.freedesktop.org/secret-service/ch03.html +# + + abi , + + include + + dbus send bus=session path=/org/gnome/keyring/daemon + interface=org.gnome.keyring.Daemon + member=GetEnvironment + peer=(name=org.gnome.keyring, label=gnome-keyring-daemon), + + include if exists + +# vim:syntax=apparmor From db347d13de5610ddcd0338f23e082a9b0e544f74 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:37:35 +0200 Subject: [PATCH 1408/1455] feat(abs): revisit and restrict the devices-usb abs. --- apparmor.d/abstractions/devices-usb | 13 +++++++++++-- apparmor.d/abstractions/devices-usb-read | 23 +++++++++++++---------- 2 files changed, 24 insertions(+), 12 deletions(-) diff --git a/apparmor.d/abstractions/devices-usb b/apparmor.d/abstractions/devices-usb index 85f8f6b92..3361f10ec 100644 --- a/apparmor.d/abstractions/devices-usb +++ b/apparmor.d/abstractions/devices-usb @@ -3,13 +3,22 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Allow raw access to all connected USB devices + abi , include - /dev/bus/usb/@{int}/@{int} wk, + @{PROC}/tty/drivers r, - @{sys}/devices/**/usb@{int}/{,**} w, + /dev/bus/usb/@{d}@{d}@{d}/@{d}@{d}@{d} wk, + + # Allow access to all ttyUSB devices too + /dev/ttyACM@{int} wk, + /dev/ttyUSB@{int} wk, + + # Allow raw access to USB printers (i.e. for receipt printers in POS systems). + /dev/usb/lp@{int} wk, include if exists diff --git a/apparmor.d/abstractions/devices-usb-read b/apparmor.d/abstractions/devices-usb-read index 836a5f3c7..ea3131d59 100644 --- a/apparmor.d/abstractions/devices-usb-read +++ b/apparmor.d/abstractions/devices-usb-read @@ -3,26 +3,29 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - abi , +# Allow detection of usb devices. Leaks plugged in USB device info - /dev/ r, - /dev/bus/usb/ r, - /dev/bus/usb/@{int}/ r, - /dev/bus/usb/@{int}/@{int} r, + abi , @{sys}/class/ r, @{sys}/class/usbmisc/ r, @{sys}/bus/ r, @{sys}/bus/usb/ r, - @{sys}/bus/usb/devices/{,**} r, - - @{sys}/devices/**/usb@{int}/{,**} r, + @{sys}/bus/usb/devices/ r, + @{sys}/devices/**/usb@{int}/ r, + @{sys}/devices/**/usb@{int}/** r, # Udev data about usb devices (~equal to content of lsusb -v) @{run}/udev/data/+usb:* r, # Identifies all USB devices - @{run}/udev/data/c16[6,7]:@{int} r, # USB modems - @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters + @{run}/udev/data/b180:@{int} r, # USB block devices + @{run}/udev/data/c16{6,7}:@{d} r, # ACM USB modems + @{run}/udev/data/c18{0,8,9}:@{int} r, # USB character devices + + /dev/ r, + /dev/bus/usb/ r, + /dev/bus/usb/@{int}/ r, + /dev/bus/usb/@{d}@{d}@{d}/@{d}@{d}@{d} r, include if exists From 26f905bcc2d7e454b66ff0329e4476ede43a97db Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:38:34 +0200 Subject: [PATCH 1409/1455] feat(abs): X-strict: use tunables. --- apparmor.d/abstractions/X-strict | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/X-strict b/apparmor.d/abstractions/X-strict index 9330d2223..a92058206 100644 --- a/apparmor.d/abstractions/X-strict +++ b/apparmor.d/abstractions/X-strict @@ -5,10 +5,10 @@ abi , # The unix socket to use to connect to the display - unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"), - unix (connect, receive, send) type=stream peer=(addr="@/tmp/.ICE-unix/[0-9]*"), - unix type=stream addr="@/tmp/.ICE-unix/[0-9]*", - unix type=stream addr="@/tmp/.X11-unix/X[0-9]*", + unix (connect, receive, send) type=stream peer=(addr=@/tmp/.ICE-unix/@{int}), + unix (connect, receive, send) type=stream peer=(addr=@/tmp/.X11-unix/X@{int}), + unix type=stream addr=@/tmp/.ICE-unix/@{int}, + unix type=stream addr=@/tmp/.X11-unix/X@{int}, /usr/share/X11/{,**} r, /usr/share/xsessions/{,*.desktop} r, # Available Xsessions @@ -16,13 +16,13 @@ /etc/X11/cursors/{,**} r, - owner @{HOME}/.ICEauthority rw, # ICEauthority files required for X authentication, per user + owner @{HOME}/.ICEauthority r, # ICEauthority files required for X authentication, per user owner @{HOME}/.Xauthority rw, # Xauthority files required for X connections, per user owner @{HOME}/.xsession-errors rw, - /tmp/.ICE-unix/* rw, + /tmp/.ICE-unix/@{int} rw, /tmp/.X@{int}-lock rw, - /tmp/.X11-unix/* rw, + /tmp/.X11-unix/X@{int} rw, owner @{tmp}/xauth_@{rand6} rl -> @{tmp}/#@{int}, owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw, # Xwayland From 170575fbff343a6c376bbebb9acac171ffbba3b6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:40:54 +0200 Subject: [PATCH 1410/1455] feat(abs): ensure graphics devices are in nvidia-strict. --- apparmor.d/abstractions/graphics-full | 6 ------ apparmor.d/abstractions/nvidia-strict | 18 +++++++++++++----- 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/apparmor.d/abstractions/graphics-full b/apparmor.d/abstractions/graphics-full index 1e2c97224..de5f865b5 100644 --- a/apparmor.d/abstractions/graphics-full +++ b/apparmor.d/abstractions/graphics-full @@ -8,13 +8,7 @@ include include - @{sys}/devices/@{pci}/numa_node r, - - @{PROC}/devices r, - /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 - /dev/nvidia-uvm rw, - /dev/nvidia-uvm-tools rw, include if exists diff --git a/apparmor.d/abstractions/nvidia-strict b/apparmor.d/abstractions/nvidia-strict index 8fd78a702..a14691a9c 100644 --- a/apparmor.d/abstractions/nvidia-strict +++ b/apparmor.d/abstractions/nvidia-strict @@ -6,7 +6,7 @@ @{bin}/nvidia-modprobe Px -> child-modprobe-nvidia, - /opt/cuda/targets/@{multiarch}/lib/libOpenCL.so.* mr, + /opt/cuda/targets/@{multiarch}/lib/libOpenCL.so{,.*} mr, /usr/share/nvidia/nvidia-application-profiles-* r, @@ -24,13 +24,17 @@ owner @{user_cache_dirs}/nvidia/GLCache/ rw, owner @{user_cache_dirs}/nvidia/GLCache/** rwk, + @{sys}/devices/@{pci}/numa_node r, @{sys}/devices/system/memory/block_size_bytes r, @{sys}/module/nvidia/version r, - @{PROC}/driver/nvidia/params r, - @{PROC}/modules r, - @{PROC}/sys/vm/max_map_count r, - @{PROC}/sys/vm/mmap_min_addr r, + @{PROC}/driver/nvidia/capabilities/mig/monitor r, + @{PROC}/driver/nvidia/gpus/@{pci_id}/information r, + @{PROC}/driver/nvidia/params r, + @{PROC}/modules r, + @{PROC}/sys/vm/max_map_count r, + @{PROC}/sys/vm/mmap_min_addr r, + @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/comm r, owner @{PROC}/@{pid}/task/@{tid}/comm r, @@ -43,6 +47,10 @@ # Nvidia graphics devices /dev/nvidia@{int} rw, + # Nvidia's Unified Memory driver + /dev/nvidia-uvm rw, + /dev/nvidia-uvm-tools rw, + # Nvidia's control device /dev/nvidiactl rw, From 34cc1ab131ef8400a104a2b93131663f3e2f21e8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:42:10 +0200 Subject: [PATCH 1411/1455] feat(abs): graphics: limit access to cpu sys value. --- apparmor.d/abstractions/graphics | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/graphics b/apparmor.d/abstractions/graphics index 79872ceb4..c4edd09b4 100644 --- a/apparmor.d/abstractions/graphics +++ b/apparmor.d/abstractions/graphics @@ -13,14 +13,22 @@ /etc/libva.conf r, @{sys}/bus/pci/devices/ r, - @{sys}/devices/system/cpu/cpu@{int}/cache/index@{int}/* r, + + @{sys}/devices/system/cpu/cpu@{int}/cache/index@{int}/id r, + @{sys}/devices/system/cpu/cpu@{int}/cache/index@{int}/level r, + @{sys}/devices/system/cpu/cpu@{int}/cache/index@{int}/size r, @{sys}/devices/system/cpu/cpu@{int}/cpu_capacity r, @{sys}/devices/system/cpu/cpu@{int}/online r, - @{sys}/devices/system/cpu/cpu@{int}/topology/* r, - @{sys}/devices/system/cpu/cpufreq/policy@{int}/* r, + @{sys}/devices/system/cpu/cpu@{int}/topology/core_cpus r, + @{sys}/devices/system/cpu/cpu@{int}/topology/physical_package_id r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_max_freq r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r, + @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_max_freq r, @{sys}/devices/system/cpu/present r, + @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node@{int}/meminfo r, + @{sys}/devices/system/node/node@{int}/cpumap r, include if exists From 51bcdd5e148cc6f44c4ba560c8aede87e437531c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:43:40 +0200 Subject: [PATCH 1412/1455] feat(abs): add the input abs. --- apparmor.d/abstractions/common/app | 5 +---- apparmor.d/abstractions/common/game | 5 +---- apparmor.d/abstractions/input | 26 ++++++++++++++++++++++++++ 3 files changed, 28 insertions(+), 8 deletions(-) create mode 100644 apparmor.d/abstractions/input diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index d0b36188b..70a50b8c1 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -26,6 +26,7 @@ include include include + include include include include @@ -72,8 +73,6 @@ @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket. @{run}/utmp rk, - @{run}/udev/data/c13:@{int} r, # for /dev/input/* - @{sys}/ r, @{sys}/block/ r, @{sys}/bus/ r, @@ -143,8 +142,6 @@ owner @{att}/dev/shm/@{uuid} r, /dev/hidraw@{int} rw, - /dev/input/ r, - /dev/input/event@{int} rw, /dev/ptmx rw, /dev/pts/ptmx rw, /dev/tty rw, diff --git a/apparmor.d/abstractions/common/game b/apparmor.d/abstractions/common/game index 6b97b014c..753d4cf0b 100644 --- a/apparmor.d/abstractions/common/game +++ b/apparmor.d/abstractions/common/game @@ -17,6 +17,7 @@ include include include + include include include @@ -108,11 +109,7 @@ /dev/ r, /dev/hidraw@{int} rw, - /dev/input/ r, - /dev/input/event@{int} rw, - /dev/input/js@{int} rw, /dev/tty rw, - /dev/uinput rw, include if exists diff --git a/apparmor.d/abstractions/input b/apparmor.d/abstractions/input new file mode 100644 index 000000000..57905fd0c --- /dev/null +++ b/apparmor.d/abstractions/input @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Canonical Ltd +# Copyright (C) 2022-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow reading and writing to raw input devices + + abi , + + # network netlink raw, + + # Allow reading for supported event reports for all input devices. See + # https://www.kernel.org/doc/Documentation/input/event-codes.txt + @{sys}/devices/**/input@{int}/capabilities/* r, + + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + + /dev/input/ r, + /dev/input/event@{int} rw, + /dev/input/mice rw, + /dev/input/mouse@{int} rw, + + include if exists + +# vim:syntax=apparmor From 8c6b0ce33f12020f067d530e1927310eab721605 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:47:50 +0200 Subject: [PATCH 1413/1455] feat(profile): cleanup profiles using the new abs. --- apparmor.d/abstractions/app/chromium | 2 +- apparmor.d/abstractions/common/app | 3 +++ apparmor.d/abstractions/common/game | 5 +---- apparmor.d/groups/bluetooth/bluetoothd | 2 +- apparmor.d/groups/steam/steam | 4 +--- apparmor.d/profiles-s-z/spice-vdagentd | 2 +- 6 files changed, 8 insertions(+), 10 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 725b57fca..efb108586 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -34,7 +34,7 @@ include include include - include + include include include include diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 70a50b8c1..043ed7125 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -28,8 +28,11 @@ include include include + include include include + include + include include include diff --git a/apparmor.d/abstractions/common/game b/apparmor.d/abstractions/common/game index 753d4cf0b..2198c8537 100644 --- a/apparmor.d/abstractions/common/game +++ b/apparmor.d/abstractions/common/game @@ -20,6 +20,7 @@ include include include + include @{bin}/uname rix, @{bin}/xdg-settings rPx, @@ -67,9 +68,6 @@ owner /dev/shm/mono.@{int} rw, owner /dev/shm/softbuffer-x11-@{rand6}@{c} rw, - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - @{run}/udev/data/c13:@{int} r, # for /dev/input/* - @{sys}/ r, @{sys}/bus/ r, @{sys}/class/ r, @@ -80,7 +78,6 @@ @{sys}/devices/@{pci}/net/*/carrier r, @{sys}/devices/**/input@{int}/ r, @{sys}/devices/**/input@{int}/**/{vendor,product} r, - @{sys}/devices/**/input@{int}/capabilities/* r, @{sys}/devices/**/input/input@{int}/ r, @{sys}/devices/**/uevent r, @{sys}/devices/system/ r, diff --git a/apparmor.d/groups/bluetooth/bluetoothd b/apparmor.d/groups/bluetooth/bluetoothd index 2800a4124..12c8e2e80 100644 --- a/apparmor.d/groups/bluetooth/bluetoothd +++ b/apparmor.d/groups/bluetooth/bluetoothd @@ -12,6 +12,7 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) { include include include + include # Needed for configuring HCI interfaces capability net_admin, @@ -57,7 +58,6 @@ profile bluetoothd @{exec_path} flags=(attach_disconnected) { @{PROC}/sys/kernel/hostname r, /dev/uhid rw, - /dev/uinput rw, /dev/rfkill rw, /dev/hidraw@{int} rw, diff --git a/apparmor.d/groups/steam/steam b/apparmor.d/groups/steam/steam index abfab75d7..e3fcb1931 100644 --- a/apparmor.d/groups/steam/steam +++ b/apparmor.d/groups/steam/steam @@ -41,6 +41,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include capability sys_ptrace, @@ -245,7 +246,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{PROC}/@{pid}/task/@{tid}/comm rw, /dev/input/ r, - /dev/uinput w, deny /opt/** r, @@ -353,8 +353,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{sys}/devices/**/report_descriptor r, @{sys}/devices/**/uevent r, @{sys}/devices/@{pci}/usb@{int}/**/{idVendor,idProduct,interface} r, - @{sys}/devices/system/cpu/kernel_max r, - @{sys}/devices/virtual/tty/tty@{int}/active r, @{PROC}/ r, @{PROC}/version r, diff --git a/apparmor.d/profiles-s-z/spice-vdagentd b/apparmor.d/profiles-s-z/spice-vdagentd index 95013d8e0..33957504c 100644 --- a/apparmor.d/profiles-s-z/spice-vdagentd +++ b/apparmor.d/profiles-s-z/spice-vdagentd @@ -11,6 +11,7 @@ profile spice-vdagentd @{exec_path} flags=(attach_disconnected) { include include include + include capability sys_nice, @@ -24,7 +25,6 @@ profile spice-vdagentd @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/cgroup r, - /dev/uinput rw, /dev/vport@{int}p@{int} rw, include if exists From ad406da5de2a886b916001956ee0ebc0fb463974 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:49:08 +0200 Subject: [PATCH 1414/1455] feat(abs): add org.freedesktop.portal.Settings. --- .../session/org.freedesktop.portal.Settings | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 apparmor.d/abstractions/bus/session/org.freedesktop.portal.Settings diff --git a/apparmor.d/abstractions/bus/session/org.freedesktop.portal.Settings b/apparmor.d/abstractions/bus/session/org.freedesktop.portal.Settings new file mode 100644 index 000000000..01cf21c46 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.freedesktop.portal.Settings @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus send bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.portal.Settings + member=Read + peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal), + + dbus send bus=session path=/org/freedesktop/portal/desktop + interface=org.freedesktop.portal.Settings + member=ReadAll + peer=(name=@{busname}, label=xdg-desktop-portal), + + include if exists + +# vim:syntax=apparmor From 608ff3db0ce9dece45f437253af461ce5d49e5ce Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:50:01 +0200 Subject: [PATCH 1415/1455] fix(abs): ColorManager peer name. --- apparmor.d/abstractions/bus/org.freedesktop.ColorManager | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager index 13d186898..46201fc23 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager +++ b/apparmor.d/abstractions/bus/org.freedesktop.ColorManager @@ -16,17 +16,17 @@ dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member=CreateDevice - peer=(name="@{busname},org.freedesktop.ColorManager", label="@{p_colord}"), + peer=(name="{@{busname},org.freedesktop.ColorManager}", label="@{p_colord}"), dbus receive bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member={DeviceAdded,DeviceRemoved} - peer=(name="@{busname},org.freedesktop.ColorManager", label="@{p_colord}"), + peer=(name="{@{busname},org.freedesktop.ColorManager}", label="@{p_colord}"), dbus (receive, send) bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager member={FindDeviceByProperty,FindDeviceById} - peer=(name="@{busname},org.freedesktop.ColorManager", label="@{p_colord}"), + peer=(name="{@{busname},org.freedesktop.ColorManager}", label="@{p_colord}"), include if exists From 4bbe0a1a32072f0224d58d694614664bec56b505 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 00:55:32 +0200 Subject: [PATCH 1416/1455] feat(abs): use the new secrets-service abstraction. --- apparmor.d/abstractions/app/chromium | 2 +- apparmor.d/groups/gnome/evolution-source-registry | 2 +- apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/gnome/seahorse | 2 +- apparmor.d/profiles-g-l/gitg | 2 +- apparmor.d/profiles-m-r/protonmail | 2 +- apparmor.d/profiles-m-r/remmina | 2 +- apparmor.d/profiles-s-z/spotify | 2 +- apparmor.d/profiles-s-z/vlc | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index efb108586..2b03d5011 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -25,7 +25,6 @@ include include include - include include include include @@ -40,6 +39,7 @@ include include include + include include include include diff --git a/apparmor.d/groups/gnome/evolution-source-registry b/apparmor.d/groups/gnome/evolution-source-registry index 299d0738b..38122b7c0 100644 --- a/apparmor.d/groups/gnome/evolution-source-registry +++ b/apparmor.d/groups/gnome/evolution-source-registry @@ -10,12 +10,12 @@ include profile evolution-source-registry @{exec_path} { include include - include include include include include include + include include network inet stream, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 8278ac648..a86ef9e37 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -27,7 +27,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include @@ -43,6 +42,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index 2f190dfab..3a643bad7 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -15,11 +15,11 @@ profile seahorse @{exec_path} { include include include - include include include include include + include include #aa:dbus own bus=session name=org.gnome.seahorse.Application interface+=org.gnome.Shell.SearchProvider2 diff --git a/apparmor.d/profiles-g-l/gitg b/apparmor.d/profiles-g-l/gitg index ff5e12444..d668fbfd2 100644 --- a/apparmor.d/profiles-g-l/gitg +++ b/apparmor.d/profiles-g-l/gitg @@ -10,10 +10,10 @@ include profile gitg @{exec_path} { include include - include include include include + include include network inet dgram, diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index 0ac23267b..f5548f696 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -17,8 +17,8 @@ include profile protonmail @{exec_path} flags=(attach_disconnected) { include include - include include + include network inet stream, network inet dgram, diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index 17ca1ec5a..23d13694e 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -16,7 +16,6 @@ profile remmina @{exec_path} { include include include - include include include include @@ -25,6 +24,7 @@ profile remmina @{exec_path} { include include include + include include include include diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 56f5e91b8..8917fa3a2 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -23,7 +23,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -33,6 +32,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index 3a3a77313..dc6e4825a 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -14,7 +14,6 @@ profile vlc @{exec_path} { include include include - include include include include @@ -28,6 +27,7 @@ profile vlc @{exec_path} { include include include + include include include From ddfe75f23f4f661027a3e04c55f3f3911909aacc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 01:05:02 +0200 Subject: [PATCH 1417/1455] refractor(abs): move org.kde.StatusNotifierItem inside the session abs dir. --- .../bus/{ => session}/org.kde.StatusNotifierItem | 7 +------ apparmor.d/profiles-s-z/superproductivity | 2 +- apparmor.d/profiles-s-z/vlc | 1 + 3 files changed, 3 insertions(+), 7 deletions(-) rename apparmor.d/abstractions/bus/{ => session}/org.kde.StatusNotifierItem (79%) diff --git a/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem b/apparmor.d/abstractions/bus/session/org.kde.StatusNotifierItem similarity index 79% rename from apparmor.d/abstractions/bus/org.kde.StatusNotifierItem rename to apparmor.d/abstractions/bus/session/org.kde.StatusNotifierItem index 87fd06727..d017d44e3 100644 --- a/apparmor.d/abstractions/bus/org.kde.StatusNotifierItem +++ b/apparmor.d/abstractions/bus/session/org.kde.StatusNotifierItem @@ -23,11 +23,6 @@ member={NewAttentionIcon,NewIcon,NewIconThemePath,NewOverlayIcon,NewStatus,NewTitle,NewToolTip} peer=(name=org.freedesktop.DBus, label="@{pp_app_indicator}"), - dbus send bus=session path=/StatusNotifierWatcher - interface=org.freedesktop.DBus.Properties - member=Get - peer=(name=org.kde.StatusNotifierWatcher, label=gnome-shell), - - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index f7abf758b..ee8ee627b 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -24,7 +24,7 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) { include include include - include + include include include diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index dc6e4825a..7e9c31866 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -16,6 +16,7 @@ profile vlc @{exec_path} { include include include + include include include include From f199cfe84dbe28b50c3136c738a42f5939c57f3f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 01:06:51 +0200 Subject: [PATCH 1418/1455] feat(abs): app: minor improvement to common app action. --- apparmor.d/abstractions/common/app | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 043ed7125..a05bc2364 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -40,7 +40,7 @@ dbus bus=session, dbus bus=system, - /usr/** r, + /usr/** rk, /usr/share/** rk, /etc/{,**} r, @@ -85,6 +85,7 @@ @{sys}/bus/pci/slots/@{int}/address r, @{sys}/class/*/ r, @{sys}/devices/** r, + @{sys}/devices/virtual/dmi/id/bios_version k, @{sys}/fs/cgroup/user.slice/* r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/* r, @@ -96,11 +97,13 @@ @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/comm rk, @{PROC}/@{pid}/fd/ r, + @{PROC}/@{pid}/maps r, @{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/net/** r, @{PROC}/@{pid}/smaps r, @{PROC}/@{pid}/stat r, @{PROC}/@{pid}/statm r, + @{PROC}/@{pid}/status r, @{PROC}/@{pid}/task/@{tid}/stat r, @{PROC}/@{pid}/task/@{tid}/status r, @{PROC}/bus/pci/devices r, From cd6bb7bd52c92085511aced5b6dcec89bf0278ef Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 01:09:31 +0200 Subject: [PATCH 1419/1455] feat(abs): add NEEDS-VARIABLE to abs using variable. Will be used by aa-logprof. --- apparmor.d/abstractions/app/chromium | 5 +++++ apparmor.d/abstractions/app/firefox | 4 ++++ apparmor.d/abstractions/common/app | 1 + apparmor.d/abstractions/common/bwrap | 1 + apparmor.d/abstractions/common/chromium | 1 + apparmor.d/abstractions/common/electron | 5 +++++ apparmor.d/abstractions/common/steam-game | 3 +++ 7 files changed, 20 insertions(+) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 2b03d5011..62a8432ba 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -2,6 +2,11 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no +# NEEDS-VARIABLE: name +# NEEDS-VARIABLE: domain +# NEEDS-VARIABLE: lib_dirs +# NEEDS-VARIABLE: config_dirs +# NEEDS-VARIABLE: cache_dirs # Full set of rules for all chromium based browsers. It works as a *function* # and requires some variables to be provided as *arguments* and set in the diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 238bf9e8b..e0321f62f 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -2,6 +2,10 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no +# NEEDS-VARIABLE: name +# NEEDS-VARIABLE: lib_dirs +# NEEDS-VARIABLE: config_dirs +# NEEDS-VARIABLE: cache_dirs # Full set of rules for all firefox based browsers. It works as a *function* # and requires some variables to be provided as *arguments* and set in the diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index a05bc2364..5a93050d6 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -2,6 +2,7 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only # LOGPROF-SUGGEST: no +# NEEDS-VARIABLE: att # Common rules for applications sandboxed using bwrap. diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index da73b8217..2d3ab179f 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -1,6 +1,7 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# NEEDS-VARIABLE: att # A minimal set of rules for sandboxed programs using bwrap. # A profile using this abstraction still needs to set: diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index 78441fe08..340092f23 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -2,6 +2,7 @@ # Copyright (C) 2022 Mikhail Morfikov # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# NEEDS-VARIABLE: domain # This abstraction is for chromium based application. Chromium based browsers # need to use abstractions/app/chromium instead. diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index b581c9073..253eab72b 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -1,6 +1,11 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# NEEDS-VARIABLE: name +# NEEDS-VARIABLE: domain +# NEEDS-VARIABLE: lib_dirs +# NEEDS-VARIABLE: config_dirs +# NEEDS-VARIABLE: cache_dirs # Minimal set of rules for all electron based UI application. It works as a # *function* and requires some variables to be provided as *arguments* and set diff --git a/apparmor.d/abstractions/common/steam-game b/apparmor.d/abstractions/common/steam-game index b60e74a10..851588220 100644 --- a/apparmor.d/abstractions/common/steam-game +++ b/apparmor.d/abstractions/common/steam-game @@ -1,6 +1,9 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# NEEDS-VARIABLE: app_dirs +# NEEDS-VARIABLE: lib_dirs +# NEEDS-VARIABLE: share_dirs abi , From 84f3f947cb343c81af50d2cc1868260c7c8ab846 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 01:11:18 +0200 Subject: [PATCH 1420/1455] feat(abs): improve chromium common. --- apparmor.d/abstractions/common/chromium | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index 340092f23..23f4544a3 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -17,9 +17,14 @@ userns, + # Required for dropping into PID namespace. Keep in mind that until the + # process drops this capability it can escape confinement, but once it + # drops CAP_SYS_ADMIN we are ok. + capability sys_admin, + + # All of these are for sanely dropping from root and chrooting capability setgid, # If kernel.unprivileged_userns_clone = 1 capability setuid, # If kernel.unprivileged_userns_clone = 1 - capability sys_admin, capability sys_chroot, capability sys_ptrace, @@ -33,20 +38,22 @@ owner @{tmp}/.@{domain}.@{rand6} rw, owner @{tmp}/.@{domain}.@{rand6}/ rw, - owner @{tmp}/.@{domain}.@{rand6}/SingletonCookie w, - owner @{tmp}/.@{domain}.@{rand6}/SingletonSocket w, + owner @{tmp}/.@{domain}.@{rand6}/SingletonCookie rw, + owner @{tmp}/.@{domain}.@{rand6}/SingletonSocket rw, owner @{tmp}/scoped_dir@{rand6}/ rw, - owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w, - owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w, - owner @{tmp}/scoped_dir@{rand6}/SS w, + owner @{tmp}/scoped_dir@{rand6}/SingletonCookie rw, + owner @{tmp}/scoped_dir@{rand6}/SingletonSocket rw, + owner @{tmp}/scoped_dir@{rand6}/SS rw, /dev/shm/ r, owner /dev/shm/.@{domain}.@{rand6} rw, @{sys}/devices/system/cpu/kernel_max r, + @{sys}/devices/virtual/tty/tty@{int}/active r, + + # Allow getting the manufacturer and model of the computer where chromium is currently running. @{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/sys_vendor r, - @{sys}/devices/virtual/tty/tty@{int}/active r, # If kernel.unprivileged_userns_clone = 1 owner @{PROC}/@{pid}/setgroups w, From 31cbe5e2e9fdf0deaceb9bc2adee764809a68a6e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 11:33:24 +0200 Subject: [PATCH 1421/1455] fix(profile): revert 06d476c fix #855 --- apparmor.d/groups/systemd/systemd-logind | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index c5e87b3e2..6b102829d 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -137,7 +137,9 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) { @{PROC}/sysvipc/{shm,sem,msg} r, owner @{PROC}/@{pid}/fdinfo/@{int} r, + /dev/dri/card@{int} rw, @{att}/dev/dri/card@{int} rw, + /dev/input/event@{int} rw, # Input devices (keyboard, mouse, etc) /dev/mqueue/ r, /dev/tty@{int} rw, From bd487d1b6653d0db9304873a9e52642b56b2f207 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 11:58:25 +0200 Subject: [PATCH 1422/1455] fear(profile): remove profile for spectre-meltdown-checker. --- .../profiles-s-z/spectre-meltdown-checker | 186 ------------------ 1 file changed, 186 deletions(-) delete mode 100644 apparmor.d/profiles-s-z/spectre-meltdown-checker diff --git a/apparmor.d/profiles-s-z/spectre-meltdown-checker b/apparmor.d/profiles-s-z/spectre-meltdown-checker deleted file mode 100644 index 6e5af1288..000000000 --- a/apparmor.d/profiles-s-z/spectre-meltdown-checker +++ /dev/null @@ -1,186 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /{,usr/}{,local/}bin/spectre-meltdown-checker{,.sh} -profile spectre-meltdown-checker @{exec_path} { - include - include - - # Needed to read the /dev/cpu/@{int}/msr device - capability sys_rawio, - - # Needed to read system logs - capability syslog, - - # Used by readlink - capability sys_ptrace, - ptrace (read), - - @{exec_path} r, - - @{bin}/ r, - @{bin}/{,@{multiarch}-}objdump rix, - @{bin}/{,@{multiarch}-}readelf rix, - @{bin}/{,@{multiarch}-}strings rix, - @{sh_path} rix, - @{bin}/{,e}grep rix, - @{bin}/{,g,m}awk rix, - @{bin}/base64 rix, - @{bin}/basename rix, - @{bin}/bunzip2 rix, - @{bin}/cat rix, - @{bin}/ccache rCx -> ccache, - @{bin}/cut rix, - @{bin}/date rix, - @{bin}/dd rix, - @{bin}/dirname rix, - @{bin}/dmesg rix, - @{bin}/find rix, - @{bin}/gunzip rix, - @{bin}/gzip rix, - @{bin}/head rix, - @{bin}/id rix, - @{sbin}/iucode_tool rix, - @{bin}/kmod rCx -> kmod, - @{bin}/lzop rix, - @{bin}/mktemp rix, - @{bin}/mount rix, - @{bin}/nproc rix, - @{bin}/od rix, - @{bin}/perl rix, - @{bin}/pgrep rCx -> pgrep, - @{sbin}/rdmsr rix, - @{bin}/readlink rix, - @{bin}/rm rix, - @{bin}/sed rix, - @{bin}/seq rix, - @{bin}/sort rix, - @{bin}/stat rix, - @{bin}/tail rix, - @{bin}/tr rix, - @{bin}/uname rix, - @{bin}/unzip rix, - @{bin}/xargs rix, - @{bin}/xz rix, - @{bin}/zstd rix, - - # To fetch MCE.db from the MCExtractor project - @{bin}/wget rCx -> mcedb, - @{bin}/sqlite3 rCx -> mcedb, - owner @{tmp}/mcedb-* rw, - owner @{tmp}/smc-* rw, - owner @{tmp}/{,smc-}intelfw-*/ rw, - owner @{tmp}/{,smc-}intelfw-*/fw.zip rw, - owner @{tmp}/{,smc-}intelfw-*/Intel-Linux-Processor-Microcode-Data-Files-{master,main}/ rw, - owner @{tmp}/{,smc-}intelfw-*/Intel-Linux-Processor-Microcode-Data-Files-{master,main}/** rw, - - owner @{HOME}/.mcedb rw, - - /tmp/ r, - owner @{tmp}/{config,kernel}-* rw, - - owner /dev/cpu/@{int}/cpuid r, - owner /dev/cpu/@{int}/msr rw, - owner /dev/kmsg r, - - @{efi}/ r, - @{efi}/config r, - @{efi}/System.map-* r, - @{efi}/vmlinuz-* r, - - @{sys}/devices/system/cpu/vulnerabilities/* r, - @{sys}/module/kvm_intel/parameters/ept r, - - @{PROC}/ r, - @{PROC}/config.gz r, - @{PROC}/cmdline r, - @{PROC}/kallsyms r, - @{PROC}/modules r, - - # find and denoise - @{PROC}/@{pids}/{status,exe} r, - @{PROC}/@{pids}/fd/ r, - @{PROC}/*/ r, - - /var/lib/dbus/machine-id r, - /etc/machine-id r, - - # For shell pwd - /root/ r, - /etc/ r, - - profile ccache { - include - - @{bin}/ccache mr, - - @{lib}/llvm-[0-9]*/bin/clang rix, - @{bin}/{,@{multiarch}-}gcc-[0-9]* rix, - @{bin}/{,@{multiarch}-}g++-[0-9]* rix, - - /media/ccache/*/** rw, - - /etc/debian_version r, - - include if exists - } - - profile pgrep { - include - include - - include if exists - } - - profile mcedb { - include - include - include - include - - deny capability net_admin, - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - network netlink raw, - - @{bin}/wget mr, - @{bin}/sqlite3 mr, - - /etc/wgetrc r, - owner @{HOME}/.wget-hsts rwk, - owner @{HOME}/.mcedb rw, - - /tmp/ r, - owner @{tmp}/{,smc-}mcedb-* rwk, - owner @{tmp}/{,smc-}intelfw-*/fw.zip rw, - - /usr/share/publicsuffix/public_suffix_list.* r, - - include if exists - } - - profile kmod { - include - include - - capability sys_module, - - owner @{sys}/module/cpuid/** r, - owner @{sys}/module/msr/** r, - - include if exists - } - - include if exists -} - -# vim:syntax=apparmor From 4982ff104ddf57c7e92d4fcff5f33437bf71cbaa Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 12:03:00 +0200 Subject: [PATCH 1423/1455] feat(profile): remove rules not needed anymore Moved into the nvidia-strict abs. --- apparmor.d/profiles-m-r/nvidia-settings | 2 -- apparmor.d/profiles-m-r/nvidia-smi | 2 -- apparmor.d/profiles-m-r/nvtop | 3 +-- 3 files changed, 1 insertion(+), 6 deletions(-) diff --git a/apparmor.d/profiles-m-r/nvidia-settings b/apparmor.d/profiles-m-r/nvidia-settings index 771bbb3b6..893770a4b 100644 --- a/apparmor.d/profiles-m-r/nvidia-settings +++ b/apparmor.d/profiles-m-r/nvidia-settings @@ -33,8 +33,6 @@ profile nvidia-settings @{exec_path} flags=(attach_disconnected) { /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 /dev/nvidia-caps/ rw, /dev/nvidia-caps/nvidia-cap@{int} r, - /dev/nvidia-uvm rw, - /dev/nvidia-uvm-tools r, include if exists } diff --git a/apparmor.d/profiles-m-r/nvidia-smi b/apparmor.d/profiles-m-r/nvidia-smi index 1d6d62e2b..eb42bd59b 100644 --- a/apparmor.d/profiles-m-r/nvidia-smi +++ b/apparmor.d/profiles-m-r/nvidia-smi @@ -26,8 +26,6 @@ profile nvidia-smi @{exec_path} { /dev/char/@{dynamic}:@{int} w, # For dynamic assignment range 234 to 254, 384 to 511 /dev/nvidia-caps/ rw, /dev/nvidia-caps/nvidia-cap@{int} rw, - /dev/nvidia-uvm rw, - /dev/nvidia-uvm-tools r, include if exists } diff --git a/apparmor.d/profiles-m-r/nvtop b/apparmor.d/profiles-m-r/nvtop index d0553d186..fc51b5b9e 100644 --- a/apparmor.d/profiles-m-r/nvtop +++ b/apparmor.d/profiles-m-r/nvtop @@ -10,7 +10,7 @@ include profile nvtop @{exec_path} flags=(attach_disconnected) { include include - include + include include capability sys_ptrace, @@ -54,7 +54,6 @@ profile nvtop @{exec_path} flags=(attach_disconnected) { @{PROC}/driver/nvidia/capabilities/mig/{config,monitor} r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - /dev/dri/ r, /dev/nvidia-caps/ rw, /dev/nvidia-caps/nvidia-cap@{int} rw, From 34aa208ec98f3baafd7042543f79929f5658dc91 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 16:11:16 +0200 Subject: [PATCH 1424/1455] refractor(abs): reorganize dbus abstraction (1) --- .../abstractions/bus/org.freedesktop.resolve1 | 16 ---------------- .../bus/{ => system}/org.freedesktop.locale1 | 3 +-- .../bus/{ => system}/org.gnome.DisplayManager | 4 ++-- apparmor.d/groups/flatpak/flatpak | 2 +- .../groups/gnome/evolution-addressbook-factory | 2 +- apparmor.d/groups/gnome/gdm-session | 2 +- apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/gnome/gsd-keyboard | 2 +- apparmor.d/groups/kde/startplasma | 2 +- 9 files changed, 9 insertions(+), 26 deletions(-) delete mode 100644 apparmor.d/abstractions/bus/org.freedesktop.resolve1 rename apparmor.d/abstractions/bus/{ => system}/org.freedesktop.locale1 (70%) rename apparmor.d/abstractions/bus/{ => system}/org.gnome.DisplayManager (73%) diff --git a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 b/apparmor.d/abstractions/bus/org.freedesktop.resolve1 deleted file mode 100644 index fe6d52dc6..000000000 --- a/apparmor.d/abstractions/bus/org.freedesktop.resolve1 +++ /dev/null @@ -1,16 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - - abi , - - #aa-dbus common bus=system name=org.freedesktop.resolve1 label="@{p_systemd_resolved}" - - dbus send bus=system path=/org/freedesktop/resolve1 - interface=org.freedesktop.resolve1.Manager - member={ResolveAddress,ResolveHostname,ResolveRecord,ResolveService} - peer=(name=org.freedesktop.resolve1, label="@{p_systemd_resolved}"), - - include if exists - -# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.locale1 b/apparmor.d/abstractions/bus/system/org.freedesktop.locale1 similarity index 70% rename from apparmor.d/abstractions/bus/org.freedesktop.locale1 rename to apparmor.d/abstractions/bus/system/org.freedesktop.locale1 index 1348c8a39..e2377a14b 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.locale1 +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.locale1 @@ -4,12 +4,11 @@ abi , - #aa:dbus common bus=system name=org.freedesktop.locale1 label="@{p_systemd_localed}" dbus send bus=system path=/org/freedesktop/locale1 interface=org.freedesktop.DBus.Properties member=GetAll peer=(name=org.freedesktop.locale1), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gnome.DisplayManager b/apparmor.d/abstractions/bus/system/org.gnome.DisplayManager similarity index 73% rename from apparmor.d/abstractions/bus/org.gnome.DisplayManager rename to apparmor.d/abstractions/bus/system/org.gnome.DisplayManager index 741631f4b..4833b1512 100644 --- a/apparmor.d/abstractions/bus/org.gnome.DisplayManager +++ b/apparmor.d/abstractions/bus/system/org.gnome.DisplayManager @@ -1,5 +1,5 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol +# Copyright (C) 2023-2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -11,6 +11,6 @@ member=RegisterDisplay peer=(name="@{busname}", label=gdm), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index bd749db40..4ef675aef 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -13,7 +13,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index 56fd3ce3f..adf2aa264 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -11,7 +11,7 @@ profile evolution-addressbook-factory @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gdm-session b/apparmor.d/groups/gnome/gdm-session index c08d12a07..5d2e3e21e 100644 --- a/apparmor.d/groups/gnome/gdm-session +++ b/apparmor.d/groups/gnome/gdm-session @@ -11,8 +11,8 @@ profile gdm-session @{exec_path} { include include include - include include + include signal receive set=(hup term) peer=gdm-session-worker, signal receive set=(term) peer=gdm, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index a86ef9e37..1fb7efd7d 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -23,7 +23,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-keyboard b/apparmor.d/groups/gnome/gsd-keyboard index cbb8ccf71..80f19f93a 100644 --- a/apparmor.d/groups/gnome/gsd-keyboard +++ b/apparmor.d/groups/gnome/gsd-keyboard @@ -14,7 +14,7 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/kde/startplasma b/apparmor.d/groups/kde/startplasma index a8c8cbd13..64e332dc5 100644 --- a/apparmor.d/groups/kde/startplasma +++ b/apparmor.d/groups/kde/startplasma @@ -12,7 +12,7 @@ profile startplasma @{exec_path} { include include include - include + include include include From 3c49755d189be4fa86c714b22ba5d175bf1901c0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 23:52:37 +0200 Subject: [PATCH 1425/1455] refractor(abs): reorganize dbus abstraction (2) - new upower-observe abstraction --- apparmor.d/abstractions/app/chromium | 5 ++--- .../bus/{ => session}/org.gnome.ArchiveManager1 | 2 +- .../org.gnome.Nautilus.FileOperations2 | 2 +- .../bus/{ => system}/org.freedesktop.ColorManager | 4 ++-- .../bus/{ => system}/org.freedesktop.UPower | 2 +- apparmor.d/groups/cups/cupsd | 11 +---------- apparmor.d/groups/freedesktop/upower | 2 +- apparmor.d/groups/freedesktop/wireplumber | 3 ++- apparmor.d/groups/gnome/gnome-extension-ding | 4 ++-- apparmor.d/groups/gnome/gnome-shell | 14 +++++++++++--- apparmor.d/groups/gnome/gsd-media-keys | 2 +- apparmor.d/groups/gnome/gsd-power | 2 +- apparmor.d/groups/gnome/localsearch | 2 +- apparmor.d/groups/gnome/tracker-miner | 2 +- apparmor.d/groups/kde/kde-powerdevil | 2 +- apparmor.d/groups/kde/kscreenlocker_greet | 4 ++-- apparmor.d/groups/kde/plasmashell | 2 +- apparmor.d/groups/kde/sddm | 2 +- apparmor.d/groups/kde/sddm-greeter | 2 +- apparmor.d/groups/ubuntu/update-manager | 2 +- apparmor.d/profiles-m-r/power-profiles-daemon | 2 +- apparmor.d/profiles-s-z/thermald | 2 +- 22 files changed, 37 insertions(+), 38 deletions(-) rename apparmor.d/abstractions/bus/{ => session}/org.gnome.ArchiveManager1 (86%) rename apparmor.d/abstractions/bus/{ => session}/org.gnome.Nautilus.FileOperations2 (76%) rename apparmor.d/abstractions/bus/{ => system}/org.freedesktop.ColorManager (90%) rename apparmor.d/abstractions/bus/{ => system}/org.freedesktop.UPower (94%) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 62a8432ba..9c5b16edd 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -27,13 +27,11 @@ include include include - include + include include include - include include include - include include include include @@ -48,6 +46,7 @@ include include include + include include include diff --git a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 b/apparmor.d/abstractions/bus/session/org.gnome.ArchiveManager1 similarity index 86% rename from apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 rename to apparmor.d/abstractions/bus/session/org.gnome.ArchiveManager1 index 6bfa6114b..f69667e08 100644 --- a/apparmor.d/abstractions/bus/org.gnome.ArchiveManager1 +++ b/apparmor.d/abstractions/bus/session/org.gnome.ArchiveManager1 @@ -11,6 +11,6 @@ member=GetSupportedTypes peer=(name="@{busname}", label="@{p_file_roller}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 b/apparmor.d/abstractions/bus/session/org.gnome.Nautilus.FileOperations2 similarity index 76% rename from apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 rename to apparmor.d/abstractions/bus/session/org.gnome.Nautilus.FileOperations2 index 178139a8d..8a3e7d74e 100644 --- a/apparmor.d/abstractions/bus/org.gnome.Nautilus.FileOperations2 +++ b/apparmor.d/abstractions/bus/session/org.gnome.Nautilus.FileOperations2 @@ -6,6 +6,6 @@ #aa:dbus common bus=session name=org.gnome.Nautilus.FileOperations2 label=nautilus - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager b/apparmor.d/abstractions/bus/system/org.freedesktop.ColorManager similarity index 90% rename from apparmor.d/abstractions/bus/org.freedesktop.ColorManager rename to apparmor.d/abstractions/bus/system/org.freedesktop.ColorManager index 46201fc23..4b5dcc746 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.ColorManager +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.ColorManager @@ -15,7 +15,7 @@ dbus send bus=system path=/org/freedesktop/ColorManager interface=org.freedesktop.ColorManager - member=CreateDevice + member={CreateProfile,CreateDevice,DeleteDevice} peer=(name="{@{busname},org.freedesktop.ColorManager}", label="@{p_colord}"), dbus receive bus=system path=/org/freedesktop/ColorManager @@ -28,6 +28,6 @@ member={FindDeviceByProperty,FindDeviceById} peer=(name="{@{busname},org.freedesktop.ColorManager}", label="@{p_colord}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.freedesktop.UPower b/apparmor.d/abstractions/bus/system/org.freedesktop.UPower similarity index 94% rename from apparmor.d/abstractions/bus/org.freedesktop.UPower rename to apparmor.d/abstractions/bus/system/org.freedesktop.UPower index 64b400a3e..aa6a61371 100644 --- a/apparmor.d/abstractions/bus/org.freedesktop.UPower +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.UPower @@ -29,6 +29,6 @@ member={DeviceAdded,DeviceRemoved} peer=(name="{@{busname},org.freedesktop.UPower}", label="@{p_upowerd}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index 642d7ef5c..0a23ce476 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -12,7 +12,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { include include include - include + include include include @@ -46,15 +46,6 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { signal (send) set=(term) peer=cups-notifier-dbus, - dbus send bus=system path=/org/freedesktop/ColorManager - interface=org.freedesktop.ColorManager - member=DeleteDevice - peer=(name=org.freedesktop.ColorManager, label="@{p_colord}"), - dbus send bus=system path=/org/freedesktop/ColorManager - interface=org.freedesktop.ColorManager - member=FindDeviceById - peer=(name=org.freedesktop.ColorManager, label="@{p_colord}"), - @{exec_path} mr, @{sh_path} rix, diff --git a/apparmor.d/groups/freedesktop/upower b/apparmor.d/groups/freedesktop/upower index 0f6f9abeb..83652914f 100644 --- a/apparmor.d/groups/freedesktop/upower +++ b/apparmor.d/groups/freedesktop/upower @@ -13,7 +13,7 @@ profile upower @{exec_path} { include include - #aa:dbus own bus=system name=org.freedesktop.UPower label="@{p_upowerd}" + #aa:dbus talk bus=system name=org.freedesktop.UPower label="@{p_upowerd}" @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index 84d6675de..fc9029ef3 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -15,11 +15,12 @@ profile wireplumber @{exec_path} { include include include - include + include include include include include + include network bluetooth raw, network bluetooth seqpacket, diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index be7edcd79..e41718803 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -19,8 +19,8 @@ profile gnome-extension-ding @{exec_path} { include include include - include - include + include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 1fb7efd7d..d8853aa3b 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -28,7 +28,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include @@ -45,6 +44,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include capability sys_nice, capability sys_ptrace, @@ -73,17 +73,25 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus own bus=session name=com.canonical.{U,u}nity #aa:dbus own bus=session name=com.canonical.dbusmenu path=/{,com/canonical/dbusmenu} + #aa:dbus own bus=session name=com.canonical.Shell.PermissionPrompting #aa:dbus own bus=session name=com.rastersoft.dingextension #aa:dbus own bus=session name=org.ayatana.NotificationItem #aa:dbus own bus=session name=org.freedesktop.a11y.Manager + #aa:dbus own bus=session name=org.gnome.Shell #aa:dbus own bus=session name=org.gtk.Actions path=/** #aa:dbus own bus=session name=org.gtk.MountOperationHandler #aa:dbus own bus=session name=org.gtk.Notifications + #aa:dbus own bus=session name=org.kde.StatusNotifierItem path=/ #aa:dbus own bus=session name=org.kde.StatusNotifierWatcher path=/StatusNotifierWatcher - #aa:dbus own bus=session name=com.canonical.Shell.PermissionPrompting + # Talk with gnome-shell + # The strategy with dbus rules in this profile is first to declare all communications + # needed on buses and to limit them only to their profiles in apparmor.d. As such, + # only dbus directive is used for this. Later, some communications could be + # restricted. + #aa:dbus talk bus=system name=org.freedesktop.Accounts label="@{p_accounts_daemon}" #aa:dbus talk bus=system name=org.freedesktop.bolt label=boltd #aa:dbus talk bus=system name=org.freedesktop.ColorManager label="@{p_colord}" @@ -95,6 +103,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding #aa:dbus talk bus=session name=org.freedesktop.Notifications label=gjs + #aa:dbus talk bus=session name=org.freedesktop.ScreenSaver label=gsd-screensaver-proxy #aa:dbus talk bus=session name=org.gnome.* label=gnome-* #aa:dbus talk bus=session name=org.gnome.*.SearchProvider interface+=org.gnome.Shell.SearchProvider2 label=* #aa:dbus talk bus=session name=org.gnome.Nautilus label=nautilus @@ -102,7 +111,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-* #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" - # Session bus dbus send bus=session path=/org/gnome/** diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 7f02d8bf4..32869cdbc 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -16,7 +16,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -26,6 +25,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include include include + include signal (receive) set=(term, hup) peer=gdm*, diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index 0f77b023e..f3be82dfd 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -20,7 +20,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -31,6 +30,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include + include network inet stream, network netlink raw, diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch index c041cdf99..66420cace 100644 --- a/apparmor.d/groups/gnome/localsearch +++ b/apparmor.d/groups/gnome/localsearch @@ -11,7 +11,6 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -24,6 +23,7 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { include include include + include network netlink raw, diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index 7f7a3a8e4..e7cdc1a38 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -11,7 +11,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -24,6 +23,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { include include include + include network netlink raw, diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index 01706e649..f40c86e03 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -17,11 +17,11 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) include include include - include include include include include + include capability wake_alarm, diff --git a/apparmor.d/groups/kde/kscreenlocker_greet b/apparmor.d/groups/kde/kscreenlocker_greet index ddd14b5c2..192d3f957 100644 --- a/apparmor.d/groups/kde/kscreenlocker_greet +++ b/apparmor.d/groups/kde/kscreenlocker_greet @@ -13,15 +13,15 @@ profile kscreenlocker_greet @{exec_path} { include include include - include include - include + include include include include include include include + include network netlink raw, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 45f0d43e9..cc9907266 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -18,7 +18,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { include include include - include include include include @@ -31,6 +30,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { include include include + include userns, diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 08835eaf0..1b8930f06 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -14,12 +14,12 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include include include + include include capability audit_write, diff --git a/apparmor.d/groups/kde/sddm-greeter b/apparmor.d/groups/kde/sddm-greeter index c9aca546a..47383bb75 100644 --- a/apparmor.d/groups/kde/sddm-greeter +++ b/apparmor.d/groups/kde/sddm-greeter @@ -13,13 +13,13 @@ profile sddm-greeter @{exec_path} { include include include - include include include include include include include + include network netlink raw, diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index bcdcf108d..34284388e 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -17,7 +17,6 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include - include include include include @@ -26,6 +25,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include + include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index 178bf28c6..e4e923159 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -12,8 +12,8 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { include include include - include include + include capability dac_read_search, capability net_admin, diff --git a/apparmor.d/profiles-s-z/thermald b/apparmor.d/profiles-s-z/thermald index b663865e8..4c27ee2ca 100644 --- a/apparmor.d/profiles-s-z/thermald +++ b/apparmor.d/profiles-s-z/thermald @@ -13,7 +13,7 @@ profile thermald @{exec_path} flags=(attach_disconnected) { include include include - include + include capability sys_boot, From 94444077a8be642422836617398638ebc6cafccc Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Sep 2025 23:53:05 +0200 Subject: [PATCH 1426/1455] feat(profile): update attachement for gnome-extension-ding --- apparmor.d/groups/gnome/gnome-extension-ding | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index e41718803..400b28b6e 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -9,7 +9,7 @@ include @{share_dirs} = /usr/share/gnome-shell/extensions/ding@rastersoft.com @{share_dirs} += @{user_share_dirs}/gnome-shell/extensions/ding@rastersoft.com -@{exec_path} = @{share_dirs}/{,app/}ding.js +@{exec_path} = @{share_dirs}/app/{ding,createThumbnail}.js profile gnome-extension-ding @{exec_path} { include include From e4b6e7e92b80adbb548800663495a3e4e6c8117f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 00:01:10 +0200 Subject: [PATCH 1427/1455] feat(abs): add the devices-u2f abs. --- apparmor.d/abstractions/app/chromium | 4 +--- apparmor.d/abstractions/app/firefox | 2 +- apparmor.d/abstractions/common/app | 2 +- apparmor.d/abstractions/devices-u2f | 23 +++++++++++++++++++++++ 4 files changed, 26 insertions(+), 5 deletions(-) create mode 100644 apparmor.d/abstractions/devices-u2f diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 9c5b16edd..1c504d2a8 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -36,6 +36,7 @@ include include include + include include include include @@ -154,9 +155,7 @@ @{sys}/class/**/ r, @{sys}/devices/@{pci}/{in_intensity_sampling_frequency,in_intensity_scale,in_illuminance_raw} r, @{sys}/devices/@{pci}/boot_vga r, - @{sys}/devices/@{pci}/report_descriptor r, @{sys}/devices/**/uevent r, - @{sys}/devices/virtual/**/report_descriptor r, @{PROC}/ r, @{PROC}/@{pid}/fd/ r, @@ -181,7 +180,6 @@ owner @{PROC}/@{pid}/task/@{tid}/stat r, /dev/ r, - /dev/hidraw@{int} rw, /dev/tty rw, owner /dev/tty@{int} rw, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index e0321f62f..21534208f 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -31,6 +31,7 @@ include include include + include include include include @@ -164,7 +165,6 @@ owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1 /dev/ r, - /dev/hidraw@{int} rw, /dev/tty rw, /dev/video@{int} rw, owner /dev/tty@{int} rw, # File Inherit diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 5a93050d6..e83efdb89 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -21,6 +21,7 @@ include include include + include include include include @@ -148,7 +149,6 @@ @{att}/dev/dri/renderD129 rw, owner @{att}/dev/shm/@{uuid} r, - /dev/hidraw@{int} rw, /dev/ptmx rw, /dev/pts/ptmx rw, /dev/tty rw, diff --git a/apparmor.d/abstractions/devices-u2f b/apparmor.d/abstractions/devices-u2f new file mode 100644 index 000000000..c707d66e0 --- /dev/null +++ b/apparmor.d/abstractions/devices-u2f @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2019 Canonical Ltd +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allows access to Universal 2nd Factor (U2F) devices + + abi , + + @{run}/udev/data/+power_supply:* r, # For power supply devices (batteries, AC adapters, USB chargers) + + # Needed for dynamic assignment of U2F devices + @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 + + @{sys}/devices/**/i2c*/**/report_descriptor r, + @{sys}/devices/**/usb@{int}/**/report_descriptor r, + + # Allow raw access HDI (Human Interface Devices) wich is how U2F devices are exposed + /dev/hidraw@{int} rw, + + include if exists + +# vim:syntax=apparmor From 939a2b7f4bd2068746b8be936fe5c66aa2140575 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 00:01:30 +0200 Subject: [PATCH 1428/1455] feat(abs): add upower-observe --- apparmor.d/abstractions/upower-observe | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 apparmor.d/abstractions/upower-observe diff --git a/apparmor.d/abstractions/upower-observe b/apparmor.d/abstractions/upower-observe new file mode 100644 index 000000000..67478bb6d --- /dev/null +++ b/apparmor.d/abstractions/upower-observe @@ -0,0 +1,13 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Can query UPower for power devices, history and statistics. + + abi , + + include + + include if exists + +# vim:syntax=apparmor From 8e73353cc8c2335dfbc92c1e0fdc7628ade4b904 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 00:09:16 +0200 Subject: [PATCH 1429/1455] feat(abs): add pcscd --- apparmor.d/abstractions/app/chromium | 2 +- apparmor.d/abstractions/app/firefox | 2 +- apparmor.d/abstractions/pcscd | 19 +++++++++++++++++++ apparmor.d/groups/gnome/gsd-smartcard | 6 +++--- apparmor.d/groups/gnome/seahorse | 2 +- apparmor.d/profiles-m-r/pkcs11-register | 3 +-- apparmor.d/profiles-m-r/rngd | 2 +- 7 files changed, 27 insertions(+), 9 deletions(-) create mode 100644 apparmor.d/abstractions/pcscd diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 1c504d2a8..6e447bf05 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -42,6 +42,7 @@ include include include + include include include include @@ -107,7 +108,6 @@ /etc/@{name}/{,**} r, /etc/fstab r, - /etc/{,opensc/}opensc.conf r, / r, owner @{HOME}/ r, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 21534208f..7630b8576 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -37,6 +37,7 @@ include include include + include include include include @@ -80,7 +81,6 @@ /usr/share/webext/{,**} r, /usr/share/xul-ext/kwallet5/* r, - /etc/{,opensc/}opensc.conf r, /etc/@{name}/{,**} r, /etc/fstab r, /etc/lsb-release r, diff --git a/apparmor.d/abstractions/pcscd b/apparmor.d/abstractions/pcscd new file mode 100644 index 000000000..33a981279 --- /dev/null +++ b/apparmor.d/abstractions/pcscd @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Canonical Ltd +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allows interacting with PC/SC Smart Card Daemon + + abi , + + # Configuration file for OPENSC + /etc/opensc.conf r, + /etc/opensc/opensc.conf r, + + # Socket for communication between PCSCD and PS/SC API library + @{run}/pcscd/pcscd.comm rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index 98ce848ba..d42fb486b 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -9,13 +9,14 @@ include @{exec_path} = @{lib}/gsd-smartcard profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { include - include include include + include include + include include include - include + include signal (receive) set=(term, hup) peer=gdm*, @@ -31,7 +32,6 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { /usr/share/dconf/profile/gdm r, /usr/share/gdm/greeter-dconf-defaults r, - /etc/{,opensc/}opensc.conf r, /etc/tpm2-tss/* rk, /var/tmp/ r, diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index 3a643bad7..1fac28dfa 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -19,6 +19,7 @@ profile seahorse @{exec_path} { include include include + include include include @@ -34,7 +35,6 @@ profile seahorse @{exec_path} { /etc/pki/trust/blocklist/ r, /etc/gcrypt/hwf.deny r, - /etc/{,opensc/}opensc.conf r, owner @{HOME}/@{XDG_SSH_DIR}/{,**} r, diff --git a/apparmor.d/profiles-m-r/pkcs11-register b/apparmor.d/profiles-m-r/pkcs11-register index 989f6ec8b..d775cafe5 100644 --- a/apparmor.d/profiles-m-r/pkcs11-register +++ b/apparmor.d/profiles-m-r/pkcs11-register @@ -9,11 +9,10 @@ include @{exec_path} = @{bin}/pkcs11-register profile pkcs11-register @{exec_path} { include + include @{exec_path} mr, - /etc/{,opensc/}opensc.conf r, - owner @{HOME}/.mozilla/firefox/*/pkcs11.txt rw, owner @{HOME}/.mozilla/firefox/profiles.ini r, owner @{HOME}/.pki/nssdb/pkcs11.txt r, diff --git a/apparmor.d/profiles-m-r/rngd b/apparmor.d/profiles-m-r/rngd index ebbf0a5ab..2e548d40c 100644 --- a/apparmor.d/profiles-m-r/rngd +++ b/apparmor.d/profiles-m-r/rngd @@ -12,6 +12,7 @@ profile rngd @{exec_path} flags=(attach_disconnected) { include include include + include capability dac_read_search, capability net_admin, @@ -24,7 +25,6 @@ profile rngd @{exec_path} flags=(attach_disconnected) { /etc/conf.d/rngd r, /etc/machine-id r, - /etc/{,opensc/}opensc.conf r, /var/lib/dbus/machine-id r, @{sys}/devices/virtual/misc/hw_random/rng_available r, From 962b372390f837f7162f97fa78fbe4b24204af26 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 01:08:15 +0200 Subject: [PATCH 1430/1455] fix(profile): qemu-ga path on opensuse. --- apparmor.d/profiles-m-r/qemu-ga | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/profiles-m-r/qemu-ga b/apparmor.d/profiles-m-r/qemu-ga index 5173c50d8..f8fd84d3f 100644 --- a/apparmor.d/profiles-m-r/qemu-ga +++ b/apparmor.d/profiles-m-r/qemu-ga @@ -6,7 +6,7 @@ abi , include -@{exec_path} = @{sbin}/qemu-ga +@{exec_path} = @{sbin}/qemu-ga @{bin}/qemu-ga #aa:lint ignore=sbin profile qemu-ga @{exec_path} { include From 2ceaa16d9a53027a77092739738ec0491e76c39a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 13:06:06 +0200 Subject: [PATCH 1431/1455] feat(abs): rewrite the avahi abs, add avahi-observe --- apparmor.d/abstractions/app/chromium | 3 +- apparmor.d/abstractions/avahi-observe | 25 +++++++++++++++ .../org.freedesktop.Avahi.AddressResolver | 25 +++++++++++++++ .../org.freedesktop.Avahi.DomainBrowser | 25 +++++++++++++++ .../org.freedesktop.Avahi.HostNameResolver | 25 +++++++++++++++ .../org.freedesktop.Avahi.RecordBrowser | 25 +++++++++++++++ .../bus/system/org.freedesktop.Avahi.Server | 31 +++++++++++++++++++ .../org.freedesktop.Avahi.ServiceBrowser | 23 ++++++++++++++ .../org.freedesktop.Avahi.ServiceResolver | 25 +++++++++++++++ .../org.freedesktop.Avahi.ServiceTypeBrowser | 25 +++++++++++++++ apparmor.d/abstractions/common/app | 2 +- apparmor.d/groups/avahi/avahi-browse | 8 ++--- apparmor.d/groups/avahi/avahi-resolve | 14 ++------- apparmor.d/groups/avahi/avahi-set-host-name | 3 ++ apparmor.d/groups/cups/cups-backend-dnssd | 2 +- apparmor.d/groups/cups/cups-browsed | 4 ++- apparmor.d/groups/cups/cupsd | 2 +- apparmor.d/groups/cups/ippfind | 2 +- apparmor.d/groups/freedesktop/colord | 3 +- apparmor.d/groups/freedesktop/geoclue | 3 +- apparmor.d/groups/freedesktop/pulseaudio | 21 +++---------- apparmor.d/groups/freedesktop/xdg-dbus-proxy | 2 +- apparmor.d/groups/gnome/gnome-control-center | 2 +- .../gnome/gnome-control-center-goa-helper | 2 +- .../groups/gnome/gsd-print-notifications | 25 +++------------ apparmor.d/groups/gnome/seahorse | 2 +- apparmor.d/groups/gvfs/gvfsd-dnssd | 3 +- apparmor.d/profiles-g-l/libreoffice | 2 +- apparmor.d/profiles-m-r/murmurd | 2 +- apparmor.d/profiles-m-r/remmina | 2 +- 30 files changed, 267 insertions(+), 71 deletions(-) create mode 100644 apparmor.d/abstractions/avahi-observe create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.AddressResolver create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.DomainBrowser create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.Server create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver create mode 100644 apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 6e447bf05..1635741ed 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -25,10 +25,9 @@ abi , include + include include include - include - include include include include diff --git a/apparmor.d/abstractions/avahi-observe b/apparmor.d/abstractions/avahi-observe new file mode 100644 index 000000000..aac14fa7d --- /dev/null +++ b/apparmor.d/abstractions/avahi-observe @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2016 Canonical Ltd +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allows domain, record, service, and service type browsing as well as address, +# host and service resolving + + abi , + + include + + include + include + include + include + include + include + include + + @{run}/avahi-daemon/socket rw, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.AddressResolver b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.AddressResolver new file mode 100644 index 000000000..f6a1a251c --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.AddressResolver @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Address resolving + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=AddressResolverNew + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/AddressResolver@{int} + interface=org.freedesktop.Avahi.AddressResolver + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus receive bus=system path=/Client@{int}/AddressResolver@{int} + interface=org.freedesktop.Avahi.AddressResolver + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.DomainBrowser b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.DomainBrowser new file mode 100644 index 000000000..39f5e4496 --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.DomainBrowser @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Domain browsing + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=DomainBrowserNew + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/DomainBrowser@{int} + interface=org.freedesktop.Avahi.DomainBrowser + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus receive bus=system path=/Client@{int}/DomainBrowser@{int} + interface=org.freedesktop.Avahi.DomainBrowser + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver new file mode 100644 index 000000000..403a4db0f --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Hostname resolving + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=HostNameResolverNew + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/HostNameResolver@{int} + interface=org.freedesktop.Avahi.HostNameResolver + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus receive bus=system path=/Client@{int}/HostNameResolver@{int} + interface=org.freedesktop.Avahi.HostNameResolver + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser new file mode 100644 index 000000000..bff079b13 --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Record browsing + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=RecordBrowserNew + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/RecordBrowser@{int} + interface=org.freedesktop.Avahi.RecordBrowser + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus receive bus=system path=/Client@{int}/RecordBrowser@{int} + interface=org.freedesktop.Avahi.RecordBrowser + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.Server b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.Server new file mode 100644 index 000000000..bfc87b3cc --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.Server @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.DBus.Peer + member=Ping + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + # Allow service introspection + dbus send bus=system path=/ + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + # Allow accessing DBus properties and resolving + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member={Get*,Resolve*,IsNSSSupportAvailable} + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + # Allow receiving anything from the Avahi server + dbus receive bus=system + interface=org.freedesktop.Avahi.Server + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser new file mode 100644 index 000000000..6a3b1510d --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser @@ -0,0 +1,23 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=ServiceBrowserNew + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/ServiceBrowser@{int} + interface=org.freedesktop.Avahi.ServiceBrowser + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} + interface=org.freedesktop.Avahi.ServiceBrowser + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver new file mode 100644 index 000000000..d90e9ca14 --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Service resolving + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=ServiceResolverNew + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/ServiceResolver@{int} + interface=org.freedesktop.Avahi.ServiceResolver + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus receive bus=system path=/Client@{int}/ServiceResolver@{int} + interface=org.freedesktop.Avahi.ServiceResolver + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser new file mode 100644 index 000000000..93affdc51 --- /dev/null +++ b/apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser @@ -0,0 +1,25 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Service type browsing + + abi , + + dbus send bus=system path=/ + interface=org.freedesktop.Avahi.Server + member=ServiceTypeBrowserNew + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus send bus=system path=/Client@{int}/ServiceTypeBrowser@{int} + interface=org.freedesktop.Avahi.ServiceTypeBrowser + member=Free + peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), + + dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int} + interface=org.freedesktop.Avahi.ServiceTypeBrowser + peer=(name=@{busname}, label="@{p_avahi_daemon}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index e83efdb89..091cfbbb4 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -13,6 +13,7 @@ abi , include + include include include include @@ -73,7 +74,6 @@ @{att}/@{run}/systemd/inhibit/@{int}.ref rw, - @{run}/avahi-daemon/socket rw, # Allow access to avahi-daemon socket. @{run}/host/{,**} r, @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket. @{run}/utmp rk, diff --git a/apparmor.d/groups/avahi/avahi-browse b/apparmor.d/groups/avahi/avahi-browse index 3ac729baa..805d54b2b 100644 --- a/apparmor.d/groups/avahi/avahi-browse +++ b/apparmor.d/groups/avahi/avahi-browse @@ -11,14 +11,10 @@ include profile avahi-browse @{exec_path} { include include - include + include + include include - dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int} - interface=org.freedesktop.Avahi.ServiceTypeBrowser - member={ItemNew,AllForNow,CacheExhausted} - peer=(name=:*, label="@{p_avahi_daemon}"), - @{exec_path} mr, @{lib}/@{multiarch}/avahi/service-types.db rwk, diff --git a/apparmor.d/groups/avahi/avahi-resolve b/apparmor.d/groups/avahi/avahi-resolve index 1a66b4726..d45cffca3 100644 --- a/apparmor.d/groups/avahi/avahi-resolve +++ b/apparmor.d/groups/avahi/avahi-resolve @@ -11,19 +11,11 @@ include profile avahi-resolve @{exec_path} { include include - include + include + include + include include - dbus send bus=system path=/Client@{int}/AddressResolver@{int} - interface=org.freedesktop.Avahi.AddressResolver - member={Free,HostNameResolverNew} - peer=(name=:*, label="@{p_avahi_daemon}"), - - dbus receive bus=system path=/Client@{int}/AddressResolver@{int} - interface=org.freedesktop.Avahi.AddressResolver - member={Failure,Found} - peer=(name=:*, label="@{p_avahi_daemon}"), - @{exec_path} mr, include if exists diff --git a/apparmor.d/groups/avahi/avahi-set-host-name b/apparmor.d/groups/avahi/avahi-set-host-name index dd9eaba6c..45df7ce93 100644 --- a/apparmor.d/groups/avahi/avahi-set-host-name +++ b/apparmor.d/groups/avahi/avahi-set-host-name @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2022 Jeroen Rijken +# Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -9,6 +10,8 @@ include @{exec_path} = @{bin}/avahi-set-host-name profile avahi-set-host-name @{exec_path} { include + include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/cups/cups-backend-dnssd b/apparmor.d/groups/cups/cups-backend-dnssd index 1009a0ef2..877200660 100644 --- a/apparmor.d/groups/cups/cups-backend-dnssd +++ b/apparmor.d/groups/cups/cups-backend-dnssd @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/cups/backend/dnssd profile cups-backend-dnssd @{exec_path} { include - include + include @{exec_path} mr, diff --git a/apparmor.d/groups/cups/cups-browsed b/apparmor.d/groups/cups/cups-browsed index 7330d67c9..1e47287ac 100644 --- a/apparmor.d/groups/cups/cups-browsed +++ b/apparmor.d/groups/cups/cups-browsed @@ -10,8 +10,10 @@ include profile cups-browsed @{exec_path} { include include - include include + include + include + include include include include diff --git a/apparmor.d/groups/cups/cupsd b/apparmor.d/groups/cups/cupsd index 0a23ce476..ec0bbfd67 100644 --- a/apparmor.d/groups/cups/cupsd +++ b/apparmor.d/groups/cups/cupsd @@ -11,7 +11,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/cups/ippfind b/apparmor.d/groups/cups/ippfind index c2a944b11..fe4347237 100644 --- a/apparmor.d/groups/cups/ippfind +++ b/apparmor.d/groups/cups/ippfind @@ -10,7 +10,7 @@ include profile ippfind @{exec_path} { include include - include + include @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/colord b/apparmor.d/groups/freedesktop/colord index b3cda6307..c069b7afd 100644 --- a/apparmor.d/groups/freedesktop/colord +++ b/apparmor.d/groups/freedesktop/colord @@ -11,8 +11,9 @@ include profile colord @{exec_path} flags=(attach_disconnected) { include include - include include + include + include include include include diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index fbc7a7582..04eeba521 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -11,9 +11,10 @@ profile geoclue @{exec_path} flags=(attach_disconnected) { include include include - include include include + include + include include include include diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index ce1dffd58..346ae7257 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -14,10 +14,12 @@ profile pulseaudio @{exec_path} { include include include - include - include include include + include + include + include + include include include include @@ -49,26 +51,11 @@ profile pulseaudio @{exec_path} { member=Introspect peer=(name=:*, label=gnome-shell), - dbus receive bus=system path=/Client@{int}/ServiceResolver@{int} - interface=org.freedesktop.Avahi.ServiceResolver - member=Found - peer=(name=:*, label="@{p_avahi_daemon}"), - - dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int} - interface=org.freedesktop.Avahi.ServiceBrowser - member=ItemRemove - peer=(name=:*, label="@{p_avahi_daemon}"), - dbus send bus=system path=/ interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects peer=(name=org.bluez), - dbus send bus=system path=/Client@{int}/ServiceResolver@{int} - interface=org.freedesktop.Avahi.ServiceResolver - member={Found,Free} - peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"), - @{exec_path} mrix, @{lib}/pulse/gsettings-helper rix, diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index c1f255c75..fafdea3a5 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -14,7 +14,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 8ef24e9ce..b4128b1af 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -10,11 +10,11 @@ include profile gnome-control-center @{exec_path} flags=(attach_disconnected) { include include + include include include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center-goa-helper b/apparmor.d/groups/gnome/gnome-control-center-goa-helper index 1fa7d7050..21a326fe6 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-goa-helper +++ b/apparmor.d/groups/gnome/gnome-control-center-goa-helper @@ -9,11 +9,11 @@ include @{exec_path} = @{lib}/gnome-control-center-goa-helper profile gnome-control-center-goa-helper @{exec_path} { include + include include include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index c5be27f27..5d037961f 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -9,11 +9,14 @@ include @{exec_path} = @{lib}/gsd-print-notifications profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { include - include include include - include include + include + include + include + include + include include include @@ -38,24 +41,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { member=Introspect peer=(name=@{busname}, label=gnome-shell), - dbus send bus=system path=/ - interface=org.freedesktop.Avahi.Server - member=RecordBrowserNew - peer=(name=org.freedesktop.Avahi, label=avahi-daemon), - dbus send bus=system path=/Client@{int}/RecordBrowser@{int} - interface=org.freedesktop.Avahi.RecordBrowser - member=Free - peer=(name=org.freedesktop.Avahi, label=avahi-daemon), - - dbus receive bus=system path=/Client@{int}/RecordBrowser@{int} - interface=org.freedesktop.Avahi.RecordBrowser - member={CacheExhausted,ItemNew} - peer=(name=@{busname}, label=avahi-daemon), - dbus receive bus=system path=/Client4/RecordBrowser3 - interface=org.freedesktop.Avahi.RecordBrowser - member=ItemNew - peer=(name=@{busname}, label=avahi-daemon), - @{exec_path} mr, @{lib}/gsd-printer rPx, diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index 1fac28dfa..96b60ab72 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -9,11 +9,11 @@ include @{exec_path} = @{bin}/seahorse profile seahorse @{exec_path} { include + include include include include include - include include include include diff --git a/apparmor.d/groups/gvfs/gvfsd-dnssd b/apparmor.d/groups/gvfs/gvfsd-dnssd index ab786106c..a4eb42821 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dnssd +++ b/apparmor.d/groups/gvfs/gvfsd-dnssd @@ -12,9 +12,10 @@ profile gvfsd-dnssd @{exec_path} { include include include - include include include + include + include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_dnssd diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index de1c4a856..63f348f9b 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -11,11 +11,11 @@ include profile libreoffice @{exec_path} { include include + include include include include include - include include include include diff --git a/apparmor.d/profiles-m-r/murmurd b/apparmor.d/profiles-m-r/murmurd index 2065dd814..e0bd8d976 100644 --- a/apparmor.d/profiles-m-r/murmurd +++ b/apparmor.d/profiles-m-r/murmurd @@ -10,7 +10,7 @@ include profile murmurd @{exec_path} { include include - include + include include include diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index 23d13694e..90db69a13 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -10,11 +10,11 @@ include profile remmina @{exec_path} { include include + include include include include include - include include include include From 63c9c8cc2da2085d884e80ca42f9c624106367dd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 13:11:23 +0200 Subject: [PATCH 1432/1455] refractor(abs): move org.kde.kwalletd --- apparmor.d/abstractions/bus/{ => session}/org.kde.kwalletd | 4 ++-- apparmor.d/abstractions/secrets-service | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) rename apparmor.d/abstractions/bus/{ => session}/org.kde.kwalletd (50%) diff --git a/apparmor.d/abstractions/bus/org.kde.kwalletd b/apparmor.d/abstractions/bus/session/org.kde.kwalletd similarity index 50% rename from apparmor.d/abstractions/bus/org.kde.kwalletd rename to apparmor.d/abstractions/bus/session/org.kde.kwalletd index 1ae5a1ace..0afce1cdf 100644 --- a/apparmor.d/abstractions/bus/org.kde.kwalletd +++ b/apparmor.d/abstractions/bus/session/org.kde.kwalletd @@ -1,9 +1,9 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2024 Alexandre Pujol +# Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/secrets-service b/apparmor.d/abstractions/secrets-service index 71b7c7d82..083672cc9 100644 --- a/apparmor.d/abstractions/secrets-service +++ b/apparmor.d/abstractions/secrets-service @@ -22,6 +22,7 @@ abi , include + include dbus send bus=session path=/org/gnome/keyring/daemon interface=org.gnome.keyring.Daemon From b471f8359a29e79d14f7e66648a136a85eaad3d0 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 13:14:18 +0200 Subject: [PATCH 1433/1455] feat(profile): update cups-browsed --- apparmor.d/groups/cups/cups-browsed | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/apparmor.d/groups/cups/cups-browsed b/apparmor.d/groups/cups/cups-browsed index 1e47287ac..ca1dc9630 100644 --- a/apparmor.d/groups/cups/cups-browsed +++ b/apparmor.d/groups/cups/cups-browsed @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{sbin}/cups-browsed -profile cups-browsed @{exec_path} { +profile cups-browsed @{exec_path} flags=(attach_disconnected) { include include include @@ -18,9 +18,8 @@ profile cups-browsed @{exec_path} { include include -# capability net_admin, + capability net_admin, capability net_bind_service, -# capability sys_nice, network inet dgram, network inet6 dgram, @@ -28,20 +27,12 @@ profile cups-browsed @{exec_path} { network inet6 stream, network netlink raw, - dbus receive bus=system path=/ - interface=org.freedesktop.Avahi.Server - member=StateChanged - peer=(name=:*, label="@{p_avahi_daemon}"), + #aa:dbus talk bus=system name=org.cups.cupsd.Notifier label=cups-notifier-dbus dbus receive bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.NetworkManager member=CheckPermissions - peer=(name=:*, label=NetworkManager), - - dbus receive bus=system path=/org/cups/cupsd/Notifier - interface=org.cups.cupsd.Notifier - member={PrinterDeleted,PrinterStopped} - peer=(name=@{busname}, label=cups-notifier-dbus), + peer=(name=@{busname}, label=NetworkManager), @{exec_path} mr, @@ -59,7 +50,7 @@ profile cups-browsed @{exec_path} { owner @{tmp}/@{hex} rw, @{run}/cups/certs/* r, - @{run}/avahi-daemon/socket rw, # TODO: in abs 'avahi' ? + @{run}/avahi-daemon/socket rw, @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, From d9ff4aecd757f41b5b8e401e20611ab3e18862dd Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 15:24:49 +0200 Subject: [PATCH 1434/1455] build: add test build target. --- Justfile | 8 ++++++++ pkg/prebuild/cli/cli.go | 6 ++++++ pkg/prebuild/directive/filter.go | 4 ++++ pkg/prebuild/directories.go | 3 +++ 4 files changed, 21 insertions(+) diff --git a/Justfile b/Justfile index 2c4c0e8d4..64e333079 100644 --- a/Justfile +++ b/Justfile @@ -65,11 +65,19 @@ build: enforce: build @./{{build}}/prebuild --buildir {{build}} +# Prebuild the profiles in enforce mode (test) +enforce-test: build + @./{{build}}/prebuild --buildir {{build}} --test + # Prebuild the profiles in complain mode [group('build')] complain: build ./{{build}}/prebuild --buildir {{build}} --complain +# Prebuild the profiles in complain mode (test) +complain-test: build + @./{{build}}/prebuild --buildir {{build}} --complain --test + # Prebuild the profiles in FSP mode [group('build')] fsp: build diff --git a/pkg/prebuild/cli/cli.go b/pkg/prebuild/cli/cli.go index bf768c050..afed5aedf 100644 --- a/pkg/prebuild/cli/cli.go +++ b/pkg/prebuild/cli/cli.go @@ -37,6 +37,7 @@ Options: -s, --server Set AppArmor for server. -b, --buildir DIR Root build directory. -F, --file Only prebuild a given file. + --test Enable test mode. --debug Enable debug mode. ` ) @@ -48,6 +49,7 @@ var ( full bool server bool debug bool + test bool abi int version float64 file string @@ -74,6 +76,7 @@ func init() { flag.StringVar(&buildir, "b", "", "Root build directory.") flag.StringVar(&buildir, "buildir", "", "Root build directory.") flag.BoolVar(&debug, "debug", false, "Enable debug mode.") + flag.BoolVar(&test, "test", false, "Enable test mode.") } func Configure() { @@ -118,6 +121,9 @@ func Configure() { if debug { builder.Register("debug") } + if test { + prebuild.Test = true + } } else if enforce { builder.Register("enforce") } diff --git a/pkg/prebuild/directive/filter.go b/pkg/prebuild/directive/filter.go index b6ec56816..ac632471b 100644 --- a/pkg/prebuild/directive/filter.go +++ b/pkg/prebuild/directive/filter.go @@ -43,6 +43,10 @@ func filterRuleForUs(opt *Option) bool { return true } + if prebuild.Test && slices.Contains(opt.ArgList, "test") { + return true + } + abiStr := fmt.Sprintf("abi%d", prebuild.ABI) if slices.Contains(opt.ArgList, abiStr) { return true diff --git a/pkg/prebuild/directories.go b/pkg/prebuild/directories.go index 201d8c841..486a45d14 100644 --- a/pkg/prebuild/directories.go +++ b/pkg/prebuild/directories.go @@ -19,6 +19,9 @@ var ( // Either or not RBAC is enabled RBAC = false + // Either or not we are in test mode + Test = false + // Pkgname is the name of the package Pkgname = "apparmor.d" From 4609595c26bcf1e129f885186784922762f73f5f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 15:34:04 +0200 Subject: [PATCH 1435/1455] refractor(abs): common/apt -> apt. --- apparmor.d/abstractions/{common => }/apt | 2 +- apparmor.d/groups/apt/apt | 2 +- apparmor.d/groups/apt/apt-cache | 2 +- apparmor.d/groups/apt/apt-cdrom | 2 +- apparmor.d/groups/apt/apt-config | 2 +- apparmor.d/groups/apt/apt-extracttemplates | 2 +- apparmor.d/groups/apt/apt-file | 2 +- apparmor.d/groups/apt/apt-forktracer | 2 +- apparmor.d/groups/apt/apt-helper | 2 +- apparmor.d/groups/apt/apt-mark | 2 +- apparmor.d/groups/apt/apt-show-versions | 2 +- apparmor.d/groups/apt/aptitude | 2 +- apparmor.d/groups/apt/command-not-found | 2 +- apparmor.d/groups/apt/debtags | 2 +- apparmor.d/groups/apt/dpkg-checkbuilddeps | 2 +- apparmor.d/groups/apt/dpkg-db-backup | 2 +- apparmor.d/groups/apt/dpkg-maintscript-helper | 2 +- apparmor.d/groups/apt/querybts | 6 +++--- apparmor.d/groups/apt/reportbug | 2 +- apparmor.d/groups/apt/synaptic | 2 +- apparmor.d/groups/apt/unattended-upgrade | 2 +- apparmor.d/groups/apt/unattended-upgrade-shutdown | 2 +- apparmor.d/groups/apt/update-apt-xapian-index | 2 +- apparmor.d/groups/grub/grub-sort-version | 2 +- apparmor.d/groups/kde/kded | 2 +- apparmor.d/groups/ubuntu/apport | 2 +- apparmor.d/groups/ubuntu/apport-gtk | 2 +- apparmor.d/groups/ubuntu/apt-esm-hook | 2 +- apparmor.d/groups/ubuntu/apt-esm-json-hook | 2 +- apparmor.d/groups/ubuntu/apt_news | 2 +- apparmor.d/groups/ubuntu/check-new-release-gtk | 2 +- apparmor.d/groups/ubuntu/do-release-upgrade | 2 +- apparmor.d/groups/ubuntu/hwe-support-status | 2 +- apparmor.d/groups/ubuntu/list-oem-metapackages | 2 +- apparmor.d/groups/ubuntu/package-data-downloader | 2 +- apparmor.d/groups/ubuntu/software-properties-dbus | 2 +- apparmor.d/groups/ubuntu/software-properties-gtk | 2 +- apparmor.d/groups/ubuntu/ubuntu-advantage | 2 +- apparmor.d/groups/ubuntu/update-manager | 2 +- apparmor.d/groups/ubuntu/update-motd-updates-available | 2 +- apparmor.d/groups/ubuntu/update-notifier | 2 +- apparmor.d/profiles-m-r/packagekitd | 2 +- apparmor.d/profiles-m-r/pycompile | 4 ++-- 43 files changed, 46 insertions(+), 46 deletions(-) rename apparmor.d/abstractions/{common => }/apt (95%) diff --git a/apparmor.d/abstractions/common/apt b/apparmor.d/abstractions/apt similarity index 95% rename from apparmor.d/abstractions/common/apt rename to apparmor.d/abstractions/apt index bec8d9a20..2802ac2a8 100644 --- a/apparmor.d/abstractions/common/apt +++ b/apparmor.d/abstractions/apt @@ -35,6 +35,6 @@ owner @{tmp}/#@{int} rw, owner @{tmp}/clearsigned.message.* rw, - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index ade8bee61..8581fe724 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt @{bin}/apt-get @{sbin}/aptd profile apt @{exec_path} flags=(attach_disconnected) { include - include + include include include include diff --git a/apparmor.d/groups/apt/apt-cache b/apparmor.d/groups/apt/apt-cache index 1251fe449..afd34f7e5 100644 --- a/apparmor.d/groups/apt/apt-cache +++ b/apparmor.d/groups/apt/apt-cache @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt-cache profile apt-cache @{exec_path} { include - include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-cdrom b/apparmor.d/groups/apt/apt-cdrom index a99b964c7..0ce146261 100644 --- a/apparmor.d/groups/apt/apt-cdrom +++ b/apparmor.d/groups/apt/apt-cdrom @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt-cdrom profile apt-cdrom @{exec_path} flags=(complain) { include - include + include include capability dac_read_search, diff --git a/apparmor.d/groups/apt/apt-config b/apparmor.d/groups/apt/apt-config index 505a4b037..834bcbd8c 100644 --- a/apparmor.d/groups/apt/apt-config +++ b/apparmor.d/groups/apt/apt-config @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt-config profile apt-config @{exec_path} { include - include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-extracttemplates b/apparmor.d/groups/apt/apt-extracttemplates index beb563f31..6fbfad65b 100644 --- a/apparmor.d/groups/apt/apt-extracttemplates +++ b/apparmor.d/groups/apt/apt-extracttemplates @@ -10,8 +10,8 @@ include @{exec_path} = @{bin}/apt-extracttemplates @{lib}/apt/apt-extracttemplates profile apt-extracttemplates @{exec_path} { include + include include - include capability dac_read_search, diff --git a/apparmor.d/groups/apt/apt-file b/apparmor.d/groups/apt/apt-file index bc140acd1..6551f21a7 100644 --- a/apparmor.d/groups/apt/apt-file +++ b/apparmor.d/groups/apt/apt-file @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt-file profile apt-file @{exec_path} { include - include + include include @{exec_path} r, diff --git a/apparmor.d/groups/apt/apt-forktracer b/apparmor.d/groups/apt/apt-forktracer index 2fbb5d95b..3eec09d60 100644 --- a/apparmor.d/groups/apt/apt-forktracer +++ b/apparmor.d/groups/apt/apt-forktracer @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt-forktracer profile apt-forktracer @{exec_path} { include - include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-helper b/apparmor.d/groups/apt/apt-helper index f16e98d2f..18b6d7241 100644 --- a/apparmor.d/groups/apt/apt-helper +++ b/apparmor.d/groups/apt/apt-helper @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/apt/apt-helper profile apt-helper @{exec_path} { include - include + include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-mark b/apparmor.d/groups/apt/apt-mark index 4af469c30..c174267f5 100644 --- a/apparmor.d/groups/apt/apt-mark +++ b/apparmor.d/groups/apt/apt-mark @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt-mark profile apt-mark @{exec_path} { include - include + include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/apt-show-versions b/apparmor.d/groups/apt/apt-show-versions index 16dc584b3..514b952ff 100644 --- a/apparmor.d/groups/apt/apt-show-versions +++ b/apparmor.d/groups/apt/apt-show-versions @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/apt-show-versions profile apt-show-versions @{exec_path} { include - include + include include include diff --git a/apparmor.d/groups/apt/aptitude b/apparmor.d/groups/apt/aptitude index 9254be27d..b3f411c84 100644 --- a/apparmor.d/groups/apt/aptitude +++ b/apparmor.d/groups/apt/aptitude @@ -10,9 +10,9 @@ include @{exec_path} = @{bin}/aptitude{,-curses} profile aptitude @{exec_path} flags=(complain) { include + include include include - include # To remove the following errors: # W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory diff --git a/apparmor.d/groups/apt/command-not-found b/apparmor.d/groups/apt/command-not-found index b42649d7c..6d09e34c0 100644 --- a/apparmor.d/groups/apt/command-not-found +++ b/apparmor.d/groups/apt/command-not-found @@ -12,7 +12,7 @@ include @{exec_path} += @{lib}/command-not-found profile command-not-found @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/apt/debtags b/apparmor.d/groups/apt/debtags index 3e3fd2ab9..53e5964bd 100644 --- a/apparmor.d/groups/apt/debtags +++ b/apparmor.d/groups/apt/debtags @@ -10,8 +10,8 @@ include @{exec_path} = @{bin}/debtags profile debtags @{exec_path} { include + include include - include include #capability sys_tty_config, diff --git a/apparmor.d/groups/apt/dpkg-checkbuilddeps b/apparmor.d/groups/apt/dpkg-checkbuilddeps index 712a74e8c..297a45f84 100644 --- a/apparmor.d/groups/apt/dpkg-checkbuilddeps +++ b/apparmor.d/groups/apt/dpkg-checkbuilddeps @@ -10,8 +10,8 @@ include @{exec_path} = @{bin}/dpkg-checkbuilddeps profile dpkg-checkbuilddeps @{exec_path} flags=(complain) { include + include include - include @{exec_path} r, diff --git a/apparmor.d/groups/apt/dpkg-db-backup b/apparmor.d/groups/apt/dpkg-db-backup index d83bdbb45..8e99e70c5 100644 --- a/apparmor.d/groups/apt/dpkg-db-backup +++ b/apparmor.d/groups/apt/dpkg-db-backup @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/dpkg/dpkg-db-backup profile dpkg-db-backup @{exec_path} { include - include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/dpkg-maintscript-helper b/apparmor.d/groups/apt/dpkg-maintscript-helper index dfb881e32..aa9232c73 100644 --- a/apparmor.d/groups/apt/dpkg-maintscript-helper +++ b/apparmor.d/groups/apt/dpkg-maintscript-helper @@ -21,8 +21,8 @@ profile dpkg-maintscript-helper @{exec_path} { profile dpkg { include + include include - include capability dac_read_search, diff --git a/apparmor.d/groups/apt/querybts b/apparmor.d/groups/apt/querybts index 2a2063d8e..87967d164 100644 --- a/apparmor.d/groups/apt/querybts +++ b/apparmor.d/groups/apt/querybts @@ -10,14 +10,14 @@ include @{exec_path} = @{bin}/querybts profile querybts @{exec_path} { include - include - include + include include + include include + include include include include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/groups/apt/reportbug b/apparmor.d/groups/apt/reportbug index a814eaaa9..a6584a23d 100644 --- a/apparmor.d/groups/apt/reportbug +++ b/apparmor.d/groups/apt/reportbug @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/reportbug profile reportbug @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/apt/synaptic b/apparmor.d/groups/apt/synaptic index 36e299a0c..c48286299 100644 --- a/apparmor.d/groups/apt/synaptic +++ b/apparmor.d/groups/apt/synaptic @@ -10,7 +10,7 @@ include @{exec_path} = @{bin}/synaptic @{bin}/synaptic-pkexec profile synaptic @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index ebdc88d08..d2da77bc3 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -10,11 +10,11 @@ include @{exec_path} = @{bin}/unattended-upgrade profile unattended-upgrade @{exec_path} flags=(attach_disconnected) { include + include include include include include - include include include include diff --git a/apparmor.d/groups/apt/unattended-upgrade-shutdown b/apparmor.d/groups/apt/unattended-upgrade-shutdown index 1fb667fae..f7b94d68d 100644 --- a/apparmor.d/groups/apt/unattended-upgrade-shutdown +++ b/apparmor.d/groups/apt/unattended-upgrade-shutdown @@ -9,10 +9,10 @@ include @{exec_path} = /usr/share/unattended-upgrades/unattended-upgrade-shutdown profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) { include + include include include include - include include include diff --git a/apparmor.d/groups/apt/update-apt-xapian-index b/apparmor.d/groups/apt/update-apt-xapian-index index f829ab3ff..6ea4f19fb 100644 --- a/apparmor.d/groups/apt/update-apt-xapian-index +++ b/apparmor.d/groups/apt/update-apt-xapian-index @@ -10,8 +10,8 @@ include @{exec_path} = @{bin}/update-apt-xapian-index profile update-apt-xapian-index @{exec_path} { include + include include - include include @{exec_path} r, diff --git a/apparmor.d/groups/grub/grub-sort-version b/apparmor.d/groups/grub/grub-sort-version index 5e65fe835..6ece8a60b 100644 --- a/apparmor.d/groups/grub/grub-sort-version +++ b/apparmor.d/groups/grub/grub-sort-version @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/grub/grub-sort-version profile grub-sort-version @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 93c70329e..2ebc6a5fa 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/kded5 @{bin}/kded6 profile kded @{exec_path} { include + include #aa:only apt include include include @@ -18,7 +19,6 @@ profile kded @{exec_path} { include include include - include #aa:only apt include include include diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index 2fa7bb92a..255dc551a 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -9,7 +9,7 @@ include @{exec_path} = /usr/share/apport/apport profile apport @{exec_path} flags=(attach_disconnected) { include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index d7480a212..b6815adea 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -9,12 +9,12 @@ include @{exec_path} = /usr/share/apport/apport-gtk profile apport-gtk @{exec_path} { include + include include include include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/apt-esm-hook b/apparmor.d/groups/ubuntu/apt-esm-hook index a04fc771d..2555d0373 100644 --- a/apparmor.d/groups/ubuntu/apt-esm-hook +++ b/apparmor.d/groups/ubuntu/apt-esm-hook @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/ubuntu-advantage/apt-esm-hook profile apt-esm-hook @{exec_path} { include - include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/apt-esm-json-hook b/apparmor.d/groups/ubuntu/apt-esm-json-hook index 2edc09970..e8f03807d 100644 --- a/apparmor.d/groups/ubuntu/apt-esm-json-hook +++ b/apparmor.d/groups/ubuntu/apt-esm-json-hook @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/ubuntu-advantage/apt-esm-json-hook profile apt-esm-json-hook @{exec_path} { include - include + include include unix (receive, send) type=stream peer=(label=apt), diff --git a/apparmor.d/groups/ubuntu/apt_news b/apparmor.d/groups/ubuntu/apt_news index 9734803e4..91c8b29cc 100644 --- a/apparmor.d/groups/ubuntu/apt_news +++ b/apparmor.d/groups/ubuntu/apt_news @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/ubuntu-advantage/apt_news.py profile apt_news @{exec_path} flags=(attach_disconnected) { include - include + include include include diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index 65a19e0e0..d0e5c8f1e 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/ubuntu-release-upgrader/check-new-release-gtk profile check-new-release-gtk @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/do-release-upgrade b/apparmor.d/groups/ubuntu/do-release-upgrade index 2d3eebbc2..e9c4c9ab3 100644 --- a/apparmor.d/groups/ubuntu/do-release-upgrade +++ b/apparmor.d/groups/ubuntu/do-release-upgrade @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/do-release-upgrade profile do-release-upgrade @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/hwe-support-status b/apparmor.d/groups/ubuntu/hwe-support-status index d5ad6e06c..c85fb9966 100644 --- a/apparmor.d/groups/ubuntu/hwe-support-status +++ b/apparmor.d/groups/ubuntu/hwe-support-status @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/hwe-support-status profile hwe-support-status @{exec_path} { include - include + include include @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/list-oem-metapackages b/apparmor.d/groups/ubuntu/list-oem-metapackages index 91bc4876f..5e4b09ce3 100644 --- a/apparmor.d/groups/ubuntu/list-oem-metapackages +++ b/apparmor.d/groups/ubuntu/list-oem-metapackages @@ -9,8 +9,8 @@ include @{exec_path} = @{lib}/update-notifier/list-oem-metapackages profile list-oem-metapackages @{exec_path} { include + include include - include @{exec_path} mr, diff --git a/apparmor.d/groups/ubuntu/package-data-downloader b/apparmor.d/groups/ubuntu/package-data-downloader index 37f7f72a5..1703d27cd 100644 --- a/apparmor.d/groups/ubuntu/package-data-downloader +++ b/apparmor.d/groups/ubuntu/package-data-downloader @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/update-notifier/package-data-downloader profile package-data-downloader @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index cc7387709..72e016573 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/software-properties/software-properties-dbus profile software-properties-dbus @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index cd858737b..5111a0278 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/software-properties-gtk profile software-properties-gtk @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -16,7 +17,6 @@ profile software-properties-gtk @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage b/apparmor.d/groups/ubuntu/ubuntu-advantage index ea9742d4c..4ede61bc8 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/ubuntu-advantage profile ubuntu-advantage @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index 34284388e..d242ae0d6 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/update-manager profile update-manager @{exec_path} flags=(attach_disconnected) { include + include include include include @@ -18,7 +19,6 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/update-motd-updates-available b/apparmor.d/groups/ubuntu/update-motd-updates-available index 88967baf8..09775cb6f 100644 --- a/apparmor.d/groups/ubuntu/update-motd-updates-available +++ b/apparmor.d/groups/ubuntu/update-motd-updates-available @@ -9,7 +9,7 @@ include @{exec_path} = @{lib}/update-notifier/update-motd-updates-available profile update-motd-updates-available @{exec_path} { include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 4c60b4aaf..70d980713 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/update-notifier profile update-notifier @{exec_path} { include + include include include include @@ -16,7 +17,6 @@ profile update-notifier @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index 19f6a515e..e5b54c34e 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -9,11 +9,11 @@ include @{exec_path} = @{lib}/packagekitd profile packagekitd @{exec_path} flags=(attach_disconnected) { include + include #aa:only apt include include include include - include #aa:only apt include include diff --git a/apparmor.d/profiles-m-r/pycompile b/apparmor.d/profiles-m-r/pycompile index c308dcd91..105264ec2 100644 --- a/apparmor.d/profiles-m-r/pycompile +++ b/apparmor.d/profiles-m-r/pycompile @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/py{,3}compile @{bin}/py{,3}clean profile pycompile @{exec_path} flags=(attach_disconnected,complain) { include - include + include include include @@ -32,8 +32,8 @@ profile pycompile @{exec_path} flags=(attach_disconnected,complain) { profile dpkg { include + include include - include capability dac_read_search, From ff21c9157c4608f49f6aa7b12665fd02d0a3922b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 15:34:32 +0200 Subject: [PATCH 1436/1455] tests(profile): add common autopkgtest paths. --- apparmor.d/abstractions/apt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apparmor.d/abstractions/apt b/apparmor.d/abstractions/apt index 2802ac2a8..25106ad6e 100644 --- a/apparmor.d/abstractions/apt +++ b/apparmor.d/abstractions/apt @@ -35,6 +35,9 @@ owner @{tmp}/#@{int} rw, owner @{tmp}/clearsigned.message.* rw, + #aa:only test + /tmp/autopkgtest.@{rand6}/** rwk, + include if exists # vim:syntax=apparmor From bf3b8345fccd475b09da20ded1a9be6e32bd731a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 16:26:28 +0200 Subject: [PATCH 1437/1455] refractor(abs): move gtk bus interfaces. --- .../bus/session/org.gtk.MountOperationHandler | 14 ++++++++++++++ .../org.gtk.Private.RemoteVolumeMonitor | 2 +- .../bus/{ => session}/org.gtk.vfs.Daemon | 6 ++++-- .../bus/{ => session}/org.gtk.vfs.Metadata | 6 +++--- .../bus/session/org.gtk.vfs.MountOperation | 2 +- .../bus/{ => session}/org.gtk.vfs.MountTracker | 14 ++++++++------ .../abstractions/bus/session/org.gtk.vfs.Spawner | 14 ++++++++++++++ 7 files changed, 45 insertions(+), 13 deletions(-) create mode 100644 apparmor.d/abstractions/bus/session/org.gtk.MountOperationHandler rename apparmor.d/abstractions/bus/{ => session}/org.gtk.Private.RemoteVolumeMonitor (91%) rename apparmor.d/abstractions/bus/{ => session}/org.gtk.vfs.Daemon (72%) rename apparmor.d/abstractions/bus/{ => session}/org.gtk.vfs.Metadata (80%) rename apparmor.d/abstractions/bus/{ => session}/org.gtk.vfs.MountTracker (89%) create mode 100644 apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner diff --git a/apparmor.d/abstractions/bus/session/org.gtk.MountOperationHandler b/apparmor.d/abstractions/bus/session/org.gtk.MountOperationHandler new file mode 100644 index 000000000..3fce0d719 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.gtk.MountOperationHandler @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus send bus=session path=/org/gtk/MountOperationHandler + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label=gnome-shell), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor b/apparmor.d/abstractions/bus/session/org.gtk.Private.RemoteVolumeMonitor similarity index 91% rename from apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor rename to apparmor.d/abstractions/bus/session/org.gtk.Private.RemoteVolumeMonitor index 9060c8c15..b8160dcb2 100644 --- a/apparmor.d/abstractions/bus/org.gtk.Private.RemoteVolumeMonitor +++ b/apparmor.d/abstractions/bus/session/org.gtk.Private.RemoteVolumeMonitor @@ -19,6 +19,6 @@ member={VolumeAdded,DriveDisconnected,DriveConnected,DriveChanged} peer=(name="@{busname}", label=gvfs-*-volume-monitor), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Daemon similarity index 72% rename from apparmor.d/abstractions/bus/org.gtk.vfs.Daemon rename to apparmor.d/abstractions/bus/session/org.gtk.vfs.Daemon index 93ad35fe5..edf954ac5 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.Daemon +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Daemon @@ -1,7 +1,9 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol +# Copyright (C) 2023-2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Each daemon (main and for mounts) implement this. + abi , dbus send bus=session path=/org/gtk/vfs/Daemon @@ -14,6 +16,6 @@ member=GetConnection peer=(name=@{busname}), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Metadata similarity index 80% rename from apparmor.d/abstractions/bus/org.gtk.vfs.Metadata rename to apparmor.d/abstractions/bus/session/org.gtk.vfs.Metadata index ce6e60082..9f1a77daf 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.Metadata +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Metadata @@ -13,13 +13,13 @@ dbus send bus=session path=/org/gtk/vfs/metadata interface=org.gtk.vfs.Metadata member={Set,Move,GetTreeFromDevice,Remove} - peer=(name="@{busname}", label=gvfsd-metadata), + peer=(name=@{busname}, label=gvfsd-metadata), dbus receive bus=session path=/org/gtk/vfs/metadata interface=org.gtk.vfs.Metadata member=AttributeChanged - peer=(name="@{busname}", label=gvfsd-metadata), + peer=(name=@{busname}, label=gvfsd-metadata), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation b/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation index ff8c928f8..54dfc837f 100644 --- a/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountOperation @@ -6,7 +6,7 @@ dbus receive bus=session path=/org/gtk/gvfs/mountop/@{int} interface=org.gtk.vfs.MountOperation - member={AskQuestion,AskPassword} + member={AskPassword,AskQuestion} peer=(name=@{busname}, label=gvfsd-*), include if exists diff --git a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker b/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountTracker similarity index 89% rename from apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker rename to apparmor.d/abstractions/bus/session/org.gtk.vfs.MountTracker index c455d4f18..107c3dc13 100644 --- a/apparmor.d/abstractions/bus/org.gtk.vfs.MountTracker +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.MountTracker @@ -2,12 +2,9 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - abi , +# The mount tracking interface. - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=ListMountableInfo - peer=(name="@{busname}", label=gvfsd), + abi , dbus send bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker @@ -19,11 +16,16 @@ member=ListMounts2 peer=(name="@{busname}", label=gvfsd), + dbus send bus=session path=/org/gtk/vfs/mounttracker + interface=org.gtk.vfs.MountTracker + member=ListMountableInfo + peer=(name="@{busname}", label=gvfsd), + dbus receive bus=session path=/org/gtk/vfs/mounttracker interface=org.gtk.vfs.MountTracker member={Mounted,Unmounted} peer=(name="@{busname}", label=gvfsd), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner new file mode 100644 index 000000000..71c0dd157 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} + interface=org.gtk.vfs.Spawner + member=Spawned + peer=(name=@{busname}, label=gvfsd), + + include if exists + +# vim:syntax=apparmor From 5cae18e064f6f3a7eb47b9553af322c781fbb068 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 16:45:54 +0200 Subject: [PATCH 1438/1455] feat(abs): add the gtk-strict abstraction. --- apparmor.d/abstractions/desktop | 2 +- apparmor.d/abstractions/gnome-strict | 2 +- apparmor.d/abstractions/gnome.d/complete | 2 +- apparmor.d/abstractions/kde-strict | 2 +- apparmor.d/abstractions/lxqt | 2 +- apparmor.d/abstractions/xfce | 2 +- apparmor.d/groups/apt/debconf-frontend | 2 +- apparmor.d/groups/kde/gmenudbusmenuproxy | 1 - apparmor.d/groups/kde/kcminit | 1 - apparmor.d/groups/kde/kconf_update | 1 - apparmor.d/groups/kde/kded | 1 - apparmor.d/groups/kde/kwalletd | 1 - apparmor.d/profiles-m-r/obconf | 2 +- 13 files changed, 8 insertions(+), 13 deletions(-) diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 3bfbcc887..316e7374e 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -12,7 +12,7 @@ include include include - include + include include include include diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 4d2d390ee..a3afccb76 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -7,7 +7,7 @@ include include include - include + include include include include diff --git a/apparmor.d/abstractions/gnome.d/complete b/apparmor.d/abstractions/gnome.d/complete index 3dece8578..3d4b47f9f 100644 --- a/apparmor.d/abstractions/gnome.d/complete +++ b/apparmor.d/abstractions/gnome.d/complete @@ -2,7 +2,7 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - include + include dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index b448c542d..f00594038 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -7,7 +7,7 @@ include include include - include + include include include include diff --git a/apparmor.d/abstractions/lxqt b/apparmor.d/abstractions/lxqt index f20c24a32..ba7347d8c 100644 --- a/apparmor.d/abstractions/lxqt +++ b/apparmor.d/abstractions/lxqt @@ -7,7 +7,7 @@ include include include - include + include include include include diff --git a/apparmor.d/abstractions/xfce b/apparmor.d/abstractions/xfce index 3046c8f6d..eaf50f6d0 100644 --- a/apparmor.d/abstractions/xfce +++ b/apparmor.d/abstractions/xfce @@ -6,7 +6,7 @@ include include - include + include include include include diff --git a/apparmor.d/groups/apt/debconf-frontend b/apparmor.d/groups/apt/debconf-frontend index 6e80839fe..0a7706fe1 100644 --- a/apparmor.d/groups/apt/debconf-frontend +++ b/apparmor.d/groups/apt/debconf-frontend @@ -14,7 +14,7 @@ profile debconf-frontend @{exec_path} flags=(complain) { include include include - include + include capability dac_read_search, diff --git a/apparmor.d/groups/kde/gmenudbusmenuproxy b/apparmor.d/groups/kde/gmenudbusmenuproxy index b30e39cdc..f63a83295 100644 --- a/apparmor.d/groups/kde/gmenudbusmenuproxy +++ b/apparmor.d/groups/kde/gmenudbusmenuproxy @@ -13,7 +13,6 @@ profile gmenudbusmenuproxy @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/kde/kcminit b/apparmor.d/groups/kde/kcminit index 4f8b10a32..59f60c285 100644 --- a/apparmor.d/groups/kde/kcminit +++ b/apparmor.d/groups/kde/kcminit @@ -11,7 +11,6 @@ profile kcminit @{exec_path} { include include include - include include #aa:dbus own bus=session name=org.kde.{KCM,kcm}init path=/kcminit diff --git a/apparmor.d/groups/kde/kconf_update b/apparmor.d/groups/kde/kconf_update index ee42fef98..6a01748fd 100644 --- a/apparmor.d/groups/kde/kconf_update +++ b/apparmor.d/groups/kde/kconf_update @@ -12,7 +12,6 @@ profile kconf_update @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index 2ebc6a5fa..ec5a1ee36 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -23,7 +23,6 @@ profile kded @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index de175635a..baaad7dcb 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -17,7 +17,6 @@ profile kwalletd @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-m-r/obconf b/apparmor.d/profiles-m-r/obconf index 7b11aaac5..d283466f5 100644 --- a/apparmor.d/profiles-m-r/obconf +++ b/apparmor.d/profiles-m-r/obconf @@ -11,7 +11,7 @@ include profile obconf @{exec_path} { include include - include + include include include include From 784ced0da32c3b380b01336f72a20c36de431c6e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 18:08:44 +0200 Subject: [PATCH 1439/1455] feat(abs): reorganise the gtk/gvfs abs. --- .../abstractions/bus/session/org.gtk.vfs.Mountable | 14 ++++++++++++++ .../abstractions/bus/session/org.gtk.vfs.Spawner | 2 +- apparmor.d/abstractions/common/gnome | 1 - apparmor.d/groups/bus/ibus-daemon | 2 +- apparmor.d/groups/bus/ibus-dconf | 2 +- apparmor.d/groups/bus/ibus-engine-simple | 2 +- apparmor.d/groups/bus/ibus-extension-gtk3 | 1 - apparmor.d/groups/bus/ibus-memconf | 2 +- apparmor.d/groups/bus/ibus-x11 | 1 - apparmor.d/groups/flatpak/flatpak | 1 - .../groups/freedesktop/xdg-desktop-portal-gtk | 1 - .../xdg-desktop-portal-rewrite-launchers | 2 +- .../groups/freedesktop/xdg-user-dirs-gtk-update | 1 - apparmor.d/groups/gnome/deja-dup-monitor | 6 +++--- .../groups/gnome/evolution-addressbook-factory | 2 +- apparmor.d/groups/gnome/evolution-alarm-notify | 1 - apparmor.d/groups/gnome/evolution-calendar-factory | 4 ++-- apparmor.d/groups/gnome/evolution-source-registry | 2 +- apparmor.d/groups/gnome/gio-launch-desktop | 3 +-- apparmor.d/groups/gnome/gnome-calendar | 1 - apparmor.d/groups/gnome/gnome-characters | 1 - apparmor.d/groups/gnome/gnome-clocks | 1 - apparmor.d/groups/gnome/gnome-control-center | 1 - .../groups/gnome/gnome-control-center-goa-helper | 1 - .../gnome/gnome-control-center-search-provider | 1 - apparmor.d/groups/gnome/gnome-disk-image-mounter | 2 +- apparmor.d/groups/gnome/gnome-extension-ding | 7 +++---- apparmor.d/groups/gnome/gnome-extension-gsconnect | 8 ++++---- apparmor.d/groups/gnome/gnome-initial-setup | 1 - apparmor.d/groups/gnome/gnome-shell | 2 +- apparmor.d/groups/gnome/gnome-software | 1 - apparmor.d/groups/gnome/gnome-system-monitor | 5 ++--- apparmor.d/groups/gnome/gnome-terminal-server | 1 - apparmor.d/groups/gnome/goa-daemon | 1 - apparmor.d/groups/gnome/goa-identity-service | 2 +- apparmor.d/groups/gnome/gsd-color | 1 - apparmor.d/groups/gnome/gsd-housekeeping | 1 - apparmor.d/groups/gnome/gsd-keyboard | 1 - apparmor.d/groups/gnome/gsd-media-keys | 3 +-- apparmor.d/groups/gnome/gsd-power | 1 - apparmor.d/groups/gnome/gsd-wacom | 1 - apparmor.d/groups/gnome/localsearch | 5 ++--- apparmor.d/groups/gnome/mutter-x11-frames | 1 - apparmor.d/groups/gnome/nautilus | 2 +- apparmor.d/groups/gnome/ptyxis | 1 - apparmor.d/groups/gnome/ptyxis-agent | 2 +- apparmor.d/groups/gnome/seahorse | 1 - apparmor.d/groups/gnome/tracker-extract | 5 ++--- apparmor.d/groups/gnome/tracker-miner | 5 ++--- apparmor.d/groups/ubuntu/apport-gtk | 1 - apparmor.d/groups/ubuntu/check-new-release-gtk | 1 - apparmor.d/groups/ubuntu/livepatch-notification | 1 - apparmor.d/groups/ubuntu/software-properties-gtk | 1 - .../groups/ubuntu/ubuntu-advantage-notification | 1 - apparmor.d/groups/ubuntu/update-manager | 1 - apparmor.d/groups/ubuntu/update-notifier | 1 - apparmor.d/profiles-a-f/atril | 1 - apparmor.d/profiles-a-f/calibre | 1 - apparmor.d/profiles-a-f/engrampa | 3 +-- apparmor.d/profiles-a-f/file-roller | 2 -- apparmor.d/profiles-g-l/gimp | 1 + apparmor.d/profiles-g-l/libreoffice | 5 ++--- apparmor.d/profiles-m-r/remmina | 2 +- apparmor.d/profiles-s-z/spice-vdagent | 1 - apparmor.d/profiles-s-z/spotify | 1 - apparmor.d/profiles-s-z/superproductivity | 2 +- apparmor.d/profiles-s-z/terminator | 1 - apparmor.d/profiles-s-z/virt-manager | 2 ++ 68 files changed, 57 insertions(+), 88 deletions(-) create mode 100644 apparmor.d/abstractions/bus/session/org.gtk.vfs.Mountable diff --git a/apparmor.d/abstractions/bus/session/org.gtk.vfs.Mountable b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Mountable new file mode 100644 index 000000000..603ef709b --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Mountable @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus receive bus=session path=/org/gtk/vfs/mountable + interface=org.gtk.vfs.Mountable + member=Mount + peer=(name=@{busname}, label=gvfsd), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner index 71c0dd157..7090afe24 100644 --- a/apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner +++ b/apparmor.d/abstractions/bus/session/org.gtk.vfs.Spawner @@ -1,5 +1,5 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2025 Alexandre Pujol +# Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index f0dd20f47..b9f36cf6c 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -10,7 +10,6 @@ include include include - include include include include diff --git a/apparmor.d/groups/bus/ibus-daemon b/apparmor.d/groups/bus/ibus-daemon index 3fdab031b..b326138d6 100644 --- a/apparmor.d/groups/bus/ibus-daemon +++ b/apparmor.d/groups/bus/ibus-daemon @@ -10,7 +10,7 @@ include profile ibus-daemon @{exec_path} flags=(attach_disconnected) { include include - include + include include include diff --git a/apparmor.d/groups/bus/ibus-dconf b/apparmor.d/groups/bus/ibus-dconf index 817d63175..bac225ebc 100644 --- a/apparmor.d/groups/bus/ibus-dconf +++ b/apparmor.d/groups/bus/ibus-dconf @@ -11,7 +11,7 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) { include include include - include + include include include diff --git a/apparmor.d/groups/bus/ibus-engine-simple b/apparmor.d/groups/bus/ibus-engine-simple index e900fc3f5..8bdc3c79c 100644 --- a/apparmor.d/groups/bus/ibus-engine-simple +++ b/apparmor.d/groups/bus/ibus-engine-simple @@ -11,7 +11,7 @@ profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) { include include include - include + include include signal (receive) set=term peer=ibus-daemon, diff --git a/apparmor.d/groups/bus/ibus-extension-gtk3 b/apparmor.d/groups/bus/ibus-extension-gtk3 index 34d881a8a..0973fce49 100644 --- a/apparmor.d/groups/bus/ibus-extension-gtk3 +++ b/apparmor.d/groups/bus/ibus-extension-gtk3 @@ -12,7 +12,6 @@ profile ibus-extension-gtk3 @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/bus/ibus-memconf b/apparmor.d/groups/bus/ibus-memconf index 5233f8603..b1f1445b3 100644 --- a/apparmor.d/groups/bus/ibus-memconf +++ b/apparmor.d/groups/bus/ibus-memconf @@ -10,7 +10,7 @@ include profile ibus-memconf @{exec_path} flags=(attach_disconnected) { include include - include + include include include include diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index 698eeedb6..cf7b40190 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -13,7 +13,6 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index 4ef675aef..3fee701a8 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -14,7 +14,6 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index 9688df798..35199d859 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -18,7 +18,6 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers b/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers index 62adb343b..2fa8cc01f 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-rewrite-launchers @@ -10,7 +10,7 @@ include profile xdg-desktop-portal-rewrite-launchers @{exec_path} { include include - include + include @{exec_path} mr, diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update index cf488af63..1b818267f 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update @@ -11,7 +11,6 @@ profile xdg-user-dirs-gtk-update @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor index a0fb366ab..59b3c5d40 100644 --- a/apparmor.d/groups/gnome/deja-dup-monitor +++ b/apparmor.d/groups/gnome/deja-dup-monitor @@ -13,9 +13,9 @@ profile deja-dup-monitor @{exec_path} { include include include - include - include - include + include + include + include include include include diff --git a/apparmor.d/groups/gnome/evolution-addressbook-factory b/apparmor.d/groups/gnome/evolution-addressbook-factory index adf2aa264..1b9051a4a 100644 --- a/apparmor.d/groups/gnome/evolution-addressbook-factory +++ b/apparmor.d/groups/gnome/evolution-addressbook-factory @@ -13,7 +13,7 @@ profile evolution-addressbook-factory @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/evolution-alarm-notify b/apparmor.d/groups/gnome/evolution-alarm-notify index 174cb323f..9f8c51a75 100644 --- a/apparmor.d/groups/gnome/evolution-alarm-notify +++ b/apparmor.d/groups/gnome/evolution-alarm-notify @@ -12,7 +12,6 @@ profile evolution-alarm-notify @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/evolution-calendar-factory b/apparmor.d/groups/gnome/evolution-calendar-factory index 2ee416bd9..87cce8fbc 100644 --- a/apparmor.d/groups/gnome/evolution-calendar-factory +++ b/apparmor.d/groups/gnome/evolution-calendar-factory @@ -12,8 +12,8 @@ profile evolution-calendar-factory @{exec_path} { include include include - include - include + include + include include include include diff --git a/apparmor.d/groups/gnome/evolution-source-registry b/apparmor.d/groups/gnome/evolution-source-registry index 38122b7c0..0732646b5 100644 --- a/apparmor.d/groups/gnome/evolution-source-registry +++ b/apparmor.d/groups/gnome/evolution-source-registry @@ -10,7 +10,7 @@ include profile evolution-source-registry @{exec_path} { include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gio-launch-desktop b/apparmor.d/groups/gnome/gio-launch-desktop index eb76f1207..3652dd6e9 100644 --- a/apparmor.d/groups/gnome/gio-launch-desktop +++ b/apparmor.d/groups/gnome/gio-launch-desktop @@ -19,8 +19,7 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) { include include include - include - include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-calendar b/apparmor.d/groups/gnome/gnome-calendar index 872fc6858..2173e3d62 100644 --- a/apparmor.d/groups/gnome/gnome-calendar +++ b/apparmor.d/groups/gnome/gnome-calendar @@ -14,7 +14,6 @@ profile gnome-calendar @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-characters b/apparmor.d/groups/gnome/gnome-characters index 7ce936e52..b5ae5672a 100644 --- a/apparmor.d/groups/gnome/gnome-characters +++ b/apparmor.d/groups/gnome/gnome-characters @@ -12,7 +12,6 @@ profile gnome-characters @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-clocks b/apparmor.d/groups/gnome/gnome-clocks index bdffedb72..92886c887 100644 --- a/apparmor.d/groups/gnome/gnome-clocks +++ b/apparmor.d/groups/gnome/gnome-clocks @@ -12,7 +12,6 @@ profile gnome-clocks @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index b4128b1af..c27f32fec 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -16,7 +16,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center-goa-helper b/apparmor.d/groups/gnome/gnome-control-center-goa-helper index 21a326fe6..aeb59295f 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-goa-helper +++ b/apparmor.d/groups/gnome/gnome-control-center-goa-helper @@ -14,7 +14,6 @@ profile gnome-control-center-goa-helper @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center-search-provider b/apparmor.d/groups/gnome/gnome-control-center-search-provider index 51c8f5107..6d24e72c1 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-search-provider +++ b/apparmor.d/groups/gnome/gnome-control-center-search-provider @@ -11,7 +11,6 @@ profile gnome-control-center-search-provider @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-disk-image-mounter b/apparmor.d/groups/gnome/gnome-disk-image-mounter index 519a248d8..55d49e250 100644 --- a/apparmor.d/groups/gnome/gnome-disk-image-mounter +++ b/apparmor.d/groups/gnome/gnome-disk-image-mounter @@ -13,7 +13,7 @@ profile gnome-disk-image-mounter @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index 400b28b6e..f56af9f67 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -21,10 +21,9 @@ profile gnome-extension-ding @{exec_path} { include include include - include - include - include - include + include + include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 7af7b8b2f..8ac7830cc 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -21,10 +21,10 @@ profile gnome-extension-gsconnect @{exec_path} { include include include - include - include - include - include + include + include + include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index 40b8bc9b5..7f4b818e3 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -15,7 +15,6 @@ profile gnome-initial-setup @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index d8853aa3b..55e95d006 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -29,7 +29,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 247436318..0b1602fbb 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -13,7 +13,6 @@ profile gnome-software @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 8bcb629a9..152b28ff7 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -10,9 +10,8 @@ include profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { include include - include - include - include + include + include include include diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index cda4568c1..7a9bad4da 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -14,7 +14,6 @@ profile gnome-terminal-server @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/goa-daemon b/apparmor.d/groups/gnome/goa-daemon index 8176d6c7c..b7c138285 100644 --- a/apparmor.d/groups/gnome/goa-daemon +++ b/apparmor.d/groups/gnome/goa-daemon @@ -12,7 +12,6 @@ profile goa-daemon @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/goa-identity-service b/apparmor.d/groups/gnome/goa-identity-service index 3992811c2..4509a6159 100644 --- a/apparmor.d/groups/gnome/goa-identity-service +++ b/apparmor.d/groups/gnome/goa-identity-service @@ -11,7 +11,7 @@ profile goa-identity-service @{exec_path} { include include include - include + include #aa:dbus own bus=session name=org.gnome.Identity diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 1b12a68cd..a0b3fac6b 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -16,7 +16,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index 35714fa0b..8d8b9fc1b 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -12,7 +12,6 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-keyboard b/apparmor.d/groups/gnome/gsd-keyboard index 80f19f93a..f4f2830b8 100644 --- a/apparmor.d/groups/gnome/gsd-keyboard +++ b/apparmor.d/groups/gnome/gsd-keyboard @@ -16,7 +16,6 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 32869cdbc..9f6f70fbc 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -18,8 +18,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include include include - include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index f3be82dfd..a6165ddcf 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -22,7 +22,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-wacom b/apparmor.d/groups/gnome/gsd-wacom index 484dda29d..50da29b5f 100644 --- a/apparmor.d/groups/gnome/gsd-wacom +++ b/apparmor.d/groups/gnome/gsd-wacom @@ -14,7 +14,6 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/localsearch b/apparmor.d/groups/gnome/localsearch index 66420cace..ea1566757 100644 --- a/apparmor.d/groups/gnome/localsearch +++ b/apparmor.d/groups/gnome/localsearch @@ -11,9 +11,8 @@ profile localsearch @{exec_path} flags=(attach_disconnected) { include include include - include - include - include + include + include include include include diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index 92e619e5c..f50bdbd9b 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -13,7 +13,6 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index a91a154a7..07abe1c08 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -18,7 +18,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/ptyxis b/apparmor.d/groups/gnome/ptyxis index ac47b5460..3195d7f03 100644 --- a/apparmor.d/groups/gnome/ptyxis +++ b/apparmor.d/groups/gnome/ptyxis @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/ptyxis profile ptyxis @{exec_path} { include - include include include include diff --git a/apparmor.d/groups/gnome/ptyxis-agent b/apparmor.d/groups/gnome/ptyxis-agent index 2735e0c5d..6418193a6 100644 --- a/apparmor.d/groups/gnome/ptyxis-agent +++ b/apparmor.d/groups/gnome/ptyxis-agent @@ -10,7 +10,7 @@ include profile ptyxis-agent @{exec_path} { include include - include + include include include include diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index 96b60ab72..090a9cbe7 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -15,7 +15,6 @@ profile seahorse @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 3f9f49281..e200ecb42 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -10,9 +10,8 @@ include profile tracker-extract @{exec_path} flags=(attach_disconnected) { include include - include - include - include + include + include include include include diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index e7cdc1a38..85b7b0d53 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -11,9 +11,8 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { include include include - include - include - include + include + include include include include diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index b6815adea..0cd509473 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -14,7 +14,6 @@ profile apport-gtk @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index d0e5c8f1e..5df19d897 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -13,7 +13,6 @@ profile check-new-release-gtk @{exec_path} { include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/livepatch-notification b/apparmor.d/groups/ubuntu/livepatch-notification index 4d5ecb46a..e003054a5 100644 --- a/apparmor.d/groups/ubuntu/livepatch-notification +++ b/apparmor.d/groups/ubuntu/livepatch-notification @@ -12,7 +12,6 @@ profile livepatch-notification @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 5111a0278..2f6398f1e 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -16,7 +16,6 @@ profile software-properties-gtk @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification index bf3d4c6c0..093fdbed7 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification @@ -12,7 +12,6 @@ profile ubuntu-advantage-notification @{exec_path} { include include include - include include include diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index d242ae0d6..a874ca346 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -18,7 +18,6 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index 70d980713..f66345b67 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -15,7 +15,6 @@ profile update-notifier @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-a-f/atril b/apparmor.d/profiles-a-f/atril index 284c35911..c95f6be55 100644 --- a/apparmor.d/profiles-a-f/atril +++ b/apparmor.d/profiles-a-f/atril @@ -13,7 +13,6 @@ profile atril @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-a-f/calibre b/apparmor.d/profiles-a-f/calibre index bba3dfedb..60843b0a6 100644 --- a/apparmor.d/profiles-a-f/calibre +++ b/apparmor.d/profiles-a-f/calibre @@ -16,7 +16,6 @@ profile calibre @{exec_path} { include include include - include include include include diff --git a/apparmor.d/profiles-a-f/engrampa b/apparmor.d/profiles-a-f/engrampa index c302ff400..8137edd8d 100644 --- a/apparmor.d/profiles-a-f/engrampa +++ b/apparmor.d/profiles-a-f/engrampa @@ -13,8 +13,7 @@ profile engrampa @{exec_path} { include include include - include - include + include include include include diff --git a/apparmor.d/profiles-a-f/file-roller b/apparmor.d/profiles-a-f/file-roller index 5ec394807..3d13b813f 100644 --- a/apparmor.d/profiles-a-f/file-roller +++ b/apparmor.d/profiles-a-f/file-roller @@ -9,8 +9,6 @@ include @{exec_path} = @{bin}/file-roller profile file-roller @{exec_path} { include - include - include include include include diff --git a/apparmor.d/profiles-g-l/gimp b/apparmor.d/profiles-g-l/gimp index 67b625d62..ad324e153 100644 --- a/apparmor.d/profiles-g-l/gimp +++ b/apparmor.d/profiles-g-l/gimp @@ -11,6 +11,7 @@ profile gimp @{exec_path} { include include include + include include include include diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index 63f348f9b..bc6516fc2 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -18,9 +18,8 @@ profile libreoffice @{exec_path} { include include include - include - include - include + include + include include include include diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index 90db69a13..b8b361e12 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -16,7 +16,7 @@ profile remmina @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index 158ea6a7f..18e3fc248 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -18,7 +18,6 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 8917fa3a2..f3c4acf4f 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -24,7 +24,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index ee8ee627b..a7adf91fa 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -23,7 +23,7 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index 59c78396d..e9baf97e1 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -13,7 +13,6 @@ profile terminator @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index f820d2953..9802ecd5a 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -16,6 +16,8 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { include include include + include + include include include include From 1fba94a197d93e9032a4f99dbe46eca3afaba671 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 18:14:30 +0200 Subject: [PATCH 1440/1455] feat(profile): update gvfs services to the abs changes. --- .../groups/gvfs/gvfs-afc-volume-monitor | 2 +- .../groups/gvfs/gvfs-goa-volume-monitor | 4 +-- .../groups/gvfs/gvfs-gphoto2-volume-monitor | 2 +- .../groups/gvfs/gvfs-mtp-volume-monitor | 2 +- .../groups/gvfs/gvfs-udisks2-volume-monitor | 4 +-- apparmor.d/groups/gvfs/gvfsd | 8 +++-- apparmor.d/groups/gvfs/gvfsd-admin | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-afc | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-afp | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-afp-browse | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-archive | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-burn | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-cdda | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-computer | 9 ++++++ apparmor.d/groups/gvfs/gvfsd-dav | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-dnssd | 26 +++-------------- apparmor.d/groups/gvfs/gvfsd-ftp | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-fuse | 16 ++++------ apparmor.d/groups/gvfs/gvfsd-google | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-gphoto2 | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-http | 24 +++++---------- apparmor.d/groups/gvfs/gvfsd-localtest | 3 ++ apparmor.d/groups/gvfs/gvfsd-metadata | 6 +++- apparmor.d/groups/gvfs/gvfsd-mtp | 16 ++++++++-- apparmor.d/groups/gvfs/gvfsd-network | 26 +++-------------- apparmor.d/groups/gvfs/gvfsd-nfs | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-recent | 19 +++--------- apparmor.d/groups/gvfs/gvfsd-sftp | 29 ++++++------------- apparmor.d/groups/gvfs/gvfsd-smb | 11 +++++++ apparmor.d/groups/gvfs/gvfsd-smb-browse | 18 +++++------- apparmor.d/groups/gvfs/gvfsd-trash | 22 ++++---------- apparmor.d/groups/gvfs/gvfsd-wsdd | 24 +++------------ 32 files changed, 237 insertions(+), 166 deletions(-) diff --git a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor index 7f50d8b45..32136d710 100644 --- a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor @@ -17,7 +17,7 @@ profile gvfs-afc-volume-monitor @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor index 3f2fb0138..017a66e84 100644 --- a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor @@ -17,12 +17,12 @@ profile gvfs-goa-volume-monitor @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), dbus send bus=session path=/org/gnome/OnlineAccounts interface=org.freedesktop.DBus.ObjectManager member=GetManagedObjects - peer=(name=:*, label=goa-daemon), + peer=(name=@{busname}, label=goa-daemon), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor index dd03254b1..ece97e688 100644 --- a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor @@ -21,7 +21,7 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor index 6fbbc6092..fd3b38012 100644 --- a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor @@ -20,7 +20,7 @@ profile gvfs-mtp-volume-monitor @{exec_path} { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor index 4ed214b71..80f7f86a9 100644 --- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor @@ -12,7 +12,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include @@ -35,7 +35,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) { dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd b/apparmor.d/groups/gvfs/gvfsd index c124c5855..e3e3edfae 100644 --- a/apparmor.d/groups/gvfs/gvfsd +++ b/apparmor.d/groups/gvfs/gvfsd @@ -18,20 +18,22 @@ profile gvfsd @{exec_path} { #aa:dbus own bus=session name=org.gtk.vfs.Daemon #aa:dbus own bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker + # The server side of abstractions/bus/session/org.gtk.vfs.Mountable dbus send bus=session path=/org/gtk/vfs/mountable interface=org.gtk.vfs.Mountable member=Mount - peer=(name=:*, label=gvfsd-*), + peer=(name=@{busname}, label=gvfsd-*), + # The server side of abstractions/bus/session/org.gtk.vfs.Spawner dbus receive bus=session path=/org/gtk/gvfs/exec_spaw/@{int} interface=org.gtk.vfs.Spawner member=Spawned - peer=(name=:*, label=gvfsd-*), + peer=(name=@{busname}, label=gvfsd-*), dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-admin b/apparmor.d/groups/gvfs/gvfsd-admin index 44248cbe3..5a1fd1c82 100644 --- a/apparmor.d/groups/gvfs/gvfsd-admin +++ b/apparmor.d/groups/gvfs/gvfsd-admin @@ -10,6 +10,10 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-admin profile gvfsd-admin @{exec_path} { include + include + include + include + include include include @@ -19,6 +23,13 @@ profile gvfsd-admin @{exec_path} { capability fowner, capability setuid, + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, #aa:lint ignore=too-wide diff --git a/apparmor.d/groups/gvfs/gvfsd-afc b/apparmor.d/groups/gvfs/gvfsd-afc index 68d4b689e..da231f469 100644 --- a/apparmor.d/groups/gvfs/gvfsd-afc +++ b/apparmor.d/groups/gvfs/gvfsd-afc @@ -10,6 +10,17 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-afc profile gvfsd-afc @{exec_path} { include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-afp b/apparmor.d/groups/gvfs/gvfsd-afp index eeaaec059..db6fe5a48 100644 --- a/apparmor.d/groups/gvfs/gvfsd-afp +++ b/apparmor.d/groups/gvfs/gvfsd-afp @@ -10,6 +10,17 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-afp profile gvfsd-afp @{exec_path} { include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-afp-browse b/apparmor.d/groups/gvfs/gvfsd-afp-browse index 48680f12f..a39e25785 100644 --- a/apparmor.d/groups/gvfs/gvfsd-afp-browse +++ b/apparmor.d/groups/gvfs/gvfsd-afp-browse @@ -10,6 +10,17 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-afp-browse profile gvfsd-afp-browse @{exec_path} { include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-archive b/apparmor.d/groups/gvfs/gvfsd-archive index 918841320..68b1e7765 100644 --- a/apparmor.d/groups/gvfs/gvfsd-archive +++ b/apparmor.d/groups/gvfs/gvfsd-archive @@ -10,9 +10,20 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-archive profile gvfsd-archive @{exec_path} { include + include + include + include + include include include + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, owner @{HOME}/**.{tar,tar.gz,zip} r, diff --git a/apparmor.d/groups/gvfs/gvfsd-burn b/apparmor.d/groups/gvfs/gvfsd-burn index b70fa7110..09062241a 100644 --- a/apparmor.d/groups/gvfs/gvfsd-burn +++ b/apparmor.d/groups/gvfs/gvfsd-burn @@ -10,6 +10,17 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-burn profile gvfsd-burn @{exec_path} { include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-cdda b/apparmor.d/groups/gvfs/gvfsd-cdda index 0648f5dc0..356f8dcd3 100644 --- a/apparmor.d/groups/gvfs/gvfsd-cdda +++ b/apparmor.d/groups/gvfs/gvfsd-cdda @@ -10,6 +10,17 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-cdda profile gvfsd-cdda @{exec_path} { include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-computer b/apparmor.d/groups/gvfs/gvfsd-computer index 6eebca738..667b448c4 100644 --- a/apparmor.d/groups/gvfs/gvfsd-computer +++ b/apparmor.d/groups/gvfs/gvfsd-computer @@ -11,9 +11,18 @@ include profile gvfsd-computer @{exec_path} { include include + include + include + include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} #aa:dbus talk bus=session name=org.gtk.Private.RemoteVolumeMonitor label=gvfs-afc-volume-monitor + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-dav b/apparmor.d/groups/gvfs/gvfsd-dav index 77e1a2f6f..b335724cb 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dav +++ b/apparmor.d/groups/gvfs/gvfsd-dav @@ -10,6 +10,10 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-dav profile gvfsd-dav @{exec_path} { include + include + include + include + include include include include @@ -24,6 +28,13 @@ profile gvfsd-dav @{exec_path} { network inet6 dgram, network netlink raw, + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, owner @{run}/user/@{uid}/gvfsd/ rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-dnssd b/apparmor.d/groups/gvfs/gvfsd-dnssd index a4eb42821..aad9de3a0 100644 --- a/apparmor.d/groups/gvfs/gvfsd-dnssd +++ b/apparmor.d/groups/gvfs/gvfsd-dnssd @@ -12,32 +12,14 @@ profile gvfsd-dnssd @{exec_path} { include include include - include - include + include + include + include include include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_dnssd - - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name=:*, label=gvfsd), - - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name=:*, label=gvfsd), - - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member={MountLocation,LookupMount,RegisterMount} - peer=(name="@{busname}", label=gvfsd), - - dbus receive bus=session path=/ - interface=org.freedesktop.DBus.Introspectable - member=Introspect - peer=(name=@{busname}, label=gnome-shell), + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gvfs/gvfsd-ftp b/apparmor.d/groups/gvfs/gvfsd-ftp index 5b7c833a5..3b36fc4f1 100644 --- a/apparmor.d/groups/gvfs/gvfsd-ftp +++ b/apparmor.d/groups/gvfs/gvfsd-ftp @@ -10,6 +10,10 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-ftp profile gvfsd-ftp @{exec_path} { include + include + include + include + include include include include @@ -20,6 +24,13 @@ profile gvfsd-ftp @{exec_path} { network inet6 stream, network netlink raw, + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, include if exists diff --git a/apparmor.d/groups/gvfs/gvfsd-fuse b/apparmor.d/groups/gvfs/gvfsd-fuse index 4741b0f31..f67068f49 100644 --- a/apparmor.d/groups/gvfs/gvfsd-fuse +++ b/apparmor.d/groups/gvfs/gvfsd-fuse @@ -11,7 +11,9 @@ include profile gvfsd-fuse @{exec_path} { include include - include + include + include + include include capability sys_admin, @@ -20,21 +22,13 @@ profile gvfsd-fuse @{exec_path} { unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse//fusermount), - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=RegisterFuse - peer=(name=@{busname}, label=gvfsd), + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd - dbus receive bus=session path=/ + dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(name=@{busname}, label=gnome-shell), - dbus send bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name=@{busname}, label=gvfsd-sftp), - @{exec_path} mr, @{bin}/fusermount{,3} rCx -> fusermount, diff --git a/apparmor.d/groups/gvfs/gvfsd-google b/apparmor.d/groups/gvfs/gvfsd-google index eb80f3a7a..819e84c39 100644 --- a/apparmor.d/groups/gvfs/gvfsd-google +++ b/apparmor.d/groups/gvfs/gvfsd-google @@ -10,6 +10,17 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-google profile gvfsd-google @{exec_path} { include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-gphoto2 b/apparmor.d/groups/gvfs/gvfsd-gphoto2 index 688f03c27..0544000c0 100644 --- a/apparmor.d/groups/gvfs/gvfsd-gphoto2 +++ b/apparmor.d/groups/gvfs/gvfsd-gphoto2 @@ -10,6 +10,17 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-gphoto2 profile gvfsd-gphoto2 @{exec_path} { include + include + include + include + include + + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-http b/apparmor.d/groups/gvfs/gvfsd-http index f51ef2afe..2678bde40 100644 --- a/apparmor.d/groups/gvfs/gvfsd-http +++ b/apparmor.d/groups/gvfs/gvfsd-http @@ -11,9 +11,11 @@ include profile gvfsd-http @{exec_path} { include include - include + include + include + include include - include + # include include include include @@ -25,25 +27,15 @@ profile gvfsd-http @{exec_path} { network netlink raw, unix type=stream peer=(label=gnome-shell), + unix type=stream peer=(label=gnome-extension-gsconnect), #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_http + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), - - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name=:*, label=gvfsd), - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name=:*, label=gvfsd), - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=RegisterMount - peer=(name=:*, label=gvfsd), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-localtest b/apparmor.d/groups/gvfs/gvfsd-localtest index 5ffbabb40..d1af3c60c 100644 --- a/apparmor.d/groups/gvfs/gvfsd-localtest +++ b/apparmor.d/groups/gvfs/gvfsd-localtest @@ -10,6 +10,9 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-localtest profile gvfsd-localtest @{exec_path} { include + include + include + include @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-metadata b/apparmor.d/groups/gvfs/gvfsd-metadata index f6f3820bb..8565856d9 100644 --- a/apparmor.d/groups/gvfs/gvfsd-metadata +++ b/apparmor.d/groups/gvfs/gvfsd-metadata @@ -11,6 +11,9 @@ include profile gvfsd-metadata @{exec_path} { include include + include + include + include include network netlink raw, @@ -18,11 +21,12 @@ profile gvfsd-metadata @{exec_path} { signal (receive) set=(usr1) peer=pacman, #aa:dbus own bus=session name=org.gtk.vfs.Metadata path=/org/gtk/vfs/{m,M}etadata + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name=:*, label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-mtp b/apparmor.d/groups/gvfs/gvfsd-mtp index 3c747b8b3..8d5ad78c5 100644 --- a/apparmor.d/groups/gvfs/gvfsd-mtp +++ b/apparmor.d/groups/gvfs/gvfsd-mtp @@ -10,6 +10,10 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-mtp profile gvfsd-mtp @{exec_path} { include + include + include + include + include include include include @@ -19,10 +23,18 @@ profile gvfsd-mtp @{exec_path} { network netlink raw, + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, - owner @{HOME}/{,**} rw, # FIXME: ? - owner @{MOUNTS}/{,**} rw, + owner @{HOME}/ r, + owner @{HOME}/** rw, + owner @{MOUNTS}/** rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-network b/apparmor.d/groups/gvfs/gvfsd-network index 46f543fa4..7874686bc 100644 --- a/apparmor.d/groups/gvfs/gvfsd-network +++ b/apparmor.d/groups/gvfs/gvfsd-network @@ -11,38 +11,20 @@ include profile gvfsd-network @{exec_path} { include include - include - include + include + include + include include include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} - - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name="@{busname}", label=gvfsd), - - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name="@{busname}", label=gvfsd), - - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member={MountLocation,LookupMount,RegisterMount} - peer=(name="@{busname}", label=gvfsd), + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect peer=(name=@{busname}, label=gnome-shell), - dbus send bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name=@{busname}), - @{exec_path} mr, owner @{run}/user/@{uid}/gvfsd/ rw, diff --git a/apparmor.d/groups/gvfs/gvfsd-nfs b/apparmor.d/groups/gvfs/gvfsd-nfs index 575d9de39..aae859d73 100644 --- a/apparmor.d/groups/gvfs/gvfsd-nfs +++ b/apparmor.d/groups/gvfs/gvfsd-nfs @@ -10,12 +10,23 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-nfs profile gvfsd-nfs @{exec_path} { include + include + include + include + include include network inet stream, network inet6 stream, network netlink raw, + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, include if exists diff --git a/apparmor.d/groups/gvfs/gvfsd-recent b/apparmor.d/groups/gvfs/gvfsd-recent index 1219c8cbd..ca59d75cd 100644 --- a/apparmor.d/groups/gvfs/gvfsd-recent +++ b/apparmor.d/groups/gvfs/gvfsd-recent @@ -11,27 +11,16 @@ include profile gvfsd-recent @{exec_path} { include include - include - include + include + include + include include include include include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} - - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name="@{busname}", label=gvfsd), - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name="@{busname}", label=gvfsd), - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=RegisterMount - peer=(name="@{busname}", label=gvfsd), + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd dbus receive bus=session interface=org.freedesktop.DBus.Introspectable diff --git a/apparmor.d/groups/gvfs/gvfsd-sftp b/apparmor.d/groups/gvfs/gvfsd-sftp index 1019a1525..862ef88aa 100644 --- a/apparmor.d/groups/gvfs/gvfsd-sftp +++ b/apparmor.d/groups/gvfs/gvfsd-sftp @@ -11,32 +11,21 @@ include profile gvfsd-sftp @{exec_path} { include include - include + include + include + include include include include + include #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} - #aa:dbus talk bus=session name=org.gtk.vfs.{M,m}ountTracker label=gvfsd + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd - dbus receive bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name=@{busname}), - - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name=@{busname}, label=gvfsd), - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name=@{busname}, label=gvfsd), - - dbus send bus=session path=/org/gtk/gvfs/mountop/@{int} - interface=org.gtk.vfs.MountOperation - member={AskQuestion,AskPassword} - peer=(name=@{busname}), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-smb b/apparmor.d/groups/gvfs/gvfsd-smb index 24891e9c3..9d99a43af 100644 --- a/apparmor.d/groups/gvfs/gvfsd-smb +++ b/apparmor.d/groups/gvfs/gvfsd-smb @@ -10,6 +10,10 @@ include @{exec_path} = @{lib}/{,gvfs/}gvfsd-smb profile gvfsd-smb @{exec_path} { include + include + include + include + include include include @@ -19,6 +23,13 @@ profile gvfsd-smb @{exec_path} { network inet dgram, network inet6 dgram, + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd + + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), + @{exec_path} mr, /etc/samba/smb.conf r, diff --git a/apparmor.d/groups/gvfs/gvfsd-smb-browse b/apparmor.d/groups/gvfs/gvfsd-smb-browse index a90cddc50..66099563e 100644 --- a/apparmor.d/groups/gvfs/gvfsd-smb-browse +++ b/apparmor.d/groups/gvfs/gvfsd-smb-browse @@ -11,7 +11,9 @@ include profile gvfsd-smb-browse @{exec_path} { include include - include + include + include + include include include include @@ -23,16 +25,12 @@ profile gvfsd-smb-browse @{exec_path} { network inet6 dgram, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_smb_browse + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name="@{busname}", label=gvfsd), - - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name="@{busname}", label=gvfsd), + dbus receive bus=session + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-trash b/apparmor.d/groups/gvfs/gvfsd-trash index e13f870c7..070c41a84 100644 --- a/apparmor.d/groups/gvfs/gvfsd-trash +++ b/apparmor.d/groups/gvfs/gvfsd-trash @@ -11,7 +11,9 @@ include profile gvfsd-trash @{exec_path} { include include - include + include + include + include include include include @@ -21,26 +23,12 @@ profile gvfsd-trash @{exec_path} { network inet6 stream, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int} - - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name="@{busname}", label=gvfsd), - - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name="@{busname}", label=gvfsd), - - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=RegisterMount - peer=(name="@{busname}", label=gvfsd), + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd dbus receive bus=session interface=org.freedesktop.DBus.Introspectable member=Introspect - peer=(name="@{busname}", label=gnome-shell), + peer=(name=@{busname}, label=gnome-shell), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-wsdd b/apparmor.d/groups/gvfs/gvfsd-wsdd index 7f4c20718..4ea39c7d0 100644 --- a/apparmor.d/groups/gvfs/gvfsd-wsdd +++ b/apparmor.d/groups/gvfs/gvfsd-wsdd @@ -11,32 +11,16 @@ profile gvfsd-wsdd @{exec_path} { include include include - include - include + include + include + include include network inet dgram, # ip=127.0.0.1 peer=(ip=127.0.0.*, port=53), network netlink raw, #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd - - dbus receive bus=session path=/org/gtk/vfs/mountable - interface=org.gtk.vfs.Mountable - member=Mount - peer=(name="@{busname}", label=gvfsd), - dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int} - interface=org.gtk.vfs.Spawner - member=Spawned - peer=(name="@{busname}", label=gvfsd), - dbus send bus=session path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=RegisterMount - peer=(name="@{busname}", label=gvfsd), - - dbus receive bus=session path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member=GetConnection - peer=(name=@{busname}, label=gvfsd-network), + #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker path=/org/gtk/vfs/mounttracker label=gvfsd dbus receive bus=session interface=org.freedesktop.DBus.Introspectable From 14ec69cd150a8926d52c5e9495edb46e37923c5b Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 18:38:02 +0200 Subject: [PATCH 1441/1455] profile(abs): rewrite the way we manage accessibility - Add some missing dbus access - Split bus access in abstractions - Use trough the new accessibility abs. --- apparmor.d/abstractions/accessibility | 15 +++++ .../abstractions/bus/accessibility/org.a11y | 65 +++++++++++++++++++ apparmor.d/abstractions/bus/org.a11y | 63 ------------------ apparmor.d/abstractions/bus/session/org.a11y | 29 +++++++++ 4 files changed, 109 insertions(+), 63 deletions(-) create mode 100644 apparmor.d/abstractions/accessibility create mode 100644 apparmor.d/abstractions/bus/accessibility/org.a11y delete mode 100644 apparmor.d/abstractions/bus/org.a11y create mode 100644 apparmor.d/abstractions/bus/session/org.a11y diff --git a/apparmor.d/abstractions/accessibility b/apparmor.d/abstractions/accessibility new file mode 100644 index 000000000..5bd8c98e7 --- /dev/null +++ b/apparmor.d/abstractions/accessibility @@ -0,0 +1,15 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow communication with Assistive Technology Service Provider Interface (AT-SPI + + abi , + + include + include + include + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/accessibility/org.a11y b/apparmor.d/abstractions/bus/accessibility/org.a11y new file mode 100644 index 000000000..0145fc494 --- /dev/null +++ b/apparmor.d/abstractions/bus/accessibility/org.a11y @@ -0,0 +1,65 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2017 Canonical Ltd +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + # Allow the accessibility services in the user session to send us any events + + dbus receive bus=accessibility + peer=(label="@{p_at_spi2_registryd}"), + + # Allow querying for capabilities and registering + + dbus send bus=accessibility path=/org/a11y/atspi/accessible/root + interface=org.a11y.atspi.Socket + member=Embed + peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), + + dbus send bus=accessibility path=/org/a11y/atspi/registry + interface=org.a11y.atspi.Registry + member=GetRegisteredEvents + peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), + + dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller + interface=org.a11y.atspi.DeviceEventController + member={GetKeystrokeListeners,GetDeviceEventListeners} + peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), + + dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller + interface=org.a11y.atspi.DeviceEventController + member=NotifyListenersSync + peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), + + # org.a11y.atspi is not designed for application isolation and these rules + # can be used to send change events for other processes. + + dbus send bus=accessibility path=/org/a11y/atspi/accessible/root + interface=org.a11y.atspi.Event.Object + member=ChildrenChanged + peer=(name=org.freedesktop.DBus, label="@{p_at_spi2_registryd}"), + + dbus send bus=accessibility path=/org/a11y/atspi/accessible/root + interface=org.a11y.atspi.Accessible + member=Get* + peer=(label="@{p_at_spi2_registryd}"), + + dbus send bus=accessibility path=/org/a11y/atspi/accessible/@{int} + interface=org.a11y.atspi.Event.Object + member={ChildrenChanged,PropertyChange,StateChanged,TextCaretMoved} + peer=(name=org.freedesktop.DBus, label="@{p_at_spi2_registryd}"), + + dbus send bus=accessibility path=/org/a11y/atspi/accessible/@{int} + interface=org.freedesktop.DBus.Properties + member={Get,GetAll} + peer=(label="@{p_at_spi2_registryd}"), + + dbus send bus=accessibility path=/org/a11y/atspi/cache + interface=org.a11y.atspi.Cache + member={AddAccessible,RemoveAccessible} + peer=(name=org.freedesktop.DBus, label="@{p_at_spi2_registryd}"), + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y deleted file mode 100644 index c99f5f8bd..000000000 --- a/apparmor.d/abstractions/bus/org.a11y +++ /dev/null @@ -1,63 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - - abi , - - # Accessibility bus - - dbus receive bus=accessibility path=/org/a11y/atspi/registry - interface=org.a11y.atspi.Registry - member=EventListenerDeregistered - peer=(name="@{busname}", label="@{p_at_spi2_registryd}"), - - dbus send bus=accessibility path=/org/a11y/atspi/registry - interface=org.a11y.atspi.Registry - member=GetRegisteredEvents - peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), - - dbus send bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller - interface=org.a11y.atspi.DeviceEventController - member={GetKeystrokeListeners,GetDeviceEventListeners} - peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), - - dbus receive bus=accessibility path=/org/a11y/atspi/accessible/root - interface=org.freedesktop.DBus.Properties - member=Set - peer=(name="@{busname}", label="@{p_at_spi2_registryd}"), - - dbus send bus=accessibility path=/org/a11y/atspi/accessible/root - interface=org.a11y.atspi.Socket - member=Embed - peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"), - - dbus send bus=accessibility path=/org/a11y/atspi/accessible/root - interface=org.a11y.atspi.Socket - member=Embed - peer=(name=org.a11y.atspi.Registry), - - # Session bus - - dbus send bus=session path=/org/a11y/bus - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=@{busname}, label="@{p_dbus_accessibility}"), - - dbus send bus=session path=/org/a11y/bus - interface=org.freedesktop.DBus.Properties - member=Get - peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"), - - dbus send bus=session path=/org/a11y/bus - interface=org.a11y.Bus - member=Get - peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"), - - dbus send bus=session path=/org/a11y/bus - interface=org.a11y.Bus - member=GetAddress - peer=(name=org.a11y.Bus), - - include if exists - -# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/bus/session/org.a11y b/apparmor.d/abstractions/bus/session/org.a11y new file mode 100644 index 000000000..8f517fe99 --- /dev/null +++ b/apparmor.d/abstractions/bus/session/org.a11y @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + dbus send bus=session path=/org/a11y/bus + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=@{busname}, label="@{p_dbus_accessibility}"), + + dbus send bus=session path=/org/a11y/bus + interface=org.freedesktop.DBus.Properties + member=Get + peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"), + + dbus send bus=session path=/org/a11y/bus + interface=org.a11y.Bus + member=Get + peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"), + + dbus send bus=session path=/org/a11y/bus + interface=org.a11y.Bus + member=GetAddress + peer=(name=org.a11y.Bus), + + include if exists + +# vim:syntax=apparmor From af6fbd2bfdf5a7d158a08f159c534867f5ccc1d2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 19:15:43 +0200 Subject: [PATCH 1442/1455] feat(profile): set accessibility use. --- apparmor.d/abstractions/accessibility | 2 +- apparmor.d/abstractions/app/firefox | 1 - apparmor.d/abstractions/app/open | 4 +--- apparmor.d/abstractions/common/app | 2 -- apparmor.d/abstractions/common/gnome | 2 -- apparmor.d/abstractions/desktop | 1 + apparmor.d/abstractions/gnome-strict | 1 + apparmor.d/abstractions/kde-strict | 1 + apparmor.d/abstractions/lxqt | 3 ++- apparmor.d/abstractions/xfce | 1 + apparmor.d/groups/bluetooth/blueman | 1 - apparmor.d/groups/bus/dbus-accessibility | 2 +- apparmor.d/groups/bus/ibus-extension-gtk3 | 2 -- apparmor.d/groups/bus/ibus-x11 | 2 -- apparmor.d/groups/flatpak/flatpak | 2 -- .../groups/freedesktop/polkit-gnome-authentication-agent | 1 - .../groups/freedesktop/polkit-kde-authentication-agent | 2 -- apparmor.d/groups/freedesktop/xdg-dbus-proxy | 3 +-- apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome | 2 -- apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk | 2 -- apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update | 1 - apparmor.d/groups/gnome/evolution-alarm-notify | 2 -- apparmor.d/groups/gnome/gnome-control-center | 2 -- apparmor.d/groups/gnome/gnome-control-center-goa-helper | 2 -- .../groups/gnome/gnome-control-center-print-renderer | 2 -- apparmor.d/groups/gnome/gnome-disk-image-mounter | 2 -- apparmor.d/groups/gnome/gnome-extension-ding | 2 -- apparmor.d/groups/gnome/gnome-extension-gsconnect | 2 -- apparmor.d/groups/gnome/gnome-initial-setup | 2 -- apparmor.d/groups/gnome/gnome-session-binary | 2 -- apparmor.d/groups/gnome/gnome-shell | 3 --- apparmor.d/groups/gnome/gnome-terminal-server | 2 -- apparmor.d/groups/gnome/gsd-color | 2 -- apparmor.d/groups/gnome/gsd-keyboard | 2 -- apparmor.d/groups/gnome/gsd-media-keys | 2 -- apparmor.d/groups/gnome/gsd-power | 2 -- apparmor.d/groups/gnome/gsd-wacom | 2 -- apparmor.d/groups/gnome/gsd-xsettings | 2 -- apparmor.d/groups/gnome/loupe | 2 -- apparmor.d/groups/gnome/mutter-x11-frames | 2 -- apparmor.d/groups/gnome/nautilus | 2 -- apparmor.d/groups/gnome/seahorse | 2 -- apparmor.d/groups/kde/DiscoverNotifier | 2 -- apparmor.d/groups/kde/baloorunner | 2 -- apparmor.d/groups/kde/gmenudbusmenuproxy | 2 -- apparmor.d/groups/kde/kaccess | 2 -- apparmor.d/groups/kde/kactivitymanagerd | 1 - apparmor.d/groups/kde/kde-powerdevil | 2 -- apparmor.d/groups/kde/kded | 4 +--- apparmor.d/groups/kde/kglobalacceld | 2 -- apparmor.d/groups/kde/konsole | 2 -- apparmor.d/groups/kde/kscreen_backend_launcher | 2 -- apparmor.d/groups/kde/ksmserver | 1 - apparmor.d/groups/kde/ksmserver-logout-greeter | 2 -- apparmor.d/groups/kde/ksplashqml | 2 -- apparmor.d/groups/kde/kstart | 1 - apparmor.d/groups/kde/kwalletd | 2 -- apparmor.d/groups/kde/kwin_wayland | 2 -- apparmor.d/groups/kde/kwin_x11 | 1 - apparmor.d/groups/kde/plasmashell | 2 -- apparmor.d/groups/kde/systemsettings | 2 -- apparmor.d/groups/kde/xembedsniproxy | 2 -- apparmor.d/groups/lxqt/lxqt-globalkeysd | 1 - apparmor.d/groups/lxqt/lxqt-session | 1 - apparmor.d/groups/network/mullvad-gui | 2 -- apparmor.d/groups/systemd/busctl | 2 -- apparmor.d/groups/ubuntu/apport-gtk | 2 -- apparmor.d/groups/ubuntu/check-new-release-gtk | 2 -- apparmor.d/groups/ubuntu/livepatch-notification | 2 -- apparmor.d/groups/ubuntu/software-properties-gtk | 2 -- apparmor.d/groups/ubuntu/ubuntu-advantage-notification | 2 -- apparmor.d/groups/ubuntu/update-manager | 2 -- apparmor.d/groups/ubuntu/update-notifier | 2 -- apparmor.d/groups/xfce/thunar | 1 - apparmor.d/groups/xfce/thunar-volman | 1 - apparmor.d/groups/xfce/xfce-clipman-settings | 1 - apparmor.d/groups/xfce/xfce-notifyd | 1 - apparmor.d/groups/xfce/xfce-panel | 1 - apparmor.d/groups/xfce/xfce-power-manager | 1 - apparmor.d/groups/xfce/xfce-screensaver | 1 - apparmor.d/groups/xfce/xfce-session | 1 - apparmor.d/groups/xfce/xfce-terminal | 1 - apparmor.d/groups/xfce/xfdesktop | 1 - apparmor.d/groups/xfce/xfsettingsd | 1 - apparmor.d/groups/xfce/xfwm | 1 - apparmor.d/profiles-a-f/alacarte | 2 -- apparmor.d/profiles-a-f/atril | 7 +------ apparmor.d/profiles-a-f/calibre | 2 -- apparmor.d/profiles-a-f/engrampa | 2 -- apparmor.d/profiles-a-f/evince | 2 -- apparmor.d/profiles-a-f/evince-previewer | 2 +- apparmor.d/profiles-g-l/kerneloops-applet | 2 -- apparmor.d/profiles-g-l/libreoffice | 2 -- apparmor.d/profiles-m-r/qbittorrent | 2 -- apparmor.d/profiles-m-r/remmina | 2 -- apparmor.d/profiles-m-r/rustdesk | 2 -- apparmor.d/profiles-s-z/YACReaderLibrary | 1 - apparmor.d/profiles-s-z/simple-scan | 2 -- apparmor.d/profiles-s-z/spice-vdagent | 2 -- apparmor.d/profiles-s-z/spotify | 4 +--- apparmor.d/profiles-s-z/superproductivity | 2 -- apparmor.d/profiles-s-z/terminator | 2 -- apparmor.d/profiles-s-z/transmission | 2 -- apparmor.d/profiles-s-z/virt-manager | 2 -- apparmor.d/profiles-s-z/vlc | 3 --- apparmor.d/profiles-s-z/wireshark | 1 - 106 files changed, 14 insertions(+), 185 deletions(-) diff --git a/apparmor.d/abstractions/accessibility b/apparmor.d/abstractions/accessibility index 5bd8c98e7..894ee467e 100644 --- a/apparmor.d/abstractions/accessibility +++ b/apparmor.d/abstractions/accessibility @@ -2,7 +2,7 @@ # Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Allow communication with Assistive Technology Service Provider Interface (AT-SPI +# Allow communication with Assistive Technology Service Provider Interface (AT-SPI) abi , diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index 7630b8576..0648e68d1 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -22,7 +22,6 @@ include include include - include include include include diff --git a/apparmor.d/abstractions/app/open b/apparmor.d/abstractions/app/open index 3d91de235..8dffc39b9 100644 --- a/apparmor.d/abstractions/app/open +++ b/apparmor.d/abstractions/app/open @@ -7,8 +7,8 @@ abi , + include include - include include # We cannot use `@{open_path} mrix,` here because it includes: @@ -31,8 +31,6 @@ # if @{DE} == kde include - include - include include include diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index 091cfbbb4..28badc6db 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -14,10 +14,8 @@ include include - include include include - include include include include diff --git a/apparmor.d/abstractions/common/gnome b/apparmor.d/abstractions/common/gnome index b9f36cf6c..6dcb26860 100644 --- a/apparmor.d/abstractions/common/gnome +++ b/apparmor.d/abstractions/common/gnome @@ -6,9 +6,7 @@ abi , - include include - include include include include diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 316e7374e..66742f02a 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -9,6 +9,7 @@ abi , + include include include include diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index a3afccb76..47efde306 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -4,6 +4,7 @@ abi , + include include include include diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index f00594038..17952414c 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -4,6 +4,7 @@ abi , + include include include include diff --git a/apparmor.d/abstractions/lxqt b/apparmor.d/abstractions/lxqt index ba7347d8c..8d83aefdc 100644 --- a/apparmor.d/abstractions/lxqt +++ b/apparmor.d/abstractions/lxqt @@ -4,8 +4,9 @@ abi , - include + include include + include include include include diff --git a/apparmor.d/abstractions/xfce b/apparmor.d/abstractions/xfce index eaf50f6d0..c7e464236 100644 --- a/apparmor.d/abstractions/xfce +++ b/apparmor.d/abstractions/xfce @@ -4,6 +4,7 @@ abi , + include include include include diff --git a/apparmor.d/groups/bluetooth/blueman b/apparmor.d/groups/bluetooth/blueman index 469fb24a0..08a553c1d 100644 --- a/apparmor.d/groups/bluetooth/blueman +++ b/apparmor.d/groups/bluetooth/blueman @@ -11,7 +11,6 @@ include profile blueman @{exec_path} flags=(attach_disconnected) { include include - include include include include diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index c254fcd2d..910ae0008 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -11,7 +11,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/bus/ibus-extension-gtk3 b/apparmor.d/groups/bus/ibus-extension-gtk3 index 0973fce49..2fa49e50f 100644 --- a/apparmor.d/groups/bus/ibus-extension-gtk3 +++ b/apparmor.d/groups/bus/ibus-extension-gtk3 @@ -9,9 +9,7 @@ include @{exec_path} = @{lib}/{,ibus/}ibus-extension-gtk3 profile ibus-extension-gtk3 @{exec_path} flags=(attach_disconnected) { include - include include - include include include include diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index cf7b40190..ce1c2b108 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -10,9 +10,7 @@ include profile ibus-x11 @{exec_path} flags=(attach_disconnected) { include include - include include - include include include include diff --git a/apparmor.d/groups/flatpak/flatpak b/apparmor.d/groups/flatpak/flatpak index 3fee701a8..341db555e 100644 --- a/apparmor.d/groups/flatpak/flatpak +++ b/apparmor.d/groups/flatpak/flatpak @@ -9,10 +9,8 @@ include @{exec_path} = @{bin}/flatpak profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) { include - include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent b/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent index f1ca0fd31..bb48d0c5b 100644 --- a/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent @@ -13,7 +13,6 @@ include profile polkit-gnome-authentication-agent @{exec_path} { include include - include include include include diff --git a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent index 5e7a75a8d..8a08f02d0 100644 --- a/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent +++ b/apparmor.d/groups/freedesktop/polkit-kde-authentication-agent @@ -11,10 +11,8 @@ include @{exec_path} += @{lib}/polkit-kde-authentication-agent-[0-9] profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected,mediate_deleted) { include - include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-dbus-proxy b/apparmor.d/groups/freedesktop/xdg-dbus-proxy index fafdea3a5..031f03ac4 100644 --- a/apparmor.d/groups/freedesktop/xdg-dbus-proxy +++ b/apparmor.d/groups/freedesktop/xdg-dbus-proxy @@ -9,11 +9,10 @@ include @{exec_path} = @{bin}/xdg-dbus-proxy profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { include + include include - include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index b6c77f336..95daf2935 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -9,10 +9,8 @@ include @{exec_path} = @{lib}/xdg-desktop-portal-gnome profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include - include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index 35199d859..d1ae86e15 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -9,10 +9,8 @@ include @{exec_path} = @{lib}/xdg-desktop-portal-gtk profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include - include include include - include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update index 1b818267f..feb1b9bd6 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/xdg-user-dirs-gtk-update profile xdg-user-dirs-gtk-update @{exec_path} { include - include include include include diff --git a/apparmor.d/groups/gnome/evolution-alarm-notify b/apparmor.d/groups/gnome/evolution-alarm-notify index 9f8c51a75..501685b22 100644 --- a/apparmor.d/groups/gnome/evolution-alarm-notify +++ b/apparmor.d/groups/gnome/evolution-alarm-notify @@ -9,9 +9,7 @@ include @{exec_path} = @{lib}/evolution-data-server/{,evolution-data-server/}evolution-alarm-notify profile evolution-alarm-notify @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index c27f32fec..9f78fb4fd 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -11,10 +11,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { include include include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center-goa-helper b/apparmor.d/groups/gnome/gnome-control-center-goa-helper index aeb59295f..8b813d260 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-goa-helper +++ b/apparmor.d/groups/gnome/gnome-control-center-goa-helper @@ -10,10 +10,8 @@ include profile gnome-control-center-goa-helper @{exec_path} { include include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-control-center-print-renderer b/apparmor.d/groups/gnome/gnome-control-center-print-renderer index 59679deb8..cbd1f1a75 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-print-renderer +++ b/apparmor.d/groups/gnome/gnome-control-center-print-renderer @@ -9,9 +9,7 @@ include @{exec_path} = @{lib}/gnome-control-center-print-renderer profile gnome-control-center-print-renderer @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-disk-image-mounter b/apparmor.d/groups/gnome/gnome-disk-image-mounter index 55d49e250..d9959691b 100644 --- a/apparmor.d/groups/gnome/gnome-disk-image-mounter +++ b/apparmor.d/groups/gnome/gnome-disk-image-mounter @@ -9,10 +9,8 @@ include @{exec_path} = @{bin}/gnome-disk-image-mounter profile gnome-disk-image-mounter @{exec_path} { include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-extension-ding b/apparmor.d/groups/gnome/gnome-extension-ding index f56af9f67..9f848be8e 100644 --- a/apparmor.d/groups/gnome/gnome-extension-ding +++ b/apparmor.d/groups/gnome/gnome-extension-ding @@ -13,11 +13,9 @@ include profile gnome-extension-ding @{exec_path} { include include - include include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-extension-gsconnect b/apparmor.d/groups/gnome/gnome-extension-gsconnect index 8ac7830cc..2592eb77e 100644 --- a/apparmor.d/groups/gnome/gnome-extension-gsconnect +++ b/apparmor.d/groups/gnome/gnome-extension-gsconnect @@ -13,10 +13,8 @@ include profile gnome-extension-gsconnect @{exec_path} { include include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-initial-setup b/apparmor.d/groups/gnome/gnome-initial-setup index 7f4b818e3..7439e0fb6 100644 --- a/apparmor.d/groups/gnome/gnome-initial-setup +++ b/apparmor.d/groups/gnome/gnome-initial-setup @@ -9,10 +9,8 @@ include @{exec_path} = @{lib}/gnome-initial-setup profile gnome-initial-setup @{exec_path} { include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index f4c61c5c6..5359a70df 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -9,10 +9,8 @@ include @{exec_path} = @{lib}/gnome-session-binary profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 55e95d006..a82278a6c 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -10,15 +10,12 @@ include profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include - include include include include include include include - include - include include include include diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index 7a9bad4da..fe380dadd 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -10,9 +10,7 @@ include profile gnome-terminal-server @{exec_path} { include include - include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index a0b3fac6b..0acdbaf38 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -10,10 +10,8 @@ include profile gsd-color @{exec_path} flags=(attach_disconnected) { include include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-keyboard b/apparmor.d/groups/gnome/gsd-keyboard index f4f2830b8..b700a7df9 100644 --- a/apparmor.d/groups/gnome/gsd-keyboard +++ b/apparmor.d/groups/gnome/gsd-keyboard @@ -10,10 +10,8 @@ include profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { include include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 9f6f70fbc..3ca105656 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -10,10 +10,8 @@ include profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index a6165ddcf..d20ad65d0 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -10,11 +10,9 @@ include profile gsd-power @{exec_path} flags=(attach_disconnected) { include include - include include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-wacom b/apparmor.d/groups/gnome/gsd-wacom index 50da29b5f..0bb1d50d1 100644 --- a/apparmor.d/groups/gnome/gsd-wacom +++ b/apparmor.d/groups/gnome/gsd-wacom @@ -10,9 +10,7 @@ include profile gsd-wacom @{exec_path} flags=(attach_disconnected) { include include - include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index 7618dc3b6..84abb82e0 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -9,10 +9,8 @@ include @{exec_path} = @{lib}/gsd-xsettings profile gsd-xsettings @{exec_path} { include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/loupe b/apparmor.d/groups/gnome/loupe index cabcca062..ea55ee902 100644 --- a/apparmor.d/groups/gnome/loupe +++ b/apparmor.d/groups/gnome/loupe @@ -9,10 +9,8 @@ include @{exec_path} = @{bin}/loupe profile loupe @{exec_path} flags=(attach_disconnected) { include - include include include - include include include include diff --git a/apparmor.d/groups/gnome/mutter-x11-frames b/apparmor.d/groups/gnome/mutter-x11-frames index f50bdbd9b..d5c83a31b 100644 --- a/apparmor.d/groups/gnome/mutter-x11-frames +++ b/apparmor.d/groups/gnome/mutter-x11-frames @@ -10,9 +10,7 @@ include profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { include include - include include - include include include include diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 07abe1c08..d3906051c 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -9,11 +9,9 @@ include @{exec_path} = @{bin}/nautilus profile nautilus @{exec_path} flags=(attach_disconnected) { include - include include include include - include include include include diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index 090a9cbe7..c34526ee1 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -10,10 +10,8 @@ include profile seahorse @{exec_path} { include include - include include include - include include include include diff --git a/apparmor.d/groups/kde/DiscoverNotifier b/apparmor.d/groups/kde/DiscoverNotifier index 0965396ab..b5e1b4ae8 100644 --- a/apparmor.d/groups/kde/DiscoverNotifier +++ b/apparmor.d/groups/kde/DiscoverNotifier @@ -10,10 +10,8 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}DiscoverNotifier profile DiscoverNotifier @{exec_path} { include - include include include - include include include include diff --git a/apparmor.d/groups/kde/baloorunner b/apparmor.d/groups/kde/baloorunner index 64372f497..33660a776 100644 --- a/apparmor.d/groups/kde/baloorunner +++ b/apparmor.d/groups/kde/baloorunner @@ -10,9 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}baloorunner profile baloorunner @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/groups/kde/gmenudbusmenuproxy b/apparmor.d/groups/kde/gmenudbusmenuproxy index f63a83295..dbca9fcf5 100644 --- a/apparmor.d/groups/kde/gmenudbusmenuproxy +++ b/apparmor.d/groups/kde/gmenudbusmenuproxy @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/gmenudbusmenuproxy profile gmenudbusmenuproxy @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/groups/kde/kaccess b/apparmor.d/groups/kde/kaccess index 8258d1bde..1fdb4b920 100644 --- a/apparmor.d/groups/kde/kaccess +++ b/apparmor.d/groups/kde/kaccess @@ -10,9 +10,7 @@ include profile kaccess @{exec_path} { include include - include include - include include include include diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index ead285e5f..1cc6b41d1 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -11,7 +11,6 @@ include profile kactivitymanagerd @{exec_path} { include include - include include include include diff --git a/apparmor.d/groups/kde/kde-powerdevil b/apparmor.d/groups/kde/kde-powerdevil index f40c86e03..7d6daeda6 100644 --- a/apparmor.d/groups/kde/kde-powerdevil +++ b/apparmor.d/groups/kde/kde-powerdevil @@ -11,10 +11,8 @@ include profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted) { include include - include include include - include include include include diff --git a/apparmor.d/groups/kde/kded b/apparmor.d/groups/kde/kded index ec5a1ee36..678c64e71 100644 --- a/apparmor.d/groups/kde/kded +++ b/apparmor.d/groups/kde/kded @@ -11,14 +11,12 @@ profile kded @{exec_path} { include include #aa:only apt include - include include include - include - include include include include + include include include include diff --git a/apparmor.d/groups/kde/kglobalacceld b/apparmor.d/groups/kde/kglobalacceld index b9c09d0c6..156bdf928 100644 --- a/apparmor.d/groups/kde/kglobalacceld +++ b/apparmor.d/groups/kde/kglobalacceld @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/kglobalaccel5 @{lib}/kglobalacceld profile kglobalacceld @{exec_path} { include - include include - include include #aa:dbus own bus=session name=org.kde.KGlobalAccel path=/kglobalaccel diff --git a/apparmor.d/groups/kde/konsole b/apparmor.d/groups/kde/konsole index fa55e177d..446d8a08d 100644 --- a/apparmor.d/groups/kde/konsole +++ b/apparmor.d/groups/kde/konsole @@ -11,9 +11,7 @@ include profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include - include include - include include include include diff --git a/apparmor.d/groups/kde/kscreen_backend_launcher b/apparmor.d/groups/kde/kscreen_backend_launcher index 00b4c9630..e44ee1f83 100644 --- a/apparmor.d/groups/kde/kscreen_backend_launcher +++ b/apparmor.d/groups/kde/kscreen_backend_launcher @@ -10,9 +10,7 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}kf{5,6}/kscreen_backend_launcher profile kscreen_backend_launcher @{exec_path} { include - include include - include include include diff --git a/apparmor.d/groups/kde/ksmserver b/apparmor.d/groups/kde/ksmserver index f4d54c295..09a228e29 100644 --- a/apparmor.d/groups/kde/ksmserver +++ b/apparmor.d/groups/kde/ksmserver @@ -11,7 +11,6 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include - include include include include diff --git a/apparmor.d/groups/kde/ksmserver-logout-greeter b/apparmor.d/groups/kde/ksmserver-logout-greeter index e46237c2a..711da6e9d 100644 --- a/apparmor.d/groups/kde/ksmserver-logout-greeter +++ b/apparmor.d/groups/kde/ksmserver-logout-greeter @@ -11,10 +11,8 @@ include @{exec_path} += @{lib}/@{multiarch}/{,libexec/}ksmserver-logout-greeter profile ksmserver-logout-greeter @{exec_path} flags=(attach_disconnected,mediate_deleted) { include - include include include - include include include include diff --git a/apparmor.d/groups/kde/ksplashqml b/apparmor.d/groups/kde/ksplashqml index ea80e28cd..770625988 100644 --- a/apparmor.d/groups/kde/ksplashqml +++ b/apparmor.d/groups/kde/ksplashqml @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/ksplashqml profile ksplashqml @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/groups/kde/kstart b/apparmor.d/groups/kde/kstart index fa0f88f75..04d084d0c 100644 --- a/apparmor.d/groups/kde/kstart +++ b/apparmor.d/groups/kde/kstart @@ -10,7 +10,6 @@ include @{exec_path} = @{bin}/kstart profile kstart @{exec_path} flags=(attach_disconnected) { include - include include include include diff --git a/apparmor.d/groups/kde/kwalletd b/apparmor.d/groups/kde/kwalletd index baaad7dcb..0a685d8e5 100644 --- a/apparmor.d/groups/kde/kwalletd +++ b/apparmor.d/groups/kde/kwalletd @@ -11,9 +11,7 @@ include profile kwalletd @{exec_path} { include include - include include - include include include include diff --git a/apparmor.d/groups/kde/kwin_wayland b/apparmor.d/groups/kde/kwin_wayland index e2e3ecfe0..224835ac2 100644 --- a/apparmor.d/groups/kde/kwin_wayland +++ b/apparmor.d/groups/kde/kwin_wayland @@ -10,10 +10,8 @@ include profile kwin_wayland @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include - include include include - include include include include diff --git a/apparmor.d/groups/kde/kwin_x11 b/apparmor.d/groups/kde/kwin_x11 index ac80b3b18..8cc233ff2 100644 --- a/apparmor.d/groups/kde/kwin_x11 +++ b/apparmor.d/groups/kde/kwin_x11 @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/kwin_x11 profile kwin_x11 @{exec_path} { include - include include include include diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index cc9907266..600d1be48 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -11,10 +11,8 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { include include include - include include include - include include include include diff --git a/apparmor.d/groups/kde/systemsettings b/apparmor.d/groups/kde/systemsettings index a78225b67..9558a6528 100644 --- a/apparmor.d/groups/kde/systemsettings +++ b/apparmor.d/groups/kde/systemsettings @@ -10,9 +10,7 @@ include profile systemsettings @{exec_path} { include include - include include - include include include include diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index 93259822e..5c36f579e 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/xembedsniproxy profile xembedsniproxy @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/groups/lxqt/lxqt-globalkeysd b/apparmor.d/groups/lxqt/lxqt-globalkeysd index 8729b1abb..a9a75aa90 100644 --- a/apparmor.d/groups/lxqt/lxqt-globalkeysd +++ b/apparmor.d/groups/lxqt/lxqt-globalkeysd @@ -10,7 +10,6 @@ include @{exec_path} = @{bin}/lxqt-globalkeysd profile lxqt-globalkeysd @{exec_path} { include - include include include diff --git a/apparmor.d/groups/lxqt/lxqt-session b/apparmor.d/groups/lxqt/lxqt-session index 085b444b1..910ea7c5f 100644 --- a/apparmor.d/groups/lxqt/lxqt-session +++ b/apparmor.d/groups/lxqt/lxqt-session @@ -11,7 +11,6 @@ include profile lxqt-session @{exec_path} flags=(attach_disconnected) { include include - include include include include diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index 639d3ce4b..132e25e6d 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -15,9 +15,7 @@ include @{exec_path} = @{lib_dirs}/mullvad-gui profile mullvad-gui @{exec_path} flags=(attach_disconnected) { include - include include - include include network inet stream, diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl index 04ed76e72..eed7080f8 100644 --- a/apparmor.d/groups/systemd/busctl +++ b/apparmor.d/groups/systemd/busctl @@ -9,10 +9,8 @@ include @{exec_path} = @{bin}/busctl profile busctl @{exec_path} flags=(attach_disconnected) { include - include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk index 0cd509473..6d90cadda 100644 --- a/apparmor.d/groups/ubuntu/apport-gtk +++ b/apparmor.d/groups/ubuntu/apport-gtk @@ -11,9 +11,7 @@ profile apport-gtk @{exec_path} { include include include - include include - include include include include diff --git a/apparmor.d/groups/ubuntu/check-new-release-gtk b/apparmor.d/groups/ubuntu/check-new-release-gtk index 5df19d897..2b7b2b4ee 100644 --- a/apparmor.d/groups/ubuntu/check-new-release-gtk +++ b/apparmor.d/groups/ubuntu/check-new-release-gtk @@ -10,9 +10,7 @@ include profile check-new-release-gtk @{exec_path} { include include - include include - include include include include diff --git a/apparmor.d/groups/ubuntu/livepatch-notification b/apparmor.d/groups/ubuntu/livepatch-notification index e003054a5..fb8eb259e 100644 --- a/apparmor.d/groups/ubuntu/livepatch-notification +++ b/apparmor.d/groups/ubuntu/livepatch-notification @@ -9,9 +9,7 @@ include @{exec_path} = @{lib}/update-notifier/livepatch-notification profile livepatch-notification @{exec_path} { include - include include - include include include diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 2f6398f1e..836adbb55 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -11,10 +11,8 @@ profile software-properties-gtk @{exec_path} flags=(attach_disconnected) { include include include - include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification index 093fdbed7..a44e226bc 100644 --- a/apparmor.d/groups/ubuntu/ubuntu-advantage-notification +++ b/apparmor.d/groups/ubuntu/ubuntu-advantage-notification @@ -9,9 +9,7 @@ include @{exec_path} = @{lib}/update-notifier/ubuntu-advantage-notification profile ubuntu-advantage-notification @{exec_path} { include - include include - include include include diff --git a/apparmor.d/groups/ubuntu/update-manager b/apparmor.d/groups/ubuntu/update-manager index a874ca346..873f06b67 100644 --- a/apparmor.d/groups/ubuntu/update-manager +++ b/apparmor.d/groups/ubuntu/update-manager @@ -11,10 +11,8 @@ profile update-manager @{exec_path} flags=(attach_disconnected) { include include include - include include include - include include include include diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier index f66345b67..06e851b45 100644 --- a/apparmor.d/groups/ubuntu/update-notifier +++ b/apparmor.d/groups/ubuntu/update-notifier @@ -11,10 +11,8 @@ profile update-notifier @{exec_path} { include include include - include include include - include include include include diff --git a/apparmor.d/groups/xfce/thunar b/apparmor.d/groups/xfce/thunar index 2fcd83048..10096bce2 100644 --- a/apparmor.d/groups/xfce/thunar +++ b/apparmor.d/groups/xfce/thunar @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/thunar profile thunar @{exec_path} flags=(attach_disconnected) { include - include include include include diff --git a/apparmor.d/groups/xfce/thunar-volman b/apparmor.d/groups/xfce/thunar-volman index fc73a14c9..41e098548 100644 --- a/apparmor.d/groups/xfce/thunar-volman +++ b/apparmor.d/groups/xfce/thunar-volman @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/thunar-volman profile thunar-volman @{exec_path} { include - include include include include diff --git a/apparmor.d/groups/xfce/xfce-clipman-settings b/apparmor.d/groups/xfce/xfce-clipman-settings index 9e74d8046..021a377b8 100644 --- a/apparmor.d/groups/xfce/xfce-clipman-settings +++ b/apparmor.d/groups/xfce/xfce-clipman-settings @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/xfce4-clipman-settings profile xfce-clipman-settings @{exec_path} { include - include include include diff --git a/apparmor.d/groups/xfce/xfce-notifyd b/apparmor.d/groups/xfce/xfce-notifyd index c594b8ed3..be813a84d 100644 --- a/apparmor.d/groups/xfce/xfce-notifyd +++ b/apparmor.d/groups/xfce/xfce-notifyd @@ -10,7 +10,6 @@ include @{exec_path} = @{lib}/{,@{multiarch}/}xfce4/notifyd/xfce4-notifyd profile xfce-notifyd @{exec_path} { include - include include include include diff --git a/apparmor.d/groups/xfce/xfce-panel b/apparmor.d/groups/xfce/xfce-panel index b04ed2eb9..00c5d8700 100644 --- a/apparmor.d/groups/xfce/xfce-panel +++ b/apparmor.d/groups/xfce/xfce-panel @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/xfce4-panel @{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0 profile xfce-panel @{exec_path} { include - include include include include diff --git a/apparmor.d/groups/xfce/xfce-power-manager b/apparmor.d/groups/xfce/xfce-power-manager index 91be9eede..11ccca455 100644 --- a/apparmor.d/groups/xfce/xfce-power-manager +++ b/apparmor.d/groups/xfce/xfce-power-manager @@ -10,7 +10,6 @@ include profile xfce-power-manager @{exec_path} flags=(attach_disconnected) { include include - include include include include diff --git a/apparmor.d/groups/xfce/xfce-screensaver b/apparmor.d/groups/xfce/xfce-screensaver index 2c0f13bc1..e9e19cca5 100644 --- a/apparmor.d/groups/xfce/xfce-screensaver +++ b/apparmor.d/groups/xfce/xfce-screensaver @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/xfce4-screensaver profile xfce-screensaver @{exec_path} flags=(attach_disconnected) { include - include include include include diff --git a/apparmor.d/groups/xfce/xfce-session b/apparmor.d/groups/xfce/xfce-session index beddcce1f..be0f5c73d 100644 --- a/apparmor.d/groups/xfce/xfce-session +++ b/apparmor.d/groups/xfce/xfce-session @@ -11,7 +11,6 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/xfce/xfce-terminal b/apparmor.d/groups/xfce/xfce-terminal index 8d2f06a75..0f8836326 100644 --- a/apparmor.d/groups/xfce/xfce-terminal +++ b/apparmor.d/groups/xfce/xfce-terminal @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/xfce4-terminal profile xfce-terminal @{exec_path} { include - include include include include diff --git a/apparmor.d/groups/xfce/xfdesktop b/apparmor.d/groups/xfce/xfdesktop index ff36e8459..6bc5ec15c 100644 --- a/apparmor.d/groups/xfce/xfdesktop +++ b/apparmor.d/groups/xfce/xfdesktop @@ -10,7 +10,6 @@ include profile xfdesktop @{exec_path} { include include - include include include include diff --git a/apparmor.d/groups/xfce/xfsettingsd b/apparmor.d/groups/xfce/xfsettingsd index 22db3f80d..d3f88c196 100644 --- a/apparmor.d/groups/xfce/xfsettingsd +++ b/apparmor.d/groups/xfce/xfsettingsd @@ -10,7 +10,6 @@ include profile xfsettingsd @{exec_path} { include include - include include include include diff --git a/apparmor.d/groups/xfce/xfwm b/apparmor.d/groups/xfce/xfwm index 7ecd2c8fe..c41e5254f 100644 --- a/apparmor.d/groups/xfce/xfwm +++ b/apparmor.d/groups/xfce/xfwm @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/xfwm4 profile xfwm @{exec_path} { include - include include include include diff --git a/apparmor.d/profiles-a-f/alacarte b/apparmor.d/profiles-a-f/alacarte index b4cfb56e6..87908dc9e 100644 --- a/apparmor.d/profiles-a-f/alacarte +++ b/apparmor.d/profiles-a-f/alacarte @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/alacarte profile alacarte @{exec_path} flags=(attach_disconnected) { include - include include - include include include include diff --git a/apparmor.d/profiles-a-f/atril b/apparmor.d/profiles-a-f/atril index c95f6be55..55502dd3e 100644 --- a/apparmor.d/profiles-a-f/atril +++ b/apparmor.d/profiles-a-f/atril @@ -10,18 +10,13 @@ include @{exec_path} = @{bin}/atril{,-*} profile atril @{exec_path} { include - include include - include include include - include - include - include + include include include include - include network netlink raw, diff --git a/apparmor.d/profiles-a-f/calibre b/apparmor.d/profiles-a-f/calibre index 60843b0a6..281d15718 100644 --- a/apparmor.d/profiles-a-f/calibre +++ b/apparmor.d/profiles-a-f/calibre @@ -12,9 +12,7 @@ include @{exec_path} += @{bin}/lrs2lrf @{bin}/lrf2lrs @{bin}/lrfviewer @{bin}/web2disk profile calibre @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/profiles-a-f/engrampa b/apparmor.d/profiles-a-f/engrampa index 8137edd8d..3e650962f 100644 --- a/apparmor.d/profiles-a-f/engrampa +++ b/apparmor.d/profiles-a-f/engrampa @@ -10,9 +10,7 @@ include @{exec_path} = @{bin}/engrampa profile engrampa @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index e07c91f3d..d6969807f 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/evince @{lib}/evinced profile evince @{exec_path} { include - include include - include include include include diff --git a/apparmor.d/profiles-a-f/evince-previewer b/apparmor.d/profiles-a-f/evince-previewer index 1597c35af..dcd28ddc9 100644 --- a/apparmor.d/profiles-a-f/evince-previewer +++ b/apparmor.d/profiles-a-f/evince-previewer @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/evince-previewer profile evince-previewer @{exec_path} { include - include + include include include include diff --git a/apparmor.d/profiles-g-l/kerneloops-applet b/apparmor.d/profiles-g-l/kerneloops-applet index 758ead716..d9d556879 100644 --- a/apparmor.d/profiles-g-l/kerneloops-applet +++ b/apparmor.d/profiles-g-l/kerneloops-applet @@ -10,10 +10,8 @@ include @{exec_path} = @{bin}/kerneloops-applet profile kerneloops-applet @{exec_path} { include - include include include - include include include diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index bc6516fc2..cc2ee8c2a 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -12,10 +12,8 @@ profile libreoffice @{exec_path} { include include include - include include include - include include include include diff --git a/apparmor.d/profiles-m-r/qbittorrent b/apparmor.d/profiles-m-r/qbittorrent index 5d9cba087..e0d430443 100644 --- a/apparmor.d/profiles-m-r/qbittorrent +++ b/apparmor.d/profiles-m-r/qbittorrent @@ -10,10 +10,8 @@ include @{exec_path} = @{bin}/qbittorrent profile qbittorrent @{exec_path} { include - include include include - include include include include diff --git a/apparmor.d/profiles-m-r/remmina b/apparmor.d/profiles-m-r/remmina index b8b361e12..80e58fd7c 100644 --- a/apparmor.d/profiles-m-r/remmina +++ b/apparmor.d/profiles-m-r/remmina @@ -11,10 +11,8 @@ profile remmina @{exec_path} { include include include - include include include - include include include include diff --git a/apparmor.d/profiles-m-r/rustdesk b/apparmor.d/profiles-m-r/rustdesk index acdad5640..3e6791ddc 100644 --- a/apparmor.d/profiles-m-r/rustdesk +++ b/apparmor.d/profiles-m-r/rustdesk @@ -10,9 +10,7 @@ include profile rustdesk @{exec_path} { include include - include include - include include include include diff --git a/apparmor.d/profiles-s-z/YACReaderLibrary b/apparmor.d/profiles-s-z/YACReaderLibrary index 38336fbc7..e6c231df3 100644 --- a/apparmor.d/profiles-s-z/YACReaderLibrary +++ b/apparmor.d/profiles-s-z/YACReaderLibrary @@ -9,7 +9,6 @@ include @{exec_path} = @{bin}/YACReaderLibrary profile YACReaderLibrary @{exec_path} flags=(attach_disconnected,mediate_deleted) { include - include include include include diff --git a/apparmor.d/profiles-s-z/simple-scan b/apparmor.d/profiles-s-z/simple-scan index f79b284fb..a005708db 100644 --- a/apparmor.d/profiles-s-z/simple-scan +++ b/apparmor.d/profiles-s-z/simple-scan @@ -9,8 +9,6 @@ include @{exec_path} = @{bin}/simple-scan profile simple-scan @{exec_path} { include - include - include include include include diff --git a/apparmor.d/profiles-s-z/spice-vdagent b/apparmor.d/profiles-s-z/spice-vdagent index 18e3fc248..2af3f99ae 100644 --- a/apparmor.d/profiles-s-z/spice-vdagent +++ b/apparmor.d/profiles-s-z/spice-vdagent @@ -11,10 +11,8 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) { include include include - include include include - include include include include diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index f3c4acf4f..a3c4b822a 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -17,11 +17,9 @@ include profile spotify @{exec_path} flags=(attach_disconnected) { include include - include include include - include - include + include include include include diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index a7adf91fa..b84322ae0 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -16,10 +16,8 @@ include profile superproductivity @{exec_path} flags=(attach_disconnected) { include include - include include include - include include include include diff --git a/apparmor.d/profiles-s-z/terminator b/apparmor.d/profiles-s-z/terminator index e9baf97e1..e8a2533b9 100644 --- a/apparmor.d/profiles-s-z/terminator +++ b/apparmor.d/profiles-s-z/terminator @@ -10,9 +10,7 @@ include profile terminator @{exec_path} flags=(attach_disconnected) { include include - include include - include include include include diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission index 78d67787d..9c4a8e673 100644 --- a/apparmor.d/profiles-s-z/transmission +++ b/apparmor.d/profiles-s-z/transmission @@ -9,9 +9,7 @@ include @{exec_path} = @{bin}/transmission-{gtk,qt} profile transmission @{exec_path} flags=(attach_disconnected) { include - include include - include include include include diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index 9802ecd5a..92dc977d9 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -12,10 +12,8 @@ include profile virt-manager @{exec_path} flags=(attach_disconnected) { include include - include include include - include include include include diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index 7e9c31866..bda3010fa 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -11,10 +11,7 @@ include profile vlc @{exec_path} { include include - include include - include - include include include include diff --git a/apparmor.d/profiles-s-z/wireshark b/apparmor.d/profiles-s-z/wireshark index c29543d6b..a07d6bad1 100644 --- a/apparmor.d/profiles-s-z/wireshark +++ b/apparmor.d/profiles-s-z/wireshark @@ -11,7 +11,6 @@ include @{exec_path} = @{bin}/wireshark profile wireshark @{exec_path} { include - include include include include From efa28446f930af3032645b0b9e3197f2d439e6e3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 19:23:43 +0200 Subject: [PATCH 1443/1455] feat(abs): add bus-session to electron As it is a layer 2 abstraction, we can safelly add it. --- apparmor.d/abstractions/common/electron | 1 + apparmor.d/groups/network/mullvad-gui | 1 - apparmor.d/profiles-a-f/cider | 8 ++------ apparmor.d/profiles-a-f/discord | 1 - apparmor.d/profiles-a-f/element-desktop | 1 - apparmor.d/profiles-a-f/freetube | 1 - apparmor.d/profiles-m-r/protonmail | 1 - apparmor.d/profiles-s-z/session-desktop | 1 - apparmor.d/profiles-s-z/signal-desktop | 2 +- apparmor.d/profiles-s-z/spotify | 1 - apparmor.d/profiles-s-z/superproductivity | 2 +- 11 files changed, 5 insertions(+), 15 deletions(-) diff --git a/apparmor.d/abstractions/common/electron b/apparmor.d/abstractions/common/electron index 253eab72b..dd4976f5e 100644 --- a/apparmor.d/abstractions/common/electron +++ b/apparmor.d/abstractions/common/electron @@ -20,6 +20,7 @@ abi , + include include include include diff --git a/apparmor.d/groups/network/mullvad-gui b/apparmor.d/groups/network/mullvad-gui index 132e25e6d..133e4bc00 100644 --- a/apparmor.d/groups/network/mullvad-gui +++ b/apparmor.d/groups/network/mullvad-gui @@ -15,7 +15,6 @@ include @{exec_path} = @{lib_dirs}/mullvad-gui profile mullvad-gui @{exec_path} flags=(attach_disconnected) { include - include include network inet stream, diff --git a/apparmor.d/profiles-a-f/cider b/apparmor.d/profiles-a-f/cider index 2b203e989..be59811a1 100644 --- a/apparmor.d/profiles-a-f/cider +++ b/apparmor.d/profiles-a-f/cider @@ -15,15 +15,11 @@ include @{exec_path} = @{bin}/{C,c}ider @{lib_dirs}/Cider profile cider @{exec_path} { include - include - include + include + include include - include include include - include - include - include network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-a-f/discord b/apparmor.d/profiles-a-f/discord index e12c25b9d..0991a243e 100644 --- a/apparmor.d/profiles-a-f/discord +++ b/apparmor.d/profiles-a-f/discord @@ -17,7 +17,6 @@ include profile discord @{exec_path} flags=(attach_disconnected) { include include - include include include include diff --git a/apparmor.d/profiles-a-f/element-desktop b/apparmor.d/profiles-a-f/element-desktop index f87486af3..59cfa3577 100644 --- a/apparmor.d/profiles-a-f/element-desktop +++ b/apparmor.d/profiles-a-f/element-desktop @@ -16,7 +16,6 @@ include profile element-desktop @{exec_path} flags=(attach_disconnected) { include include - include include include include diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index 958f9b5ee..be75567cd 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -17,7 +17,6 @@ include profile freetube @{exec_path} flags=(attach_disconnected) { include include - include include include include diff --git a/apparmor.d/profiles-m-r/protonmail b/apparmor.d/profiles-m-r/protonmail index f5548f696..8a6a2982e 100644 --- a/apparmor.d/profiles-m-r/protonmail +++ b/apparmor.d/profiles-m-r/protonmail @@ -16,7 +16,6 @@ include @{exec_path} = @{bin}/proton-mail /opt/proton-mail/Proton* profile protonmail @{exec_path} flags=(attach_disconnected) { include - include include include diff --git a/apparmor.d/profiles-s-z/session-desktop b/apparmor.d/profiles-s-z/session-desktop index cafccd791..4fd9dff69 100644 --- a/apparmor.d/profiles-s-z/session-desktop +++ b/apparmor.d/profiles-s-z/session-desktop @@ -16,7 +16,6 @@ include profile session-desktop @{exec_path} { include include - include include include include diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop index 4abe053f6..53f3d20b1 100644 --- a/apparmor.d/profiles-s-z/signal-desktop +++ b/apparmor.d/profiles-s-z/signal-desktop @@ -17,7 +17,7 @@ include profile signal-desktop @{exec_path} flags=(attach_disconnected) { include include - include + include include include include diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index a3c4b822a..f70d4e7c9 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -17,7 +17,6 @@ include profile spotify @{exec_path} flags=(attach_disconnected) { include include - include include include include diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index b84322ae0..838944aa8 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -16,7 +16,7 @@ include profile superproductivity @{exec_path} flags=(attach_disconnected) { include include - include + include include include include From 59bdb157cf260eb2dd46651e063c2e226bbe401f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:00:12 +0200 Subject: [PATCH 1444/1455] feat(abs): add the mediakeys abs. --- .../bus/{ => session}/org.gnome.SettingsDaemon.MediaKeys | 0 apparmor.d/profiles-a-f/evince | 2 +- apparmor.d/profiles-s-z/spotify | 4 +--- 3 files changed, 2 insertions(+), 4 deletions(-) rename apparmor.d/abstractions/bus/{ => session}/org.gnome.SettingsDaemon.MediaKeys (100%) diff --git a/apparmor.d/abstractions/bus/org.gnome.SettingsDaemon.MediaKeys b/apparmor.d/abstractions/bus/session/org.gnome.SettingsDaemon.MediaKeys similarity index 100% rename from apparmor.d/abstractions/bus/org.gnome.SettingsDaemon.MediaKeys rename to apparmor.d/abstractions/bus/session/org.gnome.SettingsDaemon.MediaKeys diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index d6969807f..89087df4b 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -16,6 +16,7 @@ profile evince @{exec_path} { include include include + include include include include @@ -28,7 +29,6 @@ profile evince @{exec_path} { #aa:dbus own bus=session name=org.gnome.evince - #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label="@{p_gsd_media_keys}" #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}" @{exec_path} rix, diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index f70d4e7c9..052757da2 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -18,14 +18,12 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include - include include - include include - include include include include + include include include include From 4526e96318610985fd66ff7cd5626a63410666da Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:03:22 +0200 Subject: [PATCH 1445/1455] feat(abs): add the gtk-strict abs. --- apparmor.d/abstractions/gtk-strict | 74 ++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 apparmor.d/abstractions/gtk-strict diff --git a/apparmor.d/abstractions/gtk-strict b/apparmor.d/abstractions/gtk-strict new file mode 100644 index 000000000..0bf0ab41c --- /dev/null +++ b/apparmor.d/abstractions/gtk-strict @@ -0,0 +1,74 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + include + include + include + include + + @{lib}/{,@{multiarch}/}gtk-2.0/{,**} mr, + @{lib}/{,@{multiarch}/}gtk-3.0/{,**} mr, + @{lib}/{,@{multiarch}/}gtk-4.0/{,**} mr, + + /usr/share/gtksourceview-2.0/{,**} r, + /usr/share/gtksourceview-3.0/{,**} r, + /usr/share/gtksourceview-4/{,**} r, + /usr/share/gtksourceview-5/{,**} r, + + /usr/share/gtk-2.0/ r, + /usr/share/gtk-2.0/gtkrc r, + + /usr/share/gtk-3.0/ r, + /usr/share/gtk-3.0/settings.ini r, + + /usr/share/gtk-4.0/ r, + /usr/share/gtk-4.0/settings.ini r, + + /etc/gtk/gtkrc r, + + /etc/gtk-2.0/ r, + /etc/gtk-2.0/gtkrc r, + + /etc/gtk-3.0/ r, + /etc/gtk-3.0/*.conf r, + /etc/gtk-3.0/settings.ini r, + + /etc/gtk-4.0/ r, + /etc/gtk-4.0/*.conf r, + /etc/gtk-4.0/settings.ini r, + + owner @{HOME}/.gtk r, + owner @{HOME}/.gtkrc r, + owner @{HOME}/.gtkrc-2.0 r, + owner @{HOME}/.gtk-bookmarks r, + + owner @{user_cache_dirs}/gtk-4.0/ rw, + owner @{user_cache_dirs}/gtk-4.0/vulkan-pipeline-cache/{,*} rw, + owner @{user_cache_dirs}/gtkrc r, + owner @{user_cache_dirs}/gtkrc-2.0 r, + + owner @{user_config_dirs}/gtk-2.0/ rw, + owner @{user_config_dirs}/gtk-2.0/gtkfilechooser.ini* rw, + + owner @{user_config_dirs}/gtk-3.0/ rw, + owner @{user_config_dirs}/gtk-3.0/bookmarks r, + owner @{user_config_dirs}/gtk-3.0/colors.css r, + owner @{user_config_dirs}/gtk-3.0/gtk.css r, + owner @{user_config_dirs}/gtk-3.0/servers r, + owner @{user_config_dirs}/gtk-3.0/settings.ini r, + owner @{user_config_dirs}/gtk-3.0/window_decorations.css r, + + owner @{user_config_dirs}/gtk-4.0/ rw, + owner @{user_config_dirs}/gtk-4.0/bookmarks r, + owner @{user_config_dirs}/gtk-4.0/colors.css r, + owner @{user_config_dirs}/gtk-4.0/gtk.css r, + owner @{user_config_dirs}/gtk-4.0/servers r, + owner @{user_config_dirs}/gtk-4.0/settings.ini r, + owner @{user_config_dirs}/gtk-4.0/window_decorations.css r, + + include if exists + +# vim:syntax=apparmor From f3a4372966569d58fd20addc9c2d00a493af85f9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:08:51 +0200 Subject: [PATCH 1446/1455] refractor(profile): bus/org.bluez -> bus/system/org.bluez. --- apparmor.d/abstractions/app/chromium | 1 + apparmor.d/abstractions/bus/{ => system}/org.bluez | 2 +- apparmor.d/groups/freedesktop/pulseaudio | 2 +- apparmor.d/groups/freedesktop/upowerd | 2 +- apparmor.d/groups/freedesktop/wireplumber | 3 +-- apparmor.d/groups/gnome/gnome-shell | 1 + apparmor.d/groups/network/NetworkManager | 2 +- apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-m-r/mpris-proxy | 3 +-- apparmor.d/profiles-s-z/spotify | 1 + 10 files changed, 10 insertions(+), 9 deletions(-) rename apparmor.d/abstractions/bus/{ => system}/org.bluez (96%) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 1635741ed..313f51687 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -31,6 +31,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/bus/org.bluez b/apparmor.d/abstractions/bus/system/org.bluez similarity index 96% rename from apparmor.d/abstractions/bus/org.bluez rename to apparmor.d/abstractions/bus/system/org.bluez index 461ad9f94..acaa7bb36 100644 --- a/apparmor.d/abstractions/bus/org.bluez +++ b/apparmor.d/abstractions/bus/system/org.bluez @@ -36,6 +36,6 @@ member=RegisterApplication peer=(name=org.bluez, label="@{p_bluetoothd}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index 346ae7257..206958062 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -16,7 +16,7 @@ profile pulseaudio @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index d58385831..201e49f3c 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -11,7 +11,7 @@ include profile upowerd @{exec_path} flags=(attach_disconnected) { include include - include + include include include include diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber index fc9029ef3..90eb46dc4 100644 --- a/apparmor.d/groups/freedesktop/wireplumber +++ b/apparmor.d/groups/freedesktop/wireplumber @@ -12,10 +12,9 @@ profile wireplumber @{exec_path} { include include include - include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index a82278a6c..f46a8461d 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -27,6 +27,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include + include include include include diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager index 2959441c4..fca80465d 100644 --- a/apparmor.d/groups/network/NetworkManager +++ b/apparmor.d/groups/network/NetworkManager @@ -11,7 +11,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 8447bff3e..65793364d 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -11,7 +11,7 @@ include profile fwupd @{exec_path} flags=(attach_disconnected,complain) { include include - include + include include include include diff --git a/apparmor.d/profiles-m-r/mpris-proxy b/apparmor.d/profiles-m-r/mpris-proxy index 2f31aea79..3a5dfffb6 100644 --- a/apparmor.d/profiles-m-r/mpris-proxy +++ b/apparmor.d/profiles-m-r/mpris-proxy @@ -11,8 +11,7 @@ profile mpris-proxy @{exec_path} { include include include - include - include + include #aa:dbus own bus=session name=org.mpris.MediaPlayer2 dbus receive bus=session path=/ diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index 052757da2..d1a60a8c7 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -21,6 +21,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include include include include From 48aeefa0a306efd28dfa5c83fa73e2e14639ea13 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:13:37 +0200 Subject: [PATCH 1447/1455] fix: linting issue. --- .../abstractions/bus/session/org.gnome.SettingsDaemon.MediaKeys | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/bus/session/org.gnome.SettingsDaemon.MediaKeys b/apparmor.d/abstractions/bus/session/org.gnome.SettingsDaemon.MediaKeys index 3a461a85a..93d830828 100644 --- a/apparmor.d/abstractions/bus/session/org.gnome.SettingsDaemon.MediaKeys +++ b/apparmor.d/abstractions/bus/session/org.gnome.SettingsDaemon.MediaKeys @@ -18,6 +18,6 @@ interface=org.gnome.SettingsDaemon.MediaKeys peer=(name="{@{busname},org.gnome.SettingsDaemon.MediaKeys}", label=gsd-media-keys), - include if exists + include if exists # vim:syntax=apparmor From 5559670a37d611bcb053f26a6d0588498442b97f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:37:47 +0200 Subject: [PATCH 1448/1455] feat(abs): add mediakeys --- apparmor.d/abstractions/mediakeys | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 apparmor.d/abstractions/mediakeys diff --git a/apparmor.d/abstractions/mediakeys b/apparmor.d/abstractions/mediakeys new file mode 100644 index 000000000..ecf839cda --- /dev/null +++ b/apparmor.d/abstractions/mediakeys @@ -0,0 +1,15 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow requesting interest in receiving media key events. This tells Gnome +# settings that our application should be notified when key events we are +# interested in are pressed, and allows us to receive those events. + + abi , + + include + + include if exists + +# vim:syntax=apparmor From 8c66d39a1e64c721ebb6f6c1421922d70abc0e3c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:39:38 +0200 Subject: [PATCH 1449/1455] feat(profile): merge dpkg-script-* profile into dpkg-scripts. --- apparmor.d/groups/apt/dpkg-script-apparmor | 74 --------------------- apparmor.d/groups/apt/dpkg-script-kmod | 18 ----- apparmor.d/groups/apt/dpkg-script-linux | 56 ---------------- apparmor.d/groups/apt/dpkg-script-systemd | 77 ---------------------- apparmor.d/groups/apt/dpkg-scripts | 5 +- 5 files changed, 4 insertions(+), 226 deletions(-) delete mode 100644 apparmor.d/groups/apt/dpkg-script-apparmor delete mode 100644 apparmor.d/groups/apt/dpkg-script-kmod delete mode 100644 apparmor.d/groups/apt/dpkg-script-linux delete mode 100644 apparmor.d/groups/apt/dpkg-script-systemd diff --git a/apparmor.d/groups/apt/dpkg-script-apparmor b/apparmor.d/groups/apt/dpkg-script-apparmor deleted file mode 100644 index 73a4f6c46..000000000 --- a/apparmor.d/groups/apt/dpkg-script-apparmor +++ /dev/null @@ -1,74 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2025 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# TODO: merge with dpkg-scripts - -abi , - -include - -@{exec_path} = /var/lib/dpkg/info/apparmor* -profile dpkg-script-apparmor @{exec_path} { - include - include - - capability dac_read_search, - - @{exec_path} mrix, - - @{bin}/{,e}grep ix, - @{bin}/cat ix, - @{bin}/chmod ix, - @{bin}/mkdir ix, - - @{bin}/deb-systemd-helper Px, - @{bin}/dpkg-maintscript-helper Px, - @{bin}/dpkg Px -> child-dpkg, - @{bin}/deb-systemd-invoke Px, - @{bin}/dpkg-divert ix, - @{bin}/systemctl Cx -> systemctl, - @{sbin}/apparmor_parser Px, - - /usr/share/apparmor.d/** rw, - - /etc/apparmor.d/** rw, - - /var/lib/dpkg/diversions rw, - /var/lib/dpkg/diversions-new rw, - /var/lib/dpkg/diversions-old rwl -> /var/lib/dpkg/diversions, - - /var/lib/dpkg/info/*.list r, - /var/lib/dpkg/info/format r, - /var/lib/dpkg/status r, - /var/lib/dpkg/triggers/File r, - /var/lib/dpkg/triggers/Unincorp r, - /var/lib/dpkg/updates/ r, - /var/lib/dpkg/updates/@{int} r, - - profile systemctl { - include - include - - capability net_admin, - capability sys_resource, - capability dac_override, - capability dac_read_search, - - signal send set=(cont term) peer=systemd-tty-ask-password-agent, - - @{bin}/systemd-tty-ask-password-agent rix, - - @{run}/user/@{uid}/systemd/ask-password/ rw, - @{run}/user/@{uid}/systemd/ask-password-block/{,*} rw, - - owner @{run}/systemd/ask-password/ rw, - owner @{run}/systemd/ask-password-block/{,*} rw, - - include if exists - } - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-kmod b/apparmor.d/groups/apt/dpkg-script-kmod deleted file mode 100644 index f900bba17..000000000 --- a/apparmor.d/groups/apt/dpkg-script-kmod +++ /dev/null @@ -1,18 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2025 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /var/lib/dpkg/info/kmod* -profile dpkg-script-kmod @{exec_path} { - include - - @{exec_path} mrix, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux deleted file mode 100644 index af578be50..000000000 --- a/apparmor.d/groups/apt/dpkg-script-linux +++ /dev/null @@ -1,56 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2025 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /var/lib/dpkg/info/linux* -profile dpkg-script-linux @{exec_path} { - include - include - - capability dac_read_search, - - @{exec_path} mrix, - - @{bin}/cat ix, - @{bin}/mkdir ix, - @{bin}/rm ix, - @{bin}/run-parts ix, - @{bin}/stty ix, - - @{bin}/deb-systemd-helper Px, - @{bin}/deb-systemd-invoke Px, - @{bin}/dpkg-maintscript-helper Px, - @{bin}/dpkg-trigger Px, - @{bin}/kmod Px, - @{bin}/linux-check-removal Px, - @{bin}/linux-update-symlinks Px, - @{bin}/systemctl Cx -> systemctl, - - /usr/share/{update,reboot}-notifier/notify-reboot-required Px, - /etc/kernel/{,header_}postinst.d/* Px, - /etc/kernel/postrm.d/* Px, - /etc/kernel/preinst.d/* Px, - /etc/kernel/prerm.d/* Px, - - /etc/kernel/*.d/ r, - - @{lib}/linux/triggers/* w, - @{lib}/modules/*/.fresh-install w, - - profile systemctl { - include - include - - capability net_admin, - - include if exists - } - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-script-systemd b/apparmor.d/groups/apt/dpkg-script-systemd deleted file mode 100644 index 6c76e6f70..000000000 --- a/apparmor.d/groups/apt/dpkg-script-systemd +++ /dev/null @@ -1,77 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2025 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{exec_path} = /var/lib/dpkg/info/systemd* -profile dpkg-script-systemd @{exec_path} { - include - include - - capability dac_read_search, - - @{exec_path} mrix, - - @{coreutils_path} rix, - @{bin}/bootctl Px, - @{bin}/deb-systemd-helper Px, - @{bin}/deb-systemd-invoke Px, - @{bin}/dpkg Cx -> dpkg, - @{bin}/dpkg-divert Px, - @{bin}/dpkg-maintscript-helper Px, - @{bin}/journalctl Px, - @{bin}/kernel-install mrPx, - @{bin}/systemctl Cx -> systemctl, - @{bin}/systemd-machine-id-setup Px, - @{bin}/systemd-sysusers Px, - @{bin}/systemd-tmpfiles Px, - @{lib}/systemd/systemd-sysctl Px, - @{sbin}/pam-auth-update Px, - - /etc/systemd/system/*.wants/ rw, - /etc/systemd/system/*.wants/* rw, - - /etc/pam.d/sed@{rand6} rw, - /etc/pam.d/common-password rw, - - @{efi}/ r, - - /var/lib/systemd/{,*} rw, - /var/log/journal/ rw, - - profile dpkg { - include - include - include - - capability dac_read_search, - - @{bin}/dpkg mr, - - /etc/dpkg/dpkg.cfg r, - /etc/dpkg/dpkg.cfg.d/{,*} r, - - include if exists - } - - profile systemctl { - include - include - - capability net_admin, - capability sys_resource, - - signal send set=(cont term) peer=systemd-tty-ask-password-agent, - - @{bin}/systemd-tty-ask-password-agent Px, - - include if exists - } - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts index acde577de..2434c9db9 100644 --- a/apparmor.d/groups/apt/dpkg-scripts +++ b/apparmor.d/groups/apt/dpkg-scripts @@ -63,8 +63,10 @@ profile dpkg-scripts @{exec_path} { /*/ r, @{bin}/ r, @{bin}/* w, + @{sbin}/ r, + @{sbin}/* w, @{lib}/ r, - @{lib}/** w, + @{lib}/** wl -> @{lib}/**, /opt/*/** rw, #aa:lint ignore=too-wide @@ -80,6 +82,7 @@ profile dpkg-scripts @{exec_path} { /tmp/grub.@{rand10} rw, /tmp/sed@{rand6} rw, /tmp/tmp.@{rand10} rw, + /tmp/updateppds.@{rand6} rw, @{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/mountinfo r, From d2e941163fb0221c0ddc1e99a492e65e490dc364 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:43:39 +0200 Subject: [PATCH 1450/1455] feat(abs): add mpris --- .../{ => session}/org.mpris.MediaPlayer2.Player | 4 ++-- apparmor.d/abstractions/mpris | 17 +++++++++++++++++ apparmor.d/profiles-s-z/spotify | 4 +--- apparmor.d/profiles-s-z/vlc | 4 +--- 4 files changed, 21 insertions(+), 8 deletions(-) rename apparmor.d/abstractions/bus/{ => session}/org.mpris.MediaPlayer2.Player (89%) create mode 100644 apparmor.d/abstractions/mpris diff --git a/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player b/apparmor.d/abstractions/bus/session/org.mpris.MediaPlayer2.Player similarity index 89% rename from apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player rename to apparmor.d/abstractions/bus/session/org.mpris.MediaPlayer2.Player index d71b7ac1e..b2b934074 100644 --- a/apparmor.d/abstractions/bus/org.mpris.MediaPlayer2.Player +++ b/apparmor.d/abstractions/bus/session/org.mpris.MediaPlayer2.Player @@ -1,5 +1,5 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol +# Copyright (C) 2023-2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -33,6 +33,6 @@ member=Seeked peer=(name=org.freedesktop.DBus), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/abstractions/mpris b/apparmor.d/abstractions/mpris new file mode 100644 index 000000000..f06c8560e --- /dev/null +++ b/apparmor.d/abstractions/mpris @@ -0,0 +1,17 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Allow operating as an MPRIS player. + + abi , + + include + + # Allow binding to the well-known DBus mpris interface based on the app's name + # See: https://specifications.freedesktop.org/mpris-spec/latest/ + #aa:dbus own bus=session name=org.mpris.MediaPlayer2.@{profile_name} + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify index d1a60a8c7..b04432e39 100644 --- a/apparmor.d/profiles-s-z/spotify +++ b/apparmor.d/profiles-s-z/spotify @@ -25,6 +25,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -35,8 +36,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) { network inet6 stream, network netlink raw, - #aa:dbus own bus=session name=org.mpris.MediaPlayer2.spotify - #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell #aa:dbus talk bus=session name=org.freedesktop.portal.{d,D}esktop label=xdg-desktop-portal #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label=gsd-media-keys @@ -46,7 +45,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) { member=RetrieveSecret peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal), - @{exec_path} mrix, @{sh_path} mr, diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc index bda3010fa..05866296d 100644 --- a/apparmor.d/profiles-s-z/vlc +++ b/apparmor.d/profiles-s-z/vlc @@ -22,6 +22,7 @@ profile vlc @{exec_path} { include include include + include include include include @@ -35,9 +36,6 @@ profile vlc @{exec_path} { network inet6 stream, network netlink raw, - #aa:dbus own bus=session name=org.mpris.MediaPlayer2.vlc - #aa:dbus talk bus=session name=org.mpris.MediaPlayer2.Player label=unconfined - @{exec_path} mrix, @{open_path} rPx -> child-open-help, From 5492ab1c4ecef1c09b007bbe05c29eee1c4faa7e Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:48:25 +0200 Subject: [PATCH 1451/1455] feat(profile): rewrite the gjs profile. --- apparmor.d/groups/gnome/gjs | 133 ++++++++++++++++++++++++ apparmor.d/groups/gnome/gjs-console | 108 ------------------- apparmor.d/groups/gnome/gnome-extension | 29 ++++++ apparmor.d/groups/gnome/gnome-shell | 2 +- 4 files changed, 163 insertions(+), 109 deletions(-) create mode 100644 apparmor.d/groups/gnome/gjs delete mode 100644 apparmor.d/groups/gnome/gjs-console create mode 100644 apparmor.d/groups/gnome/gnome-extension diff --git a/apparmor.d/groups/gnome/gjs b/apparmor.d/groups/gnome/gjs new file mode 100644 index 000000000..f726ab66b --- /dev/null +++ b/apparmor.d/groups/gnome/gjs @@ -0,0 +1,133 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021-2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# GNOME JavaScript interpreter. It is used to run some gnome internal app +# as well as third party extensions. +# +# Therefore, by default, some extension are confined under this profile. To fix +# this, the various programs using gjs must never run gjs as module, they need +# to run it as executable with a specific script. +# +# This currently concerns: +# - gnome-extension-ding (used to not be started as a module) +# - org.gnome.ScreenSaver (simple dbus service) +# - org.gnome.Shell.Extensions (full UI app, requires gnome-strict, graphics, ...) +# - org.gnome.Shell.Notifications (simple dbus service) +# - org.gnome.Shell.Screencast (simple dbus service) + +abi , + +include + +@{exec_path} = @{bin}/gjs-console +profile gjs @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + + # Only needed by org.gnome.Shell.Extensions + include + include + + # Only needed by gnome-extension-ding + include + include + include + include + include + include + include + include + + unix type=stream peer=(label=gnome-shell), + + signal receive set=(term hup) peer=gdm, + + #aa:dbus own bus=session name=com.rastersoft.ding interface+=org.gtk.Actions + #aa:dbus talk bus=session name=com.rastersoft.dingextension label=gnome-shell interface+=org.gtk.Actions + dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus.Introspectable + member=Introspect + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + dbus send bus=session path=/org/freedesktop/DBus + interface=org.freedesktop.DBus* + peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"), + dbus send bus=system path=/org/freedesktop/DBus + interface=org.freedesktop.DBus* + peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), + + #aa:dbus own bus=session name=org.gnome.Shell.Screencast + #aa:dbus talk bus=session name=org.gnome.Mutter.ScreenCast label=gnome-shell + + #aa:dbus own bus=session name=org.freedesktop.Notifications + #aa:dbus own bus=session name=org.gnome.ScreenSaver + #aa:dbus own bus=session name=org.gnome.Shell.Extensions + #aa:dbus own bus=session name=org.gnome.Shell.Notifications + + @{exec_path} mrix, + + # gnome-extension-ding + @{sh_path} rix, + @{bin}/env rix, + @{bin}/gnome-control-center rPx, + @{bin}/nautilus rPx, + + @{lib}/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner rCx -> gstreamer, + @{lib}/@{multiarch}/gstreamer-1.0/gst-plugin-scanner rCx -> gstreamer, + @{lib}/gstreamer-1.0/gst-plugin-scanner rCx -> gstreamer, + + /usr/share/gnome-shell/extensions/gsconnect@andyholmes.github.io/{service/daemon.js,gsconnect-preferences} rPx, + @{user_share_dirs}/gnome-shell/extensions/gsconnect@andyholmes.github.io/{service/daemon.js,gsconnect-preferences} rPx, + + /usr/share/dconf/profile/gdm r, + /usr/share/gdm/greeter-dconf-defaults r, + /usr/share/gnome-shell/{,**} r, + /usr/share/xkeyboard-config-2/{,**} r, + /usr/share/thumbnailers/{,**} r, + + owner @{gdm_cache_dirs}/gstreamer-1.0/registry.@{arch}.bin r, + owner @{gdm_config_dirs}/dconf/user r, + owner @{GDM_HOME}/greeter-dconf-defaults r, + + owner @{user_cache_dirs}/gstreamer-1.0/ rw, + owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, + + owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, + owner @{user_share_dirs}/nautilus/scripts/ r, + + owner @{user_desktop_dirs}/ r, + owner @{user_templates_dirs}/ r, + + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/@{tid}/stat r, + + /dev/ r, + /dev/dri/ r, + + deny @{user_share_dirs}/gvfs-metadata/* r, + + profile gstreamer { + include + include + include + include + include + + network (bind create getattr setopt getopt) netlink raw, + + @{lib}/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner mr, + @{lib}/@{multiarch}/gstreamer-1.0/gst-plugin-scanner mr, + @{lib}/gstreamer-1.0/gst-plugin-scanner mr, + + include if exists + } + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console deleted file mode 100644 index 6d6d6ea85..000000000 --- a/apparmor.d/groups/gnome/gjs-console +++ /dev/null @@ -1,108 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2021-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# TODO: GNOME JavaScript interpreter. It is used to run some gnome internal app -# as well as third party extensions. Therefore, by default, some extension are -# confined under this profile. The resulting profile is quite broad. -# This architecture needs to be rethinked. - -abi , - -include - -@{exec_path} = @{bin}/gjs-console -profile gjs-console @{exec_path} flags=(attach_disconnected) { - include - include - include - include - include - include - include - include - include - include - include - include - include - include - include - - network netlink raw, - - unix type=stream peer=(label=gnome-shell), - - signal receive set=(term hup) peer=gdm*, - - #aa:dbus own bus=session name=org.freedesktop.Notifications - #aa:dbus own bus=session name=org.gnome.ScreenSaver - #aa:dbus own bus=session name=org.gnome.Shell.Extensions - #aa:dbus own bus=session name=org.gnome.Shell.Notifications - #aa:dbus own bus=session name=org.gnome.Shell.Screencast - - #aa:dbus talk bus=session name=org.gnome.Mutter.ScreenCast label=gnome-shell - - dbus send bus=session path=/org/gnome/Shell - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=:*, label=gnome-shell), - dbus send bus=session path=/org/gnome/Shell - interface=org.gnome.Shell.Extensions - member=ListExtensions - peer=(name=:*, label=gnome-shell), - - @{exec_path} mr, - - @{bin}/ r, - @{bin}/* PUx, - @{lib}/** PUx, - - /usr/share/gnome-shell/extensions/gsconnect@andyholmes.github.io/{service/daemon.js,gsconnect-preferences} rPx, - @{user_share_dirs}/gnome-shell/extensions/gsconnect@andyholmes.github.io/{service/daemon.js,gsconnect-preferences} rPx, - - /etc/openni2/OpenNI.ini r, - - /usr/share/dconf/profile/gdm r, - /usr/share/gdm/greeter-dconf-defaults r, - /usr/share/gnome-shell/{,**} r, - /usr/share/thumbnailers/{,**} r, - - /tmp/ r, - /var/tmp/ r, - - owner @{gdm_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rwl, - owner @{gdm_cache_dirs}/gstreamer-1.0/ rw, - owner @{gdm_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, - owner @{gdm_config_dirs}/dconf/user r, - owner @{GDM_HOME}/greeter-dconf-defaults r, - - owner @{HOME}/ r, - - owner @{user_cache_dirs}/gstreamer-1.0/ rw, - owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, - owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, - owner @{user_share_dirs}/nautilus/scripts/ r, - - owner @{user_desktop_dirs}/ r, - owner @{user_templates_dirs}/ r, - - owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, - - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/task/ r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner @{PROC}/@{pid}/task/@{tid}/stat r, - - /dev/ r, - /dev/tty rw, - - deny @{user_share_dirs}/gvfs-metadata/* r, - - include if exists -} - -# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-extension b/apparmor.d/groups/gnome/gnome-extension new file mode 100644 index 000000000..e13eca832 --- /dev/null +++ b/apparmor.d/groups/gnome/gnome-extension @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# gjs started from gnome-shell should (in theory) only run gnome extensions. + +abi , + +include + +@{exec_path} = @{bin}/gjs-console +profile gnome-extension { + include + include + include + include + include + include + + @{exec_path} mr, + + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/@{tid}/stat r, + + include if exists +} + +# vim:syntax=apparmor diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index f46a8461d..24c069e72 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -162,7 +162,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/unzip rix, @{bin}/flatpak rPx, - @{bin}/gjs-console rPx, + @{bin}/gjs-console rPx -> gnome-extension, @{bin}/glib-compile-schemas rPx, @{bin}/ibus-daemon rPx, @{bin}/sensors rPx, From b76fe7c3429e4323834953d2e2d08e1b65e8a244 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:57:37 +0200 Subject: [PATCH 1452/1455] refractor(profile): move org.gnome.SessionManager This is the stage 1 of rewriting access to the session manager. --- apparmor.d/abstractions/app/chromium | 2 +- .../{ => session}/org.gnome.SessionManager | 22 +++++++++---------- apparmor.d/groups/bus/at-spi2-registryd | 2 +- apparmor.d/groups/bus/dbus-accessibility | 2 +- .../groups/freedesktop/xdg-desktop-portal-gtk | 2 +- apparmor.d/groups/gnome/gnome-keyring-daemon | 2 +- apparmor.d/groups/gnome/gsd-a11y-settings | 2 +- apparmor.d/groups/gnome/gsd-color | 2 +- apparmor.d/groups/gnome/gsd-datetime | 2 +- apparmor.d/groups/gnome/gsd-housekeeping | 2 +- apparmor.d/groups/gnome/gsd-keyboard | 2 +- apparmor.d/groups/gnome/gsd-media-keys | 2 +- apparmor.d/groups/gnome/gsd-power | 2 +- .../groups/gnome/gsd-print-notifications | 1 - apparmor.d/groups/gnome/gsd-printer | 5 +++-- apparmor.d/groups/gnome/gsd-rfkill | 2 +- apparmor.d/groups/gnome/gsd-screensaver-proxy | 2 +- apparmor.d/groups/gnome/gsd-sharing | 2 +- apparmor.d/groups/gnome/gsd-smartcard | 2 +- apparmor.d/groups/gnome/gsd-sound | 4 ++-- apparmor.d/groups/gnome/gsd-usb-protection | 3 +++ apparmor.d/groups/gnome/gsd-wacom | 2 +- apparmor.d/groups/gnome/gsd-xsettings | 5 ++--- apparmor.d/groups/gnome/nautilus | 2 +- apparmor.d/groups/ubuntu/apport | 2 +- apparmor.d/profiles-a-f/evince | 2 +- apparmor.d/profiles-a-f/filezilla | 2 +- apparmor.d/profiles-a-f/freetube | 2 +- apparmor.d/profiles-g-l/libreoffice | 2 +- apparmor.d/profiles-s-z/superproductivity | 2 +- apparmor.d/profiles-s-z/totem | 2 +- 31 files changed, 45 insertions(+), 45 deletions(-) rename apparmor.d/abstractions/bus/{ => session}/org.gnome.SessionManager (61%) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index 313f51687..dcb29fecb 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -30,7 +30,7 @@ include include include - include + include include include include diff --git a/apparmor.d/abstractions/bus/org.gnome.SessionManager b/apparmor.d/abstractions/bus/session/org.gnome.SessionManager similarity index 61% rename from apparmor.d/abstractions/bus/org.gnome.SessionManager rename to apparmor.d/abstractions/bus/session/org.gnome.SessionManager index a532b67f2..4c641776b 100644 --- a/apparmor.d/abstractions/bus/org.gnome.SessionManager +++ b/apparmor.d/abstractions/bus/session/org.gnome.SessionManager @@ -1,48 +1,46 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2023-2024 Alexandre Pujol +# Copyright (C) 2025 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# FIXME: Too large, restrict it. - abi , - #aa:dbus common bus=session name=org.gnome.SessionManager label=gnome-session-binary + #aa:dbus common bus=session name=org.gnome.SessionManager label="{gnome-session-binary,gnome-session-service}" dbus send bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={RegisterClient,IsSessionRunning} - peer=(name="@{busname}", label=gnome-session-binary), + peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"), dbus send bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={Inhibit,Uninhibit} - peer=(name="@{busname}", label=gnome-session-binary), + peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"), dbus send bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={Setenv,IsSessionRunning} - peer=(name=org.gnome.SessionManager, label=gnome-session-binary), + peer=(name=org.gnome.SessionManager, label="{gnome-session-binary,gnome-session-service}"), dbus receive bus=session path=/org/gnome/SessionManager interface=org.gnome.SessionManager member={ClientAdded,ClientRemoved,SessionRunning,InhibitorRemoved,InhibitorAdded} - peer=(name="@{busname}", label=gnome-session-binary), + peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"), dbus send bus=session path=/org/gnome/SessionManager/Client@{int} interface=org.gnome.SessionManager.ClientPrivate member=EndSessionResponse - peer=(name="@{busname}", label=gnome-session-binary), + peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"), dbus receive bus=session path=/org/gnome/SessionManager/Client@{int} interface=org.gnome.SessionManager.ClientPrivate member={CancelEndSession,QueryEndSession,EndSession,Stop} - peer=(name="@{busname}", label=gnome-session-binary), + peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"), dbus receive bus=session path=/org/gnome/SessionManager/Presence interface=org.gnome.SessionManager.Presence member=StatusChanged - peer=(name="@{busname}", label=gnome-session-binary), + peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"), - include if exists + include if exists # vim:syntax=apparmor diff --git a/apparmor.d/groups/bus/at-spi2-registryd b/apparmor.d/groups/bus/at-spi2-registryd index 26311b575..fec6d7897 100644 --- a/apparmor.d/groups/bus/at-spi2-registryd +++ b/apparmor.d/groups/bus/at-spi2-registryd @@ -13,7 +13,7 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { include include include - include + include include signal receive set=term peer=gdm, diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility index 910ae0008..c9b9a1538 100644 --- a/apparmor.d/groups/bus/dbus-accessibility +++ b/apparmor.d/groups/bus/dbus-accessibility @@ -12,7 +12,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk index d1ae86e15..b7906c5e2 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk @@ -14,7 +14,7 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gnome-keyring-daemon b/apparmor.d/groups/gnome/gnome-keyring-daemon index 595b3fd48..e39ef0dc0 100644 --- a/apparmor.d/groups/gnome/gnome-keyring-daemon +++ b/apparmor.d/groups/gnome/gnome-keyring-daemon @@ -15,7 +15,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { include include include - include + include capability ipc_lock, diff --git a/apparmor.d/groups/gnome/gsd-a11y-settings b/apparmor.d/groups/gnome/gsd-a11y-settings index 34ce2884d..22aaba164 100644 --- a/apparmor.d/groups/gnome/gsd-a11y-settings +++ b/apparmor.d/groups/gnome/gsd-a11y-settings @@ -10,7 +10,7 @@ include profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) { include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 0acdbaf38..1a52321b1 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -13,7 +13,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-datetime b/apparmor.d/groups/gnome/gsd-datetime index af1784e68..0364f3f2b 100644 --- a/apparmor.d/groups/gnome/gsd-datetime +++ b/apparmor.d/groups/gnome/gsd-datetime @@ -10,7 +10,7 @@ include profile gsd-datetime @{exec_path} flags=(attach_disconnected) { include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-housekeeping b/apparmor.d/groups/gnome/gsd-housekeeping index 8d8b9fc1b..497462a03 100644 --- a/apparmor.d/groups/gnome/gsd-housekeeping +++ b/apparmor.d/groups/gnome/gsd-housekeeping @@ -11,7 +11,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-keyboard b/apparmor.d/groups/gnome/gsd-keyboard index b700a7df9..be27a873e 100644 --- a/apparmor.d/groups/gnome/gsd-keyboard +++ b/apparmor.d/groups/gnome/gsd-keyboard @@ -13,7 +13,7 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 3ca105656..b299ab7ff 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -15,7 +15,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-power b/apparmor.d/groups/gnome/gsd-power index d20ad65d0..d3ac6b456 100644 --- a/apparmor.d/groups/gnome/gsd-power +++ b/apparmor.d/groups/gnome/gsd-power @@ -19,7 +19,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index 5d037961f..22ec520cb 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -11,7 +11,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { include include include - include include include include diff --git a/apparmor.d/groups/gnome/gsd-printer b/apparmor.d/groups/gnome/gsd-printer index b85a40f04..a768c8d1e 100644 --- a/apparmor.d/groups/gnome/gsd-printer +++ b/apparmor.d/groups/gnome/gsd-printer @@ -9,10 +9,11 @@ include @{exec_path} = @{lib}/gsd-printer profile gsd-printer @{exec_path} flags=(attach_disconnected) { include - include include include - include + include + include + include include signal (receive) set=(term, hup) peer=gdm*, diff --git a/apparmor.d/groups/gnome/gsd-rfkill b/apparmor.d/groups/gnome/gsd-rfkill index 5f1c13d9d..7283c5c00 100644 --- a/apparmor.d/groups/gnome/gsd-rfkill +++ b/apparmor.d/groups/gnome/gsd-rfkill @@ -15,7 +15,7 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) { include include include - include + include signal (receive) set=(term, hup) peer=gdm*, diff --git a/apparmor.d/groups/gnome/gsd-screensaver-proxy b/apparmor.d/groups/gnome/gsd-screensaver-proxy index 546a252d7..ac2f9229d 100644 --- a/apparmor.d/groups/gnome/gsd-screensaver-proxy +++ b/apparmor.d/groups/gnome/gsd-screensaver-proxy @@ -11,7 +11,7 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) { include include include - include + include signal (receive) set=(term, hup) peer=gdm*, diff --git a/apparmor.d/groups/gnome/gsd-sharing b/apparmor.d/groups/gnome/gsd-sharing index b6d90d5e3..9d432ae13 100644 --- a/apparmor.d/groups/gnome/gsd-sharing +++ b/apparmor.d/groups/gnome/gsd-sharing @@ -12,7 +12,7 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index d42fb486b..5143b9984 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -10,7 +10,7 @@ include profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-sound b/apparmor.d/groups/gnome/gsd-sound index 2b64ddf06..ff2d30766 100644 --- a/apparmor.d/groups/gnome/gsd-sound +++ b/apparmor.d/groups/gnome/gsd-sound @@ -12,8 +12,8 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) { include include include - include - include + include + include include include diff --git a/apparmor.d/groups/gnome/gsd-usb-protection b/apparmor.d/groups/gnome/gsd-usb-protection index 59e67d9bf..bcdb353a8 100644 --- a/apparmor.d/groups/gnome/gsd-usb-protection +++ b/apparmor.d/groups/gnome/gsd-usb-protection @@ -10,6 +10,9 @@ include profile gsd-usb-protection @{exec_path} { include include + include + include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-wacom b/apparmor.d/groups/gnome/gsd-wacom index 0bb1d50d1..3d4f2cb05 100644 --- a/apparmor.d/groups/gnome/gsd-wacom +++ b/apparmor.d/groups/gnome/gsd-wacom @@ -11,7 +11,7 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/gnome/gsd-xsettings b/apparmor.d/groups/gnome/gsd-xsettings index 84abb82e0..20151eec0 100644 --- a/apparmor.d/groups/gnome/gsd-xsettings +++ b/apparmor.d/groups/gnome/gsd-xsettings @@ -13,10 +13,9 @@ profile gsd-xsettings @{exec_path} { include include include - include + include include - include - include + include include include include diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index d3906051c..c405a3bf8 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -15,7 +15,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/groups/ubuntu/apport b/apparmor.d/groups/ubuntu/apport index 255dc551a..211dda9cc 100644 --- a/apparmor.d/groups/ubuntu/apport +++ b/apparmor.d/groups/ubuntu/apport @@ -11,7 +11,7 @@ profile apport @{exec_path} flags=(attach_disconnected) { include include include - include + include include include diff --git a/apparmor.d/profiles-a-f/evince b/apparmor.d/profiles-a-f/evince index 89087df4b..10b5ad4af 100644 --- a/apparmor.d/profiles-a-f/evince +++ b/apparmor.d/profiles-a-f/evince @@ -12,7 +12,7 @@ profile evince @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/profiles-a-f/filezilla b/apparmor.d/profiles-a-f/filezilla index 78781ba28..16bafb886 100644 --- a/apparmor.d/profiles-a-f/filezilla +++ b/apparmor.d/profiles-a-f/filezilla @@ -11,7 +11,7 @@ include profile filezilla @{exec_path} { include include - include + include include include include diff --git a/apparmor.d/profiles-a-f/freetube b/apparmor.d/profiles-a-f/freetube index be75567cd..b820f249c 100644 --- a/apparmor.d/profiles-a-f/freetube +++ b/apparmor.d/profiles-a-f/freetube @@ -17,7 +17,7 @@ include profile freetube @{exec_path} flags=(attach_disconnected) { include include - include + include include include include diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index cc2ee8c2a..7e4feed45 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -15,7 +15,7 @@ profile libreoffice @{exec_path} { include include include - include + include include include include diff --git a/apparmor.d/profiles-s-z/superproductivity b/apparmor.d/profiles-s-z/superproductivity index 838944aa8..f812fc570 100644 --- a/apparmor.d/profiles-s-z/superproductivity +++ b/apparmor.d/profiles-s-z/superproductivity @@ -20,7 +20,7 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include diff --git a/apparmor.d/profiles-s-z/totem b/apparmor.d/profiles-s-z/totem index d8b464956..d1e429d45 100644 --- a/apparmor.d/profiles-s-z/totem +++ b/apparmor.d/profiles-s-z/totem @@ -10,7 +10,7 @@ include profile totem @{exec_path} flags=(attach_disconnected) { include include - include + include include include include From e6e0cc07102a54a8557c155ffb817b0608339a48 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 20:59:12 +0200 Subject: [PATCH 1453/1455] fix(profile): missing updated bus abstraction paths. --- apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome | 3 +-- apparmor.d/groups/virt/libvirtd | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 95daf2935..30b415204 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -14,8 +14,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include include include - include - include + include include include include diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 23e8e20d1..378449352 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -19,7 +19,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { include include include - include + include include include include From 6a77b7ed8b9683ebcaf92470b64cc33deca9b9d8 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 14 Sep 2025 21:07:43 +0200 Subject: [PATCH 1454/1455] fix(profile): missing updated bus abstraction paths. --- apparmor.d/abstractions/mediakeys | 2 +- apparmor.d/groups/gnome/gjs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apparmor.d/abstractions/mediakeys b/apparmor.d/abstractions/mediakeys index ecf839cda..d9aafa764 100644 --- a/apparmor.d/abstractions/mediakeys +++ b/apparmor.d/abstractions/mediakeys @@ -8,7 +8,7 @@ abi , - include + include include if exists diff --git a/apparmor.d/groups/gnome/gjs b/apparmor.d/groups/gnome/gjs index f726ab66b..de9d25a14 100644 --- a/apparmor.d/groups/gnome/gjs +++ b/apparmor.d/groups/gnome/gjs @@ -115,7 +115,7 @@ profile gjs @{exec_path} flags=(attach_disconnected) { include include include - include + include include network (bind create getattr setopt getopt) netlink raw, From 9db6bf4a3583a94d4109e0b0eb9d95e121fc8119 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 16 Sep 2025 20:42:35 +0200 Subject: [PATCH 1455/1455] feat(abs): add the themes abs. fix #860 --- apparmor.d/abstractions/desktop | 1 + apparmor.d/abstractions/gnome-strict | 1 + apparmor.d/abstractions/kde-strict | 1 + apparmor.d/abstractions/lxqt | 1 + apparmor.d/abstractions/themes | 14 ++++++++++++++ apparmor.d/abstractions/xfce | 1 + 6 files changed, 19 insertions(+) create mode 100644 apparmor.d/abstractions/themes diff --git a/apparmor.d/abstractions/desktop b/apparmor.d/abstractions/desktop index 66742f02a..c4abbd574 100644 --- a/apparmor.d/abstractions/desktop +++ b/apparmor.d/abstractions/desktop @@ -18,6 +18,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/gnome-strict b/apparmor.d/abstractions/gnome-strict index 47efde306..227377f3a 100644 --- a/apparmor.d/abstractions/gnome-strict +++ b/apparmor.d/abstractions/gnome-strict @@ -13,6 +13,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict index 17952414c..79e97b23f 100644 --- a/apparmor.d/abstractions/kde-strict +++ b/apparmor.d/abstractions/kde-strict @@ -13,6 +13,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/lxqt b/apparmor.d/abstractions/lxqt index 8d83aefdc..913ab3eb3 100644 --- a/apparmor.d/abstractions/lxqt +++ b/apparmor.d/abstractions/lxqt @@ -10,6 +10,7 @@ include include include + include include include include diff --git a/apparmor.d/abstractions/themes b/apparmor.d/abstractions/themes new file mode 100644 index 000000000..13fe70bc6 --- /dev/null +++ b/apparmor.d/abstractions/themes @@ -0,0 +1,14 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2025 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + abi , + + /usr/share/themes/{,**} r, + + owner @{HOME}/.themes/{,**} r, + owner @{user_share_dirs}/themes/{,**} r, + + include if exists + +# vim:syntax=apparmor diff --git a/apparmor.d/abstractions/xfce b/apparmor.d/abstractions/xfce index c7e464236..df13363fc 100644 --- a/apparmor.d/abstractions/xfce +++ b/apparmor.d/abstractions/xfce @@ -8,6 +8,7 @@ include include include + include include include include