# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}

@{exec_path} = @{lib_dirs}/snapd/snapd
profile snapd @{exec_path} {
  include <abstractions/base>
  include <abstractions/authentication>
  include <abstractions/dbus-strict>
  include <abstractions/disks-write>
  include <abstractions/fontconfig-cache-write>
  include <abstractions/fonts>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>

  capability audit_write,
  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability fsetid,
  capability net_admin,
  capability setgid,
  capability setuid,
  capability sys_admin,
  capability sys_ptrace,
  capability sys_resource,

  network inet stream,
  network inet6 stream,
  network inet dgram,
  network inet6 dgram,
  network netlink raw,

  mount fstype=squashfs /dev/loop[0-9]* -> /tmp/syscheck-mountpoint-[0-9]*/,
  umount /tmp/syscheck-mountpoint-[0-9]*/,
  umount /snap/*/*/,

  ptrace (read) peer=snap,
  ptrace (read) peer=unconfined,

  dbus (send) bus=system path=/org/freedesktop/
         interface=org.freedesktop.login1.Manager
         member={SetWallMessage,ScheduleShutdown}
         peer=(name=org.freedesktop.login1, label=systemd-logind),

  dbus send bus=system path=/org/freedesktop/timedate1
       interface=org.freedesktop.DBus.Properties
       member=Get
       peer=(name=org.freedesktop.timedate1),

  dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority 
       interface=org.freedesktop.PolicyKit1.Authority
       member=CheckAuthorization 
       peer=(name=org.freedesktop.PolicyKit1),

  @{exec_path} mrix,

  @{bin}/adduser                  rPx,
  @{bin}/groupadd                 rPx,
  @{bin}/hostnamectl              rPx,
  @{bin}/ssh-keygen               rPx,
  @{bin}/useradd                  rPx,

  @{bin}/{,ba,da}sh               rix,
  @{bin}/apparmor_parser          rPx,
  @{bin}/cp                       rix,
  @{bin}/gzip                     rix,
  @{bin}/journalctl               rPx,
  @{bin}/kmod                     rPx,
  @{bin}/mount                    rix,
  @{bin}/runuser                  rCx -> runuser,
  @{bin}/sync                     rix,
  @{bin}/systemctl                rix,
  @{bin}/systemd-detect-virt      rPx,
  @{bin}/tar                      rix,
  @{bin}/udevadm                  rPx,
  @{bin}/umount                   rix,
  @{bin}/unsquashfs               rix,
  @{bin}/update-desktop-database  rPx,

  @{bin_dirs}/fc-cache-*              mr,
  @{bin_dirs}/snap                  rPUx,
  @{bin_dirs}/xdelta3                rix,
  @{lib_dirs}/@{multiarch}/**         mr,
  @{lib_dirs}/@{multiarch}/ld-*.so   rix,
  @{lib_dirs}/snapd/apparmor_parser  rPx -> apparmor_parser,
  @{lib_dirs}/snapd/snap-discard-ns  rPx -> snap-discard-ns,
  @{lib_dirs}/snapd/snap-seccomp     rPx -> snap-seccomp,
  @{lib_dirs}/snapd/snap-update-ns   rPx -> snap-update-ns,

  /usr/share/bash-completion/{,**} r,
  /usr/share/dbus-1/{system,session}.d/{,snapd*} r,
  /usr/share/dbus-1/services/*snap* r,
  /usr/share/polkit-1/actions/{,**/} r,

  /etc/apparmor.d/*snapd.snap* r,
  /etc/dbus-1/system.d/{,**/} r,
  /etc/environment r,
  /etc/fstab r,
  /etc/mime.types r,
  /etc/modprobe.d/{,**/} r,
  /etc/modules-load.d/{,**/} r,
  /etc/modules-load.d/*snap* rw,
  /etc/systemd/system/{,**/} r,
  /etc/systemd/system/snap* rw,
  /etc/systemd/user/{,**/} r,
  /etc/systemd/user/**/*snap* rw,
  /etc/systemd/user/*snap* rw,
  /etc/udev/rules.d/{,*snap*} rw,

  /snap/{,**} rw,
  /var/cache/snapd/{,**} rwlk,
  /var/lib/snapd/{,**} rwlk,
  /var/snap/{,**} rw,

  /var/cache/apparmor/{,*/} r,
  /var/cache/apparmor/*/snap* rw,

  /tmp/ r,
  /tmp/syscheck-mountpoint-[0-9]*/{,**} rw,
  /tmp/syscheck-squashfs-[0-9]* rw,
  /tmp/read-file[0-9]*/{,**} rw,

  /boot/ r,
  /boot/grub/grubenv r, 

  / r,
  /home/ r,
  @{HOME}/ r,
  @{HOME}/snap/{,**} rw,
  @{HOME}/.snap*/{,**} rw,

  owner @{run}/mount/ rw,
  owner @{run}/mount/utab{,.*} rw,
  owner @{run}/mount/utab.lock wk,

  @{run}/user/ r,
  @{run}/user/@{uid}/ r,
  @{run}/user/@{uid}/snapd-session-agent.socket rw,
  @{run}/user/snap.*/{,**} rw,

  @{run}/mnt/ubuntu-seed/EFI/ubuntu/grubenv r,  # only:core
  @{run}/snapd*.socket rw,
  @{run}/snapd/{,**} rw,
  @{run}/snapd/lock/*.lock rwk,
  @{run}/systemd/notify rw,
  @{run}/systemd/private rw,

  @{sys}/fs/cgroup/{,*/} r,
  @{sys}/fs/cgroup/system.slice/{,**/} r,
  @{sys}/fs/cgroup/user.slice/ r,
  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r,
  @{sys}/kernel/kexec_loaded r,
  @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
  @{sys}/kernel/security/apparmor/features/ r,
  @{sys}/kernel/security/apparmor/profiles r,

  @{sys}/fs/cgroup/system.slice/snap*.service/cgroup.procs r,
  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.procs r,

        @{PROC}/@{pids}/cgroup r,
        @{PROC}/@{pids}/stat r,
        @{PROC}/cgroups r,
        @{PROC}/cmdline r,
        @{PROC}/sys/kernel/random/boot_id r,
        @{PROC}/sys/kernel/seccomp/actions_avail r,
        @{PROC}/version r,
  owner @{PROC}/@{pids}/cmdline r,
  owner @{PROC}/@{pids}/mountinfo r,

  /dev/loop-control rw,

  profile runuser {
    include <abstractions/base>

    @{bin}/runuser mr,

    include if exists <local/snapd_runuser>
  }

  include if exists <local/snapd>
}