130 lines
3.6 KiB
Text
130 lines
3.6 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
#
|
|
# The following profile assumes that:
|
|
# openvpn is started as root with dropping privileges
|
|
# iptables is used
|
|
# config files can be stored in:
|
|
# - /etc/openvpn/*.{conf,ovpn}
|
|
# - /etc/openvpn/{client,server}/*.{conf,ovpn}
|
|
# certs/keys can be are stored in:
|
|
# - /etc/openvpn/certs/*.{key,crt}
|
|
# - $HOME/.cert/**/*.pem
|
|
# auth credentials are stored in: /etc/openvpn/auth/*.auth
|
|
# logs are redirected to: /var/log/openvpn/*.log
|
|
# DNS/resolver script is stored in: /etc/openvpn/update-resolv-conf{,.sh}
|
|
# If a user wants to type user/pass interactively, systemd-ask-password is
|
|
# invoked for that.
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}{s,}bin/openvpn
|
|
profile openvpn @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
|
|
# Needed to remove the following errors:
|
|
# ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
|
|
# Exiting due to fatal error
|
|
capability net_admin,
|
|
|
|
# These are needed when user/group are set in a OpenVPN config file
|
|
capability setuid,
|
|
capability setgid,
|
|
|
|
capability dac_read_search,
|
|
capability dac_override,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
signal (receive) set=(term) peer=nm-openvpn-service,
|
|
|
|
@{exec_path} mr,
|
|
|
|
# OpenVPN config
|
|
/etc/openvpn/*.{conf,ovpn} r,
|
|
/etc/openvpn/client/*.{conf,ovpn} r,
|
|
/etc/openvpn/client/*_userpass.txt r,
|
|
/etc/openvpn/server/*.{conf,ovpn} r,
|
|
/etc/openvpn/auth/*.auth r,
|
|
/etc/openvpn/certs/*.{key,crt} r,
|
|
@{HOME}/.cert/{,**} r,
|
|
|
|
/var/log/openvpn/*.log w,
|
|
|
|
@{run}/openvpn/*.{pid,status} rw,
|
|
@{run}/NetworkManager/nm-openvpn-@{uuid} rw,
|
|
|
|
/{usr/,}bin/ip rix,
|
|
/{usr/,}bin/systemd-ask-password rPx,
|
|
/{usr/,}lib/nm-openvpn-service-openvpn-helper rPx,
|
|
/etc/openvpn/force-user-traffic-via-vpn.sh rCx -> force-user-traffic-via-vpn,
|
|
/etc/openvpn/update-resolv-conf{,.sh} rCx -> update-resolv,
|
|
|
|
/dev/net/tun rw,
|
|
|
|
owner @{PROC}/@{pid}/net/route r,
|
|
|
|
profile update-resolv {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
# To be able to manage firewall rules.
|
|
capability net_admin,
|
|
|
|
/etc/openvpn/update-resolv-conf.sh r,
|
|
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
/{usr/,}bin/cut rix,
|
|
/{usr/,}bin/which{,.debianutils} rix,
|
|
/{usr/,}bin/ip rix,
|
|
/{usr/,}{s,}bin/xtables-nft-multi rix,
|
|
|
|
/etc/iproute2/rt_tables r,
|
|
/etc/iproute2/rt_tables.d/ r,
|
|
|
|
}
|
|
|
|
profile force-user-traffic-via-vpn {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
# To be able to manage firewall rules.
|
|
capability net_admin,
|
|
|
|
network netlink raw,
|
|
|
|
/etc/openvpn/ r,
|
|
/etc/openvpn/force-user-traffic-via-vpn.sh r,
|
|
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
/{usr/,}bin/sed rix,
|
|
/{usr/,}bin/cut rix,
|
|
/{usr/,}bin/{,e}grep rix,
|
|
/{usr/,}bin/ip rix,
|
|
/{usr/,}{s,}bin/nft rix,
|
|
/{usr/,}bin/env rix,
|
|
|
|
/etc/iproute2/rt_realms r,
|
|
/etc/iproute2/group r,
|
|
/etc/iproute2/rt_tables.d/ r,
|
|
/etc/iproute2/rt_tables rw,
|
|
/etc/iproute2/sed* rw,
|
|
|
|
owner @{PROC}/sys/net/ipv{4,}/route/flush w,
|
|
|
|
}
|
|
|
|
include if exists <local/openvpn>
|
|
}
|