168 lines
4 KiB
Text
168 lines
4 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/pass
|
|
profile pass @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
@{exec_path} mr,
|
|
|
|
@{sh_path} rix,
|
|
@{bin}/base64 ix,
|
|
@{bin}/basename ix,
|
|
@{bin}/cat ix,
|
|
@{bin}/cp ix,
|
|
@{bin}/diff ix,
|
|
@{bin}/dirname ix,
|
|
@{bin}/env r,
|
|
@{bin}/find ix,
|
|
@{bin}/getopt ix,
|
|
@{bin}/{,e}grep ix,
|
|
@{bin}/head ix,
|
|
@{bin}/mkdir ix,
|
|
@{bin}/mktemp ix,
|
|
@{bin}/mv ix,
|
|
@{bin}/rm ix,
|
|
@{bin}/rmdir ix,
|
|
@{bin}/sed ix,
|
|
@{bin}/shred ix,
|
|
@{bin}/sleep ix,
|
|
@{bin}/sort ix,
|
|
@{bin}/tail ix,
|
|
@{bin}/touch ix,
|
|
@{bin}/tr ix,
|
|
@{bin}/tree ix,
|
|
@{bin}/tty ix,
|
|
@{bin}/which{,.debianutils} rix,
|
|
|
|
@{bin}/git Cx -> git,
|
|
@{bin}/gpg{2,} Cx -> gpg,
|
|
@{bin}/pkill Cx -> pkill,
|
|
@{bin}/qdbus Cx -> qdbus,
|
|
@{bin}/wl-{copy,paste} Px,
|
|
@{bin}/xclip Px,
|
|
@{editor_path} Cx -> editor,
|
|
@{lib}/git{,-core}/git Cx -> git,
|
|
|
|
# Pass extensions
|
|
@{bin}/oathtool ix, # pass-otp
|
|
@{python_path} Px -> pass-import, # pass-import, pass-audit
|
|
@{bin}/qrencode PUx, # pass-otp
|
|
@{bin}/tomb PUx, # pass-tomb
|
|
|
|
/usr/share/terminfo/** r,
|
|
|
|
owner @{user_passwordstore_dirs}/{,**} rw,
|
|
owner /dev/shm/pass.@{rand}/{,*} rw,
|
|
|
|
@{sys}/devices/system/node/ r,
|
|
|
|
@{PROC}/ r,
|
|
@{PROC}/@{pid}/stat r,
|
|
@{PROC}/@{pids}/cmdline r,
|
|
@{PROC}/sys/kernel/osrelease r,
|
|
@{PROC}/uptime r,
|
|
|
|
/dev/tty rw,
|
|
|
|
profile pkill {
|
|
include <abstractions/base>
|
|
include <abstractions/app/pgrep>
|
|
|
|
@{bin}/pkill mr,
|
|
|
|
include if exists <local/pass_pkill>
|
|
}
|
|
|
|
profile editor {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/app/editor>
|
|
|
|
/tmp/ r,
|
|
|
|
owner @{user_passwordstore_dirs}/{,**/} r,
|
|
|
|
owner /dev/shm/pass.@{rand}/{,*} rw,
|
|
|
|
deny owner @{HOME}/ r,
|
|
|
|
include if exists <local/pass_editor>
|
|
}
|
|
|
|
profile git {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/ssl_certs>
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
@{bin}/git* mrix,
|
|
@{lib}/git{,-core}/git* mrix,
|
|
|
|
@{pager_path} rPx -> child-pager,
|
|
@{bin}/gpg{2,} rPx -> pass//gpg,
|
|
|
|
/usr/share/git{,-core}/{,**} r,
|
|
|
|
owner @{HOME}/.gitconfig r,
|
|
owner @{user_config_dirs}/git/{,*} r,
|
|
|
|
owner @{user_passwordstore_dirs}/ rw,
|
|
owner @{user_passwordstore_dirs}/** rwkl -> @{HOME}/.password-store/**,
|
|
|
|
owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature
|
|
owner /dev/shm/pass.@{rand}/.git_vtag_tmp@{rand6} rw,
|
|
|
|
include if exists <local/pass_git>
|
|
}
|
|
|
|
profile gpg {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
capability dac_read_search,
|
|
|
|
@{bin}/gpg{,2} mr,
|
|
@{bin}/gpg-agent rPx,
|
|
|
|
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
|
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
|
|
|
owner @{user_passwordstore_dirs}/ rw,
|
|
owner @{user_passwordstore_dirs}/** rwkl -> @{HOME}/.password-store/**,
|
|
owner /dev/shm/pass.@{rand}/* rw,
|
|
owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature
|
|
owner @{run}/user/@{uid}/gnupg/S.gpg-agent rw,
|
|
|
|
owner /dev/pts/@{int} rw,
|
|
|
|
include if exists <local/pass_gpg>
|
|
}
|
|
|
|
profile qdbus {
|
|
include <abstractions/base>
|
|
|
|
@{bin}/qdbus mr,
|
|
|
|
include if exists <local/pass_qdbus>
|
|
}
|
|
|
|
include if exists <usr/pass.d>
|
|
include if exists <local/pass>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|