apparmor.d/apparmor.d/groups/apt/aptitude

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{bin}/aptitude{,-curses}
profile aptitude @{exec_path} flags=(complain) {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
  include <abstractions/common/apt>

  # To remove the following errors:
  #  W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
  #     (1: Operation not permitted)
  #  W: chmod 0700 of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
  #     (1: Operation not permitted)
  #  W: chmod 0600 of file /var/lib/apt/lists/deb.debian.org_debian_dists_sid_InRelease failed -
  #     Item::QueueURI (1: Operation not permitted)
  capability fowner,

  # To remove the following errors:
  #  W: chown to _apt:root of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
  #  (1: Operation not permitted)
  #  W: chown to _apt:root of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
  #  (1: Operation not permitted)
  capability chown,

  # The "_apt" user is created by the postinst script of the "apt" package. It's the owner of the
  # dirs "/var/cache/apt/archives/partial/" and "/var/lib/apt/lists/partial/" . The "_apt" user is
  # used by APT to download packages, package list, and other things using APT methods as an
  # unprivileged user/group (_apt/nogroup).
  #
  # To remove the following errors:
  #  E: setgroups 65534 failed - setgroups (1: Operation not permitted)
  #  E: setegid 65534 failed - setegid (1: Operation not permitted)
  #  E: seteuid 100 failed - seteuid (1: Operation not permitted)
  #  E: setgroups 0 failed - setgroups (1: Operation not permitted)
  capability setuid,
  capability setgid,

  # To remove the following errors:
  #  W: Problem unlinking the file /var/lib/apt/lists/partial/*_InRelease -
  #     PrepareFiles (13: Permission denied)
  #  E: Unable to read /var/lib/apt/lists/partial/ - open (13: Permission denied)
  capability dac_read_search,

  # To remove the following errors:
  #  E: Failed to fetch https://**.deb  rename failed, Permission denied
  #     (/var/cache/apt/archives/partial/*.deb -> /var/cache/apt/archives/*.deb).
  #  E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
  capability dac_override,

  # Needed? (##FIXME##)
  capability kill,
  capability fsetid,
  capability sys_chroot,
  audit deny capability net_admin,
  #capability sys_tty_config,

  signal (send) peer=apt-methods-*,

  @{exec_path} mr,

  @{sh_path}                rix,
  @{bin}/test               rix,
  @{bin}/{,e}grep           rix,

  @{bin}/ps                 rPx,
  @{bin}/dpkg               rPx,
  @{bin}/apt-listbugs       rPx,
  @{bin}/apt-listchanges    rPx,
  @{bin}/apt-show-versions  rPx,
  @{bin}/dpkg-preconfigure rPx,
  @{bin}/debtags            rPx,
  @{bin}/localepurge       rPx,
  @{bin}/appstreamcli       rPx,
  @{bin}/adequate           rPx,
  @{bin}/update-command-not-found      rPx,
  /usr/share/command-not-found/cnf-update-db rPx,

  # Methods to use to download packages from the net
  @{lib}/apt/methods/*      rPx,

  /var/lib/apt/lists/** rw,
  /var/lib/apt/lists/lock rwk,
  /var/lib/apt/extended_states{,.*} rw,

  /var/log/apt/eipp.log.xz w,
  /var/log/apt/{term,history}.log w,
  /var/log/aptitude w,

  # For downloading the source of packages (showsrc/source options)
  @{bin}/apt rPx,

  # For changelogs
  owner @{tmp}/aptitude-*.@{pid}:*/cache{ContentCompressed,Extracted}* rw,
  owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
  owner @{tmp}/aptitude-*.@{pid}:*/parsedchangelog* w,
  owner @{user_cache_dirs}/ rw,
  owner @{user_cache_dirs}/aptitude/ rw,
  owner @{user_cache_dirs}/aptitude/metadata-download{,-journal} rw,
  owner @{user_cache_dirs}/aptitude/metadata-download rwk,
  @{bin}/sensible-pager rCx -> pager,

  # For aptitude-run-state-bundle
  owner @{tmp}/aptitudebug.*/ r,
  owner @{tmp}/aptitudebug.*/** rwk,

  /var/lib/apt-xapian-index/index r,
  /var/cache/apt-xapian-index/index.[0-9]/*.glass r,
  /var/cache/apt-xapian-index/index.[0-9]/iamglass r,

  /var/lib/dpkg/** r,
  /var/lib/dpkg/lock{,-frontend} rwk,

  owner @{PROC}/@{pid}/fd/ r,

        /tmp/ r,
        /tmp/aptitude-*.@{pid}:*/pkgstates* r,
  owner @{tmp}/aptitude-*.@{pid}:*/ rw,
  owner @{tmp}/aptitude-*.@{pid}:*/{pkgstates,control}* rw,
  owner @{tmp}/apt-dpkg-install-*/ rw,
  owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,

  /var/cache/apt/ r,
  /var/cache/apt/** rwk,

  # For the interactive mode
  /usr/share/tasksel/descs/ r,
  /usr/share/tasksel/descs/debian-tasks.desc r,
  owner @{HOME}/.aptitude/ rw,
  owner @{HOME}/.aptitude/config rw,
  owner @{HOME}/.aptitude/config@{pid} rw,
  /tmp/apt-changelog-*/ rw,
  /var/lib/debtags/vocabulary r,
  @{bin}/su rPx,

  @{run}/lock/aptitude rwk,
  /usr/share/aptitude/ r,
  /usr/share/aptitude/* r,
  /var/lib/aptitude/pkgstates{,.old,.new} rw,
  /var/lib/aptitude/pkgstates.old rwl -> /var/lib/aptitude/pkgstates,

  /var/lib/debtags/package-tags r,

  # When run in a TTY, to remove the following error:
  #  aptitude[]: *** err
  #  aptitude[]: /dev/tty2: Permission denied
  #  aptitude[]: *** err
  #  aptitude[]: Oh, oh, it's an error! possibly I die!
  /dev/tty@{int} rw,

  /dev/ptmx rw,

  /var/lib/dbus/machine-id r,
  /etc/machine-id r,

  # For package building
  @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,

  # file_inherit
  /var/log/cron-apt/temp w,


  profile pager {
    include <abstractions/base>
    include <abstractions/consoles>

    @{bin}/                r,
    @{bin}/sensible-pager mr,
    @{sh_path}        rix,

    @{bin}/which{,.debianutils}      rix,
    @{bin}/less       rix,

    owner @{HOME}/.less* rw,

    owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,

    # For shell pwd
    /root/ r,

  }

  include if exists <local/aptitude>
}


# vim:syntax=apparmor