apparmor.d/apparmor.d/groups/apt/apt

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = /{usr/,}bin/apt /{usr/,}bin/apt-get
profile apt @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/apt-common>
  include <abstractions/dbus-strict>
  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability fsetid,
  capability kill,
  capability net_admin,
  capability setgid,
  capability setuid,
  capability sys_nice,

  signal (send) peer=apt-methods-*,

  dbus send bus=system path=/org/freedesktop/PackageKit
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name=org.freedesktop.PackageKit),

  dbus send bus=system path=/org/freedesktop/PackageKit
       interface=org.freedesktop.PackageKit
       member=StateHasChanged
       peer=(name=org.freedesktop.PackageKit),

  dbus send bus=system path=/org/freedesktop/login[0-9]
       interface=org.freedesktop.login[0-9].Manager
       member=Inhibit
       peer=(name=org.freedesktop.login[0-9]),

  @{exec_path} mr,

  /{usr/,}bin/{,ba,da}sh rix,
  /{usr/,}bin/{,e}grep   rix,
  /{usr/,}bin/echo       rix,
  /{usr/,}bin/gdbus      rix,
  /{usr/,}bin/ischroot   rix,
  /{usr/,}bin/test       rix,
  /{usr/,}bin/touch      rix,

  /{usr/,}{s,}bin/dpkg-preconfigure           rPx,
  /{usr/,}{s,}bin/localepurge                 rPx,
  /{usr/,}{s,}bin/update-command-not-found    rPx,
  /{usr/,}bin/adequate                        rPx,
  /{usr/,}bin/appstreamcli                    rPx,
  /{usr/,}bin/apt-listbugs                    rPx,
  /{usr/,}bin/apt-listchanges                 rPx,
  /{usr/,}bin/apt-show-versions               rPx,
  /{usr/,}bin/debtags                         rPx,
  /{usr/,}bin/dpkg                            rPx,
  /{usr/,}bin/dpkg-source                     rcx -> dpkg-source,
  /{usr/,}bin/etckeeper                       rPx,
  /{usr/,}bin/ps                              rPx,
  /{usr/,}bin/snap                           rPUx,
  /{usr/,}lib/cnf-update-db                   rPx,
  /{usr/,}lib/needrestart/apt-pinvoke         rPx,
  /{usr/,}lib/ubuntu-advantage/apt-esm-hook   rPx,
  /{usr/,}lib/update-notifier/update-motd-updates-available rPx,
  /usr/share/command-not-found/cnf-update-db  rPx,

  # Methods to use to download packages from the net
  /{usr/,}lib/apt/methods/*      rPx,

  /var/lib/apt/extended_states{,.*} rw,
  /var/lib/apt/lists/** rw,
  /var/lib/apt/lists/lock rwk,
  /var/lib/apt/periodic/update-success-stamp rw,

  /var/log/apt/eipp.log.xz w,
  /var/log/apt/{term,history}.log w,

  # For building the source after the download process is finished (apt-get source --compile)
  /{usr/,}bin/dpkg-buildpackage rPUx,

  # For editing the sources.list file
  /etc/apt/sources.list rwk,
  /{usr/,}bin/sensible-editor rCx -> editor,
  /{usr/,}bin/vim.*           rCx -> editor,

  # For changelogs
        /tmp/apt-changelog-*/ w,
  owner /tmp/apt-changelog-*/.apt-acquire-privs-test.* rw,
        /tmp/apt-changelog-*/*.changelog w,
  /{usr/,}bin/sensible-pager    rCx -> pager,

  /var/lib/dpkg/** r,
  /var/lib/dpkg/lock{,-frontend} rwk,

  owner @{PROC}/@{pid}/fd/ r,
        @{PROC}/@{pids}/mountinfo r,

  /dev/ptmx rw,

  /var/lib/dbus/machine-id r,
  /etc/machine-id r,

        /tmp/ r,
  owner /tmp/apt.conf.* rw,
  owner /tmp/apt.data.* rw,
  owner /tmp/apt-dpkg-install-*/ rw,
  owner /tmp/apt-dpkg-install-*/[0-9]*-*.deb w,

  /var/cache/apt/ r,
  /var/cache/apt/** rwk,

  # For package building
  @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,

  @{run}/systemd/inhibit/[0-9]*.ref rw,

  profile editor flags=(complain) {
    include <abstractions/base>
    include <abstractions/nameservice-strict>

    /{usr/,}bin/sensible-editor mr,
    /{usr/,}bin/vim.*           mrix,
    /{usr/,}bin/{,ba,da}sh       rix,
    /{usr/,}bin/which{,.debianutils}            rix,

    owner @{HOME}/.selected_editor r,

    /usr/share/vim/{,**} r,
    /etc/vim/{,**} r,
    owner @{HOME}/.viminfo{,.tmp} rw,

    owner @{HOME}/.fzf/plugin/ r,
    owner @{HOME}/.fzf/plugin/fzf.vim r,

    /etc/apt/sources.list rw,

  }

  profile pager {
    include <abstractions/base>
    include <abstractions/consoles>

    capability dac_read_search,

    /{usr/,}bin/                r,
    /{usr/,}bin/sensible-pager mr,
    /{usr/,}bin/{,ba,da}sh    rix,

    /{usr/,}bin/which{,.debianutils}         rix,
    /{usr/,}bin/less          rix,

    owner @{HOME}/.less* rw,

    owner /tmp/apt-changelog-*/ r,
    owner /tmp/apt-changelog-*/*.changelog r,

    # For shell pwd
    /root/ r,

  }

  profile dpkg-source flags=(complain) {
    include <abstractions/base>
    include <abstractions/perl>
    include <abstractions/nameservice-strict>

    /{usr/,}bin/dpkg-source mr,
    /{usr/,}bin/perl r,

    /{usr/,}bin/tar     rix,
    /{usr/,}bin/bunzip2 rix,
    /{usr/,}bin/gunzip  rix,
    /{usr/,}bin/gzip    rix,
    /{usr/,}bin/xz      rix,
    /{usr/,}bin/rm      rix,
    /{usr/,}bin/chmod   rix,

    /{usr/,}bin/patch   rix,

    /etc/dpkg/origins/debian r,

               owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
               owner @{HOME}/**      rwkl -> @{HOME}/**,
    audit deny owner @{HOME}/.*     mrwkl,
    audit deny owner @{HOME}/.*/     rw,
    audit deny owner @{HOME}/.*/**  mrwkl,

  }

  include if exists <local/apt>
}