81 lines
2.2 KiB
Text
81 lines
2.2 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile flatpak-bwrap flags=(attach_disconnected,mediate_deleted) {
|
|
include <abstractions/base>
|
|
include <abstractions/bwrap-app>
|
|
include <abstractions/dbus>
|
|
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability net_admin,
|
|
capability setpcap,
|
|
capability sys_admin,
|
|
capability sys_ptrace,
|
|
capability sys_resource,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
mount options=(rw, silent, rslave) -> /,
|
|
mount fstype=tmpfs -> /tmp/,
|
|
mount -> /newroot/{,**},
|
|
mount -> /oldroot/,
|
|
mount -> /tmp/newroot/,
|
|
umount /{,oldroot/},
|
|
|
|
pivot_root oldroot=/newroot/ -> /newroot/,
|
|
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
|
|
|
|
ptrace peer=flatpak-app//&flatpak-bwrap,
|
|
|
|
signal peer=flatpak-app//&flatpak-bwrap,
|
|
|
|
@{bin}/** rmix,
|
|
@{lib}/** rmix,
|
|
/app/** rm,
|
|
|
|
@{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-bwrap//>k-update-icon-cache,
|
|
@{bin}/update-desktop-database rPx -> flatpak-bwrap//&update-desktop-database,
|
|
@{bin}/update-mime-database rPx -> flatpak-bwrap//&update-mime-database,
|
|
@{bin}/xdg-dbus-proxy rPx -> flatpak-bwrap//&xdg-dbus-proxy,
|
|
/app/** rPx -> flatpak-bwrap//&flatpak-app,
|
|
|
|
/usr/share/flatpak/triggers/* rix,
|
|
|
|
/usr/.ref rk,
|
|
|
|
/etc/shells rw,
|
|
|
|
/app/.ref k,
|
|
/app/extra/** rw,
|
|
/bindfile@{rand6} rw,
|
|
/newroot/{,**} rw,
|
|
/tmp/newroot/ w,
|
|
/tmp/oldroot/ w,
|
|
|
|
/var/lib/flatpak/app/{,**} r,
|
|
/var/lib/flatpak/exports/** rw,
|
|
/var/tmp/etilqs_@{hex} rw,
|
|
|
|
owner @{run}/flatpak/{,**} rk,
|
|
owner @{run}/ld-so-cache-dir/* rw,
|
|
|
|
@{PROC}/sys/kernel/overflowgid r,
|
|
@{PROC}/sys/kernel/overflowuid r,
|
|
@{PROC}/sys/user/max_user_namespaces w,
|
|
owner @{PROC}/@{pid}/gid_map rw,
|
|
owner @{PROC}/@{pid}/setgroups rw,
|
|
owner @{PROC}/@{pid}/uid_map rw,
|
|
|
|
include if exists <usr/flatpak-bwrap.d>
|
|
include if exists <local/flatpak-bwrap>
|
|
}
|