apparmor.d/apparmor.d/profiles-m-r/packagekitd

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{lib}/packagekitd
profile packagekitd @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/dbus-strict>
  include <abstractions/nameservice-strict>
  include <abstractions/openssl>
  include <abstractions/ssl_certs>
  include if exists <abstractions/apt-common>

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability kill,
  capability mknod,
  capability net_admin,
  capability setgid,
  capability setuid,
  capability sys_chroot,
  capability sys_nice,

  network inet stream,
  network inet6 stream,
  network inet dgram,
  network inet6 dgram,
  network netlink raw,

  signal send set=int peer=apt-methods-*,

  dbus receive bus=system path=/org/freedesktop/PackageKit
       interface=org.freedesktop.DBus.Properties 
       peer=(name=:*, label=gnome-shell),

  dbus receive bus=system path=/org/freedesktop/PackageKit
       interface=org.freedesktop.{DBus.Introspectable,PackageKit}
       member={Introspect,StateHasChanged}
       peer=(name=:*),

  dbus (send,receive) bus=system path=/[0-9]*_@{hex}
       interface=org.freedesktop.{DBus.Properties,PackageKit.Transaction},

  dbus send bus=system path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
       member={RequestName,GetConnectionUnixUser}
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

  dbus send bus=system path=/org/freedesktop/NetworkManager
       interface=org.freedesktop.DBus.Properties
       member={GetAll,PropertiesChanged}
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop/NetworkManager
       interface=org.freedesktop.NetworkManager
       member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged}
       peer=(name=:*, label=NetworkManager),

  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=polkitd),

  dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
       interface=org.freedesktop.PolicyKit[0-9].Authority
       member=Changed
       peer=(name=:*, label=polkitd),

  dbus receive bus=system path=/org/freedesktop/login[0-9]
       interface=org.freedesktop.login[0-9].Manager
       member={SessionNew,PrepareForShutdown,SessionRemoved,UserNew,UserRemoved,PrepareForSleep}
       peer=(name=:*, label=systemd-logind),

  dbus bind bus=system 
       name=org.freedesktop.PackageKit,
  
  @{exec_path} mr,

  @{bin}/gpg{,2}  rCx -> gpg,
  @{bin}/gpgconf  rCx -> gpg,
  @{bin}/gpgsm    rCx -> gpg,

  @{bin}/{,ba,da}sh     rix,
  @{bin}/cp             rix,
  @{bin}/echo           rix,
  @{bin}/gdbus          rix,
  @{bin}/gzip           rix,
  @{bin}/ischroot       rix,
  @{bin}/ldconfig       rix,
  @{bin}/repo2solv      rix,
  @{bin}/tar            rix,
  @{bin}/test           rix,
  @{bin}/touch          rix,

  @{bin}/appstreamcli                rPx,
  @{bin}/arch-audit                  rPx, # only: arch
  @{bin}/dpkg                        rPx -> child-dpkg, # only: dpkg
  @{bin}/fc-cache                    rPx
  @{bin}/glib-compile-schemas        rPx,
  @{bin}/install-info                rPx 
  @{bin}/systemd-inhibit             rPx,
  @{bin}/update-desktop-database     rPx,
  @{lib}/apt/methods/*               rPx, # only: dpkg
  @{lib}/cnf-update-db               rPx,
  @{lib}/update-notifier/update-motd-updates-available  rPx,
  @{lib}/zypp/plugins/appdata/InstallAppdata rPUx, # TODO: write the profile
  /usr/share/libalpm/scripts/*       rPx,

  # Install/update packages
  / r,
  /*{,/} rw,
  /boot/** rwl -> /boot/**,
  /etc/** rwl -> /etc/**,
  /opt/** rwl -> /opt/**,
  /srv/** rwl -> /srv/**,
  /usr/** rwlk -> /usr/**,
  /var/** rwlk -> /var/**,

        /tmp/apt-changelog-@{rand6}/ w,
        /tmp/apt-changelog-@{rand6}/*.changelog rw,
  owner /tmp/alpm_*/{,**} rw,
  owner /tmp/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw,
  owner /tmp/packagekit* rw,

        @{run}/systemd/inhibit/*.ref rw,
        @{run}/zypp.pid rwk, # only: opensuse
  owner @{run}/systemd/users/@{uid} r,
  owner @{run}/zypp-rpm.pid rwk, # only: opensuse
  owner @{run}/zypp/packages/ r, # only: opensuse

  owner /dev/shm/AP_0x@{rand6}/{,**} rw,
  owner /dev/shm/ r,

  @{sys}/**/ r,
  @{sys}/devices/**/modalias r,

        @{PROC}/@{pids}/cgroup r,
        @{PROC}/@{pids}/mountinfo r,
        @{PROC}/sys/kernel/random/uuid r,
        @{PROC}/@{pid}/cmdline r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,

  /dev/tty rw,

  profile gpg {
    include <abstractions/base>
    include <abstractions/nameservice-strict>

    capability dac_read_search,

    @{bin}/gpg{,2}  mr,
    @{bin}/gpgconf  mr,
    @{bin}/gpgsm    mr,

    @{bin}/gpg-agent rix,
    @{bin}/scdaemon  rix,

    /etc/gcrypt/hwf.deny r,

    @{HOME}/@{XDG_GPG_DIR}/*.conf r,

    owner /etc/pacman.d/gnupg/ r, # only: arch
    owner /etc/pacman.d/gnupg/** rwkl -> /tmp/pacman.d/gnupg/**,

    owner /var/tmp/zypp.*/*/ r, # only: opensuse
    owner /var/tmp/zypp.*/*/** rwkl -> /var/tmp/zypp.*/zypp-trusted-*/**,

    owner @{run}/user/@{uid}/gnupg/ r,
    owner @{run}/user/@{uid}/gnupg/ rwkl -> @{run}/user/@{uid}/gnupg/**,

    owner @{PROC}/@{pid}/fd/ r,
    owner @{PROC}/@{pid}/task/@{tid}/comm rw,

    include if exists <local/packagekitd_gpg>
  }

  include if exists <local/packagekitd>
}