e41779f576
On full system policy, use the new bwrap profile (and bwrap-app) to confine sandboxed application. It is not enabled by default as the sandbox profile is quite large. Also integrate with the gnome app that use bwrap as sandbox manager. Update other related profiles See Full system policy #252
35 lines
862 B
Text
35 lines
862 B
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
# Default profile for user sandboxed application
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile bwrap-app flags=(attach_disconnected,mediate_deleted) {
|
|
include <abstractions/base>
|
|
include <abstractions/bwrap-app>
|
|
include <abstractions/fontconfig-cache-write>
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
ptrace peer=bwrap//&bwrap-app,
|
|
|
|
signal peer=bwrap//&bwrap-app,
|
|
|
|
@{bin}/** rmix,
|
|
@{lib}/** rmix,
|
|
/opt/*/** rmix,
|
|
/usr/share/*/* rmix,
|
|
|
|
owner /var/cache/ w,
|
|
|
|
include if exists <usr/bwrap-app.d>
|
|
include if exists <local/bwrap-app>
|
|
}
|