185 lines
4.5 KiB
Text
185 lines
4.5 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023 Zane Zakraisek <zz@eng.utah.edu>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}bin/mutt
|
|
profile mutt @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
include <abstractions/ssl_certs>
|
|
include <abstractions/consoles>
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
@{exec_path} mr,
|
|
|
|
# Mutt config files
|
|
/usr/share/mutt/** r,
|
|
/etc/{mutt/,}Muttrc r,
|
|
owner @{HOME}/.mutt/** r,
|
|
owner @{HOME}/.muttrc* r,
|
|
|
|
owner @{HOME}/.cache/mutt rwk,
|
|
|
|
# Used when saving attachments. Mutt saves attachments in whatever directory
|
|
# it's launched from, which is most likely @{HOME}.
|
|
owner @{HOME}/* lw,
|
|
owner @{HOME}/.mutt*/ w,
|
|
owner @{HOME}/.mutt*/* w,
|
|
owner @{HOME}/Downloads/* lw,
|
|
# Used When viewing attachments
|
|
owner /tmp/* lrw,
|
|
# Allow uploading attachments from Public
|
|
owner @{HOME}/Public/* r,
|
|
|
|
#Needed to open a mailbox (at least an imap one)
|
|
owner /tmp/.mutt*/ rw,
|
|
owner /tmp/.mutt*/* lrwk,
|
|
|
|
# Might be able to get away without this
|
|
owner /tmp/mutt* lrwk,
|
|
|
|
# Needed for the edit operation.
|
|
@{HOME}/ r,
|
|
|
|
# User mbox
|
|
owner /var/{spool/,}mail/* rwk,
|
|
owner @{HOME}/postponed rwk,
|
|
owner @{HOME}/sent rwk,
|
|
# User maildir
|
|
owner @{HOME}/{M,m}ail/ rw,
|
|
owner @{HOME}/{M,m}ail/** rwk,
|
|
|
|
# Trusted certificate store
|
|
owner @{HOME}/.mutt_certificates rwk,
|
|
|
|
# Mutt history file
|
|
owner @{HOME}/.mutthistory rwk,
|
|
|
|
# Mutt signature file
|
|
owner @{HOME}/.signature r,
|
|
|
|
# Common location for mail aliases
|
|
owner @{HOME}/.mail_aliases r,
|
|
|
|
/usr/share/terminfo/** r,
|
|
|
|
/etc/mime.types r,
|
|
|
|
# Mutt mailcap search path
|
|
owner @{HOME}/.mailcap r,
|
|
/etc/{mutt/,}mailcap r,
|
|
/usr/{local/,}etc/mailcap r,
|
|
|
|
# Used to exec programs defined in the mailcap.
|
|
# There are countless programs that can be executed from the mailcap.
|
|
# This profile includes only the most basic.
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
|
|
/{usr/,}{s,}bin/sendmail rPUx,
|
|
/{usr/,}bin/ispell rPUx,
|
|
# TODO: Add a profile for abook (Most distros don't ship this anymore though)
|
|
/{usr/,}bin/abook rPUx,
|
|
|
|
/{usr/,}bin/w3m rCx -> html-renderer,
|
|
/{usr/,}bin/lynx rCx -> html-renderer,
|
|
/{usr/,}bin/vim rCx -> editor,
|
|
/{usr/,}bin/sensible-editor rCx -> editor,
|
|
/{usr/,}bin/more rCx -> pager,
|
|
/{usr/,}bin/less rCx -> pager,
|
|
/{usr/,}bin/pager rCx -> pager,
|
|
/{usr/,}bin/gpg{2,} rCx -> gpg,
|
|
/{usr/,}bin/pgpewrap rCx -> gpg,
|
|
|
|
|
|
profile html-renderer {
|
|
include <abstractions/base>
|
|
|
|
/{usr/,}bin/w3m mrix,
|
|
/{usr/,}bin/lynx mrix,
|
|
|
|
owner @{HOME}/.w3m/* rw,
|
|
|
|
owner /tmp/mutt* rw,
|
|
|
|
include if exists <local/mutt_html-renderer>
|
|
}
|
|
|
|
profile editor {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
/{usr/,}bin/sensible-editor mr,
|
|
/{usr/,}bin/vim mrix,
|
|
/{usr/,}bin/vim.* mrix,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
/{usr/,}bin/which{,.debianutils} rix,
|
|
|
|
/usr/share/vim/{,**} r,
|
|
/usr/share/terminfo/** r,
|
|
|
|
/etc/vimrc r,
|
|
/etc/vim/{,**} r,
|
|
|
|
owner @{HOME}/.selected_editor r,
|
|
owner @{HOME}/.viminfo{,.tmp} rw,
|
|
owner @{HOME}/.vimrc r,
|
|
|
|
# Vim swap file
|
|
owner @{HOME}/ r,
|
|
owner @{HOME}/.cache/ r,
|
|
owner @{HOME}/.cache/vim/** wr,
|
|
|
|
# This is the file that holds the message
|
|
owner /tmp/mutt* rw,
|
|
|
|
include if exists <local/mutt_editor>
|
|
}
|
|
|
|
profile pager {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
/{usr/,}bin/less mr,
|
|
/{usr/,}bin/more mr,
|
|
/{usr/,}bin/pager mr,
|
|
|
|
owner @{HOME}/.lesshsQ r,
|
|
owner @{HOME}/.local/state/ r,
|
|
owner @{HOME}/.local/state/less* rw,
|
|
|
|
/usr/share/terminfo/x/xterm-256color r,
|
|
/usr/share/file/misc/magic.mgc r,
|
|
|
|
# This is the file that holds the message
|
|
owner /tmp/mutt* rw,
|
|
|
|
include if exists <local/mutt_pager>
|
|
}
|
|
|
|
profile gpg {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
/{usr/,}bin/gpg{,2} mrix,
|
|
/{usr/,}bin/pgpewrap mr,
|
|
|
|
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
|
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
|
|
|
owner /tmp/mutt* lrw,
|
|
|
|
include if exists <local/mutt_gpg>
|
|
}
|
|
|
|
include if exists <local/mutt>
|
|
}
|