170 lines
4 KiB
Text
170 lines
4 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/pass
|
|
profile pass @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
@{exec_path} mr,
|
|
|
|
@{sh_path} rix,
|
|
@{bin}/base64 rix,
|
|
@{bin}/basename rix,
|
|
@{bin}/cat rix,
|
|
@{bin}/cp rix,
|
|
@{bin}/diff rix,
|
|
@{bin}/dirname rix,
|
|
@{bin}/env rix,
|
|
@{bin}/find rix,
|
|
@{bin}/getopt rix,
|
|
@{bin}/grep rix,
|
|
@{bin}/head rix,
|
|
@{bin}/mkdir rix,
|
|
@{bin}/mktemp rix,
|
|
@{bin}/mv rix,
|
|
@{bin}/rm rix,
|
|
@{bin}/rmdir rix,
|
|
@{bin}/sed rix,
|
|
@{bin}/shred rix,
|
|
@{bin}/sleep rix,
|
|
@{bin}/sort rix,
|
|
@{bin}/tail rix,
|
|
@{bin}/touch rix,
|
|
@{bin}/tr rix,
|
|
@{bin}/tree rix,
|
|
@{bin}/tty rix,
|
|
@{bin}/which rix,
|
|
|
|
@{bin}/git rCx -> git,
|
|
@{bin}/gpg{2,} rCx -> gpg,
|
|
@{bin}/pkill rCx -> pkill,
|
|
@{bin}/qdbus rCx -> qdbus,
|
|
@{bin}/vim{,.*} rCx -> editor,
|
|
@{lib}/git{,-core}/git rCx -> git,
|
|
@{bin}/wl-{copy,paste} rPx,
|
|
@{bin}/xclip rPx,
|
|
|
|
# Pass extensions
|
|
@{bin}/oathtool rix, # pass-otp
|
|
@{bin}/python3.@{int} rPx -> pass-import, # pass-import, pass-audit
|
|
@{bin}/qrencode rPUx, # pass-otp
|
|
@{bin}/tomb rPUx, # pass-tomb
|
|
|
|
/usr/share/terminfo/** r,
|
|
|
|
owner @{user_password_store_dirs}/{,**} rw,
|
|
owner /dev/shm/pass.*/{,*} rw,
|
|
|
|
@{sys}/devices/system/node/ r,
|
|
|
|
@{PROC}/ r,
|
|
@{PROC}/@{pid}/stat r,
|
|
@{PROC}/@{pids}/cmdline r,
|
|
@{PROC}/sys/kernel/osrelease r,
|
|
@{PROC}/uptime r,
|
|
|
|
/dev/tty rw,
|
|
|
|
profile pkill {
|
|
include <abstractions/base>
|
|
include <abstractions/app/pgrep>
|
|
|
|
@{bin}/pkill mr,
|
|
|
|
include if exists <local/pass_pkill>
|
|
}
|
|
|
|
profile editor {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/app/editor>
|
|
|
|
/tmp/ r,
|
|
|
|
owner @{user_password_store_dirs}/{,**/} r,
|
|
|
|
owner /dev/shm/pass.*/{,*} rw,
|
|
|
|
deny owner @{HOME}/ r,
|
|
|
|
include if exists <local/pass_editor>
|
|
}
|
|
|
|
profile git {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/ssl_certs>
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
@{bin}/git* mrix,
|
|
@{lib}/git{,-core}/git* mrix,
|
|
|
|
@{bin}/pager rPx -> child-pager,
|
|
@{bin}/less rPx -> child-pager,
|
|
@{bin}/more rPx -> child-pager,
|
|
|
|
@{bin}/gpg{2,} rPx -> pass//gpg,
|
|
|
|
/usr/share/git{,-core}/{,**} r,
|
|
|
|
owner @{HOME}/.gitconfig r,
|
|
owner @{user_config_dirs}/git/{,*} r,
|
|
|
|
owner @{user_password_store_dirs}/ rw,
|
|
owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**,
|
|
|
|
owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature
|
|
owner /dev/shm/pass.*/.git_vtag_tmp@{rand6} rw,
|
|
|
|
include if exists <local/pass_git>
|
|
}
|
|
|
|
profile gpg {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
capability dac_read_search,
|
|
|
|
@{bin}/gpg{,2} mr,
|
|
@{bin}/gpg-agent rPx,
|
|
|
|
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
|
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
|
|
|
owner @{user_password_store_dirs}/ rw,
|
|
owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**,
|
|
owner /dev/shm/pass.*/{,*} rw,
|
|
owner @{tmp}/.git_vtag_tmp@{rand6} rw, # For git log --show-signature
|
|
|
|
owner /dev/pts/@{int} rw,
|
|
|
|
include if exists <local/pass_gpg>
|
|
}
|
|
|
|
profile qdbus {
|
|
include <abstractions/base>
|
|
|
|
@{bin}/qdbus mr,
|
|
|
|
include if exists <local/pass_qdbus>
|
|
}
|
|
|
|
include if exists <usr/pass.d>
|
|
include if exists <local/pass>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|