apparmor.d/apparmor.d/profiles-m-r/packagekitd

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{libexec}/packagekitd
profile packagekitd @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/dbus-strict>
  include <abstractions/nameservice-strict>
  include <abstractions/openssl>
  include <abstractions/ssl_certs>
  include if exists <abstractions/apt-common>

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability kill,
  capability mknod,
  capability net_admin,
  capability setgid,
  capability setuid,
  capability sys_chroot,
  capability sys_nice,

  network inet stream,
  network inet6 stream,
  network inet dgram,
  network inet6 dgram,
  network netlink raw,

  signal send set=int peer=apt-methods-*,

  dbus receive bus=system path=/org/freedesktop/PackageKit
       interface=org.freedesktop.DBus.Properties 
       peer=(name=:*, label=gnome-shell),

  dbus receive bus=system path=/org/freedesktop/PackageKit
       interface=org.freedesktop.{DBus.Introspectable,PackageKit}
       member={Introspect,StateHasChanged}
       peer=(name=:*),

  dbus (send,receive) bus=system path=/[0-9]*_@{hex}
       interface=org.freedesktop.{DBus.Properties,PackageKit.Transaction},

  dbus send bus=system path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
       member={RequestName,GetConnectionUnixUser}
       peer=(name=org.freedesktop.DBus, label=dbus-daemon),

  dbus send bus=system path=/org/freedesktop/NetworkManager
       interface=org.freedesktop.DBus.Properties
       member={GetAll,PropertiesChanged}
       peer=(name=:*, label=NetworkManager),

  dbus receive bus=system path=/org/freedesktop/NetworkManager
       interface=org.freedesktop.NetworkManager
       member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged}
       peer=(name=:*, label=NetworkManager),

  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
       interface=org.freedesktop.DBus.Properties
       member=GetAll
       peer=(name=:*, label=polkitd),

  dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
       interface=org.freedesktop.PolicyKit[0-9].Authority
       member=Changed
       peer=(name=:*, label=polkitd),

  dbus receive bus=system path=/org/freedesktop/login[0-9]
       interface=org.freedesktop.login[0-9].Manager
       member={SessionNew,PrepareForShutdown,SessionRemoved,UserNew,UserRemoved,PrepareForSleep}
       peer=(name=:*, label=systemd-logind),

  dbus bind bus=system 
       name=org.freedesktop.PackageKit,
  
  @{exec_path} mr,

  /{usr/,}bin/gpg{,2}  rCx -> gpg,
  /{usr/,}bin/gpgconf  rCx -> gpg,
  /{usr/,}bin/gpgsm    rCx -> gpg,

  /{usr/,}{s,}bin/ldconfig   rix,
  /{usr/,}bin/{,ba,da}sh     rix,
  /{usr/,}bin/cp             rix,
  /{usr/,}bin/echo           rix,
  /{usr/,}bin/gdbus          rix,
  /{usr/,}bin/gzip           rix,
  /{usr/,}bin/ischroot       rix,
  /{usr/,}bin/repo2solv      rix,
  /{usr/,}bin/tar            rix,
  /{usr/,}bin/test           rix,
  /{usr/,}bin/touch          rix,

  /{usr/,}bin/appstreamcli                rPx,
  /{usr/,}bin/arch-audit                  rPx,
  /{usr/,}bin/dpkg                        rPx -> child-dpkg,
  /{usr/,}bin/glib-compile-schemas        rPx,
  /{usr/,}bin/systemd-inhibit             rPx,
  /{usr/,}bin/update-desktop-database     rPx,
  /{usr/,}lib/apt/methods/*               rPx,
  /{usr/,}lib/cnf-update-db               rPx,
  /{usr/,}lib/update-notifier/update-motd-updates-available  rPx,
  /{usr/,}lib/zypp/plugins/appdata/InstallAppdata rPUx, # TODO: write the profile
  /usr/share/libalpm/scripts/*            rPx,

  # Install/update packages
  / r,
  /*{,/} rw,
  /boot/** rwl -> /boot/**,
  /etc/** rwl -> /etc/**,
  /opt/** rwl -> /opt/**,
  /srv/** rwl -> /srv/**,
  /usr/** rwlk -> /usr/**,
  /var/** rwlk -> /var/**,

  owner /tmp/packagekit* rw,

        @{run}/zypp.pid rwk, # only: opensuse
        @{run}/systemd/inhibit/*.ref rw,
  owner @{run}/systemd/users/@{uid} r,

  owner /dev/shm/AP_0x??????/{,**} rw,

  @{sys}/**/ r,
  @{sys}/devices/**/modalias r,

        @{PROC}/@{pids}/cgroup r,
        @{PROC}/@{pids}/mountinfo r,
        @{PROC}/sys/kernel/random/uuid r,
  owner @{PROC}/@{pid}/cmdline r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,

  /dev/tty rw,

  profile gpg {
    include <abstractions/base>
    include <abstractions/nameservice-strict>

    capability dac_read_search,

    /{usr/,}bin/gpg{,2}  mr,
    /{usr/,}bin/gpgconf  mr,
    /{usr/,}bin/gpgsm    mr,

    /{usr/,}bin/gpg-agent rix,
    /{usr/,}bin/scdaemon  rix,

    /etc/gcrypt/hwf.deny r,

    @{HOME}/@{XDG_GPG_DIR}/*.conf r,

    owner /etc/pacman.d/gnupg/ r, # only: arch
    owner /etc/pacman.d/gnupg/** rwkl -> /tmp/pacman.d/gnupg/**,

    /var/tmp/zypp.*/zypp-*/ r, # only: opensuse
    /var/tmp/zypp.*/zypp-*/** rwkl -> /var/tmp/zypp.*/zypp-trusted-*/**,

    owner @{run}/user/@{uid}/gnupg/ r,
    owner @{run}/user/@{uid}/gnupg/ rwkl -> @{run}/user/@{uid}/gnupg/**,

    owner @{PROC}/@{pid}/fd/ r,
    owner @{PROC}/@{pid}/task/@{tid}/comm rw,

    include if exists <local/packagekitd_gpg>
  }

  include if exists <local/packagekitd>
}