apparmor.d/apparmor.d/lintian

# vim:syntax=apparmor
# ------------------------------------------------------------------
#
#    Copyright (C) 2020 Mikhail Morfikov
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

#abi <abi/3.0>,

#include <tunables/global>

@{BUILD_DIR} = /media/debuilder/

@{exec_path}  = /usr/share/lintian/bin/lintian
@{exec_path} += /usr/share/lintian/bin/lintian-info
@{exec_path} += /usr/share/lintian/bin/spellintian
@{exec_path} += /{usr/,}bin/lintian
@{exec_path} += /{usr/,}bin/lintian-info
@{exec_path} += /{usr/,}bin/spellintian
profile lintian @{exec_path} flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/nameservice-strict>
  #include <abstractions/perl>

  capability sys_ptrace,

  ptrace (read),

  @{exec_path} r,
  /{usr/,}bin/perl r,

  /usr/share/lintian/helpers/**  rix,

  /{usr/,}bin/dash               rix,
  /{usr/,}bin/fgrep              rix,
  /{usr/,}bin/env                rix,
  /{usr/,}bin/{,e}grep           rix,
  /{usr/,}bin/nproc              rix,
  /{usr/,}bin/chmod              rix,
  /{usr/,}bin/find               rix,
  /{usr/,}bin/xargs              rix,
  /{usr/,}bin/file               rix,
  /{usr/,}bin/md5sum             rix,
  /{usr/,}bin/sha{1,256,512}sum  rix,
  /{usr/,}bin/tar                rix,
  /{usr/,}bin/xz                 rix,
  /{usr/,}bin/gzip               rix,
  /{usr/,}bin/gunzip             rix,
  /{usr/,}bin/filterdiff         rix,
  /{usr/,}bin/lexgrog            rix,
  /{usr/,}bin/mv                 rix,
  /usr/bin/cp rix,

  /{usr/,}bin/{,@{multiarch}-}ar      rix,
  /{usr/,}bin/{,@{multiarch}-}readelf rix,
  /{usr/,}bin/{,@{multiarch}-}strings rix,

  /{usr/,}bin/dpkg-source        rcx -> dpkg-source,
  /{usr/,}bin/gpg                rCx -> gpg,

  /{usr/,}bin/dpkg-deb           rPx,
  /{usr/,}bin/man                rPx,
  /{usr/,}bin/dpkg-architecture  rPx,

  /usr/share/intltool-debian/* rCx -> intltool,

  /usr/share/lintian/{,**} rk,

  /etc/lintianrc r,

  /etc/xml/catalog r,

  /dev/null rwk,

  # For file
  /etc/magic r,

  owner /tmp/lintian-pool-*/ rw,
  owner /tmp/lintian-pool-*/** rwkl -> /tmp/lintian-pool-*/**,

  # For gpg
  owner /tmp/*/ rw,
  owner /tmp/*/pubring.kbx w,
  owner /tmp/*/random_seed w,

  owner /tmp/* rw,
  owner /tmp/lintian-po-debconf-*/ rw,
  owner /tmp/lintian-po-debconf-*/** rw,

  # For pbuilder
  owner @{BUILD_DIR}/**.{changes,dsc,buildinfo,tar.*,deb} rk,
  owner      @{HOME}/**.{changes,dsc,buildinfo,tar.*,deb} rk,

        @{PROC}/ r,
  owner @{PROC}/@{pid}/fd/ r,
        @{PROC}/@{pids}/cmdline r,
        @{PROC}/@{pids}/stat r,
  owner @{PROC}/@{pid}/environ r,

  /dev/ r,
  /dev/**/ r,

  /etc/apt/apt.conf r,
  /etc/apt/apt.conf.d/{,*} r,

  /etc/dpkg/origins/debian r,
  /usr/share/dpkg/{cpu,tuple}table r,


  profile dpkg-source flags=(complain) {
    #include <abstractions/base>
    #include <abstractions/nameservice-strict>
    #include <abstractions/perl>

    /{usr/,}bin/dpkg-source mr,
    /{usr/,}bin/perl r,

    /{usr/,}bin/tar     rix,
    /{usr/,}bin/bunzip2 rix,
    /{usr/,}bin/gunzip  rix,
    /{usr/,}bin/gzip    rix,
    /{usr/,}bin/xz      rix,
    /{usr/,}bin/rm      rix,
    /{usr/,}bin/chmod   rix,
    /{usr/,}bin/patch   rix,

    /etc/dpkg/origins/debian r,

    owner /tmp/lintian-pool-*/** rw,

               owner @{BUILD_DIR}/** rwkl -> @{BUILD_DIR}/**,
               owner @{HOME}/**      rwkl -> @{HOME}/**,
    audit deny owner @{HOME}/.*     mrwkl,
    audit deny owner @{HOME}/.*/     rw,
    audit deny owner @{HOME}/.*/**  mrwkl,

    # file_inherit
    owner /tmp/* rw,

  }

  profile gpg flags=(complain) {
    #include <abstractions/base>

    /{usr/,}bin/gpg mr,

    owner /tmp/temp-lintian-lab-*/**/debian/upstream/signing-key.asc r,
    owner /tmp/lintian-pool-*/**/debian/upstream/signing-key.asc r,
    owner /tmp/*/.#lk0x[0-9a-f]*.*.@{pid} rw,
    owner /tmp/*/.#lk0x[0-9a-f]*.*.@{pid}x rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
    owner /tmp/*/trustdb.gpg rw,
    owner /tmp/*/trustdb.gpg.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
    owner /tmp/*/pubring.kbx rw,
    owner /tmp/*/pubring.kbx.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
    owner /tmp/*/gnupg_spawn_agent_sentinel.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
    owner /tmp/*.gpg rw,
    owner /tmp/*.gpg~ w,
    owner /tmp/*.gpg.tmp rw,
    owner /tmp/*.gpg.lock rwl -> /tmp/.#lk0x[0-9a-f]*.*.@{pid},
    owner /tmp/.#lk0x[0-9a-f]*.*.@{pid} rw,
    owner /tmp/.#lk0x[0-9a-f]*.*.@{pid}x rwl -> /tmp/.#lk0x[0-9a-f]*.*.@{pid},
    owner @{run}/user/[0-9]*/gnupg/d.*/ rw,

    # file_inherit
    owner /tmp/* rw,

  }


  profile intltool flags=(complain) {
    #include <abstractions/base>
    #include <abstractions/perl>

    /usr/share/intltool-debian/* mrix,

    /usr/bin/dash rix,
    /usr/bin/xgettext rix,

    /usr/share/gettext/** r,
    /usr/share/gettext-*/** r,

    owner /tmp/lintian-po-debconf-*/** rw,

    # file_inherit
    owner /tmp/* rw,

  }

  #include if exists <local/lintian>
}