192 lines
6 KiB
Text
192 lines
6 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/aptitude{,-curses}
|
|
profile aptitude @{exec_path} flags=(complain) {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/common/apt>
|
|
|
|
# To remove the following errors:
|
|
# W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
|
|
# (1: Operation not permitted)
|
|
# W: chmod 0700 of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
|
|
# (1: Operation not permitted)
|
|
# W: chmod 0600 of file /var/lib/apt/lists/deb.debian.org_debian_dists_sid_InRelease failed -
|
|
# Item::QueueURI (1: Operation not permitted)
|
|
capability fowner,
|
|
|
|
# To remove the following errors:
|
|
# W: chown to _apt:root of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
|
|
# (1: Operation not permitted)
|
|
# W: chown to _apt:root of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
|
|
# (1: Operation not permitted)
|
|
capability chown,
|
|
|
|
# The "_apt" user is created by the postinst script of the "apt" package. It's the owner of the
|
|
# dirs "/var/cache/apt/archives/partial/" and "/var/lib/apt/lists/partial/" . The "_apt" user is
|
|
# used by APT to download packages, package list, and other things using APT methods as an
|
|
# unprivileged user/group (_apt/nogroup).
|
|
#
|
|
# To remove the following errors:
|
|
# E: setgroups 65534 failed - setgroups (1: Operation not permitted)
|
|
# E: setegid 65534 failed - setegid (1: Operation not permitted)
|
|
# E: seteuid 100 failed - seteuid (1: Operation not permitted)
|
|
# E: setgroups 0 failed - setgroups (1: Operation not permitted)
|
|
capability setuid,
|
|
capability setgid,
|
|
|
|
# To remove the following errors:
|
|
# W: Problem unlinking the file /var/lib/apt/lists/partial/*_InRelease -
|
|
# PrepareFiles (13: Permission denied)
|
|
# E: Unable to read /var/lib/apt/lists/partial/ - open (13: Permission denied)
|
|
capability dac_read_search,
|
|
|
|
# To remove the following errors:
|
|
# E: Failed to fetch https://**.deb rename failed, Permission denied
|
|
# (/var/cache/apt/archives/partial/*.deb -> /var/cache/apt/archives/*.deb).
|
|
# E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
|
|
capability dac_override,
|
|
|
|
# Needed? (##FIXME##)
|
|
capability kill,
|
|
capability fsetid,
|
|
capability sys_chroot,
|
|
audit deny capability net_admin,
|
|
#capability sys_tty_config,
|
|
|
|
signal (send) peer=apt-methods-*,
|
|
|
|
@{exec_path} mr,
|
|
|
|
@{sh_path} rix,
|
|
@{bin}/test rix,
|
|
@{bin}/{,e}grep rix,
|
|
|
|
@{bin}/ps rPx,
|
|
@{bin}/dpkg rPx,
|
|
@{bin}/apt-listbugs rPx,
|
|
@{bin}/apt-listchanges rPx,
|
|
@{bin}/apt-show-versions rPx,
|
|
@{bin}/dpkg-preconfigure rPx,
|
|
@{bin}/debtags rPx,
|
|
@{bin}/localepurge rPx,
|
|
@{bin}/appstreamcli rPx,
|
|
@{bin}/adequate rPx,
|
|
@{bin}/update-command-not-found rPx,
|
|
/usr/share/command-not-found/cnf-update-db rPx,
|
|
|
|
# Methods to use to download packages from the net
|
|
@{lib}/apt/methods/* rPx,
|
|
|
|
/var/lib/apt/lists/** rw,
|
|
/var/lib/apt/lists/lock rwk,
|
|
/var/lib/apt/extended_states{,.*} rw,
|
|
|
|
/var/log/apt/eipp.log.xz w,
|
|
/var/log/apt/{term,history}.log w,
|
|
/var/log/aptitude w,
|
|
|
|
# For downloading the source of packages (showsrc/source options)
|
|
@{bin}/apt rPx,
|
|
|
|
# For changelogs
|
|
owner @{tmp}/aptitude-*.@{pid}:*/cache{ContentCompressed,Extracted}* rw,
|
|
owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
|
|
owner @{tmp}/aptitude-*.@{pid}:*/parsedchangelog* w,
|
|
owner @{user_cache_dirs}/ rw,
|
|
owner @{user_cache_dirs}/aptitude/ rw,
|
|
owner @{user_cache_dirs}/aptitude/metadata-download{,-journal} rw,
|
|
owner @{user_cache_dirs}/aptitude/metadata-download rwk,
|
|
@{bin}/sensible-pager rCx -> pager,
|
|
|
|
# For aptitude-run-state-bundle
|
|
owner @{tmp}/aptitudebug.*/ r,
|
|
owner @{tmp}/aptitudebug.*/** rwk,
|
|
|
|
/var/lib/apt-xapian-index/index r,
|
|
/var/cache/apt-xapian-index/index.[0-9]/*.glass r,
|
|
/var/cache/apt-xapian-index/index.[0-9]/iamglass r,
|
|
|
|
/var/lib/dpkg/** r,
|
|
/var/lib/dpkg/lock{,-frontend} rwk,
|
|
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
|
|
/tmp/ r,
|
|
/tmp/aptitude-*.@{pid}:*/pkgstates* r,
|
|
owner @{tmp}/aptitude-*.@{pid}:*/ rw,
|
|
owner @{tmp}/aptitude-*.@{pid}:*/{pkgstates,control}* rw,
|
|
owner @{tmp}/apt-dpkg-install-*/ rw,
|
|
owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
|
|
|
|
/var/cache/apt/ r,
|
|
/var/cache/apt/** rwk,
|
|
|
|
# For the interactive mode
|
|
/usr/share/tasksel/descs/ r,
|
|
/usr/share/tasksel/descs/debian-tasks.desc r,
|
|
owner @{HOME}/.aptitude/ rw,
|
|
owner @{HOME}/.aptitude/config rw,
|
|
owner @{HOME}/.aptitude/config@{pid} rw,
|
|
/tmp/apt-changelog-*/ rw,
|
|
/var/lib/debtags/vocabulary r,
|
|
@{bin}/su rPx,
|
|
|
|
@{run}/lock/aptitude rwk,
|
|
/usr/share/aptitude/ r,
|
|
/usr/share/aptitude/* r,
|
|
/var/lib/aptitude/pkgstates{,.old,.new} rw,
|
|
/var/lib/aptitude/pkgstates.old rwl -> /var/lib/aptitude/pkgstates,
|
|
|
|
/var/lib/debtags/package-tags r,
|
|
|
|
# When run in a TTY, to remove the following error:
|
|
# aptitude[]: *** err
|
|
# aptitude[]: /dev/tty2: Permission denied
|
|
# aptitude[]: *** err
|
|
# aptitude[]: Oh, oh, it's an error! possibly I die!
|
|
/dev/tty@{int} rw,
|
|
|
|
/dev/ptmx rw,
|
|
|
|
/var/lib/dbus/machine-id r,
|
|
/etc/machine-id r,
|
|
|
|
# For package building
|
|
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
|
|
|
# file_inherit
|
|
/var/log/cron-apt/temp w,
|
|
|
|
|
|
profile pager {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
@{bin}/ r,
|
|
@{bin}/sensible-pager mr,
|
|
@{sh_path} rix,
|
|
|
|
@{bin}/which{,.debianutils} rix,
|
|
@{bin}/less rix,
|
|
|
|
owner @{HOME}/.less* rw,
|
|
|
|
owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
|
|
|
|
# For shell pwd
|
|
/root/ r,
|
|
|
|
}
|
|
|
|
include if exists <local/aptitude>
|
|
}
|
|
|