mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

test(aa): add testdata full.aa

Browse Source
This commit is contained in:
Alexandre Pujol 2024-06-19 23:34:51 +01:00
parent 7317c05646
commit 018073638b
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
3 changed files with 130 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

110
tests/testdata/full.aa vendored Normal file
View File

@ -0,0 +1,110 @@
# Simple test profile with all rules used
abi <abi/4.0>,
alias /mnt/usr -> /usr,
include <tunables/global> # optional: a comment
include if exists "/etc/apparmor.d/global/dummy space"
@{name}=torbrowser "tor browser"
@{lib_dirs} = @{lib}/@{name} /opt/@{name} # another comment
@{config_dirs} = @{HOME}/.mozilla/
@{cache_dirs}=@{user_cache_dirs}/mozilla/
alias /mnt/{,usr.sbin.}mount.cifs -> /sbin/mount.cifs,
@{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name}
profile foo @{exec_path} xattrs=(security.tagged=allowed) flags=(complain attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include "/etc/apparmor.d/abstractions/dummy space"
all,
set rlimit nproc <= 200,
userns,
capability dac_read_search,
capability dac_override,
network inet stream,
network netlink raw,
mount /{,**},
mount options=(rw rbind) /tmp/newroot/ -> /tmp/newroot/,
mount options=(rw silent rprivate) -> /oldroot/,
mount fstype=devpts options=(rw nosuid noexec) devpts -> /newroot/dev/pts/,
remount /newroot/{,**},
umount @{run}/user/@{uid}/,
pivot_root oldroot=/tmp/oldroot/ /tmp/,
change_profile -> libvirt-@{uuid},
mqueue r type=posix /,
io_uring sqpoll label=foo,
signal (receive) set=(cont,term,winch) peer=at-spi-bus-launcher,
ptrace (read) peer=nautilus,
unix (send receive) type=stream addr="@/tmp/.ICE[0-9]-unix/19 5" peer=(label=gnome-shell, addr=none),
dbus bind bus=session name=org.gnome.*,
dbus receive bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=AddMatch
peer=(name=:1.3, label=power-profiles-daemon),
# A comment! before a paragraph of rules
"/opt/Mullvad VPN/resources/*.so*" mr,
"/opt/Mullvad VPN/resources/*" r,
"/opt/Mullvad VPN/resources/openvpn" rix,
/usr/share/gnome-shell/extensions/ding@rastersoft.com/{,*/}ding.js rPx,
/opt/intel/oneapi/compiler/*/linux/lib/*.so./* rm,
owner @{user_config_dirs}/powerdevilrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
link @{user_config_dirs}/kiorc -> @{user_config_dirs}/#@{int},
@{run}/udev/data/+pci:* r,
@{sys}/devices/@{pci}/class r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
^action {
include <abstractions/base>
include if exists <local/foo_action>
}
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
capability net_admin,
include if exists <local/foo_systemctl>
}
profile sudo {
include <abstractions/base>
include <abstractions/app/sudo>
@{sh_path} rix,
include if exists <local/foo_sudo>
}
include if exists <local/foo>
}
profile foo2 {
include <abstractions/base>
include if exists <local/foo2>
}

19
tests/testdata/logs/audit.log vendored
View File

@ -35,3 +35,22 @@ type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_perm
Sep 6 11:23:47 xubuntu-lts kernel: [ 31.024982] audit: type=1107 audit(1111111111.111:1111): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.Accounts" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon"
Sep 6 11:26:12 xubuntu-lts kernel: [ 175.272924] audit: type=1107 audit(1111111111.111:1111): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_signal" bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.Accounts.User" member="Changed" name=":1.6" mask="receive" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="link" class="file" profile="akonadi_maildispatcher_agent" name="/home/bob/.config/akonadi/agent_config_akonadi_maildispatcher_agent.CmJRGE" pid=19277 comm="akonadi_maildis" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000 target="/home/bob/.config/akonadi/#3029891" FSUID="user" OUID="user"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="ptrace" class="ptrace" profile="xdg-document-portal" pid=4515 comm="pool-/usr/lib/x" requested_mask="read" denied_mask="read" peer="nautilus"
type=AVC msg=audit(1689957950.207:1952): apparmor="DENIED" operation="file_inherit" class="net" profile="nvidia_modprobe" pid=5139 comm="nvidia-modprobe" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1111111111.111:1111): apparmor="ALLOWED" operation="open" class="file" profile="gsettings" name="/var/lib/gdm3/greeter-dconf-defaults" pid=2477 comm="gsettings" requested_mask="r" denied_mask="r" fsuid=131 ouid=131
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(11111111111.111:111): apparmor="ALLOWED" operation="connect" class="net" profile="gsettings" pid=2477 comm=64636F6E6620776F726B6572 family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send receive connect" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1693): apparmor="ALLOWED" operation="file_perm" class="net" profile="gsettings" pid=2446 comm="dbus-daemon" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1694): apparmor="ALLOWED" operation="file_perm" class="net" profile="gsettings" pid=2446 comm="dbus-daemon" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1695): apparmor="ALLOWED" operation="mkdir" class="file" profile="gnome-keyring-daemon" name="/var/lib/gdm3/.local/" pid=2478 comm="gnome-keyring-d" requested_mask="c" denied_mask="c" fsuid=131 ouid=131
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1696): apparmor="ALLOWED" operation="mkdir" class="file" profile="gnome-keyring-daemon" name="/var/lib/gdm3/.local/share/" pid=2478 comm="gnome-keyring-d" requested_mask="c" denied_mask="c" fsuid=131 ouid=131
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689779263.198:3384): apparmor="DENIED" operation="ptrace" class="ptrace" profile="snap-update-ns.firefox" pid=1948 comm="systemd-journal" requested_mask="readby" denied_mask="readby" peer="systemd-journald"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689779263.198:3385): apparmor="DENIED" operation="ptrace" class="ptrace" profile="snap-update-ns.firefox" pid=1948 comm="systemd-journal" requested_mask="readby" denied_mask="readby" peer="systemd-journald"
Jul 19 15:07:43 aa-ubuntu-desktop kernel: [ 160.323577] audit: type=1400 audit(1689779263.106:3379): apparmor="DENIED" operation="capable" class="cap" profile="/snap/snapd/19457/usr/lib/snapd/snap-confine" pid=3915 comm="snap-confine" capability=12 capname="net_admin"
Jul 19 15:07:43 aa-ubuntu-desktop kernel: [ 160.323584] audit: type=1400 audit(1689779263.106:3380): apparmor="DENIED" operation="capable" class="cap" profile="/snap/snapd/19457/usr/lib/snapd/snap-confine" pid=3915 comm="snap-confine" capability=38 capname="perfmon"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_inherit" class="net" profile="firefox-vaapitest" pid=5120 comm="vaapitest" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" profile="/usr/lib/kauth/backlighthelper" pid=2632 comm="backlighthelper" capability=12 capname="net_admin"
profile="sddm-greeter" operation="setsockopt" class="net" comm="sddm-greeter" family="netlink" sock_type="raw" protocol=15 requested_mask="setopt" denied_mask="setopt"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" profile="xorg" pid=16195 comm="Xorg.bin" capability=17 capname="sys_rawio"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="getattr" class="file" profile="pacman//null-/usr/share/code-features/patch.py" name="/etc/ld.so.preload" pid=18817 comm="patch.py" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" info="optional: no audit" error=-1 profile="pacman" comm="killall" capability=19 capname="sys_ptrace"

2
tests/testdata/string.aa vendored
View File

@ -19,7 +19,7 @@ profile foo @{exec_path} xattrs=(security.tagged=allowed) flags=(complain attach
network inet stream,
network inet6 stream,
mount fstype=fuse.portal options=(rw rbind) @{run}/user/@{uid}/ -> /, # failed perms check
mount fstype=fuse.portal options=(rw rbind) @{run}/user/@{uid}/ -> /, # failed perms check
umount @{run}/user/@{uid}/,