mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): improve/update apt related profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-13 21:42:25 +01:00
parent 7b0ef88358
commit 0cbcbb29a4
Failed to generate hash of commit
10 changed files with 113 additions and 99 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

115
apparmor.d/groups/apt/apt
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -70,79 +70,81 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/snap rPUx, /{usr/,}bin/snap rPUx,
/{usr/,}lib/cnf-update-db rPx, /{usr/,}lib/cnf-update-db rPx,
/{usr/,}lib/needrestart/apt-pinvoke rPx, /{usr/,}lib/needrestart/apt-pinvoke rPx,
/{usr/,}lib/ubuntu-advantage/apt-esm-hook rPx,
/{usr/,}lib/update-notifier/update-motd-updates-available rPx, # For building the source after the download process is finished (apt-get source --compile)
/usr/share/command-not-found/cnf-update-db rPx, /{usr/,}bin/dpkg-buildpackage rPUx,
# Methods to use to download packages from the net # Methods to use to download packages from the net
/{usr/,}lib/apt/methods/* rPx, /{usr/,}lib/apt/methods/* rPx,
# Ubuntu specificities
/{usr/,}lib/ubuntu-advantage/apt-esm-hook rPx,
/{usr/,}lib/ubuntu-advantage/apt-esm-json-hook rPx,
/{usr/,}lib/update-notifier/update-motd-updates-available rPx,
/usr/share/command-not-found/cnf-update-db rPx,
# For editing the sources.list file
/{usr/,}bin/sensible-editor rCx -> editor,
/{usr/,}bin/vim.* rCx -> editor,
# For changelogs
/{usr/,}bin/sensible-pager rCx -> pager,
/etc/apt/sources.list rwk,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
/var/cache/apt/ r,
/var/cache/apt/** rwk,
/var/lib/apt/extended_states{,.*} rw, /var/lib/apt/extended_states{,.*} rw,
/var/lib/apt/lists/** rw, /var/lib/apt/lists/** rw,
/var/lib/apt/lists/lock rwk, /var/lib/apt/lists/lock rwk,
/var/lib/apt/periodic/update-success-stamp rw, /var/lib/apt/periodic/update-success-stamp rw,
/var/log/apt/eipp.log.xz w,
/var/log/apt/{term,history}.log w,
# For building the source after the download process is finished (apt-get source --compile)
/{usr/,}bin/dpkg-buildpackage rPUx,
# For editing the sources.list file
/etc/apt/sources.list rwk,
/{usr/,}bin/sensible-editor rCx -> editor,
/{usr/,}bin/vim.* rCx -> editor,
# For changelogs
/tmp/apt-changelog-*/ w,
owner /tmp/apt-changelog-*/.apt-acquire-privs-test.* rw,
/tmp/apt-changelog-*/*.changelog w,
/{usr/,}bin/sensible-pager rCx -> pager,
/var/lib/dpkg/** r, /var/lib/dpkg/** r,
/var/lib/dpkg/lock{,-frontend} rwk, /var/lib/dpkg/lock{,-frontend} rwk,
/var/lib/update-notifier/dpkg-run-stamp rw,
/var/log/apt/{term,history}.log w,
/var/log/apt/eipp.log.xz w,
# For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
/tmp/ r,
/tmp/apt-changelog-*/ w,
/tmp/apt-changelog-*/*.changelog w,
owner /tmp/apt-changelog-*/.apt-acquire-privs-test.* rw,
owner /tmp/apt-dpkg-install-*/ rw,
owner /tmp/apt-dpkg-install-*/[0-9]*-*.deb w,
owner /tmp/apt.conf.* rw,
owner /tmp/apt.data.* rw,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/mountinfo r,
/dev/ptmx rw, /dev/ptmx rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/tmp/ r,
owner /tmp/apt.conf.* rw,
owner /tmp/apt.data.* rw,
owner /tmp/apt-dpkg-install-*/ rw,
owner /tmp/apt-dpkg-install-*/[0-9]*-*.deb w,
/var/cache/apt/ r,
/var/cache/apt/** rwk,
# For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
@{run}/systemd/inhibit/[0-9]*.ref rw, @{run}/systemd/inhibit/[0-9]*.ref rw,
profile editor flags=(complain) { profile editor flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/sensible-editor mr, /{usr/,}bin/sensible-editor mr,
/{usr/,}bin/vim.* mrix, /{usr/,}bin/vim.* mrix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/which{,.debianutils} rix, /{usr/,}bin/which{,.debianutils} rix,
owner @{HOME}/.selected_editor r,
/usr/share/vim/{,**} r, /usr/share/vim/{,**} r,
/etc/vim/{,**} r,
owner @{HOME}/.viminfo{,.tmp} rw,
owner @{HOME}/.fzf/plugin/ r,
owner @{HOME}/.fzf/plugin/fzf.vim r,
/etc/apt/sources.list rw, /etc/apt/sources.list rw,
/etc/vim/{,**} r,
owner @{HOME}/.viminfo{,.tmp} rw,
owner @{HOME}/.selected_editor r,
owner @{HOME}/.fzf/plugin/ r,
owner @{HOME}/.fzf/plugin/fzf.vim r,
} }
@ -153,39 +155,36 @@ profile apt @{exec_path} flags=(attach_disconnected) {
capability dac_read_search, capability dac_read_search,
/{usr/,}bin/ r, /{usr/,}bin/ r,
/{usr/,}bin/sensible-pager mr,
/{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/which{,.debianutils} rix,
/{usr/,}bin/less rix, /{usr/,}bin/less rix,
/{usr/,}bin/sensible-pager mr,
/{usr/,}bin/which{,.debianutils} rix,
/root/ r, # For shell pwd
owner @{HOME}/.less* rw, owner @{HOME}/.less* rw,
owner /tmp/apt-changelog-*/ r, owner /tmp/apt-changelog-*/ r,
owner /tmp/apt-changelog-*/*.changelog r, owner /tmp/apt-changelog-*/*.changelog r,
# For shell pwd
/root/ r,
} }
profile dpkg-source flags=(complain) { profile dpkg-source flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/perl>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/perl>
/{usr/,}bin/dpkg-source mr, /{usr/,}bin/dpkg-source mr,
/{usr/,}bin/perl r, /{usr/,}bin/perl r,
/{usr/,}bin/tar rix,
/{usr/,}bin/bunzip2 rix, /{usr/,}bin/bunzip2 rix,
/{usr/,}bin/chmod rix,
/{usr/,}bin/gunzip rix, /{usr/,}bin/gunzip rix,
/{usr/,}bin/gzip rix, /{usr/,}bin/gzip rix,
/{usr/,}bin/xz rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/chmod rix,
/{usr/,}bin/patch rix, /{usr/,}bin/patch rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/tar rix,
/{usr/,}bin/xz rix,
/etc/dpkg/origins/debian r, /etc/dpkg/origins/debian r,

13
apparmor.d/groups/apt/apt-cache
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -9,23 +10,23 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-cache @{exec_path} = /{usr/,}bin/apt-cache
profile apt-cache @{exec_path} { profile apt-cache @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/apt-common> include <abstractions/apt-common>
include <abstractions/consoles>
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/dpkg rPx -> child-dpkg, /{usr/,}bin/dpkg rPx -> child-dpkg,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/var/lib/dpkg/** r, /var/lib/dpkg/** r,
/var/lib/dpkg/lock{,-frontend} rwk, /var/lib/dpkg/lock{,-frontend} rwk,
owner @{PROC}/@{pid}/fd/ r,
/var/cache/apt/ r, /var/cache/apt/ r,
/var/cache/apt/** rwk, /var/cache/apt/** rwk,
/var/lib/dbus/machine-id r, owner @{PROC}/@{pid}/fd/ r,
/etc/machine-id r,
include if exists <local/apt-cache> include if exists <local/apt-cache>
} }

6
apparmor.d/groups/apt/apt-cdrom
View file

@ -9,8 +9,8 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-cdrom @{exec_path} = /{usr/,}bin/apt-cdrom
profile apt-cdrom @{exec_path} flags=(complain) { profile apt-cdrom @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/apt-common> include <abstractions/apt-common>
include <abstractions/nameservice-strict>
capability dac_read_search, capability dac_read_search,
@ -21,6 +21,8 @@ profile apt-cdrom @{exec_path} flags=(complain) {
/{usr/,}bin/mount rCx -> mount, /{usr/,}bin/mount rCx -> mount,
/{usr/,}bin/umount rCx -> umount, /{usr/,}bin/umount rCx -> umount,
/etc/fstab r,
# Are all of these needed? (#FIXME#) # Are all of these needed? (#FIXME#)
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/bus/*/devices/ r, @{sys}/bus/*/devices/ r,
@ -29,8 +31,6 @@ profile apt-cdrom @{exec_path} flags=(complain) {
@{sys}/devices/**/uevent r, @{sys}/devices/**/uevent r,
@{run}/udev/data/* r, @{run}/udev/data/* r,
/etc/fstab r,
# For cd-roms # For cd-roms
/media/cdrom[0-9]/ r, /media/cdrom[0-9]/ r,
/media/cdrom[0-9]/**/ r, /media/cdrom[0-9]/**/ r,

5
apparmor.d/groups/apt/apt-config
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -9,8 +10,8 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-config @{exec_path} = /{usr/,}bin/apt-config
profile apt-config @{exec_path} { profile apt-config @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/apt-common> include <abstractions/apt-common>
include <abstractions/consoles>
@{exec_path} mr, @{exec_path} mr,

13
apparmor.d/groups/apt/apt-extracttemplates
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -16,15 +17,17 @@ profile apt-extracttemplates @{exec_path} {
/{usr/,}bin/dpkg rPx -> child-dpkg, /{usr/,}bin/dpkg rPx -> child-dpkg,
owner @{PROC}/@{pid}/fd/ r,
/var/cache/apt/ r, /var/cache/apt/ r,
/var/cache/apt/** rwk, /var/cache/apt/** rwk,
owner /tmp/*.{config,template}.?????? rw,
# For package building # For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
owner /tmp/*.{config,template}.?????? rw,
owner @{PROC}/@{pid}/fd/ r,
include if exists <local/apt-extracttemplates> include if exists <local/apt-extracttemplates>
} }

7
apparmor.d/groups/apt/apt-file
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -25,13 +26,13 @@ profile apt-file @{exec_path} {
/etc/apt/apt-file.conf r, /etc/apt/apt-file.conf r,
owner @{PROC}/@{pid}/fd/ r,
# For shell pwd # For shell pwd
/root/ r, /root/ r,
# file_inherit # file_inherit
/var/log/cron-apt/temp w, /var/log/cron-apt/temp w,
owner @{PROC}/@{pid}/fd/ r,
include if exists <local/apt-file> include if exists <local/apt-file>
} }

18
apparmor.d/groups/apt/apt-forktracer
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -9,8 +10,8 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-forktracer @{exec_path} = /{usr/,}bin/apt-forktracer
profile apt-forktracer @{exec_path} { profile apt-forktracer @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/python>
include <abstractions/apt-common> include <abstractions/apt-common>
include <abstractions/python>
@{exec_path} mr, @{exec_path} mr,
@ -19,21 +20,20 @@ profile apt-forktracer @{exec_path} {
/{usr/,}bin/apt-cache rPx, /{usr/,}bin/apt-cache rPx,
/usr/share/apt-forktracer/{,**} r, /usr/share/apt-forktracer/{,**} r,
/usr/share/distro-info/debian.csv r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/var/lib/apt/lists/ r, /var/lib/apt/lists/ r,
/var/lib/apt/lists/*_InRelease r, /var/lib/apt/lists/*_InRelease r,
/var/cache/apt/pkgcache.bin{,.*} rw, /var/cache/apt/pkgcache.bin{,.*} rw,
/usr/share/distro-info/debian.csv r,
owner @{PROC}/@{pid}/fd/ r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/etc/dpkg/origins/debian r, /etc/dpkg/origins/debian r,
/etc/debian_version r, /etc/debian_version r,
owner @{PROC}/@{pid}/fd/ r,
include if exists <local/apt-forktracer> include if exists <local/apt-forktracer>
} }

6
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -35,6 +36,7 @@ profile dpkg-preconfigure @{exec_path} {
owner /tmp/*.config.* rwPUx, owner /tmp/*.config.* rwPUx,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk, owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk,
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
# The following is needed when dpkg-preconfigure uses debcconf GUI frontends. # The following is needed when dpkg-preconfigure uses debcconf GUI frontends.
include <abstractions/gtk> include <abstractions/gtk>
@ -44,9 +46,7 @@ profile dpkg-preconfigure @{exec_path} {
capability dac_read_search, capability dac_read_search,
/{usr/,}bin/lsb_release rPx -> lsb_release, /{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/hostname rix, /{usr/,}bin/hostname rix,
owner @{PROC}/@{pid}/mounts r,
@{HOME}/.Xauthority r, @{HOME}/.Xauthority r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
include if exists <local/dpkg-preconfigure> include if exists <local/dpkg-preconfigure>

1
apparmor.d/groups/apt/dpkg-query
View file

@ -23,6 +23,7 @@ profile dpkg-query @{exec_path} {
# file_inherit # file_inherit
/tmp/#[0-9]*[0-9] rw, /tmp/#[0-9]*[0-9] rw,
/dev/tty[0-9]* rw,
include if exists <local/dpkg-query> include if exists <local/dpkg-query>
} }

16
apparmor.d/groups/apt/unattended-upgrade
View file

@ -43,19 +43,25 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/ r, /{usr/,}bin/ r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/echo rix,
/{usr/,}bin/gdbus rix,
/{usr/,}bin/ischroot rix,
/{usr/,}bin/python3.[0-9]* rix,
/{usr/,}bin/test rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/uname rix,
/{usr/,}{s,}bin/dpkg-preconfigure rPx, /{usr/,}{s,}bin/dpkg-preconfigure rPx,
/{usr/,}{s,}bin/on_ac_power rPx, /{usr/,}{s,}bin/on_ac_power rPx,
/{usr/,}{s,}bin/sendmail rPUx, /{usr/,}{s,}bin/sendmail rPUx,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/apt-listchanges rPx, /{usr/,}bin/apt-listchanges rPx,
/{usr/,}bin/dpkg rPx, /{usr/,}bin/dpkg rPx,
/{usr/,}bin/etckeeper rPx, /{usr/,}bin/etckeeper rPx,
/{usr/,}bin/ischroot rix,
/{usr/,}bin/lsb_release rPx -> lsb_release, /{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/python3.[0-9]* rix,
/{usr/,}bin/uname rix,
/{usr/,}lib/apt/methods/http{,s} rPx, /{usr/,}lib/apt/methods/http{,s} rPx,
/{usr/,}lib/needrestart/apt-pinvoke rPx, /{usr/,}lib/needrestart/apt-pinvoke rPx,
/{usr/,}lib/update-notifier/update-motd-updates-available rPx,
/usr/share/distro-info/* r, /usr/share/distro-info/* r,
/usr/share/dpkg/*table r, /usr/share/dpkg/*table r,
@ -93,5 +99,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pids}/fd/ r, owner @{PROC}/@{pids}/fd/ r,
@{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/mountinfo r,
/dev/ptmx rw,
include if exists <local/unattended-upgrade> include if exists <local/unattended-upgrade>
} }