mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): update profile with dbus-send.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-09-11 19:50:50 +01:00
parent 64c2ee5fe9
commit 0fdf514418
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
5 changed files with 96 additions and 219 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

166
apparmor.d/groups/apt/synaptic
View File

@ -10,176 +10,106 @@ include <tunables/global>
@{exec_path} = @{bin}/synaptic @{bin}/synaptic-pkexec @{exec_path} = @{bin}/synaptic @{bin}/synaptic-pkexec
profile synaptic @{exec_path} { profile synaptic @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/common/apt> include <abstractions/common/apt>
include <abstractions/consoles>
include <abstractions/desktop>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
# To remove the following errors:
# W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
# (1: Operation not permitted)
# W: chmod 0700 of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
# (1: Operation not permitted)
# W: chmod 0600 of file /var/lib/apt/lists/deb.debian.org_debian_dists_sid_InRelease failed -
# Item::QueueURI (1: Operation not permitted)
capability fowner,
# To remove the following errors:
# W: chown to _apt:root of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
# (1: Operation not permitted)
# W: chown to _apt:root of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
# (1: Operation not permitted)
capability chown, capability chown,
# To remove the following errors:
# E: setgroups 65534 failed - setgroups (1: Operation not permitted)
# E: setegid 65534 failed - setegid (1: Operation not permitted)
# E: seteuid 100 failed - seteuid (1: Operation not permitted)
# E: setgroups 0 failed - setgroups (1: Operation not permitted)
capability setuid,
capability setgid,
# To remove the following errors:
# W: Problem unlinking the file /var/lib/apt/lists/partial/*_InRelease -
# PrepareFiles (13: Permission denied)
# E: Unable to read /var/lib/apt/lists/partial/ - open (13: Permission denied)
capability dac_read_search,
# To remove the following errors:
# E: Failed to fetch https://**.deb rename failed, Permission denied
# (/var/cache/apt/archives/partial/*.deb -> /var/cache/apt/archives/*.deb).
# E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
capability dac_override, capability dac_override,
capability dac_read_search,
# Needed? (##FIXME##) capability fowner,
capability kill,
capability fsetid, capability fsetid,
deny capability net_admin, capability kill,
deny capability sys_nice, capability net_admin,
capability setgid,
capability setuid,
capability sys_nice,
signal (send) peer=apt-methods-*, signal send peer=apt-methods-*,
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/{,e,f}grep rix, @{bin}/{,e,f}grep rix,
@{bin}/test rix,
@{bin}/echo rix, @{bin}/echo rix,
# For update-apt-xapian-index
@{bin}/nice rix,
@{bin}/ionice rix, @{bin}/ionice rix,
@{bin}/nice rix,
@{bin}/test rix,
# When synaptic is run as root, it wants to exec dbus-launch, and hence it creates the two @{bin}/adequate rPx,
# following root processes: @{bin}/appstreamcli rPx,
# dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr
# /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
#
# Should this be allowed? Synaptic works fine without this.
#@{bin}/dbus-launch rCx -> dbus,
#@{bin}/dbus-send rCx -> dbus,
deny @{bin}/dbus-launch rx,
deny @{bin}/dbus-send rx,
deny @{bin}/gdbus rx,
@{bin}/ps rPx,
@{bin}/dpkg rPx,
@{bin}/apt-listbugs rPx, @{bin}/apt-listbugs rPx,
@{bin}/apt-listchanges rPx, @{bin}/apt-listchanges rPx,
@{bin}/apt-show-versions rPx, @{bin}/apt-show-versions rPx,
@{bin}/dpkg-preconfigure rPx, @{bin}/deborphan rPx,
@{bin}/debtags rPx, @{bin}/debtags rPx,
@{bin}/dpkg rPx,
@{bin}/dpkg-preconfigure rPx,
@{bin}/localepurge rPx, @{bin}/localepurge rPx,
@{bin}/appstreamcli rPx, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/adequate rPx, @{bin}/pkexec rPx,
@{bin}/ps rPx,
@{bin}/software-properties-gtk rPx,
@{bin}/tasksel rPx,
@{bin}/update-apt-xapian-index rPx,
@{bin}/update-command-not-found rPx, @{bin}/update-command-not-found rPx,
/usr/share/command-not-found/cnf-update-db rPx, /usr/share/command-not-found/cnf-update-db rPx,
@{bin}/update-apt-xapian-index rPx,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/deborphan rPx,
@{bin}/tasksel rPx,
@{bin}/pkexec rPx,
@{bin}/software-properties-gtk rPx,
# Methods to use to download packages from the net # Methods to use to download packages from the net
@{lib}/apt/methods/* rPx, @{lib}/apt/methods/* rPx,
/var/lib/apt/lists/** rw, /usr/share/synaptic/{,**} r,
/var/lib/apt/lists/lock rwk,
/var/lib/apt/extended_states{,.*} rw,
/etc/apt/apt.conf.d/99synaptic rw, /etc/apt/apt.conf.d/99synaptic rw,
# For editing the sources.list file
/etc/apt/sources.list rwk,
/etc/apt/sources.list.d/ r,
/etc/apt/sources.list.d/*.list rw,
/etc/fstab r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
/var/log/apt/eipp.log.xz w, /var/log/apt/eipp.log.xz w,
/var/log/apt/{term,history}.log w, /var/log/apt/{term,history}.log w,
# For editing the sources.list file /var/cache/apt/ r,
/etc/apt/sources.list.d/ r, /var/cache/apt/** rwk,
/etc/apt/sources.list.d/*.list rw,
/etc/apt/sources.list rwk,
/var/lib/apt-xapian-index/index r,
/var/cache/apt-xapian-index/index.[0-9]/*.glass r, /var/cache/apt-xapian-index/index.[0-9]/*.glass r,
/var/cache/apt-xapian-index/index.[0-9]/iamglass r, /var/cache/apt-xapian-index/index.[0-9]/iamglass r,
/var/lib/apt-xapian-index/index r,
/var/lib/dpkg/** r, /var/lib/dpkg/** r,
/var/lib/dpkg/lock{,-frontend} rwk, /var/lib/dpkg/lock{,-frontend} rwk,
/var/lib/apt/lists/** rw,
/var/lib/apt/lists/lock rwk,
/var/lib/apt/extended_states{,.*} rw,
/var/lib/dbus/machine-id r, # For package building
/etc/machine-id r, @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
owner @{HOME}/.synaptic/ rw,
owner @{HOME}/.synaptic/** rwk,
/tmp/ r, /tmp/ r,
owner @{tmp}/apt-dpkg-install-*/ rw, owner @{tmp}/apt-dpkg-install-*/ rw,
owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w, owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
/var/cache/apt/ r,
/var/cache/apt/** rwk,
/usr/share/synaptic/{,**} r,
owner @{HOME}/.synaptic/ rw,
owner @{HOME}/.synaptic/** rwk,
@{run}/synaptic.socket w, @{run}/synaptic.socket w,
@{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
# To remove the following error: /dev/ptmx rw,
# Internal Error: impossible to fork children. Synaptics is going to stop. Please report.
# errorcode: 2
/dev/ptmx rw,
/etc/fstab r,
# Synaptic is a GUI app started by root, so without "owner"
@{HOME}/.Xauthority r,
# For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
# file_inherit
owner /dev/tty@{int} rw, owner /dev/tty@{int} rw,
deny @{bin}/dbus-launch x,
deny @{bin}/dbus-send x,
deny @{bin}/gdbus x,
deny @{user_share_dirs}/gvfs-metadata/{*,} r, deny @{user_share_dirs}/gvfs-metadata/{*,} r,
profile dbus {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{bin}/dbus-launch mr,
@{bin}/dbus-send mr,
@{bin}/dbus-daemon rPUx,
# for dbus-launch
owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w,
@{HOME}/.Xauthority r,
}
include if exists <local/synaptic> include if exists <local/synaptic>
} }

18
apparmor.d/profiles-a-f/acpi-powerbtn
View File

@ -11,9 +11,8 @@ profile acpi-powerbtn flags=(attach_disconnected) {
/etc/acpi/powerbtn-acpi-support.sh r, /etc/acpi/powerbtn-acpi-support.sh r,
@{bin}/{ba,da,}sh rix, @{sh_path} rix,
@{bin}/{e,}grep rix, @{bin}/{e,}grep rix,
@{bin}/dbus-send rix,
@{bin}/killall5 rix, @{bin}/killall5 rix,
@{bin}/pgrep rix, @{bin}/pgrep rix,
@{bin}/pinky rix, @{bin}/pinky rix,
@ -21,10 +20,10 @@ profile acpi-powerbtn flags=(attach_disconnected) {
@{bin}/shutdown rix, @{bin}/shutdown rix,
/etc/acpi/powerbtn.sh rix, /etc/acpi/powerbtn.sh rix,
@{bin}/systemctl rCx -> systemctl, @{bin}/dbus-send Cx -> bus,
@{bin}/ps rPx, @{bin}/fgconsole Cx -> fgconsole,
@{bin}/ps Px,
@{bin}/fgconsole rCx -> fgconsole, @{bin}/systemctl Cx -> systemctl,
/usr/share/acpi-support/** r, /usr/share/acpi-support/** r,
@ -46,6 +45,13 @@ profile acpi-powerbtn flags=(attach_disconnected) {
owner /dev/tty@{int} rw, owner /dev/tty@{int} rw,
} }
profile bus flags=(complain) {
include <abstractions/base>
include <abstractions/app/bus>
include if exists <local/acpi-powerbtn_bus>
}
profile systemctl { profile systemctl {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/systemctl> include <abstractions/app/systemctl>

7
apparmor.d/profiles-a-f/dunstctl
View File

@ -13,12 +13,13 @@ profile dunstctl @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/dbus-send rCx -> dbus, @{bin}/dbus-send Cx -> bus,
profile dbus { profile bus {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/bus>
@{bin}/dbus-send mr, include if exists <local/dunstctl_bus>
} }
include if exists <local/dunstctl> include if exists <local/dunstctl>

76
apparmor.d/profiles-g-l/gsmartcontrol
View File

@ -10,43 +10,31 @@ include <tunables/global>
@{exec_path} = @{bin}/gsmartcontrol @{exec_path} = @{bin}/gsmartcontrol
profile gsmartcontrol @{exec_path} { profile gsmartcontrol @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/gtk> include <abstractions/desktop>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
capability dac_read_search, capability dac_read_search,
capability sys_nice,
# Needed?
deny capability sys_nice,
@{exec_path} mr, @{exec_path} mr,
@{bin}/smartctl rPx, @{bin}/dbus-launch Cx -> bus,
@{bin}/xterm rCx -> terminal, @{bin}/dbus-send Cx -> bus,
@{bin}/smartctl Px,
@{bin}/xterm Cx -> terminal,
# When gsmartcontrol is run as root, it wants to exec dbus-launch, and hence it creates the two /etc/fstab r,
# following root processes:
# dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr
# /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
#
# Should this be allowed? Gsmartcontrol works fine without this.
#@{bin}/dbus-launch rCx -> dbus,
#@{bin}/dbus-send rCx -> dbus,
deny @{bin}/dbus-launch rx,
deny @{bin}/dbus-send rx,
owner @{user_config_dirs}/gsmartcontrol/ rw, /var/lib/dbus/machine-id r,
owner @{user_config_dirs}/gsmartcontrol/gsmartcontrol.conf rw, /etc/machine-id r,
# As it's started as root
@{HOME}/.Xauthority r,
# For saving SMART raport # For saving SMART raport
owner /root/ r, owner /root/ r,
owner /root/**.txt w, owner /root/**.txt w,
owner @{user_config_dirs}/gsmartcontrol/ rw,
owner @{user_config_dirs}/gsmartcontrol/** rw,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
@ -55,57 +43,37 @@ profile gsmartcontrol @{exec_path} {
owner @{PROC}/scsi/scsi r, owner @{PROC}/scsi/scsi r,
owner @{PROC}/scsi/sg/devices r, owner @{PROC}/scsi/sg/devices r,
/etc/fstab r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
# The Help menu (and links in it) requires access to a web browser. Since gsmartcontrol is run as # The Help menu (and links in it) requires access to a web browser. Since gsmartcontrol is run as
# root (even when used sudo or gsmartcontrol-root), the web browser will also be run as root and # root (even when used sudo or gsmartcontrol-root), the web browser will also be run as root and
# hence this behavior should be blocked. # hence this behavior should be blocked.
deny @{lib}/@{multiarch}/glib-@{version}/gio-launch-desktop rx, deny @{open_path} rx,
profile bus flags=(complain) {
profile dbus {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/bus>
@{bin}/dbus-launch mr, include if exists <local/gsmartcontrol_bus>
@{bin}/dbus-send mr,
@{bin}/dbus-daemon rPUx,
# for dbus-launch
owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w,
@{HOME}/.Xauthority r,
} }
profile terminal { profile terminal {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/desktop>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/freedesktop.org> include <abstractions/shells>
capability setuid,
capability setgid,
capability fsetid, capability fsetid,
capability setgid,
capability setuid,
@{bin}/xterm mr, @{bin}/xterm mr,
@{bin}/update-smart-drivedb rPx,
/usr/sbin/update-smart-drivedb rPx,
owner @{HOME}/.Xauthority r,
/etc/shells r,
/etc/X11/app-defaults/XTerm-color r,
/etc/X11/app-defaults/XTerm r,
/etc/X11/cursors/*.theme r,
/usr/include/X11/bitmaps/vlines2 r, /usr/include/X11/bitmaps/vlines2 r,
/dev/ptmx rw, /dev/ptmx rw,
include if exists <local/gsmartcontrol_terminal>
} }
include if exists <local/gsmartcontrol> include if exists <local/gsmartcontrol>

48
apparmor.d/profiles-g-l/lxappearance
View File

@ -10,59 +10,31 @@ include <tunables/global>
@{exec_path} = @{bin}/lxappearance @{exec_path} = @{bin}/lxappearance
profile lxappearance @{exec_path} { profile lxappearance @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/gtk> include <abstractions/desktop>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
@{exec_path} mr, @{exec_path} mr,
# When lxappearance is run as root, it wants to exec dbus-launch, and hence it creates the two @{bin}/dbus-launch Cx -> bus,
# following root processes: @{bin}/dbus-send Cx -> bus,
# dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr
# /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
#
# Should this be allowed? Lxappearance works fine without this.
#@{bin}/dbus-launch rCx -> dbus,
#@{bin}/dbus-send rCx -> dbus,
deny @{bin}/dbus-launch rx,
deny @{bin}/dbus-send rx,
/usr/share/lxappearance/{,**} r, /usr/share/lxappearance/{,**} r,
owner @{HOME}/.themes/{,**} r,
owner @{HOME}/.icons/{,**} rw,
owner @{HOME}/.gtkrc-2.0{,.*} rw,
owner @{user_config_dirs}/gtk-3.0/settings.ini{,.*} rw,
/etc/X11/cursors/*.theme r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
/etc/fstab r, /etc/fstab r,
/etc/machine-id r, /etc/machine-id r,
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
# file_inherit owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner /dev/tty@{int} rw, owner /dev/tty@{int} rw,
profile bus {
profile dbus {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/bus>
@{bin}/dbus-launch mr, include if exists <local/lxappearance_bus>
@{bin}/dbus-send mr,
@{bin}/dbus-daemon rPUx,
# for dbus-launch
owner @{HOME}/.dbus/session-bus/@{hex}-[0-9] w,
@{HOME}/.Xauthority r,
} }
include if exists <local/lxappearance> include if exists <local/lxappearance>