mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: update profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2022-04-07 20:53:35 +01:00
parent c8cda79b78
commit 10cdde9fb7
Failed to generate hash of commit
28 changed files with 90 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/abstractions/trash
View file

@ -14,18 +14,18 @@
owner @{run}/user/@{uid}/trash.so*.[0-9].slave-socket rwl -> @{run}/user/@{uid}/#[0-9]*[0-9],
# Home trash location
owner @{user_share_dirs}/Trash/{,**} rw,
owner @{user_share_dirs}/Trash/{,**} rwl,
# Partitions' trash location when the admin creates the .Trash/ folder in the top lvl dir
owner /{media,mnt}/*/.Trash/{,**} rw,
owner /{media,mnt}/*/.Trash/{,**} rwl,
# Partitions' trash location when the admin doesn't create the .Trash/ folder in the top lvl dir
owner /{media,mnt}/*/.Trash-[0-9]*/{,**} rw,
owner /{media,mnt}/*/.Trash-[0-9]*/{,**} rwl,
# Removable media's trash location when the admin creates the .Trash/ folder in the top lvl dir
owner /{media,mnt}/*/*/.Trash/{,**} rw,
owner /{media,mnt}/*/*/.Trash/{,**} rwl,
# Removable media's trash location when the admin doesn't create the .Trash/ folder in the top lvl dir
owner /{media,mnt}/*/*/.Trash-[0-9]*/{,**} rw,
owner /{media,mnt}/*/*/.Trash-[0-9]*/{,**} rwl,
include if exists <abstractions/trash.d>

3
apparmor.d/groups/apt/apt
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/apt
profile apt @{exec_path} flags=(complain) {
profile apt @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/apt-common>
include <abstractions/consoles>
@ -84,6 +84,7 @@ profile apt @{exec_path} flags=(complain) {
# For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
@{run}/systemd/inhibit/[0-9]*.ref rw,
profile editor flags=(complain) {
include <abstractions/base>

1
apparmor.d/groups/apt/dpkg-status
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/needrestart/dpkg-status
profile dpkg-status @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,

13
apparmor.d/groups/apt/unattended-upgrade
View file

@ -24,11 +24,12 @@ profile unattended-upgrade @{exec_path} {
/{usr/,}bin/ r,
/{usr/,}bin/dpkg rPx,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/python3.[0-9]* rix,
/{usr/,}bin/uname rix,
/{usr/,}lib/apt/methods/http{,s} rPx,
/{usr/,}{s,}bin/on_ac_power rPx,
/{usr/,}bin/dpkg rPx,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/python3.[0-9]* rix,
/{usr/,}bin/uname rix,
/{usr/,}lib/apt/methods/http{,s} rPx,
/usr/share/dpkg/*table r,
@ -43,9 +44,11 @@ profile unattended-upgrade @{exec_path} {
/var/lib/apt/extended_states r,
/var/lib/apt/lists/{,**} r,
/var/lib/apt/periodic/unattended-upgrades-stamp w,
/var/lib/dpkg/lock rwk,
/var/lib/dpkg/lock-frontend rwk,
/var/lib/dpkg/status r,
/var/lib/dpkg/updates/ r,
/var/cache/apt/archives/{,**} rw,
/var/cache/apt/pkgcache.bin r,

4
apparmor.d/groups/apt/unattended-upgrade-shutdown
View file

@ -17,10 +17,12 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
/usr/share/unattended-upgrades/{,*} r,
/etc/apt/apt.conf.d/{,*} r,
owner /var/log/unattended-upgrades/*.log rw,
owner /var/log/unattended-upgrades/*.log* rw,
owner @{run}/unattended-upgrades.lock rwk,
owner @{run}/systemd/inhibit/[0-9]*.ref rw,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/unattended-upgrade-shutdown>
}

2
apparmor.d/groups/browsers/firefox
View file

@ -126,7 +126,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/mozilla/** rwk,
owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw,
owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw,
@ -189,6 +188,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
# Silencer
deny /{usr/,}lib/firefox/** w,
deny capability sys_ptrace,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
deny owner @{HOME}/.* r,
profile open {

3
apparmor.d/groups/browsers/firefox-crashreporter
View file

@ -64,5 +64,8 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
/dev/dri/card[0-9]* rw,
/dev/dri/renderD128 rw,
# Silencer
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
include if exists <local/firefox-crashreporter>
}

12
apparmor.d/groups/browsers/firefox-minidump-analyzer
View file

@ -34,7 +34,19 @@ profile firefox-minidump-analyzer @{exec_path} {
owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/stat r,
/dev/dri/renderD128 rw,
# Silencer
deny network inet dgram,
deny network inet6 dgram,
deny network inet stream,
deny network inet6 stream,
deny network netlink raw,
deny owner @{MOZ_HOMEDIR}/firefox/*/extensions/*.xpi r,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
include if exists <local/firefox-minidump-analyzer>
}

1
apparmor.d/groups/bus/dbus-daemon
View file

@ -61,6 +61,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/inhibit/[0-9]*.ref rw,
@{run}/systemd/sessions/[0-9]*.ref rw,
@{run}/systemd/users/@{uid} r,
owner @{run}/user/@{uid}/at-spi/bus rw,
owner @{run}/user/@{uid}/dbus-1/ rw,
owner @{run}/user/@{uid}/dbus-1/services/ rw,

4
apparmor.d/groups/bus/dbus-run-session
View file

@ -11,8 +11,7 @@ profile dbus-run-session @{exec_path} {
include <abstractions/base>
include <abstractions/dconf>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, kill) peer=gdm-*-session,
signal (receive) set=(term, kill, hup) peer=gdm*,
signal (send) set=term peer=dbus-daemon,
@{exec_path} mr,
@ -29,6 +28,7 @@ profile dbus-run-session @{exec_path} {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm/.cache/dconf/ rw,
owner @{PROC}/@{pid}/fd/ r,

6
apparmor.d/groups/cron/cron
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -21,6 +22,8 @@ profile cron @{exec_path} {
network netlink raw,
ptrace (read) peer=unconfined,
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
@ -37,6 +40,7 @@ profile cron @{exec_path} {
/{usr/,}sbin/e2scrub_all rPUx,
/etc/cron.daily/popularity-contest rPx,
/{usr/,}lib/sysstat/debian-sa1 rPUx,
/{usr/,}{s,}bin/sendmail rPUx,
# All stuff that is executed via the user crontab files
/{usr/,}bin/apt-file rPx,

5
apparmor.d/groups/gnome/gnome-control-center
View file

@ -95,11 +95,12 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{sys}/class/ r,
@{sys}/class/input/ r,
@{sys}/devices/**/{name,vendor,product,uevent} r,
@{sys}/devices/platform/**/uevent r,
@{sys}/devices/virtual/**/uevent r,
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
@{sys}/devices/pci[0-9]*/**/revision r,
@{sys}/devices/platform/**/uevent r,
@{sys}/devices/virtual/**/uevent r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,

1
apparmor.d/groups/gnome/gnome-control-center-print-renderer
View file

@ -40,6 +40,7 @@ profile gnome-control-center-print-renderer @{exec_path} {
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
@{sys}/devices/pci[0-9]*/**/revision r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,

3
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -19,7 +19,8 @@ profile gnome-terminal-server @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/{,z,ba,da}sh rux,
# The shell is not confined on purpose.
/{usr/,}bin/{,z,ba,da}sh rUx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/X11/xkb/{,**} r,

9
apparmor.d/groups/gnome/nautilus
View file

@ -35,12 +35,11 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
owner /tmp/{,**} rw,
# Silence non user's data
deny owner @{HOME}/@{XDG_VM_DIR}/{,**} rw,
deny /boot rw,
deny /opt rw,
deny /root rw,
deny /boot/{,**} r,
deny /opt/{,**} r,
deny /root/{,**} r,
deny /tmp/.* rw,
deny /tmp/.*/ rw,
deny /tmp/.*/{,**} rw,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

5
apparmor.d/groups/ssh/ssh-keygen
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Roman Beslik <me@beroal.in.ua>
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -10,12 +11,14 @@ include <tunables/global>
profile ssh-keygen @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/consoles> # for entering a passphrase for a key
@{exec_path} mr,
/etc/ssh/ssh_host_*_key* rw,
owner @{HOME}/@{XDG_SSH_DIR}/ w,
owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw,

1
apparmor.d/groups/systemd/systemd-udevd
View file

@ -25,6 +25,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
capability sys_admin,
capability sys_module,
capability sys_ptrace,
capability sys_rawio,
capability sys_resource,
ptrace (read),

15
apparmor.d/profiles-a-f/dhclient
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2018-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -12,17 +13,9 @@ profile dhclient @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/openssl>
# To remove the following errors:
# dhclient[]: Open a socket for LPF: Operation not permitted
capability net_raw,
# To remove the following errors:
# dhclient[]: Can't bind to dhcp address: Permission denied
capability net_admin,
capability net_bind_service,
# Needed?
audit deny capability net_admin,
audit deny capability sys_module,
capability net_raw,
network inet dgram,
network inet6 dgram,

5
apparmor.d/profiles-a-f/dhclient-script
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2018-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -93,6 +94,8 @@ profile dhclient-script @{exec_path} {
# file_inherit
/var/lib/dhcp/dhclient.leases r,
@{sys}/devices/virtual/dmi/id/board_vendor r,
profile run-parts {
include <abstractions/base>

5
apparmor.d/profiles-g-l/git
View file

@ -85,7 +85,7 @@ profile git @{exec_path} {
owner /tmp/** rwkl -> /tmp/**,
owner /tmp/**/bin/* rCx -> exec,
owner @{HOME}/.gitconfig r,
owner @{HOME}/.gitconfig* r,
owner @{HOME}/.netrc r,
owner @{user_config_dirs}/git/{,*} rw,
@ -104,7 +104,8 @@ profile git @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
/{usr/,}bin/gpg mr,
/{usr/,}bin/gpg mr,
/{usr/,}bin/gpg-agent rPx,
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,

1
apparmor.d/profiles-g-l/lspci
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/lspci
profile lspci @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
# Needed when run as root

5
apparmor.d/profiles-m-r/pass
View file

@ -82,6 +82,11 @@ profile pass @{exec_path} {
owner @{HOME}/.fzf/plugin/ r,
owner @{HOME}/.fzf/plugin/fzf.vim r,
owner @{HOME}/.viminfo{,.tmp} rw,
owner @{HOME}/.password-store/ r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/*-store/ r,
owner @{user_config_dirs}/password-store/ r,
owner @{user_cache_dirs}/vim/{,**} rw,
owner @{user_config_dirs}/vim/{,**} rw,
/dev/shm/pass.*/{,*} rw,

2
apparmor.d/profiles-m-r/pkttyagent
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile pkttyagent @{exec_path} {
include <abstractions/base>
capability sys_nice,
ptrace (read),
signal (receive),

2
apparmor.d/profiles-m-r/ps
View file

@ -62,5 +62,7 @@ profile ps @{exec_path} flags=(attach_disconnected) {
owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/ps>
}

6
apparmor.d/profiles-m-r/run-parts
View file

@ -38,6 +38,9 @@ profile run-parts @{exec_path} {
/etc/kernel/prerm.d/ r,
/etc/kernel/prerm.d/dkms rCx -> kernel-pre-post,
/etc/molly-guard/run.d/ r,
/etc/cron.hourly/ r,
owner /tmp/#[0-9]*[0-9] rw,
@ -48,8 +51,9 @@ profile run-parts @{exec_path} {
/etc/update-motd.d/[0-9]*-[a-z]* r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/uname rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/tr rix,
/{usr/,}bin/uname rix,
/usr/share/unattended-upgrades/update-motd-unattended-upgrades rix,

1
apparmor.d/profiles-s-z/udisksd
View file

@ -41,6 +41,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
/{usr/,}{s,}bin/mkfs.fat rPx,
/{usr/,}bin/eject rPx,
/{usr/,}bin/ntfs-3g rPx,
/{usr/,}bin/ntfsfix rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/systemd-escape rPx,

6
apparmor.d/profiles-s-z/update-initramfs
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -11,8 +12,7 @@ profile update-initramfs @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
# Needed? (comm="ischroot")
#ptrace (read),
ptrace (read) peer=unconfined,
@{exec_path} rix,
/{usr/,}bin/{,ba,da}sh rix,

2
apparmor.d/profiles-s-z/virt-manager
View file

@ -22,6 +22,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/opencl>
include <abstractions/python>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
@ -45,6 +46,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
/{usr/,}{s,}bin/libvirtd rPx,
/{usr/,}lib/spice-client-glib-usb-acl-helper rPx,
/usr/share/egl/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/gtksourceview-4/{,**} r,
/usr/share/hwdata/*.ids r,