diff --git a/apparmor.d/abstractions/trash b/apparmor.d/abstractions/trash index ed529672..87a61cc8 100644 --- a/apparmor.d/abstractions/trash +++ b/apparmor.d/abstractions/trash @@ -14,18 +14,18 @@ owner @{run}/user/@{uid}/trash.so*.[0-9].slave-socket rwl -> @{run}/user/@{uid}/#[0-9]*[0-9], # Home trash location - owner @{user_share_dirs}/Trash/{,**} rw, + owner @{user_share_dirs}/Trash/{,**} rwl, # Partitions' trash location when the admin creates the .Trash/ folder in the top lvl dir - owner /{media,mnt}/*/.Trash/{,**} rw, + owner /{media,mnt}/*/.Trash/{,**} rwl, # Partitions' trash location when the admin doesn't create the .Trash/ folder in the top lvl dir - owner /{media,mnt}/*/.Trash-[0-9]*/{,**} rw, + owner /{media,mnt}/*/.Trash-[0-9]*/{,**} rwl, # Removable media's trash location when the admin creates the .Trash/ folder in the top lvl dir - owner /{media,mnt}/*/*/.Trash/{,**} rw, + owner /{media,mnt}/*/*/.Trash/{,**} rwl, # Removable media's trash location when the admin doesn't create the .Trash/ folder in the top lvl dir - owner /{media,mnt}/*/*/.Trash-[0-9]*/{,**} rw, + owner /{media,mnt}/*/*/.Trash-[0-9]*/{,**} rwl, include if exists diff --git a/apparmor.d/groups/apt/apt b/apparmor.d/groups/apt/apt index 6fa7155e..88811874 100644 --- a/apparmor.d/groups/apt/apt +++ b/apparmor.d/groups/apt/apt @@ -8,7 +8,7 @@ abi , include @{exec_path} = /{usr/,}bin/apt -profile apt @{exec_path} flags=(complain) { +profile apt @{exec_path} flags=(attach_disconnected) { include include include @@ -84,6 +84,7 @@ profile apt @{exec_path} flags=(complain) { # For package building @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, + @{run}/systemd/inhibit/[0-9]*.ref rw, profile editor flags=(complain) { include diff --git a/apparmor.d/groups/apt/dpkg-status b/apparmor.d/groups/apt/dpkg-status index ed5f9218..a38119ef 100644 --- a/apparmor.d/groups/apt/dpkg-status +++ b/apparmor.d/groups/apt/dpkg-status @@ -9,6 +9,7 @@ include @{exec_path} = /{usr/,}lib/needrestart/dpkg-status profile dpkg-status @{exec_path} { include + include @{exec_path} mr, diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade index f716620c..f0bf9ab9 100644 --- a/apparmor.d/groups/apt/unattended-upgrade +++ b/apparmor.d/groups/apt/unattended-upgrade @@ -24,11 +24,12 @@ profile unattended-upgrade @{exec_path} { /{usr/,}bin/ r, - /{usr/,}bin/dpkg rPx, - /{usr/,}bin/lsb_release rPx -> lsb_release, - /{usr/,}bin/python3.[0-9]* rix, - /{usr/,}bin/uname rix, - /{usr/,}lib/apt/methods/http{,s} rPx, + /{usr/,}{s,}bin/on_ac_power rPx, + /{usr/,}bin/dpkg rPx, + /{usr/,}bin/lsb_release rPx -> lsb_release, + /{usr/,}bin/python3.[0-9]* rix, + /{usr/,}bin/uname rix, + /{usr/,}lib/apt/methods/http{,s} rPx, /usr/share/dpkg/*table r, @@ -43,9 +44,11 @@ profile unattended-upgrade @{exec_path} { /var/lib/apt/extended_states r, /var/lib/apt/lists/{,**} r, + /var/lib/apt/periodic/unattended-upgrades-stamp w, /var/lib/dpkg/lock rwk, /var/lib/dpkg/lock-frontend rwk, /var/lib/dpkg/status r, + /var/lib/dpkg/updates/ r, /var/cache/apt/archives/{,**} rw, /var/cache/apt/pkgcache.bin r, diff --git a/apparmor.d/groups/apt/unattended-upgrade-shutdown b/apparmor.d/groups/apt/unattended-upgrade-shutdown index 839278fb..a8b0028b 100644 --- a/apparmor.d/groups/apt/unattended-upgrade-shutdown +++ b/apparmor.d/groups/apt/unattended-upgrade-shutdown @@ -17,10 +17,12 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) { /usr/share/unattended-upgrades/{,*} r, /etc/apt/apt.conf.d/{,*} r, - owner /var/log/unattended-upgrades/*.log rw, + owner /var/log/unattended-upgrades/*.log* rw, owner @{run}/unattended-upgrades.lock rwk, owner @{run}/systemd/inhibit/[0-9]*.ref rw, + owner @{PROC}/@{pid}/mounts r, + include if exists } \ No newline at end of file diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 4785cd93..260c3b26 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -126,7 +126,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/mozilla/** rwk, owner @{user_share_dirs}/ r, - owner @{user_share_dirs}/gvfs-metadata/{,*} r, owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw, owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw, @@ -189,6 +188,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) { # Silencer deny /{usr/,}lib/firefox/** w, deny capability sys_ptrace, + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{HOME}/.* r, profile open { diff --git a/apparmor.d/groups/browsers/firefox-crashreporter b/apparmor.d/groups/browsers/firefox-crashreporter index 0cb2b51f..68105d12 100644 --- a/apparmor.d/groups/browsers/firefox-crashreporter +++ b/apparmor.d/groups/browsers/firefox-crashreporter @@ -64,5 +64,8 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) { /dev/dri/card[0-9]* rw, /dev/dri/renderD128 rw, + # Silencer + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, + include if exists } diff --git a/apparmor.d/groups/browsers/firefox-minidump-analyzer b/apparmor.d/groups/browsers/firefox-minidump-analyzer index b9b9c33e..95eb80b9 100644 --- a/apparmor.d/groups/browsers/firefox-minidump-analyzer +++ b/apparmor.d/groups/browsers/firefox-minidump-analyzer @@ -34,7 +34,19 @@ profile firefox-minidump-analyzer @{exec_path} { owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r, + owner @{PROC}/@{pid}/task/@{tid}/stat r, + owner @{PROC}/@{pid}/stat r, + /dev/dri/renderD128 rw, + # Silencer + deny network inet dgram, + deny network inet6 dgram, + deny network inet stream, + deny network inet6 stream, + deny network netlink raw, + deny owner @{MOZ_HOMEDIR}/firefox/*/extensions/*.xpi r, + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, + include if exists } diff --git a/apparmor.d/groups/bus/dbus-daemon b/apparmor.d/groups/bus/dbus-daemon index 2bbd3973..03583e58 100644 --- a/apparmor.d/groups/bus/dbus-daemon +++ b/apparmor.d/groups/bus/dbus-daemon @@ -61,6 +61,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) { @{run}/systemd/inhibit/[0-9]*.ref rw, @{run}/systemd/sessions/[0-9]*.ref rw, @{run}/systemd/users/@{uid} r, + owner @{run}/user/@{uid}/at-spi/bus rw, owner @{run}/user/@{uid}/dbus-1/ rw, owner @{run}/user/@{uid}/dbus-1/services/ rw, diff --git a/apparmor.d/groups/bus/dbus-run-session b/apparmor.d/groups/bus/dbus-run-session index f5f3fca2..30ad1699 100644 --- a/apparmor.d/groups/bus/dbus-run-session +++ b/apparmor.d/groups/bus/dbus-run-session @@ -11,8 +11,7 @@ profile dbus-run-session @{exec_path} { include include - signal (receive) set=term peer=gdm, - signal (receive) set=(term, kill) peer=gdm-*-session, + signal (receive) set=(term, kill, hup) peer=gdm*, signal (send) set=term peer=dbus-daemon, @{exec_path} mr, @@ -29,6 +28,7 @@ profile dbus-run-session @{exec_path} { owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/user rw, /var/lib/gdm/.config/dconf/user r, + /var/lib/gdm/.cache/dconf/ rw, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 2593a017..7d47dc73 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov +# Copyright (C) 2019-2022 Mikhail Morfikov +# Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -21,6 +22,8 @@ profile cron @{exec_path} { network netlink raw, + ptrace (read) peer=unconfined, + @{exec_path} mr, /{usr/,}bin/{,ba,da}sh rix, @@ -37,6 +40,7 @@ profile cron @{exec_path} { /{usr/,}sbin/e2scrub_all rPUx, /etc/cron.daily/popularity-contest rPx, /{usr/,}lib/sysstat/debian-sa1 rPUx, + /{usr/,}{s,}bin/sendmail rPUx, # All stuff that is executed via the user crontab files /{usr/,}bin/apt-file rPx, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index b5307a03..1df277f8 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -95,11 +95,12 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{sys}/class/ r, @{sys}/class/input/ r, @{sys}/devices/**/{name,vendor,product,uevent} r, - @{sys}/devices/platform/**/uevent r, - @{sys}/devices/virtual/**/uevent r, @{sys}/devices/pci[0-9]*/**/drm/ r, @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r, @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r, + @{sys}/devices/pci[0-9]*/**/revision r, + @{sys}/devices/platform/**/uevent r, + @{sys}/devices/virtual/**/uevent r, @{sys}/devices/virtual/dmi/id/chassis_type r, @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r, diff --git a/apparmor.d/groups/gnome/gnome-control-center-print-renderer b/apparmor.d/groups/gnome/gnome-control-center-print-renderer index 4d60b8e4..8ad64ae0 100644 --- a/apparmor.d/groups/gnome/gnome-control-center-print-renderer +++ b/apparmor.d/groups/gnome/gnome-control-center-print-renderer @@ -40,6 +40,7 @@ profile gnome-control-center-print-renderer @{exec_path} { @{sys}/devices/pci[0-9]*/**/drm/ r, @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r, @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r, + @{sys}/devices/pci[0-9]*/**/revision r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/comm r, diff --git a/apparmor.d/groups/gnome/gnome-terminal-server b/apparmor.d/groups/gnome/gnome-terminal-server index 6c267cb1..ade81ec7 100644 --- a/apparmor.d/groups/gnome/gnome-terminal-server +++ b/apparmor.d/groups/gnome/gnome-terminal-server @@ -19,7 +19,8 @@ profile gnome-terminal-server @{exec_path} { @{exec_path} mr, - /{usr/,}bin/{,z,ba,da}sh rux, + # The shell is not confined on purpose. + /{usr/,}bin/{,z,ba,da}sh rUx, /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/X11/xkb/{,**} r, diff --git a/apparmor.d/groups/gnome/nautilus b/apparmor.d/groups/gnome/nautilus index 00b7e302..5c9a2a16 100644 --- a/apparmor.d/groups/gnome/nautilus +++ b/apparmor.d/groups/gnome/nautilus @@ -35,12 +35,11 @@ profile nautilus @{exec_path} flags=(attach_disconnected) { owner /tmp/{,**} rw, # Silence non user's data - deny owner @{HOME}/@{XDG_VM_DIR}/{,**} rw, - deny /boot rw, - deny /opt rw, - deny /root rw, + deny /boot/{,**} r, + deny /opt/{,**} r, + deny /root/{,**} r, deny /tmp/.* rw, - deny /tmp/.*/ rw, + deny /tmp/.*/{,**} rw, owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/user rw, diff --git a/apparmor.d/groups/ssh/ssh-keygen b/apparmor.d/groups/ssh/ssh-keygen index b4cf2297..e05b6690 100644 --- a/apparmor.d/groups/ssh/ssh-keygen +++ b/apparmor.d/groups/ssh/ssh-keygen @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2022 Roman Beslik +# Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -10,12 +11,14 @@ include profile ssh-keygen @{exec_path} { include + include include include - include # for entering a passphrase for a key @{exec_path} mr, + /etc/ssh/ssh_host_*_key* rw, + owner @{HOME}/@{XDG_SSH_DIR}/ w, owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw, diff --git a/apparmor.d/groups/systemd/systemd-udevd b/apparmor.d/groups/systemd/systemd-udevd index a7da15df..5f2020af 100644 --- a/apparmor.d/groups/systemd/systemd-udevd +++ b/apparmor.d/groups/systemd/systemd-udevd @@ -25,6 +25,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) { capability sys_admin, capability sys_module, capability sys_ptrace, + capability sys_rawio, capability sys_resource, ptrace (read), diff --git a/apparmor.d/profiles-a-f/dhclient b/apparmor.d/profiles-a-f/dhclient index a3091424..a5c09ef3 100644 --- a/apparmor.d/profiles-a-f/dhclient +++ b/apparmor.d/profiles-a-f/dhclient @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2018-2021 Mikhail Morfikov +# Copyright (C) 2018-2022 Mikhail Morfikov +# Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -12,17 +13,9 @@ profile dhclient @{exec_path} { include include - # To remove the following errors: - # dhclient[]: Open a socket for LPF: Operation not permitted - capability net_raw, - - # To remove the following errors: - # dhclient[]: Can't bind to dhcp address: Permission denied + capability net_admin, capability net_bind_service, - - # Needed? - audit deny capability net_admin, - audit deny capability sys_module, + capability net_raw, network inet dgram, network inet6 dgram, diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script index 44150396..2c889ecc 100644 --- a/apparmor.d/profiles-a-f/dhclient-script +++ b/apparmor.d/profiles-a-f/dhclient-script @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2018-2021 Mikhail Morfikov +# Copyright (C) 2018-2022 Mikhail Morfikov +# Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -93,6 +94,8 @@ profile dhclient-script @{exec_path} { # file_inherit /var/lib/dhcp/dhclient.leases r, + @{sys}/devices/virtual/dmi/id/board_vendor r, + profile run-parts { include diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 354db016..83f90368 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -85,7 +85,7 @@ profile git @{exec_path} { owner /tmp/** rwkl -> /tmp/**, owner /tmp/**/bin/* rCx -> exec, - owner @{HOME}/.gitconfig r, + owner @{HOME}/.gitconfig* r, owner @{HOME}/.netrc r, owner @{user_config_dirs}/git/{,*} rw, @@ -104,7 +104,8 @@ profile git @{exec_path} { include include - /{usr/,}bin/gpg mr, + /{usr/,}bin/gpg mr, + /{usr/,}bin/gpg-agent rPx, owner @{HOME}/@{XDG_GPG_DIR}/ rw, owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, diff --git a/apparmor.d/profiles-g-l/lspci b/apparmor.d/profiles-g-l/lspci index 3b15a0a9..f270780b 100644 --- a/apparmor.d/profiles-g-l/lspci +++ b/apparmor.d/profiles-g-l/lspci @@ -9,6 +9,7 @@ include @{exec_path} = /{usr/,}bin/lspci profile lspci @{exec_path} { include + include include # Needed when run as root diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index e65eed8d..8455fa74 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -82,6 +82,11 @@ profile pass @{exec_path} { owner @{HOME}/.fzf/plugin/ r, owner @{HOME}/.fzf/plugin/fzf.vim r, owner @{HOME}/.viminfo{,.tmp} rw, + + owner @{HOME}/.password-store/ r, + owner @{HOME}/@{XDG_PROJECTS_DIR}/**/*-store/ r, + owner @{user_config_dirs}/password-store/ r, + owner @{user_cache_dirs}/vim/{,**} rw, owner @{user_config_dirs}/vim/{,**} rw, /dev/shm/pass.*/{,*} rw, diff --git a/apparmor.d/profiles-m-r/pkttyagent b/apparmor.d/profiles-m-r/pkttyagent index 0954ccdb..ebc0366e 100644 --- a/apparmor.d/profiles-m-r/pkttyagent +++ b/apparmor.d/profiles-m-r/pkttyagent @@ -10,6 +10,8 @@ include profile pkttyagent @{exec_path} { include + capability sys_nice, + ptrace (read), signal (receive), diff --git a/apparmor.d/profiles-m-r/ps b/apparmor.d/profiles-m-r/ps index 5839a3cb..3f524288 100644 --- a/apparmor.d/profiles-m-r/ps +++ b/apparmor.d/profiles-m-r/ps @@ -62,5 +62,7 @@ profile ps @{exec_path} flags=(attach_disconnected) { owner /dev/tty[0-9]* rw, owner @{HOME}/.xsession-errors w, + deny @{user_share_dirs}/gvfs-metadata/* r, + include if exists } diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 006f244b..7be09a45 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -38,6 +38,9 @@ profile run-parts @{exec_path} { /etc/kernel/prerm.d/ r, /etc/kernel/prerm.d/dkms rCx -> kernel-pre-post, + /etc/molly-guard/run.d/ r, + /etc/cron.hourly/ r, + owner /tmp/#[0-9]*[0-9] rw, @@ -48,8 +51,9 @@ profile run-parts @{exec_path} { /etc/update-motd.d/[0-9]*-[a-z]* r, /{usr/,}bin/{,ba,da}sh rix, - /{usr/,}bin/uname rix, /{usr/,}bin/cat rix, + /{usr/,}bin/tr rix, + /{usr/,}bin/uname rix, /usr/share/unattended-upgrades/update-motd-unattended-upgrades rix, diff --git a/apparmor.d/profiles-s-z/udisksd b/apparmor.d/profiles-s-z/udisksd index 286274a2..92e7f4f9 100644 --- a/apparmor.d/profiles-s-z/udisksd +++ b/apparmor.d/profiles-s-z/udisksd @@ -41,6 +41,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) { /{usr/,}{s,}bin/mkfs.fat rPx, /{usr/,}bin/eject rPx, /{usr/,}bin/ntfs-3g rPx, + /{usr/,}bin/ntfsfix rPx, /{usr/,}bin/systemctl rPx -> child-systemctl, /{usr/,}bin/systemd-escape rPx, diff --git a/apparmor.d/profiles-s-z/update-initramfs b/apparmor.d/profiles-s-z/update-initramfs index c9c5480d..e8114a1f 100644 --- a/apparmor.d/profiles-s-z/update-initramfs +++ b/apparmor.d/profiles-s-z/update-initramfs @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov +# Copyright (C) 2019-2022 Mikhail Morfikov +# Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -11,8 +12,7 @@ profile update-initramfs @{exec_path} { include include - # Needed? (comm="ischroot") - #ptrace (read), + ptrace (read) peer=unconfined, @{exec_path} rix, /{usr/,}bin/{,ba,da}sh rix, diff --git a/apparmor.d/profiles-s-z/virt-manager b/apparmor.d/profiles-s-z/virt-manager index ad682cdc..1f2180f0 100644 --- a/apparmor.d/profiles-s-z/virt-manager +++ b/apparmor.d/profiles-s-z/virt-manager @@ -22,6 +22,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -45,6 +46,7 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) { /{usr/,}{s,}bin/libvirtd rPx, /{usr/,}lib/spice-client-glib-usb-acl-helper rPx, + /usr/share/egl/{,**} r, /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/gtksourceview-4/{,**} r, /usr/share/hwdata/*.ids r,