From bb6df870bb6203bb881be50518ed9578b0da1e1d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 10 Jun 2024 23:43:55 +0100 Subject: [PATCH 01/32] chore: cleanup opensc debian structure. --- apparmor.d/abstractions/app/chromium | 3 +-- apparmor.d/abstractions/app/firefox | 3 +-- apparmor.d/groups/gnome/gsd-smartcard | 3 +-- apparmor.d/groups/gnome/seahorse | 3 +-- apparmor.d/profiles-m-r/pkcs11-register | 3 +-- apparmor.d/profiles-m-r/rngd | 3 +-- 6 files changed, 6 insertions(+), 12 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index c4359cc9..a3af128d 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -110,8 +110,7 @@ /etc/@{name}/{,**} r, /etc/fstab r, - /etc/opensc.conf r, - /etc/opensc/opensc.conf r, # Debian ubication + /etc/{,opensc/}opensc.conf r, /var/lib/dbus/machine-id r, /etc/machine-id r, diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index ba0c7f3e..bd8b1462 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -73,8 +73,7 @@ /etc/fstab r, /etc/mailcap r, /etc/mime.types r, - /etc/opensc.conf r, - /etc/opensc/opensc.conf r, + /etc/{,opensc/}opensc.conf r, /etc/sysconfig/proxy r, /etc/xdg/* r, /etc/xul-ext/kwallet5.js r, diff --git a/apparmor.d/groups/gnome/gsd-smartcard b/apparmor.d/groups/gnome/gsd-smartcard index 4003d175..f5516c22 100644 --- a/apparmor.d/groups/gnome/gsd-smartcard +++ b/apparmor.d/groups/gnome/gsd-smartcard @@ -30,8 +30,7 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { /usr/share/gdm/greeter-dconf-defaults r, /usr/share/glib-2.0/schemas/gschemas.compiled r, - /etc/opensc.conf r, - /etc/opensc/opensc.conf r, + /etc/{,opensc/}opensc.conf r, owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{gdm_config_dirs}/dconf/user r, diff --git a/apparmor.d/groups/gnome/seahorse b/apparmor.d/groups/gnome/seahorse index 8987ae31..1f5a088b 100644 --- a/apparmor.d/groups/gnome/seahorse +++ b/apparmor.d/groups/gnome/seahorse @@ -36,8 +36,7 @@ profile seahorse @{exec_path} { /etc/pki/trust/blocklist/ r, /etc/gcrypt/hwf.deny r, - /etc/opensc.conf r, - /etc/opensc/opensc.conf r, + /etc/{,opensc/}opensc.conf r, owner @{HOME}/@{XDG_SSH_DIR}/{,**} r, diff --git a/apparmor.d/profiles-m-r/pkcs11-register b/apparmor.d/profiles-m-r/pkcs11-register index 3ca20d32..23893edf 100644 --- a/apparmor.d/profiles-m-r/pkcs11-register +++ b/apparmor.d/profiles-m-r/pkcs11-register @@ -12,8 +12,7 @@ profile pkcs11-register @{exec_path} { @{exec_path} mr, - /etc/opensc.conf r, - /etc/opensc/opensc.conf r, + /etc/{,opensc/}opensc.conf r, owner @{HOME}/.mozilla/firefox/*/pkcs11.txt rw, owner @{HOME}/.mozilla/firefox/profiles.ini r, diff --git a/apparmor.d/profiles-m-r/rngd b/apparmor.d/profiles-m-r/rngd index b929f1a7..b600f583 100644 --- a/apparmor.d/profiles-m-r/rngd +++ b/apparmor.d/profiles-m-r/rngd @@ -24,8 +24,7 @@ profile rngd @{exec_path} flags=(attach_disconnected) { /etc/conf.d/rngd r, /etc/machine-id r, - /etc/opensc.conf r, - /etc/opensc/opensc.conf r, + /etc/{,opensc/}opensc.conf r, /var/lib/dbus/machine-id r, @{sys}/devices/virtual/misc/hw_random/rng_available r, From 222685c029ad1b0e056ff54b8bc7a80386d767b4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 10 Jun 2024 23:51:38 +0100 Subject: [PATCH 02/32] feat(profile): use the cups-client more often. --- apparmor.d/abstractions/app/firefox | 3 +-- apparmor.d/abstractions/common/app | 2 +- apparmor.d/groups/gnome/gnome-control-center | 3 +-- apparmor.d/groups/gnome/gsd-print-notifications | 5 +---- apparmor.d/groups/kde/plasmashell | 2 +- 5 files changed, 5 insertions(+), 10 deletions(-) diff --git a/apparmor.d/abstractions/app/firefox b/apparmor.d/abstractions/app/firefox index bd8b1462..578689aa 100644 --- a/apparmor.d/abstractions/app/firefox +++ b/apparmor.d/abstractions/app/firefox @@ -17,6 +17,7 @@ include include include + include include include include @@ -69,7 +70,6 @@ /usr/share/xul-ext/kwallet5/* r, /etc/@{name}/{,**} r, - /etc/cups/client.conf r, /etc/fstab r, /etc/mailcap r, /etc/mime.types r, @@ -81,7 +81,6 @@ /var/lib/nscd/services r, owner @{HOME}/ r, - owner @{HOME}/.cups/lpoptions r, owner @{config_dirs}/ rw, owner @{config_dirs}/** rwk, diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index ff3b0f7f..f563d803 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -15,6 +15,7 @@ include include include + include # include include include @@ -63,7 +64,6 @@ owner @{tmp}/** rmwk, owner /dev/shm/** rwlk -> /dev/shm/**, - @{run}/cups/cups.sock rw, # Allow access to cups printing socket. @{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket. @{run}/host/{,**} r, @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket. diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index fd2462ff..6abb6f1f 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -16,6 +16,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { include include include + include include include include @@ -93,7 +94,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { /usr/share/wallpapers/{,**} r, /usr/share/xml/iso-codes/{,**} r, - /etc/cups/client.conf r, /etc/machine-info r, /etc/rygel.conf r, /etc/security/pwquality.conf r, @@ -130,7 +130,6 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, - @{run}/cups/cups.sock rw, @{run}/samba/ rw, @{run}/systemd/sessions/ r, @{run}/systemd/sessions/* r, diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index 6846ecaa..ad71bec7 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -13,6 +13,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { include include include + include include network inet stream, @@ -34,10 +35,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { @{exec_path} mr, @{lib}/gsd-printer rPx, - /etc/cups/client.conf r, - - @{run}/cups/cups.sock rw, - owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 3c7b4eed..7464a984 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -16,6 +16,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { include include include + include include include include @@ -76,7 +77,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { /usr/share/wallpapers/{,**} r, /etc/appstream.conf r, - /etc/cups/client.conf r, /etc/fstab r, /etc/ksysguarddrc r, /etc/machine-id r, From 0d8afd21e3f7d30bfe052649517f194c8e4dd353 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 10 Jun 2024 23:52:40 +0100 Subject: [PATCH 03/32] feat(abs): vulkan: allow empty vulkan home dir. --- apparmor.d/abstractions/vulkan-strict | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/vulkan-strict b/apparmor.d/abstractions/vulkan-strict index ee56ef44..f5926fc2 100644 --- a/apparmor.d/abstractions/vulkan-strict +++ b/apparmor.d/abstractions/vulkan-strict @@ -14,9 +14,12 @@ /etc/vulkan/icd.d/{,*.json} r, /etc/vulkan/implicit_layer.d/{,*.json} r, - owner @{user_share_dirs}/vulkan/implicit_layer.d/{,*.json} r, owner @{user_cache_dirs}/radv_builtin_shaders{32,64} r, # Vulkan radv shaders cache + owner @{user_share_dirs}/vulkan/ rw, + owner @{user_share_dirs}/vulkan/implicit_layer.d/ rw, + owner @{user_share_dirs}/vulkan/implicit_layer.d/*.json r, + @{sys}/class/ r, @{sys}/class/drm/ r, @{sys}/devices/@{pci}/drm/ r, From b4407fb7f8d6441d24dfc9f449cd1d30f46b5b54 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 10 Jun 2024 23:53:31 +0100 Subject: [PATCH 04/32] feat(abs): wayland: add ibus shared file. --- apparmor.d/abstractions/wayland.d/complete | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/abstractions/wayland.d/complete b/apparmor.d/abstractions/wayland.d/complete index 4e2e7dd0..1029e0a1 100644 --- a/apparmor.d/abstractions/wayland.d/complete +++ b/apparmor.d/abstractions/wayland.d/complete @@ -2,6 +2,8 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only + owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-wayland-@{int} r, + owner @{user_share_dirs}/sddm/wayland-session.log w, owner @{run}/user/@{uid}/wayland-@{int}.lock rwk, From d283ef51965a9f1f16a121c0f1824e3e8ca189d3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Mon, 10 Jun 2024 23:58:44 +0100 Subject: [PATCH 05/32] feat(profile): general update. --- apparmor.d/groups/apt/debsign | 1 + apparmor.d/groups/apt/debsums | 14 +++---- apparmor.d/groups/apt/dpkg-divert | 2 +- .../groups/browsers/firefox-minidump-analyzer | 10 ++--- apparmor.d/groups/bus/ibus-memconf | 4 +- .../groups/cron/cron-popularity-contest | 41 +++++++++---------- apparmor.d/groups/gnome/gdm-generate-config | 2 +- apparmor.d/groups/gnome/gnome-shell | 2 + apparmor.d/groups/gnome/gnome-software | 3 ++ apparmor.d/groups/virt/libvirtd | 1 + apparmor.d/profiles-a-f/cups-notifier-dbus | 3 +- apparmor.d/profiles-a-f/flatpak-portal | 3 ++ apparmor.d/profiles-g-l/kodi-xrandr | 2 +- apparmor.d/profiles-g-l/libreoffice | 5 +++ apparmor.d/profiles-m-r/mkinitramfs | 2 +- apparmor.d/profiles-m-r/qpdfview | 4 +- apparmor.d/profiles-s-z/wsdd | 6 +++ 17 files changed, 62 insertions(+), 43 deletions(-) diff --git a/apparmor.d/groups/apt/debsign b/apparmor.d/groups/apt/debsign index c15be86e..effa93be 100644 --- a/apparmor.d/groups/apt/debsign +++ b/apparmor.d/groups/apt/debsign @@ -55,6 +55,7 @@ profile debsign @{exec_path} { owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo} r, owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo}.asc rw, + include if exists } include if exists diff --git a/apparmor.d/groups/apt/debsums b/apparmor.d/groups/apt/debsums index 7bc55f09..5cd5e045 100644 --- a/apparmor.d/groups/apt/debsums +++ b/apparmor.d/groups/apt/debsums @@ -20,13 +20,6 @@ profile debsums @{exec_path} { @{sh_path} rix, @{bin}/{m,g,}awk rix, - /etc/dpkg/dpkg.cfg.d/{,*} r, - /etc/dpkg/dpkg.cfg r, - - /var/lib/dpkg/info/* r, - - /etc/locale.nopurge r, - # Do not strip env to avoid errors like the following: # ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open # shared object file): ignored. @@ -35,6 +28,13 @@ profile debsums @{exec_path} { @{bin}/dpkg rPx -> child-dpkg, @{bin}/dpkg-divert rPx -> child-dpkg-divert, + /etc/dpkg/dpkg.cfg.d/{,*} r, + /etc/dpkg/dpkg.cfg r, + + /etc/locale.nopurge r, + + /var/lib/dpkg/info/* r, + # For shell pwd / r, /root/ r, diff --git a/apparmor.d/groups/apt/dpkg-divert b/apparmor.d/groups/apt/dpkg-divert index 74217421..515e4167 100644 --- a/apparmor.d/groups/apt/dpkg-divert +++ b/apparmor.d/groups/apt/dpkg-divert @@ -16,7 +16,7 @@ profile dpkg-divert @{exec_path} { /var/lib/dpkg/** r, - /usr/share/*/** w, + /usr/share/*/** rw, /var/lib/dpkg/diversions rw, /var/lib/dpkg/diversions-new rw, diff --git a/apparmor.d/groups/browsers/firefox-minidump-analyzer b/apparmor.d/groups/browsers/firefox-minidump-analyzer index 7c436755..665673a7 100644 --- a/apparmor.d/groups/browsers/firefox-minidump-analyzer +++ b/apparmor.d/groups/browsers/firefox-minidump-analyzer @@ -15,7 +15,7 @@ include @{cache_dirs} = @{user_cache_dirs}/mozilla/ @{exec_path} = @{lib_dirs}/minidump-analyzer -profile firefox-minidump-analyzer @{exec_path} { +profile firefox-minidump-analyzer @{exec_path} flags=(attach_disconnected) { include signal (receive) set=(term, kill) peer=firefox, @@ -27,10 +27,10 @@ profile firefox-minidump-analyzer @{exec_path} { owner "@{config_dirs}/firefox/Crash Reports/" rw, owner "@{config_dirs}/firefox/Crash Reports/pending/" rw, owner "@{config_dirs}/firefox/Crash Reports/pending/@{hex}.{dmp,extra}" rw, - owner @{config_dirs}/*.*/extensions/*.xpi r, - owner @{config_dirs}/*.*/minidumps/ rw, - owner @{config_dirs}/*.*/minidumps/@{uuid}.{dmp,extra} rw, - owner @{config_dirs}/*.*/storage/default/* r, + owner @{config_dirs}/{,firefox/}*.*/extensions/*.xpi r, + owner @{config_dirs}/{,firefox/}*.*/minidumps/ rw, + owner @{config_dirs}/{,firefox/}*.*/minidumps/@{uuid}.{dmp,extra} rw, + owner @{config_dirs}/{,firefox/}*.*/storage/default/* r, owner @{cache_dirs}/firefox/*.*/startupCache/*Cache* r, diff --git a/apparmor.d/groups/bus/ibus-memconf b/apparmor.d/groups/bus/ibus-memconf index dc7895ba..79aae18f 100644 --- a/apparmor.d/groups/bus/ibus-memconf +++ b/apparmor.d/groups/bus/ibus-memconf @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{lib}/{,ibus/}ibus-memconf -profile ibus-memconf @{exec_path} { +profile ibus-memconf @{exec_path} flags=(attach_disconnected) { include include include @@ -27,5 +27,7 @@ profile ibus-memconf @{exec_path} { owner @{desktop_config_dirs}/ibus/bus/ r, owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r, + owner /dev/tty@{int} rw, + include if exists } diff --git a/apparmor.d/groups/cron/cron-popularity-contest b/apparmor.d/groups/cron/cron-popularity-contest index aadae9bf..59bd622f 100644 --- a/apparmor.d/groups/cron/cron-popularity-contest +++ b/apparmor.d/groups/cron/cron-popularity-contest @@ -49,6 +49,7 @@ profile cron-popularity-contest @{exec_path} { /var/log/popularity-contest{,.new} rw, /var/log/popularity-contest{,.new}.gpg rw, /var/log/popularity-contest.@{int} rw, + /var/log/popularity-contest.@{int}.gpg rw, # Store last successful http submission timestamp /var/lib/popularity-contest/ rw, @@ -66,15 +67,14 @@ profile cron-popularity-contest @{exec_path} { @{bin}/savelog mr, - @{bin}/date rix, @{bin}/basename rix, - @{bin}/which{,.debianutils} rix, + @{bin}/date rix, @{bin}/dirname rix, - @{bin}/rm rix, - @{bin}/mv rix, - @{bin}/touch rix, @{bin}/gzip rix, - + @{bin}/mv rix, + @{bin}/rm rix, + @{bin}/touch rix, + @{bin}/which{,.debianutils} rix, @{sh_path} rix, /var/log/ r, @@ -82,9 +82,9 @@ profile cron-popularity-contest @{exec_path} { /var/log/popularity-contest.@{int} rw, /var/log/popularity-contest rw, - # file_inherit - owner @{tmp}/#@{int} rw, + owner @{tmp}/#@{int} rw, # file_inherit + include if exists } profile runuser { @@ -96,19 +96,18 @@ profile cron-popularity-contest @{exec_path} { @{bin}/runuser mr, @{sh_path} rix, - - @{bin}/popularity-contest rPx, - - owner @{PROC}/@{pids}/loginuid r, - @{PROC}/1/limits r, + @{bin}/popularity-contest rPx, @{etc_ro}/security/limits.d/ r, /var/log/popularity-contest.new w, - # file_inherit - owner @{tmp}/#@{int} rw, + @{PROC}/1/limits r, + owner @{PROC}/@{pids}/loginuid r, + owner @{tmp}/#@{int} rw, # file_inherit + + include if exists } profile gpg { @@ -126,9 +125,9 @@ profile cron-popularity-contest @{exec_path} { owner @{tmp}/tmp.*/** rwkl -> /tmp/tmp.*/**, - # file_inherit - owner @{tmp}/#@{int} rw, + owner @{tmp}/#@{int} rw, # file_inherit + include if exists } profile popcon-upload { @@ -142,18 +141,18 @@ profile cron-popularity-contest @{exec_path} { network inet6 stream, network netlink raw, - /usr/share/popularity-contest/popcon-upload r, @{bin}/perl r, - @{bin}/gzip rix, + /usr/share/popularity-contest/popcon-upload r, + /var/log/ r, /var/log/popularity-contest.new.gpg r, /var/log/popularity-contest.@{int}.gpg r, - # file_inherit - owner @{tmp}/#@{int} rw, + owner @{tmp}/#@{int} rw, # file_inherit + include if exists } include if exists diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config index 7d24d304..7d577c4c 100644 --- a/apparmor.d/groups/gnome/gdm-generate-config +++ b/apparmor.d/groups/gnome/gdm-generate-config @@ -41,7 +41,7 @@ profile gdm-generate-config @{exec_path} { @{sys}/devices/system/node/node@{int}/meminfo r, @{PROC}/ r, - @{PROC}/@{pid}/cgroup r, + @{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cmdline r, @{PROC}/@{pid}/stat r, @{PROC}/uptime r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 217cc0d5..2f0c112e 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -407,6 +407,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) { /usr/games/* PUx, /usr/share/gnome-shell/extensions/ding@rastersoft.com/{,*/}ding.js rPx, + owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, + deny @{user_share_dirs}/gvfs-metadata/* r, include if exists diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index f4e6a126..e87cbcd7 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -99,6 +99,9 @@ profile gnome-software @{exec_path} { owner @{run}/user/@{uid}/.flatpak/**/*.ref rwk, owner @{run}/user/@{uid}/app/{,*/} rw, + owner /dev/shm/flatpak-com.*/ rw, + owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw, + @{run}/systemd/inhibit/*.ref rw, @{sys}/module/nvidia/version r, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index 2a75035e..32428f2b 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -206,6 +206,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{sys}/devices/system/cpu/cpu@{int}/cache/{,**} r, @{sys}/devices/system/cpu/cpu@{int}/topology/{,**} r, + @{sys}/devices/system/cpu/isolated r, @{sys}/devices/system/cpu/present r, @{sys}/devices/system/node/ r, @{sys}/devices/system/node/node@{int}/ r, diff --git a/apparmor.d/profiles-a-f/cups-notifier-dbus b/apparmor.d/profiles-a-f/cups-notifier-dbus index 3fb7158e..dddfea78 100644 --- a/apparmor.d/profiles-a-f/cups-notifier-dbus +++ b/apparmor.d/profiles-a-f/cups-notifier-dbus @@ -11,14 +11,13 @@ profile cups-notifier-dbus @{exec_path} { include include include + include include signal (receive) set=(term) peer=cupsd, @{exec_path} mr, - /etc/cups/client.conf r, - owner /var/spool/cups/tmp/cups-dbus-notifier-lockfile rw, owner @{tmp}/cups-dbus-notifier-lockfile rwk, diff --git a/apparmor.d/profiles-a-f/flatpak-portal b/apparmor.d/profiles-a-f/flatpak-portal index d82c3865..a41bf3e7 100644 --- a/apparmor.d/profiles-a-f/flatpak-portal +++ b/apparmor.d/profiles-a-f/flatpak-portal @@ -34,6 +34,9 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { / r, /.flatpak-info r, + owner @{HOME}/.var/app/*/**/.ref rw, + owner @{HOME}/.var/app/*/**/logs/* rw, + owner @{user_config_dirs}/user-dirs.dirs r, owner @{user_share_dirs}/mime/mime.cache r, diff --git a/apparmor.d/profiles-g-l/kodi-xrandr b/apparmor.d/profiles-g-l/kodi-xrandr index 46947632..84337524 100644 --- a/apparmor.d/profiles-g-l/kodi-xrandr +++ b/apparmor.d/profiles-g-l/kodi-xrandr @@ -16,7 +16,7 @@ profile kodi-xrandr @{exec_path} { owner @{HOME}/.Xauthority r, # file_inherit - @{sys}/devices/virtual/thermal/thermal_zone0/temp r, + @{sys}/devices/virtual/thermal/thermal_zone@{int}/temp r, @{sys}/devices/system/cpu/cpufreq/policy0/scaling_cur_freq r, owner @{HOME}/.kodi/temp/kodi.log w, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index cad2260b..f2da11dd 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -52,13 +52,17 @@ profile libreoffice @{exec_path} { @{lib}/libreoffice/share/uno_packages/cache/stamp.sys w, @{lib}/libreoffice/{,**} rm, + /usr/share/hyphen/{,**} r, /usr/share/libexttextcat/{,**} r, /usr/share/liblangtag/{,**} r, + /usr/share/libreoffice/{,**} r, + /usr/share/mythes/{,**} r, /etc/java-openjdk/{,**} r, /etc/libreoffice/{,**} r, /etc/paperspecs r, + owner @{user_cache_dirs}/libreoffice/{,**} rw, owner @{user_config_dirs}/libreoffice/ rw, owner @{user_config_dirs}/libreoffice/** rwk, @@ -75,6 +79,7 @@ profile libreoffice @{exec_path} { @{sys}/kernel/mm/transparent_hugepage/enabled r, @{sys}/kernel/mm/transparent_hugepage/shmem_enabled r, owner @{sys}/fs/cgroup/user.slice/user-@{int}.slice/user@@{int}.service/app.slice/**/memory.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{int}.slice/user@@{int}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r, @{PROC}/cgroups r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs index 304b5834..081aad4e 100644 --- a/apparmor.d/profiles-m-r/mkinitramfs +++ b/apparmor.d/profiles-m-r/mkinitramfs @@ -59,7 +59,7 @@ profile mkinitramfs @{exec_path} { @{bin}/kmod rCx -> kmod, @{bin}/ldconfig rCx -> ldconfig, @{bin}/ldd rCx -> ldd, - @{lib}/ld-linux.so.2 rCx -> ldd, + @{lib}/ld-linux.so* rCx -> ldd, @{bin}/dpkg rPx -> child-dpkg, @{bin}/linux-version rPx, diff --git a/apparmor.d/profiles-m-r/qpdfview b/apparmor.d/profiles-m-r/qpdfview index 4ce205c2..bb0ad1aa 100644 --- a/apparmor.d/profiles-m-r/qpdfview +++ b/apparmor.d/profiles-m-r/qpdfview @@ -61,6 +61,4 @@ profile qpdfview @{exec_path} { owner /dev/tty@{int} rw, include if exists -} - - +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd index 46a3c40b..d850e9f0 100644 --- a/apparmor.d/profiles-s-z/wsdd +++ b/apparmor.d/profiles-s-z/wsdd @@ -11,6 +11,10 @@ profile wsdd @{exec_path} { include include + network inet dgram, + network inet6 dgram, + network netlink raw, + @{exec_path} mr, @{bin}/env r, @@ -18,6 +22,8 @@ profile wsdd @{exec_path} { /etc/machine-id r, + owner /var/lib/libuuid/clock.txt rw, + owner @{run}/user/@{uid}/gvfsd/wsdd w, include if exists From 8fe2bf4c20a3525c80116d7b6f5a9f4b78f72c00 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 11 Jun 2024 00:00:51 +0100 Subject: [PATCH 06/32] feat(profile): add missing enchant abs. --- apparmor.d/groups/gnome/gnome-text-editor | 3 +-- apparmor.d/groups/xfce/mousepad | 6 +----- apparmor.d/profiles-g-l/libreoffice | 1 + 3 files changed, 3 insertions(+), 7 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-text-editor b/apparmor.d/groups/gnome/gnome-text-editor index 6d40144c..de035a59 100644 --- a/apparmor.d/groups/gnome/gnome-text-editor +++ b/apparmor.d/groups/gnome/gnome-text-editor @@ -11,13 +11,12 @@ profile gnome-text-editor @{exec_path} { include include include + include include include @{exec_path} mr, - /usr/share/enchant-*/{,**} r, - owner @{user_share_dirs}/org.gnome.TextEditor/{,**} rw, owner @{PROC}/@{pid}/mountinfo r, diff --git a/apparmor.d/groups/xfce/mousepad b/apparmor.d/groups/xfce/mousepad index e61709db..a83e7fa0 100644 --- a/apparmor.d/groups/xfce/mousepad +++ b/apparmor.d/groups/xfce/mousepad @@ -10,6 +10,7 @@ include profile mousepad @{exec_path} { include include + include include include include @@ -18,14 +19,9 @@ profile mousepad @{exec_path} { @{open_path} rPx -> child-open-help, - /usr/share/hunspell/{,**} r, - owner @{user_config_dirs}/Mousepad/ rw, owner @{user_config_dirs}/Mousepad/** rwk, - owner @{user_config_dirs}/enchant/ rw, - owner @{user_config_dirs}/enchant/ rwk, - owner @{user_share_dirs}/Mousepad/ rw, owner @{user_share_dirs}/Mousepad/** rwk, diff --git a/apparmor.d/profiles-g-l/libreoffice b/apparmor.d/profiles-g-l/libreoffice index f2da11dd..f9dc7646 100644 --- a/apparmor.d/profiles-g-l/libreoffice +++ b/apparmor.d/profiles-g-l/libreoffice @@ -13,6 +13,7 @@ profile libreoffice @{exec_path} { include include include + include include include include From 08a1aba39d11e04c4cad657078ded50cfe66c5c6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 11 Jun 2024 00:01:46 +0100 Subject: [PATCH 07/32] feat(abs): bwrap: add special mount rule for debian. --- apparmor.d/abstractions/common/bwrap | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/common/bwrap b/apparmor.d/abstractions/common/bwrap index f2e76bcd..4b961047 100644 --- a/apparmor.d/abstractions/common/bwrap +++ b/apparmor.d/abstractions/common/bwrap @@ -2,10 +2,9 @@ # Copyright (C) 2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Minimal set of rules for bwrap - +# A minimal set of rules for sandboxed programs using bwrap. # A profile using this abstraction still needs to set: -# - the attach_disconnected flag +# - the flag: attach_disconnected # - bwrap execution: '@{bin}/bwrap rix,' # userns, @@ -31,6 +30,9 @@ umount /, umount /oldroot/, + #aa:only debian whonix + mount -> /newroot/{,**}, # Debian does not support the remount rule. + pivot_root oldroot=/newroot/ /newroot/, pivot_root oldroot=/tmp/oldroot/ /tmp/, From 6f5986a05e80dd24efb53340ebe58c07e0bd0ff1 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 11 Jun 2024 00:08:17 +0100 Subject: [PATCH 08/32] feat(aa-log): improve rule generation on debian. --- pkg/aa/profile.go | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/pkg/aa/profile.go b/pkg/aa/profile.go index 21181378..365bf1eb 100644 --- a/pkg/aa/profile.go +++ b/pkg/aa/profile.go @@ -190,10 +190,14 @@ var ( return newFileFromLog(log) } }, - "exec": newFileFromLog, - "file_inherit": newFileFromLog, - "file_perm": newFileFromLog, - "open": newFileFromLog, + "exec": newFileFromLog, + "getattr": newFileFromLog, + "mkdir": newFileFromLog, + "mknod": newFileFromLog, + "open": newFileFromLog, + "rename_src": newFileFromLog, + "truncate": newFileFromLog, + "unlink": newFileFromLog, } newLogMountMap = map[string]func(log map[string]string) Rule{ "mount": newMountFromLog, @@ -229,10 +233,13 @@ func (p *Profile) AddRule(log map[string]string) { } if !done { - if strings.Contains(log["operation"], "dbus") { + switch { + case strings.HasPrefix(log["operation"], "file_"): + p.Rules = append(p.Rules, newFileFromLog(log)) + case strings.Contains(log["operation"], "dbus"): p.Rules = append(p.Rules, newDbusFromLog(log)) - } else { - fmt.Printf("unknown log type: %s", log) + default: + fmt.Printf("unknown log type: %s", log["operation"]) } } } From 6d549b7c70415e884586c23a8a5d2448d89e543d Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 11 Jun 2024 00:21:29 +0100 Subject: [PATCH 09/32] feat(profile): rewrite steam profiles. - Separate profile for sandboxes. - Separate profile for native and proton games. - Updated path dirs - tested on arch & debian. Note: these profiles are still in alpha stage and disabled by default. --- apparmor.d/abstractions/common/steam-game | 115 +++++++ apparmor.d/profiles-s-z/steam | 333 ++++++++++++++------ apparmor.d/profiles-s-z/steam-fossilize | 16 +- apparmor.d/profiles-s-z/steam-game | 225 ------------- apparmor.d/profiles-s-z/steam-game-native | 37 +++ apparmor.d/profiles-s-z/steam-game-proton | 107 +++++++ apparmor.d/profiles-s-z/steam-gameoverlayui | 28 +- apparmor.d/profiles-s-z/steam-launch | 46 +++ apparmor.d/profiles-s-z/steam-launcher | 29 ++ apparmor.d/profiles-s-z/steam-reaper | 40 --- apparmor.d/profiles-s-z/steam-runtime | 81 +++-- apparmor.d/profiles-s-z/steamerrorreporter | 19 +- dists/flags/main.flags | 10 +- dists/ignore/main.ignore | 6 +- 14 files changed, 681 insertions(+), 411 deletions(-) create mode 100644 apparmor.d/abstractions/common/steam-game delete mode 100644 apparmor.d/profiles-s-z/steam-game create mode 100644 apparmor.d/profiles-s-z/steam-game-native create mode 100644 apparmor.d/profiles-s-z/steam-game-proton create mode 100644 apparmor.d/profiles-s-z/steam-launch create mode 100644 apparmor.d/profiles-s-z/steam-launcher delete mode 100644 apparmor.d/profiles-s-z/steam-reaper diff --git a/apparmor.d/abstractions/common/steam-game b/apparmor.d/abstractions/common/steam-game new file mode 100644 index 00000000..719fcbd6 --- /dev/null +++ b/apparmor.d/abstractions/common/steam-game @@ -0,0 +1,115 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + include + include + include + include + include + include + include + + @{bin}/uname rix, + @{bin}/xdg-settings rPx, + @{browsers_path} rPx, + + @{bin}/env r, + + @{app_dirs}/ r, + @{lib_dirs}/ r, + @{lib}/ r, + / r, + /home/ r, + /usr/ r, + /usr/local/ r, + /usr/local/lib/ r, + + /etc/machine-id r, + /var/lib/dbus/machine-id r, + + owner @{HOME}/ r, + owner @{HOME}/.steam/steam.pid r, + owner @{HOME}/.steam/steam.pipe r, + + owner @{user_games_dirs}/ r, + owner @{user_games_dirs}/*/ r, + owner @{user_games_dirs}/*/{,**} rwkl, + + owner @{user_config_dirs}/unity3d/{,**} rwk, + + owner @{share_dirs}/ r, + owner @{share_dirs}/* r, + owner @{share_dirs}/config/*.vdf* rw, + owner @{share_dirs}/logs/* rw, + owner @{share_dirs}/steamapps/ r, + owner @{share_dirs}/steamapps/common/ r, + owner @{share_dirs}/steamapps/common/*/** rwlk, + owner @{share_dirs}/steamapps/shadercache/{,**} rwk, + owner @{share_dirs}/shader_cache_temp_dir_*/fozpipelinesv@{int}/{,**} rw, + + @{tmp}/ r, + owner @{tmp}/#@{int} rw, + owner @{tmp}/CASESENSITIVETEST@{hex32} rw, + owner @{tmp}/crashes/ rw, + owner @{tmp}/crashes/** rwk, + owner @{tmp}/miles_image_@{rand6} mrw, + owner @{tmp}/runtime-info.txt.@{rand6} rw, + owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, + + owner /dev/shm/mono.@{int} rw, + owner /dev/shm/softbuffer-x11-@{rand6}@{c} rw, + owner /dev/shm/u@{uid}-Shm_@{hex6} rw, + owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, + owner /dev/shm/u@{uid}-Shm_@{hex8} rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, + owner /dev/shm/ValveIPCSHM_@{uid} rw, + + @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + + @{sys}/ r, + @{sys}/bus/ r, + @{sys}/class/ r, + @{sys}/class/hidraw/ r, + @{sys}/class/input/ r, + @{sys}/devices/ r, + @{sys}/devices/@{pci}/boot_vga r, + @{sys}/devices/@{pci}/net/*/carrier r, + @{sys}/devices/**/input@{int}/ r, + @{sys}/devices/**/input@{int}/**/{vendor,product} r, + @{sys}/devices/**/input@{int}/capabilities/* r, + @{sys}/devices/**/input/input@{int}/ r, + @{sys}/devices/**/uevent r, + @{sys}/devices/system/ r, + @{sys}/devices/system/clocksource/clocksource@{int}/current_clocksource r, + @{sys}/devices/system/cpu/cpu@{int}/ r, + @{sys}/devices/virtual/dmi/id/* r, + @{sys}/devices/virtual/net/*/carrier r, + @{sys}/kernel/ r, + + @{sys}/fs/cgroup/user.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r, + + @{PROC}/uptime r, + @{PROC}/version r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/pagemap r, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{PROC}/@{pid}/task/@{tid}/stat r, + + /dev/ r, + /dev/hidraw@{int} rw, + /dev/input/ r, + /dev/input/event@{int} rw, + /dev/tty rw, + /dev/uinput rw, + + include if exists \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 85f5191b..36b8bd54 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -6,28 +6,32 @@ # - Ensure no user data is accessed by either steam or steam games # - Limit what steam/games can access to the host # -# Current architecture: +# Overall architecture of the steam profiles: # steam -# ├── steam-fossilize -# ├── steam-reaper -# │ └── steam-game -# ├── steam-gameoverlayui -# └── steamerrorreporter +# ├── steam//check # Requirements check (sandboxed) +# ├── steam//web # steamwebhelper (sandboxed) +# ├── steam-fossilize # Update shader cache +# ├── steam-runtime # Launcher tasks up to the creation of the sandbox +# │ ├── steam-game-native # Native games +# │ └── steam-game-proton # Proton games (sandboxed) +# ├── steam-gameoverlayui # Steam game overlay +# └── steamerrorreporter # Error reporter abi , include -@{share_dirs} = @{user_share_dirs}/Steam +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} -@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ @{exec_path} = @{share_dirs}/steam.sh profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include - include - include include include include @@ -38,69 +42,71 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include + capability sys_ptrace, + network inet dgram, network inet6 dgram, network inet stream, network inet6 stream, network netlink raw, + network unix stream, - ptrace (read), - ptrace (trace) peer=steam, + ptrace read, + ptrace trace peer=steam, - signal (send) peer=steam-game, - signal (read), - - unix (receive) type=stream, + signal send peer=steam-game, + signal send peer=steam-launcher, + signal send peer=steam//journalctl, + signal send peer=steam//web, @{exec_path} mrix, @{sh_path} rix, @{coreutils_path} rix, - @{bin}/cmp rix, - @{bin}/file rix, @{bin}/getopt rix, - @{bin}/gzip rix, + @{bin}/journalctl rPx -> systemctl, @{bin}/ldconfig rix, @{bin}/ldd rix, - @{bin}/localedef rix, @{bin}/lsb_release rPx -> lsb_release, @{bin}/lsof rix, @{bin}/lspci rCx -> lspci, - @{bin}/steam-runtime-urlopen rix, - @{bin}/tar rix, - @{bin}/which rix, + @{bin}/which{,.debianutils} rix, @{bin}/xdg-icon-resource rPx, @{bin}/xdg-user-dir rix, - @{bin}/xz rix, - @{bin}/zenity rix, + @{lib}/@{multiarch}/ld-*.so* rix, @{lib}/ld-linux.so* rix, + @{open_path} rPx -> child-open, - @{lib_dirs}/** mr, - @{lib_dirs}/*/** ix, - @{lib_dirs}/*driverquery rix, - @{lib_dirs}/fossilize_replay rpx, - @{lib_dirs}/gameoverlayui rpx, - @{lib_dirs}/reaper rpx, - @{lib_dirs}/steam* rix, + @{lib_dirs}/** mr, + @{lib_dirs}/*driverquery rix, + @{lib_dirs}/fossilize_replay rpx, + @{lib_dirs}/gameoverlayui rpx, + @{lib_dirs}/reaper rpx, # steam-runtime + @{lib_dirs}/steam* rix, - # Entry point for steam-game - @{runtime_dirs}/*entry-point rpx, - - @{lib}/pressure-vessel/from-host/** rix, - @{run}/host/@{bin}/* rix, - @{run}/host/@{lib}/** rix, + @{app_dirs}/@{runtime}/*entry-point rpx -> steam-runtime, @{share_dirs}/linux{32,64}/steamerrorreporter rpx, - @{share_dirs}/config/cefdata/WidevineCdm/**/linux_*/libwidevinecdm.so rm, - /usr/lib/os-release rk, - /usr/share/fonts/**.{ttf,otf} rk, - /usr/share/terminfo/** r, - /usr/share/zenity/* r, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements rcx -> check, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-identify-library-abi rix, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service rpx, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-system-info rix, + @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, + @{runtime_dirs}/*entry-point rix, + @{runtime_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix, + @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, + @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rcx -> web, + @{runtime_dirs}/run{,.sh} rix, + @{runtime_dirs}/setup.sh rix, + + @{lib}/os-release rk, + + /usr/share/fonts/** rk, /etc/lsb-release r, - /etc/udev/udev.conf r, /etc/machine-id r, + /etc/timezone r, /var/lib/dbus/machine-id r, @{bin}/ r, @@ -108,16 +114,11 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { / r, /etc/ r, /home/ r, - /run/ r, /usr/ r, /usr/local/ r, /usr/local/lib/ r, /var/ r, - - owner /bindfile@{rand6} rw, - - owner /var/pressure-vessel/** rw, - owner /var/cache/ldconfig/aux-cache* rw, + /var/tmp/ r, owner @{HOME}/ r, owner @{HOME}/.steam/{,**} rw, @@ -142,106 +143,231 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { owner @{user_share_dirs}/icons/hicolor/**/apps/steam*.png rw, owner @{user_share_dirs}/vulkan/implicit_layer.d/steam*.json rwk, - owner /dev/shm/#@{int} rw, - owner /dev/shm/fossilize-*-@{int}-@{int} rw, - owner /dev/shm/u@{uid}-Shm_@{hex} rw, - owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, - owner /dev/shm/ValveIPCSHM_@{uid} rw, - @{tmp}/ r, owner @{tmp}/#@{int} rw, owner @{tmp}/dumps/ rw, owner @{tmp}/dumps/** rwk, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, - owner @{tmp}/miles_image_* mrw, - owner @{tmp}/pressure-vessel-*-@{rand6}/ rw, - owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, - owner @{tmp}/runtime-info.txt.* rwk, - owner @{tmp}/sh-thd.* rw, - owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, + owner @{tmp}/glx-icds-@{rand6}/{,**} rw, + owner @{tmp}/runtime-info.txt.@{rand6} rwk, owner @{tmp}/steam@{rand6}/{,**} rw, owner @{tmp}/steam/ rw, owner @{tmp}/steam/** rwk, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, - owner @{run}/pressure-vessel/** r, + /dev/shm/ r, + owner /dev/shm/fossilize-*-@{int}-@{int} rw, + owner /dev/shm/u@{uid}-Shm_@{hex6} rw, + owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, + owner /dev/shm/u@{uid}-Shm_@{hex8} rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, + owner /dev/shm/ValveIPCSHM_@{uid} rw, + owner @{run}/user/@{uid}/ r, - @{run}/host/{,**} r, - - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/c13:@{int} r, # for /dev/input/* - @{run}/udev/data/c116:@{int} r, # for ALSA - @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{run}/udev/data/n@{int} r, @{sys}/ r, @{sys}/bus/ r, - @{sys}/bus/pci/devices/ r, @{sys}/class/ r, @{sys}/class/hidraw/ r, @{sys}/class/input/ r, @{sys}/class/net/ r, - @{sys}/devices/@{pci}/class r, - @{sys}/devices/@{pci}/i2c-@{int}/{,**/}report_descriptor r, - @{sys}/devices/@{pci}/sound/card@{int}/** r, - @{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r, + @{sys}/devices/ r, + @{sys}/devices/@{pci}/boot_vga r, + @{sys}/devices/@{pci}/sound/card@{int}/input@{int}/properties r, @{sys}/devices/**/input@{int}/ r, @{sys}/devices/**/input@{int}/capabilities/* r, @{sys}/devices/**/input/input@{int}/ r, @{sys}/devices/**/input/input@{int}/properties r, + @{sys}/devices/**/report_descriptor r, @{sys}/devices/**/uevent r, - @{sys}/devices/system/cpu/** r, - @{sys}/devices/system/node/ r, - @{sys}/devices/virtual/**/report_descriptor r, + @{sys}/devices/system/ r, + @{sys}/devices/system/cpu/cpu@{int}/ r, + @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/bios_version r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/net/*/ r, - @{sys}/devices/virtual/tty/tty@{int}/active r, @{sys}/kernel/ r, @{sys}/power/suspend_stats/success rk, @{PROC}/ r, - @{PROC}/@{pids}/comm rk, - @{PROC}/@{pids}/net/route r, - @{PROC}/@{pids}/stat r, - @{PROC}/locks r, + @{PROC}/@{pid}/comm rk, + @{PROC}/@{pid}/fdinfo/@{int} r, @{PROC}/@{pid}/net/* r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/stat r, @{PROC}/1/cgroup r, - @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/locks r, @{PROC}/sys/kernel/sched_autogroup_enabled r, - @{PROC}/sys/kernel/unprivileged_userns_clone r, - @{PROC}/sys/kernel/yama/ptrace_scope r, - @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, - @{PROC}/sys/user/max_user_namespaces r, + @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, @{PROC}/version r, - owner @{PROC}/@{pid}/mem r, owner @{PROC}/@{pid}/autogroup rw, owner @{PROC}/@{pid}/cmdline rk, owner @{PROC}/@{pid}/environ r, owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/fdinfo/@{int} r, + owner @{PROC}/@{pid}/mem r, owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/oom_score_adj w, - owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner @{PROC}/@{pid}/task/@{tid}/status r, - /dev/hidraw@{int} rw, /dev/input/ r, - /dev/input/event@{int} r, - /dev/tty rw, /dev/uinput w, - audit deny /**.steam_exec_test.sh rw, - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, + deny /opt/** r, - profile lspci { + profile web flags=(attach_disconnected,mediate_deleted,complain) { + include + include + include + include + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + ptrace trace peer=steam//web, + + signal receive set=kill peer=steam, + + unix receive type=stream, + + @{bin}/ldconfig rix, + @{bin}/getopt rix, + @{bin}/gzip rix, + @{bin}/true rix, + @{bin}/localedef rix, + @{bin}/readlink rix, + + @{lib_dirs}/** mr, + @{lib_dirs}/steamwebhelper rix, + @{lib_dirs}/steamwebhelper_sniper_wrap.sh rix, + + @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap mr, + @{runtime_dirs}/pressure-vessel/@{bin}/steam-runtime-launcher-interface-@{int} rix, + + @{lib}/pressure-vessel/from-host/** rix, + @{run}/host/@{bin}/* rix, + @{run}/host/@{lib}/** rix, + + @{share_dirs}/config/cefdata/WidevineCdm/**/linux_*/libwidevinecdm.so mr, + + @{runtime_dirs}/var/tmp-@{rand6}/usr/.ref w, + + @{run}/host/{,**} r, + + /etc/machine-id r, + + @{lib}/ r, + /usr/local/lib/ r, + /var/tmp/ r, + + owner /bindfile@{rand6} rw, + + owner /var/cache/ldconfig/aux-cache* rw, + owner /var/pressure-vessel/ldso/* rw, + + owner @{HOME}/.pki/ rw, + owner @{HOME}/.pki/nssdb/ rw, + owner @{HOME}/.pki/nssdb/pkcs11.txt rw, + owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, + owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, + + owner @{lib_dirs}/.cef-* wk, + + owner @{share_dirs}/{,**} r, + owner @{share_dirs}/config/** rwk, + owner @{share_dirs}/logs/** rwk, + owner @{share_dirs}/clientui/** k, + owner @{share_dirs}/public/** k, + + @{tmp}/ r, + owner @{tmp}/#@{int} rw, + owner @{tmp}/dumps/ rw, + owner @{tmp}/dumps/** rwk, + owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, + owner @{tmp}/pressure-vessel-*-@{rand6}/ rw, + owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, + owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, + + /dev/shm/ r, + owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, + owner /dev/shm/u@{uid}-Shm_@{hex6} rw, + owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, + owner /dev/shm/u@{uid}-Shm_@{hex8} rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, + owner /dev/shm/ValveIPCSHM_@{uid} rw, + + owner @{run}/pressure-vessel/** r, + + @{run}/udev/data/c13:@{int} r, # for /dev/input/* + + @{sys}/bus/ r, + @{sys}/bus/*/devices/ r, + @{sys}/class/*/ r, + @{sys}/devices/**/report_descriptor r, + @{sys}/devices/**/uevent r, + @{sys}/devices/system/cpu/kernel_max r, + @{sys}/devices/virtual/tty/tty@{int}/active r, + + @{PROC}/ r, + @{PROC}/@{pid}/stat r, + @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/sys/kernel/yama/ptrace_scope r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/oom_score_adj w, + owner @{PROC}/@{pid}/statm r, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/@{tid}/status r, + + /dev/hidraw@{int} rw, + /dev/tty rw, + + include if exists + } + + profile check flags=(attach_disconnected,mediate_deleted,complain) { + include + include + include + + unix receive type=stream, + + @{bin}/true rix, + + @{lib_dirs}/** mr, + @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-check-requirements mr, + @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rix, + + / r, + + owner @{HOME}/.steam/root r, + owner @{HOME}/.steam/steam r, + + owner @{share_dirs}/ r, + + @{PROC}/@{pid}/cgroup r, + + include if exists + } + + profile lspci flags=(attach_disconnected,mediate_deleted,complain) { include include include + unix receive type=stream, + @{bin}/lspci mr, owner @{HOME}/.steam/steam.pipe r, @@ -256,5 +382,18 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include if exists } + profile systemctl { + include + include + + /{run,var}/log/journal/ r, + /{run,var}/log/journal/@{hex32}/ r, + /{run,var}/log/journal/@{hex32}/system.journal* r, + /{run,var}/log/journal/@{hex32}/system@@{hex}.journal* r, + /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r, + + include if exists + } + include if exists } diff --git a/apparmor.d/profiles-s-z/steam-fossilize b/apparmor.d/profiles-s-z/steam-fossilize index 323abea8..b8ec7e18 100644 --- a/apparmor.d/profiles-s-z/steam-fossilize +++ b/apparmor.d/profiles-s-z/steam-fossilize @@ -6,9 +6,12 @@ abi , include -@{share_dirs} = @{user_share_dirs}/Steam -@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} -@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ @{exec_path} = @{lib_dirs}/fossilize_replay profile steam-fossilize @{exec_path} flags=(attach_disconnected) { @@ -17,17 +20,22 @@ profile steam-fossilize @{exec_path} flags=(attach_disconnected) { include include + signal receive peer=steam, + @{exec_path} mr, - @{lib_dirs}/*.so* mr, + @{lib_dirs}/** mr, owner @{HOME}/.steam/steam.pipe r, + owner @{share_dirs}/logs/container-runtime-info.txt.@{rand6} rw, owner @{share_dirs}/steamapps/shadercache/@{int}/fozpipelinesv@{int}/{,**} rw, owner @{share_dirs}/steamapps/shadercache/@{int}/mesa_shader_cache_sf/{,**} rwk, owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/ rw, owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/** rwk, + owner @{tmp}/runtime-info.txt.@{rand6} rw, + owner /dev/shm/fossilize-*-@{int}-@{int} rw, @{sys}/devices/system/node/node@{int}/cpumap r, diff --git a/apparmor.d/profiles-s-z/steam-game b/apparmor.d/profiles-s-z/steam-game deleted file mode 100644 index 83d00145..00000000 --- a/apparmor.d/profiles-s-z/steam-game +++ /dev/null @@ -1,225 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2022-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -# Default profile for steam games - -# TODO: -# Split this profile in three: -# - steam-game-native for native linux games -# - steam-runtime for all runtime related task up to the creation of the sandbox -# - steam-game-proton for the sandboxed proton games -# -# Tasks: -# - AppArmor supports for {*^} regex, or find an alternative -# - AppArmor supports change profile from pivot_root -# - Stack steam//&game to bypass no-new-privs issue -# -# The current version of this profile is not very useful as it is very similar -# to the main steam profile. - -abi , - -include - -@{share_dirs} = @{user_share_dirs}/Steam -@{lib_dirs} = @{share_dirs}/ubuntu@{int}_{32,64} -@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper - -@{exec_path} = @{share_dirs}/steamapps/common/*/** -@{exec_path} += @{lib_dirs}/steam-runtime-sniper/*entry-point -profile steam-game @{exec_path} flags=(attach_disconnected) { - include - include - include - include - include - include - include - include - include - include - - capability dac_override, - capability dac_read_search, - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - network netlink raw, - - signal (receive) peer=steam, - - unix (receive) type=stream, - - @{exec_path} mrix, - - @{sh_path} rix, - @{bin}/bwrap rix, - @{bin}/env rix, - @{bin}/getopt rix, - @{bin}/gzip rix, - @{bin}/localedef rix, - @{bin}/python3.@{int} rix, - @{bin}/readlink rix, - @{bin}/steam-runtime-launcher-interface-* rix, - @{bin}/steam-runtime-system-info rix, - @{bin}/timeout rix, - @{bin}/true rix, - @{bin}/uname rix, - @{bin}/xdg-open rPx, - - @{lib}/pressure-vessel/from-host/@{bin}/* rix, - @{lib}/pressure-vessel/from-host/@{lib}/** rix, - @{lib}/steam-runtime-tools*/* mrix, - - @{lib_dirs}/{,**} r, - @{lib_dirs}/**.so* mr, - @{lib_dirs}/reaper rix, - @{lib_dirs}/steam-launch-wrapper rm, - @{lib_dirs}/steam-runtime/@{lib}/** mrix, - - @{runtime_dirs}/pressure-vessel/@{bin}/ r, - @{runtime_dirs}/pressure-vessel/@{bin}/* rix, - @{runtime_dirs}/pressure-vessel/@{lib}/ r, - @{runtime_dirs}/pressure-vessel/@{lib}/** mrix, - @{runtime_dirs}/run rix, - - @{share_dirs}/@{bin}/ r, - @{share_dirs}/@{bin}/* mr, - @{share_dirs}/d3ddriverquery64.dxvk-cache rw, - @{share_dirs}/legacycompat/ r, - @{share_dirs}/legacycompat/** mr, - @{share_dirs}/linux{32,64}/ r, - @{share_dirs}/linux{32,64}/**.so* mr, - @{share_dirs}/standalone_installscript_progress_@{int}.vdf rw, - @{share_dirs}/steamapps/common/*/* mr, - @{share_dirs}/steamapps/common/Proton*/ r, - @{share_dirs}/steamapps/common/Proton*/files/@{bin}/* mrix, - @{share_dirs}/steamapps/common/Proton*/files/@{lib}/** mrix, - @{share_dirs}/steamapps/common/Proton*/proton rix, - @{share_dirs}/steamapps/compatdata/@{int}/pfx/**.dll rm, - - @{user_games_dirs}/*/* mr, - @{user_games_dirs}/*/**.dll mr, - - @{run}/host/usr/bin/ldconfig rix, - @{run}/host/usr/lib{,32,64}/**.so* rm, - @{run}/host/usr/bin/localedef rix, - - /usr/share/terminfo/** r, - - /etc/machine-id r, - /etc/udev/udev.conf r, - /var/lib/dbus/machine-id r, - - / r, - /{usr/,}{local/,} r, - /{usr/,}{local/,}lib{,32,64}/ r, - /bindfile@{rand6} rw, - /home/ r, - /tmp/ r, - - owner /var/pressure-vessel/** rw, - owner /var/cache/ldconfig/aux-cache* rw, - - owner @{HOME}/ r, - owner @{HOME}/.steam/steam.pid r, - owner @{HOME}/.steam/steam.pipe r, - - owner @{user_games_dirs}/{,*/} r, - owner @{user_games_dirs}/*/{,**} rwkl, - - owner @{user_config_dirs}/unity3d/{,**} rwk, - - owner @{share_dirs}/ r, - owner @{share_dirs}/* r, - owner @{share_dirs}/*log* rw, - owner @{share_dirs}/config/config.vdf* rw, - owner @{share_dirs}/logs/{,*} rw, - owner @{share_dirs}/shader_cache_temp*/fozpipelinesv*/{,**} rw, - owner @{share_dirs}/steamapps/ r, - owner @{share_dirs}/steamapps/common/ r, - owner @{share_dirs}/steamapps/common/*/ r, - owner @{share_dirs}/steamapps/common/*/** rwkl, - owner @{share_dirs}/steamapps/common/Proton*/files/share/{,**} r, - owner @{share_dirs}/steamapps/compatdata/{,**} rwk, - owner @{share_dirs}/steamapps/shadercache/{,**} rwk, - owner @{share_dirs}/userdata/**/remotecache.vdf rw, - - @{run}/host/ r, - @{run}/host/container-manager r, - @{run}/host/fonts/{,**} r, - @{run}/host/share/{,**} r, - @{run}/host/usr/{,**} r, - owner @{run}/pressure-vessel/{,**} rw, - owner @{run}/user/@{uid}/ r, - owner @{run}/user/@{uid}/orcexec.* mrw, # gstreamer - - owner /dev/shm/#@{int} rw, - owner /dev/shm/mono.* rw, - owner /dev/shm/u@{uid}-Shm_@{hex} rw, - owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, - owner /dev/shm/ValveIPCSHM_@{uid} rw, - owner /dev/shm/wine-*-fsync rw, - - owner @{tmp}/ r, - owner @{tmp}/.wine-@{int}/ rw, - owner @{tmp}/.wine-@{int}/** rwk, - owner @{tmp}/.wine-@{uid}/server-*/* rwk, - owner @{tmp}/#@{int} rw, - owner @{tmp}/CASESENSITIVETEST@{hex32} rw, - owner @{tmp}/miles_image_* mr, - owner @{tmp}/pressure-vessel-*/{,**} rwl, - owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, - - @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad - - @{run}/udev/data/c13:@{int} r, # for /dev/input/* - @{run}/udev/data/c116:@{int} r, # for ALSA - @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 - - @{sys}/ r, - @{sys}/bus/ r, - @{sys}/class/ r, - @{sys}/class/hidraw/ r, - @{sys}/class/input/ r, - @{sys}/devices/**/input@{int}/ r, - @{sys}/devices/**/input@{int}/**/{vendor,product} r, - @{sys}/devices/**/input@{int}/capabilities/* r, - @{sys}/devices/**/input/input@{int}/ r, - @{sys}/devices/**/uevent r, - @{sys}/devices/@{pci}/sound/card@{int}/** r, - @{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r, - @{sys}/devices/system/clocksource/clocksource@{int}/current_clocksource r, - @{sys}/devices/system/cpu/** r, - @{sys}/devices/system/node/node[0-9]/cpumap r, - @{sys}/devices/system/node/online r, - @{sys}/devices/virtual/dmi/id/* r, - @{sys}/kernel/ r, - - @{PROC}/@{pids}/net/dev r, - @{PROC}/@{pids}/net/route r, - @{PROC}/sys/net/core/bpf_jit_enable r, - @{PROC}/uptime r, - @{PROC}/version r, - owner @{PROC}/@{pid}/cmdline r, - owner @{PROC}/@{pid}/fd/ r, - owner @{PROC}/@{pid}/mounts r, - owner @{PROC}/@{pid}/pagemap r, - owner @{PROC}/@{pid}/stat r, - owner @{PROC}/@{pid}/task/ r, - owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner @{PROC}/@{pid}/task/@{tid}/stat r, - - /dev/hidraw@{int} rw, - /dev/input/ r, - /dev/input/* rw, - /dev/tty rw, - /dev/uinput rw, - - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, - - include if exists -} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam-game-native b/apparmor.d/profiles-s-z/steam-game-native new file mode 100644 index 00000000..da72bf27 --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-game-native @@ -0,0 +1,37 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ + +@{exec_path} = @{app_dirs}/*/** +profile steam-game-native @{exec_path} flags=(attach_disconnected) { + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network unix stream, + + signal receive peer=steam, + + @{exec_path} rmix, + + @{sh_path} rix, + + @{app_dirs}/** mr, + @{lib_dirs}/** mr, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam-game-proton b/apparmor.d/profiles-s-z/steam-game-proton new file mode 100644 index 00000000..7f1e2982 --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-game-proton @@ -0,0 +1,107 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ + +@{exec_path} = @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap +profile steam-game-proton @{exec_path} flags=(attach_disconnected) { + include + include + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network unix stream, + + signal receive peer=steam, + + @{exec_path} mr, + @{bin}/bwrap mrix, + + @{bin}/getopt rix, + @{bin}/gzip rix, + @{bin}/ldconfig rix, + @{bin}/localedef rix, + @{bin}/python3.@{int} rix, + @{bin}/readlink rix, + @{bin}/steam-runtime-launcher-interface-@{int} rix, + @{bin}/steam-runtime-system-info rix, + @{bin}/steam-runtime-urlopen rix, + @{bin}/true rix, + @{bin}/chmod rix, + @{open_path} rix, + + @{lib_dirs}/** mr, + @{lib}/pressure-vessel/from-host/@{bin}/* rix, + @{lib}/pressure-vessel/from-host/@{lib}/** rix, + @{lib}/steam-runtime-tools-@{int}/@{multiarch}-* rix, + + @{app_dirs}/** mr, + @{app_dirs}/pressure-vessel/@{bin}/pressure-vessel-* rix, + @{app_dirs}/Proton*/files/@{bin}/* rix, + @{app_dirs}/Proton*/files/@{lib}/** rix, + @{app_dirs}/Proton*/proton rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{bin}/steam-runtime-launcher-interface-@{int} rix, + + @{run}/host/@{bin}/ldconfig rix, + @{run}/host/@{bin}/localedef rix, + @{run}/host/@{lib}/** mr, + + @{share_dirs}/bin/d3ddriverquery64.exe mr, + @{share_dirs}/steamapps/compatdata/@{int}/pfx/** mr, + + @{user_games_dirs}/** mr, + + owner /bindfile@{rand6} rw, + + owner /var/pressure-vessel/** rw, + owner /var/cache/ldconfig/aux-cache* rw, + + owner @{app_dirs}/@{runtime}/var/tmp-@{rand6}/usr/.ref rwk, + owner @{app_dirs}/Proton*/** rwkl, + + owner @{share_dirs}/*.dll r, + owner @{share_dirs}/steamapps/compatdata/{,**} rwk, + owner @{share_dirs}/legacycompat/ r, + owner @{share_dirs}/legacycompat/** mr, + + owner @{user_share_dirs}/applications/wine/ rw, + owner @{user_share_dirs}/applications/wine/**/ rw, + + owner @{tmp}/ r, + owner @{tmp}/.wine-@{uid}/ rw, + owner @{tmp}/.wine-@{uid}/** rwk, + owner @{tmp}/glx-icds-@{rand6}/{,**} w, + owner @{tmp}/pressure-vessel-*-@{rand6}/ rw, + owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, + owner @{tmp}/vdpau-drivers-@{rand6}/{,**} w, + + owner /dev/shm/wine-@{hex6}-fsync rw, + owner /dev/shm/wine-@{hex6}@{h}-fsync rw, + + @{run}/host/fonts/{,**} r, + @{run}/host/share/{,**} r, + @{run}/host/usr/{,**} r, + owner @{run}/pressure-vessel/{,**} r, + + @{sys}/devices/system/node/node@{int}/cpumap r, + @{sys}/devices/system/node/online r, + + @{PROC}/@{pids}/net/* r, + @{PROC}/sys/net/core/bpf_jit_enable r, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui index d41a5e64..d78751bf 100644 --- a/apparmor.d/profiles-s-z/steam-gameoverlayui +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -6,9 +6,12 @@ abi , include -@{share_dirs} = @{user_share_dirs}/Steam -@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} -@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ @{exec_path} = @{lib_dirs}/gameoverlayui profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) { @@ -19,15 +22,16 @@ profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) { network inet stream, network inet6 stream, - - unix (receive) type=stream, + network unix stream, @{exec_path} mr, - @{lib_dirs}/*.so* mr, - @{lib_dirs}/steam-runtime/@{lib}/**.so* mr, + @{lib_dirs}/**.so* mr, + @{runtime_dirs}/@{lib}/**.so* mr, - /usr/share/fonts/{,**} rk, # ? + @{lib_dirs}/steamerrorreporter rpx, + + /usr/share/fonts/{,**} rk, / r, /home/ r, @@ -45,15 +49,19 @@ profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) { owner @{share_dirs}/userdata/@{int}/{,**} rk, owner /dev/shm/u@{uid}-Shm_@{hex} rw, - owner /dev/shm/u@{uid}-ValveIPCSharedObj-* rwk, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, owner /dev/shm/ValveIPCSHM_@{uid} rw, owner @{tmp}/gameoverlayui.log* rw, + owner @{tmp}/miles_image_@{rand6} mrw, + owner @{tmp}/runtime-info.txt.@{rand6} rw, owner @{tmp}/steam_chrome_overlay_uid@{uid}_spid@{pids} rw, - owner @{tmp}/miles_image_* mrw, @{sys}/ r, @{sys}/kernel/ r, + @{sys}/devices/ r, + @{sys}/devices/system/ r, + @{sys}/devices/system/cpu/cpu@{int}/ r, @{PROC}/version r, diff --git a/apparmor.d/profiles-s-z/steam-launch b/apparmor.d/profiles-s-z/steam-launch new file mode 100644 index 00000000..1b2afd21 --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-launch @@ -0,0 +1,46 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ + +@{exec_path} = @{bin}/steam @{bin}/steam-runtime +profile steam-launch @{exec_path} { + include + include + + network unix stream, + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/cp rix, + @{bin}/dirname rix, + @{bin}/env rix, + @{bin}/id rix, + @{bin}/readlink rix, + + @{lib}/steam/steam rix, + @{lib}/steam/bin_steam.sh rix, + @{share_dirs}/steam.sh rPx, + + /usr/ r, + /usr/local/ r, + + owner @{share_dirs}/bootstrap.tar.xz rw, + + /dev/tty rw, + + deny /opt/** r, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam-launcher b/apparmor.d/profiles-s-z/steam-launcher new file mode 100644 index 00000000..9b4f09b9 --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-launcher @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ + +@{exec_path} = @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-launcher-service +profile steam-launcher @{exec_path} flags=(attach_disconnected) { + include + + network unix stream, + + signal receive peer=steam, + + @{exec_path} mr, + + @{lib_dirs}/** mr, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam-reaper b/apparmor.d/profiles-s-z/steam-reaper deleted file mode 100644 index f635b131..00000000 --- a/apparmor.d/profiles-s-z/steam-reaper +++ /dev/null @@ -1,40 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2022-2024 Alexandre Pujol -# SPDX-License-Identifier: GPL-2.0-only - -abi , - -include - -@{share_dirs} = @{user_share_dirs}/Steam -@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} -@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper - -@{exec_path} = @{lib_dirs}/reaper -profile steam-reaper @{exec_path} flags=(attach_disconnected) { - include - include - - unix (receive) type=stream, - - @{exec_path} mr, - - @{lib_dirs}/*.so* mr, - @{lib_dirs}/steam-runtime/@{lib}/**.so* mr, - @{lib_dirs}/steam-launch-wrapper rpx -> steam-game, - - @{share_dirs}/steamapps/common/*/* rpx -> steam-game, - - owner @{HOME}/.steam/steam.pipe r, - - owner @{share_dirs}/userdata/**/remotecache.vdf rw, - - owner /dev/shm/u@{uid}-Shm_@{hex} rw, - owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, - - @{sys}/devices/system/cpu/cpu@{int}/** r, - - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, - - include if exists -} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime index 6d04630d..6893dbe2 100644 --- a/apparmor.d/profiles-s-z/steam-runtime +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -6,38 +6,77 @@ abi , include -@{share_dirs} = @{user_share_dirs}/Steam -@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} -@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ -@{exec_path} = @{bin}/steam @{bin}/steam-runtime -profile steam-runtime @{exec_path} { +@{exec_path} = @{lib_dirs}/reaper +profile steam-runtime @{exec_path} flags=(attach_disconnected) { include - include + include + include + include + include + include - unix (receive) type=stream, + network unix stream, @{exec_path} mr, - @{sh_path} rix, - @{bin}/cp rix, - @{bin}/dirname rix, - @{bin}/env rix, - @{bin}/id rix, - @{bin}/readlink rix, + @{sh_path} r, + @{bin}/getopt rix, + @{bin}/readlink rix, - @{lib}/steam/steam rix, - @{lib}/steam/bin_steam.sh rix, - @{share_dirs}/steam.sh rPx, + @{lib_dirs}/** mr, + @{lib_dirs}/steam-launch-wrapper rix, - /usr/ r, - /usr/local/ r, + # Native linux games (steam-game-native) + @{app_dirs}/[^S]*/** rpx -> steam-game-native, - owner @{share_dirs}/bootstrap.tar.xz rw, + # Proton games, sandboxed (steam-game-proton) + @{app_dirs}/@{runtime}/*entry-point rmix, + @{app_dirs}/@{runtime}/pressure-vessel/@{bin}/pressure-vessel-* rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/** mr, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-capsule-capture-libs rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-detect-platform rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-inspect-library rix, + @{app_dirs}/@{runtime}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap rpx -> steam-game-proton, + @{app_dirs}/@{runtime}/run rix, + @{bin}/bwrap rpx -> steam-game-proton, + + / r, + @{lib}/ r, + @{lib_dirs}/ r, + + owner @{HOME}/.steam/steam.pipe r, + + owner @{app_dirs}/*/ r, + owner @{app_dirs}/@{runtime}/** r, + owner @{app_dirs}/@{runtime}/pressure-vessel/** rwk, + owner @{app_dirs}/@{runtime}/sniper_platform_*/** rwk, + owner @{app_dirs}/@{runtime}/var/** rwk, + owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/pressure-vessel/**, + owner link @{app_dirs}/@{runtime}/var/** -> @{app_dirs}/@{runtime}/sniper_platform_*/**, + + owner @{tmp}/ r, + owner @{tmp}/#@{int} rw, + owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, + + owner @{run}/user/@{uid}/ r, + + owner /dev/shm/u@{uid}-Shm_@{hex6} rw, + owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, + owner /dev/shm/u@{uid}-Shm_@{hex8} rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, + + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/comm r, + owner @{PROC}/@{pid}/fd/ r, /dev/tty rw, - deny /opt/** r, - include if exists } \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steamerrorreporter b/apparmor.d/profiles-s-z/steamerrorreporter index c9e1bf63..0f765c30 100644 --- a/apparmor.d/profiles-s-z/steamerrorreporter +++ b/apparmor.d/profiles-s-z/steamerrorreporter @@ -6,12 +6,15 @@ abi , include -@{share_dirs} = @{user_share_dirs}/Steam -@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} -@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper +@{arch} = amd64 i386 +@{runtime} = SteamLinuxRuntime_sniper +@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64} +@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} +@{app_dirs} = @{share_dirs}/steamapps/common/ -@{exec_path} = @{share_dirs}/linux{32,64}/steamerrorreporter -profile steamerrorreporter @{exec_path} { +@{exec_path} = @{lib_dirs}/steamerrorreporter +profile steamerrorreporter @{exec_path} flags=(attach_disconnected) { include include @@ -19,14 +22,14 @@ profile steamerrorreporter @{exec_path} { network inet stream, network inet6 dgram, network inet6 stream, + network unix stream, @{exec_path} mr, owner @{HOME}/.steam/steam.pipe r, - owner @{lib_dirs}/ r, - owner @{lib_dirs}/steam-runtime/pinned_libs_{32,64}/ r, - + owner @{lib_dirs}/{,**} r, + owner @{runtime_dirs}/pinned_libs_{32,64}/ r, owner @{share_dirs}/ r, owner @{tmp}/dumps/ r, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 4770b79e..814123c8 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -298,11 +298,13 @@ startplasma complain startx attach_disconnected,complain steam attach_disconnected,mediate_deleted,complain steam-fossilize attach_disconnected,complain -steam-game attach_disconnected,complain +steam-game-native attach_disconnected,complain +steam-game-proton attach_disconnected,complain steam-gameoverlayui attach_disconnected,complain -steam-reaper attach_disconnected,complain -steam-runtime complain -steamerrorreporter complain +steam-launch complain +steam-launcher attach_disconnected,complain +steam-runtime attach_disconnected,complain +steamerrorreporter attach_disconnected,complain sulogin complain switcherooctl complain swtpm complain diff --git a/dists/ignore/main.ignore b/dists/ignore/main.ignore index 795fbf1c..0e89a76c 100644 --- a/dists/ignore/main.ignore +++ b/dists/ignore/main.ignore @@ -17,8 +17,10 @@ man plasma-discover steam steam-fossilize -steam-game +steam-game-native +steam-game-proton steam-gameoverlayui -steam-reaper +steam-launch +steam-launcher steam-runtime steamerrorreporter From ca9a8d47f83d497d31bdd561ec4b336653986e82 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 11 Jun 2024 23:16:19 +0100 Subject: [PATCH 10/32] feat(profile): add protonmail-bridge --- apparmor.d/profiles-m-r/protonmail-bridge | 82 ++++++------------ .../profiles-m-r/protonmail-bridge-core | 85 +++++++++++++++++++ 2 files changed, 109 insertions(+), 58 deletions(-) create mode 100644 apparmor.d/profiles-m-r/protonmail-bridge-core diff --git a/apparmor.d/profiles-m-r/protonmail-bridge b/apparmor.d/profiles-m-r/protonmail-bridge index 92a5eb13..f6e8c8e4 100644 --- a/apparmor.d/profiles-m-r/protonmail-bridge +++ b/apparmor.d/profiles-m-r/protonmail-bridge @@ -2,80 +2,46 @@ # Copyright (C) 2023-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only -# Warning: only the protonmail-bridge CLI and service are supported, NOT the GUI. - abi , include -@{exec_path} = @{bin}/protonmail-bridge -profile protonmail-bridge @{exec_path} { - include - include +@{config_dirs} = @{user_config_dirs}/protonmail/bridge-v3 +@{cache_dirs} = @{user_cache_dirs}/protonmail/bridge-v3 "@{user_cache_dirs}/Proton AG/Proton Mail Bridge" +@{share_dirs} = @{user_share_dirs}/protonmail/bridge-v3 - network inet dgram, - network inet6 dgram, +@{exec_path} = @{lib}/protonmail/bridge/bridge-gui +profile protonmail-bridge @{exec_path} { + include + include + include + include + include + include + + # network inet dgram, + # network inet6 dgram, network inet stream, network inet6 stream, - network netlink raw, + # network netlink raw, @{exec_path} mr, - @{bin}/pass rCx -> pass, + @{lib}/protonmail/bridge/bridge rPx, + @{open_path} rPx -> child-open-strict, - /etc/lsb-release r, /etc/machine-id r, - owner /var/tmp/etilqs_@{hex} rw, + owner @{config_dirs}/ rw, + owner @{config_dirs}/** rwlk -> @{config_dirs}/**, - owner @{user_password_store_dirs}/docker-credential-helpers/{,**} r, - owner @{user_password_store_dirs}/protonmail-credentials/{,**} r, + owner @{cache_dirs}/ rw, + owner @{cache_dirs}/** rwlk -> @{cache_dirs}/**, - owner @{user_cache_dirs}/protonmail/{,**} rwk, - owner @{user_config_dirs}/protonmail/{,**} rwk, - owner @{user_share_dirs}/protonmail/{,**} rwk, + owner @{share_dirs}/ rw, + owner @{share_dirs}/** rwlk -> @{share_dirs}/**, - @{PROC}/sys/net/core/somaxconn r, - @{PROC}/@{pid}/cgroup r, - - # Force the use of the Gnome Keyring or Kwallet secret-service. - # Comment these lines and add the commented lines in your local/protonmail-bridge - # to allow the use of pass as secret-service. - # of pass as secret store - # deny @{bin}/pass rmx, - # deny owner @{user_password_store_dirs}/** r, - - profile pass { - include - include - - @{bin}/pass mr, - - @{sh_path} rix, - @{bin}/base64 rix, - @{bin}/dirname rix, - @{bin}/env rix, - @{bin}/getopt rix, - @{bin}/git rPx -> pass//git, - @{bin}/gpg{,2} rPx -> pass//gpg, - @{bin}/mkdir rix, - @{bin}/rm rix, - @{bin}/rmdir rix, - @{bin}/sed rix, - @{bin}/tail rix, - @{bin}/tree rix, - @{bin}/tty rix, - @{bin}/which rix, - - owner @{user_password_store_dirs}/ r, - owner @{user_password_store_dirs}/.gpg-id r, - owner @{user_password_store_dirs}/protonmail-credentials/{,**} rw, - deny owner @{user_password_store_dirs}/**/ r, - - /dev/tty rw, - - include if exists - } + owner @{PROC}/@{pid}/cmdline r, include if exists } \ No newline at end of file diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core new file mode 100644 index 00000000..ef7ec136 --- /dev/null +++ b/apparmor.d/profiles-m-r/protonmail-bridge-core @@ -0,0 +1,85 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023-2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# To force the use of the Gnome Keyring or Kwallet secret-service, add the +# following lines in your local/protonmail-bridge-core file: +# deny @{bin}/pass x, +# deny owner @{user_password_store_dirs}/** r, + +abi , + +include + +@{exec_path} = @{lib}/protonmail/bridge/bridge +profile protonmail-bridge-core @{exec_path} { + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + @{bin}/pass rCx -> pass, + + /etc/lsb-release r, + /etc/machine-id r, + + owner @{user_password_store_dirs}/docker-credential-helpers/{,**} r, + owner @{user_password_store_dirs}/protonmail-credentials/{,**} r, + + owner @{user_cache_dirs}/protonmail/{,**} rwk, + owner @{user_config_dirs}/protonmail/{,**} rwk, + owner @{user_share_dirs}/protonmail/{,**} rwk, + + owner "@{user_config_dirs}/autostart/Proton Mail Bridge.desktop" rw, + + owner @{tmp}/bridge@{int} rw, + owner @{tmp}/user/@{uid}/etilqs_@{hex} rw, + owner /var/tmp/etilqs_@{hex} rw, + + @{PROC}/ r, + @{PROC}/sys/net/core/somaxconn r, + @{PROC}/@{pid}/cgroup r, + + deny @{bin}/pass x, + deny owner @{user_password_store_dirs}/** r, + + profile pass { + include + include + + @{bin}/pass mr, + + @{sh_path} rix, + @{bin}/base64 rix, + @{bin}/dirname rix, + @{bin}/env rix, + @{bin}/getopt rix, + @{bin}/git rpx -> pass//git, + @{bin}/gpg{,2} rpx -> pass//gpg, + @{bin}/mkdir rix, + @{bin}/rm rix, + @{bin}/rmdir rix, + @{bin}/sed rix, + @{bin}/tail rix, + @{bin}/tree rix, + @{bin}/tty rix, + @{bin}/which rix, + + owner @{user_password_store_dirs}/ r, + owner @{user_password_store_dirs}/.gpg-id r, + owner @{user_password_store_dirs}/protonmail-credentials/{,**} rw, + deny owner @{user_password_store_dirs}/**/ r, + + /dev/tty rw, + + include if exists + } + + include if exists +} \ No newline at end of file From ff88400b22fe0ab0b2bc975716ff17e48e98c0e9 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Tue, 11 Jun 2024 23:18:07 +0100 Subject: [PATCH 11/32] feat(abs): minor cleanup. --- apparmor.d/abstractions/app/chromium | 8 ++++---- apparmor.d/abstractions/common/app | 2 +- apparmor.d/abstractions/common/chromium | 8 ++++---- apparmor.d/abstractions/common/steam-game | 1 + 4 files changed, 10 insertions(+), 9 deletions(-) diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium index a3af128d..fec42ba9 100644 --- a/apparmor.d/abstractions/app/chromium +++ b/apparmor.d/abstractions/app/chromium @@ -150,10 +150,10 @@ owner @{tmp}/.@{domain}.* rw, owner @{tmp}/.@{domain}*/{,**} rw, owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw, - owner @{tmp}/scoped_dir*/{,**} rw, - owner @{tmp}/tmp.* rw, - owner @{tmp}/tmp.*/ rw, - owner @{tmp}/tmp.*/** rwk, + audit owner @{tmp}/scoped_dir@{rand6}/{,**} rw, + owner @{tmp}/tmp.@{rand6} rw, + owner @{tmp}/tmp.@{rand6}/ rw, + owner @{tmp}/tmp.@{rand6}/** rwk, owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw, owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw, diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app index f563d803..84cd974a 100644 --- a/apparmor.d/abstractions/common/app +++ b/apparmor.d/abstractions/common/app @@ -16,10 +16,10 @@ include include include - # include include include include + include include include include diff --git a/apparmor.d/abstractions/common/chromium b/apparmor.d/abstractions/common/chromium index 1fc1d155..842e1f33 100644 --- a/apparmor.d/abstractions/common/chromium +++ b/apparmor.d/abstractions/common/chromium @@ -20,19 +20,19 @@ owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk, owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw, - owner @{user_share_dirs}/.org.chromium.Chromium.* rw, + owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw, /tmp/ r, /var/tmp/ r, - owner @{tmp}/.org.chromium.Chromium.* rw, - owner @{tmp}/.org.chromium.Chromium.*/{,**} rw, + owner @{tmp}/.org.chromium.Chromium.@{rand6} rw, + owner @{tmp}/.org.chromium.Chromium.@{rand6}/{,**} rw, owner @{tmp}/scoped_dir*/ rw, owner @{tmp}/scoped_dir*/SingletonCookie w, owner @{tmp}/scoped_dir*/SingletonSocket w, owner @{tmp}/scoped_dir*/SS w, /dev/shm/ r, - owner /dev/shm/.org.chromium.Chromium.* rw, + owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, # If kernel.unprivileged_userns_clone = 1 owner @{PROC}/@{pid}/setgroups w, diff --git a/apparmor.d/abstractions/common/steam-game b/apparmor.d/abstractions/common/steam-game index 719fcbd6..5a2cbd6d 100644 --- a/apparmor.d/abstractions/common/steam-game +++ b/apparmor.d/abstractions/common/steam-game @@ -59,6 +59,7 @@ owner /dev/shm/mono.@{int} rw, owner /dev/shm/softbuffer-x11-@{rand6}@{c} rw, + owner /dev/shm/u@{uid}-Shm_@{hex4}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw, owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex8} rw, From f0cff2989d1e3363e7e704e69197c621110ed789 Mon Sep 17 00:00:00 2001 From: fira959 Date: Wed, 12 Jun 2024 12:13:34 +0200 Subject: [PATCH 12/32] Update signal-desktop --- apparmor.d/groups/apps/signal-desktop | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/groups/apps/signal-desktop b/apparmor.d/groups/apps/signal-desktop index d3165a54..6048857e 100644 --- a/apparmor.d/groups/apps/signal-desktop +++ b/apparmor.d/groups/apps/signal-desktop @@ -43,6 +43,7 @@ profile signal-desktop @{exec_path} { @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.high r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/memory.max r, + @{PROC}/@{pid}/fd/ r, @{PROC}/vmstat r, include if exists From 2eab87da2f82da42a6969682a3abb18f05eb9449 Mon Sep 17 00:00:00 2001 From: fira959 Date: Wed, 12 Jun 2024 12:15:34 +0200 Subject: [PATCH 13/32] Update signal-desktop-chrome-sandbox --- apparmor.d/groups/apps/signal-desktop-chrome-sandbox | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apparmor.d/groups/apps/signal-desktop-chrome-sandbox b/apparmor.d/groups/apps/signal-desktop-chrome-sandbox index 4f6bf976..3de0c2f3 100644 --- a/apparmor.d/groups/apps/signal-desktop-chrome-sandbox +++ b/apparmor.d/groups/apps/signal-desktop-chrome-sandbox @@ -22,6 +22,8 @@ profile signal-desktop-chrome-sandbox @{exec_path} { @{lib_dirs}/signal-desktop{,-beta} rPx, @{PROC}/@{pid}/ r, + @{PROC}/@{pid}/oom_adj w, + @{PROC}/@{pid}/oom_score_adj w, include if exists } From 56464d24bffe6b8f0d54a41c5ed6cb40e632bf10 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 12 Jun 2024 22:18:02 +0100 Subject: [PATCH 14/32] fix: xdg-desktop-portal breaks screensharing fix: #376 --- apparmor.d/abstractions/audio-client | 3 +++ apparmor.d/groups/freedesktop/xdg-desktop-portal | 4 +--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/apparmor.d/abstractions/audio-client b/apparmor.d/abstractions/audio-client index f12e7fcc..c5734f6f 100644 --- a/apparmor.d/abstractions/audio-client +++ b/apparmor.d/abstractions/audio-client @@ -41,6 +41,9 @@ owner @{user_config_dirs}/pulse/client.conf.d/{,*.conf} r, owner @{user_config_dirs}/pulse/cookie rwk, + owner @{user_config_dirs}/pipewire/ rw, + owner @{user_config_dirs}/pipewire/client.conf r, + owner @{user_share_dirs}/openal/hrtf/{,**} r, owner @{user_share_dirs}/sounds/__custom/index.theme r, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index b8ee7c4a..2fef3f62 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -10,6 +10,7 @@ include profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { include include + include include include include @@ -70,10 +71,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { /.flatpak-info r, /usr/share/dconf/profile/gdm r, - /usr/share/pipewire/client.conf r, /usr/share/xdg-desktop-portal/** r, - /etc/pipewire/client.conf.d/ r, /etc/sysconfig/proxy r, /var/lib/gdm{,3}/greeter-dconf-defaults r, @@ -83,7 +82,6 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { owner @{tmp}/icon* rw, owner @{run}/user/@{uid}/.flatpak/{,*/*} r, - owner @{run}/user/@{uid}/pipewire-@{int} rw, @{PROC}/ r, @{PROC}/*/ r, From a5a434f02a32f15a20640a98eca9a38d0bcfac2f Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 12 Jun 2024 22:22:26 +0100 Subject: [PATCH 15/32] fix: ensure xdg portal can read any user files. fix #375 --- apparmor.d/groups/freedesktop/xdg-document-portal | 2 +- apparmor.d/groups/freedesktop/xdg-permission-store | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/xdg-document-portal b/apparmor.d/groups/freedesktop/xdg-document-portal index 54104e51..7884a3fd 100644 --- a/apparmor.d/groups/freedesktop/xdg-document-portal +++ b/apparmor.d/groups/freedesktop/xdg-document-portal @@ -42,7 +42,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { / r, owner /.flatpak-info r, - owner @{HOME}/*/{,**} r, + owner @{HOME}/** r, owner @{user_share_dirs}/flatpak/db/documents r, owner @{user_share_dirs}/Trash/files/** r, diff --git a/apparmor.d/groups/freedesktop/xdg-permission-store b/apparmor.d/groups/freedesktop/xdg-permission-store index 43faaaf9..9a53b96c 100644 --- a/apparmor.d/groups/freedesktop/xdg-permission-store +++ b/apparmor.d/groups/freedesktop/xdg-permission-store @@ -42,6 +42,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { owner @{user_share_dirs}/flatpak/db/.goutputstream-@{rand6} rw, owner @{user_share_dirs}/flatpak/db/background rw, owner @{user_share_dirs}/flatpak/db/devices r, + owner @{user_share_dirs}/flatpak/db/documents rw, owner @{user_share_dirs}/flatpak/db/notifications rw, /dev/tty@{int} rw, From 327c1dec332aaf2f6a9ef59e2243fdf517a0956a Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Wed, 12 Jun 2024 22:24:59 +0100 Subject: [PATCH 16/32] feat(profile): add cliphist integration on wl-copy fix: #357 --- apparmor.d/profiles-s-z/wl-copy | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/profiles-s-z/wl-copy b/apparmor.d/profiles-s-z/wl-copy index b961da10..bf395d80 100644 --- a/apparmor.d/profiles-s-z/wl-copy +++ b/apparmor.d/profiles-s-z/wl-copy @@ -15,6 +15,7 @@ profile wl-copy @{exec_path} { @{bin}/cat rix, @{bin}/rm rix, + @{bin}/cliphist rPUx, @{bin}/xdg-mime rPx, owner @{tmp}/wl-copy-buffer-*/{,**} rw, From cc9e7fdde156bb11ea33bbd3b2063cd617d68ba6 Mon Sep 17 00:00:00 2001 From: valoq Date: Fri, 7 Jun 2024 10:57:21 +0200 Subject: [PATCH 17/32] add preview tools --- apparmor.d/profiles-a-f/elinks | 21 +++++++++++++++++++++ apparmor.d/profiles-a-f/ffmpegthumbnailer | 17 +++++++++++++++++ apparmor.d/profiles-g-l/img2txt | 17 +++++++++++++++++ apparmor.d/profiles-m-r/odt2txt | 17 +++++++++++++++++ apparmor.d/profiles-m-r/pdftotext | 19 +++++++++++++++++++ apparmor.d/profiles-s-z/w3m | 19 +++++++++++++++++++ 6 files changed, 110 insertions(+) create mode 100644 apparmor.d/profiles-a-f/elinks create mode 100644 apparmor.d/profiles-a-f/ffmpegthumbnailer create mode 100644 apparmor.d/profiles-g-l/img2txt create mode 100644 apparmor.d/profiles-m-r/odt2txt create mode 100644 apparmor.d/profiles-m-r/pdftotext create mode 100644 apparmor.d/profiles-s-z/w3m diff --git a/apparmor.d/profiles-a-f/elinks b/apparmor.d/profiles-a-f/elinks new file mode 100644 index 00000000..7154acb5 --- /dev/null +++ b/apparmor.d/profiles-a-f/elinks @@ -0,0 +1,21 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/elinks +profile elinks @{exec_path} { + include + include + include + include + + @{exec_path} mr, + + owner @{user_config_dirs}/elinks/{,**} rw, + + include if exists +} diff --git a/apparmor.d/profiles-a-f/ffmpegthumbnailer b/apparmor.d/profiles-a-f/ffmpegthumbnailer new file mode 100644 index 00000000..f1b3b181 --- /dev/null +++ b/apparmor.d/profiles-a-f/ffmpegthumbnailer @@ -0,0 +1,17 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/ffmpegthumbnailer +profile ffmpegthumbnailer @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} diff --git a/apparmor.d/profiles-g-l/img2txt b/apparmor.d/profiles-g-l/img2txt new file mode 100644 index 00000000..d409f0a5 --- /dev/null +++ b/apparmor.d/profiles-g-l/img2txt @@ -0,0 +1,17 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/img2txt +profile img2txt @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} diff --git a/apparmor.d/profiles-m-r/odt2txt b/apparmor.d/profiles-m-r/odt2txt new file mode 100644 index 00000000..13a29167 --- /dev/null +++ b/apparmor.d/profiles-m-r/odt2txt @@ -0,0 +1,17 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/odt2txt +profile odt2txt @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} diff --git a/apparmor.d/profiles-m-r/pdftotext b/apparmor.d/profiles-m-r/pdftotext new file mode 100644 index 00000000..e0230d62 --- /dev/null +++ b/apparmor.d/profiles-m-r/pdftotext @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/pdftotext +profile pdftotext @{exec_path} { + include + include + + @{exec_path} mr, + + /usr/share/poppler/{,**} r, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/w3m b/apparmor.d/profiles-s-z/w3m new file mode 100644 index 00000000..60f66149 --- /dev/null +++ b/apparmor.d/profiles-s-z/w3m @@ -0,0 +1,19 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 valoq +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/w3m +profile w3m @{exec_path} { + include + include + + @{exec_path} mr, + + /usr/share/terminfo/{,**} r, + + include if exists +} From 7b69b696fb8bb772defd570a1341172c2db12052 Mon Sep 17 00:00:00 2001 From: valoq Date: Fri, 7 Jun 2024 11:02:32 +0200 Subject: [PATCH 18/32] use strict abstraction --- apparmor.d/profiles-a-f/elinks | 2 +- apparmor.d/profiles-a-f/ffmpegthumbnailer | 2 +- apparmor.d/profiles-g-l/img2txt | 2 +- apparmor.d/profiles-m-r/odt2txt | 2 +- apparmor.d/profiles-m-r/pdftotext | 2 +- apparmor.d/profiles-s-z/w3m | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/apparmor.d/profiles-a-f/elinks b/apparmor.d/profiles-a-f/elinks index 7154acb5..ee9c4bd1 100644 --- a/apparmor.d/profiles-a-f/elinks +++ b/apparmor.d/profiles-a-f/elinks @@ -11,7 +11,7 @@ profile elinks @{exec_path} { include include include - include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-a-f/ffmpegthumbnailer b/apparmor.d/profiles-a-f/ffmpegthumbnailer index f1b3b181..34d37e75 100644 --- a/apparmor.d/profiles-a-f/ffmpegthumbnailer +++ b/apparmor.d/profiles-a-f/ffmpegthumbnailer @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/ffmpegthumbnailer profile ffmpegthumbnailer @{exec_path} { include - include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-g-l/img2txt b/apparmor.d/profiles-g-l/img2txt index d409f0a5..1b351877 100644 --- a/apparmor.d/profiles-g-l/img2txt +++ b/apparmor.d/profiles-g-l/img2txt @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/img2txt profile img2txt @{exec_path} { include - include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/odt2txt b/apparmor.d/profiles-m-r/odt2txt index 13a29167..9be8b864 100644 --- a/apparmor.d/profiles-m-r/odt2txt +++ b/apparmor.d/profiles-m-r/odt2txt @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/odt2txt profile odt2txt @{exec_path} { include - include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/pdftotext b/apparmor.d/profiles-m-r/pdftotext index e0230d62..9980cff6 100644 --- a/apparmor.d/profiles-m-r/pdftotext +++ b/apparmor.d/profiles-m-r/pdftotext @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/pdftotext profile pdftotext @{exec_path} { include - include + include @{exec_path} mr, diff --git a/apparmor.d/profiles-s-z/w3m b/apparmor.d/profiles-s-z/w3m index 60f66149..557f68c9 100644 --- a/apparmor.d/profiles-s-z/w3m +++ b/apparmor.d/profiles-s-z/w3m @@ -9,7 +9,7 @@ include @{exec_path} = @{bin}/w3m profile w3m @{exec_path} { include - include + include @{exec_path} mr, From 94a654e318b007135925a6661a6a52ce253dc06b Mon Sep 17 00:00:00 2001 From: valoq Date: Sat, 8 Jun 2024 12:50:56 +0200 Subject: [PATCH 19/32] fix lynx profile --- apparmor.d/profiles-g-l/lynx | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/apparmor.d/profiles-g-l/lynx b/apparmor.d/profiles-g-l/lynx index a9b3691d..2c205f73 100644 --- a/apparmor.d/profiles-g-l/lynx +++ b/apparmor.d/profiles-g-l/lynx @@ -13,6 +13,8 @@ profile lynx @{exec_path} { include include include + include + include network inet dgram, network inet6 dgram, @@ -20,20 +22,19 @@ profile lynx @{exec_path} { network inet6 stream, @{exec_path} mr, - - /etc/lynx/{,*} r, - + @{sh_path} rix, + + /usr/share/terminfo/{,**} r, /usr/share/doc/lynx-common/** r, - /etc/mime.types r, - - @{sh_path} rix, + /etc/lynx.cfg r, + /etc/lynx.lss r, + /etc/lynx/{,**} r, /etc/mailcap r, + /etc/mime.types r, owner @{tmp}/lynxXXXX*/ rw, owner @{tmp}/lynxXXXX*/*TMP.html{,.gz} rw, - owner @{HOME}/ r, - include if exists } From d7e09d88fd64998e86540e0fffb93bc94617e559 Mon Sep 17 00:00:00 2001 From: valoq Date: Sat, 8 Jun 2024 12:58:01 +0200 Subject: [PATCH 20/32] complete browsers --- apparmor.d/profiles-a-f/elinks | 6 ++++++ apparmor.d/profiles-s-z/w3m | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/apparmor.d/profiles-a-f/elinks b/apparmor.d/profiles-a-f/elinks index ee9c4bd1..d926271f 100644 --- a/apparmor.d/profiles-a-f/elinks +++ b/apparmor.d/profiles-a-f/elinks @@ -11,8 +11,14 @@ profile elinks @{exec_path} { include include include + include include + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + @{exec_path} mr, owner @{user_config_dirs}/elinks/{,**} rw, diff --git a/apparmor.d/profiles-s-z/w3m b/apparmor.d/profiles-s-z/w3m index 557f68c9..772d07f8 100644 --- a/apparmor.d/profiles-s-z/w3m +++ b/apparmor.d/profiles-s-z/w3m @@ -9,8 +9,16 @@ include @{exec_path} = @{bin}/w3m profile w3m @{exec_path} { include + include + include + include include + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + @{exec_path} mr, /usr/share/terminfo/{,**} r, From 26e7da6641df8f4cdbb50d0a16aef1dee8631107 Mon Sep 17 00:00:00 2001 From: valoq Date: Thu, 13 Jun 2024 11:01:19 +0200 Subject: [PATCH 21/32] add config dirs --- apparmor.d/profiles-s-z/w3m | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apparmor.d/profiles-s-z/w3m b/apparmor.d/profiles-s-z/w3m index 772d07f8..4cc6b57e 100644 --- a/apparmor.d/profiles-s-z/w3m +++ b/apparmor.d/profiles-s-z/w3m @@ -23,5 +23,11 @@ profile w3m @{exec_path} { /usr/share/terminfo/{,**} r, + /etc/w3m/{,**} r, + owner @{HOME}/.w3m/{,**} r, + owner @{user_config_dirs}/w3m/{,**} r, + + owner /tmp/@{rand6}/{,**} rw, + include if exists } From eefb67351f518987206b00ab49ce756a2fceb40b Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Fri, 14 Jun 2024 06:40:09 +0200 Subject: [PATCH 22/32] Add missing `user_games_dirs` and reorganise alphabetically Also adds (s) after "Default Value" to make it more clear that you can add multiple values. --- docs/variables.md | 81 ++++++++++++++++++++++++----------------------- 1 file changed, 41 insertions(+), 40 deletions(-) diff --git a/docs/variables.md b/docs/variables.md index 6ea5285c..0ca199f6 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -6,61 +6,64 @@ title: Variables References ### User directories -| Description | Name | Default Value | +| Description | Name | Default Value(s) | |-------------|:----:|---------------| +| Books | `@{XDG_BOOKS_DIR}` | `Books` | | Desktop | `@{XDG_DESKTOP_DIR}` | `Desktop` | -| Download | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | -| Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` | -| Public | `@{XDG_PUBLICSHARE_DIR}` | `Public` | +| Disk images | `@{XDG_IMG_DIR}` | `images` | | Documents | `@{XDG_DOCUMENTS_DIR}` | `Documents` | +| Download | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | | Music | `@{XDG_MUSIC_DIR}` | `Music` | | Pictures | `@{XDG_PICTURES_DIR}` | `Pictures` | -| Videos | `@{XDG_VIDEOS_DIR}` | `Videos` | -| Books | `@{XDG_BOOKS_DIR}` | `Books` | | Projects | `@{XDG_PROJECTS_DIR}` | `Projects` | +| Public | `@{XDG_PUBLICSHARE_DIR}` | `Public` | | Screenshots | `@{XDG_SCREENSHOTS_DIR}` | `@{XDG_PICTURES_DIR}/Screenshots` | | Sync | `@{XDG_SYNC_DIR}` | `Sync` | +| Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` | | Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | +| Videos | `@{XDG_VIDEOS_DIR}` | `Videos` | | Vm | `@{XDG_VM_DIR}` | `.vm` | Wallpapers | `@{XDG_WALLPAPERS_DIR}` | `@{XDG_PICTURES_DIR}/Wallpapers` | -| Disk images | `@{XDG_IMG_DIR}` | `images` | ### Dotfiles -| Description | Name | Default Value | +| Description | Name | Default Value(s) | |-------------|:----:|---------------| -| SSH | `@{XDG_SSH_DIR}` | `.ssh` | -| GPG | `@{XDG_GPG_DIR}` | `.gnupg` | -| Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` | +| Bin | `@{XDG_BIN_DIR}` | `.local/bin` | | Cache | ` @{XDG_CACHE_DIR}` | `.cache` | | Config | `@{XDG_CONFIG_DIR}` | `.config` | | Data | `@{XDG_DATA_DIR}` | `.local/share` | -| State | `@{XDG_STATE_DIR}` | `.local/state` | -| Bin | `@{XDG_BIN_DIR}` | `.local/bin` | +| GPG | `@{XDG_GPG_DIR}` | `.gnupg` | | Lib | `@{XDG_LIB_DIR}` | `.local/lib` | +| Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` | +| SSH | `@{XDG_SSH_DIR}` | `.ssh` | +| State | `@{XDG_STATE_DIR}` | `.local/state` | ### Full configuration path -| Description | Name | Default Value | +| Description | Name | Default Value(s) | |-------------|:----:|---------------| +| Bin | `@{user_bin_dirs}` | `@{HOME}/@{XDG_BIN_DIR}` | +| Build | `@{user_build_dirs}` | `/tmp/` | | Cache | `@{user_cache_dirs}` | `@{HOME}/@{XDG_CACHE_DIR}` | | Config | `@{user_config_dirs}` | `@{HOME}/@{XDG_CONFIG_DIR}` | +| Lib | `@{user_lib_dirs}` | `@{HOME}/@{XDG_LIB_DIR}` | +| Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | | Share | `@{user_share_dirs}` | ` @{HOME}/@{XDG_DATA_DIR}` | | State | `@{user_state_dirs}` | ` @{HOME}/@{XDG_STATE_DIR}` | -| Bin | `@{user_bin_dirs}` | `@{HOME}/@{XDG_BIN_DIR}` | -| Lib | `@{user_lib_dirs}` | `@{HOME}/@{XDG_LIB_DIR}` | -| Build | `@{user_build_dirs}` | `/tmp/` | | Tmp | `@{user_tmp_dirs}` | `@{run}/user/@{uid} /tmp/` | -| Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | ### Full user path -| Description | Name | Default Value | +| Description | Name | Default Value(s) | |-------------|:----:|---------------| | Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` | +| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | | Documents | `@{user_documents_dirs}` | `@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR}` | | Download | `@{user_download_dirs}` | `@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR}` | +| Games | `@{user_games_dirs}` | `@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR}` | | Music | `@{user_music_dirs}` | `@{HOME}/@{XDG_MUSIC_DIR} @{MOUNTS}/@{XDG_MUSIC_DIR}` | +| Password | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | | Pictures | `@{user_pictures_dirs}` | `@{HOME}/@{XDG_PICTURES_DIR} @{MOUNTS}/@{XDG_PICTURES_DIR}` | | Projects | `@{user_projects_dirs}` | `@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR}` | | Public | `@{user_publicshare_dirs}` | `@{HOME}/@{XDG_PUBLICSHARE_DIR} @{MOUNTS}/@{XDG_PUBLICSHARE_DIR}` | @@ -69,8 +72,6 @@ title: Variables References | Torrents | `@{user_torrents_dirs}` | `@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}` | | Videos | `@{user_videos_dirs}` | `@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR}` | | Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` -| Password | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | -| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | ## System variables @@ -81,46 +82,46 @@ title: Variables References **Helper variables** -| Description | Name | Default Value | +| Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Integer (up to 10 digits) | `@{int}` | `[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}` | | Any 6, 8 or 10 characters | `@{rand6}`, `@{rand8}`, `@{rand10}` | | -| Hexadecimal | `@{h}*@{h}` | | -| Universally unique identifier | `@{uuid}` | | | Current Process id | `@{pid}` | `[0-9]*` | -| Processes ids | `@{pids}` | `[0-9]*` | -| User id | `@{uid}` | `[0-9]*` | -| Thread id | `@{tid}` | `[0-9]*` | -| Single hexadecimal character | `@{h}` | `[0-9a-fA-F]` | -| Single alphanumeric character | `@{c}` | `[0-9a-zA-Z]` | +| Hexadecimal | `@{h}*@{h}` | | +| Integer (up to 10 digits) | `@{int}` | `[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}` | | PCI Devices | `@{pci}` | `@{pci_bus}/**/` | | PCI Bus | `@{pci_bus}` | `pci@{h}@{h}@{h}@{h}:@{h}@{h}` | | PCI Id | `@{pci_id}` | `@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h}` | +| Processes ids | `@{pids}` | `[0-9]*` | +| Single hexadecimal character | `@{h}` | `[0-9a-fA-F]` | +| Single alphanumeric character | `@{c}` | `[0-9a-zA-Z]` | +| Thread id | `@{tid}` | `[0-9]*` | +| Universally unique identifier | `@{uuid}` | | +| User id | `@{uid}` | `[0-9]*` | **System Paths** -| Description | Name | Default Value | +| Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Root Home | `@{HOMEDIRS}` | `/home/` | -| Home directories | `@{HOME}` | `@{HOMEDIRS}/*/ /root/` | -| Root Mountpoints | `@{MOUNTDIRS}` | `/media/ @{run}/media/ /mnt/` | -| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` | | Bin | `@{bin}` | `/{usr/,}{s,}bin` | +| Flatpack export | `@{flatpak_exports_root}` | `{flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}` | +| Home directories | `@{HOME}` | `@{HOMEDIRS}/*/ /root/` | | Lib | `@{lib}` | `/{usr/,}lib{,exec,32,64}` | -| multi-arch library | `@{multiarch}` | `*-linux-gnu*` | | Proc | `@{PROC}` | `/proc/` | +| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` | +| multi-arch library | `@{multiarch}` | `*-linux-gnu*` | +| Root Home | `@{HOMEDIRS}` | `/home/` | +| Root Mountpoints | `@{MOUNTDIRS}` | `/media/ @{run}/media/ /mnt/` | | Run | `@{run}` | `/run/ /var/run/` | | Sys | `@{sys}` | `/sys/` | -| Flatpack export | `@{flatpak_exports_root}` | `{flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}` | | System wide share | `@{system_share_dirs}` | `/{usr,usr/local,var/lib/@{flatpak_exports_root}}/share` | **Program paths** -| Description | Name | Default Value | +| Description | Name | Default Value(s) | |-------------|:----:|---------------| +| All browser paths | `@{*_path}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L11) | All the shells | `@{shells}` | `sh zsh bash dash fish rbash ksh tcsh csh` | -| Shells path | `@{shells_path}` | `@{bin}/@{shells}` | | Coreutils programs that should not have dedicated profile | `@{coreutils}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L46) | | Coreutils paths | `@{coreutils_path}` | `@{bin}/@{coreutils}` | | Launcher paths | `@{open_path}` | `@{bin}/exo-open @{bin}/xdg-open @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop` -| All browser paths | `@{*_path}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L11) +| Shells path | `@{shells_path}` | `@{bin}/@{shells}` | From afbe5a95d06ab1495c9ac153e8c26a4f3db9d548 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Fri, 14 Jun 2024 06:53:22 +0200 Subject: [PATCH 23/32] Add XDG_GAMES_DIR --- docs/variables.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/variables.md b/docs/variables.md index 0ca199f6..efbcb8e1 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -13,6 +13,7 @@ title: Variables References | Disk images | `@{XDG_IMG_DIR}` | `images` | | Documents | `@{XDG_DOCUMENTS_DIR}` | `Documents` | | Download | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | +| Games | `@{XDG_GAMES_DIR}` | `.games` | | Music | `@{XDG_MUSIC_DIR}` | `Music` | | Pictures | `@{XDG_PICTURES_DIR}` | `Pictures` | | Projects | `@{XDG_PROJECTS_DIR}` | `Projects` | From aea114b1ec1c01f460f4b316a5fa00bf9e14a519 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Fri, 14 Jun 2024 19:54:35 +0200 Subject: [PATCH 24/32] Reorganise based on type As discussed in DMs --- docs/variables.md | 88 +++++++++++++++++++++++------------------------ 1 file changed, 44 insertions(+), 44 deletions(-) diff --git a/docs/variables.md b/docs/variables.md index efbcb8e1..6045faf0 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -8,71 +8,71 @@ title: Variables References | Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Books | `@{XDG_BOOKS_DIR}` | `Books` | | Desktop | `@{XDG_DESKTOP_DIR}` | `Desktop` | -| Disk images | `@{XDG_IMG_DIR}` | `images` | | Documents | `@{XDG_DOCUMENTS_DIR}` | `Documents` | -| Download | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | -| Games | `@{XDG_GAMES_DIR}` | `.games` | +| Downloads | `@{XDG_DOWNLOAD_DIR}` | `Downloads` | | Music | `@{XDG_MUSIC_DIR}` | `Music` | | Pictures | `@{XDG_PICTURES_DIR}` | `Pictures` | -| Projects | `@{XDG_PROJECTS_DIR}` | `Projects` | -| Public | `@{XDG_PUBLICSHARE_DIR}` | `Public` | -| Screenshots | `@{XDG_SCREENSHOTS_DIR}` | `@{XDG_PICTURES_DIR}/Screenshots` | -| Sync | `@{XDG_SYNC_DIR}` | `Sync` | -| Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` | -| Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | | Videos | `@{XDG_VIDEOS_DIR}` | `Videos` | -| Vm | `@{XDG_VM_DIR}` | `.vm` +| Screenshots | `@{XDG_SCREENSHOTS_DIR}` | `@{XDG_PICTURES_DIR}/Screenshots` | | Wallpapers | `@{XDG_WALLPAPERS_DIR}` | `@{XDG_PICTURES_DIR}/Wallpapers` | +| Books | `@{XDG_BOOKS_DIR}` | `Books` | +| Games | `@{XDG_GAMES_DIR}` | `.games` | +| Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` | +| Public | `@{XDG_PUBLICSHARE_DIR}` | `Public` | +| Projects | `@{XDG_PROJECTS_DIR}` | `Projects` | +| Sync | `@{XDG_SYNC_DIR}` | `Sync` | +| Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | +| Vm | `@{XDG_VM_DIR}` | `.vm` +| Disk images | `@{XDG_IMG_DIR}` | `images` | ### Dotfiles | Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Bin | `@{XDG_BIN_DIR}` | `.local/bin` | | Cache | ` @{XDG_CACHE_DIR}` | `.cache` | | Config | `@{XDG_CONFIG_DIR}` | `.config` | | Data | `@{XDG_DATA_DIR}` | `.local/share` | -| GPG | `@{XDG_GPG_DIR}` | `.gnupg` | -| Lib | `@{XDG_LIB_DIR}` | `.local/lib` | -| Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` | -| SSH | `@{XDG_SSH_DIR}` | `.ssh` | | State | `@{XDG_STATE_DIR}` | `.local/state` | +| Bin | `@{XDG_BIN_DIR}` | `.local/bin` | +| Lib | `@{XDG_LIB_DIR}` | `.local/lib` | +| GPG | `@{XDG_GPG_DIR}` | `.gnupg` | +| SSH | `@{XDG_SSH_DIR}` | `.ssh` | +| Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` | ### Full configuration path | Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Bin | `@{user_bin_dirs}` | `@{HOME}/@{XDG_BIN_DIR}` | -| Build | `@{user_build_dirs}` | `/tmp/` | | Cache | `@{user_cache_dirs}` | `@{HOME}/@{XDG_CACHE_DIR}` | | Config | `@{user_config_dirs}` | `@{HOME}/@{XDG_CONFIG_DIR}` | +| Bin | `@{user_bin_dirs}` | `@{HOME}/@{XDG_BIN_DIR}` | | Lib | `@{user_lib_dirs}` | `@{HOME}/@{XDG_LIB_DIR}` | -| Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | | Share | `@{user_share_dirs}` | ` @{HOME}/@{XDG_DATA_DIR}` | | State | `@{user_state_dirs}` | ` @{HOME}/@{XDG_STATE_DIR}` | +| Build | `@{user_build_dirs}` | `/tmp/` | +| Packages | `@{user_pkg_dirs}` | `/tmp/pkg/` | | Tmp | `@{user_tmp_dirs}` | `@{run}/user/@{uid} /tmp/` | ### Full user path | Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` | -| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | | Documents | `@{user_documents_dirs}` | `@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR}` | -| Download | `@{user_download_dirs}` | `@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR}` | -| Games | `@{user_games_dirs}` | `@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR}` | +| Downloads | `@{user_download_dirs}` | `@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR}` | | Music | `@{user_music_dirs}` | `@{HOME}/@{XDG_MUSIC_DIR} @{MOUNTS}/@{XDG_MUSIC_DIR}` | -| Password | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | | Pictures | `@{user_pictures_dirs}` | `@{HOME}/@{XDG_PICTURES_DIR} @{MOUNTS}/@{XDG_PICTURES_DIR}` | +| Videos | `@{user_videos_dirs}` | `@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR}` | +| Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` | +| Games | `@{user_games_dirs}` | `@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR}` | +| Passwords | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | | Projects | `@{user_projects_dirs}` | `@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR}` | | Public | `@{user_publicshare_dirs}` | `@{HOME}/@{XDG_PUBLICSHARE_DIR} @{MOUNTS}/@{XDG_PUBLICSHARE_DIR}` | -| Sync | `@{user_sync_dirs}` | `@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR}` | | Templates | `@{user_templates_dirs}` | `@{HOME}/@{XDG_TEMPLATES_DIR} @{MOUNTS}/@{XDG_TEMPLATES_DIR}` | | Torrents | `@{user_torrents_dirs}` | `@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}` | -| Videos | `@{user_videos_dirs}` | `@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR}` | +| Sync | `@{user_sync_dirs}` | `@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR}` | | Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` +| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | ## System variables @@ -85,44 +85,44 @@ title: Variables References | Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Any 6, 8 or 10 characters | `@{rand6}`, `@{rand8}`, `@{rand10}` | | -| Current Process id | `@{pid}` | `[0-9]*` | -| Hexadecimal | `@{h}*@{h}` | | | Integer (up to 10 digits) | `@{int}` | `[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}` | +| Any 6, 8 or 10 characters | `@{rand6}`, `@{rand8}`, `@{rand10}` | | +| Hexadecimal | `@{h}*@{h}` | | +| Universally unique identifier | `@{uuid}` | | +| Current Process id | `@{pid}` | `[0-9]*` | +| Processes ids | `@{pids}` | `[0-9]*` | +| User id | `@{uid}` | `[0-9]*` | +| Thread id | `@{tid}` | `[0-9]*` | +| Single hexadecimal character | `@{h}` | `[0-9a-fA-F]` | +| Single alphanumeric character | `@{c}` | `[0-9a-zA-Z]` | | PCI Devices | `@{pci}` | `@{pci_bus}/**/` | | PCI Bus | `@{pci_bus}` | `pci@{h}@{h}@{h}@{h}:@{h}@{h}` | | PCI Id | `@{pci_id}` | `@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h}` | -| Processes ids | `@{pids}` | `[0-9]*` | -| Single hexadecimal character | `@{h}` | `[0-9a-fA-F]` | -| Single alphanumeric character | `@{c}` | `[0-9a-zA-Z]` | -| Thread id | `@{tid}` | `[0-9]*` | -| Universally unique identifier | `@{uuid}` | | -| User id | `@{uid}` | `[0-9]*` | **System Paths** | Description | Name | Default Value(s) | |-------------|:----:|---------------| -| Bin | `@{bin}` | `/{usr/,}{s,}bin` | -| Flatpack export | `@{flatpak_exports_root}` | `{flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}` | -| Home directories | `@{HOME}` | `@{HOMEDIRS}/*/ /root/` | -| Lib | `@{lib}` | `/{usr/,}lib{,exec,32,64}` | -| Proc | `@{PROC}` | `/proc/` | -| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` | -| multi-arch library | `@{multiarch}` | `*-linux-gnu*` | | Root Home | `@{HOMEDIRS}` | `/home/` | +| Home directories | `@{HOME}` | `@{HOMEDIRS}/*/ /root/` | | Root Mountpoints | `@{MOUNTDIRS}` | `/media/ @{run}/media/ /mnt/` | +| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` | +| Bin | `@{bin}` | `/{usr/,}{s,}bin` | +| Lib | `@{lib}` | `/{usr/,}lib{,exec,32,64}` | +| multi-arch library | `@{multiarch}` | `*-linux-gnu*` | +| Proc | `@{PROC}` | `/proc/` | | Run | `@{run}` | `/run/ /var/run/` | | Sys | `@{sys}` | `/sys/` | | System wide share | `@{system_share_dirs}` | `/{usr,usr/local,var/lib/@{flatpak_exports_root}}/share` | +| Flatpak export | `@{flatpak_exports_root}` | `{flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}` | **Program paths** | Description | Name | Default Value(s) | |-------------|:----:|---------------| -| All browser paths | `@{*_path}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L11) | All the shells | `@{shells}` | `sh zsh bash dash fish rbash ksh tcsh csh` | +| Shells path | `@{shells_path}` | `@{bin}/@{shells}` | | Coreutils programs that should not have dedicated profile | `@{coreutils}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L46) | | Coreutils paths | `@{coreutils_path}` | `@{bin}/@{coreutils}` | | Launcher paths | `@{open_path}` | `@{bin}/exo-open @{bin}/xdg-open @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop` -| Shells path | `@{shells_path}` | `@{bin}/@{shells}` | +| All browser paths | `@{*_path}` | See [tunables/multiarch.d/paths](https://github.com/roddhjav/apparmor.d/blob/c2d88c9bffc626fcf7d9b15b42b50706afb29562/apparmor.d/tunables/multiarch.d/paths#L11) From 117e63d88fc2b782111c8b98885a26869bc1be93 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 14 Jun 2024 20:50:17 +0100 Subject: [PATCH 25/32] fix: ensure filter directive get cleaned on build. --- apparmor.d/abstractions/authentication.d/complete | 1 + pkg/prebuild/directive/core.go | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/abstractions/authentication.d/complete b/apparmor.d/abstractions/authentication.d/complete index 57ffc77f..a6a4e375 100644 --- a/apparmor.d/abstractions/authentication.d/complete +++ b/apparmor.d/abstractions/authentication.d/complete @@ -11,3 +11,4 @@ @{lib}/security-misc/pam_faillock_not_if_x rPx, @{lib}/security-misc/pam-abort-on-locked-password rPx, @{lib}/security-misc/pam-info rPx, + diff --git a/pkg/prebuild/directive/core.go b/pkg/prebuild/directive/core.go index 53176b01..d14dd486 100644 --- a/pkg/prebuild/directive/core.go +++ b/pkg/prebuild/directive/core.go @@ -65,7 +65,7 @@ func NewOption(file *paths.Path, match []string) *Option { // Useful to remove directive text applied on some condition only func (o *Option) Clean(profile string) string { reg := regexp.MustCompile(`\s*` + Keyword + o.Name + ` .*$`) - return reg.ReplaceAllString(profile, "") + return strings.Replace(profile, o.Raw, reg.ReplaceAllString(o.Raw, ""), 1) } func RegisterDirective(d Directive) { From 33c78ea4cfeec3b63bfe2cc3b4472769263926d4 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 14 Jun 2024 21:02:34 +0100 Subject: [PATCH 26/32] build(opensure): ensure docker build has apparmor-profiles. --- dists/docker.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dists/docker.sh b/dists/docker.sh index 19a8737a..500918c5 100644 --- a/dists/docker.sh +++ b/dists/docker.sh @@ -100,7 +100,7 @@ build_in_docker_rpm() { docker pull "$BASEIMAGE/$dist" docker run -tid --name "$img" --volume "$VOLUME:$BUILDIR" \ "$BASEIMAGE/$dist" - docker exec "$img" sudo zypper install -y distribution-release golang-packaging rsync + docker exec "$img" sudo zypper install -y distribution-release golang-packaging rsync apparmor-profiles fi docker exec --workdir="$BUILDIR/$PKGNAME" "$img" bash dists/build.sh rpm From d8dcdb0d3c2e6e46b16c09dc0584025ec44fdd31 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Fri, 14 Jun 2024 20:40:45 +0200 Subject: [PATCH 27/32] Add missing variables to docs --- docs/variables.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/variables.md b/docs/variables.md index 6045faf0..a7035826 100644 --- a/docs/variables.md +++ b/docs/variables.md @@ -21,9 +21,13 @@ title: Variables References | Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` | | Public | `@{XDG_PUBLICSHARE_DIR}` | `Public` | | Projects | `@{XDG_PROJECTS_DIR}` | `Projects` | +| Private | `@{XDG_PRIVATE_DIR}` | `.{p,P}rivate {p,P}rivate` | +| Work | `@{XDG_WORK_DIR}` | `Work` | +| Mail | `@{XDG_MAIL_DIR}` | `Mail .{m,M}ail` | | Sync | `@{XDG_SYNC_DIR}` | `Sync` | | Torrents | `@{XDG_TORRENTS_DIR}` | `Torrents` | | Vm | `@{XDG_VM_DIR}` | `.vm` +| Vm Shares | `@{XDG_VM_SHARES_DIR}` | `VM_Shares` | Disk images | `@{XDG_IMG_DIR}` | `images` | ### Dotfiles @@ -38,7 +42,9 @@ title: Variables References | Lib | `@{XDG_LIB_DIR}` | `.local/lib` | | GPG | `@{XDG_GPG_DIR}` | `.gnupg` | | SSH | `@{XDG_SSH_DIR}` | `.ssh` | +| Private | `@{XDG_PRIVATE_DIR}` | `.{p,P}rivate {p,P}rivate` | | Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` | +| Mail | `@{XDG_MAIL_DIR}` | `Mail .{m,M}ail` | ### Full configuration path @@ -65,14 +71,18 @@ title: Variables References | Videos | `@{user_videos_dirs}` | `@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR}` | | Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` | | Games | `@{user_games_dirs}` | `@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR}` | +| Private | `@{user_private_dirs}` | `@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR}` | | Passwords | `@{user_password_store_dirs}` | `@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR}` | +| Work | `@{user_work_dirs}` | `@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR}` | +| Mail | `@{user_mail_dirs}` | `@{HOME}/@{XDG_MAIL_DIR} @{MOUNTS}/@{XDG_MAIL_DIR}` | | Projects | `@{user_projects_dirs}` | `@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR}` | | Public | `@{user_publicshare_dirs}` | `@{HOME}/@{XDG_PUBLICSHARE_DIR} @{MOUNTS}/@{XDG_PUBLICSHARE_DIR}` | | Templates | `@{user_templates_dirs}` | `@{HOME}/@{XDG_TEMPLATES_DIR} @{MOUNTS}/@{XDG_TEMPLATES_DIR}` | | Torrents | `@{user_torrents_dirs}` | `@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR}` | | Sync | `@{user_sync_dirs}` | `@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR}` | | Vm | `@{user_vm_dirs}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` -| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_IMG_DIR} @{MOUNTS}/@{XDG_IMG_DIR}` | +| Vm Shares | `@{user_vm_shares}` | `@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR}` +| Disk images | `@{user_img_dirs}` | `@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR}` | ## System variables From 7b6ef48d7945d310fca95e7eab20d22767b306fb Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Fri, 14 Jun 2024 20:41:02 +0200 Subject: [PATCH 28/32] Reorganise xdg-user-dirs.d tunables --- apparmor.d/tunables/xdg-user-dirs.d/apparmor.d | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d b/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d index 7476a167..2c1fedea 100644 --- a/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d +++ b/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d @@ -18,9 +18,9 @@ @{user_download_dirs}=@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR} @{user_music_dirs}=@{HOME}/@{XDG_MUSIC_DIR} @{MOUNTS}/@{XDG_MUSIC_DIR} @{user_pictures_dirs}=@{HOME}/@{XDG_PICTURES_DIR} @{MOUNTS}/@{XDG_PICTURES_DIR} +@{user_videos_dirs}=@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR} @{user_publicshare_dirs}=@{HOME}/@{XDG_PUBLICSHARE_DIR} @{MOUNTS}/@{XDG_PUBLICSHARE_DIR} @{user_templates_dirs}=@{HOME}/@{XDG_TEMPLATES_DIR} @{MOUNTS}/@{XDG_TEMPLATES_DIR} -@{user_videos_dirs}=@{HOME}/@{XDG_VIDEOS_DIR} @{MOUNTS}/@{XDG_VIDEOS_DIR} @{user_vm_shares}=@{HOME}/@{XDG_VM_SHARES_DIR} @{MOUNTS}/@{XDG_VM_SHARES_DIR} include if exists From 307f2d6ad009e59725e97b80aa4eb5b0afa55542 Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Fri, 14 Jun 2024 20:41:22 +0200 Subject: [PATCH 29/32] Reorganise home.d tunables --- apparmor.d/tunables/home.d/apparmor.d | 28 +++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index 5b820416..f79e3ab1 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -12,22 +12,22 @@ # First part, second part in /etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d # Extra user personal directories -@{XDG_BOOKS_DIR}="Books" -@{XDG_PROJECTS_DIR}="Projects" -@{XDG_WORK_DIR}="Work" -@{XDG_SYNC_DIR}="Sync" -@{XDG_TORRENTS_DIR}="Torrents" -@{XDG_GAMES_DIR}=".games" -@{XDG_VM_DIR}=".vm" -@{XDG_VM_SHARES_DIR}="VM_Shares" @{XDG_IMG_DIR}="images" -@{XDG_MAIL_DIR}="Mail" ".{m,M}ail" @{XDG_SCREENSHOTS_DIR}="Pictures/Screenshots" @{XDG_WALLPAPERS_DIR}="Pictures/Wallpapers" +@{XDG_BOOKS_DIR}="Books" +@{XDG_GAMES_DIR}=".games" +@{XDG_PROJECTS_DIR}="Projects" +@{XDG_WORK_DIR}="Work" +@{XDG_MAIL_DIR}="Mail" ".{m,M}ail" +@{XDG_SYNC_DIR}="Sync" +@{XDG_TORRENTS_DIR}="Torrents" +@{XDG_VM_DIR}=".vm" +@{XDG_VM_SHARES_DIR}="VM_Shares" # User personal keyrings -@{XDG_SSH_DIR}=".ssh" @{XDG_GPG_DIR}=".gnupg" +@{XDG_SSH_DIR}=".ssh" @{XDG_PASSWORD_STORE_DIR}=".password-store" # User personal private directories @@ -44,9 +44,9 @@ # Full path of the user configuration directories @{user_cache_dirs}=@{HOME}/@{XDG_CACHE_DIR} @{user_config_dirs}=@{HOME}/@{XDG_CONFIG_DIR} -@{user_state_dirs}=@{HOME}/@{XDG_STATE_DIR} @{user_bin_dirs}=@{HOME}/@{XDG_BIN_DIR} @{user_lib_dirs}=@{HOME}/@{XDG_LIB_DIR} +@{user_state_dirs}=@{HOME}/@{XDG_STATE_DIR} # User build directories and output @{user_build_dirs}="/tmp/build/" @@ -57,11 +57,11 @@ # Other user directories @{user_books_dirs}=@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR} @{user_games_dirs}=@{HOME}/@{XDG_GAMES_DIR} @{MOUNTS}/@{XDG_GAMES_DIR} +@{user_private_dirs}=@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR} +@{user_password_store_dirs}=@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR} +@{user_work_dirs}=@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR} @{user_mail_dirs}=@{HOME}/@{XDG_MAIL_DIR} @{MOUNTS}/@{XDG_MAIL_DIR} @{user_projects_dirs}=@{HOME}/@{XDG_PROJECTS_DIR} @{MOUNTS}/@{XDG_PROJECTS_DIR} @{user_sync_dirs}=@{HOME}/@{XDG_SYNC_DIR} @{MOUNTS}/*/@{XDG_SYNC_DIR} @{user_torrents_dirs}=@{HOME}/@{XDG_TORRENTS_DIR} @{MOUNTS}/@{XDG_TORRENTS_DIR} @{user_vm_dirs}=@{HOME}/@{XDG_VM_DIR} @{MOUNTS}/@{XDG_VM_DIR} -@{user_work_dirs}=@{HOME}/@{XDG_WORK_DIR} @{MOUNTS}/@{XDG_WORK_DIR} -@{user_password_store_dirs}=@{HOME}/@{XDG_PASSWORD_STORE_DIR} @{MOUNTS}/@{XDG_PASSWORD_STORE_DIR} -@{user_private_dirs}=@{HOME}/@{XDG_PRIVATE_DIR} @{MOUNTS}/@{XDG_PRIVATE_DIR} From 02ea3b9ee6037e8f13bdde368da1f8b4d30a3d8e Mon Sep 17 00:00:00 2001 From: Stoppedpuma <58333920+Stoppedpuma@users.noreply.github.com> Date: Fri, 14 Jun 2024 20:48:34 +0200 Subject: [PATCH 30/32] Move disk images --- apparmor.d/tunables/home.d/apparmor.d | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/tunables/home.d/apparmor.d b/apparmor.d/tunables/home.d/apparmor.d index f79e3ab1..52b30897 100644 --- a/apparmor.d/tunables/home.d/apparmor.d +++ b/apparmor.d/tunables/home.d/apparmor.d @@ -12,7 +12,6 @@ # First part, second part in /etc/apparmor.d/tunables/xdg-user-dirs.d/apparmor.d # Extra user personal directories -@{XDG_IMG_DIR}="images" @{XDG_SCREENSHOTS_DIR}="Pictures/Screenshots" @{XDG_WALLPAPERS_DIR}="Pictures/Wallpapers" @{XDG_BOOKS_DIR}="Books" @@ -24,6 +23,7 @@ @{XDG_TORRENTS_DIR}="Torrents" @{XDG_VM_DIR}=".vm" @{XDG_VM_SHARES_DIR}="VM_Shares" +@{XDG_IMG_DIR}="images" # User personal keyrings @{XDG_GPG_DIR}=".gnupg" From 6c64ef95c62dba017eb6ceeda5e4d5c12079f3b7 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 14 Jun 2024 21:08:33 +0100 Subject: [PATCH 31/32] fix: ensure xdg-desktop-portal have access to download files. fix #386 --- apparmor.d/groups/freedesktop/xdg-desktop-portal | 1 + apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal index 2fef3f62..f7801cb6 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal @@ -20,6 +20,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { include include include + include capability sys_ptrace, diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome index 9ca2e9b5..91eb7760 100644 --- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome +++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome @@ -22,7 +22,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { include include include - include + include network unix stream, From 6c1cdf4d582bebc6f3de365f1b528d832b3e27e6 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Fri, 14 Jun 2024 21:10:02 +0100 Subject: [PATCH 32/32] fix: ensure btop can send signal fix #385 --- apparmor.d/abstractions/base.d/complete | 1 + 1 file changed, 1 insertion(+) diff --git a/apparmor.d/abstractions/base.d/complete b/apparmor.d/abstractions/base.d/complete index cc4b1a1e..e758d050 100644 --- a/apparmor.d/abstractions/base.d/complete +++ b/apparmor.d/abstractions/base.d/complete @@ -4,6 +4,7 @@ # SPDX-License-Identifier: GPL-2.0-only # Allow to receive some signals from new well-known profiles + signal (receive) peer=btop, signal (receive) peer=htop, signal (receive) peer=sudo, signal (receive) peer=top,