mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-02-20 17:05:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(abs): rewrite user-read/user-write.

Browse source 
See #307
This commit is contained in:
Alexandre Pujol 2024-03-28 16:47:40 +00:00
parent b089a4d2c5
commit 2fc2394bad
Failed to generate hash of commit
18 changed files with 96 additions and 48 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/app/chromium
View file

@ -26,7 +26,7 @@
include <abstractions/thumbnails-cache-read>
include <abstractions/uim>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
include <abstractions/video>
# userns,

27
apparmor.d/abstractions/user-read
View file

@ -2,29 +2,12 @@
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This abstraction gives read access on all defined user directories. It should
# only be used if access to **ALL** folders is required.
# Warning: This abstraction gives unrestricted read access on all non hidden user directories.
owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{user_books_dirs}/{,**} r,
owner @{user_documents_dirs}/{,**} r,
owner @{user_download_dirs}/{,**} r,
owner @{user_games_dirs}/{,**} r,
owner @{user_music_dirs}/{,**} r,
owner @{user_pictures_dirs}/{,**} r,
owner @{user_projects_dirs}/{,**} r,
owner @{user_publicshare_dirs}/{,**} r,
owner @{user_sync_dirs}/{,**} r,
owner @{user_templates_dirs}/{,**} r,
owner @{user_torrents_dirs}/{,**} r,
owner @{user_videos_dirs}/{,**} r,
owner @{user_vm_dirs}/{,**} r,
owner @{user_work_dirs}/{,**} r,
owner @{HOME}/[^.]** r,
owner @{MOUNTS}/[^.]** r,
include if exists <abstractions/user-read.d>

33
apparmor.d/abstractions/user-read-strict Normal file
View file

@ -0,0 +1,33 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This abstraction gives read access on all defined user directories. It should
# only be used if access to **ALL** folders is required.
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_books_dirs}/{,**} r,
owner @{user_documents_dirs}/{,**} r,
owner @{user_download_dirs}/{,**} r,
owner @{user_games_dirs}/{,**} r,
owner @{user_music_dirs}/{,**} r,
owner @{user_pictures_dirs}/{,**} r,
owner @{user_projects_dirs}/{,**} r,
owner @{user_publicshare_dirs}/{,**} r,
owner @{user_sync_dirs}/{,**} r,
owner @{user_templates_dirs}/{,**} r,
owner @{user_torrents_dirs}/{,**} r,
owner @{user_videos_dirs}/{,**} r,
owner @{user_vm_dirs}/{,**} r,
owner @{user_work_dirs}/{,**} r,
include if exists <abstractions/user-read-strict.d>

33
apparmor.d/abstractions/user-write-strict Normal file
View file

@ -0,0 +1,33 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This abstraction gives write only access on all defined user directories. It should
# only be used if access to **ALL** folders is required.
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} wl,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} wl,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} wl,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} wl,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} wl,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} wl,
owner @{user_books_dirs}/{,**} wl,
owner @{user_documents_dirs}/{,**} wl,
owner @{user_download_dirs}/{,**} wl,
owner @{user_games_dirs}/{,**} wl,
owner @{user_music_dirs}/{,**} wl,
owner @{user_pictures_dirs}/{,**} wl,
owner @{user_projects_dirs}/{,**} wl,
owner @{user_publicshare_dirs}/{,**} wl,
owner @{user_sync_dirs}/{,**} wl,
owner @{user_templates_dirs}/{,**} wl,
owner @{user_torrents_dirs}/{,**} wl,
owner @{user_videos_dirs}/{,**} wl,
owner @{user_vm_dirs}/{,**} wl,
owner @{user_work_dirs}/{,**} wl,
include if exists <abstractions/user-write-strict.d>

17
apparmor.d/abstractions/user-write.d/complete
View file

@ -2,15 +2,10 @@
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} rwl,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} rwl,
# Warning: This abstraction gives unrestricted write access on all non hidden user directories.
owner @{user_books_dirs}/{,**} rwl,
owner @{user_documents_dirs}/{,**} rwl,
owner @{user_games_dirs}/{,**} rwl,
owner @{user_music_dirs}/{,**} rwl,
owner @{user_pictures_dirs}/{,**} rwl,
owner @{user_projects_dirs}/{,**} rwl,
owner @{user_videos_dirs}/{,**} rwl,
owner @{user_vm_dirs}/{,**} rwl,
owner @{user_work_dirs}/{,**} rwl,
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{HOME}/[^.]** wl,
owner @{MOUNTS}/[^.]** wl,

2
apparmor.d/groups/apps/imv-wayland
View file

@ -13,7 +13,7 @@ profile imv @{exec_path} {
include <abstractions/fontconfig-cache-read>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
@{exec_path} mr,

2
apparmor.d/groups/browsers/firefox
View file

@ -34,7 +34,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
# userns,

2
apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
View file

@ -26,7 +26,7 @@ profile xdg-desktop-portal-gtk @{exec_path} {
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/thumbnails-cache-read>
include <abstractions/user-download>
include <abstractions/user-download-strict>
include <abstractions/user-write>
unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/*", label=gnome-shell),

2
apparmor.d/groups/gnome/loupe
View file

@ -14,6 +14,8 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/trash-strict>
include <abstractions/user-read-strict>
include <abstractions/user-write-strict>
signal (send) set=(kill) peer=loupe//bwrap,

2
apparmor.d/groups/gpg/gpg
View file

@ -13,7 +13,7 @@ profile gpg @{exec_path} {
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
capability dac_read_search,

2
apparmor.d/groups/gvfs/gvfsd-dav
View file

@ -14,8 +14,8 @@ profile gvfsd-dav @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
include <abstractions/p11-kit>
include <abstractions/user-read>
include <abstractions/user-download-strict>
include <abstractions/user-read-strict>
network inet stream,
network inet6 stream,

2
apparmor.d/groups/kde/kactivitymanagerd
View file

@ -14,7 +14,7 @@ profile kactivitymanagerd @{exec_path} {
include <abstractions/kde-strict>
include <abstractions/nameservice-strict>
include <abstractions/recent-documents-write>
include <abstractions/user-read>
include <abstractions/user-read-strict>
@{exec_path} mr,

4
apparmor.d/groups/kde/okular
View file

@ -15,8 +15,8 @@ profile okular @{exec_path} {
include <abstractions/kde-strict>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-write>
include <abstractions/user-read-strict>
include <abstractions/user-write-strict>
@{exec_path} mr,

2
apparmor.d/groups/whonix/torbrowser
View file

@ -33,7 +33,7 @@ profile torbrowser @{exec_path} flags=(attach_disconnected) {
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
# userns,

4
apparmor.d/profiles-a-f/evince
View file

@ -18,8 +18,8 @@ profile evince @{exec_path} {
include <abstractions/ibus>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-write>
include <abstractions/user-read-strict>
include <abstractions/user-write-strict>
# also denies network mounts
deny network inet,

4
apparmor.d/profiles-a-f/file-roller
View file

@ -15,9 +15,11 @@ profile file-roller @{exec_path} {
include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/user-write>
include <abstractions/user-read-strict>
include <abstractions/user-write-strict>
#aa:dbus own bus=session name=org.gnome.ArchiveManager1
#aa:dbus own bus=session name=org.gnome.FileRoller

2
apparmor.d/profiles-m-r/mutt
View file

@ -13,7 +13,7 @@ profile mutt @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
network inet dgram,
network inet6 dgram,

2
apparmor.d/profiles-s-z/wireshark
View file

@ -18,7 +18,7 @@ profile wireshark @{exec_path} {
include <abstractions/graphics>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
network inet dgram,
network inet6 dgram,