Initial pacman profiles.

apparmor.d/groups/pacman/pacman

@@ -0,0 +1,119 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/pacman
+profile pacman @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/disks-read>
+  include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
+  include <abstractions/ssl_certs>
+
+  capability audit_write,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability fsetid,
+  capability net_admin,
+  capability setfcap,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_resource,
+
+  network inet stream,
+  network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
+  network netlink raw,
+
+  unix (receive) type=stream,
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/gpg          rCx -> gpg,
+  /{usr/,}bin/gpgconf      rCx -> gpg,
+  /{usr/,}bin/gpgsm        rCx -> gpg,
+  /{usr/,}{s,}bin/ldconfig rix,
+  /{usr/,}bin/{,ba}sh      rix,
+
+  # Pacman hooks & install scripts
+  /{usr/,}bin/arch-audit                  rPx,
+  /{usr/,}bin/bootctl                     rPx,
+  /{usr/,}bin/env                         rix,
+  /{usr/,}bin/fc-cache                    rPx,
+  /{usr/,}bin/gdk-pixbuf-query-loaders    rPx,
+  /{usr/,}bin/glib-compile-schemas        rPx,
+  /{usr/,}bin/gtk-query-immodules-3.0     rPx,
+  /{usr/,}bin/install-info                rPx,
+  /{usr/,}bin/killall                     rPx,
+  /{usr/,}bin/pacdiff                     rPx,
+  /{usr/,}bin/sysctl                      rPx,
+  /{usr/,}bin/systemctl                   rPx -> child-systemctl,
+  /{usr/,}bin/update-ca-trust             rPx,
+  /{usr/,}bin/update-desktop-database     rPx,
+  /{usr/,}bin/update-mime-database        rPx,
+  /{usr/,}bin/vercmp                      rix,
+  /{usr/,}lib/dkms/alpm-hook              rPx,
+  /{usr/,}lib/ghc-*/bin/ghc-pkg           rix,
+  /{usr/,}lib/systemd/systemd-*           rPx,
+  /{usr/,}lib/vlc/vlc-cache-gen           rPx,
+  /usr/share/libalpm/scripts/*            rPx,
+
+  # Install/update packages
+  / r,
+  /boot/{,**} rwl,
+  /etc/{,**} rwl,
+  /opt/{,**} rwl,
+  /srv/{,**} rwl,
+  /usr/{,**} rwl,
+  /var/{,**} rwl,
+
+  # Read packages files
+  @{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r,
+
+  owner /var/lib/pacman/{,**} rwl,
+  owner /tmp/alpm_*/{,**} rw,
+  owner /tmp/checkup-db-[0-9]*/sync/*.db.part rw,
+
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/mounts r,
+        @{PROC}/sys/kernel/osrelease r,
+        @{PROC}/1/environ r,
+
+  @{run}/utmp rk,
+
+  # Silencer, 
+  deny /tmp/ r,
+  deny @{HOME}/ r,
+  deny @{HOME}/@{XDG_PROJECTS_DIR}/** r,
+
+  profile gpg {
+    include <abstractions/base>
+
+    capability dac_read_search,
+
+    /{usr/,}bin/gpg     mr,
+    /{usr/,}bin/gpgconf mr,
+    /{usr/,}bin/gpgsm   mr,
+
+    /{usr/,}bin/dirmngr           rix,
+    /{usr/,}bin/gpg-agent         rix,
+    /{usr/,}bin/gpg-connect-agent rix,
+
+    @{HOME}/@{XDG_GPG_DIR}/*.conf r,
+
+    owner /etc/pacman.d/gnupg/ rw,
+    owner /etc/pacman.d/gnupg/** rwkl,
+  }
+
+  include if exists <local/pacman>
+}

apparmor.d/groups/pacman/pacman-hook-dconf

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/dconf-update
+profile pacman-hook-dconf @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash  rix,
+  /{usr/,}bin/rm    rix,
+  /{usr/,}bin/dconf rPx,
+
+  /etc/dconf/db/{,**} rw,
+
+  include if exists <local/pacman-hook-dconf>
+}

apparmor.d/groups/pacman/pacman-hook-depmod

@@ -0,0 +1,19 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/depmod
+profile pacman-hook-depmod @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash   rix,
+  /{usr/,}bin/depmod rPx,
+
+  include if exists <local/pacman-hook-depmod>
+}

apparmor.d/groups/pacman/pacman-hook-dkms

@@ -0,0 +1,16 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/dkms/alpm-hook
+profile pacman-hook-dkms @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  include if exists <local/pacman-hook-dkms>
+}

apparmor.d/groups/pacman/pacman-hook-fontconfig

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/40-fontconfig-config
+profile pacman-hook-fontconfig @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash  rix,
+  /{usr/,}bin/ln    rix,
+  /{usr/,}bin/rm    rix,
+
+  /etc/fonts/conf.d/* rwl,
+  /usr/share/fontconfig/conf.default/* r,
+
+  include if exists <local/pacman-hook-fontconfig>
+}

apparmor.d/groups/pacman/pacman-hook-gio

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/gio-querymodules
+profile pacman-hook-gio @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash             rix,
+  /{usr/,}bin/rmdir            rix,
+  /{usr/,}bin/gio-querymodules rPx,
+
+  /{usr/,}lib/gio/modules/{,**} rw,
+
+  include if exists <local/pacman-hook-gio>
+}

apparmor.d/groups/pacman/pacman-hook-gtk

@@ -0,0 +1,33 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/gtk-update-icon-cache
+profile pacman-hook-gtk @{exec_path} {
+  include <abstractions/base>
+
+  capability dac_read_search,
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash  rix,
+  /{usr/,}bin/rm    rix,
+  /{usr/,}bin/rmdir rix,
+
+  /{usr/,}bin/gtk-update-icon-cache rPx,
+  /{usr/,}bin/gtk4-update-icon-cache rPx,
+
+  /usr/share/icons/{,**} rw,
+
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
+  include if exists <local/pacman-hook-gtk>
+}

apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install

@@ -0,0 +1,38 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-install
+profile pacman-hook-mkinitcpio-install @{exec_path} {
+  include <abstractions/base>
+
+  capability dac_read_search,
+  capability mknod,
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash       rix,
+  /{usr/,}bin/compgen    rix,
+  /{usr/,}bin/install    rix,
+  /{usr/,}bin/mkinitcpio rPx,
+  /{usr/,}bin/mv         rix,
+  /{usr/,}bin/sed        rix,
+
+  /usr/share/mkinitcpio/*.preset r,
+
+  /etc/mkinitcpio.d/{,**} r,
+
+  owner /boot/vmlinuz-* rw,
+
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
+  include if exists <local/pacman-hook-mkinitcpio-install>
+}

apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove

@@ -0,0 +1,32 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-remove
+profile pacman-hook-mkinitcpio-remove @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash  rix,
+  /{usr/,}bin/rm    rix,
+  /{usr/,}bin/mv    rix,
+
+  /usr/share/mkinitcpio/*.preset r,
+
+  /boot/vmlinuz-* rw,
+  /boot/initramfs-*.img rw,
+  /boot/initramfs-*-fallback.img rw,
+
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
+  include if exists <local/pacman-hook-mkinitcpio-remove>
+}

apparmor.d/groups/pacman/pacman-hook-perl

@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/detect-old-perl-modules.sh
+profile pacman-hook-perl @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/perl    rix,
+  /{usr/,}bin/bash    rix,
+  /{usr/,}bin/find    rix,
+  /{usr/,}bin/pacman  rPx,
+  /{usr/,}bin/sed     rix,
+
+  /{usr/,}lib/perl[0-9]*/{,**} r,
+
+  /dev/tty rw,
+
+  # Inherit silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
+  include if exists <local/pacman-hook-perl>
+}

apparmor.d/groups/pacman/pacman-hook-systemd

@@ -0,0 +1,39 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/libalpm/scripts/systemd-hook
+profile pacman-hook-systemd @{exec_path} {
+  include <abstractions/base>
+
+  capability dac_read_search,
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/bash  rix,
+  /{usr/,}bin/touch rix,
+
+  /{usr/,}bin/journalctl           rPx,
+  /{usr/,}bin/systemctl            rPx -> child-systemctl,
+  /{usr/,}bin/systemd-binfmt       rPx,
+  /{usr/,}bin/systemd-detect-virt  rPx,
+  /{usr/,}bin/systemd-hwdb         rPx,
+  /{usr/,}bin/systemd-sysctl       rPx,
+  /{usr/,}bin/systemd-sysusers     rPx,
+  /{usr/,}bin/systemd-tmpfiles     rPx,
+  /{usr/,}bin/udevadm              rPx,
+
+  /usr/ rw,
+
+  /dev/tty rw,
+
+  # Inherit silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
+  include if exists <local/pacman-hook-systemd>
+}

apparmor.d/groups/pacman/pacman-key

@@ -14,7 +14,7 @@ profile pacman-key @{exec_path} {
 
   /{usr/,}bin/basename     rix,
   /{usr/,}bin/gettext      rix,
-  /{usr/,}bin/gpg          rUx,
+  /{usr/,}bin/gpg          rCx -> gpg,
   /{usr/,}bin/pacman-conf  rPx,
   /{usr/,}bin/tput         rix,
 
@@ -23,5 +23,14 @@ profile pacman-key @{exec_path} {
 
   /dev/tty rw,
 
+  profile gpg {
+    include <abstractions/base>
+
+    /{usr/,}bin/gpg mr,
+  
+    /etc/pacman.d/gnupg/ rw,
+    /etc/pacman.d/gnupg/** rwkl,
+  }
+
   include if exists <local/pacman-key>
 }