From 415efb4ef1d5538cd628323c8fa1b010f33a2a4e Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Fri, 29 Nov 2024 15:34:10 +0000
Subject: [PATCH] feat(profile): improve some core profiles.

---
 apparmor.d/groups/systemd/networkctl |  5 ++--
 apparmor.d/profiles-a-f/cgrulesengd  | 36 ++++++++++------------------
 apparmor.d/profiles-a-f/chsh         |  4 +++-
 3 files changed, 18 insertions(+), 27 deletions(-)

diff --git a/apparmor.d/groups/systemd/networkctl b/apparmor.d/groups/systemd/networkctl
index a4bab2be..ce81686a 100644
--- a/apparmor.d/groups/systemd/networkctl
+++ b/apparmor.d/groups/systemd/networkctl
@@ -27,11 +27,10 @@ profile networkctl @{exec_path} flags=(attach_disconnected) {
   unix (bind) type=stream addr=@@{udbus}/bus/networkctl/system,
 
   #aa:dbus talk bus=system name=org.freedesktop.network1 label=systemd-networkd
-  # No label available
-  dbus send bus=system path=/org/freedesktop/network@{int}
+  dbus send bus=system path=/org/freedesktop/network1{,/**}
        interface=org.freedesktop.DBus.Properties
        member=Get
-       peer=(name=org.freedesktop.network@{int}),
+       peer=(name=org.freedesktop.network1),
 
   @{exec_path} mr,
 
diff --git a/apparmor.d/profiles-a-f/cgrulesengd b/apparmor.d/profiles-a-f/cgrulesengd
index 08b1d83b..6f31a43d 100644
--- a/apparmor.d/profiles-a-f/cgrulesengd
+++ b/apparmor.d/profiles-a-f/cgrulesengd
@@ -12,19 +12,9 @@ profile cgrulesengd @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
-  # For creating Unix domain sockets/IPC sockets:
-  #  socket(AF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR) = 3
-  #  ...
-  #  bind(3, {sa_family=AF_NETLINK, nl_pid=13284, nl_groups=0x000001}, 12) = -1 EPERM (Operation
-  #   not permitted)
-  capability net_admin,
-
-  # To remove the following errors:
-  #  readlink("/proc/12/exe", 0x7ffc9fa85cd0, 4096) = -1 EACCES (Permission denied)
-  capability sys_ptrace,
-
-  # To be able to read the /proc/ files of all processes in the system.
   capability dac_read_search,
+  capability net_admin,
+  capability sys_ptrace,
 
   network netlink dgram,
 
@@ -32,22 +22,22 @@ profile cgrulesengd @{exec_path} {
 
   @{exec_path} mr,
 
-  @{sys}/fs/cgroup/**/tasks w,
+
+  /etc/cgconfig.conf r,
+  /etc/cgconfig.d/{,*} r,
+
+  /etc/cgrules.conf r,
+  /etc/cgrules.d/{,*} r,
+
+  owner @{run}/cgred.socket w,
+
+  @{sys}/fs/cgroup/** rw,
 
         @{PROC}/ r,
         @{PROC}/@{pids}/cmdline r,
         @{PROC}/@{pids}/task/ r,
-  owner @{PROC}/@{pid}/mounts r,
         @{PROC}/cgroups r,
-
-  @{sys}/fs/cgroup/unified/cgroup.controllers r,
-
-  owner @{run}/cgred.socket w,
-
-  /etc/cgconfig.conf r,
-  /etc/cgrules.conf r,
-  /etc/cgconfig.d/ r,
-
+  owner @{PROC}/@{pid}/mounts r,
 
   include if exists <local/cgrulesengd>
 }
diff --git a/apparmor.d/profiles-a-f/chsh b/apparmor.d/profiles-a-f/chsh
index f8a2af5c..e124e4d1 100644
--- a/apparmor.d/profiles-a-f/chsh
+++ b/apparmor.d/profiles-a-f/chsh
@@ -26,11 +26,13 @@ profile chsh @{exec_path} {
 
   /etc/shells r,
 
+  /etc/.chsh.@{rand6} rw,
   /etc/passwd rw,
   /etc/passwd- w,
-  /etc/passwd+ rw,
   /etc/passwd.@{pid} w,
   /etc/passwd.lock wl -> /etc/passwd.@{pid},
+  /etc/passwd.OLD wl -> /etc/passwd,
+  /etc/passwd+ rw,
 
   /etc/shadow r,