polishing

apparmor.d/groups/bus/dbus-daemon

@@ -38,11 +38,14 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  /{usr/,}bin/ r,
   @{libexec}/*            rPUx,
   /{usr/,}lib/ibus/ibus-* rPx,
-  /{usr/,}bin/ r,
   /{usr/,}bin/[a-z0-9]*   rPUx,
   /{usr/,}lib/dbus-1.0/dbus-daemon-launch-helper rPx,
+  # Xubuntu
+  /{usr/,}lib/@{multiarch}/xfce4/xfconf/xfconfd  rPUx,
+  /{usr/,}lib/@{multiarch}/tumbler-1/tumblerd    rPUx,
 
   /etc/dbus-1/{,**} r,
 
@@ -72,6 +75,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
         @{run}/systemd/inhibit/[0-9]*.ref rw,
         @{run}/systemd/sessions/*.ref rw,
         @{run}/systemd/userdb/io.systemd.DynamicUser  w,
+        @{run}/systemd/userdb/io.systemd.Machine     rw,
         @{run}/systemd/users/@{uid} r,
 
   @{sys}/kernel/security/apparmor/.access rw,

apparmor.d/groups/systemd/systemd-logind

@@ -65,12 +65,11 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
   @{run}/systemd/seats/ rw,
   @{run}/systemd/seats/.#seat* rw,
   @{run}/systemd/seats/seat[0-9]* rw,
-  @{run}/systemd/sessions/      rw,
+  @{run}/systemd/sessions/{,*}  rw,
-  @{run}/systemd/sessions/*     r,
-  @{run}/systemd/sessions/.#*   rw,
   @{run}/systemd/sessions/*.ref rw,
   @{run}/systemd/userdb/ r,
   @{run}/systemd/userdb/io.systemd.DynamicUser rw,
+  @{run}/systemd/userdb/io.systemd.Machine     rw,
   @{run}/systemd/users/ rw,
   @{run}/systemd/users/.#* rw,
   @{run}/systemd/users/@{uid} rw,
@@ -117,16 +116,16 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
     bus="system" path="/org/freedesktop/login1{,/**}" interface="org.freedesktop.DBus.Properties" peer=(name="{org.freedesktop.DBus,:*}"),
 
   dbus (send, receive)
-    bus="system" path="/org/freedesktop/login1{,/**}" interface="org.freedesktop.login1.Manager" peer=(name="{org.freedesktop.DBus,:*}"),
+    bus="system" path="/org/freedesktop/login1/**"    interface="org.freedesktop.DBus.Properties" peer=(name="{org.freedesktop.DBus,:*}"),
 
   dbus (send, receive)
-    bus="system" path="/org/freedesktop/login1/**" interface="org.freedesktop.login1.Session" peer=(name="{org.freedesktop.DBus,:*}"),
+    bus="system" path="/org/freedesktop/login1{,/**}" interface="org.freedesktop.login1.*"        peer=(name="{org.freedesktop.DBus,:*}"),
 
   dbus receive
     bus="system" path="/org/freedesktop/login1"       interface="org.freedesktop.DBus.Introspectable" member="Introspect" peer=(name=":*"),
 
-  dbus (send, receive)
+  dbus receive
-    bus="system" path="/org/freedesktop/login1/*" interface="org.freedesktop.DBus.Properties" peer=(name="{org.freedesktop.DBus,:*}"),
+    bus="system" path="/org/freedesktop/systemd1"     interface="org.freedesktop.DBus.Properties"     member="PropertiesChanged" peer=(name=":*"),
 
   dbus send
     bus="system" path="/org/freedesktop/systemd1"     interface="org.freedesktop.systemd1.Manager"    member="{Subscribe,StartUnit,StartTransientUnit,StopUnit}" peer=(name="org.freedesktop.systemd1"),
@@ -134,9 +133,6 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
   dbus receive
     bus="system" path="/org/freedesktop/systemd1"     interface="org.freedesktop.systemd1.Manager"    member="{UnitRemoved,UnitRemoved,JobRemoved,Reloading}" peer=(name=":*"),
 
-  dbus receive
-    bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.DBus.Properties" member="PropertiesChanged" peer=(name=":*"),
-
   dbus send
     bus="system" path="/org/freedesktop/systemd1/unit/**" interface="org.freedesktop.DBus.Properties" member="Get" peer=(name="org.freedesktop.systemd1"),
 

apparmor.d/groups/systemd/systemd-tty-ask-password-agent

@@ -11,6 +11,8 @@ profile systemd-tty-ask-password-agent @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
 
+#  capability net_admin,
+
   signal (receive) set=(term cont) peer=logrotate,
 
   @{exec_path} mr,
@@ -19,6 +21,9 @@ profile systemd-tty-ask-password-agent @{exec_path} {
   @{run}/systemd/ask-password/ r,
 
   @{PROC}/@{pids}/stat r,
+  @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/cmdline r,
+  @{PROC}/1/environ r,
 
   include if exists <local/systemd-tty-ask-password-agent>
 }

apparmor.d/profiles-a-f/agetty

@@ -21,7 +21,11 @@ profile agetty @{exec_path} {
 
   /{usr/,}bin/login rPx,
 
-  /etc/issue r,
+  /{etc,run,lib,usr/lib}/issue        r,
+  /{etc,run,lib,usr/lib}/issue.d/{,*} r,
+  /{,usr/}lib/os-release  r,
+  /etc/inittab            r,
+  /etc/os-release         r,
 
   owner @{run}/agetty.reload rw,
         @{run}/resolvconf/resolv.conf r,

apparmor.d/profiles-g-l/login

@@ -18,20 +18,46 @@ profile login @{exec_path} {
   capability fsetid,
   capability setgid,
   capability setuid,
+  capability sys_resource,
+  capability audit_write,
+  capability dac_read_search,
+#  capability net_admin,
+
+#  network netlink raw,
 
   @{exec_path} mr,
 
   /{usr/,}bin/{,z,ba,da}sh  rUx,
 
   /etc/environment r,
+  /etc/motd r,
+  /etc/legal r,
+  /etc/default/locale r,
+  /etc/security/pam_env.conf r,
+  /etc/security/group.conf r,
+  /etc/security/limits.conf r,
+  /etc/security/limits.d/{,*} r,
 
   /var/log/btmp{,.[0-9]*} r,
 
   @{run}/faillock/root rwk,
   @{run}/systemd/userdb/ r,
+  @{run}/systemd/userdb/io.systemd.DynamicUser rw,
+  @{run}/dbus/system_bus_socket rw,
+  @{run}/motd.dynamic{,.new} rw,
+  @{run}/systemd/sessions/*.ref rw,
 
-  @{PROC}/@{pid}/loginuid rw,
+  owner @{PROC}/@{pid}/uid_map r,
-  @{PROC}/@{pid}/uid_map r,
+  owner @{PROC}/@{pid}/loginuid rw,
+        @{PROC}/1/limits r,
+
+  owner @{user_cache_dirs}/motd.legal-displayed rw,
+
+  dbus send
+    bus="system" path="/org/freedesktop/DBus"   interface="org.freedesktop.DBus" member="Hello" peer=(name="org.freedesktop.DBus"),
+
+  dbus send
+    bus="system" path="/org/freedesktop/login1" interface="org.freedesktop.login1.*" peer=(name="org.freedesktop.login1"),
 
   include if exists <local/login>
 }

apparmor.d/profiles-g-l/logrotate

@@ -31,6 +31,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
 
   /{usr/,}bin/{,ba,da}sh             rix,
   /{usr/,}bin/cat                    rix,
+  /{usr/,}bin/grep                   rix,
   /{usr/,}bin/kill                   rix,
   /{usr/,}bin/ls                     rix,
   /{usr/,}bin/gzip                   rix,
@@ -39,6 +40,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
   /{usr/,}lib/rsyslog/rsyslog-rotate rix,
   /{usr/,}bin/fail2ban-client                rPx,
   /{usr/,}bin/systemd-tty-ask-password-agent rPx,
+  /{usr/,}bin/my_print_defaults              rPUx,
 
   # no new privs
   #/{usr/,}bin/systemctl              rCx -> systemctl,
@@ -65,8 +67,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
   /var/lib/logrotate.status rwk,
   /var/lib/logrotate.status.tmp rw,
 
-  /var/log/   r,
+  /var/log{,.hdd}/   r,
-  /var/log/** rw,
+  /var/log{,.hdd}/** rw,
 
   # Needed to remove the following error:
   #  logrotate[]: error: could not change directory to '.'