From 526dcc3252fddf0e89b87af26946c3fc8e27ac76 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 7 May 2023 20:34:00 +0100 Subject: [PATCH] feat(profiles): general update. --- apparmor.d/groups/gnome/gnome-session-binary | 1 + apparmor.d/groups/gnome/tracker-extract | 2 +- apparmor.d/groups/network/mullvad-daemon | 1 + apparmor.d/groups/ssh/ssh | 1 + apparmor.d/groups/systemd/systemd-machine-id-setup | 11 ++++++++++- apparmor.d/groups/systemd/systemd-sleep-grub2 | 4 ++++ apparmor.d/profiles-a-f/fwupd | 2 +- apparmor.d/profiles-g-l/kmod | 1 + apparmor.d/profiles-g-l/logrotate | 1 + apparmor.d/profiles-m-r/mount | 1 + apparmor.d/profiles-m-r/run-parts | 2 +- apparmor.d/profiles-s-z/slirp4netns | 7 +++---- apparmor.d/profiles-s-z/steam | 3 ++- apparmor.d/profiles-s-z/sudo | 1 + 14 files changed, 29 insertions(+), 9 deletions(-) diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 5fba4a1a..f20249b6 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -157,6 +157,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { /{usr/,}bin/aa-notify rPx, /{usr/,}bin/baloo_file rPx, + @{libexec}/baloo_file rPx, /{usr/,}bin/blueman-applet rPx, /{usr/,}bin/firewall-applet rPUx, /{usr/,}bin/gnome-keyring-daemon rPx, diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 34576d60..49c86a16 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -7,7 +7,7 @@ abi , include @{exec_path} = @{libexec}/tracker-extract-3 -profile tracker-extract @{exec_path} { +profile tracker-extract @{exec_path} flags=(attach_disconnected) { include include include diff --git a/apparmor.d/groups/network/mullvad-daemon b/apparmor.d/groups/network/mullvad-daemon index 97f96add..527d924d 100644 --- a/apparmor.d/groups/network/mullvad-daemon +++ b/apparmor.d/groups/network/mullvad-daemon @@ -40,6 +40,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { "/opt/Mullvad VPN/resources/*" r, /etc/mullvad-vpn/{,*} r, + /etc/mullvad-vpn/@{uid} rw, /etc/mullvad-vpn/*.json rw, @{etc_rw}/resolv.conf rw, @{etc_rw}/resolv.conf.mullvadbackup rw, diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index 0d2365a6..6ce12f56 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -27,6 +27,7 @@ profile ssh @{exec_path} { /{usr/,}bin/{,b,d,rb}ash rix, /{usr/,}bin/{c,k,tc,z}sh rix, + @{etc_ro}/ssh/ssh_config r, @{etc_ro}/ssh/sshd_config r, @{etc_ro}/ssh/sshd_config.d/{,*} r, diff --git a/apparmor.d/groups/systemd/systemd-machine-id-setup b/apparmor.d/groups/systemd/systemd-machine-id-setup index 1c126650..b2f09afc 100644 --- a/apparmor.d/groups/systemd/systemd-machine-id-setup +++ b/apparmor.d/groups/systemd/systemd-machine-id-setup @@ -7,16 +7,24 @@ abi , include @{exec_path} = /{usr/,}bin/systemd-machine-id-setup -profile systemd-machine-id-setup @{exec_path} { +profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) { include include capability dac_override, + capability setgid, + capability setuid, + capability sys_admin, + capability sys_chroot, ptrace (read), + mount /, + umount /etc/machine-id, + @{exec_path} mr, + / r, /etc/machine-id rw, /etc/ r, /var/ r, @@ -25,6 +33,7 @@ profile systemd-machine-id-setup @{exec_path} { @{PROC}/cmdline r, @{PROC}/sys/kernel/osrelease r, owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/setgroups r, include if exists } diff --git a/apparmor.d/groups/systemd/systemd-sleep-grub2 b/apparmor.d/groups/systemd/systemd-sleep-grub2 index 9c94e172..459f590c 100644 --- a/apparmor.d/groups/systemd/systemd-sleep-grub2 +++ b/apparmor.d/groups/systemd/systemd-sleep-grub2 @@ -18,7 +18,11 @@ profile systemd-sleep-grub @{exec_path} { /etc/sysconfig/bootloader r, + /var/lib/nscd/passwd r, + @{PROC}/@{pid}/maps r, + /dev/tty rw, + include if exists } \ No newline at end of file diff --git a/apparmor.d/profiles-a-f/fwupd b/apparmor.d/profiles-a-f/fwupd index 08336060..4ffcd520 100644 --- a/apparmor.d/profiles-a-f/fwupd +++ b/apparmor.d/profiles-a-f/fwupd @@ -88,7 +88,7 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) { /boot/EFI/*/.goutputstream-* rw, /boot/EFI/*/fw/fwupd-*.cap{,.*} rw, /boot/EFI/*/fwupdx[0-9]*.efi rw, - @{libexec}/fwupd/efi/fwupdx[0-9]*.efi r, + @{libexec}/fwupd/efi/fwupdx[0-9]*.efi r, /etc/machine-id r, /var/lib/dbus/machine-id r, diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index af6c4821..d1974498 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -55,6 +55,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) { owner @{user_build_dirs}/**/lib/modules/*/kernel/{,**/} r, owner @{user_build_dirs}/**/lib/modules/*/kernel/**/*.ko r, + @{run}/xtables.lock r, owner @{run}/tmpfiles.d/ w, owner @{run}/tmpfiles.d/static-nodes.conf w, diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate index b9aa7736..8af7cc18 100644 --- a/apparmor.d/profiles-g-l/logrotate +++ b/apparmor.d/profiles-g-l/logrotate @@ -19,6 +19,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected) { capability fsetid, capability setgid, capability setuid, + capability net_admin, audit deny capability net_admin, diff --git a/apparmor.d/profiles-m-r/mount b/apparmor.d/profiles-m-r/mount index 4fae0680..e39cce5d 100644 --- a/apparmor.d/profiles-m-r/mount +++ b/apparmor.d/profiles-m-r/mount @@ -54,6 +54,7 @@ profile mount @{exec_path} { # Mount iso/img files owner @{user_img_dirs}/{,**} rwk, + @{run}/ r, owner @{run}/mount/ rw, owner @{run}/mount/utab{,.*} rw, owner @{run}/mount/utab.lock wk, diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 307033fe..157119c0 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -162,7 +162,7 @@ profile run-parts @{exec_path} { /etc/lsb-release r, /etc/update-motd.d/[0-9]*-[a-z]* r, - /var/cache/motd-news r, + /var/cache/motd-news rw, /var/lib/update-notifier/updates-available r, /var/lib/ubuntu-advantage/messages/motd-esm-announce r, diff --git a/apparmor.d/profiles-s-z/slirp4netns b/apparmor.d/profiles-s-z/slirp4netns index c2f3d6b2..90cb3f35 100644 --- a/apparmor.d/profiles-s-z/slirp4netns +++ b/apparmor.d/profiles-s-z/slirp4netns @@ -23,7 +23,9 @@ profile slirp4netns @{exec_path} flags=(attach_disconnected) { mount, umount, - pivot_root oldroot=/tmp/old/ -> /tmp/, + pivot_root /tmp/**, + pivot_root /tmp/old/, + # pivot_root oldroot=/tmp/old/ -> /tmp/, @{exec_path} mr, @@ -34,9 +36,6 @@ profile slirp4netns @{exec_path} flags=(attach_disconnected) { @{run}/user/@{uid}/netns/cni-* r, owner @{run}/user/@{uid}/libpod/tmp/slirp4netns-*.log r, - pivot_root /tmp/**, - pivot_root /tmp/old/, - /dev/net/tun rw, include if exists diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index 26ac0143..4ab5d310 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -78,7 +78,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) /{usr/,}bin/uname rix, /{usr/,}bin/which rix, /{usr/,}bin/xdg-icon-resource rPx, - /{usr/,}bin/xdg-user-dir rPx, + /{usr/,}bin/xdg-user-dir rix, /{usr/,}bin/xz rix, /{usr/,}bin/zenity rix, /{usr/,}lib{32,64}/ld-linux.so* rix, @@ -135,6 +135,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) owner @{user_config_dirs}/autostart/ r, owner @{user_config_dirs}/cef_user_data/{,**} r, owner @{user_config_dirs}/unity3d/{,**} rwk, + owner @{user_config_dirs}/user-dirs.dirs r, owner @{user_share_dirs}/ r, owner @{user_share_dirs}/applications/*.desktop w, diff --git a/apparmor.d/profiles-s-z/sudo b/apparmor.d/profiles-s-z/sudo index b54759d4..a944362a 100644 --- a/apparmor.d/profiles-s-z/sudo +++ b/apparmor.d/profiles-s-z/sudo @@ -87,6 +87,7 @@ profile sudo @{exec_path} { @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/fd/ r, + @{PROC}/@{pids}/loginuid r, @{PROC}/@{pids}/stat r, @{PROC}/1/limits r, @{PROC}/sys/kernel/seccomp/actions_avail r,