diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh index e98fb958..5575d72b 100644 --- a/apparmor.d/groups/ssh/ssh +++ b/apparmor.d/groups/ssh/ssh @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2021 Mikhail Morfikov +# 2021 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -15,6 +16,9 @@ profile ssh @{exec_path} { network inet stream, network inet6 stream, + network inet dgram, + network inet6 dgram, + network netlink raw, @{exec_path} mr, @@ -23,8 +27,8 @@ profile ssh @{exec_path} { owner @{HOME}/@{XDG_SSH_DIR}/ r, owner @{HOME}/@{XDG_SSH_DIR}/config r, owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r, - owner @{HOME}/@{XDG_SSH_DIR}/*_rsa{,.pub} r, - owner @{HOME}/@{XDG_SSH_DIR}/*_ed25519{,.pub} r, + owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r, + owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r, /etc/ssh/ssh_config r, /etc/ssh/ssh_config.d/ r, diff --git a/apparmor.d/groups/ssh/ssh-agent b/apparmor.d/groups/ssh/ssh-agent index 6938099c..70f73bad 100644 --- a/apparmor.d/groups/ssh/ssh-agent +++ b/apparmor.d/groups/ssh/ssh-agent @@ -1,5 +1,6 @@ # apparmor.d - Full set of apparmor profiles # Copyright (C) 2018-2021 Mikhail Morfikov +# 2021 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only abi , @@ -22,6 +23,11 @@ profile ssh-agent @{exec_path} { /{usr/,}bin/sway rPUx, /{usr/,}bin/enlightenment_start rPUx, + # SSH keys + owner @{HOME}/@{XDG_SSH_DIR}/ rw, + owner @{HOME}/@{XDG_SSH_DIR}/* r, + owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r, + # When started via systemd @{run}/user/[0-9]*/openssh_agent rw, @@ -34,5 +40,7 @@ profile ssh-agent @{exec_path} { owner /dev/tty[0-9]* rw, owner @{HOME}/.xsession-errors w, + @{run}/user/1000/keyring/.ssh rw, + include if exists }