From 66b529497d0e05e8e99ae0001b8dd6ae49ca4ba3 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 13 Aug 2022 20:36:52 +0100 Subject: [PATCH] feat(profiles): initial support for steam & steam games. --- apparmor.d/profiles-s-z/steam | 188 +++++++++++++++++ apparmor.d/profiles-s-z/steam-fossilize | 44 ++++ apparmor.d/profiles-s-z/steam-game | 217 ++++++++++++++++++++ apparmor.d/profiles-s-z/steam-gameoverlayui | 54 +++++ apparmor.d/profiles-s-z/steam-reaper | 32 +++ dists/flags/main.flags | 5 + 6 files changed, 540 insertions(+) create mode 100644 apparmor.d/profiles-s-z/steam create mode 100644 apparmor.d/profiles-s-z/steam-fossilize create mode 100644 apparmor.d/profiles-s-z/steam-game create mode 100644 apparmor.d/profiles-s-z/steam-gameoverlayui create mode 100644 apparmor.d/profiles-s-z/steam-reaper diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam new file mode 100644 index 00000000..dd688cfb --- /dev/null +++ b/apparmor.d/profiles-s-z/steam @@ -0,0 +1,188 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{user_share_dirs}/Steam/steam.sh +profile steam @{exec_path} { + include + include + include + include + include + include + include + include + include + include + include + include + include + include + include + + capability sys_ptrace, + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + ptrace (read) peer=steam-*, + + signal (send) peer=steam-game, + signal (read), + + @{exec_path} mrix, + + /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}bin/basename rix, + /{usr/,}bin/cat rix, + /{usr/,}bin/cmp rix, + /{usr/,}bin/cut rix, + /{usr/,}bin/dirname rix, + /{usr/,}bin/gawk rix, + /{usr/,}bin/getopt rix, + /{usr/,}bin/grep rix, + /{usr/,}bin/head rix, + /{usr/,}bin/ldconfig rix, + /{usr/,}bin/ldd rix, + /{usr/,}bin/ln rix, + /{usr/,}bin/lspci rPx, + /{usr/,}bin/readlink rix, + /{usr/,}bin/realpath rix, + /{usr/,}bin/rm rix, + /{usr/,}bin/sed rix, + /{usr/,}bin/steam-runtime-urlopen rix, + /{usr/,}bin/tail rix, + /{usr/,}bin/tr rix, + /{usr/,}bin/uname rix, + /{usr/,}bin/which rix, + /{usr/,}bin/xdg-icon-resource rPx, + + /{usr/,}lib{32,64}/ld-linux.so* rix, + + @{user_share_dirs}/Steam/config/widevine/linux-x64/libwidevinecdm.so mr, + @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier/*entry-point rpx, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/*.so* mr, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/*driverquery rix, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/fossilize_replay rPx, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/gameoverlayui rpx, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/reaper rpx, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam rix, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime-heavy.sh rix, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime{,-heavy}/{setup,run}.sh rix, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{amd64,i386}/usr/bin/* rix, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{usr/,}lib/**.so* mr, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steamwebhelper rix, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steamwebhelper.sh rix, + + /usr/share/fonts/**.{ttf,otf} rk, + /usr/share/glib-2.0/schemas/gschemas.compiled r, + /usr/share/terminfo/x/xterm-256color r, + /usr/share/themes/{,**} r, + /usr/share/X11/{,**} r, + + /etc/lsb-release r, + /etc/udev/udev.conf r, + /etc/machine-id r, + /var/lib/dbus/machine-id r, + + / r, + /{usr/,}{local/,} r, + /{usr/,}{local/,}share/ r, + /{usr/,}lib{,32,64}/ r, + /etc/ r, + /home/ r, + + owner @{HOME}/ r, + owner @{HOME}/.local/ r, + owner @{HOME}/.steam/{,**} rw, + owner @{HOME}/.steam/registry.vdf rwk, + owner @{HOME}/.steampath rw, + owner @{HOME}/.steampid rw, + + owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/autostart/ r, + owner @{user_config_dirs}/unity3d/{,**} rwk, + + owner @{user_share_dirs}/ r, + owner @{user_share_dirs}/applications/*.desktop w, + owner @{user_share_dirs}/gvfs-metadata/{,*} r, + owner @{user_share_dirs}/icons/hicolor/**/apps/steam*.png rw, + owner @{user_share_dirs}/Steam/ rw, + owner @{user_share_dirs}/Steam/** rwkl -> @{user_share_dirs}/Steam/**, + + owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw, + + owner /dev/shm/#[0-9]* rw, + owner /dev/shm/fossilize-*-[0-9]*-[0-9]* rw, + owner /dev/shm/u@{uid}-Shm_[0-9a-f]* rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, + owner /dev/shm/ValveIPCSHM_@{uid} rw, + + owner /tmp/dumps/{assert,crash}_[0-9]*_[0-9]*.dmp rw, + owner /tmp/sh-thd.* rw, + owner /tmp/steam_chrome_shmem_uid@{uid}_spid[0-9]* rw, + owner /tmp/miles_image_* mrw, + + @{run}/udev/data/+input* r, # for mouse, keyboard, touchpad + @{run}/udev/data/+sound* r, + @{run}/udev/data/+pci* r, + + @{run}/udev/data/c13:[0-9]* r, # for /dev/input/* + @{run}/udev/data/c116:[0-9]* r, # for ALSA + @{run}/udev/data/c241:[0-9]* r, + @{run}/udev/data/n[0-9]* r, + + @{sys}/ r, + @{sys}/bus/ r, + @{sys}/bus/pci/devices/ r, + @{sys}/class/ r, + @{sys}/class/hidraw/ r, + @{sys}/class/input/ r, + @{sys}/class/net/ r, + @{sys}/class/sound/ r, + @{sys}/devices/**/input[0-9]*/ r, + @{sys}/devices/**/input[0-9]*/capabilities/* r, + @{sys}/devices/**/input/input[0-9]*/ r, + @{sys}/devices/**/uevent r, + @{sys}/devices/pci[0-9]*/**/class r, + @{sys}/devices/pci[0-9]*/**/sound/card[0-9]*/** r, + @{sys}/devices/pci[0-9]*/**/usb[0-9]*/{manufacturer,product,bcdDevice,bInterfaceNumber} r, + @{sys}/devices/system/cpu/** r, + @{sys}/devices/system/node/ r, + @{sys}/devices/virtual/net/*/ r, + @{sys}/devices/virtual/tty/tty[0-9]/active r, + @{sys}/kernel/ r, + @{sys}/power/suspend_stats/success rk, + + @{PROC}/ r, + @{PROC}/@{pids}/net/route r, + @{PROC}/@{pids}/stat r, + @{PROC}/sys/fs/inotify/max_user_watches r, + @{PROC}/sys/kernel/sched_autogroup_enabled r, + @{PROC}/sys/kernel/unprivileged_userns_clone r, + @{PROC}/sys/kernel/yama/ptrace_scope r, + @{PROC}/sys/user/max_user_namespaces r, + @{PROC}/version r, + owner @{PROC}/@{pid}/comm rk, + owner @{PROC}/@{pid}/autogroup rw, + owner @{PROC}/@{pid}/cmdline rk, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/oom_score_adj w, + owner @{PROC}/@{pid}/statm r, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{PROC}/@{pid}/task/@{tid}/status r, + + /dev/input/ r, + /dev/tty rw, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/steam-fossilize b/apparmor.d/profiles-s-z/steam-fossilize new file mode 100644 index 00000000..452f29a1 --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-fossilize @@ -0,0 +1,44 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/fossilize_replay +profile steam-fossilize @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + + @{exec_path} mr, + + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/*.so* mr, + + owner @{HOME}/.steam/steam.pipe r, + + owner @{user_share_dirs}/Steam/steamapps/shadercache/[0-9]*/fozpipelinesv[0-9]*/{,*} rw, + owner @{user_share_dirs}/Steam/steamapps/shadercache/[0-9]*/mesa_shader_cache_sf/{,**} rwk, + owner @{user_share_dirs}/Steam/steamapps/shadercache/[0-9]*/nvidiav[0-9]*/GLCache/ rw, + owner @{user_share_dirs}/Steam/steamapps/shadercache/[0-9]*/nvidiav[0-9]*/GLCache/** rwk, + + owner @{user_share_dirs}/gvfs-metadata/{,*} r, + + owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw, + + owner /dev/shm/fossilize-*-[0-9]*-[0-9]* rw, + + @{sys}/devices/system/cpu/possible r, + @{sys}/devices/system/node/ r, + @{sys}/devices/system/node/node[0-9]*/cpumap r, + + @{PROC}/@{pids}/statm r, + @{PROC}/pressure/io r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/steam-game b/apparmor.d/profiles-s-z/steam-game new file mode 100644 index 00000000..807b7959 --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-game @@ -0,0 +1,217 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Default profile for steam games + +# TODO: +# Split this profile in three: +# - steam-game-native for native linux games +# - steam-runtime for all runtime related task up to the creation of the sandbox +# - steam-game-proton for the sandboxed proton games +# Requirments: +# - AppArmor supports for {*^} regex +# - AppArmor supports change profile from pivot_root +# - Bypass no-new-privs issue + +abi , + +include + +@{steamruntime}=@{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier +@{exec_path} = @{user_share_dirs}/Steam/steamapps/common/*/** +profile steam-game @{exec_path} flags=(attach_disconnected) { + include + include + include + include + include + include + include + include + include + include + include + include + include + include + + capability setpcap, + capability sys_admin, + capability sys_ptrace, + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + mount options=(rw, silent, rslave) -> /, + mount fstype=tmpfs -> /tmp/, + mount -> /newroot/{,**}, + mount -> /oldroot/, + mount -> /tmp/newroot/, + umount /{,oldroot/}, + + pivot_root /newroot/, + pivot_root oldroot=/tmp/oldroot/ /tmp/, + + signal (receive) peer=steam, + + unix (receive) type=stream, + + @{exec_path} mrix, + + /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}bin/bwrap rix, + /{usr/,}bin/env rix, + /{usr/,}bin/getopt rix, + /{usr/,}bin/gzip rix, + /{usr/,}bin/localedef rix, + /{usr/,}bin/python3.[0-9]* rix, + /{usr/,}bin/readlink rix, + /{usr/,}bin/steam-runtime-launcher-interface-* rix, + /{usr/,}bin/timeout rix, + /{usr/,}bin/true rix, + /{usr/,}bin/uname rix, + /{usr/,}bin/xdg-open rPx, + + /{usr/,}lib/pressure-vessel/from-host/bin/pressure-vessel-adverb rix, + /{usr/,}lib/pressure-vessel/from-host/bin/pressure-vessel-locale-gen rix, + /{usr/,}lib/pressure-vessel/from-host/libexec/steam-runtime-tools-*/*-detect-platform rix, + /{usr/,}lib/pressure-vessel/from-host/bin/pressure-vessel-try-setlocale rix, + + @{steamruntime}/pressure-vessel/bin/pressure-vessel-unruntime rix, + @{steamruntime}/pressure-vessel/bin/pressure-vessel-wrap rix, + @{steamruntime}/pressure-vessel/bin/pv-bwrap rix, + @{steamruntime}/pressure-vessel/bin/steam-runtime-launcher-interface-* rix, + @{steamruntime}/pressure-vessel/lib{,exec}/ r, + @{steamruntime}/pressure-vessel/lib{,exec}/** mrix, + @{steamruntime}/run rix, + + @{user_share_dirs}/Steam/legacycompat/ r, + @{user_share_dirs}/Steam/legacycompat/** mr, + @{user_share_dirs}/Steam/linux{32,64}/ r, + @{user_share_dirs}/Steam/linux{32,64}/**.so* mr, + @{user_share_dirs}/Steam/steamapps/common/*/* mr, + @{user_share_dirs}/Steam/steamapps/common/Proton*/ r, + @{user_share_dirs}/Steam/steamapps/common/Proton*/files/bin/* mrix, + @{user_share_dirs}/Steam/steamapps/common/Proton*/files/lib{,32,64}/** mrix, + @{user_share_dirs}/Steam/steamapps/common/Proton*/proton rix, + @{user_share_dirs}/Steam/steamapps/compatdata/[0-9]*/pfx/**.dll rm, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/{,**} r, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/**.so* mr, + + @{run}/host/usr/bin/ldconfig rix, + @{run}/host/usr/lib{,32,64}/**.so* rm, + @{run}/host/usr/bin/localedef rix, + + /usr/share/egl/{,**} r, + /usr/share/icons/{,**} r, + /usr/share/terminfo/x/xterm-256color r, + + /etc/machine-id r, + /etc/udev/udev.conf r, + /var/lib/dbus/machine-id r, + + /newroot/{,**} rw, + + /var/cache/ldconfig/aux-cache* rw, + + / r, + /{usr/,}{local/,} r, + /{usr/,}{local/,}lib{,32,64}/ r, + /bindfile* rw, + /home/ r, + /tmp/ r, + + owner @{HOME}/ r, + owner @{HOME}/.local/ r, + owner @{HOME}/.steam/steam.pid r, + owner @{HOME}/.steam/steam.pipe r, + + owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/unity3d/{,**} rwk, + + owner @{user_share_dirs}/ r, + owner @{user_share_dirs}/Steam/ r, + owner @{user_share_dirs}/Steam/* r, + owner @{user_share_dirs}/Steam/*log* rw, + owner @{user_share_dirs}/Steam/steamapps/ r, + owner @{user_share_dirs}/Steam/steamapps/common/ r, + owner @{user_share_dirs}/Steam/steamapps/common/*/ r, + owner @{user_share_dirs}/Steam/steamapps/common/*/** rwkl, + owner @{user_share_dirs}/Steam/steamapps/common/Proton*/files/share/{,**} r, + owner @{user_share_dirs}/Steam/steamapps/compatdata/[0-9]*/{,**} rwk, + owner @{user_share_dirs}/Steam/steamapps/shadercache/{,**} rwk, + owner @{user_share_dirs}/Steam/userdata/**/remotecache.vdf rw, + + owner @{user_share_dirs}/gvfs-metadata/{,*} r, + + @{run}/host/fonts/{,**} r, + @{run}/host/share/{,**} r, + @{run}/host/usr/{,**} r, + owner @{run}/pressure-vessel/{,**} rw, + owner @{run}/user/@{uid}/ r, + owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw, + + owner /dev/shm/#[0-9]* rw, + owner /dev/shm/mono.* rw, + owner /dev/shm/u@{uid}-Shm_[0-9a-f]* rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, + owner /dev/shm/wine-*-fsync rw, + + owner /tmp/.wine-@{uid}/server-*/* rwk, + owner /tmp/** rw, + owner /tmp/miles_image_* mr, + owner /tmp/pressure-vessel-*/{,**} rwl, + + @{run}/udev/data/+input* r, # for mouse, keyboard, touchpad + @{run}/udev/data/+sound* r, + + @{run}/udev/data/c13:[0-9]* r, # for /dev/input/* + @{run}/udev/data/c116:[0-9]* r, # for ALSA + @{run}/udev/data/c241:[0-9]* r, + + @{sys}/ r, + @{sys}/bus/ r, + @{sys}/class/ r, + @{sys}/class/hidraw/ r, + @{sys}/class/input/ r, + @{sys}/class/sound/ r, + @{sys}/devices/**/input[0-9]*/ r, + @{sys}/devices/**/input[0-9]*/capabilities/* r, + @{sys}/devices/**/input/input[0-9]*/ r, + @{sys}/devices/**/uevent r, + @{sys}/devices/pci[0-9]*/**/sound/card[0-9]*/** r, + @{sys}/devices/pci[0-9]*/**/usb[0-9]*/{manufacturer,product,bcdDevice,bInterfaceNumber} r, + @{sys}/devices/system/clocksource/clocksource[0-9]*/current_clocksource r, + @{sys}/devices/system/cpu/** r, + @{sys}/devices/system/node/node[0-9]/cpumap r, + @{sys}/devices/system/node/online r, + @{sys}/devices/virtual/dmi/id/* r, + @{sys}/kernel/ r, + + @{PROC}/@{pids}/net/dev r, + @{PROC}/@{pids}/net/route r, + @{PROC}/sys/kernel/overflowgid r, + @{PROC}/sys/kernel/overflowuid r, + @{PROC}/uptime r, + @{PROC}/version r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/cmdline r, + owner @{PROC}/@{pid}/gid_map rw, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/setgroups rw, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + owner @{PROC}/@{pid}/task/@{tid}/stat r, + owner @{PROC}/@{pid}/uid_map rw, + + /dev/hidraw[0-9]* rw, + /dev/input/ r, + /dev/tty rw, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui new file mode 100644 index 00000000..35598b9d --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -0,0 +1,54 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/gameoverlayui +profile steam-gameoverlayui @{exec_path} { + include + include + include + + network inet stream, + network inet6 stream, + + unix (receive) type=stream, + + @{exec_path} mr, + + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/*.so* mr, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{usr/,}lib/**.so* mr, + + /usr/share/fonts/{,**} rk, # ? + + / r, + /home/ r, + /tmp/ r, + + owner @{HOME}/ r, + owner @{HOME}/.steam/registry.vdf rk, + owner @{HOME}/.steam/steam.pipe r, + owner @{user_share_dirs}/gvfs-metadata/{,*} r, + owner @{user_share_dirs}/Steam/{,**} r, + owner @{user_share_dirs}/Steam/config/DialogConfigOverlay*.vdf rw, + owner @{user_share_dirs}/Steam/public/url_list.txt rk, + + owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw, + + owner /dev/shm/u@{uid}-Shm_[0-9a-f]* rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-* rwk, + + owner /tmp/gameoverlayui.log* rw, + owner /tmp/steam_chrome_overlay_uid@{uid}_spid@{pids} rw, + + @{sys}/ r, + @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r, + @{sys}/kernel/ r, + + @{PROC}/version r, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/steam-reaper b/apparmor.d/profiles-s-z/steam-reaper new file mode 100644 index 00000000..2d2f7170 --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-reaper @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/reaper +profile steam-reaper @{exec_path} { + include + include + + unix (receive) type=stream, + + @{exec_path} mr, + + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/*.so* mr, + @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{usr/,}lib/**.so* mr, + + @{user_share_dirs}/Steam/steamapps/common/*/* rpx -> steam-game, + + owner @{HOME}/.steam/steam.pipe r, + + owner @{user_share_dirs}/gvfs-metadata/{,*} r, + owner @{user_share_dirs}/Steam/userdata/**/remotecache.vdf rw, + + owner /dev/shm/u@{uid}-Shm_[0-9a-f]* rw, + owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, + + include if exists +} \ No newline at end of file diff --git a/dists/flags/main.flags b/dists/flags/main.flags index e1c1e42d..88f0c6c1 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -141,6 +141,11 @@ splunkforwarder complain ss complain ssh complain sshd attach_disconnected,complain +steam complain +steam-fossilize attach_disconnected,complain +steam-game attach_disconnected,complain +steam-gameoverlayui complain +steam-reaper complain su complain sudo complain sulogin complain