From 7d1380530aa56f31589ccc6a360a8144f3601731 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 18 May 2024 15:02:20 +0100 Subject: [PATCH] feat(profile): update steam profiles. - Still a wip stage - Not shipped by default --- apparmor.d/profiles-s-z/steam | 82 ++++++++----- apparmor.d/profiles-s-z/steam-fossilize | 24 ++-- apparmor.d/profiles-s-z/steam-game | 122 +++++++++++--------- apparmor.d/profiles-s-z/steam-gameoverlayui | 30 +++-- apparmor.d/profiles-s-z/steam-reaper | 21 ++-- apparmor.d/profiles-s-z/steam-runtime | 43 +++++++ apparmor.d/profiles-s-z/steamerrorreporter | 38 ++++++ dists/flags/main.flags | 1 - dists/ignore/main.ignore | 2 + 9 files changed, 248 insertions(+), 115 deletions(-) create mode 100644 apparmor.d/profiles-s-z/steam-runtime create mode 100644 apparmor.d/profiles-s-z/steamerrorreporter diff --git a/apparmor.d/profiles-s-z/steam b/apparmor.d/profiles-s-z/steam index ec4ae779..85f5191b 100644 --- a/apparmor.d/profiles-s-z/steam +++ b/apparmor.d/profiles-s-z/steam @@ -2,14 +2,28 @@ # Copyright (C) 2022-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only +# Security objectives of the steam profiles: +# - Ensure no user data is accessed by either steam or steam games +# - Limit what steam/games can access to the host +# +# Current architecture: +# steam +# ├── steam-fossilize +# ├── steam-reaper +# │ └── steam-game +# ├── steam-gameoverlayui +# └── steamerrorreporter + abi , include -@{lib_dirs} = @{user_share_dirs}/Steam/ubuntu@{int2}_{32,64} +@{share_dirs} = @{user_share_dirs}/Steam +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} +@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper -@{exec_path} = @{user_share_dirs}/Steam/steam.sh -profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) { +@{exec_path} = @{share_dirs}/steam.sh +profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) { include include include @@ -31,6 +45,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) network netlink raw, ptrace (read), + ptrace (trace) peer=steam, signal (send) peer=steam-game, signal (read), @@ -60,22 +75,23 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) @{bin}/zenity rix, @{lib}/ld-linux.so* rix, - @{lib_dirs}/* mr, - @{lib_dirs}/*/** mrix, + @{lib_dirs}/** mr, + @{lib_dirs}/*/** ix, @{lib_dirs}/*driverquery rix, @{lib_dirs}/fossilize_replay rpx, @{lib_dirs}/gameoverlayui rpx, @{lib_dirs}/reaper rpx, @{lib_dirs}/steam* rix, - @{lib}/pressure-vessel/from-host/** rix, + # Entry point for steam-game + @{runtime_dirs}/*entry-point rpx, - @{run}/host/@{bin}/* rix, - @{run}/host/@{lib}/** rix, + @{lib}/pressure-vessel/from-host/** rix, + @{run}/host/@{bin}/* rix, + @{run}/host/@{lib}/** rix, - @{user_share_dirs}/Steam/config/widevine/linux-*/libwidevinecdm.so mr, - @{user_share_dirs}/Steam/linux{32,64}/steamerrorreporter rpx, - @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier/*entry-point rpx, + @{share_dirs}/linux{32,64}/steamerrorreporter rpx, + @{share_dirs}/config/cefdata/WidevineCdm/**/linux_*/libwidevinecdm.so rm, /usr/lib/os-release rk, /usr/share/fonts/**.{ttf,otf} rk, @@ -93,11 +109,15 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) /etc/ r, /home/ r, /run/ r, + /usr/ r, + /usr/local/ r, + /usr/local/lib/ r, /var/ r, owner /bindfile@{rand6} rw, owner /var/pressure-vessel/** rw, + owner /var/cache/ldconfig/aux-cache* rw, owner @{HOME}/ r, owner @{HOME}/.steam/{,**} rw, @@ -105,7 +125,11 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) owner @{HOME}/.steampath rw, owner @{HOME}/.steampid rw, - owner @{user_games_dirs}/{,**} rwlk, + owner @{share_dirs}/ rw, + owner @{share_dirs}/** rwkl -> @{share_dirs}/**, + + owner @{user_games_dirs}/ rw, + owner @{user_games_dirs}/** rwlk -> @{user_games_dirs}/**, owner @{user_config_dirs}/autostart/ r, owner @{user_config_dirs}/cef_user_data/{,**} r, @@ -116,8 +140,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) owner @{user_share_dirs}/applications/*.desktop w, owner @{user_share_dirs}/icons/hicolor/**/apps/steam*.png rw, - owner @{user_share_dirs}/Steam/ rw, - owner @{user_share_dirs}/Steam/** rwkl -> @{user_share_dirs}/Steam/**, owner @{user_share_dirs}/vulkan/implicit_layer.d/steam*.json rwk, owner /dev/shm/#@{int} rw, @@ -126,20 +148,25 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, owner /dev/shm/ValveIPCSHM_@{uid} rw, - owner @{tmp}/#@{int} w, + @{tmp}/ r, + owner @{tmp}/#@{int} rw, owner @{tmp}/dumps/ rw, - owner @{tmp}/dumps/{assert,crash}_@{int}_@{int}.dmp rw, - owner @{tmp}/dumps/*/ r, - owner @{tmp}/dumps/settings.dat rwk, + owner @{tmp}/dumps/** rwk, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, owner @{tmp}/miles_image_* mrw, - owner @{tmp}/pressure-vessel-*-@{rand6}/** rw, + owner @{tmp}/pressure-vessel-*-@{rand6}/ rw, + owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**, owner @{tmp}/runtime-info.txt.* rwk, owner @{tmp}/sh-thd.* rw, owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, owner @{tmp}/steam@{rand6}/{,**} rw, + owner @{tmp}/steam/ rw, + owner @{tmp}/steam/** rwk, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, + owner @{run}/pressure-vessel/** r, + owner @{run}/user/@{uid}/ r, + @{run}/host/{,**} r, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @@ -157,20 +184,18 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) @{sys}/class/hidraw/ r, @{sys}/class/input/ r, @{sys}/class/net/ r, + @{sys}/devices/@{pci}/class r, + @{sys}/devices/@{pci}/i2c-@{int}/{,**/}report_descriptor r, + @{sys}/devices/@{pci}/sound/card@{int}/** r, + @{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r, @{sys}/devices/**/input@{int}/ r, @{sys}/devices/**/input@{int}/capabilities/* r, @{sys}/devices/**/input/input@{int}/ r, + @{sys}/devices/**/input/input@{int}/properties r, @{sys}/devices/**/uevent r, - @{sys}/devices/@{pci}/class r, - @{sys}/devices/@{pci}/i2c-@{int}/report_descriptor r, - @{sys}/devices/@{pci}/sound/card@{int}/** r, - @{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r, @{sys}/devices/system/cpu/** r, @{sys}/devices/system/node/ r, - @{sys}/devices/virtual/dmi/id/bios_version rk, - @{sys}/devices/virtual/dmi/id/board_{vendor,name,version} rk, - @{sys}/devices/virtual/dmi/id/product_{name,version} r, - @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{sys}/devices/virtual/**/report_descriptor r, @{sys}/devices/virtual/net/*/ r, @{sys}/devices/virtual/tty/tty@{int}/active r, @{sys}/kernel/ r, @@ -180,6 +205,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) @{PROC}/@{pids}/comm rk, @{PROC}/@{pids}/net/route r, @{PROC}/@{pids}/stat r, + @{PROC}/locks r, @{PROC}/@{pid}/net/* r, @{PROC}/1/cgroup r, @{PROC}/sys/fs/inotify/max_user_watches r, @@ -189,6 +215,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, @{PROC}/sys/user/max_user_namespaces r, @{PROC}/version r, + owner @{PROC}/@{pid}/mem r, owner @{PROC}/@{pid}/autogroup rw, owner @{PROC}/@{pid}/cmdline rk, owner @{PROC}/@{pid}/environ r, @@ -206,7 +233,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) /dev/input/event@{int} r, /dev/tty rw, /dev/uinput w, - /dev/video@{int} rw, audit deny /**.steam_exec_test.sh rw, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, diff --git a/apparmor.d/profiles-s-z/steam-fossilize b/apparmor.d/profiles-s-z/steam-fossilize index f708aa80..323abea8 100644 --- a/apparmor.d/profiles-s-z/steam-fossilize +++ b/apparmor.d/profiles-s-z/steam-fossilize @@ -6,33 +6,37 @@ abi , include -@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64} -@{exec_path} = @{steam_lib_dirs}/fossilize_replay +@{share_dirs} = @{user_share_dirs}/Steam +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} +@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper + +@{exec_path} = @{lib_dirs}/fossilize_replay profile steam-fossilize @{exec_path} flags=(attach_disconnected) { include include + include + include @{exec_path} mr, - @{steam_lib_dirs}/*.so* mr, + @{lib_dirs}/*.so* mr, owner @{HOME}/.steam/steam.pipe r, - owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/fozpipelinesv@{int}/{,**} rw, - owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/mesa_shader_cache_sf/{,**} rwk, - owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/ rw, - owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/** rwk, + owner @{share_dirs}/steamapps/shadercache/@{int}/fozpipelinesv@{int}/{,**} rw, + owner @{share_dirs}/steamapps/shadercache/@{int}/mesa_shader_cache_sf/{,**} rwk, + owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/ rw, + owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/** rwk, - owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw, + owner /dev/shm/fossilize-*-@{int}-@{int} rw, @{sys}/devices/system/node/node@{int}/cpumap r, @{PROC}/@{pids}/statm r, @{PROC}/pressure/io r, + owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, - owner /dev/shm/fossilize-*-@{int}-@{int} rw, - deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, include if exists diff --git a/apparmor.d/profiles-s-z/steam-game b/apparmor.d/profiles-s-z/steam-game index e476bc26..83d00145 100644 --- a/apparmor.d/profiles-s-z/steam-game +++ b/apparmor.d/profiles-s-z/steam-game @@ -9,19 +9,25 @@ # - steam-game-native for native linux games # - steam-runtime for all runtime related task up to the creation of the sandbox # - steam-game-proton for the sandboxed proton games -# Requirments: -# - AppArmor supports for {*^} regex -# - AppArmor supports change profile from pivot_root -# - Bypass no-new-privs issue +# +# Tasks: +# - AppArmor supports for {*^} regex, or find an alternative +# - AppArmor supports change profile from pivot_root +# - Stack steam//&game to bypass no-new-privs issue +# +# The current version of this profile is not very useful as it is very similar +# to the main steam profile. abi , include -@{runtime} = @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier -@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64} +@{share_dirs} = @{user_share_dirs}/Steam +@{lib_dirs} = @{share_dirs}/ubuntu@{int}_{32,64} +@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper -@{exec_path} = @{user_share_dirs}/Steam/steamapps/common/*/** +@{exec_path} = @{share_dirs}/steamapps/common/*/** +@{exec_path} += @{lib_dirs}/steam-runtime-sniper/*entry-point profile steam-game @{exec_path} flags=(attach_disconnected) { include include @@ -64,39 +70,36 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { @{bin}/uname rix, @{bin}/xdg-open rPx, - @{lib}/pressure-vessel/from-host/bin/pressure-vessel-adverb rix, - @{lib}/pressure-vessel/from-host/bin/pressure-vessel-locale-gen rix, - @{lib}/pressure-vessel/from-host/bin/pressure-vessel-try-setlocale rix, - @{lib}/pressure-vessel/from-host/libexec/steam-runtime-tools-*/*-detect-platform rix, - @{lib}/steam-runtime-tools*/* mrix, + @{lib}/pressure-vessel/from-host/@{bin}/* rix, + @{lib}/pressure-vessel/from-host/@{lib}/** rix, + @{lib}/steam-runtime-tools*/* mrix, - @{runtime}/pressure-vessel/bin/pressure-vessel-unruntime rix, - @{runtime}/pressure-vessel/bin/pressure-vessel-wrap rix, - @{runtime}/pressure-vessel/bin/pv-bwrap rix, - @{runtime}/pressure-vessel/bin/steam-runtime-launcher-interface-* rix, - @{runtime}/pressure-vessel/lib{,exec}/ r, - @{runtime}/pressure-vessel/lib{,exec}/** mrix, - @{runtime}/run rix, + @{lib_dirs}/{,**} r, + @{lib_dirs}/**.so* mr, + @{lib_dirs}/reaper rix, + @{lib_dirs}/steam-launch-wrapper rm, + @{lib_dirs}/steam-runtime/@{lib}/** mrix, - @{steam_lib_dirs}/{,**} r, - @{steam_lib_dirs}/**.so* mr, - @{steam_lib_dirs}/reaper rix, - @{steam_lib_dirs}/steam-launch-wrapper rm, - @{steam_lib_dirs}/steam-runtime/{usr/,}lib{exec,}/** mrix, - @{user_share_dirs}/Steam/bin/ r, - @{user_share_dirs}/Steam/bin/* mr, - @{user_share_dirs}/Steam/d3ddriverquery64.dxvk-cache rw, - @{user_share_dirs}/Steam/legacycompat/ r, - @{user_share_dirs}/Steam/legacycompat/** mr, - @{user_share_dirs}/Steam/linux{32,64}/ r, - @{user_share_dirs}/Steam/linux{32,64}/**.so* mr, - @{user_share_dirs}/Steam/standalone_installscript_progress_@{int}.vdf rw, - @{user_share_dirs}/Steam/steamapps/common/*/* mr, - @{user_share_dirs}/Steam/steamapps/common/Proton*/ r, - @{user_share_dirs}/Steam/steamapps/common/Proton*/files/bin/* mrix, - @{user_share_dirs}/Steam/steamapps/common/Proton*/files/lib{,32,64}/** mrix, - @{user_share_dirs}/Steam/steamapps/common/Proton*/proton rix, - @{user_share_dirs}/Steam/steamapps/compatdata/@{int}/pfx/**.dll rm, + @{runtime_dirs}/pressure-vessel/@{bin}/ r, + @{runtime_dirs}/pressure-vessel/@{bin}/* rix, + @{runtime_dirs}/pressure-vessel/@{lib}/ r, + @{runtime_dirs}/pressure-vessel/@{lib}/** mrix, + @{runtime_dirs}/run rix, + + @{share_dirs}/@{bin}/ r, + @{share_dirs}/@{bin}/* mr, + @{share_dirs}/d3ddriverquery64.dxvk-cache rw, + @{share_dirs}/legacycompat/ r, + @{share_dirs}/legacycompat/** mr, + @{share_dirs}/linux{32,64}/ r, + @{share_dirs}/linux{32,64}/**.so* mr, + @{share_dirs}/standalone_installscript_progress_@{int}.vdf rw, + @{share_dirs}/steamapps/common/*/* mr, + @{share_dirs}/steamapps/common/Proton*/ r, + @{share_dirs}/steamapps/common/Proton*/files/@{bin}/* mrix, + @{share_dirs}/steamapps/common/Proton*/files/@{lib}/** mrix, + @{share_dirs}/steamapps/common/Proton*/proton rix, + @{share_dirs}/steamapps/compatdata/@{int}/pfx/**.dll rm, @{user_games_dirs}/*/* mr, @{user_games_dirs}/*/**.dll mr, @@ -111,8 +114,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { /etc/udev/udev.conf r, /var/lib/dbus/machine-id r, - /var/cache/ldconfig/aux-cache* rw, - / r, /{usr/,}{local/,} r, /{usr/,}{local/,}lib{,32,64}/ r, @@ -120,6 +121,9 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { /home/ r, /tmp/ r, + owner /var/pressure-vessel/** rw, + owner /var/cache/ldconfig/aux-cache* rw, + owner @{HOME}/ r, owner @{HOME}/.steam/steam.pid r, owner @{HOME}/.steam/steam.pipe r, @@ -129,21 +133,20 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/unity3d/{,**} rwk, - owner @{user_share_dirs}/ r, - owner @{user_share_dirs}/Steam/ r, - owner @{user_share_dirs}/Steam/* r, - owner @{user_share_dirs}/Steam/*log* rw, - owner @{user_share_dirs}/Steam/config/config.vdf* rw, - owner @{user_share_dirs}/Steam/logs/{,*} rw, - owner @{user_share_dirs}/Steam/shader_cache_temp*/fozpipelinesv*/{,**} rw, - owner @{user_share_dirs}/Steam/steamapps/ r, - owner @{user_share_dirs}/Steam/steamapps/common/ r, - owner @{user_share_dirs}/Steam/steamapps/common/*/ r, - owner @{user_share_dirs}/Steam/steamapps/common/*/** rwkl, - owner @{user_share_dirs}/Steam/steamapps/common/Proton*/files/share/{,**} r, - owner @{user_share_dirs}/Steam/steamapps/compatdata/{,**} rwk, - owner @{user_share_dirs}/Steam/steamapps/shadercache/{,**} rwk, - owner @{user_share_dirs}/Steam/userdata/**/remotecache.vdf rw, + owner @{share_dirs}/ r, + owner @{share_dirs}/* r, + owner @{share_dirs}/*log* rw, + owner @{share_dirs}/config/config.vdf* rw, + owner @{share_dirs}/logs/{,*} rw, + owner @{share_dirs}/shader_cache_temp*/fozpipelinesv*/{,**} rw, + owner @{share_dirs}/steamapps/ r, + owner @{share_dirs}/steamapps/common/ r, + owner @{share_dirs}/steamapps/common/*/ r, + owner @{share_dirs}/steamapps/common/*/** rwkl, + owner @{share_dirs}/steamapps/common/Proton*/files/share/{,**} r, + owner @{share_dirs}/steamapps/compatdata/{,**} rwk, + owner @{share_dirs}/steamapps/shadercache/{,**} rwk, + owner @{share_dirs}/userdata/**/remotecache.vdf rw, @{run}/host/ r, @{run}/host/container-manager r, @@ -161,10 +164,15 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { owner /dev/shm/ValveIPCSHM_@{uid} rw, owner /dev/shm/wine-*-fsync rw, + owner @{tmp}/ r, + owner @{tmp}/.wine-@{int}/ rw, + owner @{tmp}/.wine-@{int}/** rwk, owner @{tmp}/.wine-@{uid}/server-*/* rwk, - owner @{tmp}/** rw, + owner @{tmp}/#@{int} rw, + owner @{tmp}/CASESENSITIVETEST@{hex32} rw, owner @{tmp}/miles_image_* mr, owner @{tmp}/pressure-vessel-*/{,**} rwl, + owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @@ -193,11 +201,13 @@ profile steam-game @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/net/dev r, @{PROC}/@{pids}/net/route r, + @{PROC}/sys/net/core/bpf_jit_enable r, @{PROC}/uptime r, @{PROC}/version r, owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, + owner @{PROC}/@{pid}/pagemap r, owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/profiles-s-z/steam-gameoverlayui b/apparmor.d/profiles-s-z/steam-gameoverlayui index b259ebd8..d41a5e64 100644 --- a/apparmor.d/profiles-s-z/steam-gameoverlayui +++ b/apparmor.d/profiles-s-z/steam-gameoverlayui @@ -6,10 +6,12 @@ abi , include -@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu@{int2}_{32,64} +@{share_dirs} = @{user_share_dirs}/Steam +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} +@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper -@{exec_path} = @{steam_lib_dirs}/gameoverlayui -profile steam-gameoverlayui @{exec_path} { +@{exec_path} = @{lib_dirs}/gameoverlayui +profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) { include include include @@ -22,8 +24,8 @@ profile steam-gameoverlayui @{exec_path} { @{exec_path} mr, - @{steam_lib_dirs}/*.so* mr, - @{steam_lib_dirs}/steam-runtime/@{lib}/**.so* mr, + @{lib_dirs}/*.so* mr, + @{lib_dirs}/steam-runtime/@{lib}/**.so* mr, /usr/share/fonts/{,**} rk, # ? @@ -34,12 +36,13 @@ profile steam-gameoverlayui @{exec_path} { owner @{HOME}/ r, owner @{HOME}/.steam/registry.vdf rk, owner @{HOME}/.steam/steam.pipe r, - owner @{steam_lib_dirs}/fontconfig/{,**} rwl, - owner @{user_share_dirs}/Steam/{,**} r, - owner @{user_share_dirs}/Steam/config/DialogConfigOverlay*.vdf rw, - owner @{user_share_dirs}/Steam/public/* rk, - owner @{user_share_dirs}/Steam/resource/{,**} rk, - owner @{user_share_dirs}/Steam/userdata/@{int}/{,**} rk, + owner @{lib_dirs}/fontconfig/{,**} rwl, + + owner @{share_dirs}/{,**} r, + owner @{share_dirs}/config/DialogConfigOverlay*.vdf rw, + owner @{share_dirs}/public/* rk, + owner @{share_dirs}/resource/{,**} rk, + owner @{share_dirs}/userdata/@{int}/{,**} rk, owner /dev/shm/u@{uid}-Shm_@{hex} rw, owner /dev/shm/u@{uid}-ValveIPCSharedObj-* rwk, @@ -49,6 +52,11 @@ profile steam-gameoverlayui @{exec_path} { owner @{tmp}/steam_chrome_overlay_uid@{uid}_spid@{pids} rw, owner @{tmp}/miles_image_* mrw, + @{sys}/ r, + @{sys}/kernel/ r, + + @{PROC}/version r, + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, include if exists diff --git a/apparmor.d/profiles-s-z/steam-reaper b/apparmor.d/profiles-s-z/steam-reaper index 7cc8cc9a..f635b131 100644 --- a/apparmor.d/profiles-s-z/steam-reaper +++ b/apparmor.d/profiles-s-z/steam-reaper @@ -6,25 +6,28 @@ abi , include -@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64} -@{exec_path} = @{steam_lib_dirs}/reaper -profile steam-reaper @{exec_path} { +@{share_dirs} = @{user_share_dirs}/Steam +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} +@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper + +@{exec_path} = @{lib_dirs}/reaper +profile steam-reaper @{exec_path} flags=(attach_disconnected) { include - include + include unix (receive) type=stream, @{exec_path} mr, - @{steam_lib_dirs}/*.so* mr, - @{steam_lib_dirs}/steam-runtime/{usr/,}lib/**.so* mr, - @{steam_lib_dirs}/steam-launch-wrapper rpx -> steam-game, + @{lib_dirs}/*.so* mr, + @{lib_dirs}/steam-runtime/@{lib}/**.so* mr, + @{lib_dirs}/steam-launch-wrapper rpx -> steam-game, - @{user_share_dirs}/Steam/steamapps/common/*/* rpx -> steam-game, + @{share_dirs}/steamapps/common/*/* rpx -> steam-game, owner @{HOME}/.steam/steam.pipe r, - owner @{user_share_dirs}/Steam/userdata/**/remotecache.vdf rw, + owner @{share_dirs}/userdata/**/remotecache.vdf rw, owner /dev/shm/u@{uid}-Shm_@{hex} rw, owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, diff --git a/apparmor.d/profiles-s-z/steam-runtime b/apparmor.d/profiles-s-z/steam-runtime new file mode 100644 index 00000000..6d04630d --- /dev/null +++ b/apparmor.d/profiles-s-z/steam-runtime @@ -0,0 +1,43 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{share_dirs} = @{user_share_dirs}/Steam +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} +@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper + +@{exec_path} = @{bin}/steam @{bin}/steam-runtime +profile steam-runtime @{exec_path} { + include + include + + unix (receive) type=stream, + + @{exec_path} mr, + + @{sh_path} rix, + @{bin}/cp rix, + @{bin}/dirname rix, + @{bin}/env rix, + @{bin}/id rix, + @{bin}/readlink rix, + + @{lib}/steam/steam rix, + @{lib}/steam/bin_steam.sh rix, + @{share_dirs}/steam.sh rPx, + + /usr/ r, + /usr/local/ r, + + owner @{share_dirs}/bootstrap.tar.xz rw, + + /dev/tty rw, + + deny /opt/** r, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/steamerrorreporter b/apparmor.d/profiles-s-z/steamerrorreporter new file mode 100644 index 00000000..c9e1bf63 --- /dev/null +++ b/apparmor.d/profiles-s-z/steamerrorreporter @@ -0,0 +1,38 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2024 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{share_dirs} = @{user_share_dirs}/Steam +@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} +@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper + +@{exec_path} = @{share_dirs}/linux{32,64}/steamerrorreporter +profile steamerrorreporter @{exec_path} { + include + include + + network inet dgram, + network inet stream, + network inet6 dgram, + network inet6 stream, + + @{exec_path} mr, + + owner @{HOME}/.steam/steam.pipe r, + + owner @{lib_dirs}/ r, + owner @{lib_dirs}/steam-runtime/pinned_libs_{32,64}/ r, + + owner @{share_dirs}/ r, + + owner @{tmp}/dumps/ r, + owner @{tmp}/dumps/*_log.txt rw, + + owner @{PROC}/@{pid}/status r, + + include if exists +} \ No newline at end of file diff --git a/dists/flags/main.flags b/dists/flags/main.flags index e90b42a3..436c1c28 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -300,7 +300,6 @@ steam attach_disconnected,mediate_deleted,complain steam-fossilize attach_disconnected,complain steam-game attach_disconnected,complain steam-gameoverlayui attach_disconnected,complain -steam-launcher complain steam-reaper attach_disconnected,complain steam-runtime complain steamerrorreporter complain diff --git a/dists/ignore/main.ignore b/dists/ignore/main.ignore index e723be33..795fbf1c 100644 --- a/dists/ignore/main.ignore +++ b/dists/ignore/main.ignore @@ -20,3 +20,5 @@ steam-fossilize steam-game steam-gameoverlayui steam-reaper +steam-runtime +steamerrorreporter