mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): update steam profiles.

Browse Source 
- Still a wip stage
- Not shipped by default
This commit is contained in:
Alexandre Pujol 2024-05-18 15:02:20 +01:00
parent 5e6af16580
commit 7d1380530a
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
9 changed files with 248 additions and 115 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
apparmor.d/profiles-s-z/steam
View File

@ -2,14 +2,28 @@
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
# Security objectives of the steam profiles:
# - Ensure no user data is accessed by either steam or steam games
# - Limit what steam/games can access to the host
#
# Current architecture:
# steam
# ├── steam-fossilize
# ├── steam-reaper
# │ └── steam-game
# ├── steam-gameoverlayui
# └── steamerrorreporter
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{lib_dirs} = @{user_share_dirs}/Steam/ubuntu@{int2}_{32,64} @{share_dirs} = @{user_share_dirs}/Steam
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper
@{exec_path} = @{user_share_dirs}/Steam/steam.sh @{exec_path} = @{share_dirs}/steam.sh
profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) { profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base> include <abstractions/base>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/common/bwrap> include <abstractions/common/bwrap>
@ -31,6 +45,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
network netlink raw, network netlink raw,
ptrace (read), ptrace (read),
ptrace (trace) peer=steam,
signal (send) peer=steam-game, signal (send) peer=steam-game,
signal (read), signal (read),
@ -60,22 +75,23 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
@{bin}/zenity rix, @{bin}/zenity rix,
@{lib}/ld-linux.so* rix, @{lib}/ld-linux.so* rix,
@{lib_dirs}/* mr, @{lib_dirs}/** mr,
@{lib_dirs}/*/** mrix, @{lib_dirs}/*/** ix,
@{lib_dirs}/*driverquery rix, @{lib_dirs}/*driverquery rix,
@{lib_dirs}/fossilize_replay rpx, @{lib_dirs}/fossilize_replay rpx,
@{lib_dirs}/gameoverlayui rpx, @{lib_dirs}/gameoverlayui rpx,
@{lib_dirs}/reaper rpx, @{lib_dirs}/reaper rpx,
@{lib_dirs}/steam* rix, @{lib_dirs}/steam* rix,
@{lib}/pressure-vessel/from-host/** rix, # Entry point for steam-game
@{runtime_dirs}/*entry-point rpx,
@{run}/host/@{bin}/* rix, @{lib}/pressure-vessel/from-host/** rix,
@{run}/host/@{lib}/** rix, @{run}/host/@{bin}/* rix,
@{run}/host/@{lib}/** rix,
@{user_share_dirs}/Steam/config/widevine/linux-*/libwidevinecdm.so mr, @{share_dirs}/linux{32,64}/steamerrorreporter rpx,
@{user_share_dirs}/Steam/linux{32,64}/steamerrorreporter rpx, @{share_dirs}/config/cefdata/WidevineCdm/**/linux_*/libwidevinecdm.so rm,
@{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier/*entry-point rpx,
/usr/lib/os-release rk, /usr/lib/os-release rk,
/usr/share/fonts/**.{ttf,otf} rk, /usr/share/fonts/**.{ttf,otf} rk,
@ -93,11 +109,15 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
/etc/ r, /etc/ r,
/home/ r, /home/ r,
/run/ r, /run/ r,
/usr/ r,
/usr/local/ r,
/usr/local/lib/ r,
/var/ r, /var/ r,
owner /bindfile@{rand6} rw, owner /bindfile@{rand6} rw,
owner /var/pressure-vessel/** rw, owner /var/pressure-vessel/** rw,
owner /var/cache/ldconfig/aux-cache* rw,
owner @{HOME}/ r, owner @{HOME}/ r,
owner @{HOME}/.steam/{,**} rw, owner @{HOME}/.steam/{,**} rw,
@ -105,7 +125,11 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
owner @{HOME}/.steampath rw, owner @{HOME}/.steampath rw,
owner @{HOME}/.steampid rw, owner @{HOME}/.steampid rw,
owner @{user_games_dirs}/{,**} rwlk, owner @{share_dirs}/ rw,
owner @{share_dirs}/** rwkl -> @{share_dirs}/**,
owner @{user_games_dirs}/ rw,
owner @{user_games_dirs}/** rwlk -> @{user_games_dirs}/**,
owner @{user_config_dirs}/autostart/ r, owner @{user_config_dirs}/autostart/ r,
owner @{user_config_dirs}/cef_user_data/{,**} r, owner @{user_config_dirs}/cef_user_data/{,**} r,
@ -116,8 +140,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
owner @{user_share_dirs}/applications/*.desktop w, owner @{user_share_dirs}/applications/*.desktop w,
owner @{user_share_dirs}/icons/hicolor/**/apps/steam*.png rw, owner @{user_share_dirs}/icons/hicolor/**/apps/steam*.png rw,
owner @{user_share_dirs}/Steam/ rw,
owner @{user_share_dirs}/Steam/** rwkl -> @{user_share_dirs}/Steam/**,
owner @{user_share_dirs}/vulkan/implicit_layer.d/steam*.json rwk, owner @{user_share_dirs}/vulkan/implicit_layer.d/steam*.json rwk,
owner /dev/shm/#@{int} rw, owner /dev/shm/#@{int} rw,
@ -126,20 +148,25 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
owner /dev/shm/ValveIPCSHM_@{uid} rw, owner /dev/shm/ValveIPCSHM_@{uid} rw,
owner @{tmp}/#@{int} w, @{tmp}/ r,
owner @{tmp}/#@{int} rw,
owner @{tmp}/dumps/ rw, owner @{tmp}/dumps/ rw,
owner @{tmp}/dumps/{assert,crash}_@{int}_@{int}.dmp rw, owner @{tmp}/dumps/** rwk,
owner @{tmp}/dumps/*/ r,
owner @{tmp}/dumps/settings.dat rwk,
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
owner @{tmp}/miles_image_* mrw, owner @{tmp}/miles_image_* mrw,
owner @{tmp}/pressure-vessel-*-@{rand6}/** rw, owner @{tmp}/pressure-vessel-*-@{rand6}/ rw,
owner @{tmp}/pressure-vessel-*-@{rand6}/** rwlk -> @{tmp}/pressure-vessel-*-@{rand6}/**,
owner @{tmp}/runtime-info.txt.* rwk, owner @{tmp}/runtime-info.txt.* rwk,
owner @{tmp}/sh-thd.* rw, owner @{tmp}/sh-thd.* rw,
owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw, owner @{tmp}/steam_chrome_shmem_uid@{uid}_spid@{int} rw,
owner @{tmp}/steam@{rand6}/{,**} rw, owner @{tmp}/steam@{rand6}/{,**} rw,
owner @{tmp}/steam/ rw,
owner @{tmp}/steam/** rwk,
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,
owner @{run}/pressure-vessel/** r,
owner @{run}/user/@{uid}/ r,
@{run}/host/{,**} r, @{run}/host/{,**} r,
@{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad
@ -157,20 +184,18 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
@{sys}/class/hidraw/ r, @{sys}/class/hidraw/ r,
@{sys}/class/input/ r, @{sys}/class/input/ r,
@{sys}/class/net/ r, @{sys}/class/net/ r,
@{sys}/devices/@{pci}/class r,
@{sys}/devices/@{pci}/i2c-@{int}/{,**/}report_descriptor r,
@{sys}/devices/@{pci}/sound/card@{int}/** r,
@{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r,
@{sys}/devices/**/input@{int}/ r, @{sys}/devices/**/input@{int}/ r,
@{sys}/devices/**/input@{int}/capabilities/* r, @{sys}/devices/**/input@{int}/capabilities/* r,
@{sys}/devices/**/input/input@{int}/ r, @{sys}/devices/**/input/input@{int}/ r,
@{sys}/devices/**/input/input@{int}/properties r,
@{sys}/devices/**/uevent r, @{sys}/devices/**/uevent r,
@{sys}/devices/@{pci}/class r,
@{sys}/devices/@{pci}/i2c-@{int}/report_descriptor r,
@{sys}/devices/@{pci}/sound/card@{int}/** r,
@{sys}/devices/@{pci}/usb@{int}/{manufacturer,product,bcdDevice,bInterfaceNumber} r,
@{sys}/devices/system/cpu/** r, @{sys}/devices/system/cpu/** r,
@{sys}/devices/system/node/ r, @{sys}/devices/system/node/ r,
@{sys}/devices/virtual/dmi/id/bios_version rk, @{sys}/devices/virtual/**/report_descriptor r,
@{sys}/devices/virtual/dmi/id/board_{vendor,name,version} rk,
@{sys}/devices/virtual/dmi/id/product_{name,version} r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/net/*/ r, @{sys}/devices/virtual/net/*/ r,
@{sys}/devices/virtual/tty/tty@{int}/active r, @{sys}/devices/virtual/tty/tty@{int}/active r,
@{sys}/kernel/ r, @{sys}/kernel/ r,
@ -180,6 +205,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
@{PROC}/@{pids}/comm rk, @{PROC}/@{pids}/comm rk,
@{PROC}/@{pids}/net/route r, @{PROC}/@{pids}/net/route r,
@{PROC}/@{pids}/stat r, @{PROC}/@{pids}/stat r,
@{PROC}/locks r,
@{PROC}/@{pid}/net/* r, @{PROC}/@{pid}/net/* r,
@{PROC}/1/cgroup r, @{PROC}/1/cgroup r,
@{PROC}/sys/fs/inotify/max_user_watches r, @{PROC}/sys/fs/inotify/max_user_watches r,
@ -189,6 +215,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r, @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
@{PROC}/sys/user/max_user_namespaces r, @{PROC}/sys/user/max_user_namespaces r,
@{PROC}/version r, @{PROC}/version r,
owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/autogroup rw, owner @{PROC}/@{pid}/autogroup rw,
owner @{PROC}/@{pid}/cmdline rk, owner @{PROC}/@{pid}/cmdline rk,
owner @{PROC}/@{pid}/environ r, owner @{PROC}/@{pid}/environ r,
@ -206,7 +233,6 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
/dev/input/event@{int} r, /dev/input/event@{int} r,
/dev/tty rw, /dev/tty rw,
/dev/uinput w, /dev/uinput w,
/dev/video@{int} rw,
audit deny /**.steam_exec_test.sh rw, audit deny /**.steam_exec_test.sh rw,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,

24
apparmor.d/profiles-s-z/steam-fossilize
View File

@ -6,33 +6,37 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64} @{share_dirs} = @{user_share_dirs}/Steam
@{exec_path} = @{steam_lib_dirs}/fossilize_replay @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper
@{exec_path} = @{lib_dirs}/fossilize_replay
profile steam-fossilize @{exec_path} flags=(attach_disconnected) { profile steam-fossilize @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/graphics> include <abstractions/graphics>
include <abstractions/wayland>
include <abstractions/X-strict>
@{exec_path} mr, @{exec_path} mr,
@{steam_lib_dirs}/*.so* mr, @{lib_dirs}/*.so* mr,
owner @{HOME}/.steam/steam.pipe r, owner @{HOME}/.steam/steam.pipe r,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/fozpipelinesv@{int}/{,**} rw, owner @{share_dirs}/steamapps/shadercache/@{int}/fozpipelinesv@{int}/{,**} rw,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/mesa_shader_cache_sf/{,**} rwk, owner @{share_dirs}/steamapps/shadercache/@{int}/mesa_shader_cache_sf/{,**} rwk,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/ rw, owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/ rw,
owner @{user_share_dirs}/Steam/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/** rwk, owner @{share_dirs}/steamapps/shadercache/@{int}/nvidiav@{int}/GLCache/** rwk,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw, owner /dev/shm/fossilize-*-@{int}-@{int} rw,
@{sys}/devices/system/node/node@{int}/cpumap r, @{sys}/devices/system/node/node@{int}/cpumap r,
@{PROC}/@{pids}/statm r, @{PROC}/@{pids}/statm r,
@{PROC}/pressure/io r, @{PROC}/pressure/io r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner /dev/shm/fossilize-*-@{int}-@{int} rw,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
include if exists <local/steam-fossilize> include if exists <local/steam-fossilize>

122
apparmor.d/profiles-s-z/steam-game
View File

@ -9,19 +9,25 @@
# - steam-game-native for native linux games # - steam-game-native for native linux games
# - steam-runtime for all runtime related task up to the creation of the sandbox # - steam-runtime for all runtime related task up to the creation of the sandbox
# - steam-game-proton for the sandboxed proton games # - steam-game-proton for the sandboxed proton games
# Requirments: #
# - AppArmor supports for {*^} regex # Tasks:
# - AppArmor supports change profile from pivot_root # - AppArmor supports for {*^} regex, or find an alternative
# - Bypass no-new-privs issue # - AppArmor supports change profile from pivot_root
# - Stack steam//&game to bypass no-new-privs issue
#
# The current version of this profile is not very useful as it is very similar
# to the main steam profile.
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{runtime} = @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier @{share_dirs} = @{user_share_dirs}/Steam
@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64} @{lib_dirs} = @{share_dirs}/ubuntu@{int}_{32,64}
@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper
@{exec_path} = @{user_share_dirs}/Steam/steamapps/common/*/** @{exec_path} = @{share_dirs}/steamapps/common/*/**
@{exec_path} += @{lib_dirs}/steam-runtime-sniper/*entry-point
profile steam-game @{exec_path} flags=(attach_disconnected) { profile steam-game @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/audio-client> include <abstractions/audio-client>
@ -64,39 +70,36 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
@{bin}/uname rix, @{bin}/uname rix,
@{bin}/xdg-open rPx, @{bin}/xdg-open rPx,
@{lib}/pressure-vessel/from-host/bin/pressure-vessel-adverb rix, @{lib}/pressure-vessel/from-host/@{bin}/* rix,
@{lib}/pressure-vessel/from-host/bin/pressure-vessel-locale-gen rix, @{lib}/pressure-vessel/from-host/@{lib}/** rix,
@{lib}/pressure-vessel/from-host/bin/pressure-vessel-try-setlocale rix, @{lib}/steam-runtime-tools*/* mrix,
@{lib}/pressure-vessel/from-host/libexec/steam-runtime-tools-*/*-detect-platform rix,
@{lib}/steam-runtime-tools*/* mrix,
@{runtime}/pressure-vessel/bin/pressure-vessel-unruntime rix, @{lib_dirs}/{,**} r,
@{runtime}/pressure-vessel/bin/pressure-vessel-wrap rix, @{lib_dirs}/**.so* mr,
@{runtime}/pressure-vessel/bin/pv-bwrap rix, @{lib_dirs}/reaper rix,
@{runtime}/pressure-vessel/bin/steam-runtime-launcher-interface-* rix, @{lib_dirs}/steam-launch-wrapper rm,
@{runtime}/pressure-vessel/lib{,exec}/ r, @{lib_dirs}/steam-runtime/@{lib}/** mrix,
@{runtime}/pressure-vessel/lib{,exec}/** mrix,
@{runtime}/run rix,
@{steam_lib_dirs}/{,**} r, @{runtime_dirs}/pressure-vessel/@{bin}/ r,
@{steam_lib_dirs}/**.so* mr, @{runtime_dirs}/pressure-vessel/@{bin}/* rix,
@{steam_lib_dirs}/reaper rix, @{runtime_dirs}/pressure-vessel/@{lib}/ r,
@{steam_lib_dirs}/steam-launch-wrapper rm, @{runtime_dirs}/pressure-vessel/@{lib}/** mrix,
@{steam_lib_dirs}/steam-runtime/{usr/,}lib{exec,}/** mrix, @{runtime_dirs}/run rix,
@{user_share_dirs}/Steam/bin/ r,
@{user_share_dirs}/Steam/bin/* mr, @{share_dirs}/@{bin}/ r,
@{user_share_dirs}/Steam/d3ddriverquery64.dxvk-cache rw, @{share_dirs}/@{bin}/* mr,
@{user_share_dirs}/Steam/legacycompat/ r, @{share_dirs}/d3ddriverquery64.dxvk-cache rw,
@{user_share_dirs}/Steam/legacycompat/** mr, @{share_dirs}/legacycompat/ r,
@{user_share_dirs}/Steam/linux{32,64}/ r, @{share_dirs}/legacycompat/** mr,
@{user_share_dirs}/Steam/linux{32,64}/**.so* mr, @{share_dirs}/linux{32,64}/ r,
@{user_share_dirs}/Steam/standalone_installscript_progress_@{int}.vdf rw, @{share_dirs}/linux{32,64}/**.so* mr,
@{user_share_dirs}/Steam/steamapps/common/*/* mr, @{share_dirs}/standalone_installscript_progress_@{int}.vdf rw,
@{user_share_dirs}/Steam/steamapps/common/Proton*/ r, @{share_dirs}/steamapps/common/*/* mr,
@{user_share_dirs}/Steam/steamapps/common/Proton*/files/bin/* mrix, @{share_dirs}/steamapps/common/Proton*/ r,
@{user_share_dirs}/Steam/steamapps/common/Proton*/files/lib{,32,64}/** mrix, @{share_dirs}/steamapps/common/Proton*/files/@{bin}/* mrix,
@{user_share_dirs}/Steam/steamapps/common/Proton*/proton rix, @{share_dirs}/steamapps/common/Proton*/files/@{lib}/** mrix,
@{user_share_dirs}/Steam/steamapps/compatdata/@{int}/pfx/**.dll rm, @{share_dirs}/steamapps/common/Proton*/proton rix,
@{share_dirs}/steamapps/compatdata/@{int}/pfx/**.dll rm,
@{user_games_dirs}/*/* mr, @{user_games_dirs}/*/* mr,
@{user_games_dirs}/*/**.dll mr, @{user_games_dirs}/*/**.dll mr,
@ -111,8 +114,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
/etc/udev/udev.conf r, /etc/udev/udev.conf r,
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
/var/cache/ldconfig/aux-cache* rw,
/ r, / r,
/{usr/,}{local/,} r, /{usr/,}{local/,} r,
/{usr/,}{local/,}lib{,32,64}/ r, /{usr/,}{local/,}lib{,32,64}/ r,
@ -120,6 +121,9 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
/home/ r, /home/ r,
/tmp/ r, /tmp/ r,
owner /var/pressure-vessel/** rw,
owner /var/cache/ldconfig/aux-cache* rw,
owner @{HOME}/ r, owner @{HOME}/ r,
owner @{HOME}/.steam/steam.pid r, owner @{HOME}/.steam/steam.pid r,
owner @{HOME}/.steam/steam.pipe r, owner @{HOME}/.steam/steam.pipe r,
@ -129,21 +133,20 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/unity3d/{,**} rwk, owner @{user_config_dirs}/unity3d/{,**} rwk,
owner @{user_share_dirs}/ r, owner @{share_dirs}/ r,
owner @{user_share_dirs}/Steam/ r, owner @{share_dirs}/* r,
owner @{user_share_dirs}/Steam/* r, owner @{share_dirs}/*log* rw,
owner @{user_share_dirs}/Steam/*log* rw, owner @{share_dirs}/config/config.vdf* rw,
owner @{user_share_dirs}/Steam/config/config.vdf* rw, owner @{share_dirs}/logs/{,*} rw,
owner @{user_share_dirs}/Steam/logs/{,*} rw, owner @{share_dirs}/shader_cache_temp*/fozpipelinesv*/{,**} rw,
owner @{user_share_dirs}/Steam/shader_cache_temp*/fozpipelinesv*/{,**} rw, owner @{share_dirs}/steamapps/ r,
owner @{user_share_dirs}/Steam/steamapps/ r, owner @{share_dirs}/steamapps/common/ r,
owner @{user_share_dirs}/Steam/steamapps/common/ r, owner @{share_dirs}/steamapps/common/*/ r,
owner @{user_share_dirs}/Steam/steamapps/common/*/ r, owner @{share_dirs}/steamapps/common/*/** rwkl,
owner @{user_share_dirs}/Steam/steamapps/common/*/** rwkl, owner @{share_dirs}/steamapps/common/Proton*/files/share/{,**} r,
owner @{user_share_dirs}/Steam/steamapps/common/Proton*/files/share/{,**} r, owner @{share_dirs}/steamapps/compatdata/{,**} rwk,
owner @{user_share_dirs}/Steam/steamapps/compatdata/{,**} rwk, owner @{share_dirs}/steamapps/shadercache/{,**} rwk,
owner @{user_share_dirs}/Steam/steamapps/shadercache/{,**} rwk, owner @{share_dirs}/userdata/**/remotecache.vdf rw,
owner @{user_share_dirs}/Steam/userdata/**/remotecache.vdf rw,
@{run}/host/ r, @{run}/host/ r,
@{run}/host/container-manager r, @{run}/host/container-manager r,
@ -161,10 +164,15 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
owner /dev/shm/ValveIPCSHM_@{uid} rw, owner /dev/shm/ValveIPCSHM_@{uid} rw,
owner /dev/shm/wine-*-fsync rw, owner /dev/shm/wine-*-fsync rw,
owner @{tmp}/ r,
owner @{tmp}/.wine-@{int}/ rw,
owner @{tmp}/.wine-@{int}/** rwk,
owner @{tmp}/.wine-@{uid}/server-*/* rwk, owner @{tmp}/.wine-@{uid}/server-*/* rwk,
owner @{tmp}/** rw, owner @{tmp}/#@{int} rw,
owner @{tmp}/CASESENSITIVETEST@{hex32} rw,
owner @{tmp}/miles_image_* mr, owner @{tmp}/miles_image_* mr,
owner @{tmp}/pressure-vessel-*/{,**} rwl, owner @{tmp}/pressure-vessel-*/{,**} rwl,
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,
@{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad @{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad
@ -193,11 +201,13 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/net/dev r, @{PROC}/@{pids}/net/dev r,
@{PROC}/@{pids}/net/route r, @{PROC}/@{pids}/net/route r,
@{PROC}/sys/net/core/bpf_jit_enable r,
@{PROC}/uptime r, @{PROC}/uptime r,
@{PROC}/version r, @{PROC}/version r,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/pagemap r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,

30
apparmor.d/profiles-s-z/steam-gameoverlayui
View File

@ -6,10 +6,12 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu@{int2}_{32,64} @{share_dirs} = @{user_share_dirs}/Steam
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper
@{exec_path} = @{steam_lib_dirs}/gameoverlayui @{exec_path} = @{lib_dirs}/gameoverlayui
profile steam-gameoverlayui @{exec_path} { profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/desktop> include <abstractions/desktop>
@ -22,8 +24,8 @@ profile steam-gameoverlayui @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{steam_lib_dirs}/*.so* mr, @{lib_dirs}/*.so* mr,
@{steam_lib_dirs}/steam-runtime/@{lib}/**.so* mr, @{lib_dirs}/steam-runtime/@{lib}/**.so* mr,
/usr/share/fonts/{,**} rk, # ? /usr/share/fonts/{,**} rk, # ?
@ -34,12 +36,13 @@ profile steam-gameoverlayui @{exec_path} {
owner @{HOME}/ r, owner @{HOME}/ r,
owner @{HOME}/.steam/registry.vdf rk, owner @{HOME}/.steam/registry.vdf rk,
owner @{HOME}/.steam/steam.pipe r, owner @{HOME}/.steam/steam.pipe r,
owner @{steam_lib_dirs}/fontconfig/{,**} rwl, owner @{lib_dirs}/fontconfig/{,**} rwl,
owner @{user_share_dirs}/Steam/{,**} r,
owner @{user_share_dirs}/Steam/config/DialogConfigOverlay*.vdf rw, owner @{share_dirs}/{,**} r,
owner @{user_share_dirs}/Steam/public/* rk, owner @{share_dirs}/config/DialogConfigOverlay*.vdf rw,
owner @{user_share_dirs}/Steam/resource/{,**} rk, owner @{share_dirs}/public/* rk,
owner @{user_share_dirs}/Steam/userdata/@{int}/{,**} rk, owner @{share_dirs}/resource/{,**} rk,
owner @{share_dirs}/userdata/@{int}/{,**} rk,
owner /dev/shm/u@{uid}-Shm_@{hex} rw, owner /dev/shm/u@{uid}-Shm_@{hex} rw,
owner /dev/shm/u@{uid}-ValveIPCSharedObj-* rwk, owner /dev/shm/u@{uid}-ValveIPCSharedObj-* rwk,
@ -49,6 +52,11 @@ profile steam-gameoverlayui @{exec_path} {
owner @{tmp}/steam_chrome_overlay_uid@{uid}_spid@{pids} rw, owner @{tmp}/steam_chrome_overlay_uid@{uid}_spid@{pids} rw,
owner @{tmp}/miles_image_* mrw, owner @{tmp}/miles_image_* mrw,
@{sys}/ r,
@{sys}/kernel/ r,
@{PROC}/version r,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
include if exists <local/steam-gameoverlayui> include if exists <local/steam-gameoverlayui>

21
apparmor.d/profiles-s-z/steam-reaper
View File

@ -6,25 +6,28 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64} @{share_dirs} = @{user_share_dirs}/Steam
@{exec_path} = @{steam_lib_dirs}/reaper @{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
profile steam-reaper @{exec_path} { @{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper
@{exec_path} = @{lib_dirs}/reaper
profile steam-reaper @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nvidia> include <abstractions/graphics>
unix (receive) type=stream, unix (receive) type=stream,
@{exec_path} mr, @{exec_path} mr,
@{steam_lib_dirs}/*.so* mr, @{lib_dirs}/*.so* mr,
@{steam_lib_dirs}/steam-runtime/{usr/,}lib/**.so* mr, @{lib_dirs}/steam-runtime/@{lib}/**.so* mr,
@{steam_lib_dirs}/steam-launch-wrapper rpx -> steam-game, @{lib_dirs}/steam-launch-wrapper rpx -> steam-game,
@{user_share_dirs}/Steam/steamapps/common/*/* rpx -> steam-game, @{share_dirs}/steamapps/common/*/* rpx -> steam-game,
owner @{HOME}/.steam/steam.pipe r, owner @{HOME}/.steam/steam.pipe r,
owner @{user_share_dirs}/Steam/userdata/**/remotecache.vdf rw, owner @{share_dirs}/userdata/**/remotecache.vdf rw,
owner /dev/shm/u@{uid}-Shm_@{hex} rw, owner /dev/shm/u@{uid}-Shm_@{hex} rw,
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,

43
apparmor.d/profiles-s-z/steam-runtime Normal file
View File

@ -0,0 +1,43 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{share_dirs} = @{user_share_dirs}/Steam
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper
@{exec_path} = @{bin}/steam @{bin}/steam-runtime
profile steam-runtime @{exec_path} {
include <abstractions/base>
include <abstractions/python>
unix (receive) type=stream,
@{exec_path} mr,
@{sh_path} rix,
@{bin}/cp rix,
@{bin}/dirname rix,
@{bin}/env rix,
@{bin}/id rix,
@{bin}/readlink rix,
@{lib}/steam/steam rix,
@{lib}/steam/bin_steam.sh rix,
@{share_dirs}/steam.sh rPx,
/usr/ r,
/usr/local/ r,
owner @{share_dirs}/bootstrap.tar.xz rw,
/dev/tty rw,
deny /opt/** r,
include if exists <local/steam-runtime>
}

38
apparmor.d/profiles-s-z/steamerrorreporter Normal file
View File

@ -0,0 +1,38 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{share_dirs} = @{user_share_dirs}/Steam
@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
@{runtime_dirs} = @{share_dirs}/steamapps/common/SteamLinuxRuntime_sniper
@{exec_path} = @{share_dirs}/linux{32,64}/steamerrorreporter
profile steamerrorreporter @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
network inet dgram,
network inet stream,
network inet6 dgram,
network inet6 stream,
@{exec_path} mr,
owner @{HOME}/.steam/steam.pipe r,
owner @{lib_dirs}/ r,
owner @{lib_dirs}/steam-runtime/pinned_libs_{32,64}/ r,
owner @{share_dirs}/ r,
owner @{tmp}/dumps/ r,
owner @{tmp}/dumps/*_log.txt rw,
owner @{PROC}/@{pid}/status r,
include if exists <local/steamerrorreporter>
}

1
dists/flags/main.flags
View File

@ -300,7 +300,6 @@ steam attach_disconnected,mediate_deleted,complain
steam-fossilize attach_disconnected,complain steam-fossilize attach_disconnected,complain
steam-game attach_disconnected,complain steam-game attach_disconnected,complain
steam-gameoverlayui attach_disconnected,complain steam-gameoverlayui attach_disconnected,complain
steam-launcher complain
steam-reaper attach_disconnected,complain steam-reaper attach_disconnected,complain
steam-runtime complain steam-runtime complain
steamerrorreporter complain steamerrorreporter complain

2
dists/ignore/main.ignore
View File

@ -20,3 +20,5 @@ steam-fossilize
steam-game steam-game
steam-gameoverlayui steam-gameoverlayui
steam-reaper steam-reaper
steam-runtime
steamerrorreporter