diff --git a/apparmor.d/groups/apps/signal-desktop b/apparmor.d/groups/apps/signal-desktop index e42374c6..af557d24 100644 --- a/apparmor.d/groups/apps/signal-desktop +++ b/apparmor.d/groups/apps/signal-desktop @@ -21,6 +21,7 @@ profile signal-desktop @{exec_path} { include include include + include include # Needed? @@ -95,6 +96,8 @@ profile signal-desktop @{exec_path} { /var/lib/dbus/machine-id r, /etc/machine-id r, + /usr/share/glib-2.0/schemas/gschemas.compiled r, + # No new privs /{usr/,}bin/xdg-settings rPUx, diff --git a/apparmor.d/groups/apps/telegram-desktop b/apparmor.d/groups/apps/telegram-desktop index 5fae855c..88ef11d6 100644 --- a/apparmor.d/groups/apps/telegram-desktop +++ b/apparmor.d/groups/apps/telegram-desktop @@ -21,6 +21,7 @@ profile telegram-desktop @{exec_path} { include include include + include include include include diff --git a/apparmor.d/groups/apt/apt-listchanges b/apparmor.d/groups/apt/apt-listchanges index f3efd5d3..601b1959 100644 --- a/apparmor.d/groups/apt/apt-listchanges +++ b/apparmor.d/groups/apt/apt-listchanges @@ -61,6 +61,7 @@ profile apt-listchanges @{exec_path} { owner /tmp/apt-listchanges*/*/*/*/*/*/changelog.gz rw, owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw, owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw, + owner /tmp/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw, # The following is needed when apt-listchanges uses debcconf GUI frontends. include diff --git a/apparmor.d/groups/bus/dbus-daemon b/apparmor.d/groups/bus/dbus-daemon index 04c60bd4..5ba06879 100644 --- a/apparmor.d/groups/bus/dbus-daemon +++ b/apparmor.d/groups/bus/dbus-daemon @@ -26,7 +26,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) { network bluetooth stream, network bluetooth seqpacket, - ptrace (read) peer=unconfined, + ptrace (read), @{exec_path} mr, diff --git a/apparmor.d/groups/gvfs/gvfsd-smb b/apparmor.d/groups/gvfs/gvfsd-smb index 3010e1c2..c16978d5 100644 --- a/apparmor.d/groups/gvfs/gvfsd-smb +++ b/apparmor.d/groups/gvfs/gvfsd-smb @@ -24,6 +24,8 @@ profile gvfsd-smb @{exec_path} { owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/user rw, + owner @{run}/user/@{uid}/gvfsd/socket-[a-zA-z0-9]* rw, + /usr/share/glib-2.0/schemas/gschemas.compiled r, /etc/samba/smb.conf r, diff --git a/apparmor.d/groups/gvfs/gvfsd-smb-browse b/apparmor.d/groups/gvfs/gvfsd-smb-browse index 3549a8dc..2fa5cb33 100644 --- a/apparmor.d/groups/gvfs/gvfsd-smb-browse +++ b/apparmor.d/groups/gvfs/gvfsd-smb-browse @@ -24,6 +24,8 @@ profile gvfsd-smb-browse @{exec_path} { owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/user rw, + owner @{run}/user/@{uid}/gvfsd/socket-[a-zA-z0-9]* rw, + /usr/share/glib-2.0/schemas/gschemas.compiled r, /etc/samba/smb.conf r, diff --git a/apparmor.d/groups/gvfs/gvfsd-trash b/apparmor.d/groups/gvfs/gvfsd-trash index a5246ce6..545f5a3d 100644 --- a/apparmor.d/groups/gvfs/gvfsd-trash +++ b/apparmor.d/groups/gvfs/gvfsd-trash @@ -27,7 +27,7 @@ profile gvfsd-trash @{exec_path} { @{run}/mount/utab r, owner @{run}/user/@{uid}/gvfsd/ rw, - owner @{run}/user/@{uid}/gvfsd/socket-[a-zA-z0-9]* rw, + owner @{run}/user/@{uid}/gvfsd/socket-* rw, # Can restore all user files owner @{HOME}/{,**} rw, diff --git a/apparmor.d/profiles-g-l/gajim b/apparmor.d/profiles-g-l/gajim index 6da3dc11..94ea627c 100644 --- a/apparmor.d/profiles-g-l/gajim +++ b/apparmor.d/profiles-g-l/gajim @@ -49,6 +49,9 @@ profile gajim @{exec_path} { /{usr/,}bin/gpgconf rCx -> gpg, /{usr/,}bin/gpgsm rCx -> gpg, + /{usr/,}bin/ccache rCx -> ccache, + /{usr/,}bin/{,@{multiarch}-}ld.bfd rCx -> ccache, + # External apps /{usr/,}bin/xdg-settings rPx, /{usr/,}lib/firefox/firefox rPx, @@ -98,6 +101,27 @@ profile gajim @{exec_path} { deny /usr/share/gajim/** w, + profile ccache { + include + include + + /{usr/,}bin/ccache mr, + + /{usr/,}lib/llvm-[0-9]*/bin/clang rix, + /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix, + /{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix, + /{usr/,}bin/{,@{multiarch}-}ld.bfd rix, + /{usr/,}lib/gcc/@{multiarch}/[0-9]*/collect2 rix, + + owner /tmp/cc* rw, + owner /tmp/tmp* rw, + + /media/ccache/*/** rw, + + /etc/debian_version r, + + } + profile gpg { include diff --git a/apparmor.d/profiles-g-l/git b/apparmor.d/profiles-g-l/git index 6bd18526..2acfb20e 100644 --- a/apparmor.d/profiles-g-l/git +++ b/apparmor.d/profiles-g-l/git @@ -52,6 +52,14 @@ profile git @{exec_path} { /{usr/,}bin/cat rix, /{usr/,}bin/dirname rix, + owner @{BUILD_DIR}/*/.repo/repo/hooks/* rwix, + /{usr/,}bin/mv rix, + /{usr/,}bin/whoami rix, + /{usr/,}bin/hostname rix, + /{usr/,}bin/rm rix, + /{usr/,}bin/cat rix, + /{usr/,}bin/date rix, + /{usr/,}bin/pager rPx -> child-pager, /{usr/,}bin/less rPx -> child-pager, /{usr/,}bin/more rPx -> child-pager, @@ -71,7 +79,7 @@ profile git @{exec_path} { /{usr/,}bin/vim rCx -> editor, /{usr/,}bin/vim.* rCx -> editor, - owner @{HOME}/.gitconfig rw, + owner @{HOME}/.gitconfig r, owner @{user_config_dirs}/git/{,*} rw, /usr/share/git-core/{,**} r, diff --git a/apparmor.d/profiles-g-l/iw b/apparmor.d/profiles-g-l/iw index 5497a220..6a1c85a5 100644 --- a/apparmor.d/profiles-g-l/iw +++ b/apparmor.d/profiles-g-l/iw @@ -20,6 +20,8 @@ profile iw @{exec_path} { @{exec_path} mr, + @{sys}/devices/pci[0-9]*/**/ieee80211/phy[0-9]*/index r, + # file_inherit owner /dev/tty[0-9]* rw, diff --git a/apparmor.d/profiles-m-r/nft b/apparmor.d/profiles-m-r/nft index adb54561..8a2a8aa7 100644 --- a/apparmor.d/profiles-m-r/nft +++ b/apparmor.d/profiles-m-r/nft @@ -16,6 +16,8 @@ profile nft @{exec_path} { network netlink raw, + ptrace(read), + @{exec_path} mr, owner /etc/iproute2/** r, diff --git a/apparmor.d/profiles-m-r/polkitd b/apparmor.d/profiles-m-r/polkitd index f3c4ee69..0431f84f 100644 --- a/apparmor.d/profiles-m-r/polkitd +++ b/apparmor.d/profiles-m-r/polkitd @@ -17,7 +17,7 @@ profile polkitd @{exec_path} { capability sys_ptrace, audit deny capability net_admin, - ptrace (read) peer=unconfined, + ptrace (read), @{exec_path} mr, diff --git a/apparmor.d/profiles-m-r/repo b/apparmor.d/profiles-m-r/repo index 1d83a7a9..89a30512 100644 --- a/apparmor.d/profiles-m-r/repo +++ b/apparmor.d/profiles-m-r/repo @@ -80,6 +80,7 @@ profile repo @{exec_path} { /{usr/,}bin/gpg mr, + owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**, owner @{HOME}/.repoconfig/gnupg/** rwkl -> @{HOME}/.repoconfig/gnupg/**, owner /tmp/.git_vtag_tmp* r, diff --git a/apparmor.d/profiles-s-z/update-ca-certificates b/apparmor.d/profiles-s-z/update-ca-certificates index 6763ba42..65764fb0 100644 --- a/apparmor.d/profiles-s-z/update-ca-certificates +++ b/apparmor.d/profiles-s-z/update-ca-certificates @@ -10,6 +10,7 @@ include profile update-ca-certificates @{exec_path} { include include + include include @{exec_path} r, @@ -37,7 +38,7 @@ profile update-ca-certificates @{exec_path} { /etc/ r, /etc/ca-certificates.conf r, - /etc/ssl/certs/ca-certificates.crt rw, + /etc/ssl/certs/ca-certificates.crt{,.new} rw, /etc/ssl/certs/*.pem rw, /etc/ssl/certs/[0-9a-f]*.[0-9] rw, diff --git a/apparmor.d/profiles-s-z/usr.sbin.cupsd b/apparmor.d/profiles-s-z/usr.sbin.cupsd index ef8c1af5..975e8146 100644 --- a/apparmor.d/profiles-s-z/usr.sbin.cupsd +++ b/apparmor.d/profiles-s-z/usr.sbin.cupsd @@ -72,6 +72,7 @@ /etc/pnm2ppa.conf r, /etc/printcap rwl, /etc/ssl/** r, + /etc/letsencrypt/archive/** r, @{PROC}/net/ r, @{PROC}/net/* r, @{PROC}/sys/dev/parport/** r, diff --git a/apparmor.d/profiles-s-z/wpa-action b/apparmor.d/profiles-s-z/wpa-action new file mode 100644 index 00000000..0dbbcb06 --- /dev/null +++ b/apparmor.d/profiles-s-z/wpa-action @@ -0,0 +1,42 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Mikhail Morfikov +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}sbin/wpa_action +profile wpa-action @{exec_path} { + include + + capability net_admin, + + network netlink raw, + + @{exec_path} mr, + + /{usr/,}sbin/wpa_cli rPx, + + /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}bin/logger rix, + /{usr/,}bin/ln rix, + /{usr/,}sbin/ifup rix, + /{usr/,}bin/rm rix, + /{usr/,}bin/ip rix, + /{usr/,}bin/{,e}grep rix, + /{usr/,}bin/cat rix, + /{usr/,}bin/date rix, + + /etc/wpa_supplicant/{,**} r, + + owner @{run}/wpa_action.wlan[0-9]*.ifupdown rw, + owner @{run}/wpa_action.wlan[0-9]*.timestamp rw, + owner @{run}/network/ifstate.wlan[0-9]* rwk, + owner @{run}/sendsigs.omit.d/wpasupplicant.wpa_supplicant.wlan[0-9]*.pid rw, + + /etc/network/interfaces r, + /etc/network/interfaces.d/{,*} r, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/wpa-cli b/apparmor.d/profiles-s-z/wpa-cli new file mode 100644 index 00000000..4427ff38 --- /dev/null +++ b/apparmor.d/profiles-s-z/wpa-cli @@ -0,0 +1,26 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Mikhail Morfikov +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}sbin/wpa_cli +profile wpa-cli @{exec_path} { + include + + @{exec_path} mr, + + /{usr/,}sbin/wpa_action rPx, + + owner @{run}/wpa_supplicant/ r, + owner /tmp/wpa_ctrl_@{pid}-[0-9] rw, + + # for interactive mode + /etc/inputrc r, + owner @{HOME}/.wpa_cli_history rw, + owner @{HOME}/.wpa_cli_history-[0-9]*.tmp rw, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/xorg b/apparmor.d/profiles-s-z/xorg index d17b183a..8949c39f 100644 --- a/apparmor.d/profiles-s-z/xorg +++ b/apparmor.d/profiles-s-z/xorg @@ -132,7 +132,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+input* r, # for mouse, keyboard, touchpad @{run}/udev/data/+platform* r, # for ? @{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs - #@{run}/udev/data/+dmi* r, # for ? + @{run}/udev/data/+dmi* r, # for ? @{run}/udev/data/+acpi* r, # for ? @{run}/udev/data/+hid* r, # for HID-Compliant Keyboard @{run}/udev/data/+pci* r, # for VGA compatible controller