mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 16:03:51 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): update flatpak profiles stack.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-04-28 13:51:57 +01:00
parent 65d0cfafe4
commit a63201486b
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
4 changed files with 27 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
apparmor.d/profiles-a-f/flatpak-app
View File

@ -12,9 +12,10 @@
# some applications, flatpak needs write access to the sandbox content. This is # some applications, flatpak needs write access to the sandbox content. This is
# done through bwrap and therefore in this profile. # done through bwrap and therefore in this profile.
# #
# 1. All of this will have to be improved. However, as of today, it is the only way # 1. All of this will have to be improved. However, as of today, it is the only
# to not break some (major) flatpak app. # way to not break some (major) flatpak app.
# 2. It is not a big deal as flatpak is responsible for the sandbox anyway. This this only defence in depth. # 2. It is not a big deal as flatpak is responsible for the sandbox anyway.
# This this only defence in depth.
# 3. The main purpose of this profile is to ensure all processes are confined. # 3. The main purpose of this profile is to ensure all processes are confined.
abi <abi/3.0>, abi <abi/3.0>,
@ -29,8 +30,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
capability dac_override, capability dac_override,
capability dac_read_search, capability dac_read_search,
# When bwrap is setup with setuid privileges, it needs the setuid capability. capability setuid, # Needed when bwrap is setup with setuid privileges.
capability setuid,
capability sys_resource, capability sys_resource,
network inet dgram, network inet dgram,
@ -69,6 +69,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
/app/.ref k, /app/.ref k,
/app/extra/** rw, /app/extra/** rw,
/app/lib/** rk,
/bindfile@{rand6} rw, /bindfile@{rand6} rw,
/var/lib/flatpak/app/{,**} r, /var/lib/flatpak/app/{,**} r,

3
apparmor.d/profiles-a-f/flatpak-session-helper
View File

@ -20,7 +20,10 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix,
@{bin}/dbus-monitor rPUx, @{bin}/dbus-monitor rPUx,
@{bin}/flatpak rPx,
@{bin}/ps rPx,
@{bin}/p11-kit rix, @{bin}/p11-kit rix,
@{bin}/pkexec rPx, @{bin}/pkexec rPx,
@{lib}/p11-kit/p11-kit-remote rix, @{lib}/p11-kit/p11-kit-remote rix,

3
apparmor.d/profiles-a-f/flatpak-system-helper
View File

@ -50,7 +50,7 @@ profile flatpak-system-helper @{exec_path} {
@{PROC}/@{pid}/stat r, @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/fdinfo/@{int} r,
profile gpg { profile gpg {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -68,6 +68,7 @@ profile flatpak-system-helper @{exec_path} {
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,
include if exists <local/flatpak-system-helper_gpg>
} }
include if exists <local/flatpak-system-helper> include if exists <local/flatpak-system-helper>

16
apparmor.d/profiles-a-f/flatpak-validate-icon Normal file
View File

@ -0,0 +1,16 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/flatpak-validate-icon
profile flatpak-validate-icon @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/flatpak-validate-icon>
}