diff --git a/apparmor.d/profiles-a-f/flatpak b/apparmor.d/profiles-a-f/flatpak new file mode 100644 index 00000000..46770705 --- /dev/null +++ b/apparmor.d/profiles-a-f/flatpak @@ -0,0 +1,97 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = @{bin}/flatpak +profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) { + include + include + include + include + include + include + include + include + + capability dac_override, + capability dac_read_search, + capability net_admin, + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + @{exec_path} mr, + + @{bin}/bwrap rPx -> flatpak-bwrap, + @{bin}/gpg rCx -> gpg, + @{bin}/gpgconf rCx -> gpg, + @{bin}/gpgsm rCx -> gpg, + + /usr/share/gvfs/remote-volume-monitors/*.monitor r, + /usr/share/flatpak/{,**} r, + + /etc/flatpak/{,**} r, + /etc/pulse/client.conf r, + + /var/lib/flatpak/{,**} rwlk, + /var/tmp/#@{int} rw, + + / r, + + owner @{HOME}/.var/ w, + owner @{HOME}/.var/app/{,**} rw, + + owner @{user_cache_dirs}/flatpak/{,**} rw, + owner @{user_config_dirs}/pulse/client.conf r, + owner @{user_config_dirs}/user-dirs.dirs r, + + @{user_share_dirs}/flatpak/{,**} r, + owner @{user_share_dirs}/flatpak/{,**} rw, + + /tmp/#@{int} rw, + owner /dev/shm/flatpak*/{,**} rw, + owner /tmp/ostree-gpg-*/{,**} rw, + + @{run}/user/@{uid}/.dbus-proxy/ w, + @{run}/user/@{uid}/dconf/user rw, + owner @{run}/user/@{uid}/.dbus-proxy/* rw, + owner @{run}/user/@{uid}/.flatpak/ rw, + owner @{run}/user/@{uid}/.flatpak/** rwlk -> @{run}/user/@{uid}/.flatpak/**, + owner @{run}/user/@{uid}/app/ w, + owner @{run}/user/@{uid}/app/*/ w, + + @{sys}/module/nvidia/version r, + + owner @{PROC}/@{pid}/stat r, + + deny @{user_share_dirs}/gvfs-metadata/* r, + + /dev/tty rw, + /dev/tty@{int} rw, + + profile gpg { + include + + capability dac_read_search, + + @{bin}/gpg{,2} mr, + @{bin}/gpgconf mr, + @{bin}/gpgsm mr, + + @{HOME}/@{XDG_GPG_DIR}/*.conf r, + + owner /tmp/ostree-gpg-*/ rw, + owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**, + + include if exists + } + + include if exists +} diff --git a/apparmor.d/profiles-a-f/flatpak-app b/apparmor.d/profiles-a-f/flatpak-app new file mode 100644 index 00000000..14a32bd3 --- /dev/null +++ b/apparmor.d/profiles-a-f/flatpak-app @@ -0,0 +1,36 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +# Default profile for all flatpak applications. Ideally, this profile should be +# generated by flatpak itself with settings from the flatpak manifest. + +abi , + +include + +profile flatpak-app flags=(attach_disconnected,mediate_deleted) { + include + include + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + ptrace peer=flatpak-bwrap//&flatpak-app, + + signal peer=flatpak-bwrap//&flatpak-app, + + @{bin}/** rmix, + @{lib}/** rmix, + /app/** rmix, + + /var/lib/flatpak/app/{,**} r, + + @{run}/flatpak/{,**} r, + + include if exists + include if exists +} diff --git a/apparmor.d/profiles-a-f/flatpak-bwrap b/apparmor.d/profiles-a-f/flatpak-bwrap new file mode 100644 index 00000000..de6e31c9 --- /dev/null +++ b/apparmor.d/profiles-a-f/flatpak-bwrap @@ -0,0 +1,77 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +profile flatpak-bwrap flags=(attach_disconnected,mediate_deleted) { + include + include + include + + capability dac_override, + capability dac_read_search, + capability net_admin, + capability setpcap, + capability sys_admin, + capability sys_ptrace, + capability sys_resource, + + network inet dgram, + network inet6 dgram, + network inet stream, + network inet6 stream, + network netlink raw, + + mount, + umount, + + pivot_root oldroot=/newroot/ -> /newroot/, + pivot_root oldroot=/tmp/oldroot/ -> /tmp/, + + ptrace peer=flatpak-bwrap//&flatpak-app, + + signal peer=flatpak-bwrap//&flatpak-app, + + @{bin}/** rmix, + @{lib}/** rmix, + /app/** rm, + + @{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-bwrap//>k-update-icon-cache, + @{bin}/update-desktop-database rPx -> flatpak-bwrap//&update-desktop-database, + @{bin}/update-mime-database rPx -> flatpak-bwrap//&update-mime-database, + @{bin}/xdg-dbus-proxy rPx -> flatpak-bwrap//&xdg-dbus-proxy, + /app/** rPx -> flatpak-bwrap//&flatpak-app, + + /usr/share/flatpak/triggers/* rix, + + /usr/.ref rk, + + /etc/shells rw, + + /app/.ref k, + /app/extra/** rw, + /bindfile@{rand6} rw, + /newroot/{,**} rw, + /tmp/newroot/ w, + /tmp/oldroot/ w, + + /var/lib/flatpak/app/{,**} r, + /var/lib/flatpak/exports/** rw, + /var/tmp/etilqs_@{hex} rw, + + owner @{run}/flatpak/{,**} rk, + owner @{run}/ld-so-cache-dir/* rw, + + @{PROC}/sys/kernel/overflowgid r, + @{PROC}/sys/kernel/overflowuid r, + @{PROC}/sys/user/max_user_namespaces w, + owner @{PROC}/@{pid}/gid_map rw, + owner @{PROC}/@{pid}/setgroups rw, + owner @{PROC}/@{pid}/uid_map rw, + + include if exists + include if exists +} diff --git a/apparmor.d/profiles-a-f/flatpak-portal b/apparmor.d/profiles-a-f/flatpak-portal index f96928e5..0c3ae9ee 100644 --- a/apparmor.d/profiles-a-f/flatpak-portal +++ b/apparmor.d/profiles-a-f/flatpak-portal @@ -15,13 +15,13 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) { network netlink raw, - ptrace (read) peer=xdg-dbus-proxy, + ptrace (read), signal (send) peer=unconfined, @{exec_path} mr, - @{bin}/flatpak rUx, + @{bin}/flatpak rPx, /usr/share/mime/mime.cache r, /usr/share/xdg-desktop-portal/portals/{,*.portal} r, diff --git a/dists/flags/main.flags b/dists/flags/main.flags index 71b18da3..d25e91be 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -101,7 +101,13 @@ file-roller complain firefox-glxtest complain firefox-kmozillahelper complain firefox-vaapitest complain -flatpak-session-helper complain +flatpak attach_disconnected,mediate_deleted,complain +flatpak-app attach_disconnected,mediate_deleted,complain +flatpak-bwrap attach_disconnected,mediate_deleted,complain +flatpak-portal attach_disconnected,complain +flatpak-session-helper attach_disconnected,complain +flatpak-system-helper complain +flatpak-validate-icon complain fsck-ext4 complain fuse-overlayfs complain fusermount complain