mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 08:58:15 +01:00
feat(flatpak): add flatpak integration.
- Add flatpak profile - Add flatpak-bwrap subprofile: it manage the sandbox creation & has some larger access. - Add flatpak-app, default profile for sandboxed app. See Full system policy #252
This commit is contained in:
Alexandre Pujol
parent
e41779f576
commit
aa1553388b
5 changed files with 219 additions and 3 deletions
97
apparmor.d/profiles-a-f/flatpak
Normal file
97
apparmor.d/profiles-a-f/flatpak
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/flatpak
|
||||
profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/X-strict>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/bwrap rPx -> flatpak-bwrap,
|
||||
@{bin}/gpg rCx -> gpg,
|
||||
@{bin}/gpgconf rCx -> gpg,
|
||||
@{bin}/gpgsm rCx -> gpg,
|
||||
|
||||
/usr/share/gvfs/remote-volume-monitors/*.monitor r,
|
||||
/usr/share/flatpak/{,**} r,
|
||||
|
||||
/etc/flatpak/{,**} r,
|
||||
/etc/pulse/client.conf r,
|
||||
|
||||
/var/lib/flatpak/{,**} rwlk,
|
||||
/var/tmp/#@{int} rw,
|
||||
|
||||
/ r,
|
||||
|
||||
owner @{HOME}/.var/ w,
|
||||
owner @{HOME}/.var/app/{,**} rw,
|
||||
|
||||
owner @{user_cache_dirs}/flatpak/{,**} rw,
|
||||
owner @{user_config_dirs}/pulse/client.conf r,
|
||||
owner @{user_config_dirs}/user-dirs.dirs r,
|
||||
|
||||
@{user_share_dirs}/flatpak/{,**} r,
|
||||
owner @{user_share_dirs}/flatpak/{,**} rw,
|
||||
|
||||
/tmp/#@{int} rw,
|
||||
owner /dev/shm/flatpak*/{,**} rw,
|
||||
owner /tmp/ostree-gpg-*/{,**} rw,
|
||||
|
||||
@{run}/user/@{uid}/.dbus-proxy/ w,
|
||||
@{run}/user/@{uid}/dconf/user rw,
|
||||
owner @{run}/user/@{uid}/.dbus-proxy/* rw,
|
||||
owner @{run}/user/@{uid}/.flatpak/ rw,
|
||||
owner @{run}/user/@{uid}/.flatpak/** rwlk -> @{run}/user/@{uid}/.flatpak/**,
|
||||
owner @{run}/user/@{uid}/app/ w,
|
||||
owner @{run}/user/@{uid}/app/*/ w,
|
||||
|
||||
@{sys}/module/nvidia/version r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
/dev/tty rw,
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{bin}/gpg{,2} mr,
|
||||
@{bin}/gpgconf mr,
|
||||
@{bin}/gpgsm mr,
|
||||
|
||||
@{HOME}/@{XDG_GPG_DIR}/*.conf r,
|
||||
|
||||
owner /tmp/ostree-gpg-*/ rw,
|
||||
owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
|
||||
|
||||
include if exists <local/flatpak_gpg>
|
||||
}
|
||||
|
||||
include if exists <local/flatpak>
|
||||
}
|
||||
36
apparmor.d/profiles-a-f/flatpak-app
Normal file
36
apparmor.d/profiles-a-f/flatpak-app
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# Default profile for all flatpak applications. Ideally, this profile should be
|
||||
# generated by flatpak itself with settings from the flatpak manifest.
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap-app>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
ptrace peer=flatpak-bwrap//&flatpak-app,
|
||||
|
||||
signal peer=flatpak-bwrap//&flatpak-app,
|
||||
|
||||
@{bin}/** rmix,
|
||||
@{lib}/** rmix,
|
||||
/app/** rmix,
|
||||
|
||||
/var/lib/flatpak/app/{,**} r,
|
||||
|
||||
@{run}/flatpak/{,**} r,
|
||||
|
||||
include if exists <usr/flatpak-app.d>
|
||||
include if exists <local/flatpak-app>
|
||||
}
|
||||
77
apparmor.d/profiles-a-f/flatpak-bwrap
Normal file
77
apparmor.d/profiles-a-f/flatpak-bwrap
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
profile flatpak-bwrap flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap-app>
|
||||
include <abstractions/dbus>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
capability setpcap,
|
||||
capability sys_admin,
|
||||
capability sys_ptrace,
|
||||
capability sys_resource,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
mount,
|
||||
umount,
|
||||
|
||||
pivot_root oldroot=/newroot/ -> /newroot/,
|
||||
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
|
||||
|
||||
ptrace peer=flatpak-bwrap//&flatpak-app,
|
||||
|
||||
signal peer=flatpak-bwrap//&flatpak-app,
|
||||
|
||||
@{bin}/** rmix,
|
||||
@{lib}/** rmix,
|
||||
/app/** rm,
|
||||
|
||||
@{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-bwrap//>k-update-icon-cache,
|
||||
@{bin}/update-desktop-database rPx -> flatpak-bwrap//&update-desktop-database,
|
||||
@{bin}/update-mime-database rPx -> flatpak-bwrap//&update-mime-database,
|
||||
@{bin}/xdg-dbus-proxy rPx -> flatpak-bwrap//&xdg-dbus-proxy,
|
||||
/app/** rPx -> flatpak-bwrap//&flatpak-app,
|
||||
|
||||
/usr/share/flatpak/triggers/* rix,
|
||||
|
||||
/usr/.ref rk,
|
||||
|
||||
/etc/shells rw,
|
||||
|
||||
/app/.ref k,
|
||||
/app/extra/** rw,
|
||||
/bindfile@{rand6} rw,
|
||||
/newroot/{,**} rw,
|
||||
/tmp/newroot/ w,
|
||||
/tmp/oldroot/ w,
|
||||
|
||||
/var/lib/flatpak/app/{,**} r,
|
||||
/var/lib/flatpak/exports/** rw,
|
||||
/var/tmp/etilqs_@{hex} rw,
|
||||
|
||||
owner @{run}/flatpak/{,**} rk,
|
||||
owner @{run}/ld-so-cache-dir/* rw,
|
||||
|
||||
@{PROC}/sys/kernel/overflowgid r,
|
||||
@{PROC}/sys/kernel/overflowuid r,
|
||||
@{PROC}/sys/user/max_user_namespaces w,
|
||||
owner @{PROC}/@{pid}/gid_map rw,
|
||||
owner @{PROC}/@{pid}/setgroups rw,
|
||||
owner @{PROC}/@{pid}/uid_map rw,
|
||||
|
||||
include if exists <usr/flatpak-bwrap.d>
|
||||
include if exists <local/flatpak-bwrap>
|
||||
}
|
||||
|
|
@ -15,13 +15,13 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read) peer=xdg-dbus-proxy,
|
||||
ptrace (read),
|
||||
|
||||
signal (send) peer=unconfined,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/flatpak rUx,
|
||||
@{bin}/flatpak rPx,
|
||||
|
||||
/usr/share/mime/mime.cache r,
|
||||
/usr/share/xdg-desktop-portal/portals/{,*.portal} r,
|
||||
|
|
|
|||
|
|
@ -101,7 +101,13 @@ file-roller complain
|
|||
firefox-glxtest complain
|
||||
firefox-kmozillahelper complain
|
||||
firefox-vaapitest complain
|
||||
flatpak-session-helper complain
|
||||
flatpak attach_disconnected,mediate_deleted,complain
|
||||
flatpak-app attach_disconnected,mediate_deleted,complain
|
||||
flatpak-bwrap attach_disconnected,mediate_deleted,complain
|
||||
flatpak-portal attach_disconnected,complain
|
||||
flatpak-session-helper attach_disconnected,complain
|
||||
flatpak-system-helper complain
|
||||
flatpak-validate-icon complain
|
||||
fsck-ext4 complain
|
||||
fuse-overlayfs complain
|
||||
fusermount complain
|
||||
|
|
|
|||
Loading…
Reference in a new issue