mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Profiles update.

Browse source
This commit is contained in:
Alexandre Pujol 2021-10-22 15:01:43 +01:00
parent b91ddfa493
commit aac0a93080
Failed to generate hash of commit
34 changed files with 136 additions and 144 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/totem
View file

@ -40,7 +40,7 @@
owner @{user_config_dirs}/totem/** rwk, owner @{user_config_dirs}/totem/** rwk,
owner @{user_share_dirs}/grilo-plugins/ rwk, owner @{user_share_dirs}/grilo-plugins/ rwk,
owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk, owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk,
owner @{user_share_dirs}/gvfs-metadata/** r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/totem/ rwk, owner @{user_share_dirs}/totem/ rwk,
owner @{user_share_dirs}/tracker/data/tracker-store.journal rwk, owner @{user_share_dirs}/tracker/data/tracker-store.journal rwk,

4
apparmor.d/groups/apps/atom
View file

@ -68,9 +68,9 @@ profile atom @{exec_path} {
/{usr/,}bin/lsb_release rPx -> lsb_release, /{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/xdg-open rCx -> open, /{usr/,}bin/xdg-open rCx -> open,
/{usr/,}bin/xdg-settings rPUx, /{usr/,}bin/xdg-settings rPx,
/{usr/,}bin/git rPUx, /{usr/,}bin/git rPx,
# Needed to sign commits # Needed to sign commits
/{usr/,}bin/gpg rCx -> gpg, /{usr/,}bin/gpg rCx -> gpg,

4
apparmor.d/groups/apps/usr.lib.libreoffice.program.senddoc
View file

@ -27,8 +27,8 @@ profile libreoffice-senddoc /usr/lib/libreoffice/program/senddoc flags=(complain
/usr/bin/basename rmix, /usr/bin/basename rmix,
/{usr/,}bin/grep rmix, /{usr/,}bin/grep rmix,
/{usr/,}bin/uname rmix, /{usr/,}bin/uname rmix,
/usr/bin/xdg-open rPUx, /usr/bin/xdg-open rPx,
/usr/bin/xdg-email rPUx, /usr/bin/xdg-email rPx,
/dev/null rw, /dev/null rw,
/usr/lib/libreoffice/program/uri-encode rmpux, /usr/lib/libreoffice/program/uri-encode rmpux,
/usr/share/libreoffice/share/config/* r, /usr/share/libreoffice/share/config/* r,

2
apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
View file

@ -169,7 +169,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
/usr/lib/libreoffice/program/soffice.bin mix, /usr/lib/libreoffice/program/soffice.bin mix,
/usr/lib/libreoffice/program/xpdfimport px, /usr/lib/libreoffice/program/xpdfimport px,
/usr/lib/libreoffice/program/senddoc px, /usr/lib/libreoffice/program/senddoc px,
/usr/bin/xdg-open rPUx, /usr/bin/xdg-open rPx,
/usr/share/java/**.jar r, /usr/share/java/**.jar r,
/usr/share/hunspell/ r, /usr/share/hunspell/ r,

4
apparmor.d/groups/browsers/brave
View file

@ -73,8 +73,8 @@ profile brave @{exec_path} {
#deny /{usr/,}bin/xdg-desktop-menu rx, #deny /{usr/,}bin/xdg-desktop-menu rx,
/{usr/,}bin/xdg-open rCx -> open, /{usr/,}bin/xdg-open rCx -> open,
/{usr/,}bin/xdg-settings rPUx, /{usr/,}bin/xdg-settings rPx,
/{usr/,}bin/xdg-mime rPUx, /{usr/,}bin/xdg-mime rPx,
/usr/share/chromium/extensions/ r, /usr/share/chromium/extensions/ r,

2
apparmor.d/groups/browsers/chromium
View file

@ -34,6 +34,8 @@ profile chromium @{exec_path} flags=(attach_disconnected) {
# For chromium -g # For chromium -g
/{usr/,}bin/gdb rPUx, /{usr/,}bin/gdb rPUx,
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner /tmp/chromiumargs.?????? rw, owner /tmp/chromiumargs.?????? rw,
# For a temp profile # For a temp profile

8
apparmor.d/groups/browsers/chromium-chromium
View file

@ -60,11 +60,11 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/browserpass rPx, /{usr/,}bin/browserpass rPx,
/{usr/,}bin/lsb_release rPx -> lsb_release, /{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/xdg-mime rPUx, /{usr/,}bin/xdg-mime rPx,
/{usr/,}bin/xdg-open rCx -> open, /{usr/,}bin/xdg-open rCx -> open,
/{usr/,}bin/xdg-settings rPUx, /{usr/,}bin/xdg-settings rPx,
/{usr/,}bin/xdg-desktop-menu rPUx, /{usr/,}bin/xdg-desktop-menu rPx,
/{usr/,}bin/xdg-icon-resource rPUx, /{usr/,}bin/xdg-icon-resource rPx,
# To remove the following error: # To remove the following error:
# Error initializing NSS with a persistent database # Error initializing NSS with a persistent database

35
apparmor.d/groups/browsers/firefox
View file

@ -1,8 +1,10 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2021 Mikhail Morfikov # Copyright (C) 2015-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
# Warning: Such a profile is limitted as it gives access to a lot of resources.
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@ -14,22 +16,22 @@ include <tunables/global>
@{exec_path} = @{MOZ_LIBDIR}/firefox{,-bin,-esr} @{exec_path} = @{MOZ_LIBDIR}/firefox{,-bin,-esr}
profile firefox @{exec_path} flags=(attach_disconnected) { profile firefox @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/wayland>
include <abstractions/opencl-intel>
include <abstractions/vulkan>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/mesa>
include <abstractions/audio> include <abstractions/audio>
include <abstractions/deny-root-dir-access>
include <abstractions/enchant> include <abstractions/enchant>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/opencl-intel>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/user-download-strict> include <abstractions/user-download-strict>
include <abstractions/user-read> include <abstractions/user-read>
include <abstractions/thumbnails-cache-read> include <abstractions/vulkan>
include <abstractions/nameservice-strict> include <abstractions/wayland>
include <abstractions/ssl_certs>
include <abstractions/deny-root-dir-access>
##include <abstractions/nvidia> ##include <abstractions/nvidia>
ptrace peer=@{profile_name}, ptrace peer=@{profile_name},
@ -210,16 +212,14 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
owner @{user_share_dirs}/ r, owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/gvfs-metadata/home r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
owner @{user_share_dirs}/gvfs-metadata/root r,
owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
include <abstractions/dconf> include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw, owner @{run}/user/@{uid}/dconf/user rw,
# Silencer # Silencer
deny capability sys_ptrace,
deny owner @{HOME}/.* r, deny owner @{HOME}/.* r,
profile open { profile open {
@ -252,6 +252,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/telegram-desktop rPx, /{usr/,}bin/telegram-desktop rPx,
/{usr/,}bin/spacefm rPx, /{usr/,}bin/spacefm rPx,
/{usr/,}bin/qpdfview rPx, /{usr/,}bin/qpdfview rPx,
/{usr/,}bin/evince rPx,
/usr/share/xfce4/exo/exo-compose-mail rPx, /usr/share/xfce4/exo/exo-compose-mail rPx,
# file_inherit # file_inherit

4
apparmor.d/groups/browsers/google-chrome-chrome
View file

@ -66,8 +66,8 @@ profile google-chrome-chrome @{exec_path} {
deny /{usr/,}bin/xdg-desktop-menu rx, deny /{usr/,}bin/xdg-desktop-menu rx,
deny /{usr/,}bin/xdg-icon-resource rx, deny /{usr/,}bin/xdg-icon-resource rx,
/{usr/,}bin/xdg-mime rPUx, /{usr/,}bin/xdg-mime rPx,
/{usr/,}bin/xdg-settings rPUx, /{usr/,}bin/xdg-settings rPx,
# To remove the following error: # To remove the following error:
# Error initializing NSS with a persistent database # Error initializing NSS with a persistent database

8
apparmor.d/groups/browsers/opera
View file

@ -56,11 +56,11 @@ profile opera @{exec_path} {
@{OPERA_INSTALLDIR}/opera_autoupdate krix, @{OPERA_INSTALLDIR}/opera_autoupdate krix,
/{usr/,}bin/lsb_release rPx -> lsb_release, /{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/xdg-mime rPUx, /{usr/,}bin/xdg-mime rPx,
/{usr/,}bin/xdg-open rCx -> open, /{usr/,}bin/xdg-open rCx -> open,
/{usr/,}bin/xdg-settings rPUx, /{usr/,}bin/xdg-settings rPx,
/{usr/,}bin/xdg-desktop-menu rPUx, /{usr/,}bin/xdg-desktop-menu rPx,
/{usr/,}bin/xdg-icon-resource rPUx, /{usr/,}bin/xdg-icon-resource rPx,
# To remove the following error: # To remove the following error:
# Error initializing NSS with a persistent database # Error initializing NSS with a persistent database

6
apparmor.d/groups/bus/dbus-daemon
View file

@ -17,9 +17,9 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
capability setuid, capability setuid,
capability sys_resource, capability sys_resource,
signal (receive) set=(term, kill), signal (receive) set=(term hup kill) peer=gdm*,
signal (receive) set=(term, hup) peer=gdm*, signal (send) set=(term hup kill) peer=at-spi-bus-launcher,
signal (send) set=(term, kill) peer=at-spi-bus-launcher, signal (send) set=(term hup kill) peer=xdg-permission-store,
network netlink raw, network netlink raw,

8
apparmor.d/groups/desktop/at-spi-bus-launcher
View file

@ -17,16 +17,16 @@ profile at-spi-bus-launcher @{exec_path} {
# Needed? # Needed?
deny capability sys_nice, deny capability sys_nice,
signal (receive) set=(term hup) peer=gdm*, signal (receive) set=(term hup kill) peer=dbus-daemon,
signal (receive) set=(term hup) peer=dbus-daemon, signal (receive) set=(term hup kill) peer=gdm*,
signal (send) set=(term, kill) peer=dbus-daemon, signal (send) set=(term hup kill) peer=dbus-daemon,
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/dbus-daemon rPUx, /{usr/,}bin/dbus-daemon rPx,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,

1
apparmor.d/groups/gnome/gnome-calendar
View file

@ -12,6 +12,7 @@ profile gnome-calendar @{exec_path} {
include <abstractions/gnome> include <abstractions/gnome>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/p11-kit>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
network netlink raw, network netlink raw,

5
apparmor.d/groups/gnome/gnome-shell
View file

@ -79,10 +79,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/backgrounds/{,**} rw, owner @{user_share_dirs}/backgrounds/{,**} rw,
owner @{user_share_dirs}/gnome-shell/{,**} rw, owner @{user_share_dirs}/gnome-shell/{,**} rw,
owner @{user_share_dirs}/gnome-shell/extensions/{,**} r, owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
owner @{user_share_dirs}/gvfs-metadata/home r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
owner @{user_share_dirs}/gvfs-metadata/root r,
owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r, owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r,
owner @{user_cache_dirs}/gnome-photos/{,**} r, owner @{user_cache_dirs}/gnome-photos/{,**} r,

5
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -30,10 +30,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
/usr/share/gnome-system-monitor/{,**} r, /usr/share/gnome-system-monitor/{,**} r,
/usr/share/pixmaps/{,**} r, /usr/share/pixmaps/{,**} r,
owner @{user_share_dirs}/gvfs-metadata/home r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
owner @{user_share_dirs}/gvfs-metadata/root r,
owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
include <abstractions/dconf> include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/ rw,

6
apparmor.d/groups/gnome/nautilus
View file

@ -44,11 +44,17 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/net/wireless r,
@{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/random/boot_id r,
@{run}/mount/utab r, @{run}/mount/utab r,
@{run}/systemd/userdb/ r, @{run}/systemd/userdb/ r,
@{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
/dev/tty rw, /dev/tty rw,
/dev/dri/card[0-9]* rw, /dev/dri/card[0-9]* rw,

3
apparmor.d/groups/gvfs/gvfsd-metadata
View file

@ -16,8 +16,7 @@ profile gvfsd-metadata @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
owner @{HOME}/.local/share/gvfs-metadata/ rw, owner @{user_share_dirs}/gvfs-metadata/{,*} rw,
owner @{HOME}/.local/share/gvfs-metadata/** rw,
include if exists <local/gvfsd-metadata> include if exists <local/gvfsd-metadata>
} }

5
apparmor.d/groups/pacman/pacman
View file

@ -48,6 +48,7 @@ profile pacman @{exec_path} {
/{usr/,}bin/cat rix, /{usr/,}bin/cat rix,
/{usr/,}bin/dot rix, /{usr/,}bin/dot rix,
/{usr/,}bin/env rix, /{usr/,}bin/env rix,
/{usr/,}bin/ghc-pkg-* rix,
/{usr/,}bin/rm rix, /{usr/,}bin/rm rix,
/{usr/,}bin/setcap rix, /{usr/,}bin/setcap rix,
/{usr/,}bin/vercmp rix, /{usr/,}bin/vercmp rix,
@ -81,8 +82,8 @@ profile pacman @{exec_path} {
/etc/{,**} rwl, /etc/{,**} rwl,
/opt/{,**} rwl, /opt/{,**} rwl,
/srv/{,**} rwl, /srv/{,**} rwl,
/usr/{,**} rwl, /usr/{,**} rwlk,
/var/{,**} rwl, /var/{,**} rwlk,
/bin/ rwl, /bin/ rwl,
/home/ rw, /home/ rw,

6
apparmor.d/groups/pacman/pacman-hook-fontconfig
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile pacman-hook-fontconfig @{exec_path} { profile pacman-hook-fontconfig @{exec_path} {
include <abstractions/base> include <abstractions/base>
capability dac_read_search,
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/bash rix, /{usr/,}bin/bash rix,
@ -19,5 +21,9 @@ profile pacman-hook-fontconfig @{exec_path} {
/etc/fonts/conf.d/* rwl, /etc/fonts/conf.d/* rwl,
/usr/share/fontconfig/conf.default/* r, /usr/share/fontconfig/conf.default/* r,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-fontconfig> include if exists <local/pacman-hook-fontconfig>
} }

9
apparmor.d/groups/systemd/systemd-sysctl
View file

@ -12,11 +12,10 @@ profile systemd-sysctl @{exec_path} {
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/systemd-common> include <abstractions/systemd-common>
# Are these needed? capability net_admin,
deny capability sys_ptrace, capability sys_admin,
deny capability sys_admin, capability sys_ptrace,
deny capability net_admin, # capability sys_resource,
deny capability sys_resource,
@{exec_path} mr, @{exec_path} mr,

3
apparmor.d/groups/systemd/systemd-sysusers
View file

@ -37,6 +37,9 @@ profile systemd-sysusers @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
@{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/random/boot_id r,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
deny /apparmor/.null rw, deny /apparmor/.null rw,
include if exists <local/systemd-sysusers> include if exists <local/systemd-sysusers>

4
apparmor.d/profiles-a-f/apparmor_parser
View file

@ -20,11 +20,11 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
owner /var/cache/apparmor/{,**} rw, owner /var/cache/apparmor/{,**} rw,
owner /var/lib/docker/tmp/docker-default[0-9]* r, owner /var/lib/docker/tmp/docker-default[0-9]* r,
owner @{sys}/kernel/security/apparmor/{,**} r,
owner @{sys}/kernel/security/apparmor/.{remove,replace,load,access} rw, owner @{sys}/kernel/security/apparmor/.{remove,replace,load,access} rw,
@{sys}/kernel/security/apparmor/{,**} r,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
deny /apparmor/.null rw, deny /apparmor/.null rw,

2
apparmor.d/profiles-a-f/engrampa
View file

@ -66,7 +66,7 @@ profile engrampa @{exec_path} {
owner @{user_config_dirs}/mimeapps.list{,.*} rw, owner @{user_config_dirs}/mimeapps.list{,.*} rw,
owner @{user_share_dirs}/ r, owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/gvfs-metadata/** r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
/usr/share/engrampa/{,**} r, /usr/share/engrampa/{,**} r,

2
apparmor.d/profiles-a-f/font-manager
View file

@ -44,7 +44,7 @@ profile font-manager @{exec_path} {
owner "@{user_share_dirs}/fonts/Google Fonts/**" rw, owner "@{user_share_dirs}/fonts/Google Fonts/**" rw,
owner @{user_share_dirs}/ r, owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/gvfs-metadata/** r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/glib-2.0/schemas/gschemas.compiled r,

4
apparmor.d/profiles-a-f/fuse-overlayfs
View file

@ -17,9 +17,9 @@ profile fuse-overlayfs @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
mount fstype=fuse.* options=(rw,nodev,noatime) @{user_share_dirs}/containers/storage/overlay/**/ -> **, mount fstype=fuse.* options=(rw,nodev,noatime) @{user_share_dirs}/containers/storage/overlay/**/merged/ -> **,
owner @{user_share_dirs}/containers/storage/overlay/{,**} rw, owner @{user_share_dirs}/containers/storage/overlay/{,**} rwl,
@{PROC}/sys/kernel/overflowgid r, @{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r, @{PROC}/sys/kernel/overflowuid r,

12
apparmor.d/profiles-a-f/fwupd
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov # Copyright (C) 2020-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -31,12 +31,12 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
/{usr/,}bin/gpgconf rCx -> gpg, /{usr/,}bin/gpgconf rCx -> gpg,
/{usr/,}bin/gpgsm rCx -> gpg, /{usr/,}bin/gpgsm rCx -> gpg,
/etc/pki/fwupd/** r, /etc/pki/fwupd/{,**} r,
/etc/pki/fwupd-metadata/** r, /etc/pki/fwupd-metadata/{,**} r,
/etc/fwupd/** r, /etc/fwupd/{,**} r,
/usr/share/fwupd/** r, /usr/share/fwupd/{,**} r,
/var/cache/fwupd/** rw, /var/cache/fwupd/{,**} rw,
/var/lib/fwupd/{,**} rw, /var/lib/fwupd/{,**} rw,
/var/lib/fwupd/pending.db rwk, /var/lib/fwupd/pending.db rwk,

2
apparmor.d/profiles-a-f/fwupdmgr
View file

@ -25,7 +25,7 @@ profile fwupdmgr @{exec_path} flags=(complain) {
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/dbus-launch rCx -> dbus, /{usr/,}bin/dbus-launch rCx -> dbus,
/{usr/,}bin/pkttyagent rux, # TODO: Work in progress /{usr/,}bin/pkttyagent rPx,
owner @{user_cache_dirs}/ rw, owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/fwupd/ rw, owner @{user_cache_dirs}/fwupd/ rw,

27
apparmor.d/profiles-s-z/su
View file

@ -9,25 +9,16 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/su @{exec_path} = /{usr/,}bin/su
profile su @{exec_path} { profile su @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/authentication> include <abstractions/authentication>
include <abstractions/wutmp> include <abstractions/consoles>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/wutmp>
# include <pam/mappings> # include <pam/mappings>
# To remove the following errors:
# su: cannot set groups: Operation not permitted
capability setgid,
# To remove the following errors:
# su: cannot set user id: Operation not permitted
capability setuid,
# To write records to the kernel auditing log.
capability audit_write, capability audit_write,
capability setgid,
# Needed? capability setuid,
audit deny capability net_bind_service, #audit deny capability net_bind_service,
signal (send) set=(term,kill), signal (send) set=(term,kill),
signal (receive) set=(int,quit,term), signal (receive) set=(int,quit,term),
@ -43,16 +34,14 @@ profile su @{exec_path} {
# Fake shells to politely refuse a login # Fake shells to politely refuse a login
#/{usr/,}{s,}bin/nologin rpux, #/{usr/,}{s,}bin/nologin rpux,
/etc/default/locale r,
/etc/environment r, /etc/environment r,
/etc/security/limits.d/ r,
/etc/shells r,
@{PROC}/1/limits r, @{PROC}/1/limits r,
owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/loginuid r,
/etc/default/locale r,
/etc/security/limits.d/ r,
/etc/shells r,
# For pam_securetty # For pam_securetty
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{sys}/devices/virtual/tty/console/active r, @{sys}/devices/virtual/tty/console/active r,

65
apparmor.d/profiles-s-z/sudo
View file

@ -9,43 +9,26 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/sudo @{exec_path} = /{usr/,}bin/sudo
profile sudo @{exec_path} { profile sudo @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/authentication> include <abstractions/authentication>
include <abstractions/wutmp> include <abstractions/consoles>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/wutmp>
# include <pam/mappings> # include <pam/mappings>
# To remove the following errors: # capability mknod,
# sudo: unable to change to root gid: Operation not permitted
capability setgid,
# To remove the following errors:
# sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted
# sudo: no valid sudoers sources found, quitting
# sudo: setresuid() [0, 0, 0] -> [1000, -1, -1]: Operation not permitted
capability setuid,
# To write records to the kernel auditing log.
capability audit_write, capability audit_write,
# For changing ownership of the /var/log/sudo.log file
capability chown, capability chown,
# Needed? (#FIXME#)
capability sys_resource,
capability net_admin,
capability sys_ptrace,
capability dac_read_search,
capability dac_override, capability dac_override,
capability mknod, capability dac_read_search,
ptrace read, capability net_admin,
capability setgid,
capability setuid,
capability sys_ptrace,
capability sys_resource,
# To remove the following error:
# sudo: PAM account management error: Permission denied
# sudo: unable to open audit system: Permission denied
# sudo: a password is required
network netlink raw, network netlink raw,
ptrace (read),
signal, signal,
@{exec_path} mr, @{exec_path} mr,
@ -56,19 +39,7 @@ profile sudo @{exec_path} {
/{usr/,}bin/[a-z0-9]* rPUx, /{usr/,}bin/[a-z0-9]* rPUx,
/{usr/,}{s,}bin/[a-z0-9]* rPUx, /{usr/,}{s,}bin/[a-z0-9]* rPUx,
/{usr/,}lib/cockpit/cockpit-askpass rPx, /{usr/,}lib/cockpit/cockpit-askpass rPUx,
/dev/ r,
/dev/ptmx rw,
# For timestampdir
owner @{run}/sudo/ rw,
owner @{run}/sudo/ts/ rw,
owner @{run}/sudo/ts/* rwk,
@{run}/faillock/{,*} rwk,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/stat r,
/etc/sudo.conf r, /etc/sudo.conf r,
@ -79,9 +50,21 @@ profile sudo @{exec_path} {
/var/log/sudo.log wk, /var/log/sudo.log wk,
# file_inherit # For timestampdir
owner @{run}/sudo/ rw,
owner @{run}/sudo/ts/ rw,
owner @{run}/sudo/ts/* rwk,
@{run}/faillock/{,*} rwk,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/stat r,
# File Inherit
owner /dev/tty[0-9]* rw, owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w, owner @{HOME}/.xsession-errors w,
/dev/ r,
/dev/ptmx rw,
include if exists <local/sudo> include if exists <local/sudo>
} }

3
apparmor.d/profiles-s-z/update-mime-database
View file

@ -10,6 +10,9 @@ include <tunables/global>
profile update-mime-database @{exec_path} { profile update-mime-database @{exec_path} {
include <abstractions/base> include <abstractions/base>
capability dac_override,
capability dac_read_search,
@{exec_path} mr, @{exec_path} mr,
/usr/share/mime/{,**} rw, /usr/share/mime/{,**} rw,

5
apparmor.d/profiles-s-z/xdg-dbus-proxy
View file

@ -12,10 +12,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected, complain) {
@{exec_path} mr, @{exec_path} mr,
owner @{user_share_dirs}/gvfs-metadata/home r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
owner @{user_share_dirs}/gvfs-metadata/root r,
owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
owner @{run}/firejail/dbus/[0-9]*/[0-9]*-user rw, owner @{run}/firejail/dbus/[0-9]*/[0-9]*-user rw,
owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw, owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw,

3
apparmor.d/profiles-s-z/xdg-desktop-portal
View file

@ -13,6 +13,8 @@ profile xdg-desktop-portal @{exec_path} {
network netlink raw, network netlink raw,
ptrace (read),
@{exec_path} mr, @{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/glib-2.0/schemas/gschemas.compiled r,
@ -26,6 +28,7 @@ profile xdg-desktop-portal @{exec_path} {
owner @{run}/user/@{uid}/dconf/ rw, owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw, owner @{run}/user/@{uid}/dconf/user rw,
owner @{PROC}/@{pids}/cgroup r,
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{PROC}/cmdline r, @{PROC}/cmdline r,

8
apparmor.d/profiles-s-z/xdg-desktop-portal-gtk
View file

@ -11,6 +11,9 @@ profile xdg-desktop-portal-gtk @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/fonts> include <abstractions/fonts>
include <abstractions/freedesktop.org> include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/thumbnails-cache-read>
include <abstractions/user-download>
@{exec_path} mr, @{exec_path} mr,
@ -18,6 +21,11 @@ profile xdg-desktop-portal-gtk @{exec_path} {
/usr/share/themes/{,**} r, /usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r, /usr/share/X11/xkb/{,**} r,
/ r,
owner @{HOME}/@{XDG_DATA_HOME}/ r,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
include <abstractions/dconf> include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/user rw, owner @{run}/user/@{uid}/dconf/user rw,

5
apparmor.d/profiles-s-z/xdg-mime
View file

@ -46,10 +46,7 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/mimeapps.list{,.new} rw, owner @{user_config_dirs}/mimeapps.list{,.new} rw,
owner @{user_share_dirs}/gvfs-metadata/home r, owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
owner @{user_share_dirs}/gvfs-metadata/root r,
owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
owner @{HOME}/.Xauthority r, owner @{HOME}/.Xauthority r,