mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Profiles update.

Browse Source
This commit is contained in:
Alexandre Pujol 2022-03-13 21:04:42 +00:00
parent 7fc804c386
commit bb0847f5df
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
25 changed files with 115 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
apparmor.d/groups/browsers/firefox
View File

@ -151,6 +151,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{sys}/class/ r,
@{sys}/class/**/ r,
@{sys}/devices/**/uevent r,
@{sys}/devices/pci[0-9]*/**/irq r,
@{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,

4
apparmor.d/groups/bus/dbus-run-session
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/dbus-run-session
profile dbus-run-session @{exec_path} {
include <abstractions/base>
include <abstractions/dconf>
signal (receive) set=term peer=gdm,
signal (receive) set=(term, kill) peer=gdm-*-session,
@ -23,11 +24,10 @@ profile dbus-run-session @{exec_path} {
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/dconf/profile/gdm r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/dconf/profile/gdm r,
/var/lib/gdm/.config/dconf/user r,
owner @{PROC}/@{pid}/fd/ r,

31
apparmor.d/groups/desktop/at-spi-bus-launcher
View File

@ -9,11 +9,11 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/at-spi2-core/at-spi-bus-launcher
@{exec_path} += @{libexec}/at-spi-bus-launcher
profile at-spi-bus-launcher @{exec_path} {
profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dconf>
include <abstractions/nameservice-strict>
signal (receive) set=(term hup kill) peer=dbus-daemon,
signal (receive) set=(term hup kill) peer=gdm*,
signal (send) set=(term hup kill) peer=dbus-daemon,
@ -26,28 +26,27 @@ profile at-spi-bus-launcher @{exec_path} {
/{usr/,}bin/dbus-daemon rPx,
/{usr/,}bin/dbus-broker-launch rPUx,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r,
owner @{HOME}/.Xauthority r,
/var/lib/lightdm/.Xauthority r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/dconf/profile/gdm r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
include <abstractions/dconf>
owner @{HOME}/.Xauthority r,
owner @{HOME}/.xsession-errors w,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/usr/share/dconf/profile/gdm r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
/var/lib/lightdm/.Xauthority r,
/var/lib/gdm/.config/dconf/user r,
# file_inherit
owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w,
/var/log/lightdm/seat[0-9]*-greeter.log w,
/usr/share/gdm/greeter-dconf-defaults r,
@{PROC}/1/cgroup r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/1/cgroup r,
owner /dev/tty[0-9]* rw, # file_inherit
include if exists <local/at-spi-bus-launcher>
}

2
apparmor.d/groups/gnome/gdm-xsession
View File

@ -26,9 +26,9 @@ profile gdm-xsession @{exec_path} {
/{usr/,}bin/dbus-update-activation-environment rCx -> dbus,
/{usr/,}bin/flatpak rPUx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/xbrlapi rPx,
/{usr/,}bin/xhost rPx,
/{usr/,}lib/gnome-session-binary rPx,
/{usr/,}bin/xbrlapi rPx,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/etc/X11/{,**} r,

2
apparmor.d/groups/gnome/gnome-control-center
View File

@ -93,6 +93,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/platform/**/uevent r,
@{sys}/devices/virtual/**/uevent r,
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,

4
apparmor.d/groups/gnome/gnome-control-center-print-renderer
View File

@ -37,6 +37,10 @@ profile gnome-control-center-print-renderer @{exec_path} {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
@{PROC}/sys/dev/i915/perf_stream_paranoid r,

3
apparmor.d/groups/gnome/gnome-shell
View File

@ -89,6 +89,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r,
owner @{user_cache_dirs}/gnome-boxes/*.png r,
owner @{user_cache_dirs}/gnome-photos/{,**} r,
owner @{user_cache_dirs}/gnome-screenshot/{,**} rw,
owner @{user_cache_dirs}/libgweather/{,**} r,
@ -150,6 +151,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
@{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,

2
apparmor.d/groups/gnome/nautilus
View File

@ -10,6 +10,7 @@ include <tunables/global>
profile nautilus @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-launcher-user>
include <abstractions/dconf>
include <abstractions/gnome>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
@ -40,7 +41,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
deny /tmp/.* rw,
deny /tmp/.*/ rw,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

12
apparmor.d/groups/gpg/dirmngr
View File

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2017-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -21,13 +21,19 @@ profile dirmngr @{exec_path} {
@{exec_path} mr,
/usr/share/gnupg/sks-keyservers.netCA.pem r,
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/dirmngr.conf r,
owner @{HOME}/@{XDG_GPG_DIR}/dirmngr_ldapservers.conf r,
owner @{HOME}/@{XDG_GPG_DIR}/crls.d/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/crls.d/DIR.txt rw,
/usr/share/gnupg/sks-keyservers.netCA.pem r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/dirmngr.conf r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/dirmngr_ldapservers.conf r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/crls.d/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/crls.d/DIR.txt rw,
owner @{run}/user/@{uid}/gnupg/ rw,
owner @{run}/user/@{uid}/gnupg/S.dirmngr rw,

12
apparmor.d/groups/gpg/gpg-agent
View File

@ -29,12 +29,12 @@ profile gpg-agent @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{HOME}/@{XDG_GPG_DIR}/sshcontrol r,
owner @{MOUNTS}/*/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/*/@{XDG_GPG_DIR}/gpg-agent.conf r,
owner @{MOUNTS}/*/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
owner @{MOUNTS}/*/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
owner @{MOUNTS}/*/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{MOUNTS}/*/@{XDG_GPG_DIR}/sshcontrol r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/gpg-agent.conf r,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/sshcontrol r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/ rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/gpg-agent.conf r,

4
apparmor.d/groups/gpg/scdaemon
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov
# Copyright (C) 2017-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -21,6 +22,7 @@ profile scdaemon @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/reader_0.status rw,
owner @{run}/user/@{uid}/gnupg/S.scdaemon rw,
owner @{run}/user/@{uid}/gnupg/d.*/S.scdaemon rw,
@{PROC}/@{pid}/task/@{tid}/comm rw,

36
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2021-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -10,10 +11,11 @@ include <tunables/global>
@{exec_path} += @{libexec}/gvfs-udisks2-volume-monitor
profile gvfs-udisks2-volume-monitor @{exec_path} {
include <abstractions/base>
include <abstractions/dconf>
include <abstractions/devices-usb>
include <abstractions/disks-read>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/disks-read>
include <abstractions/devices-usb>
network inet stream,
network inet6 stream,
@ -28,33 +30,31 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
/{usr/,}bin/mount rPx,
/{usr/,}bin/umount rPx,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ w,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/systemd/sessions/[0-9]* r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/ r,
/etc/fstab r,
/etc/machine-id r,
# Mount points
@{MOUNTS}/*/ r,
@{MOUNTS}/*/**/ r,
@{HOME}/*/*/ r,
@{HOME}/*/*/**/ r,
@{HOME}/bluetooth/ r,
owner @{MOUNTS}/*/ r,
owner @{MOUNTS}/*/**/ r,
owner @{HOME}/*/*/ r,
owner @{HOME}/*/*/**/ r,
owner @{HOME}/bluetooth/ r,
/ r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
owner @{run}/user/@{uid}/dconf/ w,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/mount/utab r,
@{run}/systemd/sessions/[0-9]* r,
@{PROC}/ r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/stat r,
@{PROC}/ r,
@{PROC}/1/cgroup r,
@{PROC}/locks r,

2
apparmor.d/groups/pacman/pacman
View File

@ -68,7 +68,7 @@ profile pacman @{exec_path} {
/{usr/,}bin/archlinux-java rPx,
/{usr/,}bin/bootctl rPx,
/{usr/,}bin/dconf rPx,
/{usr/,}bin/fc-cache rPx,
/{usr/,}bin/fc-cache{,-32} rPx,
/{usr/,}bin/gdk-pixbuf-query-loaders rPx,
/{usr/,}bin/glib-compile-schemas rPx,
/{usr/,}bin/groupadd rPx,

2
apparmor.d/groups/pacman/pacman-hook-systemd
View File

@ -24,7 +24,7 @@ profile pacman-hook-systemd @{exec_path} {
/{usr/,}bin/systemd-sysusers rPx,
/{usr/,}bin/systemd-tmpfiles rPx,
/{usr/,}bin/udevadm rPx,
/{usr/,}lib/systemd-binfmt rPx,
/{usr/,}lib/systemd/systemd-binfmt rPx,
/{usr/,}lib/systemd/systemd-sysctl rPx,
/usr/ rw,

8
apparmor.d/groups/systemd/systemd-shutdown
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# Copyright (C) 2020-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -11,9 +12,10 @@ profile systemd-shutdown @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/systemd-common>
capability sys_resource,
capability sys_boot,
capability kill,
capability sys_boot,
capability sys_ptrace,
capability sys_resource,
signal (send) set=(stop, cont, term, kill),

3
apparmor.d/profiles-a-f/auditd
View File

@ -27,7 +27,8 @@ profile auditd @{exec_path} {
/etc/machine-id r,
@{run}/auditd.pid rw,
owner @{run}/auditd.pid rwl,
owner @{run}/auditd.state rw,
@{run}/systemd/userdb/ r,
owner @{PROC}/@{pid}/attr/current r,

2
apparmor.d/profiles-a-f/fc-cache
View File

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/fc-cache
@{exec_path} = /{usr/,}bin/fc-cache{,-32}
profile fc-cache @{exec_path} {
include <abstractions/base>
include <abstractions/fonts>

2
apparmor.d/profiles-g-l/gtk-update-icon-cache
View File

@ -18,6 +18,8 @@ profile gtk-update-icon-cache @{exec_path} flags=(attach_disconnected) {
/usr/share/icons/**/.icon-theme.cache rw,
/usr/share/icons/**/icon-theme.cache rw,
/var/lib/flatpak/exports/share/icons/hicolor/.icon-theme.cache rw,
deny /apparmor/.null rw,
include if exists <local/gtk-update-icon-cache>

2
apparmor.d/profiles-g-l/id
View File

@ -16,5 +16,7 @@ profile id @{exec_path} {
/etc/machine-id r,
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/id>
}

1
apparmor.d/profiles-g-l/lspci
View File

@ -35,6 +35,7 @@ profile lspci @{exec_path} {
# file_inherit
@{PROC}/ioports r,
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/lspci>
}

2
apparmor.d/profiles-s-z/uname
View File

@ -18,5 +18,7 @@ profile uname @{exec_path} {
# file_inherit
owner @{HOME}/.xsession-errors w,
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/uname>
}

6
apparmor.d/profiles-s-z/xdg-desktop-portal
View File

@ -20,10 +20,14 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/{usr/,}lib/x r,
/{usr/,}bin/{,ba,da}sh rix,
# Allowed apps to open
/{usr/,}bin/firefox rPx -> firefox,
/ r,
/.flatpak-info r,
/{usr/,}lib/x r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/pipewire/client.conf r,

2
apparmor.d/profiles-s-z/xdg-icon-resource
View File

@ -38,5 +38,7 @@ profile xdg-icon-resource @{exec_path} flags=(complain) {
owner @{user_share_dirs}/icons/**/.xdg-icon-resource-dummy rw,
/opt/**/*.png r,
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/xdg-icon-resource>
}

57
apparmor.d/profiles-s-z/xdg-settings
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -15,51 +16,41 @@ profile xdg-settings @{exec_path} {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/wc rix,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/basename rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/sort rix,
/{usr/,}bin/which{,.debianutils} rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/basename rix,
/{usr/,}bin/uname rix,
/{usr/,}bin/wc rix,
/{usr/,}bin/which{,.debianutils} rix,
# When xdg-settings is run as root, it wants to exec dbus-launch, and hence it creates the two
# following root processes:
# dbus-launch --autolaunch e0a30ad97cd6421c85247839ccef9db2 --binary-syntax --close-stderr
# /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
#
# Should this be allowed? Xdg-settings works fine without this.
#/{usr/,}bin/dbus-launch rCx -> dbus,
#/{usr/,}bin/dbus-send rCx -> dbus,
deny /{usr/,}bin/dbus-launch rx,
deny /{usr/,}bin/dbus-send rx,
/{usr/,}bin/xprop rPx,
/{usr/,}bin/xdg-mime rPx,
owner @{PROC}/@{pid}/fd/ r,
/etc/xdg/xfce4/helpers.rc r,
owner @{user_config_dirs}/xfce4/helpers.rc{,.*} rw,
owner @{user_share_dirs}/applications/ r,
owner @{user_share_dirs}/applications/*.desktop r,
owner @{HOME}/.Xauthority r,
/{usr/,}bin/dbus-launch rCx -> dbus,
/{usr/,}bin/dbus-send rCx -> dbus,
/{usr/,}bin/xdg-mime rPx,
/{usr/,}bin/xprop rPx,
/usr/share/terminfo/x/xterm-256color r,
/usr/share/applications/ r,
/var/lib/dbus/machine-id r,
/etc/xdg/xfce4/helpers.rc r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
# For shell pwd
owner @{HOME}/ r,
owner @{HOME}/.Xauthority r,
@{run}/user/@{uid}/ r,
owner @{user_config_dirs}/xfce4/helpers.rc{,.*} rw,
owner @{user_share_dirs}/applications/ r,
owner @{user_share_dirs}/applications/*.desktop r,
owner @{run}/user/@{uid}/ r,
owner @{PROC}/@{pid}/fd/ r,
profile dbus {
include <abstractions/base>

4
apparmor.d/tunables/extend
View File

@ -13,7 +13,7 @@
@{MOUNTS}=/media/ @{run}/media /mnt
# Libexec path. Different in some distribution
@{libexec}=/usr/lib # Archlinux
@{libexec}=/usr/libexec # Debian/Ubuntu
@{libexec}=/{usr/,}lib # Archlinux
@{libexec}=/{usr/,}libexec # Debian/Ubuntu
include if exists <tunables/extend.d>