feat(profile): update flatpak.

This commit is contained in:
Alexandre Pujol 2023-12-08 18:03:47 +00:00
parent d81bce5559
commit c54d72543e
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
5 changed files with 78 additions and 19 deletions

View File

@ -27,12 +27,16 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
network inet6 stream,
network netlink raw,
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
@{exec_path} mr,
@{bin}/bwrap rPx -> flatpak-bwrap,
@{bin}/gpg rCx -> gpg,
@{bin}/gpgconf rCx -> gpg,
@{bin}/gpgsm rCx -> gpg,
@{bin}/bwrap rPx -> flatpak-bwrap,
@{bin}/fusermount{,3} rCx -> fusermount,
@{bin}/gpg rCx -> gpg,
@{bin}/gpgconf rCx -> gpg,
@{bin}/gpgsm rCx -> gpg,
@{lib}/revokefs-fuse rix,
/usr/share/gvfs/remote-volume-monitors/*.monitor r,
/usr/share/flatpak/{,**} r,
@ -40,11 +44,14 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
/etc/flatpak/{,**} r,
/etc/pulse/client.conf r,
/var/lib/flatpak/{,**} rwlk,
/var/tmp/#@{int} rw,
/ r,
/var/lib/flatpak/{,**} rwlk,
/var/tmp/#@{int} rw,
/var/tmp/flatpak-cache-@{rand6}/{,**/} r,
owner /var/tmp/flatpak-cache-@{rand6}/{,**} rwk,
owner @{HOME}/.var/ w,
owner @{HOME}/.var/app/{,**} rw,
@ -69,15 +76,18 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
@{sys}/module/nvidia/version r,
@{PROC}/sys/fs/pipe-max-size r,
owner @{PROC}/@{pid}/stat r,
deny @{user_share_dirs}/gvfs-metadata/* r,
/dev/fuse rw,
/dev/tty rw,
/dev/tty@{int} rw,
deny @{user_share_dirs}/gvfs-metadata/* r,
profile gpg {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
@ -93,5 +103,26 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
include if exists <local/flatpak_gpg>
}
profile fusermount {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_admin,
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/flatpak_fusermount>
}
include if exists <local/flatpak>
}

View File

@ -13,19 +13,24 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/bwrap-app>
capability sys_ptrace,
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
network netlink raw,
ptrace (read),
ptrace peer=flatpak-app//&flatpak-bwrap,
signal peer=flatpak-app//&flatpak-bwrap,
@{bin}/** rmix,
@{lib}/** rmix,
/app/** rmix,
@{bin}/** rmix,
@{lib}/** rmix,
/app/** rmix,
/var/lib/flatpak/app/*/**/@{bin}/** rmix,
/var/lib/flatpak/app/*/**/@{lib}/** rmix,
/var/lib/flatpak/app/{,**} r,

View File

@ -25,8 +25,12 @@ profile flatpak-bwrap flags=(attach_disconnected,mediate_deleted) {
network inet6 stream,
network netlink raw,
mount,
umount,
mount options=(rw, silent, rslave) -> /,
mount fstype=tmpfs -> /tmp/,
mount -> /newroot/{,**},
mount -> /oldroot/,
mount -> /tmp/newroot/,
umount /{,oldroot/},
pivot_root oldroot=/newroot/ -> /newroot/,
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,

View File

@ -0,0 +1,17 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/flatpak-oci-authenticator
profile flatpak-oci-authenticator @{exec_path} {
include <abstractions/base>
include <abstractions/openssl>
@{exec_path} mr,
include if exists <local/flatpak-oci-authenticator>
}

View File

@ -17,11 +17,13 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{bin}/dbus-monitor rPUx,
@{bin}/p11-kit rix,
@{bin}/pkexec rPx,
@{lib}/p11-kit/p11-kit-remote rix,
@{lib}/p11-kit/p11-kit-server rix,
@{bin}/dbus-monitor rPUx,
@{bin}/p11-kit rix,
@{bin}/pkexec rPx,
@{lib}/p11-kit/p11-kit-remote rix,
@{lib}/p11-kit/p11-kit-server rix,
/var/lib/flatpak/app/*/**/@{bin}/** rPx -> flatpak-app,
/var/lib/flatpak/app/*/**/@{lib}/** rPx -> flatpak-app,
owner @{run}/user/@{uid}/.flatpak-helper/{,**} rw,
owner @{run}/user/@{uid}/.flatpak-helper/pkcs11-flatpak-[0-9]* rw,