feat(profile): update flatpak.

apparmor.d/profiles-a-f/flatpak

@@ -27,12 +27,16 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
   network inet6 stream,
   network netlink raw,
 
+  mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
+
   @{exec_path} mr,
 
-  @{bin}/bwrap    rPx -> flatpak-bwrap, 
+  @{bin}/bwrap               rPx -> flatpak-bwrap, 
-  @{bin}/gpg      rCx -> gpg,
+  @{bin}/fusermount{,3}      rCx -> fusermount,
-  @{bin}/gpgconf  rCx -> gpg,
+  @{bin}/gpg                 rCx -> gpg,
-  @{bin}/gpgsm    rCx -> gpg,
+  @{bin}/gpgconf             rCx -> gpg,
+  @{bin}/gpgsm               rCx -> gpg,
+  @{lib}/revokefs-fuse       rix,
 
   /usr/share/gvfs/remote-volume-monitors/*.monitor r,
   /usr/share/flatpak/{,**} r,
@@ -40,11 +44,14 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
   /etc/flatpak/{,**} r,
   /etc/pulse/client.conf r,
 
-  /var/lib/flatpak/{,**} rwlk,
-  /var/tmp/#@{int} rw,
-
   / r,
 
+  /var/lib/flatpak/{,**} rwlk,
+
+        /var/tmp/#@{int} rw,
+        /var/tmp/flatpak-cache-@{rand6}/{,**/} r,
+  owner /var/tmp/flatpak-cache-@{rand6}/{,**} rwk,
+
   owner @{HOME}/.var/ w,
   owner @{HOME}/.var/app/{,**} rw,
 
@@ -69,15 +76,18 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
 
   @{sys}/module/nvidia/version r,
 
+        @{PROC}/sys/fs/pipe-max-size r,
   owner @{PROC}/@{pid}/stat r,
 
-  deny @{user_share_dirs}/gvfs-metadata/* r,
+  /dev/fuse rw,
-
   /dev/tty rw,
   /dev/tty@{int} rw,
 
+  deny @{user_share_dirs}/gvfs-metadata/* r,
+
   profile gpg {
     include <abstractions/base>
+    include <abstractions/consoles>
 
     capability dac_read_search,
 
@@ -93,5 +103,26 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
     include if exists <local/flatpak_gpg>
   }
 
+  profile fusermount {
+    include <abstractions/base>
+    include <abstractions/consoles>
+    include <abstractions/nameservice-strict>
+
+    capability sys_admin,
+
+    mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
+    umount /var/tmp/flatpak-cache-*/*/,
+
+    @{bin}/fusermount{,3} mr,
+
+    /etc/fuse.conf r,
+
+    @{PROC}/@{pids}/mounts r,
+
+    /dev/fuse rw,
+
+    include if exists <local/flatpak_fusermount>
+  }
+
   include if exists <local/flatpak>
 }

apparmor.d/profiles-a-f/flatpak-app

@@ -13,19 +13,24 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/base>
   include <abstractions/bwrap-app>
 
+  capability sys_ptrace,
+
   network inet dgram,
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
   network netlink raw,
 
+  ptrace (read),
   ptrace peer=flatpak-app//&flatpak-bwrap,
 
   signal peer=flatpak-app//&flatpak-bwrap,
 
-  @{bin}/**                       rmix,
+  @{bin}/**                            rmix,
-  @{lib}/**                       rmix,
+  @{lib}/**                            rmix,
-  /app/**                         rmix,
+  /app/**                              rmix,
+  /var/lib/flatpak/app/*/**/@{bin}/**  rmix,
+  /var/lib/flatpak/app/*/**/@{lib}/**  rmix,
 
   /var/lib/flatpak/app/{,**} r,
 

apparmor.d/profiles-a-f/flatpak-bwrap

@@ -25,8 +25,12 @@ profile flatpak-bwrap flags=(attach_disconnected,mediate_deleted) {
   network inet6 stream,
   network netlink raw,
 
-  mount,
+  mount options=(rw, silent, rslave) -> /,
-  umount,
+  mount fstype=tmpfs -> /tmp/,
+  mount -> /newroot/{,**},
+  mount -> /oldroot/,
+  mount -> /tmp/newroot/,
+  umount /{,oldroot/},
 
   pivot_root oldroot=/newroot/ -> /newroot/,
   pivot_root oldroot=/tmp/oldroot/ -> /tmp/,

apparmor.d/profiles-a-f/flatpak-oci-authenticator

@@ -0,0 +1,17 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/flatpak-oci-authenticator
+profile flatpak-oci-authenticator @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/openssl>
+
+  @{exec_path} mr,
+
+  include if exists <local/flatpak-oci-authenticator>
+}

apparmor.d/profiles-a-f/flatpak-session-helper

@@ -17,11 +17,13 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  @{bin}/dbus-monitor           rPUx,
+  @{bin}/dbus-monitor                 rPUx,
-  @{bin}/p11-kit                 rix,
+  @{bin}/p11-kit                       rix,
-  @{bin}/pkexec                  rPx,
+  @{bin}/pkexec                        rPx,
-  @{lib}/p11-kit/p11-kit-remote  rix,
+  @{lib}/p11-kit/p11-kit-remote        rix,
-  @{lib}/p11-kit/p11-kit-server  rix,
+  @{lib}/p11-kit/p11-kit-server        rix,
+  /var/lib/flatpak/app/*/**/@{bin}/**  rPx -> flatpak-app,
+  /var/lib/flatpak/app/*/**/@{lib}/**  rPx -> flatpak-app,
 
   owner @{run}/user/@{uid}/.flatpak-helper/{,**} rw,
   owner @{run}/user/@{uid}/.flatpak-helper/pkcs11-flatpak-[0-9]* rw,