feat(profiles): add some whonix specific profiles.

Dev only, they may be moved into whonix repo later.

apparmor.d/groups/whonix/msgdispatcher

@@ -0,0 +1,34 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/msgcollector/msgdispatcher
+profile msgdispatcher @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  @{bin}/{,ba,da}sh           rix,
+  @{bin}/basename             rix,
+  @{bin}/flock                rix,
+  @{bin}/inotifywait          rix,
+  @{bin}/mkdir                rix,
+  @{bin}/mkfifo               rix,
+  @{bin}/rm                   rix,
+  @{bin}/sleep                rix,
+  @{bin}/touch                rix,
+  @{bin}/whoami               rix,
+
+  @{lib}/msgcollector/* r,
+
+        @{run}/msgcollector/ r,
+  owner @{run}/msgcollector/user/{,**} rwk,
+
+  include if exists <local/msgdispatcher>
+}

apparmor.d/groups/whonix/open-link-confirmation

@@ -0,0 +1,16 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/open-link-confirmation/open-link-confirmation
+profile open-link-confirmation @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  include if exists <local/open-link-confirmation>
+}

apparmor.d/groups/whonix/sensible-browser

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/sensible-browser
+profile sensible-browser @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} mr,
+
+  @{bin}/{,ba,da}sh     rix,
+  @{bin}/whichbrowser   rix,
+  @{bin}/x-www-browser  rix,
+
+  @{bin}/torbrowser     rPx,
+
+  include if exists <local/sensible-browser>
+}

apparmor.d/groups/whonix/whonix-firewall-edit

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/whonix-firewall/{firewall30default,firewall50user}
+profile whonix-firewall-edit @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} mr,
+
+  @{bin}/{,ba,da}sh            rix,
+  @{bin}/gsudoedit             rix,
+
+  /etc/whonix_firewall.d/*.conf rw,
+
+  include if exists <local/whonix-firewall-edit>
+}
+

apparmor.d/groups/whonix/whonix-firewall-restarter

@@ -0,0 +1,47 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/whonix-firewall/firewall-restarter
+profile whonix-firewall-restarter @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/systemd-common>
+  include <abstractions/nameservice-strict>
+
+  capability chown,
+  capability net_admin,
+
+  ptrace read, # peer=,
+
+  @{exec_path} mr,
+
+  @{bin}/{,ba,da}sh         rix,
+  @{bin}/chown              rix,
+  @{bin}/inotifywait        rix,
+  @{bin}/mkdir              rix,
+  @{bin}/mkfifo             rix,
+  @{bin}/mktemp             rix,
+  @{bin}/rm                 rix,
+  @{bin}/systemctl          rix,
+
+  /etc/machine-id r,
+
+  /{run,var}/log/journal/ r,
+  /{run,var}/log/journal/@{md5}/ r,
+  /{run,var}/log/journal/@{md5}/user-@{hex}.journal* r,
+  /{run,var}/log/journal/@{md5}/system.journal* r,
+  /{run,var}/log/journal/@{md5}/system@@{hex}.journal* r,
+
+ owner /tmp/tmp.@{rand10} rw,
+
+       @{run}/sdwdate/{,*} rw,
+ owner @{run}/updatesproxycheck/{,*} rw,
+
+  include if exists <local/whonix-firewall-restarter>
+}
+

apparmor.d/groups/whonix/whonix-firewalld

@@ -0,0 +1,49 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/whonix_firewall @{lib}/whonix-firewall/reloadfirewall
+profile whonix-firewall @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+
+  capability net_admin,
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  @{bin}/{,ba,da}sh         rix,
+  @{bin}/date               rix,
+  @{bin}/id                 rix,
+  @{bin}/mkdir              rix,
+  @{bin}/rm                 rix,
+  @{bin}/touch              rix,
+  @{bin}/whonix-*-firewall  rix,
+  @{bin}/xtables-nft-multi  rix,
+
+  @{bin}/qubesdb-read      rPUx,
+  @{bin}/qubesdb-cmd       rPUx,
+
+  /etc/whonix_firewall.d/{,**} r,
+  /usr/local/etc/whonix_firewall.d/{,**} r,
+
+  /var/lib/whonix-firewall/{,**} rw,
+
+        @{run}/updatesproxycheck/ r,
+  owner @{run}/anon-firewall/{,**} rw,
+  owner @{run}/qubes-service/{,**} rw,
+  owner @{run}/updatesproxycheck/{,**} rw,
+  owner @{run}/whonix_firewall/{,**} rw,
+
+  include if exists <local/whonix-firewall>
+}

apparmor.d/tunables/home.d/whonix

@@ -0,0 +1,6 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+alias /usr/bin/apt -> /usr/bin/apt.anondist,
+alias /usr/bin/apt -> /usr/bin/apt.anondist-orig,