mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): start using the new bwrap abs.

Browse source
This commit is contained in:
Alexandre Pujol 2024-02-28 23:52:15 +00:00
parent cbbb2b4a3e
commit cda8f30c29
Failed to generate hash of commit
3 changed files with 4 additions and 68 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
apparmor.d/groups/_full/bwrap
View file

@ -11,33 +11,19 @@ include <tunables/global>
@{exec_path} = @{bin}/bwrap
profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/bwrap>
include <abstractions/bwrap-app>
include <abstractions/dbus>
include <abstractions/fontconfig-cache-write>
capability dac_override,
capability dac_read_search,
capability net_admin,
capability setpcap,
capability sys_admin,
capability sys_ptrace,
capability sys_resource,
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
network netlink raw,
mount options=(rw, silent, rslave) -> /,
mount fstype=tmpfs -> /tmp/,
mount -> /newroot/{,**},
mount -> /oldroot/,
mount -> /tmp/newroot/,
umount /{,oldroot/},
pivot_root oldroot=/newroot/ -> /newroot/,
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
ptrace peer=bwrap//&bwrap-app,
@ -66,13 +52,6 @@ profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{run}/ld-so-cache-dir/* rw,
@{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r,
@{PROC}/sys/user/max_user_namespaces w,
owner @{PROC}/@{pid}/gid_map rw,
owner @{PROC}/@{pid}/setgroups rw,
owner @{PROC}/@{pid}/uid_map rw,
include if exists <usr/bwrap.d>
include if exists <local/bwrap>
}

27
apparmor.d/profiles-a-f/flatpak-app
View file

@ -22,18 +22,15 @@ include <tunables/global>
profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/bwrap-app>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/bwrap-app>
include <abstractions/bwrap>
capability dac_override,
capability dac_read_search,
capability net_admin,
# When bwrap is setup with setuid privileges, it needs the setuid capability.
capability setuid,
capability setpcap,
capability sys_admin,
capability sys_ptrace,
capability sys_resource,
network inet dgram,
@ -43,16 +40,6 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
network netlink dgram,
network netlink raw,
mount options=(rw, silent, rslave) -> /,
mount fstype=tmpfs -> /tmp/,
mount -> /newroot/{,**},
mount -> /oldroot/,
mount -> /tmp/newroot/,
umount /{,oldroot/},
pivot_root oldroot=/newroot/ -> /newroot/,
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
ptrace (read),
signal (receive) set=(int) peer=flatpak-portal,
@ -95,16 +82,6 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
owner @{run}/flatpak/app/*/*ipc* rw,
owner @{run}/ld-so-cache-dir/* rw,
@{PROC}/@{pid}/fd/ r,
@{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r,
@{PROC}/sys/user/max_user_namespaces w,
owner @{PROC}/@{pid}/gid_map rw,
owner @{PROC}/@{pid}/setgroups rw,
owner @{PROC}/@{pid}/uid_map rw,
deny /apparmor/.null rw,
include if exists <usr/flatpak-app.d>
include if exists <local/flatpak-app>
}

22
apparmor.d/profiles-s-z/steam-game
View file

@ -24,6 +24,7 @@ include <tunables/global>
profile steam-game @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio>
include <abstractions/bwrap>
include <abstractions/desktop>
include <abstractions/devices-usb>
include <abstractions/fontconfig-cache-write>
@ -34,9 +35,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
capability dac_override,
capability dac_read_search,
capability setpcap,
capability sys_admin,
capability sys_ptrace,
network inet dgram,
network inet6 dgram,
@ -44,16 +42,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
network inet6 stream,
network netlink raw,
mount options=(rw, silent, rslave) -> /,
mount fstype=tmpfs -> /tmp/,
mount -> /newroot/{,**},
mount -> /oldroot/,
mount -> /tmp/newroot/,
umount /{,oldroot/},
pivot_root oldroot=/newroot/ -> /newroot/,
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
signal (receive) peer=steam,
unix (receive) type=stream,
@ -122,8 +110,6 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
/etc/udev/udev.conf r,
/var/lib/dbus/machine-id r,
/newroot/{,**} rw,
/var/cache/ldconfig/aux-cache* rw,
/ r,
@ -206,21 +192,15 @@ profile steam-game @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/net/dev r,
@{PROC}/@{pids}/net/route r,
@{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r,
@{PROC}/uptime r,
@{PROC}/version r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/gid_map rw,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/setgroups rw,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/uid_map rw,
/dev/hidraw@{int} rw,
/dev/input/ r,