diff --git a/apparmor.d/groups/apps/vlc b/apparmor.d/groups/apps/vlc index e4dea4e3..b65a73fd 100644 --- a/apparmor.d/groups/apps/vlc +++ b/apparmor.d/groups/apps/vlc @@ -198,6 +198,7 @@ profile vlc @{exec_path} { # Silencer deny @{lib}/@{multiarch}/vlc/{,**} w, + deny @{user_share_dirs}/gvfs-metadata/{*,} r, profile xdg-screensaver { include @@ -225,4 +226,4 @@ profile vlc @{exec_path} { } include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/groups/apt/apt-extracttemplates b/apparmor.d/groups/apt/apt-extracttemplates index 0e0b99dd..e30faa49 100644 --- a/apparmor.d/groups/apt/apt-extracttemplates +++ b/apparmor.d/groups/apt/apt-extracttemplates @@ -13,6 +13,8 @@ profile apt-extracttemplates @{exec_path} { include include + capability dac_read_search, + @{exec_path} mr, @{bin}/dpkg rPx -> child-dpkg, diff --git a/apparmor.d/groups/apt/apt-key b/apparmor.d/groups/apt/apt-key index 8cacc89b..54dbb540 100644 --- a/apparmor.d/groups/apt/apt-key +++ b/apparmor.d/groups/apt/apt-key @@ -15,7 +15,9 @@ profile apt-key @{exec_path} { @{exec_path} mr, @{bin}/{,ba,da}sh rix, - @{bin}/{,e}grep rix, + @{bin}/{,e,f}grep rix, + @{bin}/{,m,g}awk rix, + @{bin}/base64 rix, @{bin}/cat rix, @{bin}/chmod rix, @{bin}/cmp rix, @@ -27,6 +29,7 @@ profile apt-key @{exec_path} { @{bin}/mktemp rix, @{bin}/readlink rix, @{bin}/rm rix, + @{bin}/mv rix, @{bin}/sed rix, @{bin}/sort rix, @{bin}/touch rix, @@ -50,7 +53,7 @@ profile apt-key @{exec_path} { /root/ r, /etc/apt/trusted.gpg r, - /etc/apt/trusted.gpg.d/{,*.gpg} r, + /etc/apt/trusted.gpg.d/{,*.gpg,*.asc} r, /tmp/ r, owner /tmp/apt-key-gpghome.*/{,**} rw, @@ -99,6 +102,7 @@ profile apt-key @{exec_path} { owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, + include if exists } include if exists diff --git a/apparmor.d/groups/apt/apt-methods-rred b/apparmor.d/groups/apt/apt-methods-rred index ac80f623..bff3f986 100644 --- a/apparmor.d/groups/apt/apt-methods-rred +++ b/apparmor.d/groups/apt/apt-methods-rred @@ -23,6 +23,7 @@ profile apt-methods-rred @{exec_path} { signal (receive) peer=apt-get, signal (receive) peer=aptitude, signal (receive) peer=synaptic, + signal (receive) set=(int) peer=packagekitd, @{exec_path} mr, diff --git a/apparmor.d/groups/apt/dpkg-preconfigure b/apparmor.d/groups/apt/dpkg-preconfigure index aaa659b2..9f863a85 100644 --- a/apparmor.d/groups/apt/dpkg-preconfigure +++ b/apparmor.d/groups/apt/dpkg-preconfigure @@ -35,12 +35,17 @@ profile dpkg-preconfigure @{exec_path} { owner /tmp/*.template.* rw, owner /tmp/*.config.* rwPUx, + /var/lib/dbus/machine-id r, owner /var/cache/debconf/ rw, owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk, + owner /var/cache/debconf/tmp.ci/ r, owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw, + @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, @{run}/user/@{uid}/pk-debconf-socket rw, + owner @{PROC}/@{pid}/fd/ r, + # The following is needed when dpkg-preconfigure uses debcconf GUI frontends. include include diff --git a/apparmor.d/groups/apt/synaptic b/apparmor.d/groups/apt/synaptic index 44468d0b..fa7bcbc7 100644 --- a/apparmor.d/groups/apt/synaptic +++ b/apparmor.d/groups/apt/synaptic @@ -64,8 +64,9 @@ profile synaptic @{exec_path} { @{exec_path} mr, @{bin}/{,ba,da}sh rix, + @{bin}/{,e,f}grep rix, @{bin}/test rix, - @{bin}/{,e}grep rix, + @{bin}/echo rix, # For update-apt-xapian-index @{bin}/nice rix, @@ -81,6 +82,7 @@ profile synaptic @{exec_path} { #@{bin}/dbus-send rCx -> dbus, deny @{bin}/dbus-launch rx, deny @{bin}/dbus-send rx, + deny @{bin}/gdbus rx, @{bin}/ps rPx, @{bin}/dpkg rPx, @@ -99,6 +101,7 @@ profile synaptic @{exec_path} { @{bin}/deborphan rPx, @{bin}/tasksel rPx, @{bin}/pkexec rPx, + @{bin}/software-properties-gtk rPx, # Methods to use to download packages from the net @{lib}/apt/methods/* rPx, @@ -139,6 +142,8 @@ profile synaptic @{exec_path} { owner @{HOME}/.synaptic/** rwk, @{run}/synaptic.socket w, + @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, + owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, @@ -158,6 +163,7 @@ profile synaptic @{exec_path} { # file_inherit owner /dev/tty@{int} rw, + deny @{user_share_dirs}/gvfs-metadata/{*,} r, profile dbus { include diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index 3399abae..d5bed9b4 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -21,6 +21,12 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) { unix (connect, receive, send) type=stream peer=(label=ibus-daemon), + network inet stream, + network inet6 stream, + network inet dgram, + network inet6 dgram, + network netlink raw, + dbus send bus=session path=/org/a11y/bus interface=org.a11y.Bus member=GetAddress diff --git a/apparmor.d/groups/children/child-open b/apparmor.d/groups/children/child-open index ddd2f86b..f3d028f2 100644 --- a/apparmor.d/groups/children/child-open +++ b/apparmor.d/groups/children/child-open @@ -76,7 +76,7 @@ profile child-open { @{bin}/gnome-calculator rPUx, @{bin}/gnome-disk-image-mounter rPx, @{bin}/gnome-disks rPx, - @{bin}/gwenview rPUx, + @{bin}/gwenview rPUx, @{bin}/kgx rPx, @{bin}/okular rPx, @{bin}/qbittorrent rPx, @@ -88,8 +88,9 @@ profile child-open { @{bin}/thunderbird rPx, @{bin}/transmission-gtk rPx, @{bin}/viewnior rPUx, - @{bin}/vlc rPUx, + @{bin}/vlc rPUx, @{bin}/xarchiver rPx, + @{bin}/xbrlapi rPx, @{lib}/libreoffice/program/{soffice,soffice.bin,oosplash} rPUx, diff --git a/apparmor.d/groups/freedesktop/accounts-daemon b/apparmor.d/groups/freedesktop/accounts-daemon index b9719066..a67cf060 100644 --- a/apparmor.d/groups/freedesktop/accounts-daemon +++ b/apparmor.d/groups/freedesktop/accounts-daemon @@ -47,6 +47,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) { @{bin}/cat rix, @{bin}/chage rPx, @{bin}/passwd rPx, + @{bin}/chpasswd rPx, @{bin}/userdel rPx, @{bin}/usermod rPx, @{bin}/locale rPUx, diff --git a/apparmor.d/groups/freedesktop/geoclue b/apparmor.d/groups/freedesktop/geoclue index 63ad11ee..c03b3c1b 100644 --- a/apparmor.d/groups/freedesktop/geoclue +++ b/apparmor.d/groups/freedesktop/geoclue @@ -75,6 +75,7 @@ profile geoclue @{exec_path} flags=(attach_disconnected) { /etc/geoclue/{,**} r, /var/lib/nscd/services r, + /var/lib/dbus/machine-id r, @{run}/systemd/journal/socket rw, diff --git a/apparmor.d/groups/freedesktop/plymouthd b/apparmor.d/groups/freedesktop/plymouthd index e7d586c6..ea4ea636 100644 --- a/apparmor.d/groups/freedesktop/plymouthd +++ b/apparmor.d/groups/freedesktop/plymouthd @@ -19,6 +19,7 @@ profile plymouthd @{exec_path} { network netlink raw, signal (send) peer=unconfined, + signal (send) set=(rtmin+23) peer=systemd-shutdown, ptrace (read) peer=plymouth, @@ -63,4 +64,4 @@ profile plymouthd @{exec_path} { /dev/ttyS[0-9]* rw, include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/groups/freedesktop/xdg-user-dirs-update b/apparmor.d/groups/freedesktop/xdg-user-dirs-update index 0dd4238f..3f43a990 100644 --- a/apparmor.d/groups/freedesktop/xdg-user-dirs-update +++ b/apparmor.d/groups/freedesktop/xdg-user-dirs-update @@ -48,6 +48,7 @@ profile xdg-user-dirs-update @{exec_path} { owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/ w, owner @{HOME}/@{XDG_TEMPLATES_DIR}/ w, owner @{HOME}/@{XDG_VIDEOS_DIR}/ w, + owner @{user_config_dirs}/ w, owner @{user_config_dirs}/user-dirs.dirs rw, owner @{user_config_dirs}/user-dirs.dirs@{rand6} rw, diff --git a/apparmor.d/groups/gnome/gdm-session-worker b/apparmor.d/groups/gnome/gdm-session-worker index 4d4f9050..838d524c 100644 --- a/apparmor.d/groups/gnome/gdm-session-worker +++ b/apparmor.d/groups/gnome/gdm-session-worker @@ -19,6 +19,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { capability dac_override, capability dac_read_search, capability fowner, + capability fsetid, capability kill, capability net_admin, capability setgid, @@ -107,5 +108,10 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) { /dev/tty rw, /dev/tty@{int} rw, + # Add user; set password on first login + /etc/.pwd.lock wk, + /etc/nshadow rw, + /etc/shadow w, + include if exists } diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index a53b26b1..d6192c02 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -132,6 +132,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { owner @{HOME}/.cat_installer/ca.pem r, owner @{HOME}/.cert/nm-openvpn/*.pem r, + owner @{HOME}/.face r, owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, owner @{user_cache_dirs}/gnome-control-center/{,**} rw, owner @{user_cache_dirs}/thumbnails/{,**} rw, diff --git a/apparmor.d/groups/gnome/gnome-session-binary b/apparmor.d/groups/gnome/gnome-session-binary index 68a2f341..d0729a85 100644 --- a/apparmor.d/groups/gnome/gnome-session-binary +++ b/apparmor.d/groups/gnome/gnome-session-binary @@ -153,9 +153,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) { @{lib}/gnome-session-failed rix, @{lib}/gsd-* rPx, - # TODO: rCx gio-launch-desktop and put all the following program in this - # subprofile. Not done yet as it breaks compatibility with Ubuntu/Debian @{lib}/gio-launch-desktop rix, + @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix, @{bin}/aa-notify rPx, @{bin}/baloo_file rPx, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index 2dc8a7dd..38089261 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -473,6 +473,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { @{bin}/Xwayland rPx, @{lib}/polkit-1/polkit* rPx, @{lib}/* rPUx, + @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix, /usr/share/gnome-shell/extensions/ding@rastersoft.com/ding.js rPx, @@ -506,8 +507,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { /.flatpak-info r, /etc/fstab r, - /etc/udev/hwdb.bin r, /etc/pipewire/client.conf.d/{,**} r, + /etc/timezone r, + /etc/udev/hwdb.bin r, /etc/xdg/menus/gnome-applications.menu r, /var/lib/gdm{3,}/.cache/ w, @@ -542,6 +544,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { /var/lib/snapd/desktop/icons/{,**} r, + owner @{HOME}/.face r, owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r, owner @{HOME}/.var/app/**/ r, owner @{HOME}/.var/app/**.{png,jpg,svg} r, @@ -555,6 +558,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/ibus/ w, owner @{user_config_dirs}/monitors.xml{,~} rwl, owner @{user_config_dirs}/pulse/ r, + owner @{user_config_dirs}/pulse/ w, # change to 'c' owner @{user_config_dirs}/tiling-assistant/{,**} rw, owner @{user_share_dirs}/backgrounds/{,**} rw, diff --git a/apparmor.d/groups/gnome/gnome-software b/apparmor.d/groups/gnome/gnome-software index 9726777d..b7bf3af9 100644 --- a/apparmor.d/groups/gnome/gnome-software +++ b/apparmor.d/groups/gnome/gnome-software @@ -61,6 +61,8 @@ profile gnome-software @{exec_path} { /var/cache/app-info/xmls/{,**} r, /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r, + /var/lib/apt/lists/*.yml.gz r, + /var/lib/flatpak/app/{,**} r, /var/lib/flatpak/appstream/{,**} r, /var/lib/flatpak/repo/{,**} r, @@ -68,6 +70,8 @@ profile gnome-software @{exec_path} { /var/lib/PackageKit/offline-update-competed r, /var/lib/PackageKit/prepared-update r, + /var/lib/swcatalog/icons/**.png r, + /var/lib/swcatalog/yaml/ r, /var/tmp/flatpak-cache-*/ rw, /var/tmp/flatpak-cache-*/** rwkl, @@ -143,4 +147,4 @@ profile gnome-software @{exec_path} { } include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/groups/gnome/gnome-system-monitor b/apparmor.d/groups/gnome/gnome-system-monitor index 0e810716..be5bcf3d 100644 --- a/apparmor.d/groups/gnome/gnome-system-monitor +++ b/apparmor.d/groups/gnome/gnome-system-monitor @@ -29,6 +29,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { @{bin}/pkexec rPx, /usr/share/gnome-system-monitor/{,**} r, + /usr/share/firefox-esr/browser/chrome/icons/default/*.png r, # freedesktop.org-strict /usr/share/pixmaps/{,**} r, @@ -40,13 +41,14 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) { /var/lib/snapd/desktop/icons/ r, owner @{run}/user/@{uid}/doc/ rw, + owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, @{run}/systemd/sessions/* r, @{run}/systemd/sessions/*.ref r, - @{sys}/devices/@{pci}/net/*/statistics/collisions r, - @{sys}/devices/@{pci}/net/*/statistics/rx_{bytes,errors,packets} r, - @{sys}/devices/@{pci}/net/*/statistics/tx_{bytes,errors,packets} r, + @{sys}/devices/@{pci}/{,*/}net/*/statistics/collisions r, + @{sys}/devices/@{pci}/{,*/}net/*/statistics/rx_{bytes,errors,packets} r, + @{sys}/devices/@{pci}/{,*/}net/*/statistics/tx_{bytes,errors,packets} r, @{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/collisions r, @{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/rx_{bytes,errors,packets} r, @{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/tx_{bytes,errors,packets} r, diff --git a/apparmor.d/groups/gnome/gsd-color b/apparmor.d/groups/gnome/gsd-color index 2405ffe7..a6cfa808 100644 --- a/apparmor.d/groups/gnome/gsd-color +++ b/apparmor.d/groups/gnome/gsd-color @@ -125,6 +125,8 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) { /usr/share/mime/mime.cache r, /usr/share/X11/xkb/** r, + /etc/timezone r, + /var/lib/flatpak/exports/share/mime/mime.cache r, /var/lib/gdm{3,}/.config/dconf/user r, /var/lib/gdm{3,}/.local/share/icc/ rw, diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 8bf6eed4..b745fe76 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -95,10 +95,14 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { /etc/fstab r, /etc/libva.conf r, + # dri-common-strict + /usr/share/drirc.d/{,*.conf} r, + /var/lib/gdm{3,}/.cache/ rw, /var/lib/gdm{3,}/.cache/tracker3/{,**} rw, /var/lib/gdm{3,}/.cache/gstreamer-1.0/ rw, /var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw, + /var/lib/gdm{3,}/.config/dconf/user r, /var/lib/gdm{3,}/greeter-dconf-defaults r, /var/lib/lightdm/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} r, @@ -130,6 +134,9 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { @{run}/mount/utab r, + @{sys}/devices/pci[0-9]*/*/vendor r, + @{sys}/devices/pci[0-9]*/*/device r, + owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/groups/gnome/tracker-miner b/apparmor.d/groups/gnome/tracker-miner index 7b216d01..d4c7f5f5 100644 --- a/apparmor.d/groups/gnome/tracker-miner +++ b/apparmor.d/groups/gnome/tracker-miner @@ -77,6 +77,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { /etc/fstab r, /etc/blkid.conf r, + /etc/timezone r, /var/lib/flatpak/exports/share/applications/{,mimeinfo.cache} r, /var/lib/snapd/desktop/applications/{,mimeinfo.cache} r, @@ -84,6 +85,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) { /var/lib/gdm{3,}/ r, /var/lib/gdm{3,}/.cache/tracker3/{,tracker3/}files/{,**} rwk, /var/lib/gdm{3,}/.local/share/applications/ r, + /var/lib/gdm{3,}/.config/dconf/user r, /var/lib/gdm{3,}/greeter-dconf-defaults r, /var/lib/lightdm/.config/dconf/user r, diff --git a/apparmor.d/groups/network/nm-dispatcher b/apparmor.d/groups/network/nm-dispatcher index e4b8ade7..9bae1db2 100644 --- a/apparmor.d/groups/network/nm-dispatcher +++ b/apparmor.d/groups/network/nm-dispatcher @@ -77,6 +77,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) { /etc/network/if-*.d/ r, /etc/network/if-*.d/* rPUx, + /etc/wpa_supplicant/ifupdown.sh rPUx, include if exists } diff --git a/apparmor.d/groups/ssh/ssh-agent-launch b/apparmor.d/groups/ssh/ssh-agent-launch index a96406ec..1ecd8b87 100644 --- a/apparmor.d/groups/ssh/ssh-agent-launch +++ b/apparmor.d/groups/ssh/ssh-agent-launch @@ -17,14 +17,15 @@ profile ssh-agent-launch @{exec_path} { @{bin}/grep rix, @{bin}/ssh-agent rPx, + /etc/X11/Xsession.options r, + profile dbus { include - @{bin}/dbus-update-activation-environment mr, include if exists } include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/groups/systemd/systemd-oomd b/apparmor.d/groups/systemd/systemd-oomd index dc3b9ad1..93603c69 100644 --- a/apparmor.d/groups/systemd/systemd-oomd +++ b/apparmor.d/groups/systemd/systemd-oomd @@ -33,9 +33,9 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) { @{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/memory.pressure r, - @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}0.service/memory.* r, + @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/memory.* r, @{PROC}/pressure/{cpu,io,memory} r, include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/groups/systemd/systemd-shutdown b/apparmor.d/groups/systemd/systemd-shutdown index 5622cc14..e59777f6 100644 --- a/apparmor.d/groups/systemd/systemd-shutdown +++ b/apparmor.d/groups/systemd/systemd-shutdown @@ -8,7 +8,7 @@ abi , include @{exec_path} = @{lib}/systemd/systemd-shutdown -profile systemd-shutdown @{exec_path} flags=(complain) { +profile systemd-shutdown @{exec_path} { include include @@ -17,7 +17,8 @@ profile systemd-shutdown @{exec_path} flags=(complain) { capability sys_ptrace, capability sys_resource, - signal (send) set=(stop, cont, term, kill), + signal (send) set=(stop, cont, term, kill), + signal (receive) set=(rtmin+23) peer=plymouthd, @{exec_path} mr, @@ -29,5 +30,7 @@ profile systemd-shutdown @{exec_path} flags=(complain) { owner @{PROC}/sys/kernel/core_pattern w, owner @{PROC}/sys/kernel/printk rw, + /dev/watchdog@{int} w, + include if exists } diff --git a/apparmor.d/groups/ubuntu/software-properties-dbus b/apparmor.d/groups/ubuntu/software-properties-dbus index 786bdf7e..ce36afa3 100644 --- a/apparmor.d/groups/ubuntu/software-properties-dbus +++ b/apparmor.d/groups/ubuntu/software-properties-dbus @@ -35,18 +35,22 @@ profile software-properties-dbus @{exec_path} { @{bin}/python3.[0-9]* rix, @{bin}/env rix, + @{bin}/apt-key rPx, # Changing trusted keys @{bin}/lsb_release rPx -> lsb_release, + /etc/apt/apt.conf.d/10periodic w, + /etc/apt/sources.list{,.save} rw, + /usr/share/python-apt/{,**} r, /usr/share/distro-info/*.csv r, /usr/share/xml/iso-codes/{,**} r, - owner /tmp/[a-z0-9]* rw, - owner /tmp/_[a-z0-9]* rw, - owner /tmp/tmp*/{,apt.conf} rw, + owner /tmp/???????? rw, + owner /tmp/tmp????????/ w, # change to 'c' + owner /tmp/tmp????????/apt.conf w, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/groups/ubuntu/software-properties-gtk b/apparmor.d/groups/ubuntu/software-properties-gtk index 4fa437c9..64426e33 100644 --- a/apparmor.d/groups/ubuntu/software-properties-gtk +++ b/apparmor.d/groups/ubuntu/software-properties-gtk @@ -40,6 +40,7 @@ profile software-properties-gtk @{exec_path} { @{bin}/ r, + @{bin}/python3.[0-9]* r, @{bin}/{,da,ba}sh rix, @{bin}/aplay rPx, @{bin}/apt-key rPx, @@ -49,7 +50,6 @@ profile software-properties-gtk @{exec_path} { @{bin}/ubuntu-advantage rPx, /usr/share/distro-info/*.csv r, - /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/icons/{,**} r, /usr/share/mime/mime.cache r, /usr/share/pixmaps/ r, @@ -59,6 +59,7 @@ profile software-properties-gtk @{exec_path} { /usr/share/ubuntu-drivers-common/detect/{,**} r, /usr/share/X11/xkb/{,**} r, /usr/share/xml/iso-codes/{,**} r, + /usr/share/software-properties/gtkbuilder/* r, /etc/apport/blacklist.d/{,*} r, /etc/default/apport r, @@ -70,8 +71,11 @@ profile software-properties-gtk @{exec_path} { /var/lib/snapd/desktop/icons/ r, /var/lib/ubuntu-advantage/status.json r, - owner /tmp/[a-z0-9]* rw, - owner /tmp/tmp*/{,apt.conf} rw, + owner /tmp/???????? rw, + owner /tmp/tmp????????/ rw, # change to 'c' + owner /tmp/tmp????????/apt.conf rw, + + owner @{run}/user/@{uid}/gnome-shell-disable-extensions w, @{sys}/devices/ r, @{sys}/devices/**/ r, @@ -89,4 +93,4 @@ profile software-properties-gtk @{exec_path} { deny @{user_share_dirs}/gvfs-metadata/* r, include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/profiles-a-f/adduser b/apparmor.d/profiles-a-f/adduser index 7813a892..3c6006dd 100644 --- a/apparmor.d/profiles-a-f/adduser +++ b/apparmor.d/profiles-a-f/adduser @@ -16,6 +16,8 @@ profile adduser @{exec_path} { capability chown, capability dac_override, capability dac_read_search, + capability setuid, + capability setgid, capability fowner, capability fsetid, @@ -40,6 +42,8 @@ profile adduser @{exec_path} { /etc/adduser.conf r, /etc/skel/{,.*} r, + @{run}/adduser wk, + # To create user dirs and copy files from /etc/skel/ to them @{HOME}/ rw, @{HOME}/.* w, diff --git a/apparmor.d/profiles-a-f/augenrules b/apparmor.d/profiles-a-f/augenrules index d6220546..198e32c5 100644 --- a/apparmor.d/profiles-a-f/augenrules +++ b/apparmor.d/profiles-a-f/augenrules @@ -18,8 +18,8 @@ profile augenrules @{exec_path} { @{bin}/chmod rix, @{bin}/cmp rix, @{bin}/cp rix, - @{bin}/gawk rix, - @{bin}/grep rix, + @{bin}/{,g,m}awk rix, + @{bin}/{,e,f}grep rix, @{bin}/ls rix, @{bin}/mktemp rix, @{bin}/rm rix, @@ -27,9 +27,9 @@ profile augenrules @{exec_path} { /etc/audit/audit.rules rw, /etc/audit/rules.d/{,*} r, - owner /tmp/aurules.* rw, + owner /tmp/aurules.@{rand8} rw, /dev/tty rw, include if exists -} \ No newline at end of file +} diff --git a/apparmor.d/profiles-a-f/chpasswd b/apparmor.d/profiles-a-f/chpasswd new file mode 100644 index 00000000..24106299 --- /dev/null +++ b/apparmor.d/profiles-a-f/chpasswd @@ -0,0 +1,34 @@ +# apparmor.d - Full set of apparmor profiles +# SPDX-License-Identifier: GPL-2.0-only + +include + +@{exec_path} = @{bin}/chpasswd +profile chpasswd @{exec_path} { + include + include + include + + capability chown, + capability fsetid, + capability setuid, + + signal (receive) set=(term, kill) peer=gnome-control-center, + + @{exec_path} mr, + + /etc/.pwd.lock wk, + /etc/login.defs r, + /etc/shadow rw, + /etc/shadow.@{int} w, + /etc/shadow.lock w, # change to 'd' + /etc/shadow.lock l -> /etc/shadow.@{int}, + /etc/shadow- w, + /etc/shadow+ rw, + /etc/passwd rw, + /etc/passwd.@{int} w, + /etc/passwd.lock w, # change to 'd' + /etc/passwd.lock l -> /etc/passwd.@{int}, + + include if exists +} diff --git a/apparmor.d/profiles-a-f/cups-browsed b/apparmor.d/profiles-a-f/cups-browsed index ed117a5a..fa4cda6f 100644 --- a/apparmor.d/profiles-a-f/cups-browsed +++ b/apparmor.d/profiles-a-f/cups-browsed @@ -65,5 +65,7 @@ profile cups-browsed @{exec_path} { @{run}/cups/certs/* r, + @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r, + include if exists } diff --git a/apparmor.d/profiles-g-l/ifup b/apparmor.d/profiles-g-l/ifup index e7c17b40..d1baa058 100644 --- a/apparmor.d/profiles-g-l/ifup +++ b/apparmor.d/profiles-g-l/ifup @@ -56,6 +56,7 @@ profile ifup @{exec_path} { /etc/network/if-down.d/ r, /etc/network/if-down.d/resolvconf rPUx, + /etc/network/if-down.d/resolved rPUx, /etc/network/if-down.d/openvpn rPUx, /etc/network/if-down.d/wpasupplicant rPUx, /etc/wpa_supplicant/ifupdown.sh rPUx, @@ -84,6 +85,7 @@ profile ifup @{exec_path} { /etc/network/if-up.d/ r, /etc/network/if-up.d/*resolvconf rPUx, + /etc/network/if-up.d/resolved rPUx, /etc/network/if-up.d/chrony rPUx, /etc/network/if-up.d/ethtool rPUx, /etc/network/if-up.d/ifenslave rPUx, diff --git a/apparmor.d/profiles-m-r/packagekitd b/apparmor.d/profiles-m-r/packagekitd index 0b330712..94949bdd 100644 --- a/apparmor.d/profiles-m-r/packagekitd +++ b/apparmor.d/profiles-m-r/packagekitd @@ -120,6 +120,9 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { /usr/** rwlk -> /usr/**, /var/** rwlk -> /var/**, + /tmp/apt-changelog-@{rand6}/ w, + /tmp/apt-changelog-@{rand6}/*.changelog rw, + owner /tmp/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw, owner /tmp/packagekit* rw, @{run}/systemd/inhibit/*.ref rw, @@ -137,7 +140,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/mountinfo r, @{PROC}/sys/kernel/random/uuid r, - owner @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/mounts r, diff --git a/apparmor.d/profiles-s-z/wireplumber b/apparmor.d/profiles-s-z/wireplumber index 77fcb60d..ae9b846c 100644 --- a/apparmor.d/profiles-s-z/wireplumber +++ b/apparmor.d/profiles-s-z/wireplumber @@ -58,6 +58,8 @@ profile wireplumber @{exec_path} { @{sys}/devices/pci[0-9]*/**/modalias r, @{sys}/devices/pci[0-9]*/**/video4linux/video[0-9]*/uevent r, @{sys}/devices/virtual/dmi/id/bios_vendor r, + @{sys}/devices/virtual/dmi/id/product_name r, + @{sys}/devices/virtual/dmi/id/sys_vendor r, owner @{PROC}/@{pid}/task/@{tid}/comm rw,