update apparmor profiles

apparmor.d/abstractions/wutmp

@@ -2,6 +2,7 @@
 #
 #    Copyright (C) 2002-2009 Novell/SUSE
 #    Copyright (C) 2009 Canonical Ltd.
+#    Copyright (C) 2021 Mikhail Morfikov
 #
 #    This program is free software; you can redistribute it and/or
 #    modify it under the terms of version 2 of the GNU General Public
@@ -14,7 +15,8 @@
   # some services update wtmp, utmp, and lastlog with per-user
   # connection information
   /var/log/lastlog  rwk,
-  /var/log/wtmp     wk,
+  /var/log/wtmp     rwk,
+  /var/log/btmp     rwk,
   @{run}/utmp       rwk,
 
   # Include additions to the abstraction

apparmor.d/accounts-daemon

@@ -35,7 +35,5 @@ profile accounts-daemon @{exec_path} {
   /etc/shells r,
   /etc/shadow r,
 
-  /var/log/wtmp r,
-
   include if exists <local/accounts-daemon>
 }

apparmor.d/adb

@@ -0,0 +1,38 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path}  = /{usr/,}bin/adb
+@{exec_path} += /{usr/,}lib/android-sdk/platform-tools/adb
+profile adb @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+  include <abstractions/devices-usb>
+  include <abstractions/user-download-strict>
+
+  # For adb kill-server:
+  #  cannot connect to daemon at tcp:5037: Permission denied
+  network inet stream,
+  network inet6 stream,
+
+  @{exec_path} mrix,
+
+  owner /tmp/adb.[0-9]*.log rw,
+
+  owner @{HOME}/.android/ rw,
+  owner @{HOME}/.android/adb.[0-9]* rw,
+  owner @{HOME}/.android/adbkey rw,
+
+  include if exists <local/adb>
+}

apparmor.d/cron-apt-compat

@@ -14,7 +14,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/apt-compat
-profile cron-apt-compat @{exec_path} flags=(complain) {
+profile cron-apt-compat @{exec_path} {
   include <abstractions/base>
 
   @{exec_path} r,

apparmor.d/cron-debtags

@@ -14,7 +14,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/debtags
-profile cron-debtags @{exec_path} flags=(complain) {
+profile cron-debtags @{exec_path} {
   include <abstractions/base>
 
   @{exec_path} r,

apparmor.d/cron-exim4-base

@@ -14,7 +14,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /etc/cron.daily/exim4-base
-profile cron-exim4-base @{exec_path} flags=(complain) {
+profile cron-exim4-base @{exec_path} {
   include <abstractions/base>
 
   capability dac_read_search,

apparmor.d/cron-man-db

@@ -14,7 +14,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/man-db
-profile cron-man-db @{exec_path} flags=(complain) {
+profile cron-man-db @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 

apparmor.d/id

@@ -0,0 +1,24 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/id
+profile id @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  include if exists <local/id>
+}

apparmor.d/last

@@ -0,0 +1,32 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/last{,b}
+profile last @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+  include <abstractions/wutmp>
+
+  # For the --dns flag
+  network inet dgram,
+  network inet6 dgram,
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  @{PROC}/@{pids}/loginuid r,
+
+  include if exists <local/last>
+}

apparmor.d/lastlog

@@ -0,0 +1,29 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/lastlog
+profile lastlog @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /var/log/lastlog r,
+  /etc/login.defs r,
+
+  include if exists <local/lastlog>
+}

apparmor.d/lightdm

@@ -97,7 +97,6 @@ profile lightdm @{exec_path} {
 
   # LightDM logs
   /var/log/lightdm/{,**} rw,
-  /var/log/btmp wk,
 
   @{run}/lightdm/{,**} rw,
   @{run}/lightdm.pid rw,

apparmor.d/sddm

@@ -101,7 +101,6 @@ profile sddm @{exec_path} {
   owner @{HOME}/.local/share/kwalletd/kdewallet.salt rw,
         @{HOME}/.local/share/kwalletd/kdewallet.salt r,
   owner @{run}/user/[0-9]*/kwallet5.socket rw,
-  /var/log/btmp wk,
 
   # Themes
   /usr/share/sddm/themes/** r,

apparmor.d/su

@@ -60,8 +60,6 @@ profile su @{exec_path} {
 
   /etc/shells r,
 
-  owner /var/log/btmp wk,
-
   # For pam_securetty
   @{PROC}/cmdline r,
   @{sys}/devices/virtual/tty/console/active r,

apparmor.d/utmpdump

@@ -0,0 +1,26 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/utmpdump
+profile utmpdump @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /var/log/wtmp{,.[0-9]*} r,
+  /var/log/btmp{,.[0-9]*} r,
+
+  include if exists <local/utmpdump>
+}

apparmor.d/w

@@ -0,0 +1,34 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/w
+profile w @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+  include <abstractions/wutmp>
+
+  ptrace (read),
+
+  @{exec_path} mr,
+
+  @{PROC}/ r,
+  @{PROC}/uptime r,
+  @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/loadavg r,
+  @{PROC}/@{pids}/stat r,
+  @{PROC}/@{pids}/cmdline r,
+
+  include if exists <local/w>
+}