mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-16 00:13:48 +01:00
248 lines
8.4 KiB
Plaintext
248 lines
8.4 KiB
Plaintext
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
# Default profile for steam games
|
|
|
|
# TODO:
|
|
# Split this profile in three:
|
|
# - steam-game-native for native linux games
|
|
# - steam-runtime for all runtime related task up to the creation of the sandbox
|
|
# - steam-game-proton for the sandboxed proton games
|
|
# Requirments:
|
|
# - AppArmor supports for {*^} regex
|
|
# - AppArmor supports change profile from pivot_root
|
|
# - Bypass no-new-privs issue
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{runtime} = @{user_share_dirs}/Steam/steamapps/common/SteamLinuxRuntime_soldier
|
|
@{steam_lib_dirs} = @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}
|
|
@{exec_path} = @{user_share_dirs}/Steam/steamapps/common/*/**
|
|
profile steam-game @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/audio>
|
|
include <abstractions/devices-usb>
|
|
include <abstractions/dri-common>
|
|
include <abstractions/dri-enumerate>
|
|
include <abstractions/fontconfig-cache-write>
|
|
include <abstractions/fonts>
|
|
include <abstractions/mesa>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/opencl-nvidia>
|
|
include <abstractions/python>
|
|
include <abstractions/ssl_certs>
|
|
include <abstractions/vulkan>
|
|
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability setpcap,
|
|
capability sys_admin,
|
|
capability sys_ptrace,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
mount options=(rw, silent, rslave) -> /,
|
|
mount fstype=tmpfs -> /tmp/,
|
|
mount -> /newroot/{,**},
|
|
mount -> /oldroot/,
|
|
mount -> /tmp/newroot/,
|
|
umount /{,oldroot/},
|
|
|
|
pivot_root /newroot/,
|
|
pivot_root oldroot=/tmp/oldroot/ /tmp/,
|
|
|
|
signal (receive) peer=steam,
|
|
|
|
unix (receive) type=stream,
|
|
|
|
@{exec_path} mrix,
|
|
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
/{usr/,}bin/bwrap rix,
|
|
/{usr/,}bin/env rix,
|
|
/{usr/,}bin/getopt rix,
|
|
/{usr/,}bin/gzip rix,
|
|
/{usr/,}bin/localedef rix,
|
|
/{usr/,}bin/python3.[0-9]* rix,
|
|
/{usr/,}bin/readlink rix,
|
|
/{usr/,}bin/steam-runtime-launcher-interface-* rix,
|
|
/{usr/,}bin/steam-runtime-system-info rix,
|
|
/{usr/,}bin/timeout rix,
|
|
/{usr/,}bin/true rix,
|
|
/{usr/,}bin/uname rix,
|
|
/{usr/,}bin/xdg-open rPx,
|
|
|
|
/{usr/,}lib/pressure-vessel/from-host/bin/pressure-vessel-adverb rix,
|
|
/{usr/,}lib/pressure-vessel/from-host/bin/pressure-vessel-locale-gen rix,
|
|
/{usr/,}lib/pressure-vessel/from-host/bin/pressure-vessel-try-setlocale rix,
|
|
/{usr/,}lib/pressure-vessel/from-host/libexec/steam-runtime-tools-*/*-detect-platform rix,
|
|
/{usr/,}libexec/steam-runtime-tools*/* mrix,
|
|
|
|
@{runtime}/pressure-vessel/bin/pressure-vessel-unruntime rix,
|
|
@{runtime}/pressure-vessel/bin/pressure-vessel-wrap rix,
|
|
@{runtime}/pressure-vessel/bin/pv-bwrap rix,
|
|
@{runtime}/pressure-vessel/bin/steam-runtime-launcher-interface-* rix,
|
|
@{runtime}/pressure-vessel/lib{,exec}/ r,
|
|
@{runtime}/pressure-vessel/lib{,exec}/** mrix,
|
|
@{runtime}/run rix,
|
|
|
|
@{steam_lib_dirs}/{,**} r,
|
|
@{steam_lib_dirs}/**.so* mr,
|
|
@{steam_lib_dirs}/reaper rix,
|
|
@{steam_lib_dirs}/steam-launch-wrapper rm,
|
|
@{steam_lib_dirs}/steam-runtime/{usr/,}lib{exec,}/** mrix,
|
|
@{user_share_dirs}/Steam/bin/ r,
|
|
@{user_share_dirs}/Steam/bin/* mr,
|
|
@{user_share_dirs}/Steam/d3ddriverquery64.dxvk-cache rw,
|
|
@{user_share_dirs}/Steam/legacycompat/ r,
|
|
@{user_share_dirs}/Steam/legacycompat/** mr,
|
|
@{user_share_dirs}/Steam/linux{32,64}/ r,
|
|
@{user_share_dirs}/Steam/linux{32,64}/**.so* mr,
|
|
@{user_share_dirs}/Steam/standalone_installscript_progress_[0-9]*.vdf rw,
|
|
@{user_share_dirs}/Steam/steamapps/common/*/* mr,
|
|
@{user_share_dirs}/Steam/steamapps/common/Proton*/ r,
|
|
@{user_share_dirs}/Steam/steamapps/common/Proton*/files/bin/* mrix,
|
|
@{user_share_dirs}/Steam/steamapps/common/Proton*/files/lib{,32,64}/** mrix,
|
|
@{user_share_dirs}/Steam/steamapps/common/Proton*/proton rix,
|
|
@{user_share_dirs}/Steam/steamapps/compatdata/[0-9]*/pfx/**.dll rm,
|
|
|
|
@{user_games_dirs}/*/* mr,
|
|
@{user_games_dirs}/*/**.dll mr,
|
|
|
|
@{run}/host/usr/bin/ldconfig rix,
|
|
@{run}/host/usr/lib{,32,64}/**.so* rm,
|
|
@{run}/host/usr/bin/localedef rix,
|
|
|
|
/usr/share/egl/{,**} r,
|
|
/usr/share/icons/{,**} r,
|
|
/usr/share/terminfo/x/xterm-256color r,
|
|
|
|
/etc/machine-id r,
|
|
/etc/udev/udev.conf r,
|
|
/var/lib/dbus/machine-id r,
|
|
|
|
/newroot/{,**} rw,
|
|
|
|
/var/cache/ldconfig/aux-cache* rw,
|
|
|
|
/ r,
|
|
/{usr/,}{local/,} r,
|
|
/{usr/,}{local/,}lib{,32,64}/ r,
|
|
/bindfile* rw,
|
|
/home/ r,
|
|
/tmp/ r,
|
|
|
|
owner @{HOME}/ r,
|
|
owner @{HOME}/.local/ r,
|
|
owner @{HOME}/.steam/steam.pid r,
|
|
owner @{HOME}/.steam/steam.pipe r,
|
|
|
|
owner @{user_games_dirs}/{,*/} r,
|
|
owner @{user_games_dirs}/*/{,**} rwkl,
|
|
|
|
owner @{user_config_dirs}/ r,
|
|
owner @{user_config_dirs}/unity3d/{,**} rwk,
|
|
|
|
owner @{user_share_dirs}/ r,
|
|
owner @{user_share_dirs}/Steam/ r,
|
|
owner @{user_share_dirs}/Steam/* r,
|
|
owner @{user_share_dirs}/Steam/*log* rw,
|
|
owner @{user_share_dirs}/Steam/config/config.vdf* rw,
|
|
owner @{user_share_dirs}/Steam/logs/{,*} rw,
|
|
owner @{user_share_dirs}/Steam/shader_cache_temp*/fozpipelinesv*/{,**} rw,
|
|
owner @{user_share_dirs}/Steam/steamapps/ r,
|
|
owner @{user_share_dirs}/Steam/steamapps/common/ r,
|
|
owner @{user_share_dirs}/Steam/steamapps/common/*/ r,
|
|
owner @{user_share_dirs}/Steam/steamapps/common/*/** rwkl,
|
|
owner @{user_share_dirs}/Steam/steamapps/common/Proton*/files/share/{,**} r,
|
|
owner @{user_share_dirs}/Steam/steamapps/compatdata/{,**} rwk,
|
|
owner @{user_share_dirs}/Steam/steamapps/shadercache/{,**} rwk,
|
|
owner @{user_share_dirs}/Steam/userdata/**/remotecache.vdf rw,
|
|
|
|
@{run}/host/ r,
|
|
@{run}/host/container-manager r,
|
|
@{run}/host/fonts/{,**} r,
|
|
@{run}/host/share/{,**} r,
|
|
@{run}/host/usr/{,**} r,
|
|
owner @{run}/pressure-vessel/{,**} rw,
|
|
owner @{run}/user/@{uid}/ r,
|
|
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
|
|
owner @{run}/user/@{uid}/gdm/Xauthority r,
|
|
owner @{run}/user/@{uid}/orcexec.* mrw, # gstreamer
|
|
|
|
owner /dev/shm/#[0-9]* rw,
|
|
owner /dev/shm/mono.* rw,
|
|
owner /dev/shm/u@{uid}-Shm_@{hex} rw,
|
|
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
|
|
owner /dev/shm/ValveIPCSHM_@{uid} rw,
|
|
owner /dev/shm/wine-*-fsync rw,
|
|
|
|
owner /tmp/.wine-@{uid}/server-*/* rwk,
|
|
owner /tmp/** rw,
|
|
owner /tmp/miles_image_* mr,
|
|
owner /tmp/pressure-vessel-*/{,**} rwl,
|
|
|
|
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
|
|
@{run}/udev/data/+sound* r,
|
|
|
|
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
|
|
@{run}/udev/data/c116:[0-9]* r, # for ALSA
|
|
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
|
|
@{run}/udev/data/c24[0-9]:[0-9]* r,
|
|
@{run}/udev/data/c25[0-4]:[0-9]* r,
|
|
|
|
@{sys}/ r,
|
|
@{sys}/bus/ r,
|
|
@{sys}/class/ r,
|
|
@{sys}/class/hidraw/ r,
|
|
@{sys}/class/input/ r,
|
|
@{sys}/class/sound/ r,
|
|
@{sys}/devices/**/input[0-9]*/ r,
|
|
@{sys}/devices/**/input[0-9]*/**/{vendor,product} r,
|
|
@{sys}/devices/**/input[0-9]*/capabilities/* r,
|
|
@{sys}/devices/**/input/input[0-9]*/ r,
|
|
@{sys}/devices/**/uevent r,
|
|
@{sys}/devices/pci[0-9]*/**/sound/card[0-9]*/** r,
|
|
@{sys}/devices/pci[0-9]*/**/usb[0-9]*/{manufacturer,product,bcdDevice,bInterfaceNumber} r,
|
|
@{sys}/devices/system/clocksource/clocksource[0-9]*/current_clocksource r,
|
|
@{sys}/devices/system/cpu/** r,
|
|
@{sys}/devices/system/node/node[0-9]/cpumap r,
|
|
@{sys}/devices/system/node/online r,
|
|
@{sys}/devices/virtual/dmi/id/* r,
|
|
@{sys}/kernel/ r,
|
|
|
|
@{PROC}/@{pids}/net/dev r,
|
|
@{PROC}/@{pids}/net/route r,
|
|
@{PROC}/sys/kernel/overflowgid r,
|
|
@{PROC}/sys/kernel/overflowuid r,
|
|
@{PROC}/uptime r,
|
|
@{PROC}/version r,
|
|
owner @{PROC}/@{pid}/cmdline r,
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/gid_map rw,
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
owner @{PROC}/@{pid}/mounts r,
|
|
owner @{PROC}/@{pid}/setgroups rw,
|
|
owner @{PROC}/@{pid}/stat r,
|
|
owner @{PROC}/@{pid}/task/ r,
|
|
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
|
owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
|
owner @{PROC}/@{pid}/uid_map rw,
|
|
|
|
/dev/hidraw[0-9]* rw,
|
|
/dev/input/ r,
|
|
/dev/input/* rw,
|
|
/dev/tty rw,
|
|
/dev/uinput rw,
|
|
|
|
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
|
|
|
include if exists <local/steam-game>
|
|
} |