apparmor.d/apparmor.d/profiles-a-f/flatpak-app
2024-02-07 00:16:21 +01:00

103 lines
3.1 KiB
Text

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Default profile for all flatpak applications. Ideally, this profile should be
# generated by flatpak itself with settings from the flatpak manifest and
# fully separated from bwrap.
# Note: This profile used to be split in two (flatpak-bwrap & flatpak-app) in order
# to separate bwrap from the sandboxed app itself. It was generating issue with
# zypak-sandbox, therefore the profiles have been merged. Meanwhile, to install
# some applications, flatpak needs write access to the sandbox content. This is
# done through bwrap and therefore in this profile.
#
# 1. All of this will have to be improved. However, as of today, it is the only way
# to not break some (major) flatpak app.
# 2. It is not a big deal as flatpak is responsible for the sandbox anyway.
abi <abi/3.0>,
include <tunables/global>
profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/bwrap-app>
capability dac_override,
capability dac_read_search,
capability net_admin,
capability setpcap,
capability sys_admin,
capability sys_ptrace,
capability sys_resource,
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
network netlink dgram,
network netlink raw,
mount options=(rw, silent, rslave) -> /,
mount fstype=tmpfs -> /tmp/,
mount -> /newroot/{,**},
mount -> /oldroot/,
mount -> /tmp/newroot/,
umount /{,oldroot/},
pivot_root oldroot=/newroot/ -> /newroot/,
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
ptrace (read),
signal (receive) set=(int) peer=flatpak-portal,
@{bin}/** rmix,
@{lib}/** rmix,
/app/** rmix,
/var/lib/flatpak/app/*/**/@{bin}/** rmix,
/var/lib/flatpak/app/*/**/@{lib}/** rmix,
@{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-app//&gtk-update-icon-cache,
@{bin}/update-desktop-database rPx -> flatpak-app//&update-desktop-database,
@{bin}/update-mime-database rPx -> flatpak-app//&update-mime-database,
@{bin}/xdg-dbus-proxy rPx -> flatpak-app//&xdg-dbus-proxy,
/var/lib/flatpak/app/{,**} r,
/usr/share/flatpak/triggers/* rix,
/usr/.ref rk,
/etc/shells rw,
/app/.ref k,
/app/extra/** rw,
/bindfile@{rand6} rw,
/newroot/{,**} rw,
/tmp/newroot/ w,
/tmp/oldroot/ w,
/var/lib/flatpak/app/{,**} r,
/var/lib/flatpak/exports/** rw,
/var/tmp/etilqs_@{hex} rw,
@{run}/.userns r,
owner @{run}/flatpak/{,**} rk,
owner @{run}/flatpak/app/*/*ipc* rw,
owner @{run}/ld-so-cache-dir/* rw,
@{PROC}/@{pid}/fd/ r,
@{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r,
@{PROC}/sys/user/max_user_namespaces w,
owner @{PROC}/@{pid}/gid_map rw,
owner @{PROC}/@{pid}/setgroups rw,
owner @{PROC}/@{pid}/uid_map rw,
deny /apparmor/.null rw,
include if exists <usr/flatpak-app.d>
include if exists <local/flatpak-app>
}