mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-07 18:55:15 +01:00
103 lines
3.1 KiB
Text
103 lines
3.1 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
# Default profile for all flatpak applications. Ideally, this profile should be
|
|
# generated by flatpak itself with settings from the flatpak manifest and
|
|
# fully separated from bwrap.
|
|
|
|
# Note: This profile used to be split in two (flatpak-bwrap & flatpak-app) in order
|
|
# to separate bwrap from the sandboxed app itself. It was generating issue with
|
|
# zypak-sandbox, therefore the profiles have been merged. Meanwhile, to install
|
|
# some applications, flatpak needs write access to the sandbox content. This is
|
|
# done through bwrap and therefore in this profile.
|
|
#
|
|
# 1. All of this will have to be improved. However, as of today, it is the only way
|
|
# to not break some (major) flatpak app.
|
|
# 2. It is not a big deal as flatpak is responsible for the sandbox anyway.
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
|
|
include <abstractions/base>
|
|
include <abstractions/bwrap-app>
|
|
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability net_admin,
|
|
capability setpcap,
|
|
capability sys_admin,
|
|
capability sys_ptrace,
|
|
capability sys_resource,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink dgram,
|
|
network netlink raw,
|
|
|
|
mount options=(rw, silent, rslave) -> /,
|
|
mount fstype=tmpfs -> /tmp/,
|
|
mount -> /newroot/{,**},
|
|
mount -> /oldroot/,
|
|
mount -> /tmp/newroot/,
|
|
umount /{,oldroot/},
|
|
|
|
pivot_root oldroot=/newroot/ -> /newroot/,
|
|
pivot_root oldroot=/tmp/oldroot/ -> /tmp/,
|
|
|
|
ptrace (read),
|
|
|
|
signal (receive) set=(int) peer=flatpak-portal,
|
|
|
|
@{bin}/** rmix,
|
|
@{lib}/** rmix,
|
|
/app/** rmix,
|
|
/var/lib/flatpak/app/*/**/@{bin}/** rmix,
|
|
/var/lib/flatpak/app/*/**/@{lib}/** rmix,
|
|
|
|
@{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-app//>k-update-icon-cache,
|
|
@{bin}/update-desktop-database rPx -> flatpak-app//&update-desktop-database,
|
|
@{bin}/update-mime-database rPx -> flatpak-app//&update-mime-database,
|
|
@{bin}/xdg-dbus-proxy rPx -> flatpak-app//&xdg-dbus-proxy,
|
|
|
|
/var/lib/flatpak/app/{,**} r,
|
|
|
|
/usr/share/flatpak/triggers/* rix,
|
|
|
|
/usr/.ref rk,
|
|
|
|
/etc/shells rw,
|
|
|
|
/app/.ref k,
|
|
/app/extra/** rw,
|
|
/bindfile@{rand6} rw,
|
|
/newroot/{,**} rw,
|
|
/tmp/newroot/ w,
|
|
/tmp/oldroot/ w,
|
|
|
|
/var/lib/flatpak/app/{,**} r,
|
|
/var/lib/flatpak/exports/** rw,
|
|
/var/tmp/etilqs_@{hex} rw,
|
|
|
|
@{run}/.userns r,
|
|
owner @{run}/flatpak/{,**} rk,
|
|
owner @{run}/flatpak/app/*/*ipc* rw,
|
|
owner @{run}/ld-so-cache-dir/* rw,
|
|
|
|
@{PROC}/@{pid}/fd/ r,
|
|
@{PROC}/sys/kernel/overflowgid r,
|
|
@{PROC}/sys/kernel/overflowuid r,
|
|
@{PROC}/sys/user/max_user_namespaces w,
|
|
owner @{PROC}/@{pid}/gid_map rw,
|
|
owner @{PROC}/@{pid}/setgroups rw,
|
|
owner @{PROC}/@{pid}/uid_map rw,
|
|
|
|
deny /apparmor/.null rw,
|
|
|
|
include if exists <usr/flatpak-app.d>
|
|
include if exists <local/flatpak-app>
|
|
}
|