mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-05 17:01:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/private-files-strict

31 lines
1.2 KiB
Text
Raw Normal View History

merge profiles from Ubuntu, including change_hat apache2 template
2009-11-11 11:42:30 -08:00
# vim:syntax=apparmor
# privacy-violations-strict contains additional rules for sensitive
Description: Disallow writing and linking to @{HOME}/.pki/nssdb/ .so files Bug-Ubuntu: https://launchpad.net/bugs/911847 Acked-by: Jamie Strandboge <jamie@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 10:29:32 -06:00
# files that you want to explicitly deny access
merge profiles from Ubuntu, including change_hat apache2 template
2009-11-11 11:42:30 -08:00
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2020-05-05 00:08:39 -07:00
abi <abi/3.0>,
Change `#include` to `include` in abstractions and tunables
2020-06-09 23:28:41 +02:00
include <abstractions/private-files>
merge profiles from Ubuntu, including change_hat apache2 template
2009-11-11 11:42:30 -08:00
# potentially extremely sensitive files
deny ~/.mutt** in private-files and audit deny ~/.aws in private-files-strict Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
2018-11-19 16:13:57 -06:00
audit deny @{HOME}/.aws/{,**} mrwkl,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.gnupg/{,**} mrwkl,
audit deny @{HOME}/.ssh/{,**} mrwkl,
audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
private-files{,-strict}: disallow writes to parent dirs too
2018-09-27 14:42:14 -05:00
audit deny @{HOME}/.gnome2/ w,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl,
profiles: rw file perms are now needed on AF_UNIX socket files The AppArmor kernel now checks for both read and write permissions when a process calls connect() on a UNIX domain socket. The patch updates four abstractions that were found to be needing changes after the change in AF_UNIX kernel mediation. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-19 23:19:40 -08:00
# don't allow access to any gnome-keyring modules
Use "run" variable in profiles Signed-off-by: nl6720 <nl6720@gmail.com>
2020-02-13 11:02:49 +02:00
audit deny @{run}/user/[0-9]*/keyring** mrwkl,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.mozilla/{,**} mrwkl,
private-files{,-strict}: disallow writes to parent dirs too
2018-09-27 14:42:14 -05:00
audit deny @{HOME}/.config/ w,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.config/chromium/{,**} mrwkl,
audit deny @{HOME}/.config/evolution/{,**} mrwkl,
private-files{,-strict}: disallow writes to parent dirs too
2018-09-27 14:42:14 -05:00
audit deny @{HOME}/.evolution/{,**} mrwkl,
audit deny @{HOME}/.{,mozilla-}thunderbird/{,**} mrwkl,
audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/{,**} mrwkl,
audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl,
add new path for kwallet (used in KDE 5) Reported on IRC by finalspacevoid
2021-02-07 14:19:46 +01:00
audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl,
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:03:11 -08:00
# Include additions to the abstraction
abstractions: remove '#' from 'include if exists' This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'.
2020-05-30 19:46:08 +02:00
include if exists <abstractions/private-files-strict.d>
Reference in a new issue Copy permalink