mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-05 17:01:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/private-files-strict

25 lines
1,006 B
Text
Raw Normal View History

merge profiles from Ubuntu, including change_hat apache2 template
2009-11-11 11:42:30 -08:00
# vim:syntax=apparmor
# privacy-violations-strict contains additional rules for sensitive
Description: Disallow writing and linking to @{HOME}/.pki/nssdb/ .so files Bug-Ubuntu: https://launchpad.net/bugs/911847 Acked-by: Jamie Strandboge <jamie@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 10:29:32 -06:00
# files that you want to explicitly deny access
merge profiles from Ubuntu, including change_hat apache2 template
2009-11-11 11:42:30 -08:00
#include <abstractions/private-files>
# potentially extremely sensitive files
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.gnupg/{,**} mrwkl,
audit deny @{HOME}/.ssh/{,**} mrwkl,
audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
private-files{,-strict}: disallow writes to parent dirs too
2018-09-27 14:42:14 -05:00
audit deny @{HOME}/.gnome2/ w,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl,
profiles: rw file perms are now needed on AF_UNIX socket files The AppArmor kernel now checks for both read and write permissions when a process calls connect() on a UNIX domain socket. The patch updates four abstractions that were found to be needing changes after the change in AF_UNIX kernel mediation. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-19 23:19:40 -08:00
# don't allow access to any gnome-keyring modules
we don't need to adjust keyring**. Thanks cboltz
2018-09-27 12:13:04 -05:00
audit deny /{,var/}run/user/[0-9]*/keyring** mrwkl,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.mozilla/{,**} mrwkl,
private-files{,-strict}: disallow writes to parent dirs too
2018-09-27 14:42:14 -05:00
audit deny @{HOME}/.config/ w,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.config/chromium/{,**} mrwkl,
audit deny @{HOME}/.config/evolution/{,**} mrwkl,
private-files{,-strict}: disallow writes to parent dirs too
2018-09-27 14:42:14 -05:00
audit deny @{HOME}/.evolution/{,**} mrwkl,
audit deny @{HOME}/.{,mozilla-}thunderbird/{,**} mrwkl,
audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w,
abstractions/private-files-strict: disallow access to the dirs of private files Reference: https://launchpad.net/bugs/1794820
2018-09-27 11:42:03 -05:00
audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/{,**} mrwkl,
audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl,
merge profiles from Ubuntu, including change_hat apache2 template
2009-11-11 11:42:30 -08:00
Reference in a new issue Copy permalink