apparmor/profiles/apparmor.d/abstractions/private-files-strict

# vim:syntax=apparmor
# privacy-violations-strict contains additional rules for sensitive
# files that you want to explicitly deny access

  #include <abstractions/private-files>

  # potentially extremely sensitive files
  audit deny @{HOME}/.gnupg/** mrwkl,
  audit deny @{HOME}/.ssh/** mrwkl,
  audit deny @{HOME}/.gnome2_private/** mrwkl,
  audit deny @{HOME}/.gnome2/keyrings/** mrwkl,
  # don't allow access to any gnome-keyring modules
  audit deny /{,var/}run/user/[0-9]*/keyring** mrwkl,
  audit deny @{HOME}/.mozilla/** mrwkl,
  audit deny @{HOME}/.config/chromium/** mrwkl,
  audit deny @{HOME}/.{,mozilla-}thunderbird/** mrwkl,
  audit deny @{HOME}/.evolution/** mrwkl,
  audit deny @{HOME}/.config/evolution/** mrwkl,
  audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/** mrwkl,
  audit deny @{HOME}/.kde{,4}/share/apps/kwallet/** mrwkl,
merge profiles from Ubuntu, including change_hat apache2 template 2009-11-11 11:42:30 -08:00			`# vim:syntax=apparmor`
			`# privacy-violations-strict contains additional rules for sensitive`
Description: Disallow writing and linking to @{HOME}/.pki/nssdb/ .so files Bug-Ubuntu: https://launchpad.net/bugs/911847 Acked-by: Jamie Strandboge <jamie@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com> 2012-01-06 10:29:32 -06:00			`# files that you want to explicitly deny access`
merge profiles from Ubuntu, including change_hat apache2 template 2009-11-11 11:42:30 -08:00
			`#include <abstractions/private-files>`

			`# potentially extremely sensitive files`
			`audit deny @{HOME}/.gnupg/** mrwkl,`
			`audit deny @{HOME}/.ssh/** mrwkl,`
			`audit deny @{HOME}/.gnome2_private/** mrwkl,`
add @{HOME}/.gnome2/keyrings/** to abstractions/private-files-strict Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com> 2013-05-13 14:55:23 -05:00			`audit deny @{HOME}/.gnome2/keyrings/** mrwkl,`
profiles: rw file perms are now needed on AF_UNIX socket files The AppArmor kernel now checks for both read and write permissions when a process calls connect() on a UNIX domain socket. The patch updates four abstractions that were found to be needing changes after the change in AF_UNIX kernel mediation. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> 2013-12-19 23:19:40 -08:00			`# don't allow access to any gnome-keyring modules`
			`audit deny /{,var/}run/user/[0-9]/keyring* mrwkl,`
merge profiles from Ubuntu, including change_hat apache2 template 2009-11-11 11:42:30 -08:00			`audit deny @{HOME}/.mozilla/** mrwkl,`
abstractions/private-files: don't allow wl to autostart directories abstractions/private-files-strict: don't allow access to: - chromium - thunderbird - evolution - kmail - kwallet 2011-01-07 10:44:47 -06:00			`audit deny @{HOME}/.config/chromium/** mrwkl,`
			`audit deny @{HOME}/.{,mozilla-}thunderbird/** mrwkl,`
			`audit deny @{HOME}/.evolution/** mrwkl,`
			`audit deny @{HOME}/.config/evolution/** mrwkl,`
Update abstractios for KDE4 (At least) openSUSE uses ~/.kde4 to store KDE4 settings. This patch changes ~/.kde/ to ~/.kde{,4} in all abstractions. The patch is mostly from Velery Valery, I only fixed a merge conflict and added the kmail{,2} part in private-files-strict. References: https://bugzilla.novell.com/show_bug.cgi?id=741592 Acked-By: Steve Beattie <sbeattie@ubuntu.com> for both trunk and 2.7. 2012-01-19 15:20:28 +01:00			`audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/** mrwkl,`
			`audit deny @{HOME}/.kde{,4}/share/apps/kwallet/** mrwkl,`
merge profiles from Ubuntu, including change_hat apache2 template 2009-11-11 11:42:30 -08:00