mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-06 17:31:01 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/profiles/apparmor.d/abstractions/fonts

69 lines
2.2 KiB
Text
Raw Normal View History

some new abstractions from Mathias Gug
2007-08-27 23:49:51 +00:00
# vim:syntax=apparmor
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
# ------------------------------------------------------------------
#
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
# Copyright (C) 2002-2009 Novell/SUSE
# Copyright (C) 2009 Canonical Ltd.
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
policy: tag policy with the AppArmor 3.0 abi Tag profiles and abstractions with abi information. Tagging abstractions is not strictly necessary but allows the parser to detect when their is a mismatch and that policy will need an update for abi. We do not currently tag the tunables because variable declarations are not currently affected by abi. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2020-05-05 00:08:39 -07:00
abi <abi/3.0>,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/usr/share/AbiSuite/fonts/** r,
removing /opt/gnome, /opt/OpenOffice.org, /usr/X11R6/, /opt/mozilla
2007-06-11 04:09:23 +00:00
/usr/lib/xorg/modules/fonts/**.so* mr,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Update fonts abstraction for Debian Mikhail Morfikov has discovered [0] that some font packages in Debian ships font files in /usr/bin/fonts-foo-bar (like /usr/share/fonts-font-awesome/ for example). This produces denials for GUI applications. Update fonts abstraction to allow reading /usr/bin/fonts-* directories. Also, refactor abstraction to aggregate two old rules into one. Closes #94 [0] https://gitlab.com/apparmor/apparmor/-/issues/94
2020-06-27 11:48:22 +03:00
/usr/share/fonts/{,**} r,
/usr/share/fonts-*/{,**} r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/etc/fonts/** r,
Update fonts for Debian and openSUSE * Allow to read conf-avail dir itself. * Add various openSUSE-specific font config directories.
2018-04-15 17:02:36 +03:00
# Debian, openSUSE paths are different
/usr/share/{fontconfig,fonts-config,*-fonts}/conf.avail/{,**} r,
/usr/share/ghostscript/fonts/{,**} r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/opt/kde3/share/fonts/** r,
pull in Ubuntu updates to profiles/apparmor.d
2009-11-04 14:25:42 -06:00
/usr/lib{,32,64}/openoffice/share/fonts/** r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/var/cache/fonts/** r,
r3527@dhcp-81: root | 2006-08-02 15:33:07 -0700 Fix up the m, U, and P stuff, and other misc fixes
2006-08-04 18:13:59 +00:00
/var/cache/fontconfig/** mr,
some new abstractions from Mathias Gug
2007-08-27 23:49:51 +00:00
/var/lib/defoma/** mr,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/usr/share/a2ps/fonts/** r,
/usr/share/xfce/fonts/** r,
/usr/share/ghostscript/fonts/** r,
From: intrigeri <intrigeri@boum.org> Debian sid's fonts-mathjax ships fonts in /usr/share/javascript/mathjax/fonts, that are now used by default by fontconfig-enabled software. Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-08 17:43:08 -07:00
/usr/share/javascript/*/fonts/** r,
Description: allow read access to /usr/share/texmf/fonts Bug-Ubuntu: https://launchpad.net/bugs/941503 Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-02 15:08:03 -06:00
/usr/share/texmf/{,*/}fonts/** r,
From: intrigeri <intrigeri@boum.org> At least on Debian sid, software such as Vidalia and Iceweasel go look for fonts in there. Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-08 17:43:49 -07:00
/usr/share/texlive/texmf-dist/fonts/** r,
update fonts abstraction to add '/var/lib/ghostscript/** r,'
2010-09-03 08:38:14 -05:00
/var/lib/ghostscript/** r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.fonts.conf r,
owner @{HOME}/.fonts/ r,
owner @{HOME}/.fonts/** r,
abstractions/fonts: also allow owner read on ~/.local/share/fonts The fonts abstraction had owner rules for ~/.fonts, but the current standard location[1][2] in XDG_DATA_HOME was missing. [1]https://cgit.freedesktop.org/fontconfig/commit/?id=8c255fb1 [2]https://lists.freedesktop.org/archives/fontconfig/2014-July/005270.html
2017-12-05 15:37:57 -06:00
owner @{HOME}/.local/share/fonts/ r,
owner @{HOME}/.local/share/fonts/** r,
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.fonts.cache-2 mr,
Updated abstractions to allow creating some common config dirs
2018-08-08 19:28:25 -04:00
owner @{HOME}/.{,cache/}fontconfig/ rw,
abstractions/fonts: don't allow write of fontconfig cache files 879531b36ec3dfc7f9b72475c68c30e4f4b7b6af changed access for @{HOME}/.{,cache/}fontconfig/** to include 'w'rite. Fontconfig has been a source of CVEs. Confined applications should absolutely have read access, but write access could lead to breaking out of the sandbox if a confined application can write a malformed font cache file since unconfined applications could then pick them up and be controlled via the malformed cache. The breakout is dependent on the fontconfig vulnerability, but this is the sort of thing AppArmor is meant to help guard against.
2019-09-09 15:48:05 -05:00
owner @{HOME}/.{,cache/}fontconfig/** mrl,
Subject: profiles - owner usage for @{HOME} rules From: Simon Deziel <simon.deziel@gmail.com> A fair number of the rules that apply to files in @{HOME} predate the existence of the 'owner' qualifier. This patch adds the 'owner' qualifier in several places. Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
owner @{HOME}/.fonts.conf.d/ r,
owner @{HOME}/.fonts.conf.d/** r,
On Ubuntu saucy fontconfig reads user configs from $HOME/.config/fontconfig/conf.d/* and $HOME/.config/fontconfig/fonts.conf /etc/fonts/conf.d/50-user.conf: <!-- Load per-user customization files where stored on XDG Base Directory specification compliant places. it should be usually: $HOME/.config/fontconfig/conf.d $HOME/.config/fontconfig/fonts.conf --> <include ignore_missing="yes" prefix="xdg">fontconfig/conf.d</include> <include ignore_missing="yes" prefix="xdg">fontconfig/fonts.conf</include> abstractions/fonts should allow read access to those files: From: Felix Geyer debfx@ubuntu.com Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-14 17:38:48 -07:00
owner @{HOME}/.config/fontconfig/ r,
owner @{HOME}/.config/fontconfig/** r,
Add Fontmatrix to abstractions/fonts [Fontmatrix] [adds ~/.Fontmatrix/Activated to fonts.conf]. This causes programs which use [Fontconfig] (directly or indirectly through libraries such as [pango]) to include that directory in their font search path, which causes errors such as: audit: type=1400 audit(1602678958.525:53): apparmor="DENIED" operation="open" profile="fr.emersion.Mako" name="/home/username/.Fontmatrix/Activated/.uuid" pid=48553 comm="mako" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 audit: type=1400 audit(1602678958.525:54): apparmor="DENIED" operation="open" profile="fr.emersion.Mako" name="/home/username/.Fontmatrix/Activated/" pid=48553 comm="mako" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 if the program does not explicitly include this directory in its AppArmor profile. As with other common font locations, add ~/.Fontmatrix/Activated to the fonts abstraction for read-only access. [Fontconfig]: https://gitlab.freedesktop.org/fontconfig/fontconfig [Fontmatrix]: https://github.com/fontmatrix/fontmatrix [Pango]: https://pango.gnome.org/ [adds ~/.Fontmatrix/Activated to fonts.conf]: https://github.com/fontmatrix/fontmatrix/blob/75552e2/src/typotek.cpp#L1081-L1088 Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
2020-10-14 19:30:29 -06:00
owner @{HOME}/.Fontmatrix/Activated/ r,
owner @{HOME}/.Fontmatrix/Activated/** r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Adapt abstractions and some profiles in active/ to the new syntax.
2007-04-10 22:05:33 +00:00
/usr/local/share/fonts/ r,
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
/usr/local/share/fonts/** r,
move poppler cMap from gnome to fonts, thanks to Felix Geyer
2013-05-30 12:01:27 -07:00
# poppler CMap tables
/usr/share/poppler/cMap/** r,
libthai-data is used by LibThai which is the library used to deal with Thai-specific functions like word-breaking, input and output methods and basic character and string support. This is: https://launchpad.net/bugs/1278702 Acked-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-14 14:28:12 -06:00
# data files for LibThai
/usr/share/libthai/thbrk.tri r,
Add support for local additions to abstractions Local policy may want to extend or override abstractions, so add support for including local updates to them. Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: intrigeri <intrigeri@boum.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:03:11 -08:00
# Include additions to the abstraction
abstractions: remove '#' from 'include if exists' This matches what we use in the profiles for local abstractions. Also adjust the check in the Makefile to expect the variant without '#'.
2020-05-30 19:46:08 +02:00
include if exists <abstractions/fonts.d>
Reference in a new issue Copy permalink