mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
Merge Updates to the chromium_browser profile
This is a retargeting of [my MR in apparmor-profiles](https://gitlab.com/apparmor/apparmor-profiles/-/merge_requests/58).
The most significant change is the addition of a `crashpad_handler` subprofile, to factor out some permissions that the browser proper does not need. The remainder is mostly updates from my normal usage monitoring.
I have recorded below examples of the AppArmor log messages that motivated the updates. They are listed in the order in which they appear in the overall diff:
#### +abstractions/fonts
`Jun 30 16:45:42 testvm kernel: [ 4956.877581] audit: type=1400 audit(1688157942.647:127): apparmor="DENIED" operation="mknod" profile="chromium_browser" name="/home/username/.cache/fontconfig/af531e44-9f34-43fa-a244-e0ea9a6dc5f1-le64.cache-7.TMP-VbjHEy" pid=2136 comm="chromium" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000`
#### +abstractions/mesa
`May 30 21:08:36 testvm kernel: [ 9893.605107] audit: type=1400 audit(1685495316.380:1708): apparmor="ALLOWED" operation="file_lock" profile="chromium_browser" name="/home/username/.cache/mesa_shader_cache/6b/ce9f90908044cb4d4dabc34d81bf24b2fbda0a.tmp" pid=5879 comm="chromiu:disk$0" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000`
#### +abstractions/vulcan
`May 30 22:35:36 testvm kernel: [1544761.278181] audit: type=1400 audit(1685500536.387:22272): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:02.0/drm/card0/gt_min_freq_mhz" pid=963194 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
#### -deny dbus path=/org/freedesktop/hostname1
`Jun 13 19:16:35 image-ubuntu64 kernel: [78978.711877] audit: type=1107 audit(1686698195.982:2339): pid=540 uid=102 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.369" pid=17766 label="chromium_browser" peer_pid=17975 peer_label="unconfined"`
#### +dbus path=/org/freedesktop/login1
`Jun 12 21:45:36 testvm kernel: [ 1518.318643] audit: type=1107 audit(1686620736.127:67): pid=540 uid=102 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_signal" bus="system" path="/org/freedesktop/login1" interface="org.freedesktop.login1.Manager" member="SessionNew" name=":1.1" mask="receive" pid=3378 label="chromium_browser" peer_pid=565 peer_label="unconfined"`
`Jun 12 21:40:03 testvm kernel: [ 1185.247117] audit: type=1107 audit(1686620403.059:66): pid=540 uid=102 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_signal" bus="system" path="/org/freedesktop/login1" interface="org.freedesktop.login1.Manager" member="SessionRemoved" name=":1.1" mask="receive" pid=3378 label="chromium_browser" peer_pid=565 peer_label="unconfined"`
#### +dbus path=/org/freedesktop/DBus
`Jun 2 00:02:39 image-ubuntu64 dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="AddMatch" mask="send" name="org.freedesktop.DBus" pid=34637 label="chromium_browser" peer_label="unconfined"`
`Jun 2 00:02:39 image-ubuntu64 dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="GetNameOwner" mask="send" name="org.freedesktop.DBus" pid=34637 label="chromium_browser" peer_label="unconfined"`
`Jun 2 00:02:39 image-ubuntu64 dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="Hello" mask="send" name="org.freedesktop.DBus" pid=34637 label="chromium_browser" peer_label="unconfined"`
`Jun 2 00:02:39 image-ubuntu64 dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="NameHasOwner" mask="send" name="org.freedesktop.DBus" pid=34637 label="chromium_browser" peer_label="unconfined"`
`Jun 2 00:02:39 image-ubuntu64 dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="RemoveMatch" mask="send" name="org.freedesktop.DBus" pid=34637 label="chromium_browser" peer_label="unconfined"`
`Jun 2 00:02:39 image-ubuntu64 dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="StartServiceByName" mask="send" name="org.freedesktop.DBus" pid=34637 label="chromium_browser" peer_label="unconfined"`
#### +dbus path=/org/freedesktop/portal/desktop
`Jun 2 00:02:39 testvm dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/portal/desktop" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.freedesktop.portal.Desktop" pid=34637 label="chromium_browser" peer_pid=10595 peer_label="unconfined"`
#### +dbus path=/org/freedesktop/Notifications
`Jun 2 00:02:39 testvm dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/Notifications" interface="org.freedesktop.Notifications" member="GetCapabilities" mask="send" name="org.freedesktop.Notifications" pid=34637 label="chromium_browser" peer_pid=10438 peer_label="unconfined"`
`Jun 2 00:02:39 testvm dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/freedesktop/Notifications" interface="org.freedesktop.Notifications" member="GetServerInformation" mask="send" name="org.freedesktop.Notifications" pid=34637 label="chromium_browser" peer_pid=10438 peer_label="unconfined"`
#### +dbus path=/org/gtk/vfs/mounttracker
`Jun 2 00:02:39 testvm dbus-daemon[10113]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/gtk/vfs/mounttracker" interface="org.gtk.vfs.MountTracker" member="ListMountableInfo" mask="send" name=":1.9" pid=34637 label="chromium_browser" peer_pid=10331 peer_label="unconfined"`
#### +/etc/fstab
`Jun 19 00:12:34 testvm kernel: [3192175.541293] audit: type=1400 audit(1687147954.193:127452): apparmor="DENIED" operation="open" profile="chromium_browser" name="/etc/fstab" pid=1541844 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1002 ouid=0`
#### +~/.cache/thumbnails
`Jun 28 14:31:34 testvm kernel: [4021314.484388] audit: type=1400 audit(1687977094.903:128621): apparmor="DENIED" operation="open" profile="chromium_browser" name="/home/username/.cache/thumbnails/normal/5ff3c24d6d3b35a6ea92e12c71c487f9.png" pid=1781421 comm="pool-chromium" requested_mask="r" denied_mask="r" fsuid=1002 ouid=1002`
`Jun 28 14:31:34 testvm kernel: [4021314.484975] audit: type=1400 audit(1687977094.903:128622): apparmor="DENIED" operation="open" profile="chromium_browser" name="/home/username/.cache/thumbnails/normal/5ff3c24d6d3b35a6ea92e12c71c487f9.png" pid=1781421 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1002 ouid=1002`
#### -/proc/$PID/fd/
This rule appears to have been used by the crash handler, so I've moved it to the new `crashpad_handler` subprofile. I have not observed the normal browser process(es) attempting this access.
#### +/proc/pressure/{cpu,io,memory}
`May 30 22:44:26 testvm kernel: [1545291.245886] audit: type=1400 audit(1685501066.352:22355): apparmor="DENIED" operation="open" profile="chromium_browser" name="/proc/pressure/cpu" pid=741817 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1002 ouid=0`
`May 30 22:44:26 testvm kernel: [1545291.245903] audit: type=1400 audit(1685501066.352:22356): apparmor="DENIED" operation="open" profile="chromium_browser" name="/proc/pressure/io" pid=741817 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1002 ouid=0`
`May 30 22:44:26 testvm kernel: [1545291.245912] audit: type=1400 audit(1685501066.352:22357): apparmor="DENIED" operation="open" profile="chromium_browser" name="/proc/pressure/memory" pid=741817 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1002 ouid=0`
#### +/proc/$PID/clear_refs
`May 30 18:32:55 testvm kernel: [ 552.316554] audit: type=1400 audit(1685485975.161:305): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/proc/1950/clear_refs" pid=1950 comm="MemoryInfra" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000`
#### +/proc/$PID/mountinfo
`Jun 19 00:12:34 testvm kernel: [3192175.541221] audit: type=1400 audit(1687147954.193:127451): apparmor="DENIED" operation="open" profile="chromium_browser" name="/proc/1541844/mountinfo" pid=1541844 comm="gmain" requested_mask="r" denied_mask="r" fsuid=1002 ouid=1002`
#### +/proc/sys/fs/inotify/max_user_watches
`May 30 18:32:26 testvm kernel: [ 523.274479] audit: type=1400 audit(1685485946.109:288): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/proc/sys/fs/inotify/max_user_watches" pid=1972 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
#### +/sys/devices/system/cpu/{kernel_max,possible,present}
`May 30 18:32:26 testvm kernel: [ 523.287063] audit: type=1400 audit(1685485946.125:290): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/sys/devices/system/cpu/kernel_max" pid=1971 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`May 30 18:32:26 testvm kernel: [ 523.287107] audit: type=1400 audit(1685485946.125:291): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/sys/devices/system/cpu/possible" pid=1971 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`May 30 18:32:26 testvm kernel: [ 523.287607] audit: type=1400 audit(1685485946.125:297): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/sys/devices/system/cpu/present" pid=1972 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
#### +/sys/devices/pci[0-9]*/**/{bConfigurationValue,boot_vga,busnum}
`2023-07-03T04:40:49.955727-04:00 testsys kernel: [28353.647821] audit: type=1400 audit(1688373649.948:152): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.3/usb5/5-2/bConfigurationValue" pid=5585 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`Jul 4 00:10:52 testvm kernel: [ 405.584960] audit: type=1400 audit(1688443852.472:148): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:02.0/boot_vga" pid=2057 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`2023-07-03T04:40:49.955731-04:00 testsys kernel: [28353.647923] audit: type=1400 audit(1688373649.948:153): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.3/usb5/5-2/busnum" pid=5585 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
#### +/sys/devices/pci[0-9]*/**/{descriptors,devnum}
`2023-07-02T21:29:22.067669-04:00 testsys kernel: [ 2465.760458] audit: type=1400 audit(1688347762.063:71): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.0/usb2/descriptors" pid=2276 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`2023-07-02T21:29:22.071708-04:00 testsys kernel: [ 2465.762364] audit: type=1400 audit(1688347762.067:75): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.3/usb5/5-2/descriptors" pid=2276 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`2023-07-02T21:29:22.071721-04:00 testsys kernel: [ 2465.763437] audit: type=1400 audit(1688347762.067:78): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.7/usb1/1-6/1-6.3/descriptors" pid=2276 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`2023-07-03T04:40:49.955736-04:00 testsys kernel: [28353.648042] audit: type=1400 audit(1688373649.948:154): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.3/usb5/5-2/devnum" pid=5585 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
#### +/sys/devices/pci[0-9]*/**/{manufacturer,product}
`2023-07-03T04:40:49.955694-04:00 testsys kernel: [28353.647497] audit: type=1400 audit(1688373649.948:150): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.3/usb5/5-2/manufacturer" pid=5585 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`2023-07-03T04:40:49.955721-04:00 testsys kernel: [28353.647661] audit: type=1400 audit(1688373649.948:151): apparmor="DENIED" operation="open" profile="chromium_browser" name="/sys/devices/pci0000:00/0000:00:1d.3/usb5/5-2/product" pid=5585 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
#### +/sys/devices/pci[0-9]*/**/serial
(lost the log entry for this one)
#### +deny /sys/devices/virtual/dmi/id/*
`May 30 18:38:58 testvm kernel: [ 915.363204] audit: type=1400 audit(1685486338.202:390): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/sys/devices/virtual/dmi/id/sys_vendor" pid=2158 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
`May 30 18:38:58 testvm kernel: [ 915.363521] audit: type=1400 audit(1685486338.202:391): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/sys/devices/virtual/dmi/id/product_name" pid=2158 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
These sysfs paths yield the make and model of your system, so their access is questionable from a privacy perspective.
#### +{dev,var/run} in shm paths
Can't be replaced with `@{run}` as this does not include `/dev`.
#### +ptrace (read)
`May 31 04:47:35 testvm kernel: [1567080.438164] audit: type=1400 audit(1685522855.581:124669): apparmor="DENIED" operation="ptrace" profile="chromium_browser" pid=1145702 comm="ThreadPoolForeg" requested_mask="read" denied_mask="read" peer="chromium_browser//xdgsettings"`
Figured I'd add read access proactively to `lsb_release` as well. Holding back on adding it to self for now.
#### /etc/@{chromium}/policies/** -> /etc/@{chromium}/**
`May 30 21:25:44 testvm kernel: [10922.020981] audit: type=1400 audit(1685496344.792:2031): apparmor="ALLOWED" operation="open" profile="chromium_browser" name="/etc/chromium/master_preferences" pid=6465 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0`
#### Note: "~/.pki/... denied by private-files abstraction"
`May 30 21:29:13 testvm kernel: [11130.436441] audit: type=1400 audit(1685496553.206:2105): apparmor="ALLOWED" operation="mkdir" profile="chromium_browser" name="/home/username/.pki/" pid=7344 comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000`
`May 30 21:29:13 testvm kernel: [11130.437992] audit: type=1400 audit(1685496553.206:2106): apparmor="ALLOWED" operation="mkdir" profile="chromium_browser" name="/home/username/.pki/nssdb/" pid=7344 comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000`
Something else will need to create these directories.
#### +Widevine
`May 31 04:46:52 testvm kernel: [1567036.849155] audit: type=1400 audit(1685522811.993:124665): apparmor="DENIED" operation="file_mmap" profile="chromium_browser" name="/home/username/.config/chromium/WidevineCdm/4.10.2557.0/_platform_specific/linux_x64/libwidevinecdm.so" pid=1145723 comm="chromium" requested_mask="m" denied_mask="m" fsuid=1002 ouid=1002`
#### +GVfs
`Jun 13 19:16:35 testvm kernel: [78978.537455] audit: type=1400 audit(1686698195.810:2337): apparmor="DENIED" operation="connect" profile="chromium_browser" name="/run/user/1000/gvfsd/socket-EpT3MyPP" pid=17766 comm="chromium" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=1000`
#### +/lib/libc.so
`May 30 18:02:25 testvm kernel: [ 868.340300] audit: type=1400 audit(1685484145.031:80): apparmor="ALLOWED" operation="open" profile="chromium_browser//chromium_browser_sandbox" name="/lib/x86_64-linux-gnu/libc.so.6" pid=2405 comm="chrome-sandbox" requested_mask="r" denied_mask="r" fsuid=0 ouid=0`
`May 30 18:02:25 testvm kernel: [ 868.340363] audit: type=1400 audit(1685484145.031:81): apparmor="ALLOWED" operation="file_mmap" profile="chromium_browser//chromium_browser_sandbox" name="/lib/x86_64-linux-gnu/libc.so.6" pid=2405 comm="chrome-sandbox" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0`
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1208
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit a1afe3265c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
John Johansen
parent
f763c44cd0
commit
2284e99613
1 changed files with 110 additions and 20 deletions
|
|
@ -12,7 +12,7 @@
|
|||
|
||||
abi <abi/4.0>,
|
||||
|
||||
#include <tunables/global>
|
||||
include <tunables/global>
|
||||
|
||||
@{chromium} = chromium{,-browser}
|
||||
|
||||
|
|
@ -22,10 +22,13 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
include <abstractions/cups-client>
|
||||
include <abstractions/dbus-session>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/ibus>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/user-tmp>
|
||||
include <abstractions/vulkan>
|
||||
|
||||
# This include specifies which ubuntu-browsers.d abstractions to use. Eg, if
|
||||
# you want access to productivity applications, adjust the following file
|
||||
|
|
@ -57,14 +60,48 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
member={EnumerateDevices,GetDisplayDevice}
|
||||
peer=(label=unconfined),
|
||||
|
||||
# ???
|
||||
deny dbus (send)
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/org/freedesktop/hostname1
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(label=unconfined),
|
||||
|
||||
dbus (receive)
|
||||
bus=system
|
||||
path=/org/freedesktop/login1
|
||||
interface=org.freedesktop.login1.Manager
|
||||
member={SessionNew,SessionRemoved}
|
||||
peer=(label=unconfined),
|
||||
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/freedesktop/DBus
|
||||
interface=org.freedesktop.DBus
|
||||
member={AddMatch,GetNameOwner,Hello,NameHasOwner,RemoveMatch,StartServiceByName}
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/freedesktop/portal/desktop
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(name=org.freedesktop.portal.Desktop),
|
||||
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/freedesktop/Notifications
|
||||
interface=org.freedesktop.Notifications
|
||||
member={GetCapabilities,GetServerInformation}
|
||||
peer=(name=org.freedesktop.Notifications),
|
||||
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/gtk/vfs/mounttracker
|
||||
interface=org.gtk.vfs.MountTracker
|
||||
member=ListMountableInfo
|
||||
peer=(label=unconfined),
|
||||
|
||||
# Networking
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
|
@ -72,30 +109,35 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
@{PROC}/@{pid}/net/ipv6_route r,
|
||||
|
||||
# Should maybe be in abstractions
|
||||
/etc/fstab r,
|
||||
/etc/mime.types r,
|
||||
/etc/mailcap r,
|
||||
/etc/mtab r,
|
||||
/etc/xdg/xubuntu/applications/defaults.list r,
|
||||
owner @{HOME}/.cache/thumbnails/** r,
|
||||
owner @{HOME}/.local/share/applications/defaults.list r,
|
||||
owner @{HOME}/.local/share/applications/mimeinfo.cache r,
|
||||
/tmp/.X[0-9]*-lock r,
|
||||
|
||||
@{PROC}/self/exe ixr,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/filesystems r,
|
||||
@{PROC}/pressure/{cpu,io,memory} r,
|
||||
@{PROC}/vmstat r,
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
owner @{PROC}/@{pid}/clear_refs w,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/io r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/{uid,gid}_map w,
|
||||
@{PROC}/@{pid}/smaps r,
|
||||
owner @{PROC}/@{pid}/smaps r,
|
||||
@{PROC}/@{pid}/stat r,
|
||||
@{PROC}/@{pid}/statm r,
|
||||
@{PROC}/@{pid}/status r,
|
||||
owner @{PROC}/@{pid}/status r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/status r,
|
||||
deny @{PROC}/@{pid}/oom_{,score_}adj w,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/sys/net/ipv4/tcp_fastopen r,
|
||||
|
||||
|
|
@ -105,13 +147,24 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
/sys/devices/**/uevent r,
|
||||
/sys/devices/system/cpu/cpufreq/policy*/cpuinfo_max_freq r,
|
||||
/sys/devices/system/cpu/cpu*/cpufreq/cpuinfo_max_freq r,
|
||||
/sys/devices/system/cpu/kernel_max r,
|
||||
/sys/devices/system/cpu/possible r,
|
||||
/sys/devices/system/cpu/present r,
|
||||
/sys/devices/system/node/node*/meminfo r,
|
||||
/sys/devices/pci[0-9]*/**/bConfigurationValue r,
|
||||
/sys/devices/pci[0-9]*/**/boot_vga r,
|
||||
/sys/devices/pci[0-9]*/**/busnum r,
|
||||
/sys/devices/pci[0-9]*/**/class r,
|
||||
/sys/devices/pci[0-9]*/**/config r,
|
||||
/sys/devices/pci[0-9]*/**/descriptors r,
|
||||
/sys/devices/pci[0-9]*/**/device r,
|
||||
/sys/devices/pci[0-9]*/**/devnum r,
|
||||
/sys/devices/pci[0-9]*/**/irq r,
|
||||
/sys/devices/pci[0-9]*/**/manufacturer r,
|
||||
/sys/devices/pci[0-9]*/**/product r,
|
||||
/sys/devices/pci[0-9]*/**/resource r,
|
||||
/sys/devices/pci[0-9]*/**/revision r,
|
||||
/sys/devices/pci[0-9]*/**/serial r,
|
||||
/sys/devices/pci[0-9]*/**/subsystem_device r,
|
||||
/sys/devices/pci[0-9]*/**/subsystem_vendor r,
|
||||
/sys/devices/pci[0-9]*/**/vendor r,
|
||||
|
|
@ -122,6 +175,7 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
/sys/devices/virtual/tty/tty*/active r,
|
||||
# This is requested, but doesn't seem to actually be needed so deny for now
|
||||
deny /run/udev/data/** r,
|
||||
deny /sys/devices/virtual/dmi/id/* r,
|
||||
|
||||
# Needed for the crash reporter
|
||||
owner @{PROC}/@{pid}/auxv r,
|
||||
|
|
@ -132,13 +186,13 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
/usr/share/fonts/**/*.pfb m,
|
||||
/usr/share/mime/mime.cache m,
|
||||
/usr/share/icons/**/*.cache m,
|
||||
owner /{dev,run}/shm/pulse-shm* m,
|
||||
owner /{dev,run,var/run}/shm/pulse-shm* m,
|
||||
owner @{HOME}/.local/share/mime/mime.cache m,
|
||||
owner /tmp/** m,
|
||||
|
||||
@{PROC}/sys/kernel/shmmax r,
|
||||
owner /{dev,run}/shm/{,.}org.chromium.* mrw,
|
||||
owner /{,var/}run/shm/shmfd-* mrw,
|
||||
owner /{dev,run,var/run}/shm/{,.}org.chromium.* mrw,
|
||||
owner /{dev,run,var/run}/shm/shmfd-* mrw,
|
||||
|
||||
/usr/lib/@{chromium}/*.pak mr,
|
||||
/usr/lib/@{chromium}/locales/* mr,
|
||||
|
|
@ -149,8 +203,8 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
|
||||
# Allow ptracing ourselves and our helpers
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
ptrace (trace) peer=@{profile_name}//xdgsettings,
|
||||
ptrace (trace) peer=lsb_release,
|
||||
ptrace (read, trace) peer=@{profile_name}//xdgsettings,
|
||||
ptrace (read, trace) peer=lsb_release,
|
||||
|
||||
# Make browsing directories work
|
||||
/ r,
|
||||
|
|
@ -183,10 +237,9 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
/etc/firefox/profile/bookmarks.html r,
|
||||
owner @{HOME}/.mozilla/** k,
|
||||
|
||||
# Chromium Policies
|
||||
/etc/@{chromium}/policies/** r,
|
||||
|
||||
# Chromium configuration
|
||||
/etc/@{chromium}/** r,
|
||||
# Note: "~/.pki/{,nssdb/} w" is denied by private-files abstraction
|
||||
owner @{HOME}/.pki/nssdb/* rwk,
|
||||
owner @{HOME}/.cache/chromium/ rw,
|
||||
owner @{HOME}/.cache/chromium/** rw,
|
||||
|
|
@ -197,12 +250,18 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
owner @{HOME}/.config/chromium/Dictionaries/*.bdic mr,
|
||||
owner @{HOME}/.config/chromium/**/Dictionaries/*.bdic mr,
|
||||
|
||||
# Allow transitions to ourself and our sandbox
|
||||
# Widevine CDM plugin
|
||||
owner @{HOME}/.config/chromium/WidevineCdm/*/_platform_specific/*/libwidevinecdm.so mr,
|
||||
|
||||
# Allow transitions to ourself, our sandbox, and crash handler
|
||||
/usr/lib/@{chromium}/@{chromium} ix,
|
||||
/usr/lib/@{chromium}/chrome-sandbox cx -> sandbox,
|
||||
/usr/lib/@{chromium}/chrome_crashpad_handler Cxr -> crashpad_handler,
|
||||
|
||||
# Allow communicating with sandbox
|
||||
# Allow communicating with sandbox and crash handler
|
||||
unix (receive, send) peer=(label=@{profile_name}//sandbox),
|
||||
unix (receive, send) peer=(label=@{profile_name}//crashpad_handler),
|
||||
signal (receive) set=(cont) peer=@{profile_name}//crashpad_handler,
|
||||
|
||||
/{usr/,}bin/ps Uxr,
|
||||
/usr/lib/@{chromium}/xdg-settings Cxr -> xdgsettings,
|
||||
|
|
@ -210,10 +269,13 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
/usr/bin/lsb_release Pxr -> lsb_release,
|
||||
|
||||
# GSettings
|
||||
owner /{,var/}run/user/*/dconf/ rw,
|
||||
owner /{,var/}run/user/*/dconf/user rw,
|
||||
owner @{run}/user/[0-9]*/dconf/ rw,
|
||||
owner @{run}/user/[0-9]*/dconf/user rw,
|
||||
owner @{HOME}/.config/dconf/user r,
|
||||
|
||||
# GVfs
|
||||
owner @{run}/user/[0-9]*/gvfsd/socket-* rw,
|
||||
|
||||
# Magnet links
|
||||
/usr/bin/gio ixr,
|
||||
|
||||
|
|
@ -230,7 +292,7 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
/etc/ld.so.cache r,
|
||||
/etc/xdg/** r,
|
||||
/usr/bin/xdg-settings r,
|
||||
/{usr/,}lib{,32,64}/@{chromium}/xdg-settings r,
|
||||
/usr/lib/@{chromium}/xdg-settings r,
|
||||
/usr/share/applications/*.desktop r,
|
||||
/usr/share/applications/*.list r,
|
||||
|
||||
|
|
@ -266,6 +328,8 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
/{usr/,}lib/@{multiarch}/libpthread-*.so* mr,
|
||||
/{usr/,}lib{,32,64}/libatomic.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/libatomic.so* mr,
|
||||
/{usr/,}lib{,32,64}/libc.so.* mr,
|
||||
/{usr/,}lib/@{multiarch}/libc.so.* mr,
|
||||
/{usr/,}lib{,32,64}/libc-*.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/libc-*.so* mr,
|
||||
/{usr/,}lib{,32,64}/libdl-*.so* mr,
|
||||
|
|
@ -326,6 +390,32 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|||
owner /tmp/** rw,
|
||||
}
|
||||
|
||||
profile crashpad_handler {
|
||||
include <abstractions/base>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read, trace) peer=chromium_browser,
|
||||
|
||||
signal (send) set=(cont) peer=chromium_browser,
|
||||
|
||||
unix (receive, send) peer=(label=chromium_browser),
|
||||
|
||||
/usr/lib/@{chromium}/chrome_crashpad_handler ixr,
|
||||
|
||||
/sys/devices/system/cpu/cpufreq/policy[0-9]*/scaling_{cur,max}_freq r,
|
||||
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mem r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/task/ r,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm r,
|
||||
|
||||
owner @{HOME}/.config/chromium/Crash?Reports/** rwk,
|
||||
}
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
include if exists <local/chromium_browser>
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue