mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add zgrep and xzgrep profile

Browse source 
This prevents exploiting https://www.openwall.com/lists/oss-security/2022/04/08/2
aka CVE-2022-1271 (file write and code execution via "funny" filenames)
This commit is contained in:
Christian Boltz 2022-04-10 15:03:08 +02:00
parent 52b6b97c98
commit 4c853dc74d
Failed to generate hash of commit
1 changed files with 59 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
profiles/apparmor.d/zgrep Normal file
View file

@ -0,0 +1,59 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2022 Christian Boltz
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
abi <abi/3.0>,
include <tunables/global>
profile zgrep /usr/bin/{x,}zgrep {
include <abstractions/base>
include <abstractions/bash>
/dev/tty rw,
/usr/bin/{ba,da,}sh ix,
/usr/bin/bzip2 Cx -> helper,
/usr/bin/cat ix,
/usr/bin/grep Cx -> helper,
/usr/bin/gzip Cx -> helper,
/usr/bin/mktemp ix,
/usr/bin/rm ix,
/usr/bin/sed Cx -> sed,
/usr/bin/xz Cx -> helper,
/usr/bin/xzgrep r,
/usr/bin/zgrep Cx -> helper,
owner /tmp/zgrep* rw,
/usr/bin/zgrep r,
include if exists <local/zgrep>
profile helper {
include <abstractions/base>
capability dac_override,
capability dac_read_search,
/usr/bin/{ba,da,}sh ix,
/usr/bin/bzip2 mr,
/usr/bin/grep mr,
/usr/bin/gzip mr,
/usr/bin/xz mr,
/{,**} r,
}
profile sed {
include <abstractions/base>
/dev/tty rw,
/usr/bin/{ba,da,}sh ix,
/usr/bin/sed mr,
}
}