Commit graph

14 commits

Author SHA1 Message Date
Christian Boltz
9fc8e43c67
abstractions: remove '#' from 'include if exists'
This matches what we use in the profiles for local abstractions.

Also adjust the check in the Makefile to expect the variant without '#'.
2020-05-30 19:53:49 +02:00
John Johansen
730db17607 policy: tag policy with the AppArmor 3.0 abi
Tag profiles and abstractions with abi information.

Tagging abstractions is not strictly necessary but allows the parser
to detect when their is a mismatch and that policy will need an
update for abi.

We do not currently tag the tunables because variable declarations
are not currently affected by abi.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/491
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2020-05-29 00:23:17 -07:00
Matthew Garrett
d9ab83281b Add support for local additions to abstractions
Local policy may want to extend or override abstractions, so add support for including local updates to them.

Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: intrigeri <intrigeri@boum.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:06:03 -08:00
Jamie Strandboge
170e8d6ac8 deny ~/.mutt** in private-files and audit deny ~/.aws in private-files-strict
Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
2018-11-19 16:13:57 -06:00
Jamie Strandboge
bbe0f9af78 private-files{,-strict}: disallow writes to parent dirs too 2018-09-27 14:42:14 -05:00
Emerson Bernier
afdd4f2189 abstractions/private-files: disallow access to the dirs of private files
Reference:
https://launchpad.net/bugs/1794820
2018-09-27 19:07:21 +00:00
Jamie Strandboge
503d2904dc abstractions/private-files: disallow writes to thumbnailer dir (LP: #1788929) 2018-09-27 11:56:09 -05:00
Jamie Strandboge
58f5df11e6 deny writes to upstart user sessions jobs in abstractions/private-files
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-05-13 14:56:10 -05:00
Christian Boltz
77f37e84eb Update abstractios for KDE4
(At least) openSUSE uses ~/.kde4 to store KDE4 settings.
This patch changes ~/.kde/ to ~/.kde{,4} in all abstractions.

The patch is mostly from Velery Valery, I only fixed a merge conflict 
and added the kmail{,2} part in private-files-strict.

References: https://bugzilla.novell.com/show_bug.cgi?id=741592

Acked-By: Steve Beattie <sbeattie@ubuntu.com> for both trunk and 2.7.
2012-01-19 15:20:28 +01:00
Steve Beattie
25f800ac7d Fix from Felix Geyer: block write access to ~/.kde/env because KDE
automatically sources scripts in that folder on startup.

Bug: https://launchpad.net/bugs/914190
2012-01-10 11:54:12 +01:00
Jamie Strandboge
0cb4e48344 Description: Disallow writing and linking to @{HOME}/.pki/nssdb/ .so files
Bug-Ubuntu: https://launchpad.net/bugs/911847

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 10:29:32 -06:00
Jamie Strandboge
780ae4663d profiles/apparmor.d/abstractions/private-files:
- add zsh files (LP: #761217)
- add .inputrc (bash)
- add .login and .logout (csh, tcsh, etc)
2011-04-18 08:55:50 -05:00
Jamie Strandboge
f7c6a848bb abstractions/private-files: don't allow wl to autostart directories
abstractions/private-files-strict: don't allow access to:
- chromium
- thunderbird
- evolution
- kmail
- kwallet
2011-01-07 10:44:47 -06:00
Kees Cook
40e8c9f6e6 merge profiles from Ubuntu, including change_hat apache2 template 2009-11-11 11:42:30 -08:00