Commit graph

11 commits

Author SHA1 Message Date
Matthew Garrett
d9ab83281b Add support for local additions to abstractions
Local policy may want to extend or override abstractions, so add support for including local updates to them.

Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: intrigeri <intrigeri@boum.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-24 03:06:03 -08:00
Jamie Strandboge
170e8d6ac8 deny ~/.mutt** in private-files and audit deny ~/.aws in private-files-strict
Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
2018-11-19 16:13:57 -06:00
Jamie Strandboge
bbe0f9af78 private-files{,-strict}: disallow writes to parent dirs too 2018-09-27 14:42:14 -05:00
Jamie Strandboge
5efd257585 we don't need to adjust keyring**. Thanks cboltz 2018-09-27 12:13:04 -05:00
Jamie Strandboge
d1937093f7 abstractions/private-files-strict: disallow access to the dirs of private files
Reference:
https://launchpad.net/bugs/1794820
2018-09-27 11:55:37 -05:00
Tyler Hicks
d64797e4c3 profiles: rw file perms are now needed on AF_UNIX socket files
The AppArmor kernel now checks for both read and write permissions when
a process calls connect() on a UNIX domain socket.

The patch updates four abstractions that were found to be needing
changes after the change in AF_UNIX kernel mediation.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-19 23:19:40 -08:00
Jamie Strandboge
e3c0425857 add @{HOME}/.gnome2/keyrings/** to abstractions/private-files-strict
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-05-13 14:55:23 -05:00
Christian Boltz
77f37e84eb Update abstractios for KDE4
(At least) openSUSE uses ~/.kde4 to store KDE4 settings.
This patch changes ~/.kde/ to ~/.kde{,4} in all abstractions.

The patch is mostly from Velery Valery, I only fixed a merge conflict 
and added the kmail{,2} part in private-files-strict.

References: https://bugzilla.novell.com/show_bug.cgi?id=741592

Acked-By: Steve Beattie <sbeattie@ubuntu.com> for both trunk and 2.7.
2012-01-19 15:20:28 +01:00
Jamie Strandboge
0cb4e48344 Description: Disallow writing and linking to @{HOME}/.pki/nssdb/ .so files
Bug-Ubuntu: https://launchpad.net/bugs/911847

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 10:29:32 -06:00
Jamie Strandboge
f7c6a848bb abstractions/private-files: don't allow wl to autostart directories
abstractions/private-files-strict: don't allow access to:
- chromium
- thunderbird
- evolution
- kmail
- kwallet
2011-01-07 10:44:47 -06:00
Kees Cook
40e8c9f6e6 merge profiles from Ubuntu, including change_hat apache2 template 2009-11-11 11:42:30 -08:00