mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-07 01:41:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
4798 commits 23 branches 109 tags 32 MiB
Commit graph

432 commits

Author SHA1 Message Date
John Johansen
ec86a15322 Merge branch 'recent-documents-write' into 'master' 
Add recent-documents-write abstraction

See merge request apparmor/apparmor!163

Acked-by: John Johansen <john.johansen@canonical.com>
 2018-08-14 23:26:02 +00:00
Daniel Richard G
7972c038d7 Updated abstractions to allow writing to some common config dirs 2018-08-14 16:38:18 -04:00
Daniel Richard G
094dc741ee Updated abstractions to allow creating some common config dirs 2018-08-14 16:38:18 -04:00
John Johansen
085e2fc1a4 Merge branch 'kde-settings' into 'master' 
Update kde abstraction for common settings

See merge request apparmor/apparmor!162

Acked-by: John Johansen <john.johansen@canonical.com>
 2018-08-08 05:33:00 +00:00
John Johansen
e76181c4d9 Merge branch 'cboltz-ssl-dehydrated' into 'master' 
add dehydrated certificate location to ssl_* abstractions

See merge request apparmor/apparmor!161

Acked-by: John Johansen <john.johansen@canonical.com>
 2018-08-08 05:31:39 +00:00
Vincas Dargis
4fe8ae97c4 Add recent-documents-write abstraction 
Add abstraction for updating recent documents list.
 2018-08-07 23:27:23 +03:00
Vincas Dargis
867442e962 Update kde abstraction for common settings 
Add rules to allow reading common KDE-specific settings, used mostly by
native KDE file dialog.
 2018-08-07 20:20:08 +03:00
John Johansen
4200932d8f Merge branch 'binmerge' into 'master' 
profiles: support distributions which merge sbin into bin

Closes #8

See merge request apparmor/apparmor!149

Acked-by: John Johansen <john.johansen@canonical.com>
 2018-08-07 09:53:17 +00:00
John Johansen
bc4aa43d64 Merge branch 'cboltz-abstractions-opencl-pocl' into 'master' 
Fix typo (double /) in opencl-pocl abstraction

See merge request apparmor/apparmor!158

Acked-by: John Johansen <john.johansen@canonical.com>
 2018-08-07 09:16:56 +00:00
Christian Boltz
2e8b902248
add dehydrated certificate location to ssl_* abstractions 
I don't use dehydrated myself, therefore this is based on the comments
on https://build.opensuse.org/request/show/533380
 2018-08-06 23:15:06 +02:00
Christian Boltz
763a6787d8 Merge branch 'add-path-to-abstractions-python' into 'master' 
Allow /usr/local/lib/python3/dist-packages in abstractions/python

See merge request apparmor/apparmor!160

Acked-by: John Johansen <john.johansen@canonical.com>

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master
 2018-08-06 18:11:37 +00:00
segfault
6a10f07650 Allow /usr/local/lib/python3/dist-packages in abstractions/python 2018-08-06 19:53:16 +02:00
Christian Boltz
a054855433
Fix typo (double /) in opencl-pocl abstraction 2018-08-05 17:03:34 +02:00
Daniel Richard G
ac1d0545f4 ldapclient abstraction: allow rw access to the nslcd socket. 
This addresses https://launchpad.net/bugs/1575438 and also the case of
applications accessing the socket directly (due to NSS config).
 2018-07-30 22:49:24 -04:00
intrigeri
34dbe372c5 Rename @{usr_share} → @{system_share_dirs} and @{home_local_share} → @{user_share_dirs}. 
Thanks a lot to Simon McVittie for the much better names suggestion.
 2018-07-27 06:33:42 +00:00
intrigeri
51f2259c08 freedesktop.org abstraction: refactor (factorize) for consistency. 
This change makes the @{home_local_share} rules similar to the
@{usr_share} ones.
 2018-07-27 06:28:22 +00:00
intrigeri
aed447aca2 freedesktop.org abstraction: simplify by not attempting to guess the exhaustive list of files that can exist in {~/.local/share,/usr/share}/applications/. 
As Simon McVittie wrote, "if a specification or library creates extra caches, or
has .desktop files in a subdirectory, or anything like that, then I don't see
why we wouldn't want to allow reading those too".
 2018-07-27 06:26:57 +00:00
intrigeri
9d843b90fe kde abstraction: drop redundant rules for icons access. 
These rules are already in abstractions/freedesktop.org that's included
by the abstractions/kde.
 2018-07-27 06:22:29 +00:00
intrigeri
160f1027e4 freedesktop.org abstraction: DRY by factorizing duplicated path components with variables. 
These alternations will need to grow quite a bit in order to support Flatpak
exports. Let's avoid repeating ourselves too much.
 2018-07-27 06:21:40 +00:00
Cameron Nemo
9ab45d811e profiles: support distributions which merge sbin into bin 
Closes #8
 2018-07-25 14:07:35 -07:00
intrigeri
59865e54c5 mesa abstraction: allow locking .cache/mesa_shader_cache/??/*. 
At least Totem needs it on current Debian sid.
 2018-07-24 07:21:51 +00:00
Christian Boltz
01f41fbff8
adjust abstractions/python for python 3.7 
Python 3.7 was released yesterday - and to make the abstraction
future-proof, also cover 3.8 and 3.9 in advance ;-)
 2018-06-28 13:34:08 +02:00
Vincas Dargis
a0c719df73 Add mesa abstraction 
Add mesa abstraction to allow writing to the Mesa-specific cache
locations and listing devices. Abstraction is needed for applications
utilizing OpenGL API with Mesa implementation available on the system.
 2018-06-23 17:07:05 +03:00
Christian Boltz
1185df3c65
fix path for apache2 stapling-cache 
... to match the default apache settings

See also the discussion on the mailinglist:
https://lists.ubuntu.com/archives/apparmor/2018-June/011688.html
 2018-06-17 16:16:22 +02:00
Jamie Strandboge
0c7c34c6f1 Merge branch 'vulkan' into 'master' 
Add Vulkan abstraction

See merge request apparmor/apparmor!126
 2018-05-22 21:45:31 +00:00
Vincas Dargis
47520931be Add Vulkan abstraction 
Add abstraction for Vulkan API specific file paths.
 2018-05-22 21:48:13 +03:00
Jamie Strandboge
c1431bc2de Merge branch 'nvidia-app-profiles' into 'master' 
Update nvidia for reading application profiles

See merge request apparmor/apparmor!125
 2018-05-22 18:24:19 +00:00
Vincas Dargis
f2e0fdc72b Update nvidia for reading application profiles 
Add file rule to allow reading application profiles for NVIDIA
Linux graphics driver.
 2018-05-22 20:43:56 +03:00
Vincas Dargis
8237d6e776 Add OpenCL abstractions 2018-05-13 20:14:15 +00:00
Jamie Strandboge
7bd3029f25 Merge branch 'update-fonts' into 'master' 
Update fonts for Debian and openSUSE

See merge request apparmor/apparmor!96
 2018-04-30 10:03:22 +00:00
Christian Boltz
3009b22aec Merge branch 'qt5' into 'master' 
Add qt5 abstraction

See merge request apparmor/apparmor!99

Acked-by: Christian Boltz <apparmor@cboltz.de>
 2018-04-18 22:18:30 +00:00
Vincas Dargis
b902d2505d Update fonts for Debian and openSUSE 
* Allow to read conf-avail dir itself.
* Add various openSUSE-specific font config directories.
 2018-04-18 19:16:29 +03:00
Vincas Dargis
6a85ffe00e Add qt5 abstraction 
Create abtractions/qt5 with common rules needed for Qt5-based
applications.
 2018-04-18 19:12:28 +03:00
Vincas Dargis
0d0a196077 Allow nvidia abstraction to read memory block size 
Fix DENIED message detected with NVIDIA 390.48 drivers.
 2018-04-12 20:36:56 +03:00
Vincas Dargis
0c2690d819 Fix ubuntu-browsers for 64bit openSUSE 
On 64 bit openSUSE system, Chromium and Firefox browsers are installed in
/usr/lib64/ directory.
 2018-04-01 16:48:13 +03:00
Vincas Dargis
11e7dab95e Allow to create .nv directory 
Update nvidia abstraction to allow creating NVIDIA-specific user directories in
case it is missing (due to fresh $HOME or if manually removed for any reason).
 2018-02-16 16:54:32 +02:00
Christian Boltz
e88af93322 Merge branch 'update-base-abstraction' into 'master' 
Update base abstraction for ld.so.conf and friends.

See merge request apparmor/apparmor!62

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9..master
 2018-02-15 20:14:38 +00:00
Vincas Dargis
b0456adbd8 Add dri-enumerate abstraction 
Create new dri-enumerate abstraction with rules needed for some GUI applications
allowing to get GPU device information.
 2018-02-04 16:01:27 +02:00
Vincas Dargis
8dd517f6dd Move DRI-specific rules into it's own abstraction 
Add new dri-common abstraction to contain basic DRI-specific rules.

This refactoring is based on a decision to have set of dri-* abstractions for
fine grained control on case-by-case basis. While dri-common is included in X
abstraction by default, additional DRI-related abstractions can be introduced
(such as for enumerating graphics devices) while keeping them logically together
with same dri- prefix.
 2018-02-04 14:21:16 +02:00
Vincas Dargis
6d22c871bf Update base abstraction for ld.so.conf and friends. 
Fix denies for latest Thunderbird and Firefox on Debian Sid due to
missing access to /etc/ld.so.conf and /etc/ld.so.conf.d/*.
 2018-01-26 19:55:31 +02:00
Rene Engelhard
8fc3dcb312 abstractions/gnupg: allow pubring.kbx 2018-01-20 23:54:08 +01:00
John Johansen
bcfb735b9a Merge branch 'cboltz-xauth' into 'master' 
abstractions/X: add another location for .Xauthority

See merge request apparmor/apparmor!39

Acked-by: John Johansen <john.johansen@canonical.com>
 2017-12-22 19:00:36 +00:00
Christian Boltz
bb96e38a90
abstractions/X: add another location for .Xauthority 
With the latest sddm, .Xauthority is now located at
  @{HOME}/.local/share/sddm/.Xauthority
 2017-12-17 15:38:26 +01:00
Vincas Dargis
f73627cbb5 Fix local pulseaudio config file access 
Add rules to allow reading .conf files from $HOME/.config/pulse
and $HOME/.config/pulse/client.conf.d directories.
 2017-12-17 15:56:21 +02:00
Vincas Dargis
7546413b43 Update abstraction for new Thunderbird executable path 
* Add -bin suffix to reach new Thunderbird executable.
 2017-12-07 16:41:10 +00:00
Jamie Strandboge
c4a5e1d554 abstractions/fonts: also allow owner read on ~/.local/share/fonts 
The fonts abstraction had owner rules for ~/.fonts, but the current
standard location[1][2] in XDG_DATA_HOME was missing.

[1]https://cgit.freedesktop.org/fontconfig/commit/?id=8c255fb1
[2]https://lists.freedesktop.org/archives/fontconfig/2014-July/005270.html
 2017-12-05 15:49:55 -06:00
Steve Beattie
2aabf0c0f0 Update Java abstraction for version 8 and 9 
Merge branch 'update-java' into 'master'

I have discovered denies on Debian Sid by Thunderbird being unable to load IcedTead plugin upon profile creation (can be reproduced by deleteing/moving `$HOME/.thunderbird` directory).

Additionally, profile was tested with (modified) `usr.lib.firefox.firefox` and made it run some random IcedTea applet successfully [0].

There are still denies for `/usr/bin/logger`, but I left this for later patches.

Please note that path to Java 9 binary is different that to previous versions.

Relevant DENIED messages:

```
type=AVC msg=audit(1511099962.556:810): apparmor="DENIED" operation="file_mmap" profile="thunderbird" name="/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so" pid=5186 comm="thunderbird" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
type=SYSCALL msg=audit(1511099962.556:810): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=296bc8 a2=5 a3=802 items=0 ppid=1541 pid=5186 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="thunderbird" exe="/usr/lib/thunderbird/thunderbird" key=(null)
type=PROCTITLE msg=audit(1511099962.556:810): proctitle="/usr/lib/thunderbird/thunderbird"
```

```
type=AVC msg=audit(1511100105.471:1018): apparmor="DENIED" operation="open" profile="/usr/lib/firefox{,-esr}/firefox{,-esr}{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-vincas-gHIeGy/6064-icedteanp-plugin-debug-to-appletviewer" pid=6073 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1511100105.471:1018): arch=c000003e syscall=2 success=no exit=-13 a0=7f3638000cb0 a1=0 a2=1b6 a3=7f36ae502620 items=0 ppid=6064 pid=6073 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="java" exe="/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java" key=(null)
type=PROCTITLE msg=audit(1511100105.471:1018): proctitle=2F7573722F6C69622F6A766D2F6A6176612D382D6F70656E6A646B2D616D6436342F62696E2F6A617661002D44696365647465612D7765622E62696E2E6C6F636174696F6E3D2F7573722F62696E2F6A6176617773002D44696365647465612D7765622E62696E2E6E616D653D6A6176617773002D58626F6F74636C61737370
```

```
type=AVC msg=audit(1511100105.471:1019): apparmor="DENIED" operation="open" profile="/usr/lib/firefox{,-esr}/firefox{,-esr}{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-vincas-gHIeGy/6064-icedteanp-plugin-to-appletviewer" pid=6073 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1511100105.471:1019): arch=c000003e syscall=2 success=no exit=-13 a0=7f36a822bdc0 a1=0 a2=1b6 a3=10002ae08 items=0 ppid=6064 pid=6073 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="java" exe="/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java" key=(null)
type=PROCTITLE msg=audit(1511100105.471:1019): proctitle=2F7573722F6C69622F6A766D2F6A6176612D382D6F70656E6A646B2D616D6436342F62696E2F6A617661002D44696365647465612D7765622E62696E2E6C6F636174696F6E3D2F7573722F62696E2F6A6176617773002D44696365647465612D7765622E62696E2E6E616D653D6A6176617773002D58626F6F74636C61737370
```

```
type=AVC msg=audit(1511100221.153:1132): apparmor="DENIED" operation="open" profile="/usr/lib/firefox{,-esr}/firefox{,-esr}{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-vincas-JY8Sat/6405-icedteanp-appletviewer-to-plugin" pid=6414 comm="java" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1511100221.153:1132): arch=c000003e syscall=2 success=no exit=-13 a0=7f20e025e280 a1=241 a2=1b6 a3=10002ae08 items=0 ppid=6405 pid=6414 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="java" exe="/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java" key=(null)
type=PROCTITLE msg=audit(1511100221.153:1132): proctitle=2F7573722F6C69622F6A766D2F6A6176612D382D6F70656E6A646B2D616D6436342F62696E2F6A617661002D44696365647465612D7765622E62696E2E6C6F636174696F6E3D2F7573722F62696E2F6A6176617773002D44696365647465612D7765622E62696E2E6E616D653D6A6176617773002D58626F6F74636C61737370
```

[0] https://centra.tecnico.ulisboa.pt/~amaro/Spline3D.html

See merge request https://gitlab.com/apparmor/apparmor/merge_requests/13/
 2017-11-29 23:41:42 +00:00
Vincas Dargis
d662c2be72 Update Java abstraction for version 8 and up 
* Alter paths to allow Java version 8 and up.
* Add file rules to fix IcedTea browser plugin.
* Refactor to keep path consistensy against parent and child profile,
reduce repetitive rules.
 2017-11-25 16:04:24 +02:00
Vincas Dargis
9658471d38 Allow to read pulseaudio config subdirectories 
Fixes denied "/etc/pulse/client.conf.d/00-disable-autospawn.conf" read on Debian Sid
 2017-11-18 14:20:07 +00:00
intrigeri
2b02d7df83 ubuntu-browsers, ubuntu-helpers: add support for Google Chrome unstable (LP: #1730536). 2017-11-12 13:39:54 +00:00