mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-06 17:31:01 +01:00
fb3283f37e
Whenever the evince deb package tries to open a snap browser which was selected as the default, we get the following denial: audit[2110]: AVC apparmor="DENIED" operation="exec" profile="/usr/bin/evince" name="/usr/bin/snap" pid=2110 comm="env" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 As a short-term solution, we are adding a snap-browsers profile which restricts what snaps opened by evince can do. The long-term solution is currently not available, but could be accomplished by using enhanced environment variable filtering/mediation and delegation of open fds. Bug: https://launchpad.net/bugs/1794064 Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
35 lines
1.1 KiB
Text
35 lines
1.1 KiB
Text
profile snap_browsers {
|
|
include if exists <abstractions/snap_browsers.d>
|
|
include <abstractions/base>
|
|
|
|
/etc/passwd r,
|
|
/etc/nsswitch.conf r,
|
|
/etc/fstab r,
|
|
|
|
# noisy
|
|
deny owner /run/user/[0-9]*/gdm/Xauthority r, # not needed on Ubuntu
|
|
deny /run/snapd.socket rw,
|
|
|
|
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrix, # re-exec
|
|
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/info r,
|
|
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snapd r,
|
|
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-seccomp rPix,
|
|
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-confine Pix,
|
|
/var/lib/snapd/system-key r,
|
|
|
|
@{PROC}/version r,
|
|
@{PROC}/cmdline r,
|
|
@{PROC}/sys/net/core/somaxconn r,
|
|
@{PROC}/sys/kernel/seccomp/actions_avail r,
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
owner @{HOME}/.snap/auth.json r, # if exists, required
|
|
owner /run/user/[0-9]*/bus rw,
|
|
|
|
/sys/kernel/security/apparmor/features/ r,
|
|
|
|
# allow launching official browser snaps.
|
|
/snap/chromium/[0-9]*/meta/{snap.yaml,hooks/} r,
|
|
/snap/firefox/[0-9]*/meta/{snap.yaml,hooks/} r,
|
|
/snap/opera/[0-9]*/meta/{snap.yaml,hooks/} r,
|
|
# add other browsers here
|
|
}
|