15 flatpak

John Johansen edited this page 2021-10-16 20:21:24 +00:00

Table of Contents

• Related Documentation
• Introduction
• Confining Bubble wrap applications
• Discovering flatpak application paths
• Creating a profile for a flatpak application
• Create the base profile
• Issues
• bubblewwrap
• Indirect launch
• Portals
• Namespaces
• no_new_privs

Related Documentation

• Containers Overview
• Bubblewarp
• portals
• AppArmor namespaces
• no_new_privs

Introduction

Flatpak uses bubblewrap to sandbox its applications. Unfortunately bubblewrap causes several problems for AppArmor and makes use of AppArmor with flatpaks more difficult than regular applications.

When confining flatpak applications there are 4 main issues that must be dealt with.

• Indirect start of Applications
• portals
• namespacing
• no_new_privs

These are explained in more detail below in the issues section after the basic tutorial on what needs to be done to get AppArmor confinement working without having to understand the issues indepth.

Confining Bubble wrap applications

Discovering flatpak application paths

Flatpak applications are launched using the flatpak command. However the name passed to the flatpak command is different than the actual binary name. For the following example we will use Aisleriot from flathub.

To see the application name use the flatpak list command

$ flatpak list
Name                   Application ID              Version Branch Installation
Mesa                   …esktop.Platform.GL.default 21.1.7  20.08  system
openh264               …edesktop.Platform.openh264 2.1.0   2.0    system
Aisleriot Solitaire    org.gnome.Aisleriot         3.22.13 stable system
GNOME Application Pla… org.gnome.Platform                  40     system

To run it use the flatpak run command with Application ID

flatpak run org.gnome.Aisleriot

This however does not reveal the application name that is needed to setup a profile to confine the application.

To do this we can setup a basic profile on flatpak itself

$ cat flatpak.profile
include <tunables/kernelvars>

profile flatpak /usr/bin/flatpak flags=(complain, attach_disconnected) {

  rwmk /{**,},
  unix,

  cx /usr/bin/bwrap -> bwrap,

  profile bwrap flags=(attach_disconnected) {
    capability sys_admin,
    capability sys_ptrace,
    capability setpcap,
    capability net_admin,
    capability dac_override,

    ptrace peer=flatpak//bwrap,
    mount,
    umount,
    pivot_root,

    rwmk /{**,},
    unix,
    network netlink,

    # either inherit or stack because of no-new-privs
    px /usr/bin/xdg-dbus-proxy -> flatpak//bwrap//&flatpak//dbus-proxy,

  }

  profile dbus-proxy flags=(complain, attach_disconnected) {
    rwmk /**,
    unix,
  }

}

The profile can be loaded using the apparmor_parser

sudo apparmor_parser -r flatpak.profile

or by putting the profile in /etc/apparmor.d/ and either reloading policy using your systems init system. Eg. for systemd

systemctl reload apparmor

or rebooting your system. Once the profile is loaded the flatpak run command can be used to discover the actual application path

$ flatpak run org.gnome.Aisleriot
$ sudo dmesg | grep DENIED
[13373.719982] audit: type=1400 audit(1633083236.125:4724): apparmor="DENIED" operation="exec" profile="flatpak//bwrap" name="/app/bin/sol" pid=6365 comm="bwrap" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

A profile for the flatpak can now be created.

Creating a profile for a flatpak application

After discovering the application path it is possible to create a profile. The flatpak, and bwrap profiles can be removed from the kernel or left in place. If left in place they will need to be updated to include a stacking transition for the applications profile. For the AisleRot application the new transition rule would be added to the bwrap profile and would look like

px /app/bin/sol -> flatpak//bwrap//&sol,

Leaving the flatpak profile in place could also have other affects on profile rule for the application not covered here so it is recommended that the flatpack profile be removed when not discovering flatpak application paths.

$ sudo apparmor_parser -R flatpak.profile

Create the base profile

An empty profile in complain mode can now be created and loaded into the kernel, and regular policy development techniques can be used. It is important to note that flatpak applications require the attach_disconneted profile flag.

profile sol /app/bin/sol flags=(complain, attach_disconnected) {

}

Issues

bubblewwrap

• has support for apparmor but flatpak doesn't allow calling with params
• need to investigate more

Indirect launch

Portals

It should also be noted that if an application is designed to use portals with flatpak, some permission access occur outside of the applications confinement and then are passed back in to the confined application. This may result in certain apparmor rules appearing like they are not applied. See the issues section below.

Namespaces

no_new_privs

How they are handled and