diff options
| author | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
| commit | 83f7fe4b8402bab171d110703a1b1115efbc9b28 (patch) | |
| tree | 19110702c7d740f6bd8ee4f5d2ebcb97442be237 /straper/db/public/apparmor/apparmor.d | |
| parent | 51d43498b07dc97d795947964534f0903cd05db5 (diff) | |
| download | bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.tar.gz bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.zip | |
cleaned up many scrits and deleted some that were of no use; renamed a lot
Diffstat (limited to 'straper/db/public/apparmor/apparmor.d')
273 files changed, 0 insertions, 7774 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/1password b/straper/db/public/apparmor/apparmor.d/1password deleted file mode 100644 index 2cd1448..0000000 --- a/straper/db/public/apparmor/apparmor.d/1password +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile 1password /opt/1Password/1password flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/1password> -} diff --git a/straper/db/public/apparmor/apparmor.d/Discord b/straper/db/public/apparmor/apparmor.d/Discord deleted file mode 100644 index 4e96b8f..0000000 --- a/straper/db/public/apparmor/apparmor.d/Discord +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile Discord /usr/share/discord/Discord flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/Discord> -} diff --git a/straper/db/public/apparmor/apparmor.d/MongoDB_Compass b/straper/db/public/apparmor/apparmor.d/MongoDB_Compass deleted file mode 100644 index 6c796ca..0000000 --- a/straper/db/public/apparmor/apparmor.d/MongoDB_Compass +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile "MongoDB Compass" "/usr/lib/mongodb-compass/MongoDB Compass" flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/MongoDB_Compass> -} diff --git a/straper/db/public/apparmor/apparmor.d/QtWebEngineProcess b/straper/db/public/apparmor/apparmor.d/QtWebEngineProcess deleted file mode 100644 index 65dec48..0000000 --- a/straper/db/public/apparmor/apparmor.d/QtWebEngineProcess +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile QtWebEngineProcess /usr/lib/@{multiarch}/qt{5,6}/libexec/QtWebEngineProcess flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/QtWebEngineProcess> -} diff --git a/straper/db/public/apparmor/apparmor.d/Xorg b/straper/db/public/apparmor/apparmor.d/Xorg deleted file mode 100644 index 34fe319..0000000 --- a/straper/db/public/apparmor/apparmor.d/Xorg +++ /dev/null @@ -1,123 +0,0 @@ -# vim:syntax=apparmor -# Author: Daniel Richard G. <skunk@iSKUNK.ORG> - -# Related: -# https://bugs.launchpad.net/bugs/1292324 -# https://github.com/canonical/lightdm/issues/18 - -abi <abi/4.0>, - -include <tunables/global> - -# Note: attach_disconnected appears necessary in rootless mode -profile Xorg /usr/lib/xorg/Xorg flags=(complain,attach_disconnected, complain) { - include <abstractions/base> - include <abstractions/dbus-strict> - include <abstractions/fonts> - include <abstractions/mesa> - include <abstractions/nameservice> - include <abstractions/vulkan> - include <abstractions/X> - - capability dac_override, - capability ipc_owner, - capability perfmon, - capability setgid, - capability setuid, - capability sys_admin, - capability sys_nice, - capability sys_rawio, - - network netlink raw, - - signal (receive) set=(hup, term), - signal (send) set=(usr1), - - unix (accept, bind, listen, receive, send) type=stream addr="@/tmp/.X11-unix/X[0-9]*", - - dbus (send) - bus=system - path=/org/freedesktop/login1 - interface=org.freedesktop.login1.Manager - member=GetSessionByPID - peer=(name=org.freedesktop.login1), - - dbus (send) - bus=system - path=/org/freedesktop/login1/session/* - interface=org.freedesktop.login1.Session - member={PauseDeviceComplete,ReleaseControl,ReleaseDevice,TakeControl,TakeDevice} - peer=(name=org.freedesktop.login1), - - dbus (receive) - bus=system - path=/org/freedesktop/login1/session/* - interface=org.freedesktop.login1.Session - member=PauseDevice, - - /{,usr/}bin/{bash,dash,sh} ix, - /usr/bin/xkbcomp ix, - - @{PROC}/cmdline r, - @{PROC}/@{pid}/cmdline r, - @{PROC}/ioports r, - @{PROC}/mtrr rw, - - @{sys}/**/ r, - @{sys}/devices/** r, - @{sys}/module/** r, - - @{sys}/devices/pci*/**/backlight/*/brightness rw, - - # Display managers - @{run}/user/@{uid}/gdm/* r, - @{run}/lightdm/** r, - @{run}/lxdm/* r, - @{run}/sddm/* r, - @{run}/slim.auth r, - /var/lib/wdm/** r, - /var/lib/xdm/** r, - - @{run}/nvidia-xdriver-* rw, # TODO: double-check - @{run}/udev/data/** r, - - /dev/dri/card[0-9]* r, - /dev/fb0 rw, - /dev/input/event* rw, - /dev/tty[0-9]* rw, - /dev/vga_arbiter rw, - - /etc/X11/** r, - - owner /tmp/.tX[0-9]*-lock rw, - owner /tmp/.X[0-9]*-lock wl, - owner /tmp/serverauth.* r, # startx(1) - owner /tmp/server-[0-9]*.xkm rw, - - /usr/lib/xorg/modules/ r, - /usr/lib/xorg/modules/** mr, - /usr/share/** r, - - owner /var/lib/xkb/** rw, - owner /var/log/Xorg.pid-[1-9]*.log rw, - owner /var/log/Xorg.[0-9]*.log{,.old} rw, - - # Rootless mode (gdm3, startx) - owner @{HOME}/.local/ w, - owner @{HOME}/.local/share/ w, - owner @{HOME}/.local/share/xorg/ w, - owner @{HOME}/.local/share/xorg/Xorg.pid-[1-9]*.log rw, - owner @{HOME}/.local/share/xorg/Xorg.[0-9]*.log{,.old} rw, - owner /var/lib/gdm*/.cache/mesa_shader_cache/ rw, - owner /var/lib/gdm*/.cache/mesa_shader_cache/** rwk, - owner /var/lib/gdm*/.local/share/xorg/Xorg.pid-[1-9]*.log rw, - owner /var/lib/gdm*/.local/share/xorg/Xorg.[0-9]*.log{,.old} rw, - - # When running without a kernel mode-setting (KMS) driver, Xorg may need - # these additional permissions. DO NOT enable these unless necessary! - #nokms#/dev/mem rw, - #nokms#@{sys}/devices/pci[0-9]*/*/*/resource[0-9] w, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/Xorg> -} diff --git a/straper/db/public/apparmor/apparmor.d/abi/3.0 b/straper/db/public/apparmor/apparmor.d/abi/3.0 deleted file mode 100644 index 4b60c42..0000000 --- a/straper/db/public/apparmor/apparmor.d/abi/3.0 +++ /dev/null @@ -1,78 +0,0 @@ -query {label {multi_transaction {yes -} -data {yes -} -perms {allow deny audit quiet -} -} -} -dbus {mask {acquire send receive -} -} -signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost -} -} -ptrace {mask {read trace -} -} -caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf -} -} -rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime -} -} -capability {0xffffff -} -namespaces {pivot_root {no -} -profile {yes -} -} -mount {mask {mount umount pivot_root -} -} -network {af_unix {yes -} -af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp -} -} -network_v8 {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp -} -} -file {mask {create read write exec append mmap_exec link lock -} -} -domain {version {1.2 -} -attach_conditions {xattr {yes -} -} -computed_longest_left {yes -} -post_nnp_subset {yes -} -fix_binfmt_elf_mmap {yes -} -stack {yes -} -change_profile {yes -} -change_onexec {yes -} -change_hatv {yes -} -change_hat {yes -} -} -policy {set_load {yes -} -versions {v8 {yes -} -v7 {yes -} -v6 {yes -} -v5 {yes -} -} -} diff --git a/straper/db/public/apparmor/apparmor.d/abi/4.0 b/straper/db/public/apparmor/apparmor.d/abi/4.0 deleted file mode 100644 index 9e61fe3..0000000 --- a/straper/db/public/apparmor/apparmor.d/abi/4.0 +++ /dev/null @@ -1,91 +0,0 @@ -capability {0xffffff -} -caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore -} -} -dbus {mask {acquire send receive -} -} -domain {attach_conditions {xattr {yes -} -} -change_hat {yes -} -change_hatv {yes -} -change_onexec {yes -} -change_profile {yes -} -computed_longest_left {yes -} -fix_binfmt_elf_mmap {yes -} -post_nnp_subset {yes -} -stack {yes -} -version {1.2 -} -} -file {mask {create read write exec append mmap_exec link lock -} -} -ipc {posix_mqueue {create read write open delete setattr getattr -} -} -mount {mask {mount umount pivot_root -} -} -namespaces {mask {userns_create -} -pivot_root {no -} -profile {yes -} -} -network {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp -} -af_unix {yes -} -} -network_v8 {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp -} -} -policy {outofband {0x000001 -} -permstable32 {allow deny subtree cond kill complain prompt audit quiet hide xindex tag label -} -permstable32_version {0x000002 -} -set_load {yes -} -versions {v5 {yes -} -v6 {yes -} -v7 {yes -} -v8 {yes -} -v9 {yes -} -} -} -ptrace {mask {read trace -} -} -query {label {data {yes -} -multi_transaction {yes -} -perms {allow deny audit quiet -} -} -} -rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime -} -} -signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost -} -} diff --git a/straper/db/public/apparmor/apparmor.d/abi/kernel-5.4-outoftree-network b/straper/db/public/apparmor/apparmor.d/abi/kernel-5.4-outoftree-network deleted file mode 100644 index 6d5e95b..0000000 --- a/straper/db/public/apparmor/apparmor.d/abi/kernel-5.4-outoftree-network +++ /dev/null @@ -1,76 +0,0 @@ -query {label {multi_transaction {yes -} -data {yes -} -perms {allow deny audit quiet -} -} -} -dbus {mask {acquire send receive -} -} -signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost -} -} -ptrace {mask {read trace -} -} -caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read -} -} -rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime -} -} -capability {0xffffff -} -namespaces {pivot_root {no -} -profile {yes -} -} -mount {mask {mount umount pivot_root -} -} -network {af_unix {yes -} -af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp -} -} -} -file {mask {create read write exec append mmap_exec link lock -} -} -domain {version {1.2 -} -attach_conditions {xattr {yes -} -} -computed_longest_left {yes -} -post_nnp_subset {yes -} -fix_binfmt_elf_mmap {yes -} -stack {yes -} -change_profile {yes -} -change_onexec {yes -} -change_hatv {yes -} -change_hat {yes -} -} -policy {set_load {yes -} -versions {v8 {yes -} -v7 {yes -} -v6 {yes -} -v5 {yes -} -} -} diff --git a/straper/db/public/apparmor/apparmor.d/abi/kernel-5.4-vanilla b/straper/db/public/apparmor/apparmor.d/abi/kernel-5.4-vanilla deleted file mode 100644 index 9fa0e8f..0000000 --- a/straper/db/public/apparmor/apparmor.d/abi/kernel-5.4-vanilla +++ /dev/null @@ -1,68 +0,0 @@ -query {label {multi_transaction {yes -} -data {yes -} -perms {allow deny audit quiet -} -} -} -signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost -} -} -ptrace {mask {read trace -} -} -caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read -} -} -rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime -} -} -capability {0xffffff -} -namespaces {pivot_root {no -} -profile {yes -} -} -mount {mask {mount umount pivot_root -} -} -} -file {mask {create read write exec append mmap_exec link lock -} -} -domain {version {1.2 -} -attach_conditions {xattr {yes -} -} -computed_longest_left {yes -} -post_nnp_subset {yes -} -fix_binfmt_elf_mmap {yes -} -stack {yes -} -change_profile {yes -} -change_onexec {yes -} -change_hatv {yes -} -change_hat {yes -} -} -policy {set_load {yes -} -versions {v8 {yes -} -v7 {yes -} -v6 {yes -} -v5 {yes -} -} -} diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/X b/straper/db/public/apparmor/apparmor.d/abstractions/X deleted file mode 100644 index 6df8911..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/X +++ /dev/null @@ -1,67 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - include <abstractions/dri-common> - - - # .ICEauthority files required for X authentication, per user - owner @{HOME}/.ICEauthority r, - owner @{run}/user/*/ICEauthority r, - - # .Xauthority files required for X connections, per user - owner @{HOME}/.Xauthority r, - owner @{HOME}/.local/share/sddm/.Xauthority r, - owner @{run}/gdm{,3}/*/database r, - owner @{run}/lightdm/authority/[0-9]* r, - owner @{run}/lightdm/*/xauthority r, - owner @{run}/user/*/gdm/Xauthority r, - owner @{run}/user/*/X11/Xauthority r, - owner @{run}/user/*/xauth_* r, - owner /tmp/xauth_?????? r, - - # the unix socket to use to connect to the display - /tmp/.X11-unix/* rw, - unix (connect, receive, send) - type=stream - peer=(addr="@/tmp/.X11-unix/X[0-9]*"), - unix (connect, receive, send) - type=stream - peer=(addr="@/tmp/.ICE-unix/[0-9]*"), - - /usr/include/X11/ r, - /usr/include/X11/** r, - - # The X tree changes and is large -- grant read access to the whole thing - /usr/X11R6/** r, - /usr/share/X11/ r, - /usr/share/X11/** r, - /usr/X11R6/**.so* mr, - - # EGL - /usr/lib/@{multiarch}/egl/*.so* mr, - - # Xcompose - owner @{HOME}/.XCompose r, - /var/cache/libx11/compose/* r, - deny /var/cache/libx11/compose/* wlk, - - # mouse themes - /etc/X11/cursors/ r, - /etc/X11/cursors/** r, - - # Xwayland - owner @{run}/user/*/.mutter-Xwaylandauth.* r, - - # Include additions to the abstraction - include if exists <abstractions/X.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common b/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common deleted file mode 100644 index 0982635..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common +++ /dev/null @@ -1,43 +0,0 @@ -# vim:syntax=apparmor - -# This file contains basic permissions for Apache and every vHost - - abi <abi/4.0>, - - include <abstractions/nameservice> - - # Allow other processes to read our /proc entries - ptrace (readby), - # Allow other processes to trace us by default - ptrace (tracedby), - # Allow unconfined processes to send us signals by default - signal (receive) peer=unconfined, - # Allow apache to send us signals by default - signal (receive) peer=apache2, - # Allow other hats to signal by default - signal peer=apache2//*, - # Allow us to signal ourselves - signal peer=@{profile_name}, - - # Apache - network inet stream, - network inet6 stream, - # apache manual, error pages and icons - /usr/share/apache2/** r, - - # changehat itself - @{PROC}/@{pid}/attr/{apparmor/,}current rw, - - # htaccess files - for what ever it is worth - /**/.htaccess r, - - /dev/urandom r, - - # sasl-auth - @{run}/saslauthd/mux rw, - - # OCSP stapling - @{run}/lock/apache2/stapling-cache* rw, - - # Include additions to the abstraction - include if exists <abstractions/apache2-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/change_profile b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/change_profile deleted file mode 100644 index 13df61a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/change_profile +++ /dev/null @@ -1,13 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -abi <abi/4.0>, - -include <abstractions/apparmor_api/introspect> - -@{PROC}/@{tid}/attr/{apparmor/,}{current,exec} w, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/examine b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/examine deleted file mode 100644 index f90a364..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/examine +++ /dev/null @@ -1,14 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# Make sure to include at least tunables/proc and tunables/kernelvars -# when using this abstraction, if not tunables/global. - -abi <abi/4.0>, - -@{PROC}/@{pids}/attr/{apparmor/,}{current,prev,exec} r, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/find_mountpoint b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/find_mountpoint deleted file mode 100644 index dae90c9..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/find_mountpoint +++ /dev/null @@ -1,16 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -abi <abi/4.0>, - -#permissions needed for aa_find_mountpoint - -# Make sure to include at least tunables/proc and tunables/kernelvars -# when using this abstraction, if not tunables/global. - -@{PROC}/@{pids}/mounts r, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/introspect b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/introspect deleted file mode 100644 index 00934fb..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/introspect +++ /dev/null @@ -1,14 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -abi <abi/4.0>, - -# Make sure to include at least tunables/proc and tunables/kernelvars -# when using this abstraction, if not tunables/global. - -@{PROC}/@{tid}/attr/{apparmor/,}{current,prev,exec} r, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/is_enabled b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/is_enabled deleted file mode 100644 index a47b3d4..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/is_enabled +++ /dev/null @@ -1,20 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -abi <abi/4.0>, - -# permissions needed for aa_is_enabled - -# Make sure to include tunables/apparmorfs and tunables/global -# when using this abstraction - -include <abstractions/apparmor_api/find_mountpoint> -@{sys}/module/apparmor/parameters/enabled r, -@{sys}/module/apparmor/parameters/available r, - -# TODO: add alternate apparmorfs interface for enabled diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/aspell b/straper/db/public/apparmor/apparmor.d/abstractions/aspell deleted file mode 100644 index f6989d7..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/aspell +++ /dev/null @@ -1,18 +0,0 @@ -# vim:syntax=apparmor -# aspell permissions - - abi <abi/4.0>, - - # per-user settings and dictionaries - owner @{HOME}/.aspell.*.{pws,prepl} rwk, - - # system libraries and dictionaries - /usr/lib/aspell/ r, - /usr/lib/aspell/* r, - /usr/lib/aspell/*.so m, - /usr/share/aspell/ r, - /usr/share/aspell/* r, - /var/lib/aspell/* r, - - # Include additions to the abstraction - include if exists <abstractions/aspell.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/audio b/straper/db/public/apparmor/apparmor.d/abstractions/audio deleted file mode 100644 index 5965559..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/audio +++ /dev/null @@ -1,93 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -abi <abi/4.0>, - - -/dev/admmidi* rw, -/dev/adsp* rw, -/dev/aload* rw, -/dev/amidi* rw, -/dev/audio* rw, -/dev/dmfm* rw, -/dev/dmmidi* rw, -/dev/dsp* rw, -/dev/midi* rw, -/dev/mixer* rw, -/dev/mpu401data rw, -/dev/mpu401stat rw, -/dev/patmgr* rw, -/dev/phone* rw, -/dev/radio* rw, -/dev/rmidi* rw, -/dev/sequencer rw, -/dev/sequencer2 rw, -/dev/smpte* rw, - -/dev/snd/* rw, -/dev/sound/* rw, - -@{PROC}/asound/** rw, - -/usr/share/alsa/** r, -/usr/share/sounds/ r, -/usr/share/sounds/** r, - -owner @{HOME}/.esd_auth r, -/etc/asound.conf r, -owner @{HOME}/.asoundrc r, -/etc/esound/esd.conf r, - -# libao -/etc/libao.conf r, -owner @{HOME}/.libao r, - -# libcanberra -owner @{HOME}/.cache/event-sound-cache.* rwk, - -# pulse -/etc/pulse/ r, -/etc/pulse/** r, -/dev/shm/ r, -@{run}/shm/ r, -owner /dev/shm/pulse-shm* rwk, -owner @{run}/shm/pulse-shm* rwk, -owner @{HOME}/.pulse-cookie rwk, -owner @{HOME}/.pulse/ rw, -owner @{HOME}/.pulse/* rwk, -owner @{run}/user/*/pulse/ rw, -owner @{run}/user/*/pulse/{native,pid} rwk, -owner @{HOME}/.config/pulse/*.conf r, -owner @{HOME}/.config/pulse/client.conf.d/{,*.conf} r, -owner @{HOME}/.config/pulse/cookie rwk, -owner /tmp/pulse-*/ rw, -owner /tmp/pulse-*/* rw, - -# libgnome2 -/etc/sound/ r, -/etc/sound/** r, - -# openal -/etc/alsa/conf.d/{,*} r, -/etc/openal/alsoft.conf r, -owner @{HOME}/.alsoftrc r, -/usr/{,local/}share/openal/hrtf/{,**} r, -owner @{HOME}/.local/share/openal/hrtf/{,**} r, - -# wildmidi -/etc/wildmidi/wildmidi.cfg r, - -# pipewire -/usr/share/pipewire/client{,-rt}.conf r, - - # Include additions to the abstraction - include if exists <abstractions/audio.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/authentication b/straper/db/public/apparmor/apparmor.d/abstractions/authentication deleted file mode 100644 index 094f235..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/authentication +++ /dev/null @@ -1,74 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2012 Canonical Ltd -# Copyright (C) 2019-2021 Christian Boltz -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - - # Some services need to perform authentication of users - # Such authentication almost certainly needs access to the local users - # databases containing passwords, PAM configuration files, PAM libraries - @{etc_ro}/nologin r, - @{etc_ro}/pam.d/* r, - @{etc_ro}/securetty r, - @{etc_ro}/security/* r, - @{etc_ro}/shadow r, - @{etc_ro}/gshadow r, - @{etc_ro}/pwdb.conf r, - - /{usr/,}lib{,32,64}/security/pam_filter/* mr, - /{usr/,}lib{,32,64}/security/pam_*.so mr, - /{usr/,}lib{,32,64}/security/ r, - /{usr/,}lib/@{multiarch}/security/pam_filter/* mr, - /{usr/,}lib/@{multiarch}/security/pam_*.so mr, - /{usr/,}lib/@{multiarch}/security/ r, - - # pam_unix - owner /proc/@{pid}/loginuid r, - /{,usr/}{,s}bin/unix_chkpwd Px, - - # pam_env - @{etc_ro}/environment r, - - # pam_limit - @{etc_ro}/security/limits.d/ r, - @{etc_ro}/security/limits.d/*.conf r, - - # gssapi - @{etc_ro}/gss/mech r, - @{etc_ro}/gss/mech.d/ r, - @{etc_ro}/gss/mech.d/*.conf r, - - # kerberos - include <abstractions/kerberosclient> - # SuSE's pwdutils are different: - @{etc_ro}/default/passwd r, - @{etc_ro}/login.defs r, - @{etc_ro}/login.defs.d/ r, - @{etc_ro}/login.defs.d/*.defs r, - - # nis - include <abstractions/nis> - - # winbind - include <abstractions/winbind> - - # likewise - include <abstractions/likewise> - - # smbpass - include <abstractions/smbpass> - - # p11-kit (PKCS#11 modules configuration) - include <abstractions/p11-kit> - - # Include additions to the abstraction - include if exists <abstractions/authentication.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/base b/straper/db/public/apparmor/apparmor.d/abstractions/base deleted file mode 100644 index 20700db..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/base +++ /dev/null @@ -1,185 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - include <abstractions/crypto> - - # (Note that the ldd profile has inlined this file; if you make - # modifications here, please consider including them in the ldd - # profile as well.) - - # The __canary_death_handler function writes a time-stamped log - # message to /dev/log for logging by syslogd. So, /dev/log, timezones, - # and localisations of date should be available EVERYWHERE, so - # StackGuard, FormatGuard, etc., alerts can be properly logged. - /dev/log w, - /dev/random r, - /dev/urandom r, - # Allow access to the uuidd daemon (this daemon is a thin wrapper around - # time and getrandom()/{,u}random and, when available, runs under an - # unprivilged, dedicated user). - @{run}/uuidd/request r, - @{etc_ro}/locale/** r, - @{etc_ro}/locale.alias r, - @{etc_ro}/localtime r, - @{etc_rw}/localtime r, - /etc/writable/localtime r, - /usr/share/locale-bundle/** r, - /usr/share/locale-langpack/** r, - /usr/share/locale/ r, - /usr/share/locale/** r, - /usr/share/**/locale/** r, - /usr/share/zoneinfo{,-icu}/ r, - /usr/share/zoneinfo{,-icu}/** r, - /usr/share/X11/locale/** r, - @{run}/systemd/journal/dev-log w, - # systemd native journal API (see sd_journal_print(4)) - @{run}/systemd/journal/socket w, - # Nested containers and anything using systemd-cat need this. 'r' shouldn't - # be required but applications fail without it. journald doesn't leak - # anything when reading so this is ok. - @{run}/systemd/journal/stdout rw, - - /usr/lib{,32,64}/locale/** mr, - /usr/lib{,32,64}/gconv/*.so mr, - /usr/lib{,32,64}/gconv/gconv-modules* mr, - /usr/lib/@{multiarch}/gconv/*.so mr, - /usr/lib/@{multiarch}/gconv/gconv-modules* mr, - - # used by glibc when binding to ephemeral ports - @{etc_ro}/bindresvport.blacklist r, - - # ld.so.cache and ld are used to load shared libraries; they are best - # available everywhere - @{etc_ro}/ld.so.cache mr, - @{etc_ro}/ld.so.conf r, - @{etc_ro}/ld.so.conf.d/{,*.conf} r, - @{etc_ro}/ld.so.preload r, - @{etc_ro}/ld-musl-*.path r, - /{usr/,}lib{,32,64}/ld{,32,64}-*.so mr, - /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so mr, - /{usr/,}lib/tls/i686/{cmov,nosegneg}/ld-*.so mr, - /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/ld-*.so mr, - /opt/*-linux-uclibc/lib/ld-uClibc*so* mr, - - # we might as well allow everything to use common libraries - /{usr/,}lib{,32,64}/** r, - /{usr/,}lib{,32,64}/**.so* mr, - /{usr/,}lib/@{multiarch}/** r, - /{usr/,}lib/@{multiarch}/**.so* mr, - /{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so* mr, - /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so* mr, - - # FIPS-140-2 versions of some crypto libraries need to access their - # associated integrity verification file, or they will abort. - /{usr/,}lib{,32,64}/.lib*.so*.hmac r, - /{usr/,}lib/@{multiarch}/.lib*.so*.hmac r, - - # /dev/null is pretty harmless and frequently used - /dev/null rw, - # as is /dev/zero - /dev/zero rw, - # recent glibc uses /dev/full in preference to /dev/null for programs - # that don't have open fds at exec() - /dev/full rw, - - # Sometimes used to determine kernel/user interfaces to use - @{PROC}/sys/kernel/version r, - # Depending on which glibc routine uses this file, base may not be the - # best place -- but many profiles require it, and it is quite harmless. - @{PROC}/sys/kernel/ngroups_max r, - - # Used to determine if Linux is running in FIPS mode - @{PROC}/sys/crypto/fips_enabled r, - - # glibc's sysconf(3) routine to determine free memory, etc - @{PROC}/meminfo r, - @{PROC}/stat r, - @{PROC}/cpuinfo r, - @{sys}/devices/system/cpu/ r, - @{sys}/devices/system/cpu/online r, - @{sys}/devices/system/cpu/possible r, - - # transparent hugepage support - @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, - - # glibc's *printf protections read the maps file - @{PROC}/@{pid}/{maps,auxv,status} r, - - # some applications will display license information - /usr/share/common-licenses/** r, - - # glibc statvfs - @{PROC}/filesystems r, - - # glibc malloc (man 5 proc) - @{PROC}/sys/vm/overcommit_memory r, - - # Allow determining the highest valid capability of the running kernel - @{PROC}/sys/kernel/cap_last_cap r, - - # Allow other processes to read our /proc entries, futexes, perf tracing and - # kcmp for now (they will need 'read' in the first place). Administrators can - # override with: - # deny ptrace (readby) ... - ptrace (readby), - - # Allow other processes to trace us by default (they will need 'trace' in - # the first place). Administrators can override with: - # deny ptrace (tracedby) ... - ptrace (tracedby), - - # Allow us to ptrace read ourselves - ptrace (read) peer=@{profile_name}, - - # Allow unconfined processes to send us signals by default - signal (receive) peer=unconfined, - - # Allow us to signal ourselves - signal peer=@{profile_name}, - - # Checking for PID existence is quite common so add it by default for now - signal (receive, send) set=("exists"), - - # Allow us to create and use abstract and anonymous sockets - unix peer=(label=@{profile_name}), - - # Allow unconfined processes to us via unix sockets - unix (receive) peer=(label=unconfined), - - # Allow us to create abstract and anonymous sockets - unix (create), - - # Allow us to getattr, getopt, setop and shutdown on unix sockets - unix (getattr, getopt, setopt, shutdown), - - # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked - # filesystems generally. This does not appreciably decrease security with - # Ubuntu profiles because the user is expected to have access to files owned - # by him/her. Exceptions to this are explicit in the profiles. While this rule - # grants access to those exceptions, the intended privacy is maintained due to - # the encrypted contents of the files in this directory. Files in this - # directory will also use filename encryption by default, so the files are - # further protected. Also, with the use of 'owner', this rule properly - # prevents access to the files from processes running under a different uid. - - # encrypted ~/.Private and old-style encrypted $HOME - owner @{HOME}/.Private/ r, - owner @{HOME}/.Private/** mrixwlk, - # new-style encrypted $HOME - owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r, - owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk, - - - # Include additions to the abstraction - include if exists <abstractions/base.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/bash b/straper/db/public/apparmor/apparmor.d/abstractions/bash deleted file mode 100644 index ba2c4e3..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/bash +++ /dev/null @@ -1,49 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # user-specific bash files - @{HOMEDIRS} r, - @{HOME}/.bashrc r, - @{HOME}/.profile r, - @{HOME}/.bash_profile r, - @{HOME}/.bash_history rw, - - # system-wide bash configuration - /etc/profile.dos r, - /etc/profile r, - /etc/profile.d/ r, - /etc/profile.d/* r, - /etc/bashrc r, - /etc/bash.bashrc r, - /etc/bash.bashrc.local r, - /etc/bash_completion r, - /etc/bash_completion.d/ r, - /etc/bash_completion.d/* r, - - # bash relies on system-wide readline configuration - /etc/inputrc r, - - # bash inspects filesystems at startup - /etc/mtab r, - @{PROC}/@{pid}/mounts r, - @{PROC}/filesystems r, - - # probably readline wants to know terminal capabilities - /usr/share/terminfo/** r, - - # run out of /etc/bash.bashrc - /etc/DIR_COLORS r, - /{usr/,}bin/ls mix, - /usr/bin/dircolors mix, - - # Include additions to the abstraction - include if exists <abstractions/bash.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/consoles b/straper/db/public/apparmor/apparmor.d/abstractions/consoles deleted file mode 100644 index 267cb03..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/consoles +++ /dev/null @@ -1,27 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2005 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - - # there are three common ways to refer to consoles - /dev/console rw, - /dev/tty rw, - # this next entry is a tad unfortunate; /dev/tty will always be - # associated with the controlling terminal by the kernel, but if a - # program uses the /dev/pts/ interface, it actually has access to - # -all- xterm, sshd, etc, terminals on the system. - /dev/pts/[0-9]* rw, - /dev/pts/ r, - - - # Include additions to the abstraction - include if exists <abstractions/consoles.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/crypto b/straper/db/public/apparmor/apparmor.d/abstractions/crypto deleted file mode 100644 index 9d46608..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/crypto +++ /dev/null @@ -1,34 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# Copyright (C) 2021 Christian Boltz -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # Global config of openssl - include <abstractions/openssl> - - @{etc_ro}/gcrypt/hwf.deny r, - @{etc_ro}/gcrypt/random.conf r, - @{PROC}/sys/crypto/fips_enabled r, - - # libgcrypt reads some flags from /proc - @{PROC}/sys/crypto/* r, - - # crypto policies used by various libraries - /etc/crypto-policies/*/*.txt r, - /usr/share/crypto-policies/*/*.txt r, - - # Global gnutls config - @{etc_ro}/gnutls/config r, - @{etc_ro}/gnutls/pkcs11.conf r, - - include if exists <abstractions/crypto.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/cups-client b/straper/db/public/apparmor/apparmor.d/abstractions/cups-client deleted file mode 100644 index a085bd4..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/cups-client +++ /dev/null @@ -1,23 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009-2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # discoverable system configuration for non-local cupsd - /etc/cups/client.conf r, - # client should be able to talk the local cupsd - @{run}/cups/cups.sock rw, - # client should be able to read user-specified cups configuration - owner @{HOME}/.cups/client.conf r, - owner @{HOME}/.cups/lpoptions r, - - # Include additions to the abstraction - include if exists <abstractions/cups-client.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus b/straper/db/public/apparmor/apparmor.d/abstractions/dbus deleted file mode 100644 index 83d44e4..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dbus +++ /dev/null @@ -1,21 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009-2013 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # This abstraction grants full system bus access. Consider using the - # dbus-strict abstraction for fine-grained bus mediation. - - include <abstractions/dbus-strict> - dbus bus=system, - - # Include additions to the abstraction - include if exists <abstractions/dbus.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility deleted file mode 100644 index cade13e..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility +++ /dev/null @@ -1,21 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2013 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # This abstraction grants full accessibility bus access. Consider using the - # dbus-accessibility-strict abstraction for fine-grained bus mediation. - - include <abstractions/dbus-accessibility-strict> - dbus bus=accessibility, - - # Include additions to the abstraction - include if exists <abstractions/dbus-accessibility.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility-strict deleted file mode 100644 index 1a0a293..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility-strict +++ /dev/null @@ -1,22 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2013 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - dbus send - bus=accessibility - path=/org/freedesktop/DBus - interface=org.freedesktop.DBus - member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} - peer=(name=org.freedesktop.DBus), - - # Include additions to the abstraction - include if exists <abstractions/dbus-accessibility-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-network-manager-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-network-manager-strict deleted file mode 100644 index 849d6ec..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-network-manager-strict +++ /dev/null @@ -1,47 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - - dbus send - bus=system - path=/org/freedesktop/NetworkManager - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=org.freedesktop.NetworkManager), - - dbus send - bus=system - path=/org/freedesktop/NetworkManager - interface=org.freedesktop.NetworkManager - member=GetDevices - peer=(name=org.freedesktop.NetworkManager), - - dbus send - bus=system - path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]* - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=org.freedesktop.NetworkManager), - - dbus send - bus=system - path=/org/freedesktop/NetworkManager/Devices/[0-9]* - interface=org.freedesktop.DBus.Properties - member=GetAll - peer=(name=org.freedesktop.NetworkManager), - - dbus send - bus=system - path=/org/freedesktop/NetworkManager/Settings - interface=org.freedesktop.NetworkManager.Settings - member={GetDevices,ListConnections} - peer=(name=org.freedesktop.NetworkManager), - - dbus send - bus=system - path=/org/freedesktop/NetworkManager/Settings/[0-9]* - interface=org.freedesktop.NetworkManager.Settings.Connection - member=GetSettings - peer=(name=org.freedesktop.NetworkManager), - - include if exists <abstractions/dbus-network-manager-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session deleted file mode 100644 index 99104c2..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session +++ /dev/null @@ -1,22 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2011-2013 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # This abstraction grants full session bus access. Consider using the - # dbus-session-strict abstraction for fine-grained bus mediation. - - include <abstractions/dbus-session-strict> - /usr/bin/dbus-launch ix, - dbus bus=session, - - # Include additions to the abstraction - include if exists <abstractions/dbus-session.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict deleted file mode 100644 index 1796a55..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict +++ /dev/null @@ -1,39 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2011-2013 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # unique per-machine identifier - /etc/machine-id r, - /var/lib/dbus/machine-id r, - - unix (connect, receive, send, accept) type=stream peer=(addr="@/tmp/dbus-*"), - - unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-*", - unix (bind, listen) type=stream addr="@/tmp/dbus-*", - - # dbus with systemd and --enable-user-session - owner @{run}/user/[0-9]*/bus rw, - - dbus send - bus=session - path=/org/freedesktop/DBus - interface=org.freedesktop.DBus - member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} - peer=(name=org.freedesktop.DBus), - - owner @{run}/user/@{uid}/at-spi/ rw, - owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw, - - owner /tmp/dbus-[0-9a-zA-Z]* rw, - - # Include additions to the abstraction - include if exists <abstractions/dbus-session-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-strict deleted file mode 100644 index 60b5d19..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-strict +++ /dev/null @@ -1,24 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009-2013 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - @{run}/dbus/system_bus_socket rw, - - dbus send - bus=system - path=/org/freedesktop/DBus - interface=org.freedesktop.DBus - member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} - peer=(name=org.freedesktop.DBus), - - # Include additions to the abstraction - include if exists <abstractions/dbus-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dconf b/straper/db/public/apparmor/apparmor.d/abstractions/dconf deleted file mode 100644 index 959cfd4..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dconf +++ /dev/null @@ -1,14 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# permissions for querying dconf settings; granting write access should -# be specified in a specific application's profile. - - @{etc_ro}/dconf/** r, - # TODO: make w conditional when an override is available, so it can be moved to a portal. - owner @{run}/user/*/dconf/user rw, - owner @{HOME}/.config/dconf/user r, - - # Include additions to the abstraction - include if exists <abstractions/dconf.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb b/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb deleted file mode 100644 index 9c3d5bb..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb +++ /dev/null @@ -1,22 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2021 Mikhail Morfikov -# Copyright (C) 2021-2025 Alexandre Pujol <alexandre@pujol.io> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - include <abstractions/devices-usb-read> - - /dev/bus/usb/@{int}/@{int} wk, - - @{sys}/devices/**/usb@{int}/{,**} w, - - include if exists <abstractions/devices-usb.d> - -# vim:syntax=apparmor diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb-read b/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb-read deleted file mode 100644 index 3fdb709..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb-read +++ /dev/null @@ -1,35 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2021 Mikhail Morfikov -# Copyright (C) 2021-2025 Alexandre Pujol <alexandre@pujol.io> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /dev/ r, - /dev/bus/usb/ r, - /dev/bus/usb/@{int}/ r, - /dev/bus/usb/@{int}/@{int} r, - - @{sys}/class/ r, - @{sys}/class/usbmisc/ r, - - @{sys}/bus/ r, - @{sys}/bus/usb/ r, - @{sys}/bus/usb/devices/{,**} r, - - @{sys}/devices/**/usb@{int}/{,**} r, - - # Udev data about usb devices (~equal to content of lsusb -v) - @{run}/udev/data/+usb:* r, - @{run}/udev/data/c16[6,7]:@{int} r, # USB modems - @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters - - include if exists <abstractions/devices-usb-read.d> - -# vim:syntax=apparmor diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dovecot-common b/straper/db/public/apparmor/apparmor.d/abstractions/dovecot-common deleted file mode 100644 index d0722eb..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dovecot-common +++ /dev/null @@ -1,24 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2014 Canonical, Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ -# used with dovecot/* - - abi <abi/4.0>, - - capability setgid, - - deny capability block_suspend, - - # dovecot's master can send us signals - signal receive peer=dovecot, - - owner @{run}/dovecot/config rw, - - # Include additions to the abstraction - include if exists <abstractions/dovecot-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dri-common b/straper/db/public/apparmor/apparmor.d/abstractions/dri-common deleted file mode 100644 index fb82b8d..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dri-common +++ /dev/null @@ -1,19 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# This file contains common DRI-specific rules useful for GUI applications -# (needed by libdrm and similar). - - /usr/lib{,32,64}/dri/** mr, - /usr/lib/@{multiarch}/dri/** mr, - /usr/lib/fglrx/dri/** mr, - /dev/dri/ r, - /dev/dri/** rw, - /etc/drirc r, - /usr/share/drirc.d/{,*.conf} r, - owner @{HOME}/.drirc r, - - - # Include additions to the abstraction - include if exists <abstractions/dri-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dri-enumerate b/straper/db/public/apparmor/apparmor.d/abstractions/dri-enumerate deleted file mode 100644 index 4774cee..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/dri-enumerate +++ /dev/null @@ -1,13 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# This file contains common DRI-specific rules useful for GUI applications that -# needs to enumerate graphic devices (as with drmParsePciDeviceInfo() from -# libdrm). - - @{sys}/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r, - - - # Include additions to the abstraction - include if exists <abstractions/dri-enumerate.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/enchant b/straper/db/public/apparmor/apparmor.d/abstractions/enchant deleted file mode 100644 index ecfbe0e..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/enchant +++ /dev/null @@ -1,64 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # abstraction for Enchant spellchecking frontend - - /usr/share/enchant/ r, - /usr/share/enchant/enchant.ordering r, - - /usr/share/enchant-2/ r, - /usr/share/enchant-2/enchant.ordering r, - - # aspell - include <abstractions/aspell> - /var/lib/dictionaries-common/aspell/ r, - /var/lib/dictionaries-common/aspell/* r, - - # hspell - /usr/share/hspell/ r, - /usr/share/hspell/*.wgz.* r, - - # hunspell - /usr/share/hunspell/ r, - /usr/share/hunspell/* r, - - # ispell - /usr/lib/ispell/ r, - /usr/lib/ispell/*.hash r, - /usr/share/dict/ r, - /usr/share/dict/* r, - /var/lib/dictionaries-common/ r, - /var/lib/dictionaries-common/{ispell,wordlist}/ r, - /var/lib/dictionaries-common/{ispell,wordlist}/* r, - - # myspell - /usr/share/myspell/ r, - /usr/share/myspell/** r, - - # voikko - /usr/lib/voikko/ r, - /usr/lib/voikko/2/ r, - /usr/lib/voikko/2/mor-standard/ r, - /usr/lib/voikko/2/mor-standard/voikko* r, - - # zemberek - /usr/share/java/ r, - /usr/share/java/zemberek-[0-9]*.jar r, - /usr/share/java/zemberek-tr-[0-9]*.jar r, - - # per-user dictionaries - owner @{HOME}/.config/enchant/ rw, - owner @{HOME}/.config/enchant/* rwk, - - # Include additions to the abstraction - include if exists <abstractions/enchant.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/exo-open b/straper/db/public/apparmor/apparmor.d/abstractions/exo-open deleted file mode 100644 index a6b50c4..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/exo-open +++ /dev/null @@ -1,69 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# This abstraction is designed to be used in a child profile to limit what -# confined application can invoke via exo-open helper. -# -# NOTE: most likely you want to use xdg-open abstraction instead for better -# portability across desktop environments, unless you are sure that confined -# application only uses /usr/bin/exo-open directly. -# -# Usage example: -# -# ``` -# profile foo /usr/bin/foo { -# ... -# /usr/bin/exo-open rPx -> foo//exo-open, -# ... -# } # end of main profile -# -# # out-of-line child profile -# profile foo//exo-open { -# include <abstractions/exo-open> -# -# # needed for ubuntu-* abstractions -# include <abstractions/ubuntu-helpers> -# -# # Only allow to handle http[s]: and mailto: links -# include <abstractions/ubuntu-browsers> -# include <abstractions/ubuntu-email> -# -# # Add if accessibility access is considered as required -# # (for message box in case exo-open fails) -# include <abstractions/dbus-accessibility> -# -# # < add additional allowed applications here > -# } - - include <abstractions/X> - include <abstractions/audio> # for alert messages - include <abstractions/base> - include <abstractions/dbus-session-strict> - include <abstractions/gnome> - - # Main executables - - /usr/bin/exo-open rix, - /usr/lib{32,64,/@{multiarch}}/xfce4/exo-[0-9]/exo-helper-[0-9] ix, - - # Other executables - - /{,usr/}bin/which rix, - - # System files - - /etc/xdg/{,xdg-*/}xfce4/helpers.rc r, - /etc/xfce4/defaults.list r, # TODO: move into xfce4 abstraction? - /usr/share/sounds/freedesktop/** r, # for message box alert sound - /usr/share/xfce4/helpers/*.desktop r, - /usr/share/{xfce{,4},xubuntu}/applications/{,*.list} r, - - # User files - - owner @{PROC}/@{pid}/fd/ r, - owner @{HOME}/.config/xfce4/helpers.rc r, - owner @{HOME}/.local/share/xfce4/helpers/*.desktop r, - - # Include additions to the abstraction - include if exists <abstractions/exo-open.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/fcitx b/straper/db/public/apparmor/apparmor.d/abstractions/fcitx deleted file mode 100644 index 63173a0..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/fcitx +++ /dev/null @@ -1,18 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2016 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - include <abstractions/fcitx-strict> - dbus bus=fcitx, - - # Include additions to the abstraction - include if exists <abstractions/fcitx.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/fcitx-strict b/straper/db/public/apparmor/apparmor.d/abstractions/fcitx-strict deleted file mode 100644 index c4e7301..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/fcitx-strict +++ /dev/null @@ -1,39 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2016 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - include <abstractions/dbus-session-strict> - - dbus send - bus=fcitx - path=/org/freedesktop/DBus - interface=org.freedesktop.DBus - member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} - peer=(name=org.freedesktop.DBus), - - owner @{HOME}/.config/fcitx/dbus/* r, - - # Allow access to the Fcitx portal, supported by fcitx/fcitx5 - dbus (send) - bus=session - path=/{,org/freedesktop/portal/}inputmethod - interface=org.fcitx.Fcitx.InputMethod1 - member={CreateInputContext,Version} - peer=(name=org.freedesktop.portal.Fcitx), - - dbus (send, receive) - bus=session - path=/{,org/freedesktop/portal/}inputcontext/** - interface=org.fcitx.Fcitx.InputContext1, - - # Include additions to the abstraction - include if exists <abstractions/fcitx-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/fonts b/straper/db/public/apparmor/apparmor.d/abstractions/fonts deleted file mode 100644 index d86d230..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/fonts +++ /dev/null @@ -1,68 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /usr/share/AbiSuite/fonts/** r, - - /usr/lib/xorg/modules/fonts/**.so* mr, - - /usr/share/fonts/{,**} r, - /usr/share/fonts-*/{,**} r, - - /etc/fonts/** r, - # Debian, openSUSE paths are different - /usr/share/{fontconfig,fonts-config,*-fonts}/conf.avail/{,**} r, - /usr/share/ghostscript/fonts/{,**} r, - - /opt/kde3/share/fonts/** r, - - /usr/lib{,32,64}/openoffice/share/fonts/** r, - - /var/cache/fonts/** r, - /var/cache/fontconfig/** mr, - /var/lib/defoma/** mr, - - /usr/share/a2ps/fonts/** r, - /usr/share/xfce/fonts/** r, - /usr/share/ghostscript/fonts/** r, - /usr/share/javascript/*/fonts/** r, - /usr/share/texmf/{,*/}fonts/** r, - /usr/share/texlive/texmf-dist/fonts/** r, - /var/lib/ghostscript/** r, - - owner @{HOME}/.fonts.conf r, - owner @{HOME}/.fonts/ r, - owner @{HOME}/.fonts/** r, - owner @{HOME}/.local/share/fonts/ r, - owner @{HOME}/.local/share/fonts/** r, - owner @{HOME}/.fonts.cache-2 mr, - owner @{HOME}/.{,cache/}fontconfig/ rw, - owner @{HOME}/.{,cache/}fontconfig/** mrwkl, - owner @{HOME}/.fonts.conf.d/ r, - owner @{HOME}/.fonts.conf.d/** r, - owner @{HOME}/.config/fontconfig/ r, - owner @{HOME}/.config/fontconfig/** r, - owner @{HOME}/.Fontmatrix/Activated/ r, - owner @{HOME}/.Fontmatrix/Activated/** r, - - /usr/local/share/fonts/ r, - /usr/local/share/fonts/** r, - - # poppler CMap tables - /usr/share/poppler/cMap/** r, - - # data files for LibThai - /usr/share/libthai/thbrk.tri r, - - # Include additions to the abstraction - include if exists <abstractions/fonts.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/freedesktop.org b/straper/db/public/apparmor/apparmor.d/abstractions/freedesktop.org deleted file mode 100644 index cb5e1ec..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/freedesktop.org +++ /dev/null @@ -1,41 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # system configuration - @{system_share_dirs}/applications/{**,} r, - @{system_share_dirs}/*ubuntu/applications/{**,} r, - @{system_share_dirs}/gnome/applications/{**,} r, - @{system_share_dirs}/xfce4/applications/{**,} r, - @{system_share_dirs}/icons/{**,} r, - @{system_share_dirs}/pixmaps/{**,} r, - - # this should probably go elsewhere - @{system_share_dirs}/mime/** r, - - @{system_share_dirs}/glib-2.0/schemas/gschemas.compiled r, - - /etc/gnome/defaults.list r, - /etc/xfce4/defaults.list r, - - # per-user configurations - owner @{HOME}/.icons/{,**} r, - owner @{HOME}/.recently-used.xbel* rw, - owner @{HOME}/.local/share/recently-used.xbel* rw, - owner @{HOME}/.config/user-dirs.dirs r, - owner @{HOME}/.config/mimeapps.list r, - owner @{user_share_dirs}/applications/{**,} r, - owner @{user_share_dirs}/icons/{**,} r, - owner @{user_share_dirs}/mime/{**,} r, - - # Include additions to the abstraction - include if exists <abstractions/freedesktop.org.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gio-open b/straper/db/public/apparmor/apparmor.d/abstractions/gio-open deleted file mode 100644 index f211717..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/gio-open +++ /dev/null @@ -1,59 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# This abstraction is designed to be used in a child profile to limit what -# confined application can invoke via gio helper. -# -# NOTE: most likely you want to use xdg-open abstraction instead for better -# portability across desktop environments, unless you are sure that confined -# application only uses /usr/bin/gio directly. -# -# Usage example: -# -# ``` -# profile foo /usr/bin/foo { -# ... -# /usr/bin/gio rPx -> foo//gio-open, -# ... -# } # end of main profile -# -# # out-of-line child profile -# profile foo//gio-open { -# include <abstractions/gio-open> -# -# # needed for ubuntu-* abstractions -# include <abstractions/ubuntu-helpers> -# -# # Only allow to handle http[s]: and mailto: links -# include <abstractions/ubuntu-browsers> -# include <abstractions/ubuntu-email> -# -# # < add additional allowed applications here > -# } - - include <abstractions/base> - include <abstractions/dbus-session-strict> - - # Main executables - - /usr/bin/gio rix, - /usr/bin/gio-launch-desktop ix, # for OpenSUSE - /usr/lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop ix, - - # System files - - /etc/gnome/defaults.list r, - /usr/share/mime/* r, - /usr/share/{,*/}applications/{,**} r, - /var/cache/gio-[0-9]*.[0-9]*/gnome-mimeapps.list r, - /var/lib/snapd/desktop/applications/{,**} r, - - # User files - - owner @{HOME}/.config/mimeapps.list r, - owner @{HOME}/.local/share/applications/{,*.desktop} r, - owner @{PROC}/@{pid}/fd/ r, - - # Include additions to the abstraction - include if exists <abstractions/gio-open.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gnome b/straper/db/public/apparmor/apparmor.d/abstractions/gnome deleted file mode 100644 index ca2eb39..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/gnome +++ /dev/null @@ -1,117 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - include <abstractions/base> - include <abstractions/fonts> - include <abstractions/X> - include <abstractions/freedesktop.org> - include <abstractions/xdg-desktop> - include <abstractions/user-tmp> - include <abstractions/wayland> - - # systemwide gtk defaults - /etc/gnome/gtkrc* r, - /etc/gtk/* r, - /usr/lib{,32,64}/gtk/** mr, - /usr/lib/@{multiarch}/gtk/** mr, - /usr/lib{,32,64}/gtk-[0-9]*/** mr, - /usr/lib/@{multiarch}/gtk-[0-9]*/** mr, - /usr/share/themes/ r, - /usr/share/themes/** r, - /usr/share/gtk-3.0/settings.ini r, - - # for gnome 1 applications - /etc/orbitrc r, - - # gtk-2 needed some new rights - /etc/fonts/* r, - /etc/gtk-*/* r, - /etc/pango/* r, - /usr/lib{,32,64}/pango/** mr, - /usr/lib{,32,64}/gtk-*/** mr, - /usr/lib{,32,64}/gdk-pixbuf-*/** mr, - /usr/lib/@{multiarch}/pango/** mr, - /usr/lib/@{multiarch}/gtk-*/** mr, - /usr/lib/@{multiarch}/gdk-pixbuf-*/** mr, - - # per-user gtk configuration - owner @{HOME}/.config/gtk-3.0/ w, - owner @{HOME}/.config/gtk-3.0/* r, - owner @{HOME}/.gnome/Gnome r, - owner @{HOME}/.gtk r, - owner @{HOME}/.gtkrc r, - owner @{HOME}/.gtkrc-2.0 r, - owner @{HOME}/.gtk-bookmarks r, - owner @{HOME}/.themes/ r, - owner @{HOME}/.themes/** r, - owner @{user_share_dirs}/themes/ r, - owner @{user_share_dirs}/themes/** r, - - # for gtk file dialog - owner @{HOME}/.config/gtk-2.0/ w, - owner @{HOME}/.config/gtk-2.0/** r, - owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw, - - # from evolution-mail - owner @{HOME}/.gconfd/lock/* r, - owner @{HOME}/.gnome/application-info r, - - # per-user font business - owner @{HOME}/.fonts.cache-* rwl, - - # GtkComposeTable - owner @{HOME}/.cache/gtk-3.0/** r, - - # icon caches - /var/cache/**/icon-theme.cache r, - /usr/share/**/icon-theme.cache r, - - # GLib schemas - /usr/{local/,}share/glib-[0-9]*/schemas/ r, - /usr/{local/,}share/glib-[0-9]*/schemas/** r, - - # gnome VFS modules - /etc/gnome-vfs-2.0/modules/ r, - /etc/gnome-vfs-2.0/modules/* r, - /usr/lib/gnome-vfs-2.0/modules/*.so mr, - /usr/lib/@{multiarch}/gnome-vfs-2.0/modules/*.so mr, - - # gvfs - /usr/share/gvfs/remote-volume-monitors/ r, - /usr/share/gvfs/remote-volume-monitors/* r, - @{PROC}/@{pid}/mounts r, - @{run}/mount/utab r, - - # printing - /etc/papersize r, - /etc/cups/lpoptions r, - /usr/share/cups/charmaps/** r, - - # holds MIT-MAGIC-COOKIE for gnome - owner @{run}/gdm/auth*/database r, - - # mime-types - /etc/gnome/defaults.list r, - /etc/xdg/{,*-}mimeapps.list r, - /usr/share/gnome/applications/ r, - /usr/share/gnome/applications/mimeinfo.cache r, - - # Allow connecting to the GNOME vfs socket (still need corresponding DBus - # rules) - unix (send, receive, connect) - type=stream - peer=(addr="@/dbus-vfs-daemon/socket-*"), - - # Include additions to the abstraction - include if exists <abstractions/gnome.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gnupg b/straper/db/public/apparmor/apparmor.d/abstractions/gnupg deleted file mode 100644 index e94f3bc..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/gnupg +++ /dev/null @@ -1,16 +0,0 @@ -# vim:syntax=apparmor -# gnupg sub-process running permissions - - abi <abi/4.0>, - - # user configurations - owner @{HOME}/.gnupg/options r, - owner @{HOME}/.gnupg/pubring.gpg r, - owner @{HOME}/.gnupg/pubring.kbx r, - owner @{HOME}/.gnupg/random_seed rw, - owner @{HOME}/.gnupg/secring.gpg r, - owner @{HOME}/.gnupg/so/*.x86_64 mr, - owner @{HOME}/.gnupg/trustdb.gpg rw, - - # Include additions to the abstraction - include if exists <abstractions/gnupg.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/groff b/straper/db/public/apparmor/apparmor.d/abstractions/groff deleted file mode 100644 index 874fbb7..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/groff +++ /dev/null @@ -1,67 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# Copyright (C) 2023 SUSE LLC -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - # Note: executing groff and nroff themself is not included in this abstraction - # so that you can choose to ix, Px or Cx them in your profile - - # groff/nroff helpers, preprocessors, and postprocessors - /usr/bin/addftinfo mrix, - /usr/bin/afmtodit mrix, - /usr/bin/chem mrix, - /usr/bin/eqn mrix, - /usr/bin/eqn2graph mrix, - /usr/bin/gdiffmk mrix, - /usr/bin/geqn mrix, - /usr/bin/grap2graph mrix, - /usr/bin/grn mrix, - /usr/bin/grodvi mrix, - /usr/bin/groffer mrix, - /usr/bin/grog mrix, - /usr/bin/grolbp mrix, - /usr/bin/grolj4 mrix, - /usr/bin/gropdf mrix, - /usr/bin/grops mrix, - /usr/bin/grotty mrix, - /usr/bin/gtbl mrix, - /usr/bin/hpftodit mrix, - /usr/bin/indxbib mrix, - /usr/bin/lkbib mrix, - /usr/bin/lookbib mrix, - /usr/bin/mmroff mrix, - /usr/bin/neqn mrix, - /usr/bin/pdfmom mrix, - /usr/bin/pdfroff mrix, - /usr/bin/pfbtops mrix, - /usr/bin/pic mrix, - /usr/bin/pic2graph mrix, - /usr/bin/post-grohtml mrix, - /usr/bin/pre-grohtml mrix, - /usr/bin/preconv mrix, - /usr/bin/refer mrix, - /usr/bin/roff2dvi mrix, - /usr/bin/roff2html mrix, - /usr/bin/roff2pdf mrix, - /usr/bin/roff2ps mrix, - /usr/bin/roff2text mrix, - /usr/bin/roff2x mrix, - /usr/bin/soelim mrix, - /usr/bin/tbl mrix, - /usr/bin/tfmtodit mrix, - /usr/bin/troff mrix, - /usr/bin/xtotroff mrix, - - # at least its macros and fonts - /usr/libexec/groff/** r, - /usr/share/groff/** r, - - # Include additions to the abstraction - include if exists <abstractions/groff.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gtk b/straper/db/public/apparmor/apparmor.d/abstractions/gtk deleted file mode 100644 index 99f46ed..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/gtk +++ /dev/null @@ -1,58 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /usr/share/themes/{,**} r, - - /usr/share/gtksourceview-[0-9]*/{,**} r, - - /usr/share/gtk-2.0/ r, - /usr/share/gtk-2.0/gtkrc r, - - /usr/share/gtk-{3,4}.0/ r, - /usr/share/gtk-{3,4}.0/settings.ini r, - - /etc/gtk-2.0/ r, - /etc/gtk-2.0/gtkrc r, - - /etc/gtk-{3,4}.0/ r, - /etc/gtk-{3,4}.0/*.conf r, - /etc/gtk-{3,4}.0/settings.ini r, - - /etc/gtk/gtkrc r, - - owner @{HOME}/.themes/{,**} r, - owner @{HOME}/.local/share/themes/{,**} r, - - owner @{HOME}/.gtk r, - owner @{HOME}/.gtkrc r, - owner @{HOME}/.gtkrc-2.0 r, - owner @{HOME}/.gtk-bookmarks r, - owner @{HOME}/.config/gtkrc r, - owner @{HOME}/.config/gtkrc-2.0 r, - owner @{HOME}/.config/gtk-{3,4}.0/ rw, - owner @{HOME}/.config/gtk-{3,4}.0/settings.ini r, - owner @{HOME}/.config/gtk-{3,4}.0/bookmarks r, - owner @{HOME}/.config/gtk-{3,4}.0/gtk.css r, - owner @{HOME}/.config/gtk-{3,4}.0/colors.css r, - owner @{HOME}/.config/gtk-{3,4}.0/servers r, - - # for gtk file dialog - owner @{HOME}/.config/gtk-2.0/ rw, - owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw, - - # .Xauthority file required for X connections - owner @{HOME}/.Xauthority r, - - # Xsession errors file - owner @{HOME}/.xsession-errors w, - - # Include additions to the abstraction - include if exists <abstractions/gtk.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open b/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open deleted file mode 100644 index 06b3585..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open +++ /dev/null @@ -1,47 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# This abstraction is designed to be used in a child profile to limit what -# confined application can invoke via gvfs-open helper. -# -# NOTE: most likely you want to use xdg-open abstraction instead for better -# portability across desktop environments, unless you are sure that confined -# application only uses /usr/bin/gvfs-open directly. -# -# Usage example: -# -# ``` -# profile foo /usr/bin/foo { -# ... -# /usr/bin/gvfs-open rPx -> foo//gvfs-open, -# ... -# } # end of main profile -# -# # out-of-line child profile -# profile foo//gvfs-open { -# include <abstractions/gvfs-open> -# -# # needed for ubuntu-* abstractions -# include <abstractions/ubuntu-helpers> -# -# # Only allow to handle http[s]: and mailto: links -# include <abstractions/ubuntu-browsers> -# include <abstractions/ubuntu-email> -# -# # < add additional allowed applications here > -# } -# ``` - - include <abstractions/base> - - # gvfs-open is deprecated, it launches gio open <uri> - include <abstractions/gio-open> - - # Main executables - - /usr/bin/gvfs-open r, - /{,usr/}bin/dash mr, - - # Include additions to the abstraction - include if exists <abstractions/gvfs-open.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/hosts_access b/straper/db/public/apparmor/apparmor.d/abstractions/hosts_access deleted file mode 100644 index bc49814..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/hosts_access +++ /dev/null @@ -1,17 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2020 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /etc/hosts.deny r, - /etc/hosts.allow r, - - include if exists <abstractions/hosts_access.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ibus b/straper/db/public/apparmor/apparmor.d/abstractions/ibus deleted file mode 100644 index 9de24de..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ibus +++ /dev/null @@ -1,29 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # abstraction for ibus input methods - owner @{HOME}/.config/ibus/ r, - owner @{HOME}/.config/ibus/bus/ rw, - owner @{HOME}/.config/ibus/bus/* rw, - - # abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache) - # This should use this, but due to LP: #1856738 we cannot - #unix (connect, receive, send) - # type=stream - # peer=(addr="@@{HOME}/.cache/ibus/dbus-*"), - unix (connect, receive, send) - type=stream - peer=(addr="@/home/*/.cache/ibus/dbus-*"), - - # Include additions to the abstraction - include if exists <abstractions/ibus.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde b/straper/db/public/apparmor/apparmor.d/abstractions/kde deleted file mode 100644 index 9ba93ce..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/kde +++ /dev/null @@ -1,88 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -abi <abi/4.0>, - -include <abstractions/base> -include <abstractions/fonts> -include <abstractions/X> -include <abstractions/freedesktop.org> -include <abstractions/xdg-desktop> -include <abstractions/user-tmp> -include <abstractions/qt5> - -/etc/qt3/kstylerc r, -/etc/qt3/qt_plugins_3.3rc r, -/etc/qt3/qtrc r, -/etc/kderc r, -/etc/kde3/* r, -/etc/kde4rc r, -/etc/xdg/kdeglobals r, -/etc/xdg/Trolltech.conf r, -/usr/share/desktop-base/kf5-settings/baloofilerc r, -/usr/share/desktop-base/kf5-settings/kdeglobals r, -/usr/share/desktop-base/kf5-settings/kscreenlockerrc r, -/usr/share/knotifications5/*.notifyrc r, # KNotification::sendEvent() -/usr/share/kubuntu-default-settings/kf5-settings/* r, - -owner @{HOME}/.DCOPserver_* r, -owner @{HOME}/.ICEauthority r, -owner @{HOME}/.fonts.* lrw, -owner @{HOME}/.kde{,4}/share/config/kdeglobals rw, -owner @{HOME}/.kde{,4}/share/config/*.lock rwl, -owner @{HOME}/.qt/** rw, -owner @{HOME}/.cache/ksycoca5_??_* r, # KDE System Configuration Cache -owner @{HOME}/.config/Trolltech.conf rwk, -owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget -owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget -owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent() -owner @{HOME}/.config/kdedefaults/kdeglobals r, # QPlatformThemeFactory::create() -> KDEPlasmaPlatformTheme.so -owner @{HOME}/.config/kdedefaults/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so -owner @{HOME}/.config/kdeglobals r, # global settings, used by Breeze style, etc. -owner @{HOME}/.config/klanguageoverridesrc r, # per-application languages, for KDEPrivate::initializeLanguages() from libKF5XmlGui.so -owner @{HOME}/.config/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so -owner @{HOME}/.config/trashrc r, # Used by KFileWidget - -/usr/share/X11/XKeysymDB r, - -# kde3 -/usr/lib*/kde3/plugins/styles/ r, -/usr/lib*/kde3/plugins/styles/* mr, -/usr/lib*/kde3/lib*so* mr, -/usr/lib/@{multiarch}/kde3/plugins/styles/ r, -/usr/lib/@{multiarch}/kde3/plugins/styles/* mr, -/usr/lib/@{multiarch}/kde3/lib*so* mr, -/usr/lib*/qt3/lib*/lib*so* mr, -/usr/lib*/qt3/plugins/** mr, -/usr/lib/@{multiarch}/qt3/lib*/lib*so* mr, -/usr/lib/@{multiarch}/qt3/plugins/** mr, -/usr/lib*/libqt-mt*so* mr, -/usr/lib*/libqui*so* mr, -/usr/lib/@{multiarch}/libqt-mt*so* mr, -/usr/lib/@{multiarch}/libqui*so* mr, -/usr/share/qt3/lib*/libqt-mt*so* mr, -/usr/share/qt3/lib*/libqui*so* mr, - -# kde4 -/usr/lib*/kde4/plugins/*/*.so mr, -/usr/lib*/kde4/plugins/*/ r, -/usr/lib*/kde4/lib*so* mr, -/usr/lib/@{multiarch}/kde4/plugins/*/*.so mr, -/usr/lib/@{multiarch}/kde4/plugins/*/ r, -/usr/lib/@{multiarch}/kde4/lib*so* mr, -/usr/lib*/qt4/lib*/lib*so* mr, -/usr/lib*/qt4/plugins/** mr, -/usr/lib/@{multiarch}/qt4/lib*/lib*so* mr, -/usr/lib/@{multiarch}/qt4/plugins/** mr, -/usr/share/qt4/** r, - - # Include additions to the abstraction - include if exists <abstractions/kde.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-globals-write b/straper/db/public/apparmor/apparmor.d/abstractions/kde-globals-write deleted file mode 100644 index b3142d8..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/kde-globals-write +++ /dev/null @@ -1,15 +0,0 @@ -# vim:syntax=apparmor -# Rules for changing KDE settings (for KFileDialog and other). - - abi <abi/4.0>, - - # User files - - owner @{HOME}/.config/#[0-9]* rw, - owner @{HOME}/.config/kdeglobals rw, - owner @{HOME}/.config/kdeglobals.?????? rwl -> @{HOME}/.config/#[0-9]*, - owner @{HOME}/.config/kdeglobals.lock rwk, - - - # Include additions to the abstraction - include if exists <abstractions/kde-globals-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-icon-cache-write b/straper/db/public/apparmor/apparmor.d/abstractions/kde-icon-cache-write deleted file mode 100644 index 9f01985..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/kde-icon-cache-write +++ /dev/null @@ -1,12 +0,0 @@ -# vim:syntax=apparmor -# Rules for writing KDE icon cache - - abi <abi/4.0>, - - # User files - - owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader - - - # Include additions to the abstraction - include if exists <abstractions/kde-icon-cache-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-language-write b/straper/db/public/apparmor/apparmor.d/abstractions/kde-language-write deleted file mode 100644 index ad124b7..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/kde-language-write +++ /dev/null @@ -1,18 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# Rules for changing per-application language settings on KDE. Some KDE -# applications have "Help -> Switch Application Language..." option, that needs -# write access to language settings file. - - # User files - - owner @{HOME}/.config/#[0-9]* rw, - owner @{HOME}/.config/klanguageoverridesrc rw, - owner @{HOME}/.config/klanguageoverridesrc.?????? rwl -> @{HOME}/.config/#[0-9]*, - owner @{HOME}/.config/klanguageoverridesrc.lock rwk, - - - # Include additions to the abstraction - include if exists <abstractions/kde-language-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-open5 b/straper/db/public/apparmor/apparmor.d/abstractions/kde-open5 deleted file mode 100644 index 546a8f2..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/kde-open5 +++ /dev/null @@ -1,105 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# This abstraction is designed to be used in a child profile to limit what -# confined application can invoke via kde-open5 helper. -# -# NOTE: most likely you want to use xdg-open abstraction instead for better -# portability across desktop environments, unless you are sure that confined -# application only uses /usr/bin/kde-open5 directly. -# -# Usage example: -# -# ``` -# profile foo /usr/bin/foo { -# ... -# /usr/bin/kde-open5 rPx -> foo//kde-open5, -# ... -# } # end of main profile -# -# # out-of-line child profile -# profile foo//kde-open5 { -# include <abstractions/kde-open5> -# -# # needed for ubuntu-* abstractions -# include <abstractions/ubuntu-helpers> -# -# # Only allow to handle http[s]: and mailto: links -# include <abstractions/ubuntu-browsers> -# include <abstractions/ubuntu-email> -# -# # Add if accessibility access is considered as required -# # (for message box in case exo-open fails) -# include <abstractions/dbus-accessibility> -# -# # Add if audio support for message box is -# # considered as required. -# include if exists <abstractions/gstreamer> -# -# # < add additional allowed applications here > -# } -# ``` - - include <abstractions/audio> # for alert messages - include <abstractions/base> - include <abstractions/dbus-accessibility-strict> - include <abstractions/dbus-network-manager-strict> - include <abstractions/dbus-session-strict> - include <abstractions/dbus-strict> - include <abstractions/kde-icon-cache-write> - include <abstractions/kde> - include <abstractions/nameservice> # for IceProcessMessages () from libICE.so (called by libQtCore.so) - include <abstractions/qt5> - include <abstractions/recent-documents-write> - include <abstractions/X> - - # Main executables - - /usr/bin/kde-open5 rix, - /usr/lib/@{multiarch}/libexec/kf5/kioslave{,5} ix, - - # DBus - - dbus - bus=session - interface=org.kde.KLauncher - member=start_service_by_desktop_path - peer=(name=org.kde.klauncher5), - - # Denied system files - - deny /usr/lib/vlc/plugins/* w, # VLC backed tries to create plugins.dat.16109 - - # libpcre2 on openSUSE tries to mmap() shared memory on directory. - # see: https://lists.ubuntu.com/archives/apparmor/2019-January/011925.html - # AppArmor does not allow to distinguish "real" file vs shared memory one, - # so we deny this path to protect from loading exploits from /tmp. - deny /tmp/#[0-9]*[0-9] m, - - # System files - - /dev/tty r, - /etc/xdg/accept-languages.codes r, - /etc/xdg/menus/{,*/} r, - /usr/share/*fonts*/conf.avail/*.conf r, # for openSUSE, when showing error message box - /usr/share/ghostscript/fonts/ r, # for openSUSE, when showing error message box - /usr/share/hwdata/pnp.ids r, # for openSUSE, when showing error message box, for QXcbConnection::initializeScreens() from libQt5XcbQpa.so - /usr/share/icu/[0-9]*.[0-9]*/*.dat r, # for openSUSE - /usr/share/kservices5/{,**} r, # for KProtocolManager::defaultUserAgent() from libKF5KIOCore.so - /usr/share/mime/ r, - /usr/share/mime/generic-icons r, - /usr/share/plasma/look-and-feel/*/contents/defaults r, # TODO: move to kde abstraction? - /usr/share/sounds/ r, - @{PROC}/sys/kernel/core_pattern r, - @{PROC}/sys/kernel/random/boot_id r, - - # User files - - owner /tmp/xauth-[0-9]*-_[0-9] r, # for libQt5XcbQpa.so - owner @{run}/user/[0-9]*/#[0-9]* rw, # for /run/user/1000/#13 - owner @{run}/user/[0-9]*/kioclient*slave-socket lrw -> @{run}/user/[0-9]/#[0-9]*, # for KIO::Slave::holdSlave(QString const&, QUrl const&) () from libKF5KIOCore.so (not 100% sure) - owner @{HOME}/.cache/kio_http/ rw, - - # Include additions to the abstraction - include if exists <abstractions/kde-open5.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kerberosclient b/straper/db/public/apparmor/apparmor.d/abstractions/kerberosclient deleted file mode 100644 index e5f3a93..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/kerberosclient +++ /dev/null @@ -1,44 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # files required by kerberos client programs - /usr/lib{,32,64}/krb5/plugins/libkrb5/ r, - /usr/lib{,32,64}/krb5/plugins/libkrb5/* mr, - /usr/lib/@{multiarch}/krb5/plugins/libkrb5/ r, - /usr/lib/@{multiarch}/krb5/plugins/libkrb5/* mr, - - /usr/lib{,32,64}/krb5/plugins/preauth/ r, - /usr/lib{,32,64}/krb5/plugins/preauth/* mr, - /usr/lib/@{multiarch}/krb5/plugins/preauth/ r, - /usr/lib/@{multiarch}/krb5/plugins/preauth/* mr, - - /usr/lib{,32,64}/krb5/plugins/authdata/ r, - /usr/lib{,32,64}/krb5/plugins/authdata/* mr, - /usr/lib/@{multiarch}/krb5/plugins/authdata/ r, - /usr/lib/@{multiarch}/krb5/plugins/authdata/* mr, - - /etc/krb5.keytab rk, - /etc/krb5.conf r, - /etc/krb5.conf.d/ r, - /etc/krb5.conf.d/* r, - - # config files found via strings on libs - /etc/krb.conf r, - /etc/krb.realms r, - /etc/srvtab r, - - # credential caches - /tmp/krb5cc* r, - - # Include additions to the abstraction - include if exists <abstractions/kerberosclient.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ldapclient b/straper/db/public/apparmor/apparmor.d/abstractions/ldapclient deleted file mode 100644 index ecc403f..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ldapclient +++ /dev/null @@ -1,29 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2011 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # files required by LDAP clients (e.g. nss_ldap/pam_ldap) - /etc/ldap.conf r, - /etc/ldap.secret r, - /etc/openldap/* r, - /etc/openldap/cacerts/* r, - - # SASL plugins and config - /etc/sasl2/* r, - /usr/lib{,32,64}/sasl2/* r, - - # local LDAP name service daemon - @{run}/nslcd/socket rw, - - include <abstractions/ssl_certs> - - # Include additions to the abstraction - include if exists <abstractions/ldapclient.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/libpam-systemd b/straper/db/public/apparmor/apparmor.d/abstractions/libpam-systemd deleted file mode 100644 index 5d69abe..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/libpam-systemd +++ /dev/null @@ -1,24 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2015-2016 Simon Deziel -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - -include <abstractions/dbus-strict> - - # libpam-systemd notifies systemd-logind about session logins/logouts - dbus send - bus=system - path=/org/freedesktop/login1 - interface=org.freedesktop.login1.Manager - member={CreateSession,ReleaseSession}, - - # Include additions to the abstraction - include if exists <abstractions/libpam-systemd.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/likewise b/straper/db/public/apparmor/apparmor.d/abstractions/likewise deleted file mode 100644 index 1985f36..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/likewise +++ /dev/null @@ -1,18 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /tmp/.lwidentity/pipe rw, - /var/lib/likewise-open/lwidentity_privileged/pipe rw, - - # Include additions to the abstraction - include if exists <abstractions/likewise.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mdns b/straper/db/public/apparmor/apparmor.d/abstractions/mdns deleted file mode 100644 index 5024b7a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/mdns +++ /dev/null @@ -1,19 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # mdnsd - /etc/mdns.allow r, - /etc/nss_mdns.conf r, - @{run}/mdnsd w, - - # Include additions to the abstraction - include if exists <abstractions/mdns.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mesa b/straper/db/public/apparmor/apparmor.d/abstractions/mesa deleted file mode 100644 index c401a8e..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/mesa +++ /dev/null @@ -1,37 +0,0 @@ -# vim:syntax=apparmor -# Rules for Mesa implementation of the OpenGL API - - abi <abi/4.0>, - - # System files - /dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2() - - # Needed to check if the kernel supports the i915 perf interface - # (src/intel/perf/gen_perf.c, load_oa_metrics()) - @{PROC}/sys/dev/i915/perf_stream_paranoid r, - - @{sys}/devices/pci[0-9]*/**/{revision,config} r, - - # User files - owner @{HOME}/.cache/ w, # if user clears all caches - owner @{HOME}/.cache/mesa_shader_cache/ rw, - owner @{HOME}/.cache/mesa_shader_cache/index rw, - owner @{HOME}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw, - owner @{HOME}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* rw, - owner @{HOME}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]*.tmp rwk, - - owner @{HOME}/.cache/mesa_shader_cache_db/ rw, - owner @{HOME}/.cache/mesa_shader_cache_db/index rwk, - owner @{HOME}/.cache/mesa_shader_cache_db/part*/ rw, - owner @{HOME}/.cache/mesa_shader_cache_db/part*/mesa_cache.db rwk, - owner @{HOME}/.cache/mesa_shader_cache_db/part*/mesa_cache.idx rwk, - - # Fallback location when @{HOME}/.cache is not available - owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/ rw, - owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/index rw, - owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw, - owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* rw, - owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]*.tmp rwk, - - # Include additions to the abstraction - include if exists <abstractions/mesa.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mir b/straper/db/public/apparmor/apparmor.d/abstractions/mir deleted file mode 100644 index 85ebde7..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/mir +++ /dev/null @@ -1,22 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2015 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # mir libraries sometimes do not have a lib prefix - # see LP: #1422521 - /usr/lib/@{multiarch}/mir/*.so* mr, - /usr/lib/@{multiarch}/mir/**/*.so* mr, - - # unprivileged mir socket for clients - - # Include additions to the abstraction - include if exists <abstractions/mir.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mozc b/straper/db/public/apparmor/apparmor.d/abstractions/mozc deleted file mode 100644 index 6ca1a84..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/mozc +++ /dev/null @@ -1,17 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2016 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - unix (connect, receive, send) type=stream peer=(addr="@tmp/.mozc.*"), - - # Include additions to the abstraction - include if exists <abstractions/mozc.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mysql b/straper/db/public/apparmor/apparmor.d/abstractions/mysql deleted file mode 100644 index 5643953..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/mysql +++ /dev/null @@ -1,20 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2013 Christian Boltz -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /var/lib/mysql{,d}/mysql{,d}.sock rw, - @{run}/mysql{,d}/mysql{,d}.sock rw, - /usr/share/{mysql,mysql-community-server,mariadb}/charsets/ r, - /usr/share/{mysql,mysql-community-server,mariadb}/charsets/*.xml r, - - # Include additions to the abstraction - include if exists <abstractions/mysql.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice b/straper/db/public/apparmor/apparmor.d/abstractions/nameservice deleted file mode 100644 index efba4ac..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice +++ /dev/null @@ -1,106 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# Copyright (C) 2011-2024 Christian Boltz -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - include <abstractions/nameservice-strict> - - # libtirpc (used for NIS/YP login) needs this - @{etc_ro}/netconfig r, - - # When using sssd, the passwd and group files are stored in an alternate path - # and the nss plugin also needs to talk to a pipe - /var/lib/sss/mc/group r, - /var/lib/sss/mc/initgroups r, - /var/lib/sss/mc/passwd r, - /var/lib/sss/pipes/nss rw, - - # On systems where /etc/resolv.conf is managed programmatically, it is - # a symlink to @{run}/(whatever program is managing it)/resolv.conf. - @{run}/{NetworkManager,connman,netconfig}/resolv.conf r, - @{etc_ro}/resolvconf/run/resolv.conf r, - /mnt/wsl/resolv.conf r, - - @{etc_ro}/samba/lmhosts r, - # db backend - /var/lib/misc/*.db r, - # The Name Service Cache Daemon can cache lookups, sometimes leading - # to vast speed increases when working with network-based lookups. - @{run}/.nscd_socket rw, - @{run}/nscd/socket rw, - /{var/db,var/cache,var/lib,var/run,run}/nscd/{passwd,group,services,hosts} r, - # nscd renames and unlinks files in it's operation that clients will - # have open - @{run}/nscd/db* mix, - - # make libnss-libvirt name resolution work. - /var/lib/libvirt/dnsmasq/* r, - - # make libnss-libvirt name resolution work. - /var/lib/libvirt/dnsmasq/ r, - /var/lib/libvirt/dnsmasq/*.status r, - - # The nss libraries are sometimes used in addition to PAM; make sure - # they are available - /{usr/,}lib{,32,64}/libnss_*.so* mr, - /{usr/,}lib/@{multiarch}/libnss_*.so* mr, - - # avahi-daemon is used for mdns4 resolution - @{run}/avahi-daemon/socket rw, - - # libnl-3-200 via libnss-gw-name - @{PROC}/@{pid}/net/psched r, - @{etc_ro}/libnl-*/classid r, - - # nis - include <abstractions/nis> - - # ldap - include <abstractions/ldapclient> - - # winbind - include <abstractions/winbind> - - # likewise - include <abstractions/likewise> - - # mdnsd - include <abstractions/mdns> - - # kerberos - include <abstractions/kerberosclient> - - # Also allow lookups for systemd-exec's DynamicUsers via D-Bus - # https://www.freedesktop.org/software/systemd/man/systemd.exec.html - dbus send - bus=system - path="/org/freedesktop/systemd1" - interface="org.freedesktop.systemd1.Manager" - member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}" - peer=(name="org.freedesktop.systemd1"), - - # TCP/UDP network access - network inet stream, - network inet6 stream, - network inet dgram, - network inet6 dgram, - - # TODO: adjust when support finer-grained netlink rules - # Netlink raw needed for nscd - network netlink raw, - - # interface details - @{PROC}/@{pid}/net/ipv6_route r, - @{PROC}/@{pid}/net/route r, - - # Include additions to the abstraction - include if exists <abstractions/nameservice.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice-strict b/straper/db/public/apparmor/apparmor.d/abstractions/nameservice-strict deleted file mode 100644 index 5f49a63..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice-strict +++ /dev/null @@ -1,40 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2022 Mikhail Morfikov -# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io> -# SPDX-License-Identifier: GPL-2.0-only - -# Many programs wish to perform nameservice-like operations, such as looking up -# users by name or id, groups by name or id, hosts by name or IP, etc. - - abi <abi/4.0>, - - include <abstractions/nss-systemd> - - @{etc_ro}/default/nss r, - @{etc_ro}/gai.conf r, - @{etc_ro}/group r, - @{etc_ro}/host.conf r, - @{etc_ro}/hosts r, - @{etc_ro}/nsswitch.conf r, - @{etc_ro}/passwd r, - @{etc_ro}/protocols r, - @{etc_ro}/resolv.conf r, - @{etc_ro}/services r, - - # On systems with authselect installed, /etc/nsswitch.conf is a symlink to /etc/authselect/nsswitch.conf - @{etc_ro}/authselect/nsswitch.conf r, - - # Alternative location for group & passwd files - /var/lib/extrausers/group r, - /var/lib/extrausers/passwd r, - /var/lib/nscd/group r, - /var/lib/nscd/passwd r, - - @{run}/nscd/db* r, - @{run}/resolvconf/resolv.conf r, - @{run}/systemd/resolve/resolv.conf r, - @{run}/systemd/resolve/stub-resolv.conf r, - - include if exists <abstractions/nameservice-strict.d> - -# vim:syntax=apparmor diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nis b/straper/db/public/apparmor/apparmor.d/abstractions/nis deleted file mode 100644 index 70c426b..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/nis +++ /dev/null @@ -1,20 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # NIS rules - /var/yp/binding/* r, - # portmapper may ask root processes to do nis/ldap at low ports - capability net_bind_service, - - - # Include additions to the abstraction - include if exists <abstractions/nis.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nss-systemd b/straper/db/public/apparmor/apparmor.d/abstractions/nss-systemd deleted file mode 100644 index 0d2683c..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/nss-systemd +++ /dev/null @@ -1,31 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - -# libnss-systemd - # - # https://systemd.io/USER_GROUP_API/ - # https://systemd.io/USER_RECORD/ - # https://www.freedesktop.org/software/systemd/man/nss-systemd.html - # - # Allow User/Group lookups via common VarLink socket APIs. Applications need - # to either consult all of them or the io.systemd.Multiplexer frontend. - @{run}/systemd/userdb/ r, - @{run}/systemd/userdb/io.systemd.Multiplexer rw, - @{run}/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users - @{run}/systemd/userdb/io.systemd.Home rw, # systemd-home dirs - @{run}/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS - @{run}/systemd/userdb/io.systemd.Machine rw, # systemd-machined - - @{PROC}/sys/kernel/random/boot_id r, - - include if exists <abstractions/nss-systemd.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nvidia b/straper/db/public/apparmor/apparmor.d/abstractions/nvidia deleted file mode 100644 index fb1ffaf..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/nvidia +++ /dev/null @@ -1,40 +0,0 @@ -# vim:syntax=apparmor -# nvidia access requirements - - abi <abi/4.0>, - - # configuration queries - capability ipc_lock, - - /etc/nvidia/nvidia-application-profiles* r, - /usr/share/nvidia/nvidia-application-profiles* r, - - # libvdpau config file for nvidia workarounds - /etc/vdpau_wrapper.cfg r, - - # device files - /dev/nvidiactl rw, - /dev/nvidia-modeset rw, - /dev/nvidia[0-9]* rw, - - @{PROC}/interrupts r, - @{PROC}/sys/vm/max_map_count r, - @{PROC}/driver/nvidia/params r, - @{PROC}/modules r, - - @{sys}/devices/system/memory/block_size_bytes r, - - owner @{HOME}/.cache/nvidia/ w, - owner @{HOME}/.cache/nvidia/GLCache/ rw, - owner @{HOME}/.cache/nvidia/GLCache/** rwk, - owner @{HOME}/.nv/ w, - owner @{HOME}/.nv/GLCache/ rw, - owner @{HOME}/.nv/GLCache/** rwk, - owner @{HOME}/.nv/nvidia-application-profiles* r, - owner @{PROC}/@{pid}/comm r, # somehwere in libnvidia-glcore.so - - unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"), - unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"), - - # Include additions to the abstraction - include if exists <abstractions/nvidia.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl b/straper/db/public/apparmor/apparmor.d/abstractions/opencl deleted file mode 100644 index 6dc3c5a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/opencl +++ /dev/null @@ -1,15 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# OpenCL access requirements - - # TODO: use conditionals to select allowed implementations - include <abstractions/opencl-intel> - include <abstractions/opencl-mesa> - include <abstractions/opencl-nvidia> - include <abstractions/opencl-pocl> - - - # Include additions to the abstraction - include if exists <abstractions/opencl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-common b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-common deleted file mode 100644 index 52b40d3..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-common +++ /dev/null @@ -1,16 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# implementation-independent OpenCL access requirements - - # System files - - /etc/OpenCL/** r, - @{sys}/bus/pci/devices/ r, # libpocl.so -> libhwlock.so, libnvidia-opencl.so, beignet/libcl.so -> libdrm_intel.so - @{sys}/devices/system/node/ r, # for clGetPlatformIDs() from libOpenCL.so - @{sys}/devices/system/node/node[0-9]*/meminfo r, # for clGetPlatformIDs() from libOpenCL.so - - - # Include additions to the abstraction - include if exists <abstractions/opencl-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-intel b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-intel deleted file mode 100644 index b584af2..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-intel +++ /dev/null @@ -1,23 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# OpenCL access requirements for Intel implementation - - include <abstractions/opencl-common> - - # for libcl.so (libOpenCL.so -> beignet/libcl.so calls XOpenDisplay()) - include <abstractions/X> - - # for libOpenCL.so -> beignet/libcl.so -> libpciaccess.so - include <abstractions/dri-enumerate> - - # System files - - /dev/dri/card[0-9]* rw, # beignet/libcl.so - @{sys}/devices/pci[0-9]*/**/{class,config,resource,revision} r, # libcl.so -> libdrm_intel.so -> libpciaccess.so (move to dri-enumerate ?) - /usr/lib/@{multiarch}/beignet/** r, - - - # Include additions to the abstraction - include if exists <abstractions/opencl-intel.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-mesa b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-mesa deleted file mode 100644 index 3579277..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-mesa +++ /dev/null @@ -1,26 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# OpenCL access requirements for Mesa implementation - - include <abstractions/opencl-common> - - # Additional libraries - - /usr/lib/@{multiarch}/gallium-pipe/*.so mr, # libMesaOpenCL.so - /usr/lib{,64}/gallium-pipe/*.so mr, # libMesaOpenCL.so on openSUSE - - # System files - - /dev/dri/ r, # libMesaOpenCL.so -> libdrm.so - /dev/dri/render* rw, # libMesaOpenCL.so - /etc/drirc r, # libMesaOpenCL.so - - # User files - - owner @{HOME}/.cache/mesa_shader_cache/{,**} rw, # libMesaOpenCL.so -> pipe_nouveau.so - - - # Include additions to the abstraction - include if exists <abstractions/opencl-mesa.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-nvidia b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-nvidia deleted file mode 100644 index 5ad69b3..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-nvidia +++ /dev/null @@ -1,36 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# OpenCL access requirements for NVIDIA implementation - - include <abstractions/nvidia> - include <abstractions/opencl-common> - - # Executables - - # https://github.com/NVIDIA/nvidia-modprobe - # This setuid executable is used to create various device files and load the - # the nvidia kernel module. - /usr/bin/nvidia-modprobe Px -> nvidia_modprobe, - - # System files - - # libnvidia-opencl.so rules: - /dev/nvidia-uvm rw, - /dev/nvidia-uvm-tools rw, - @{sys}/devices/pci[0-9]*/**/config r, - @{sys}/devices/system/memory/block_size_bytes r, - /usr/share/nvidia/** r, - @{PROC}/devices r, - @{PROC}/sys/vm/mmap_min_addr r, - - # User files - - owner @{HOME}/.nv/ComputeCache/ w, - owner @{HOME}/.nv/ComputeCache/** rw, - owner @{HOME}/.nv/ComputeCache/index rwk, - - - # Include additions to the abstraction - include if exists <abstractions/opencl-nvidia.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-pocl b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-pocl deleted file mode 100644 index c69e7e6..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-pocl +++ /dev/null @@ -1,81 +0,0 @@ -# vim:syntax=apparmor -# OpenCL access requirements for POCL implementation - - abi <abi/4.0>, - - include <abstractions/opencl-common> - - # Executables - - /usr/bin/{,@{multiarch}-}ld.bfd Cx -> opencl_pocl_ld, - /usr/lib/llvm-[0-9]*.[0-9]*/bin/clang Cx -> opencl_pocl_clang, - - # System files - - / r, # libpocl.so -> libhwloc.so - @{sys}/bus/pci/slots/ r, # libpocl.so -> hwloc_topology_load() from libhwloc.so - @{sys}/bus/{cpu,node}/devices/ r, # libpocl.so -> libhwlock.so - @{sys}/class/net/ r, # libpocl.so -> hwloc_pci_traverse_lookuposdevices_cb() from libhwloc.so - @{sys}/devices/pci[0-9]*/**/ r, # for libpocl -> hwloc_linux_lookup_block_class() from libhwloc.so - @{sys}/devices/pci[0-9]*/**/block/*/dev r, # libpocl.so -> hwloc_linux_lookup_host_block_class() from libhwloc.so - @{sys}/devices/pci[0-9]*/**/{class,local_cpus} r, # libpocl.so -> libhwlock.so - @{sys}/devices/pci[0-9]*/*/net/*/address r, # libpocl.so -> hwloc_pci_traverse_lookuposdevices_cb() from libhwloc.so - @{sys}/devices/system/cpu/ r, # libpocl.so -> libnuma.so - @{sys}/devices/system/cpu/cpu[0-9]*/cache/index[0-9]*/* r, # libpocl.so -> libhwloc.so - @{sys}/devices/system/cpu/cpu[0-9]*/online r, # libpocl.so -> libhwlock.so - @{sys}/devices/system/cpu/cpu[0-9]*/topology/* r, # *_siblings, physical_package_id and lot's of others, for libpocl.so -> libhwloc.so - @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/* r, # for clGetPlatformIDs() from libpocl.so - @{sys}/devices/system/cpu/possible r, # libpocl.so -> libhwloc.so - @{sys}/devices/virtual/dmi/id/{,*} r, # libpocl.so -> libhwloc.so - @{sys}/fs/cgroup/cpuset/cpuset.{cpus,mems} r, # libpocl.so -> libhwloc.so - @{sys}/kernel/mm/hugepages{/,/**} r, # libpocl.so -> libhwloc.so - /usr/share/pocl/** r, - @{run}/udev/data/*:* r, # libpocl.so -> hwloc_linux_block_class_fillinfos() from libhwloc.so - - # User files - - owner @{HOME}/.cache/pocl/ w, - owner @{HOME}/.cache/pocl/kcache/ w, - owner @{HOME}/.cache/pocl/kcache/** rw, - owner @{HOME}/.cache/pocl/kcache/**.so mrw, # dangerous! - owner @{PROC}/@{pid}/{cgroup,cpuset,status} r, # libpocl.so -> libhwloc.so, status for libpocl.so -> libnuma.so - - # Child profiles - - profile opencl_pocl_ld { - include <abstractions/base> - - # Main executables - - /usr/bin/{,@{multiarch}-}ld.bfd mr, - - # User files - - owner @{HOME}/.cache/pocl/kcache/tempfile*.so rw, - owner @{HOME}/.cache/pocl/kcache/**.so.o r, - } - - profile opencl_pocl_clang { - include <abstractions/base> - - # Main executables - - /usr/lib/llvm-[0-9]*.[0-9]*/bin/clang mr, - - # Additional executables - - /usr/bin/{,@{multiarch}-}ld.bfd ix, # TODO: transfer to opencl_ld child profile? - - # System files - - /etc/debian-version r, - /etc/lsb-release r, - - # User files - - owner @{HOME}/.cache/pocl/kcache/*/*/*/*/*.so{,.o} rw, - } - - - # Include additions to the abstraction - include if exists <abstractions/opencl-pocl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/openssl b/straper/db/public/apparmor/apparmor.d/abstractions/openssl deleted file mode 100644 index b4483b0..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/openssl +++ /dev/null @@ -1,20 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2011 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /etc/ssl/openssl.cnf r, - /etc/ssl/openssl-*.cnf r, - /etc/ssl/{engdef*,engines*}.d/ r, - /etc/ssl/{engdef*,engines*}.d/*.cnf r, - /usr/share/ssl/openssl.cnf r, - - # Include additions to the abstraction - include if exists <abstractions/openssl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/orbit2 b/straper/db/public/apparmor/apparmor.d/abstractions/orbit2 deleted file mode 100644 index 20e6b6f..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/orbit2 +++ /dev/null @@ -1,10 +0,0 @@ -# vim:syntax=apparmor -# orbit2 permissions - - abi <abi/4.0>, - - # system library - /usr/lib/orbit-2.0/*.so mr, - - # Include additions to the abstraction - include if exists <abstractions/orbit2.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/p11-kit b/straper/db/public/apparmor/apparmor.d/abstractions/p11-kit deleted file mode 100644 index 57b8f88..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/p11-kit +++ /dev/null @@ -1,32 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /etc/pkcs11/ r, - /etc/pkcs11/pkcs11.conf r, - /etc/pkcs11/modules/ r, - /etc/pkcs11/modules/* r, - - /usr/lib{,32,64}/pkcs11/*.so mr, - /usr/lib/@{multiarch}/pkcs11/*.so mr, - - /usr/share/p11-kit/modules/ r, - /usr/share/p11-kit/modules/* r, - - # gnome-keyring pkcs11 module - owner @{run}/user/[0-9]*/keyring*/pkcs11 rw, - - # p11-kit also supports reading user configuration from ~/.pkcs11 depending - # on how /etc/pkcs11/pkcs11.conf is configured. This should generally not be - # included in this abstraction. - - # Include additions to the abstraction - include if exists <abstractions/p11-kit.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/perl b/straper/db/public/apparmor/apparmor.d/abstractions/perl deleted file mode 100644 index d69fc54..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/perl +++ /dev/null @@ -1,28 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # a few files typically required for perl scripts - /usr/bin/perl rmix, - /usr/bin/perl[0-9].[0-9].[0-9] rmix, - - /usr/lib{,32,64}/perl5/** r, - /usr/lib{,32,64}/perl{,5}/**.so* mr, - /usr/lib/@{multiarch}/perl{,5,-base}/** r, - /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr, - - /usr/share/perl/** r, - /usr/share/perl5/** r, - /etc/perl/** r, - - # Include additions to the abstraction - include if exists <abstractions/perl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/php b/straper/db/public/apparmor/apparmor.d/abstractions/php deleted file mode 100644 index ca7ca37..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/php +++ /dev/null @@ -1,43 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2009-2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # shared snippets for config files - /etc/php{,5,7,8,-legacy}/** r, - - # Xlibs - /usr/X11R6/lib{,32,64}/lib*.so* mr, - # php extensions - /usr/lib{64,}/php{,5,7,8,-legacy}/*/*.so mr, - - # ICU (unicode support) data tables - /usr/share/icu/*/*.dat r, - - # php session mmap socket - /var/lib/php{,5,7,8,-legacy}/session_mm_* rwlk, - # file based session handler - /var/lib/php{,5,7,8,-legacy}/sess_* rwlk, - /var/lib/php{,5,7,8,-legacy}/sessions/* rwlk, - - # php libraries - /usr/share/php{,5,7,8,-legacy}/ r, - /usr/share/php{,5,7,8,-legacy}/** mr, - - # MySQL extension - /usr/share/mysql/** r, - - # Zend opcache - /tmp/.ZendSem.* rwlk, - - # Include additions to the abstraction - include if exists <abstractions/php.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/php-worker b/straper/db/public/apparmor/apparmor.d/abstractions/php-worker deleted file mode 100644 index 40f63ad..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/php-worker +++ /dev/null @@ -1,22 +0,0 @@ -# vim:syntax=apparmor - -# This file contains basic permissions for php-fpm workers - - abi <abi/4.0>, - - # load common libraries and their support files - include <abstractions/base> - # common php files and support files that php needs - include <abstractions/php> - - signal (receive) peer=php-fpm, - - # This is some php opcaching file - /tmp/.ZendSem.* rwk, - - # I think this is adaptive memory management - /sys/devices/system/node/* r, - /sys/devices/system/node/*/meminfo r, - /sys/devices/system/node/ r, - - include if exists <abstractions/php-worker.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/php5 b/straper/db/public/apparmor/apparmor.d/abstractions/php5 deleted file mode 100644 index 222968c..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/php5 +++ /dev/null @@ -1,8 +0,0 @@ -#backwards compatibility include, actual abstraction moved from php5 to php - - abi <abi/4.0>, - - include <abstractions/php> - - # Include additions to the abstraction - include if exists <abstractions/php5.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/postfix-common b/straper/db/public/apparmor/apparmor.d/abstractions/postfix-common deleted file mode 100644 index 2691de8..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/postfix-common +++ /dev/null @@ -1,45 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2005 Novell/SUSE -# Copyright (C) 2015-2018 Canonical, Ltd. -# Copyright (C) 2020-2021 Christian Boltz -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ -# used with postfix/* - - abi <abi/4.0>, - - - capability setuid, - capability setgid, - capability sys_chroot, - - # postfix's master can send us signals - signal receive peer=postfix-master, - - unix (send, receive) peer=(label=postfix-master), - - /etc/mailname r, - /etc/postfix/*.cf r, - /etc/postfix/*.db rk, - /etc/postfix/*.lmdb rk, - @{PROC}/net/if_inet6 r, - /usr/lib/postfix/*.so mr, - /usr/lib{,32,64}/sasl2/* mr, - /usr/lib{,32,64}/sasl2/ r, - /usr/lib/@{multiarch}/sasl2/* mr, - /usr/lib/@{multiarch}/sasl2/ r, - /usr/share/icu/[0-9]*.[0-9]*/*.dat r, - - /var/spool/postfix/etc/* r, - /var/spool/postfix/lib/lib*.so* mr, - /var/spool/postfix/lib/@{multiarch}/lib*.so* mr, - - /etc/postfix/dynamicmaps.cf.d/ r, - - # Include additions to the abstraction - include if exists <abstractions/postfix-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/private-files b/straper/db/public/apparmor/apparmor.d/abstractions/private-files deleted file mode 100644 index 00ad5f1..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/private-files +++ /dev/null @@ -1,52 +0,0 @@ -# vim:syntax=apparmor -# privacy-violations contains rules for common files that you want to -# explicitly deny access - - abi <abi/4.0>, - - # privacy violations (don't audit files under $HOME otherwise get a - # lot of false positives when reading contents of directories) - deny @{HOME}/.*history mrwkl, - deny @{HOME}/.fetchmail* mrwkl, - deny @{HOME}/.mutt** mrwkl, - deny @{HOME}/.viminfo* mrwkl, - deny @{HOME}/.*~ mrwkl, - deny @{HOME}/.*.swp mrwkl, - deny @{HOME}/.*~1~ mrwkl, - deny @{HOME}/.*.bak mrwkl, - - # special attention to (potentially) executable files - audit deny @{HOME}/bin/{,**} wl, - audit deny @{HOME}/.config/ w, - audit deny @{HOME}/.config/autostart/{,**} wl, - audit deny @{HOME}/.config/upstart/{,**} wl, - audit deny @{HOME}/.init/{,**} wl, - audit deny @{HOME}/.kde{,4}/ w, - audit deny @{HOME}/.kde{,4}/Autostart/{,**} wl, - audit deny @{HOME}/.kde{,4}/env/{,**} wl, - audit deny @{HOME}/.local/{,share/} w, - audit deny @{HOME}/.local/share/thumbnailers/{,**} wl, - audit deny @{HOME}/.pki/ w, - audit deny @{HOME}/.pki/nssdb/{,*.so{,.[0-9]*}} wl, - - # don't allow reading/updating of run control files - deny @{HOME}/.*rc mrk, - audit deny @{HOME}/.*rc wl, - - # bash - deny @{HOME}/.bash* mrk, - audit deny @{HOME}/.bash* wl, - deny @{HOME}/.inputrc mrk, - audit deny @{HOME}/.inputrc wl, - - # sh/dash/csh/tcsh/pdksh/zsh - deny @{HOME}/.{,z}profile* mrk, - audit deny @{HOME}/.{,z}profile* wl, - deny @{HOME}/.{,z}log{in,out} mrk, - audit deny @{HOME}/.{,z}log{in,out} wl, - - deny @{HOME}/.zshenv mrk, - audit deny @{HOME}/.zshenv wl, - - # Include additions to the abstraction - include if exists <abstractions/private-files.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict b/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict deleted file mode 100644 index 28d3ab1..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict +++ /dev/null @@ -1,30 +0,0 @@ -# vim:syntax=apparmor -# privacy-violations-strict contains additional rules for sensitive -# files that you want to explicitly deny access - - abi <abi/4.0>, - - include <abstractions/private-files> - - # potentially extremely sensitive files - audit deny @{HOME}/.aws/{,**} mrwkl, - audit deny @{HOME}/.gnupg/{,**} mrwkl, - audit deny @{HOME}/.ssh/{,**} mrwkl, - audit deny @{HOME}/.gnome2_private/{,**} mrwkl, - audit deny @{HOME}/.gnome2/ w, - audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl, - # don't allow access to any gnome-keyring modules - audit deny @{run}/user/[0-9]*/keyring** mrwkl, - audit deny @{HOME}/.mozilla/{,**} mrwkl, - audit deny @{HOME}/.config/ w, - audit deny @{HOME}/.config/chromium/{,**} mrwkl, - audit deny @{HOME}/.config/evolution/{,**} mrwkl, - audit deny @{HOME}/.evolution/{,**} mrwkl, - audit deny @{HOME}/.{,mozilla-}thunderbird/{,**} mrwkl, - audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w, - audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/{,**} mrwkl, - audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl, - audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl, - - # Include additions to the abstraction - include if exists <abstractions/private-files-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/python b/straper/db/public/apparmor/apparmor.d/abstractions/python deleted file mode 100644 index 9289df6..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/python +++ /dev/null @@ -1,54 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /{usr/,}bin/ r, - /{usr/,}bin/python{2.[4-7],3,3.[0-9],3.1[0-9]} r, - - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so,so.*[0-9]} mr, - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r, - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r, - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r, - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.dist-info/{METADATA,namespace_packages.txt} r, - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.VERSION r, - /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.egg-info/PKG-INFO r, - /usr/{local/,}lib{,32,64}/python3.{1,}[0-9]/lib-dynload/*.so mr, - - # Site-wide configuration - /etc/python{2.[4-7],3.[0-9],3.1[0-9]}/** r, - - # shared python paths - /usr/share/{pyshared,pycentral,python-support}/** r, - /{var,usr}/lib/{pyshared,pycentral,python-support}/** r, - /usr/lib/{pyshared,pycentral,python-support}/**.so mr, - /var/lib/{pyshared,pycentral,python-support}/**.pyc mr, - /usr/lib/python3/dist-packages/**.so mr, - - # wx paths - /usr/lib/wx/python/*.pth r, - - # python build configuration and headers - /usr/include/python{2.[4-7],3.[0-9],3.1[0-9]}*/pyconfig.h r, - - owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so} mr, - owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r, - owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r, - owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r, - - # Starting with Python 3.8, you can use the PYTHONPYCACHEPREFIX environment - # variable to define a cache directory for Python. - owner @{HOME}/.cache/Python/ rw, - owner @{HOME}/.cache/Python/** rw, - - # Include additions to the abstraction - include if exists <abstractions/python.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt5 b/straper/db/public/apparmor/apparmor.d/abstractions/qt5 deleted file mode 100644 index d9d53ba..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/qt5 +++ /dev/null @@ -1,27 +0,0 @@ -# vim:syntax=apparmor -# Common rules for Qt5-based applications - - abi <abi/4.0>, - - # Additional libraries - - /usr/lib{,64,/@{multiarch}}/qt5/plugins/**.so mr, - /usr/lib{,64,/@{multiarch}}/qt5/qml/**.so mr, - /usr/lib{,64,/@{multiarch}}/qt5/qml/**.{qmlc,jsc} mr, # Precompiled QML/JavaScript modules - - # System files - - /etc/xdg/QtProject/qtlogging.ini r, - /usr/share/qt5/translations/*.qm r, - /usr/lib{,64,/@{multiarch}}/qt5/plugins/** r, - /usr/lib{,64,/@{multiarch}}/qt5/qml/** r, - - # User files - - owner @{HOME}/.config/QtProject/qtlogging.ini r, - owner @{HOME}/.config/QtProject.conf r, # common settings for QFileDialog, etc (application might need write access) - owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r, # for "platforminputcontexts" plugins - - - # Include additions to the abstraction - include if exists <abstractions/qt5.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt5-compose-cache-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt5-compose-cache-write deleted file mode 100644 index a34178b..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/qt5-compose-cache-write +++ /dev/null @@ -1,13 +0,0 @@ -# vim:syntax=apparmor -# Allow writing cache for Qt5 "platforminputcontexts" plugins - - abi <abi/4.0>, - - # User files - - owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9], - owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory) - - - # Include additions to the abstraction - include if exists <abstractions/qt5-compose-cache-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt5-settings-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt5-settings-write deleted file mode 100644 index fe592dc..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/qt5-settings-write +++ /dev/null @@ -1,16 +0,0 @@ -# vim:syntax=apparmor -# Allow writing shared settings for Qt-based applications - - abi <abi/4.0>, - - # User files - - owner @{HOME}/.config/#[0-9]*[0-9] rw, - owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9], - # for temporary files like QtProject.conf.Aqrgeb - owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], - owner @{HOME}/.config/QtProject.conf.lock rwk, - - - # Include additions to the abstraction - include if exists <abstractions/qt5-settings-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt6 b/straper/db/public/apparmor/apparmor.d/abstractions/qt6 deleted file mode 100644 index 531f125..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/qt6 +++ /dev/null @@ -1,27 +0,0 @@ -# vim:syntax=apparmor -# Common rules for Qt6-based applications - - abi <abi/4.0>, - - # Additional libraries - - /usr/lib{,64,/@{multiarch}}/qt6/plugins/**.so mr, - /usr/lib{,64,/@{multiarch}}/qt6/qml/**.so mr, - /usr/lib{,64,/@{multiarch}}/qt6/qml/**.{qmlc,jsc} mr, # Precompiled QML/JavaScript modules - - # System files - - /etc/xdg/QtProject/qtlogging.ini r, - /usr/share/qt6/translations/*.qm r, - /usr/lib{,64,/@{multiarch}}/qt6/plugins/** r, - /usr/lib{,64,/@{multiarch}}/qt6/qml/** r, - - # User files - - owner @{HOME}/.config/QtProject/qtlogging.ini r, - owner @{HOME}/.config/QtProject.conf r, # common settings for QFileDialog, etc (application might need write access) - owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r, # for "platforminputcontexts" plugins - - - # Include additions to the abstraction - include if exists <abstractions/qt6.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt6-compose-cache-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt6-compose-cache-write deleted file mode 100644 index 0da3a0f..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/qt6-compose-cache-write +++ /dev/null @@ -1,13 +0,0 @@ -# vim:syntax=apparmor -# Allow writing cache for Qt6 "platforminputcontexts" plugins - - abi <abi/4.0>, - - # User files - - owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9], - owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory) - - - # Include additions to the abstraction - include if exists <abstractions/qt6-compose-cache-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt6-settings-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt6-settings-write deleted file mode 100644 index acdbd72..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/qt6-settings-write +++ /dev/null @@ -1,16 +0,0 @@ -# vim:syntax=apparmor -# Allow writing shared settings for Qt6-based applications - - abi <abi/4.0>, - - # User files - - owner @{HOME}/.config/#[0-9]*[0-9] rw, - owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9], - # for temporary files like QtProject.conf.Aqrgeb - owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], - owner @{HOME}/.config/QtProject.conf.lock rwk, - - - # Include additions to the abstraction - include if exists <abstractions/qt6-settings-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/recent-documents-write b/straper/db/public/apparmor/apparmor.d/abstractions/recent-documents-write deleted file mode 100644 index 93c90ca..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/recent-documents-write +++ /dev/null @@ -1,15 +0,0 @@ -# vim:syntax=apparmor -# Allow updating recent documents - - abi <abi/4.0>, - - # User files - - owner @{HOME}/.local/share/RecentDocuments/ rw, - owner @{HOME}/.local/share/RecentDocuments/#[0-9]* rw, - owner @{HOME}/.local/share/RecentDocuments/*.desktop rwl -> @{HOME}/.local/share/RecentDocuments/#[0-9]*, - owner @{HOME}/.local/share/RecentDocuments/*.lock rwk, - - - # Include additions to the abstraction - include if exists <abstractions/recent-documents-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ruby b/straper/db/public/apparmor/apparmor.d/abstractions/ruby deleted file mode 100644 index 2f35e67..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ruby +++ /dev/null @@ -1,26 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/ r, - /usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/**.rb r, - /usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/*-linux/**.so mr, - - /usr/{,local/}lib{,32,64}/ruby/{site,vendor}_ruby/1.[89]{.[0-9],}/ r, - /usr/{,local/}lib{,32,64}/ruby/{site,vendor}_ruby/1.[89]{.[0-9],}/**.rb r, - /usr/{,local/}lib{,32,64}/ruby/{site,vendor}_ruby/1.[89]{.[0-9],}/*-linux/**.so mr, - - /usr/lib{,32,64}/ruby/gems/1.[89]{.[0-9],}/ r, - /usr/lib{,32,64}/ruby/gems/1.[89]{.[0-9],}/** r, - - # Include additions to the abstraction - include if exists <abstractions/ruby.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/samba b/straper/db/public/apparmor/apparmor.d/abstractions/samba deleted file mode 100644 index 4863720..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/samba +++ /dev/null @@ -1,42 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009-2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /etc/samba/* r, - /etc/gnutls/config r, - /usr/lib*/ldb/*.so mr, - /usr/lib*/ldb2/*.so mr, - /usr/lib*/ldb2/modules/ldb/*.so mr, - /usr/lib*/samba/ldb/*.so mr, - /usr/share/samba/*.dat r, - /usr/share/samba/codepages/{lowcase,upcase,valid}.dat r, - /var/cache/samba/ w, - /var/cache/samba/lck/* rwk, - /var/lib/samba/** rwk, - /var/log/samba/cores/ rw, - /var/log/samba/cores/** rw, - /var/log/samba/* rw, - @{run}/{,lock/}samba/ w, - @{run}/{,lock/}samba/*.tdb rwk, - @{run}/{,lock/}samba/msg.{lock,sock}/ rwk, - @{run}/{,lock/}samba/msg.{lock,sock}/[0-9]* rwk, - /var/cache/samba/*.tdb rwk, - /var/cache/samba/msg.lock/ rwk, - /var/cache/samba/msg.lock/[0-9]* rwk, - - # required for clustering - /var/lib/ctdb/** rwk, - - deny capability net_admin, # noisy setsockopt() calls from systemd - - # Include additions to the abstraction - include if exists <abstractions/samba.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/samba-rpcd b/straper/db/public/apparmor/apparmor.d/abstractions/samba-rpcd deleted file mode 100644 index fca361a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/samba-rpcd +++ /dev/null @@ -1,30 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2022 SUSE LLC -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ -# vim:syntax=apparmor - -# This file contains basic permissions for samba rpcd_xyz services - - abi <abi/4.0>, - - include <abstractions/base> - include <abstractions/nameservice> - include <abstractions/samba> - - capability setgid, - capability setuid, - - signal receive set=term peer=smbd, - - @{PROC}/sys/kernel/core_pattern r, - owner @{PROC}/@{pid}/fd/ r, - - # Include additions to the abstraction - include if exists <abstractions/samba-rpcd.d> - diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/smbpass b/straper/db/public/apparmor/apparmor.d/abstractions/smbpass deleted file mode 100644 index 0a7f60d..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/smbpass +++ /dev/null @@ -1,18 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # libpam-smbpass/pam_smbpass.so permissions - /var/lib/samba/*.[lt]db rwk, - - # Include additions to the abstraction - include if exists <abstractions/smbpass.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers b/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers deleted file mode 100644 index b6ee4ee..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers +++ /dev/null @@ -1,39 +0,0 @@ -profile snap_browsers { - include if exists <abstractions/snap_browsers.d> - include <abstractions/base> - include <abstractions/dbus-session-strict> - - /etc/passwd r, - /etc/nsswitch.conf r, - /etc/fstab r, - - # noisy - deny owner /run/user/[0-9]*/gdm/Xauthority r, # not needed on Ubuntu - - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrix, # re-exec - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/info r, - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snapd r, - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-seccomp rPix, - /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-confine Pix, - /var/lib/snapd/system-key r, - /run/snapd.socket rw, - - @{PROC}/version r, - @{PROC}/cmdline r, - @{PROC}/sys/net/core/somaxconn r, - @{PROC}/sys/kernel/seccomp/actions_avail r, - @{PROC}/sys/kernel/random/uuid r, - owner @{PROC}/@{pid}/cgroup r, - owner @{PROC}/@{pid}/mountinfo r, - owner @{HOME}/.snap/auth.json r, # if exists, required - - dbus send bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="StartTransientUnit" peer=(name="org.freedesktop.systemd1"), - dbus receive bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="JobRemoved", - - /sys/kernel/security/apparmor/features/ r, - - # allow launching official browser snaps. - /snap/{brave,chromium,firefox,opera}/[0-9]*/meta/{snap.yaml,hooks/} r, - /var/lib/snapd/sequence/{brave,chromium,firefox,opera}.json r, - /var/lib/snapd/inhibit/{brave,chromium,firefox,opera}.lock rk, -} diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ssl_certs b/straper/db/public/apparmor/apparmor.d/abstractions/ssl_certs deleted file mode 100644 index 3db31fa..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ssl_certs +++ /dev/null @@ -1,46 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2005 Novell/SUSE -# Copyright (C) 2010-2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /etc/ca-certificates/{,**} r, - /etc/{,libre}ssl/ r, - /etc/{,libre}ssl/cert.pem r, - /etc/{,libre}ssl/certs/{,**} r, - /{etc,usr/share}/pki/bl[ao]cklist/{,*} r, - /{etc,usr/share}/pki/trust/{,*} r, - /{etc,usr/share}/pki/trust/{bl[oa]cklist,anchors}/{,**} r, - /usr/share/ca-certificates/{,**} r, - /usr/share/ssl/certs/ca-bundle.crt r, - /usr/local/share/ca-certificates/{,**} r, - /var/lib/ca-certificates/{,**} r, - - # acmetool - /var/lib/acme/certs/*/chain r, - /var/lib/acme/certs/*/cert r, - - # dehydrated - /{etc,var/lib}/dehydrated/certs/*/cert*.pem r, - /{etc,var/lib}/dehydrated/certs/*/chain*.pem r, - /{etc,var/lib}/dehydrated/certs/*/fullchain*.pem r, - /{etc,var/lib}/dehydrated/certs/*/ocsp*.der r, - - # certbot - /etc/letsencrypt/archive/*/cert*.pem r, - /etc/letsencrypt/archive/*/chain*.pem r, - /etc/letsencrypt/archive/*/fullchain*.pem r, - - /etc/certbot/archive/*/cert*.pem r, - /etc/certbot/archive/*/chain*.pem r, - /etc/certbot/archive/*/fullchain*.pem r, - - # Include additions to the abstraction - include if exists <abstractions/ssl_certs.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ssl_keys b/straper/db/public/apparmor/apparmor.d/abstractions/ssl_keys deleted file mode 100644 index 21e4727..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ssl_keys +++ /dev/null @@ -1,35 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # private ssl permissions - - # Just include the whole /etc/ssl directory if we should have access to - # private keys too - /etc/ssl/ r, - /etc/ssl/** r, - - # acmetool - /var/lib/acme/live/* r, - /var/lib/acme/certs/** r, - /var/lib/acme/keys/** r, - - # dehydrated - /{etc,var/lib}/dehydrated/certs/*/privkey*.pem r, - - # certbot / letsencrypt - /etc/letsencrypt/archive/*/privkey*.pem r, - - /etc/certbot/archive/*/privkey*.pem r, - - # Include additions to the abstraction - include if exists <abstractions/ssl_keys.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/svn-repositories b/straper/db/public/apparmor/apparmor.d/abstractions/svn-repositories deleted file mode 100644 index 8a1c7b6..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/svn-repositories +++ /dev/null @@ -1,57 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # This little snippet should abstract the read/write access to a repository. - # it is intended to be included in profiles for svnserve/apache2 and maybe - # some repository viewers like trac/viewvc - - # no hooks exec by default; please define whatever you need explicitly. - - /srv/svn/**/conf/* r, - /srv/svn/**/format r, - /srv/svn/**/db/fs-type r, - /srv/svn/**/db/format r, - - # FSFS - /srv/svn/**/db/ r, - /srv/svn/**/db/uuid r, - /srv/svn/**/db/write-lock rwl, - /srv/svn/**/db/current rwl, - /srv/svn/**/db/current*.tmp rwl, - /srv/svn/**/db/revs/ r, - /srv/svn/**/db/revs/* rw, - /srv/svn/**/db/revprops/ r, - /srv/svn/**/db/revprops/* rw, - /srv/svn/**/db/transactions/** rw, - - # BDB - /srv/svn/**/db/DB_CONFIG r, - /srv/svn/**/db/__db.[0-9]* rwl, - /srv/svn/**/db/log.[0-9]* rwl, - /srv/svn/**/db/nodes rwl, - /srv/svn/**/db/revisions rwl, - /srv/svn/**/db/transactions rwl, - /srv/svn/**/db/copies rwl, - /srv/svn/**/db/changes rwl, - /srv/svn/**/db/representations rwl, - /srv/svn/**/db/strings rwl, - /srv/svn/**/db/uuids rwl, - /srv/svn/**/db/locks rwl, - /srv/svn/**/db/lock-tokens rwl, - - # temp files - /tmp/apr* rwl, - /var/tmp/apr* rwl, - /tmp/report*.tmp rwl, - - # Include additions to the abstraction - include if exists <abstractions/svn-repositories.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/terminfo b/straper/db/public/apparmor/apparmor.d/abstractions/terminfo deleted file mode 100644 index c3391a0..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/terminfo +++ /dev/null @@ -1,10 +0,0 @@ - abi <abi/4.0>, - - # Default hardcoded locations searched by ncurses for terminfo - @{HOME}/.terminfo/** r, - /etc/terminfo/** r, - /{usr/,}lib/terminfo/** r, - /usr/share/terminfo/** r, - - # Local overrides for systems with TERMINFO env vars, etc. - include if exists <abstractions/terminfo.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/tor b/straper/db/public/apparmor/apparmor.d/abstractions/tor deleted file mode 100644 index 0b6c08e..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/tor +++ /dev/null @@ -1,33 +0,0 @@ -# vim:syntax=apparmor - - #include <abstractions/base> - #include <abstractions/nameservice> - #include <abstractions/openssl> - - network tcp, - network udp, - - capability chown, - capability dac_read_search, - capability fowner, - capability fsetid, - capability setgid, - capability setuid, - - /usr/bin/tor r, - /usr/sbin/tor r, - - # Needed by obfs4proxy - /proc/sys/net/core/somaxconn r, - - /proc/sys/kernel/random/uuid r, - /sys/devices/system/cpu/ r, - /sys/devices/system/cpu/** r, - - /etc/tor/* r, - /usr/share/tor/** r, - - /usr/bin/obfsproxy PUx, - /usr/bin/obfs4proxy Pix, - - /usr/bin/snowflake-client Pix, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/transmission-common b/straper/db/public/apparmor/apparmor.d/abstractions/transmission-common deleted file mode 100644 index 038e65e..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/transmission-common +++ /dev/null @@ -1,153 +0,0 @@ -# vim:syntax=apparmor -# LOGPROF-SUGGEST: no -# Author: Daniel Richard G. <skunk@iSKUNK.ORG> - - include <abstractions/base> - include <abstractions/freedesktop.org> - include <abstractions/nameservice> - include <abstractions/openssl> - - network inet dgram, - network inet6 dgram, - network netlink dgram, - network inet stream, - network inet6 stream, - - dbus (bind) - bus=session - name=com.transmissionbt.Transmission, - dbus (bind) - bus=session - name=com.transmissionbt.transmission_*, - - dbus (receive) - bus=session - path=/ca/desrt/dconf/Writer/user - interface=ca.desrt.dconf.Writer - member=Notify, - dbus (send) - bus=session - path=/ca/desrt/dconf/Writer/user - interface=ca.desrt.dconf.Writer - member=Change - peer=(name=ca.desrt.dconf), - - dbus (receive) - bus=accessibility - path=/org/a11y/atspi/accessible/root - interface=org.freedesktop.DBus.Properties - member=Set, - dbus (send) - bus=accessibility - path=/org/a11y/atspi/accessible/root - interface=org.a11y.atspi.Socket - member=Embed - peer=(name=org.a11y.atspi.Registry), - dbus (send) - bus=accessibility - path=/org/a11y/atspi/registry - interface=org.a11y.atspi.Registry - member=GetRegisteredEvents - peer=(name=org.a11y.atspi.Registry), - dbus (send) - bus=accessibility - path=/org/a11y/atspi/registry/deviceeventcontroller - interface=org.a11y.atspi.DeviceEventController - member={GetDeviceEventListeners,GetKeystrokeListeners} - peer=(name=org.a11y.atspi.Registry), - - dbus (send) - bus={accessibility,session} - path=/org/freedesktop/DBus - interface=org.freedesktop.DBus - member={AddMatch,GetNameOwner,Hello,ReleaseName,RemoveMatch,RequestName,StartServiceByName} - peer=(name=org.freedesktop.DBus), - dbus (send) - bus=session - interface=org.freedesktop.DBus.Introspectable - path=/StatusNotifierWatcher - member=Introspect - peer=(name=org.kde.StatusNotifierWatcher), - dbus (send) - bus=session - interface=org.freedesktop.DBus.Properties - path=/StatusNotifierWatcher - member=Get - peer=(name=org.kde.StatusNotifierWatcher), - dbus (send) - bus=session - interface=org.freedesktop.DBus.Properties - path=/org/a11y/bus - member=Get - peer=(name=org.a11y.Bus), - dbus (send) - bus=system - interface=org.freedesktop.DBus.Properties - path=/org/freedesktop/hostname1 - member=GetAll, - - dbus (send) - bus=session - interface=org.freedesktop.Notifications - path=/org/freedesktop/Notifications - member={GetCapabilities,Notify}, - - dbus (send) - bus=session - path=/org/gtk/Private/RemoteVolumeMonitor - interface=org.gtk.Private.RemoteVolumeMonitor - member={IsSupported,List}, - dbus (send) - bus=session - path=/org/gtk/vfs/Daemon - interface=org.gtk.vfs.Daemon - member={GetConnection,ListMonitorImplementations}, - dbus (send) - bus=session - path=/org/gtk/vfs/mount/[1-9]* - interface=org.gtk.vfs.Mount - member={CreateFileMonitor,Enumerate,QueryInfo}, - dbus (receive) - bus=session - path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member=Mounted, - dbus (send) - bus=session - path=/org/gtk/vfs/mounttracker - interface=org.gtk.vfs.MountTracker - member={ListMountableInfo,ListMounts2,LookupMount}, - - @{PROC}/sys/kernel/random/uuid r, - - owner @{PROC}/@{pid}/mountinfo r, - owner @{PROC}/@{pid}/mounts r, - - owner @{run}/user/@{uid}/gvfsd/socket-* rw, - - @{etc_ro}/fstab r, - - @{system_share_dirs}/hwdata/** r, - @{system_share_dirs}/lxqt/** r, - - owner /tmp/tr_session_id_* rwk, - - # allow a top-level directory listing - @{HOME}/ r, - - owner @{HOME}/.cache/transmission/ w, - owner @{HOME}/.cache/transmission/** rw, - owner @{HOME}/.config/transmission/ w, - owner @{HOME}/.config/transmission/** rw, - - owner @{HOME}/.config/lxqt/lxqt.conf r, - - owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ r, - owner @{HOME}/@{XDG_DOWNLOAD_DIR}/** rw, - - # exclude these for now - deny /usr/share/thumbnailers/ r, - deny @{HOME}/.local/share/gvfs-metadata/** r, - deny @{HOME}/.config/lxqt/** rw, - - include if exists <abstractions/transmission-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/trash b/straper/db/public/apparmor/apparmor.d/abstractions/trash deleted file mode 100644 index 96d80ed..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/trash +++ /dev/null @@ -1,75 +0,0 @@ -abi <abi/4.0>, - -# requires <tunables/home> - - owner @{HOME}/.config/trashrc rw, - owner @{HOME}/.config/trashrc.lock rwk, - owner @{HOME}/.config/#[0-9]*[0-9] rwk, - owner @{HOME}/.config/trashrc.* rwl -> @{HOME}/.config/#[0-9]*[0-9], - - owner @{run}/user/@{uid}/#[0-9]*[0-9] rw, - owner @{run}/user/@{uid}/trash.so*.[0-9].slave-socket rwl -> @{run}/user/@{uid}/#[0-9]*[0-9], - - # Home trash location - owner @{HOME}/.local/share/Trash/ rw, - owner @{HOME}/.local/share/Trash/#[0-9]*[0-9] rw, - owner @{HOME}/.local/share/Trash/directorysizes{,.*} rwl -> @{HOME}/.local/share/Trash/#[0-9]*[0-9], - owner @{HOME}/.local/share/Trash/files/{,**} rw, - owner @{HOME}/.local/share/Trash/info/ rw, - owner @{HOME}/.local/share/Trash/info/*.trashinfo{,.*} rw, - owner @{HOME}/.local/share/Trash/expunged/ rw, - owner @{HOME}/.local/share/Trash/expunged/[0-9]* rw, - owner @{HOME}/.local/share/Trash/expunged/[0-9]*/ rw, - owner @{HOME}/.local/share/Trash/expunged/[0-9]*/** rw, - - # Partitions' trash location when the admin creates the .Trash/ folder in the top lvl dir - owner /media/*/.Trash/ rw, - owner /media/*/.Trash/@{uid}/ rw, - owner /media/*/.Trash/@{uid}/#[0-9]*[0-9] rw, - owner /media/*/.Trash/@{uid}/directorysizes{,.*} rwl -> /media/*/.Trash/@{uid}/#[0-9]*[0-9], - owner /media/*/.Trash/@{uid}/files/{,**} rw, - owner /media/*/.Trash/@{uid}/info/ rw, - owner /media/*/.Trash/@{uid}/info/*.trashinfo{,.*} rw, - owner /media/*/.Trash/@{uid}/expunged/ rw, - owner /media/*/.Trash/@{uid}/expunged/[0-9]* rw, - owner /media/*/.Trash/@{uid}/expunged/[0-9]*/ rw, - owner /media/*/.Trash/@{uid}/expunged/[0-9]*/** rw, - - # Partitions' trash location when the admin doesn't create the .Trash/ folder in the top lvl dir - owner /media/*/.Trash-@{uid}/ rw, - owner /media/*/.Trash-@{uid}/#[0-9]*[0-9] rw, - owner /media/*/.Trash-@{uid}/directorysizes{,.*} rwl -> /media/*/.Trash-@{uid}/#[0-9]*[0-9], - owner /media/*/.Trash-@{uid}/files/{,**} rw, - owner /media/*/.Trash-@{uid}/info/ rw, - owner /media/*/.Trash-@{uid}/info/*.trashinfo{,.*} rw, - owner /media/*/.Trash-@{uid}/expunged/ rw, - owner /media/*/.Trash-@{uid}/expunged/[0-9]* rw, - owner /media/*/.Trash-@{uid}/expunged/[0-9]*/ rw, - owner /media/*/.Trash-@{uid}/expunged/[0-9]*/** rw, - - # Removable media's trash location when the admin creates the .Trash/ folder in the top lvl dir - owner /media/*/*/.Trash/ rw, - owner /media/*/*/.Trash/@{uid}/ rw, - owner /media/*/*/.Trash/@{uid}/#[0-9]*[0-9] rw, - owner /media/*/*/.Trash/@{uid}/directorysizes{,.*} rwl -> /media/*/*/.Trash/@{uid}/#[0-9]*[0-9], - owner /media/*/*/.Trash/@{uid}/files/{,**} rw, - owner /media/*/*/.Trash/@{uid}/info/ rw, - owner /media/*/*/.Trash/@{uid}/info/*.trashinfo{,.*} rw, - owner /media/*/*/.Trash/@{uid}/expunged/ rw, - owner /media/*/*/.Trash/@{uid}/expunged/[0-9]* rw, - owner /media/*/*/.Trash/@{uid}/expunged/[0-9]*/ rw, - owner /media/*/*/.Trash/@{uid}/expunged/[0-9]*/** rw, - - # Removable media's trash location when the admin doesn't create the .Trash/ folder in the top lvl dir - owner /media/*/*/.Trash-@{uid}/ rw, - owner /media/*/*/.Trash-@{uid}/#[0-9]*[0-9] rw, - owner /media/*/*/.Trash-@{uid}/directorysizes{,.*} rwl -> /media/*/*/.Trash-@{uid}/#[0-9]*[0-9], - owner /media/*/*/.Trash-@{uid}/files/{,**} rw, - owner /media/*/*/.Trash-@{uid}/info/ rw, - owner /media/*/*/.Trash-@{uid}/info/*.trashinfo{,.*} rw, - owner /media/*/*/.Trash-@{uid}/expunged/ rw, - owner /media/*/*/.Trash-@{uid}/expunged/[0-9]* rw, - owner /media/*/*/.Trash-@{uid}/expunged/[0-9]*/ rw, - owner /media/*/*/.Trash-@{uid}/expunged/[0-9]*/** rw, - - include if exists <abstractions/trash.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-bittorrent-clients b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-bittorrent-clients deleted file mode 100644 index 36378e4..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-bittorrent-clients +++ /dev/null @@ -1,22 +0,0 @@ -# vim:syntax=apparmor -# -# abstraction for allowing graphical bittorrent clients in Ubuntu -# -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - /usr/bin/azureus Cxr -> sanitized_helper, - /usr/bin/bitstormlite Cxr -> sanitized_helper, - /usr/bin/btmaketorrentgui Cxr -> sanitized_helper, - /usr/bin/deluge{,-gtk,-console} Cxr -> sanitized_helper, - /usr/bin/gnome-btdownload Cxr -> sanitized_helper, - /usr/bin/kget Cxr -> sanitized_helper, - /usr/bin/ktorrent Cxr -> sanitized_helper, - /usr/bin/qbittorrent Cxr -> sanitized_helper, - /usr/bin/transmission{,-gtk,-qt,-cli} Cxr -> sanitized_helper, - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-bittorrent-clients.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers deleted file mode 100644 index a85203e..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers +++ /dev/null @@ -1,41 +0,0 @@ -# vim:syntax=apparmor -# -# abstraction for allowing access to graphical browsers in Ubuntu -# -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - /usr/bin/arora Cx -> sanitized_helper, - /usr/bin/dillo Cx -> sanitized_helper, - /usr/bin/Dooble Cx -> sanitized_helper, - /usr/bin/epiphany Cx -> sanitized_helper, - /usr/bin/epiphany-browser Cx -> sanitized_helper, - /usr/bin/epiphany-webkit Cx -> sanitized_helper, - /usr/lib/fennec-*/fennec Cx -> sanitized_helper, - /usr/bin/kazehakase Cx -> sanitized_helper, - /usr/bin/konqueror Cx -> sanitized_helper, - /usr/bin/midori Cx -> sanitized_helper, - /usr/bin/netsurf Cx -> sanitized_helper, - /usr/bin/seamonkey Cx -> sanitized_helper, - /usr/bin/sensible-browser Pixr, - - /usr/bin/chromium{,-browser} Cx -> sanitized_helper, - /usr/lib{,64}/chromium{,-browser}/chromium{,-browser} Cx -> sanitized_helper, - - # this should cover all firefox browsers and versions (including shiretoko - # and abrowser) - /usr/bin/firefox Cxr -> sanitized_helper, - /usr/lib{,64}/firefox*/firefox* Cx -> sanitized_helper, - - # Iceweasel - /usr/bin/iceweasel Cxr -> sanitized_helper, - /usr/lib/iceweasel/iceweasel Cx -> sanitized_helper, - - # some unpackaged, but popular browsers - /usr/lib/icecat-*/icecat Cx -> sanitized_helper, - /usr/bin/opera Cx -> sanitized_helper, - /opt/google/chrome{,-beta,-unstable}/google-chrome{,-beta,-unstable} Cx -> sanitized_helper, - /opt/brave.com/brave{,-beta,-dev,-nightly}/brave-browser{,-beta,-dev,-nightly} Cx -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/java b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/java deleted file mode 100644 index 00dc502..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/java +++ /dev/null @@ -1,120 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - - # Java plugin - owner @{HOME}/.java/deployment/deployment.properties k, - /etc/java-*/ r, - /etc/java-*/** r, - /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}lib/*/IcedTeaPlugin.so mr, - /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}lib/*/IcedTeaPlugin.so mr, - /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java cx -> browser_openjdk, - /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java cx -> browser_openjdk, - /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} cx -> browser_java, - /usr/lib/jvm/java-*-sun-1.*/jre/lib/*/libnp*.so cx -> browser_java, - /usr/lib/j2*-ibm/jre/bin/java cx -> browser_java, - owner /{,var/}run/user/*/icedteaplugin-*/ rw, - owner /{,var/}run/user/*/icedteaplugin-*/** rwk, - - # Profile for the supported OpenJDK in Ubuntu. This doesn't require the - # unfortunate workarounds of the proprietary Javas, so have a separate - # profile. - profile browser_openjdk { - include <abstractions/base> - include <abstractions/fonts> - include <abstractions/gnome> - include <abstractions/kde> - include <abstractions/nameservice> - include <abstractions/ssl_certs> - include <abstractions/user-tmp> - include <abstractions/private-files-strict> - - network inet stream, - network inet6 stream, - @{PROC}/@{pid}/net/if_inet6 r, - @{PROC}/@{pid}/net/ipv6_route r, - - /etc/java-*/ r, - /etc/java-*/** r, - /etc/lsb-release r, - /etc/ssl/certs/java/* r, - /etc/timezone r, - /etc/writable/timezone r, - - @{PROC}/@{pid}/ r, - @{PROC}/@{pid}/fd/ r, - @{PROC}/filesystems r, - @{sys}/devices/system/cpu/ r, - @{sys}/devices/system/cpu/** r, - /usr/share/** r, - /var/lib/dbus/machine-id r, - - /usr/bin/env ix, - /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java ix, - /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java ix, - /usr/lib/jvm/java-{6,7}-openjdk*/jre/lib/i386/client/classes.jsa m, - - # Why would java need this? - deny /usr/bin/gconftool-2 x, - - owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-appletviewer-to-plugin rw, - owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-plugin-{,debug-}to-appletviewer r, - owner @{HOME}/ r, - owner @{HOME}/** rwk, - } - - # Profile for commercial Javas. These need workarounds to work right (eg - # Sun's forcing of an executable stack (LP: #535247)). - profile browser_java { - include <abstractions/base> - include <abstractions/fonts> - include <abstractions/gnome> - include <abstractions/kde> - include <abstractions/nameservice> - include <abstractions/ssl_certs> - include <abstractions/user-tmp> - include <abstractions/private-files-strict> - - network inet stream, - network inet6 stream, - @{PROC}/@{pid}/net/if_inet6 r, - @{PROC}/@{pid}/net/ipv6_route r, - @{PROC}/loadavg r, - - /etc/debian_version r, - /etc/java-*/ r, - /etc/java-*/** r, - /etc/lsb-release r, - /etc/ssl/certs/java/* r, - /etc/timezone r, - /etc/writable/timezone r, - - @{PROC}/@{pid}/ r, - @{PROC}/@{pid}/fd/ r, - @{PROC}/filesystems r, - @{sys}/devices/system/cpu/ r, - @{sys}/devices/system/cpu/** r, - /usr/share/** r, - /var/lib/dbus/machine-id r, - - /usr/bin/env ix, - /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} ix, - /usr/lib/jvm/java-*-sun-1.*/jre/lib/i386/client/classes.jsa m, - /usr/lib/j2*-ibm/jre/bin/java ix, - - # noisy, can't write here anyway - deny /etc/.java/ w, - deny /etc/.java/** w, - - deny /usr/bin/gconftool-2 x, - - owner @{HOME}/ r, - owner @{HOME}/** rwk, - - # These are seriously unfortunate, but required due to LP: #535247 - /etc/passwd m, - owner @{HOME}/.java/**/cache/** m, - owner /tmp/** m, - /usr/lib{,32,64}/jvm/**/*.jar mr, - /usr/share/fonts/** m, - } diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/kde b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/kde deleted file mode 100644 index 0447862..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/kde +++ /dev/null @@ -1,12 +0,0 @@ -# vim:syntax=apparmor -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - include <abstractions/kde> - /usr/bin/kde4-config Cx -> sanitized_helper, - - # https://bugs.kde.org/show_bug.cgi?id=397399 - /usr/bin/plasma-browser-integration-host Cx -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/mailto b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/mailto deleted file mode 100644 index c09b501..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/mailto +++ /dev/null @@ -1,11 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - - # for mailto: - include <abstractions/ubuntu-email> - include <abstractions/ubuntu-console-email> - - # Terminals for using console applications. These abstractions should ideally - # have 'ix' to restrct access to what only firefox is allowed to do - include <abstractions/ubuntu-gnome-terminal> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/multimedia b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/multimedia deleted file mode 100644 index 37fae70..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/multimedia +++ /dev/null @@ -1,51 +0,0 @@ -# vim:syntax=apparmor -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - include <abstractions/X> - - # Pulseaudio - /usr/bin/pulseaudio Pixr, - - # Image viewers - /usr/bin/eog Cxr -> sanitized_helper, - /usr/bin/gimp* Cxr -> sanitized_helper, - /usr/bin/shotwell Cxr -> sanitized_helper, - /usr/bin/digikam Cxr -> sanitized_helper, - /usr/bin/gwenview Cxr -> sanitized_helper, - - include <abstractions/ubuntu-media-players> - owner @{HOME}/.adobe/ w, - owner @{HOME}/.adobe/** rw, - owner @{HOME}/.macromedia/ w, - owner @{HOME}/.macromedia/** rw, - /opt/real/RealPlayer/mozilla/nphelix.so rm, - /usr/bin/lpstat Cxr -> sanitized_helper, - /usr/bin/lpr Cxr -> sanitized_helper, - - # Bittorrent clients - include <abstractions/ubuntu-bittorrent-clients> - - # Archivers - /usr/bin/ark Cxr -> sanitized_helper, - /usr/bin/file-roller Cxr -> sanitized_helper, - /usr/bin/xarchiver Cxr -> sanitized_helper, - /usr/local/lib{,32,64}/*.so* mr, - - # News feed readers - include <abstractions/ubuntu-feed-readers> - - # If we allow the above, nvidia based systems will also need this - include <abstractions/nvidia> - - # Virus scanners - /usr/bin/clamscan Cx -> sanitized_helper, - - # gxine (LP: #1057642) - /var/lib/xine/gxine.desktop r, - - # For WebRTC camera access (LP: #1665535) - /dev/video[0-9]* rw, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common deleted file mode 100644 index b4c4b37..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common +++ /dev/null @@ -1,18 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - - # - # Plugins/helpers - # - @{PROC}/@{pid}/fd/ r, - /usr/lib/** rm, - /{,usr/}bin/bash ixr, - /{,usr/}bin/dash ixr, - /{,usr/}bin/grep ixr, - /{,usr/}bin/sed ixr, - /usr/bin/m4 ixr, - - # Since all the ubuntu-browsers.d abstractions need this, just include it - # here - include <abstractions/ubuntu-helpers> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/productivity b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/productivity deleted file mode 100644 index f778ce2..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/productivity +++ /dev/null @@ -1,26 +0,0 @@ -# vim:syntax=apparmor -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - # Openoffice.org - /usr/bin/ooffice Cxr -> sanitized_helper, - /usr/bin/oocalc Cxr -> sanitized_helper, - /usr/bin/oodraw Cxr -> sanitized_helper, - /usr/bin/ooimpress Cxr -> sanitized_helper, - /usr/bin/oowriter Cxr -> sanitized_helper, - /usr/lib/openoffice/program/soffice Cxr -> sanitized_helper, - - # LibreOffice - /usr/bin/libreoffice Cxr -> sanitized_helper, - /usr/bin/localc Cxr -> sanitized_helper, - /usr/bin/lodraw Cxr -> sanitized_helper, - /usr/bin/loimpress Cxr -> sanitized_helper, - /usr/bin/lowriter Cxr -> sanitized_helper, - /usr/lib/libreoffice/program/soffice Cxr -> sanitized_helper, - - # PDFs - /usr/bin/evince Cxr -> sanitized_helper, - /usr/bin/okular Cxr -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/text-editors b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/text-editors deleted file mode 100644 index 6280b4d..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/text-editors +++ /dev/null @@ -1,16 +0,0 @@ -# vim:syntax=apparmor -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - # Text editors (It's All Text [https://addons.mozilla.org/en-US/firefox/addon/4125]) - /usr/bin/emacsclient.emacs-snapshot Cxr -> sanitized_helper, - /usr/bin/emacsclient.emacs2[2-9] Cxr -> sanitized_helper, - /usr/bin/emacs-snapshot-gtk Cxr -> sanitized_helper, - /usr/bin/gedit Cxr -> sanitized_helper, - /usr/bin/vim.gnome Cxr -> sanitized_helper, - /usr/bin/leafpad Cxr -> sanitized_helper, - /usr/bin/mousepad Cxr -> sanitized_helper, - /usr/bin/kate Cxr -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration deleted file mode 100644 index 8e73ec2..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration +++ /dev/null @@ -1,37 +0,0 @@ -# vim:syntax=apparmor -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - # Apport - /usr/bin/apport-bug Cx -> sanitized_helper, - - # Package installation - /usr/bin/apturl Cxr -> sanitized_helper, - /usr/share/software-center/software-center Cxr -> sanitized_helper, - - # Input Methods - /usr/bin/scim Cx -> sanitized_helper, - /usr/bin/scim-bridge Cx -> sanitized_helper, - - # File managers - /usr/bin/nautilus Cxr -> sanitized_helper, - /usr/bin/{t,T}hunar Cxr -> sanitized_helper, - /usr/bin/dolphin Cxr -> sanitized_helper, - - # Themes - /usr/bin/gnome-appearance-properties Cxr -> sanitized_helper, - - # Kubuntu - /usr/lib/mozilla/kmozillahelper Cxr -> sanitized_helper, - - # Exo-aware applications - include <abstractions/exo-open> - - # unity webapps integration. Could go in its own abstraction - owner /run/user/*/dconf/user rw, - owner @{HOME}/.local/share/unity-webapps/availableapps*.db rwk, - /usr/bin/debconf-communicate Cxr -> sanitized_helper, - owner @{HOME}/.config/libaccounts-glib/accounts.db rk, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration-xul b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration-xul deleted file mode 100644 index c1e4f7a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration-xul +++ /dev/null @@ -1,8 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - - # firefox-notify - include <abstractions/python> - /usr/bin/python2.[4567] ix, - /usr/share/xul-ext/notify/**/download_complete_notify.py ix, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files deleted file mode 100644 index fa73152..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files +++ /dev/null @@ -1,31 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - - # Allow read to all files user has DAC access to and write access to all - # files owned by the user in $HOME. - @{HOME}/ r, - @{HOME}/** r, - owner @{HOME}/** w, - - # Do not allow read and/or write to particularly sensitive/problematic files - include <abstractions/private-files> - audit deny @{HOME}/.ssh/{,**} mrwkl, - audit deny @{HOME}/.gnome2_private/{,**} mrwkl, - audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w, - audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl, - audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl, - - # Comment this out if using gpg plugin/addons - audit deny @{HOME}/.gnupg/{,**} mrwkl, - - # Allow read to all files user has DAC access to and write for files the user - # owns on removable media and filesystems. - /media/** r, - /mnt/** r, - /srv/** r, - /net/** r, - owner /media/** w, - owner /mnt/** w, - owner /srv/** w, - owner /net/** w, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-browsers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-browsers deleted file mode 100644 index f055858..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-browsers +++ /dev/null @@ -1,23 +0,0 @@ -# vim:syntax=apparmor -# -# abstraction for allowing access to text-only browsers in Ubuntu. These will -# typically also need a terminal, so when using this abstraction, should also -# do something like: -# -# include <abstractions/ubuntu-gnome-terminal> -# -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - /usr/bin/elinks Cx -> sanitized_helper, - /usr/bin/links Cx -> sanitized_helper, - /usr/bin/lynx.cur Cx -> sanitized_helper, - /usr/bin/netrik Cx -> sanitized_helper, - /usr/bin/w3m Cx -> sanitized_helper, - - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-console-browsers.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-email b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-email deleted file mode 100644 index dee7fee..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-email +++ /dev/null @@ -1,23 +0,0 @@ -# vim:syntax=apparmor -# -# abstraction for allowing console email clients in Ubuntu. These will -# typically also need a terminal, so when using this abstraction, should also -# do something like: -# -# include <abstractions/ubuntu-gnome-terminal> -# -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - /usr/bin/alpine Cx -> sanitized_helper, - /usr/bin/citadel Cx -> sanitized_helper, - /usr/bin/cone Cx -> sanitized_helper, - /usr/bin/elmo Cx -> sanitized_helper, - /usr/bin/mutt Cx -> sanitized_helper, - - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-console-email.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-email b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-email deleted file mode 100644 index 6ebc26e..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-email +++ /dev/null @@ -1,29 +0,0 @@ -# vim:syntax=apparmor -# -# abstraction for allowing graphical email clients in Ubuntu -# -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - /usr/bin/anjal Cx -> sanitized_helper, - /usr/bin/balsa Cx -> sanitized_helper, - /usr/bin/claws-mail Cx -> sanitized_helper, - /usr/bin/evolution Cx -> sanitized_helper, - /usr/bin/geary Cx -> sanitized_helper, - /usr/bin/gnome-gmail Cx -> sanitized_helper, - /usr/lib/GNUstep/Applications/GNUMail.app/GNUMail Cx -> sanitized_helper, - /usr/bin/kmail Cx -> sanitized_helper, - /usr/bin/mailody Cx -> sanitized_helper, - /usr/bin/modest Cx -> sanitized_helper, - /usr/bin/seamonkey Cx -> sanitized_helper, - /usr/bin/sylpheed Cx -> sanitized_helper, - /usr/bin/tkrat Cx -> sanitized_helper, - - /usr/bin/thunderbird Cx -> sanitized_helper, # used by gio-launch-desktop - /usr/lib/thunderbird*/thunderbird{,.sh,-bin} Cx -> sanitized_helper, - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-email.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-feed-readers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-feed-readers deleted file mode 100644 index 9e2e116..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-feed-readers +++ /dev/null @@ -1,15 +0,0 @@ -# vim:syntax=apparmor -# -# abstraction for allowing graphical news feed readers in Ubuntu -# -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - /usr/bin/akregator Cxr -> sanitized_helper, - /usr/bin/liferea-add-feed Cxr -> sanitized_helper, - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-feed-readers.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-gnome-terminal b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-gnome-terminal deleted file mode 100644 index 46318f4..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-gnome-terminal +++ /dev/null @@ -1,15 +0,0 @@ -# vim:syntax=apparmor -# -# for allowing access to gnome-terminal -# - - abi <abi/4.0>, - - include <abstractions/gnome> - - # do not use ux or PUx here. Use at a minimum ix - /usr/bin/gnome-terminal ix, - - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-gnome-terminal.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-helpers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-helpers deleted file mode 100644 index d5f2243..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-helpers +++ /dev/null @@ -1,98 +0,0 @@ -# Lenient profile that is intended to be used when 'Ux' is desired but -# does not provide enough environment sanitizing. This effectively is an -# open profile that blacklists certain known dangerous files and also -# does not allow any capabilities. For example, it will not allow 'm' on files -# owned be the user invoking the program. While this provides some additional -# protection, please use with care as applications running under this profile -# are effectively running without any AppArmor protection. Use this profile -# only if the process absolutely must be run (effectively) unconfined. -# -# Usage: -# Because this abstraction defines the sanitized_helper profile, it must only -# be included once. Therefore this abstraction should typically not be -# included in other abstractions so as to avoid parser errors regarding -# multiple definitions. -# -# Limitations: -# 1. This does not work for root owned processes, because of the way we use -# owner matching in the sanitized helper. We could do a better job with -# this to support root, but it would make the policy harder to understand -# and going unconfined as root is not desirable any way. -# -# 2. For this sanitized_helper to work, the program running in the sanitized -# environment must open symlinks directly in order for AppArmor to mediate -# it. This is confirmed to work with: -# - compiled code which can load shared libraries -# - python imports -# It is known not to work with: -# - perl includes -# 3. Sanitizing ruby and java -# -# Use at your own risk. This profile was developed as an interim workaround for -# LP: #851986 until AppArmor utilizes proper environment filtering. - - abi <abi/4.0>, - -profile sanitized_helper { - include <abstractions/base> - include <abstractions/X> - include if exists <local/ubuntu-helpers> - - # Allow all networking - network inet, - network inet6, - - # Allow all DBus communications - include <abstractions/dbus-session-strict> - include <abstractions/dbus-strict> - dbus, - - # Needed for Google Chrome - ptrace (trace) peer=**//sanitized_helper, - - # Allow exec of anything, but under this profile. Allow transition - # to other profiles if they exist. - /{usr/,usr/local/,}{bin,sbin}/* Pixr, - - # Allow exec of libexec applications in /usr/lib* and /usr/local/lib* - /usr/{,local/}lib*/{,**/}* Pixr, - - # Allow exec of software-center scripts. We may need to allow wider - # permissions for /usr/share, but for now just do this. (LP: #972367) - /usr/share/software-center/* Pixr, - - # Allow exec of texlive font build scripts (LP: #1010909) - /usr/share/texlive/texmf{,-dist}/web2c/{,**/}* Pixr, - - # While the chromium and chrome sandboxes are setuid root, they only link - # in limited libraries so glibc's secure execution should be enough to not - # require the santized_helper (ie, LD_PRELOAD will only use standard system - # paths (man ld.so)). - /usr/lib/chromium-browser/chromium-browser-sandbox PUxr, - /usr/lib/chromium{,-browser}/chrome-sandbox PUxr, - /opt/google/chrome{,-beta,-unstable}/chrome-sandbox PUxr, - /opt/google/chrome{,-beta,-unstable}/google-chrome Pixr, - /opt/google/chrome{,-beta,-unstable}/chrome Pixr, - /opt/google/chrome{,-beta,-unstable}/chrome_crashpad_handler Pixr, - /opt/google/chrome{,-beta,-unstable}/{,**/}lib*.so{,.*} m, - - # The same is needed for Brave - /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome-sandbox PUxr, - /opt/brave.com/brave{,-beta,-dev,-nightly}/brave-browser{,-beta,-dev,-nightly} Pixr, - /opt/brave.com/brave{,-beta,-dev,-nightly}/brave Pixr, - /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome_crashpad_handler Pixr, - /opt/brave.com/brave{,-beta,-dev,-nightly}/{,**/}lib*.so{,.*} m, - - # Allow running snap applications - # https://bugs.launchpad.net/apparmor/+bug/2095872 - /usr/bin/snap ux, - - # Full access - / r, - /** rwkl, - /{,usr/,usr/local/}lib{,32,64}/{,**/}*.so{,.*} m, - - # Dangerous files - audit deny owner /**/* m, # compiled libraries - audit deny owner /**/*.py* r, # python imports -} diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-konsole b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-konsole deleted file mode 100644 index 2a40e38..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-konsole +++ /dev/null @@ -1,22 +0,0 @@ -# vim:syntax=apparmor -# -# for allowing access to konsole -# - - abi <abi/4.0>, - - include <abstractions/consoles> - include <abstractions/kde> - capability sys_ptrace, - @{PROC}/@{pid}/status r, - @{PROC}/@{pid}/stat r, - @{PROC}/@{pid}/cmdline r, - /{,var/}run/utmp r, - /dev/ptmx rw, - - # do not use ux or Ux here. Use at a minimum ix - /usr/bin/konsole ix, - - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-konsole.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-media-players b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-media-players deleted file mode 100644 index 86ec80a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-media-players +++ /dev/null @@ -1,65 +0,0 @@ -# vim:syntax=apparmor -# -# abstraction for allowing access to media players in Ubuntu -# -# Users of this abstraction need to include the ubuntu-helpers abstraction -# in the toplevel profile. Eg: -# include <abstractions/ubuntu-helpers> - - abi <abi/4.0>, - - /usr/bin/amarok Cxr -> sanitized_helper, - /usr/bin/audacious2 Cxr -> sanitized_helper, - /usr/bin/audacity Cxr -> sanitized_helper, - /usr/bin/bangarang Cxr -> sanitized_helper, - /usr/bin/banshee Cxr -> sanitized_helper, - /usr/bin/banshee-1 Cxr -> sanitized_helper, - /usr/bin/decibel Cxr -> sanitized_helper, - /usr/bin/dragon Cxr -> sanitized_helper, - /usr/bin/esperanza Cxr -> sanitized_helper, - /usr/bin/exaile Cxr -> sanitized_helper, - /usr/bin/freevo Cxr -> sanitized_helper, - /usr/bin/gmerlin Cxr -> sanitized_helper, - /usr/bin/gxmms Cxr -> sanitized_helper, - /usr/bin/gxmms2 Cxr -> sanitized_helper, - /usr/bin/hornsey Cxr -> sanitized_helper, - /usr/bin/jlgui Cxr -> sanitized_helper, - /usr/bin/juk Cxr -> sanitized_helper, - /usr/bin/kaffeine Cxr -> sanitized_helper, - /usr/bin/listen Cxr -> sanitized_helper, - /usr/share/minirok/minirok.py Cxr -> sanitized_helper, - - # mplayer - /etc/mplayerplug-in.conf r, - /usr/bin/gmplayer Cxr -> sanitized_helper, - /usr/bin/gnome-mplayer Cxr -> sanitized_helper, - /usr/bin/kmplayer Cxr -> sanitized_helper, - /usr/bin/mplayer Cxr -> sanitized_helper, - /usr/bin/smplayer Cxr -> sanitized_helper, - - /usr/bin/muine Cxr -> sanitized_helper, - /usr/bin/potamus Cxr -> sanitized_helper, - /usr/bin/promoe Cxr -> sanitized_helper, - /usr/bin/qmmp Cxr -> sanitized_helper, - /usr/bin/quodlibet Cxr -> sanitized_helper, - /usr/bin/rhythmbox Cxr -> sanitized_helper, - /usr/bin/strange-quark Cxr -> sanitized_helper, - /usr/bin/swfdec-player Cxr -> sanitized_helper, - /usr/bin/timidity Cxr -> sanitized_helper, - /usr/lib/totem/** ixr, - /usr/bin/totem-gstreamer Cxr -> sanitized_helper, - /usr/bin/totem-xine Cxr -> sanitized_helper, - /usr/bin/totem Cxr -> sanitized_helper, - /usr/bin/vlc Cxr -> sanitized_helper, - /usr/bin/xfmedia Cxr -> sanitized_helper, - /usr/bin/xmms Cxr -> sanitized_helper, - - # gnash - /usr/bin/gtk-gnash ixr, - /etc/gnashrc r, - /etc/gnashpluginrc r, - owner @{HOME}/.gnash/ rw, - owner @{HOME}/.gnash/** rw, - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-media-players.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-base b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-base deleted file mode 100644 index c8305d8..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-base +++ /dev/null @@ -1,105 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2013-2014 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - -# -# Rules common to applications running under Unity 7 -# - -include <abstractions/gnome> - -include <abstractions/dbus-session-strict> -include <abstractions/dbus-strict> - - # - # Access required for connecting to/communication with Unity HUD - # - dbus (send) - bus=session - path="/com/canonical/hud", - dbus (send) - bus=session - interface="com.canonical.hud.*", - dbus (send) - bus=session - path="/com/canonical/hud/applications/*", - dbus (receive) - bus=session - path="/com/canonical/hud", - dbus (receive) - bus=session - interface="com.canonical.hud.*", - - # - # Allow access for connecting to/communication with the appmenu - # - # dbusmenu - dbus (send) - bus=session - interface="com.canonical.AppMenu.*", - dbus (receive, send) - bus=session - path=/com/canonical/menu/**, - - # gmenu - dbus (receive, send) - bus=session - interface=org.gtk.Actions, - dbus (receive, send) - bus=session - interface=org.gtk.Menus, - - # - # Access required for using freedesktop notifications - # - dbus (send) - bus=session - path=/org/freedesktop/Notifications - member=GetCapabilities, - dbus (send) - bus=session - path=/org/freedesktop/Notifications - member=GetServerInformation, - dbus (send) - bus=session - path=/org/freedesktop/Notifications - member=Notify, - dbus (receive) - bus=session - member="Notify" - peer=(name="org.freedesktop.DBus"), - dbus (receive) - bus=session - path=/org/freedesktop/Notifications - member=NotificationClosed, - dbus (send) - bus=session - path=/org/freedesktop/Notifications - member=CloseNotification, - - # accessibility - dbus (send) - bus=session - peer=(name=org.a11y.Bus), - dbus (receive) - bus=session - interface=org.a11y.atspi*, - dbus (receive, send) - bus=accessibility, - - # - # Deny potentially dangerous access - # - deny dbus bus=session path=/com/canonical/[Uu]nity/[Dd]ebug**, - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-unity7-base.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-launcher b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-launcher deleted file mode 100644 index d73edfc..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-launcher +++ /dev/null @@ -1,12 +0,0 @@ - abi <abi/4.0>, - - # - # Access required for connecting to/communicating with the Unity Launcher - # - dbus (send) - bus=session - interface="com.canonical.Unity.LauncherEntry" - member="Update", - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-unity7-launcher.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-messaging b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-messaging deleted file mode 100644 index 7e2ff3a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-messaging +++ /dev/null @@ -1,12 +0,0 @@ - abi <abi/4.0>, - - # - # Access required for connecting to/communicating with the Unity messaging - # indicator - # - dbus (receive, send) - bus=session - path="/com/canonical/indicator/messages/*", - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-unity7-messaging.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-xterm b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-xterm deleted file mode 100644 index 932f85a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-xterm +++ /dev/null @@ -1,18 +0,0 @@ -# vim:syntax=apparmor -# -# for allowing access to xterm -# - - abi <abi/4.0>, - - include <abstractions/consoles> - /dev/ptmx rw, - /{,var/}run/utmp r, - /etc/X11/app-defaults/XTerm r, - - # do not use ux or Ux here. Use at a minimum ix - /usr/bin/xterm ix, - - - # Include additions to the abstraction - include if exists <abstractions/ubuntu-xterm.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-download b/straper/db/public/apparmor/apparmor.d/abstractions/user-download deleted file mode 100644 index 0f8e30a..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/user-download +++ /dev/null @@ -1,29 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2014 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - -# Description: Where common programs should allow users to download -# files - - owner @{HOME}/tmp/** rwl, - owner @{HOME}/[dD]ownload{,s}/ r, - owner @{HOME}/[dD]ownload{,s}/** rwl, - owner @{HOME}/[^.]* rwl, - owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, - owner @{HOME}/@{XDG_DESKTOP_DIR}/* rwl, - owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ r, - owner @{HOME}/@{XDG_DOWNLOAD_DIR}/* rwl, - owner "@{HOME}/My Downloads/" r, - owner "@{HOME}/My Downloads/**" rwl, - - # Include additions to the abstraction - include if exists <abstractions/user-download.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-mail b/straper/db/public/apparmor/apparmor.d/abstractions/user-mail deleted file mode 100644 index 366c7b2..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/user-mail +++ /dev/null @@ -1,28 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2014 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # location of user mail, spool and mboxes - owner @{HOME}/[mM]ail/ r, - owner @{HOME}/[mM]ail/** rwl, - owner @{HOME}/postponed* rwl, - /var/{,spool/}mail/ r, - owner /var/{,spool/}mail/* rwl, - owner @{HOME}/mbox.lock* rwl, - owner @{HOME}/mbox rw, - owner @{HOME}/inbox rw, - owner @{HOME}/.forward r, - owner @{HOME}/Maildir/ r, - owner @{HOME}/Maildir/** rwl, - - # Include additions to the abstraction - include if exists <abstractions/user-mail.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-manpages b/straper/db/public/apparmor/apparmor.d/abstractions/user-manpages deleted file mode 100644 index 66a4013..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/user-manpages +++ /dev/null @@ -1,29 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # perhaps your configuration has users elsewhere, or you don't wish - # them to read their own manpages - owner @{HOME}/man/ r, - owner @{HOME}/man/** r, - owner @{HOME}/tmp/groff* rwl, - - # kindof required - owner /tmp/groff* rwl, - - # standard system manpages - /usr/local/share/man/man?/ r, - /usr/local/share/man/man?/** r, - /usr/{share,X11R6,local,kerberos}/man/** r, - /usr/man/** r, - - # Include additions to the abstraction - include if exists <abstractions/user-manpages.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-tmp b/straper/db/public/apparmor/apparmor.d/abstractions/user-tmp deleted file mode 100644 index 804135f..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/user-tmp +++ /dev/null @@ -1,25 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009-2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # per-user tmp directories - owner @{HOME}/tmp/** rwkl, - owner @{HOME}/tmp/ rw, - - # global tmp directories - owner /var/tmp/** rwkl, - /var/tmp/ rw, - owner /tmp/** rwkl, - /tmp/ rw, - - # Include additions to the abstraction - include if exists <abstractions/user-tmp.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-write b/straper/db/public/apparmor/apparmor.d/abstractions/user-write deleted file mode 100644 index b94ce17..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/user-write +++ /dev/null @@ -1,26 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2014 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # per-user write directories - owner @{HOME}/ r, - owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, - owner @{HOME}/@{XDG_DOCUMENTS_DIR}/ r, - owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/ r, - owner @{HOME}/[^.]*/ rw, - owner @{HOME}/[^.]* rwl, - owner @{HOME}/@{XDG_DESKTOP_DIR}/** rwl, - owner @{HOME}/@{XDG_DOCUMENTS_DIR}/** rwl, - owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/** rwl, - - # Include additions to the abstraction - include if exists <abstractions/user-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/video b/straper/db/public/apparmor/apparmor.d/abstractions/video deleted file mode 100644 index 0495388..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/video +++ /dev/null @@ -1,20 +0,0 @@ -# vim:syntax=apparmor -# video device access - - abi <abi/4.0>, - - # System devices - @{sys}/class/video4linux/ r, - @{sys}/class/video4linux/** r, - - owner /dev/shm/libv4l-* rw, - /dev/video[0-9]* rw, - @{sys}/devices/pci[0-9]*/**/usb[0-9]/**/video4linux/video[0-9]*/dev r, - @{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{modalias,speed} r, - - @{sys}/devices/virtual/dmi/id/sys_vendor r, - @{sys}/devices/virtual/dmi/id/product_{name,version} r, - @{sys}/devices/virtual/dmi/id/board_{vendor,name,version} r, - - # Include additions to the abstraction - include if exists <abstractions/video.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/vulkan b/straper/db/public/apparmor/apparmor.d/abstractions/vulkan deleted file mode 100644 index aede375..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/vulkan +++ /dev/null @@ -1,26 +0,0 @@ -# vim:syntax=apparmor -# Vulkan access requirements - - abi <abi/4.0>, - - # System files - /dev/dri/ r, # libvulkan_radeon.so, libvulkan_intel.so (Mesa) - /etc/glvnd/egl_vendor.d/{,*.json} r, - /etc/vulkan/icd.d/{,*.json} r, - /etc/vulkan/{explicit,implicit}_layer.d/{,*.json} r, - # for drmGetMinorNameForFD() from libvulkan_intel.so (Mesa) - @{sys}/devices/pci[0-9]*/*/drm/ r, - @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/gt_{max,min}_freq_mhz r, # anv_enumerate_physical_devices() from libvulkan_intel.so - @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/metrics/ r, # anv_enumerate_physical_devices() from libvulkan_intel.so - @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/metrics/????????-????-????-????-????????????/id r, # anv_enumerate_physical_devices() from libvulkan_intel.so - /usr/share/egl/egl_external_platform.d/{,*} r, - /usr/share/glvnd/egl_vendor.d/{,*} r, - /usr/share/vulkan/icd.d/{,*.json} r, - /usr/share/vulkan/{explicit,implicit}_layer.d/{,*.json} r, - - # User files - owner @{HOME}/.local/share/vulkan/implicit_layer.d/{,*.json} r, - - - # Include additions to the abstraction - include if exists <abstractions/vulkan.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/wayland b/straper/db/public/apparmor/apparmor.d/abstractions/wayland deleted file mode 100644 index 27563d5..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/wayland +++ /dev/null @@ -1,21 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2016 intrigeri <intrigeri@boum.org> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - owner @{run}/user/*/wayland-[0-9]* rw, - owner @{run}/user/*/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw, - - #For compositors based on wlroots - owner /dev/shm/wlroots-* rw, - - # Include additions to the abstraction - include if exists <abstractions/wayland.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/web-data b/straper/db/public/apparmor/apparmor.d/abstractions/web-data deleted file mode 100644 index f7849b8..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/web-data +++ /dev/null @@ -1,30 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2006 Novell/SUSE -# Copyright (C) 2014 Canonical Ltd -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /srv/www/htdocs/ r, - /srv/www/htdocs/** r, - # virtual hosting - /srv/www/vhosts/ r, - /srv/www/vhosts/** r, - # mod_userdir - @{HOME}/public_html/ r, - @{HOME}/public_html/** r, - - /srv/www/rails/*/public/ r, - /srv/www/rails/*/public/** r, - - /var/www/html/ r, - /var/www/html/** r, - - # Include additions to the abstraction - include if exists <abstractions/web-data.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/winbind b/straper/db/public/apparmor/apparmor.d/abstractions/winbind deleted file mode 100644 index 9b5b9ab..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/winbind +++ /dev/null @@ -1,27 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # pam_winbindd - /tmp/.winbindd/pipe rw, - /var/lib/samba/winbindd_privileged/pipe rw, - @{run}/samba/winbindd_privileged/pipe rw, - /etc/samba/smb.conf r, - /etc/samba/dhcp.conf r, - /usr/lib*/samba/valid.dat r, - /usr/lib*/samba/upcase.dat r, - /usr/lib*/samba/lowcase.dat r, - /usr/share/samba/codepages/{lowcase,upcase,valid}.dat r, - - - # Include additions to the abstraction - include if exists <abstractions/winbind.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/wutmp b/straper/db/public/apparmor/apparmor.d/abstractions/wutmp deleted file mode 100644 index 937ca77..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/wutmp +++ /dev/null @@ -1,27 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2002-2009 Novell/SUSE -# Copyright (C) 2009 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # some services update wtmp, utmp, and lastlog with per-user - # connection information - /var/lib/wtmpdb/ r, - /var/lib/wtmpdb/wtmp.db{,-journal} rwlk, - /var/log/lastlog rwk, - /var/log/wtmp rwk, - /var/log/btmp rwk, - @{run}/utmp rwk, - - # Some read the list of sessions from systemd - /run/systemd/sessions/ r, - - # Include additions to the abstraction - include if exists <abstractions/wutmp.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/xad b/straper/db/public/apparmor/apparmor.d/abstractions/xad deleted file mode 100644 index 5969f2c..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/xad +++ /dev/null @@ -1,30 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2007 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - /opt/novell/xad/lib/ r, - /opt/novell/xad/lib/lib*.so* mr, - /opt/novell/xad/lib/gss/*.so* mr, - /opt/novell/lib/libpthread_ext*.so* mr, - /opt/novell/lib/libccs2.so* mr, - /opt/novell/xad/lib64/ r, - /opt/novell/xad/lib64/lib*.so* mr, - /opt/novell/xad/lib64/gss/*.so* mr, - /opt/novell/lib64/libpthread_ext*.so* mr, - /opt/novell/lib64/libccs2.so* mr, - /etc/opt/novell/xad/krb5.conf r, - /etc/opt/novell/nici.cfg r, - /var/opt/novell/nici/* r, - /var/opt/novell/nici/*/ r, - /var/opt/novell/nici/*/* rw, - - # Include additions to the abstraction - include if exists <abstractions/xad.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/xdg-desktop b/straper/db/public/apparmor/apparmor.d/abstractions/xdg-desktop deleted file mode 100644 index 19c3e62..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/xdg-desktop +++ /dev/null @@ -1,29 +0,0 @@ -# vim:syntax=apparmor -# ------------------------------------------------------------------ -# -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - - abi <abi/4.0>, - - # Entries based on: - # http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html - - owner @{HOME}/.cache/ rw, - - owner @{HOME}/.config/ rw, - - owner @{HOME}/.local/ rw, - owner @{HOME}/.local/share/ rw, - - # fallbacks - /usr/share/ r, - /usr/local/share/ r, - - # Include additions to the abstraction - include if exists <abstractions/xdg-desktop.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/xdg-open b/straper/db/public/apparmor/apparmor.d/abstractions/xdg-open deleted file mode 100644 index 5e539e1..0000000 --- a/straper/db/public/apparmor/apparmor.d/abstractions/xdg-open +++ /dev/null @@ -1,86 +0,0 @@ -# vim:syntax=apparmor - - abi <abi/4.0>, - -# This abstraction is designed to be used in a child profile to limit what -# confined application can invoke via xdg-open helper. xdg-open abstraction -# will allow to use gio-open, kde-open5 and other helpers of the different -# desktop environments. -# -# Usage example: -# -# ``` -# profile foo /usr/bin/foo { -# ... -# /usr/bin/xdg-open rPx -> foo//xdg-open, -# ... -# } # end of main profile -# -# # out-of-line child profile -# profile foo//xdg-open { -# include <abstractions/xdg-open> -# -# # Enable a11y support if considered required by -# # profile author for (rare) error message boxes. -# include <abstractions/dbus-accessibility> -# -# # Enable gstreamer support if considered required by -# # profile author for (rare) error message boxes. -# include if exists <abstractions/gstreamer> -# -# # needed for ubuntu-* abstractions -# include <abstractions/ubuntu-helpers> -# -# # Only allow to handle http[s]: and mailto: links -# include <abstractions/ubuntu-browsers> -# include <abstractions/ubuntu-email> -# -# # < add additional allowed applications here > -# } -# ``` - - include <abstractions/base> - - # for opening with `exo-open` - include <abstractions/exo-open> - - # for opening with `gio open <uri>` - include <abstractions/gio-open> - - # for opening with gvfs-open (deprecated) - include <abstractions/gvfs-open> - - # for opening with kde-open5 - include <abstractions/kde-open5> - - # Main executables - - /{,usr/}bin/{b,d}ash mr, - /usr/bin/xdg-open r, - - # Additional executables - - /usr/bin/xdg-mime rix, - /{,usr/}bin/cut rix, # for xdg-mime - /{,usr/}bin/head rix, # for xdg-mime - /{,usr/}bin/sed rix, # for xdg-open - /{,usr/}bin/tr rix, # for xdg-mime - /{,usr/}bin/which rix, # for xdg-open - /{,usr/}bin/{grep,egrep} rix, # for xdg-open - - # System files - - /dev/pts/[0-9]* rw, - /dev/tty w, - /etc/gnome/defaults.list r, # for grep - /usr/share/applications/mimeinfo.cache r, # for grep - /usr/share/terminfo/s/screen r, # for bash on openSUSE - /usr/share/{,*/}applications/{,*.desktop} r, # for xdg-mime - /var/lib/menu-xdg/applications/ r, # for xdg-mime - - # Usr files - - owner @{HOME}/.local/share/applications/{,*.desktop} r, - - # Include additions to the abstraction - include if exists <abstractions/xdg-open.d> diff --git a/straper/db/public/apparmor/apparmor.d/balena-etcher b/straper/db/public/apparmor/apparmor.d/balena-etcher deleted file mode 100644 index 9a55bcd..0000000 --- a/straper/db/public/apparmor/apparmor.d/balena-etcher +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile balena-etcher /usr/lib/balena-etcher/balena-etcher flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/balena-etcher> -} diff --git a/straper/db/public/apparmor/apparmor.d/brave b/straper/db/public/apparmor/apparmor.d/brave deleted file mode 100644 index 4aba1a3..0000000 --- a/straper/db/public/apparmor/apparmor.d/brave +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile brave /opt/brave.com/brave/brave flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/brave> -} diff --git a/straper/db/public/apparmor/apparmor.d/buildah b/straper/db/public/apparmor/apparmor.d/buildah deleted file mode 100644 index 4281dc6..0000000 --- a/straper/db/public/apparmor/apparmor.d/buildah +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile buildah /usr/bin/buildah flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/buildah> -} diff --git a/straper/db/public/apparmor/apparmor.d/busybox b/straper/db/public/apparmor/apparmor.d/busybox deleted file mode 100644 index d726ddf..0000000 --- a/straper/db/public/apparmor/apparmor.d/busybox +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile busybox /usr/bin/busybox flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/busybox> -} diff --git a/straper/db/public/apparmor/apparmor.d/cam b/straper/db/public/apparmor/apparmor.d/cam deleted file mode 100644 index d56c55a..0000000 --- a/straper/db/public/apparmor/apparmor.d/cam +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile cam /usr/bin/cam flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/cam> -} diff --git a/straper/db/public/apparmor/apparmor.d/ch-checkns b/straper/db/public/apparmor/apparmor.d/ch-checkns deleted file mode 100644 index eafb556..0000000 --- a/straper/db/public/apparmor/apparmor.d/ch-checkns +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile ch-checkns /usr/bin/ch-checkns flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/ch-checkns> -} diff --git a/straper/db/public/apparmor/apparmor.d/ch-run b/straper/db/public/apparmor/apparmor.d/ch-run deleted file mode 100644 index 2d20b43..0000000 --- a/straper/db/public/apparmor/apparmor.d/ch-run +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile ch-run /usr/bin/ch-run flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/ch-run> -} diff --git a/straper/db/public/apparmor/apparmor.d/chrome b/straper/db/public/apparmor/apparmor.d/chrome deleted file mode 100644 index 085c198..0000000 --- a/straper/db/public/apparmor/apparmor.d/chrome +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile chrome /opt/google/chrome/chrome flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/chrome> -} diff --git a/straper/db/public/apparmor/apparmor.d/chromium b/straper/db/public/apparmor/apparmor.d/chromium deleted file mode 100644 index 61132bb..0000000 --- a/straper/db/public/apparmor/apparmor.d/chromium +++ /dev/null @@ -1,14 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -@{chromium} = {,ungoogled-}chromium{,-browser} - -profile chromium /usr/lib/@{chromium}/@{chromium} flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/chromium> -} diff --git a/straper/db/public/apparmor/apparmor.d/code b/straper/db/public/apparmor/apparmor.d/code deleted file mode 100644 index d990544..0000000 --- a/straper/db/public/apparmor/apparmor.d/code +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile vscode /usr/share/code{/bin,}/code flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/code> -} diff --git a/straper/db/public/apparmor/apparmor.d/crun b/straper/db/public/apparmor/apparmor.d/crun deleted file mode 100644 index 04c9f4f..0000000 --- a/straper/db/public/apparmor/apparmor.d/crun +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile crun /usr/bin/crun flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/crun> -} diff --git a/straper/db/public/apparmor/apparmor.d/devhelp b/straper/db/public/apparmor/apparmor.d/devhelp deleted file mode 100644 index ed7891a..0000000 --- a/straper/db/public/apparmor/apparmor.d/devhelp +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile devhelp /usr/bin/devhelp flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/devhelp> -} diff --git a/straper/db/public/apparmor/apparmor.d/element-desktop b/straper/db/public/apparmor/apparmor.d/element-desktop deleted file mode 100644 index 937a5b0..0000000 --- a/straper/db/public/apparmor/apparmor.d/element-desktop +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile element-desktop /opt/Element/element-desktop flags=(unconfined) { - userns, - -# Site-specific additions and overrides. See local/README for details. - include if exists <local/element-desktop> -} diff --git a/straper/db/public/apparmor/apparmor.d/epiphany b/straper/db/public/apparmor/apparmor.d/epiphany deleted file mode 100644 index 7a412d2..0000000 --- a/straper/db/public/apparmor/apparmor.d/epiphany +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile epiphany /usr/bin/epiphany{,-browser} flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/epiphany> -} diff --git a/straper/db/public/apparmor/apparmor.d/evolution b/straper/db/public/apparmor/apparmor.d/evolution deleted file mode 100644 index 48b842b..0000000 --- a/straper/db/public/apparmor/apparmor.d/evolution +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile evolution /usr/bin/evolution flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/evolution> -} diff --git a/straper/db/public/apparmor/apparmor.d/firefox b/straper/db/public/apparmor/apparmor.d/firefox deleted file mode 100644 index 4071c34..0000000 --- a/straper/db/public/apparmor/apparmor.d/firefox +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile firefox /{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin} flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/firefox> -} diff --git a/straper/db/public/apparmor/apparmor.d/flatpak b/straper/db/public/apparmor/apparmor.d/flatpak deleted file mode 100644 index 8469784..0000000 --- a/straper/db/public/apparmor/apparmor.d/flatpak +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile flatpak /usr/bin/flatpak flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/flatpak> -} diff --git a/straper/db/public/apparmor/apparmor.d/foliate b/straper/db/public/apparmor/apparmor.d/foliate deleted file mode 100644 index efc3af1..0000000 --- a/straper/db/public/apparmor/apparmor.d/foliate +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile foliate /usr/bin/foliate flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/foliate> -} diff --git a/straper/db/public/apparmor/apparmor.d/geary b/straper/db/public/apparmor/apparmor.d/geary deleted file mode 100644 index 6e65176..0000000 --- a/straper/db/public/apparmor/apparmor.d/geary +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile geary /usr/bin/geary flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/geary> -} diff --git a/straper/db/public/apparmor/apparmor.d/github-desktop b/straper/db/public/apparmor/apparmor.d/github-desktop deleted file mode 100644 index d2c0908..0000000 --- a/straper/db/public/apparmor/apparmor.d/github-desktop +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile github-desktop /usr/lib/github-desktop/github-desktop flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/github-desktop> -} diff --git a/straper/db/public/apparmor/apparmor.d/goldendict b/straper/db/public/apparmor/apparmor.d/goldendict deleted file mode 100644 index bb81eb9..0000000 --- a/straper/db/public/apparmor/apparmor.d/goldendict +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile goldendict /usr/bin/goldendict flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/goldendict> -} diff --git a/straper/db/public/apparmor/apparmor.d/ipa_verify b/straper/db/public/apparmor/apparmor.d/ipa_verify deleted file mode 100644 index c977242..0000000 --- a/straper/db/public/apparmor/apparmor.d/ipa_verify +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile ipa_verify /usr/bin/ipa_verify flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/ipa_verify> -} diff --git a/straper/db/public/apparmor/apparmor.d/kchmviewer b/straper/db/public/apparmor/apparmor.d/kchmviewer deleted file mode 100644 index a604d90..0000000 --- a/straper/db/public/apparmor/apparmor.d/kchmviewer +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile kchmviewer /usr/bin/kchmviewer flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/kchmviewer> -} diff --git a/straper/db/public/apparmor/apparmor.d/keybase b/straper/db/public/apparmor/apparmor.d/keybase deleted file mode 100644 index 1cd646d..0000000 --- a/straper/db/public/apparmor/apparmor.d/keybase +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile keybase /opt/keybase/Keybase flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/keybase> -} diff --git a/straper/db/public/apparmor/apparmor.d/lc-compliance b/straper/db/public/apparmor/apparmor.d/lc-compliance deleted file mode 100644 index e7eb13a..0000000 --- a/straper/db/public/apparmor/apparmor.d/lc-compliance +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lc-compliance /usr/bin/lc-compliance flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lc-compliance> -} diff --git a/straper/db/public/apparmor/apparmor.d/libcamerify b/straper/db/public/apparmor/apparmor.d/libcamerify deleted file mode 100644 index 3751b94..0000000 --- a/straper/db/public/apparmor/apparmor.d/libcamerify +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile libcamerify /usr/bin/libcamerify flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/libcamerify> -} diff --git a/straper/db/public/apparmor/apparmor.d/linux-sandbox b/straper/db/public/apparmor/apparmor.d/linux-sandbox deleted file mode 100644 index 94f365a..0000000 --- a/straper/db/public/apparmor/apparmor.d/linux-sandbox +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile linux-sandbox /usr/libexec/@{multiarch}/bazel/linux-sandbox flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/linux-sandbox> -} diff --git a/straper/db/public/apparmor/apparmor.d/local/README b/straper/db/public/apparmor/apparmor.d/local/README deleted file mode 100644 index 688ed42..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/README +++ /dev/null @@ -1,27 +0,0 @@ -# This directory is intended to contain profile additions and overrides for -# inclusion by distributed profiles to aid in packaging AppArmor for -# distributions. -# -# The shipped profiles in /etc/apparmor.d can still be modified by an -# administrator and people should modify the shipped profile when making -# large policy changes, rather than trying to make those adjustments here. -# -# For simple access additions or the occasional deny override, adjusting them -# here can prevent the package manager of the distribution from interfering -# with local modifications. As always, new policy should be reviewed to ensure -# it is appropriate for your site. -# -# For example, if the shipped /etc/apparmor.d/usr.sbin.smbd profile has: -# include <local/usr.sbin.smbd> -# or -# include if exists <local/usr.sbin.smbd> -# -# then an administrator can adjust /etc/apparmor.d/local/usr.sbin.smbd -# (create the file if it doesn't exist yet) to contain any additional paths -# to be allowed, such as: -# -# /var/exports/** lrwk, -# -# Keep in mind that 'deny' rules are evaluated after allow rules, so you won't -# be able to allow access to files that are explicitly denied by the shipped -# profile using this mechanism. diff --git a/straper/db/public/apparmor/apparmor.d/local/lsb_release b/straper/db/public/apparmor/apparmor.d/local/lsb_release deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/lsb_release +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/nvidia_modprobe b/straper/db/public/apparmor/apparmor.d/local/nvidia_modprobe deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/nvidia_modprobe +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/system_tor b/straper/db/public/apparmor/apparmor.d/local/system_tor deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/system_tor +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/usr.bin.i2pd b/straper/db/public/apparmor/apparmor.d/local/usr.bin.i2pd deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/usr.bin.i2pd +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/usr.bin.man b/straper/db/public/apparmor/apparmor.d/local/usr.bin.man deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/usr.bin.man +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/usr.bin.msmtp b/straper/db/public/apparmor/apparmor.d/local/usr.bin.msmtp deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/usr.bin.msmtp +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/usr.bin.tcpdump b/straper/db/public/apparmor/apparmor.d/local/usr.bin.tcpdump deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/usr.bin.tcpdump +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/usr.sbin.dhclient b/straper/db/public/apparmor/apparmor.d/local/usr.sbin.dhclient deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/usr.sbin.dhclient +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/local/usr.sbin.unbound b/straper/db/public/apparmor/apparmor.d/local/usr.sbin.unbound deleted file mode 100644 index e69de29..0000000 --- a/straper/db/public/apparmor/apparmor.d/local/usr.sbin.unbound +++ /dev/null diff --git a/straper/db/public/apparmor/apparmor.d/loupe b/straper/db/public/apparmor/apparmor.d/loupe deleted file mode 100644 index f1beaac..0000000 --- a/straper/db/public/apparmor/apparmor.d/loupe +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile loupe /usr/bin/loupe flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/loupe> -} diff --git a/straper/db/public/apparmor/apparmor.d/lsb_release b/straper/db/public/apparmor/apparmor.d/lsb_release deleted file mode 100644 index 3f40918..0000000 --- a/straper/db/public/apparmor/apparmor.d/lsb_release +++ /dev/null @@ -1,54 +0,0 @@ -# Note: This profile does not specify an attachment path because it is -# intended to be used only via "Px -> lsb_release" exec transitions from -# other profiles. We want to confine the lsb_release(1) utility when it -# is invoked from other confined applications, but not when it is used -# in regular (unconfined) shell scripts or run directly by the user. - -abi <abi/4.0>, - -include <tunables/global> - -# Do not attach to /usr/bin/lsb_release by default -profile lsb_release { - include <abstractions/base> - include <abstractions/python> - include <abstractions/terminfo> - - owner @{PROC}/@{pid}/fd/ r, - - /dev/tty rw, - - /usr/bin/lsb_release r, - /usr/bin/python3.{1,}[0-9] mr, - - /etc/debian_version r, - /etc/default/apport r, - /etc/dpkg/origins/** r, - /etc/lsb-release r, - /etc/lsb-release.d/ r, - - /{usr/,}bin/bash ixr, - /{usr/,}bin/dash ixr, - /usr/bin/basename ixr, - /usr/bin/dpkg-query ixr, - /usr/bin/cat ixr, - /usr/bin/cut ixr, - /usr/bin/getopt ixr, - /usr/bin/sed ixr, - /usr/bin/tr ixr, - - # TODO - many more permissions needed for this to work - deny /usr/bin/apt-cache x, - - /usr/bin/ r, - /usr/include/python*/pyconfig.h r, - /usr/share/distro-info/** r, - /usr/share/dpkg/** r, - /var/lib/dpkg/** r, - - # file_inherit - deny /tmp/gtalkplugin.log w, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lsb_release> -} diff --git a/straper/db/public/apparmor/apparmor.d/lxc-attach b/straper/db/public/apparmor/apparmor.d/lxc-attach deleted file mode 100644 index f384610..0000000 --- a/straper/db/public/apparmor/apparmor.d/lxc-attach +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lxc-attach /usr/bin/lxc-attach flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lxc-attach> -} diff --git a/straper/db/public/apparmor/apparmor.d/lxc-create b/straper/db/public/apparmor/apparmor.d/lxc-create deleted file mode 100644 index 44c5038..0000000 --- a/straper/db/public/apparmor/apparmor.d/lxc-create +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lxc-create /usr/bin/lxc-create flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lxc-create> -} diff --git a/straper/db/public/apparmor/apparmor.d/lxc-destroy b/straper/db/public/apparmor/apparmor.d/lxc-destroy deleted file mode 100644 index 862b946..0000000 --- a/straper/db/public/apparmor/apparmor.d/lxc-destroy +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lxc-destroy /usr/bin/lxc-destroy flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lxc-destroy> -} diff --git a/straper/db/public/apparmor/apparmor.d/lxc-execute b/straper/db/public/apparmor/apparmor.d/lxc-execute deleted file mode 100644 index 8629fa4..0000000 --- a/straper/db/public/apparmor/apparmor.d/lxc-execute +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lxc-execute /usr/bin/lxc-execute flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lxc-execute> -} diff --git a/straper/db/public/apparmor/apparmor.d/lxc-stop b/straper/db/public/apparmor/apparmor.d/lxc-stop deleted file mode 100644 index cb769df..0000000 --- a/straper/db/public/apparmor/apparmor.d/lxc-stop +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lxc-stop /usr/bin/lxc-stop flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lxc-stop> -} diff --git a/straper/db/public/apparmor/apparmor.d/lxc-unshare b/straper/db/public/apparmor/apparmor.d/lxc-unshare deleted file mode 100644 index 36ca0ea..0000000 --- a/straper/db/public/apparmor/apparmor.d/lxc-unshare +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lxc-unshare /usr/bin/lxc-unshare flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lxc-unshare> -} diff --git a/straper/db/public/apparmor/apparmor.d/lxc-usernsexec b/straper/db/public/apparmor/apparmor.d/lxc-usernsexec deleted file mode 100644 index 4295abc..0000000 --- a/straper/db/public/apparmor/apparmor.d/lxc-usernsexec +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile lxc-usernsexec /usr/bin/lxc-usernsexec flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/lxc-usernsexec> -} diff --git a/straper/db/public/apparmor/apparmor.d/mmdebstrap b/straper/db/public/apparmor/apparmor.d/mmdebstrap deleted file mode 100644 index d7fea3c..0000000 --- a/straper/db/public/apparmor/apparmor.d/mmdebstrap +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile mmdebstrap /usr/bin/mmdebstrap flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/mmdebstrap> -} diff --git a/straper/db/public/apparmor/apparmor.d/msedge b/straper/db/public/apparmor/apparmor.d/msedge deleted file mode 100644 index 0e3a1b3..0000000 --- a/straper/db/public/apparmor/apparmor.d/msedge +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile msedge /opt/microsoft/msedge/msedge flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/msedge> -} diff --git a/straper/db/public/apparmor/apparmor.d/nautilus b/straper/db/public/apparmor/apparmor.d/nautilus deleted file mode 100644 index d4031a0..0000000 --- a/straper/db/public/apparmor/apparmor.d/nautilus +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile nautilus /usr/bin/nautilus flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/nautilus> -} diff --git a/straper/db/public/apparmor/apparmor.d/notepadqq b/straper/db/public/apparmor/apparmor.d/notepadqq deleted file mode 100644 index e1d4160..0000000 --- a/straper/db/public/apparmor/apparmor.d/notepadqq +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile notepadqq /{{usr/bin,etc/alternatives}/notepadqq,usr/lib/notepadqq/notepadqq.sh} flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/notepadqq> -} diff --git a/straper/db/public/apparmor/apparmor.d/nvidia_modprobe b/straper/db/public/apparmor/apparmor.d/nvidia_modprobe deleted file mode 100644 index c9642fd..0000000 --- a/straper/db/public/apparmor/apparmor.d/nvidia_modprobe +++ /dev/null @@ -1,67 +0,0 @@ -# vim:syntax=apparmor - -abi <abi/4.0>, - -include <tunables/global> - -profile nvidia_modprobe { - include <abstractions/base> - - # Capabilities - - capability chown, - capability mknod, - capability setuid, - capability sys_admin, - - # Main executable - - /usr/bin/nvidia-modprobe mr, - - # Other executables - - /usr/bin/kmod Cx -> kmod, - - # System files - - /dev/nvidia-modeset w, - /dev/nvidia-uvm w, - /dev/nvidia-uvm-tools w, - @{sys}/bus/pci/devices/ r, - @{sys}/devices/pci[0-9]*/**/config r, - @{PROC}/devices r, - @{PROC}/driver/nvidia/params r, - @{PROC}/modules r, - @{PROC}/sys/kernel/modprobe r, - - # Child profiles - - profile kmod { - include <abstractions/base> - - # Capabilities - - capability sys_module, - - # Main executable - - /usr/bin/kmod mrix, - - # Other executables - - /{,usr/}bin/{,ba,da}sh ix, - - # System files - - /etc/modprobe.d/{,*.conf} r, - /etc/nvidia/{current,legacy*,tesla*}/*.conf r, - @{sys}/module/ipmi_devintf/initstate r, - @{sys}/module/ipmi_msghandler/initstate r, - @{sys}/module/{drm,nvidia}/initstate r, - @{PROC}/cmdline r, - } - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/nvidia_modprobe> -} - diff --git a/straper/db/public/apparmor/apparmor.d/obsidian b/straper/db/public/apparmor/apparmor.d/obsidian deleted file mode 100644 index 3d6ef7f..0000000 --- a/straper/db/public/apparmor/apparmor.d/obsidian +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile obsidian /opt/Obsidian/obsidian flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/obsidian> -} diff --git a/straper/db/public/apparmor/apparmor.d/opam b/straper/db/public/apparmor/apparmor.d/opam deleted file mode 100644 index b0cd7a6..0000000 --- a/straper/db/public/apparmor/apparmor.d/opam +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile opam /usr/bin/opam flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/opam> -} diff --git a/straper/db/public/apparmor/apparmor.d/opera b/straper/db/public/apparmor/apparmor.d/opera deleted file mode 100644 index cbf88c6..0000000 --- a/straper/db/public/apparmor/apparmor.d/opera +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile opera /usr/lib/@{multiarch}/opera/opera flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/opera> -} diff --git a/straper/db/public/apparmor/apparmor.d/pageedit b/straper/db/public/apparmor/apparmor.d/pageedit deleted file mode 100644 index baa0da7..0000000 --- a/straper/db/public/apparmor/apparmor.d/pageedit +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile pageedit /usr/bin/pageedit flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/pageedit> -} diff --git a/straper/db/public/apparmor/apparmor.d/plasmashell b/straper/db/public/apparmor/apparmor.d/plasmashell deleted file mode 100644 index 43b47e8..0000000 --- a/straper/db/public/apparmor/apparmor.d/plasmashell +++ /dev/null @@ -1,47 +0,0 @@ -abi <abi/4.0>, - -include <tunables/global> - -profile plasmashell /usr/bin/plasmashell flags=(complain) { - include <abstractions/dbus-session> - - capability, - userns, - network, - dbus, - mount, - umount, - remount, - signal, - mqueue, - unix, - ptrace, - - # allow executing QtWebEngineProcess with full permissions including userns (using profile stacking to avoid no_new_privs issues) - /usr/lib/x86_64-linux-gnu/qt[56]/libexec/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess, - /usr/libexec/qt[56]/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess, - - # allow to execute all other programs under their own profile, or to run unconfined - /** pux, - - /{,**} mrwlk, - - profile QtWebEngineProcess flags=(complain) { - capability, - userns, - network, - dbus, - mount, - umount, - remount, - signal, - mqueue, - unix, - ptrace, - /** pux, - /{,**} mrwlk, - } - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/plasmashell> -} diff --git a/straper/db/public/apparmor/apparmor.d/polypane b/straper/db/public/apparmor/apparmor.d/polypane deleted file mode 100644 index ebe60e0..0000000 --- a/straper/db/public/apparmor/apparmor.d/polypane +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile polypane /opt/Polypane/polypane flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/polypane> -} diff --git a/straper/db/public/apparmor/apparmor.d/privacybrowser b/straper/db/public/apparmor/apparmor.d/privacybrowser deleted file mode 100644 index ee010b7..0000000 --- a/straper/db/public/apparmor/apparmor.d/privacybrowser +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile privacybrowser /usr/bin/privacybrowser flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/privacybrowser> -} diff --git a/straper/db/public/apparmor/apparmor.d/qcam b/straper/db/public/apparmor/apparmor.d/qcam deleted file mode 100644 index 5da2f7b..0000000 --- a/straper/db/public/apparmor/apparmor.d/qcam +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile qcam /usr/bin/qcam flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/qcam> -} diff --git a/straper/db/public/apparmor/apparmor.d/qmapshack b/straper/db/public/apparmor/apparmor.d/qmapshack deleted file mode 100644 index 20ffad1..0000000 --- a/straper/db/public/apparmor/apparmor.d/qmapshack +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile qmapshack /usr/bin/qmapshack flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/qmapshack> -} diff --git a/straper/db/public/apparmor/apparmor.d/qutebrowser b/straper/db/public/apparmor/apparmor.d/qutebrowser deleted file mode 100644 index bc92a99..0000000 --- a/straper/db/public/apparmor/apparmor.d/qutebrowser +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile qutebrowser /usr/bin/qutebrowser flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/qutebrowser> -} diff --git a/straper/db/public/apparmor/apparmor.d/rootlesskit b/straper/db/public/apparmor/apparmor.d/rootlesskit deleted file mode 100644 index d5f4ac9..0000000 --- a/straper/db/public/apparmor/apparmor.d/rootlesskit +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile rootlesskit /usr/bin/rootlesskit flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/rootlesskit> -} diff --git a/straper/db/public/apparmor/apparmor.d/rpm b/straper/db/public/apparmor/apparmor.d/rpm deleted file mode 100644 index 04c95a6..0000000 --- a/straper/db/public/apparmor/apparmor.d/rpm +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile rpm /usr/bin/rpm flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/rpm> -} diff --git a/straper/db/public/apparmor/apparmor.d/rssguard b/straper/db/public/apparmor/apparmor.d/rssguard deleted file mode 100644 index 33b7d33..0000000 --- a/straper/db/public/apparmor/apparmor.d/rssguard +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile rssguard /usr/bin/rssguard flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/rssguard> -} diff --git a/straper/db/public/apparmor/apparmor.d/runc b/straper/db/public/apparmor/apparmor.d/runc deleted file mode 100644 index d425495..0000000 --- a/straper/db/public/apparmor/apparmor.d/runc +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile runc /usr/{bin,sbin}/runc flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/runc> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild b/straper/db/public/apparmor/apparmor.d/sbuild deleted file mode 100644 index 53a21a8..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild /usr/bin/sbuild flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - userns, - - # override default pix - /usr/bin/unshare ix, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-abort b/straper/db/public/apparmor/apparmor.d/sbuild-abort deleted file mode 100644 index af88fca..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-abort +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-abort /usr/bin/sbuild-abort flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-abort> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-adduser b/straper/db/public/apparmor/apparmor.d/sbuild-adduser deleted file mode 100644 index 9c8245c..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-adduser +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-adduser /usr/sbin/sbuild-adduser flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-adduser> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-apt b/straper/db/public/apparmor/apparmor.d/sbuild-apt deleted file mode 100644 index 34526a8..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-apt +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-apt /usr/bin/sbuild-apt flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-apt> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-checkpackages b/straper/db/public/apparmor/apparmor.d/sbuild-checkpackages deleted file mode 100644 index 581e412..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-checkpackages +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-checkpackages /usr/bin/sbuild-checkpackages flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-checkpackages> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-clean b/straper/db/public/apparmor/apparmor.d/sbuild-clean deleted file mode 100644 index 4e11939..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-clean +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-clean /usr/bin/sbuild-clean flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-clean> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-createchroot b/straper/db/public/apparmor/apparmor.d/sbuild-createchroot deleted file mode 100644 index 556ea90..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-createchroot +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-createchroot /usr/bin/sbuild-createchroot flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-createchroot> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-destroychroot b/straper/db/public/apparmor/apparmor.d/sbuild-destroychroot deleted file mode 100644 index e7eb77f..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-destroychroot +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-destroychroot /usr/sbin/sbuild-destroychroot flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-destroychroot> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-distupgrade b/straper/db/public/apparmor/apparmor.d/sbuild-distupgrade deleted file mode 100644 index 1faefda..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-distupgrade +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-distupgrade /usr/bin/sbuild-distupgrade flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-distupgrade> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-hold b/straper/db/public/apparmor/apparmor.d/sbuild-hold deleted file mode 100644 index 65d9af7..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-hold +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-hold /usr/bin/sbuild-hold flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-hold> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-shell b/straper/db/public/apparmor/apparmor.d/sbuild-shell deleted file mode 100644 index ea1ac27..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-shell +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-shell /usr/bin/sbuild-shell flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-shell> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-unhold b/straper/db/public/apparmor/apparmor.d/sbuild-unhold deleted file mode 100644 index f6dddf7..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-unhold +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-unhold /usr/bin/sbuild-unhold flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-unhold> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-update b/straper/db/public/apparmor/apparmor.d/sbuild-update deleted file mode 100644 index c4aae72..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-update +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-update /usr/bin/sbuild-update flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-update> -} diff --git a/straper/db/public/apparmor/apparmor.d/sbuild-upgrade b/straper/db/public/apparmor/apparmor.d/sbuild-upgrade deleted file mode 100644 index 0a27241..0000000 --- a/straper/db/public/apparmor/apparmor.d/sbuild-upgrade +++ /dev/null @@ -1,17 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile sbuild-upgrade /usr/bin/sbuild-upgrade flags=(complain,attach_disconnected mediate_deleted) { - allow all, - - # override default pix - /usr/bin/unshare ix, - - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/sbuild-upgrade> -} diff --git a/straper/db/public/apparmor/apparmor.d/scide b/straper/db/public/apparmor/apparmor.d/scide deleted file mode 100644 index 4cbde8b..0000000 --- a/straper/db/public/apparmor/apparmor.d/scide +++ /dev/null @@ -1,13 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -#supercollider-ide -profile scide /usr/bin/scide flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/scide> -} diff --git a/straper/db/public/apparmor/apparmor.d/signal-desktop b/straper/db/public/apparmor/apparmor.d/signal-desktop deleted file mode 100644 index 05738b9..0000000 --- a/straper/db/public/apparmor/apparmor.d/signal-desktop +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile signal-desktop /opt/Signal/signal-desktop flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/signal-desktop> -} diff --git a/straper/db/public/apparmor/apparmor.d/slack b/straper/db/public/apparmor/apparmor.d/slack deleted file mode 100644 index 158b3d3..0000000 --- a/straper/db/public/apparmor/apparmor.d/slack +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile slack /usr/lib/slack/slack flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/slack> -} diff --git a/straper/db/public/apparmor/apparmor.d/slirp4netns b/straper/db/public/apparmor/apparmor.d/slirp4netns deleted file mode 100644 index 014819e..0000000 --- a/straper/db/public/apparmor/apparmor.d/slirp4netns +++ /dev/null @@ -1,16 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile slirp4netns /usr/bin/slirp4netns flags=(unconfined) { - userns, - - # pivot_root is required for running `slirp4netns --enable-sandbox` inside LXD. - # https://github.com/rootless-containers/slirp4netns/issues/348 - pivot_root, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/slirp4netns> -} diff --git a/straper/db/public/apparmor/apparmor.d/steam b/straper/db/public/apparmor/apparmor.d/steam deleted file mode 100644 index ebd06f7..0000000 --- a/straper/db/public/apparmor/apparmor.d/steam +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile steam /usr/{lib/steam/bin_steam.sh,games/steam} flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/steam> -} diff --git a/straper/db/public/apparmor/apparmor.d/stress-ng b/straper/db/public/apparmor/apparmor.d/stress-ng deleted file mode 100644 index 314b815..0000000 --- a/straper/db/public/apparmor/apparmor.d/stress-ng +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile stress-ng /usr/bin/stress-ng flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/stress-ng> -} diff --git a/straper/db/public/apparmor/apparmor.d/surfshark b/straper/db/public/apparmor/apparmor.d/surfshark deleted file mode 100644 index adbd896..0000000 --- a/straper/db/public/apparmor/apparmor.d/surfshark +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile surfshark /opt/Surfshark/surfshark flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/surfshark> -} diff --git a/straper/db/public/apparmor/apparmor.d/system_tor b/straper/db/public/apparmor/apparmor.d/system_tor deleted file mode 100644 index eb13ccd..0000000 --- a/straper/db/public/apparmor/apparmor.d/system_tor +++ /dev/null @@ -1,25 +0,0 @@ -# vim:syntax=apparmor -#include <tunables/global> - -profile system_tor flags=(attach_disconnected) { - #include <abstractions/tor> - - owner /var/lib/tor/** rwk, - owner /var/lib/tor/ r, - owner /var/log/tor/* w, - - # During startup, tor (as root) tries to open various things such as - # directories via check_private_dir(). Let it. - /var/lib/tor/** r, - - /{,var/}run/tor/ r, - /{,var/}run/tor/control w, - /{,var/}run/tor/socks w, - /{,var/}run/tor/tor.pid w, - /{,var/}run/tor/control.authcookie w, - /{,var/}run/tor/control.authcookie.tmp rw, - /{,var/}run/systemd/notify w, - - # Site-specific additions and overrides. See local/README for details. - #include <local/system_tor> -} diff --git a/straper/db/public/apparmor/apparmor.d/systemd-coredump b/straper/db/public/apparmor/apparmor.d/systemd-coredump deleted file mode 100644 index 5b89dcd..0000000 --- a/straper/db/public/apparmor/apparmor.d/systemd-coredump +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile systemd-coredump /usr/lib/systemd/systemd-coredump flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/systemd-coredump> -} diff --git a/straper/db/public/apparmor/apparmor.d/toybox b/straper/db/public/apparmor/apparmor.d/toybox deleted file mode 100644 index e384606..0000000 --- a/straper/db/public/apparmor/apparmor.d/toybox +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile toybox /usr/bin/toybox flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/toybox> -} diff --git a/straper/db/public/apparmor/apparmor.d/transmission b/straper/db/public/apparmor/apparmor.d/transmission deleted file mode 100644 index 5b05af3..0000000 --- a/straper/db/public/apparmor/apparmor.d/transmission +++ /dev/null @@ -1,76 +0,0 @@ -# vim:syntax=apparmor -# Author: Daniel Richard G. <skunk@iSKUNK.ORG> - -abi <abi/4.0>, - -include <tunables/global> - -profile transmission-daemon /usr/bin/transmission-daemon flags=(complain,attach_disconnected) { - # Don't use abstractions/transmission-common here, as the - # access needed is narrower than the user applications - include <abstractions/base> - include <abstractions/nameservice> - include <abstractions/openssl> - - network inet dgram, - network inet6 dgram, - network inet stream, - network inet6 stream, - - owner @{PROC}/@{pid}/mounts r, - @{PROC}/sys/kernel/random/uuid r, - - @{run}/systemd/notify w, - - /etc/transmission-daemon/** r, - owner /etc/transmission-daemon/settings.json{,.tmp.*} rw, - - owner /tmp/tr_session_id_* rwk, - - /usr/share/transmission/web/** r, - - owner /var/lib/transmission-daemon/.config/transmission-daemon/** rw, - owner /var/lib/transmission-daemon/downloads/** rw, - owner /var/lib/transmission-daemon/info/** rw, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/transmission> - include if exists <local/transmission-daemon> -} - -profile transmission-cli /usr/bin/transmission-cli flags=(complain) { - include <abstractions/transmission-common> - include <abstractions/consoles> - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/transmission> - include if exists <local/transmission-cli> -} - -profile transmission-gtk /usr/bin/transmission-gtk flags=(complain,attach_disconnected) { - include <abstractions/transmission-common> - include <abstractions/dbus-session-strict> - include <abstractions/dconf> - include <abstractions/gnome> - - owner @{run}/user/*/dconf/user w, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/transmission> - include if exists <local/transmission-gtk> -} - -profile transmission-qt /usr/bin/transmission-qt flags=(complain) { - include <abstractions/transmission-common> - include <abstractions/dbus-accessibility-strict> - include <abstractions/dbus-network-manager-strict> - include <abstractions/dbus-session-strict> - include <abstractions/fonts> - include <abstractions/X> - include <abstractions/qt5> - include <abstractions/qt5-settings-write> - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/transmission> - include if exists <local/transmission-qt> -} diff --git a/straper/db/public/apparmor/apparmor.d/trinity b/straper/db/public/apparmor/apparmor.d/trinity deleted file mode 100644 index 41e2346..0000000 --- a/straper/db/public/apparmor/apparmor.d/trinity +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile trinity /usr/bin/trinity flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/trinity> -} diff --git a/straper/db/public/apparmor/apparmor.d/tunables/alias b/straper/db/public/apparmor/apparmor.d/tunables/alias deleted file mode 100644 index 15385aa..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/alias +++ /dev/null @@ -1,19 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# Alias rules can be used to rewrite paths and are done after variable -# resolution. For example, if '/usr' is on removable media: -# alias /usr/ -> /mnt/usr/, -# -# Or if mysql databases are stored in /home: -# alias /var/lib/mysql/ -> /home/mysql/, - -# Also, include files in tunables/alias.d for site-specific adjustments -include if exists <tunables/alias.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/apparmorfs b/straper/db/public/apparmor/apparmor.d/tunables/apparmorfs deleted file mode 100644 index ff30e8f..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/apparmorfs +++ /dev/null @@ -1,14 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -include <tunables/securityfs> - -@{apparmorfs}=@{securityfs}/apparmor/ - -# Also, include files in tunables/apparmorfs.d for site-specific adjustments -include if exists <tunables/apparmorfs.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/dovecot b/straper/db/public/apparmor/apparmor.d/tunables/dovecot deleted file mode 100644 index 6779a9a..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/dovecot +++ /dev/null @@ -1,22 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2013 Christian Boltz -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ -# vim:ft=apparmor - -# @{DOVECOT_MAILSTORE} is a space-separated list of all directories -# where dovecot is allowed to store and read mails -# -# The default value is quite broad to avoid breaking existing setups. -# Please change @{DOVECOT_MAILSTORE} to (only) contain the directory -# you use, and remove everything else. - -@{DOVECOT_MAILSTORE}=@{HOME}/Maildir/ @{HOME}/mail/ @{HOME}/Mail/ /var/vmail/ /var/mail/ /var/spool/mail/ - -# Also, include files in tunables/dovecot.d for site-specific adjustments -include if exists <tunables/dovecot.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/etc b/straper/db/public/apparmor/apparmor.d/tunables/etc deleted file mode 100644 index 353cb57..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/etc +++ /dev/null @@ -1,28 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2020 Christian Boltz -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# @{etc_ro} contains a space-separated list of the system configuration directories. -# Traditionally this means /etc/, but when using a read-only / filesystem and/or -# with the goal of having only user-modified config files in /etc/, directories -# like /usr/etc/ get introduced for storing the default config. - -# @{etc_ro} contains directories with configuration files, including read-only directories. -# Do not use @{etc_ro} in rules that allow write access. -@{etc_ro}=/etc/ /usr/etc/ - -# @{etc_rw} contains directories where writing to configuration files is allowed. -# @{etc_rw} should always be a subset of @{etc_ro}. -# -# Only use @{etc_rw} if the profile allows writing to a configuration file. -# For rules that only allows read access, use @{etc_ro}. -@{etc_rw}=/etc/ - -# Also, include files in tunables/etc.d for site-specific adjustments -include if exists <tunables/etc.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/global b/straper/db/public/apparmor/apparmor.d/tunables/global deleted file mode 100644 index 70e8864..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/global +++ /dev/null @@ -1,27 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2006-2009 Novell/SUSE -# Copyright (C) 2010-2014 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# All the tunables definitions that should be available to every profile -# should be included here - -include <tunables/home> -include <tunables/multiarch> -include <tunables/proc> -include <tunables/alias> -include <tunables/kernelvars> -include <tunables/system> -include <tunables/xdg-user-dirs> -include <tunables/share> -include <tunables/etc> -include <tunables/run> - -# Also, include files in tunables/global.d for site-specific adjustments -include if exists <tunables/global.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/home b/straper/db/public/apparmor/apparmor.d/tunables/home deleted file mode 100644 index 468adb3..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/home +++ /dev/null @@ -1,24 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2006-2009 Novell/SUSE -# Copyright (C) 2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# @{HOMEDIRS} is a space-separated list of where user home directories -# are stored, for programs that must enumerate all home directories on a -# system. -@{HOMEDIRS}=/home/ - -# @{HOME} is a space-separated list of all user home directories. While -# it doesn't refer to a specific home directory (AppArmor doesn't -# enforce discretionary access controls) it can be used as if it did -# refer to a specific home directory -@{HOME}=@{HOMEDIRS}/*/ /root/ - -# Also, include files in tunables/home.d for site-specific adjustments -include if exists <tunables/home.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/home.d/site.local b/straper/db/public/apparmor/apparmor.d/tunables/home.d/site.local deleted file mode 100644 index e6796a0..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/home.d/site.local +++ /dev/null @@ -1,13 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2010 Canonical Ltd. -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# The following is a space-separated list of where additional user home -# directories are stored, each must have a trailing '/'. Directories added -# here are appended to @{HOMEDIRS}. See tunables/home for details. Eg: -#@{HOMEDIRS}+=/srv/nfs/home/ /mnt/home/ diff --git a/straper/db/public/apparmor/apparmor.d/tunables/home.d/ubuntu b/straper/db/public/apparmor/apparmor.d/tunables/home.d/ubuntu deleted file mode 100644 index 32db092..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/home.d/ubuntu +++ /dev/null @@ -1,7 +0,0 @@ -# This file is auto-generated. It is recommended you update it using: -# $ sudo dpkg-reconfigure apparmor -# -# The following is a space-separated list of where additional user home -# directories are stored, each must have a trailing '/'. Directories added -# here are appended to @{HOMEDIRS}. See tunables/home for details. -#@{HOMEDIRS}+= diff --git a/straper/db/public/apparmor/apparmor.d/tunables/kernelvars b/straper/db/public/apparmor/apparmor.d/tunables/kernelvars deleted file mode 100644 index 0edd9e0..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/kernelvars +++ /dev/null @@ -1,36 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# This file should contain declarations to kernel vars or variables -# that will become kernel vars at some point - -# until kernel vars are implemented -# and until the parser supports nested groupings like -# @{pid}=[1-9]{[0-9]{[0-9]{[0-9]{[0-9]{[0-9],},},},},} -# use -@{pid}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]} - -#same pattern as @{pid} for now -@{tid}=@{pid} - -#A pattern for pids that can appear -@{pids}=@{pid} - -# Placeholder for user id until kernel var is implemented to match -# current user of the confined application. -# Values are 0...4,294,967,295 (32-bit unsigned, 10 digits). -@{uid}={[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]} - -#same pattern as @{uid} for now -@{uids}=@{uid} - -# until kernel var is implemented -@{sys}=/sys/ - -# Also, include files in tunables/kernelvars.d for site-specific adjustments -include if exists <tunables/kernelvars.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/multiarch b/straper/db/public/apparmor/apparmor.d/tunables/multiarch deleted file mode 100644 index 5075e8d..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/multiarch +++ /dev/null @@ -1,16 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# @{multiarch} is the set of patterns matching multi-arch library -# install prefixes. -@{multiarch}=*-linux-gnu* - -# Also, include files in tunables/multiarch.d for site-specific adjustments -include if exists <tunables/multiarch.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/multiarch.d/site.local b/straper/db/public/apparmor/apparmor.d/tunables/multiarch.d/site.local deleted file mode 100644 index 91877e2..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/multiarch.d/site.local +++ /dev/null @@ -1,14 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2011 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# The following is a space-separated list of where additional multipath -# prefixes are stored, each should not have a trailing '/'. Directories -# added here are appended to @{multiarch}. See tunables/mutliarch for details. Eg: -#@{multiarch}+=*-freebsd* s390-hurd-zomg diff --git a/straper/db/public/apparmor/apparmor.d/tunables/proc b/straper/db/public/apparmor/apparmor.d/tunables/proc deleted file mode 100644 index a0e4b50..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/proc +++ /dev/null @@ -1,15 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2006 Novell/SUSE -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# @{PROC} is the location where procfs is mounted. -@{PROC}=/proc/ - -# Also, include files in tunables/proc.d for site-specific adjustments -include if exists <tunables/proc.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/run b/straper/db/public/apparmor/apparmor.d/tunables/run deleted file mode 100644 index 5a5b97b..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/run +++ /dev/null @@ -1,4 +0,0 @@ -@{run}=/run/ /var/run/ - -# Also, include files in tunables/run.d for site-specific adjustments -include if exists <tunables/run.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/securityfs b/straper/db/public/apparmor/apparmor.d/tunables/securityfs deleted file mode 100644 index 652f92d..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/securityfs +++ /dev/null @@ -1,13 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# @{securityfs} is the location where securityfs is mounted. -@{securityfs}=@{sys}/kernel/security/ - -# Also, include files in tunables/securityfs.d for site-specific adjustments -include if exists <tunables/securityfs.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/share b/straper/db/public/apparmor/apparmor.d/tunables/share deleted file mode 100644 index 8aa5fba..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/share +++ /dev/null @@ -1,18 +0,0 @@ -@{flatpak_exports_root} = {flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export} - -# System-wide directories with behaviour analogous to /usr/share -# in patterns like the freedesktop.org basedir spec. These are -# owned by root or a system user, appear in XDG_DATA_DIRS, and -# are the parent directory for `applications`, `themes`, -# `dbus-1/services`, etc. -@{system_share_dirs} = /{usr,usr/local,var/lib/@{flatpak_exports_root}}/share - -# Per-user/personal directories with behaviour analogous to -# ~/.local/share in patterns like the freedesktop.org basedir spec. -# These are owned by the user running an application, appear in -# XDG_DATA_DIRS or XDG_DATA_HOME, and are the parent directory -# for the same subdirectories as @{system_share_dirs} -@{user_share_dirs} = @{HOME}/.local{,/share/@{flatpak_exports_root}}/share - -# Also, include files in tunables/share.d for site-specific adjustments -include if exists <tunables/share.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/sys b/straper/db/public/apparmor/apparmor.d/tunables/sys deleted file mode 100644 index c5257e3..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/sys +++ /dev/null @@ -1,9 +0,0 @@ -# Copyright (C) 2012 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -#This file is DEPRECATED! @{sys} is defined in tunables/kernelvars now. diff --git a/straper/db/public/apparmor/apparmor.d/tunables/system b/straper/db/public/apparmor/apparmor.d/tunables/system deleted file mode 100644 index 2b5e6cc..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/system +++ /dev/null @@ -1,99 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# Any digit -@{d}=[0-9] - -# Any letter -@{l}=[a-zA-Z] - -# Single alphanumeric character -@{c}=[0-9a-zA-Z] - -# Word character: matches any letter, digit or underscore. -@{w}=[a-zA-Z0-9_] - -# Single hexadecimal character -@{h}=[0-9a-fA-F] - -# Integer up to 10 digits (0-9999999999) -@{int}=@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},} - -# hexadecimal, alphanumeric and word up to 64 characters -@{hex}=@{h}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},}{@{h},} -@{rand}=@{c}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},}{@{c},} -@{word}=@{w}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},}{@{w},} - -# Unsigned integer over 8 bits (0...255) -@{u8}=[0-9]{[0-9],} 1[0-9][0-9] 2[0-4][0-9] 25[0-5] - -# Unsigned integer over 16 bits (0...65,535 5 digits) -@{u16}={@{d},[1-9]@{d},[1-9][@{d}@{d},[1-9]@{d}@{d}@{d},[1-6]@{d}@{d}@{d}@{d}} - -# Unsigned integer over 32 bits (0...4,294,967,295 10 digits) -@{u32}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-4]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} - -# Unsigned integer over 64 bits (0...18,446,744,073,709,551,615 20 digits). -@{u64}={@{d},[1-9]@{d},[1-9]@{d}@{d},[1-9]@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},[1-9]@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d},1@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}@{d}} - -# Any x digits characters -@{int2}=@{d}@{d} -@{int4}=@{int2}@{int2} -@{int6}=@{int4}@{int2} -@{int8}=@{int4}@{int4} -@{int9}=@{int8}@{d} -@{int10}=@{int8}@{int2} -@{int12}=@{int8}@{int4} -@{int15}=@{int8}@{int4}@{int2}@{d} -@{int16}=@{int8}@{int8} -@{int32}=@{int16}@{int16} -@{int64}=@{int32}@{int32} - -# Any x hexadecimal characters -@{hex2}=@{h}@{h} -@{hex4}=@{hex2}@{hex2} -@{hex6}=@{hex4}@{hex2} -@{hex8}=@{hex4}@{hex4} -@{hex9}=@{hex8}@{h} -@{hex10}=@{hex8}@{hex2} -@{hex12}=@{hex8}@{hex4} -@{hex15}=@{hex8}@{hex4}@{hex2}@{h} -@{hex16}=@{hex8}@{hex8} -@{hex32}=@{hex16}@{hex16} -@{hex38}=@{hex32}@{hex6} -@{hex64}=@{hex32}@{hex32} - -# Any x alphanumeric characters -@{rand2}=@{c}@{c} -@{rand4}=@{rand2}@{rand2} -@{rand6}=@{rand4}@{rand2} -@{rand8}=@{rand4}@{rand4} -@{rand9}=@{rand8}@{c} -@{rand10}=@{rand8}@{rand2} -@{rand12}=@{rand8}@{rand4} -@{rand15}=@{rand8}@{rand4}@{rand2}@{c} -@{rand16}=@{rand8}@{rand8} -@{rand32}=@{rand16}@{rand16} -@{rand64}=@{rand32}@{rand32} - -# Any x word characters -@{word2}=@{w}@{w} -@{word4}=@{word2}@{word2} -@{word6}=@{word4}@{word2} -@{word8}=@{word4}@{word4} -@{word9}=@{word8}@{w} -@{word10}=@{word8}@{word2} -@{word12}=@{word8}@{word4} -@{word15}=@{word8}@{word4}@{word2}@{w} -@{word16}=@{word8}@{word8} -@{word32}=@{word16}@{word16} -@{word64}=@{word32}@{word32} - -include if exists <tunables/system.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/xdg-user-dirs b/straper/db/public/apparmor/apparmor.d/tunables/xdg-user-dirs deleted file mode 100644 index a73f4d7..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/xdg-user-dirs +++ /dev/null @@ -1,23 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2014 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# Define the common set of XDG user directories (usually defined in -# /etc/xdg/user-dirs.defaults) -@{XDG_DESKTOP_DIR}="Desktop" -@{XDG_DOWNLOAD_DIR}="Downloads" -@{XDG_TEMPLATES_DIR}="Templates" -@{XDG_PUBLICSHARE_DIR}="Public" -@{XDG_DOCUMENTS_DIR}="Documents" -@{XDG_MUSIC_DIR}="Music" -@{XDG_PICTURES_DIR}="Pictures" -@{XDG_VIDEOS_DIR}="Videos" - -# Also, include files in tunables/xdg-user-dirs.d for site-specific adjustments -include if exists <tunables/xdg-user-dirs.d> diff --git a/straper/db/public/apparmor/apparmor.d/tunables/xdg-user-dirs.d/site.local b/straper/db/public/apparmor/apparmor.d/tunables/xdg-user-dirs.d/site.local deleted file mode 100644 index 8fcabfa..0000000 --- a/straper/db/public/apparmor/apparmor.d/tunables/xdg-user-dirs.d/site.local +++ /dev/null @@ -1,21 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2014 Canonical Ltd. -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -# The following may be used to add additional entries such as for -# translations. See tunables/xdg-user-dirs for details. Eg: -#@{XDG_MUSIC_DIR}+="Musique" - -#@{XDG_DESKTOP_DIR}+="" -#@{XDG_DOWNLOAD_DIR}+="" -#@{XDG_TEMPLATES_DIR}+="" -#@{XDG_PUBLICSHARE_DIR}+="" -#@{XDG_DOCUMENTS_DIR}+="" -#@{XDG_MUSIC_DIR}+="" -#@{XDG_PICTURES_DIR}+="" -#@{XDG_VIDEOS_DIR}+="" diff --git a/straper/db/public/apparmor/apparmor.d/tup b/straper/db/public/apparmor/apparmor.d/tup deleted file mode 100644 index 482a0d3..0000000 --- a/straper/db/public/apparmor/apparmor.d/tup +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile tup /usr/bin/tup flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/tup> -} diff --git a/straper/db/public/apparmor/apparmor.d/tuxedo-control-center b/straper/db/public/apparmor/apparmor.d/tuxedo-control-center deleted file mode 100644 index d64c762..0000000 --- a/straper/db/public/apparmor/apparmor.d/tuxedo-control-center +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label unconfined - -abi <abi/4.0>, -include <tunables/global> - -profile tuxedo-control-center /opt/tuxedo-control-center/tuxedo-control-center flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/tuxedo-control-center> -} diff --git a/straper/db/public/apparmor/apparmor.d/unix-chkpwd b/straper/db/public/apparmor/apparmor.d/unix-chkpwd deleted file mode 100644 index a338a5f..0000000 --- a/straper/db/public/apparmor/apparmor.d/unix-chkpwd +++ /dev/null @@ -1,35 +0,0 @@ -# apparmor.d - Full set of apparmor profiles -# Copyright (C) 2019-2021 Mikhail Morfikov -# SPDX-License-Identifier: GPL-2.0-only - -# The apparmor.d project comes with several variables and abstractions -# that are not part of upstream AppArmor yet. Therefore this profile was -# adopted to use abstractions and variables that are available. -# Copyright (C) Christian Boltz 2024 - -abi <abi/4.0>, - -include <tunables/global> - -profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd flags=(complain) { - include <abstractions/base> - include <abstractions/nameservice> - - # To write records to the kernel auditing log. - capability audit_write, - - network netlink raw, - - /{,usr/}{,s}bin/unix_chkpwd mr, - - /etc/shadow r, - - # systemd userdb, used in nspawn - /run/host/userdb/*.user r, - /run/host/userdb/*.user-privileged r, - - # file_inherit - owner /dev/tty[0-9]* rw, - - include if exists <local/unix-chkpwd> -} diff --git a/straper/db/public/apparmor/apparmor.d/unprivileged_userns b/straper/db/public/apparmor/apparmor.d/unprivileged_userns deleted file mode 100644 index bac3f26..0000000 --- a/straper/db/public/apparmor/apparmor.d/unprivileged_userns +++ /dev/null @@ -1,27 +0,0 @@ -# Special profile transitioned to by unconfined when creating an unprivileged -# user namespace. -# -abi <abi/4.0>, -include <tunables/global> - -profile unprivileged_userns flags=(complain) { - audit deny capability, - audit deny change_profile, - - # allow block to be replaced by allow when x dominance test is fixed - #allow all, - allow network, - allow signal, - allow dbus, - allow file rwlkm /**, - allow unix, - allow mqueue, - allow ptrace, - allow userns, - - # stack children to strip capabilities - allow pix /** -> &unprivileged_userns , - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/unprivileged_userns> -} diff --git a/straper/db/public/apparmor/apparmor.d/userbindmount b/straper/db/public/apparmor/apparmor.d/userbindmount deleted file mode 100644 index 406f494..0000000 --- a/straper/db/public/apparmor/apparmor.d/userbindmount +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile userbindmount /usr/bin/userbindmount flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/userbindmount> -} diff --git a/straper/db/public/apparmor/apparmor.d/usr.bin.i2pd b/straper/db/public/apparmor/apparmor.d/usr.bin.i2pd deleted file mode 100644 index 4d370f3..0000000 --- a/straper/db/public/apparmor/apparmor.d/usr.bin.i2pd +++ /dev/null @@ -1,25 +0,0 @@ -# Basic profile for i2pd -# Should work without modifications with Ubuntu/Debian packages -# Author: Darknet Villain <supervillain@riseup.net> -# -#include <tunables/global> - -profile i2pd /{usr/,}bin/i2pd { - #include <abstractions/base> - #include <abstractions/openssl> - #include <abstractions/nameservice> - - # path specific (feel free to modify if you have another paths) - /etc/i2pd/** r, - /var/lib/i2pd/** rw, - /var/log/i2pd/i2pd.log w, - /{var/,}run/i2pd/i2pd.pid rwk, - /{usr/,}bin/i2pd mr, - @{system_share_dirs}/i2pd/** r, - - # user homedir (if started not by init.d or systemd) - owner @{HOME}/.i2pd/ rw, - owner @{HOME}/.i2pd/** rwk, - - #include if exists <local/usr.bin.i2pd> -} diff --git a/straper/db/public/apparmor/apparmor.d/usr.bin.man b/straper/db/public/apparmor/apparmor.d/usr.bin.man deleted file mode 100644 index b6cd0be..0000000 --- a/straper/db/public/apparmor/apparmor.d/usr.bin.man +++ /dev/null @@ -1,113 +0,0 @@ -# vim:syntax=apparmor - -#include <tunables/global> - -/usr/bin/man { - #include <abstractions/base> - - # Use a special profile when man calls anything groff-related. We only - # include the programs that actually parse input data in a non-trivial - # way, not wrappers such as groff and nroff, since the latter would need a - # broader profile. - /usr/bin/eqn rmCx -> &man_groff, - /usr/bin/grap rmCx -> &man_groff, - /usr/bin/pic rmCx -> &man_groff, - /usr/bin/preconv rmCx -> &man_groff, - /usr/bin/refer rmCx -> &man_groff, - /usr/bin/tbl rmCx -> &man_groff, - /usr/bin/troff rmCx -> &man_groff, - /usr/bin/vgrind rmCx -> &man_groff, - - # Similarly, use a special profile when man calls decompressors and other - # simple filters. - /{,usr/}bin/bzip2 rmCx -> &man_filter, - /{,usr/}bin/gzip rmCx -> &man_filter, - /usr/bin/col rmCx -> &man_filter, - /usr/bin/compress rmCx -> &man_filter, - /usr/bin/iconv rmCx -> &man_filter, - /usr/bin/lzip.lzip rmCx -> &man_filter, - /usr/bin/tr rmCx -> &man_filter, - /usr/bin/xz rmCx -> &man_filter, - - # Allow basically anything in terms of file system access, subject to DAC. - # The purpose of this profile isn't to confine man itself (that might be - # nice in the future, but is tricky since it's quite configurable), but to - # confine the processes it calls that parse untrusted data. - /** mrixwlk, - unix, - - capability setuid, - capability setgid, - - # Ordinary permission checks sometimes involve checking whether the - # process has this capability, which can produce audit log messages. - # Silence them. - deny capability dac_override, - deny capability dac_read_search, - - signal peer=@{profile_name}, - signal peer=/usr/bin/man//&man_groff, - signal peer=/usr/bin/man//&man_filter, - - # Site-specific additions and overrides. See local/README for details. - #include <local/usr.bin.man> -} - -profile man_groff { - #include <abstractions/base> - # Recent kernels revalidate open FDs, and there are often some still - # open on TTYs. This is temporary until man learns to close irrelevant - # open FDs before execve. - #include <abstractions/consoles> - # man always runs its groff pipeline with the input file open on stdin, - # so we can skip <abstractions/user-manpages>. - - /usr/bin/eqn rm, - /usr/bin/grap rm, - /usr/bin/pic rm, - /usr/bin/preconv rm, - /usr/bin/refer rm, - /usr/bin/tbl rm, - /usr/bin/troff rm, - /usr/bin/vgrind rm, - - /etc/groff/** r, - /etc/papersize r, - /usr/lib/groff/site-tmac/** r, - /usr/share/groff/** r, - - /tmp/groff* rw, - - signal peer=/usr/bin/man, - # @{profile_name} doesn't seem to work here. - signal peer=/usr/bin/man//&man_groff, -} - -profile man_filter { - #include <abstractions/base> - # Recent kernels revalidate open FDs, and there are often some still - # open on TTYs. This is temporary until man learns to close irrelevant - # open FDs before execve. - #include <abstractions/consoles> - - /{,usr/}bin/bzip2 rm, - /{,usr/}bin/gzip rm, - /usr/bin/col rm, - /usr/bin/compress rm, - /usr/bin/iconv rm, - /usr/bin/lzip.lzip rm, - /usr/bin/tr rm, - /usr/bin/xz rm, - - # Manual pages can be more or less anywhere, especially with "man -l", and - # there's no harm in allowing wide read access here since the worst it can - # do is feed data to the invoking man process. - /** r, - - # Allow writing cat pages. - /var/cache/man/** w, - - signal peer=/usr/bin/man, - # @{profile_name} doesn't seem to work here. - signal peer=/usr/bin/man//&man_filter, -} diff --git a/straper/db/public/apparmor/apparmor.d/usr.bin.msmtp b/straper/db/public/apparmor/apparmor.d/usr.bin.msmtp deleted file mode 100644 index e47f209..0000000 --- a/straper/db/public/apparmor/apparmor.d/usr.bin.msmtp +++ /dev/null @@ -1,86 +0,0 @@ -# Author: Simon Deziel <simon@sdeziel.info> - -#include <tunables/global> - -profile msmtp /usr/bin/msmtp flags=(attach_disconnected) { - #include <abstractions/base> - #include <abstractions/dbus-session-strict> - #include <abstractions/nameservice> - #include <abstractions/p11-kit> - #include <abstractions/ssl_certs> - #include <abstractions/ssl_keys> - #include <abstractions/kerberosclient> - - /usr/bin/msmtp mr, - /etc/aliases r, - /etc/msmtprc r, - /etc/mailname r, - /etc/netrc r, - owner @{HOME}/.msmtp* r, - owner @{HOME}/.netrc r, - owner @{HOME}/.tls-crls r, - - owner @{HOME}/.msmtp*.log wk, - /var/log/msmtp wk, - - owner @{HOME}/**/*msmtprc r, - owner @{HOME}/.config/msmtp/* r, - owner @{HOME}/.cache/msmtp/* r, - owner @{HOME}/.cache/msmtp/*.log wk, - - @{PROC}/@{pid}/loginuid r, - /tmp/ rw, - owner /tmp/* rw, - - # kerberos related - /tmp/{,.}krb5cc_* rwk, - /etc/gss/mech.d/ r, - /etc/gss/mech.d/** r, - - # to type password interactively - /dev/tty rw, - owner /dev/pts/[0-9]* rw, - - dbus send - bus=session - path=/org/freedesktop/secrets - interface=org.freedesktop.Secret.Service, - dbus receive - bus=session - path=/org/freedesktop/secrets - interface=org.freedesktop.Secret.Service, - dbus send - bus=session - path=/org/freedesktop/secrets/prompt/* - interface=org.freedesktop.Secret.Prompt, - dbus receive - bus=session - path=/org/freedesktop/secrets/prompt/* - interface=org.freedesktop.Secret.Prompt, - dbus send - bus=session - path=/org/freedesktop/secrets - interface=org.freedesktop.DBus.Properties - member=GetAll, - - # secret helpers - /{,usr/}bin/bash Cx -> helpers, - /{,usr/}bin/dash Cx -> helpers, - profile helpers { - #include <abstractions/base> - /{,usr/}bin/bash mr, - /{,usr/}bin/dash mr, - /tmp/ rw, - owner /tmp/* rw, - - /usr/bin/secret-tool PUx, - /usr/bin/gpg{,2} PUx, - /usr/bin/pass PUx, - /usr/bin/head PUx, - /usr/bin/keyring PUx, - /{,usr/}bin/cat PUx, - /usr/bin/oauth2get PUx, - } - - #include <local/usr.bin.msmtp> -} diff --git a/straper/db/public/apparmor/apparmor.d/usr.bin.tcpdump b/straper/db/public/apparmor/apparmor.d/usr.bin.tcpdump deleted file mode 100644 index 510a5ad..0000000 --- a/straper/db/public/apparmor/apparmor.d/usr.bin.tcpdump +++ /dev/null @@ -1,71 +0,0 @@ -# vim:syntax=apparmor -#include <tunables/global> - -profile tcpdump /usr/bin/tcpdump { - #include <abstractions/base> - #include <abstractions/nameservice> - #include <abstractions/user-tmp> - - capability net_raw, - capability setuid, - capability setgid, - capability dac_override, - capability chown, - network raw, - network packet, - - # for -D - @{PROC}/bus/usb/ r, - @{PROC}/bus/usb/** r, - - # for finding an interface - /dev/ r, - @{PROC}/[0-9]*/net/dev r, - /sys/bus/usb/devices/ r, - /sys/class/net/ r, - /sys/devices/**/net/** r, - - # for -j - capability net_admin, - - # for tracing USB bus, which libpcap supports - /dev/usbmon* r, - /dev/bus/usb/ r, - /dev/bus/usb/** r, - - # for init_etherarray(), with -e - /etc/ethers r, - - # for USB probing (see libpcap-1.1.x/pcap-usb-linux.c:probe_devices()) - /dev/bus/usb/**/[0-9]* w, - - # for -z - /{usr/,}bin/gzip ixr, - /{usr/,}bin/bzip2 ixr, - - # for -F and -w - audit deny @{HOME}/.* mrwkl, - audit deny @{HOME}/.*/ rw, - audit deny @{HOME}/.*/** mrwkl, - audit deny @{HOME}/bin/ rw, - audit deny @{HOME}/bin/** mrwkl, - owner @{HOME}/ r, - owner @{HOME}/** rw, - - # for -r, -F and -w - /**.[pP][cC][aA][pP] rw, - /**.[pP][cC][aA][pP][nN][gG] rw, - /**.[cC][aA][pP] rw, - # -W adds a numerical suffix - /**.[pP][cC][aA][pP][0-9]* rw, - /**.[pP][cC][aA][pP][nN][gG][0-9]* rw, - /**.[cC][aA][pP][0-9]* rw, - - # for convenience with -r (ie, read pcap files from other sources) - /var/log/snort/*log* r, - - /usr/bin/tcpdump mr, - - # Site-specific additions and overrides. See local/README for details. - #include <local/usr.bin.tcpdump> -} diff --git a/straper/db/public/apparmor/apparmor.d/usr.sbin.dhclient b/straper/db/public/apparmor/apparmor.d/usr.sbin.dhclient deleted file mode 100644 index 7547353..0000000 --- a/straper/db/public/apparmor/apparmor.d/usr.sbin.dhclient +++ /dev/null @@ -1,113 +0,0 @@ -# vim:syntax=apparmor -#include <tunables/global> - -/{,usr/}sbin/dhclient flags=(attach_disconnected) { - #include <abstractions/base> - #include <abstractions/nameservice> - #include <abstractions/openssl> - - capability net_bind_service, - capability net_raw, - capability dac_override, - capability net_admin, - - network packet, - network raw, - - @{PROC}/[0-9]*/net/ r, - @{PROC}/[0-9]*/net/** r, - - # dhclient wants to update its threads with functional names - # https://gitlab.com/apparmor/apparmor/-/merge_requests/730 - # see LP: #1918410 - owner @{PROC}/@{pid}/task/[0-9]*/comm rw, - - /{,usr/}sbin/dhclient mr, - # LP: #1197484 and LP: #1202203 - why is this needed? :( - /{,usr/}bin/bash mr, - - /etc/dhclient.conf r, - /etc/dhcp/ r, - /etc/dhcp/** r, - - /var/lib/dhcp{,3}/dhclient* lrw, - /{,var/}run/dhclient*.pid lrw, - /{,var/}run/dhclient*.lease* lrw, - - # NetworkManager - /{,var/}run/nm*conf r, - /{,var/}run/sendsigs.omit.d/network-manager.dhclient*.pid lrw, - /{,var/}run/NetworkManager/dhclient*.pid lrw, - /var/lib/NetworkManager/dhclient*.conf lrw, - /var/lib/NetworkManager/dhclient*.lease* lrw, - signal (receive) peer=/usr/sbin/NetworkManager, - ptrace (readby) peer=/usr/sbin/NetworkManager, - - # connman - /{,var/}run/connman/dhclient*.pid lrw, - /{,var/}run/connman/dhclient*.leases lrw, - - # synce-hal - /usr/share/synce-hal/dhclient.conf r, - - # if there is a custom script, let it run unconfined - /etc/dhcp/dhclient-script Uxr, - - # The dhclient-script shell script sources other shell scripts rather than - # executing them, so we can't just use a separate profile for dhclient-script - # with 'Uxr' on the hook scripts. However, for the long-running dhclient3 - # daemon to run arbitrary code via /sbin/dhclient-script, it would need to be - # able to subvert dhclient-script or write to the hooks.d directories. As - # such, if the dhclient3 daemon is subverted, this effectively limits it to - # only being able to run the hooks scripts. - /{,usr/}sbin/dhclient-script Uxr, - - # Run the ELF executables under their own unrestricted profiles - /usr/lib/NetworkManager/nm-dhcp-client.action Pxrm, - /usr/lib/connman/scripts/dhclient-script Pxrm, - - # Support the new executable helper from NetworkManager. - /usr/lib/NetworkManager/nm-dhcp-helper Pxrm, - signal (receive) peer=/usr/lib/NetworkManager/nm-dhcp-helper, - /usr/libexec/nm-dhcp-helper Pxrm, - signal (receive) peer=/usr/libexec/nm-dhcp-helper, - - # Site-specific additions and overrides. See local/README for details. - #include <local/usr.sbin.dhclient> -} - -/usr/lib/NetworkManager/nm-dhcp-client.action { - #include <abstractions/base> - #include <abstractions/dbus> - /usr/lib/NetworkManager/nm-dhcp-client.action mr, - - /var/lib/NetworkManager/*lease r, - signal (receive) peer=/usr/sbin/NetworkManager, - ptrace (readby) peer=/usr/sbin/NetworkManager, - network inet dgram, - network inet6 dgram, -} - -/usr/{lib/NetworkManager,libexec}/nm-dhcp-helper { - #include <abstractions/base> - #include <abstractions/dbus> - /usr/{lib/NetworkManager,libexec}/nm-dhcp-helper mr, - - /run/NetworkManager/private-dhcp rw, - signal (send) peer=/sbin/dhclient, - - /var/lib/NetworkManager/*lease r, - signal (receive) peer=/usr/sbin/NetworkManager, - ptrace (readby) peer=/usr/sbin/NetworkManager, - network inet dgram, - network inet6 dgram, -} - -/usr/lib/connman/scripts/dhclient-script { - #include <abstractions/base> - #include <abstractions/dbus> - /usr/lib/connman/scripts/dhclient-script mr, - network inet dgram, - network inet6 dgram, -} - diff --git a/straper/db/public/apparmor/apparmor.d/usr.sbin.mariadbd b/straper/db/public/apparmor/apparmor.d/usr.sbin.mariadbd deleted file mode 100644 index b1f229b..0000000 --- a/straper/db/public/apparmor/apparmor.d/usr.sbin.mariadbd +++ /dev/null @@ -1,15 +0,0 @@ -# This file is intentionally empty to disable apparmor by default for newer -# versions of MariaDB, while providing seamless upgrade from older versions -# and from mysql, where apparmor is used. -# -# By default, we do not want to have any apparmor profile for the MariaDB -# server. It does not provide much useful functionality/security, and causes -# several problems for users who often are not even aware that apparmor -# exists and runs on their system. -# -# Users can modify and maintain their own profile, and in this case it will -# be used. -# -# When upgrading from previous version, users who modified the profile -# will be prompted to keep or discard it, while for default installs -# we will automatically disable the profile. diff --git a/straper/db/public/apparmor/apparmor.d/usr.sbin.unbound b/straper/db/public/apparmor/apparmor.d/usr.sbin.unbound deleted file mode 100644 index 551bfc8..0000000 --- a/straper/db/public/apparmor/apparmor.d/usr.sbin.unbound +++ /dev/null @@ -1,56 +0,0 @@ -# Author: Simon Deziel -# vim:syntax=apparmor -#include <tunables/global> - -profile unbound /usr/sbin/unbound flags=(attach_disconnected) { - #include <abstractions/base> - #include <abstractions/nameservice> - #include <abstractions/openssl> - - # chown (chgrp) the Unix control socket - capability chown, - # chmod the Unix control socket - capability fowner, - capability fsetid, - - # added to abstractions/nameservices in Apparmor 2.12 - /var/lib/sss/mc/initgroups r, - - capability net_bind_service, - capability setgid, - capability setuid, - capability sys_chroot, - capability sys_resource, - - # root hints from dns-data-root - /usr/share/dns/root.* r, - - # non-chrooted paths - /etc/unbound/** r, - owner /etc/unbound/*.key* rw, - # explicitly deny (and audit) attempts to write to the key files - # this should be unnecessary after switch to /run/unbound.ctl control socket - # (here and below) - audit deny /etc/unbound/unbound_control.{key,pem} rw, - audit deny /etc/unbound/unbound_server.key w, - - # chrooted paths - # unbound can be chrooted into /etc/unbound (upstream default) with - # /var/lib/unbound/ bind-mounted to /etc/unbound/var/lib/unbound/, - # or it can be chrooted into /var/lib/unbound/ with /etc/unbound/ copied - # into there (previous debian package default). - /{,etc/unbound/}var/lib/unbound/** r, - owner /{,etc/unbound/}var/lib/unbound/** rw, - audit deny /{,etc/unbound/}var/lib/unbound/**/unbound_control.{key,pem} rw, - audit deny /{,etc/unbound/}var/lib/unbound/**/unbound_server.key w, - - /usr/sbin/unbound mr, - - /run/systemd/notify w, - /run/unbound.pid rw, - - # Unix control socket - /run/unbound.ctl rw, - - #include <local/usr.sbin.unbound> -} diff --git a/straper/db/public/apparmor/apparmor.d/uwsgi-core b/straper/db/public/apparmor/apparmor.d/uwsgi-core deleted file mode 100644 index 0ffcca5..0000000 --- a/straper/db/public/apparmor/apparmor.d/uwsgi-core +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile uwsgi-core /usr/bin/uwsgi-core flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/uwsgi-core> -} diff --git a/straper/db/public/apparmor/apparmor.d/vdens b/straper/db/public/apparmor/apparmor.d/vdens deleted file mode 100644 index 643b295..0000000 --- a/straper/db/public/apparmor/apparmor.d/vdens +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile vdens /usr/bin/vdens flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/vdens> -} diff --git a/straper/db/public/apparmor/apparmor.d/virtiofsd b/straper/db/public/apparmor/apparmor.d/virtiofsd deleted file mode 100644 index 380a840..0000000 --- a/straper/db/public/apparmor/apparmor.d/virtiofsd +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile virtiofsd /usr/libexec/virtiofsd flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/virtiofsd> -} diff --git a/straper/db/public/apparmor/apparmor.d/vivaldi-bin b/straper/db/public/apparmor/apparmor.d/vivaldi-bin deleted file mode 100644 index 200c567..0000000 --- a/straper/db/public/apparmor/apparmor.d/vivaldi-bin +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile vivaldi-bin /opt/vivaldi/vivaldi-bin flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/vivaldi-bin> -} diff --git a/straper/db/public/apparmor/apparmor.d/vpnns b/straper/db/public/apparmor/apparmor.d/vpnns deleted file mode 100644 index 8fea237..0000000 --- a/straper/db/public/apparmor/apparmor.d/vpnns +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile vpnns /usr/bin/vpnns flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/vpnns> -} diff --git a/straper/db/public/apparmor/apparmor.d/wike b/straper/db/public/apparmor/apparmor.d/wike deleted file mode 100644 index 5abb253..0000000 --- a/straper/db/public/apparmor/apparmor.d/wike +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile wike /usr/bin/wike flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/wike> -} diff --git a/straper/db/public/apparmor/apparmor.d/wpcom b/straper/db/public/apparmor/apparmor.d/wpcom deleted file mode 100644 index 301f37b..0000000 --- a/straper/db/public/apparmor/apparmor.d/wpcom +++ /dev/null @@ -1,12 +0,0 @@ -# This profile allows everything and only exists to give the -# application a name instead of having the label "unconfined" - -abi <abi/4.0>, -include <tunables/global> - -profile wpcom /opt/WordPress.com/wpcom flags=(unconfined) { - userns, - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/wpcom> -} |