1 files changed, 30 insertions, 0 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict b/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict
new file mode 100644
index 0000000..28d3ab1
--- /dev/null
+++ b/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict
@@ -0,0 +1,30 @@
+# vim:syntax=apparmor
+# privacy-violations-strict contains additional rules for sensitive
+# files that you want to explicitly deny access
+
+  abi <abi/4.0>,
+
+  include <abstractions/private-files>
+
+  # potentially extremely sensitive files
+  audit deny @{HOME}/.aws/{,**} mrwkl,
+  audit deny @{HOME}/.gnupg/{,**} mrwkl,
+  audit deny @{HOME}/.ssh/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
+  audit deny @{HOME}/.gnome2/ w,
+  audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl,
+  # don't allow access to any gnome-keyring modules
+  audit deny @{run}/user/[0-9]*/keyring** mrwkl,
+  audit deny @{HOME}/.mozilla/{,**} mrwkl,
+  audit deny @{HOME}/.config/ w,
+  audit deny @{HOME}/.config/chromium/{,**} mrwkl,
+  audit deny @{HOME}/.config/evolution/{,**} mrwkl,
+  audit deny @{HOME}/.evolution/{,**} mrwkl,
+  audit deny @{HOME}/.{,mozilla-}thunderbird/{,**} mrwkl,
+  audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w,
+  audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/{,**} mrwkl,
+  audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl,
+  audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/private-files-strict.d>