diff options
Diffstat (limited to 'straper/db/public/apparmor/apparmor.d/abstractions')
135 files changed, 4922 insertions, 0 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/X b/straper/db/public/apparmor/apparmor.d/abstractions/X new file mode 100644 index 0000000..6df8911 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/X @@ -0,0 +1,67 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + include <abstractions/dri-common> + + + # .ICEauthority files required for X authentication, per user + owner @{HOME}/.ICEauthority r, + owner @{run}/user/*/ICEauthority r, + + # .Xauthority files required for X connections, per user + owner @{HOME}/.Xauthority r, + owner @{HOME}/.local/share/sddm/.Xauthority r, + owner @{run}/gdm{,3}/*/database r, + owner @{run}/lightdm/authority/[0-9]* r, + owner @{run}/lightdm/*/xauthority r, + owner @{run}/user/*/gdm/Xauthority r, + owner @{run}/user/*/X11/Xauthority r, + owner @{run}/user/*/xauth_* r, + owner /tmp/xauth_?????? r, + + # the unix socket to use to connect to the display + /tmp/.X11-unix/* rw, + unix (connect, receive, send) + type=stream + peer=(addr="@/tmp/.X11-unix/X[0-9]*"), + unix (connect, receive, send) + type=stream + peer=(addr="@/tmp/.ICE-unix/[0-9]*"), + + /usr/include/X11/ r, + /usr/include/X11/** r, + + # The X tree changes and is large -- grant read access to the whole thing + /usr/X11R6/** r, + /usr/share/X11/ r, + /usr/share/X11/** r, + /usr/X11R6/**.so* mr, + + # EGL + /usr/lib/@{multiarch}/egl/*.so* mr, + + # Xcompose + owner @{HOME}/.XCompose r, + /var/cache/libx11/compose/* r, + deny /var/cache/libx11/compose/* wlk, + + # mouse themes + /etc/X11/cursors/ r, + /etc/X11/cursors/** r, + + # Xwayland + owner @{run}/user/*/.mutter-Xwaylandauth.* r, + + # Include additions to the abstraction + include if exists <abstractions/X.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common b/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common new file mode 100644 index 0000000..0982635 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/apache2-common @@ -0,0 +1,43 @@ +# vim:syntax=apparmor + +# This file contains basic permissions for Apache and every vHost + + abi <abi/4.0>, + + include <abstractions/nameservice> + + # Allow other processes to read our /proc entries + ptrace (readby), + # Allow other processes to trace us by default + ptrace (tracedby), + # Allow unconfined processes to send us signals by default + signal (receive) peer=unconfined, + # Allow apache to send us signals by default + signal (receive) peer=apache2, + # Allow other hats to signal by default + signal peer=apache2//*, + # Allow us to signal ourselves + signal peer=@{profile_name}, + + # Apache + network inet stream, + network inet6 stream, + # apache manual, error pages and icons + /usr/share/apache2/** r, + + # changehat itself + @{PROC}/@{pid}/attr/{apparmor/,}current rw, + + # htaccess files - for what ever it is worth + /**/.htaccess r, + + /dev/urandom r, + + # sasl-auth + @{run}/saslauthd/mux rw, + + # OCSP stapling + @{run}/lock/apache2/stapling-cache* rw, + + # Include additions to the abstraction + include if exists <abstractions/apache2-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/change_profile b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/change_profile new file mode 100644 index 0000000..13df61a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/change_profile @@ -0,0 +1,13 @@ +# Copyright (C) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi <abi/4.0>, + +include <abstractions/apparmor_api/introspect> + +@{PROC}/@{tid}/attr/{apparmor/,}{current,exec} w, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/examine b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/examine new file mode 100644 index 0000000..f90a364 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/examine @@ -0,0 +1,14 @@ +# Copyright (C) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +# Make sure to include at least tunables/proc and tunables/kernelvars +# when using this abstraction, if not tunables/global. + +abi <abi/4.0>, + +@{PROC}/@{pids}/attr/{apparmor/,}{current,prev,exec} r, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/find_mountpoint b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/find_mountpoint new file mode 100644 index 0000000..dae90c9 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/find_mountpoint @@ -0,0 +1,16 @@ +# Copyright (C) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi <abi/4.0>, + +#permissions needed for aa_find_mountpoint + +# Make sure to include at least tunables/proc and tunables/kernelvars +# when using this abstraction, if not tunables/global. + +@{PROC}/@{pids}/mounts r, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/introspect b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/introspect new file mode 100644 index 0000000..00934fb --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/introspect @@ -0,0 +1,14 @@ +# Copyright (C) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi <abi/4.0>, + +# Make sure to include at least tunables/proc and tunables/kernelvars +# when using this abstraction, if not tunables/global. + +@{PROC}/@{tid}/attr/{apparmor/,}{current,prev,exec} r, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/is_enabled b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/is_enabled new file mode 100644 index 0000000..a47b3d4 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/apparmor_api/is_enabled @@ -0,0 +1,20 @@ +# Copyright (C) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi <abi/4.0>, + +# permissions needed for aa_is_enabled + +# Make sure to include tunables/apparmorfs and tunables/global +# when using this abstraction + +include <abstractions/apparmor_api/find_mountpoint> +@{sys}/module/apparmor/parameters/enabled r, +@{sys}/module/apparmor/parameters/available r, + +# TODO: add alternate apparmorfs interface for enabled diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/aspell b/straper/db/public/apparmor/apparmor.d/abstractions/aspell new file mode 100644 index 0000000..f6989d7 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/aspell @@ -0,0 +1,18 @@ +# vim:syntax=apparmor +# aspell permissions + + abi <abi/4.0>, + + # per-user settings and dictionaries + owner @{HOME}/.aspell.*.{pws,prepl} rwk, + + # system libraries and dictionaries + /usr/lib/aspell/ r, + /usr/lib/aspell/* r, + /usr/lib/aspell/*.so m, + /usr/share/aspell/ r, + /usr/share/aspell/* r, + /var/lib/aspell/* r, + + # Include additions to the abstraction + include if exists <abstractions/aspell.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/audio b/straper/db/public/apparmor/apparmor.d/abstractions/audio new file mode 100644 index 0000000..5965559 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/audio @@ -0,0 +1,93 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi <abi/4.0>, + + +/dev/admmidi* rw, +/dev/adsp* rw, +/dev/aload* rw, +/dev/amidi* rw, +/dev/audio* rw, +/dev/dmfm* rw, +/dev/dmmidi* rw, +/dev/dsp* rw, +/dev/midi* rw, +/dev/mixer* rw, +/dev/mpu401data rw, +/dev/mpu401stat rw, +/dev/patmgr* rw, +/dev/phone* rw, +/dev/radio* rw, +/dev/rmidi* rw, +/dev/sequencer rw, +/dev/sequencer2 rw, +/dev/smpte* rw, + +/dev/snd/* rw, +/dev/sound/* rw, + +@{PROC}/asound/** rw, + +/usr/share/alsa/** r, +/usr/share/sounds/ r, +/usr/share/sounds/** r, + +owner @{HOME}/.esd_auth r, +/etc/asound.conf r, +owner @{HOME}/.asoundrc r, +/etc/esound/esd.conf r, + +# libao +/etc/libao.conf r, +owner @{HOME}/.libao r, + +# libcanberra +owner @{HOME}/.cache/event-sound-cache.* rwk, + +# pulse +/etc/pulse/ r, +/etc/pulse/** r, +/dev/shm/ r, +@{run}/shm/ r, +owner /dev/shm/pulse-shm* rwk, +owner @{run}/shm/pulse-shm* rwk, +owner @{HOME}/.pulse-cookie rwk, +owner @{HOME}/.pulse/ rw, +owner @{HOME}/.pulse/* rwk, +owner @{run}/user/*/pulse/ rw, +owner @{run}/user/*/pulse/{native,pid} rwk, +owner @{HOME}/.config/pulse/*.conf r, +owner @{HOME}/.config/pulse/client.conf.d/{,*.conf} r, +owner @{HOME}/.config/pulse/cookie rwk, +owner /tmp/pulse-*/ rw, +owner /tmp/pulse-*/* rw, + +# libgnome2 +/etc/sound/ r, +/etc/sound/** r, + +# openal +/etc/alsa/conf.d/{,*} r, +/etc/openal/alsoft.conf r, +owner @{HOME}/.alsoftrc r, +/usr/{,local/}share/openal/hrtf/{,**} r, +owner @{HOME}/.local/share/openal/hrtf/{,**} r, + +# wildmidi +/etc/wildmidi/wildmidi.cfg r, + +# pipewire +/usr/share/pipewire/client{,-rt}.conf r, + + # Include additions to the abstraction + include if exists <abstractions/audio.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/authentication b/straper/db/public/apparmor/apparmor.d/abstractions/authentication new file mode 100644 index 0000000..094f235 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/authentication @@ -0,0 +1,74 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2012 Canonical Ltd +# Copyright (C) 2019-2021 Christian Boltz +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + + # Some services need to perform authentication of users + # Such authentication almost certainly needs access to the local users + # databases containing passwords, PAM configuration files, PAM libraries + @{etc_ro}/nologin r, + @{etc_ro}/pam.d/* r, + @{etc_ro}/securetty r, + @{etc_ro}/security/* r, + @{etc_ro}/shadow r, + @{etc_ro}/gshadow r, + @{etc_ro}/pwdb.conf r, + + /{usr/,}lib{,32,64}/security/pam_filter/* mr, + /{usr/,}lib{,32,64}/security/pam_*.so mr, + /{usr/,}lib{,32,64}/security/ r, + /{usr/,}lib/@{multiarch}/security/pam_filter/* mr, + /{usr/,}lib/@{multiarch}/security/pam_*.so mr, + /{usr/,}lib/@{multiarch}/security/ r, + + # pam_unix + owner /proc/@{pid}/loginuid r, + /{,usr/}{,s}bin/unix_chkpwd Px, + + # pam_env + @{etc_ro}/environment r, + + # pam_limit + @{etc_ro}/security/limits.d/ r, + @{etc_ro}/security/limits.d/*.conf r, + + # gssapi + @{etc_ro}/gss/mech r, + @{etc_ro}/gss/mech.d/ r, + @{etc_ro}/gss/mech.d/*.conf r, + + # kerberos + include <abstractions/kerberosclient> + # SuSE's pwdutils are different: + @{etc_ro}/default/passwd r, + @{etc_ro}/login.defs r, + @{etc_ro}/login.defs.d/ r, + @{etc_ro}/login.defs.d/*.defs r, + + # nis + include <abstractions/nis> + + # winbind + include <abstractions/winbind> + + # likewise + include <abstractions/likewise> + + # smbpass + include <abstractions/smbpass> + + # p11-kit (PKCS#11 modules configuration) + include <abstractions/p11-kit> + + # Include additions to the abstraction + include if exists <abstractions/authentication.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/base b/straper/db/public/apparmor/apparmor.d/abstractions/base new file mode 100644 index 0000000..20700db --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/base @@ -0,0 +1,185 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + include <abstractions/crypto> + + # (Note that the ldd profile has inlined this file; if you make + # modifications here, please consider including them in the ldd + # profile as well.) + + # The __canary_death_handler function writes a time-stamped log + # message to /dev/log for logging by syslogd. So, /dev/log, timezones, + # and localisations of date should be available EVERYWHERE, so + # StackGuard, FormatGuard, etc., alerts can be properly logged. + /dev/log w, + /dev/random r, + /dev/urandom r, + # Allow access to the uuidd daemon (this daemon is a thin wrapper around + # time and getrandom()/{,u}random and, when available, runs under an + # unprivilged, dedicated user). + @{run}/uuidd/request r, + @{etc_ro}/locale/** r, + @{etc_ro}/locale.alias r, + @{etc_ro}/localtime r, + @{etc_rw}/localtime r, + /etc/writable/localtime r, + /usr/share/locale-bundle/** r, + /usr/share/locale-langpack/** r, + /usr/share/locale/ r, + /usr/share/locale/** r, + /usr/share/**/locale/** r, + /usr/share/zoneinfo{,-icu}/ r, + /usr/share/zoneinfo{,-icu}/** r, + /usr/share/X11/locale/** r, + @{run}/systemd/journal/dev-log w, + # systemd native journal API (see sd_journal_print(4)) + @{run}/systemd/journal/socket w, + # Nested containers and anything using systemd-cat need this. 'r' shouldn't + # be required but applications fail without it. journald doesn't leak + # anything when reading so this is ok. + @{run}/systemd/journal/stdout rw, + + /usr/lib{,32,64}/locale/** mr, + /usr/lib{,32,64}/gconv/*.so mr, + /usr/lib{,32,64}/gconv/gconv-modules* mr, + /usr/lib/@{multiarch}/gconv/*.so mr, + /usr/lib/@{multiarch}/gconv/gconv-modules* mr, + + # used by glibc when binding to ephemeral ports + @{etc_ro}/bindresvport.blacklist r, + + # ld.so.cache and ld are used to load shared libraries; they are best + # available everywhere + @{etc_ro}/ld.so.cache mr, + @{etc_ro}/ld.so.conf r, + @{etc_ro}/ld.so.conf.d/{,*.conf} r, + @{etc_ro}/ld.so.preload r, + @{etc_ro}/ld-musl-*.path r, + /{usr/,}lib{,32,64}/ld{,32,64}-*.so mr, + /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so mr, + /{usr/,}lib/tls/i686/{cmov,nosegneg}/ld-*.so mr, + /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/ld-*.so mr, + /opt/*-linux-uclibc/lib/ld-uClibc*so* mr, + + # we might as well allow everything to use common libraries + /{usr/,}lib{,32,64}/** r, + /{usr/,}lib{,32,64}/**.so* mr, + /{usr/,}lib/@{multiarch}/** r, + /{usr/,}lib/@{multiarch}/**.so* mr, + /{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so* mr, + /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so* mr, + + # FIPS-140-2 versions of some crypto libraries need to access their + # associated integrity verification file, or they will abort. + /{usr/,}lib{,32,64}/.lib*.so*.hmac r, + /{usr/,}lib/@{multiarch}/.lib*.so*.hmac r, + + # /dev/null is pretty harmless and frequently used + /dev/null rw, + # as is /dev/zero + /dev/zero rw, + # recent glibc uses /dev/full in preference to /dev/null for programs + # that don't have open fds at exec() + /dev/full rw, + + # Sometimes used to determine kernel/user interfaces to use + @{PROC}/sys/kernel/version r, + # Depending on which glibc routine uses this file, base may not be the + # best place -- but many profiles require it, and it is quite harmless. + @{PROC}/sys/kernel/ngroups_max r, + + # Used to determine if Linux is running in FIPS mode + @{PROC}/sys/crypto/fips_enabled r, + + # glibc's sysconf(3) routine to determine free memory, etc + @{PROC}/meminfo r, + @{PROC}/stat r, + @{PROC}/cpuinfo r, + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/online r, + @{sys}/devices/system/cpu/possible r, + + # transparent hugepage support + @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, + + # glibc's *printf protections read the maps file + @{PROC}/@{pid}/{maps,auxv,status} r, + + # some applications will display license information + /usr/share/common-licenses/** r, + + # glibc statvfs + @{PROC}/filesystems r, + + # glibc malloc (man 5 proc) + @{PROC}/sys/vm/overcommit_memory r, + + # Allow determining the highest valid capability of the running kernel + @{PROC}/sys/kernel/cap_last_cap r, + + # Allow other processes to read our /proc entries, futexes, perf tracing and + # kcmp for now (they will need 'read' in the first place). Administrators can + # override with: + # deny ptrace (readby) ... + ptrace (readby), + + # Allow other processes to trace us by default (they will need 'trace' in + # the first place). Administrators can override with: + # deny ptrace (tracedby) ... + ptrace (tracedby), + + # Allow us to ptrace read ourselves + ptrace (read) peer=@{profile_name}, + + # Allow unconfined processes to send us signals by default + signal (receive) peer=unconfined, + + # Allow us to signal ourselves + signal peer=@{profile_name}, + + # Checking for PID existence is quite common so add it by default for now + signal (receive, send) set=("exists"), + + # Allow us to create and use abstract and anonymous sockets + unix peer=(label=@{profile_name}), + + # Allow unconfined processes to us via unix sockets + unix (receive) peer=(label=unconfined), + + # Allow us to create abstract and anonymous sockets + unix (create), + + # Allow us to getattr, getopt, setop and shutdown on unix sockets + unix (getattr, getopt, setopt, shutdown), + + # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked + # filesystems generally. This does not appreciably decrease security with + # Ubuntu profiles because the user is expected to have access to files owned + # by him/her. Exceptions to this are explicit in the profiles. While this rule + # grants access to those exceptions, the intended privacy is maintained due to + # the encrypted contents of the files in this directory. Files in this + # directory will also use filename encryption by default, so the files are + # further protected. Also, with the use of 'owner', this rule properly + # prevents access to the files from processes running under a different uid. + + # encrypted ~/.Private and old-style encrypted $HOME + owner @{HOME}/.Private/ r, + owner @{HOME}/.Private/** mrixwlk, + # new-style encrypted $HOME + owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r, + owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk, + + + # Include additions to the abstraction + include if exists <abstractions/base.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/bash b/straper/db/public/apparmor/apparmor.d/abstractions/bash new file mode 100644 index 0000000..ba2c4e3 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/bash @@ -0,0 +1,49 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # user-specific bash files + @{HOMEDIRS} r, + @{HOME}/.bashrc r, + @{HOME}/.profile r, + @{HOME}/.bash_profile r, + @{HOME}/.bash_history rw, + + # system-wide bash configuration + /etc/profile.dos r, + /etc/profile r, + /etc/profile.d/ r, + /etc/profile.d/* r, + /etc/bashrc r, + /etc/bash.bashrc r, + /etc/bash.bashrc.local r, + /etc/bash_completion r, + /etc/bash_completion.d/ r, + /etc/bash_completion.d/* r, + + # bash relies on system-wide readline configuration + /etc/inputrc r, + + # bash inspects filesystems at startup + /etc/mtab r, + @{PROC}/@{pid}/mounts r, + @{PROC}/filesystems r, + + # probably readline wants to know terminal capabilities + /usr/share/terminfo/** r, + + # run out of /etc/bash.bashrc + /etc/DIR_COLORS r, + /{usr/,}bin/ls mix, + /usr/bin/dircolors mix, + + # Include additions to the abstraction + include if exists <abstractions/bash.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/consoles b/straper/db/public/apparmor/apparmor.d/abstractions/consoles new file mode 100644 index 0000000..267cb03 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/consoles @@ -0,0 +1,27 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2005 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + + # there are three common ways to refer to consoles + /dev/console rw, + /dev/tty rw, + # this next entry is a tad unfortunate; /dev/tty will always be + # associated with the controlling terminal by the kernel, but if a + # program uses the /dev/pts/ interface, it actually has access to + # -all- xterm, sshd, etc, terminals on the system. + /dev/pts/[0-9]* rw, + /dev/pts/ r, + + + # Include additions to the abstraction + include if exists <abstractions/consoles.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/crypto b/straper/db/public/apparmor/apparmor.d/abstractions/crypto new file mode 100644 index 0000000..9d46608 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/crypto @@ -0,0 +1,34 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# Copyright (C) 2021 Christian Boltz +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # Global config of openssl + include <abstractions/openssl> + + @{etc_ro}/gcrypt/hwf.deny r, + @{etc_ro}/gcrypt/random.conf r, + @{PROC}/sys/crypto/fips_enabled r, + + # libgcrypt reads some flags from /proc + @{PROC}/sys/crypto/* r, + + # crypto policies used by various libraries + /etc/crypto-policies/*/*.txt r, + /usr/share/crypto-policies/*/*.txt r, + + # Global gnutls config + @{etc_ro}/gnutls/config r, + @{etc_ro}/gnutls/pkcs11.conf r, + + include if exists <abstractions/crypto.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/cups-client b/straper/db/public/apparmor/apparmor.d/abstractions/cups-client new file mode 100644 index 0000000..a085bd4 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/cups-client @@ -0,0 +1,23 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009-2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # discoverable system configuration for non-local cupsd + /etc/cups/client.conf r, + # client should be able to talk the local cupsd + @{run}/cups/cups.sock rw, + # client should be able to read user-specified cups configuration + owner @{HOME}/.cups/client.conf r, + owner @{HOME}/.cups/lpoptions r, + + # Include additions to the abstraction + include if exists <abstractions/cups-client.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus b/straper/db/public/apparmor/apparmor.d/abstractions/dbus new file mode 100644 index 0000000..83d44e4 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus @@ -0,0 +1,21 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009-2013 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # This abstraction grants full system bus access. Consider using the + # dbus-strict abstraction for fine-grained bus mediation. + + include <abstractions/dbus-strict> + dbus bus=system, + + # Include additions to the abstraction + include if exists <abstractions/dbus.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility new file mode 100644 index 0000000..cade13e --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility @@ -0,0 +1,21 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2013 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # This abstraction grants full accessibility bus access. Consider using the + # dbus-accessibility-strict abstraction for fine-grained bus mediation. + + include <abstractions/dbus-accessibility-strict> + dbus bus=accessibility, + + # Include additions to the abstraction + include if exists <abstractions/dbus-accessibility.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility-strict new file mode 100644 index 0000000..1a0a293 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-accessibility-strict @@ -0,0 +1,22 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2013 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + dbus send + bus=accessibility + path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus), + + # Include additions to the abstraction + include if exists <abstractions/dbus-accessibility-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-network-manager-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-network-manager-strict new file mode 100644 index 0000000..849d6ec --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-network-manager-strict @@ -0,0 +1,47 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + + dbus send + bus=system + path=/org/freedesktop/NetworkManager + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=org.freedesktop.NetworkManager), + + dbus send + bus=system + path=/org/freedesktop/NetworkManager + interface=org.freedesktop.NetworkManager + member=GetDevices + peer=(name=org.freedesktop.NetworkManager), + + dbus send + bus=system + path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]* + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=org.freedesktop.NetworkManager), + + dbus send + bus=system + path=/org/freedesktop/NetworkManager/Devices/[0-9]* + interface=org.freedesktop.DBus.Properties + member=GetAll + peer=(name=org.freedesktop.NetworkManager), + + dbus send + bus=system + path=/org/freedesktop/NetworkManager/Settings + interface=org.freedesktop.NetworkManager.Settings + member={GetDevices,ListConnections} + peer=(name=org.freedesktop.NetworkManager), + + dbus send + bus=system + path=/org/freedesktop/NetworkManager/Settings/[0-9]* + interface=org.freedesktop.NetworkManager.Settings.Connection + member=GetSettings + peer=(name=org.freedesktop.NetworkManager), + + include if exists <abstractions/dbus-network-manager-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session new file mode 100644 index 0000000..99104c2 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session @@ -0,0 +1,22 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2011-2013 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # This abstraction grants full session bus access. Consider using the + # dbus-session-strict abstraction for fine-grained bus mediation. + + include <abstractions/dbus-session-strict> + /usr/bin/dbus-launch ix, + dbus bus=session, + + # Include additions to the abstraction + include if exists <abstractions/dbus-session.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict new file mode 100644 index 0000000..1796a55 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-session-strict @@ -0,0 +1,39 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2011-2013 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # unique per-machine identifier + /etc/machine-id r, + /var/lib/dbus/machine-id r, + + unix (connect, receive, send, accept) type=stream peer=(addr="@/tmp/dbus-*"), + + unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-*", + unix (bind, listen) type=stream addr="@/tmp/dbus-*", + + # dbus with systemd and --enable-user-session + owner @{run}/user/[0-9]*/bus rw, + + dbus send + bus=session + path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus), + + owner @{run}/user/@{uid}/at-spi/ rw, + owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw, + + owner /tmp/dbus-[0-9a-zA-Z]* rw, + + # Include additions to the abstraction + include if exists <abstractions/dbus-session-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dbus-strict b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-strict new file mode 100644 index 0000000..60b5d19 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dbus-strict @@ -0,0 +1,24 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009-2013 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + @{run}/dbus/system_bus_socket rw, + + dbus send + bus=system + path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus), + + # Include additions to the abstraction + include if exists <abstractions/dbus-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dconf b/straper/db/public/apparmor/apparmor.d/abstractions/dconf new file mode 100644 index 0000000..959cfd4 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dconf @@ -0,0 +1,14 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# permissions for querying dconf settings; granting write access should +# be specified in a specific application's profile. + + @{etc_ro}/dconf/** r, + # TODO: make w conditional when an override is available, so it can be moved to a portal. + owner @{run}/user/*/dconf/user rw, + owner @{HOME}/.config/dconf/user r, + + # Include additions to the abstraction + include if exists <abstractions/dconf.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb b/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb new file mode 100644 index 0000000..9c3d5bb --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb @@ -0,0 +1,22 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# Copyright (C) 2021-2025 Alexandre Pujol <alexandre@pujol.io> +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + include <abstractions/devices-usb-read> + + /dev/bus/usb/@{int}/@{int} wk, + + @{sys}/devices/**/usb@{int}/{,**} w, + + include if exists <abstractions/devices-usb.d> + +# vim:syntax=apparmor diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb-read b/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb-read new file mode 100644 index 0000000..3fdb709 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/devices-usb-read @@ -0,0 +1,35 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# Copyright (C) 2021-2025 Alexandre Pujol <alexandre@pujol.io> +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /dev/ r, + /dev/bus/usb/ r, + /dev/bus/usb/@{int}/ r, + /dev/bus/usb/@{int}/@{int} r, + + @{sys}/class/ r, + @{sys}/class/usbmisc/ r, + + @{sys}/bus/ r, + @{sys}/bus/usb/ r, + @{sys}/bus/usb/devices/{,**} r, + + @{sys}/devices/**/usb@{int}/{,**} r, + + # Udev data about usb devices (~equal to content of lsusb -v) + @{run}/udev/data/+usb:* r, + @{run}/udev/data/c16[6,7]:@{int} r, # USB modems + @{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters + + include if exists <abstractions/devices-usb-read.d> + +# vim:syntax=apparmor diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dovecot-common b/straper/db/public/apparmor/apparmor.d/abstractions/dovecot-common new file mode 100644 index 0000000..d0722eb --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dovecot-common @@ -0,0 +1,24 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2014 Canonical, Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ +# used with dovecot/* + + abi <abi/4.0>, + + capability setgid, + + deny capability block_suspend, + + # dovecot's master can send us signals + signal receive peer=dovecot, + + owner @{run}/dovecot/config rw, + + # Include additions to the abstraction + include if exists <abstractions/dovecot-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dri-common b/straper/db/public/apparmor/apparmor.d/abstractions/dri-common new file mode 100644 index 0000000..fb82b8d --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dri-common @@ -0,0 +1,19 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This file contains common DRI-specific rules useful for GUI applications +# (needed by libdrm and similar). + + /usr/lib{,32,64}/dri/** mr, + /usr/lib/@{multiarch}/dri/** mr, + /usr/lib/fglrx/dri/** mr, + /dev/dri/ r, + /dev/dri/** rw, + /etc/drirc r, + /usr/share/drirc.d/{,*.conf} r, + owner @{HOME}/.drirc r, + + + # Include additions to the abstraction + include if exists <abstractions/dri-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/dri-enumerate b/straper/db/public/apparmor/apparmor.d/abstractions/dri-enumerate new file mode 100644 index 0000000..4774cee --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/dri-enumerate @@ -0,0 +1,13 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This file contains common DRI-specific rules useful for GUI applications that +# needs to enumerate graphic devices (as with drmParsePciDeviceInfo() from +# libdrm). + + @{sys}/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r, + + + # Include additions to the abstraction + include if exists <abstractions/dri-enumerate.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/enchant b/straper/db/public/apparmor/apparmor.d/abstractions/enchant new file mode 100644 index 0000000..ecfbe0e --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/enchant @@ -0,0 +1,64 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2010 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # abstraction for Enchant spellchecking frontend + + /usr/share/enchant/ r, + /usr/share/enchant/enchant.ordering r, + + /usr/share/enchant-2/ r, + /usr/share/enchant-2/enchant.ordering r, + + # aspell + include <abstractions/aspell> + /var/lib/dictionaries-common/aspell/ r, + /var/lib/dictionaries-common/aspell/* r, + + # hspell + /usr/share/hspell/ r, + /usr/share/hspell/*.wgz.* r, + + # hunspell + /usr/share/hunspell/ r, + /usr/share/hunspell/* r, + + # ispell + /usr/lib/ispell/ r, + /usr/lib/ispell/*.hash r, + /usr/share/dict/ r, + /usr/share/dict/* r, + /var/lib/dictionaries-common/ r, + /var/lib/dictionaries-common/{ispell,wordlist}/ r, + /var/lib/dictionaries-common/{ispell,wordlist}/* r, + + # myspell + /usr/share/myspell/ r, + /usr/share/myspell/** r, + + # voikko + /usr/lib/voikko/ r, + /usr/lib/voikko/2/ r, + /usr/lib/voikko/2/mor-standard/ r, + /usr/lib/voikko/2/mor-standard/voikko* r, + + # zemberek + /usr/share/java/ r, + /usr/share/java/zemberek-[0-9]*.jar r, + /usr/share/java/zemberek-tr-[0-9]*.jar r, + + # per-user dictionaries + owner @{HOME}/.config/enchant/ rw, + owner @{HOME}/.config/enchant/* rwk, + + # Include additions to the abstraction + include if exists <abstractions/enchant.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/exo-open b/straper/db/public/apparmor/apparmor.d/abstractions/exo-open new file mode 100644 index 0000000..a6b50c4 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/exo-open @@ -0,0 +1,69 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This abstraction is designed to be used in a child profile to limit what +# confined application can invoke via exo-open helper. +# +# NOTE: most likely you want to use xdg-open abstraction instead for better +# portability across desktop environments, unless you are sure that confined +# application only uses /usr/bin/exo-open directly. +# +# Usage example: +# +# ``` +# profile foo /usr/bin/foo { +# ... +# /usr/bin/exo-open rPx -> foo//exo-open, +# ... +# } # end of main profile +# +# # out-of-line child profile +# profile foo//exo-open { +# include <abstractions/exo-open> +# +# # needed for ubuntu-* abstractions +# include <abstractions/ubuntu-helpers> +# +# # Only allow to handle http[s]: and mailto: links +# include <abstractions/ubuntu-browsers> +# include <abstractions/ubuntu-email> +# +# # Add if accessibility access is considered as required +# # (for message box in case exo-open fails) +# include <abstractions/dbus-accessibility> +# +# # < add additional allowed applications here > +# } + + include <abstractions/X> + include <abstractions/audio> # for alert messages + include <abstractions/base> + include <abstractions/dbus-session-strict> + include <abstractions/gnome> + + # Main executables + + /usr/bin/exo-open rix, + /usr/lib{32,64,/@{multiarch}}/xfce4/exo-[0-9]/exo-helper-[0-9] ix, + + # Other executables + + /{,usr/}bin/which rix, + + # System files + + /etc/xdg/{,xdg-*/}xfce4/helpers.rc r, + /etc/xfce4/defaults.list r, # TODO: move into xfce4 abstraction? + /usr/share/sounds/freedesktop/** r, # for message box alert sound + /usr/share/xfce4/helpers/*.desktop r, + /usr/share/{xfce{,4},xubuntu}/applications/{,*.list} r, + + # User files + + owner @{PROC}/@{pid}/fd/ r, + owner @{HOME}/.config/xfce4/helpers.rc r, + owner @{HOME}/.local/share/xfce4/helpers/*.desktop r, + + # Include additions to the abstraction + include if exists <abstractions/exo-open.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/fcitx b/straper/db/public/apparmor/apparmor.d/abstractions/fcitx new file mode 100644 index 0000000..63173a0 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/fcitx @@ -0,0 +1,18 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2016 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + include <abstractions/fcitx-strict> + dbus bus=fcitx, + + # Include additions to the abstraction + include if exists <abstractions/fcitx.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/fcitx-strict b/straper/db/public/apparmor/apparmor.d/abstractions/fcitx-strict new file mode 100644 index 0000000..c4e7301 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/fcitx-strict @@ -0,0 +1,39 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2016 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + include <abstractions/dbus-session-strict> + + dbus send + bus=fcitx + path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName} + peer=(name=org.freedesktop.DBus), + + owner @{HOME}/.config/fcitx/dbus/* r, + + # Allow access to the Fcitx portal, supported by fcitx/fcitx5 + dbus (send) + bus=session + path=/{,org/freedesktop/portal/}inputmethod + interface=org.fcitx.Fcitx.InputMethod1 + member={CreateInputContext,Version} + peer=(name=org.freedesktop.portal.Fcitx), + + dbus (send, receive) + bus=session + path=/{,org/freedesktop/portal/}inputcontext/** + interface=org.fcitx.Fcitx.InputContext1, + + # Include additions to the abstraction + include if exists <abstractions/fcitx-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/fonts b/straper/db/public/apparmor/apparmor.d/abstractions/fonts new file mode 100644 index 0000000..d86d230 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/fonts @@ -0,0 +1,68 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /usr/share/AbiSuite/fonts/** r, + + /usr/lib/xorg/modules/fonts/**.so* mr, + + /usr/share/fonts/{,**} r, + /usr/share/fonts-*/{,**} r, + + /etc/fonts/** r, + # Debian, openSUSE paths are different + /usr/share/{fontconfig,fonts-config,*-fonts}/conf.avail/{,**} r, + /usr/share/ghostscript/fonts/{,**} r, + + /opt/kde3/share/fonts/** r, + + /usr/lib{,32,64}/openoffice/share/fonts/** r, + + /var/cache/fonts/** r, + /var/cache/fontconfig/** mr, + /var/lib/defoma/** mr, + + /usr/share/a2ps/fonts/** r, + /usr/share/xfce/fonts/** r, + /usr/share/ghostscript/fonts/** r, + /usr/share/javascript/*/fonts/** r, + /usr/share/texmf/{,*/}fonts/** r, + /usr/share/texlive/texmf-dist/fonts/** r, + /var/lib/ghostscript/** r, + + owner @{HOME}/.fonts.conf r, + owner @{HOME}/.fonts/ r, + owner @{HOME}/.fonts/** r, + owner @{HOME}/.local/share/fonts/ r, + owner @{HOME}/.local/share/fonts/** r, + owner @{HOME}/.fonts.cache-2 mr, + owner @{HOME}/.{,cache/}fontconfig/ rw, + owner @{HOME}/.{,cache/}fontconfig/** mrwkl, + owner @{HOME}/.fonts.conf.d/ r, + owner @{HOME}/.fonts.conf.d/** r, + owner @{HOME}/.config/fontconfig/ r, + owner @{HOME}/.config/fontconfig/** r, + owner @{HOME}/.Fontmatrix/Activated/ r, + owner @{HOME}/.Fontmatrix/Activated/** r, + + /usr/local/share/fonts/ r, + /usr/local/share/fonts/** r, + + # poppler CMap tables + /usr/share/poppler/cMap/** r, + + # data files for LibThai + /usr/share/libthai/thbrk.tri r, + + # Include additions to the abstraction + include if exists <abstractions/fonts.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/freedesktop.org b/straper/db/public/apparmor/apparmor.d/abstractions/freedesktop.org new file mode 100644 index 0000000..cb5e1ec --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/freedesktop.org @@ -0,0 +1,41 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # system configuration + @{system_share_dirs}/applications/{**,} r, + @{system_share_dirs}/*ubuntu/applications/{**,} r, + @{system_share_dirs}/gnome/applications/{**,} r, + @{system_share_dirs}/xfce4/applications/{**,} r, + @{system_share_dirs}/icons/{**,} r, + @{system_share_dirs}/pixmaps/{**,} r, + + # this should probably go elsewhere + @{system_share_dirs}/mime/** r, + + @{system_share_dirs}/glib-2.0/schemas/gschemas.compiled r, + + /etc/gnome/defaults.list r, + /etc/xfce4/defaults.list r, + + # per-user configurations + owner @{HOME}/.icons/{,**} r, + owner @{HOME}/.recently-used.xbel* rw, + owner @{HOME}/.local/share/recently-used.xbel* rw, + owner @{HOME}/.config/user-dirs.dirs r, + owner @{HOME}/.config/mimeapps.list r, + owner @{user_share_dirs}/applications/{**,} r, + owner @{user_share_dirs}/icons/{**,} r, + owner @{user_share_dirs}/mime/{**,} r, + + # Include additions to the abstraction + include if exists <abstractions/freedesktop.org.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gio-open b/straper/db/public/apparmor/apparmor.d/abstractions/gio-open new file mode 100644 index 0000000..f211717 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/gio-open @@ -0,0 +1,59 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This abstraction is designed to be used in a child profile to limit what +# confined application can invoke via gio helper. +# +# NOTE: most likely you want to use xdg-open abstraction instead for better +# portability across desktop environments, unless you are sure that confined +# application only uses /usr/bin/gio directly. +# +# Usage example: +# +# ``` +# profile foo /usr/bin/foo { +# ... +# /usr/bin/gio rPx -> foo//gio-open, +# ... +# } # end of main profile +# +# # out-of-line child profile +# profile foo//gio-open { +# include <abstractions/gio-open> +# +# # needed for ubuntu-* abstractions +# include <abstractions/ubuntu-helpers> +# +# # Only allow to handle http[s]: and mailto: links +# include <abstractions/ubuntu-browsers> +# include <abstractions/ubuntu-email> +# +# # < add additional allowed applications here > +# } + + include <abstractions/base> + include <abstractions/dbus-session-strict> + + # Main executables + + /usr/bin/gio rix, + /usr/bin/gio-launch-desktop ix, # for OpenSUSE + /usr/lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop ix, + + # System files + + /etc/gnome/defaults.list r, + /usr/share/mime/* r, + /usr/share/{,*/}applications/{,**} r, + /var/cache/gio-[0-9]*.[0-9]*/gnome-mimeapps.list r, + /var/lib/snapd/desktop/applications/{,**} r, + + # User files + + owner @{HOME}/.config/mimeapps.list r, + owner @{HOME}/.local/share/applications/{,*.desktop} r, + owner @{PROC}/@{pid}/fd/ r, + + # Include additions to the abstraction + include if exists <abstractions/gio-open.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gnome b/straper/db/public/apparmor/apparmor.d/abstractions/gnome new file mode 100644 index 0000000..ca2eb39 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/gnome @@ -0,0 +1,117 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + include <abstractions/base> + include <abstractions/fonts> + include <abstractions/X> + include <abstractions/freedesktop.org> + include <abstractions/xdg-desktop> + include <abstractions/user-tmp> + include <abstractions/wayland> + + # systemwide gtk defaults + /etc/gnome/gtkrc* r, + /etc/gtk/* r, + /usr/lib{,32,64}/gtk/** mr, + /usr/lib/@{multiarch}/gtk/** mr, + /usr/lib{,32,64}/gtk-[0-9]*/** mr, + /usr/lib/@{multiarch}/gtk-[0-9]*/** mr, + /usr/share/themes/ r, + /usr/share/themes/** r, + /usr/share/gtk-3.0/settings.ini r, + + # for gnome 1 applications + /etc/orbitrc r, + + # gtk-2 needed some new rights + /etc/fonts/* r, + /etc/gtk-*/* r, + /etc/pango/* r, + /usr/lib{,32,64}/pango/** mr, + /usr/lib{,32,64}/gtk-*/** mr, + /usr/lib{,32,64}/gdk-pixbuf-*/** mr, + /usr/lib/@{multiarch}/pango/** mr, + /usr/lib/@{multiarch}/gtk-*/** mr, + /usr/lib/@{multiarch}/gdk-pixbuf-*/** mr, + + # per-user gtk configuration + owner @{HOME}/.config/gtk-3.0/ w, + owner @{HOME}/.config/gtk-3.0/* r, + owner @{HOME}/.gnome/Gnome r, + owner @{HOME}/.gtk r, + owner @{HOME}/.gtkrc r, + owner @{HOME}/.gtkrc-2.0 r, + owner @{HOME}/.gtk-bookmarks r, + owner @{HOME}/.themes/ r, + owner @{HOME}/.themes/** r, + owner @{user_share_dirs}/themes/ r, + owner @{user_share_dirs}/themes/** r, + + # for gtk file dialog + owner @{HOME}/.config/gtk-2.0/ w, + owner @{HOME}/.config/gtk-2.0/** r, + owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw, + + # from evolution-mail + owner @{HOME}/.gconfd/lock/* r, + owner @{HOME}/.gnome/application-info r, + + # per-user font business + owner @{HOME}/.fonts.cache-* rwl, + + # GtkComposeTable + owner @{HOME}/.cache/gtk-3.0/** r, + + # icon caches + /var/cache/**/icon-theme.cache r, + /usr/share/**/icon-theme.cache r, + + # GLib schemas + /usr/{local/,}share/glib-[0-9]*/schemas/ r, + /usr/{local/,}share/glib-[0-9]*/schemas/** r, + + # gnome VFS modules + /etc/gnome-vfs-2.0/modules/ r, + /etc/gnome-vfs-2.0/modules/* r, + /usr/lib/gnome-vfs-2.0/modules/*.so mr, + /usr/lib/@{multiarch}/gnome-vfs-2.0/modules/*.so mr, + + # gvfs + /usr/share/gvfs/remote-volume-monitors/ r, + /usr/share/gvfs/remote-volume-monitors/* r, + @{PROC}/@{pid}/mounts r, + @{run}/mount/utab r, + + # printing + /etc/papersize r, + /etc/cups/lpoptions r, + /usr/share/cups/charmaps/** r, + + # holds MIT-MAGIC-COOKIE for gnome + owner @{run}/gdm/auth*/database r, + + # mime-types + /etc/gnome/defaults.list r, + /etc/xdg/{,*-}mimeapps.list r, + /usr/share/gnome/applications/ r, + /usr/share/gnome/applications/mimeinfo.cache r, + + # Allow connecting to the GNOME vfs socket (still need corresponding DBus + # rules) + unix (send, receive, connect) + type=stream + peer=(addr="@/dbus-vfs-daemon/socket-*"), + + # Include additions to the abstraction + include if exists <abstractions/gnome.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gnupg b/straper/db/public/apparmor/apparmor.d/abstractions/gnupg new file mode 100644 index 0000000..e94f3bc --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/gnupg @@ -0,0 +1,16 @@ +# vim:syntax=apparmor +# gnupg sub-process running permissions + + abi <abi/4.0>, + + # user configurations + owner @{HOME}/.gnupg/options r, + owner @{HOME}/.gnupg/pubring.gpg r, + owner @{HOME}/.gnupg/pubring.kbx r, + owner @{HOME}/.gnupg/random_seed rw, + owner @{HOME}/.gnupg/secring.gpg r, + owner @{HOME}/.gnupg/so/*.x86_64 mr, + owner @{HOME}/.gnupg/trustdb.gpg rw, + + # Include additions to the abstraction + include if exists <abstractions/gnupg.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/groff b/straper/db/public/apparmor/apparmor.d/abstractions/groff new file mode 100644 index 0000000..874fbb7 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/groff @@ -0,0 +1,67 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# Copyright (C) 2023 SUSE LLC +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + # Note: executing groff and nroff themself is not included in this abstraction + # so that you can choose to ix, Px or Cx them in your profile + + # groff/nroff helpers, preprocessors, and postprocessors + /usr/bin/addftinfo mrix, + /usr/bin/afmtodit mrix, + /usr/bin/chem mrix, + /usr/bin/eqn mrix, + /usr/bin/eqn2graph mrix, + /usr/bin/gdiffmk mrix, + /usr/bin/geqn mrix, + /usr/bin/grap2graph mrix, + /usr/bin/grn mrix, + /usr/bin/grodvi mrix, + /usr/bin/groffer mrix, + /usr/bin/grog mrix, + /usr/bin/grolbp mrix, + /usr/bin/grolj4 mrix, + /usr/bin/gropdf mrix, + /usr/bin/grops mrix, + /usr/bin/grotty mrix, + /usr/bin/gtbl mrix, + /usr/bin/hpftodit mrix, + /usr/bin/indxbib mrix, + /usr/bin/lkbib mrix, + /usr/bin/lookbib mrix, + /usr/bin/mmroff mrix, + /usr/bin/neqn mrix, + /usr/bin/pdfmom mrix, + /usr/bin/pdfroff mrix, + /usr/bin/pfbtops mrix, + /usr/bin/pic mrix, + /usr/bin/pic2graph mrix, + /usr/bin/post-grohtml mrix, + /usr/bin/pre-grohtml mrix, + /usr/bin/preconv mrix, + /usr/bin/refer mrix, + /usr/bin/roff2dvi mrix, + /usr/bin/roff2html mrix, + /usr/bin/roff2pdf mrix, + /usr/bin/roff2ps mrix, + /usr/bin/roff2text mrix, + /usr/bin/roff2x mrix, + /usr/bin/soelim mrix, + /usr/bin/tbl mrix, + /usr/bin/tfmtodit mrix, + /usr/bin/troff mrix, + /usr/bin/xtotroff mrix, + + # at least its macros and fonts + /usr/libexec/groff/** r, + /usr/share/groff/** r, + + # Include additions to the abstraction + include if exists <abstractions/groff.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gtk b/straper/db/public/apparmor/apparmor.d/abstractions/gtk new file mode 100644 index 0000000..99f46ed --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/gtk @@ -0,0 +1,58 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /usr/share/themes/{,**} r, + + /usr/share/gtksourceview-[0-9]*/{,**} r, + + /usr/share/gtk-2.0/ r, + /usr/share/gtk-2.0/gtkrc r, + + /usr/share/gtk-{3,4}.0/ r, + /usr/share/gtk-{3,4}.0/settings.ini r, + + /etc/gtk-2.0/ r, + /etc/gtk-2.0/gtkrc r, + + /etc/gtk-{3,4}.0/ r, + /etc/gtk-{3,4}.0/*.conf r, + /etc/gtk-{3,4}.0/settings.ini r, + + /etc/gtk/gtkrc r, + + owner @{HOME}/.themes/{,**} r, + owner @{HOME}/.local/share/themes/{,**} r, + + owner @{HOME}/.gtk r, + owner @{HOME}/.gtkrc r, + owner @{HOME}/.gtkrc-2.0 r, + owner @{HOME}/.gtk-bookmarks r, + owner @{HOME}/.config/gtkrc r, + owner @{HOME}/.config/gtkrc-2.0 r, + owner @{HOME}/.config/gtk-{3,4}.0/ rw, + owner @{HOME}/.config/gtk-{3,4}.0/settings.ini r, + owner @{HOME}/.config/gtk-{3,4}.0/bookmarks r, + owner @{HOME}/.config/gtk-{3,4}.0/gtk.css r, + owner @{HOME}/.config/gtk-{3,4}.0/colors.css r, + owner @{HOME}/.config/gtk-{3,4}.0/servers r, + + # for gtk file dialog + owner @{HOME}/.config/gtk-2.0/ rw, + owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw, + + # .Xauthority file required for X connections + owner @{HOME}/.Xauthority r, + + # Xsession errors file + owner @{HOME}/.xsession-errors w, + + # Include additions to the abstraction + include if exists <abstractions/gtk.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open b/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open new file mode 100644 index 0000000..06b3585 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/gvfs-open @@ -0,0 +1,47 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This abstraction is designed to be used in a child profile to limit what +# confined application can invoke via gvfs-open helper. +# +# NOTE: most likely you want to use xdg-open abstraction instead for better +# portability across desktop environments, unless you are sure that confined +# application only uses /usr/bin/gvfs-open directly. +# +# Usage example: +# +# ``` +# profile foo /usr/bin/foo { +# ... +# /usr/bin/gvfs-open rPx -> foo//gvfs-open, +# ... +# } # end of main profile +# +# # out-of-line child profile +# profile foo//gvfs-open { +# include <abstractions/gvfs-open> +# +# # needed for ubuntu-* abstractions +# include <abstractions/ubuntu-helpers> +# +# # Only allow to handle http[s]: and mailto: links +# include <abstractions/ubuntu-browsers> +# include <abstractions/ubuntu-email> +# +# # < add additional allowed applications here > +# } +# ``` + + include <abstractions/base> + + # gvfs-open is deprecated, it launches gio open <uri> + include <abstractions/gio-open> + + # Main executables + + /usr/bin/gvfs-open r, + /{,usr/}bin/dash mr, + + # Include additions to the abstraction + include if exists <abstractions/gvfs-open.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/hosts_access b/straper/db/public/apparmor/apparmor.d/abstractions/hosts_access new file mode 100644 index 0000000..bc49814 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/hosts_access @@ -0,0 +1,17 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2020 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /etc/hosts.deny r, + /etc/hosts.allow r, + + include if exists <abstractions/hosts_access.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ibus b/straper/db/public/apparmor/apparmor.d/abstractions/ibus new file mode 100644 index 0000000..9de24de --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ibus @@ -0,0 +1,29 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2010 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # abstraction for ibus input methods + owner @{HOME}/.config/ibus/ r, + owner @{HOME}/.config/ibus/bus/ rw, + owner @{HOME}/.config/ibus/bus/* rw, + + # abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache) + # This should use this, but due to LP: #1856738 we cannot + #unix (connect, receive, send) + # type=stream + # peer=(addr="@@{HOME}/.cache/ibus/dbus-*"), + unix (connect, receive, send) + type=stream + peer=(addr="@/home/*/.cache/ibus/dbus-*"), + + # Include additions to the abstraction + include if exists <abstractions/ibus.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde b/straper/db/public/apparmor/apparmor.d/abstractions/kde new file mode 100644 index 0000000..9ba93ce --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/kde @@ -0,0 +1,88 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi <abi/4.0>, + +include <abstractions/base> +include <abstractions/fonts> +include <abstractions/X> +include <abstractions/freedesktop.org> +include <abstractions/xdg-desktop> +include <abstractions/user-tmp> +include <abstractions/qt5> + +/etc/qt3/kstylerc r, +/etc/qt3/qt_plugins_3.3rc r, +/etc/qt3/qtrc r, +/etc/kderc r, +/etc/kde3/* r, +/etc/kde4rc r, +/etc/xdg/kdeglobals r, +/etc/xdg/Trolltech.conf r, +/usr/share/desktop-base/kf5-settings/baloofilerc r, +/usr/share/desktop-base/kf5-settings/kdeglobals r, +/usr/share/desktop-base/kf5-settings/kscreenlockerrc r, +/usr/share/knotifications5/*.notifyrc r, # KNotification::sendEvent() +/usr/share/kubuntu-default-settings/kf5-settings/* r, + +owner @{HOME}/.DCOPserver_* r, +owner @{HOME}/.ICEauthority r, +owner @{HOME}/.fonts.* lrw, +owner @{HOME}/.kde{,4}/share/config/kdeglobals rw, +owner @{HOME}/.kde{,4}/share/config/*.lock rwl, +owner @{HOME}/.qt/** rw, +owner @{HOME}/.cache/ksycoca5_??_* r, # KDE System Configuration Cache +owner @{HOME}/.config/Trolltech.conf rwk, +owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget +owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget +owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent() +owner @{HOME}/.config/kdedefaults/kdeglobals r, # QPlatformThemeFactory::create() -> KDEPlasmaPlatformTheme.so +owner @{HOME}/.config/kdedefaults/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so +owner @{HOME}/.config/kdeglobals r, # global settings, used by Breeze style, etc. +owner @{HOME}/.config/klanguageoverridesrc r, # per-application languages, for KDEPrivate::initializeLanguages() from libKF5XmlGui.so +owner @{HOME}/.config/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so +owner @{HOME}/.config/trashrc r, # Used by KFileWidget + +/usr/share/X11/XKeysymDB r, + +# kde3 +/usr/lib*/kde3/plugins/styles/ r, +/usr/lib*/kde3/plugins/styles/* mr, +/usr/lib*/kde3/lib*so* mr, +/usr/lib/@{multiarch}/kde3/plugins/styles/ r, +/usr/lib/@{multiarch}/kde3/plugins/styles/* mr, +/usr/lib/@{multiarch}/kde3/lib*so* mr, +/usr/lib*/qt3/lib*/lib*so* mr, +/usr/lib*/qt3/plugins/** mr, +/usr/lib/@{multiarch}/qt3/lib*/lib*so* mr, +/usr/lib/@{multiarch}/qt3/plugins/** mr, +/usr/lib*/libqt-mt*so* mr, +/usr/lib*/libqui*so* mr, +/usr/lib/@{multiarch}/libqt-mt*so* mr, +/usr/lib/@{multiarch}/libqui*so* mr, +/usr/share/qt3/lib*/libqt-mt*so* mr, +/usr/share/qt3/lib*/libqui*so* mr, + +# kde4 +/usr/lib*/kde4/plugins/*/*.so mr, +/usr/lib*/kde4/plugins/*/ r, +/usr/lib*/kde4/lib*so* mr, +/usr/lib/@{multiarch}/kde4/plugins/*/*.so mr, +/usr/lib/@{multiarch}/kde4/plugins/*/ r, +/usr/lib/@{multiarch}/kde4/lib*so* mr, +/usr/lib*/qt4/lib*/lib*so* mr, +/usr/lib*/qt4/plugins/** mr, +/usr/lib/@{multiarch}/qt4/lib*/lib*so* mr, +/usr/lib/@{multiarch}/qt4/plugins/** mr, +/usr/share/qt4/** r, + + # Include additions to the abstraction + include if exists <abstractions/kde.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-globals-write b/straper/db/public/apparmor/apparmor.d/abstractions/kde-globals-write new file mode 100644 index 0000000..b3142d8 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/kde-globals-write @@ -0,0 +1,15 @@ +# vim:syntax=apparmor +# Rules for changing KDE settings (for KFileDialog and other). + + abi <abi/4.0>, + + # User files + + owner @{HOME}/.config/#[0-9]* rw, + owner @{HOME}/.config/kdeglobals rw, + owner @{HOME}/.config/kdeglobals.?????? rwl -> @{HOME}/.config/#[0-9]*, + owner @{HOME}/.config/kdeglobals.lock rwk, + + + # Include additions to the abstraction + include if exists <abstractions/kde-globals-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-icon-cache-write b/straper/db/public/apparmor/apparmor.d/abstractions/kde-icon-cache-write new file mode 100644 index 0000000..9f01985 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/kde-icon-cache-write @@ -0,0 +1,12 @@ +# vim:syntax=apparmor +# Rules for writing KDE icon cache + + abi <abi/4.0>, + + # User files + + owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader + + + # Include additions to the abstraction + include if exists <abstractions/kde-icon-cache-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-language-write b/straper/db/public/apparmor/apparmor.d/abstractions/kde-language-write new file mode 100644 index 0000000..ad124b7 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/kde-language-write @@ -0,0 +1,18 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# Rules for changing per-application language settings on KDE. Some KDE +# applications have "Help -> Switch Application Language..." option, that needs +# write access to language settings file. + + # User files + + owner @{HOME}/.config/#[0-9]* rw, + owner @{HOME}/.config/klanguageoverridesrc rw, + owner @{HOME}/.config/klanguageoverridesrc.?????? rwl -> @{HOME}/.config/#[0-9]*, + owner @{HOME}/.config/klanguageoverridesrc.lock rwk, + + + # Include additions to the abstraction + include if exists <abstractions/kde-language-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kde-open5 b/straper/db/public/apparmor/apparmor.d/abstractions/kde-open5 new file mode 100644 index 0000000..546a8f2 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/kde-open5 @@ -0,0 +1,105 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This abstraction is designed to be used in a child profile to limit what +# confined application can invoke via kde-open5 helper. +# +# NOTE: most likely you want to use xdg-open abstraction instead for better +# portability across desktop environments, unless you are sure that confined +# application only uses /usr/bin/kde-open5 directly. +# +# Usage example: +# +# ``` +# profile foo /usr/bin/foo { +# ... +# /usr/bin/kde-open5 rPx -> foo//kde-open5, +# ... +# } # end of main profile +# +# # out-of-line child profile +# profile foo//kde-open5 { +# include <abstractions/kde-open5> +# +# # needed for ubuntu-* abstractions +# include <abstractions/ubuntu-helpers> +# +# # Only allow to handle http[s]: and mailto: links +# include <abstractions/ubuntu-browsers> +# include <abstractions/ubuntu-email> +# +# # Add if accessibility access is considered as required +# # (for message box in case exo-open fails) +# include <abstractions/dbus-accessibility> +# +# # Add if audio support for message box is +# # considered as required. +# include if exists <abstractions/gstreamer> +# +# # < add additional allowed applications here > +# } +# ``` + + include <abstractions/audio> # for alert messages + include <abstractions/base> + include <abstractions/dbus-accessibility-strict> + include <abstractions/dbus-network-manager-strict> + include <abstractions/dbus-session-strict> + include <abstractions/dbus-strict> + include <abstractions/kde-icon-cache-write> + include <abstractions/kde> + include <abstractions/nameservice> # for IceProcessMessages () from libICE.so (called by libQtCore.so) + include <abstractions/qt5> + include <abstractions/recent-documents-write> + include <abstractions/X> + + # Main executables + + /usr/bin/kde-open5 rix, + /usr/lib/@{multiarch}/libexec/kf5/kioslave{,5} ix, + + # DBus + + dbus + bus=session + interface=org.kde.KLauncher + member=start_service_by_desktop_path + peer=(name=org.kde.klauncher5), + + # Denied system files + + deny /usr/lib/vlc/plugins/* w, # VLC backed tries to create plugins.dat.16109 + + # libpcre2 on openSUSE tries to mmap() shared memory on directory. + # see: https://lists.ubuntu.com/archives/apparmor/2019-January/011925.html + # AppArmor does not allow to distinguish "real" file vs shared memory one, + # so we deny this path to protect from loading exploits from /tmp. + deny /tmp/#[0-9]*[0-9] m, + + # System files + + /dev/tty r, + /etc/xdg/accept-languages.codes r, + /etc/xdg/menus/{,*/} r, + /usr/share/*fonts*/conf.avail/*.conf r, # for openSUSE, when showing error message box + /usr/share/ghostscript/fonts/ r, # for openSUSE, when showing error message box + /usr/share/hwdata/pnp.ids r, # for openSUSE, when showing error message box, for QXcbConnection::initializeScreens() from libQt5XcbQpa.so + /usr/share/icu/[0-9]*.[0-9]*/*.dat r, # for openSUSE + /usr/share/kservices5/{,**} r, # for KProtocolManager::defaultUserAgent() from libKF5KIOCore.so + /usr/share/mime/ r, + /usr/share/mime/generic-icons r, + /usr/share/plasma/look-and-feel/*/contents/defaults r, # TODO: move to kde abstraction? + /usr/share/sounds/ r, + @{PROC}/sys/kernel/core_pattern r, + @{PROC}/sys/kernel/random/boot_id r, + + # User files + + owner /tmp/xauth-[0-9]*-_[0-9] r, # for libQt5XcbQpa.so + owner @{run}/user/[0-9]*/#[0-9]* rw, # for /run/user/1000/#13 + owner @{run}/user/[0-9]*/kioclient*slave-socket lrw -> @{run}/user/[0-9]/#[0-9]*, # for KIO::Slave::holdSlave(QString const&, QUrl const&) () from libKF5KIOCore.so (not 100% sure) + owner @{HOME}/.cache/kio_http/ rw, + + # Include additions to the abstraction + include if exists <abstractions/kde-open5.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/kerberosclient b/straper/db/public/apparmor/apparmor.d/abstractions/kerberosclient new file mode 100644 index 0000000..e5f3a93 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/kerberosclient @@ -0,0 +1,44 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # files required by kerberos client programs + /usr/lib{,32,64}/krb5/plugins/libkrb5/ r, + /usr/lib{,32,64}/krb5/plugins/libkrb5/* mr, + /usr/lib/@{multiarch}/krb5/plugins/libkrb5/ r, + /usr/lib/@{multiarch}/krb5/plugins/libkrb5/* mr, + + /usr/lib{,32,64}/krb5/plugins/preauth/ r, + /usr/lib{,32,64}/krb5/plugins/preauth/* mr, + /usr/lib/@{multiarch}/krb5/plugins/preauth/ r, + /usr/lib/@{multiarch}/krb5/plugins/preauth/* mr, + + /usr/lib{,32,64}/krb5/plugins/authdata/ r, + /usr/lib{,32,64}/krb5/plugins/authdata/* mr, + /usr/lib/@{multiarch}/krb5/plugins/authdata/ r, + /usr/lib/@{multiarch}/krb5/plugins/authdata/* mr, + + /etc/krb5.keytab rk, + /etc/krb5.conf r, + /etc/krb5.conf.d/ r, + /etc/krb5.conf.d/* r, + + # config files found via strings on libs + /etc/krb.conf r, + /etc/krb.realms r, + /etc/srvtab r, + + # credential caches + /tmp/krb5cc* r, + + # Include additions to the abstraction + include if exists <abstractions/kerberosclient.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ldapclient b/straper/db/public/apparmor/apparmor.d/abstractions/ldapclient new file mode 100644 index 0000000..ecc403f --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ldapclient @@ -0,0 +1,29 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2011 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # files required by LDAP clients (e.g. nss_ldap/pam_ldap) + /etc/ldap.conf r, + /etc/ldap.secret r, + /etc/openldap/* r, + /etc/openldap/cacerts/* r, + + # SASL plugins and config + /etc/sasl2/* r, + /usr/lib{,32,64}/sasl2/* r, + + # local LDAP name service daemon + @{run}/nslcd/socket rw, + + include <abstractions/ssl_certs> + + # Include additions to the abstraction + include if exists <abstractions/ldapclient.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/libpam-systemd b/straper/db/public/apparmor/apparmor.d/abstractions/libpam-systemd new file mode 100644 index 0000000..5d69abe --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/libpam-systemd @@ -0,0 +1,24 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2015-2016 Simon Deziel +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + +include <abstractions/dbus-strict> + + # libpam-systemd notifies systemd-logind about session logins/logouts + dbus send + bus=system + path=/org/freedesktop/login1 + interface=org.freedesktop.login1.Manager + member={CreateSession,ReleaseSession}, + + # Include additions to the abstraction + include if exists <abstractions/libpam-systemd.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/likewise b/straper/db/public/apparmor/apparmor.d/abstractions/likewise new file mode 100644 index 0000000..1985f36 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/likewise @@ -0,0 +1,18 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /tmp/.lwidentity/pipe rw, + /var/lib/likewise-open/lwidentity_privileged/pipe rw, + + # Include additions to the abstraction + include if exists <abstractions/likewise.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mdns b/straper/db/public/apparmor/apparmor.d/abstractions/mdns new file mode 100644 index 0000000..5024b7a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/mdns @@ -0,0 +1,19 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # mdnsd + /etc/mdns.allow r, + /etc/nss_mdns.conf r, + @{run}/mdnsd w, + + # Include additions to the abstraction + include if exists <abstractions/mdns.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mesa b/straper/db/public/apparmor/apparmor.d/abstractions/mesa new file mode 100644 index 0000000..c401a8e --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/mesa @@ -0,0 +1,37 @@ +# vim:syntax=apparmor +# Rules for Mesa implementation of the OpenGL API + + abi <abi/4.0>, + + # System files + /dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2() + + # Needed to check if the kernel supports the i915 perf interface + # (src/intel/perf/gen_perf.c, load_oa_metrics()) + @{PROC}/sys/dev/i915/perf_stream_paranoid r, + + @{sys}/devices/pci[0-9]*/**/{revision,config} r, + + # User files + owner @{HOME}/.cache/ w, # if user clears all caches + owner @{HOME}/.cache/mesa_shader_cache/ rw, + owner @{HOME}/.cache/mesa_shader_cache/index rw, + owner @{HOME}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw, + owner @{HOME}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* rw, + owner @{HOME}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]*.tmp rwk, + + owner @{HOME}/.cache/mesa_shader_cache_db/ rw, + owner @{HOME}/.cache/mesa_shader_cache_db/index rwk, + owner @{HOME}/.cache/mesa_shader_cache_db/part*/ rw, + owner @{HOME}/.cache/mesa_shader_cache_db/part*/mesa_cache.db rwk, + owner @{HOME}/.cache/mesa_shader_cache_db/part*/mesa_cache.idx rwk, + + # Fallback location when @{HOME}/.cache is not available + owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/ rw, + owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/index rw, + owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw, + owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* rw, + owner /tmp/Temp-[a-f0-9]*/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]*.tmp rwk, + + # Include additions to the abstraction + include if exists <abstractions/mesa.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mir b/straper/db/public/apparmor/apparmor.d/abstractions/mir new file mode 100644 index 0000000..85ebde7 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/mir @@ -0,0 +1,22 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2015 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # mir libraries sometimes do not have a lib prefix + # see LP: #1422521 + /usr/lib/@{multiarch}/mir/*.so* mr, + /usr/lib/@{multiarch}/mir/**/*.so* mr, + + # unprivileged mir socket for clients + + # Include additions to the abstraction + include if exists <abstractions/mir.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mozc b/straper/db/public/apparmor/apparmor.d/abstractions/mozc new file mode 100644 index 0000000..6ca1a84 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/mozc @@ -0,0 +1,17 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2016 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + unix (connect, receive, send) type=stream peer=(addr="@tmp/.mozc.*"), + + # Include additions to the abstraction + include if exists <abstractions/mozc.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/mysql b/straper/db/public/apparmor/apparmor.d/abstractions/mysql new file mode 100644 index 0000000..5643953 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/mysql @@ -0,0 +1,20 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2013 Christian Boltz +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /var/lib/mysql{,d}/mysql{,d}.sock rw, + @{run}/mysql{,d}/mysql{,d}.sock rw, + /usr/share/{mysql,mysql-community-server,mariadb}/charsets/ r, + /usr/share/{mysql,mysql-community-server,mariadb}/charsets/*.xml r, + + # Include additions to the abstraction + include if exists <abstractions/mysql.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice b/straper/db/public/apparmor/apparmor.d/abstractions/nameservice new file mode 100644 index 0000000..efba4ac --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/nameservice @@ -0,0 +1,106 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# Copyright (C) 2011-2024 Christian Boltz +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + include <abstractions/nameservice-strict> + + # libtirpc (used for NIS/YP login) needs this + @{etc_ro}/netconfig r, + + # When using sssd, the passwd and group files are stored in an alternate path + # and the nss plugin also needs to talk to a pipe + /var/lib/sss/mc/group r, + /var/lib/sss/mc/initgroups r, + /var/lib/sss/mc/passwd r, + /var/lib/sss/pipes/nss rw, + + # On systems where /etc/resolv.conf is managed programmatically, it is + # a symlink to @{run}/(whatever program is managing it)/resolv.conf. + @{run}/{NetworkManager,connman,netconfig}/resolv.conf r, + @{etc_ro}/resolvconf/run/resolv.conf r, + /mnt/wsl/resolv.conf r, + + @{etc_ro}/samba/lmhosts r, + # db backend + /var/lib/misc/*.db r, + # The Name Service Cache Daemon can cache lookups, sometimes leading + # to vast speed increases when working with network-based lookups. + @{run}/.nscd_socket rw, + @{run}/nscd/socket rw, + /{var/db,var/cache,var/lib,var/run,run}/nscd/{passwd,group,services,hosts} r, + # nscd renames and unlinks files in it's operation that clients will + # have open + @{run}/nscd/db* mix, + + # make libnss-libvirt name resolution work. + /var/lib/libvirt/dnsmasq/* r, + + # make libnss-libvirt name resolution work. + /var/lib/libvirt/dnsmasq/ r, + /var/lib/libvirt/dnsmasq/*.status r, + + # The nss libraries are sometimes used in addition to PAM; make sure + # they are available + /{usr/,}lib{,32,64}/libnss_*.so* mr, + /{usr/,}lib/@{multiarch}/libnss_*.so* mr, + + # avahi-daemon is used for mdns4 resolution + @{run}/avahi-daemon/socket rw, + + # libnl-3-200 via libnss-gw-name + @{PROC}/@{pid}/net/psched r, + @{etc_ro}/libnl-*/classid r, + + # nis + include <abstractions/nis> + + # ldap + include <abstractions/ldapclient> + + # winbind + include <abstractions/winbind> + + # likewise + include <abstractions/likewise> + + # mdnsd + include <abstractions/mdns> + + # kerberos + include <abstractions/kerberosclient> + + # Also allow lookups for systemd-exec's DynamicUsers via D-Bus + # https://www.freedesktop.org/software/systemd/man/systemd.exec.html + dbus send + bus=system + path="/org/freedesktop/systemd1" + interface="org.freedesktop.systemd1.Manager" + member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}" + peer=(name="org.freedesktop.systemd1"), + + # TCP/UDP network access + network inet stream, + network inet6 stream, + network inet dgram, + network inet6 dgram, + + # TODO: adjust when support finer-grained netlink rules + # Netlink raw needed for nscd + network netlink raw, + + # interface details + @{PROC}/@{pid}/net/ipv6_route r, + @{PROC}/@{pid}/net/route r, + + # Include additions to the abstraction + include if exists <abstractions/nameservice.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nameservice-strict b/straper/db/public/apparmor/apparmor.d/abstractions/nameservice-strict new file mode 100644 index 0000000..5f49a63 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/nameservice-strict @@ -0,0 +1,40 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2019-2022 Mikhail Morfikov +# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io> +# SPDX-License-Identifier: GPL-2.0-only + +# Many programs wish to perform nameservice-like operations, such as looking up +# users by name or id, groups by name or id, hosts by name or IP, etc. + + abi <abi/4.0>, + + include <abstractions/nss-systemd> + + @{etc_ro}/default/nss r, + @{etc_ro}/gai.conf r, + @{etc_ro}/group r, + @{etc_ro}/host.conf r, + @{etc_ro}/hosts r, + @{etc_ro}/nsswitch.conf r, + @{etc_ro}/passwd r, + @{etc_ro}/protocols r, + @{etc_ro}/resolv.conf r, + @{etc_ro}/services r, + + # On systems with authselect installed, /etc/nsswitch.conf is a symlink to /etc/authselect/nsswitch.conf + @{etc_ro}/authselect/nsswitch.conf r, + + # Alternative location for group & passwd files + /var/lib/extrausers/group r, + /var/lib/extrausers/passwd r, + /var/lib/nscd/group r, + /var/lib/nscd/passwd r, + + @{run}/nscd/db* r, + @{run}/resolvconf/resolv.conf r, + @{run}/systemd/resolve/resolv.conf r, + @{run}/systemd/resolve/stub-resolv.conf r, + + include if exists <abstractions/nameservice-strict.d> + +# vim:syntax=apparmor diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nis b/straper/db/public/apparmor/apparmor.d/abstractions/nis new file mode 100644 index 0000000..70c426b --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/nis @@ -0,0 +1,20 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # NIS rules + /var/yp/binding/* r, + # portmapper may ask root processes to do nis/ldap at low ports + capability net_bind_service, + + + # Include additions to the abstraction + include if exists <abstractions/nis.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nss-systemd b/straper/db/public/apparmor/apparmor.d/abstractions/nss-systemd new file mode 100644 index 0000000..0d2683c --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/nss-systemd @@ -0,0 +1,31 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2011 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + +# libnss-systemd + # + # https://systemd.io/USER_GROUP_API/ + # https://systemd.io/USER_RECORD/ + # https://www.freedesktop.org/software/systemd/man/nss-systemd.html + # + # Allow User/Group lookups via common VarLink socket APIs. Applications need + # to either consult all of them or the io.systemd.Multiplexer frontend. + @{run}/systemd/userdb/ r, + @{run}/systemd/userdb/io.systemd.Multiplexer rw, + @{run}/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users + @{run}/systemd/userdb/io.systemd.Home rw, # systemd-home dirs + @{run}/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS + @{run}/systemd/userdb/io.systemd.Machine rw, # systemd-machined + + @{PROC}/sys/kernel/random/boot_id r, + + include if exists <abstractions/nss-systemd.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/nvidia b/straper/db/public/apparmor/apparmor.d/abstractions/nvidia new file mode 100644 index 0000000..fb1ffaf --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/nvidia @@ -0,0 +1,40 @@ +# vim:syntax=apparmor +# nvidia access requirements + + abi <abi/4.0>, + + # configuration queries + capability ipc_lock, + + /etc/nvidia/nvidia-application-profiles* r, + /usr/share/nvidia/nvidia-application-profiles* r, + + # libvdpau config file for nvidia workarounds + /etc/vdpau_wrapper.cfg r, + + # device files + /dev/nvidiactl rw, + /dev/nvidia-modeset rw, + /dev/nvidia[0-9]* rw, + + @{PROC}/interrupts r, + @{PROC}/sys/vm/max_map_count r, + @{PROC}/driver/nvidia/params r, + @{PROC}/modules r, + + @{sys}/devices/system/memory/block_size_bytes r, + + owner @{HOME}/.cache/nvidia/ w, + owner @{HOME}/.cache/nvidia/GLCache/ rw, + owner @{HOME}/.cache/nvidia/GLCache/** rwk, + owner @{HOME}/.nv/ w, + owner @{HOME}/.nv/GLCache/ rw, + owner @{HOME}/.nv/GLCache/** rwk, + owner @{HOME}/.nv/nvidia-application-profiles* r, + owner @{PROC}/@{pid}/comm r, # somehwere in libnvidia-glcore.so + + unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"), + unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"), + + # Include additions to the abstraction + include if exists <abstractions/nvidia.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl b/straper/db/public/apparmor/apparmor.d/abstractions/opencl new file mode 100644 index 0000000..6dc3c5a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/opencl @@ -0,0 +1,15 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# OpenCL access requirements + + # TODO: use conditionals to select allowed implementations + include <abstractions/opencl-intel> + include <abstractions/opencl-mesa> + include <abstractions/opencl-nvidia> + include <abstractions/opencl-pocl> + + + # Include additions to the abstraction + include if exists <abstractions/opencl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-common b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-common new file mode 100644 index 0000000..52b40d3 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-common @@ -0,0 +1,16 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# implementation-independent OpenCL access requirements + + # System files + + /etc/OpenCL/** r, + @{sys}/bus/pci/devices/ r, # libpocl.so -> libhwlock.so, libnvidia-opencl.so, beignet/libcl.so -> libdrm_intel.so + @{sys}/devices/system/node/ r, # for clGetPlatformIDs() from libOpenCL.so + @{sys}/devices/system/node/node[0-9]*/meminfo r, # for clGetPlatformIDs() from libOpenCL.so + + + # Include additions to the abstraction + include if exists <abstractions/opencl-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-intel b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-intel new file mode 100644 index 0000000..b584af2 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-intel @@ -0,0 +1,23 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# OpenCL access requirements for Intel implementation + + include <abstractions/opencl-common> + + # for libcl.so (libOpenCL.so -> beignet/libcl.so calls XOpenDisplay()) + include <abstractions/X> + + # for libOpenCL.so -> beignet/libcl.so -> libpciaccess.so + include <abstractions/dri-enumerate> + + # System files + + /dev/dri/card[0-9]* rw, # beignet/libcl.so + @{sys}/devices/pci[0-9]*/**/{class,config,resource,revision} r, # libcl.so -> libdrm_intel.so -> libpciaccess.so (move to dri-enumerate ?) + /usr/lib/@{multiarch}/beignet/** r, + + + # Include additions to the abstraction + include if exists <abstractions/opencl-intel.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-mesa b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-mesa new file mode 100644 index 0000000..3579277 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-mesa @@ -0,0 +1,26 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# OpenCL access requirements for Mesa implementation + + include <abstractions/opencl-common> + + # Additional libraries + + /usr/lib/@{multiarch}/gallium-pipe/*.so mr, # libMesaOpenCL.so + /usr/lib{,64}/gallium-pipe/*.so mr, # libMesaOpenCL.so on openSUSE + + # System files + + /dev/dri/ r, # libMesaOpenCL.so -> libdrm.so + /dev/dri/render* rw, # libMesaOpenCL.so + /etc/drirc r, # libMesaOpenCL.so + + # User files + + owner @{HOME}/.cache/mesa_shader_cache/{,**} rw, # libMesaOpenCL.so -> pipe_nouveau.so + + + # Include additions to the abstraction + include if exists <abstractions/opencl-mesa.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-nvidia b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-nvidia new file mode 100644 index 0000000..5ad69b3 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-nvidia @@ -0,0 +1,36 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# OpenCL access requirements for NVIDIA implementation + + include <abstractions/nvidia> + include <abstractions/opencl-common> + + # Executables + + # https://github.com/NVIDIA/nvidia-modprobe + # This setuid executable is used to create various device files and load the + # the nvidia kernel module. + /usr/bin/nvidia-modprobe Px -> nvidia_modprobe, + + # System files + + # libnvidia-opencl.so rules: + /dev/nvidia-uvm rw, + /dev/nvidia-uvm-tools rw, + @{sys}/devices/pci[0-9]*/**/config r, + @{sys}/devices/system/memory/block_size_bytes r, + /usr/share/nvidia/** r, + @{PROC}/devices r, + @{PROC}/sys/vm/mmap_min_addr r, + + # User files + + owner @{HOME}/.nv/ComputeCache/ w, + owner @{HOME}/.nv/ComputeCache/** rw, + owner @{HOME}/.nv/ComputeCache/index rwk, + + + # Include additions to the abstraction + include if exists <abstractions/opencl-nvidia.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/opencl-pocl b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-pocl new file mode 100644 index 0000000..c69e7e6 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/opencl-pocl @@ -0,0 +1,81 @@ +# vim:syntax=apparmor +# OpenCL access requirements for POCL implementation + + abi <abi/4.0>, + + include <abstractions/opencl-common> + + # Executables + + /usr/bin/{,@{multiarch}-}ld.bfd Cx -> opencl_pocl_ld, + /usr/lib/llvm-[0-9]*.[0-9]*/bin/clang Cx -> opencl_pocl_clang, + + # System files + + / r, # libpocl.so -> libhwloc.so + @{sys}/bus/pci/slots/ r, # libpocl.so -> hwloc_topology_load() from libhwloc.so + @{sys}/bus/{cpu,node}/devices/ r, # libpocl.so -> libhwlock.so + @{sys}/class/net/ r, # libpocl.so -> hwloc_pci_traverse_lookuposdevices_cb() from libhwloc.so + @{sys}/devices/pci[0-9]*/**/ r, # for libpocl -> hwloc_linux_lookup_block_class() from libhwloc.so + @{sys}/devices/pci[0-9]*/**/block/*/dev r, # libpocl.so -> hwloc_linux_lookup_host_block_class() from libhwloc.so + @{sys}/devices/pci[0-9]*/**/{class,local_cpus} r, # libpocl.so -> libhwlock.so + @{sys}/devices/pci[0-9]*/*/net/*/address r, # libpocl.so -> hwloc_pci_traverse_lookuposdevices_cb() from libhwloc.so + @{sys}/devices/system/cpu/ r, # libpocl.so -> libnuma.so + @{sys}/devices/system/cpu/cpu[0-9]*/cache/index[0-9]*/* r, # libpocl.so -> libhwloc.so + @{sys}/devices/system/cpu/cpu[0-9]*/online r, # libpocl.so -> libhwlock.so + @{sys}/devices/system/cpu/cpu[0-9]*/topology/* r, # *_siblings, physical_package_id and lot's of others, for libpocl.so -> libhwloc.so + @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/* r, # for clGetPlatformIDs() from libpocl.so + @{sys}/devices/system/cpu/possible r, # libpocl.so -> libhwloc.so + @{sys}/devices/virtual/dmi/id/{,*} r, # libpocl.so -> libhwloc.so + @{sys}/fs/cgroup/cpuset/cpuset.{cpus,mems} r, # libpocl.so -> libhwloc.so + @{sys}/kernel/mm/hugepages{/,/**} r, # libpocl.so -> libhwloc.so + /usr/share/pocl/** r, + @{run}/udev/data/*:* r, # libpocl.so -> hwloc_linux_block_class_fillinfos() from libhwloc.so + + # User files + + owner @{HOME}/.cache/pocl/ w, + owner @{HOME}/.cache/pocl/kcache/ w, + owner @{HOME}/.cache/pocl/kcache/** rw, + owner @{HOME}/.cache/pocl/kcache/**.so mrw, # dangerous! + owner @{PROC}/@{pid}/{cgroup,cpuset,status} r, # libpocl.so -> libhwloc.so, status for libpocl.so -> libnuma.so + + # Child profiles + + profile opencl_pocl_ld { + include <abstractions/base> + + # Main executables + + /usr/bin/{,@{multiarch}-}ld.bfd mr, + + # User files + + owner @{HOME}/.cache/pocl/kcache/tempfile*.so rw, + owner @{HOME}/.cache/pocl/kcache/**.so.o r, + } + + profile opencl_pocl_clang { + include <abstractions/base> + + # Main executables + + /usr/lib/llvm-[0-9]*.[0-9]*/bin/clang mr, + + # Additional executables + + /usr/bin/{,@{multiarch}-}ld.bfd ix, # TODO: transfer to opencl_ld child profile? + + # System files + + /etc/debian-version r, + /etc/lsb-release r, + + # User files + + owner @{HOME}/.cache/pocl/kcache/*/*/*/*/*.so{,.o} rw, + } + + + # Include additions to the abstraction + include if exists <abstractions/opencl-pocl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/openssl b/straper/db/public/apparmor/apparmor.d/abstractions/openssl new file mode 100644 index 0000000..b4483b0 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/openssl @@ -0,0 +1,20 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2011 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /etc/ssl/openssl.cnf r, + /etc/ssl/openssl-*.cnf r, + /etc/ssl/{engdef*,engines*}.d/ r, + /etc/ssl/{engdef*,engines*}.d/*.cnf r, + /usr/share/ssl/openssl.cnf r, + + # Include additions to the abstraction + include if exists <abstractions/openssl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/orbit2 b/straper/db/public/apparmor/apparmor.d/abstractions/orbit2 new file mode 100644 index 0000000..20e6b6f --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/orbit2 @@ -0,0 +1,10 @@ +# vim:syntax=apparmor +# orbit2 permissions + + abi <abi/4.0>, + + # system library + /usr/lib/orbit-2.0/*.so mr, + + # Include additions to the abstraction + include if exists <abstractions/orbit2.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/p11-kit b/straper/db/public/apparmor/apparmor.d/abstractions/p11-kit new file mode 100644 index 0000000..57b8f88 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/p11-kit @@ -0,0 +1,32 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /etc/pkcs11/ r, + /etc/pkcs11/pkcs11.conf r, + /etc/pkcs11/modules/ r, + /etc/pkcs11/modules/* r, + + /usr/lib{,32,64}/pkcs11/*.so mr, + /usr/lib/@{multiarch}/pkcs11/*.so mr, + + /usr/share/p11-kit/modules/ r, + /usr/share/p11-kit/modules/* r, + + # gnome-keyring pkcs11 module + owner @{run}/user/[0-9]*/keyring*/pkcs11 rw, + + # p11-kit also supports reading user configuration from ~/.pkcs11 depending + # on how /etc/pkcs11/pkcs11.conf is configured. This should generally not be + # included in this abstraction. + + # Include additions to the abstraction + include if exists <abstractions/p11-kit.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/perl b/straper/db/public/apparmor/apparmor.d/abstractions/perl new file mode 100644 index 0000000..d69fc54 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/perl @@ -0,0 +1,28 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # a few files typically required for perl scripts + /usr/bin/perl rmix, + /usr/bin/perl[0-9].[0-9].[0-9] rmix, + + /usr/lib{,32,64}/perl5/** r, + /usr/lib{,32,64}/perl{,5}/**.so* mr, + /usr/lib/@{multiarch}/perl{,5,-base}/** r, + /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr, + + /usr/share/perl/** r, + /usr/share/perl5/** r, + /etc/perl/** r, + + # Include additions to the abstraction + include if exists <abstractions/perl.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/php b/straper/db/public/apparmor/apparmor.d/abstractions/php new file mode 100644 index 0000000..ca7ca37 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/php @@ -0,0 +1,43 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2009-2010 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # shared snippets for config files + /etc/php{,5,7,8,-legacy}/** r, + + # Xlibs + /usr/X11R6/lib{,32,64}/lib*.so* mr, + # php extensions + /usr/lib{64,}/php{,5,7,8,-legacy}/*/*.so mr, + + # ICU (unicode support) data tables + /usr/share/icu/*/*.dat r, + + # php session mmap socket + /var/lib/php{,5,7,8,-legacy}/session_mm_* rwlk, + # file based session handler + /var/lib/php{,5,7,8,-legacy}/sess_* rwlk, + /var/lib/php{,5,7,8,-legacy}/sessions/* rwlk, + + # php libraries + /usr/share/php{,5,7,8,-legacy}/ r, + /usr/share/php{,5,7,8,-legacy}/** mr, + + # MySQL extension + /usr/share/mysql/** r, + + # Zend opcache + /tmp/.ZendSem.* rwlk, + + # Include additions to the abstraction + include if exists <abstractions/php.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/php-worker b/straper/db/public/apparmor/apparmor.d/abstractions/php-worker new file mode 100644 index 0000000..40f63ad --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/php-worker @@ -0,0 +1,22 @@ +# vim:syntax=apparmor + +# This file contains basic permissions for php-fpm workers + + abi <abi/4.0>, + + # load common libraries and their support files + include <abstractions/base> + # common php files and support files that php needs + include <abstractions/php> + + signal (receive) peer=php-fpm, + + # This is some php opcaching file + /tmp/.ZendSem.* rwk, + + # I think this is adaptive memory management + /sys/devices/system/node/* r, + /sys/devices/system/node/*/meminfo r, + /sys/devices/system/node/ r, + + include if exists <abstractions/php-worker.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/php5 b/straper/db/public/apparmor/apparmor.d/abstractions/php5 new file mode 100644 index 0000000..222968c --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/php5 @@ -0,0 +1,8 @@ +#backwards compatibility include, actual abstraction moved from php5 to php + + abi <abi/4.0>, + + include <abstractions/php> + + # Include additions to the abstraction + include if exists <abstractions/php5.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/postfix-common b/straper/db/public/apparmor/apparmor.d/abstractions/postfix-common new file mode 100644 index 0000000..2691de8 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/postfix-common @@ -0,0 +1,45 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2005 Novell/SUSE +# Copyright (C) 2015-2018 Canonical, Ltd. +# Copyright (C) 2020-2021 Christian Boltz +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ +# used with postfix/* + + abi <abi/4.0>, + + + capability setuid, + capability setgid, + capability sys_chroot, + + # postfix's master can send us signals + signal receive peer=postfix-master, + + unix (send, receive) peer=(label=postfix-master), + + /etc/mailname r, + /etc/postfix/*.cf r, + /etc/postfix/*.db rk, + /etc/postfix/*.lmdb rk, + @{PROC}/net/if_inet6 r, + /usr/lib/postfix/*.so mr, + /usr/lib{,32,64}/sasl2/* mr, + /usr/lib{,32,64}/sasl2/ r, + /usr/lib/@{multiarch}/sasl2/* mr, + /usr/lib/@{multiarch}/sasl2/ r, + /usr/share/icu/[0-9]*.[0-9]*/*.dat r, + + /var/spool/postfix/etc/* r, + /var/spool/postfix/lib/lib*.so* mr, + /var/spool/postfix/lib/@{multiarch}/lib*.so* mr, + + /etc/postfix/dynamicmaps.cf.d/ r, + + # Include additions to the abstraction + include if exists <abstractions/postfix-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/private-files b/straper/db/public/apparmor/apparmor.d/abstractions/private-files new file mode 100644 index 0000000..00ad5f1 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/private-files @@ -0,0 +1,52 @@ +# vim:syntax=apparmor +# privacy-violations contains rules for common files that you want to +# explicitly deny access + + abi <abi/4.0>, + + # privacy violations (don't audit files under $HOME otherwise get a + # lot of false positives when reading contents of directories) + deny @{HOME}/.*history mrwkl, + deny @{HOME}/.fetchmail* mrwkl, + deny @{HOME}/.mutt** mrwkl, + deny @{HOME}/.viminfo* mrwkl, + deny @{HOME}/.*~ mrwkl, + deny @{HOME}/.*.swp mrwkl, + deny @{HOME}/.*~1~ mrwkl, + deny @{HOME}/.*.bak mrwkl, + + # special attention to (potentially) executable files + audit deny @{HOME}/bin/{,**} wl, + audit deny @{HOME}/.config/ w, + audit deny @{HOME}/.config/autostart/{,**} wl, + audit deny @{HOME}/.config/upstart/{,**} wl, + audit deny @{HOME}/.init/{,**} wl, + audit deny @{HOME}/.kde{,4}/ w, + audit deny @{HOME}/.kde{,4}/Autostart/{,**} wl, + audit deny @{HOME}/.kde{,4}/env/{,**} wl, + audit deny @{HOME}/.local/{,share/} w, + audit deny @{HOME}/.local/share/thumbnailers/{,**} wl, + audit deny @{HOME}/.pki/ w, + audit deny @{HOME}/.pki/nssdb/{,*.so{,.[0-9]*}} wl, + + # don't allow reading/updating of run control files + deny @{HOME}/.*rc mrk, + audit deny @{HOME}/.*rc wl, + + # bash + deny @{HOME}/.bash* mrk, + audit deny @{HOME}/.bash* wl, + deny @{HOME}/.inputrc mrk, + audit deny @{HOME}/.inputrc wl, + + # sh/dash/csh/tcsh/pdksh/zsh + deny @{HOME}/.{,z}profile* mrk, + audit deny @{HOME}/.{,z}profile* wl, + deny @{HOME}/.{,z}log{in,out} mrk, + audit deny @{HOME}/.{,z}log{in,out} wl, + + deny @{HOME}/.zshenv mrk, + audit deny @{HOME}/.zshenv wl, + + # Include additions to the abstraction + include if exists <abstractions/private-files.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict b/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict new file mode 100644 index 0000000..28d3ab1 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/private-files-strict @@ -0,0 +1,30 @@ +# vim:syntax=apparmor +# privacy-violations-strict contains additional rules for sensitive +# files that you want to explicitly deny access + + abi <abi/4.0>, + + include <abstractions/private-files> + + # potentially extremely sensitive files + audit deny @{HOME}/.aws/{,**} mrwkl, + audit deny @{HOME}/.gnupg/{,**} mrwkl, + audit deny @{HOME}/.ssh/{,**} mrwkl, + audit deny @{HOME}/.gnome2_private/{,**} mrwkl, + audit deny @{HOME}/.gnome2/ w, + audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl, + # don't allow access to any gnome-keyring modules + audit deny @{run}/user/[0-9]*/keyring** mrwkl, + audit deny @{HOME}/.mozilla/{,**} mrwkl, + audit deny @{HOME}/.config/ w, + audit deny @{HOME}/.config/chromium/{,**} mrwkl, + audit deny @{HOME}/.config/evolution/{,**} mrwkl, + audit deny @{HOME}/.evolution/{,**} mrwkl, + audit deny @{HOME}/.{,mozilla-}thunderbird/{,**} mrwkl, + audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w, + audit deny @{HOME}/.kde{,4}/share/apps/kmail{,2}/{,**} mrwkl, + audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl, + audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl, + + # Include additions to the abstraction + include if exists <abstractions/private-files-strict.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/python b/straper/db/public/apparmor/apparmor.d/abstractions/python new file mode 100644 index 0000000..9289df6 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/python @@ -0,0 +1,54 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /{usr/,}bin/ r, + /{usr/,}bin/python{2.[4-7],3,3.[0-9],3.1[0-9]} r, + + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so,so.*[0-9]} mr, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.dist-info/{METADATA,namespace_packages.txt} r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.VERSION r, + /usr/{local/,}lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/*.egg-info/PKG-INFO r, + /usr/{local/,}lib{,32,64}/python3.{1,}[0-9]/lib-dynload/*.so mr, + + # Site-wide configuration + /etc/python{2.[4-7],3.[0-9],3.1[0-9]}/** r, + + # shared python paths + /usr/share/{pyshared,pycentral,python-support}/** r, + /{var,usr}/lib/{pyshared,pycentral,python-support}/** r, + /usr/lib/{pyshared,pycentral,python-support}/**.so mr, + /var/lib/{pyshared,pycentral,python-support}/**.pyc mr, + /usr/lib/python3/dist-packages/**.so mr, + + # wx paths + /usr/lib/wx/python/*.pth r, + + # python build configuration and headers + /usr/include/python{2.[4-7],3.[0-9],3.1[0-9]}*/pyconfig.h r, + + owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so} mr, + owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r, + owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r, + owner @{HOME}/.local/lib/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/**/ r, + + # Starting with Python 3.8, you can use the PYTHONPYCACHEPREFIX environment + # variable to define a cache directory for Python. + owner @{HOME}/.cache/Python/ rw, + owner @{HOME}/.cache/Python/** rw, + + # Include additions to the abstraction + include if exists <abstractions/python.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt5 b/straper/db/public/apparmor/apparmor.d/abstractions/qt5 new file mode 100644 index 0000000..d9d53ba --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/qt5 @@ -0,0 +1,27 @@ +# vim:syntax=apparmor +# Common rules for Qt5-based applications + + abi <abi/4.0>, + + # Additional libraries + + /usr/lib{,64,/@{multiarch}}/qt5/plugins/**.so mr, + /usr/lib{,64,/@{multiarch}}/qt5/qml/**.so mr, + /usr/lib{,64,/@{multiarch}}/qt5/qml/**.{qmlc,jsc} mr, # Precompiled QML/JavaScript modules + + # System files + + /etc/xdg/QtProject/qtlogging.ini r, + /usr/share/qt5/translations/*.qm r, + /usr/lib{,64,/@{multiarch}}/qt5/plugins/** r, + /usr/lib{,64,/@{multiarch}}/qt5/qml/** r, + + # User files + + owner @{HOME}/.config/QtProject/qtlogging.ini r, + owner @{HOME}/.config/QtProject.conf r, # common settings for QFileDialog, etc (application might need write access) + owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r, # for "platforminputcontexts" plugins + + + # Include additions to the abstraction + include if exists <abstractions/qt5.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt5-compose-cache-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt5-compose-cache-write new file mode 100644 index 0000000..a34178b --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/qt5-compose-cache-write @@ -0,0 +1,13 @@ +# vim:syntax=apparmor +# Allow writing cache for Qt5 "platforminputcontexts" plugins + + abi <abi/4.0>, + + # User files + + owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9], + owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory) + + + # Include additions to the abstraction + include if exists <abstractions/qt5-compose-cache-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt5-settings-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt5-settings-write new file mode 100644 index 0000000..fe592dc --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/qt5-settings-write @@ -0,0 +1,16 @@ +# vim:syntax=apparmor +# Allow writing shared settings for Qt-based applications + + abi <abi/4.0>, + + # User files + + owner @{HOME}/.config/#[0-9]*[0-9] rw, + owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9], + # for temporary files like QtProject.conf.Aqrgeb + owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], + owner @{HOME}/.config/QtProject.conf.lock rwk, + + + # Include additions to the abstraction + include if exists <abstractions/qt5-settings-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt6 b/straper/db/public/apparmor/apparmor.d/abstractions/qt6 new file mode 100644 index 0000000..531f125 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/qt6 @@ -0,0 +1,27 @@ +# vim:syntax=apparmor +# Common rules for Qt6-based applications + + abi <abi/4.0>, + + # Additional libraries + + /usr/lib{,64,/@{multiarch}}/qt6/plugins/**.so mr, + /usr/lib{,64,/@{multiarch}}/qt6/qml/**.so mr, + /usr/lib{,64,/@{multiarch}}/qt6/qml/**.{qmlc,jsc} mr, # Precompiled QML/JavaScript modules + + # System files + + /etc/xdg/QtProject/qtlogging.ini r, + /usr/share/qt6/translations/*.qm r, + /usr/lib{,64,/@{multiarch}}/qt6/plugins/** r, + /usr/lib{,64,/@{multiarch}}/qt6/qml/** r, + + # User files + + owner @{HOME}/.config/QtProject/qtlogging.ini r, + owner @{HOME}/.config/QtProject.conf r, # common settings for QFileDialog, etc (application might need write access) + owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r, # for "platforminputcontexts" plugins + + + # Include additions to the abstraction + include if exists <abstractions/qt6.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt6-compose-cache-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt6-compose-cache-write new file mode 100644 index 0000000..0da3a0f --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/qt6-compose-cache-write @@ -0,0 +1,13 @@ +# vim:syntax=apparmor +# Allow writing cache for Qt6 "platforminputcontexts" plugins + + abi <abi/4.0>, + + # User files + + owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9], + owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory) + + + # Include additions to the abstraction + include if exists <abstractions/qt6-compose-cache-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/qt6-settings-write b/straper/db/public/apparmor/apparmor.d/abstractions/qt6-settings-write new file mode 100644 index 0000000..acdbd72 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/qt6-settings-write @@ -0,0 +1,16 @@ +# vim:syntax=apparmor +# Allow writing shared settings for Qt6-based applications + + abi <abi/4.0>, + + # User files + + owner @{HOME}/.config/#[0-9]*[0-9] rw, + owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9], + # for temporary files like QtProject.conf.Aqrgeb + owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], + owner @{HOME}/.config/QtProject.conf.lock rwk, + + + # Include additions to the abstraction + include if exists <abstractions/qt6-settings-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/recent-documents-write b/straper/db/public/apparmor/apparmor.d/abstractions/recent-documents-write new file mode 100644 index 0000000..93c90ca --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/recent-documents-write @@ -0,0 +1,15 @@ +# vim:syntax=apparmor +# Allow updating recent documents + + abi <abi/4.0>, + + # User files + + owner @{HOME}/.local/share/RecentDocuments/ rw, + owner @{HOME}/.local/share/RecentDocuments/#[0-9]* rw, + owner @{HOME}/.local/share/RecentDocuments/*.desktop rwl -> @{HOME}/.local/share/RecentDocuments/#[0-9]*, + owner @{HOME}/.local/share/RecentDocuments/*.lock rwk, + + + # Include additions to the abstraction + include if exists <abstractions/recent-documents-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ruby b/straper/db/public/apparmor/apparmor.d/abstractions/ruby new file mode 100644 index 0000000..2f35e67 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ruby @@ -0,0 +1,26 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/ r, + /usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/**.rb r, + /usr/lib{,32,64}/ruby/1.[89]{.[0-9],}/*-linux/**.so mr, + + /usr/{,local/}lib{,32,64}/ruby/{site,vendor}_ruby/1.[89]{.[0-9],}/ r, + /usr/{,local/}lib{,32,64}/ruby/{site,vendor}_ruby/1.[89]{.[0-9],}/**.rb r, + /usr/{,local/}lib{,32,64}/ruby/{site,vendor}_ruby/1.[89]{.[0-9],}/*-linux/**.so mr, + + /usr/lib{,32,64}/ruby/gems/1.[89]{.[0-9],}/ r, + /usr/lib{,32,64}/ruby/gems/1.[89]{.[0-9],}/** r, + + # Include additions to the abstraction + include if exists <abstractions/ruby.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/samba b/straper/db/public/apparmor/apparmor.d/abstractions/samba new file mode 100644 index 0000000..4863720 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/samba @@ -0,0 +1,42 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009-2010 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /etc/samba/* r, + /etc/gnutls/config r, + /usr/lib*/ldb/*.so mr, + /usr/lib*/ldb2/*.so mr, + /usr/lib*/ldb2/modules/ldb/*.so mr, + /usr/lib*/samba/ldb/*.so mr, + /usr/share/samba/*.dat r, + /usr/share/samba/codepages/{lowcase,upcase,valid}.dat r, + /var/cache/samba/ w, + /var/cache/samba/lck/* rwk, + /var/lib/samba/** rwk, + /var/log/samba/cores/ rw, + /var/log/samba/cores/** rw, + /var/log/samba/* rw, + @{run}/{,lock/}samba/ w, + @{run}/{,lock/}samba/*.tdb rwk, + @{run}/{,lock/}samba/msg.{lock,sock}/ rwk, + @{run}/{,lock/}samba/msg.{lock,sock}/[0-9]* rwk, + /var/cache/samba/*.tdb rwk, + /var/cache/samba/msg.lock/ rwk, + /var/cache/samba/msg.lock/[0-9]* rwk, + + # required for clustering + /var/lib/ctdb/** rwk, + + deny capability net_admin, # noisy setsockopt() calls from systemd + + # Include additions to the abstraction + include if exists <abstractions/samba.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/samba-rpcd b/straper/db/public/apparmor/apparmor.d/abstractions/samba-rpcd new file mode 100644 index 0000000..fca361a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/samba-rpcd @@ -0,0 +1,30 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2022 SUSE LLC +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ +# vim:syntax=apparmor + +# This file contains basic permissions for samba rpcd_xyz services + + abi <abi/4.0>, + + include <abstractions/base> + include <abstractions/nameservice> + include <abstractions/samba> + + capability setgid, + capability setuid, + + signal receive set=term peer=smbd, + + @{PROC}/sys/kernel/core_pattern r, + owner @{PROC}/@{pid}/fd/ r, + + # Include additions to the abstraction + include if exists <abstractions/samba-rpcd.d> + diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/smbpass b/straper/db/public/apparmor/apparmor.d/abstractions/smbpass new file mode 100644 index 0000000..0a7f60d --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/smbpass @@ -0,0 +1,18 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # libpam-smbpass/pam_smbpass.so permissions + /var/lib/samba/*.[lt]db rwk, + + # Include additions to the abstraction + include if exists <abstractions/smbpass.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers b/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers new file mode 100644 index 0000000..b6ee4ee --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/snap_browsers @@ -0,0 +1,39 @@ +profile snap_browsers { + include if exists <abstractions/snap_browsers.d> + include <abstractions/base> + include <abstractions/dbus-session-strict> + + /etc/passwd r, + /etc/nsswitch.conf r, + /etc/fstab r, + + # noisy + deny owner /run/user/[0-9]*/gdm/Xauthority r, # not needed on Ubuntu + + /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrix, # re-exec + /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/info r, + /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snapd r, + /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-seccomp rPix, + /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-confine Pix, + /var/lib/snapd/system-key r, + /run/snapd.socket rw, + + @{PROC}/version r, + @{PROC}/cmdline r, + @{PROC}/sys/net/core/somaxconn r, + @{PROC}/sys/kernel/seccomp/actions_avail r, + @{PROC}/sys/kernel/random/uuid r, + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{HOME}/.snap/auth.json r, # if exists, required + + dbus send bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="StartTransientUnit" peer=(name="org.freedesktop.systemd1"), + dbus receive bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="JobRemoved", + + /sys/kernel/security/apparmor/features/ r, + + # allow launching official browser snaps. + /snap/{brave,chromium,firefox,opera}/[0-9]*/meta/{snap.yaml,hooks/} r, + /var/lib/snapd/sequence/{brave,chromium,firefox,opera}.json r, + /var/lib/snapd/inhibit/{brave,chromium,firefox,opera}.lock rk, +} diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ssl_certs b/straper/db/public/apparmor/apparmor.d/abstractions/ssl_certs new file mode 100644 index 0000000..3db31fa --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ssl_certs @@ -0,0 +1,46 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2005 Novell/SUSE +# Copyright (C) 2010-2011 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /etc/ca-certificates/{,**} r, + /etc/{,libre}ssl/ r, + /etc/{,libre}ssl/cert.pem r, + /etc/{,libre}ssl/certs/{,**} r, + /{etc,usr/share}/pki/bl[ao]cklist/{,*} r, + /{etc,usr/share}/pki/trust/{,*} r, + /{etc,usr/share}/pki/trust/{bl[oa]cklist,anchors}/{,**} r, + /usr/share/ca-certificates/{,**} r, + /usr/share/ssl/certs/ca-bundle.crt r, + /usr/local/share/ca-certificates/{,**} r, + /var/lib/ca-certificates/{,**} r, + + # acmetool + /var/lib/acme/certs/*/chain r, + /var/lib/acme/certs/*/cert r, + + # dehydrated + /{etc,var/lib}/dehydrated/certs/*/cert*.pem r, + /{etc,var/lib}/dehydrated/certs/*/chain*.pem r, + /{etc,var/lib}/dehydrated/certs/*/fullchain*.pem r, + /{etc,var/lib}/dehydrated/certs/*/ocsp*.der r, + + # certbot + /etc/letsencrypt/archive/*/cert*.pem r, + /etc/letsencrypt/archive/*/chain*.pem r, + /etc/letsencrypt/archive/*/fullchain*.pem r, + + /etc/certbot/archive/*/cert*.pem r, + /etc/certbot/archive/*/chain*.pem r, + /etc/certbot/archive/*/fullchain*.pem r, + + # Include additions to the abstraction + include if exists <abstractions/ssl_certs.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ssl_keys b/straper/db/public/apparmor/apparmor.d/abstractions/ssl_keys new file mode 100644 index 0000000..21e4727 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ssl_keys @@ -0,0 +1,35 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # private ssl permissions + + # Just include the whole /etc/ssl directory if we should have access to + # private keys too + /etc/ssl/ r, + /etc/ssl/** r, + + # acmetool + /var/lib/acme/live/* r, + /var/lib/acme/certs/** r, + /var/lib/acme/keys/** r, + + # dehydrated + /{etc,var/lib}/dehydrated/certs/*/privkey*.pem r, + + # certbot / letsencrypt + /etc/letsencrypt/archive/*/privkey*.pem r, + + /etc/certbot/archive/*/privkey*.pem r, + + # Include additions to the abstraction + include if exists <abstractions/ssl_keys.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/svn-repositories b/straper/db/public/apparmor/apparmor.d/abstractions/svn-repositories new file mode 100644 index 0000000..8a1c7b6 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/svn-repositories @@ -0,0 +1,57 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # This little snippet should abstract the read/write access to a repository. + # it is intended to be included in profiles for svnserve/apache2 and maybe + # some repository viewers like trac/viewvc + + # no hooks exec by default; please define whatever you need explicitly. + + /srv/svn/**/conf/* r, + /srv/svn/**/format r, + /srv/svn/**/db/fs-type r, + /srv/svn/**/db/format r, + + # FSFS + /srv/svn/**/db/ r, + /srv/svn/**/db/uuid r, + /srv/svn/**/db/write-lock rwl, + /srv/svn/**/db/current rwl, + /srv/svn/**/db/current*.tmp rwl, + /srv/svn/**/db/revs/ r, + /srv/svn/**/db/revs/* rw, + /srv/svn/**/db/revprops/ r, + /srv/svn/**/db/revprops/* rw, + /srv/svn/**/db/transactions/** rw, + + # BDB + /srv/svn/**/db/DB_CONFIG r, + /srv/svn/**/db/__db.[0-9]* rwl, + /srv/svn/**/db/log.[0-9]* rwl, + /srv/svn/**/db/nodes rwl, + /srv/svn/**/db/revisions rwl, + /srv/svn/**/db/transactions rwl, + /srv/svn/**/db/copies rwl, + /srv/svn/**/db/changes rwl, + /srv/svn/**/db/representations rwl, + /srv/svn/**/db/strings rwl, + /srv/svn/**/db/uuids rwl, + /srv/svn/**/db/locks rwl, + /srv/svn/**/db/lock-tokens rwl, + + # temp files + /tmp/apr* rwl, + /var/tmp/apr* rwl, + /tmp/report*.tmp rwl, + + # Include additions to the abstraction + include if exists <abstractions/svn-repositories.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/terminfo b/straper/db/public/apparmor/apparmor.d/abstractions/terminfo new file mode 100644 index 0000000..c3391a0 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/terminfo @@ -0,0 +1,10 @@ + abi <abi/4.0>, + + # Default hardcoded locations searched by ncurses for terminfo + @{HOME}/.terminfo/** r, + /etc/terminfo/** r, + /{usr/,}lib/terminfo/** r, + /usr/share/terminfo/** r, + + # Local overrides for systems with TERMINFO env vars, etc. + include if exists <abstractions/terminfo.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/tor b/straper/db/public/apparmor/apparmor.d/abstractions/tor new file mode 100644 index 0000000..0b6c08e --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/tor @@ -0,0 +1,33 @@ +# vim:syntax=apparmor + + #include <abstractions/base> + #include <abstractions/nameservice> + #include <abstractions/openssl> + + network tcp, + network udp, + + capability chown, + capability dac_read_search, + capability fowner, + capability fsetid, + capability setgid, + capability setuid, + + /usr/bin/tor r, + /usr/sbin/tor r, + + # Needed by obfs4proxy + /proc/sys/net/core/somaxconn r, + + /proc/sys/kernel/random/uuid r, + /sys/devices/system/cpu/ r, + /sys/devices/system/cpu/** r, + + /etc/tor/* r, + /usr/share/tor/** r, + + /usr/bin/obfsproxy PUx, + /usr/bin/obfs4proxy Pix, + + /usr/bin/snowflake-client Pix, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/transmission-common b/straper/db/public/apparmor/apparmor.d/abstractions/transmission-common new file mode 100644 index 0000000..038e65e --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/transmission-common @@ -0,0 +1,153 @@ +# vim:syntax=apparmor +# LOGPROF-SUGGEST: no +# Author: Daniel Richard G. <skunk@iSKUNK.ORG> + + include <abstractions/base> + include <abstractions/freedesktop.org> + include <abstractions/nameservice> + include <abstractions/openssl> + + network inet dgram, + network inet6 dgram, + network netlink dgram, + network inet stream, + network inet6 stream, + + dbus (bind) + bus=session + name=com.transmissionbt.Transmission, + dbus (bind) + bus=session + name=com.transmissionbt.transmission_*, + + dbus (receive) + bus=session + path=/ca/desrt/dconf/Writer/user + interface=ca.desrt.dconf.Writer + member=Notify, + dbus (send) + bus=session + path=/ca/desrt/dconf/Writer/user + interface=ca.desrt.dconf.Writer + member=Change + peer=(name=ca.desrt.dconf), + + dbus (receive) + bus=accessibility + path=/org/a11y/atspi/accessible/root + interface=org.freedesktop.DBus.Properties + member=Set, + dbus (send) + bus=accessibility + path=/org/a11y/atspi/accessible/root + interface=org.a11y.atspi.Socket + member=Embed + peer=(name=org.a11y.atspi.Registry), + dbus (send) + bus=accessibility + path=/org/a11y/atspi/registry + interface=org.a11y.atspi.Registry + member=GetRegisteredEvents + peer=(name=org.a11y.atspi.Registry), + dbus (send) + bus=accessibility + path=/org/a11y/atspi/registry/deviceeventcontroller + interface=org.a11y.atspi.DeviceEventController + member={GetDeviceEventListeners,GetKeystrokeListeners} + peer=(name=org.a11y.atspi.Registry), + + dbus (send) + bus={accessibility,session} + path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member={AddMatch,GetNameOwner,Hello,ReleaseName,RemoveMatch,RequestName,StartServiceByName} + peer=(name=org.freedesktop.DBus), + dbus (send) + bus=session + interface=org.freedesktop.DBus.Introspectable + path=/StatusNotifierWatcher + member=Introspect + peer=(name=org.kde.StatusNotifierWatcher), + dbus (send) + bus=session + interface=org.freedesktop.DBus.Properties + path=/StatusNotifierWatcher + member=Get + peer=(name=org.kde.StatusNotifierWatcher), + dbus (send) + bus=session + interface=org.freedesktop.DBus.Properties + path=/org/a11y/bus + member=Get + peer=(name=org.a11y.Bus), + dbus (send) + bus=system + interface=org.freedesktop.DBus.Properties + path=/org/freedesktop/hostname1 + member=GetAll, + + dbus (send) + bus=session + interface=org.freedesktop.Notifications + path=/org/freedesktop/Notifications + member={GetCapabilities,Notify}, + + dbus (send) + bus=session + path=/org/gtk/Private/RemoteVolumeMonitor + interface=org.gtk.Private.RemoteVolumeMonitor + member={IsSupported,List}, + dbus (send) + bus=session + path=/org/gtk/vfs/Daemon + interface=org.gtk.vfs.Daemon + member={GetConnection,ListMonitorImplementations}, + dbus (send) + bus=session + path=/org/gtk/vfs/mount/[1-9]* + interface=org.gtk.vfs.Mount + member={CreateFileMonitor,Enumerate,QueryInfo}, + dbus (receive) + bus=session + path=/org/gtk/vfs/mounttracker + interface=org.gtk.vfs.MountTracker + member=Mounted, + dbus (send) + bus=session + path=/org/gtk/vfs/mounttracker + interface=org.gtk.vfs.MountTracker + member={ListMountableInfo,ListMounts2,LookupMount}, + + @{PROC}/sys/kernel/random/uuid r, + + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/mounts r, + + owner @{run}/user/@{uid}/gvfsd/socket-* rw, + + @{etc_ro}/fstab r, + + @{system_share_dirs}/hwdata/** r, + @{system_share_dirs}/lxqt/** r, + + owner /tmp/tr_session_id_* rwk, + + # allow a top-level directory listing + @{HOME}/ r, + + owner @{HOME}/.cache/transmission/ w, + owner @{HOME}/.cache/transmission/** rw, + owner @{HOME}/.config/transmission/ w, + owner @{HOME}/.config/transmission/** rw, + + owner @{HOME}/.config/lxqt/lxqt.conf r, + + owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ r, + owner @{HOME}/@{XDG_DOWNLOAD_DIR}/** rw, + + # exclude these for now + deny /usr/share/thumbnailers/ r, + deny @{HOME}/.local/share/gvfs-metadata/** r, + deny @{HOME}/.config/lxqt/** rw, + + include if exists <abstractions/transmission-common.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/trash b/straper/db/public/apparmor/apparmor.d/abstractions/trash new file mode 100644 index 0000000..96d80ed --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/trash @@ -0,0 +1,75 @@ +abi <abi/4.0>, + +# requires <tunables/home> + + owner @{HOME}/.config/trashrc rw, + owner @{HOME}/.config/trashrc.lock rwk, + owner @{HOME}/.config/#[0-9]*[0-9] rwk, + owner @{HOME}/.config/trashrc.* rwl -> @{HOME}/.config/#[0-9]*[0-9], + + owner @{run}/user/@{uid}/#[0-9]*[0-9] rw, + owner @{run}/user/@{uid}/trash.so*.[0-9].slave-socket rwl -> @{run}/user/@{uid}/#[0-9]*[0-9], + + # Home trash location + owner @{HOME}/.local/share/Trash/ rw, + owner @{HOME}/.local/share/Trash/#[0-9]*[0-9] rw, + owner @{HOME}/.local/share/Trash/directorysizes{,.*} rwl -> @{HOME}/.local/share/Trash/#[0-9]*[0-9], + owner @{HOME}/.local/share/Trash/files/{,**} rw, + owner @{HOME}/.local/share/Trash/info/ rw, + owner @{HOME}/.local/share/Trash/info/*.trashinfo{,.*} rw, + owner @{HOME}/.local/share/Trash/expunged/ rw, + owner @{HOME}/.local/share/Trash/expunged/[0-9]* rw, + owner @{HOME}/.local/share/Trash/expunged/[0-9]*/ rw, + owner @{HOME}/.local/share/Trash/expunged/[0-9]*/** rw, + + # Partitions' trash location when the admin creates the .Trash/ folder in the top lvl dir + owner /media/*/.Trash/ rw, + owner /media/*/.Trash/@{uid}/ rw, + owner /media/*/.Trash/@{uid}/#[0-9]*[0-9] rw, + owner /media/*/.Trash/@{uid}/directorysizes{,.*} rwl -> /media/*/.Trash/@{uid}/#[0-9]*[0-9], + owner /media/*/.Trash/@{uid}/files/{,**} rw, + owner /media/*/.Trash/@{uid}/info/ rw, + owner /media/*/.Trash/@{uid}/info/*.trashinfo{,.*} rw, + owner /media/*/.Trash/@{uid}/expunged/ rw, + owner /media/*/.Trash/@{uid}/expunged/[0-9]* rw, + owner /media/*/.Trash/@{uid}/expunged/[0-9]*/ rw, + owner /media/*/.Trash/@{uid}/expunged/[0-9]*/** rw, + + # Partitions' trash location when the admin doesn't create the .Trash/ folder in the top lvl dir + owner /media/*/.Trash-@{uid}/ rw, + owner /media/*/.Trash-@{uid}/#[0-9]*[0-9] rw, + owner /media/*/.Trash-@{uid}/directorysizes{,.*} rwl -> /media/*/.Trash-@{uid}/#[0-9]*[0-9], + owner /media/*/.Trash-@{uid}/files/{,**} rw, + owner /media/*/.Trash-@{uid}/info/ rw, + owner /media/*/.Trash-@{uid}/info/*.trashinfo{,.*} rw, + owner /media/*/.Trash-@{uid}/expunged/ rw, + owner /media/*/.Trash-@{uid}/expunged/[0-9]* rw, + owner /media/*/.Trash-@{uid}/expunged/[0-9]*/ rw, + owner /media/*/.Trash-@{uid}/expunged/[0-9]*/** rw, + + # Removable media's trash location when the admin creates the .Trash/ folder in the top lvl dir + owner /media/*/*/.Trash/ rw, + owner /media/*/*/.Trash/@{uid}/ rw, + owner /media/*/*/.Trash/@{uid}/#[0-9]*[0-9] rw, + owner /media/*/*/.Trash/@{uid}/directorysizes{,.*} rwl -> /media/*/*/.Trash/@{uid}/#[0-9]*[0-9], + owner /media/*/*/.Trash/@{uid}/files/{,**} rw, + owner /media/*/*/.Trash/@{uid}/info/ rw, + owner /media/*/*/.Trash/@{uid}/info/*.trashinfo{,.*} rw, + owner /media/*/*/.Trash/@{uid}/expunged/ rw, + owner /media/*/*/.Trash/@{uid}/expunged/[0-9]* rw, + owner /media/*/*/.Trash/@{uid}/expunged/[0-9]*/ rw, + owner /media/*/*/.Trash/@{uid}/expunged/[0-9]*/** rw, + + # Removable media's trash location when the admin doesn't create the .Trash/ folder in the top lvl dir + owner /media/*/*/.Trash-@{uid}/ rw, + owner /media/*/*/.Trash-@{uid}/#[0-9]*[0-9] rw, + owner /media/*/*/.Trash-@{uid}/directorysizes{,.*} rwl -> /media/*/*/.Trash-@{uid}/#[0-9]*[0-9], + owner /media/*/*/.Trash-@{uid}/files/{,**} rw, + owner /media/*/*/.Trash-@{uid}/info/ rw, + owner /media/*/*/.Trash-@{uid}/info/*.trashinfo{,.*} rw, + owner /media/*/*/.Trash-@{uid}/expunged/ rw, + owner /media/*/*/.Trash-@{uid}/expunged/[0-9]* rw, + owner /media/*/*/.Trash-@{uid}/expunged/[0-9]*/ rw, + owner /media/*/*/.Trash-@{uid}/expunged/[0-9]*/** rw, + + include if exists <abstractions/trash.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-bittorrent-clients b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-bittorrent-clients new file mode 100644 index 0000000..36378e4 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-bittorrent-clients @@ -0,0 +1,22 @@ +# vim:syntax=apparmor +# +# abstraction for allowing graphical bittorrent clients in Ubuntu +# +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + /usr/bin/azureus Cxr -> sanitized_helper, + /usr/bin/bitstormlite Cxr -> sanitized_helper, + /usr/bin/btmaketorrentgui Cxr -> sanitized_helper, + /usr/bin/deluge{,-gtk,-console} Cxr -> sanitized_helper, + /usr/bin/gnome-btdownload Cxr -> sanitized_helper, + /usr/bin/kget Cxr -> sanitized_helper, + /usr/bin/ktorrent Cxr -> sanitized_helper, + /usr/bin/qbittorrent Cxr -> sanitized_helper, + /usr/bin/transmission{,-gtk,-qt,-cli} Cxr -> sanitized_helper, + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-bittorrent-clients.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers new file mode 100644 index 0000000..a85203e --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers @@ -0,0 +1,41 @@ +# vim:syntax=apparmor +# +# abstraction for allowing access to graphical browsers in Ubuntu +# +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + /usr/bin/arora Cx -> sanitized_helper, + /usr/bin/dillo Cx -> sanitized_helper, + /usr/bin/Dooble Cx -> sanitized_helper, + /usr/bin/epiphany Cx -> sanitized_helper, + /usr/bin/epiphany-browser Cx -> sanitized_helper, + /usr/bin/epiphany-webkit Cx -> sanitized_helper, + /usr/lib/fennec-*/fennec Cx -> sanitized_helper, + /usr/bin/kazehakase Cx -> sanitized_helper, + /usr/bin/konqueror Cx -> sanitized_helper, + /usr/bin/midori Cx -> sanitized_helper, + /usr/bin/netsurf Cx -> sanitized_helper, + /usr/bin/seamonkey Cx -> sanitized_helper, + /usr/bin/sensible-browser Pixr, + + /usr/bin/chromium{,-browser} Cx -> sanitized_helper, + /usr/lib{,64}/chromium{,-browser}/chromium{,-browser} Cx -> sanitized_helper, + + # this should cover all firefox browsers and versions (including shiretoko + # and abrowser) + /usr/bin/firefox Cxr -> sanitized_helper, + /usr/lib{,64}/firefox*/firefox* Cx -> sanitized_helper, + + # Iceweasel + /usr/bin/iceweasel Cxr -> sanitized_helper, + /usr/lib/iceweasel/iceweasel Cx -> sanitized_helper, + + # some unpackaged, but popular browsers + /usr/lib/icecat-*/icecat Cx -> sanitized_helper, + /usr/bin/opera Cx -> sanitized_helper, + /opt/google/chrome{,-beta,-unstable}/google-chrome{,-beta,-unstable} Cx -> sanitized_helper, + /opt/brave.com/brave{,-beta,-dev,-nightly}/brave-browser{,-beta,-dev,-nightly} Cx -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/java b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/java new file mode 100644 index 0000000..00dc502 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/java @@ -0,0 +1,120 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + + # Java plugin + owner @{HOME}/.java/deployment/deployment.properties k, + /etc/java-*/ r, + /etc/java-*/** r, + /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}lib/*/IcedTeaPlugin.so mr, + /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}lib/*/IcedTeaPlugin.so mr, + /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java cx -> browser_openjdk, + /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java cx -> browser_openjdk, + /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} cx -> browser_java, + /usr/lib/jvm/java-*-sun-1.*/jre/lib/*/libnp*.so cx -> browser_java, + /usr/lib/j2*-ibm/jre/bin/java cx -> browser_java, + owner /{,var/}run/user/*/icedteaplugin-*/ rw, + owner /{,var/}run/user/*/icedteaplugin-*/** rwk, + + # Profile for the supported OpenJDK in Ubuntu. This doesn't require the + # unfortunate workarounds of the proprietary Javas, so have a separate + # profile. + profile browser_openjdk { + include <abstractions/base> + include <abstractions/fonts> + include <abstractions/gnome> + include <abstractions/kde> + include <abstractions/nameservice> + include <abstractions/ssl_certs> + include <abstractions/user-tmp> + include <abstractions/private-files-strict> + + network inet stream, + network inet6 stream, + @{PROC}/@{pid}/net/if_inet6 r, + @{PROC}/@{pid}/net/ipv6_route r, + + /etc/java-*/ r, + /etc/java-*/** r, + /etc/lsb-release r, + /etc/ssl/certs/java/* r, + /etc/timezone r, + /etc/writable/timezone r, + + @{PROC}/@{pid}/ r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/filesystems r, + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/** r, + /usr/share/** r, + /var/lib/dbus/machine-id r, + + /usr/bin/env ix, + /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java ix, + /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java ix, + /usr/lib/jvm/java-{6,7}-openjdk*/jre/lib/i386/client/classes.jsa m, + + # Why would java need this? + deny /usr/bin/gconftool-2 x, + + owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-appletviewer-to-plugin rw, + owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-plugin-{,debug-}to-appletviewer r, + owner @{HOME}/ r, + owner @{HOME}/** rwk, + } + + # Profile for commercial Javas. These need workarounds to work right (eg + # Sun's forcing of an executable stack (LP: #535247)). + profile browser_java { + include <abstractions/base> + include <abstractions/fonts> + include <abstractions/gnome> + include <abstractions/kde> + include <abstractions/nameservice> + include <abstractions/ssl_certs> + include <abstractions/user-tmp> + include <abstractions/private-files-strict> + + network inet stream, + network inet6 stream, + @{PROC}/@{pid}/net/if_inet6 r, + @{PROC}/@{pid}/net/ipv6_route r, + @{PROC}/loadavg r, + + /etc/debian_version r, + /etc/java-*/ r, + /etc/java-*/** r, + /etc/lsb-release r, + /etc/ssl/certs/java/* r, + /etc/timezone r, + /etc/writable/timezone r, + + @{PROC}/@{pid}/ r, + @{PROC}/@{pid}/fd/ r, + @{PROC}/filesystems r, + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/** r, + /usr/share/** r, + /var/lib/dbus/machine-id r, + + /usr/bin/env ix, + /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} ix, + /usr/lib/jvm/java-*-sun-1.*/jre/lib/i386/client/classes.jsa m, + /usr/lib/j2*-ibm/jre/bin/java ix, + + # noisy, can't write here anyway + deny /etc/.java/ w, + deny /etc/.java/** w, + + deny /usr/bin/gconftool-2 x, + + owner @{HOME}/ r, + owner @{HOME}/** rwk, + + # These are seriously unfortunate, but required due to LP: #535247 + /etc/passwd m, + owner @{HOME}/.java/**/cache/** m, + owner /tmp/** m, + /usr/lib{,32,64}/jvm/**/*.jar mr, + /usr/share/fonts/** m, + } diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/kde b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/kde new file mode 100644 index 0000000..0447862 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/kde @@ -0,0 +1,12 @@ +# vim:syntax=apparmor +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + include <abstractions/kde> + /usr/bin/kde4-config Cx -> sanitized_helper, + + # https://bugs.kde.org/show_bug.cgi?id=397399 + /usr/bin/plasma-browser-integration-host Cx -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/mailto b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/mailto new file mode 100644 index 0000000..c09b501 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/mailto @@ -0,0 +1,11 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + + # for mailto: + include <abstractions/ubuntu-email> + include <abstractions/ubuntu-console-email> + + # Terminals for using console applications. These abstractions should ideally + # have 'ix' to restrct access to what only firefox is allowed to do + include <abstractions/ubuntu-gnome-terminal> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/multimedia b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/multimedia new file mode 100644 index 0000000..37fae70 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/multimedia @@ -0,0 +1,51 @@ +# vim:syntax=apparmor +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + include <abstractions/X> + + # Pulseaudio + /usr/bin/pulseaudio Pixr, + + # Image viewers + /usr/bin/eog Cxr -> sanitized_helper, + /usr/bin/gimp* Cxr -> sanitized_helper, + /usr/bin/shotwell Cxr -> sanitized_helper, + /usr/bin/digikam Cxr -> sanitized_helper, + /usr/bin/gwenview Cxr -> sanitized_helper, + + include <abstractions/ubuntu-media-players> + owner @{HOME}/.adobe/ w, + owner @{HOME}/.adobe/** rw, + owner @{HOME}/.macromedia/ w, + owner @{HOME}/.macromedia/** rw, + /opt/real/RealPlayer/mozilla/nphelix.so rm, + /usr/bin/lpstat Cxr -> sanitized_helper, + /usr/bin/lpr Cxr -> sanitized_helper, + + # Bittorrent clients + include <abstractions/ubuntu-bittorrent-clients> + + # Archivers + /usr/bin/ark Cxr -> sanitized_helper, + /usr/bin/file-roller Cxr -> sanitized_helper, + /usr/bin/xarchiver Cxr -> sanitized_helper, + /usr/local/lib{,32,64}/*.so* mr, + + # News feed readers + include <abstractions/ubuntu-feed-readers> + + # If we allow the above, nvidia based systems will also need this + include <abstractions/nvidia> + + # Virus scanners + /usr/bin/clamscan Cx -> sanitized_helper, + + # gxine (LP: #1057642) + /var/lib/xine/gxine.desktop r, + + # For WebRTC camera access (LP: #1665535) + /dev/video[0-9]* rw, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common new file mode 100644 index 0000000..b4c4b37 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common @@ -0,0 +1,18 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + + # + # Plugins/helpers + # + @{PROC}/@{pid}/fd/ r, + /usr/lib/** rm, + /{,usr/}bin/bash ixr, + /{,usr/}bin/dash ixr, + /{,usr/}bin/grep ixr, + /{,usr/}bin/sed ixr, + /usr/bin/m4 ixr, + + # Since all the ubuntu-browsers.d abstractions need this, just include it + # here + include <abstractions/ubuntu-helpers> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/productivity b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/productivity new file mode 100644 index 0000000..f778ce2 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/productivity @@ -0,0 +1,26 @@ +# vim:syntax=apparmor +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + # Openoffice.org + /usr/bin/ooffice Cxr -> sanitized_helper, + /usr/bin/oocalc Cxr -> sanitized_helper, + /usr/bin/oodraw Cxr -> sanitized_helper, + /usr/bin/ooimpress Cxr -> sanitized_helper, + /usr/bin/oowriter Cxr -> sanitized_helper, + /usr/lib/openoffice/program/soffice Cxr -> sanitized_helper, + + # LibreOffice + /usr/bin/libreoffice Cxr -> sanitized_helper, + /usr/bin/localc Cxr -> sanitized_helper, + /usr/bin/lodraw Cxr -> sanitized_helper, + /usr/bin/loimpress Cxr -> sanitized_helper, + /usr/bin/lowriter Cxr -> sanitized_helper, + /usr/lib/libreoffice/program/soffice Cxr -> sanitized_helper, + + # PDFs + /usr/bin/evince Cxr -> sanitized_helper, + /usr/bin/okular Cxr -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/text-editors b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/text-editors new file mode 100644 index 0000000..6280b4d --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/text-editors @@ -0,0 +1,16 @@ +# vim:syntax=apparmor +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + # Text editors (It's All Text [https://addons.mozilla.org/en-US/firefox/addon/4125]) + /usr/bin/emacsclient.emacs-snapshot Cxr -> sanitized_helper, + /usr/bin/emacsclient.emacs2[2-9] Cxr -> sanitized_helper, + /usr/bin/emacs-snapshot-gtk Cxr -> sanitized_helper, + /usr/bin/gedit Cxr -> sanitized_helper, + /usr/bin/vim.gnome Cxr -> sanitized_helper, + /usr/bin/leafpad Cxr -> sanitized_helper, + /usr/bin/mousepad Cxr -> sanitized_helper, + /usr/bin/kate Cxr -> sanitized_helper, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration new file mode 100644 index 0000000..8e73ec2 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration @@ -0,0 +1,37 @@ +# vim:syntax=apparmor +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + # Apport + /usr/bin/apport-bug Cx -> sanitized_helper, + + # Package installation + /usr/bin/apturl Cxr -> sanitized_helper, + /usr/share/software-center/software-center Cxr -> sanitized_helper, + + # Input Methods + /usr/bin/scim Cx -> sanitized_helper, + /usr/bin/scim-bridge Cx -> sanitized_helper, + + # File managers + /usr/bin/nautilus Cxr -> sanitized_helper, + /usr/bin/{t,T}hunar Cxr -> sanitized_helper, + /usr/bin/dolphin Cxr -> sanitized_helper, + + # Themes + /usr/bin/gnome-appearance-properties Cxr -> sanitized_helper, + + # Kubuntu + /usr/lib/mozilla/kmozillahelper Cxr -> sanitized_helper, + + # Exo-aware applications + include <abstractions/exo-open> + + # unity webapps integration. Could go in its own abstraction + owner /run/user/*/dconf/user rw, + owner @{HOME}/.local/share/unity-webapps/availableapps*.db rwk, + /usr/bin/debconf-communicate Cxr -> sanitized_helper, + owner @{HOME}/.config/libaccounts-glib/accounts.db rk, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration-xul b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration-xul new file mode 100644 index 0000000..c1e4f7a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/ubuntu-integration-xul @@ -0,0 +1,8 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + + # firefox-notify + include <abstractions/python> + /usr/bin/python2.[4567] ix, + /usr/share/xul-ext/notify/**/download_complete_notify.py ix, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files new file mode 100644 index 0000000..fa73152 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files @@ -0,0 +1,31 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + + # Allow read to all files user has DAC access to and write access to all + # files owned by the user in $HOME. + @{HOME}/ r, + @{HOME}/** r, + owner @{HOME}/** w, + + # Do not allow read and/or write to particularly sensitive/problematic files + include <abstractions/private-files> + audit deny @{HOME}/.ssh/{,**} mrwkl, + audit deny @{HOME}/.gnome2_private/{,**} mrwkl, + audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w, + audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl, + audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl, + + # Comment this out if using gpg plugin/addons + audit deny @{HOME}/.gnupg/{,**} mrwkl, + + # Allow read to all files user has DAC access to and write for files the user + # owns on removable media and filesystems. + /media/** r, + /mnt/** r, + /srv/** r, + /net/** r, + owner /media/** w, + owner /mnt/** w, + owner /srv/** w, + owner /net/** w, diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-browsers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-browsers new file mode 100644 index 0000000..f055858 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-browsers @@ -0,0 +1,23 @@ +# vim:syntax=apparmor +# +# abstraction for allowing access to text-only browsers in Ubuntu. These will +# typically also need a terminal, so when using this abstraction, should also +# do something like: +# +# include <abstractions/ubuntu-gnome-terminal> +# +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + /usr/bin/elinks Cx -> sanitized_helper, + /usr/bin/links Cx -> sanitized_helper, + /usr/bin/lynx.cur Cx -> sanitized_helper, + /usr/bin/netrik Cx -> sanitized_helper, + /usr/bin/w3m Cx -> sanitized_helper, + + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-console-browsers.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-email b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-email new file mode 100644 index 0000000..dee7fee --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-console-email @@ -0,0 +1,23 @@ +# vim:syntax=apparmor +# +# abstraction for allowing console email clients in Ubuntu. These will +# typically also need a terminal, so when using this abstraction, should also +# do something like: +# +# include <abstractions/ubuntu-gnome-terminal> +# +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + /usr/bin/alpine Cx -> sanitized_helper, + /usr/bin/citadel Cx -> sanitized_helper, + /usr/bin/cone Cx -> sanitized_helper, + /usr/bin/elmo Cx -> sanitized_helper, + /usr/bin/mutt Cx -> sanitized_helper, + + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-console-email.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-email b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-email new file mode 100644 index 0000000..6ebc26e --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-email @@ -0,0 +1,29 @@ +# vim:syntax=apparmor +# +# abstraction for allowing graphical email clients in Ubuntu +# +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + /usr/bin/anjal Cx -> sanitized_helper, + /usr/bin/balsa Cx -> sanitized_helper, + /usr/bin/claws-mail Cx -> sanitized_helper, + /usr/bin/evolution Cx -> sanitized_helper, + /usr/bin/geary Cx -> sanitized_helper, + /usr/bin/gnome-gmail Cx -> sanitized_helper, + /usr/lib/GNUstep/Applications/GNUMail.app/GNUMail Cx -> sanitized_helper, + /usr/bin/kmail Cx -> sanitized_helper, + /usr/bin/mailody Cx -> sanitized_helper, + /usr/bin/modest Cx -> sanitized_helper, + /usr/bin/seamonkey Cx -> sanitized_helper, + /usr/bin/sylpheed Cx -> sanitized_helper, + /usr/bin/tkrat Cx -> sanitized_helper, + + /usr/bin/thunderbird Cx -> sanitized_helper, # used by gio-launch-desktop + /usr/lib/thunderbird*/thunderbird{,.sh,-bin} Cx -> sanitized_helper, + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-email.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-feed-readers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-feed-readers new file mode 100644 index 0000000..9e2e116 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-feed-readers @@ -0,0 +1,15 @@ +# vim:syntax=apparmor +# +# abstraction for allowing graphical news feed readers in Ubuntu +# +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + /usr/bin/akregator Cxr -> sanitized_helper, + /usr/bin/liferea-add-feed Cxr -> sanitized_helper, + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-feed-readers.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-gnome-terminal b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-gnome-terminal new file mode 100644 index 0000000..46318f4 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-gnome-terminal @@ -0,0 +1,15 @@ +# vim:syntax=apparmor +# +# for allowing access to gnome-terminal +# + + abi <abi/4.0>, + + include <abstractions/gnome> + + # do not use ux or PUx here. Use at a minimum ix + /usr/bin/gnome-terminal ix, + + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-gnome-terminal.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-helpers b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-helpers new file mode 100644 index 0000000..d5f2243 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-helpers @@ -0,0 +1,98 @@ +# Lenient profile that is intended to be used when 'Ux' is desired but +# does not provide enough environment sanitizing. This effectively is an +# open profile that blacklists certain known dangerous files and also +# does not allow any capabilities. For example, it will not allow 'm' on files +# owned be the user invoking the program. While this provides some additional +# protection, please use with care as applications running under this profile +# are effectively running without any AppArmor protection. Use this profile +# only if the process absolutely must be run (effectively) unconfined. +# +# Usage: +# Because this abstraction defines the sanitized_helper profile, it must only +# be included once. Therefore this abstraction should typically not be +# included in other abstractions so as to avoid parser errors regarding +# multiple definitions. +# +# Limitations: +# 1. This does not work for root owned processes, because of the way we use +# owner matching in the sanitized helper. We could do a better job with +# this to support root, but it would make the policy harder to understand +# and going unconfined as root is not desirable any way. +# +# 2. For this sanitized_helper to work, the program running in the sanitized +# environment must open symlinks directly in order for AppArmor to mediate +# it. This is confirmed to work with: +# - compiled code which can load shared libraries +# - python imports +# It is known not to work with: +# - perl includes +# 3. Sanitizing ruby and java +# +# Use at your own risk. This profile was developed as an interim workaround for +# LP: #851986 until AppArmor utilizes proper environment filtering. + + abi <abi/4.0>, + +profile sanitized_helper { + include <abstractions/base> + include <abstractions/X> + include if exists <local/ubuntu-helpers> + + # Allow all networking + network inet, + network inet6, + + # Allow all DBus communications + include <abstractions/dbus-session-strict> + include <abstractions/dbus-strict> + dbus, + + # Needed for Google Chrome + ptrace (trace) peer=**//sanitized_helper, + + # Allow exec of anything, but under this profile. Allow transition + # to other profiles if they exist. + /{usr/,usr/local/,}{bin,sbin}/* Pixr, + + # Allow exec of libexec applications in /usr/lib* and /usr/local/lib* + /usr/{,local/}lib*/{,**/}* Pixr, + + # Allow exec of software-center scripts. We may need to allow wider + # permissions for /usr/share, but for now just do this. (LP: #972367) + /usr/share/software-center/* Pixr, + + # Allow exec of texlive font build scripts (LP: #1010909) + /usr/share/texlive/texmf{,-dist}/web2c/{,**/}* Pixr, + + # While the chromium and chrome sandboxes are setuid root, they only link + # in limited libraries so glibc's secure execution should be enough to not + # require the santized_helper (ie, LD_PRELOAD will only use standard system + # paths (man ld.so)). + /usr/lib/chromium-browser/chromium-browser-sandbox PUxr, + /usr/lib/chromium{,-browser}/chrome-sandbox PUxr, + /opt/google/chrome{,-beta,-unstable}/chrome-sandbox PUxr, + /opt/google/chrome{,-beta,-unstable}/google-chrome Pixr, + /opt/google/chrome{,-beta,-unstable}/chrome Pixr, + /opt/google/chrome{,-beta,-unstable}/chrome_crashpad_handler Pixr, + /opt/google/chrome{,-beta,-unstable}/{,**/}lib*.so{,.*} m, + + # The same is needed for Brave + /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome-sandbox PUxr, + /opt/brave.com/brave{,-beta,-dev,-nightly}/brave-browser{,-beta,-dev,-nightly} Pixr, + /opt/brave.com/brave{,-beta,-dev,-nightly}/brave Pixr, + /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome_crashpad_handler Pixr, + /opt/brave.com/brave{,-beta,-dev,-nightly}/{,**/}lib*.so{,.*} m, + + # Allow running snap applications + # https://bugs.launchpad.net/apparmor/+bug/2095872 + /usr/bin/snap ux, + + # Full access + / r, + /** rwkl, + /{,usr/,usr/local/}lib{,32,64}/{,**/}*.so{,.*} m, + + # Dangerous files + audit deny owner /**/* m, # compiled libraries + audit deny owner /**/*.py* r, # python imports +} diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-konsole b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-konsole new file mode 100644 index 0000000..2a40e38 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-konsole @@ -0,0 +1,22 @@ +# vim:syntax=apparmor +# +# for allowing access to konsole +# + + abi <abi/4.0>, + + include <abstractions/consoles> + include <abstractions/kde> + capability sys_ptrace, + @{PROC}/@{pid}/status r, + @{PROC}/@{pid}/stat r, + @{PROC}/@{pid}/cmdline r, + /{,var/}run/utmp r, + /dev/ptmx rw, + + # do not use ux or Ux here. Use at a minimum ix + /usr/bin/konsole ix, + + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-konsole.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-media-players b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-media-players new file mode 100644 index 0000000..86ec80a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-media-players @@ -0,0 +1,65 @@ +# vim:syntax=apparmor +# +# abstraction for allowing access to media players in Ubuntu +# +# Users of this abstraction need to include the ubuntu-helpers abstraction +# in the toplevel profile. Eg: +# include <abstractions/ubuntu-helpers> + + abi <abi/4.0>, + + /usr/bin/amarok Cxr -> sanitized_helper, + /usr/bin/audacious2 Cxr -> sanitized_helper, + /usr/bin/audacity Cxr -> sanitized_helper, + /usr/bin/bangarang Cxr -> sanitized_helper, + /usr/bin/banshee Cxr -> sanitized_helper, + /usr/bin/banshee-1 Cxr -> sanitized_helper, + /usr/bin/decibel Cxr -> sanitized_helper, + /usr/bin/dragon Cxr -> sanitized_helper, + /usr/bin/esperanza Cxr -> sanitized_helper, + /usr/bin/exaile Cxr -> sanitized_helper, + /usr/bin/freevo Cxr -> sanitized_helper, + /usr/bin/gmerlin Cxr -> sanitized_helper, + /usr/bin/gxmms Cxr -> sanitized_helper, + /usr/bin/gxmms2 Cxr -> sanitized_helper, + /usr/bin/hornsey Cxr -> sanitized_helper, + /usr/bin/jlgui Cxr -> sanitized_helper, + /usr/bin/juk Cxr -> sanitized_helper, + /usr/bin/kaffeine Cxr -> sanitized_helper, + /usr/bin/listen Cxr -> sanitized_helper, + /usr/share/minirok/minirok.py Cxr -> sanitized_helper, + + # mplayer + /etc/mplayerplug-in.conf r, + /usr/bin/gmplayer Cxr -> sanitized_helper, + /usr/bin/gnome-mplayer Cxr -> sanitized_helper, + /usr/bin/kmplayer Cxr -> sanitized_helper, + /usr/bin/mplayer Cxr -> sanitized_helper, + /usr/bin/smplayer Cxr -> sanitized_helper, + + /usr/bin/muine Cxr -> sanitized_helper, + /usr/bin/potamus Cxr -> sanitized_helper, + /usr/bin/promoe Cxr -> sanitized_helper, + /usr/bin/qmmp Cxr -> sanitized_helper, + /usr/bin/quodlibet Cxr -> sanitized_helper, + /usr/bin/rhythmbox Cxr -> sanitized_helper, + /usr/bin/strange-quark Cxr -> sanitized_helper, + /usr/bin/swfdec-player Cxr -> sanitized_helper, + /usr/bin/timidity Cxr -> sanitized_helper, + /usr/lib/totem/** ixr, + /usr/bin/totem-gstreamer Cxr -> sanitized_helper, + /usr/bin/totem-xine Cxr -> sanitized_helper, + /usr/bin/totem Cxr -> sanitized_helper, + /usr/bin/vlc Cxr -> sanitized_helper, + /usr/bin/xfmedia Cxr -> sanitized_helper, + /usr/bin/xmms Cxr -> sanitized_helper, + + # gnash + /usr/bin/gtk-gnash ixr, + /etc/gnashrc r, + /etc/gnashpluginrc r, + owner @{HOME}/.gnash/ rw, + owner @{HOME}/.gnash/** rw, + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-media-players.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-base b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-base new file mode 100644 index 0000000..c8305d8 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-base @@ -0,0 +1,105 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2013-2014 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + +# +# Rules common to applications running under Unity 7 +# + +include <abstractions/gnome> + +include <abstractions/dbus-session-strict> +include <abstractions/dbus-strict> + + # + # Access required for connecting to/communication with Unity HUD + # + dbus (send) + bus=session + path="/com/canonical/hud", + dbus (send) + bus=session + interface="com.canonical.hud.*", + dbus (send) + bus=session + path="/com/canonical/hud/applications/*", + dbus (receive) + bus=session + path="/com/canonical/hud", + dbus (receive) + bus=session + interface="com.canonical.hud.*", + + # + # Allow access for connecting to/communication with the appmenu + # + # dbusmenu + dbus (send) + bus=session + interface="com.canonical.AppMenu.*", + dbus (receive, send) + bus=session + path=/com/canonical/menu/**, + + # gmenu + dbus (receive, send) + bus=session + interface=org.gtk.Actions, + dbus (receive, send) + bus=session + interface=org.gtk.Menus, + + # + # Access required for using freedesktop notifications + # + dbus (send) + bus=session + path=/org/freedesktop/Notifications + member=GetCapabilities, + dbus (send) + bus=session + path=/org/freedesktop/Notifications + member=GetServerInformation, + dbus (send) + bus=session + path=/org/freedesktop/Notifications + member=Notify, + dbus (receive) + bus=session + member="Notify" + peer=(name="org.freedesktop.DBus"), + dbus (receive) + bus=session + path=/org/freedesktop/Notifications + member=NotificationClosed, + dbus (send) + bus=session + path=/org/freedesktop/Notifications + member=CloseNotification, + + # accessibility + dbus (send) + bus=session + peer=(name=org.a11y.Bus), + dbus (receive) + bus=session + interface=org.a11y.atspi*, + dbus (receive, send) + bus=accessibility, + + # + # Deny potentially dangerous access + # + deny dbus bus=session path=/com/canonical/[Uu]nity/[Dd]ebug**, + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-unity7-base.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-launcher b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-launcher new file mode 100644 index 0000000..d73edfc --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-launcher @@ -0,0 +1,12 @@ + abi <abi/4.0>, + + # + # Access required for connecting to/communicating with the Unity Launcher + # + dbus (send) + bus=session + interface="com.canonical.Unity.LauncherEntry" + member="Update", + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-unity7-launcher.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-messaging b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-messaging new file mode 100644 index 0000000..7e2ff3a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-unity7-messaging @@ -0,0 +1,12 @@ + abi <abi/4.0>, + + # + # Access required for connecting to/communicating with the Unity messaging + # indicator + # + dbus (receive, send) + bus=session + path="/com/canonical/indicator/messages/*", + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-unity7-messaging.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-xterm b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-xterm new file mode 100644 index 0000000..932f85a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-xterm @@ -0,0 +1,18 @@ +# vim:syntax=apparmor +# +# for allowing access to xterm +# + + abi <abi/4.0>, + + include <abstractions/consoles> + /dev/ptmx rw, + /{,var/}run/utmp r, + /etc/X11/app-defaults/XTerm r, + + # do not use ux or Ux here. Use at a minimum ix + /usr/bin/xterm ix, + + + # Include additions to the abstraction + include if exists <abstractions/ubuntu-xterm.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-download b/straper/db/public/apparmor/apparmor.d/abstractions/user-download new file mode 100644 index 0000000..0f8e30a --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/user-download @@ -0,0 +1,29 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2014 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + +# Description: Where common programs should allow users to download +# files + + owner @{HOME}/tmp/** rwl, + owner @{HOME}/[dD]ownload{,s}/ r, + owner @{HOME}/[dD]ownload{,s}/** rwl, + owner @{HOME}/[^.]* rwl, + owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, + owner @{HOME}/@{XDG_DESKTOP_DIR}/* rwl, + owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ r, + owner @{HOME}/@{XDG_DOWNLOAD_DIR}/* rwl, + owner "@{HOME}/My Downloads/" r, + owner "@{HOME}/My Downloads/**" rwl, + + # Include additions to the abstraction + include if exists <abstractions/user-download.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-mail b/straper/db/public/apparmor/apparmor.d/abstractions/user-mail new file mode 100644 index 0000000..366c7b2 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/user-mail @@ -0,0 +1,28 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2014 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # location of user mail, spool and mboxes + owner @{HOME}/[mM]ail/ r, + owner @{HOME}/[mM]ail/** rwl, + owner @{HOME}/postponed* rwl, + /var/{,spool/}mail/ r, + owner /var/{,spool/}mail/* rwl, + owner @{HOME}/mbox.lock* rwl, + owner @{HOME}/mbox rw, + owner @{HOME}/inbox rw, + owner @{HOME}/.forward r, + owner @{HOME}/Maildir/ r, + owner @{HOME}/Maildir/** rwl, + + # Include additions to the abstraction + include if exists <abstractions/user-mail.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-manpages b/straper/db/public/apparmor/apparmor.d/abstractions/user-manpages new file mode 100644 index 0000000..66a4013 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/user-manpages @@ -0,0 +1,29 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # perhaps your configuration has users elsewhere, or you don't wish + # them to read their own manpages + owner @{HOME}/man/ r, + owner @{HOME}/man/** r, + owner @{HOME}/tmp/groff* rwl, + + # kindof required + owner /tmp/groff* rwl, + + # standard system manpages + /usr/local/share/man/man?/ r, + /usr/local/share/man/man?/** r, + /usr/{share,X11R6,local,kerberos}/man/** r, + /usr/man/** r, + + # Include additions to the abstraction + include if exists <abstractions/user-manpages.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-tmp b/straper/db/public/apparmor/apparmor.d/abstractions/user-tmp new file mode 100644 index 0000000..804135f --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/user-tmp @@ -0,0 +1,25 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009-2010 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # per-user tmp directories + owner @{HOME}/tmp/** rwkl, + owner @{HOME}/tmp/ rw, + + # global tmp directories + owner /var/tmp/** rwkl, + /var/tmp/ rw, + owner /tmp/** rwkl, + /tmp/ rw, + + # Include additions to the abstraction + include if exists <abstractions/user-tmp.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/user-write b/straper/db/public/apparmor/apparmor.d/abstractions/user-write new file mode 100644 index 0000000..b94ce17 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/user-write @@ -0,0 +1,26 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2014 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # per-user write directories + owner @{HOME}/ r, + owner @{HOME}/@{XDG_DESKTOP_DIR}/ r, + owner @{HOME}/@{XDG_DOCUMENTS_DIR}/ r, + owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/ r, + owner @{HOME}/[^.]*/ rw, + owner @{HOME}/[^.]* rwl, + owner @{HOME}/@{XDG_DESKTOP_DIR}/** rwl, + owner @{HOME}/@{XDG_DOCUMENTS_DIR}/** rwl, + owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/** rwl, + + # Include additions to the abstraction + include if exists <abstractions/user-write.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/video b/straper/db/public/apparmor/apparmor.d/abstractions/video new file mode 100644 index 0000000..0495388 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/video @@ -0,0 +1,20 @@ +# vim:syntax=apparmor +# video device access + + abi <abi/4.0>, + + # System devices + @{sys}/class/video4linux/ r, + @{sys}/class/video4linux/** r, + + owner /dev/shm/libv4l-* rw, + /dev/video[0-9]* rw, + @{sys}/devices/pci[0-9]*/**/usb[0-9]/**/video4linux/video[0-9]*/dev r, + @{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{modalias,speed} r, + + @{sys}/devices/virtual/dmi/id/sys_vendor r, + @{sys}/devices/virtual/dmi/id/product_{name,version} r, + @{sys}/devices/virtual/dmi/id/board_{vendor,name,version} r, + + # Include additions to the abstraction + include if exists <abstractions/video.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/vulkan b/straper/db/public/apparmor/apparmor.d/abstractions/vulkan new file mode 100644 index 0000000..aede375 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/vulkan @@ -0,0 +1,26 @@ +# vim:syntax=apparmor +# Vulkan access requirements + + abi <abi/4.0>, + + # System files + /dev/dri/ r, # libvulkan_radeon.so, libvulkan_intel.so (Mesa) + /etc/glvnd/egl_vendor.d/{,*.json} r, + /etc/vulkan/icd.d/{,*.json} r, + /etc/vulkan/{explicit,implicit}_layer.d/{,*.json} r, + # for drmGetMinorNameForFD() from libvulkan_intel.so (Mesa) + @{sys}/devices/pci[0-9]*/*/drm/ r, + @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/gt_{max,min}_freq_mhz r, # anv_enumerate_physical_devices() from libvulkan_intel.so + @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/metrics/ r, # anv_enumerate_physical_devices() from libvulkan_intel.so + @{sys}/devices/pci[0-9]*/*/drm/card[0-9]/metrics/????????-????-????-????-????????????/id r, # anv_enumerate_physical_devices() from libvulkan_intel.so + /usr/share/egl/egl_external_platform.d/{,*} r, + /usr/share/glvnd/egl_vendor.d/{,*} r, + /usr/share/vulkan/icd.d/{,*.json} r, + /usr/share/vulkan/{explicit,implicit}_layer.d/{,*.json} r, + + # User files + owner @{HOME}/.local/share/vulkan/implicit_layer.d/{,*.json} r, + + + # Include additions to the abstraction + include if exists <abstractions/vulkan.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/wayland b/straper/db/public/apparmor/apparmor.d/abstractions/wayland new file mode 100644 index 0000000..27563d5 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/wayland @@ -0,0 +1,21 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2016 intrigeri <intrigeri@boum.org> +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + owner @{run}/user/*/wayland-[0-9]* rw, + owner @{run}/user/*/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw, + + #For compositors based on wlroots + owner /dev/shm/wlroots-* rw, + + # Include additions to the abstraction + include if exists <abstractions/wayland.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/web-data b/straper/db/public/apparmor/apparmor.d/abstractions/web-data new file mode 100644 index 0000000..f7849b8 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/web-data @@ -0,0 +1,30 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2006 Novell/SUSE +# Copyright (C) 2014 Canonical Ltd +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /srv/www/htdocs/ r, + /srv/www/htdocs/** r, + # virtual hosting + /srv/www/vhosts/ r, + /srv/www/vhosts/** r, + # mod_userdir + @{HOME}/public_html/ r, + @{HOME}/public_html/** r, + + /srv/www/rails/*/public/ r, + /srv/www/rails/*/public/** r, + + /var/www/html/ r, + /var/www/html/** r, + + # Include additions to the abstraction + include if exists <abstractions/web-data.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/winbind b/straper/db/public/apparmor/apparmor.d/abstractions/winbind new file mode 100644 index 0000000..9b5b9ab --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/winbind @@ -0,0 +1,27 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # pam_winbindd + /tmp/.winbindd/pipe rw, + /var/lib/samba/winbindd_privileged/pipe rw, + @{run}/samba/winbindd_privileged/pipe rw, + /etc/samba/smb.conf r, + /etc/samba/dhcp.conf r, + /usr/lib*/samba/valid.dat r, + /usr/lib*/samba/upcase.dat r, + /usr/lib*/samba/lowcase.dat r, + /usr/share/samba/codepages/{lowcase,upcase,valid}.dat r, + + + # Include additions to the abstraction + include if exists <abstractions/winbind.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/wutmp b/straper/db/public/apparmor/apparmor.d/abstractions/wutmp new file mode 100644 index 0000000..937ca77 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/wutmp @@ -0,0 +1,27 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2009 Novell/SUSE +# Copyright (C) 2009 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # some services update wtmp, utmp, and lastlog with per-user + # connection information + /var/lib/wtmpdb/ r, + /var/lib/wtmpdb/wtmp.db{,-journal} rwlk, + /var/log/lastlog rwk, + /var/log/wtmp rwk, + /var/log/btmp rwk, + @{run}/utmp rwk, + + # Some read the list of sessions from systemd + /run/systemd/sessions/ r, + + # Include additions to the abstraction + include if exists <abstractions/wutmp.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/xad b/straper/db/public/apparmor/apparmor.d/abstractions/xad new file mode 100644 index 0000000..5969f2c --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/xad @@ -0,0 +1,30 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2007 Novell/SUSE +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + /opt/novell/xad/lib/ r, + /opt/novell/xad/lib/lib*.so* mr, + /opt/novell/xad/lib/gss/*.so* mr, + /opt/novell/lib/libpthread_ext*.so* mr, + /opt/novell/lib/libccs2.so* mr, + /opt/novell/xad/lib64/ r, + /opt/novell/xad/lib64/lib*.so* mr, + /opt/novell/xad/lib64/gss/*.so* mr, + /opt/novell/lib64/libpthread_ext*.so* mr, + /opt/novell/lib64/libccs2.so* mr, + /etc/opt/novell/xad/krb5.conf r, + /etc/opt/novell/nici.cfg r, + /var/opt/novell/nici/* r, + /var/opt/novell/nici/*/ r, + /var/opt/novell/nici/*/* rw, + + # Include additions to the abstraction + include if exists <abstractions/xad.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/xdg-desktop b/straper/db/public/apparmor/apparmor.d/abstractions/xdg-desktop new file mode 100644 index 0000000..19c3e62 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/xdg-desktop @@ -0,0 +1,29 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + + abi <abi/4.0>, + + # Entries based on: + # http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html + + owner @{HOME}/.cache/ rw, + + owner @{HOME}/.config/ rw, + + owner @{HOME}/.local/ rw, + owner @{HOME}/.local/share/ rw, + + # fallbacks + /usr/share/ r, + /usr/local/share/ r, + + # Include additions to the abstraction + include if exists <abstractions/xdg-desktop.d> diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/xdg-open b/straper/db/public/apparmor/apparmor.d/abstractions/xdg-open new file mode 100644 index 0000000..5e539e1 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/xdg-open @@ -0,0 +1,86 @@ +# vim:syntax=apparmor + + abi <abi/4.0>, + +# This abstraction is designed to be used in a child profile to limit what +# confined application can invoke via xdg-open helper. xdg-open abstraction +# will allow to use gio-open, kde-open5 and other helpers of the different +# desktop environments. +# +# Usage example: +# +# ``` +# profile foo /usr/bin/foo { +# ... +# /usr/bin/xdg-open rPx -> foo//xdg-open, +# ... +# } # end of main profile +# +# # out-of-line child profile +# profile foo//xdg-open { +# include <abstractions/xdg-open> +# +# # Enable a11y support if considered required by +# # profile author for (rare) error message boxes. +# include <abstractions/dbus-accessibility> +# +# # Enable gstreamer support if considered required by +# # profile author for (rare) error message boxes. +# include if exists <abstractions/gstreamer> +# +# # needed for ubuntu-* abstractions +# include <abstractions/ubuntu-helpers> +# +# # Only allow to handle http[s]: and mailto: links +# include <abstractions/ubuntu-browsers> +# include <abstractions/ubuntu-email> +# +# # < add additional allowed applications here > +# } +# ``` + + include <abstractions/base> + + # for opening with `exo-open` + include <abstractions/exo-open> + + # for opening with `gio open <uri>` + include <abstractions/gio-open> + + # for opening with gvfs-open (deprecated) + include <abstractions/gvfs-open> + + # for opening with kde-open5 + include <abstractions/kde-open5> + + # Main executables + + /{,usr/}bin/{b,d}ash mr, + /usr/bin/xdg-open r, + + # Additional executables + + /usr/bin/xdg-mime rix, + /{,usr/}bin/cut rix, # for xdg-mime + /{,usr/}bin/head rix, # for xdg-mime + /{,usr/}bin/sed rix, # for xdg-open + /{,usr/}bin/tr rix, # for xdg-mime + /{,usr/}bin/which rix, # for xdg-open + /{,usr/}bin/{grep,egrep} rix, # for xdg-open + + # System files + + /dev/pts/[0-9]* rw, + /dev/tty w, + /etc/gnome/defaults.list r, # for grep + /usr/share/applications/mimeinfo.cache r, # for grep + /usr/share/terminfo/s/screen r, # for bash on openSUSE + /usr/share/{,*/}applications/{,*.desktop} r, # for xdg-mime + /var/lib/menu-xdg/applications/ r, # for xdg-mime + + # Usr files + + owner @{HOME}/.local/share/applications/{,*.desktop} r, + + # Include additions to the abstraction + include if exists <abstractions/xdg-open.d> |