From 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Fri, 20 Mar 2026 19:16:32 +0100 Subject: feat: first fully successful run e2e on straper --- .../abstractions/ubuntu-browsers.d/user-files | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files (limited to 'straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files') diff --git a/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files new file mode 100644 index 0000000..fa73152 --- /dev/null +++ b/straper/db/public/apparmor/apparmor.d/abstractions/ubuntu-browsers.d/user-files @@ -0,0 +1,31 @@ +# vim:syntax=apparmor + + abi , + + # Allow read to all files user has DAC access to and write access to all + # files owned by the user in $HOME. + @{HOME}/ r, + @{HOME}/** r, + owner @{HOME}/** w, + + # Do not allow read and/or write to particularly sensitive/problematic files + include + audit deny @{HOME}/.ssh/{,**} mrwkl, + audit deny @{HOME}/.gnome2_private/{,**} mrwkl, + audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w, + audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl, + audit deny @{HOME}/.local/share/kwalletd/{,**} mrwkl, + + # Comment this out if using gpg plugin/addons + audit deny @{HOME}/.gnupg/{,**} mrwkl, + + # Allow read to all files user has DAC access to and write for files the user + # owns on removable media and filesystems. + /media/** r, + /mnt/** r, + /srv/** r, + /net/** r, + owner /media/** w, + owner /mnt/** w, + owner /srv/** w, + owner /net/** w, -- cgit v1.3