StarMirror/qTox
1
0
Fork 0
mirror of https://github.com/qTox/qTox.git synced 2024-03-22 14:00:36 +08:00
Code Issues Projects Releases Wiki Activity
d1715500f7
qTox/security/apparmor/2.12.1/usr.bin.qtox

401 lines
13 KiB
Plaintext
Raw Normal View History

feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
#include <tunables/global>
#include <tunables/usr.bin.qtox>
# using variables in profile name is not yet recommended due to issues with
# AppArmor tools
# TODO: use this alternative in the future when available
#profile qtox @{qtox_prefix}/bin/qtox {
profile qtox /usr{,/local}/bin/qtox {
#include <abstractions/audio>
#include <abstractions/base>
fix(apparmor): Fix accessibility DBus access AppArmor denies access to a11y: ``` Jan 26 15:23:31 vincas-ubuntu1804 dbus-daemon: apparmor="DENIED" operation="dbus_method_call" bus="accessibility" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="Hello" mask="send" name="org.freedesktop.DBus" pid=8011 label="qtox" peer_label="unconfined" Jan 26 15:23:31 vincas-ubuntu1804 dbus-daemon[1474]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/a11y/bus" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.a11y.Bus" pid=8011 label="qtox" peer_pid=1620 peer_label="unconfined" ``` Include dbus-accessibility abstraction and one addition dbus rule to fix denies.
2019-01-26 21:35:22 +08:00
#include <abstractions/dbus-accessibility>
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
#include <abstractions/dbus-session-strict>
#include <abstractions/gnome>
fix(apparmor): Add ibus abstraction IBus-related rules are needed detected on Gnome-based desktop (Ubuntu 18.40): ``` type=AVC msg=audit(1548508639.169:546): apparmor="DENIED" operation="open" profile="qtox" name="/home/vincas/.config/ibus/bus/c3d8689228fc49d8867d4e63e4408e23-unix-0" pid=7653 comm="qtox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 ``` Include ibus abstraction to fix IBus functionality.
2019-01-26 21:19:29 +08:00
#include <abstractions/ibus>
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
#include <abstractions/kde>
#include <abstractions/nameservice>
fix(apparmor): Fix access to openssl configuration AppArmor denies access to openssl configuration files: ``` type=AVC msg=audit(1548516028.121:3031): apparmor="DENIED" operation="open" profile="qtox" name="/etc/ssl/openssl.cnf" pid=12416 comm="qtox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` Fix deny by including openssl abstraction.
2019-01-26 23:23:20 +08:00
#include <abstractions/openssl>
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
#include <abstractions/video>
# Site-specific additions and overrides. See local/README for details.
fix(apparmor): Fix AppArmor profile for version 2.12.1 * Remove `include if exists` usage. * Remove @{uid} usage. * Backport missing AppArmor abstractions as inline rules.
2019-01-26 20:50:12 +08:00
#include <local/usr.bin.qtox>
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
# Main executable
fix(apparmor): Fix typo in file path File rule to allow loading the executable itself has typo - no executable name itself is present. Profile still works OK but it might fail on some older kernels. Fix file rule by specifying full path to the executable.
2019-03-19 03:06:15 +08:00
@{qtox_prefix}/bin/qtox mr,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
# Other executables
#TODO: use xdg-open abstraction when it's available
/usr/bin/xdg-open PUx,
fix(apparmor): fix file dialog on KDE desktop Opening file dialog produces error: ``` type=AVC msg=audit(1549805942.022:1474): apparmor="DENIED" operation="exec" profile="qtox" name="/usr/lib/x86_64-linux-gnu/libexec/kf5/kioslave" pid=2784 comm="qtox" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 ``` Add rule to allow launching kioslave helper.
2019-02-10 21:49:36 +08:00
#TODO: use named profile or abstraction when it's available
/usr/lib/@{multiarch}/libexec/kf5/kioslave PUx,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
fix(apparmor): Fix loading libraries from custom install prefix If qtox is installed in /usr/local prefix (for example), launching qTox fails because loading libraries from @{qtox_prefix} directory was not allowed. Add rule to allow loading libraries from @{qtox_prefix}/lib directory.
2019-01-26 21:08:34 +08:00
# Additional libraries
# Allow /usr/local/lib/libtoxcore.so...
@{qtox_prefix}/lib/*.so* mr,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
# Networking
fix(apparmor): Make network rules more strict Explicitly define allowed network domain.
2019-03-26 01:31:41 +08:00
network inet udp,
network inet6 udp,
network inet tcp,
network inet6 tcp,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
fix(apparmor): Fix accessibility DBus access AppArmor denies access to a11y: ``` Jan 26 15:23:31 vincas-ubuntu1804 dbus-daemon: apparmor="DENIED" operation="dbus_method_call" bus="accessibility" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="Hello" mask="send" name="org.freedesktop.DBus" pid=8011 label="qtox" peer_label="unconfined" Jan 26 15:23:31 vincas-ubuntu1804 dbus-daemon[1474]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/a11y/bus" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.a11y.Bus" pid=8011 label="qtox" peer_pid=1620 peer_label="unconfined" ``` Include dbus-accessibility abstraction and one addition dbus rule to fix denies.
2019-01-26 21:35:22 +08:00
# DBus
dbus send
bus=session
path=/org/a11y/bus
interface=org.freedesktop.DBus.Properties
member=Get
peer=(label=unconfined),
fix(apparmor): Fix dbus access Add rules to allow DBus access (send & receive) to various DBus interfaces. Detected on Ubuntu 18.04.
2019-01-26 23:19:15 +08:00
dbus receive
bus=session
path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
dbus send
bus=session
path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
fix(apparmor): Fix DBUS denies on Kubuntu 18.04 AppArmor denies access to systray on Kubuntu 18.04. Add DBUS rules to make systray icon work.
2019-01-27 21:37:55 +08:00
dbus (send,receive)
fix(apparmor): Fix dbus access Add rules to allow DBus access (send & receive) to various DBus interfaces. Detected on Ubuntu 18.04.
2019-01-26 23:19:15 +08:00
bus=session
path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Properties
member=Get
peer=(label=unconfined),
fix(apparmor): Fix DBUS denies on Kubuntu 18.04 AppArmor denies access to systray on Kubuntu 18.04. Add DBUS rules to make systray icon work.
2019-01-27 21:37:55 +08:00
dbus receive
bus=session
path=/StatusNotifierItem
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(label=unconfined),
fix(apparmor): Fix dbus access Add rules to allow DBus access (send & receive) to various DBus interfaces. Detected on Ubuntu 18.04.
2019-01-26 23:19:15 +08:00
dbus send
bus=system
path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(label=unconfined),
dbus send
bus=system
path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=GetDevices
peer=(label=unconfined),
dbus receive
bus=system
path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=PropertiesChanged
peer=(label=unconfined),
dbus send
bus=system
path=/org/freedesktop/NetworkManager/Settings
interface=org.freedesktop.NetworkManager.Settings
member=ListConnections
peer=(label=unconfined),
dbus send
bus=system
path=/org/freedesktop/NetworkManager/Settings/[0-9]*
interface=org.freedesktop.NetworkManager.Settings.Connection
member=GetSettings
peer=(label=unconfined),
dbus send
bus=system
path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]*
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(label=unconfined),
dbus receive
bus=system
path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]*
interface=org.freedesktop.NetworkManager.Connection.Active
member=PropertiesChanged
peer=(label=unconfined),
dbus send
bus=system
path=/org/freedesktop/NetworkManager/Devices/[0-9]*
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(label=unconfined),
fix(apparmor): Fix DBUS denies on Kubuntu 18.04 AppArmor denies access to systray on Kubuntu 18.04. Add DBUS rules to make systray icon work.
2019-01-27 21:37:55 +08:00
dbus send
bus=session
path=/StatusNotifierWatcher
interface=org.kde.StatusNotifierWatcher
member=RegisterStatusNotifierItem
peer=(label=unconfined),
dbus receive
bus=session
path=/StatusNotifierItem
interface=org.kde.StatusNotifierItem
member=Activate
peer=(label=unconfined),
dbus (send,receive)
bus=session
path=/MenuBar
interface=com.canonical.dbusmenu
member=GetLayout
peer=(label=unconfined),
dbus (send,receive)
bus=session
path=/MenuBar
interface=com.canonical.dbusmenu
member={AboutToShow,Event}
peer=(label=unconfined),
dbus send
bus=session
path=/StatusNotifierItem
interface=org.kde.StatusNotifierItem
member={NewIcon,NewToolTip}
peer=(label=unconfined),
fix(apparmor): fix file dialog denies Add dbus and file rules to fix numerous denies when File Dialog is used to select file for sending.
2019-02-10 22:26:05 +08:00
dbus send
bus=system
path=/org/freedesktop/UPower
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
dbus send
bus=system
path=/org/freedesktop/UDisks2/{block_devices,block_devices/*,drives,drives/*}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
dbus send
bus=system
path=/org/freedesktop/UDisks2/{block_devices,drives}/*
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(label=unconfined),
dbus send
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetConnectionUnixUser
peer=(label=unconfined),
dbus send
bus=session
path=/
interface=org.kde.KDirNotify
member={enteredDirectory,leftDirectory}
peer=(label=unconfined),
dbus receive
bus=session
path=/
interface=org.kde.KDirNotify
member=FilesAdded
peer=(label=unconfined),
dbus send
bus=session
path=/KLauncher
interface=org.kde.KSlaveLauncher
member=requestSlave
peer=(label=unconfined),
fix(apparmor): Fix spam of DENIED messages on openSUSE AppArmor produced spams lot's of log messages like these: ``` type=AVC msg=audit(1548784382.499:2192): apparmor="DENIED" operation="file_mmap" profile="qtox" name="/tmp/#13317" pid=6389 comm="qtox" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000 ``` These appears to be libpcre2 mmaped shared memory, related to jitting. Deny mmap()'ing files for execution from /tmp directory because currently there is no way to allow shared memory access explicitly with AppArmor, so we choose more secure way (while probably loosing regex performance).
2019-01-30 02:33:45 +08:00
# Denied files
# libpcre2 on openSUSE tries to mmap() shared memory on directory.
# see: https://lists.ubuntu.com/archives/apparmor/2019-January/011925.html
# AppArmor does not allow to distinguish "real" file vs shared memory one,
# so we deny this path to protect from loading exploits from /tmp.
deny /tmp/#[0-9][0-9][0-9][0-9][0-9] m,
fix(apparmor): Fix font-related denies on openSUSE Add file rules to fix numerous AppArmor denies related to fonts.
2019-02-10 22:49:39 +08:00
# libfontconfig bug? Should not write to root-owned dirs.
deny /usr/share/fonts/** w,
deny /var/cache/fontconfig/ w,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
# System files
fix(apparmor): Fix hunspell access AppArmor denies access to hunspell files: ``` type=AVC msg=audit(1548511779.241:1773): apparmor="DENIED" operation="open" profile="qtox" name="/usr/share/hunspell/lt_LT.aff" pid=9833 comm="qtox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 type=AVC msg=audit(1548511779.241:1774): apparmor="DENIED" operation="open" profile="qtox" name="/usr/share/hunspell/lt_LT.dic" pid=9833 comm="qtox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` Add rule to allow reading hunspell dictionaries.
2019-01-26 22:13:25 +08:00
/usr/share/hunspell/* r,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
@{qtox_additional_rw_dirs}/ r,
@{qtox_additional_rw_dirs}/** rw,
# Sensitive directory access!!!
# Allow navigating directories with file dialog, to access directory you
# can write (read) file to, for most convenience (though against maximum
# security). Note: this allows reading only directory contents (list),
# not the files itself.
/{,**/} r,
/dev/ r,
/dev/dri/ r,
/dev/video[0-9]* rw, # webcam
/etc/fstab r, # file dialog
/etc/xdg/menus/ r, # file dialog
/proc/sys/kernel/core_pattern r, # for KCrash::initialize()
/proc/sys/kernel/random/boot_id r, # for QSysInfo::bootUniqueId(), mvoe to qt5 abstraction?
/run/udev/data/*:* r, # libKF5KIOFileWidgets.so -> libudev.so (KDE file dialog)
/sys/bus/ r, # file dialog
/sys/bus/usb/devices/ r, # file dialog
/sys/class/ r, # file dialog
fix(apparmor): fix file dialog denies Add dbus and file rules to fix numerous denies when File Dialog is used to select file for sending.
2019-02-10 22:26:05 +08:00
/sys/devices/**/uevent r, # file dialog
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
/sys/devices/system/node/ r, # for ld-linux-x86-64.so -> libnuma1.so
/sys/devices/system/node/node[0-9]*/meminfo r, # for ld-linux-x86-64.so -> libnuma1.so
/usr/share/emoticons/{,**} r,
fix(apparmor): Fix openSUSE-related AppArmor denies Add file rules for denies detected only in openSUSE desktop.
2019-03-17 18:03:46 +08:00
/usr/share/hwdata/pnp.ids r, # For OpenSUSE only?
/usr/share/icu/[0-9]*.[0-9]*/icudt[0-9]*.dat r, # For OpenSUSE only?
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
/usr/share/kservices5/{,**} r, # file dialog
/usr/share/mime/ r, # file dialog
/usr/share/plasma/look-and-feel/*/contents/defaults r, # TODO: move to kde abstraction?
/usr/share/sounds/ r, # file dialog (alert)
fix(apparmor): fix file dialog denies Add dbus and file rules to fix numerous denies when File Dialog is used to select file for sending.
2019-02-10 22:26:05 +08:00
/{,var/}run/udev/data/* r, # file dialog
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
# User files
# Sensitive file access!!!
# Allow reading & writing into $HOME, EXCEPT for dot files and directories,
# for most convenience (though against maximum security).
owner @{HOME}/ r,
owner @{HOME}/[^.]* rw,
owner @{HOME}/[^.]*/{,**} rw,
# QSaveFile security measures? While saving log file
owner @{HOME}/[^.]* l -> @{HOME}/#[0-9]*[0-9],
owner @{HOME}/[^.]*/** l -> @{HOME}/#[0-9]*[0-9],
fix(apparmor): Fix AppArmor profile for version 2.12.1 * Remove `include if exists` usage. * Remove @{uid} usage. * Backport missing AppArmor abstractions as inline rules.
2019-01-26 20:50:12 +08:00
owner /{,var/}run/user/[0-9]*[0-9]/#[0-9]*[0-9] rw, # file dialog
owner /{,var/}run/user/[0-9]*[0-9]/qTox*.slave-socket rwl -> /{,var/}run/user/[0-9]*[0-9]/#[0-9]*[0-9], # file dialog
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
owner @{HOME}/.cache/Tox/ w,
owner @{HOME}/.cache/Tox/qTox/{,**} rw,
fix(apparmor): Fix font-related denies on openSUSE Add file rules to fix numerous AppArmor denies related to fonts.
2019-02-10 22:49:39 +08:00
owner @{HOME}/.cache/fontconfig/** rwk,
fix(apparmor): Fix qTox cache access AppAmor denies access to qTox cache directory: ``` type=AVC msg=audit(1548508759.153:640): apparmor="DENIED" operation="mkdir" profile="qtox" name="/home/vincas/.cache/qTox/" pid=7802 comm="qtox" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000 ``` Add rule to allow access to qTox cache directory.
2019-01-26 21:31:49 +08:00
owner @{HOME}/.cache/qTox/{,**} rw,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
owner @{HOME}/.cache/thumbnails/** rw, # receiving image file produces thumbnail?
owner @{HOME}/.config/menus/ r, # file dialog
owner @{HOME}/.config/menus/applications-merged/ r, # file dialog
owner @{HOME}/.config/qToxrc rw,
owner @{HOME}/.config/qToxrc.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], # QSaveFile?
owner @{HOME}/.config/qToxrc.lock rwk,
owner @{HOME}/.config/tox/** l -> @{HOME}/.config/tox/**, # QSaveFile?
owner @{HOME}/.config/tox/{,**} rwk,
fix(apparmor): Fix font-related denies on openSUSE Add file rules to fix numerous AppArmor denies related to fonts.
2019-02-10 22:49:39 +08:00
owner @{HOME}/.fonts/.uuid* rw,
owner @{HOME}/.fonts/.uuid.* l -> @{HOME}/.fonts/.uuid.*,
owner @{HOME}/.fonts/.uuid.*/ rw,
fix(apparmor): Fix screenshot capture under AppArmor AppArmor denies creating screenshot file: ``` type=AVC msg=audit(1552817813.136:554): apparmor="DENIED" operation="mkdir" profile="qtox" name="/home/vincas/.local/share/Tox/qTox/images/" pid=16100 comm="qtox" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000 ``` Add file rule to allow creating desktop screenshot.
2019-03-17 18:23:47 +08:00
owner @{HOME}/.local/share/Tox/{,**} rw,
fix(apparmor): Fix .local/share/qTox/ access Capturing desktop screenshot produces this DENIED messages: ``` type=AVC msg=audit(1548516170.837:3146): apparmor="DENIED" operation="mkdir" profile="qtox" name="/home/vincas/.local/share/qTox/" pid=12605 comm="qtox" requested_mask="c" denied_mask="c" fsuid=1000 ouid= 1000 ``` Add rule to allow writing to .local/share/qTox/
2019-01-26 23:26:05 +08:00
owner @{HOME}/.local/share/qTox/{,**} rw,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
owner @{HOME}/.local/share/user-places.xbel r, # file dialog
owner @{PROC}/@{pid}/cmdline r,
# Backport from more recent qt5-compose-cache-write abstraction
# commit 1250402471d9d83134b0faa90239a733a37f23f0
owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9],
owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory)
fix(apparmor): Fix AppArmor profile for version 2.12.1 * Remove `include if exists` usage. * Remove @{uid} usage. * Backport missing AppArmor abstractions as inline rules.
2019-01-26 20:50:12 +08:00
# Backport kde-globals-write abstraction
# commit fae93f1b6c7a28bb77ad186ab1de41372630272b
owner @{HOME}/.config/#[0-9]* rw,
owner @{HOME}/.config/kdeglobals rw,
owner @{HOME}/.config/kdeglobals.?????? rwl -> @{HOME}/.config/#[0-9]*,
owner @{HOME}/.config/kdeglobals.lock rwk,
# Backport kde-icon-cache-write abstraction
# commit 94014c09f09fc63229bb10fea3f0727113fe5bae
owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader
# Backport mesa abstraction
# commit b5be5964609b4e0927af7c9e4f0276e50ccdc3e3
# System files
/dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2()
/usr/share/drirc.d/{,*.conf} r,
# User files
owner @{HOME}/.cache/ w, # if user clears all caches
owner @{HOME}/.cache/mesa_shader_cache/ w,
owner @{HOME}/.cache/mesa_shader_cache/index rw,
owner @{HOME}/.cache/mesa_shader_cache/??/ w,
owner @{HOME}/.cache/mesa_shader_cache/??/* rwk,
# End of backported mesa abstraction
fix(apparmor): Backport qt5 abstraction for v2.12.1 profile AppArmor 2.12.1 does not have qt5 abstraction, with Qt5-related rules. Backport qt5 abstraction from AppArmor upstream as inline rules.
2019-01-26 21:15:44 +08:00
# Backport qt5 abstraction
# commit 67816c42cfbadd85aa5cbb086284076c4c289881
# Additional libraries
/usr/lib{,64,/@{multiarch}}/qt5/plugins/**.so mr,
/usr/lib{,64,/@{multiarch}}/qt5/qml/**.so mr,
/usr/lib{,64,/@{multiarch}}/qt5/qml/**.{qmlc,jsc} mr, # Precompiled QML/JavaScript modules
# System files
/etc/xdg/QtProject/qtlogging.ini r,
/usr/share/qt5/translations/*.qm r,
/usr/lib{,64,/@{multiarch}}/qt5/plugins/** r,
/usr/lib{,64,/@{multiarch}}/qt5/qml/** r,
# User files
owner @{HOME}/.config/QtProject.conf r, # common settings for QFileDialog, etc (application might need write access)
owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r, # for "platforminputcontexts" plugins
# End of backported qt5 abstractions
fix(apparmor): Fix AppArmor profile for version 2.12.1 * Remove `include if exists` usage. * Remove @{uid} usage. * Backport missing AppArmor abstractions as inline rules.
2019-01-26 20:50:12 +08:00
# Backport qt5-compose-cache-write abstraction
# commit 1250402471d9d83134b0faa90239a733a37f23f0
owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9],
owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory)
# Backport qt5-settings-write abstraction
# commit 8f6a8fb1942122705af4c45168922c4afd696c8a
owner @{HOME}/.config/#[0-9]*[0-9] rw,
owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9],
# for temporary files like QtProject.conf.Aqrgeb
owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9],
owner @{HOME}/.config/QtProject.conf.lock rwk,
# Backport recent-documents-write
# commit 4fe8ae97c43d72d7f5a948c7149f5ea35339832a
owner @{HOME}/.local/share/RecentDocuments/ rw,
owner @{HOME}/.local/share/RecentDocuments/#[0-9]* rw,
owner @{HOME}/.local/share/RecentDocuments/*.desktop rwl -> @{HOME}/.local/share/RecentDocuments/#[0-9]*,
owner @{HOME}/.local/share/RecentDocuments/*.lock rwk,
fix(apparmor): Backport dri-enumerate abstraction AppArmor 2.12 (Ubuntu 18.04) does not have dri-enumerate abstraction, so policy compilation fails. Backport dri-enumerate abstraction as inline rules.
2019-01-27 20:21:59 +08:00
# Backport dri-enumerate abstraction
# commit b0456adbd86aab73e4a19013fdfed22da98ed455
/sys/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
fix(apparmor): backport kde abstraction AppArmor upstream has new rules useful for running applications in KDE desktop. Backport rules from update kde abstraction to fix AppArmor denies.
2019-02-10 21:39:15 +08:00
# Backport kde abstraction
# commit aae838faca57905d2dbc27db7bffd595c09d26f0
# commit dc3b73daf9f648336a6f9ab90103acc962c0bf40
/etc/xdg/kdeglobals r,
/usr/share/knotifications5/*.notifyrc r, # KNotification::sendEvent()
/usr/share/kubuntu-default-settings/kf5-settings/* r,
owner @{HOME}/.cache/ksycoca5_??_* r, # KDE System Configuration Cache
owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget
owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget
owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent()
owner @{HOME}/.config/kdeglobals r, # global settings, used by Breeze style, etc.
owner @{HOME}/.config/klanguageoverridesrc r, # per-application languages, for KDEPrivate::initializeLanguages() from libKF5XmlGui.so
owner @{HOME}/.config/trashrc r, # Used by KFileWidget
fix(apparmor): Backport fix from dri-common abstraction AppArmor produces denies: ``` type=AVC msg=audit(1552817150.513:371): apparmor="DENIED" operation="open" profile="qtox" name="/usr/share/drirc.d/00-mesa-defaults.conf" pid=5895 comm="qtox" requested_mas k="r" denied_mask="r" fsuid=1000 ouid=0 ``` Fix is available in upstream. Backport AppArmor commit 2d8d2f06d5697d9692330686bb5ddb0095621144 to fix dri-related denies.
2019-03-17 18:10:46 +08:00
# Backport dri-common abstraction
# commit 2d8d2f06d5697d9692330686bb5ddb0095621144
/usr/share/drirc.d/{,*.conf} r,
feat(apparmor): Add AppArmor v2.12.1 profile Copy 2.13.2 profile into 2.12.1 place to be the starting point for modifying (backporting) AppArmor profile for version 2.12.1 (on Ubuntu 18.04, Debian Stretch, etc). At this point 2.12.1 profile does not work, as AppArmor v2.12.1 does not have needed abstractions and policy language features (such as `include if exists`). Followup commits will fix these issues.
2019-01-26 20:45:35 +08:00
}
Reference in New Issue Copy Permalink