logo

apparmor.d

Unnamed repository; edit this file 'description' to name the repository. git clone https://hacktivis.me/git/apparmor.d.git

java (3829B)

    

  1. # vim:syntax=apparmor
  3.   abi <abi/3.0>,
  5.   # Java plugin
  6.   owner @{HOME}/.java/deployment/deployment.properties k,
  7.   /etc/java-*/ r,
  8.   /etc/java-*/** r,
  9.   /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}lib/*/IcedTeaPlugin.so mr,
  10.   /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}lib/*/IcedTeaPlugin.so mr,
  11.   /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java cx -> browser_openjdk,
  12.   /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java cx -> browser_openjdk,
  13.   /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} cx -> browser_java,
  14.   /usr/lib/jvm/java-*-sun-1.*/jre/lib/*/libnp*.so cx -> browser_java,
  15.   /usr/lib/j2*-ibm/jre/bin/java cx -> browser_java,
  16.   owner /{,var/}run/user/*/icedteaplugin-*/   rw,
  17.   owner /{,var/}run/user/*/icedteaplugin-*/** rwk,
  19.   # Profile for the supported OpenJDK in Ubuntu. This doesn't require the
  20.   # unfortunate workarounds of the proprietary Javas, so have a separate
  21.   # profile.
  22.   profile browser_openjdk {
  23.     include <abstractions/base>
  24.     include <abstractions/fonts>
  25.     include <abstractions/gnome>
  26.     include <abstractions/kde>
  27.     include <abstractions/nameservice>
  28.     include <abstractions/ssl_certs>
  29.     include <abstractions/user-tmp>
  30.     include <abstractions/private-files-strict>
  32.     network inet stream,
  33.     network inet6 stream,
  34.     @{PROC}/@{pid}/net/if_inet6 r,
  35.     @{PROC}/@{pid}/net/ipv6_route r,
  37.     /etc/java-*/ r,
  38.     /etc/java-*/** r,
  39.     /etc/lsb-release r,
  40.     /etc/ssl/certs/java/* r,
  41.     /etc/timezone r,
  43.     @{PROC}/@{pid}/ r,
  44.     @{PROC}/@{pid}/fd/ r,
  45.     @{PROC}/filesystems r,
  46.     @{sys}/devices/system/cpu/ r,
  47.     @{sys}/devices/system/cpu/** r,
  48.     /usr/share/** r,
  49.     /var/lib/dbus/machine-id r,
  51.     /usr/bin/env ix,
  52.     /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java ix,
  53.     /usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java ix,
  54.     /usr/lib/jvm/java-{6,7}-openjdk*/jre/lib/i386/client/classes.jsa m,
  56.     # Why would java need this?
  57.     deny /usr/bin/gconftool-2 x,
  59.     owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-appletviewer-to-plugin rw,
  60.     owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-plugin-{,debug-}to-appletviewer r,
  61.     owner @{HOME}/ r,
  62.     owner @{HOME}/** rwk,
  63.   }
  65.   # Profile for commercial Javas. These need workarounds to work right (eg
  66.   # Sun's forcing of an executable stack (LP: #535247)).
  67.   profile browser_java {
  68.     include <abstractions/base>
  69.     include <abstractions/fonts>
  70.     include <abstractions/gnome>
  71.     include <abstractions/kde>
  72.     include <abstractions/nameservice>
  73.     include <abstractions/ssl_certs>
  74.     include <abstractions/user-tmp>
  75.     include <abstractions/private-files-strict>
  77.     network inet stream,
  78.     network inet6 stream,
  79.     @{PROC}/@{pid}/net/if_inet6 r,
  80.     @{PROC}/@{pid}/net/ipv6_route r,
  81.     @{PROC}/loadavg r,
  83.     /etc/debian_version r,
  84.     /etc/java-*/ r,
  85.     /etc/java-*/** r,
  86.     /etc/lsb-release r,
  87.     /etc/ssl/certs/java/* r,
  88.     /etc/timezone r,
  90.     @{PROC}/@{pid}/ r,
  91.     @{PROC}/@{pid}/fd/ r,
  92.     @{PROC}/filesystems r,
  93.     @{sys}/devices/system/cpu/ r,
  94.     @{sys}/devices/system/cpu/** r,
  95.     /usr/share/** r,
  96.     /var/lib/dbus/machine-id r,
  98.     /usr/bin/env ix,
  99.     /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} ix,
  100.     /usr/lib/jvm/java-*-sun-1.*/jre/lib/i386/client/classes.jsa m,
  101.     /usr/lib/j2*-ibm/jre/bin/java ix,
  103.     # noisy, can't write here anyway
  104.     deny /etc/.java/ w,
  105.     deny /etc/.java/** w,
  107.     deny /usr/bin/gconftool-2 x,
  109.     owner @{HOME}/ r,
  110.     owner @{HOME}/** rwk,
  112.     # These are seriously unfortunate, but required due to LP: #535247
  113.     /etc/passwd m,
  114.     owner @{HOME}/.java/**/cache/** m,
  115.     owner /tmp/** m,
  116.     /usr/lib{,32,64}/jvm/**/*.jar mr,
  117.     /usr/share/fonts/** m,
  118.   }