logo

apparmor.d

Unnamed repository; edit this file 'description' to name the repository. git clone https://hacktivis.me/git/apparmor.d.git

ubuntu-helpers (3909B)

    

  1. # Lenient profile that is intended to be used when 'Ux' is desired but
  2. # does not provide enough environment sanitizing. This effectively is an
  3. # open profile that blacklists certain known dangerous files and also
  4. # does not allow any capabilities. For example, it will not allow 'm' on files
  5. # owned be the user invoking the program. While this provides some additional
  6. # protection, please use with care as applications running under this profile
  7. # are effectively running without any AppArmor protection. Use this profile
  8. # only if the process absolutely must be run (effectively) unconfined.
  9. #
  10. # Usage:
  11. # Because this abstraction defines the sanitized_helper profile, it must only
  12. # be included once. Therefore this abstraction should typically not be
  13. # included in other abstractions so as to avoid parser errors regarding
  14. # multiple definitions.
  15. #
  16. # Limitations:
  17. # 1. This does not work for root owned processes, because of the way we use
  18. #    owner matching in the sanitized helper. We could do a better job with
  19. #    this to support root, but it would make the policy harder to understand
  20. #    and going unconfined as root is not desirable any way.
  21. #
  22. # 2. For this sanitized_helper to work, the program running in the sanitized
  23. #    environment must open symlinks directly in order for AppArmor to mediate
  24. #    it. This is confirmed to work with:
  25. #     - compiled code which can load shared libraries
  26. #     - python imports
  27. #    It is known not to work with:
  28. #     - perl includes
  29. # 3. Sanitizing ruby and java
  30. #
  31. # Use at your own risk. This profile was developed as an interim workaround for
  32. # LP: #851986 until AppArmor utilizes proper environment filtering.
  34.   abi <abi/3.0>,
  36. profile sanitized_helper {
  37.   include <abstractions/base>
  38.   include <abstractions/X>
  39.   include if exists <local/ubuntu-helpers>
  41.   # Allow all networking
  42.   network inet,
  43.   network inet6,
  45.   # Allow all DBus communications
  46.   include <abstractions/dbus-session-strict>
  47.   include <abstractions/dbus-strict>
  48.   dbus,
  50.   # Needed for Google Chrome
  51.   ptrace (trace) peer=**//sanitized_helper,
  53.   # Allow exec of anything, but under this profile. Allow transition
  54.   # to other profiles if they exist.
  55.   /{usr/,usr/local/,}{bin,sbin}/* Pixr,
  57.   # Allow exec of libexec applications in /usr/lib* and /usr/local/lib*
  58.   /usr/{,local/}lib*/{,**/}* Pixr,
  60.   # Allow exec of software-center scripts. We may need to allow wider
  61.   # permissions for /usr/share, but for now just do this. (LP: #972367)
  62.   /usr/share/software-center/* Pixr,
  64.   # Allow exec of texlive font build scripts (LP: #1010909)
  65.   /usr/share/texlive/texmf{,-dist}/web2c/{,**/}* Pixr,
  67.   # While the chromium and chrome sandboxes are setuid root, they only link
  68.   # in limited libraries so glibc's secure execution should be enough to not
  69.   # require the santized_helper (ie, LD_PRELOAD will only use standard system
  70.   # paths (man ld.so)).
  71.   /usr/lib/chromium-browser/chromium-browser-sandbox PUxr,
  72.   /usr/lib/chromium{,-browser}/chrome-sandbox PUxr,
  73.   /opt/google/chrome{,-beta,-unstable}/chrome-sandbox PUxr,
  74.   /opt/google/chrome{,-beta,-unstable}/google-chrome Pixr,
  75.   /opt/google/chrome{,-beta,-unstable}/chrome Pixr,
  76.   /opt/google/chrome{,-beta,-unstable}/chrome_crashpad_handler Pixr,
  77.   /opt/google/chrome{,-beta,-unstable}/{,**/}lib*.so{,.*} m,
  79.   # The same is needed for Brave
  80.   /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome-sandbox PUxr,
  81.   /opt/brave.com/brave{,-beta,-dev,-nightly}/brave-browser{,-beta,-dev,-nightly} Pixr,
  82.   /opt/brave.com/brave{,-beta,-dev,-nightly}/brave Pixr,
  83.   /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome_crashpad_handler Pixr,
  84.   /opt/brave.com/brave{,-beta,-dev,-nightly}/{,**/}lib*.so{,.*} m,
  86.   # Full access
  87.   / r,
  88.   /** rwkl,
  89.   /{,usr/,usr/local/}lib{,32,64}/{,**/}*.so{,.*} m,
  91.   # Dangerous files
  92.   audit deny owner /**/* m,              # compiled libraries
  93.   audit deny owner /**/*.py* r,          # python imports
  94. }