API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Apr 17th, 2024
45
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.42 KB | None | 0 0
raw download clone embed print report
  1. # Author: Jamie Strandboge <[email protected]>
  2. #include <tunables/global>
  3.  
  4. /usr/lib/snapd/snap-confine (attach_disconnected) {
  5. # Include any additional files that snapd chose to generate.
  6. # - for $HOME on NFS
  7. # - for $HOME on encrypted media
  8. #
  9. # Those are discussed on https://forum.snapcraft.io/t/snapd-vs-upstream-kernel-vs-apparmor
  10. # and https://forum.snapcraft.io/t/snaps-and-nfs-home/
  11. #include "/var/lib/snapd/apparmor/snap-confine"
  12.  
  13. # We run privileged, so be fanatical about what we include and don't use
  14. # any abstractions
  15. /etc/ld.so.cache r,
  16. /etc/ld.so.preload r,
  17.  
  18. # Do not assume that the interpreter is always named like
  19. # ld-linux-x86_64.so, as on some architectures there can be a version after
  20. # the .so suffix, eg. ld-linux-aarch64.so.1
  21. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}ld{-*,64}.so* mrix,
  22. # libc, you are funny
  23. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libc{,-[0-9]*}.so* mr,
  24. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libpthread{,-[0-9]*}.so* mr,
  25. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libreadline{,-[0-9]*}.so* mr,
  26. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}librt{,-[0-9]*}.so* mr,
  27. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libgcc_s.so* mr,
  28. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libncursesw{,-[0-9]*}.so* mr,
  29. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libresolv{,-[0-9]*}.so* mr,
  30. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libselinux.so* mr,
  31. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libpcre{,2}{,-[0-9]*}.so* mr,
  32. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libmount.so* mr,
  33. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libblkid.so* mr,
  34. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libuuid.so* mr,
  35. # normal libs in order
  36. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libapparmor.so* mr,
  37. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcgmanager.so* mr,
  38. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libdl{,-[0-9]*}.so* mr,
  39. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnih.so* mr,
  40. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnih-dbus.so* mr,
  41. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libdbus-1.so* mr,
  42. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libudev.so* mr,
  43. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libseccomp.so* mr,
  44. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcap.so* mr,
  45.  
  46. /usr/lib/snapd/snap-confine mr,
  47.  
  48. # This rule is needed when executing from a "base: core" devmode snap on
  49. # UC18 and newer where the /usr/lib/snapd/snap-confine inside the
  50. # "base: core" mount namespace always comes from the snapd snap, and thus
  51. # we will execute snap-confine via this path, and thus need to be able to
  52. # read this path when executing. It's also necessary on classic where both
  53. # the snapd and the core snap are installed at the same time.
  54. # TODO: remove this rule when we stop supporting executing other snaps from
  55. # inside devmode snaps, ideally even in the short term we would only include
  56. # this rule on core only, and specifically uc18 and newer where we need it
  57. #@VERBATIM_LIBEXECDIR_SNAP_CONFINE@ mr,
  58.  
  59. /dev/null rw,
  60. /dev/full rw,
  61. /dev/zero rw,
  62. /dev/random r,
  63. /dev/urandom r,
  64. /dev/pts/[0-9]* rw,
  65. /dev/tty rw,
  66.  
  67. # cgroup: devices
  68. capability sys_admin,
  69. capability dac_read_search,
  70. capability dac_override,
  71. /sys/fs/cgroup/ r,
  72. /sys/fs/cgroup/devices/ r,
  73. /sys/fs/cgroup/devices/snap.*/ rw,
  74. /sys/fs/cgroup/devices/snap.*/cgroup.procs w,
  75. /sys/fs/cgroup/devices/snap.*/devices.{allow,deny} w,
  76.  
  77. # cgroup: freezer
  78. # Allow creating per-snap cgroup freezers and adding snap command (task)
  79. # invocations to the freezer. This allows for reliably enumerating all
  80. # running processes for the snap. In addition, allow enumerating processes
  81. # in the cgroup to determine if it is occupied.
  82. /sys/fs/cgroup/freezer/ r,
  83. /sys/fs/cgroup/freezer/snap.*/ w,
  84. /sys/fs/cgroup/freezer/snap.*/cgroup.procs rw,
  85. /sys/fs/cgroup/ r,
  86. /sys/fs/cgroup/** r,
  87.  
  88. # cgroup: reading own cgroup
  89. @{PROC}/@{pid}/cgroup r,
  90.  
  91. # cgroup: manage bpf map for device cgroup
  92. /sys/fs/bpf/ r,
  93. /sys/fs/bpf/snap/ rw,
  94. /sys/fs/bpf/snap/* rw,
  95. # s-c may need to raise the memlock limit
  96. capability sys_resource,
  97.  
  98. # querying udev
  99. /etc/udev/udev.conf r,
  100. /sys/**/uevent r,
  101. /run/udev/** rw,
  102. /{,usr/}bin/tr ixr,
  103. /usr/lib/locale/** r,
  104. /usr/lib/@{multiarch}/gconv/gconv-modules r,
  105. /usr/lib/@{multiarch}/gconv/gconv-modules.cache r,
  106.  
  107. # priv dropping
  108. capability setuid,
  109. capability setgid,
  110.  
  111. # changing profile
  112. @{PROC}/[0-9]*/attr/{,apparmor/}exec w,
  113. # Reading current profile
  114. @{PROC}/[0-9]*/attr/{,apparmor/}current r,
  115. # Reading available filesystems
  116. @{PROC}/filesystems r,
  117.  
  118. # To find where apparmor is mounted
  119. @{PROC}/[0-9]*/mounts r,
  120. # To find if apparmor is enabled
  121. /sys/module/apparmor/parameters/enabled r,
  122.  
  123. # Don't allow changing profile to unconfined or profiles that start with
  124. # '/'. Use 'unsafe' to support snap-exec on armhf and its reliance on
  125. # the environment for determining the capabilities of the architecture.
  126. # 'unsafe' is ok here because the kernel will have already cleared the
  127. # environment as part of launching snap-confine with CAP_SYS_ADMIN. This
  128. # does leave directories as configured by ld.so.preload as well as
  129. # LD_PRELOAD to be set to a library which is in a directory configured by
  130. # ld.so.conf, but access to those locations is mediated by this profile
  131. # (which requires rules for specific locations).
  132. change_profile unsafe /** -> [^u/]**,
  133. change_profile unsafe /** -> u[^n]**,
  134. change_profile unsafe /** -> un[^c]**,
  135. change_profile unsafe /** -> unc[^o]**,
  136. change_profile unsafe /** -> unco[^n]**,
  137. change_profile unsafe /** -> uncon[^f]**,
  138. change_profile unsafe /** -> unconf[^i]**,
  139. change_profile unsafe /** -> unconfi[^n]**,
  140. change_profile unsafe /** -> unconfin[^e]**,
  141. change_profile unsafe /** -> unconfine[^d]**,
  142. change_profile unsafe /** -> unconfined?**,
  143.  
  144. # allow changing to a few not caught above
  145. change_profile unsafe /** -> {u,un,unc,unco,uncon,unconf,unconfi,unconfin,unconfine},
  146.  
  147. # LP: #1446794 - when this bug is fixed, change the above to:
  148. # deny change_profile unsafe /** -> {unconfined,/**},
  149. # change_profile unsafe /** -> **,
  150.  
  151. # reading seccomp filters
  152. /{tmp/snap.rootfs_*/,}var/lib/snapd/seccomp/bpf/*.bin r,
  153.  
  154. # adding a missing bpf mount
  155. mount fstype=bpf options=(rw) bpf -> /sys/fs/bpf/,
  156.  
  157. # LP: #1668659 and parallel instaces of classic snaps
  158. mount options=(rw rbind) /snap/ -> /snap/,
  159. mount options=(rw rshared) -> /snap/,
  160. mount options=(rw rbind) /var/lib/snapd/snap/ -> /var/lib/snapd/snap/,
  161. mount options=(rw rshared) -> /var/lib/snapd/snap/,
  162.  
  163. # boostrapping the mount namespace
  164. /tmp/snap.rootfs_*/ rw,
  165. mount options=(rw rshared) -> /,
  166. mount options=(rw bind) /tmp/snap.rootfs_*/ -> /tmp/snap.rootfs_*/,
  167. mount options=(rw unbindable) -> /tmp/snap.rootfs_*/,
  168. # the next line is for classic system
  169. mount options=(rw rbind) /snap/*/*/ -> /tmp/snap.rootfs_*/,
  170. # the next line is for core system
  171. mount options=(rw rbind) / -> /tmp/snap.rootfs_*/,
  172. # all of the constructed rootfs is a rslave
  173. mount options=(rw rslave) -> /tmp/snap.rootfs_*/,
  174. # bidirectional mounts (for both classic and core)
  175. # NOTE: this doesn't capture the MERGED_USR configuration option so that
  176. # when a distro with merged /usr and / that uses apparmor shows up it
  177. # should be handled here.
  178. /{,run/}media/ w,
  179. mount options=(rw rbind) /{,run/}media/ -> /tmp/snap.rootfs_*/{,run/}media/,
  180. /run/netns/ w,
  181. mount options=(rw rbind) /run/netns/ -> /tmp/snap.rootfs_*/run/netns/,
  182. # unidirectional mounts (only for classic system)
  183. mount options=(rw rbind) /dev/ -> /tmp/snap.rootfs_*/dev/,
  184. mount options=(rw rslave) -> /tmp/snap.rootfs_*/dev/,
  185.  
  186. mount options=(rw rbind) /etc/ -> /tmp/snap.rootfs_*/etc/,
  187. mount options=(rw rslave) -> /tmp/snap.rootfs_*/etc/,
  188.  
  189. mount options=(rw rbind) /home/ -> /tmp/snap.rootfs_*/home/,
  190. mount options=(rw rslave) -> /tmp/snap.rootfs_*/home/,
  191.  
  192. mount options=(rw rbind) /root/ -> /tmp/snap.rootfs_*/root/,
  193. mount options=(rw rslave) -> /tmp/snap.rootfs_*/root/,
  194.  
  195. mount options=(rw rbind) /proc/ -> /tmp/snap.rootfs_*/proc/,
  196. mount options=(rw rslave) -> /tmp/snap.rootfs_*/proc/,
  197.  
  198. mount options=(rw rbind) /sys/ -> /tmp/snap.rootfs_*/sys/,
  199. mount options=(rw rslave) -> /tmp/snap.rootfs_*/sys/,
  200.  
  201. mount options=(rw rbind) /tmp/ -> /tmp/snap.rootfs_*/tmp/,
  202. mount options=(rw rslave) -> /tmp/snap.rootfs_*/tmp/,
  203.  
  204. mount options=(rw rbind) /var/lib/dhcp/ -> /tmp/snap.rootfs_*/var/lib/dhcp/,
  205. mount options=(rw rslave) -> /tmp/snap.rootfs_*/var/lib/dhcp/,
  206.  
  207. mount options=(rw rbind) /var/lib/snapd/ -> /tmp/snap.rootfs_*/var/lib/snapd/,
  208. mount options=(rw rslave) -> /tmp/snap.rootfs_*/var/lib/snapd/,
  209.  
  210. mount options=(rw rbind) /var/snap/ -> /tmp/snap.rootfs_*/var/snap/,
  211. mount options=(rw rslave) -> /tmp/snap.rootfs_*/var/snap/,
  212.  
  213. mount options=(rw rbind) /var/tmp/ -> /tmp/snap.rootfs_*/var/tmp/,
  214. # /var/volatile is the default volatile location on Yocto/Poky, typically used with read-only rootfs setups
  215. mount options=(rw rbind) /var/volatile/tmp/ -> /tmp/snap.rootfs_*/var/tmp/,
  216. mount options=(rw rslave) -> /tmp/snap.rootfs_*/var/tmp/,
  217.  
  218. mount options=(rw rbind) /run/ -> /tmp/snap.rootfs_*/run/,
  219. mount options=(rw rslave) -> /tmp/snap.rootfs_*/run/,
  220.  
  221. mount options=(rw rbind) /var/lib/extrausers/ -> /tmp/snap.rootfs_*/var/lib/extrausers/,
  222. mount options=(rw rslave) -> /tmp/snap.rootfs_*/var/lib/extrausers/,
  223.  
  224. mount options=(rw rbind) {,/usr}/lib{,32,64,x32}/modules/ -> /tmp/snap.rootfs_*{,/usr}/lib/modules/,
  225. mount options=(rw rslave) -> /tmp/snap.rootfs_*{,/usr}/lib/modules/,
  226.  
  227. mount options=(rw rbind) {,/usr}/lib{,32,64,x32}/firmware/ -> /tmp/snap.rootfs_*{,/usr}/lib/firmware/,
  228. mount options=(rw rslave) -> /tmp/snap.rootfs_*{,/usr}/lib/firmware/,
  229.  
  230. mount options=(rw rbind) /var/log/ -> /tmp/snap.rootfs_*/var/log/,
  231. # /var/volatile is the default volatile location on Yocto/Poky, typically used with read-only rootfs setups
  232. mount options=(rw rbind) /var/volatile/log/ -> /tmp/snap.rootfs_*/var/log/,
  233. mount options=(rw rslave) -> /tmp/snap.rootfs_*/var/log/,
  234.  
  235. mount options=(rw rbind) /usr/src/ -> /tmp/snap.rootfs_*/usr/src/,
  236. mount options=(rw rslave) -> /tmp/snap.rootfs_*/usr/src/,
  237.  
  238. mount options=(rw rbind) /mnt/ -> /tmp/snap.rootfs_*/mnt/,
  239. mount options=(rw rslave) -> /tmp/snap.rootfs_*/mnt/,
  240.  
  241. # allow making host snap-exec available inside base snaps
  242. mount options=(rw bind) /usr/lib/snapd/ -> /tmp/snap.rootfs_*/usr/lib/snapd/,
  243. mount options=(rw slave) -> /tmp/snap.rootfs_*/usr/lib/snapd/,
  244.  
  245. # allow making re-execed host snap-exec available inside base snaps
  246. mount options=(ro bind) /snap/core/*/usr/lib/snapd/ -> /tmp/snap.rootfs_*/usr/lib/snapd/,
  247. # allow making snapd snap tools available inside base snaps
  248. mount options=(ro bind) /snap/snapd/*/usr/lib/snapd/ -> /tmp/snap.rootfs_*/usr/lib/snapd/,
  249.  
  250. mount options=(rw bind) /usr/bin/snapctl -> /tmp/snap.rootfs_*/usr/bin/snapctl,
  251. mount options=(rw slave) -> /tmp/snap.rootfs_*/usr/bin/snapctl,
  252.  
  253. # /etc/alternatives (classic and normal mode)
  254. mount options=(rw bind) /snap/*/*/etc/alternatives/ -> /tmp/snap.rootfs_*/etc/alternatives/,
  255. mount options=(rw bind) /snap/*/*/etc/ssl/ -> /tmp/snap.rootfs_*/etc/ssl/,
  256. mount options=(rw bind) /snap/*/*/etc/nsswitch.conf -> /tmp/snap.rootfs_*/etc/nsswitch.conf,
  257. mount options=(rw bind) /snap/*/*/etc/apparmor/ -> /tmp/snap.rootfs_*/etc/apparmor/,
  258. mount options=(rw bind) /snap/*/*/etc/apparmor.d/ -> /tmp/snap.rootfs_*/etc/apparmor.d/,
  259.  
  260. # /etc/alternatives (core/legacy mode)
  261. mount options=(rw bind) /etc/alternatives/ -> /tmp/snap.rootfs_*/etc/alternatives/,
  262.  
  263. # making all those directories slave shared.
  264. mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/alternatives/,
  265. mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/ssl/,
  266. mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/nsswitch.conf,
  267. mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/apparmor/,
  268. mount options=(rw slave) -> /tmp/snap.rootfs_*/etc/apparmor.d/,
  269.  
  270. # the /snap directory
  271. mount options=(rw rbind) /snap/ -> /tmp/snap.rootfs_*/snap/,
  272. mount options=(rw rslave) -> /tmp/snap.rootfs_*/snap/,
  273. # pivot_root preparation and execution
  274. mount options=(rw bind) /tmp/snap.rootfs_*/var/lib/snapd/hostfs/ -> /tmp/snap.rootfs_*/var/lib/snapd/hostfs/,
  275. mount options=(rw private) -> /tmp/snap.rootfs_*/var/lib/snapd/hostfs/,
  276.  
  277. # pivot_root mediation in AppArmor is not complete. See LP: #1791711.
  278. # However, we can mediate the new_root and put_old to be what we expect,
  279. # and then deny directory creation within old_root to prevent trivial
  280. # pivoting into a whitelisted path.
  281. pivot_root oldroot=/tmp/snap.rootfs_*/var/lib/snapd/hostfs/ /tmp/snap.rootfs_*/,
  282. # Explicitly deny creating the old_root directory in case it is
  283. # inadvertently added somewhere else. While this doesn't resolve
  284. # LP: #1791711, it provides some hardening.
  285. audit deny /tmp/snap.rootfs_*/{var/,var/lib/,var/lib/snapd/,var/lib/snapd/hostfs/} w,
  286.  
  287. # cleanup
  288. umount /var/lib/snapd/hostfs/tmp/snap.rootfs_*/,
  289. umount /var/lib/snapd/hostfs/sys/,
  290. umount /var/lib/snapd/hostfs/dev/,
  291. umount /var/lib/snapd/hostfs/proc/,
  292. mount options=(rw rslave) -> /var/lib/snapd/hostfs/,
  293.  
  294. # Hide /writable from view of snaps.
  295. mount options=(rprivate) -> /{,var/lib/snapd/hostfs/}writable/,
  296. umount /{,var/lib/snapd/hostfs/}writable/,
  297.  
  298. # set up user mount namespace
  299. mount options=(rslave) -> /,
  300.  
  301. # set up mount namespace for parallel instances of classic snaps
  302. mount options=(rw rbind) /snap/{,*/} -> /snap/{,*/},
  303. mount options=(rslave) -> /snap/,
  304. mount options=(rslave) -> /var/snap/,
  305. mount options=(rw rbind) /var/snap/{,*/} -> /var/snap/{,*/},
  306. mount options=(rw rshared) -> /var/snap/,
  307.  
  308. # Allow reading the os-release file (possibly a symlink to /usr/lib).
  309. /{etc/,usr/lib/}os-release r,
  310.  
  311. # Allow creating /var/lib/snapd/hostfs, if missing
  312. /var/lib/snapd/hostfs/ rw,
  313.  
  314. # set up snap-specific private /tmp dir
  315. capability chown,
  316. /tmp/ rw,
  317. /tmp/snap-private-tmp/ rw,
  318. /tmp/snap-private-tmp/snap.*/ rw,
  319. /tmp/snap-private-tmp/snap.*/tmp/ rw,
  320. mount options=(rw private) -> /tmp/,
  321. mount options=(rw bind) /tmp/snap-private-tmp/snap.*/tmp/ -> /tmp/,
  322. mount fstype=devpts options=(rw) devpts -> /dev/pts/,
  323. mount options=(rw bind) /dev/pts/ptmx -> /dev/ptmx, # for bind mounting
  324. mount options=(rw bind) /dev/pts/ptmx -> /dev/pts/ptmx, # for bind mounting under LXD
  325. # Workaround for LP: #1584456 on older kernels that mistakenly think
  326. # /dev/pts/ptmx needs a trailing '/'
  327. mount options=(rw bind) /dev/pts/ptmx/ -> /dev/ptmx/,
  328. mount options=(rw bind) /dev/pts/ptmx/ -> /dev/pts/ptmx/,
  329.  
  330. # for running snaps on classic
  331. /snap/ r,
  332. /snap/** r,
  333. /snap/ r,
  334. /snap/** r,
  335.  
  336. # NOTE: at this stage the /snap directory is stable as we have called
  337. # pivot_root already.
  338.  
  339. # nvidia handling, glob needs /usr/** and the launcher must be
  340. # able to bind mount the nvidia dir
  341. /sys/module/nvidia/version r,
  342. /sys/**/drivers/nvidia{,_*}/* r,
  343. /sys/**/nvidia*/uevent r,
  344. /sys/module/nvidia{,_*}/* r,
  345. /dev/nvidia[0-9]* r,
  346. /dev/nvidiactl r,
  347. /dev/nvidia-uvm r,
  348. /usr/** r,
  349. mount options=(rw bind) /usr/lib{,32}/nvidia-*/ -> /{tmp/snap.rootfs_*/,}var/lib/snapd/lib/gl{,32}/,
  350. mount options=(rw bind) /usr/lib{,32}/nvidia-*/ -> /{tmp/snap.rootfs_*/,}var/lib/snapd/lib/gl{,32}/,
  351. /tmp/snap.rootfs_*/var/lib/snapd/lib/gl{,32}/{,*} w,
  352. mount fstype=tmpfs options=(rw nodev noexec) none -> /tmp/snap.rootfs_*/var/lib/snapd/lib/gl{,32}/,
  353. mount options=(remount ro bind) -> /tmp/snap.rootfs_*/var/lib/snapd/lib/gl{,32}/,
  354.  
  355. # Vulkan support
  356. /tmp/snap.rootfs_*/var/lib/snapd/lib/vulkan/{,*} w,
  357. mount fstype=tmpfs options=(rw nodev noexec) none -> /tmp/snap.rootfs_*/var/lib/snapd/lib/vulkan/,
  358. mount options=(remount ro bind) -> /tmp/snap.rootfs_*/var/lib/snapd/lib/vulkan/,
  359.  
  360. # GLVND EGL vendor
  361. /tmp/snap.rootfs_*/var/lib/snapd/lib/glvnd/{,*} w,
  362. mount fstype=tmpfs options=(rw nodev noexec) none -> /tmp/snap.rootfs_*/var/lib/snapd/lib/glvnd/,
  363. mount options=(remount ro bind) -> /tmp/snap.rootfs_*/var/lib/snapd/lib/glvnd/,
  364.  
  365. # create gl dirs as needed
  366. /tmp/snap.rootfs_*/ r,
  367. /tmp/snap.rootfs_*/var/ r,
  368. /tmp/snap.rootfs_*/var/lib/ r,
  369. /tmp/snap.rootfs_*/var/lib/snapd/ r,
  370. /tmp/snap.rootfs_*/var/lib/snapd/lib/ r,
  371. /tmp/snap.rootfs_*/var/lib/snapd/lib/gl{,32}/ r,
  372. /tmp/snap.rootfs_*/var/lib/snapd/lib/gl{,32}/** rw,
  373. /tmp/snap.rootfs_*/var/lib/snapd/lib/vulkan/ r,
  374. /tmp/snap.rootfs_*/var/lib/snapd/lib/vulkan/** rw,
  375. /tmp/snap.rootfs_*/var/lib/snapd/lib/glvnd/ r,
  376. /tmp/snap.rootfs_*/var/lib/snapd/lib/glvnd/** rw,
  377.  
  378. # for chroot on steroids, we use pivot_root as a better chroot that makes
  379. # apparmor rules behave the same on classic and outside of classic.
  380.  
  381. # for creating the user data directories: ~/snap, ~/snap/<name> and
  382. # ~/snap/<name>/<version>
  383. / r,
  384. @{HOMEDIRS}/ r,
  385. # These should both have 'owner' match but due to LP: #1466234, we can't
  386. # yet
  387. @{HOME}/ r,
  388. @{HOME}/snap/{,*/,*/*/} rw,
  389.  
  390. # experimental
  391. @{HOME}/.snap/ rw,
  392. @{HOME}/.snap/data/{,*/,*/*/} rw,
  393. @{HOME}/Snap/{,*/,*/*/} rw,
  394.  
  395. # Special case for *classic* snaps that are used by users with existing dirs
  396. # in /var/lib/. Like jenkins, postgresql, mysql, puppet, ...
  397. # (see https://forum.snapcraft.io/t/9717)
  398. # TODO: this can be removed once we support home-dirs outside of /home
  399. # better
  400. /var/ r,
  401. /var/lib/ r,
  402. # These should both have 'owner' match but due to LP: #1466234, we can't
  403. # yet
  404. /var/lib/*/ r,
  405. /var/lib/*/snap/{,*/,*/*/} rw,
  406.  
  407. # for creating the user shared memory directories
  408. /{dev,run}/{,shm/} r,
  409. # This should both have 'owner' match but due to LP: #1466234, we can't yet
  410. /{dev,run}/shm/{,*/,*/*/} rw,
  411.  
  412. # for creating the user XDG_RUNTIME_DIR: /run/user, /run/user/UID and
  413. # /run/user/UID/<name>
  414. /run/user/{,[0-9]*/,[0-9]*/*/} rw,
  415.  
  416. # Workaround https://launchpad.net/bugs/359338 until upstream handles
  417. # stacked filesystems generally.
  418. # encrypted ~/.Private and old-style encrypted $HOME
  419. @{HOME}/.Private/ r,
  420. @{HOME}/.Private/** mrwlk,
  421. # new-style encrypted $HOME
  422. @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
  423. @{HOMEDIRS}/.ecryptfs/*/.Private/** mrwlk,
  424.  
  425. # Allow snap-confine to move to the void, creating it if necessary.
  426. /var/lib/snapd/void/ rw,
  427.  
  428. # Allow snap-confine to read snap contexts
  429. /var/lib/snapd/context/snap.* r,
  430.  
  431. # Allow snap-confine to unmount stale mount namespaces.
  432. umount /run/snapd/ns/*.mnt,
  433. /run/snapd/ns/snap.*.fstab w,
  434. # Allow snap-confine to read and write mount namespace information files.
  435. /run/snapd/ns/snap.*.info rw,
  436. # Required to correctly unmount bound mount namespace.
  437. # See LP: #1735459 for details.
  438. umount /,
  439.  
  440. # support for locking
  441. /run/snapd/lock/ rw,
  442. /run/snapd/lock/*.lock rwk,
  443.  
  444. # support for the mount namespace sharing
  445. capability sys_ptrace,
  446. # allow snap-confine to read /proc/1/ns/mnt
  447. ptrace read peer=unconfined,
  448. # https://forum.snapcraft.io/t/custom-kernel-error-on-readlinkat-in-mount-namespace/6097/21
  449. ptrace trace peer=unconfined,
  450.  
  451. mount options=(rw rbind) /run/snapd/ns/ -> /run/snapd/ns/,
  452. mount options=(private) -> /run/snapd/ns/,
  453. / rw,
  454. /run/ rw,
  455. /run/snapd/ rw,
  456. /run/snapd/ns/ rw,
  457. /run/snapd/ns/*.lock rwk,
  458. /run/snapd/ns/*.mnt rw,
  459. ptrace (read, readby, tracedby) peer=/usr/lib/snapd/snap-confine//mount-namespace-capture-helper,
  460. @{PROC}/*/mountinfo r,
  461. capability sys_chroot,
  462. capability sys_admin,
  463. signal (send, receive) set=(abrt) peer=/usr/lib/snapd/snap-confine,
  464. signal (send) set=(int) peer=/usr/lib/snapd/snap-confine//mount-namespace-capture-helper,
  465. signal (send, receive) set=(int, alrm, exists) peer=/usr/lib/snapd/snap-confine,
  466. signal (receive) set=(exists) peer=/usr/lib/snapd/snap-confine//mount-namespace-capture-helper,
  467.  
  468. # workaround for linux 4.13/upstream, see
  469. # https://forum.snapcraft.io/t/snapd-2-27-6-2-in-debian-sid-blocked-on-apparmor-in-kernel-4-13-0-1/2813/3
  470. ptrace (trace, tracedby) peer=/usr/lib/snapd/snap-confine,
  471.  
  472. # Allow reading snap cookies.
  473. /var/lib/snapd/cookie/snap.* r,
  474.  
  475. # For aa_change_hat() to go into ^mount-namespace-capture-helper
  476. @{PROC}/[0-9]*/attr/{,apparmor/}current w,
  477.  
  478. # As a special exception allow snap-confine to write to anything in /var/lib.
  479. # This code should be changed to allow delegation so that snap-confine can
  480. # inherit any file descriptor and pass it to the invoked application but
  481. # this is not possible in apparmor yet.
  482. # See https://bugs.launchpad.net/snapd/+bug/1815869
  483. /var/lib/** rw,
  484.  
  485. ^mount-namespace-capture-helper (attach_disconnected) {
  486. # We run privileged, so be fanatical about what we include and don't use
  487. # any abstractions
  488. /etc/ld.so.cache r,
  489. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}ld{-*,64}.so* mrix,
  490. # libc, you are funny
  491. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libc{,-[0-9]*}.so* mr,
  492. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libpthread{,-[0-9]*}.so* mr,
  493. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libreadline{,-[0-9]*}.so* mr,
  494. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}librt{,-[0-9]*}.so* mr,
  495. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libgcc_s.so* mr,
  496. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libncursesw{,-[0-9]*}.so* mr,
  497. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libresolv{,-[0-9]*}.so* mr,
  498. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libselinux.so* mr,
  499. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libpcre.so* mr,
  500. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libmount.so* mr,
  501. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libblkid.so* mr,
  502. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libuuid.so* mr,
  503. # normal libs in order
  504. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libapparmor.so* mr,
  505. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcgmanager.so* mr,
  506. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libdl{,-[0-9]*}.so* mr,
  507. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnih.so* mr,
  508. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnih-dbus.so* mr,
  509. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libdbus-1.so* mr,
  510. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libudev.so* mr,
  511. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libseccomp.so* mr,
  512. /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcap.so* mr,
  513.  
  514. /usr/lib/snapd/snap-confine mr,
  515.  
  516. /dev/null rw,
  517. /dev/full rw,
  518. /dev/zero rw,
  519. /dev/random r,
  520. /dev/urandom r,
  521.  
  522. capability sys_ptrace,
  523. capability sys_admin,
  524. # This allows us to read and bind mount the namespace file
  525. / r,
  526. @{PROC}/ r,
  527. @{PROC}/*/ r,
  528. @{PROC}/*/ns/ r,
  529. @{PROC}/*/ns/mnt r,
  530. /run/ r,
  531. /run/snapd/ r,
  532. /run/snapd/ns/ r,
  533. /run/snapd/ns/*.mnt rw,
  534. # NOTE: the source name is / even though we map /proc/123/ns/mnt
  535. mount options=(rw bind) / -> /run/snapd/ns/*.mnt,
  536. # This is the SIGALRM that we send and receive if a timeout expires
  537. signal (send, receive) set=(alrm) peer=/usr/lib/snapd/snap-confine//mount-namespace-capture-helper,
  538. # Those two rules are exactly the same but we don't know if the parent process is still alive
  539. # and hence has the appropriate label or is already dead and hence has no label.
  540. signal (send) set=(exists) peer=/usr/lib/snapd/snap-confine,
  541. signal (send) set=(exists) peer=unconfined,
  542. # This is so that we can abort
  543. signal (send, receive) set=(abrt) peer=/usr/lib/snapd/snap-confine//mount-namespace-capture-helper,
  544. # This is the signal we get if snap-confine dies (we subscribe to it with prctl)
  545. signal (receive) set=(int) peer=/usr/lib/snapd/snap-confine,
  546. # This allows snap-confine to be killed from the outside.
  547. signal (receive) peer=unconfined,
  548. # This allows snap-confine to wait for us
  549. ptrace (read, trace, tracedby) peer=/usr/lib/snapd/snap-confine,
  550. }
  551.  
  552. # Allow snap-confine to be killed
  553. signal (receive) peer=unconfined,
  554.  
  555. # Allow switching to snap-update-ns with a per-snap profile.
  556. change_profile -> snap-update-ns.*,
  557.  
  558. # Allow executing snap-update-ns when...
  559.  
  560. # ...snap-confine is, conceptually, re-executing and uses snap-update-ns
  561. # from the distribution package. This is also the location used when using
  562. # the core/base snap on all-snap systems. The variants here represent
  563. # various locations of libexecdir across distributions.
  564. /usr/lib{,exec,64}/snapd/snap-update-ns r,
  565.  
  566. # ...snap-confine is not, conceptually, re-executing and uses
  567. # snap-update-ns from the distribution package but we are already inside
  568. # the constructed mount namespace so we must traverse "hostfs". The
  569. # variants here represent various locations of libexecdir across
  570. # distributions.
  571. /var/lib/snapd/hostfs/usr/lib{,exec,64}/snapd/snap-update-ns r,
  572.  
  573. # ..snap-confine is, conceptually, re-executing and uses snap-update-ns
  574. # from the core or snapd snaps. Note that the location of the actual snap
  575. # varies from distribution to distribution. The variants here represent
  576. # different locations of snap mount directory across distributions.
  577. /{,var/lib/snapd/}snap/{core,snapd}/*/usr/lib/snapd/snap-update-ns r,
  578.  
  579. # ...snap-confine is, conceptually, re-executing and uses snap-update-ns
  580. # from the core snap or snapd snap, but we are already inside the
  581. # constructed mount namespace. Here the apparmor kernel module
  582. # re-constructs the path to snap-update-ns using the "hostfs" mount entry
  583. # rather than the more "natural" /snap mount entry but we have no control
  584. # over that. This is reported as (LP: #1716339). The variants here
  585. # represent different locations of snap mount directory across
  586. # distributions.
  587. /var/lib/snapd/hostfs/{,var/lib/snapd/}snap/{core,snapd}/*/usr/lib/snapd/snap-update-ns r,
  588.  
  589. # Allow executing snap-discard-ns, just like the set for snap-update-ns
  590. # above but with the key difference that snap-discard-ns does not
  591. # have a dedicated profile so we need to inherit snap-confine's profile.
  592.  
  593. /usr/lib{,exec,64}/snapd/snap-discard-ns rix,
  594. /var/lib/snapd/hostfs/usr/lib{,exec,64}/snapd/snap-discard-ns rix,
  595. /{,var/lib/snapd/}snap/{core,snapd}/*/usr/lib/snapd/snap-discard-ns rix,
  596. /var/lib/snapd/hostfs/{,var/lib/snapd/}snap/{core,snapd}/*/usr/lib/snapd/snap-discard-ns rix,
  597.  
  598. # Allow mounting /var/lib/jenkins from the host into the snap.
  599. mount options=(rw rbind) /var/lib/jenkins/ -> /tmp/snap.rootfs_*/var/lib/jenkins/,
  600. mount options=(rw rslave) -> /tmp/snap.rootfs_*/var/lib/jenkins/,
  601.  
  602. # Suppress noisy file_inherit denials (LP: #1850552) until LP: #1849753 is
  603. # fixed.
  604. deny /dev/shm/.org.chromium.Chromium.* rw,
  605.  
  606. # While snap-confine itself doesn't require unix rules and therefore all
  607. # unix rules are implicitly denied, adding an explicit deny for unix to
  608. # silence noisy denials breaks nested lxd. Until the cause is determined,
  609. # do not use an explicit deny for unix. (LP: #1855355)
  610. #deny unix,
  611.  
  612. # Explicitly deny these accesses which show up on Arch to silence the
  613. # denials for this unneeded access.
  614. deny /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnss_files-[0-9]*.so* mr,
  615. deny /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnss_mymachines.[0-9]*.so* mr,
  616. deny /{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnss_systemd.[0-9]*.so* mr,
  617. deny /etc/nsswitch.conf r,
  618. deny /etc/passwd r,
  619. }
  620.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!