Public Pastes
daily pastebin goal
1%
SHARE
TWEET

/var/lib/snapd/apparmor/profiles/snap.hugo.hugo

a guest Aug 25th, 2017 86 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Description: Allows access to app-specific directories and basic runtime
  2. # Usage: common
  3.  
  4. # vim:syntax=apparmor
  5.  
  6. #include <tunables/global>
  7.  
  8. @{SNAP_NAME}="hugo"
  9. @{SNAP_REVISION}="475"
  10. @{PROFILE_DBUS}="snap_2ehugo_2ehugo"
  11. @{INSTALL_DIR}="/snap"
  12.  
  13. profile "snap.hugo.hugo" (attach_disconnected) {
  14.   #include <abstractions/base>
  15.   #include <abstractions/consoles>
  16.   #include <abstractions/openssl>
  17.  
  18.   # While in later versions of the base abstraction, include this explicitly
  19.   # for series 16 and cross-distro
  20.   /etc/ld.so.preload r,
  21.  
  22.   # for python apps/services
  23.   #include <abstractions/python>
  24.   /usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr,
  25.  
  26.   # explicitly deny noisy denials to read-only filesystems (see LP: #1496895
  27.   # for details)
  28.   deny /usr/lib/python3*/{,**/}__pycache__/ w,
  29.   deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w,
  30.   deny @{INSTALL_DIR}/@{SNAP_NAME}/**/__pycache__/             w,
  31.   deny @{INSTALL_DIR}/@{SNAP_NAME}/**/__pycache__/*.pyc.[0-9]* w,
  32.  
  33.   # for perl apps/services
  34.   #include <abstractions/perl>
  35.   /usr/bin/perl{,5*} ixr,
  36.  
  37.   # Note: the following dangerous accesses should not be allowed in most
  38.   # policy, but we cannot explicitly deny since other trusted interfaces might
  39.   # add them.
  40.   # Explicitly deny ptrace for now since it can be abused to break out of the
  41.   # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
  42.   #audit deny ptrace (trace),
  43.  
  44.   # Explicitly deny capability mknod so apps can't create devices
  45.   #audit deny capability mknod,
  46.  
  47.   # Explicitly deny mount, remount and umount so apps can't modify things in
  48.   # their namespace
  49.   #audit deny mount,
  50.   #audit deny remount,
  51.   #audit deny umount,
  52.  
  53.   # End dangerous accesses
  54.  
  55.   # Note: this potentially allows snaps to DoS other snaps via resource
  56.   # exhaustion but we can't sensibly mediate this today. In the future we may
  57.   # employ cgroup limits, AppArmor rlimit mlock rules or something else.
  58.   capability ipc_lock,
  59.  
  60.   # for bash 'binaries' (do *not* use abstractions/bash)
  61.   # user-specific bash files
  62.   /bin/bash ixr,
  63.   /bin/dash ixr,
  64.   /etc/bash.bashrc r,
  65.   /etc/{passwd,group,nsswitch.conf} r,  # very common
  66.   /etc/libnl-3/{classid,pktloc} r,      # apps that use libnl
  67.   /var/lib/extrausers/{passwd,group} r,
  68.   /etc/profile r,
  69.   /etc/environment r,
  70.   /usr/share/terminfo/** r,
  71.   /etc/inputrc r,
  72.   # Common utilities for shell scripts
  73.   /{,usr/}bin/arch ixr,
  74.   /{,usr/}bin/{,g,m}awk ixr,
  75.   /{,usr/}bin/basename ixr,
  76.   /{,usr/}bin/bunzip2 ixr,
  77.   /{,usr/}bin/bzcat ixr,
  78.   /{,usr/}bin/bzdiff ixr,
  79.   /{,usr/}bin/bzgrep ixr,
  80.   /{,usr/}bin/bzip2 ixr,
  81.   /{,usr/}bin/cat ixr,
  82.   /{,usr/}bin/chmod ixr,
  83.   /{,usr/}bin/clear ixr,
  84.   /{,usr/}bin/cmp ixr,
  85.   /{,usr/}bin/cp ixr,
  86.   /{,usr/}bin/cpio ixr,
  87.   /{,usr/}bin/cut ixr,
  88.   /{,usr/}bin/date ixr,
  89.   /{,usr/}bin/dd ixr,
  90.   /{,usr/}bin/diff{,3} ixr,
  91.   /{,usr/}bin/dir ixr,
  92.   /{,usr/}bin/dirname ixr,
  93.   /{,usr/}bin/echo ixr,
  94.   /{,usr/}bin/{,e,f,r}grep ixr,
  95.   /{,usr/}bin/env ixr,
  96.   /{,usr/}bin/expr ixr,
  97.   /{,usr/}bin/false ixr,
  98.   /{,usr/}bin/find ixr,
  99.   /{,usr/}bin/flock ixr,
  100.   /{,usr/}bin/fmt ixr,
  101.   /{,usr/}bin/getent ixr,
  102.   /{,usr/}bin/getopt ixr,
  103.   /{,usr/}bin/groups ixr,
  104.   /{,usr/}bin/gzip ixr,
  105.   /{,usr/}bin/head ixr,
  106.   /{,usr/}bin/hostname ixr,
  107.   /{,usr/}bin/id ixr,
  108.   /{,usr/}bin/igawk ixr,
  109.   /{,usr/}bin/infocmp ixr,
  110.   /{,usr/}bin/kill ixr,
  111.   /{,usr/}bin/ldd ixr,
  112.   /{usr/,}lib{,32,64}/ld{,32,64}-*.so ix,
  113.   /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so ix,
  114.   /{,usr/}bin/less{,file,pipe} ixr,
  115.   /{,usr/}bin/ln ixr,
  116.   /{,usr/}bin/line ixr,
  117.   /{,usr/}bin/link ixr,
  118.   /{,usr/}bin/locale ixr,
  119.   /{,usr/}bin/logger ixr,
  120.   /{,usr/}bin/ls ixr,
  121.   /{,usr/}bin/md5sum ixr,
  122.   /{,usr/}bin/mkdir ixr,
  123.   /{,usr/}bin/mkfifo ixr,
  124.   /{,usr/}bin/mknod ixr,
  125.   /{,usr/}bin/mktemp ixr,
  126.   /{,usr/}bin/more ixr,
  127.   /{,usr/}bin/mv ixr,
  128.   /{,usr/}bin/nice ixr,
  129.   /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
  130.   /{,usr/}bin/pgrep ixr,
  131.   /{,usr/}bin/printenv ixr,
  132.   /{,usr/}bin/printf ixr,
  133.   /{,usr/}bin/ps ixr,
  134.   /{,usr/}bin/pwd ixr,
  135.   /{,usr/}bin/readlink ixr,
  136.   /{,usr/}bin/realpath ixr,
  137.   /{,usr/}bin/rev ixr,
  138.   /{,usr/}bin/rm ixr,
  139.   /{,usr/}bin/rmdir ixr,
  140.   /{,usr/}bin/run-parts ixr,
  141.   /{,usr/}bin/sed ixr,
  142.   /{,usr/}bin/seq ixr,
  143.   /{,usr/}bin/sha{1,224,256,384,512}sum ixr,
  144.   /{,usr/}bin/shuf ixr,
  145.   /{,usr/}bin/sleep ixr,
  146.   /{,usr/}bin/sort ixr,
  147.   /{,usr/}bin/stat ixr,
  148.   /{,usr/}bin/stdbuf ixr,
  149.   /{,usr/}bin/stty ixr,
  150.   /{,usr/}bin/systemd-cat ixr,
  151.   /{,usr/}bin/tac ixr,
  152.   /{,usr/}bin/tail ixr,
  153.   /{,usr/}bin/tar ixr,
  154.   /{,usr/}bin/tee ixr,
  155.   /{,usr/}bin/test ixr,
  156.   /{,usr/}bin/tempfile ixr,
  157.   /{,usr/}bin/tset ixr,
  158.   /{,usr/}bin/touch ixr,
  159.   /{,usr/}bin/tput ixr,
  160.   /{,usr/}bin/tr ixr,
  161.   /{,usr/}bin/true ixr,
  162.   /{,usr/}bin/tty ixr,
  163.   /{,usr/}bin/uname ixr,
  164.   /{,usr/}bin/uniq ixr,
  165.   /{,usr/}bin/unlink ixr,
  166.   /{,usr/}bin/unxz ixr,
  167.   /{,usr/}bin/unzip ixr,
  168.   /{,usr/}bin/vdir ixr,
  169.   /{,usr/}bin/wc ixr,
  170.   /{,usr/}bin/which ixr,
  171.   /{,usr/}bin/xargs ixr,
  172.   /{,usr/}bin/xz ixr,
  173.   /{,usr/}bin/yes ixr,
  174.   /{,usr/}bin/zcat ixr,
  175.   /{,usr/}bin/z{,e,f}grep ixr,
  176.   /{,usr/}bin/zip ixr,
  177.   /{,usr/}bin/zipgrep ixr,
  178.  
  179.   # For snappy reexec on 4.8+ kernels
  180.   /usr/lib/snapd/snap-exec m,
  181.  
  182.   # For in-snap tab completion
  183.   /etc/bash_completion.d/{,*} r,
  184.   /usr/lib/snapd/etelpmoc.sh ixr,               # marshaller (see complete.sh for out-of-snap unmarshal)
  185.   /usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here
  186.  
  187.   # For printing the cache (we don't allow updating the cache)
  188.   /{,usr/}sbin/ldconfig{,.real} ixr,
  189.  
  190.   # uptime
  191.   /{,usr/}bin/uptime ixr,
  192.   @{PROC}/uptime r,
  193.   @{PROC}/loadavg r,
  194.  
  195.   # lsb-release
  196.   /usr/bin/lsb_release ixr,
  197.   /usr/bin/ r,
  198.   /usr/share/distro-info/*.csv r,
  199.  
  200.   # Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib
  201.   # but on 14.04 it is an actual file so it doens't fall under other rules.
  202.   /etc/os-release r,
  203.  
  204.   # systemd native journal API (see sd_journal_print(4)). This should be in
  205.   # AppArmor's base abstraction, but until it is, include here.
  206.   /run/systemd/journal/socket w,
  207.   /run/systemd/journal/stdout rw, # 'r' shouldn't be needed, but journald
  208.                                   # doesn't leak anything so allow
  209.  
  210.   # snapctl and its requirements
  211.   /usr/bin/snapctl ixr,
  212.   @{PROC}/sys/net/core/somaxconn r,
  213.   /run/snapd-snap.socket rw,
  214.  
  215.   # Note: for now, don't explicitly deny this noisy denial so --devmode isn't
  216.   # broken but eventually we may conditionally deny this since it is an
  217.   # information leak.
  218.   #deny /{,var/}run/utmp r,
  219.  
  220.   # java
  221.   @{PROC}/@{pid}/ r,
  222.   @{PROC}/@{pid}/fd/ r,
  223.   owner @{PROC}/@{pid}/auxv r,
  224.   @{PROC}/sys/vm/zone_reclaim_mode r,
  225.   /etc/lsb-release r,
  226.   /sys/devices/**/read_ahead_kb r,
  227.   /sys/devices/system/cpu/** r,
  228.   /sys/devices/system/node/node[0-9]*/* r,
  229.   /sys/kernel/mm/transparent_hugepage/enabled r,
  230.   /sys/kernel/mm/transparent_hugepage/defrag r,
  231.   # NOTE: this leaks running process but java seems to want it (even though it
  232.   # seems to operate ok without it) and SDL apps crash without it. Allow owner
  233.   # match until AppArmor kernel var is available to solve this properly (see
  234.   # LP: #1546825 for details)
  235.   owner @{PROC}/@{pid}/cmdline r,
  236.   owner @{PROC}/@{pid}/comm r,
  237.  
  238.   # Per man(5) proc, the kernel enforces that a thread may only modify its comm
  239.   # value or those in its thread group.
  240.   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
  241.  
  242.   # Miscellaneous accesses
  243.   /dev/{,u}random w,
  244.   /etc/machine-id r,
  245.   /etc/mime.types r,
  246.   @{PROC}/ r,
  247.   @{PROC}/version r,
  248.   @{PROC}/version_signature r,
  249.   /etc/{,writable/}hostname r,
  250.   /etc/{,writable/}localtime r,
  251.   /etc/{,writable/}mailname r,
  252.   /etc/{,writable/}timezone r,
  253.   @{PROC}/@{pid}/io r,
  254.   owner @{PROC}/@{pid}/limits r,
  255.   @{PROC}/@{pid}/smaps r,
  256.   @{PROC}/@{pid}/stat r,
  257.   @{PROC}/@{pid}/statm r,
  258.   @{PROC}/@{pid}/status r,
  259.   @{PROC}/@{pid}/task/ r,
  260.   @{PROC}/@{pid}/task/[0-9]*/smaps r,
  261.   @{PROC}/@{pid}/task/[0-9]*/stat r,
  262.   @{PROC}/@{pid}/task/[0-9]*/statm r,
  263.   @{PROC}/@{pid}/task/[0-9]*/status r,
  264.   @{PROC}/sys/kernel/hostname r,
  265.   @{PROC}/sys/kernel/osrelease r,
  266.   @{PROC}/sys/kernel/yama/ptrace_scope r,
  267.   @{PROC}/sys/kernel/shmmax r,
  268.   @{PROC}/sys/fs/file-max r,
  269.   @{PROC}/sys/kernel/pid_max r,
  270.   @{PROC}/sys/kernel/random/uuid r,
  271.   @{PROC}/sys/kernel/random/boot_id r,
  272.   /sys/devices/virtual/tty/{console,tty*}/active r,
  273.   /{,usr/}lib/ r,
  274.  
  275.   # Reads of oom_adj and oom_score_adj are safe
  276.   owner @{PROC}/@{pid}/oom_{,score_}adj r,
  277.  
  278.   # Note: for now, don't explicitly deny write access so --devmode isn't broken
  279.   # but eventually we may conditionally deny this since it allows the process
  280.   # to increase the oom heuristic of other processes (make them more likely to
  281.   # be killed). Once AppArmor kernel var is available to solve this properly,
  282.   # this can safely be allowed since non-root processes won't be able to
  283.   # decrease the value and root processes will only be able to with
  284.   # 'capability sys_resource,' which we deny be default.
  285.   # deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
  286.  
  287.   # Eases hardware assignment (doesn't give anything away)
  288.   /etc/udev/udev.conf r,
  289.   /sys/       r,
  290.   /sys/bus/   r,
  291.   /sys/class/ r,
  292.  
  293.   # this leaks interface names and stats, but not in a way that is traceable
  294.   # to the user/device
  295.   @{PROC}/net/dev r,
  296.   @{PROC}/@{pid}/net/dev r,
  297.  
  298.   # Read-only for the install directory
  299.   @{INSTALL_DIR}/@{SNAP_NAME}/                   r,
  300.   @{INSTALL_DIR}/@{SNAP_NAME}/@{SNAP_REVISION}/    r,
  301.   @{INSTALL_DIR}/@{SNAP_NAME}/@{SNAP_REVISION}/**  mrklix,
  302.  
  303.   # Read-only install directory for other revisions to help with bugs like
  304.   # LP: #1616650 and LP: #1655992
  305.   @{INSTALL_DIR}/@{SNAP_NAME}/**  mrkix,
  306.  
  307.   # Read-only home area for other versions
  308.   owner @{HOME}/snap/@{SNAP_NAME}/                  r,
  309.   owner @{HOME}/snap/@{SNAP_NAME}/**                mrkix,
  310.  
  311.   # Writable home area for this version.
  312.   owner @{HOME}/snap/@{SNAP_NAME}/@{SNAP_REVISION}/** wl,
  313.   owner @{HOME}/snap/@{SNAP_NAME}/common/** wl,
  314.  
  315.   # Read-only system area for other versions
  316.   /var/snap/@{SNAP_NAME}/   r,
  317.   /var/snap/@{SNAP_NAME}/** mrkix,
  318.  
  319.   # Writable system area only for this version
  320.   /var/snap/@{SNAP_NAME}/@{SNAP_REVISION}/** wl,
  321.   /var/snap/@{SNAP_NAME}/common/** wl,
  322.  
  323.   # The ubuntu-core-launcher creates an app-specific private restricted /tmp
  324.   # and will fail to launch the app if something goes wrong. As such, we can
  325.   # simply allow full access to /tmp.
  326.   /tmp/   r,
  327.   /tmp/** mrwlkix,
  328.  
  329.   # App-specific access to files and directories in /dev/shm. We allow file
  330.   # access in /dev/shm for shm_open() and files in subdirectories for open()
  331.   /{dev,run}/shm/snap.@{SNAP_NAME}.** mrwlkix,
  332.   # Also allow app-specific access for sem_open()
  333.   /{dev,run}/shm/sem.snap.@{SNAP_NAME}.* mrwk,
  334.  
  335.   # Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
  336.   owner /run/user/[0-9]*/snap.@{SNAP_NAME}/   rw,
  337.   owner /run/user/[0-9]*/snap.@{SNAP_NAME}/** mrwklix,
  338.  
  339.   # Allow apps from the same package to communicate with each other via an
  340.   # abstract or anonymous socket
  341.   unix peer=(label=snap.@{SNAP_NAME}.*),
  342.  
  343.   # Allow apps from the same package to communicate with each other via DBus.
  344.   # Note: this does not grant access to the DBus sockets of well known buses
  345.   # (will still need to use an appropriate interface for that).
  346.   dbus (receive, send) peer=(label=snap.@{SNAP_NAME}.*),
  347.  
  348.   # Allow apps from the same package to signal each other via signals
  349.   signal peer=snap.@{SNAP_NAME}.*,
  350.  
  351.   # for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign'
  352.   /{,s}bin/udevadm ixr,
  353.   /etc/udev/udev.conf r,
  354.   /{,var/}run/udev/tags/snappy-assign/ r,
  355.   @{PROC}/cmdline r,
  356.   /sys/devices/**/uevent r,
  357.  
  358.   # LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above
  359.   # requires:
  360.   #   /run/udev/data/* r,
  361.   # but that reveals too much about the system and cannot be granted to apps
  362.   # by default at this time.
  363.  
  364.   # For convenience, allow apps to see what is in /dev even though cgroups
  365.   # will block most access
  366.   /dev/ r,
  367.   /dev/**/ r,
  368.  
  369.   # Allow setting up pseudoterminal via /dev/pts system. This is safe because
  370.   # the launcher uses a per-app devpts newinstance.
  371.   /dev/ptmx rw,
  372.  
  373.   # Do the same with /sys/devices and /sys/class to help people using hw-assign
  374.   /sys/devices/ r,
  375.   /sys/devices/**/ r,
  376.   /sys/class/ r,
  377.   /sys/class/**/ r,
  378.  
  379.   # Allow all snaps to chroot
  380.   capability sys_chroot,
  381.   /{,usr/}sbin/chroot ixr,
  382.  
  383.  
  384. # Description: Can access non-hidden files in user's $HOME. This is restricted
  385. # because it gives file access to all of the user's $HOME.
  386.  
  387. # Note, @{HOME} is the user's $HOME, not the snap's $HOME
  388.  
  389. # Allow read access to toplevel $HOME for the user
  390. owner @{HOME}/ r,
  391.  
  392. # Allow read/write access to all files in @{HOME}, except snap application
  393. # data in @{HOME}/snaps and toplevel hidden directories in @{HOME}.
  394. owner @{HOME}/[^s.]**             rwk,
  395. owner @{HOME}/s[^n]**             rwk,
  396. owner @{HOME}/sn[^a]**            rwk,
  397. owner @{HOME}/sna[^p]**           rwk,
  398. # Allow creating a few files not caught above
  399. owner @{HOME}/{s,sn,sna}{,/} rwk,
  400.  
  401. # Allow access to gvfs mounts for files owned by the user (including hidden
  402. # files; only allow writes to files, not the mount point).
  403. owner /run/user/[0-9]*/gvfs/{,**} r,
  404. owner /run/user/[0-9]*/gvfs/*/**  w,
  405.  
  406.  
  407. # Description: Can access the network as a server.
  408. #include <abstractions/nameservice>
  409. #include <abstractions/ssl_certs>
  410.  
  411. # These probably shouldn't be something that apps should use, but this offers
  412. # no information disclosure since the files are in the read-only part of the
  413. # system.
  414. /etc/hosts.deny r,
  415. /etc/hosts.allow r,
  416.  
  417. @{PROC}/sys/net/core/somaxconn r,
  418. @{PROC}/sys/net/ipv4/ip_local_port_range r,
  419.  
  420. # LP: #1496906: java apps need these for some reason and they leak the IPv6 IP
  421. # addresses and routes. Until we find another way to handle them (see the bug
  422. # for some options), we need to allow them to avoid developer confusion.
  423. @{PROC}/@{pid}/net/if_inet6 r,
  424. @{PROC}/@{pid}/net/ipv6_route r,
  425.  
  426. # java apps attempt this, presumably to handle interface changes, but a
  427. # corresponding seccomp socket rule is required to use netlink. When
  428. # fine-grained netlink mediation is implemented (LP: #1669552), we can perhaps
  429. # allow 'read' with NETLINK_ROUTE, but for now we omit it here and don't
  430. # explicitly deny this noisy denial so --devmode isn't broken. LP: #1499897
  431. #deny network netlink dgram,
  432.  
  433. }
RAW Paste Data
Top