API tools faq
paste
Guest User

Untitled

a guest
Apr 14th, 2020
41
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 55.67 KB | None | 0 0
raw download clone embed print report
  1.  
  2. # Description: Allows access to app-specific directories and basic runtime
  3. # Usage: common
  4.  
  5. # vim:syntax=apparmor
  6.  
  7. #include <tunables/global>
  8.  
  9. # snapd supports the concept of 'parallel installs' where snaps with the same
  10. # name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz
  11. # may all be installed on the system. To support this, SNAP_NAME is set to the
  12. # name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg
  13. # 'foo_bar'). The profile name and most rules therefore reference
  14. # SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime
  15. # environment so the snap doesn't have to be aware of the distinction (eg,
  16. # SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with
  17. # SNAP_NAME so the security policy will allow writing to both locations (since
  18. # they are equivalent).
  19.  
  20. # This is a snap name without the instance key
  21. @{SNAP_NAME}="snap-store"
  22. # This is a snap name with instance key
  23. @{SNAP_INSTANCE_NAME}="snap-store"
  24. @{SNAP_COMMAND_NAME}="ubuntu-software"
  25. @{SNAP_REVISION}="357"
  26. @{PROFILE_DBUS}="snap_2esnap_2dstore_2eubuntu_2dsoftware"
  27. @{INSTALL_DIR}="/{,var/lib/snapd/}snap"
  28.  
  29. profile "snap.snap-store.ubuntu-software" (attach_disconnected,mediate_deleted) {
  30. #include <abstractions/base>
  31. #include <abstractions/consoles>
  32. #include <abstractions/openssl>
  33.  
  34. # While in later versions of the base abstraction, include this explicitly
  35. # for series 16 and cross-distro
  36. /etc/ld.so.preload r,
  37.  
  38. # The base abstraction doesn't yet have this
  39. /etc/sysconfig/clock r,
  40. /lib/terminfo/** rk,
  41. /usr/share/terminfo/** k,
  42. /usr/share/zoneinfo/** k,
  43. owner @{PROC}/@{pid}/maps k,
  44. # While the base abstraction has rules for encryptfs encrypted home and
  45. # private directories, it is missing rules for directory read on the toplevel
  46. # directory of the mount (LP: #1848919)
  47. owner @{HOME}/.Private/ r,
  48. owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
  49.  
  50. # for python apps/services
  51. #include <abstractions/python>
  52. /usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr,
  53. # additional accesses needed for newer pythons in later bases
  54. /usr/lib{,32,64}/python3.[0-9]/**.{pyc,so} mr,
  55. /usr/lib{,32,64}/python3.[0-9]/**.{egg,py,pth} r,
  56. /usr/lib{,32,64}/python3.[0-9]/{site,dist}-packages/ r,
  57. /usr/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr,
  58. /etc/python3.[0-9]/** r,
  59. /usr/include/python3.[0-9]*/pyconfig.h r,
  60.  
  61. # explicitly deny noisy denials to read-only filesystems (see LP: #1496895
  62. # for details)
  63. deny /usr/lib/python3*/{,**/}__pycache__/ w,
  64. deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w,
  65. # bind mount used here (see 'parallel installs', above)
  66. deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/ w,
  67. deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w,
  68.  
  69. # for perl apps/services
  70. #include <abstractions/perl>
  71. /usr/bin/perl{,5*} ixr,
  72. # AppArmor <2.12 doesn't have rules for perl-base, so add them here
  73. /usr/lib/@{multiarch}/perl{,5,-base}/** r,
  74. /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,
  75.  
  76. # Note: the following dangerous accesses should not be allowed in most
  77. # policy, but we cannot explicitly deny since other trusted interfaces might
  78. # add them.
  79. # Explicitly deny ptrace for now since it can be abused to break out of the
  80. # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
  81. #audit deny ptrace (trace),
  82.  
  83. # Explicitly deny capability mknod so apps can't create devices
  84. #audit deny capability mknod,
  85.  
  86. # Explicitly deny mount, remount and umount so apps can't modify things in
  87. # their namespace
  88. #audit deny mount,
  89. #audit deny remount,
  90. #audit deny umount,
  91.  
  92. # End dangerous accesses
  93.  
  94. # Note: this potentially allows snaps to DoS other snaps via resource
  95. # exhaustion but we can't sensibly mediate this today. In the future we may
  96. # employ cgroup limits, AppArmor rlimit mlock rules or something else.
  97. capability ipc_lock,
  98.  
  99. # for bash 'binaries' (do *not* use abstractions/bash)
  100. # user-specific bash files
  101. /{,usr/}bin/bash ixr,
  102. /{,usr/}bin/dash ixr,
  103. /etc/bash.bashrc r,
  104.  
  105. # user/group/seat lookups
  106. /etc/{passwd,group,nsswitch.conf} r, # very common
  107. /var/lib/extrausers/{passwd,group} r,
  108. /run/systemd/users/[0-9]* r,
  109. /etc/default/nss r,
  110.  
  111. # libnss-systemd (subset from nameservice abstraction)
  112. #
  113. # https://systemd.io/USER_GROUP_API/
  114. # https://systemd.io/USER_RECORD/
  115. # https://www.freedesktop.org/software/systemd/man/nss-systemd.html
  116. #
  117. # Allow User/Group lookups via common VarLink socket APIs. Applications need
  118. # to either consult all of them or the io.systemd.Multiplexer frontend.
  119. /run/systemd/userdb/ r,
  120. /run/systemd/userdb/io.systemd.Multiplexer rw,
  121. /run/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users
  122. /run/systemd/userdb/io.systemd.Home rw, # systemd-home dirs
  123. /run/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS
  124.  
  125. /etc/libnl-3/{classid,pktloc} r, # apps that use libnl
  126. /etc/profile r,
  127. /etc/environment r,
  128. /usr/share/terminfo/** r,
  129. /etc/inputrc r,
  130. # Common utilities for shell scripts
  131. /{,usr/}bin/arch ixr,
  132. /{,usr/}bin/{,g,m}awk ixr,
  133. /{,usr/}bin/base32 ixr,
  134. /{,usr/}bin/base64 ixr,
  135. /{,usr/}bin/basename ixr,
  136. /{,usr/}bin/bunzip2 ixr,
  137. /{,usr/}bin/bzcat ixr,
  138. /{,usr/}bin/bzdiff ixr,
  139. /{,usr/}bin/bzgrep ixr,
  140. /{,usr/}bin/bzip2 ixr,
  141. /{,usr/}bin/cat ixr,
  142. /{,usr/}bin/chgrp ixr,
  143. /{,usr/}bin/chmod ixr,
  144. /{,usr/}bin/chown ixr,
  145. /{,usr/}bin/clear ixr,
  146. /{,usr/}bin/cmp ixr,
  147. /{,usr/}bin/cp ixr,
  148. /{,usr/}bin/cpio ixr,
  149. /{,usr/}bin/cut ixr,
  150. /{,usr/}bin/date ixr,
  151. /{,usr/}bin/dbus-daemon ixr,
  152. /{,usr/}bin/dbus-run-session ixr,
  153. /{,usr/}bin/dbus-send ixr,
  154. /{,usr/}bin/dd ixr,
  155. /{,usr/}bin/diff{,3} ixr,
  156. /{,usr/}bin/dir ixr,
  157. /{,usr/}bin/dirname ixr,
  158. /{,usr/}bin/du ixr,
  159. /{,usr/}bin/echo ixr,
  160. /{,usr/}bin/{,e,f,r}grep ixr,
  161. /{,usr/}bin/env ixr,
  162. /{,usr/}bin/expr ixr,
  163. /{,usr/}bin/false ixr,
  164. /{,usr/}bin/find ixr,
  165. /{,usr/}bin/flock ixr,
  166. /{,usr/}bin/fmt ixr,
  167. /{,usr/}bin/fold ixr,
  168. /{,usr/}bin/getconf ixr,
  169. /{,usr/}bin/getent ixr,
  170. /{,usr/}bin/getopt ixr,
  171. /{,usr/}bin/groups ixr,
  172. /{,usr/}bin/gzip ixr,
  173. /{,usr/}bin/head ixr,
  174. /{,usr/}bin/hostname ixr,
  175. /{,usr/}bin/id ixr,
  176. /{,usr/}bin/igawk ixr,
  177. /{,usr/}bin/infocmp ixr,
  178. /{,usr/}bin/kill ixr,
  179. /{,usr/}bin/ldd ixr,
  180. /{usr/,}lib{,32,64}/ld{,32,64}-*.so ix,
  181. /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so ix,
  182. /{,usr/}bin/less{,file,pipe} ixr,
  183. /{,usr/}bin/ln ixr,
  184. /{,usr/}bin/line ixr,
  185. /{,usr/}bin/link ixr,
  186. /{,usr/}bin/locale ixr,
  187. /{,usr/}bin/logger ixr,
  188. /{,usr/}bin/ls ixr,
  189. /{,usr/}bin/md5sum ixr,
  190. /{,usr/}bin/mkdir ixr,
  191. /{,usr/}bin/mkfifo ixr,
  192. /{,usr/}bin/mknod ixr,
  193. /{,usr/}bin/mktemp ixr,
  194. /{,usr/}bin/more ixr,
  195. /{,usr/}bin/mv ixr,
  196. /{,usr/}bin/nice ixr,
  197. /{,usr/}bin/nohup ixr,
  198. /{,usr/}bin/od ixr,
  199. /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
  200. /{,usr/}bin/paste ixr,
  201. /{,usr/}bin/pgrep ixr,
  202. /{,usr/}bin/printenv ixr,
  203. /{,usr/}bin/printf ixr,
  204. /{,usr/}bin/ps ixr,
  205. /{,usr/}bin/pwd ixr,
  206. /{,usr/}bin/readlink ixr,
  207. /{,usr/}bin/realpath ixr,
  208. /{,usr/}bin/rev ixr,
  209. /{,usr/}bin/rm ixr,
  210. /{,usr/}bin/rmdir ixr,
  211. /{,usr/}bin/run-parts ixr,
  212. /{,usr/}bin/sed ixr,
  213. /{,usr/}bin/seq ixr,
  214. /{,usr/}bin/sha{1,224,256,384,512}sum ixr,
  215. /{,usr/}bin/shuf ixr,
  216. /{,usr/}bin/sleep ixr,
  217. /{,usr/}bin/sort ixr,
  218. /{,usr/}bin/stat ixr,
  219. /{,usr/}bin/stdbuf ixr,
  220. /{,usr/}bin/stty ixr,
  221. /{,usr/}bin/sync ixr,
  222. /{,usr/}bin/systemd-cat ixr,
  223. /{,usr/}bin/tac ixr,
  224. /{,usr/}bin/tail ixr,
  225. /{,usr/}bin/tar ixr,
  226. /{,usr/}bin/tee ixr,
  227. /{,usr/}bin/test ixr,
  228. /{,usr/}bin/tempfile ixr,
  229. /{,usr/}bin/tset ixr,
  230. /{,usr/}bin/touch ixr,
  231. /{,usr/}bin/tput ixr,
  232. /{,usr/}bin/tr ixr,
  233. /{,usr/}bin/true ixr,
  234. /{,usr/}bin/tty ixr,
  235. /{,usr/}bin/uname ixr,
  236. /{,usr/}bin/uniq ixr,
  237. /{,usr/}bin/unlink ixr,
  238. /{,usr/}bin/unxz ixr,
  239. /{,usr/}bin/unzip ixr,
  240. /{,usr/}bin/vdir ixr,
  241. /{,usr/}bin/wc ixr,
  242. /{,usr/}bin/which ixr,
  243. /{,usr/}bin/xargs ixr,
  244. /{,usr/}bin/xz ixr,
  245. /{,usr/}bin/yes ixr,
  246. /{,usr/}bin/zcat ixr,
  247. /{,usr/}bin/z{,e,f}grep ixr,
  248. /{,usr/}bin/zip ixr,
  249. /{,usr/}bin/zipgrep ixr,
  250.  
  251. # For snappy reexec on 4.8+ kernels
  252. /usr/lib/snapd/snap-exec m,
  253.  
  254. # For gdb support
  255. /usr/lib/snapd/snap-gdb-shim ixr,
  256.  
  257. # For in-snap tab completion
  258. /etc/bash_completion.d/{,*} r,
  259. /usr/lib/snapd/etelpmoc.sh ixr, # marshaller (see complete.sh for out-of-snap unmarshal)
  260. /usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here
  261.  
  262. # For printing the cache (we don't allow updating the cache)
  263. /{,usr/}sbin/ldconfig{,.real} ixr,
  264.  
  265. # uptime
  266. /{,usr/}bin/uptime ixr,
  267. @{PROC}/uptime r,
  268. @{PROC}/loadavg r,
  269.  
  270. # lsb-release
  271. /usr/bin/lsb_release ixr,
  272. /usr/bin/ r,
  273. /usr/share/distro-info/*.csv r,
  274.  
  275. # Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib
  276. # which is allowed by the base abstraction, but on 14.04 it is an actual file
  277. # so need to add it here. Also allow read locks on the file.
  278. /etc/os-release rk,
  279. /usr/lib/os-release k,
  280.  
  281. # systemd native journal API (see sd_journal_print(4)). This should be in
  282. # AppArmor's base abstraction, but until it is, include here.
  283. /run/systemd/journal/socket w,
  284. /run/systemd/journal/stdout rw, # 'r' shouldn't be needed, but journald
  285. # doesn't leak anything so allow
  286.  
  287. # snapctl and its requirements
  288. /usr/bin/snapctl ixr,
  289. /usr/lib/snapd/snapctl ixr,
  290. @{PROC}/sys/net/core/somaxconn r,
  291. /run/snapd-snap.socket rw,
  292.  
  293. # Note: for now, don't explicitly deny this noisy denial so --devmode isn't
  294. # broken but eventually we may conditionally deny this since it is an
  295. # information leak.
  296. #deny /{,var/}run/utmp r,
  297.  
  298. # java
  299. @{PROC}/@{pid}/ r,
  300. @{PROC}/@{pid}/fd/ r,
  301. owner @{PROC}/@{pid}/auxv r,
  302. @{PROC}/sys/vm/zone_reclaim_mode r,
  303. /etc/lsb-release r,
  304. /sys/devices/**/read_ahead_kb r,
  305. /sys/devices/system/cpu/** r,
  306. /sys/devices/system/node/node[0-9]*/* r,
  307. /sys/kernel/mm/transparent_hugepage/enabled r,
  308. /sys/kernel/mm/transparent_hugepage/defrag r,
  309. # NOTE: this leaks running process but java seems to want it (even though it
  310. # seems to operate ok without it) and SDL apps crash without it. Allow owner
  311. # match until AppArmor kernel var is available to solve this properly (see
  312. # LP: #1546825 for details). comm is a subset of cmdline, so allow it too.
  313. owner @{PROC}/@{pid}/cmdline r,
  314. owner @{PROC}/@{pid}/comm r,
  315.  
  316. # Per man(5) proc, the kernel enforces that a thread may only modify its comm
  317. # value or those in its thread group.
  318. owner @{PROC}/@{pid}/task/@{tid}/comm rw,
  319.  
  320. # Allow reading and writing to our file descriptors in /proc which, for
  321. # example, allow access to /dev/std{in,out,err} which are all symlinks to
  322. # /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE)
  323. # linkat() temporary file technique, allow all fds. Importantly, access to
  324. # another's task's fd via this proc interface is mediated via 'ptrace (read)'
  325. # (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so
  326. # this rule by itself doesn't allow opening another snap's fds via proc.
  327. owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw,
  328.  
  329. # Miscellaneous accesses
  330. /dev/{,u}random w,
  331. /etc/machine-id r,
  332. /etc/mime.types r,
  333. @{PROC}/ r,
  334. @{PROC}/version r,
  335. @{PROC}/version_signature r,
  336. /etc/{,writable/}hostname r,
  337. /etc/{,writable/}localtime r,
  338. /etc/{,writable/}mailname r,
  339. /etc/{,writable/}timezone r,
  340. owner @{PROC}/@{pid}/cgroup rk,
  341. @{PROC}/@{pid}/io r,
  342. owner @{PROC}/@{pid}/limits r,
  343. owner @{PROC}/@{pid}/loginuid r,
  344. @{PROC}/@{pid}/smaps r,
  345. @{PROC}/@{pid}/stat r,
  346. @{PROC}/@{pid}/statm r,
  347. @{PROC}/@{pid}/status r,
  348. @{PROC}/@{pid}/task/ r,
  349. @{PROC}/@{pid}/task/[0-9]*/smaps r,
  350. @{PROC}/@{pid}/task/[0-9]*/stat r,
  351. @{PROC}/@{pid}/task/[0-9]*/statm r,
  352. @{PROC}/@{pid}/task/[0-9]*/status r,
  353. @{PROC}/sys/fs/pipe-max-size r,
  354. @{PROC}/sys/kernel/hostname r,
  355. @{PROC}/sys/kernel/osrelease r,
  356. @{PROC}/sys/kernel/ostype r,
  357. @{PROC}/sys/kernel/pid_max r,
  358. @{PROC}/sys/kernel/yama/ptrace_scope r,
  359. @{PROC}/sys/kernel/shmmax r,
  360. @{PROC}/sys/fs/file-max r,
  361. @{PROC}/sys/fs/inotify/max_* r,
  362. @{PROC}/sys/kernel/pid_max r,
  363. @{PROC}/sys/kernel/random/boot_id r,
  364. @{PROC}/sys/kernel/random/uuid r,
  365. # Allow access to the uuidd daemon (this daemon is a thin wrapper around
  366. # time and getrandom()/{,u}random and, when available, runs under an
  367. # unprivilged, dedicated user).
  368. /run/uuidd/request r,
  369. /sys/devices/virtual/tty/{console,tty*}/active r,
  370. /sys/fs/cgroup/memory/memory.limit_in_bytes r,
  371. /sys/fs/cgroup/memory/snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r,
  372. /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
  373. /sys/module/apparmor/parameters/enabled r,
  374. /{,usr/}lib/ r,
  375.  
  376. # Reads of oom_adj and oom_score_adj are safe
  377. owner @{PROC}/@{pid}/oom_{,score_}adj r,
  378.  
  379. # Note: for now, don't explicitly deny write access so --devmode isn't broken
  380. # but eventually we may conditionally deny this since it allows the process
  381. # to increase the oom heuristic of other processes (make them more likely to
  382. # be killed). Once AppArmor kernel var is available to solve this properly,
  383. # this can safely be allowed since non-root processes won't be able to
  384. # decrease the value and root processes will only be able to with
  385. # 'capability sys_resource,' which we deny be default.
  386. # deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
  387.  
  388. # Eases hardware assignment (doesn't give anything away)
  389. /etc/udev/udev.conf r,
  390. /sys/ r,
  391. /sys/bus/ r,
  392. /sys/class/ r,
  393.  
  394. # this leaks interface names and stats, but not in a way that is traceable
  395. # to the user/device
  396. @{PROC}/net/dev r,
  397. @{PROC}/@{pid}/net/dev r,
  398.  
  399. # Read-only of this snap
  400. /var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r,
  401.  
  402. # Read-only for the install directory
  403. # bind mount used here (see 'parallel installs', above)
  404. @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r,
  405. @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/ r,
  406. @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/** mrklix,
  407.  
  408. # Read-only install directory for other revisions to help with bugs like
  409. # LP: #1616650 and LP: #1655992
  410. @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
  411.  
  412. # Read-only home area for other versions
  413. # bind mount *not* used here (see 'parallel installs', above)
  414. owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/ r,
  415. owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/** mrkix,
  416.  
  417. # Writable home area for this version.
  418. # bind mount *not* used here (see 'parallel installs', above)
  419. owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
  420. owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl,
  421.  
  422. # Read-only system area for other versions
  423. # bind mount used here (see 'parallel installs', above)
  424. /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r,
  425. /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
  426.  
  427. # Writable system area only for this version
  428. # bind mount used here (see 'parallel installs', above)
  429. /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl,
  430. /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl,
  431.  
  432. # The ubuntu-core-launcher creates an app-specific private restricted /tmp
  433. # and will fail to launch the app if something goes wrong. As such, we can
  434. # simply allow full access to /tmp.
  435. /tmp/ r,
  436. /tmp/** mrwlkix,
  437.  
  438. # App-specific access to files and directories in /dev/shm. We allow file
  439. # access in /dev/shm for shm_open() and files in subdirectories for open()
  440. # bind mount *not* used here (see 'parallel installs', above)
  441. /{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix,
  442. # Also allow app-specific access for sem_open()
  443. /{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk,
  444.  
  445. # Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
  446. # bind mount *not* used here (see 'parallel installs', above)
  447. owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/ rw,
  448. owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
  449.  
  450. # Allow apps from the same package to communicate with each other via an
  451. # abstract or anonymous socket
  452. unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**",
  453. unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
  454.  
  455. # Allow apps from the same package to communicate with each other via DBus.
  456. # Note: this does not grant access to the DBus sockets of well known buses
  457. # (will still need to use an appropriate interface for that).
  458. dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
  459. # In addition to the above, dbus-run-session attempts reading these files
  460. # from the snap base runtime.
  461. /usr/share/dbus-1/services/{,*} r,
  462. /usr/share/dbus-1/system-services/{,*} r,
  463. # Allow apps to perform DBus introspection on org.freedesktop.DBus for both
  464. # the system and session buses.
  465. # Note: this does not grant access to the DBus sockets of these buses, but
  466. # we grant it here since it is missing from the dbus abstractions
  467. # (LP: #1866168)
  468. dbus (send)
  469. bus={session,system}
  470. path=/org/freedesktop/DBus
  471. interface=org.freedesktop.DBus.Introspectable
  472. member=Introspect
  473. peer=(label=unconfined),
  474.  
  475. # Allow apps from the same package to signal each other via signals
  476. signal peer=snap.@{SNAP_INSTANCE_NAME}.*,
  477.  
  478. # Allow receiving signals from all snaps (and focus on mediating sending of
  479. # signals)
  480. signal (receive) peer=snap.*,
  481.  
  482. # Allow receiving signals from unconfined (eg, systemd)
  483. signal (receive) peer=unconfined,
  484.  
  485. # for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign'
  486. /{,s}bin/udevadm ixr,
  487. /etc/udev/udev.conf r,
  488. /{,var/}run/udev/tags/snappy-assign/ r,
  489. @{PROC}/cmdline r,
  490. /sys/devices/**/uevent r,
  491.  
  492. # LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above
  493. # requires:
  494. # /run/udev/data/* r,
  495. # but that reveals too much about the system and cannot be granted to apps
  496. # by default at this time.
  497.  
  498. # For convenience, allow apps to see what is in /dev even though cgroups
  499. # will block most access
  500. /dev/ r,
  501. /dev/**/ r,
  502.  
  503. # Allow setting up pseudoterminal via /dev/pts system. This is safe because
  504. # the launcher uses a per-app devpts newinstance.
  505. /dev/ptmx rw,
  506.  
  507. # Do the same with /sys/devices and /sys/class to help people using hw-assign
  508. /sys/devices/ r,
  509. /sys/devices/**/ r,
  510. /sys/class/ r,
  511. /sys/class/**/ r,
  512.  
  513. # Allow all snaps to chroot
  514. capability sys_chroot,
  515. /{,usr/}sbin/chroot ixr,
  516.  
  517. # Lttng tracing is very noisy and should not be allowed by confined apps. Can
  518. # safely deny for the normal case (LP: #1260491). If/when an lttng-trace
  519. # interface is needed, we can rework this.
  520. deny /{dev,run,var/run}/shm/lttng-ust-* rw,
  521.  
  522. # Allow read-access on /home/ for navigating to other parts of the
  523. # filesystem. While this allows enumerating users, this is already allowed
  524. # via /etc/passwd and getent.
  525. @{HOMEDIRS}/ r,
  526.  
  527. # Allow read-access to / for navigating to other parts of the filesystem.
  528. / r,
  529.  
  530. # Snap-specific run directory. Bind mount *not* used here
  531. # (see 'parallel installs', above)
  532. /run/snap.@{SNAP_INSTANCE_NAME}/ rw,
  533. /run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
  534.  
  535.  
  536. # Allow access to the Wayland compositor server socket
  537. owner /run/user/[0-9]*/wayland-[0-9]* rw,
  538.  
  539. # Needed when using QT_QPA_PLATFORM=wayland-egl (MESA dri config)
  540. /etc/drirc r,
  541.  
  542.  
  543. # Description: Allow access to AppStream metadata from the host system
  544.  
  545. # Allow access to AppStream upstream metadata files
  546. /usr/share/metainfo/{,**} r,
  547. /usr/share/appdata/{,**} r,
  548.  
  549. # Allow access to AppStream collection metadata
  550. /usr/share/app-info/** r,
  551. /var/cache/app-info/** r,
  552. /var/lib/app-info/** r,
  553.  
  554. # Apt symlinks the DEP-11 metadata to files in /var/lib/apt/lists
  555. /var/lib/apt/lists/*.yml.gz r,
  556.  
  557.  
  558. # Description: Allow access to PackageKit service which gives
  559. # privileged access to native package management on the system
  560.  
  561. #include <abstractions/dbus-strict>
  562.  
  563. # Allow communication with the main PackageKit end point.
  564. dbus (receive, send)
  565. bus=system
  566. path=/org/freedesktop/PackageKit
  567. interface=org.freedesktop.PackageKit
  568. peer=(label=unconfined),
  569. dbus (receive, send)
  570. bus=system
  571. path=/org/freedesktop/PackageKit
  572. interface=org.freedesktop.PackageKit.Offline
  573. peer=(label=unconfined),
  574. dbus (send)
  575. bus=system
  576. path=/org/freedesktop/PackageKit
  577. interface=org.freedesktop.DBus.Properties
  578. member=Get{,All}
  579. peer=(label=unconfined),
  580. dbus (receive)
  581. bus=system
  582. path=/org/freedesktop/PackageKit
  583. interface=org.freedesktop.DBus.Properties
  584. member=PropertiesChanged
  585. peer=(label=unconfined),
  586. dbus (send)
  587. bus=system
  588. path=/org/freedesktop/PackageKit
  589. interface=org.freedesktop.DBus.Introspectable
  590. member=Introspect
  591. peer=(label=unconfined),
  592.  
  593. # Allow communication with PackageKit transactions. Transactions are
  594. # exported with random object paths that currently take the form
  595. # "/{number}_{hexstring}". If PackageKit (or a reimplementation of
  596. # packagekitd) changes this, then these rules will need to change too.
  597. dbus (receive, send)
  598. bus=system
  599. path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
  600. interface=org.freedesktop.PackageKit.Transaction
  601. peer=(label=unconfined),
  602. dbus (send)
  603. bus=system
  604. path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
  605. interface=org.freedesktop.DBus.Properties
  606. member=Get{,All}
  607. peer=(label=unconfined),
  608. dbus (receive)
  609. bus=system
  610. path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
  611. interface=org.freedesktop.DBus.Properties
  612. member=PropertiesChanged
  613. peer=(label=unconfined),
  614. dbus (send)
  615. bus=system
  616. path=/[0-9]*_[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]
  617. interface=org.freedesktop.DBus.Introspectable
  618. member=Introspect
  619. peer=(label=unconfined),
  620.  
  621.  
  622. # Description: Allow access to password manager services provided by popular
  623. # Desktop Environments. This interface gives access to sensitive information
  624. # available in the user's session.
  625.  
  626. #include <abstractions/dbus-session-strict>
  627.  
  628. # Provide full access to the secret-service API:
  629. # - https://standards.freedesktop.org/secret-service/)
  630. #
  631. # The secret-service allows managing (add/delete/lock/etc) collections and
  632. # (add/delete/etc) items within collections. The API also has the concept of
  633. # aliases for collections which is typically used to access the default
  634. # collection. While it would be possible for an application developer to use a
  635. # snap-specific collection and mediate by object path, application developers
  636. # are meant to instead to treat collections (typically the default collection)
  637. # as a database of key/value attributes each with an associated secret that
  638. # applications may query. Because AppArmor does not mediate member data,
  639. # typical and recommended usage of the API does not allow for application
  640. # isolation. For details, see:
  641. # - https://standards.freedesktop.org/secret-service/ch03.html
  642. #
  643. dbus (receive, send)
  644. bus=session
  645. path=/org/freedesktop/secrets{,/**}
  646. interface=org.freedesktop.DBus.*
  647. peer=(label=unconfined),
  648.  
  649. dbus (receive, send)
  650. bus=session
  651. path=/org/freedesktop/secrets{,/**}
  652. interface=org.freedesktop.Secret.{Collection,Item,Prompt,Service,Session}
  653. peer=(label=unconfined),
  654.  
  655. # KWallet's client API is still in use in KDE/Plasma. It's DBus API relies upon
  656. # member data for access to its 'folders' and 'entries' and it therefore does
  657. # not allow for application isolation via AppArmor. For details, see:
  658. # - https://cgit.kde.org/kdelibs.git/tree/kdeui/util/kwallet.h?h=v4.14.33
  659. #
  660. dbus (receive, send)
  661. bus=session
  662. path=/modules/kwalletd{,5}
  663. interface=org.freedesktop.DBus.*
  664. peer=(label=unconfined),
  665.  
  666. dbus (receive, send)
  667. bus=session
  668. path=/modules/kwalletd{,5}
  669. interface=org.kde.KWallet
  670. peer=(label=unconfined),
  671.  
  672.  
  673. # Description: Allow owning a name on DBus public bus
  674.  
  675. #include <abstractions/dbus-session-strict>
  676.  
  677. # register on DBus
  678. dbus (send)
  679. bus=session
  680. path=/org/freedesktop/DBus
  681. interface=org.freedesktop.DBus
  682. member="{Request,Release}Name"
  683. peer=(name=org.freedesktop.DBus, label=unconfined),
  684.  
  685. dbus (send)
  686. bus=session
  687. path=/org/freedesktop/DBus
  688. interface=org.freedesktop.DBus
  689. member="GetConnectionUnix{ProcessID,User}"
  690. peer=(name=org.freedesktop.DBus, label=unconfined),
  691.  
  692. dbus (send)
  693. bus=session
  694. path=/org/freedesktop/DBus
  695. interface=org.freedesktop.DBus
  696. member="GetConnectionCredentials"
  697. peer=(name=org.freedesktop.DBus, label=unconfined),
  698.  
  699. # bind to a well-known DBus name: io.snapcraft.Store
  700. dbus (bind)
  701. bus=session
  702. name=io.snapcraft.Store,
  703.  
  704. # For KDE applications and some other cases, also support alternation for:
  705. # - using org.kde.foo-PID as the 'well-known' name
  706. # - using org.foo.cmd_<num>_<num> as the 'well-known' name
  707. # Note, snapd does not allow declaring a 'well-known' name that ends with
  708. # '-[0-9]+' or that contains '_'. Parallel installs of DBus services aren't
  709. # supported at this time, but if they were, this could allow a parallel
  710. # install'swell-known name to overlap with the normal install.
  711. dbus (bind)
  712. bus=session
  713. name=io.snapcraft.Store{_,-}[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}{,_[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}},
  714.  
  715. # Allow us to talk to dbus-daemon
  716. dbus (receive)
  717. bus=session
  718. path="/io/snapcraft/Store{,/**}"
  719. peer=(name=org.freedesktop.DBus, label=unconfined),
  720. dbus (send)
  721. bus=session
  722. path="/io/snapcraft/Store{,/**}"
  723. interface=org.freedesktop.DBus.Properties
  724. peer=(name=org.freedesktop.DBus, label=unconfined),
  725.  
  726. # Allow us to introspect org.freedesktop.DBus (needed by pydbus)
  727. dbus (send)
  728. bus=session
  729. interface=org.freedesktop.DBus.Introspectable
  730. member=Introspect
  731. peer=(name=org.freedesktop.DBus, label=unconfined),
  732.  
  733.  
  734. # Description: Allow owning a name on DBus public bus
  735.  
  736. #include <abstractions/dbus-session-strict>
  737.  
  738. # register on DBus
  739. dbus (send)
  740. bus=session
  741. path=/org/freedesktop/DBus
  742. interface=org.freedesktop.DBus
  743. member="{Request,Release}Name"
  744. peer=(name=org.freedesktop.DBus, label=unconfined),
  745.  
  746. dbus (send)
  747. bus=session
  748. path=/org/freedesktop/DBus
  749. interface=org.freedesktop.DBus
  750. member="GetConnectionUnix{ProcessID,User}"
  751. peer=(name=org.freedesktop.DBus, label=unconfined),
  752.  
  753. dbus (send)
  754. bus=session
  755. path=/org/freedesktop/DBus
  756. interface=org.freedesktop.DBus
  757. member="GetConnectionCredentials"
  758. peer=(name=org.freedesktop.DBus, label=unconfined),
  759.  
  760. # bind to a well-known DBus name: org.freedesktop.PackageKit
  761. dbus (bind)
  762. bus=session
  763. name=org.freedesktop.PackageKit,
  764.  
  765. # For KDE applications and some other cases, also support alternation for:
  766. # - using org.kde.foo-PID as the 'well-known' name
  767. # - using org.foo.cmd_<num>_<num> as the 'well-known' name
  768. # Note, snapd does not allow declaring a 'well-known' name that ends with
  769. # '-[0-9]+' or that contains '_'. Parallel installs of DBus services aren't
  770. # supported at this time, but if they were, this could allow a parallel
  771. # install'swell-known name to overlap with the normal install.
  772. dbus (bind)
  773. bus=session
  774. name=org.freedesktop.PackageKit{_,-}[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}{,_[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}},
  775.  
  776. # Allow us to talk to dbus-daemon
  777. dbus (receive)
  778. bus=session
  779. path="/org/freedesktop/PackageKit{,/**}"
  780. peer=(name=org.freedesktop.DBus, label=unconfined),
  781. dbus (send)
  782. bus=session
  783. path="/org/freedesktop/PackageKit{,/**}"
  784. interface=org.freedesktop.DBus.Properties
  785. peer=(name=org.freedesktop.DBus, label=unconfined),
  786.  
  787. # Allow us to introspect org.freedesktop.DBus (needed by pydbus)
  788. dbus (send)
  789. bus=session
  790. interface=org.freedesktop.DBus.Introspectable
  791. member=Introspect
  792. peer=(name=org.freedesktop.DBus, label=unconfined),
  793.  
  794.  
  795. # Description: Allow using fwupd service. This gives # privileged access to the
  796. # fwupd service.
  797.  
  798. #Can access the network
  799. #include <abstractions/nameservice>
  800. #include <abstractions/ssl_certs>
  801. /run/systemd/resolve/stub-resolv.conf r,
  802.  
  803. # DBus accesses
  804. #include <abstractions/dbus-strict>
  805.  
  806. # systemd-resolved (not yet included in nameservice abstraction)
  807. #
  808. # Allow access to the safe members of the systemd-resolved D-Bus API:
  809. #
  810. # https://www.freedesktop.org/wiki/Software/systemd/resolved/
  811. #
  812. # This API may be used directly over the D-Bus system bus or it may be used
  813. # indirectly via the nss-resolve plugin:
  814. #
  815. # https://www.freedesktop.org/software/systemd/man/nss-resolve.html
  816. #
  817. dbus send
  818. bus=system
  819. path="/org/freedesktop/resolve1"
  820. interface="org.freedesktop.resolve1.Manager"
  821. member="Resolve{Address,Hostname,Record,Service}"
  822. peer=(name="org.freedesktop.resolve1"),
  823.  
  824. # Allow access to fwupd service
  825. dbus (receive, send)
  826. bus=system
  827. path=/
  828. interface=org.freedesktop.fwupd
  829. peer=(label=unconfined),
  830.  
  831. dbus (receive, send)
  832. bus=system
  833. path=/
  834. interface=org.freedesktop.DBus.Properties
  835. peer=(label=unconfined),
  836.  
  837. # Allow clients to introspect the service on non-classic (due to the path,
  838. # allowing on classic would reveal too much for unconfined)
  839. dbus (send)
  840. bus=system
  841. path=/
  842. interface=org.freedesktop.DBus.Introspectable
  843. member=Introspect
  844. peer=(label=unconfined),
  845.  
  846.  
  847. # Description: Can access basic graphical desktop resources. To be used with
  848. # other interfaces (eg, wayland).
  849.  
  850. #include <abstractions/dbus-strict>
  851. #include <abstractions/dbus-session-strict>
  852.  
  853. # Allow finding the DBus session bus id (eg, via dbus_bus_get_id())
  854. dbus (send)
  855. bus=session
  856. path=/org/freedesktop/DBus
  857. interface=org.freedesktop.DBus
  858. member=GetId
  859. peer=(name=org.freedesktop.DBus, label=unconfined),
  860.  
  861. #include <abstractions/fonts>
  862. owner @{HOME}/.local/share/fonts/{,**} r,
  863. /var/cache/fontconfig/ r,
  864. /var/cache/fontconfig/** mr,
  865. # some applications are known to mmap fonts
  866. /usr/{,local/}share/fonts/** m,
  867.  
  868. # subset of gnome abstraction
  869. /etc/gtk-3.0/settings.ini r,
  870. owner @{HOME}/.config/gtk-3.0/settings.ini r,
  871. # Note: this leaks directory names that wouldn't otherwise be known to the snap
  872. owner @{HOME}/.config/gtk-3.0/bookmarks r,
  873.  
  874. /usr/share/icons/ r,
  875. /usr/share/icons/** r,
  876. /usr/share/icons/*/index.theme rk,
  877. /usr/share/pixmaps/ r,
  878. /usr/share/pixmaps/** r,
  879. /usr/share/unity/icons/** r,
  880. /usr/share/thumbnailer/icons/** r,
  881. /usr/share/themes/** r,
  882.  
  883. # The snapcraft desktop part may look for schema files in various locations, so
  884. # allow reading system installed schemas.
  885. /usr/share/glib*/schemas/{,*} r,
  886. /usr/share/gnome/glib*/schemas/{,*} r,
  887. /usr/share/ubuntu/glib*/schemas/{,*} r,
  888.  
  889. # subset of freedesktop.org
  890. owner @{HOME}/.local/share/mime/** r,
  891. owner @{HOME}/.config/user-dirs.* r,
  892.  
  893. /etc/xdg/user-dirs.conf r,
  894. /etc/xdg/user-dirs.defaults r,
  895.  
  896. # gmenu
  897. dbus (send)
  898. bus=session
  899. interface=org.gtk.Actions
  900. member=Changed
  901. peer=(name=org.freedesktop.DBus, label=unconfined),
  902.  
  903. # notifications
  904. dbus (send)
  905. bus=session
  906. path=/org/freedesktop/Notifications
  907. interface=org.freedesktop.Notifications
  908. member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
  909. peer=(label=unconfined),
  910.  
  911. dbus (receive)
  912. bus=session
  913. path=/org/freedesktop/Notifications
  914. interface=org.freedesktop.Notifications
  915. member={ActionInvoked,NotificationClosed,NotificationReplied}
  916. peer=(label=unconfined),
  917.  
  918. # DesktopAppInfo Launched
  919. dbus (send)
  920. bus=session
  921. path=/org/gtk/gio/DesktopAppInfo
  922. interface=org.gtk.gio.DesktopAppInfo
  923. member=Launched
  924. peer=(label=unconfined),
  925.  
  926. # Allow requesting interest in receiving media key events. This tells Gnome
  927. # settings that our application should be notified when key events we are
  928. # interested in are pressed, and allows us to receive those events.
  929. dbus (receive, send)
  930. bus=session
  931. interface=org.gnome.SettingsDaemon.MediaKeys
  932. path=/org/gnome/SettingsDaemon/MediaKeys
  933. peer=(label=unconfined),
  934. dbus (send)
  935. bus=session
  936. interface=org.freedesktop.DBus.Properties
  937. path=/org/gnome/SettingsDaemon/MediaKeys
  938. member="Get{,All}"
  939. peer=(label=unconfined),
  940.  
  941. # Allow use of snapd's internal 'xdg-open'
  942. /usr/bin/xdg-open ixr,
  943. /usr/share/applications/{,*} r,
  944. dbus (send)
  945. bus=session
  946. path=/
  947. interface=com.canonical.SafeLauncher
  948. member=OpenURL
  949. peer=(label=unconfined),
  950. # ... and this allows access to the new xdg-open service which
  951. # is now part of snapd itself.
  952. dbus (send)
  953. bus=session
  954. path=/io/snapcraft/Launcher
  955. interface=io.snapcraft.Launcher
  956. member={OpenURL,OpenFile}
  957. peer=(label=unconfined),
  958.  
  959. # Allow checking status, activating and locking the screensaver
  960. # gnome/kde/freedesktop.org
  961. dbus (send)
  962. bus=session
  963. path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
  964. interface="org.{freedesktop,gnome}.ScreenSaver"
  965. member="{GetActive,GetActiveTime,Lock,SetActive}"
  966. peer=(label=unconfined),
  967.  
  968. dbus (receive)
  969. bus=session
  970. path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
  971. interface="org.{freedesktop,gnome}.ScreenSaver"
  972. member=ActiveChanged
  973. peer=(label=unconfined),
  974.  
  975. # Allow unconfined to introspect us
  976. dbus (receive)
  977. bus=session
  978. interface=org.freedesktop.DBus.Introspectable
  979. member=Introspect
  980. peer=(label=unconfined),
  981.  
  982. # Allow use of snapd's internal 'xdg-settings'
  983. /usr/bin/xdg-settings ixr,
  984. dbus (send)
  985. bus=session
  986. path=/io/snapcraft/Settings
  987. interface=io.snapcraft.Settings
  988. member={Check,Get,Set}
  989. peer=(label=unconfined),
  990.  
  991. ## Allow access to xdg-document-portal file system. Access control is
  992. ## handled by bind mounting a snap-specific sub-tree to this location.
  993. owner /run/user/[0-9]*/doc/ r,
  994. owner /run/user/[0-9]*/doc/** rw,
  995.  
  996. # Allow access to xdg-desktop-portal and xdg-document-portal
  997. dbus (receive, send)
  998. bus=session
  999. interface=org.freedesktop.portal.*
  1000. path=/org/freedesktop/portal/{desktop,documents}{,/**}
  1001. peer=(label=unconfined),
  1002.  
  1003. dbus (receive, send)
  1004. bus=session
  1005. interface=org.freedesktop.DBus.Properties
  1006. path=/org/freedesktop/portal/{desktop,documents}{,/**}
  1007. peer=(label=unconfined),
  1008.  
  1009. # These accesses are noisy and applications can't do anything with the found
  1010. # icon files, so explicitly deny to silence the denials
  1011. deny /var/lib/snapd/desktop/icons/ r,
  1012.  
  1013.  
  1014. # Description: Can access common desktop legacy methods. This gives privileged
  1015. # access to the user's input.
  1016.  
  1017. # accessibility (a11y)
  1018. #include <abstractions/dbus-session-strict>
  1019. dbus (send)
  1020. bus=session
  1021. path=/org/a11y/bus
  1022. interface=org.a11y.Bus
  1023. member=GetAddress
  1024. peer=(label=unconfined),
  1025.  
  1026. #include <abstractions/dbus-accessibility-strict>
  1027.  
  1028. # Allow the accessibility services in the user session to send us any events
  1029. dbus (receive)
  1030. bus=accessibility
  1031. peer=(label=unconfined),
  1032.  
  1033. # Allow querying for capabilities and registering
  1034. dbus (send)
  1035. bus=accessibility
  1036. path="/org/a11y/atspi/accessible/root"
  1037. interface="org.a11y.atspi.Socket"
  1038. member="Embed"
  1039. peer=(name=org.a11y.atspi.Registry, label=unconfined),
  1040. dbus (send)
  1041. bus=accessibility
  1042. path="/org/a11y/atspi/registry"
  1043. interface="org.a11y.atspi.Registry"
  1044. member="GetRegisteredEvents"
  1045. peer=(name=org.a11y.atspi.Registry, label=unconfined),
  1046. dbus (send)
  1047. bus=accessibility
  1048. path="/org/a11y/atspi/registry/deviceeventcontroller"
  1049. interface="org.a11y.atspi.DeviceEventController"
  1050. member="Get{DeviceEvent,Keystroke}Listeners"
  1051. peer=(name=org.a11y.atspi.Registry, label=unconfined),
  1052. dbus (send)
  1053. bus=accessibility
  1054. path="/org/a11y/atspi/registry/deviceeventcontroller"
  1055. interface="org.a11y.atspi.DeviceEventController"
  1056. member="NotifyListenersSync"
  1057. peer=(name=org.a11y.atspi.Registry, label=unconfined),
  1058.  
  1059. # org.a11y.atspi is not designed for application isolation and these rules
  1060. # can be used to send change events for other processes.
  1061. dbus (send)
  1062. bus=accessibility
  1063. path="/org/a11y/atspi/accessible/root"
  1064. interface="org.a11y.atspi.Event.Object"
  1065. member="ChildrenChanged"
  1066. peer=(name=org.freedesktop.DBus, label=unconfined),
  1067. dbus (send)
  1068. bus=accessibility
  1069. path="/org/a11y/atspi/accessible/root"
  1070. interface="org.a11y.atspi.Accessible"
  1071. member="Get*"
  1072. peer=(label=unconfined),
  1073. dbus (send)
  1074. bus=accessibility
  1075. path="/org/a11y/atspi/accessible/[0-9]*"
  1076. interface="org.a11y.atspi.Event.Object"
  1077. member="{ChildrenChanged,PropertyChange,StateChanged,TextCaretMoved}"
  1078. peer=(name=org.freedesktop.DBus, label=unconfined),
  1079. dbus (send)
  1080. bus=accessibility
  1081. path="/org/a11y/atspi/accessible/[0-9]*"
  1082. interface="org.freedesktop.DBus.Properties"
  1083. member="Get{,All}"
  1084. peer=(label=unconfined),
  1085.  
  1086. dbus (send)
  1087. bus=accessibility
  1088. path="/org/a11y/atspi/cache"
  1089. interface="org.a11y.atspi.Cache"
  1090. member="{Add,Remove}Accessible"
  1091. peer=(name=org.freedesktop.DBus, label=unconfined),
  1092.  
  1093.  
  1094. # ibus
  1095. # subset of ibus abstraction
  1096. /usr/lib/@{multiarch}/gtk-2.0/[0-9]*/immodules/im-ibus.so mr,
  1097. owner @{HOME}/.config/ibus/ r,
  1098. owner @{HOME}/.config/ibus/bus/ r,
  1099. owner @{HOME}/.config/ibus/bus/* r,
  1100.  
  1101. # allow communicating with ibus-daemon (this allows sniffing key events)
  1102. unix (connect, receive, send)
  1103. type=stream
  1104. peer=(addr="@/tmp/ibus/dbus-*"),
  1105.  
  1106. # abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache)
  1107. # This should use this, but due to LP: #1856738 we cannot
  1108. #unix (connect, receive, send)
  1109. # type=stream
  1110. # peer=(addr="@@{HOME}/.cache/ibus/dbus-*"),
  1111. unix (connect, receive, send)
  1112. type=stream
  1113. peer=(addr="@/home/*/.cache/ibus/dbus-*"),
  1114.  
  1115.  
  1116. # mozc
  1117. # allow communicating with mozc server
  1118. unix (connect, receive, send)
  1119. type=stream
  1120. peer=(addr="@tmp/.mozc.*"),
  1121.  
  1122.  
  1123. # fcitx
  1124. # allow communicating with fcitx dbus service
  1125. dbus send
  1126. bus=fcitx
  1127. path=/org/freedesktop/DBus
  1128. interface=org.freedesktop.DBus
  1129. member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
  1130. peer=(name=org.freedesktop.DBus),
  1131.  
  1132. owner @{HOME}/.config/fcitx/dbus/* r,
  1133.  
  1134. # allow creating an input context
  1135. dbus send
  1136. bus={fcitx,session}
  1137. path=/inputmethod
  1138. interface=org.fcitx.Fcitx.InputMethod
  1139. member=CreateIC*
  1140. peer=(label=unconfined),
  1141.  
  1142. # allow setting up and tearing down the input context
  1143. dbus send
  1144. bus={fcitx,session}
  1145. path=/inputcontext_[0-9]*
  1146. interface=org.fcitx.Fcitx.InputContext
  1147. member="{Close,Destroy,Enable}IC"
  1148. peer=(label=unconfined),
  1149.  
  1150. dbus send
  1151. bus={fcitx,session}
  1152. path=/inputcontext_[0-9]*
  1153. interface=org.fcitx.Fcitx.InputContext
  1154. member=Reset
  1155. peer=(label=unconfined),
  1156.  
  1157. # allow service to send us signals
  1158. dbus receive
  1159. bus=fcitx
  1160. peer=(label=unconfined),
  1161.  
  1162. dbus receive
  1163. bus=session
  1164. interface=org.fcitx.Fcitx.*
  1165. peer=(label=unconfined),
  1166.  
  1167. # use the input context
  1168. dbus send
  1169. bus={fcitx,session}
  1170. path=/inputcontext_[0-9]*
  1171. interface=org.fcitx.Fcitx.InputContext
  1172. member="Focus{In,Out}"
  1173. peer=(label=unconfined),
  1174.  
  1175. dbus send
  1176. bus={fcitx,session}
  1177. path=/inputcontext_[0-9]*
  1178. interface=org.fcitx.Fcitx.InputContext
  1179. member="{CommitPreedit,Set*}"
  1180. peer=(label=unconfined),
  1181.  
  1182. # this is an information leak and allows key and mouse sniffing. If the input
  1183. # context path were tied to the process' security label, this would not be an
  1184. # issue.
  1185. dbus send
  1186. bus={fcitx,session}
  1187. path=/inputcontext_[0-9]*
  1188. interface=org.fcitx.Fcitx.InputContext
  1189. member="{MouseEvent,ProcessKeyEvent}"
  1190. peer=(label=unconfined),
  1191.  
  1192. # this method does not exist with the sunpinyin backend (at least), so allow
  1193. # it for other input methods. This may consitute an information leak (which,
  1194. # again, could be avoided if the path were tied to the process' security
  1195. # label).
  1196. dbus send
  1197. bus={fcitx,session}
  1198. path=/inputcontext_[0-9]*
  1199. interface=org.freedesktop.DBus.Properties
  1200. member=GetAll
  1201. peer=(label=unconfined),
  1202.  
  1203. # gtk2/gvfs gtk_show_uri()
  1204. dbus (send)
  1205. bus=session
  1206. path=/org/gtk/vfs/mounttracker
  1207. interface=org.gtk.vfs.MountTracker
  1208. member=ListMountableInfo,
  1209. dbus (send)
  1210. bus=session
  1211. path=/org/gtk/vfs/mounttracker
  1212. interface=org.gtk.vfs.MountTracker
  1213. member=LookupMount,
  1214.  
  1215. # This leaks the names of snaps with desktop files
  1216. /var/lib/snapd/desktop/applications/ r,
  1217. /var/lib/snapd/desktop/applications/mimeinfo.cache r,
  1218. # Support BAMF_DESKTOP_FILE_HINT by allowing reading our desktop files
  1219. # parallel-installs: this leaks read access to desktop files owned by keyed
  1220. # instances of @{SNAP_NAME} to @{SNAP_NAME} snap
  1221. /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_NAME}_*.desktop r,
  1222.  
  1223.  
  1224. # Description: Can access global gsettings of the user's session. Restricted
  1225. # because this gives privileged access to sensitive information stored in
  1226. # gsettings and allows adjusting settings of other applications.
  1227.  
  1228. #include <abstractions/dbus-session-strict>
  1229.  
  1230. #include <abstractions/dconf>
  1231. owner /{,var/}run/user/*/dconf/user w,
  1232. owner @{HOME}/.config/dconf/user w,
  1233. dbus (receive, send)
  1234. bus=session
  1235. interface="ca.desrt.dconf.Writer"
  1236. peer=(label=unconfined),
  1237.  
  1238.  
  1239. # Description: Can access specific system files or directories.
  1240. # This is restricted because it gives file access to arbitrary locations.
  1241. "/var/lib/snapd/hostfs/usr/share/applications{,/,/**}" rk,
  1242.  
  1243.  
  1244. # Description: Can access the X server. Restricted because X does not prevent
  1245. # eavesdropping or apps interfering with one another.
  1246.  
  1247. # The X abstraction doesn't check the peer label, but in this case that's
  1248. # ok because x11ConnectedSlotAppArmor will limit which clients can connect
  1249. # to the slot implementation.
  1250. #include <abstractions/X>
  1251. #include <abstractions/fonts>
  1252. owner @{HOME}/.local/share/fonts/{,**} r,
  1253. /var/cache/fontconfig/ r,
  1254. /var/cache/fontconfig/** mr,
  1255.  
  1256. # Allow access to the user specific copy of the xauth file specified
  1257. # in the XAUTHORITY environment variable, that "snap run" creates on
  1258. # startup.
  1259. owner /run/user/[0-9]*/.Xauthority r,
  1260.  
  1261. # Allow reading an Xwayland Xauth file
  1262. # (see https://gitlab.gnome.org/GNOME/mutter/merge_requests/626)
  1263. owner /run/user/[0-9]*/.mutter-Xwaylandauth.* r,
  1264. owner /run/user/[0-9]*/mutter/Xauthority r,
  1265.  
  1266.  
  1267. # Needed by QtSystems on X to detect mouse and keyboard. Note, the 'netlink
  1268. # raw' rule is not finely mediated by apparmor so we mediate with seccomp arg
  1269. # filtering.
  1270. network netlink raw,
  1271. /run/udev/data/c13:[0-9]* r,
  1272. /run/udev/data/+input:* r,
  1273.  
  1274.  
  1275. # Description: Can access the network as a client.
  1276. #include <abstractions/nameservice>
  1277. /run/systemd/resolve/stub-resolv.conf rk,
  1278. /etc/mdns.allow r, # not yet include in mdns abstraction
  1279.  
  1280. # systemd-resolved (not yet included in nameservice abstraction)
  1281. #
  1282. # Allow access to the safe members of the systemd-resolved D-Bus API:
  1283. #
  1284. # https://www.freedesktop.org/wiki/Software/systemd/resolved/
  1285. #
  1286. # This API may be used directly over the D-Bus system bus or it may be used
  1287. # indirectly via the nss-resolve plugin:
  1288. #
  1289. # https://www.freedesktop.org/software/systemd/man/nss-resolve.html
  1290. #
  1291. #include <abstractions/dbus-strict>
  1292. dbus send
  1293. bus=system
  1294. path="/org/freedesktop/resolve1"
  1295. interface="org.freedesktop.resolve1.Manager"
  1296. member="Resolve{Address,Hostname,Record,Service}"
  1297. peer=(name="org.freedesktop.resolve1"),
  1298.  
  1299. # libnss-systemd (D-Bus portion from nameservice abstraction)
  1300. # Also allow lookups for systemd-exec's DynamicUsers via D-Bus
  1301. # https://www.freedesktop.org/software/systemd/man/systemd.exec.html
  1302. dbus send
  1303. bus=system
  1304. path="/org/freedesktop/systemd1"
  1305. interface="org.freedesktop.systemd1.Manager"
  1306. member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
  1307. peer=(name="org.freedesktop.systemd1"),
  1308.  
  1309. #include <abstractions/ssl_certs>
  1310.  
  1311. @{PROC}/sys/net/core/somaxconn r,
  1312. @{PROC}/sys/net/ipv4/tcp_fastopen r,
  1313.  
  1314. # Allow using netcat as client
  1315. /{,usr/}bin/nc{,.openbsd} ixr,
  1316.  
  1317.  
  1318. # Description: Can manage snaps via snapd.
  1319.  
  1320. /run/snapd.socket rw,
  1321.  
  1322.  
  1323. # Description: Can query UPower for power devices, history and statistics.
  1324.  
  1325. #include <abstractions/dbus-strict>
  1326.  
  1327. # Find all devices monitored by UPower
  1328. dbus (send)
  1329. bus=system
  1330. path=/org/freedesktop/UPower
  1331. interface=org.freedesktop.UPower
  1332. member=EnumerateDevices
  1333. peer=(label=unconfined),
  1334.  
  1335. # Read all properties from UPower and devices
  1336. # do not use peer=(label=unconfined) here since this is DBus activated
  1337. dbus (send)
  1338. bus=system
  1339. path=/org/freedesktop/UPower{,/Wakeups,/devices/**}
  1340. interface=org.freedesktop.DBus.Properties
  1341. member=Get{,All},
  1342.  
  1343. dbus (send)
  1344. bus=system
  1345. path=/org/freedesktop/UPower
  1346. interface=org.freedesktop.UPower
  1347. member=GetCriticalAction
  1348. peer=(label=unconfined),
  1349.  
  1350. dbus (send)
  1351. bus=system
  1352. path=/org/freedesktop/UPower
  1353. interface=org.freedesktop.UPower
  1354. member=GetDisplayDevice
  1355. peer=(label=unconfined),
  1356.  
  1357. dbus (send)
  1358. bus=system
  1359. path=/org/freedesktop/UPower/devices/**
  1360. interface=org.freedesktop.UPower.Device
  1361. member=GetHistory
  1362. peer=(label=unconfined),
  1363.  
  1364. # Receive property changed events
  1365. dbus (receive)
  1366. bus=system
  1367. path=/org/freedesktop/UPower{,/devices/**}
  1368. interface=org.freedesktop.DBus.Properties
  1369. member=PropertiesChanged
  1370. peer=(label=unconfined),
  1371.  
  1372. # Allow clients to introspect the service
  1373. # do not use peer=(label=unconfined) here since this is DBus activated
  1374. dbus (send)
  1375. bus=system
  1376. interface=org.freedesktop.DBus.Introspectable
  1377. path=/org/freedesktop/UPower
  1378. member=Introspect,
  1379.  
  1380.  
  1381. # Description: Can query system status information. This is restricted because
  1382. # it gives privileged read access to all processes on the system and should
  1383. # only be used with trusted apps.
  1384.  
  1385. # Needed by 'ps'
  1386. @{PROC}/tty/drivers r,
  1387.  
  1388. # This ptrace is an information leak. Intentionlly omit 'ptrace (trace)' here
  1389. # since since ps doesn't actually need to trace other processes. Note this
  1390. # allows a number of accesses (assuming the associated /proc file is allowed),
  1391. # such as various memory address locations and esp/eip via /proc/*/stat,
  1392. # /proc/*/mem, /proc/*/personality, /proc/*/stack, /proc/*/syscall,
  1393. # /proc/*/timerslack_ns and /proc/*/wchan (see man proc).
  1394. #
  1395. # Some files like /proc/kallsyms (but anything using %pK format specifier) need
  1396. # 'capability syslog' when /proc/sys/kernel/kptr_restrict=1, but we
  1397. # intentionally do not allow since it could be used to defeat KASLR.
  1398. ptrace (read),
  1399.  
  1400. # Other miscellaneous accesses for observing the system
  1401. @{PROC}/locks r,
  1402. @{PROC}/modules r,
  1403. @{PROC}/stat r,
  1404. @{PROC}/vmstat r,
  1405. @{PROC}/diskstats r,
  1406. @{PROC}/kallsyms r,
  1407. @{PROC}/partitions r,
  1408. @{PROC}/sys/kernel/panic r,
  1409. @{PROC}/sys/kernel/panic_on_oops r,
  1410. @{PROC}/sys/vm/panic_on_oom r,
  1411.  
  1412. # These are not process-specific (/proc/*/... and /proc/*/task/*/...)
  1413. @{PROC}/*/{,task/,task/*/} r,
  1414. @{PROC}/*/{,task/*/}auxv r,
  1415. @{PROC}/*/{,task/*/}cgroup r,
  1416. @{PROC}/*/{,task/*/}cmdline r,
  1417. @{PROC}/*/{,task/*/}comm r,
  1418. @{PROC}/*/{,task/*/}exe r,
  1419. @{PROC}/*/{,task/*/}fdinfo/* r,
  1420. @{PROC}/*/{,task/*/}stat r,
  1421. @{PROC}/*/{,task/*/}statm r,
  1422. @{PROC}/*/{,task/*/}status r,
  1423. @{PROC}/*/{,task/*/}wchan r,
  1424.  
  1425. # Allow discovering the os-release of the host
  1426. /var/lib/snapd/hostfs/etc/os-release rk,
  1427. /var/lib/snapd/hostfs/usr/lib/os-release rk,
  1428.  
  1429. # Allow discovering system-wide CFS Bandwidth Control information
  1430. # https://www.kernel.org/doc/html/latest/scheduler/sched-bwc.html
  1431. /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us r,
  1432. /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
  1433. /sys/fs/cgroup/cpu,cpuacct/cpu.shares r,
  1434. /sys/fs/cgroup/cpu,cpuacct/cpu.stat r,
  1435.  
  1436. #include <abstractions/dbus-strict>
  1437.  
  1438. # do not use peer=(label=unconfined) here since this is DBus activated
  1439. dbus (send)
  1440. bus=system
  1441. path=/org/freedesktop/hostname1
  1442. interface=org.freedesktop.DBus.Properties
  1443. member=Get{,All},
  1444.  
  1445. # Allow clients to introspect hostname1
  1446. # do not use peer=(label=unconfined) here since this is DBus activated
  1447. dbus (send)
  1448. bus=system
  1449. path=/org/freedesktop/hostname1
  1450. interface=org.freedesktop.DBus.Introspectable
  1451. member=Introspect,
  1452.  
  1453. # Allow clients to enumerate DBus connection names on common buses
  1454. dbus (send)
  1455. bus={session,system}
  1456. path=/org/freedesktop/DBus
  1457. interface=org.freedesktop.DBus
  1458. member=ListNames
  1459. peer=(label=unconfined),
  1460.  
  1461. # Allow clients to obtain the DBus machine ID on common buses. We do not
  1462. # mediate the path since any peer can be used.
  1463. dbus (send)
  1464. bus={session,system}
  1465. interface=org.freedesktop.DBus.Peer
  1466. member=GetMachineId
  1467. peer=(label=unconfined),
  1468.  
  1469.  
  1470. # In addition to the bind mount, add any AppArmor rules so that
  1471. # snaps may directly access the slot implementation's files
  1472. # read-only.
  1473. /snap/gnome-3-34-1804/24/** mrkix,
  1474.  
  1475.  
  1476. # In addition to the bind mount, add any AppArmor rules so that
  1477. # snaps may directly access the slot implementation's files
  1478. # read-only.
  1479. /snap/gtk-common-themes/1474/share/icons/Adwaita/** mrkix,
  1480. /snap/gtk-common-themes/1474/share/icons/hicolor/** mrkix,
  1481. /snap/gtk-common-themes/1474/share/icons/HighContrast/** mrkix,
  1482. /snap/gtk-common-themes/1474/share/icons/Humanity/** mrkix,
  1483. /snap/gtk-common-themes/1474/share/icons/Humanity-Dark/** mrkix,
  1484. /snap/gtk-common-themes/1474/share/icons/ubuntu-mono-dark/** mrkix,
  1485. /snap/gtk-common-themes/1474/share/icons/ubuntu-mono-light/** mrkix,
  1486. /snap/gtk-common-themes/1474/share/icons/DMZ-Black/** mrkix,
  1487. /snap/gtk-common-themes/1474/share/icons/DMZ-White/** mrkix,
  1488. /snap/gtk-common-themes/1474/share/icons/communitheme/** mrkix,
  1489. /snap/gtk-common-themes/1474/share/icons/Suru/** mrkix,
  1490. /snap/gtk-common-themes/1474/share/icons/Yaru/** mrkix,
  1491. /snap/gtk-common-themes/1474/share/icons/elementary/** mrkix,
  1492. /snap/gtk-common-themes/1474/share/icons/Ambiant-MATE/** mrkix,
  1493. /snap/gtk-common-themes/1474/share/icons/Radiant-MATE/** mrkix,
  1494. /snap/gtk-common-themes/1474/share/icons/Papirus-Adapta-Maia/** mrkix,
  1495. /snap/gtk-common-themes/1474/share/icons/Papirus-Adapta-Nokto-Maia/** mrkix,
  1496. /snap/gtk-common-themes/1474/share/icons/Papirus-Dark-Maia/** mrkix,
  1497. /snap/gtk-common-themes/1474/share/icons/Papirus-Light-Maia/** mrkix,
  1498. /snap/gtk-common-themes/1474/share/icons/Papirus-Maia/** mrkix,
  1499. /snap/gtk-common-themes/1474/share/icons/breeze_cursors/** mrkix,
  1500. /snap/gtk-common-themes/1474/share/icons/Breeze_Snow/** mrkix,
  1501.  
  1502.  
  1503. # In addition to the bind mount, add any AppArmor rules so that
  1504. # snaps may directly access the slot implementation's files
  1505. # read-only.
  1506. /snap/gtk-common-themes/1474/share/sounds/communitheme/** mrkix,
  1507. /snap/gtk-common-themes/1474/share/sounds/Yaru/** mrkix,
  1508.  
  1509.  
  1510. # In addition to the bind mount, add any AppArmor rules so that
  1511. # snaps may directly access the slot implementation's files
  1512. # read-only.
  1513. /snap/gtk-common-themes/1474/share/themes/Adwaita/** mrkix,
  1514. /snap/gtk-common-themes/1474/share/themes/Adwaita-dark/** mrkix,
  1515. /snap/gtk-common-themes/1474/share/themes/HighContrast/** mrkix,
  1516. /snap/gtk-common-themes/1474/share/themes/Ambiance/** mrkix,
  1517. /snap/gtk-common-themes/1474/share/themes/Radiance/** mrkix,
  1518. /snap/gtk-common-themes/1474/share/themes/Arc/** mrkix,
  1519. /snap/gtk-common-themes/1474/share/themes/Arc-Dark/** mrkix,
  1520. /snap/gtk-common-themes/1474/share/themes/Arc-Darker/** mrkix,
  1521. /snap/gtk-common-themes/1474/share/themes/Breeze/** mrkix,
  1522. /snap/gtk-common-themes/1474/share/themes/Breeze-Dark/** mrkix,
  1523. /snap/gtk-common-themes/1474/share/themes/Communitheme/** mrkix,
  1524. /snap/gtk-common-themes/1474/share/themes/Communitheme-dark/** mrkix,
  1525. /snap/gtk-common-themes/1474/share/themes/Communitheme-light/** mrkix,
  1526. /snap/gtk-common-themes/1474/share/themes/Yaru/** mrkix,
  1527. /snap/gtk-common-themes/1474/share/themes/Yaru-dark/** mrkix,
  1528. /snap/gtk-common-themes/1474/share/themes/Yaru-light/** mrkix,
  1529. /snap/gtk-common-themes/1474/share/themes/elementary/** mrkix,
  1530. /snap/gtk-common-themes/1474/share/themes/Ambiant-MATE/** mrkix,
  1531. /snap/gtk-common-themes/1474/share/themes/Ambiant-MATE-Dark/** mrkix,
  1532. /snap/gtk-common-themes/1474/share/themes/Radiant-MATE/** mrkix,
  1533. /snap/gtk-common-themes/1474/share/themes/Matcha-aliz/** mrkix,
  1534. /snap/gtk-common-themes/1474/share/themes/Matcha-azul/** mrkix,
  1535. /snap/gtk-common-themes/1474/share/themes/Matcha-dark-aliz/** mrkix,
  1536. /snap/gtk-common-themes/1474/share/themes/Matcha-dark-azul/** mrkix,
  1537. /snap/gtk-common-themes/1474/share/themes/Matcha-dark-sea/** mrkix,
  1538. /snap/gtk-common-themes/1474/share/themes/Matcha-sea/** mrkix,
  1539.  
  1540.  
  1541. # allow unconfined clients to introspect us on classic
  1542. dbus (receive)
  1543. bus=session
  1544. interface=org.freedesktop.DBus.Introspectable
  1545. member=Introspect
  1546. peer=(label=unconfined),
  1547.  
  1548. # allow us to respond to unconfined clients via "io.snapcraft.Store{,.*}"
  1549. # on classic (send should be handled via another snappy interface).
  1550. dbus (receive)
  1551. bus=session
  1552. interface="io.snapcraft.Store{,.*}"
  1553. peer=(label=unconfined),
  1554.  
  1555. # allow us to respond to unconfined clients via "/io/snapcraft/Store{,/**}" (eg,
  1556. # org.freedesktop.*, org.gtk.Application, etc) on classic (send should be
  1557. # handled via another snappy interface).
  1558. dbus (receive)
  1559. bus=session
  1560. path="/io/snapcraft/Store{,/**}"
  1561. peer=(label=unconfined),
  1562.  
  1563.  
  1564. # allow unconfined clients to introspect us on classic
  1565. dbus (receive)
  1566. bus=session
  1567. interface=org.freedesktop.DBus.Introspectable
  1568. member=Introspect
  1569. peer=(label=unconfined),
  1570.  
  1571. # allow us to respond to unconfined clients via "org.freedesktop.PackageKit{,.*}"
  1572. # on classic (send should be handled via another snappy interface).
  1573. dbus (receive)
  1574. bus=session
  1575. interface="org.freedesktop.PackageKit{,.*}"
  1576. peer=(label=unconfined),
  1577.  
  1578. # allow us to respond to unconfined clients via "/org/freedesktop/PackageKit{,/**}" (eg,
  1579. # org.freedesktop.*, org.gtk.Application, etc) on classic (send should be
  1580. # handled via another snappy interface).
  1581. dbus (receive)
  1582. bus=session
  1583. path="/org/freedesktop/PackageKit{,/**}"
  1584. peer=(label=unconfined),
  1585.  
  1586. # Layout path: /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0
  1587. /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0{,/**} mrwklix,
  1588. # Layout path: /usr/share/applications
  1589. /usr/share/applications{,/**} mrwklix,
  1590. # Layout path: /usr/share/xml/iso-codes
  1591. /usr/share/xml/iso-codes{,/**} mrwklix,
  1592. # While commands like 'ps', 'ip netns identify <pid>', 'ip netns pids foo', etc
  1593. # trigger a 'ptrace (trace)' denial, they aren't actually tracing other
  1594. # processes. Unfortunately, the kernel overloads trace such that the LSMs are
  1595. # unable to distinguish between tracing other processes and other accesses.
  1596. # ptrace (trace) can be used to break out of the seccomp sandbox unless the
  1597. # kernel has 93e35efb8de45393cf61ed07f7b407629bf698ea (in 4.8+). Until snapd
  1598. # has full ptrace support conditional on kernel support, explicitly deny to
  1599. # silence noisy denials/avoid confusion and accidentally giving away this
  1600. # dangerous access frivolously.
  1601. deny ptrace (trace),
  1602. deny capability sys_ptrace,
  1603.  
  1604. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!