# Sample AppArmor Profile. # License: Public Domain # Last change: January 25, 2018 include <tunables/global> # Variable assignment @{FOO_LIB}=/usr/lib{,32,64}/foo @{USER_DIR} = @{HOME}/Public @{HOME}/Desktop @{USER_DIR} += @{HOME}/Hello # Profile for /usr/bin/foo /usr/bin/foo (attach_disconnected, enforce) { include <abstractions/base> include <abstractions/dbus> #include <abstractions/ubuntu-helpers> #include<abstractions/wayland> #include"/etc/apparmor.d/abstractions/ubuntu-konsole" include "/etc/apparmor.d/abstractions/openssl" /{,**/} r,# Read only directories owner /{home,media,mnt,srv,net}/** r, owner @{USER_DIR}/** rw, audit deny owner /**/* mx, /**.[tT][xX][tT] r, # txt owner file @{HOME}/.local/share/foo/{,**} rwkl, owner @{HOME}/.config/foo/{,**} rwk, owner @{HOME}/.config/* rw, owner @{HOME}/.config/*.[a-zA-Z0-9]* rwk, owner @{HOME}/.cache/foo/{,**} rwk, "/usr/share/**" r, "/var/lib/flatpak/exports/share/**" r, "/var/lib/flatpak/app/**/export/share/applications/*.desktop" r, allow file /etc/nsswitch.conf r, allow /etc/fstab r, /etc/udev/udev.conf r, /etc/xdg/** r, /etc/xdg/Trolltech.conf k, deny /etc/xdg/{autostart,systemd}/** r, deny /boot/** rwlkmx, owner @{PROC}/@{pid}/{cmdline,mountinfo,mounts,stat,status,vmstat} r, /sys/devices/**/uevent r, /usr/bin/foo ixr, /usr/bin/dolphin PUx, /usr/bin/* Pixr, /usr/bin/khelpcenter Cx -> sanitized_helper, /usr/bin/helloworld Cxr -> hello_world, /usr/lib{,32,64}/{,@{multiarch}/}qt5/plugins/{,**/}*.so m, @{FOO_LIB}/{,**} mr, audit deny /dev/{audio,video}* rwlkmx, # Dbus rules dbus (send) bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.DBus.Introspectable peer=(name=org.freedesktop.NetworkManager label=unconfined), dbus (send receive) bus=system path=/org/freedesktop/NetworkManager interface=org.freedesktop.NetworkManager member={Introspect,state} peer=(name=(org.freedesktop.NetworkManager|org.freedesktop.DBus)), dbus (send) bus=session path=/org/gnome/GConf/Database/* member={AddMatch,AddNotify,AllEntries,LookupExtended,RemoveNotify}, dbus (bind) bus=system name=org.bluez, # Signal rules signal (send) set=(term) peer=unconfined, signal (send, receive) set=(int exists rtmin+8) peer=/usr/lib/hello/world//foo-helper, # Child profile profile hello_world { # File rules (three different ways) file /usr/lib{,32,64}/helloworld/**.so mr, /usr/lib{,32,64}/helloworld/** r, rk /usr/lib{,32,64}/helloworld/hello,file, # Link rules (two ways) l /foo1 -> /bar, link /foo2 -> bar, link /foo3 to bar, link subset /link* -> /**, # Network rules network inet6 tcp, #Allow access to tcp only for inet6 addresses network netlink dgram, network bluetooth, network unspec dgram, # Capability rules capability dac_override, capability sys_admin, capability sys_chroot, # Mount rules mount options=(rw bind remount nodev noexec) vfstype=ecryptfs /home/*/.helloworld/ -> /home/*/helloworld/, mount options in (rw, bind) / -> /run/hellowordd/*.mnt, mount option=read-only fstype=btrfs /dev/sd[a-z][1-9]* -> /media/*/*, umount /home/*/helloworld/, # Pivot Root rules pivot_root oldroot=/mnt/root/old/ /mnt/root/, pivot_root /mnt/root/, # Ptrace rules ptrace (trace) peer=unconfined, ptrace (read, trace, tracedby) peer=/usr/lib/hello/helloword, # Unix rules unix (connect receive send) type=(stream) peer=(label=unconfined addr=@/tmp/ibus/dbus-*), unix (send,receive) type=(stream) protocol=0 peer=(addr=none), unix peer=(label=@{profile_name},addr=@helloworld), # Rlimit rule set rlimit data <= 100M, set rlimit nproc <= 10, set rlimit memlock <= 2GB, set rlimit rss <= infinity, # Change Profile rules change_profile unsafe /** -> [^u/]**, change_profile unsafe /** -> {u,un,unc,unco,uncon,unconf,unconfi,unconfin,unconfine}, change_profile /bin/bash -> new_profile, # Alias alias /usr/ -> /mnt/usr/, } # Hat ^foo-helper { network unix stream, unix stream, /usr/hi\"esc\x23esc\032esc\*es\{esc\ rw r, # Escape expressions # Text after a variable is highlighted as path file /my/path r, @{FOO_LIB}file r, @{FOO_LIB}#my/path r, #Comment } }