Skip to content

Commit

Permalink
feat: profiles and integration tests improvments.
Browse files Browse the repository at this point in the history 
Add the udbus variable to be used in `unix bind` rule for dbus.
  • Loading branch information
@roddhjav
roddhjav committed Nov 19, 2024
1 parent b4bcb2f commit 4e5f4cb
Show file tree
Hide file tree
Showing 43 changed files with 81 additions and 47 deletions.
8 changes: 4 additions & 4 deletions apparmor.d/abstractions/app/sudo
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 24,10 @@

network netlink raw, # PAM

dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.logi1.Manager
member=CreateSession
peer=(name=org.freedesktop.login1, label=systemd-logind),
unix bind type=stream addr=@@{udbus}/bus/sudo/system,

#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind

dbus (send receive) bus=session path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd.Manager
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/abstractions/app/systemctl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 10,7 @@

ptrace read peer=@{p_systemd},

unix bind type=stream addr=@@{hex16}/bus/systemctl/,
unix bind type=stream addr=@@{udbus}/bus/systemctl/,

@{bin}/systemctl mr,

Expand Down
2 changes: 2 additions & 0 deletions apparmor.d/abstractions/attached/base
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 7,10 @@

abi <abi/4.0>,

@{att}/@{run}/systemd/journal/dev-log w,
@{att}/@{run}/systemd/journal/socket w,

deny /apparmor/.null rw,
deny @{att}/apparmor/.null rw,

include if exists <abstractions/attached/base.d>
Expand Down
4 changes: 2 additions & 2 deletions apparmor.d/groups/_full/systemd-user
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 32,8 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) {

ptrace read peer=@{p_systemd},

unix bind type=stream addr=@@{hex16}/bus/systemd/bus-system,
unix bind type=stream addr=@@{hex16}/bus/systemd/bus-api-user,
unix bind type=stream addr=@@{udbus}/bus/systemd/bus-system,
unix bind type=stream addr=@@{udbus}/bus/systemd/bus-api-user,

#aa:dbus own bus=session name=org.freedesktop.systemd1

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/apt/apt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 34,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {

signal (send) peer=apt-methods-*,

unix (bind) type=stream addr=@@{hex16}/bus/apt/system,
unix (bind) type=stream addr=@@{udbus}/bus/apt/system,
unix (send, receive) type=stream peer=(label=apt-esm-json-hook),
unix (send, receive) type=stream peer=(label=snapd),

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/apt/unattended-upgrade
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 33,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {

signal (send) peer=apt-methods-http,

unix type=stream addr=@@{hex16}/bus/unattended-upgr/system,
unix type=stream addr=@@{udbus}/bus/unattended-upgr/system,

@{exec_path} mr,

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/bus/dbus-system
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 33,7 @@ profile dbus-system flags=(attach_disconnected) {

ptrace (read) peer=@{p_systemd},

#aa:dbus own bus=system name=org.freedesktop.DBus
#aa:dbus own bus=system name=org.freedesktop.DBus path=/{,org/freedesktop/DBus}

@{exec_path} mrix,

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/gnome/gdm-session-worker
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 47,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
signal (send) set=hup peer=xorg,
signal (send) set=hup peer=xwayland,

unix (bind) type=stream addr=@@{hex16}/bus/gdm-session-wor/system,
unix (bind) type=stream addr=@@{udbus}/bus/gdm-session-wor/system,

#aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon

Expand Down
8 changes: 6 additions & 2 deletions apparmor.d/groups/network/ModemManager
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 25,13 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {

@{exec_path} mr,

@{run}/udev/data/ acpi:* r, # for acpi
@{run}/udev/data/ pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.)
@{run}/udev/data/ platform:* r,
@{run}/udev/data/ pnp:* r,
@{run}/udev/data/ serial*:* r,
@{run}/udev/data/ usb:* r,
@{run}/udev/data/ vmbus:* r,
@{run}/udev/data/c16[6,7]:@{int} r, # USB modems
@{run}/udev/data/c18[0,8,9]:@{int} r, # USB devices & USB serial converters
@{run}/udev/data/c4:@{int} r, # for /dev/tty[0-9]*
Expand All @@ -43,9 47,9 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {
@{sys}/class/tty/ r,
@{sys}/class/wwan/ r,

@{sys}/devices/**/uevent r,
@{sys}/devices/@{pci}/revision r,
@{sys}/devices/virtual/net/*/ r,
@{sys}/devices/**/net/*/ r,
@{sys}/devices/**/uevent r,
@{sys}/devices/virtual/tty/*/ r,

include if exists <local/ModemManager>
Expand Down
9 changes: 7 additions & 2 deletions apparmor.d/groups/network/NetworkManager
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 47,10 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
#aa:dbus talk bus=system name=org.freedesktop.nm_dispatcher label=nm-dispatcher
#aa:dbus talk bus=system name=org.freedesktop.resolve1 label=systemd-resolved

dbus send bus=system path=/org/freedesktop/nm_dispatcher
interface=org.freedesktop.nm_dispatcher
peer=(name=org.freedesktop.nm_dispatcher),

dbus receive bus=system path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
member=GetManagedObjects
Expand Down Expand Up @@ -128,10 132,11 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/ rfkill:* r,
@{run}/udev/data/n@{int} r,

@{sys}/devices/**/uevent r,
@{sys}/devices/virtual/net/{,**} r,
@{sys}/devices/@{pci}/net/*/{,**} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/{,**} r,
@{sys}/devices/**/@{uuid}/net/*/{,**} r,
@{sys}/devices/**/uevent r,
@{sys}/devices/virtual/net/{,**} r,

@{PROC}/@{pids}/stat r,
@{PROC}/1/environ r,
Expand Down
16 changes: 14 additions & 2 deletions apparmor.d/groups/network/netplan.script
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 12,8 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
include <abstractions/nameservice-strict>
include <abstractions/python>

network netlink raw,

@{exec_path} mr,

@{lib}/netplan/generate rix,
Expand All @@ -22,15 24,25 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {

/etc/netplan/{,*} r,

@{run}/NetworkManager/conf.d/10-globally-managed-devices.conf{,.@{rand6}} rw,
@{run}/netplan/ r,

@{run}/NetworkManager/conf.d/@{int}-globally-managed-devices.conf{,.@{rand6}} rw,
@{run}/NetworkManager/system-connections/ rw,
@{run}/NetworkManager/system-connections/netplan-*.nmconnection{,.@{rand6}} rw,

@{run}/systemd/network/ r,
@{run}/systemd/network/@{int}-netplan{,-*}.{network,link}{,.@{rand6}} rw,
@{run}/systemd/system/ r,
@{run}/systemd/system/netplan-* rw,
@{run}/systemd/system/systemd-networkd-wait-online.service.d/ r,
@{run}/systemd/system/systemd-networkd-wait-online.service.d/@{int}-netplan.conf{,.@{rand6}} rw,
@{run}/systemd/system/systemd-networkd.service.wants/ rw,
@{run}/systemd/system/systemd-networkd.service.wants/netplan-*.service rw,

@{run}/udev/rules.d/ r,
@{run}/udev/rules.d/90-netplan.rules{,.@{rand6}} rw,
@{run}/udev/rules.d/@{int}-netplan{,-*}.rules{,.@{rand6}} rw,

@{sys}/devices/**/net/*/address r,

profile udevadm {
include <abstractions/base>
Expand Down
1 change: 1 addition & 0 deletions apparmor.d/groups/network/nm-online
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 11,7 @@ profile nm-online @{exec_path} {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/consoles>

dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/@{int}
interface=org.freedesktop.NetworkManager.Connection.Active
Expand Down
4 changes: 4 additions & 0 deletions apparmor.d/groups/network/nmcli
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 9,14 @@ include <tunables/global>
@{exec_path} = @{bin}/nmcli
profile nmcli @{exec_path} {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/consoles>

capability dac_read_search,
capability sys_nice,

#aa:dbus talk bus=system name=org.freedesktop.NetworkManager label=NetworkManager

@{exec_path} mr,

@{pager_path} rPx -> child-pager,
Expand Down
1 change: 1 addition & 0 deletions apparmor.d/groups/ssh/ssh-keygen
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 22,7 @@ profile ssh-keygen @{exec_path} {
owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw,

/tmp/snapd@{int}/*_*{,.pub} w,
/tmp/snapd@{int}/*.key{,.pub} w,

/dev/tty@{int} rw,
/dev/ttyS@{int} rw,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/ssh/sshd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 53,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) {

ptrace (read,trace) peer=@{p_systemd},

unix (bind) type=stream addr=@@{hex16}/bus/sshd/system,
unix (bind) type=stream addr=@@{udbus}/bus/sshd/system,

dbus send bus=system path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/busctl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 22,7 @@ profile busctl @{exec_path} {

ptrace (read),

unix (bind) type=stream addr=@@{hex16}/bus/busctl/busctl,
unix (bind) type=stream addr=@@{udbus}/bus/busctl/busctl,

signal (send) set=(cont) peer=child-pager,

Expand Down
1 change: 1 addition & 0 deletions apparmor.d/groups/systemd/hostnamectl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 10,7 @@ include <tunables/global>
profile hostnamectl @{exec_path} {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.systemd1>
include <abstractions/consoles>

capability net_admin,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/networkctl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 24,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) {

ptrace (read) peer=@{p_systemd},

unix (bind) type=stream addr=@@{hex16}/bus/networkctl/system,
unix (bind) type=stream addr=@@{udbus}/bus/networkctl/system,

#aa:dbus talk bus=system name=org.freedesktop.network1 label=systemd-networkd
# No label available
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-analyze
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 22,7 @@ profile systemd-analyze @{exec_path} {

signal (send) peer=child-pager,

unix bind type=stream addr=@@{hex16}/bus/systemd-analyze/system,
unix bind type=stream addr=@@{udbus}/bus/systemd-analyze/system,

#aa:dbus talk bus=system name=org.freedesktop.systemd1 label="@{p_systemd}"

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-cgls
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 19,7 @@ profile systemd-cgls @{exec_path} {

signal send set=cont peer=child-pager,

unix bind type=stream addr=@@{hex16}/bus/systemd-cgls/system,
unix bind type=stream addr=@@{udbus}/bus/systemd-cgls/system,

@{exec_path} mr,

Expand Down
3 changes: 3 additions & 0 deletions apparmor.d/groups/systemd/systemd-homed
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 35,8 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
mount options=(rw, rslave) -> @{run}/,
mount /dev/dm-@{int} -> @{run}/systemd/user-home-mount/,

unix bind type=stream addr=@@{udbus}/bus/systemd-homed/system,

#aa:dbus own bus=system name=org.freedesktop.home1

@{exec_path} mr,
Expand All @@ -61,6 63,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/home/{,**} rw,
@{run}/systemd/userdb/io.systemd.home r,
@{run}/systemd/user-home-mount/{,**} rw,
@{run}/systemd/notify w,

@{sys}/bus/ r,
@{sys}/fs/ r,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-hostnamed
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 18,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {

network unix stream,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-hostnam/system,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-hostnam/system,

#aa:dbus own bus=system name=org.freedesktop.hostname1

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-localed
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 14,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) {
include <abstractions/consoles>
include <abstractions/common/systemd>

unix (bind) type=stream addr=@@{hex16}/bus/systemd-localed/system,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-localed/system,

#aa:dbus own bus=system name=org.freedesktop.locale1

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-logind
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 29,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {

mqueue r type=posix /,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-logind/system,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-logind/system,

#aa:dbus own bus=system name=org.freedesktop.login1

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-networkd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 27,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
network packet dgram,
network packet raw,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-network/bus-api-network,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network,

#aa:dbus own bus=system name=org.freedesktop.network1

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-oomd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 15,7 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
capability dac_override,
capability kill,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-oomd/bus-api-oom,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-oomd/bus-api-oom,

#aa:dbus own bus=system name=org.freedesktop.oom1

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-timedated
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 15,7 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) {

capability sys_time,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-timedat/system,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-timedat/system,

#aa:dbus own bus=system name=org.freedesktop.timedate1

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-timesyncd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 21,7 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
network inet stream,
network inet6 stream,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-timesyn/bus-api-timesync,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-timesyn/bus-api-timesync,
unix (send, receive) type=dgram addr=none peer=(label=@{p_systemd}, addr=none),

#aa:dbus own bus=system name=org.freedesktop.timesync1
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-update-utmp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 17,7 @@ profile systemd-update-utmp @{exec_path} {

network netlink raw,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-update-/,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-update-/,

@{exec_path} mr,

Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/groups/systemd/systemd-user-runtime-dir
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 25,7 @@ profile systemd-user-runtime-dir @{exec_path} {
mount fstype=tmpfs options=(rw,nosuid,nodev) -> @{run}/user/@{uid}/,
umount @{run}/user/@{uid}/,

unix (bind) type=stream addr=@@{hex16}/bus/systemd-user-ru/system,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-user-ru/system,

@{exec_path} mr,

Expand Down
4 changes: 2 additions & 2 deletions apparmor.d/groups/ubuntu/update-notifier
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 22,7 @@ profile update-notifier @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/python>

unix (bind) type=stream addr=@@{hex16}/bus/systemd/bus-api-user,
unix (bind) type=stream addr=@@{udbus}/bus/systemd/bus-api-user,

#aa:dbus talk bus=system name=org.debian.apt label=apt
#aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell
Expand Down Expand Up @@ -87,7 87,7 @@ profile update-notifier @{exec_path} {
include <abstractions/app/systemctl>
include <abstractions/bus-system>

unix (bind) type=stream addr=@@{hex16}/bus/systemctl/system,
unix (bind) type=stream addr=@@{udbus}/bus/systemctl/system,

dbus send bus=system path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/profiles-g-l/login
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 32,7 @@ profile login @{exec_path} flags=(attach_disconnected) {

signal (send) set=(hup term),

unix type=stream addr=@@{hex16}/bus/login/system,
unix type=stream addr=@@{udbus}/bus/login/system,

ptrace read,

Expand Down
2 changes: 2 additions & 0 deletions apparmor.d/profiles-m-r/needrestart-apt-pinvoke
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 13,8 @@ profile needrestart-apt-pinvoke @{exec_path} {
include <abstractions/bus/org.freedesktop.login1>
include <abstractions/consoles>

capability dac_read_search,

@{exec_path} mr,

@{sh_path} rix,
Expand Down
2 changes: 1 addition & 1 deletion apparmor.d/profiles-m-r/qemu-ga
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 21,7 @@ profile qemu-ga @{exec_path} {

ptrace (read) peer=@{p_systemd},

unix type=stream addr=@@{hex16}/bus/shutdown/system,
unix type=stream addr=@@{udbus}/bus/shutdown/system,

#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind

Expand Down
Loading

0 comments on commit 4e5f4cb

Please sign in to comment.