diff --git a/profiles/apparmor.d/gpg-agent b/profiles/apparmor.d/gpg-agent new file mode 100644 index 000000000..a6113ba27 --- /dev/null +++ b/profiles/apparmor.d/gpg-agent @@ -0,0 +1,53 @@ +#------------------------------------------------------------------ +# Copyright (C) 2025 Canonical Ltd. +# +# Author: Paulo Flabiano Smorigo +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +#------------------------------------------------------------------ + +abi , + +include + +@{GNUPG_DEFAULT}="@{HOME}/{.,.config/}gnupg" +@{GNUPG_PACMAN}="{/etc/pacman.d/,/var/lib/*/{.,}}gnupg" +@{GNUPG_ZYPPER}="/var/tmp/zypp.*" +@{GNUPG_CONFIGS}="{@{GNUPG_DEFAULT},@{GNUPG_PACMAN},@{GNUPG_ZYPPER}}" + +profile gpg-agent /usr/bin/gpg-agent { + include + include + + capability dac_read_search, + + @{etc_ro}/gnupg/*.conf r, + /usr/share/{,doc/}gnupg/{,**} r, + /usr/lib/gnupg/{,**} r, + + /usr/bin/gpg-agent mr, + /usr/bin/pinentry-* rPix, + /usr/bin/scdaemon rPix, + /usr/lib/{,gnupg/}scdaemon rPix, + + @{PROC}/@{pid}/fd/ r, + + owner @{run}/user/@{uid}/gnupg/{*.conf,sshcontrol} r, + owner @{run}/user/@{uid}/gnupg/{,d.**/} rw, + owner @{run}/user/@{uid}/gnupg/{,d.**/}S.gpg-agent{,.browser,.extra,.ssh} rw, + owner @{run}/user/@{uid}/gnupg/{,d.**/}S.{dirmngr,keyboxd} rw, + owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/{,**.key{,.tmp}} rw, + + owner @{GNUPG_CONFIGS}/{,**} rw, + owner @{GNUPG_CONFIGS}/{*.conf,sshcontrol} r, + owner @{GNUPG_CONFIGS}/{,private-keys-v1.d/{,**.key{,.tmp}}} rw, + owner @{GNUPG_CONFIGS}/{,d.**/}S.gpg-agent{,.ssh,.browser,.extra} rw, + + owner /dev/tty[0-9]* rw, + + include if exists +} + +# vim: ft=apparmor