mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-30 22:05:27 +00:00
profiles: Add chromium-browser profile from Ubuntu
Ubuntu is dropping their chromium-browser profile because chromium-browser has been made a snap on ubuntu. Suck in the profile upstream as a reference profile for those who want to confine chromium outside of a snap, and update its includes. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/606 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <steve.beattie@canonical.com>
This commit is contained in:
John Johansen
@@ -0,0 +1,29 @@
|
||||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020 Canonical Ltd.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
# Author: Jamie Strandboge <jamie@canonical.com>
|
||||
|
||||
# This file is updated currently not managed by the package but in the future
|
||||
# will be overwritten on upgrades.
|
||||
#
|
||||
# For site-specific adjustments, please see:
|
||||
# /etc/apparmor.d/local/chromium-browser
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <abstractions/ubuntu-browsers.d/plugins-common>
|
||||
include <abstractions/ubuntu-browsers.d/mailto>
|
||||
include <abstractions/ubuntu-browsers.d/multimedia>
|
||||
include <abstractions/ubuntu-browsers.d/productivity>
|
||||
include <abstractions/ubuntu-browsers.d/java>
|
||||
include <abstractions/ubuntu-browsers.d/kde>
|
||||
include <abstractions/ubuntu-browsers.d/text-editors>
|
||||
include <abstractions/ubuntu-browsers.d/ubuntu-integration>
|
||||
include <abstractions/ubuntu-browsers.d/user-files>
|
||||
344
profiles/apparmor/profiles/extras/usr.bin.chromium-browser
Normal file
344
profiles/apparmor/profiles/extras/usr.bin.chromium-browser
Normal file
@@ -0,0 +1,344 @@
|
||||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020 Canonical Ltd.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
# Author: Jamie Strandboge <jamie@canonical.com>
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
#include <tunables/global>
|
||||
|
||||
@{chromium} = chromium{,-browser}
|
||||
|
||||
# We need 'flags=(attach_disconnected)' in newer chromium versions
|
||||
profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconnected) {
|
||||
include <abstractions/audio>
|
||||
include <abstractions/cups-client>
|
||||
include <abstractions/dbus-session>
|
||||
include <abstractions/dbus-strict>
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/ibus>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/user-tmp>
|
||||
|
||||
# This include specifies which ubuntu-browsers.d abstractions to use. Eg, if
|
||||
# you want access to productivity applications, adjust the following file
|
||||
# accordingly.
|
||||
include if exists <abstractions/ubuntu-browsers.d/chromium-browser>
|
||||
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability sys_ptrace,
|
||||
|
||||
# UPower
|
||||
# Not sure why these are needed, so deny for now
|
||||
deny dbus (send)
|
||||
bus=system
|
||||
path=/org/freedesktop/UPower
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(label=unconfined),
|
||||
deny dbus (send)
|
||||
bus=system
|
||||
path=/org/freedesktop/UPower/devices/*
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(label=unconfined),
|
||||
deny dbus (send)
|
||||
bus=system
|
||||
path=/org/freedesktop/UPower
|
||||
interface=org.freedesktop.UPower
|
||||
member={EnumerateDevices,GetDisplayDevice}
|
||||
peer=(label=unconfined),
|
||||
|
||||
# ???
|
||||
deny dbus (send)
|
||||
bus=system
|
||||
path=/org/freedesktop/hostname1
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=GetAll
|
||||
peer=(label=unconfined),
|
||||
|
||||
# Networking
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
@{PROC}/[0-9]*/net/if_inet6 r,
|
||||
@{PROC}/[0-9]*/net/ipv6_route r,
|
||||
|
||||
# Should maybe be in abstractions
|
||||
/etc/mime.types r,
|
||||
/etc/mailcap r,
|
||||
/etc/mtab r,
|
||||
/etc/xdg/xubuntu/applications/defaults.list r,
|
||||
owner @{HOME}/.local/share/applications/defaults.list r,
|
||||
owner @{HOME}/.local/share/applications/mimeinfo.cache r,
|
||||
/tmp/.X[0-9]*-lock r,
|
||||
|
||||
@{PROC}/self/exe ixr,
|
||||
@{PROC}/[0-9]*/fd/ r,
|
||||
@{PROC}/filesystems r,
|
||||
@{PROC}/vmstat r,
|
||||
@{PROC}/ r,
|
||||
@{PROC}/[0-9]*/task/[0-9]*/stat r,
|
||||
owner @{PROC}/[0-9]*/cmdline r,
|
||||
owner @{PROC}/[0-9]*/io r,
|
||||
owner @{PROC}/[0-9]*/setgroups w,
|
||||
owner @{PROC}/[0-9]*/{uid,gid}_map w,
|
||||
@{PROC}/[0-9]*/smaps r,
|
||||
@{PROC}/[0-9]*/stat r,
|
||||
@{PROC}/[0-9]*/statm r,
|
||||
owner @{PROC}/[0-9]*/status r,
|
||||
owner @{PROC}/[0-9]*/task/[0-9]*/status r,
|
||||
deny @{PROC}/[0-9]*/oom_{,score_}adj w,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/sys/net/ipv4/tcp_fastopen r,
|
||||
|
||||
# Newer chromium needs these now
|
||||
/etc/udev/udev.conf r,
|
||||
# Chromium appears to want all "uevent" files under /sys/devices/
|
||||
/sys/devices/**/uevent r,
|
||||
/sys/devices/system/cpu/cpufreq/policy*/cpuinfo_max_freq r,
|
||||
/sys/devices/system/cpu/cpu*/cpufreq/cpuinfo_max_freq r,
|
||||
/sys/devices/system/node/node*/meminfo r,
|
||||
/sys/devices/pci[0-9]*/**/class r,
|
||||
/sys/devices/pci[0-9]*/**/config r,
|
||||
/sys/devices/pci[0-9]*/**/device r,
|
||||
/sys/devices/pci[0-9]*/**/irq r,
|
||||
/sys/devices/pci[0-9]*/**/resource r,
|
||||
/sys/devices/pci[0-9]*/**/revision r,
|
||||
/sys/devices/pci[0-9]*/**/subsystem_device r,
|
||||
/sys/devices/pci[0-9]*/**/subsystem_vendor r,
|
||||
/sys/devices/pci[0-9]*/**/vendor r,
|
||||
/sys/devices/pci[0-9]*/**/removable r,
|
||||
/sys/devices/pci[0-9]*/**/block/**/size r,
|
||||
/sys/devices/virtual/block/**/removable r,
|
||||
/sys/devices/virtual/block/**/size r,
|
||||
/sys/devices/virtual/tty/tty*/active r,
|
||||
# This is requested, but doesn't seem to actually be needed so deny for now
|
||||
deny /run/udev/data/** r,
|
||||
|
||||
# Needed for the crash reporter
|
||||
owner @{PROC}/[0-9]*/auxv r,
|
||||
|
||||
# chromium mmaps all kinds of things for speed.
|
||||
/etc/passwd m,
|
||||
/usr/share/fonts/truetype/**/*.tt[cf] m,
|
||||
/usr/share/fonts/**/*.pfb m,
|
||||
/usr/share/mime/mime.cache m,
|
||||
/usr/share/icons/**/*.cache m,
|
||||
owner /{dev,run}/shm/pulse-shm* m,
|
||||
owner @{HOME}/.local/share/mime/mime.cache m,
|
||||
owner /tmp/** m,
|
||||
|
||||
@{PROC}/sys/kernel/shmmax r,
|
||||
owner /{dev,run}/shm/{,.}org.chromium.* mrw,
|
||||
owner /{,var/}run/shm/shmfd-* mrw,
|
||||
|
||||
/usr/lib/@{chromium}/*.pak mr,
|
||||
/usr/lib/@{chromium}/locales/* mr,
|
||||
|
||||
# Noisy
|
||||
deny /usr/lib/@{chromium}/** w,
|
||||
deny /var/cache/fontconfig/ w,
|
||||
|
||||
# Allow ptracing ourselves and our helpers
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
ptrace (trace) peer=@{profile_name}//lsb_release,
|
||||
ptrace (trace) peer=@{profile_name}//xdgsettings,
|
||||
|
||||
# Make browsing directories work
|
||||
/ r,
|
||||
/**/ r,
|
||||
|
||||
# Allow access to documentation and other files the user may want to look
|
||||
# at in /usr
|
||||
/usr/{include,share,src}** r,
|
||||
|
||||
# Default profile allows downloads to ~/Downloads and uploads from ~/Public
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/Public/ r,
|
||||
owner @{HOME}/Public/* r,
|
||||
owner @{HOME}/Downloads/ r,
|
||||
owner @{HOME}/Downloads/* rw,
|
||||
|
||||
# For migration
|
||||
owner @{HOME}/.mozilla/firefox/profiles.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/prefs.js r,
|
||||
|
||||
# Helpers
|
||||
/usr/bin/xdg-open ixr,
|
||||
/usr/bin/gnome-open ixr,
|
||||
/usr/bin/gvfs-open ixr,
|
||||
/usr/bin/kdialog ixr,
|
||||
# TODO: xfce
|
||||
|
||||
# Importing firefox settings (requires 'r' access to @{HOME}/.mozilla/**
|
||||
# which is provided by abstractions/ubuntu-browsers.d/user-files).
|
||||
/etc/firefox/profile/bookmarks.html r,
|
||||
owner @{HOME}/.mozilla/** k,
|
||||
|
||||
# Chromium Policies
|
||||
/etc/@{chromium}/policies/** r,
|
||||
|
||||
# Chromium configuration
|
||||
owner @{HOME}/.pki/nssdb/* rwk,
|
||||
owner @{HOME}/.cache/chromium/ rw,
|
||||
owner @{HOME}/.cache/chromium/** rw,
|
||||
owner @{HOME}/.cache/chromium/Cache/* mr,
|
||||
owner @{HOME}/.config/chromium/ rw,
|
||||
owner @{HOME}/.config/chromium/** rwk,
|
||||
owner @{HOME}/.config/chromium/**/Cache/* mr,
|
||||
owner @{HOME}/.config/chromium/Dictionaries/*.bdic mr,
|
||||
owner @{HOME}/.config/chromium/**/Dictionaries/*.bdic mr,
|
||||
|
||||
# Allow transitions to ourself and our sandbox
|
||||
/usr/lib/@{chromium}/@{chromium} ix,
|
||||
/usr/lib/@{chromium}/chrome-sandbox cx -> chromium_browser_sandbox,
|
||||
|
||||
# Allow communicating with sandbox
|
||||
unix (receive, send) peer=(label=/usr/lib/@{chromium}/@{chromium}//chromium_browser_sandbox),
|
||||
|
||||
/{usr/,}bin/ps Uxr,
|
||||
/usr/lib/@{chromium}/xdg-settings Cxr -> xdgsettings,
|
||||
/usr/bin/xdg-settings Cxr -> xdgsettings,
|
||||
/usr/bin/lsb_release Cxr -> lsb_release,
|
||||
|
||||
# GSettings
|
||||
owner /{,var/}run/user/*/dconf/ rw,
|
||||
owner /{,var/}run/user/*/dconf/user rw,
|
||||
owner @{HOME}/.config/dconf/user r,
|
||||
|
||||
# Magnet links
|
||||
/usr/bin/gio ixr,
|
||||
|
||||
# Chrome Gnome Shell Integration
|
||||
/etc/chromium/native-messaging-hosts/org.gnome.chrome_gnome_shell.json r,
|
||||
/usr/bin/chrome-gnome-shell ixr,
|
||||
|
||||
profile xdgsettings {
|
||||
include <abstractions/bash>
|
||||
include <abstractions/gnome>
|
||||
|
||||
/{usr/,}bin/dash ixr,
|
||||
|
||||
/etc/ld.so.cache r,
|
||||
/etc/xdg/** r,
|
||||
/usr/bin/xdg-settings r,
|
||||
/usr/lib/@{chromium}/xdg-settings r,
|
||||
/usr/share/applications/*.desktop r,
|
||||
/usr/share/applications/*.list r,
|
||||
|
||||
# Checking default browser
|
||||
/{usr/,}bin/grep ixr,
|
||||
/{usr/,}bin/head ixr,
|
||||
/{usr/,}bin/readlink ixr,
|
||||
/{usr/,}bin/sed ixr,
|
||||
/{usr/,}bin/tr ixr,
|
||||
/{usr/,}bin/which ixr,
|
||||
/usr/bin/basename ixr,
|
||||
/usr/bin/cut ixr,
|
||||
|
||||
# Setting the default browser
|
||||
/{usr/,}bin/mkdir ixr,
|
||||
/{usr/,}bin/mv ixr,
|
||||
/{usr/,}bin/touch ixr,
|
||||
/usr/bin/dirname ixr,
|
||||
/usr/bin/gconftool-2 ix,
|
||||
/usr/bin/[gm]awk ixr,
|
||||
/usr/bin/xdg-mime ixr,
|
||||
owner @{HOME}/.local/share/applications/ w,
|
||||
owner @{HOME}/.local/share/applications/mimeapps.list* rw,
|
||||
}
|
||||
|
||||
profile lsb_release {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
/usr/bin/lsb_release r,
|
||||
/{usr/,}bin/dash ixr,
|
||||
/usr/bin/dpkg-query ixr,
|
||||
/usr/include/python2.[4567]/pyconfig.h r,
|
||||
/etc/lsb-release r,
|
||||
/etc/debian_version r,
|
||||
/etc/dpkg/origins/** r,
|
||||
/usr/share/distro-info/** r,
|
||||
/var/lib/dpkg/** r,
|
||||
|
||||
/usr/local/lib/python3.[0-9]/dist-packages/ r,
|
||||
/usr/bin/ r,
|
||||
/usr/bin/python3.[0-9] mr,
|
||||
}
|
||||
|
||||
profile chromium_browser_sandbox {
|
||||
# Be fanatical since it is setuid root and don't use an abstraction
|
||||
/{usr/,}lib/libgcc_s.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/libgcc_s.so* mr,
|
||||
/{usr/,}lib{,32,64}/libm-*.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/libm-*.so* mr,
|
||||
/{usr/,}lib{,32,64}/libpthread-*.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/libpthread-*.so* mr,
|
||||
/{usr/,}lib{,32,64}/libc-*.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/libc-*.so* mr,
|
||||
/{usr/,}lib{,32,64}/libld-*.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/libld-*.so* mr,
|
||||
/{usr/,}lib{,32,64}/ld-*.so* mr,
|
||||
/{usr/,}lib/@{multiarch}/ld-*.so* mr,
|
||||
/{usr/,}lib/tls/*/{cmov,nosegneg}/libm-*.so* mr,
|
||||
/{usr/,}lib/tls/*/{cmov,nosegneg}/libpthread-*.so* mr,
|
||||
/{usr/,}lib/tls/*/{cmov,nosegneg}/libc-*.so* mr,
|
||||
/usr/lib/libstdc++.so* mr,
|
||||
/usr/lib/@{multiarch}/libstdc++.so* mr,
|
||||
/etc/ld.so.cache r,
|
||||
|
||||
# Required for dropping into PID namespace. Keep in mind that until the
|
||||
# process drops this capability it can escape confinement, but once it
|
||||
# drops CAP_SYS_ADMIN we are ok.
|
||||
capability sys_admin,
|
||||
|
||||
# All of these are for sanely dropping from root and chrooting
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability dac_override,
|
||||
capability sys_chroot,
|
||||
|
||||
capability sys_ptrace,
|
||||
ptrace (read, readby),
|
||||
|
||||
signal (receive) peer=unconfined,
|
||||
signal peer=@{profile_name},
|
||||
signal (receive, send) set=("exists"),
|
||||
signal (receive) peer=/usr/lib/@{chromium}/@{chromium},
|
||||
|
||||
unix (receive, send) peer=(label=/usr/lib/@{chromium}/@{chromium}),
|
||||
unix (create),
|
||||
unix peer=(label=@{profile_name}),
|
||||
unix (getattr, getopt, setopt, shutdown) addr=none,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/[0-9]*/ r,
|
||||
@{PROC}/[0-9]*/fd/ r,
|
||||
deny @{PROC}/[0-9]*/oom_adj w,
|
||||
deny @{PROC}/[0-9]*/oom_score_adj w,
|
||||
@{PROC}/[0-9]*/status r,
|
||||
@{PROC}/[0-9]*/task/[0-9]*/stat r,
|
||||
|
||||
/usr/bin/@{chromium} r,
|
||||
/usr/lib/@{chromium}/@{chromium} Px,
|
||||
/usr/lib/@{chromium}/chrome-sandbox mr,
|
||||
|
||||
/dev/null rw,
|
||||
|
||||
owner /tmp/** rw,
|
||||
}
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
include if exists <local/chromium_browser>
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user