mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 01:57:43 +00:00
af396a46ee
There were failures in the flatpak-build autopkgtests due to missing mount permissions: [ 60.822732] audit: type=1400 audit(1749737394.684:168): apparmor="DENIED" operation="mount" class="mount" info="failed mntpnt match" error=-13 profile="fusermount3" name="/var/tmp/test-flatpak-uuKcEE/.flatpak-builder/rofiles/rofiles-JxeDhQ/" pid=3150 comm="fusermount3" fstype="fuse.rofiles-fuse" srcname="rofiles-fuse" flags="rw, nosuid, nodev" [ 60.825556] audit: type=1400 audit(1749737394.686:169): apparmor="DENIED" operation="mount" class="mount" info="failed mntpnt match" error=-13 profile="fusermount3" name="/var/tmp/test-flatpak-uuKcEE/.flatpak-builder/rofiles/rofiles-JxeDhQ/" pid=3151 comm="fusermount3" fstype="fuse" srcname="/dev/fuse" flags="rw, nosuid, nodev" [ 918.564687] audit: type=1400 audit(1749738252.435:186): apparmor="DENIED" operation="umount" class="mount" profile="fusermount3" name="/var/tmp/test-flatpak-AI4MsP/.flatpak-builder/rofiles/rofiles-vIM7ok/" pid=7093 comm="fusermount" Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
54 lines
2.1 KiB
Plaintext
54 lines
2.1 KiB
Plaintext
abi <abi/4.0>,
|
|
include <tunables/global>
|
|
|
|
@{fuse_types} = {fuse,fuse.*,fuseblk,fusectl}
|
|
profile fusermount3 /usr/bin/fusermount3 {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice>
|
|
|
|
capability sys_admin,
|
|
capability dac_read_search,
|
|
|
|
# Allow both rw and ro type mounts (e.g. AppImage uses ro)
|
|
#MS_DIRSYNC, MS_NOATIME, MS_NODIRATIME, MS_NOEXEC, MS_SYNCHRONOUS, MS_NOSYMFOLLOW
|
|
# Below broad mount flags should be revisited once we have rule delegation
|
|
mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> @{HOME}/**/,
|
|
mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> /mnt/{,**/},
|
|
mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> @{run}/user/@{uid}/**/,
|
|
mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> /media/**/,
|
|
mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> /tmp/**/,
|
|
# Cern VM fs is special and only uses these exact flags
|
|
mount fstype=@{fuse_types} options=(nosuid,nodev,ro) -> /cvmfs/**/,
|
|
|
|
umount @{HOME}/**/,
|
|
umount /mnt/{,**/},
|
|
umount @{run}/user/@{uid}/**/,
|
|
umount /media/**/,
|
|
umount /tmp/**/,
|
|
umount /cvmfs/**/,
|
|
|
|
# Flatpak's default cache directory where it mounts a revokefs-fuse
|
|
mount fstype=fuse options=(nosuid,nodev,rw) /dev/fuse -> /var/tmp/flatpak-cache-*/**/,
|
|
mount fstype=fuse.revokefs-fuse options=(nosuid,nodev,rw) revokefs-fuse -> /var/tmp/flatpak-cache-*/**/,
|
|
umount /var/tmp/flatpak-cache-*/**/,
|
|
|
|
# flatpak-builder uses rofiles-fuse
|
|
mount fstype=fuse.rofiles-fuse options=(nosuid,nodev,rw) {rofiles-fuse,/dev/fuse} -> /var/tmp/test-flatpak-*/**/,
|
|
umount /var/tmp/test-flatpak-*/**/,
|
|
|
|
/dev/fuse rw,
|
|
|
|
# needed since libfuse 3.17.1-rc0 (LP: #2111845)
|
|
/usr/bin/mount ix,
|
|
/usr/bin/umount ix,
|
|
|
|
@{etc_ro}/fuse.conf r,
|
|
@{PROC}/@{pid}/{mounts,mountinfo} r,
|
|
|
|
@{exec_path} mr,
|
|
|
|
include if exists <local/fusermount3>
|
|
}
|
|
|
|
# vim:ft=apparmor
|