mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 01:57:43 +00:00
Code Issues Releases Wiki Activity
apparmor/profiles/apparmor.d
History
Maxime Bélair 91c5e9639c Merge Add curl profile 
In order to test the profile, I did the following inside an oracular VM:

- `curl https://ubuntu.com/ -o /tmp/ubuntu`
- `curl 'https://ubuntu.com/security/{CVE-2024-12797,CVE-2025-24032}' -o '#1'`
- `curl -u dlpuser:rNrKYTX9g7z3RgJRmxWuGHbeu ftp://ftp.dlptest.com/`

Finally, I ran the package's testsuite:
```
apt source curl
cd curl-8.9.1
./configure --without-ssl # SSL has been tested using the above
make
cd test/server
make
cd ..
./runtests.pl -c $(which curl)
```

The only test which should fail should be the last one, since the build was configured with support for less protocols than the ones provided by the binary we're using (this is expected and happens regardless of whether the profile is loaded or not).

A spread smoke-test is also provided as part of this MR.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1560
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Maxime Bélair <maxime.belair@canonical.com>
2025-06-23 13:49:24 +00:00
..
abi
policy: update to use 4.0 abi
2023-06-30 23:36:12 -07:00
abstractions
Merge abstractions/gnome: include abstractions/gtk
2025-05-08 06:15:56 +00:00
apache2.d
policy: update to use 4.0 abi
2023-06-30 23:36:12 -07:00
local
Don't create local/* profile sniplets by default
2023-08-20 11:49:10 +02:00
tunables
Merge profiles/apparmor.d: add gs profile
2025-05-12 12:42:55 +00:00
1password
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
alsamixer
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
babeld
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
balena-etcher
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
bfdd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
bgpd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
bin.ping
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
brave
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
buildah
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
busybox
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
cam
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
ch-checkns
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
ch-run
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
chrome
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
chromium
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
code
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
crun
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
curl
Add curl profile
2025-06-23 13:49:23 +00:00
devhelp
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
dig
add apparmor profile for dig
2025-05-21 14:48:05 +00:00
Discord
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
dnstracer
Add profile keyword
2025-02-12 19:56:12 +05:30
eigrpd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
element-desktop
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
epiphany
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
evolution
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
fabricd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
firefox
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
flatpak
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
foliate
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
fusermount3
Allow noexec mounts in fusermount3 profile
2025-05-27 15:40:21 -04:00
geary
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
github-desktop
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
goldendict
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
gs
profiles: small fix for gs profile
2025-05-12 16:23:04 +02:00
hostname
profiles: add profile for hostname
2025-05-12 12:35:27 +00:00
iotop-c
Merge profiles: remove CAP_SYS_ADMIN from iotop_c profile
2025-05-12 12:02:17 +00:00
ipa_verify
fixup profile
2025-05-09 04:53:35 -07:00
isisd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
john
add owner back to rule lines
2025-06-02 16:29:57 -04:00
kchmviewer
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
keybase
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lc-compliance
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
ldpd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
libcamerify
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
linux-sandbox
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
locale
locale: add mmap perms to the compressors as well.
2025-04-28 11:39:20 +02:00
loupe
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lsb_release
profiles: restore exec path rules from profiles where they were removed
2025-06-17 10:53:14 -07:00
lsblk
Use @{int} instead of ranges
2025-05-25 13:06:08 +00:00
lsof
profiles: give lsof network netlink dgram permissions
2025-05-14 09:45:53 +02:00
lsusb
profiles: add additional rules needed for lsusb under sudo + other flags
2025-06-09 12:56:36 -07:00
lxc-attach
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lxc-create
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lxc-destroy
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lxc-execute
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lxc-stop
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lxc-unshare
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
lxc-usernsexec
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
mbsync
profiles: mbsync: Allow mmap as it is needed for other architectures
2025-06-11 11:33:34 +02:00
mmdebstrap
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
MongoDB_Compass
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
mosquitto
profiles/apparmor.d: add mosquitto profile
2025-02-13 10:58:04 +05:30
msedge
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
nautilus
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
nc.openbsd
Allow network access
2025-01-23 14:04:47 -03:00
nhrpd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
notepadqq
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
notify-send
profiles: add a profile for notify-send
2025-04-18 08:44:40 -07:00
nslookup
Deny CAP_SYS_ADMIN and cleanup profile
2025-04-22 07:19:13 -04:00
nvidia_modprobe
profiles: restore exec path rules from profiles where they were removed
2025-06-17 10:53:14 -07:00
obsidian
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
opam
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
opera
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
ospf6d
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
ospfd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
pageedit
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
pathd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
pbrd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
php-fpm
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
pim6d
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
pimd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
plasmashell
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
podman
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
polypane
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
privacybrowser
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
proftpd
ProFTPD Profile
2025-05-12 14:27:27 +00:00
qcam
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
qmapshack
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
qpdf
Exclude hidden locations in home directories
2025-05-02 14:16:53 +01:00
QtWebEngineProcess
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
qutebrowser
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
remmina
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
ripd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
ripngd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
rootlesskit
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
rpm
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
rssguard
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
runc
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
rygel
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
samba-bgqd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
samba-dcerpcd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
samba-rpcd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
samba-rpcd-classic
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
samba-rpcd-spoolss
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbin.klogd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbin.syslog-ng
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbin.syslogd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-abort
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-adduser
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-apt
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-checkpackages
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-clean
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-createchroot
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-destroychroot
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-distupgrade
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-hold
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-shell
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-unhold
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-update
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
sbuild-upgrade
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
scide
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
signal-desktop
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
slack
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
slirp4netns
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
ssh-keyscan
profiles/apparmor.d: remove file access
2025-05-06 08:57:57 +10:00
staticd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
steam
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
stress-ng
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
surfshark
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
systemd-coredump
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
systemd-detect-virt
profiles: add a systemd-detect-virt profile
2025-04-22 10:34:36 -07:00
tar
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
thunderbird
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
tinyproxy
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
tnftp
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
transmission
Merge Enforce Transmission Profile
2025-05-12 14:06:46 +00:00
trinity
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
tshark
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
tup
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
tuxedo-control-center
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
unix-chkpwd
unix-chkpwd: Add read capability to profile
2025-05-12 15:53:33 +00:00
unprivileged_userns
unprivileged_userns profile: Allow full file system access
2025-04-11 09:02:49 +02:00
userbindmount
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.bin.hwctl
profiles: provide backwards compat for hwctl profile
2025-05-30 13:24:17 -07:00
usr.lib.apache2.mpm-prefork.apache2
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.anvil
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.auth
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.config
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.deliver
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.dict
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.director
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.doveadm-server
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.dovecot-auth
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.dovecot-lda
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.imap
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.imap-login
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.lmtp
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.log
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.managesieve
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.managesieve-login
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.pop3
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.pop3-login
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.replicator
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.script-login
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.ssl-params
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.lib.dovecot.stats
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.apache2
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.avahi-daemon
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.dnsmasq
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.dovecot
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.identd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.mdnsd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.nmbd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.nscd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.ntpd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.smbd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.smbldap-useradd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.traceroute
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
usr.sbin.winbindd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
uwsgi-core
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
vdens
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
virtiofsd
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
vivaldi-bin
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
vpnns
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
vrrpd
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
wg
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
wg-quick
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
who
profiles: add a who profile
2025-05-12 15:42:24 +02:00
wike
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
wpa_supplicant
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
wpcom
profiles: update the rest of the profiles to use @{exec_path}
2025-05-09 03:53:05 -07:00
Xorg
Merge profiles: also confine Xorg.wrap in addition to Xorg
2025-05-12 06:43:27 -07:00
zgrep
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00
znc
profiles: update set of profiles updated in MR:1637 to use @{exec_path}
2025-05-09 03:53:05 -07:00