I Wrote An Apparmor Profile For Chrome
EDIT: This profile got wayyyyyy out of hand. To the point where it can’t possibly be worth it. I suggest using variables to avoid 90% of this profile – you still don’t need to pull abstractions. I’m leaving it up because it’s still fairly comprehensive, and someone may want to build on it.
A feature of Apparmor is that you can import what are known as ‘abstractions’. These abstractions are profiles of their own and when you import an abstraction to a programs profile that program gains the ruleset defined by the abstraction. So if <abstraction/xyz> has ‘/etc/** r,’ and you import it to your Chrome profile you allow Chrome to read all of /etc/ ‘s subdirectories.
The default Chromium profile has a lot of abstractions.
Namely:
<abstractions/audio>
<abstractions/base>
<abstractions/cups-client>
<abstractions/dbus-session>
<abstractions/fonts>
<abstractions/freedesktop.org>
<abstractions/gnome>
<abstractions/nameservice>
<abstractions/user-tmp>
Abstractions can pull in other abstractions so you end up with this whole obfuscated and encapsulated area of your profile that potentially includes a number of rules you don’t need. It also makes things really complicated and difficult to follow. When <abstraction/base> is also pulling in <abstraction/X> or whatever it makes things really difficult to keep track of.
A complicated policy is oftentimes a weak policy. While complexity can lead to fine granularity in this case it leads to looser profiles and confusion.
Because of this I sought out to remove as many abstraction as possible. I actually managed to remove them all. Because I removed cupsd this profile is somewhat specific to me but for anyone looking to start off a Chrome apparmor profile without abstractions this’ll be a nice starting place. I may update it in the future – I try to avoid having places that can be written to also be places that can be mmap’d, though this is obviously impossible to eliminate due to caches.
The child processes can currently lead to slight privilege escalation. Working on that.
There are three profiles. One is for Native Client, one is for the Chrome Sandbox process, and one is for the browser processes (it can call itself with ix rule). I haven’t finished the Native Client profile yet.
I also might have some redundant rules. It’s not the cleanest because it’s so large – I’ll clean it up later.
It also assumes Java is installed.
It also assumes a 64bit Chrome and Linux install. As I said this is highly specific. If you’re looking to create a 32bit Chrome profile check out this guide:
https://insanitybit.wordpress.com/2012/05/29/apparmor-how-to/
Chrome Sandbox:
Last Modified: Tue Sep 11 20:58:31 2012
#include <tunables/global>
/opt/google/chrome/chrome-sandbox flags=(complain) {
Be fanatical since it is setuid root and don’t use an abstraction
/lib/libgcc_s.so* mr,
/lib{,32,64}/libm-.so mr,
/lib/@{multiarch}/libm-.so mr,
/lib{,32,64}/libpthread-.so mr,
/lib/@{multiarch}/libpthread-.so mr,
/lib{,32,64}/libc-.so mr,
/lib/@{multiarch}/libc-.so mr,
/lib{,32,64}/libld-.so mr,
/lib/@{multiarch}/libld-.so mr,
/lib{,32,64}/ld-.so mr,
/lib/@{multiarch}/ld-.so mr,
/lib/tls//{cmov,nosegneg}/libm-.so* mr,
/lib/tls//{cmov,nosegneg}/libpthread-.so* mr,
/lib/tls//{cmov,nosegneg}/libc-.so* mr,
/usr/lib/libstdc++.so* mr,
/etc/ld.so.cache r,Required for dropping into PID namespace. Keep in mind that until the
process drops this capability it can escape confinement, but once it
drops CAP_SYS_ADMIN we are ok.
capability sys_admin,
All of these are for sanely dropping from root and chrooting
capability chown,
capability fsetid,
capability setgid,
capability setuid,
capability dac_override,
capability sys_chroot,Sigh
capability sys_ptrace,
@{PROC}/ r,
@{PROC}/[0-9]/ r,
@{PROC}/[0-9]/fd/ r,
@{PROC}/[0-9]/oom_adj w,
@{PROC}/[0-9]/oom_score_adj w,
@{PROC}/[0-9]/task/[0-9]/stat r,/opt/google/chrome rm,
/opt/google/chrome/chrome rmPx,
/opt/google/chrome/chrome-sandbox r,owner /tmp/** rw,
}
Chrome:
Last Modified: Sat Dec 8 23:49:49 2012
#include <tunables/global>
/opt/google/chrome/chrome {
capability sys_ptrace,network inet dgram,
network inet stream,
network inet tcp,
network inet6 stream,
network inet6 tcp,
/bin/grep rix,
/bin/mkdir rCx,
/bin/mv rCx,
/bin/readlink rCx,
/bin/sed rix,
/bin/which rCx,
/dev/ r,
/dev/dri/card* rw,
/dev/null rw,
/dev/ptmx rw,
/dev/random r,
/dev/snd/controlC* rw,
/dev/snd/pcm* rw,
/dev/snd/timer r,
/dev/tty rw,
/dev/urandom r,
/dev/video* r,
/etc/fonts/** r,
/etc/fstab r,
/etc/gai.conf r,
/etc/group r,
/etc/host.conf r,
/etc/hosts mr,
/etc/ld.so.cache mr,
/etc/locale.alias r,
/etc/localtime r,
/etc/lsb-release r,
/etc/mtab r,
/etc/nsswitch.conf r,
/etc/opt/chrome/policies/managed/ r,
/etc/opt/chrome/policies/managed/.json r,
/etc/opt/chrome/policies/recommended/ r,
/etc/opt/chrome/policies/recommended/.json r,
/etc/passwd mr,
/etc/pkcs11/modules/ r,
/etc/pulse/client.conf r,
/etc/python/sitecustomize.py r,
/etc/udev/udev.conf r,
/home//.Xauthority r,
owner /home//.cache/dconf/user mrw,
/home//.config/dconf/user r,
/home//.config/google-chrome/** rwk,
/home//.gtk-bookmarks r,
/home//.java/deployment/deployment.properties rwk,
/home//.local/share/icons/ r,
/home//.local/share/icons///apps/ r,
/home//.local/share/mime/* mr,
/home//.local/share/recently-used.xbel rw,
/home//.local/share/recently-used.xbel.* rw,
/home//.mozilla/firefox/.default/.ini r,
/home//.mozilla/firefox/profiles.ini r,
/home//.pki/nssdb/cert9.db rwk,
/home//.pki/nssdb/key4.db rwk,
/home//.pki/nssdb/pkcs11.txt rw,
/home//.pulse-cookie rwk,
/home//.pulse/ r,
/home//.thumbnails/normal/* r,
/home//Documents/Misc/** r,
/home//Documents/Misc/C++/** mrk,
/home//Downloads/ r,
/home//Downloads/** rw,
/home//Pictures/ r,
/home//Pictures/** rw,
/lib/libnss_mdns_minimal.so. mr,
/lib/x8664-linux-gnu/ld-*.so mr,
/lib/x86_64-linux-gnu/libbz2.so.* mr,
/lib/x86_64-linux-gnu/libc-*.so mr,
/lib/x86_64-linux-gnu/libcom_err.so.* mr,
/lib/x86_64-linux-gnu/libdbus-*.so.* mr,
/lib/x86_64-linux-gnu/libdl-*.so mr,
/lib/x86_64-linux-gnu/libexpat.so.* mr,
/lib/x86_64-linux-gnu/libgcc_s.so.* mr,
/lib/x86_64-linux-gnu/libgcrypt.so.* mr,
/lib/x86_64-linux-gnu/libglib-*.so.* mr,
/lib/x86_64-linux-gnu/libgpg-error.so.* mr,
/lib/x86_64-linux-gnu/libkeyutils.so.* mr,
/lib/x86_64-linux-gnu/libm-*.so mr,
/lib/x86_64-linux-gnu/libnsl-*.so mr,
/lib/x86_64-linux-gnu/libnss_compat-*.so mr,
/lib/x86_64-linux-gnu/libnss_dns-*.so mr,
/lib/x86_64-linux-gnu/libnss_files-*.so mr,
/lib/x86_64-linux-gnu/libnss_nis-*.so mr,
/lib/x86_64-linux-gnu/libpci.so.* mr,
/lib/x86_64-linux-gnu/libpcre.so.* mr,
/lib/x86_64-linux-gnu/libpng*.so.* mr,
/lib/x86_64-linux-gnu/libpthread-*.so mr,
/lib/x86_64-linux-gnu/libresolv-*.so mr,
/lib/x86_64-linux-gnu/librt-*.so mr,
/lib/x86_64-linux-gnu/libselinux.so.* mr,
/lib/x86_64-linux-gnu/libtinfo.so.* mr,
/lib/x86_64-linux-gnu/libudev.so.* mr,
/lib/x86_64-linux-gnu/libwrap.so.* mr,
/lib/x86_64-linux-gnu/libz.so.* mr,
/media/** r,
owner /opt/google/chrome/*.png r,
/opt/google/chrome/PepperFlash/libpepflashplayer.so mr,
/opt/google/chrome/chrome mrix,
/opt/google/chrome/chrome-sandbox mrPx,
/opt/google/chrome/chrome.pak r,
/opt/google/chrome/chrome_percent.pak r,
/opt/google/chrome/default_apps/ r,
/opt/google/chrome/default_apps/.json rw,
/opt/google/chrome/extensions/ rw,
/opt/google/chrome/google-chrome rix,
/opt/google/chrome/libffmpegsumo.so mr,
/opt/google/chrome/libpdf.so mr,
/opt/google/chrome/libppGoogleNaClPluginChrome.so mr,
/opt/google/chrome/locales/en-US.pak r,
/opt/google/chrome/nacl_helper_bootstrap Px,
/opt/google/chrome/nacl_irt_x8664.nexe r,
/opt/google/chrome/resources.pak r,
/opt/google/chrome/theme_resources_percent.pak r,
/opt/google/chrome/ui_resources__percent.pak r,
/run/resolvconf/resolv.conf r,
/run/shm/ r,
/run/shm/.com.google.Chrome.* rw,
/run/shm/com.google.Chrome.shmem.._service_shmem rw,
/run/shm/pulse-shm- rw,
/run/udev/data/* r,
/run/user//dconf/user rw,
/selinux/ r,
/sys/bus/pci/devices/ r,
/sys/devices/** r,
/tmp/ r,
/tmp/ w,
/tmp/** rw,
/usr/bin/basename rix,
/usr/bin/cut rix,
/usr/bin/dbus-launch Cx,
/usr/bin/dirname rCx,
/usr/bin/lsb_release rCx,
/usr/bin/xdg-desktop-menu Cx,
/usr/bin/xdg-open rCx,
/usr/bin/xdg-settings rCx,
/usr/include/python/pyconfig.h r,
/usr/lib/gtk-//menuproxies/libappmenu.so mr,
/usr/lib/jvm/java--oracle/jre/bin/java mrPx,
/usr/lib/jvm/java--oracle/jre/lib/** mr,
/usr/lib/libdee-.so.* mr,
/usr/lib/libicudata.so.* mr,
/usr/lib/libicui18n.so.* mr,
/usr/lib/libicuuc.so.* mr,
/usr/lib/liboverlay-scrollbar.so. mr,
/usr/lib/libunity.so.* mr,
/usr/lib/locale/** mr,
/usr/lib/mozilla/plugins/ r,
/usr/lib/x86_64-linux-gnu///modules/.so mr,
/usr/lib/x86_64-linux-gnu/alsa-lib/libasound_module_conf_pulse.so mr,
/usr/lib/x86_64-linux-gnu/alsa-lib/libasound_module_pcm_pulse.so mr,
/usr/lib/x86_64-linux-gnu/alsa-lib/libasound_module_rate_speexrate.so mr,
/usr/lib/x86_64-linux-gnu/dri/libdricore.so mr,
/usr/lib/x86_64-linux-gnu/dri/libgallium.so mr,
/usr/lib/x86_64-linux-gnu/dri/libglsl.so mr,
/usr/lib/x86_64-linux-gnu/dri/r_dri.so mr,
/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so mr,
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules mr,
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache mr,
/usr/lib/x86_64-linux-gnu/gdk-pixbuf-//loaders.cache mr,
/usr/lib/x86_64-linux-gnu/gdk-pixbuf-//loaders/libpixbufloader-png.so mr,
/usr/lib/x86_64-linux-gnu/gdk-pixbuf-//loaders/libpixbufloader-svg.so mr,
/usr/lib/x86_64-linux-gnu/gio/modules/ r,
/usr/lib/x86_64-linux-gnu/gio/modules/giomodule.cache mr,
/usr/lib/x86_64-linux-gnu/gio/modules/libdconfsettings.so mr,
/usr/lib/x86_64-linux-gnu/gio/modules/libgiognutls.so mr,
/usr/lib/x86_64-linux-gnu/gio/modules/libgiolibproxy.so mr,
/usr/lib/x86_64-linux-gnu/gio/modules/libgioremote-volume-monitor.so mr,
/usr/lib/x86_64-linux-gnu/gio/modules/libgvfsdbus.so mr,
/usr/lib/x86_64-linux-gnu/gtk-//engines/libmurrine.so mr,
/usr/lib/x86_64-linux-gnu/gtk-//gtk.immodules mr,
/usr/lib/x86_64-linux-gnu/gtk-//menuproxies/libappmenu.so mr,
/usr/lib/x86_64-linux-gnu/gtk-//printbackends/libprintbackend-cups.so mr,
/usr/lib/x86_64-linux-gnu/gtk-//printbackends/libprintbackend-file.so mr,
/usr/lib/x86_64-linux-gnu/gtk-/modules/libcanberra-gtk-module.so mr,
/usr/lib/x86_64-linux-gnu/gtk-/modules/liboverlay-scrollbar.so mr,
/usr/lib/x86_64-linux-gnu/gvfs/libgvfscommon.so mr,
/usr/lib/x86_64-linux-gnu/libFLAC.so. mr,
/usr/lib/x86_64-linux-gnu/libLLVM-.so. mr,
/usr/lib/x86_64-linux-gnu/libX11-xcb.so.* mr,
/usr/lib/x86_64-linux-gnu/libX11.so.* mr,
/usr/lib/x86_64-linux-gnu/libXau.so.* mr,
/usr/lib/x86_64-linux-gnu/libXcomposite.so.* mr,
/usr/lib/x86_64-linux-gnu/libXcursor.so.* mr,
/usr/lib/x86_64-linux-gnu/libXdamage.so.* mr,
/usr/lib/x86_64-linux-gnu/libXdmcp.so.* mr,
/usr/lib/x86_64-linux-gnu/libXext.so.* mr,
/usr/lib/x86_64-linux-gnu/libXfixes.so.* mr,
/usr/lib/x86_64-linux-gnu/libXi.so.* mr,
/usr/lib/x86_64-linux-gnu/libXinerama.so.* mr,
/usr/lib/x86_64-linux-gnu/libXrandr.so.* mr,
/usr/lib/x86_64-linux-gnu/libXrender.so.* mr,
/usr/lib/x86_64-linux-gnu/libXss.so.* mr,
/usr/lib/x86_64-linux-gnu/libXxf86vm.so.* mr,
/usr/lib/x86_64-linux-gnu/libasound.so.* mr,
/usr/lib/x86_64-linux-gnu/libasyncns.so.* mr,
/usr/lib/x86_64-linux-gnu/libatk-.so. mr,
/usr/lib/x86_64-linux-gnu/libavahi-client.so.* mr,
/usr/lib/x86_64-linux-gnu/libavahi-common.so.* mr,
/usr/lib/x86_64-linux-gnu/libcairo.so.* mr,
/usr/lib/x86_64-linux-gnu/libcanberra-/libcanberra-alsa.so mr,
/usr/lib/x86_64-linux-gnu/libcanberra-/libcanberra-pulse.so mr,
/usr/lib/x86_64-linux-gnu/libcanberra-gtk.so.* mr,
/usr/lib/x86_64-linux-gnu/libcanberra.so.* mr,
/usr/lib/x86_64-linux-gnu/libcroco-.so. mr,
/usr/lib/x86_64-linux-gnu/libcups.so.* mr,
/usr/lib/x86_64-linux-gnu/libdbus-glib-.so. mr,
/usr/lib/x86_64-linux-gnu/libdbusmenu-glib.so.* mr,
/usr/lib/x86_64-linux-gnu/libdbusmenu-gtk.so.* mr,
/usr/lib/x86_64-linux-gnu/libdrm.so.* mr,
/usr/lib/x86_64-linux-gnu/libdrm_radeon.so.* r,
/usr/lib/x86_64-linux-gnu/libffi.so.* mr,
/usr/lib/x86_64-linux-gnu/libfontconfig.so.* mr,
/usr/lib/x86_64-linux-gnu/libfreetype.so.* mr,
/usr/lib/x86_64-linux-gnu/libgconf-.so. mr,
/usr/lib/x86_64-linux-gnu/libgdk-x11-.so. mr,
/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-.so. mr,
/usr/lib/x86_64-linux-gnu/libgee.so.* mr,
/usr/lib/x86_64-linux-gnu/libgio-.so. mr,
/usr/lib/x86_64-linux-gnu/libglapi.so.* mr,
/usr/lib/x86_64-linux-gnu/libgmodule-.so. mr,
/usr/lib/x86_64-linux-gnu/libgnome-keyring.so.* mr,
/usr/lib/x86_64-linux-gnu/libgnutls.so.* mr,
/usr/lib/x86_64-linux-gnu/libgobject-.so. mr,
/usr/lib/x86_64-linux-gnu/libgssapi_krb.so. mr,
/usr/lib/x86_64-linux-gnu/libgthread-.so. mr,
/usr/lib/x86_64-linux-gnu/libgtk-x-.so.* mr,
/usr/lib/x86_64-linux-gnu/libibus-..so.* mr,
/usr/lib/x86_64-linux-gnu/libjson.so.* mr,
/usr/lib/x86_64-linux-gnu/libk5crypto.so.* mr,
/usr/lib/x86_64-linux-gnu/libkrb5.so.* mr,
/usr/lib/x86_64-linux-gnu/libkrb5support.so.* mr,
/usr/lib/x86_64-linux-gnu/libltdl.so.* mr,
/usr/lib/x86_64-linux-gnu/libnspr.so mr,
/usr/lib/x86_64-linux-gnu/libnss.so mr,
/usr/lib/x86_64-linux-gnu/libogg.so.* mr,
/usr/lib/x86_64-linux-gnu/libp-kit.so. mr,
/usr/lib/x86_64-linux-gnu/libpango-.so. mr,
/usr/lib/x86_64-linux-gnu/libpangocairo-.so. mr,
/usr/lib/x86_64-linux-gnu/libpangoft-.so.* mr,
/usr/lib/x86_64-linux-gnu/libpixman-.so. mr,
/usr/lib/x86_64-linux-gnu/libplc.so mr,
/usr/lib/x86_64-linux-gnu/libplds.so mr,
/usr/lib/x86_64-linux-gnu/libpulse.so.* mr,
/usr/lib/x86_64-linux-gnu/libpulsecommon-.so mr,
/usr/lib/x86_64-linux-gnu/librsvg-2.o.* mr,
/usr/lib/x86_64-linux-gnu/libsmime.so mr,
/usr/lib/x86_64-linux-gnu/libsndfile.so. mr,
/usr/lib/x86_64-linux-gnu/libspeexdsp.so.* mr,
/usr/lib/x86_64-linux-gnu/libsqlite.so. mr,
/usr/lib/x86_64-linux-gnu/libstdc.so. mr,
/usr/lib/x86_64-linux-gnu/libtasn1.so.* mr,
/usr/lib/x86_64-linux-gnu/libtdb.so.* mr,
/usr/lib/x86_64-linux-gnu/libtxc_dxtn_s2tc.so.* mr,
/usr/lib/x86_64-linux-gnu/libunity.so.* r,
/usr/lib/x86_64-linux-gnu/libvorbis.so.* mr,
/usr/lib/x86_64-linux-gnu/libvorbisenc.so.* mr,
/usr/lib/x86_64-linux-gnu/libvorbisfile.so.* mr,
/usr/lib/x86_64-linux-gnu/libxcb-glx.so.* mr,
/usr/lib/x86_64-linux-gnu/libxcb-render.so.* mr,
/usr/lib/x86_64-linux-gnu/libxcb-shm.so.* mr,
/usr/lib/x86_64-linux-gnu/libxcb.so.* mr,
/usr/lib/x86_64-linux-gnu/libxml2.so.* mr,
/usr/lib/x86_64-linux-gnu/mesa/libGL.so.* mr,
/usr/lib/x86_64-linux-gnu/nss/libfreebl.so mr,
/usr/lib/x86_64-linux-gnu/nss/libnssckbi.so mr,
/usr/lib/x86_64-linux-gnu/nss/libsoftokn.so mr,
/usr/lib/x86_64-linux-gnu/pango//module-files.d/ r,
/usr/lib/x86_64-linux-gnu/pango//module-files.d/libpango..modules mr,
/usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-.so mr,
/usr/local/lib/python/dist-packages/ r,
/usr/local/share/fonts/ r,
/usr/local/share/icons/ r,
/usr/local/share/icons/hicolor//apps/ r,
/usr/local/share/icons/hicolor//apps/chrome.png r,
/usr/local/share/icons/hicolor/scalable/apps/ r,
/usr/share/** r,
/var/cache//.cache- mr,
/var/lib/dbus/machine-id r,
/var/tmp/ r,
/var/tmp/** rw,
/{,var/}run/mdnsd rw,
/{,var/}run/utmp r,
owner @{HOME}/.cache/** mrw,
owner @{HOME}/.config/** mrw,
owner @{HOME}/.local/share/applications/ w,
owner @{HOME}/.local/share/applications/mimeapps.list* rw,
@{PROC}/ r,
@{PROC}//auxv r,
@{PROC}//coredump_filter rw,
@{PROC}//maps r,
@{PROC}/[0-9]/cmdline r,
@{PROC}/[0-9]/fd/ r,
@{PROC}/[0-9]/io r,
@{PROC}/[0-9]/net/if_inet6 r,
@{PROC}/[0-9]/net/ipv6_route r,
@{PROC}/[0-9]/oom_score_adj w,
@{PROC}/[0-9]/stat r,
@{PROC}/[0-9]/statm r,
@{PROC}/[0-9]/status r,
@{PROC}/[0-9]/task/ r,
@{PROC}/[0-9]/task//stat r,
@{PROC}/[0-9]/task/[0-9]*/stat r,
@{PROC}/cpuinfo r,
@{PROC}/filesystems r,
@{PROC}/meminfo r,
@{PROC}/sys/kernel/shmmax r,
profile /bin/mkdir {/bin/mkdir r,
/etc/ld.so.cache mr,
/lib/x86_64-linux-gnu/ld.so mr,
/lib/x86_64-linux-gnu/libc.so mr,
/lib/x86_64-linux-gnu/libdl.so mr,
/lib/x86_64-linux-gnu/libselinux.so mr,
/proc/filesystems r,
/usr/lib/locale/locale-archive r,}
profile /bin/readlink {
/bin/readlink r,
/etc/ld.so.cache mr,
/lib/x86_64-linux-gnu/ld.so mr,
/lib/x86_64-linux-gnu/libc-.so mr,
/usr/lib/locale/locale-archive r,}
profile /bin/which {
/bin/dash r,
/bin/which r,
/dev/null rw,
/etc/ld.so.cache mr,
/lib/x86_64-linux-gnu/ld-.so mr,
/lib/x86_64-linux-gnu/libc-.so mr,}
profile /usr/bin/dbus-launch {
}profile /usr/bin/dirname {
/etc/ld.so.cache mr,
/lib/x86_64-linux-gnu/ld-.so mr,
/lib/x86_64-linux-gnu/libc-.so mr,
/usr/bin/dirname r,
/usr/lib/locale/locale-archive r,}
profile /usr/bin/lsb_release {
/dev/null rw,
/etc/default/apport r,
/etc/ld.so.cache mr,
/etc/python2.7/sitecustomize.py r,
/etc/python3.2/sitecustomize.py r,
/lib/x86_64-linux-gnu/ld-.so mr,
/lib/x86_64-linux-gnu/libc-.so mr,
/lib/x86_64-linux-gnu/libcrypto.so.* mr,
/lib/x86_64-linux-gnu/libdl-.so mr,
/lib/x86_64-linux-gnu/libexpat.so. mr,
/lib/x86_64-linux-gnu/libgcc_s.so.* mr,
/lib/x86_64-linux-gnu/libm-.so mr,
/lib/x86_64-linux-gnu/libpthread-.so mr,
/lib/x86_64-linux-gnu/libssl.so.* mr,
/lib/x86_64-linux-gnu/libutil-.so mr,
/lib/x86_64-linux-gnu/libz.so. mr,
/proc/meminfo r,
/usr/bin/lsb_release r,
/usr/bin/python* r,
/usr/include/python2.7/pyconfig.h r,
/usr/lib/locale/locale-archive r,
/usr/lib/pymodules/python2.7/.path r,
/usr/lib/python/UserDict.py r,
/usr/lib/python/UserDict.pyc r,
/usr/lib/python/_abcoll.py r,
/usr/lib/python/_abcoll.pyc r,
/usr/lib/python/abc.py r,
/usr/lib/python/abc.pyc r,
/usr/lib/python/genericpath.py r,
/usr/lib/python/genericpath.pyc r,
/usr/lib/python/linecache.py r,
/usr/lib/python/linecache.pyc r,
/usr/lib/python/os.py r,
/usr/lib/python/os.pyc r,
/usr/lib/python/posixpath.py r,
/usr/lib/python/posixpath.pyc r,
/usr/lib/python/site.py r,
/usr/lib/python/site.pyc r,
/usr/lib/python/stat.py r,
/usr/lib/python/stat.pyc r,
/usr/lib/python/types.py r,
/usr/lib/python/types.pyc r,
/usr/lib/python/warnings.py r,
/usr/lib/python/warnings.pyc r,
/usr/lib/python2.7/_weakrefset.py r,
/usr/lib/python2.7/_weakrefset.pyc r,
/usr/lib/python2.7/codecs.py r,
/usr/lib/python2.7/codecs.pyc r,
/usr/lib/python2.7/commands.py r,
/usr/lib/python2.7/commands.pyc r,
/usr/lib/python2.7/config/Makefile r,
/usr/lib/python2.7/copy.py r,
/usr/lib/python2.7/copy.pyc r,
/usr/lib/python2.7/copy_reg.py r,
/usr/lib/python2.7/copy_reg.pyc r,
/usr/lib/python2.7/dist-packages/ r,
/usr/lib/python2.7/dist-packages/apport/init.pyc r,
/usr/lib/python2.7/dist-packages/apport/fileutils.pyc r,
/usr/lib/python2.7/dist-packages/apport/report.pyc rw,
/usr/lib/python2.7/dist-packages/apport_python_hook.pyc r,
/usr/lib/python2.7/dist-packages/lsb_release.pyc r,
/usr/lib/python2.7/encodings/init.py r,
/usr/lib/python2.7/encodings/init.pyc r,
/usr/lib/python2.7/encodings/aliases.py r,
/usr/lib/python2.7/encodings/aliases.pyc r,
/usr/lib/python2.7/encodings/utf_8.py r,
/usr/lib/python2.7/encodings/utf_8.pyc r,
/usr/lib/python2.7/functools.py r,
/usr/lib/python2.7/functools.pyc r,
/usr/lib/python2.7/gettext.py r,
/usr/lib/python2.7/gettext.pyc r,
/usr/lib/python2.7/locale.py r,
/usr/lib/python2.7/locale.pyc r,
/usr/lib/python2.7/optparse.py r,
/usr/lib/python2.7/optparse.pyc r,
/usr/lib/python2.7/re.py r,
/usr/lib/python2.7/re.pyc r,
/usr/lib/python2.7/sitecustomize.pyc r,
/usr/lib/python2.7/sre_compile.py r,
/usr/lib/python2.7/sre_compile.pyc r,
/usr/lib/python2.7/sre_constants.py r,
/usr/lib/python2.7/sre_constants.pyc r,
/usr/lib/python2.7/sre_parse.py r,
/usr/lib/python2.7/sre_parse.pyc r,
/usr/lib/python2.7/string.py r,
/usr/lib/python2.7/string.pyc r,
/usr/lib/python2.7/struct.py r,
/usr/lib/python2.7/struct.pyc r,
/usr/lib/python2.7/sysconfig.py r,
/usr/lib/python2.7/sysconfig.pyc r,
/usr/lib/python2.7/textwrap.py r,
/usr/lib/python2.7/textwrap.pyc r,
/usr/lib/python2.7/traceback.py r,
/usr/lib/python2.7/traceback.pyc r,
/usr/lib/python2.7/weakref.py r,
/usr/lib/python2.7/weakref.pyc r,
/usr/lib/python3.2/pycache/* r,
/usr/lib/python3.2/codecs.py r,
/usr/lib/python3.2/encodings/* r,
/usr/lib/python3.2/encodings/pycache/* rw,
/usr/lib/python3.2/fnmatch.py r,
/usr/lib/python3.2/glob.py r,
/usr/lib/python3.2/io.py r,
/usr/lib/python3.2/optparse.py r,
/usr/lib/python3/dist-packages/pycache/* r,
/usr/lib/python3/dist-packages/apport_python_hook.py r,
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules r,
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache r,
/usr/local/lib/python2.7/dist-packages/ r,
/usr/share/pyshared/PIL.pth r,
/usr/share/pyshared/apport/init.py r,
/usr/share/pyshared/apport/fileutils.py r,
/usr/share/pyshared/apport/report.py r,
/usr/share/pyshared/apport_python_hook.py r,
/usr/share/pyshared/gtk-2.0-pysupport-compat.pth r,
/usr/share/pyshared/lazr.restfulclient-0.12.0-nspkg.pth r,
/usr/share/pyshared/lazr.uri-1.0.3-nspkg.pth r,
/usr/share/pyshared/lsb_release.py r,
/usr/share/pyshared/pygst.pth r,
/usr/share/pyshared/pygtk.pth r,
/usr/share/pyshared/ubuntu-sso-client.pth r,
/usr/share/pyshared/ubuntuone-installer.pth r,
/usr/share/pyshared/zope.interface-3.6.1-nspkg.pth r,}
profile /usr/bin/xdg-desktop-menu {
}profile /usr/bin/xdg-open {
/bin/dash r,
/etc/ld.so.cache mr,
/lib/x86_64-linux-gnu/ld-.so mr,
/lib/x86_64-linux-gnu/libc-.so mr,}
profile /usr/bin/xdg-settings {
/bin/dash r,
/bin/grep rix,
/bin/mkdir rix,
/bin/mv rix,
/bin/readlink rix,
/bin/sed rix,
/bin/touch rix,
/bin/which rix,
/dev/null rw,
/etc/gnome/defaults.list r,
/etc/ld.so.cache mr,
/etc/locale.alias r,
/home//.local/share/applications/ rw,
/home//.local/share/applications/mimeapps.list rw,
/home//.local/share/applications/mimeapps.list.new w,
/lib/x86_64-linux-gnu/ld-.so mr,
/lib/x86_64-linux-gnu/libc-.so mr,
/lib/x86_64-linux-gnu/libdbus-.so.* mr,
/lib/x86_64-linux-gnu/libdl-.so mr,
/lib/x86_64-linux-gnu/libglib-.so.* mr,
/lib/x86_64-linux-gnu/liblzma.so.* mr,
/lib/x86_64-linux-gnu/libm-.so mr,
/lib/x86_64-linux-gnu/libpcre.so. mr,
/lib/x86_64-linux-gnu/libpthread-.so mr,
/lib/x86_64-linux-gnu/libresolv-.so mr,
/lib/x86_64-linux-gnu/librt-.so mr,
/lib/x86_64-linux-gnu/libselinux.so. mr,
/lib/x86_64-linux-gnu/libz.so.* mr,
/proc//maps r,
/proc/filesystems r,
/usr/bin/basename rix,
/usr/bin/cut rix,
/usr/bin/dirname rix,
/usr/bin/gawk rix,
/usr/bin/gconftool-2 rix,
/usr/bin/mawk rix,
/usr/bin/xdg-mime rix,
/usr/bin/xdg-settings r,
/usr/lib/libsigsegv.so. mr,
/usr/lib/locale/** r,
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules mr,
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache mr,
/usr/lib/x86_64-linux-gnu/libdbus-glib-1.so.* mr,
/usr/lib/x86_64-linux-gnu/libffi.so.* mr,
/usr/lib/x86_64-linux-gnu/libgconf-.so. mr,
/usr/lib/x86_64-linux-gnu/libgio-.so. mr,
/usr/lib/x86_64-linux-gnu/libgmodule-.so. mr,
/usr/lib/x86_64-linux-gnu/libgobject-.so. mr,
/usr/lib/x86_64-linux-gnu/libgthread-.so. mr,
/usr/lib/x86_64-linux-gnu/libxml.so. mr,
/usr/local/share/applications/google-chrome.desktop r,
/usr/share/applications/google-chrome.desktop r,}
}In all honesty the abstractions included aren’t going to open huge holes with Ux or anything. They mostly just give read and mmap access to shared libraries or other specific areas. But that’s still plenty dangerous and every file contains potentially useful information for an attacker or potentially exploitable code. Even something as simple as restricting read access to */apps/, which does nothing but hold icons should be enforced – maybe an attacker would use that area to find out what else is installed etc. It’s not about paranoia it’s just about consistently enforcing least privilege. You have to assume that any piece of information available to an attacker can be used against you. Or you don’t, it’s also largely about how bored you are and how much time you have. Regardless, I like my profile.
blog comments powered by Disqus