github.com/anonymouse64/snapd@v0.0.0-20210824153203-04c4c42d842d/interfaces/apparmor/template.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2020 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package apparmor 21 22 // Rules for app snaps are comprised of: 23 // 24 // - preamble and rules common regardless of base runtime 25 // - base-specific runtime rules 26 // - snippet rules from interfaces, etc, regardless of base runtime 27 // 28 // As part of the mount namespace setup, some directories from the host will be 29 // bind mounted onto the base snap (these are defined by snap-confine). The 30 // locations of the target mounts that the snap sees at runtime are (for 31 // clarity, not all subdirectories are listed (eg, /var/lib/snapd/hostfs is not 32 // listed since /var/lib/snapd is)): 33 // 34 // - /dev 35 // - /etc 36 // - /home 37 // - /lib/modules and /usr/lib/modules 38 // - /lib/firmware and /usr/lib/firmware 39 // - /mnt, /media and /run/media 40 // - /proc 41 // - /root 42 // - /run 43 // - /snap and /var/snap 44 // - /sys 45 // - /usr/lib/snapd 46 // - /usr/src 47 // - /var/lib/dhcp 48 // - /var/lib/extrausers 49 // - /var/lib/jenkins 50 // - /var/lib/snapd 51 // - /var/log 52 // - /var/tmp 53 // 54 // For files coming from the host in this manner, accesses should be common to 55 // all bases, either via the template or interface rules (eg, given the same 56 // connected interfaces, access to devices in /dev should generally be the 57 // same, regardless of whether the snap specifies 'base: core18' or 58 // 'base: other'). 59 // 60 // The preamble and default accesses common to all bases go in templateCommon. 61 // These rules include the aformentioned host file rules as well as non-file 62 // rules (eg signal, dbus, unix, etc). 63 // 64 var templateCommon = ` 65 # vim:syntax=apparmor 66 67 #include <tunables/global> 68 69 # snapd supports the concept of 'parallel installs' where snaps with the same 70 # name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz 71 # may all be installed on the system. To support this, SNAP_NAME is set to the 72 # name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg 73 # 'foo_bar'). The profile name and most rules therefore reference 74 # SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime 75 # environment so the snap doesn't have to be aware of the distinction (eg, 76 # SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with 77 # SNAP_NAME so the security policy will allow writing to both locations (since 78 # they are equivalent). 79 80 ###VAR### 81 82 ###PROFILEATTACH### (attach_disconnected,mediate_deleted) { 83 #include <abstractions/base> 84 #include <abstractions/consoles> 85 #include <abstractions/openssl> 86 87 # While in later versions of the base abstraction, include this explicitly 88 # for series 16 and cross-distro 89 /etc/ld.so.preload r, 90 91 # The base abstraction doesn't yet have this 92 /etc/sysconfig/clock r, 93 owner @{PROC}/@{pid}/maps k, 94 # While the base abstraction has rules for encryptfs encrypted home and 95 # private directories, it is missing rules for directory read on the toplevel 96 # directory of the mount (LP: #1848919) 97 owner @{HOME}/.Private/ r, 98 owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r, 99 100 # for python apps/services 101 #include <abstractions/python> 102 /etc/python3.[0-9]/** r, 103 104 # explicitly deny noisy denials to read-only filesystems (see LP: #1496895 105 # for details) 106 deny /usr/lib/python3*/{,**/}__pycache__/ w, 107 deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w, 108 # bind mount used here (see 'parallel installs', above) 109 deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/ w, 110 deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w, 111 112 # for perl apps/services 113 #include <abstractions/perl> 114 # Missing from perl abstraction 115 /usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr, 116 117 # Note: the following dangerous accesses should not be allowed in most 118 # policy, but we cannot explicitly deny since other trusted interfaces might 119 # add them. 120 # Explicitly deny ptrace for now since it can be abused to break out of the 121 # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823 122 #audit deny ptrace (trace), 123 124 # Explicitly deny capability mknod so apps can't create devices 125 #audit deny capability mknod, 126 127 # Explicitly deny mount, remount and umount so apps can't modify things in 128 # their namespace 129 #audit deny mount, 130 #audit deny remount, 131 #audit deny umount, 132 133 # End dangerous accesses 134 135 # Note: this potentially allows snaps to DoS other snaps via resource 136 # exhaustion but we can't sensibly mediate this today. In the future we may 137 # employ cgroup limits, AppArmor rlimit mlock rules or something else. 138 capability ipc_lock, 139 140 # for bash 'binaries' (do *not* use abstractions/bash) 141 # user-specific bash files 142 /etc/bash.bashrc r, 143 /etc/inputrc r, 144 /etc/environment r, 145 /etc/profile r, 146 147 # user/group/seat lookups 148 /etc/{passwd,group,nsswitch.conf} r, # very common 149 /var/lib/extrausers/{passwd,group} r, 150 /run/systemd/users/[0-9]* r, 151 /etc/default/nss r, 152 153 # libnss-systemd (subset from nameservice abstraction) 154 # 155 # https://systemd.io/USER_GROUP_API/ 156 # https://systemd.io/USER_RECORD/ 157 # https://www.freedesktop.org/software/systemd/man/nss-systemd.html 158 # 159 # Allow User/Group lookups via common VarLink socket APIs. Applications need 160 # to either consult all of them or the io.systemd.Multiplexer frontend. 161 /run/systemd/userdb/ r, 162 /run/systemd/userdb/io.systemd.Multiplexer rw, 163 /run/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users 164 /run/systemd/userdb/io.systemd.Home rw, # systemd-home dirs 165 /run/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS 166 167 /etc/libnl-3/{classid,pktloc} r, # apps that use libnl 168 169 # For snappy reexec on 4.8+ kernels 170 /usr/lib/snapd/snap-exec m, 171 172 # For gdb support 173 /usr/lib/snapd/snap-gdb-shim ixr, 174 /usr/lib/snapd/snap-gdbserver-shim ixr, 175 176 # For in-snap tab completion 177 /etc/bash_completion.d/{,*} r, 178 /usr/lib/snapd/etelpmoc.sh ixr, # marshaller (see complete.sh for out-of-snap unmarshal) 179 /usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here 180 181 # uptime 182 @{PROC}/uptime r, 183 @{PROC}/loadavg r, 184 185 # Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib 186 # which is allowed by the base abstraction, but on 14.04 it is an actual file 187 # so need to add it here. Also allow read locks on the file. 188 /etc/os-release rk, 189 /usr/lib/os-release k, 190 191 # systemd native journal API (see sd_journal_print(4)). This should be in 192 # AppArmor's base abstraction, but until it is, include here. 193 /run/systemd/journal/socket w, 194 /run/systemd/journal/stdout rw, # 'r' shouldn't be needed, but journald 195 # doesn't leak anything so allow 196 197 # snapctl and its requirements 198 /usr/bin/snapctl ixr, 199 /usr/lib/snapd/snapctl ixr, 200 @{PROC}/sys/net/core/somaxconn r, 201 /run/snapd-snap.socket rw, 202 203 # Note: for now, don't explicitly deny this noisy denial so --devmode isn't 204 # broken but eventually we may conditionally deny this since it is an 205 # information leak. 206 #deny /{,var/}run/utmp r, 207 208 # java 209 @{PROC}/@{pid}/ r, 210 @{PROC}/@{pid}/fd/ r, 211 owner @{PROC}/@{pid}/auxv r, 212 @{PROC}/sys/vm/zone_reclaim_mode r, 213 /etc/lsb-release r, 214 /sys/devices/**/read_ahead_kb r, 215 /sys/devices/system/cpu/** r, 216 /sys/devices/system/node/node[0-9]*/* r, 217 /sys/kernel/mm/transparent_hugepage/enabled r, 218 /sys/kernel/mm/transparent_hugepage/defrag r, 219 # NOTE: this leaks running process but java seems to want it (even though it 220 # seems to operate ok without it) and SDL apps crash without it. Allow owner 221 # match until AppArmor kernel var is available to solve this properly (see 222 # LP: #1546825 for details). comm is a subset of cmdline, so allow it too. 223 owner @{PROC}/@{pid}/cmdline r, 224 owner @{PROC}/@{pid}/comm r, 225 226 # Per man(5) proc, the kernel enforces that a thread may only modify its comm 227 # value or those in its thread group. 228 owner @{PROC}/@{pid}/task/@{tid}/comm rw, 229 230 # Allow reading and writing to our file descriptors in /proc which, for 231 # example, allow access to /dev/std{in,out,err} which are all symlinks to 232 # /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE) 233 # linkat() temporary file technique, allow all fds. Importantly, access to 234 # another task's fd via this proc interface is mediated via 'ptrace (read)' 235 # (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so 236 # this rule by itself doesn't allow opening another snap's fds via proc. 237 owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw, 238 239 # Miscellaneous accesses 240 /dev/{,u}random w, 241 /etc/machine-id r, 242 /etc/mime.types r, 243 @{PROC}/ r, 244 @{PROC}/version r, 245 @{PROC}/version_signature r, 246 /etc/{,writable/}hostname r, 247 /etc/{,writable/}localtime r, 248 /etc/{,writable/}mailname r, 249 /etc/{,writable/}timezone r, 250 owner @{PROC}/@{pid}/cgroup rk, 251 @{PROC}/@{pid}/io r, 252 owner @{PROC}/@{pid}/limits r, 253 owner @{PROC}/@{pid}/loginuid r, 254 @{PROC}/@{pid}/smaps r, 255 @{PROC}/@{pid}/stat r, 256 @{PROC}/@{pid}/statm r, 257 @{PROC}/@{pid}/status r, 258 @{PROC}/@{pid}/task/ r, 259 @{PROC}/@{pid}/task/[0-9]*/smaps r, 260 @{PROC}/@{pid}/task/[0-9]*/stat r, 261 @{PROC}/@{pid}/task/[0-9]*/statm r, 262 @{PROC}/@{pid}/task/[0-9]*/status r, 263 @{PROC}/sys/fs/pipe-max-size r, 264 @{PROC}/sys/kernel/hostname r, 265 @{PROC}/sys/kernel/osrelease r, 266 @{PROC}/sys/kernel/ostype r, 267 @{PROC}/sys/kernel/pid_max r, 268 @{PROC}/sys/kernel/yama/ptrace_scope r, 269 @{PROC}/sys/kernel/shmmax r, 270 @{PROC}/sys/fs/file-max r, 271 @{PROC}/sys/fs/file-nr r, 272 @{PROC}/sys/fs/inotify/max_* r, 273 @{PROC}/sys/kernel/pid_max r, 274 @{PROC}/sys/kernel/random/boot_id r, 275 @{PROC}/sys/kernel/random/entropy_avail r, 276 @{PROC}/sys/kernel/random/uuid r, 277 # Allow access to the uuidd daemon (this daemon is a thin wrapper around 278 # time and getrandom()/{,u}random and, when available, runs under an 279 # unprivilged, dedicated user). 280 /run/uuidd/request rw, 281 /sys/devices/virtual/tty/{console,tty*}/active r, 282 /sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r, 283 /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r, 284 /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r, 285 /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r, 286 /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r, 287 /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r, 288 /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r, 289 /sys/module/apparmor/parameters/enabled r, 290 /{,usr/}lib/ r, 291 292 # Reads of oom_adj and oom_score_adj are safe 293 owner @{PROC}/@{pid}/oom_{,score_}adj r, 294 295 # Note: for now, don't explicitly deny write access so --devmode isn't broken 296 # but eventually we may conditionally deny this since it allows the process 297 # to increase the oom heuristic of other processes (make them more likely to 298 # be killed). Once AppArmor kernel var is available to solve this properly, 299 # this can safely be allowed since non-root processes won't be able to 300 # decrease the value and root processes will only be able to with 301 # 'capability sys_resource,' which we deny be default. 302 # deny owner @{PROC}/@{pid}/oom_{,score_}adj w, 303 304 # Eases hardware assignment (doesn't give anything away) 305 /etc/udev/udev.conf r, 306 /sys/ r, 307 /sys/bus/ r, 308 /sys/class/ r, 309 310 # this leaks interface names and stats, but not in a way that is traceable 311 # to the user/device 312 @{PROC}/net/dev r, 313 @{PROC}/@{pid}/net/dev r, 314 315 # Read-only of this snap 316 /var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r, 317 318 # Read-only of snapd restart state for snapctl specifically 319 /var/lib/snapd/maintenance.json r, 320 321 # Read-only for the install directory 322 # bind mount used here (see 'parallel installs', above) 323 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r, 324 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/ r, 325 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/** mrklix, 326 327 # Read-only install directory for other revisions to help with bugs like 328 # LP: #1616650 and LP: #1655992 329 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix, 330 331 # Read-only home area for other versions 332 # bind mount *not* used here (see 'parallel installs', above) 333 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/ r, 334 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/** mrkix, 335 336 # Writable home area for this version. 337 # bind mount *not* used here (see 'parallel installs', above) 338 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl, 339 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl, 340 341 # Read-only system area for other versions 342 # bind mount used here (see 'parallel installs', above) 343 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r, 344 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix, 345 346 # Writable system area only for this version 347 # bind mount used here (see 'parallel installs', above) 348 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl, 349 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl, 350 351 # The ubuntu-core-launcher creates an app-specific private restricted /tmp 352 # and will fail to launch the app if something goes wrong. As such, we can 353 # simply allow full access to /tmp. 354 /tmp/ r, 355 /tmp/** mrwlkix, 356 357 # App-specific access to files and directories in /dev/shm. We allow file 358 # access in /dev/shm for shm_open() and files in subdirectories for open() 359 # bind mount *not* used here (see 'parallel installs', above) 360 /{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix, 361 # Also allow app-specific access for sem_open() 362 /{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk, 363 364 # Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user 365 # bind mount *not* used here (see 'parallel installs', above) 366 owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/ rw, 367 owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix, 368 369 # Allow apps from the same package to communicate with each other via an 370 # abstract or anonymous socket 371 unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**", 372 unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*), 373 374 # Allow apps from the same package to communicate with each other via DBus. 375 # Note: this does not grant access to the DBus sockets of well known buses 376 # (will still need to use an appropriate interface for that). 377 dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*), 378 # In addition to the above, dbus-run-session attempts reading these files 379 # from the snap base runtime. 380 /usr/share/dbus-1/services/{,*} r, 381 /usr/share/dbus-1/system-services/{,*} r, 382 # Allow apps to perform DBus introspection on org.freedesktop.DBus for both 383 # the system and session buses. 384 # Note: this does not grant access to the DBus sockets of these buses, but 385 # we grant it here since it is missing from the dbus abstractions 386 # (LP: #1866168) 387 dbus (send) 388 bus={session,system} 389 path=/org/freedesktop/DBus 390 interface=org.freedesktop.DBus.Introspectable 391 member=Introspect 392 peer=(label=unconfined), 393 394 # Allow apps from the same package to signal each other via signals 395 signal peer=snap.@{SNAP_INSTANCE_NAME}.*, 396 397 # Allow receiving signals from all snaps (and focus on mediating sending of 398 # signals) 399 signal (receive) peer=snap.*, 400 401 # Allow receiving signals from unconfined (eg, systemd) 402 signal (receive) peer=unconfined, 403 404 # for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign' 405 /{,s}bin/udevadm ixr, 406 /etc/udev/udev.conf r, 407 /{,var/}run/udev/tags/snappy-assign/ r, 408 @{PROC}/cmdline r, 409 /sys/devices/**/uevent r, 410 411 # LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above 412 # requires: 413 # /run/udev/data/* r, 414 # but that reveals too much about the system and cannot be granted to apps 415 # by default at this time. 416 417 # For convenience, allow apps to see what is in /dev even though cgroups 418 # will block most access 419 /dev/ r, 420 /dev/**/ r, 421 422 # Allow setting up pseudoterminal via /dev/pts system. This is safe because 423 # the launcher uses a per-app devpts newinstance. 424 /dev/ptmx rw, 425 426 # Do the same with /sys/devices and /sys/class to help people using hw-assign 427 /sys/devices/ r, 428 /sys/devices/**/ r, 429 /sys/class/ r, 430 /sys/class/**/ r, 431 432 # Allow all snaps to chroot 433 capability sys_chroot, 434 435 # Lttng tracing is very noisy and should not be allowed by confined apps. Can 436 # safely deny for the normal case (LP: #1260491). If/when an lttng-trace 437 # interface is needed, we can rework this. 438 deny /{dev,run,var/run}/shm/lttng-ust-* rw, 439 440 # Allow read-access on /home/ for navigating to other parts of the 441 # filesystem. While this allows enumerating users, this is already allowed 442 # via /etc/passwd and getent. 443 @{HOMEDIRS}/ r, 444 445 # Allow read-access to / for navigating to other parts of the filesystem. 446 / r, 447 448 # Snap-specific run directory. Bind mount *not* used here 449 # (see 'parallel installs', above) 450 /run/snap.@{SNAP_INSTANCE_NAME}/ rw, 451 /run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix, 452 453 # Snap-specific lock directory and prerequisite navigation permissions. 454 /run/lock/ r, 455 /run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw, 456 /run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix, 457 ` 458 459 var templateFooter = ` 460 ###SNIPPETS### 461 } 462 ` 463 464 // defaultCoreRuntimeTemplateRules contains core* runtime-specific rules. In general, 465 // binaries exposed here declare what the core runtime has historically been 466 // expected to support. 467 var defaultCoreRuntimeTemplateRules = ` 468 # Default rules for core base runtimes 469 470 # The base abstraction doesn't yet have this 471 /{,usr/}lib/terminfo/** rk, 472 /usr/share/terminfo/** k, 473 /usr/share/zoneinfo/** k, 474 475 # for python apps/services 476 /usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr, 477 # additional accesses needed for newer pythons in later bases 478 /usr/lib{,32,64}/python3.[0-9]/**.{pyc,so} mr, 479 /usr/lib{,32,64}/python3.[0-9]/**.{egg,py,pth} r, 480 /usr/lib{,32,64}/python3.[0-9]/{site,dist}-packages/ r, 481 /usr/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr, 482 /usr/include/python3.[0-9]*/pyconfig.h r, 483 484 # for perl apps/services 485 /usr/bin/perl{,5*} ixr, 486 # AppArmor <2.12 doesn't have rules for perl-base, so add them here 487 /usr/lib/@{multiarch}/perl{,5,-base}/** r, 488 /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr, 489 490 # for bash 'binaries' (do *not* use abstractions/bash) 491 # user-specific bash files 492 /{,usr/}bin/bash ixr, 493 /{,usr/}bin/dash ixr, 494 /usr/share/terminfo/** r, 495 496 # Common utilities for shell scripts 497 /{,usr/}bin/arch ixr, 498 /{,usr/}bin/{,g,m}awk ixr, 499 /{,usr/}bin/base32 ixr, 500 /{,usr/}bin/base64 ixr, 501 /{,usr/}bin/basename ixr, 502 /{,usr/}bin/bunzip2 ixr, 503 /{,usr/}bin/bzcat ixr, 504 /{,usr/}bin/bzdiff ixr, 505 /{,usr/}bin/bzgrep ixr, 506 /{,usr/}bin/bzip2 ixr, 507 /{,usr/}bin/cat ixr, 508 /{,usr/}bin/chgrp ixr, 509 /{,usr/}bin/chmod ixr, 510 /{,usr/}bin/chown ixr, 511 /{,usr/}bin/clear ixr, 512 /{,usr/}bin/cmp ixr, 513 /{,usr/}bin/cp ixr, 514 /{,usr/}bin/cpio ixr, 515 /{,usr/}bin/cut ixr, 516 /{,usr/}bin/date ixr, 517 /{,usr/}bin/dbus-daemon ixr, 518 /{,usr/}bin/dbus-run-session ixr, 519 /{,usr/}bin/dbus-send ixr, 520 /{,usr/}bin/dd ixr, 521 /{,usr/}bin/diff{,3} ixr, 522 /{,usr/}bin/dir ixr, 523 /{,usr/}bin/dirname ixr, 524 /{,usr/}bin/du ixr, 525 /{,usr/}bin/echo ixr, 526 /{,usr/}bin/{,e,f,r}grep ixr, 527 /{,usr/}bin/env ixr, 528 /{,usr/}bin/expr ixr, 529 /{,usr/}bin/false ixr, 530 /{,usr/}bin/find ixr, 531 /{,usr/}bin/flock ixr, 532 /{,usr/}bin/fmt ixr, 533 /{,usr/}bin/fold ixr, 534 /{,usr/}bin/getconf ixr, 535 /{,usr/}bin/getent ixr, 536 /{,usr/}bin/getopt ixr, 537 /{,usr/}bin/groups ixr, 538 /{,usr/}bin/gzip ixr, 539 /{,usr/}bin/head ixr, 540 /{,usr/}bin/hostname ixr, 541 /{,usr/}bin/id ixr, 542 /{,usr/}bin/igawk ixr, 543 /{,usr/}bin/infocmp ixr, 544 /{,usr/}bin/kill ixr, 545 /{,usr/}bin/ldd ixr, 546 /{usr/,}lib{,32,64}/ld{,32,64}-*.so ix, 547 /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so ix, 548 /{,usr/}bin/less{,file,pipe} ixr, 549 /{,usr/}bin/ln ixr, 550 /{,usr/}bin/line ixr, 551 /{,usr/}bin/link ixr, 552 /{,usr/}bin/locale ixr, 553 /{,usr/}bin/logger ixr, 554 /{,usr/}bin/ls ixr, 555 /{,usr/}bin/md5sum ixr, 556 /{,usr/}bin/mkdir ixr, 557 /{,usr/}bin/mkfifo ixr, 558 /{,usr/}bin/mknod ixr, 559 /{,usr/}bin/mktemp ixr, 560 /{,usr/}bin/more ixr, 561 /{,usr/}bin/mv ixr, 562 /{,usr/}bin/nice ixr, 563 /{,usr/}bin/nohup ixr, 564 /{,usr/}bin/od ixr, 565 /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial 566 /{,usr/}bin/paste ixr, 567 /{,usr/}bin/pgrep ixr, 568 /{,usr/}bin/printenv ixr, 569 /{,usr/}bin/printf ixr, 570 /{,usr/}bin/ps ixr, 571 /{,usr/}bin/pwd ixr, 572 /{,usr/}bin/readlink ixr, 573 /{,usr/}bin/realpath ixr, 574 /{,usr/}bin/rev ixr, 575 /{,usr/}bin/rm ixr, 576 /{,usr/}bin/rmdir ixr, 577 /{,usr/}bin/run-parts ixr, 578 /{,usr/}bin/sed ixr, 579 /{,usr/}bin/seq ixr, 580 /{,usr/}bin/sha{1,224,256,384,512}sum ixr, 581 /{,usr/}bin/shuf ixr, 582 /{,usr/}bin/sleep ixr, 583 /{,usr/}bin/sort ixr, 584 /{,usr/}bin/stat ixr, 585 /{,usr/}bin/stdbuf ixr, 586 /{,usr/}bin/stty ixr, 587 /{,usr/}bin/sync ixr, 588 /{,usr/}bin/systemd-cat ixr, 589 /{,usr/}bin/tac ixr, 590 /{,usr/}bin/tail ixr, 591 /{,usr/}bin/tar ixr, 592 /{,usr/}bin/tee ixr, 593 /{,usr/}bin/test ixr, 594 /{,usr/}bin/tempfile ixr, 595 /{,usr/}bin/tset ixr, 596 /{,usr/}bin/touch ixr, 597 /{,usr/}bin/tput ixr, 598 /{,usr/}bin/tr ixr, 599 /{,usr/}bin/true ixr, 600 /{,usr/}bin/tty ixr, 601 /{,usr/}bin/uname ixr, 602 /{,usr/}bin/uniq ixr, 603 /{,usr/}bin/unlink ixr, 604 /{,usr/}bin/unxz ixr, 605 /{,usr/}bin/unzip ixr, 606 /{,usr/}bin/uptime ixr, 607 /{,usr/}bin/vdir ixr, 608 /{,usr/}bin/wc ixr, 609 /{,usr/}bin/which ixr, 610 /{,usr/}bin/xargs ixr, 611 /{,usr/}bin/xz ixr, 612 /{,usr/}bin/yes ixr, 613 /{,usr/}bin/zcat ixr, 614 /{,usr/}bin/z{,e,f}grep ixr, 615 /{,usr/}bin/zip ixr, 616 /{,usr/}bin/zipgrep ixr, 617 618 # lsb-release 619 /usr/bin/lsb_release ixr, 620 /usr/bin/ r, 621 /usr/share/distro-info/*.csv r, 622 623 # For printing the cache (we don't allow updating the cache) 624 /{,usr/}sbin/ldconfig{,.real} ixr, 625 626 # Allow all snaps to chroot 627 /{,usr/}sbin/chroot ixr, 628 ` 629 630 // defaultCoreRuntimeTemplate contains the default apparmor template for core* bases. It 631 // can be overridden for testing using MockTemplate(). 632 var defaultCoreRuntimeTemplate = templateCommon + defaultCoreRuntimeTemplateRules + templateFooter 633 634 // defaultOtherBaseTemplateRules for non-core* bases. When a snap specifies an 635 // alternative base to core*, it is allowed read-only access to all files 636 // within the base, but all other accesses (eg, host file rules, signal, dbus, 637 // unix, etc rules) should be the same as the default template. 638 // 639 // For clarity and ease of maintenance, we will whitelist top-level directories 640 // here instead of using glob rules (we can add more if specific bases 641 // dictate). 642 var defaultOtherBaseTemplateRules = ` 643 # Default rules for non-core base runtimes 644 645 # /bin and /sbin (/usr/{,local/}{s,bin} handled in /usr) 646 /{,s}bin/ r, 647 /{,s}bin/** mrklix, 648 649 # /lib - the mount setup may bind mount to: 650 # 651 # - /lib/firmware 652 # - /lib/modules 653 # 654 # Everything but /lib/firmware and /lib/modules 655 /{,usr/}lib/ r, 656 /{,usr/}lib/[^fm]** mrklix, 657 /{,usr/}lib/{f[^i],m[^o]}** mrklix, 658 /{,usr/}lib/{fi[^r],mo[^d]}** mrklix, 659 /{,usr/}lib/{fir[^m],mod[^u]}** mrklix, 660 /{,usr/}lib/{firm[^w],modu[^l]}** mrklix, 661 /{,usr/}lib/{firmw[^a],modul[^e]}** mrklix, 662 /{,usr/}lib/{firmwa[^r],module[^s]}** mrklix, 663 /{,usr/}lib/modules[^/]** mrklix, 664 /{,usr/}lib/firmwar[^e]** mrklix, 665 /{,usr/}lib/firmware[^/]** mrklix, 666 667 # /lib64, etc 668 /{,usr/}lib[^/]** mrklix, 669 670 # /opt 671 /opt/ r, 672 /opt/** mrklix, 673 674 # /usr - the mount setup may bind mount to: 675 # 676 # - /usr/lib/modules 677 # - /usr/lib/firmware 678 # - /usr/lib/snapd 679 # - /usr/src 680 # 681 # Everything but /usr/lib and /usr/src, which are handled elsewhere. 682 /usr/ r, 683 /usr/[^ls]** mrklix, 684 /usr/{l[^i],s[^r]}** mrklix, 685 /usr/{li[^b],sr[^c]}** mrklix, 686 /usr/{lib,src}[^/]** mrklix, 687 # Everything in /usr/lib except /usr/lib/firmware, /usr/lib/modules and 688 # /usr/lib/snapd, which are handled elsewhere. 689 /usr/lib/[^fms]** mrklix, 690 /usr/lib/{f[^i],m[^o],s[^n]}** mrklix, 691 /usr/lib/{fi[^r],mo[^d],sn[^a]}** mrklix, 692 /usr/lib/{fir[^m],mod[^u],sna[^p]}** mrklix, 693 /usr/lib/{firm[^w],modu[^l],snap[^d]}** mrklix, 694 /usr/lib/snapd[^/]** mrklix, 695 696 # /var - the mount setup may bind mount in: 697 # 698 # - /var/lib/dhcp 699 # - /var/lib/extrausers 700 # - /var/lib/jenkins 701 # - /var/lib/snapd 702 # - /var/log 703 # - /var/snap 704 # - /var/tmp 705 # 706 # Everything but /var/lib, /var/log, /var/snap and /var/tmp, which are 707 # handled elsewhere. 708 /var/ r, 709 /var/[^lst]** mrklix, 710 /var/{l[^io],s[^n],t[^m]}** mrklix, 711 /var/{li[^b],lo[^g],sn[^a],tm[^p]}** mrklix, 712 /var/{lib,log,tmp}[^/]** mrklix, 713 /var/sna[^p]** mrklix, 714 /var/snap[^/]** mrklix, 715 # Everything in /var/lib except /var/lib/dhcp, /var/lib/extrausers, 716 # /var/lib/jenkins and /var/lib/snapd which are handled elsewhere. 717 /var/lib/ r, 718 /var/lib/[^dejs]** mrklix, 719 /var/lib/{d[^h],e[^x],j[^e],s[^n]}** mrklix, 720 /var/lib/{dh[^c],ex[^t],je[^n],sn[^a]}** mrklix, 721 /var/lib/{dhc[^p],ext[^r],jen[^k],sna[^p]}** mrklix, 722 /var/lib/dhcp[^/]** mrklix, 723 /var/lib/{extr[^a],jenk[^i],snap[^d]}** mrklix, 724 /var/lib/snapd[^/]** mrklix, 725 /var/lib/{extra[^u],jenki[^n]}** mrklix, 726 /var/lib/{extrau[^s],jenkin[^s]}** mrklix, 727 /var/lib/jenkins[^/]** mrklix, 728 /var/lib/extraus[^e]** mrklix, 729 /var/lib/extrause[^r]** mrklix, 730 /var/lib/extrauser[^s]** mrklix, 731 /var/lib/extrausers[^/]** mrklix, 732 ` 733 734 // defaultOtherBaseTemplate contains the default apparmor template for non-core 735 // bases 736 var defaultOtherBaseTemplate = templateCommon + defaultOtherBaseTemplateRules + templateFooter 737 738 // Template for privilege drop and chown operations. The specific setuid, 739 // setgid and chown operations are controlled via seccomp. 740 // 741 // To expand on the policy comment below: "this is not a problem in practice": 742 // access to sockets is mediated by file and unix AppArmor rules. When the 743 // access is allowed, the snap is expected to be able to use the socket. Some 744 // service listeners will employ additional checks, such as 'is the connecting 745 // (snap) process root' or 'is the connecting non-root (snap) process in a 746 // particular group', etc. Since snapd daemons start as root and because the 747 // service listeners typically let the root process do anything, the snap 748 // doesn't gain anything from being able to forge a uid since it has full 749 // access to the socket API already. A snap could forge a check to bypass the 750 // theoretical case of the service listener wanting to limit root to something 751 // less than another user, but in practice service listeners won't do this 752 // because it is ineffective against unconfined root processes which can 753 // manipulate the service listener in other ways to subvert a check like this. 754 // 755 // For CAP_KILL, AppArmor mediates signals and the default policy allows 756 // sending signals only to processes with a security label that matches the 757 // snap, but AppArmor does not currently mediate the uid/gid of the 758 // sender/receiver to finely mediate what non-root uid/gids a root process may 759 // send to, so we have always required the process-control interface for snaps 760 // to send signals to other users (even within the same snap). We want to 761 // maintain this with our privilege dropping rules, so we omit 'capability 762 // kill' since snaps can work within the system without 'capability kill': 763 // - root parent can drop, spawn a child and later (dropped) parent can send a 764 // signal 765 // - root parent can spawn a child that drops, then later temporarily drop 766 // (ie, seteuid/setegid), send the signal, then reraise 767 var privDropAndChownRules = ` 768 # allow setuid, setgid and chown for privilege dropping (mediation is done 769 # via seccomp). Note: CAP_SETUID allows (and CAP_SETGID is the same, but 770 # for gid operations): 771 # - forging of UIDs when passing passing socket credentials via UNIX domain 772 # sockets and we don't currently mediate socket credentials, between 773 # mediating socket access in general and the execve() boundary that drops 774 # the capability for non-root commands, this is not a problem in practice. 775 # - accessing the persistent keyring via keyctl, but keyctl is mediated via 776 # seccomp. 777 # - writing a user ID mapping in a user namespace, but we mediate access to 778 # /proc/*/uid_map with AppArmor 779 # 780 # CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH are intentionally omitted from the 781 # policy since we want traditional DAC to be enforced for root. It is 782 # expected that a program that is dropping privileges, etc will create/modify 783 # files in a way that doesn't require these capabilities. 784 capability setuid, 785 capability setgid, 786 capability chown, 787 #capability dac_override, 788 #capability dac_read_search, 789 790 # Similarly, CAP_KILL is intentionally omitted since we want traditional 791 # DAC to be enforced for root. It is expected that a program that is spawning 792 # processes that ultimately run as non-root will send signals to those 793 # processes as the matching non-root user. 794 #capability kill, 795 ` 796 797 // classicTemplate contains apparmor template used for snaps with classic 798 // confinement. This template was Designed by jdstrand: 799 // https://github.com/snapcore/snapd/pull/2366#discussion_r90101320 800 // 801 // The classic template intentionally provides no confinement and is used 802 // simply to ensure that processes have the proper command-specific security 803 // label instead of 'unconfined'. 804 // 805 // It can be overridden for testing using MockClassicTemplate(). 806 var classicTemplate = ` 807 #include <tunables/global> 808 809 ###VAR### 810 811 ###PROFILEATTACH### (attach_disconnected,mediate_deleted) { 812 # set file rules so that exec() inherits our profile unless there is 813 # already a profile for it (eg, snap-confine) 814 / rwkl, 815 /** rwlkm, 816 /** pix, 817 818 capability, 819 ###CHANGEPROFILE_RULE### 820 dbus, 821 network, 822 mount, 823 remount, 824 umount, 825 pivot_root, 826 ptrace, 827 signal, 828 unix, 829 830 ###SNIPPETS### 831 } 832 ` 833 834 // classicJailmodeSnippet contains extra rules that allow snaps using classic 835 // confinement, that were put in to jailmode, to execute by at least having 836 // access to the core snap (e.g. for the dynamic linker and libc). 837 838 var classicJailmodeSnippet = ` 839 # Read-only access to the core snap. 840 @{INSTALL_DIR}/core/** r, 841 # Read only access to the core snap to load libc from. 842 # This is related to LP: #1666897 843 @{INSTALL_DIR}/core/*/{,usr/}lib/@{multiarch}/{,**/}lib*.so* m, 844 845 # For snappy reexec on 4.8+ kernels 846 @{INSTALL_DIR}/core/*/usr/lib/snapd/snap-exec m, 847 ` 848 849 // nfsSnippet contains extra permissions necessary for snaps and snap-confine 850 // to operate when NFS is used. This is an imperfect solution as this grants 851 // some network access to all the snaps on the system. 852 // For tracking see https://bugs.launchpad.net/apparmor/+bug/1724903 853 var nfsSnippet = ` 854 # snapd autogenerated workaround for systems using NFS, for details see: 855 # https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1662552 856 network inet, 857 network inet6, 858 ` 859 860 // overlayRootSnippet contains the extra permissions necessary for snap and 861 // snap-confine to operate on systems where '/' is a writable overlay fs. 862 // AppArmor requires directory reads for upperdir (but these aren't otherwise 863 // visible to the snap). While we filter AppArmor regular expression (AARE) 864 // characters elsewhere, we double quote the path in case UPPERDIR has spaces. 865 var overlayRootSnippet = ` 866 # snapd autogenerated workaround for systems using '/' on overlayfs. For 867 # details see: https://bugs.launchpad.net/apparmor/+bug/1703674 868 "###UPPERDIR###/{,**/}" r, 869 ` 870 871 var ptraceTraceDenySnippet = ` 872 # While commands like 'ps', 'ip netns identify <pid>', 'ip netns pids foo', etc 873 # trigger a 'ptrace (trace)' denial, they aren't actually tracing other 874 # processes. Unfortunately, the kernel overloads trace such that the LSMs are 875 # unable to distinguish between tracing other processes and other accesses. 876 # ptrace (trace) can be used to break out of the seccomp sandbox unless the 877 # kernel has 93e35efb8de45393cf61ed07f7b407629bf698ea (in 4.8+). Until snapd 878 # has full ptrace support conditional on kernel support, explicitly deny to 879 # silence noisy denials/avoid confusion and accidentally giving away this 880 # dangerous access frivolously. 881 deny ptrace (trace), 882 deny capability sys_ptrace, 883 ` 884 885 // updateNSTemplate defines the apparmor profile for per-snap snap-update-ns. 886 // 887 // The per-snap snap-update-ns profiles are composed via a template and 888 // snippets for the snap. The template allows: 889 // - accesses to libraries, files and /proc entries required to run 890 // - using global and per-snap lock files 891 // - reading per-snap mount namespaces and mount profiles 892 // - managing per-snap freezer state files 893 // - per-snap mounting/unmounting fonts from the host 894 // - denying mounts to restricted places (eg, /snap/bin and /media) 895 var updateNSTemplate = ` 896 # Description: Allows snap-update-ns to construct the mount namespace specific 897 # to a particular snap (see the name below). This specifically includes the 898 # precise locations of the layout elements. 899 900 # vim:syntax=apparmor 901 902 #include <tunables/global> 903 904 profile snap-update-ns.###SNAP_INSTANCE_NAME### (attach_disconnected) { 905 # The next four rules mirror those above. We want to be able to read 906 # and map snap-update-ns into memory but it may come from a variety of places. 907 /usr/lib{,exec,64}/snapd/snap-update-ns mr, 908 /var/lib/snapd/hostfs/usr/lib{,exec,64}/snapd/snap-update-ns mr, 909 /{,var/lib/snapd/}snap/{core,snapd}/*/usr/lib/snapd/snap-update-ns mr, 910 /var/lib/snapd/hostfs/{,var/lib/snapd/}snap/core/*/usr/lib/snapd/snap-update-ns mr, 911 912 # Allow reading the dynamic linker cache. 913 /etc/ld.so.cache r, 914 # Allow reading, mapping and executing the dynamic linker. 915 /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}ld-*.so mrix, 916 # Allow reading and mapping various parts of the standard library and 917 # dynamically loaded nss modules and what not. 918 /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libc{,-[0-9]*}.so* mr, 919 /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libpthread{,-[0-9]*}.so* mr, 920 921 # Common devices accesses 922 /dev/null rw, 923 /dev/full rw, 924 /dev/zero rw, 925 /dev/random r, 926 /dev/urandom r, 927 928 # golang runtime variables 929 /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r, 930 # glibc 2.27+ may poke this file to find out the number of CPUs 931 # available in the system when creating a new arena for malloc, see 932 # Golang issue 25628 933 /sys/devices/system/cpu/online r, 934 935 # Allow reading the command line (snap-update-ns uses it in pre-Go bootstrap code). 936 @{PROC}/@{pid}/cmdline r, 937 938 # Allow reading file descriptor paths 939 @{PROC}/@{pid}/fd/* r, 940 # Allow reading /proc/version. For release.go WSL detection. 941 @{PROC}/version r, 942 943 # Allow reading own cgroups 944 @{PROC}/@{pid}/cgroup r, 945 946 # Allow reading somaxconn, required in newer distro releases 947 @{PROC}/sys/net/core/somaxconn r, 948 # but silence noisy denial of inet/inet6 949 deny network inet, 950 deny network inet6, 951 952 # Allow reading the os-release file (possibly a symlink to /usr/lib). 953 /{etc/,usr/lib/}os-release r, 954 955 # Allow creating/grabbing global and per-snap lock files. 956 /run/snapd/lock/###SNAP_INSTANCE_NAME###.lock rwk, 957 /run/snapd/lock/.lock rwk, 958 959 # Allow reading stored mount namespaces, 960 /run/snapd/ns/ r, 961 /run/snapd/ns/###SNAP_INSTANCE_NAME###.mnt r, 962 963 # Allow reading per-snap desired mount profiles. Those are written by 964 # snapd and represent the desired layout and content connections. 965 /var/lib/snapd/mount/snap.###SNAP_INSTANCE_NAME###.fstab r, 966 /var/lib/snapd/mount/snap.###SNAP_INSTANCE_NAME###.user-fstab r, 967 968 # Allow reading and writing actual per-snap mount profiles. Note that 969 # the wildcard in the rule to allow an atomic write + rename strategy. 970 # Those files are written by snap-update-ns and represent the actual 971 # mount profile at a given moment. 972 /run/snapd/ns/snap.###SNAP_INSTANCE_NAME###.fstab{,.*} rw, 973 974 # NOTE: at this stage the /snap directory is stable as we have called 975 # pivot_root already. 976 977 # Needed to perform mount/unmounts. 978 capability sys_admin, 979 # Needed for mimic construction. 980 capability chown, 981 # Needed for dropping to calling user when processing per-user mounts 982 capability setuid, 983 capability setgid, 984 # Allow snap-update-ns to override file ownership and permission checks. 985 # This is required because writable mimics now preserve the permissions 986 # of the original and hence we may be asked to create a directory when the 987 # parent is a tmpfs without DAC write access. 988 capability dac_override, 989 990 # Allow freezing and thawing the per-snap cgroup freezers 991 # v1 hierarchy where we know the group name of all processes of 992 # a given snap upfront 993 /sys/fs/cgroup/freezer/snap.###SNAP_INSTANCE_NAME###/freezer.state rw, 994 # v2 hierarchy, where we need to walk the tree to looking for the tracking 995 # groups and act on each one 996 /sys/fs/cgroup/ r, 997 /sys/fs/cgroup/** r, 998 /sys/fs/cgroup/**/snap.###SNAP_INSTANCE_NAME###.*.scope/cgroup.freeze rw, 999 /sys/fs/cgroup/**/snap.###SNAP_INSTANCE_NAME###.*.service/cgroup.freeze rw, 1000 1001 # Allow the content interface to bind fonts from the host filesystem 1002 mount options=(ro bind) /var/lib/snapd/hostfs/usr/share/fonts/ -> /snap/###SNAP_INSTANCE_NAME###/*/**, 1003 mount options=(rw private) -> /snap/###SNAP_INSTANCE_NAME###/*/**, 1004 umount /snap/###SNAP_INSTANCE_NAME###/*/**, 1005 1006 # set up user mount namespace 1007 mount options=(rslave) -> /, 1008 1009 # Allow traversing from the root directory and several well-known places. 1010 # Specific directory permissions are added by snippets below. 1011 / r, 1012 /etc/ r, 1013 /snap/ r, 1014 /tmp/ r, 1015 /usr/ r, 1016 /var/ r, 1017 /var/snap/ r, 1018 1019 # Allow reading timezone data. 1020 /usr/share/zoneinfo/** r, 1021 1022 # Don't allow anyone to touch /snap/bin 1023 audit deny mount /snap/bin/** -> /**, 1024 audit deny mount /** -> /snap/bin/**, 1025 1026 # Don't allow bind mounts to /media which has special 1027 # sharing and propagates mount events outside of the snap namespace. 1028 audit deny mount -> /media, 1029 1030 # Allow receiving signals from unconfined (eg, systemd) 1031 signal (receive) peer=unconfined, 1032 # Allow sending and receiving signals from ourselves. 1033 signal peer=@{profile_name}, 1034 1035 # Commonly needed permissions for writable mimics. 1036 /tmp/ r, 1037 /tmp/.snap/{,**} rw, 1038 1039 # snapd logger.go checks /proc/cmdline 1040 @{PROC}/cmdline r, 1041 1042 ###SNIPPETS### 1043 } 1044 `