gopkg.in/ubuntu-core/snappy.v0@v0.0.0-20210902073436-25a8614f10a6/interfaces/apparmor/template.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2020 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package apparmor 21 22 // Rules for app snaps are comprised of: 23 // 24 // - preamble and rules common regardless of base runtime 25 // - base-specific runtime rules 26 // - snippet rules from interfaces, etc, regardless of base runtime 27 // 28 // As part of the mount namespace setup, some directories from the host will be 29 // bind mounted onto the base snap (these are defined by snap-confine). The 30 // locations of the target mounts that the snap sees at runtime are (for 31 // clarity, not all subdirectories are listed (eg, /var/lib/snapd/hostfs is not 32 // listed since /var/lib/snapd is)): 33 // 34 // - /dev 35 // - /etc 36 // - /home 37 // - /lib/modules and /usr/lib/modules 38 // - /lib/firmware and /usr/lib/firmware 39 // - /mnt, /media and /run/media 40 // - /proc 41 // - /root 42 // - /run 43 // - /snap and /var/snap 44 // - /sys 45 // - /usr/lib/snapd 46 // - /usr/src 47 // - /var/lib/dhcp 48 // - /var/lib/extrausers 49 // - /var/lib/jenkins 50 // - /var/lib/snapd 51 // - /var/log 52 // - /var/tmp 53 // 54 // For files coming from the host in this manner, accesses should be common to 55 // all bases, either via the template or interface rules (eg, given the same 56 // connected interfaces, access to devices in /dev should generally be the 57 // same, regardless of whether the snap specifies 'base: core18' or 58 // 'base: other'). 59 // 60 // The preamble and default accesses common to all bases go in templateCommon. 61 // These rules include the aformentioned host file rules as well as non-file 62 // rules (eg signal, dbus, unix, etc). 63 // 64 var templateCommon = ` 65 # vim:syntax=apparmor 66 67 #include <tunables/global> 68 69 # snapd supports the concept of 'parallel installs' where snaps with the same 70 # name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz 71 # may all be installed on the system. To support this, SNAP_NAME is set to the 72 # name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg 73 # 'foo_bar'). The profile name and most rules therefore reference 74 # SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime 75 # environment so the snap doesn't have to be aware of the distinction (eg, 76 # SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with 77 # SNAP_NAME so the security policy will allow writing to both locations (since 78 # they are equivalent). 79 80 ###VAR### 81 82 ###PROFILEATTACH### (attach_disconnected,mediate_deleted) { 83 #include <abstractions/base> 84 #include <abstractions/consoles> 85 #include <abstractions/openssl> 86 87 # While in later versions of the base abstraction, include this explicitly 88 # for series 16 and cross-distro 89 /etc/ld.so.preload r, 90 91 # The base abstraction doesn't yet have this 92 /etc/sysconfig/clock r, 93 owner @{PROC}/@{pid}/maps k, 94 # While the base abstraction has rules for encryptfs encrypted home and 95 # private directories, it is missing rules for directory read on the toplevel 96 # directory of the mount (LP: #1848919) 97 owner @{HOME}/.Private/ r, 98 owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r, 99 100 # for python apps/services 101 #include <abstractions/python> 102 /etc/python3.[0-9]/** r, 103 104 # explicitly deny noisy denials to read-only filesystems (see LP: #1496895 105 # for details) 106 deny /usr/lib/python3*/{,**/}__pycache__/ w, 107 deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w, 108 # bind mount used here (see 'parallel installs', above) 109 deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/ w, 110 deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w, 111 112 # for perl apps/services 113 #include <abstractions/perl> 114 # Missing from perl abstraction 115 /usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr, 116 117 # Note: the following dangerous accesses should not be allowed in most 118 # policy, but we cannot explicitly deny since other trusted interfaces might 119 # add them. 120 # Explicitly deny ptrace for now since it can be abused to break out of the 121 # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823 122 #audit deny ptrace (trace), 123 124 # Explicitly deny capability mknod so apps can't create devices 125 #audit deny capability mknod, 126 127 # Explicitly deny mount, remount and umount so apps can't modify things in 128 # their namespace 129 #audit deny mount, 130 #audit deny remount, 131 #audit deny umount, 132 133 # End dangerous accesses 134 135 # Note: this potentially allows snaps to DoS other snaps via resource 136 # exhaustion but we can't sensibly mediate this today. In the future we may 137 # employ cgroup limits, AppArmor rlimit mlock rules or something else. 138 capability ipc_lock, 139 140 # for bash 'binaries' (do *not* use abstractions/bash) 141 # user-specific bash files 142 /etc/bash.bashrc r, 143 /etc/inputrc r, 144 /etc/environment r, 145 /etc/profile r, 146 147 # user/group/seat lookups 148 /etc/{passwd,group,nsswitch.conf} r, # very common 149 /var/lib/extrausers/{passwd,group} r, 150 /run/systemd/users/[0-9]* r, 151 /etc/default/nss r, 152 153 # libnss-systemd (subset from nameservice abstraction) 154 # 155 # https://systemd.io/USER_GROUP_API/ 156 # https://systemd.io/USER_RECORD/ 157 # https://www.freedesktop.org/software/systemd/man/nss-systemd.html 158 # 159 # Allow User/Group lookups via common VarLink socket APIs. Applications need 160 # to either consult all of them or the io.systemd.Multiplexer frontend. 161 /run/systemd/userdb/ r, 162 /run/systemd/userdb/io.systemd.Multiplexer rw, 163 /run/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users 164 /run/systemd/userdb/io.systemd.Home rw, # systemd-home dirs 165 /run/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS 166 167 /etc/libnl-3/{classid,pktloc} r, # apps that use libnl 168 169 # For snappy reexec on 4.8+ kernels 170 /usr/lib/snapd/snap-exec m, 171 172 # For gdb support 173 /usr/lib/snapd/snap-gdb-shim ixr, 174 /usr/lib/snapd/snap-gdbserver-shim ixr, 175 176 # For in-snap tab completion 177 /etc/bash_completion.d/{,*} r, 178 /usr/lib/snapd/etelpmoc.sh ixr, # marshaller (see complete.sh for out-of-snap unmarshal) 179 /usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here 180 181 # uptime 182 @{PROC}/uptime r, 183 @{PROC}/loadavg r, 184 185 # Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib 186 # which is allowed by the base abstraction, but on 14.04 it is an actual file 187 # so need to add it here. Also allow read locks on the file. 188 /etc/os-release rk, 189 /usr/lib/os-release k, 190 191 # systemd native journal API (see sd_journal_print(4)). This should be in 192 # AppArmor's base abstraction, but until it is, include here. 193 /run/systemd/journal/socket w, 194 /run/systemd/journal/stdout rw, # 'r' shouldn't be needed, but journald 195 # doesn't leak anything so allow 196 197 # snapctl and its requirements 198 /usr/bin/snapctl ixr, 199 /usr/lib/snapd/snapctl ixr, 200 @{PROC}/sys/net/core/somaxconn r, 201 /run/snapd-snap.socket rw, 202 203 # Note: for now, don't explicitly deny this noisy denial so --devmode isn't 204 # broken but eventually we may conditionally deny this since it is an 205 # information leak. 206 #deny /{,var/}run/utmp r, 207 208 # java 209 @{PROC}/@{pid}/ r, 210 @{PROC}/@{pid}/fd/ r, 211 owner @{PROC}/@{pid}/auxv r, 212 @{PROC}/sys/vm/zone_reclaim_mode r, 213 /etc/lsb-release r, 214 /sys/devices/**/read_ahead_kb r, 215 /sys/devices/system/cpu/** r, 216 /sys/devices/system/node/node[0-9]*/* r, 217 /sys/kernel/mm/transparent_hugepage/enabled r, 218 /sys/kernel/mm/transparent_hugepage/defrag r, 219 # NOTE: this leaks running process but java seems to want it (even though it 220 # seems to operate ok without it) and SDL apps crash without it. Allow owner 221 # match until AppArmor kernel var is available to solve this properly (see 222 # LP: #1546825 for details). comm is a subset of cmdline, so allow it too. 223 owner @{PROC}/@{pid}/cmdline r, 224 owner @{PROC}/@{pid}/comm r, 225 226 # Per man(5) proc, the kernel enforces that a thread may only modify its comm 227 # value or those in its thread group. 228 owner @{PROC}/@{pid}/task/@{tid}/comm rw, 229 230 # Allow reading and writing to our file descriptors in /proc which, for 231 # example, allow access to /dev/std{in,out,err} which are all symlinks to 232 # /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE) 233 # linkat() temporary file technique, allow all fds. Importantly, access to 234 # another task's fd via this proc interface is mediated via 'ptrace (read)' 235 # (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so 236 # this rule by itself doesn't allow opening another snap's fds via proc. 237 owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw, 238 239 # Miscellaneous accesses 240 /dev/{,u}random w, 241 /etc/machine-id r, 242 /etc/mime.types r, 243 @{PROC}/ r, 244 @{PROC}/version r, 245 @{PROC}/version_signature r, 246 /etc/{,writable/}hostname r, 247 /etc/{,writable/}localtime r, 248 /etc/{,writable/}mailname r, 249 /etc/{,writable/}timezone r, 250 owner @{PROC}/@{pid}/cgroup rk, 251 @{PROC}/@{pid}/io r, 252 owner @{PROC}/@{pid}/limits r, 253 owner @{PROC}/@{pid}/loginuid r, 254 @{PROC}/@{pid}/smaps r, 255 @{PROC}/@{pid}/stat r, 256 @{PROC}/@{pid}/statm r, 257 @{PROC}/@{pid}/status r, 258 @{PROC}/@{pid}/task/ r, 259 @{PROC}/@{pid}/task/[0-9]*/smaps r, 260 @{PROC}/@{pid}/task/[0-9]*/stat r, 261 @{PROC}/@{pid}/task/[0-9]*/statm r, 262 @{PROC}/@{pid}/task/[0-9]*/status r, 263 @{PROC}/sys/fs/pipe-max-size r, 264 @{PROC}/sys/kernel/hostname r, 265 @{PROC}/sys/kernel/osrelease r, 266 @{PROC}/sys/kernel/ostype r, 267 @{PROC}/sys/kernel/pid_max r, 268 @{PROC}/sys/kernel/yama/ptrace_scope r, 269 @{PROC}/sys/kernel/shmmax r, 270 @{PROC}/sys/fs/file-max r, 271 @{PROC}/sys/fs/file-nr r, 272 @{PROC}/sys/fs/inotify/max_* r, 273 @{PROC}/sys/kernel/pid_max r, 274 @{PROC}/sys/kernel/random/boot_id r, 275 @{PROC}/sys/kernel/random/entropy_avail r, 276 @{PROC}/sys/kernel/random/uuid r, 277 @{PROC}/sys/kernel/cap_last_cap r, 278 # Allow access to the uuidd daemon (this daemon is a thin wrapper around 279 # time and getrandom()/{,u}random and, when available, runs under an 280 # unprivilged, dedicated user). 281 /run/uuidd/request rw, 282 /sys/devices/virtual/tty/{console,tty*}/active r, 283 /sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r, 284 /sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r, 285 /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r, 286 /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r, 287 /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r, 288 /sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r, 289 /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r, 290 /sys/module/apparmor/parameters/enabled r, 291 /{,usr/}lib/ r, 292 293 # Reads of oom_adj and oom_score_adj are safe 294 owner @{PROC}/@{pid}/oom_{,score_}adj r, 295 296 # Note: for now, don't explicitly deny write access so --devmode isn't broken 297 # but eventually we may conditionally deny this since it allows the process 298 # to increase the oom heuristic of other processes (make them more likely to 299 # be killed). Once AppArmor kernel var is available to solve this properly, 300 # this can safely be allowed since non-root processes won't be able to 301 # decrease the value and root processes will only be able to with 302 # 'capability sys_resource,' which we deny be default. 303 # deny owner @{PROC}/@{pid}/oom_{,score_}adj w, 304 305 # Eases hardware assignment (doesn't give anything away) 306 /etc/udev/udev.conf r, 307 /sys/ r, 308 /sys/bus/ r, 309 /sys/class/ r, 310 311 # this leaks interface names and stats, but not in a way that is traceable 312 # to the user/device 313 @{PROC}/net/dev r, 314 @{PROC}/@{pid}/net/dev r, 315 316 # Read-only of this snap 317 /var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r, 318 319 # Read-only of snapd restart state for snapctl specifically 320 /var/lib/snapd/maintenance.json r, 321 322 # Read-only for the install directory 323 # bind mount used here (see 'parallel installs', above) 324 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r, 325 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/ r, 326 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/** mrklix, 327 328 # Read-only install directory for other revisions to help with bugs like 329 # LP: #1616650 and LP: #1655992 330 @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix, 331 332 # Read-only home area for other versions 333 # bind mount *not* used here (see 'parallel installs', above) 334 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/ r, 335 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/** mrkix, 336 337 # Writable home area for this version. 338 # bind mount *not* used here (see 'parallel installs', above) 339 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl, 340 owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl, 341 342 # Read-only system area for other versions 343 # bind mount used here (see 'parallel installs', above) 344 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r, 345 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix, 346 347 # Writable system area only for this version 348 # bind mount used here (see 'parallel installs', above) 349 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl, 350 /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl, 351 352 # The ubuntu-core-launcher creates an app-specific private restricted /tmp 353 # and will fail to launch the app if something goes wrong. As such, we can 354 # simply allow full access to /tmp. 355 /tmp/ r, 356 /tmp/** mrwlkix, 357 358 # App-specific access to files and directories in /dev/shm. We allow file 359 # access in /dev/shm for shm_open() and files in subdirectories for open() 360 # bind mount *not* used here (see 'parallel installs', above) 361 /{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix, 362 # Also allow app-specific access for sem_open() 363 /{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk, 364 365 # Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user 366 # bind mount *not* used here (see 'parallel installs', above) 367 owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/ rw, 368 owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix, 369 370 # Allow apps from the same package to communicate with each other via an 371 # abstract or anonymous socket 372 unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**", 373 unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*), 374 375 # Allow apps from the same package to communicate with each other via DBus. 376 # Note: this does not grant access to the DBus sockets of well known buses 377 # (will still need to use an appropriate interface for that). 378 dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*), 379 # In addition to the above, dbus-run-session attempts reading these files 380 # from the snap base runtime. 381 /usr/share/dbus-1/services/{,*} r, 382 /usr/share/dbus-1/system-services/{,*} r, 383 # Allow apps to perform DBus introspection on org.freedesktop.DBus for both 384 # the system and session buses. 385 # Note: this does not grant access to the DBus sockets of these buses, but 386 # we grant it here since it is missing from the dbus abstractions 387 # (LP: #1866168) 388 dbus (send) 389 bus={session,system} 390 path=/org/freedesktop/DBus 391 interface=org.freedesktop.DBus.Introspectable 392 member=Introspect 393 peer=(label=unconfined), 394 395 # Allow apps from the same package to signal each other via signals 396 signal peer=snap.@{SNAP_INSTANCE_NAME}.*, 397 398 # Allow receiving signals from all snaps (and focus on mediating sending of 399 # signals) 400 signal (receive) peer=snap.*, 401 402 # Allow receiving signals from unconfined (eg, systemd) 403 signal (receive) peer=unconfined, 404 405 # for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign' 406 /{,s}bin/udevadm ixr, 407 /etc/udev/udev.conf r, 408 /{,var/}run/udev/tags/snappy-assign/ r, 409 @{PROC}/cmdline r, 410 /sys/devices/**/uevent r, 411 412 # LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above 413 # requires: 414 # /run/udev/data/* r, 415 # but that reveals too much about the system and cannot be granted to apps 416 # by default at this time. 417 418 # For convenience, allow apps to see what is in /dev even though cgroups 419 # will block most access 420 /dev/ r, 421 /dev/**/ r, 422 423 # Allow setting up pseudoterminal via /dev/pts system. This is safe because 424 # the launcher uses a per-app devpts newinstance. 425 /dev/ptmx rw, 426 427 # Do the same with /sys/devices and /sys/class to help people using hw-assign 428 /sys/devices/ r, 429 /sys/devices/**/ r, 430 /sys/class/ r, 431 /sys/class/**/ r, 432 433 # Allow all snaps to chroot 434 capability sys_chroot, 435 436 # Lttng tracing is very noisy and should not be allowed by confined apps. Can 437 # safely deny for the normal case (LP: #1260491). If/when an lttng-trace 438 # interface is needed, we can rework this. 439 deny /{dev,run,var/run}/shm/lttng-ust-* rw, 440 441 # Allow read-access on /home/ for navigating to other parts of the 442 # filesystem. While this allows enumerating users, this is already allowed 443 # via /etc/passwd and getent. 444 @{HOMEDIRS}/ r, 445 446 # Allow read-access to / for navigating to other parts of the filesystem. 447 / r, 448 449 # Snap-specific run directory. Bind mount *not* used here 450 # (see 'parallel installs', above) 451 /run/snap.@{SNAP_INSTANCE_NAME}/ rw, 452 /run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix, 453 454 # Snap-specific lock directory and prerequisite navigation permissions. 455 /run/lock/ r, 456 /run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw, 457 /run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix, 458 ` 459 460 var templateFooter = ` 461 ###SNIPPETS### 462 } 463 ` 464 465 // defaultCoreRuntimeTemplateRules contains core* runtime-specific rules. In general, 466 // binaries exposed here declare what the core runtime has historically been 467 // expected to support. 468 var defaultCoreRuntimeTemplateRules = ` 469 # Default rules for core base runtimes 470 471 # The base abstraction doesn't yet have this 472 /{,usr/}lib/terminfo/** rk, 473 /usr/share/terminfo/** k, 474 /usr/share/zoneinfo/** k, 475 476 # for python apps/services 477 /usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr, 478 # additional accesses needed for newer pythons in later bases 479 /usr/lib{,32,64}/python3.[0-9]/**.{pyc,so} mr, 480 /usr/lib{,32,64}/python3.[0-9]/**.{egg,py,pth} r, 481 /usr/lib{,32,64}/python3.[0-9]/{site,dist}-packages/ r, 482 /usr/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr, 483 /usr/include/python3.[0-9]*/pyconfig.h r, 484 485 # for perl apps/services 486 /usr/bin/perl{,5*} ixr, 487 # AppArmor <2.12 doesn't have rules for perl-base, so add them here 488 /usr/lib/@{multiarch}/perl{,5,-base}/** r, 489 /usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr, 490 491 # for bash 'binaries' (do *not* use abstractions/bash) 492 # user-specific bash files 493 /{,usr/}bin/bash ixr, 494 /{,usr/}bin/dash ixr, 495 /usr/share/terminfo/** r, 496 497 # Common utilities for shell scripts 498 /{,usr/}bin/arch ixr, 499 /{,usr/}bin/{,g,m}awk ixr, 500 /{,usr/}bin/base32 ixr, 501 /{,usr/}bin/base64 ixr, 502 /{,usr/}bin/basename ixr, 503 /{,usr/}bin/bunzip2 ixr, 504 /{,usr/}bin/bzcat ixr, 505 /{,usr/}bin/bzdiff ixr, 506 /{,usr/}bin/bzgrep ixr, 507 /{,usr/}bin/bzip2 ixr, 508 /{,usr/}bin/cat ixr, 509 /{,usr/}bin/chgrp ixr, 510 /{,usr/}bin/chmod ixr, 511 /{,usr/}bin/chown ixr, 512 /{,usr/}bin/clear ixr, 513 /{,usr/}bin/cmp ixr, 514 /{,usr/}bin/cp ixr, 515 /{,usr/}bin/cpio ixr, 516 /{,usr/}bin/cut ixr, 517 /{,usr/}bin/date ixr, 518 /{,usr/}bin/dbus-daemon ixr, 519 /{,usr/}bin/dbus-run-session ixr, 520 /{,usr/}bin/dbus-send ixr, 521 /{,usr/}bin/dd ixr, 522 /{,usr/}bin/diff{,3} ixr, 523 /{,usr/}bin/dir ixr, 524 /{,usr/}bin/dirname ixr, 525 /{,usr/}bin/du ixr, 526 /{,usr/}bin/echo ixr, 527 /{,usr/}bin/{,e,f,r}grep ixr, 528 /{,usr/}bin/env ixr, 529 /{,usr/}bin/expr ixr, 530 /{,usr/}bin/false ixr, 531 /{,usr/}bin/find ixr, 532 /{,usr/}bin/flock ixr, 533 /{,usr/}bin/fmt ixr, 534 /{,usr/}bin/fold ixr, 535 /{,usr/}bin/getconf ixr, 536 /{,usr/}bin/getent ixr, 537 /{,usr/}bin/getopt ixr, 538 /{,usr/}bin/groups ixr, 539 /{,usr/}bin/gzip ixr, 540 /{,usr/}bin/head ixr, 541 /{,usr/}bin/hostname ixr, 542 /{,usr/}bin/id ixr, 543 /{,usr/}bin/igawk ixr, 544 /{,usr/}bin/infocmp ixr, 545 /{,usr/}bin/kill ixr, 546 /{,usr/}bin/ldd ixr, 547 /{usr/,}lib{,32,64}/ld{,32,64}-*.so ix, 548 /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so ix, 549 /{,usr/}bin/less{,file,pipe} ixr, 550 /{,usr/}bin/ln ixr, 551 /{,usr/}bin/line ixr, 552 /{,usr/}bin/link ixr, 553 /{,usr/}bin/locale ixr, 554 /{,usr/}bin/logger ixr, 555 /{,usr/}bin/ls ixr, 556 /{,usr/}bin/md5sum ixr, 557 /{,usr/}bin/mkdir ixr, 558 /{,usr/}bin/mkfifo ixr, 559 /{,usr/}bin/mknod ixr, 560 /{,usr/}bin/mktemp ixr, 561 /{,usr/}bin/more ixr, 562 /{,usr/}bin/mv ixr, 563 /{,usr/}bin/nice ixr, 564 /{,usr/}bin/nohup ixr, 565 /{,usr/}bin/od ixr, 566 /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial 567 /{,usr/}bin/paste ixr, 568 /{,usr/}bin/pgrep ixr, 569 /{,usr/}bin/printenv ixr, 570 /{,usr/}bin/printf ixr, 571 /{,usr/}bin/ps ixr, 572 /{,usr/}bin/pwd ixr, 573 /{,usr/}bin/readlink ixr, 574 /{,usr/}bin/realpath ixr, 575 /{,usr/}bin/rev ixr, 576 /{,usr/}bin/rm ixr, 577 /{,usr/}bin/rmdir ixr, 578 /{,usr/}bin/run-parts ixr, 579 /{,usr/}bin/sed ixr, 580 /{,usr/}bin/seq ixr, 581 /{,usr/}bin/sha{1,224,256,384,512}sum ixr, 582 /{,usr/}bin/shuf ixr, 583 /{,usr/}bin/sleep ixr, 584 /{,usr/}bin/sort ixr, 585 /{,usr/}bin/stat ixr, 586 /{,usr/}bin/stdbuf ixr, 587 /{,usr/}bin/stty ixr, 588 /{,usr/}bin/sync ixr, 589 /{,usr/}bin/systemd-cat ixr, 590 /{,usr/}bin/tac ixr, 591 /{,usr/}bin/tail ixr, 592 /{,usr/}bin/tar ixr, 593 /{,usr/}bin/tee ixr, 594 /{,usr/}bin/test ixr, 595 /{,usr/}bin/tempfile ixr, 596 /{,usr/}bin/tset ixr, 597 /{,usr/}bin/touch ixr, 598 /{,usr/}bin/tput ixr, 599 /{,usr/}bin/tr ixr, 600 /{,usr/}bin/true ixr, 601 /{,usr/}bin/tty ixr, 602 /{,usr/}bin/uname ixr, 603 /{,usr/}bin/uniq ixr, 604 /{,usr/}bin/unlink ixr, 605 /{,usr/}bin/unxz ixr, 606 /{,usr/}bin/unzip ixr, 607 /{,usr/}bin/uptime ixr, 608 /{,usr/}bin/vdir ixr, 609 /{,usr/}bin/wc ixr, 610 /{,usr/}bin/which ixr, 611 /{,usr/}bin/xargs ixr, 612 /{,usr/}bin/xz ixr, 613 /{,usr/}bin/yes ixr, 614 /{,usr/}bin/zcat ixr, 615 /{,usr/}bin/z{,e,f}grep ixr, 616 /{,usr/}bin/zip ixr, 617 /{,usr/}bin/zipgrep ixr, 618 619 # lsb-release 620 /usr/bin/lsb_release ixr, 621 /usr/bin/ r, 622 /usr/share/distro-info/*.csv r, 623 624 # For printing the cache (we don't allow updating the cache) 625 /{,usr/}sbin/ldconfig{,.real} ixr, 626 627 # Allow all snaps to chroot 628 /{,usr/}sbin/chroot ixr, 629 ` 630 631 // defaultCoreRuntimeTemplate contains the default apparmor template for core* bases. It 632 // can be overridden for testing using MockTemplate(). 633 var defaultCoreRuntimeTemplate = templateCommon + defaultCoreRuntimeTemplateRules + templateFooter 634 635 // defaultOtherBaseTemplateRules for non-core* bases. When a snap specifies an 636 // alternative base to core*, it is allowed read-only access to all files 637 // within the base, but all other accesses (eg, host file rules, signal, dbus, 638 // unix, etc rules) should be the same as the default template. 639 // 640 // For clarity and ease of maintenance, we will whitelist top-level directories 641 // here instead of using glob rules (we can add more if specific bases 642 // dictate). 643 var defaultOtherBaseTemplateRules = ` 644 # Default rules for non-core base runtimes 645 646 # /bin and /sbin (/usr/{,local/}{s,bin} handled in /usr) 647 /{,s}bin/ r, 648 /{,s}bin/** mrklix, 649 650 # /lib - the mount setup may bind mount to: 651 # 652 # - /lib/firmware 653 # - /lib/modules 654 # 655 # Everything but /lib/firmware and /lib/modules 656 /{,usr/}lib/ r, 657 /{,usr/}lib/[^fm]** mrklix, 658 /{,usr/}lib/{f[^i],m[^o]}** mrklix, 659 /{,usr/}lib/{fi[^r],mo[^d]}** mrklix, 660 /{,usr/}lib/{fir[^m],mod[^u]}** mrklix, 661 /{,usr/}lib/{firm[^w],modu[^l]}** mrklix, 662 /{,usr/}lib/{firmw[^a],modul[^e]}** mrklix, 663 /{,usr/}lib/{firmwa[^r],module[^s]}** mrklix, 664 /{,usr/}lib/modules[^/]** mrklix, 665 /{,usr/}lib/firmwar[^e]** mrklix, 666 /{,usr/}lib/firmware[^/]** mrklix, 667 668 # /lib64, etc 669 /{,usr/}lib[^/]** mrklix, 670 671 # /opt 672 /opt/ r, 673 /opt/** mrklix, 674 675 # /usr - the mount setup may bind mount to: 676 # 677 # - /usr/lib/modules 678 # - /usr/lib/firmware 679 # - /usr/lib/snapd 680 # - /usr/src 681 # 682 # Everything but /usr/lib and /usr/src, which are handled elsewhere. 683 /usr/ r, 684 /usr/[^ls]** mrklix, 685 /usr/{l[^i],s[^r]}** mrklix, 686 /usr/{li[^b],sr[^c]}** mrklix, 687 /usr/{lib,src}[^/]** mrklix, 688 # Everything in /usr/lib except /usr/lib/firmware, /usr/lib/modules and 689 # /usr/lib/snapd, which are handled elsewhere. 690 /usr/lib/[^fms]** mrklix, 691 /usr/lib/{f[^i],m[^o],s[^n]}** mrklix, 692 /usr/lib/{fi[^r],mo[^d],sn[^a]}** mrklix, 693 /usr/lib/{fir[^m],mod[^u],sna[^p]}** mrklix, 694 /usr/lib/{firm[^w],modu[^l],snap[^d]}** mrklix, 695 /usr/lib/snapd[^/]** mrklix, 696 697 # /var - the mount setup may bind mount in: 698 # 699 # - /var/lib/dhcp 700 # - /var/lib/extrausers 701 # - /var/lib/jenkins 702 # - /var/lib/snapd 703 # - /var/log 704 # - /var/snap 705 # - /var/tmp 706 # 707 # Everything but /var/lib, /var/log, /var/snap and /var/tmp, which are 708 # handled elsewhere. 709 /var/ r, 710 /var/[^lst]** mrklix, 711 /var/{l[^io],s[^n],t[^m]}** mrklix, 712 /var/{li[^b],lo[^g],sn[^a],tm[^p]}** mrklix, 713 /var/{lib,log,tmp}[^/]** mrklix, 714 /var/sna[^p]** mrklix, 715 /var/snap[^/]** mrklix, 716 # Everything in /var/lib except /var/lib/dhcp, /var/lib/extrausers, 717 # /var/lib/jenkins and /var/lib/snapd which are handled elsewhere. 718 /var/lib/ r, 719 /var/lib/[^dejs]** mrklix, 720 /var/lib/{d[^h],e[^x],j[^e],s[^n]}** mrklix, 721 /var/lib/{dh[^c],ex[^t],je[^n],sn[^a]}** mrklix, 722 /var/lib/{dhc[^p],ext[^r],jen[^k],sna[^p]}** mrklix, 723 /var/lib/dhcp[^/]** mrklix, 724 /var/lib/{extr[^a],jenk[^i],snap[^d]}** mrklix, 725 /var/lib/snapd[^/]** mrklix, 726 /var/lib/{extra[^u],jenki[^n]}** mrklix, 727 /var/lib/{extrau[^s],jenkin[^s]}** mrklix, 728 /var/lib/jenkins[^/]** mrklix, 729 /var/lib/extraus[^e]** mrklix, 730 /var/lib/extrause[^r]** mrklix, 731 /var/lib/extrauser[^s]** mrklix, 732 /var/lib/extrausers[^/]** mrklix, 733 ` 734 735 // defaultOtherBaseTemplate contains the default apparmor template for non-core 736 // bases 737 var defaultOtherBaseTemplate = templateCommon + defaultOtherBaseTemplateRules + templateFooter 738 739 // Template for privilege drop and chown operations. The specific setuid, 740 // setgid and chown operations are controlled via seccomp. 741 // 742 // To expand on the policy comment below: "this is not a problem in practice": 743 // access to sockets is mediated by file and unix AppArmor rules. When the 744 // access is allowed, the snap is expected to be able to use the socket. Some 745 // service listeners will employ additional checks, such as 'is the connecting 746 // (snap) process root' or 'is the connecting non-root (snap) process in a 747 // particular group', etc. Since snapd daemons start as root and because the 748 // service listeners typically let the root process do anything, the snap 749 // doesn't gain anything from being able to forge a uid since it has full 750 // access to the socket API already. A snap could forge a check to bypass the 751 // theoretical case of the service listener wanting to limit root to something 752 // less than another user, but in practice service listeners won't do this 753 // because it is ineffective against unconfined root processes which can 754 // manipulate the service listener in other ways to subvert a check like this. 755 // 756 // For CAP_KILL, AppArmor mediates signals and the default policy allows 757 // sending signals only to processes with a security label that matches the 758 // snap, but AppArmor does not currently mediate the uid/gid of the 759 // sender/receiver to finely mediate what non-root uid/gids a root process may 760 // send to, so we have always required the process-control interface for snaps 761 // to send signals to other users (even within the same snap). We want to 762 // maintain this with our privilege dropping rules, so we omit 'capability 763 // kill' since snaps can work within the system without 'capability kill': 764 // - root parent can drop, spawn a child and later (dropped) parent can send a 765 // signal 766 // - root parent can spawn a child that drops, then later temporarily drop 767 // (ie, seteuid/setegid), send the signal, then reraise 768 var privDropAndChownRules = ` 769 # allow setuid, setgid and chown for privilege dropping (mediation is done 770 # via seccomp). Note: CAP_SETUID allows (and CAP_SETGID is the same, but 771 # for gid operations): 772 # - forging of UIDs when passing passing socket credentials via UNIX domain 773 # sockets and we don't currently mediate socket credentials, between 774 # mediating socket access in general and the execve() boundary that drops 775 # the capability for non-root commands, this is not a problem in practice. 776 # - accessing the persistent keyring via keyctl, but keyctl is mediated via 777 # seccomp. 778 # - writing a user ID mapping in a user namespace, but we mediate access to 779 # /proc/*/uid_map with AppArmor 780 # 781 # CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH are intentionally omitted from the 782 # policy since we want traditional DAC to be enforced for root. It is 783 # expected that a program that is dropping privileges, etc will create/modify 784 # files in a way that doesn't require these capabilities. 785 capability setuid, 786 capability setgid, 787 capability chown, 788 #capability dac_override, 789 #capability dac_read_search, 790 791 # Similarly, CAP_KILL is intentionally omitted since we want traditional 792 # DAC to be enforced for root. It is expected that a program that is spawning 793 # processes that ultimately run as non-root will send signals to those 794 # processes as the matching non-root user. 795 #capability kill, 796 ` 797 798 // classicTemplate contains apparmor template used for snaps with classic 799 // confinement. This template was Designed by jdstrand: 800 // https://github.com/snapcore/snapd/pull/2366#discussion_r90101320 801 // 802 // The classic template intentionally provides no confinement and is used 803 // simply to ensure that processes have the proper command-specific security 804 // label instead of 'unconfined'. 805 // 806 // It can be overridden for testing using MockClassicTemplate(). 807 var classicTemplate = ` 808 #include <tunables/global> 809 810 ###VAR### 811 812 ###PROFILEATTACH### (attach_disconnected,mediate_deleted) { 813 # set file rules so that exec() inherits our profile unless there is 814 # already a profile for it (eg, snap-confine) 815 / rwkl, 816 /** rwlkm, 817 /** pix, 818 819 capability, 820 ###CHANGEPROFILE_RULE### 821 dbus, 822 network, 823 mount, 824 remount, 825 umount, 826 pivot_root, 827 ptrace, 828 signal, 829 unix, 830 831 ###SNIPPETS### 832 } 833 ` 834 835 // classicJailmodeSnippet contains extra rules that allow snaps using classic 836 // confinement, that were put in to jailmode, to execute by at least having 837 // access to the core snap (e.g. for the dynamic linker and libc). 838 839 var classicJailmodeSnippet = ` 840 # Read-only access to the core snap. 841 @{INSTALL_DIR}/core/** r, 842 # Read only access to the core snap to load libc from. 843 # This is related to LP: #1666897 844 @{INSTALL_DIR}/core/*/{,usr/}lib/@{multiarch}/{,**/}lib*.so* m, 845 846 # For snappy reexec on 4.8+ kernels 847 @{INSTALL_DIR}/core/*/usr/lib/snapd/snap-exec m, 848 ` 849 850 // nfsSnippet contains extra permissions necessary for snaps and snap-confine 851 // to operate when NFS is used. This is an imperfect solution as this grants 852 // some network access to all the snaps on the system. 853 // For tracking see https://bugs.launchpad.net/apparmor/+bug/1724903 854 var nfsSnippet = ` 855 # snapd autogenerated workaround for systems using NFS, for details see: 856 # https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1662552 857 network inet, 858 network inet6, 859 ` 860 861 // overlayRootSnippet contains the extra permissions necessary for snap and 862 // snap-confine to operate on systems where '/' is a writable overlay fs. 863 // AppArmor requires directory reads for upperdir (but these aren't otherwise 864 // visible to the snap). While we filter AppArmor regular expression (AARE) 865 // characters elsewhere, we double quote the path in case UPPERDIR has spaces. 866 var overlayRootSnippet = ` 867 # snapd autogenerated workaround for systems using '/' on overlayfs. For 868 # details see: https://bugs.launchpad.net/apparmor/+bug/1703674 869 "###UPPERDIR###/{,**/}" r, 870 ` 871 872 var ptraceTraceDenySnippet = ` 873 # While commands like 'ps', 'ip netns identify <pid>', 'ip netns pids foo', etc 874 # trigger a 'ptrace (trace)' denial, they aren't actually tracing other 875 # processes. Unfortunately, the kernel overloads trace such that the LSMs are 876 # unable to distinguish between tracing other processes and other accesses. 877 # ptrace (trace) can be used to break out of the seccomp sandbox unless the 878 # kernel has 93e35efb8de45393cf61ed07f7b407629bf698ea (in 4.8+). Until snapd 879 # has full ptrace support conditional on kernel support, explicitly deny to 880 # silence noisy denials/avoid confusion and accidentally giving away this 881 # dangerous access frivolously. 882 deny ptrace (trace), 883 deny capability sys_ptrace, 884 ` 885 886 // updateNSTemplate defines the apparmor profile for per-snap snap-update-ns. 887 // 888 // The per-snap snap-update-ns profiles are composed via a template and 889 // snippets for the snap. The template allows: 890 // - accesses to libraries, files and /proc entries required to run 891 // - using global and per-snap lock files 892 // - reading per-snap mount namespaces and mount profiles 893 // - managing per-snap freezer state files 894 // - per-snap mounting/unmounting fonts from the host 895 // - denying mounts to restricted places (eg, /snap/bin and /media) 896 var updateNSTemplate = ` 897 # Description: Allows snap-update-ns to construct the mount namespace specific 898 # to a particular snap (see the name below). This specifically includes the 899 # precise locations of the layout elements. 900 901 # vim:syntax=apparmor 902 903 #include <tunables/global> 904 905 profile snap-update-ns.###SNAP_INSTANCE_NAME### (attach_disconnected) { 906 # The next four rules mirror those above. We want to be able to read 907 # and map snap-update-ns into memory but it may come from a variety of places. 908 /usr/lib{,exec,64}/snapd/snap-update-ns mr, 909 /var/lib/snapd/hostfs/usr/lib{,exec,64}/snapd/snap-update-ns mr, 910 /{,var/lib/snapd/}snap/{core,snapd}/*/usr/lib/snapd/snap-update-ns mr, 911 /var/lib/snapd/hostfs/{,var/lib/snapd/}snap/core/*/usr/lib/snapd/snap-update-ns mr, 912 913 # Allow reading the dynamic linker cache. 914 /etc/ld.so.cache r, 915 # Allow reading, mapping and executing the dynamic linker. 916 /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}ld-*.so mrix, 917 # Allow reading and mapping various parts of the standard library and 918 # dynamically loaded nss modules and what not. 919 /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libc{,-[0-9]*}.so* mr, 920 /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libpthread{,-[0-9]*}.so* mr, 921 922 # Common devices accesses 923 /dev/null rw, 924 /dev/full rw, 925 /dev/zero rw, 926 /dev/random r, 927 /dev/urandom r, 928 929 # golang runtime variables 930 /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r, 931 # glibc 2.27+ may poke this file to find out the number of CPUs 932 # available in the system when creating a new arena for malloc, see 933 # Golang issue 25628 934 /sys/devices/system/cpu/online r, 935 936 # Allow reading the command line (snap-update-ns uses it in pre-Go bootstrap code). 937 @{PROC}/@{pid}/cmdline r, 938 939 # Allow reading file descriptor paths 940 @{PROC}/@{pid}/fd/* r, 941 # Allow reading /proc/version. For release.go WSL detection. 942 @{PROC}/version r, 943 944 # Allow reading own cgroups 945 @{PROC}/@{pid}/cgroup r, 946 947 # Allow reading somaxconn, required in newer distro releases 948 @{PROC}/sys/net/core/somaxconn r, 949 # but silence noisy denial of inet/inet6 950 deny network inet, 951 deny network inet6, 952 953 # Allow reading the os-release file (possibly a symlink to /usr/lib). 954 /{etc/,usr/lib/}os-release r, 955 956 # Allow creating/grabbing global and per-snap lock files. 957 /run/snapd/lock/###SNAP_INSTANCE_NAME###.lock rwk, 958 /run/snapd/lock/.lock rwk, 959 960 # Allow reading stored mount namespaces, 961 /run/snapd/ns/ r, 962 /run/snapd/ns/###SNAP_INSTANCE_NAME###.mnt r, 963 964 # Allow reading per-snap desired mount profiles. Those are written by 965 # snapd and represent the desired layout and content connections. 966 /var/lib/snapd/mount/snap.###SNAP_INSTANCE_NAME###.fstab r, 967 /var/lib/snapd/mount/snap.###SNAP_INSTANCE_NAME###.user-fstab r, 968 969 # Allow reading and writing actual per-snap mount profiles. Note that 970 # the wildcard in the rule to allow an atomic write + rename strategy. 971 # Those files are written by snap-update-ns and represent the actual 972 # mount profile at a given moment. 973 /run/snapd/ns/snap.###SNAP_INSTANCE_NAME###.fstab{,.*} rw, 974 975 # NOTE: at this stage the /snap directory is stable as we have called 976 # pivot_root already. 977 978 # Needed to perform mount/unmounts. 979 capability sys_admin, 980 # Needed for mimic construction. 981 capability chown, 982 # Needed for dropping to calling user when processing per-user mounts 983 capability setuid, 984 capability setgid, 985 # Allow snap-update-ns to override file ownership and permission checks. 986 # This is required because writable mimics now preserve the permissions 987 # of the original and hence we may be asked to create a directory when the 988 # parent is a tmpfs without DAC write access. 989 capability dac_override, 990 991 # Allow freezing and thawing the per-snap cgroup freezers 992 # v1 hierarchy where we know the group name of all processes of 993 # a given snap upfront 994 /sys/fs/cgroup/freezer/snap.###SNAP_INSTANCE_NAME###/freezer.state rw, 995 # v2 hierarchy, where we need to walk the tree to looking for the tracking 996 # groups and act on each one 997 /sys/fs/cgroup/ r, 998 /sys/fs/cgroup/** r, 999 /sys/fs/cgroup/**/snap.###SNAP_INSTANCE_NAME###.*.scope/cgroup.freeze rw, 1000 /sys/fs/cgroup/**/snap.###SNAP_INSTANCE_NAME###.*.service/cgroup.freeze rw, 1001 1002 # Allow the content interface to bind fonts from the host filesystem 1003 mount options=(ro bind) /var/lib/snapd/hostfs/usr/share/fonts/ -> /snap/###SNAP_INSTANCE_NAME###/*/**, 1004 mount options=(rw private) -> /snap/###SNAP_INSTANCE_NAME###/*/**, 1005 umount /snap/###SNAP_INSTANCE_NAME###/*/**, 1006 1007 # set up user mount namespace 1008 mount options=(rslave) -> /, 1009 1010 # Allow traversing from the root directory and several well-known places. 1011 # Specific directory permissions are added by snippets below. 1012 / r, 1013 /etc/ r, 1014 /snap/ r, 1015 /tmp/ r, 1016 /usr/ r, 1017 /var/ r, 1018 /var/snap/ r, 1019 1020 # Allow reading timezone data. 1021 /usr/share/zoneinfo/** r, 1022 1023 # Don't allow anyone to touch /snap/bin 1024 audit deny mount /snap/bin/** -> /**, 1025 audit deny mount /** -> /snap/bin/**, 1026 1027 # Don't allow bind mounts to /media which has special 1028 # sharing and propagates mount events outside of the snap namespace. 1029 audit deny mount -> /media, 1030 1031 # Allow receiving signals from unconfined (eg, systemd) 1032 signal (receive) peer=unconfined, 1033 # Allow sending and receiving signals from ourselves. 1034 signal peer=@{profile_name}, 1035 1036 # Commonly needed permissions for writable mimics. 1037 /tmp/ r, 1038 /tmp/.snap/{,**} rw, 1039 1040 # snapd logger.go checks /proc/cmdline 1041 @{PROC}/cmdline r, 1042 1043 ###SNIPPETS### 1044 } 1045 `