Author: Jamie Strandboge <[email protected]>
Bug-Ubuntu: https://launchpad.net/bugs/933440 Forwarded: yes
This is a very slightly updated version of the skype profile
update that Jamie Strandboge submitted, but did not get a review.
The only addition over the previously submitted version is rw access
to @{HOME}/.config/Skype/Skype.conf.
---
profiles/apparmor/profiles/extras/usr.bin.skype | 75 ++++++++++++++++++------
1 file changed, 58 insertions(+), 17 deletions(-)
Index: b/profiles/apparmor/profiles/extras/usr.bin.skype
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.bin.skype
+++ b/profiles/apparmor/profiles/extras/usr.bin.skype
@@ -1,40 +1,81 @@
-# Last Modified: Mon Oct 26 13:29:13 2009
-# REPOSITORY: http://apparmor.test.opensuse.org/backend/api draglor 53
-# Additional profiling based on work by ÐндÑей Ðалинин, LP:
#226624
+# Last Modified: Thu Jul 5 11:06:45 2009
+# Additional profiling based on work by:
+# - ÐндÑей Ðалинин, LP: #226624
+# - Jamie Strandboge and Ivan Frederiks, LP: #933440
#include <tunables/global>
/usr/bin/skype flags=(complain) {
#include <abstractions/audio>
#include <abstractions/base>
+ #include <abstractions/dbus-session>
#include <abstractions/fonts>
#include <abstractions/freedesktop.org>
+ #include <abstractions/gnome>
+ #include <abstractions/ibus>
#include <abstractions/kde>
#include <abstractions/nameservice>
#include <abstractions/nvidia>
+ #include <abstractions/ssl_certs>
#include <abstractions/user-tmp>
#include <abstractions/X>
- # are these needed?
- /proc/*/cmdline r,
+ @{PROC}/sys/kernel/{ostype,osrelease} r,
+ @{PROC}/[0-9]*/net/arp r,
+ owner @{PROC}/[0-9]*/auxv r,
+ owner @{PROC}/[0-9]*/cmdline r,
+ owner @{PROC}/[0-9]*/fd/ r,
+ owner @{PROC}/[0-9]*/task/ r,
+ owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
+
+ /sys/devices/**/power_supply/**/online r,
+ /sys/devices/system/cpu/ r,
+ /sys/devices/system/cpu/cpu[0-9]*/cpufreq/scaling_{cur_freq,max_freq} r,
+
+ /dev/ r,
+ owner /{dev,run}/shm/pulse-shm* m,
+ /dev/snd/* m,
/dev/video* mrw,
+
/var/cache/libx11/compose/* r,
# should this be in a separate KDE abstraction?
- @{HOME}/.kde/share/config/kioslaverc r,
+ owner @{HOME}/.kde/share/config/kioslaverc r,
/usr/bin/skype mr,
+ /etc/xdg/sni-qt.conf rk,
+ /etc/xdg/Trolltech.conf rk,
/usr/share/skype/** kr,
+ /usr/share/skype/**/*.qm mr,
/usr/share/skype/sounds/*.wav kr,
+ /usr/lib/@{multiarch}/pango/** mr,
- @{HOME}/.Skype/ rw,
- @{HOME}/.Skype/** krw,
- @{HOME}/.config/* kr,
-
- @{HOME}/.mozilla/ r,
- @{HOME}/.mozilla/*/ r,
- @{HOME}/.mozilla/*/*/ r,
- @{HOME}/.mozilla/*/*/bookmarkbackups/ r,
- @{HOME}/.mozilla/*/*/chrome/ r,
- @{HOME}/.mozilla/*/*/extensions/ r,
- @{HOME}/.mozilla/*/*/prefs.js r,
+ # For opening links in the browser (still requires explicit access to execute
+ # the browser)
+ /usr/bin/xdg-open ixr,
+
+ owner @{HOME}/.Skype/ rw,
+ owner @{HOME}/.Skype/** krw,
+ owner @{HOME}/.config/ r,
+ owner @{HOME}/.config/*/ r,
+ owner @{HOME}/.config/Skype/Skype.conf rw,
+ owner @{HOME}/.config/Trolltech.conf kr,
+
+ # Skype traverses the .mozilla directory and needs access to prefs.js
+ owner @{HOME}/.mozilla/ r,
+ owner @{HOME}/.mozilla/**/ r,
+ owner @{HOME}/.mozilla/*/*/prefs.js r,
+
+ # Skype also looks around in these directories
+ /{,usr/,usr/local/}lib/ r,
+
+ # Recent skype builds have an executable stack, so it tries to mmap certain
+ # files. Let's deny them for now.
+ deny /etc/passwd m,
+ deny /etc/group m,
+ deny /usr/share/fonts/** m,
+
+ # Silence a few non-needed writes
+ deny /var/cache/fontconfig/ w,
+ deny owner @{HOME}/.fontconfig/ w,
+ deny owner @{HOME}/.fontconfig/*.cache-*.TMP* w,
}
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
