This patch adds the kernelvars tunable to the global set that is usually
included by default in apparmor policies. It then converts the rules
that are intended to match /proc/pid to use this tunable.
---
profiles/apparmor.d/abstractions/apache2-common | 2 -
profiles/apparmor.d/abstractions/base | 2 -
profiles/apparmor.d/abstractions/bash | 2 -
profiles/apparmor.d/abstractions/gnome | 2 -
profiles/apparmor.d/abstractions/nameservice | 2 -
profiles/apparmor.d/abstractions/ubuntu-browsers.d/java | 16
++++----
profiles/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common | 2 -
profiles/apparmor.d/abstractions/ubuntu-konsole | 6 +--
profiles/apparmor.d/tunables/global | 1
profiles/apparmor.d/usr.lib.dovecot.dovecot-auth | 2 -
profiles/apparmor.d/usr.sbin.avahi-daemon | 2 -
profiles/apparmor.d/usr.sbin.dovecot | 2 -
profiles/apparmor.d/usr.sbin.nscd | 8 ++--
profiles/apparmor.d/usr.sbin.ntpd | 4 +-
profiles/apparmor.d/usr.sbin.smbd | 2 -
profiles/apparmor/profiles/extras/bin.netstat | 20
+++++-----
profiles/apparmor/profiles/extras/etc.cron.daily.logrotate | 2 -
profiles/apparmor/profiles/extras/sbin.dhclient | 2 -
profiles/apparmor/profiles/extras/usr.bin.evolution-2.10 | 2 -
profiles/apparmor/profiles/extras/usr.bin.gaim | 2 -
profiles/apparmor/profiles/extras/usr.bin.opera | 2 -
profiles/apparmor/profiles/extras/usr.bin.skype | 12 +++---
profiles/apparmor/profiles/extras/usr.lib.firefox.firefox | 16
++++----
profiles/apparmor/profiles/extras/usr.sbin.smbd | 2 -
profiles/apparmor/profiles/extras/usr.sbin.squid | 2 -
profiles/apparmor/profiles/extras/usr.sbin.sshd | 12 +++---
profiles/apparmor/profiles/extras/usr.sbin.useradd | 2 -
profiles/apparmor/profiles/extras/usr.sbin.userdel | 2 -
28 files changed, 67 insertions(+), 66 deletions(-)
Index: b/profiles/apparmor.d/abstractions/apache2-common
===================================================================
--- a/profiles/apparmor.d/abstractions/apache2-common
+++ b/profiles/apparmor.d/abstractions/apache2-common
@@ -11,7 +11,7 @@
/usr/share/apache2/** r,
# changehat itself
- @{PROC}/[0-9]*/attr/current w,
+ @{PROC}/@{pid}/attr/current w,
# htaccess files - for what ever it is worth
/**/.htaccess r,
Index: b/profiles/apparmor.d/tunables/global
===================================================================
--- a/profiles/apparmor.d/tunables/global
+++ b/profiles/apparmor.d/tunables/global
@@ -16,3 +16,4 @@
#include <tunables/multiarch>
#include <tunables/proc>
#include <tunables/alias>
+#include <tunables/kernelvars>
Index: b/profiles/apparmor.d/usr.sbin.nscd
===================================================================
--- a/profiles/apparmor.d/usr.sbin.nscd
+++ b/profiles/apparmor.d/usr.sbin.nscd
@@ -36,10 +36,10 @@
/var/{cache,run}/nscd/{passwd,group,services,hosts} rw,
/{,var/}run/{nscd/,}nscd.pid rwl,
/var/log/nscd.log rw,
- @{PROC}/[0-9]*/fd/ r,
- @{PROC}/[0-9]*/fd/* r,
- @{PROC}/[0-9]*/maps r,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/fd/ r,
+ @{PROC}/@{pid}/fd/* r,
+ @{PROC}/@{pid}/maps r,
+ @{PROC}/@{pid}/mounts r,
@{PROC}/filesystems r,
# Site-specific additions and overrides. See local/README for details.
Index: b/profiles/apparmor.d/usr.sbin.ntpd
===================================================================
--- a/profiles/apparmor.d/usr.sbin.ntpd
+++ b/profiles/apparmor.d/usr.sbin.ntpd
@@ -58,11 +58,11 @@
/{,var/}run/nscd/services r,
/{,var/}run/ntpd.pid w,
/var/tmp/ntp* rwl,
- @{PROC}/*/net/if_inet6 r,
+ @{PROC}/@{pid}/net/if_inet6 r,
@{PROC}/sys/kernel/ngroups_max r,
# allow access for when chrooted
- /var/lib/ntp/@{PROC}/*/net/if_inet6 r,
+ /var/lib/ntp/@{PROC}/@{pid}/net/if_inet6 r,
/var/lib/ntp/@{PROC}/sys/kernel/ngroups_max r,
@{NTPD_DEVICE} rw,
Index: b/profiles/apparmor.d/usr.lib.dovecot.dovecot-auth
===================================================================
--- a/profiles/apparmor.d/usr.lib.dovecot.dovecot-auth
+++ b/profiles/apparmor.d/usr.lib.dovecot.dovecot-auth
@@ -11,7 +11,7 @@
capability chown,
capability dac_override,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
/usr/lib/dovecot/dovecot-auth mr,
/{,var/}run/dovecot/** rw,
# required for postfix+dovecot integration
Index: b/profiles/apparmor.d/usr.sbin.smbd
===================================================================
--- a/profiles/apparmor.d/usr.sbin.smbd
+++ b/profiles/apparmor.d/usr.sbin.smbd
@@ -24,7 +24,7 @@
/etc/netgroup r,
/etc/printcap r,
/etc/samba/* rwk,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
@{PROC}/sys/kernel/core_pattern r,
/usr/lib*/samba/vfs/*.so mr,
/usr/lib*/samba/charset/*.so mr,
Index: b/profiles/apparmor/profiles/extras/usr.bin.gaim
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.bin.gaim
+++ b/profiles/apparmor/profiles/extras/usr.bin.gaim
@@ -50,7 +50,7 @@
/usr/share/sounds/gaim/* r,
/usr/share/themes/** r,
/opt/kde3/bin/kde-config mixr,
- @{PROC}/*/cmdline r,
+ @{PROC}/@{pid}/cmdline r,
/usr/X11R6/lib/Acrobat*/Resource/Font/* r,
/usr/X11R6/lib/Acrobat*/Resource/Font/PFM/* r,
/usr/lib/ao/plugins-* r,
Index: b/profiles/apparmor.d/abstractions/base
===================================================================
--- a/profiles/apparmor.d/abstractions/base
+++ b/profiles/apparmor.d/abstractions/base
@@ -89,7 +89,7 @@
/sys/devices/system/cpu/online r,
# glibc's *printf protections read the maps file
- @{PROC}/*/maps r,
+ @{PROC}/@{pid}/maps r,
# libgcrypt reads some flags from /proc
@{PROC}/sys/crypto/* r,
Index: b/profiles/apparmor.d/abstractions/bash
===================================================================
--- a/profiles/apparmor.d/abstractions/bash
+++ b/profiles/apparmor.d/abstractions/bash
@@ -32,7 +32,7 @@
# bash inspects filesystems at startup
/etc/mtab r,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
@{PROC}/filesystems r,
# probably readline wants to know terminal capabilities
Index: b/profiles/apparmor.d/usr.sbin.avahi-daemon
===================================================================
--- a/profiles/apparmor.d/usr.sbin.avahi-daemon
+++ b/profiles/apparmor.d/usr.sbin.avahi-daemon
@@ -17,7 +17,7 @@
/etc/avahi/hosts r,
/etc/avahi/services/ r,
/etc/avahi/services/*.service r,
- @{PROC}/[0-9]*/fd/ r,
+ @{PROC}/@{pid}/fd/ r,
/usr/sbin/avahi-daemon mr,
/usr/share/avahi/introspection/*.introspect r,
/usr/share/dbus-1/interfaces/org.freedesktop.Avahi.*.xml r,
Index: b/profiles/apparmor.d/usr.sbin.dovecot
===================================================================
--- a/profiles/apparmor.d/usr.sbin.dovecot
+++ b/profiles/apparmor.d/usr.sbin.dovecot
@@ -19,7 +19,7 @@
/etc/mtab r,
/etc/lsb-release r,
/etc/SuSE-release r,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
/usr/lib/dovecot/dovecot-auth Pxmr,
/usr/lib/dovecot/imap Pxmr,
/usr/lib/dovecot/imap-login Pxmr,
Index: b/profiles/apparmor.d/abstractions/ubuntu-browsers.d/java
===================================================================
--- a/profiles/apparmor.d/abstractions/ubuntu-browsers.d/java
+++ b/profiles/apparmor.d/abstractions/ubuntu-browsers.d/java
@@ -28,8 +28,8 @@
network inet stream,
network inet6 stream,
- @{PROC}/[0-9]*/net/if_inet6 r,
- @{PROC}/[0-9]*/net/ipv6_route r,
+ @{PROC}/@{pid}/net/if_inet6 r,
+ @{PROC}/@{pid}/net/ipv6_route r,
/etc/java-*/ r,
/etc/java-*/** r,
@@ -37,8 +37,8 @@
/etc/ssl/certs/java/* r,
/etc/timezone r,
- @{PROC}/[0-9]*/ r,
- @{PROC}/[0-9]*/fd/ r,
+ @{PROC}/@{pid}/ r,
+ @{PROC}/@{pid}/fd/ r,
@{PROC}/filesystems r,
/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/** r,
@@ -70,8 +70,8 @@
network inet stream,
network inet6 stream,
- @{PROC}/[0-9]*/net/if_inet6 r,
- @{PROC}/[0-9]*/net/ipv6_route r,
+ @{PROC}/@{pid}/net/if_inet6 r,
+ @{PROC}/@{pid}/net/ipv6_route r,
@{PROC}/loadavg r,
/etc/debian_version r,
@@ -81,8 +81,8 @@
/etc/ssl/certs/java/* r,
/etc/timezone r,
- @{PROC}/[0-9]*/ r,
- @{PROC}/[0-9]*/fd/ r,
+ @{PROC}/@{pid}/ r,
+ @{PROC}/@{pid}/fd/ r,
@{PROC}/filesystems r,
/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/** r,
Index: b/profiles/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common
===================================================================
--- a/profiles/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common
+++ b/profiles/apparmor.d/abstractions/ubuntu-browsers.d/plugins-common
@@ -3,7 +3,7 @@
#
# Plugins/helpers
#
- @{PROC}/[0-9]*/fd/ r,
+ @{PROC}/@{pid}/fd/ r,
/usr/lib/** rm,
/bin/bash ixr,
/bin/dash ixr,
Index: b/profiles/apparmor.d/abstractions/nameservice
===================================================================
--- a/profiles/apparmor.d/abstractions/nameservice
+++ b/profiles/apparmor.d/abstractions/nameservice
@@ -77,4 +77,4 @@
network inet6 dgram,
# interface details
- @{PROC}/*/net/route r,
+ @{PROC}/@{pid}/net/route r,
Index: b/profiles/apparmor.d/abstractions/ubuntu-konsole
===================================================================
--- a/profiles/apparmor.d/abstractions/ubuntu-konsole
+++ b/profiles/apparmor.d/abstractions/ubuntu-konsole
@@ -6,9 +6,9 @@
#include <abstractions/consoles>
#include <abstractions/kde>
capability sys_ptrace,
- @{PROC}/[0-9]*/status r,
- @{PROC}/[0-9]*/stat r,
- @{PROC}/[0-9]*/cmdline r,
+ @{PROC}/@{pid}/status r,
+ @{PROC}/@{pid}/stat r,
+ @{PROC}/@{pid}/cmdline r,
/{,var/}run/utmp r,
/dev/ptmx rw,
Index: b/profiles/apparmor.d/abstractions/gnome
===================================================================
--- a/profiles/apparmor.d/abstractions/gnome
+++ b/profiles/apparmor.d/abstractions/gnome
@@ -70,7 +70,7 @@
# gvfs
/usr/share/gvfs/remote-volume-monitors/ r,
/usr/share/gvfs/remote-volume-monitors/* r,
- @{PROC}/*/mounts r,
+ @{PROC}/@{pid}/mounts r,
# printing
/etc/papersize r,
Index: b/profiles/apparmor/profiles/extras/usr.sbin.userdel
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.sbin.userdel
+++ b/profiles/apparmor/profiles/extras/usr.sbin.userdel
@@ -38,7 +38,7 @@
/etc/shadow* rwl,
/etc/pwdutils/logging r,
@{HOMEDIRS}** rwl,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
/usr/bin/crontab rmix,
/usr/lib*/pwdutils/*.so.* mr,
/usr/sbin/userdel rmix,
Index: b/profiles/apparmor/profiles/extras/sbin.dhclient
===================================================================
--- a/profiles/apparmor/profiles/extras/sbin.dhclient
+++ b/profiles/apparmor/profiles/extras/sbin.dhclient
@@ -38,7 +38,7 @@
/etc/dhclient.conf r,
@{PROC}/ r,
@{PROC}/interrupts r,
- @{PROC}/*/net/dev r,
+ @{PROC}/@{pid}/net/dev r,
@{PROC}/rtc r,
# following rule shouldn't work, self is a symlink
@{PROC}/self/status r,
Index: b/profiles/apparmor/profiles/extras/usr.bin.opera
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.bin.opera
+++ b/profiles/apparmor/profiles/extras/usr.bin.opera
@@ -32,7 +32,7 @@
/etc/cups/lpoptions r,
/etc/opera6rc rw,
/etc/opera6rc.fixed rw,
- @{PROC}/[0-9]*/stat r,
+ @{PROC}/@{pid}/stat r,
@{PROC}/net/if_inet6 r,
@{PROC}/sys/vm/heap-stack-gap r,
Index: b/profiles/apparmor/profiles/extras/usr.sbin.smbd
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.sbin.smbd
+++ b/profiles/apparmor/profiles/extras/usr.sbin.smbd
@@ -31,7 +31,7 @@
@{HOME}/** rwl,
@{HOMEDIRS} rwl,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
/tmp rw,
/var/tmp rw,
/var/tmp/** lrw,
Index: b/profiles/apparmor/profiles/extras/usr.sbin.squid
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.sbin.squid
+++ b/profiles/apparmor/profiles/extras/usr.sbin.squid
@@ -29,7 +29,7 @@
/dev/tty rw,
/etc/mtab r,
/etc/squid/* r,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
@{PROC}/mounts r,
/usr/share/squid/** r,
/var/log/squid/access.log w,
Index: b/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate
===================================================================
--- a/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate
+++ b/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate
@@ -40,7 +40,7 @@
/etc/logrotate.d/* r,
/etc/subdomain.d r,
@{PROC} r,
- @{PROC}/[1-9]* r,
+ @{PROC}/@{pid} r,
/tmp w,
/tmp/file* wl,
/tmp/logrot* wlr,
Index: b/profiles/apparmor/profiles/extras/usr.sbin.sshd
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.sbin.sshd
+++ b/profiles/apparmor/profiles/extras/usr.sbin.sshd
@@ -40,15 +40,15 @@
/etc/hosts.deny r,
/etc/modules.conf r,
/etc/ssh/* r,
- @{PROC}/[0-9]*/oom_adj rw,
- @{PROC}/[0-9]*/oom_score_adj rw,
+ @{PROC}/@{pid}/oom_adj rw,
+ @{PROC}/@{pid}/oom_score_adj rw,
/usr/sbin/sshd mrix,
/var/log/btmp r,
/{,var/}run w,
/{,var/}run/sshd{,.init}.pid wl,
- @{PROC}/[0-9]*/fd/ r,
- @{PROC}/[0-9]*/loginuid w,
+ @{PROC}/@{pid}/fd/ r,
+ @{PROC}/@{pid}/loginuid w,
# should only be here for use in non-change-hat openssh
# duplicated from EXEC hat
@@ -74,7 +74,7 @@
/dev/pts/[0-9]* rw,
/etc/ssh/moduli r,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
# duplicated from AUTHENTICATED
/etc/motd r,
@@ -143,7 +143,7 @@
/etc/hosts.allow r,
/etc/hosts.deny r,
/etc/ssh/moduli r,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
# for debugging
# /dev/pts/[0-9]* rw,
Index: b/profiles/apparmor/profiles/extras/usr.sbin.useradd
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.sbin.useradd
+++ b/profiles/apparmor/profiles/extras/usr.sbin.useradd
@@ -38,7 +38,7 @@
/etc/skel r,
/etc/skel/** r,
@{HOMEDIRS}** rw,
- @{PROC}/[0-9]*/mounts r,
+ @{PROC}/@{pid}/mounts r,
@{PROC}/filesystems r,
/usr/lib*/pwdutils/*so* mr,
/usr/sbin/adduser rmix,
Index: b/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10
+++ b/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10
@@ -126,7 +126,7 @@
/usr/share/** r,
/opt/kde3/share/** r,
/opt/mozilla/bin/mozilla.sh Pxr,
- @{PROC}/*/cmdline r,
+ @{PROC}/@{pid}/cmdline r,
@{PROC}/net r,
@{PROC}/net/* r,
/tmp r,
Index: b/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox
+++ b/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox
@@ -28,8 +28,8 @@
# for networking
network inet stream,
network inet6 stream,
- @{PROC}/[0-9]*/net/if_inet6 r,
- @{PROC}/[0-9]*/net/ipv6_route r,
+ @{PROC}/@{pid}/net/if_inet6 r,
+ @{PROC}/@{pid}/net/ipv6_route r,
# should maybe be in abstractions
/usr/share/xubuntu/applications/defaults.list r,
@@ -68,17 +68,17 @@
/sbin/killall5 ixr,
/bin/which ixr,
/usr/bin/tr ixr,
- @{PROC}/[0-9]*/cmdline r,
- @{PROC}/[0-9]*/mountinfo r,
- @{PROC}/[0-9]*/stat r,
- @{PROC}/[0-9]*/status r,
+ @{PROC}/@{pid}/cmdline r,
+ @{PROC}/@{pid}/mountinfo r,
+ @{PROC}/@{pid}/stat r,
+ @{PROC}/@{pid}/status r,
/etc/mtab r,
/etc/fstab r,
# Needed for the crash reporter
- owner @{PROC}/[0-9]*/environ r,
- owner @{PROC}/[0-9]*/auxv r,
+ owner @{PROC}/@{pid}/environ r,
+ owner @{PROC}/@{pid}/auxv r,
/etc/lsb-release r,
/usr/bin/expr ix,
Index: b/profiles/apparmor/profiles/extras/bin.netstat
===================================================================
--- a/profiles/apparmor/profiles/extras/bin.netstat
+++ b/profiles/apparmor/profiles/extras/bin.netstat
@@ -26,16 +26,16 @@
/bin/netstat rmix,
/etc/networks r,
@{PROC} r,
- @{PROC}/[0-9]*/cmdline r,
- @{PROC}/[0-9]*/fd r,
+ @{PROC}/@{pids}/cmdline r,
+ @{PROC}/@{pids}/fd r,
@{PROC}/net r,
@{PROC}/net/* r,
- @{PROC}/*/fd/ r,
- owner @{PROC}/*/net/raw r,
- owner @{PROC}/*/net/raw6 r,
- owner @{PROC}/*/net/tcp r,
- owner @{PROC}/*/net/tcp6 r,
- owner @{PROC}/*/net/udp r,
- owner @{PROC}/*/net/udp6 r,
- owner @{PROC}/*/net/unix r,
+ @{PROC}/@{pids}/fd/ r,
+ owner @{PROC}/@{pid}/net/raw r,
+ owner @{PROC}/@{pid}/net/raw6 r,
+ owner @{PROC}/@{pid}/net/tcp r,
+ owner @{PROC}/@{pid}/net/tcp6 r,
+ owner @{PROC}/@{pid}/net/udp r,
+ owner @{PROC}/@{pid}/net/udp6 r,
+ owner @{PROC}/@{pid}/net/unix r,
}
Index: b/profiles/apparmor/profiles/extras/usr.bin.skype
===================================================================
--- a/profiles/apparmor/profiles/extras/usr.bin.skype
+++ b/profiles/apparmor/profiles/extras/usr.bin.skype
@@ -19,12 +19,12 @@
#include <abstractions/X>
@{PROC}/sys/kernel/{ostype,osrelease} r,
- @{PROC}/[0-9]*/net/arp r,
- owner @{PROC}/[0-9]*/auxv r,
- owner @{PROC}/[0-9]*/cmdline r,
- owner @{PROC}/[0-9]*/fd/ r,
- owner @{PROC}/[0-9]*/task/ r,
- owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
+ @{PROC}/@{pid}/net/arp r,
+ owner @{PROC}/@{pid}/auxv r,
+ owner @{PROC}/@{pid}/cmdline r,
+ owner @{PROC}/@{pid}/fd/ r,
+ owner @{PROC}/@{pid}/task/ r,
+ owner @{PROC}/@{pid}/task/[0-9]*/stat r,
/sys/devices/**/power_supply/**/online r,
/sys/devices/system/cpu/ r,
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
