On 12-12-18 07:00 PM, Seth Arnold wrote:
> On Tue, Dec 18, 2012 at 05:26:49PM -0500, Simon Deziel wrote:
>> I am wondering why some of the profile abstractions are not using the
>> owner prefix with the variable @{HOME} while many others do (and some
>> mix both)?
>
> Funny, Steve's recent patch set made me wonder the same thing. (If only
> by shining a light clearly on the differences again.)
That's exactly what triggered my question.
> In some cases, 'owner' couldn't work -- e.g., Apache's mod_userdir. I'm
> sure there are others.
>
> Different sites have different security goals and our provided profiles
> are intended to help the people who want to be safer than running without
> AppArmor, but don't want to put in effort to use it.
>
> This does mean missing some opportunities for further tightening profiles.
>
> If we add 'owner' to every desktop-oriented program where it makes sense,
> some of our users will be upset that they cannot share files amongst the
> users -- shared documents, shared music, shared photos, etc., are common
> among families (and historical acedemic Unix deployments have tended to
> be everything shared by default, and specific things like ~/.netrc, mail
> spools, browser cookie stores, etc., kept private).
I understand that security shouldn't get too much in the way.
Since many of the rules are covering hidden/config files, I would expect
that blocking such access with "owner" wouldn't be too problematic IMHO.
As an example, I'm assuming someone running a KDE program as a regular
user should only need read/write access to his own KDE config files. For
that use case, using "owner" has very limited downside if any, IMHO.
> If we don't add 'owner' to the rules, a virus or worm is more likely to be
> able to spread outside of one user account to infect other user accounts,
> either by actively writing to other user's data, or by allowing a program
> to read another user's infected data. (Think of a corrupt user-installed
> font, corrupted PDF, etc.)
Agreed. Also, I can't think of a good scenario where someone would need
read (or even write) access to another user's fonts or config files.
> I could see using 'owner' everywhere, using 'owner' only to keep some
> data separate (~/.ssh, ~/.gnupg, etc.), or not using 'owner' at all.
>
> I think I fall down on the "keep private data private" version. It feels
> like the best balance for the most number of users who won't themselves
> edit profiles. It also requires a decision at every use...
If you expand the notion of "private data" to also cover config/hidden
files maybe we are both agreeing :)
I have attached a patch that adds "owner" for config/hidden files so
comments/improvements are welcome.
Thanks for the feedback so far.
Regards,
Simon
=== modified file 'profiles/apparmor.d/abstractions/X'
--- profiles/apparmor.d/abstractions/X 2012-04-25 18:36:51 +0000
+++ profiles/apparmor.d/abstractions/X 2012-12-19 23:00:34 +0000
@@ -13,10 +13,10 @@
# .ICEauthority files required for X authentication, per user
- @{HOME}/.ICEauthority r,
+ owner @{HOME}/.ICEauthority r,
# .Xauthority files required for X connections, per user
- @{HOME}/.Xauthority r,
+ owner @{HOME}/.Xauthority r,
owner /{,var/}run/gdm{,3}/*/database r,
owner /{,var/}run/lightdm/authority/[0-9]* r,
=== modified file 'profiles/apparmor.d/abstractions/audio'
--- profiles/apparmor.d/abstractions/audio 2011-08-04 23:52:45 +0000
+++ profiles/apparmor.d/abstractions/audio 2012-12-19 23:00:49 +0000
@@ -40,12 +40,12 @@
/usr/share/alsa/** r,
/usr/share/sounds/** r,
-@{HOME}/.esd_auth r,
-@{HOME}/.asoundrc r,
+owner @{HOME}/.esd_auth r,
+owner @{HOME}/.asoundrc r,
/etc/esound/esd.conf r,
# libcanberra
-@{HOME}/.cache/event-sound-cache.* rwk,
+owner @{HOME}/.cache/event-sound-cache.* rwk,
# pulse
/etc/pulse/ r,
=== modified file 'profiles/apparmor.d/abstractions/bash'
--- profiles/apparmor.d/abstractions/bash 2012-08-06 11:56:31 +0000
+++ profiles/apparmor.d/abstractions/bash 2012-12-19 22:57:02 +0000
@@ -10,10 +10,10 @@
# user-specific bash files
@{HOMEDIRS} r,
- @{HOME}/.bashrc r,
- @{HOME}/.profile r,
- @{HOME}/.bash_profile r,
- @{HOME}/.bash_history rw,
+ owner @{HOME}/.bashrc r,
+ owner @{HOME}/.profile r,
+ owner @{HOME}/.bash_profile r,
+ owner @{HOME}/.bash_history rw,
# system-wide bash configuration
/etc/profile.dos r,
=== modified file 'profiles/apparmor.d/abstractions/fonts'
--- profiles/apparmor.d/abstractions/fonts 2012-08-14 18:40:58 +0000
+++ profiles/apparmor.d/abstractions/fonts 2012-12-19 22:54:28 +0000
@@ -33,14 +33,14 @@
/usr/share/texmf/{,*/}fonts/** r,
/var/lib/ghostscript/** r,
- @{HOME}/.fonts.conf r,
- @{HOME}/.fonts/ r,
- @{HOME}/.fonts/** r,
- @{HOME}/.fonts.cache-2 mr,
- @{HOME}/.{,cache/}fontconfig/ r,
- @{HOME}/.{,cache/}fontconfig/** mrl,
- @{HOME}/.fonts.conf.d/ r,
- @{HOME}/.fonts.conf.d/** r,
+ owner @{HOME}/.fonts.conf r,
+ owner @{HOME}/.fonts/ r,
+ owner @{HOME}/.fonts/** r,
+ owner @{HOME}/.fonts.cache-2 mr,
+ owner @{HOME}/.{,cache/}fontconfig/ r,
+ owner @{HOME}/.{,cache/}fontconfig/** mrl,
+ owner @{HOME}/.fonts.conf.d/ r,
+ owner @{HOME}/.fonts.conf.d/** r,
/usr/local/share/fonts/ r,
/usr/local/share/fonts/** r,
=== modified file 'profiles/apparmor.d/abstractions/gnome'
--- profiles/apparmor.d/abstractions/gnome 2012-08-14 19:31:58 +0000
+++ profiles/apparmor.d/abstractions/gnome 2012-12-19 22:56:12 +0000
@@ -38,24 +38,24 @@
/usr/lib/@{multiarch}/gdk-pixbuf-*/** mr,
# per-user gtk configuration
- @{HOME}/.gnome/Gnome r,
- @{HOME}/.gtk r,
- @{HOME}/.gtkrc r,
- @{HOME}/.gtkrc-2.0 r,
- @{HOME}/.gtk-bookmarks r,
- @{HOME}/.themes/ r,
- @{HOME}/.themes/** r,
+ owner @{HOME}/.gnome/Gnome r,
+ owner @{HOME}/.gtk r,
+ owner @{HOME}/.gtkrc r,
+ owner @{HOME}/.gtkrc-2.0 r,
+ owner @{HOME}/.gtk-bookmarks r,
+ owner @{HOME}/.themes/ r,
+ owner @{HOME}/.themes/** r,
# for gtk file dialog
- @{HOME}/.config/gtk-2.0/** r,
- @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
+ owner @{HOME}/.config/gtk-2.0/** r,
+ owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
# from evolution-mail
- @{HOME}/.gconfd/lock/* r,
- @{HOME}/.gnome/application-info r,
+ owner @{HOME}/.gconfd/lock/* r,
+ owner @{HOME}/.gnome/application-info r,
# per-user font business
- @{HOME}/.fonts.cache-* rwl,
+ owner @{HOME}/.fonts.cache-* rwl,
# icon caches
/var/cache/**/icon-theme.cache r,
=== modified file 'profiles/apparmor.d/abstractions/gnupg'
--- profiles/apparmor.d/abstractions/gnupg 2007-08-27 23:49:51 +0000
+++ profiles/apparmor.d/abstractions/gnupg 2012-12-19 22:55:06 +0000
@@ -2,9 +2,9 @@
# gnupg sub-process running permissions
# user configurations
- @{HOME}/.gnupg/options r,
- @{HOME}/.gnupg/pubring.gpg r,
- @{HOME}/.gnupg/random_seed rw,
- @{HOME}/.gnupg/secring.gpg r,
- @{HOME}/.gnupg/so/*.x86_64 mr,
- @{HOME}/.gnupg/trustdb.gpg rw,
+ owner @{HOME}/.gnupg/options r,
+ owner @{HOME}/.gnupg/pubring.gpg r,
+ owner @{HOME}/.gnupg/random_seed rw,
+ owner @{HOME}/.gnupg/secring.gpg r,
+ owner @{HOME}/.gnupg/so/*.x86_64 mr,
+ owner @{HOME}/.gnupg/trustdb.gpg rw,
=== modified file 'profiles/apparmor.d/abstractions/kde'
--- profiles/apparmor.d/abstractions/kde 2012-01-19 14:20:28 +0000
+++ profiles/apparmor.d/abstractions/kde 2012-12-19 22:56:36 +0000
@@ -23,13 +23,13 @@
/etc/kde3/* r,
/etc/kde4rc r,
-@{HOME}/.DCOPserver_* r,
-@{HOME}/.ICEauthority r,
-@{HOME}/.fonts.* lrw,
-@{HOME}/.kde{,4}/share/config/kdeglobals rw,
-@{HOME}/.kde{,4}/share/config/*.lock rwl,
-@{HOME}/.qt/** rw,
-@{HOME}/.config/Trolltech.conf rwk,
+owner @{HOME}/.DCOPserver_* r,
+owner @{HOME}/.ICEauthority r,
+owner @{HOME}/.fonts.* lrw,
+owner @{HOME}/.kde{,4}/share/config/kdeglobals rw,
+owner @{HOME}/.kde{,4}/share/config/*.lock rwl,
+owner @{HOME}/.qt/** rw,
+owner @{HOME}/.config/Trolltech.conf rwk,
/usr/share/icons/ r,
/usr/share/icons/** r,
=== modified file 'profiles/apparmor.d/abstractions/ubuntu-browsers.d/user-files'
--- profiles/apparmor.d/abstractions/ubuntu-browsers.d/user-files 2012-01-19 14:20:28 +0000
+++ profiles/apparmor.d/abstractions/ubuntu-browsers.d/user-files 2012-12-19 23:21:58 +0000
@@ -5,7 +5,6 @@
@{HOME}/ r,
@{HOME}/** r,
owner @{HOME}/** w,
- owner @{HOME}/Desktop/** r,
# Do not allow read and/or write to particularly sensitive/problematic files
#include <abstractions/private-files>
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
