On 01/03/2014 04:26 PM, Tyler Hicks wrote: > Move the file rule from the existing permissive session bus abstraction > into a new strict session bus abstraction. > Thanks for all these! This is a really good idea. Sorry for not responding sooner. ... > > diff --git a/profiles/apparmor.d/abstractions/dbus-session > b/profiles/apparmor.d/abstractions/dbus-session > index 76a7bbf..2eda4e0 100644 > --- a/profiles/apparmor.d/abstractions/dbus-session > +++ b/profiles/apparmor.d/abstractions/dbus-session
...
> - /usr/bin/dbus-launch ix,
...
> diff --git a/profiles/apparmor.d/abstractions/dbus-session-strict
> b/profiles/apparmor.d/abstractions/dbus-session-strict
> + /usr/bin/dbus-launch ix,
...
First off, can we change this to be 'Pix'?
Secondly, I wonder if this rule should be in the permissive session bus
abstraction rather than the strict one. I have quite a few profiles that use
dbus rules without the existing dbus abstractions, and only one has a
/usr/bin/dbus-launch rule. Moving '/usr/bin/dbus-launch Pix,' out of
dbus-session-strict seems to make a lot of sense and I suggest we just do that.
What do others think?
Lastly, what I have for that profile is:
/usr/bin/dbus-launch Cx -> dbus_launch,
profile dbus_launch {
#include <abstractions/base>
#include <abstractions/nameservice>
#include <abstractions/X>
/usr/bin/dbus-launch r,
}
This confinement for dbus-launch is mildly interesting, but I think we might
have some issues if we use a child profile in this exact manner in the
abstraction. We could ship the profile outside of the abstraction though, and
use 'Pix -> dbus_launch' in the abstraction instead. It doesn't give much added
security, but dbus-launch clearly doesn't need much access.
--
Jamie Strandboge http://www.ubuntu.com/
signature.asc
Description: OpenPGP digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
