Simon Déziel has proposed merging lp:~sdeziel/apparmor-profiles/ssh-scp-profiles into lp:apparmor-profiles.
Requested reviews: AppArmor Developers (apparmor-dev) For more details, see: https://code.launchpad.net/~sdeziel/apparmor-profiles/ssh-scp-profiles/+merge/234310 Second attempt at proposing a merge into lp:apparmor-profiles, hopefully in the right direction this time. Sorry for the noise BTW. This is a slightly modified version of the profiles posted on the Apparmor mailing list [1]. 1: https://lists.ubuntu.com/archives/apparmor/2014-August/006178.html -- https://code.launchpad.net/~sdeziel/apparmor-profiles/ssh-scp-profiles/+merge/234310 Your team AppArmor Developers is requested to review the proposed merge of lp:~sdeziel/apparmor-profiles/ssh-scp-profiles into lp:apparmor-profiles.
=== added file 'ubuntu/14.04/usr.bin.scp' --- ubuntu/14.04/usr.bin.scp 1970-01-01 00:00:00 +0000 +++ ubuntu/14.04/usr.bin.scp 2014-09-11 13:22:37 +0000 @@ -0,0 +1,16 @@ +# Author: Simon Deziel <[email protected]> + +#include <tunables/global> + +/usr/bin/scp { + #include <abstractions/base> + + # scp is almost just a wrapper around ssh + /usr/bin/ssh Px, + + # for file transfers + owner /** rw, + /** r, + + #include <local/usr.bin.scp> +} === added file 'ubuntu/14.04/usr.bin.ssh' --- ubuntu/14.04/usr.bin.ssh 1970-01-01 00:00:00 +0000 +++ ubuntu/14.04/usr.bin.ssh 2014-09-11 13:22:37 +0000 @@ -0,0 +1,84 @@ +# Author: Simon Deziel <[email protected]> + +#include <tunables/global> + +/usr/bin/ssh { + #include <abstractions/base> + #include <abstractions/nameservice> + #include <abstractions/openssl> + + capability setuid, + capability setgid, + + /etc/ssh/ssh_config r, + + # to unlock private keys + /dev/tty rw, + /usr/lib/openssh/gnome-ssh-askpass mix, + + owner @{HOME}/.ssh/ rw, + owner @{HOME}/.ssh/** rl, + owner @{HOME}/.ssh/known_hosts rwl, + # use with "ControlPath ~/.ssh/%r@%h:%p" + owner @{HOME}/.ssh/*@*:[0-9]* rwl, + # use with "ControlPath ~/.ssh/%C": a SHA1 hash of "%l%h%p%r" + owner @{HOME}/.ssh/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]* rwl, + audit deny @{HOME}/.ssh/authorized_keys{,2} rw, + audit deny @{HOME}/.ssh/config w, + audit deny @{HOME}/.ssh/id_{dsa,rsa,ecdsa,ed25519}{,.pub} w, + owner /tmp/ssh-*/ rw, + owner /tmp/ssh-*/agent.@{pid} rw, + owner /run/user/[0-9]*/keyring-*/ssh rw, + owner @{PROC}/@{pid}/fd/ r, + + # for ProxyCommand + /bin/ash Cx -> proxycommand, + /bin/bash{,2} Cx -> proxycommand, + /bin/bsh Cx -> proxycommand, + /bin/csh Cx -> proxycommand, + /bin/csh Cx -> proxycommand, + /bin/dash Cx -> proxycommand, + /bin/ksh Cx -> proxycommand, + /bin/sh Cx -> proxycommand, + /bin/tcsh Cx -> proxycommand, + /bin/zsh{,4} Cx -> proxycommand, + /usr/bin/ssh rm, + /bin/nc.openbsd rm, + + # Allow to HUP ProxyCommand from subprofile + signal (send) set=("hup") peer=/usr/bin/ssh//nc, + + profile proxycommand { + #include <abstractions/base> + + /bin/ash rm, + /bin/bash{,2} rm, + /bin/bsh rm, + /bin/csh rm, + /bin/csh rm, + /bin/dash rm, + /bin/ksh rm, + /bin/sh rm, + /bin/tcsh rm, + /bin/zsh{,4} rm, + /usr/bin/ssh Px, + # XXX: Cx doesn't work. For details, see + # https://lists.ubuntu.com/archives/apparmor/2012-November/003114.html + #/bin/nc.openbsd Cx -> nc, + /bin/nc.openbsd Px -> /usr/bin/ssh//nc, + + # unlocking the key is done by the parent so why is this needed? + /dev/tty rw, + } + profile nc { + #include <abstractions/base> + #include <abstractions/nameservice> + + # Accept HUP from parent + signal (receive) set=("hup") peer=/usr/bin/ssh, + + /bin/nc.openbsd rix, + } + + #include <local/usr.bin.ssh> +} === added file 'ubuntu/14.10/usr.bin.scp' --- ubuntu/14.10/usr.bin.scp 1970-01-01 00:00:00 +0000 +++ ubuntu/14.10/usr.bin.scp 2014-09-11 13:22:37 +0000 @@ -0,0 +1,16 @@ +# Author: Simon Deziel <[email protected]> + +#include <tunables/global> + +/usr/bin/scp { + #include <abstractions/base> + + # scp is almost just a wrapper around ssh + /usr/bin/ssh Px, + + # for file transfers + owner /** rw, + /** r, + + #include <local/usr.bin.scp> +} === added file 'ubuntu/14.10/usr.bin.ssh' --- ubuntu/14.10/usr.bin.ssh 1970-01-01 00:00:00 +0000 +++ ubuntu/14.10/usr.bin.ssh 2014-09-11 13:22:37 +0000 @@ -0,0 +1,84 @@ +# Author: Simon Deziel <[email protected]> + +#include <tunables/global> + +/usr/bin/ssh { + #include <abstractions/base> + #include <abstractions/nameservice> + #include <abstractions/openssl> + + capability setuid, + capability setgid, + + /etc/ssh/ssh_config r, + + # to unlock private keys + /dev/tty rw, + /usr/lib/openssh/gnome-ssh-askpass mix, + + owner @{HOME}/.ssh/ rw, + owner @{HOME}/.ssh/** rl, + owner @{HOME}/.ssh/known_hosts rwl, + # use with "ControlPath ~/.ssh/%r@%h:%p" + owner @{HOME}/.ssh/*@*:[0-9]* rwl, + # use with "ControlPath ~/.ssh/%C": a SHA1 hash of "%l%h%p%r" + owner @{HOME}/.ssh/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]* rwl, + audit deny @{HOME}/.ssh/authorized_keys{,2} rw, + audit deny @{HOME}/.ssh/config w, + audit deny @{HOME}/.ssh/id_{dsa,rsa,ecdsa,ed25519}{,.pub} w, + owner /tmp/ssh-*/ rw, + owner /tmp/ssh-*/agent.@{pid} rw, + owner /run/user/[0-9]*/keyring-*/ssh rw, + owner @{PROC}/@{pid}/fd/ r, + + # for ProxyCommand + /bin/ash Cx -> proxycommand, + /bin/bash{,2} Cx -> proxycommand, + /bin/bsh Cx -> proxycommand, + /bin/csh Cx -> proxycommand, + /bin/csh Cx -> proxycommand, + /bin/dash Cx -> proxycommand, + /bin/ksh Cx -> proxycommand, + /bin/sh Cx -> proxycommand, + /bin/tcsh Cx -> proxycommand, + /bin/zsh{,4} Cx -> proxycommand, + /usr/bin/ssh rm, + /bin/nc.openbsd rm, + + # Allow to HUP ProxyCommand from subprofile + signal (send) set=("hup") peer=/usr/bin/ssh//nc, + + profile proxycommand { + #include <abstractions/base> + + /bin/ash rm, + /bin/bash{,2} rm, + /bin/bsh rm, + /bin/csh rm, + /bin/csh rm, + /bin/dash rm, + /bin/ksh rm, + /bin/sh rm, + /bin/tcsh rm, + /bin/zsh{,4} rm, + /usr/bin/ssh Px, + # XXX: Cx doesn't work. For details, see + # https://lists.ubuntu.com/archives/apparmor/2012-November/003114.html + #/bin/nc.openbsd Cx -> nc, + /bin/nc.openbsd Px -> /usr/bin/ssh//nc, + + # unlocking the key is done by the parent so why is this needed? + /dev/tty rw, + } + profile nc { + #include <abstractions/base> + #include <abstractions/nameservice> + + # Accept HUP from parent + signal (receive) set=("hup") peer=/usr/bin/ssh, + + /bin/nc.openbsd rix, + } + + #include <local/usr.bin.ssh> +}
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
