Originally Posted by
linuxyogi
I am looking for some good apparmor profiles but I cant find any and if am not wrong profile for a particular app differ from distro to didtro.s
Here's what I got for Ubuntu 14.04 beta. It probably works for 12.04. Check step 3 below to be sure.
Code:
#include <tunables/global>
/usr/bin/transmission-gtk {
#include <abstractions/base>
#include <abstractions/gnome>
#include <abstractions/lightdm>
#include <abstractions/nameservice>
#include <abstractions/user-tmp>
network inet stream,
network inet6 stream,
owner /.Trash-*/ w,
owner @{HOME}/.Xauthority r,
owner @{HOME}/.cache/transmission/ w,
owner @{HOME}/.cache/transmission/** rw,
owner @{HOME}/.config/dconf/user r,
owner @{HOME}/.config/gtk-3.0/bookmarks r,
owner @{HOME}/.config/transmission/ w,
owner @{HOME}/.config/transmission/** rw,
owner @{HOME}/.config/user-dirs.dirs r,
owner @{HOME}/.local/share/Trash/files/* w,
owner @{HOME}/.local/share/Trash/info/* rw,
owner @{HOME}/.local/share/applications/ r,
owner @{HOME}/.local/share/applications/mimeapps.list r,
owner @{HOME}/.local/share/applications/mimeinfo.cache r,
owner @{HOME}/.local/share/gvfs-metadata/home r,
owner @{HOME}/.local/share/gvfs-metadata/home-*.log r,
owner @{HOME}/.local/share/gvfs-metadata/root r,
owner @{HOME}/.local/share/gvfs-metadata/root-*.log r,
owner @{HOME}/.local/share/mime/mime.cache r,
owner @{HOME}/.local/share/recently-used.xbel rw,
owner @{HOME}/.local/share/recently-used.xbel.* rw,
owner @{HOME}/Downloads/** rw,
@{PROC}/*/fd/ r,
@{PROC}/*/mountinfo r,
@{PROC}/[0-9]*/net/dev r,
@{PROC}/[0-9]*/net/if_inet6 r,
@{PROC}/[0-9]*/net/wireless r,
@{PROC}/net/ipv6_route r,
@{PROC}/net/route r,
@{PROC}/sys/kernel/random/uuid r,
}
It's the first profile I've tried making so it is likely to be imperfect.
Here's how I got it.
1) Generating an initial profile takes three steps.
1a) start up aa-genprof
Code:
sudo aa-genprof /usr/bin/transmission-gtk
1b) Then I wiped all configurations for Transmission and started it up and ran it through all the actions I could think of:
Code:
/usr/bin/transmission-gtk
2) Initial refinement of the profile takes several steps. Repeat until "done" with globbing and consolidation.
2a) Edit the rules manually, globbing where possible. See the manual page for apparmor.d Add in 'includes' as needed, they can be found in /etc/apparmor.d/abstractions/ and /etc/apparmor.d/tunables/
Code:
sudo nano -w /etc/apparmor.d/usr.bin.transmission-gtk
2b) Set apparmor to test the rules
Code:
sudo aa-complain /usr/bin/transmission-gtk
2c) Run transmission through its paces again.
Code:
/usr/bin/transmission-gtk
2d) Add any exceptions
3) Final refinements. Repeat until done.
3a) Edit in rule qualifiers like 'owner' and variables like @{HOME} and @{PROC}
3b) Load apparmor in enforcing mode. Needs to be done each time the profile is changed.
Code:
sudo aa-enforce /usr/bin/transmission-gtk
3c) Watch the logs for problems and while that is running, put Transmission through its paces.
Code:
sudo tail -f /var/log/kern.log | grep apparmor
Bookmarks