Attachment 867631 Details for Bug 1211989

snap-update-ns.acestreamplayer profile

snap-update-ns.acestreamplayer.profile (text/plain), 16.04 KB, created by Aleksey Kontsevich on 2023-06-16 19:47:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Aleksey Kontsevich

Created: 2023-06-16 19:47:28 UTC

Size: 16.04 KB

patch

obsolete

>
># Description: Allows snap-update-ns to construct the mount namespace specific
># to a particular snap (see the name below). This specifically includes the
># precise locations of the layout elements.
>
># vim:syntax=apparmor
>
> 
>
>##included <tunables/global>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006-2009 Novell/SUSE
>#    Copyright (C) 2010-2014 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># All the tunables definitions that should be available to every profile
># should be included here
>
> 
>
>##included <tunables/home>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006-2009 Novell/SUSE
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{HOMEDIRS} is a space-separated list of where user home directories
># are stored, for programs that must enumerate all home directories on a
># system.
>@{HOMEDIRS}=/home/
>
>
># @{HOME} is a space-separated list of all user home directories. While
># it doesn't refer to a specific home directory (AppArmor doesn't
># enforce discretionary access controls) it can be used as if it did
># refer to a specific home directory
>@{HOME}=@{HOMEDIRS}/*/ /root/
>
>
># Also, include files in tunables/home.d for site-specific adjustments to
># @{HOMEDIRS}.
> 
>
>##included <tunables/home.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following is a space-separated list of where additional user home
># directories are stored, each must have a trailing '/'. Directories added
># here are appended to @{HOMEDIRS}.  See tunables/home for details. Eg:
>#@{HOMEDIRS}+=/srv/nfs/home/ /mnt/home/
>
>
> 
>
>##included <tunables/multiarch>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{multiarch} is the set of patterns matching multi-arch library
># install prefixes.
>@{multiarch}=*-linux-gnu*
>
>
># Also, include files in tunables/multiarch.d for site and packaging
># specific adjustments to @{multiarch}.
> 
>
>##included <tunables/multiarch.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2011 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following is a space-separated list of where additional multipath
># prefixes are stored, each should not have a trailing '/'. Directories
># added here are appended to @{multiarch}. See tunables/mutliarch for details. Eg:
>#@{multiarch}+=*-freebsd* s390-hurd-zomg
>
>
> 
>
>##included <tunables/proc>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2006 Novell/SUSE
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{PROC} is the location where procfs is mounted.
>@{PROC}=/proc/
>
>
> 
>
>##included <tunables/alias>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2010 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># Alias rules can be used to rewrite paths and are done after variable
># resolution. For example, if '/usr' is on removable media:
># alias /usr/ -> /mnt/usr/,
>#
># Or if mysql databases are stored in /home:
># alias /var/lib/mysql/ -> /home/mysql/,
>
> 
>
>##included <tunables/kernelvars>
>#    Copyright (C) 2012 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># This file should contain declarations to kernel vars or variables
># that will become kernel vars at some point
>
># until kernel vars are implemented
># and until the parser supports nested groupings like
>#   @{pid}=[1-9]{[0-9]{[0-9]{[0-9]{[0-9]{[0-9],},},},},}
># use
>@{pid}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]}
>
>
>#same pattern as @{pid} for now
>@{tid}=@{pid}
>
>
>#A pattern for pids that can appear
>@{pids}=@{pid}
>
>
># Placeholder for user id until kernel var is implemented to match
># current user of the confined application.
># Values are 0...4,294,967,295 (32-bit unsigned, 10 digits).
>@{uid}={[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]}
>
>
>#same pattern as @{uid} for now
>@{uids}=@{uid}
>
>
># until kernel var is implemented
>@{sys}=/sys/
>
>
> 
>
>##included <tunables/xdg-user-dirs>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2014 Canonical Ltd.
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># Define the common set of XDG user directories (usually defined in
># /etc/xdg/user-dirs.defaults)
>@{XDG_DESKTOP_DIR}="Desktop"
>
>@{XDG_DOWNLOAD_DIR}="Downloads"
>
>@{XDG_TEMPLATES_DIR}="Templates"
>
>@{XDG_PUBLICSHARE_DIR}="Public"
>
>@{XDG_DOCUMENTS_DIR}="Documents"
>
>@{XDG_MUSIC_DIR}="Music"
>
>@{XDG_PICTURES_DIR}="Pictures"
>
>@{XDG_VIDEOS_DIR}="Videos"
>
>
># Also, include files in tunables/xdg-user-dirs.d for site-specific adjustments
># to the various XDG directories
> 
>
>##included <tunables/xdg-user-dirs.d>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2014 Canonical Ltd.
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># The following may be used to add additional entries such as for
># translations. See tunables/xdg-user-dirs for details. Eg:
>#@{XDG_MUSIC_DIR}+="Musique"
>
>#@{XDG_DESKTOP_DIR}+=""
>#@{XDG_DOWNLOAD_DIR}+=""
>#@{XDG_TEMPLATES_DIR}+=""
>#@{XDG_PUBLICSHARE_DIR}+=""
>#@{XDG_DOCUMENTS_DIR}+=""
>#@{XDG_MUSIC_DIR}+=""
>#@{XDG_PICTURES_DIR}+=""
>#@{XDG_VIDEOS_DIR}+=""
>
>
> 
>
>##included <tunables/share>
>@{flatpak_exports_root} = {flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export}
>
>
># System-wide directories with behaviour analogous to /usr/share
># in patterns like the freedesktop.org basedir spec. These are
># owned by root or a system user, appear in XDG_DATA_DIRS, and
># are the parent directory for `applications`, `themes`,
># `dbus-1/services`, etc.
>@{system_share_dirs} = /{usr,usr/local,var/lib/@{flatpak_exports_root}}/share
>
>
># Per-user/personal directories with behaviour analogous to
># ~/.local/share in patterns like the freedesktop.org basedir spec.
># These are owned by the user running an application, appear in
># XDG_DATA_DIRS or XDG_DATA_HOME, and are the parent directory
># for the same subdirectories as @{system_share_dirs}
>@{user_share_dirs} = @{HOME}/.local{,/share/@{flatpak_exports_root}}/share
>
>
> 
>
>##included <tunables/etc>
># ------------------------------------------------------------------
>#
>#    Copyright (C) 2020 Christian Boltz
>#
>#    This program is free software; you can redistribute it and/or
>#    modify it under the terms of version 2 of the GNU General Public
>#    License published by the Free Software Foundation.
>#
># ------------------------------------------------------------------
>
># @{etc_ro} contains a space-separated list of the system configuration directories.
># Traditionally this means /etc/, but when using a read-only / filesystem and/or
># with the goal of having only user-modified config files in /etc/, directories
># like /usr/etc/ get introduced for storing the default config.
>
># @{etc_ro} contains directories with configuration files, including read-only directories.
># Do not use @{etc_ro} in rules that allow write access.
>@{etc_ro}=/etc/ /usr/etc/
>
>
># @{etc_rw} contains directories where writing to configuration files is allowed.
># @{etc_rw} should always be a subset of @{etc_ro}.
>#
># Only use @{etc_rw} if the profile allows writing to a configuration file.
># For rules that only allows read access, use @{etc_ro}.
>@{etc_rw}=/etc/
>
>
># Also, include files in tunables/etc.d/ for site-specific adjustments to
># @{etc_ro} and @{etc_rw}.
> 
>
>##failed include <tunables/etc.d>
>
>
> 
>
>##included <tunables/run>
>@{run}=/run/ /var/run/
>
>
>
>
>profile snap-update-ns.acestreamplayer (attach_disconnected) {
>  # The next four rules mirror those above. We want to be able to read
>  # and map snap-update-ns into memory but it may come from a variety of places.
>  /usr/lib{,exec,64}/snapd/snap-update-ns mr,
>  /var/lib/snapd/hostfs/usr/lib{,exec,64}/snapd/snap-update-ns mr,
>  /{,var/lib/snapd/}snap/{core,snapd}/*/usr/lib/snapd/snap-update-ns mr,
>  /var/lib/snapd/hostfs/{,var/lib/snapd/}snap/core/*/usr/lib/snapd/snap-update-ns mr,
>
>  # Allow reading the dynamic linker cache.
>  /etc/ld.so.cache r,
>  # Allow reading, mapping and executing the dynamic linker.
>  /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}ld-*.so mrix,
>  # Allow reading and mapping various parts of the standard library and
>  # dynamically loaded nss modules and what not.
>  /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libc{,-[0-9]*}.so* mr,
>  /{,usr/}lib{,32,64,x32}/{,@{multiarch}/{,atomics/}}libpthread{,-[0-9]*}.so* mr,
>
>  # Common devices accesses
>  /dev/null rw,
>  /dev/full rw,
>  /dev/zero rw,
>  /dev/random r,
>  /dev/urandom r,
>
>  # golang runtime variables
>  /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
>  # glibc 2.27+ may poke this file to find out the number of CPUs
>  # available in the system when creating a new arena for malloc, see
>  # Golang issue 25628
>  /sys/devices/system/cpu/online r,
>
>  # Allow reading the command line (snap-update-ns uses it in pre-Go bootstrap code).
>  @{PROC}/@{pid}/cmdline r,
>
>  # Allow reading file descriptor paths
>  @{PROC}/@{pid}/fd/* r,
>  # Allow reading /proc/version. For release.go WSL detection.
>  @{PROC}/version r,
>
>  # Allow reading own cgroups
>  @{PROC}/@{pid}/cgroup r,
>
>  # Allow reading somaxconn, required in newer distro releases
>  @{PROC}/sys/net/core/somaxconn r,
>  # but silence noisy denial of inet/inet6
>  deny network inet,
>  deny network inet6,
>
>  # Allow reading the os-release file (possibly a symlink to /usr/lib).
>  /{etc/,usr/lib/}os-release r,
>
>  # Allow creating/grabbing global and per-snap lock files.
>  /run/snapd/lock/acestreamplayer.lock rwk,
>  /run/snapd/lock/.lock rwk,
>
>  # Allow reading stored mount namespaces,
>  /run/snapd/ns/ r,
>  /run/snapd/ns/acestreamplayer.mnt r,
>
>  # Allow reading per-snap desired mount profiles. Those are written by
>  # snapd and represent the desired layout and content connections.
>  /var/lib/snapd/mount/snap.acestreamplayer.fstab r,
>  /var/lib/snapd/mount/snap.acestreamplayer.user-fstab r,
>
>  # Allow reading and writing actual per-snap mount profiles. Note that
>  # the wildcard in the rule to allow an atomic write + rename strategy.
>  # Those files are written by snap-update-ns and represent the actual
>  # mount profile at a given moment.
>  /run/snapd/ns/snap.acestreamplayer.fstab{,.*} rw,
>
>  # NOTE: at this stage the /snap directory is stable as we have called
>  # pivot_root already.
>
>  # Needed to perform mount/unmounts.
>  capability sys_admin,
>  # Needed for mimic construction.
>  capability chown,
>  # Needed for dropping to calling user when processing per-user mounts
>  capability setuid,
>  capability setgid,
>  # Allow snap-update-ns to override file ownership and permission checks.
>  # This is required because writable mimics now preserve the permissions
>  # of the original and hence we may be asked to create a directory when the
>  # parent is a tmpfs without DAC write access.
>  capability dac_override,
>
>  # Allow freezing and thawing the per-snap cgroup freezers
>  # v1 hierarchy where we know the group name of all processes of
>  # a given snap upfront
>  /sys/fs/cgroup/freezer/snap.acestreamplayer/freezer.state rw,
>  # v2 hierarchy, where we need to walk the tree to looking for the tracking
>  # groups and act on each one
>  /sys/fs/cgroup/ r,
>  /sys/fs/cgroup/** r,
>  /sys/fs/cgroup/**/snap.acestreamplayer.*.scope/cgroup.freeze rw,
>  /sys/fs/cgroup/**/snap.acestreamplayer.*.service/cgroup.freeze rw,
>
>  # Allow the content interface to bind fonts from the host filesystem
>  mount options=(ro bind) /var/lib/snapd/hostfs/usr/share/fonts/ -> /snap/acestreamplayer/*/**,
>  mount options=(rw private) -> /snap/acestreamplayer/*/**,
>  umount /snap/acestreamplayer/*/**,
>
>  # set up user mount namespace
>  mount options=(rslave) -> /,
>
>  # Allow traversing from the root directory and several well-known places.
>  # Specific directory permissions are added by snippets below.
>  / r,
>  /etc/ r,
>  /snap/ r,
>  /tmp/ r,
>  /usr/ r,
>  /var/ r,
>  /var/snap/ r,
>
>  # Allow reading timezone data.
>  /usr/share/zoneinfo/** r,
>
>  # Don't allow anyone to touch /snap/bin
>  audit deny mount /snap/bin/** -> /**,
>  audit deny mount /** -> /snap/bin/**,
>
>  # Don't allow bind mounts to /media which has special
>  # sharing and propagates mount events outside of the snap namespace.
>  audit deny mount -> /media,
>
>  # Allow receiving signals from unconfined (eg, systemd)
>  signal (receive) peer=unconfined,
>  # Allow sending and receiving signals from ourselves.
>  signal peer=@{profile_name},
>
>  # Commonly needed permissions for writable mimics.
>  /tmp/ r,
>  /tmp/.snap/{,**} rw,
>
>  # snapd logger.go checks /proc/cmdline
>  @{PROC}/cmdline r,
>
>
>		/{,var/lib/snapd/hostfs/}tmp/.X11-unix/ rw,
>		mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/.X11-unix/ -> /tmp/.X11-unix/,
>		mount options=(ro, remount, bind) -> /tmp/.X11-unix/,
>		mount options=(rslave) -> /tmp/.X11-unix/,
>		umount /tmp/.X11-unix/,
>		
>  # Mount the document portal
>
>  mount options=(bind) /run/user/[0-9]*/doc/by-app/snap.acestreamplayer/ -> /run/user/[0-9]*/doc/,
>
>  umount /run/user/[0-9]*/doc/,
>
>
>  # Read-only access to /usr/share/fonts
>
>  mount options=(bind) /var/lib/snapd/hostfs/usr/share/fonts/ -> /usr/share/fonts/,
>
>  remount options=(bind, ro) /usr/share/fonts/,
>
>  umount /usr/share/fonts/,
>
>
>  # Read-only access to /usr/local/share/fonts
>
>  mount options=(bind) /var/lib/snapd/hostfs/usr/local/share/fonts/ -> /usr/local/share/fonts/,
>
>  remount options=(bind, ro) /usr/local/share/fonts/,
>
>  umount /usr/local/share/fonts/,
>
>
>  # Read-only access to /var/cache/fontconfig
>
>  mount options=(bind) /var/lib/snapd/hostfs/var/cache/fontconfig/ -> /var/cache/fontconfig/,
>
>  remount options=(bind, ro) /var/cache/fontconfig/,
>
>  umount /var/cache/fontconfig/,
>
>
>}

Actions: View

Attachments on bug 1211989: 867626 | 867627 | 867630 | 867631 | 867632 | 867633 | 867634 | 867635 | 867652