Current Dir: /snap/core22/2955/etc/apparmor.d/abstractions/
[DIR] apparmor_api [ delete | rename ]
[DIR] ubuntu-browsers.d [ delete | rename ]
[FILE] apache2-common [ edit | delete | rename ]
[FILE] aspell [ edit | delete | rename ]
[FILE] audio [ edit | delete | rename ]
[FILE] authentication [ edit | delete | rename ]
[FILE] base [ edit | delete | rename ]
[FILE] bash [ edit | delete | rename ]
[FILE] consoles [ edit | delete | rename ]
[FILE] crypto [ edit | delete | rename ]
[FILE] cups-client [ edit | delete | rename ]
[FILE] dbus [ edit | delete | rename ]
[FILE] dbus-accessibility [ edit | delete | rename ]
[FILE] dbus-accessibility-strict [ edit | delete | rename ]
[FILE] dbus-network-manager-strict [ edit | delete | rename ]
[FILE] dbus-session [ edit | delete | rename ]
[FILE] dbus-session-strict [ edit | delete | rename ]
[FILE] dbus-strict [ edit | delete | rename ]
[FILE] dconf [ edit | delete | rename ]
[FILE] dovecot-common [ edit | delete | rename ]
[FILE] dri-common [ edit | delete | rename ]
[FILE] dri-enumerate [ edit | delete | rename ]
[FILE] enchant [ edit | delete | rename ]
[FILE] exo-open [ edit | delete | rename ]
[FILE] fcitx [ edit | delete | rename ]
[FILE] fcitx-strict [ edit | delete | rename ]
[FILE] fonts [ edit | delete | rename ]
[FILE] freedesktop.org [ edit | delete | rename ]
[FILE] gio-open [ edit | delete | rename ]
[FILE] gnome [ edit | delete | rename ]
[FILE] gnupg [ edit | delete | rename ]
[FILE] gtk [ edit | delete | rename ]
[FILE] gvfs-open [ edit | delete | rename ]
[FILE] hosts_access [ edit | delete | rename ]
[FILE] ibus [ edit | delete | rename ]
[FILE] kde [ edit | delete | rename ]
[FILE] kde-globals-write [ edit | delete | rename ]
[FILE] kde-icon-cache-write [ edit | delete | rename ]
[FILE] kde-language-write [ edit | delete | rename ]
[FILE] kde-open5 [ edit | delete | rename ]
[FILE] kerberosclient [ edit | delete | rename ]
[FILE] ldapclient [ edit | delete | rename ]
[FILE] libpam-systemd [ edit | delete | rename ]
[FILE] likewise [ edit | delete | rename ]
[FILE] mdns [ edit | delete | rename ]
[FILE] mesa [ edit | delete | rename ]
[FILE] mir [ edit | delete | rename ]
[FILE] mozc [ edit | delete | rename ]
[FILE] mysql [ edit | delete | rename ]
[FILE] nameservice [ edit | delete | rename ]
[FILE] nis [ edit | delete | rename ]
[FILE] nss-systemd [ edit | delete | rename ]
[FILE] nvidia [ edit | delete | rename ]
[FILE] opencl [ edit | delete | rename ]
[FILE] opencl-common [ edit | delete | rename ]
[FILE] opencl-intel [ edit | delete | rename ]
[FILE] opencl-mesa [ edit | delete | rename ]
[FILE] opencl-nvidia [ edit | delete | rename ]
[FILE] opencl-pocl [ edit | delete | rename ]
[FILE] openssl [ edit | delete | rename ]
[FILE] orbit2 [ edit | delete | rename ]
[FILE] p11-kit [ edit | delete | rename ]
[FILE] perl [ edit | delete | rename ]
[FILE] php [ edit | delete | rename ]
[FILE] php-worker [ edit | delete | rename ]
[FILE] php5 [ edit | delete | rename ]
[FILE] postfix-common [ edit | delete | rename ]
[FILE] private-files [ edit | delete | rename ]
[FILE] private-files-strict [ edit | delete | rename ]
[FILE] python [ edit | delete | rename ]
[FILE] qt5 [ edit | delete | rename ]
[FILE] qt5-compose-cache-write [ edit | delete | rename ]
[FILE] qt5-settings-write [ edit | delete | rename ]
[FILE] recent-documents-write [ edit | delete | rename ]
[FILE] ruby [ edit | delete | rename ]
[FILE] samba [ edit | delete | rename ]
[FILE] smbpass [ edit | delete | rename ]
[FILE] snap_browsers [ edit | delete | rename ]
[FILE] ssl_certs [ edit | delete | rename ]
[FILE] ssl_keys [ edit | delete | rename ]
[FILE] svn-repositories [ edit | delete | rename ]
[FILE] ubuntu-bittorrent-clients [ edit | delete | rename ]
[FILE] ubuntu-browsers [ edit | delete | rename ]
[FILE] ubuntu-console-browsers [ edit | delete | rename ]
[FILE] ubuntu-console-email [ edit | delete | rename ]
[FILE] ubuntu-email [ edit | delete | rename ]
[FILE] ubuntu-feed-readers [ edit | delete | rename ]
[FILE] ubuntu-gnome-terminal [ edit | delete | rename ]
[FILE] ubuntu-helpers [ edit | delete | rename ]
[FILE] ubuntu-konsole [ edit | delete | rename ]
[FILE] ubuntu-media-players [ edit | delete | rename ]
[FILE] ubuntu-unity7-base [ edit | delete | rename ]
[FILE] ubuntu-unity7-launcher [ edit | delete | rename ]
[FILE] ubuntu-unity7-messaging [ edit | delete | rename ]
[FILE] ubuntu-xterm [ edit | delete | rename ]
[FILE] user-download [ edit | delete | rename ]
[FILE] user-mail [ edit | delete | rename ]
[FILE] user-manpages [ edit | delete | rename ]
[FILE] user-tmp [ edit | delete | rename ]
[FILE] user-write [ edit | delete | rename ]
[FILE] video [ edit | delete | rename ]
[FILE] vulkan [ edit | delete | rename ]
[FILE] wayland [ edit | delete | rename ]
[FILE] web-data [ edit | delete | rename ]
[FILE] winbind [ edit | delete | rename ]
[FILE] wutmp [ edit | delete | rename ]
[FILE] X [ edit | delete | rename ]
[FILE] xad [ edit | delete | rename ]
[FILE] xdg-desktop [ edit | delete | rename ]
[FILE] xdg-open [ edit | delete | rename ]
Viewing: /snap/core22/2955/etc/apparmor.d/abstractions/ubuntu-helpers
# Lenient profile that is intended to be used when 'Ux' is desired but
# does not provide enough environment sanitizing. This effectively is an
# open profile that blacklists certain known dangerous files and also
# does not allow any capabilities. For example, it will not allow 'm' on files
# owned be the user invoking the program. While this provides some additional
# protection, please use with care as applications running under this profile
# are effectively running without any AppArmor protection. Use this profile
# only if the process absolutely must be run (effectively) unconfined.
#
# Usage:
# Because this abstraction defines the sanitized_helper profile, it must only
# be included once. Therefore this abstraction should typically not be
# included in other abstractions so as to avoid parser errors regarding
# multiple definitions.
#
# Limitations:
# 1. This does not work for root owned processes, because of the way we use
# owner matching in the sanitized helper. We could do a better job with
# this to support root, but it would make the policy harder to understand
# and going unconfined as root is not desirable any way.
#
# 2. For this sanitized_helper to work, the program running in the sanitized
# environment must open symlinks directly in order for AppArmor to mediate
# it. This is confirmed to work with:
# - compiled code which can load shared libraries
# - python imports
# It is known not to work with:
# - perl includes
# 3. Sanitizing ruby and java
#
# Use at your own risk. This profile was developed as an interim workaround for
# LP: #851986 until AppArmor utilizes proper environment filtering.
abi <abi/3.0>,
profile sanitized_helper {
include <abstractions/base>
include <abstractions/X>
# Allow all networking
network inet,
network inet6,
# Allow all DBus communications
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
dbus,
# Needed for Google Chrome
ptrace (trace) peer=**//sanitized_helper,
# Allow exec of anything, but under this profile. Allow transition
# to other profiles if they exist.
/{usr/,usr/local/,}{bin,sbin}/* Pixr,
# Allow exec of libexec applications in /usr/lib* and /usr/local/lib*
/usr/{,local/}lib*/{,**/}* Pixr,
# Allow exec of software-center scripts. We may need to allow wider
# permissions for /usr/share, but for now just do this. (LP: #972367)
/usr/share/software-center/* Pixr,
# Allow exec of texlive font build scripts (LP: #1010909)
/usr/share/texlive/texmf{,-dist}/web2c/{,**/}* Pixr,
# While the chromium and chrome sandboxes are setuid root, they only link
# in limited libraries so glibc's secure execution should be enough to not
# require the santized_helper (ie, LD_PRELOAD will only use standard system
# paths (man ld.so)).
/usr/lib/chromium-browser/chromium-browser-sandbox PUxr,
/usr/lib/chromium{,-browser}/chrome-sandbox PUxr,
/opt/google/chrome{,-beta,-unstable}/chrome-sandbox PUxr,
/opt/google/chrome{,-beta,-unstable}/google-chrome Pixr,
/opt/google/chrome{,-beta,-unstable}/chrome Pixr,
/opt/google/chrome{,-beta,-unstable}/chrome_crashpad_handler Pixr,
/opt/google/chrome{,-beta,-unstable}/{,**/}lib*.so{,.*} m,
# The same is needed for Brave
/opt/brave.com/brave{,-beta,-dev,-nightly}/chrome-sandbox PUxr,
/opt/brave.com/brave{,-beta,-dev,-nightly}/brave-browser{,-beta,-dev,-nightly} Pixr,
/opt/brave.com/brave{,-beta,-dev,-nightly}/brave Pixr,
/opt/brave.com/brave{,-beta,-dev,-nightly}/{,**/}lib*.so{,.*} m,
# Full access
/ r,
/** rwkl,
/{,usr/,usr/local/}lib{,32,64}/{,**/}*.so{,.*} m,
# Dangerous files
audit deny owner /**/* m, # compiled libraries
audit deny owner /**/*.py* r, # python imports
}