Merge lp:~sdeziel/apparmor/wireshark-refresh into lp:apparmor/2.12

[Simon Déziel]

This refreshed profile was tested with Wireshark 2.0.2 (from Xenial). I only tested reading from pcaps. No capture testing was done because I feel this is best done with tcpdump that is well protected by Apparmor anyways.

[Seth Arnold (seth-arnold)]

It feels like the accessibility dbus rules may be better suited in an #include. What else will require these?

Otherwise looks good to me.

Thanks

[Simon Déziel (sdeziel)]

On 2016-04-13 05:50 PM, Seth Arnold wrote:
> It feels like the accessibility dbus rules may be better suited in an #include.

Or maybe abstractions/dbus-accessibility-strict is just too strict?

> What else will require these?

I copied it from Firefox. Locally I have the following profiles using
the "a11y" rules:

 usr.bin.firefox
 usr.bin.keepassx
 usr.bin.pidgin
 usr.bin.remmina
 usr.bin.vlc
 usr.bin.wireshark

[Tyler Hicks (tyhicks)]

On 2016-04-14 14:03:27, Simon Déziel wrote:
> On 2016-04-13 05:50 PM, Seth Arnold wrote:
> > It feels like the accessibility dbus rules may be better suited in an #include.
>
> Or maybe abstractions/dbus-accessibility-strict is just too strict?

dbus-accessibility-strict is for talking to dbus-daemon itself on the
accessibility bus.

dbus-accessibility is for doing any action on the accessibility bus.

Note that the rules you have are for talking to a service on the session
bus. I'm thinking that there should be an "accessibility-services" (or
maybe just "accessibility") abstraction which has the a11y rules and
also includes dbus-accessibility-strict?

[Jamie Strandboge (jdstrand)]

@Tyler, this makes sense to me. The accessibility rules are not well defined at all and could use a lot of love.

[intrigeri (intrigeri)]

Seth, Jamie, Tyler: thanks for the reviews and the forward looking thinking. It's not clear to me what's a blocker or not. Are you blocking on a big refactoring of the accessibility rules before this MR gets merged? I'm not sure it would be fair to expect Simon to do this work right now :) How about we track the refactoring proposal on a new bug and not block on it here?

[Steve Beattie (sbeattie)]

intrigeri: I agree, we should probably not block this merge request on an accessibility abstraction cleanup. I have filed https://bugs.launchpad.net/apparmor/+bug/1727887 to capture that request.

Otherwise, LGTM. I'll merge it in.

review: Approve

=== modified file 'profiles/apparmor/profiles/extras/usr.bin.wireshark'
--- profiles/apparmor/profiles/extras/usr.bin.wireshark	2010-12-20 20:29:10 +0000
+++ profiles/apparmor/profiles/extras/usr.bin.wireshark	2016-04-13 20:56:30 +0000
@@ -16,29 +16,66 @@
   #include <abstractions/base>
   #include <abstractions/bash>
   #include <abstractions/consoles>
+  #include <abstractions/dconf>
+  #include <abstractions/dbus-session-strict>
+  #include <abstractions/ibus>
   #include <abstractions/kde>
   #include <abstractions/nameservice>
   #include <abstractions/gnome>
   #include <abstractions/user-write>
   #include <abstractions/X>
 
+  #include <abstractions/dbus-accessibility-strict>
+  dbus (send)
+       bus=session
+       peer=(name=org.a11y.Bus),
+  dbus (receive)
+       bus=session
+       interface=org.a11y.atspi**,
+  dbus (receive, send)
+       bus=accessibility,
+
   capability net_raw,
 
+  # From abstractions/evince
+  deny /run/udev/data/** r,
+
   /etc/ethers r,
-
-  @{HOME}/.wireshark/* rw,
-  @{HOME}/.fonts.cache-* r,
+  /etc/udev/udev.conf r,
+  /etc/wireshark/** r,
+
+  owner @{HOME}/.wireshark/* rw,
+  owner @{HOME}/.config/wireshark/* rw,
+  owner @{HOME}/.config/QtProject.conf rw,
+  owner @{HOME}/.config/QtProject.conf.lock rw,
+  owner @{HOME}/.fonts.cache-* r,
+
+  owner @{HOME}/.config/dconf/user w,
+  owner /{,var/}run/user/*/dconf/user w,
+  owner @{PROC}/@{pid}/cmdline r,
+  owner @{PROC}/@{pid}/fd/ r,
+  @{PROC}/@{pid}/net/dev r,
+  /sys/devices/pci[0-9]*/**/uevent r,
 
   /etc/pango/pango.modules r,
   /usr/lib/gtk-*/*/loaders/* mr,
-  /usr/share/* r,
-  /usr/share/icons/** r,
+  /usr/share/icons/   r,
+  /usr/share/icons/** rk,
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/mime/* r,
   /usr/lib/firefox/firefox.sh rPx,
   /usr/bin/wireshark mixr,
-  /usr/share/icons r,
   /usr/share/mime/* r,
   /usr/share/snmp/mibs r,
   /usr/share/snmp/mibs/* r,
   /usr/share/snmp/mibs/.index rw,
+  /usr/share/wireshark/** r,
+  /usr/share/GeoIP/ r,
+  /usr/share/GeoIP/** r,
+  /usr/lib/@{multiarch}/wireshark/extcap/* ix,
+  /usr/lib/@{multiarch}/wireshark/plugins/**/   r,
+  /usr/lib/@{multiarch}/wireshark/plugins/**.so mr,
+
+  # for reading pcaps
+  /**.pcap r,
 }