Merge lp:~dobey/tarmac/add-apparmor into lp:tarmac

[dobey]

Add an apparmor profile for tarmac.

This adds an apparmor profile for tarmac, and it's children (as executed by the command.py plug-in). There is probably a lot more the profile could do here, but I don't know apparmor well enough to really lock things down and keep allowing the ability to run arbitrary things (like python/cmake/qmake/etc…).

I think this is a reasonable start though.

[Seth Arnold (seth-arnold)]

This is a great start; tarmac's children are confined to the tarmac_child profile, and the broad /** rmix, rule will keep everything confined to that child. The #include <abstractions/private-files-strict> provides some assurance that tarmac's children won't be able to easily impersonate a developer who might run tarmac.

I am a little worried about the attachment specification "/**/tarmac" -- if tarmac is being packaged probably the full path should be known and used instead. (aa-logprof does not handle these paths well, if I recall correctly, but apparmor_parser and the kernel will handle it fine.) Consider changing this in the future.

Looks great. Thanks!

review: Approve

[Manuel de la Peña (mandel)]

review: Approve

=== added directory 'data'
=== added file 'data/tarmac.apparmor'
--- data/tarmac.apparmor	1970-01-01 00:00:00 +0000
+++ data/tarmac.apparmor	2013-10-30 19:45:01 +0000
@@ -0,0 +1,50 @@
+#include <tunables/global>
+
+/**/tarmac {
+  #include <abstractions/base>
+  #include <abstractions/python>
+  #include <abstractions/private-files-strict>
+
+  @{HOME}/.cache/tarmac/ w,
+  @{HOME}/.cache/tarmac/** rwl,
+
+  @{HOME}/.config/tarmac/ w,
+  @{HOME}/.config/tarmac/** rwl,
+
+  owner /tmp/tarmac/ w,
+  owner /tmp/tarmac/** rwl,
+
+  owner /var/cache/tarmac/ w,
+  owner /var/cache/tarmac/** rwl,
+
+  /** Cx -> tarmac_child,
+
+  profile tarmac_child {
+    #include <abstractions/base>
+    #include <abstractions/bash>
+    #include <abstractions/dbus-session>
+    #include <abstractions/gnome>
+    #include <abstractions/kde>
+    #include <abstractions/perl>
+    #include <abstractions/python>
+    #include <abstractions/private-files-strict>
+
+    # Need to be able exec most anything, which unfortunately
+    # requires a lot of read permissions
+    /**/ r,
+    /** rmix,
+
+    # Don't allow access to bzr
+    audit deny @{HOME}/.bazaar/** mrukl,
+    audit deny @{HOME}/.bzr* mrukl,
+    audit deny /**/.bzr/** mrukl,
+
+    # Don't allow subprocesses to access the tarmac config, or cache
+    audit deny @{HOME}/.cache/tarmac/** mrukl,
+    audit deny @{HOME}/.config/tarmac/** mrukl,
+    audit deny /tmp/tarmac/merge.** mrukl,
+    audit deny /var/cache/tarmac/** mrukl,
+
+    owner /tmp/tarmac/branch.** rwl,
+  }
+}

=== modified file 'setup.py'
--- setup.py	2013-10-30 14:14:25 +0000
+++ setup.py	2013-10-30 19:45:01 +0000
@@ -36,7 +36,10 @@
     #data_files=[('share/tarmac/', ['tarmac-web']),
     #            ('share/tarmac/templates/', ['templates/index.html']),
     #            ],
-    data_files=[('share/man/man1', ['docs/tarmac.1'])],
+    data_files=[
+        ('share/man/man1', ['docs/tarmac.1']),
+        ('/etc/apparmor.d', ['data/tarmac.apparmor']),
+    ],
     long_description='''
         Tarmac is a series of scripts to facilitate the landing of Bazaar
         branches in Launchpad (https://launchpad.net).''',