Merge lp:~elmo/apparmor-profiles/bprobe into lp:apparmor-profiles

[James Troup]

An apparmor profile for bprobe, the client side agent of Boundary (http://boundary.com/). bprobe uses libpcap, so the profile looks superficially similar to tcpdump but is more restrictive. I've included versions for 8.04, 10.04 and 12.04, i.e. all current LTSes. All have been tested and are in use in production.

[Seth Arnold (seth-arnold)]

Excellent comments, good descriptions, but I'm concerned/surprised about a /usr/local/bin/ profile -- seems to somewhat violate the idea that /usr/local is for admins.

Thanks!

[James Troup (elmo)]

> Excellent comments, good descriptions, but I'm concerned/surprised
> about a /usr/local/bin/ profile -- seems to somewhat violate the
> idea that /usr/local is for admins.

Ah, sorry, I did mean to mention that. The Debian/Ubuntu packages
that Boundary provide unfortunately install bprobe into
/usr/local/bin. I've suggested to them that they either use /usr/sbin
or /opt, but I don't think fixing it (and/or FHS and Debian/Ubuntu
policy) is high on their list of concerns right now.

If the consensus is that the profile should have a sane name
regardless of the current state of the packages, I'm happy to fix up
my branch.

Unmerged revisions

104. By James Troup on 2012-09-29

Add profiles for bprobe (the Boundary client-side agent).

=== added file 'ubuntu/10.04/usr.local.bin.bprobe'
--- ubuntu/10.04/usr.local.bin.bprobe	1970-01-01 00:00:00 +0000
+++ ubuntu/10.04/usr.local.bin.bprobe	2012-09-29 03:20:23 +0000
@@ -0,0 +1,43 @@
+# vim:syntax=apparmor
+# Author: James Troup <[e-mail]>
+
+#include <tunables/global>
+
+/usr/local/bin/bprobe {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_admin,
+  capability net_raw,
+  capability setgid,
+  capability setuid,
+  capability sys_module,
+
+  network packet dgram,
+  network packet raw,
+
+  /usr/local/bin/bprobe mr,
+  /usr/local/lib/lib*so* mr,
+
+  /etc/bprobe/* r,
+  /var/run/bprobe.pid w,
+
+  # These files are used to determine basic system information
+  # that's sent up to Boundary and used in e.g. dynamic groups
+  /etc/issue r,
+  /sys/devices/system/cpu/ r,
+  /sys/devices/system/cpu/cpu[0-9]*/cpufreq/cpuinfo_max_freq r,
+
+  # for finding an interface
+  @{PROC}/[0-9]*/net/dev r,
+  /sys/class/net/ r,
+
+  # for tracing USB bus, which libpcap supports
+  /dev/usbmon* r,
+  /dev/bus/usb/ r,
+  /dev/bus/usb/** r,
+  /sys/bus/usb/devices/ r,
+
+  # for USB probing (see libpcap-1.1.x/pcap-usb-linux.c:probe_devices())
+  /dev/bus/usb/**/[0-9]* w,
+}

=== added file 'ubuntu/12.04/usr.local.bin.bprobe'
--- ubuntu/12.04/usr.local.bin.bprobe	1970-01-01 00:00:00 +0000
+++ ubuntu/12.04/usr.local.bin.bprobe	2012-09-29 03:20:23 +0000
@@ -0,0 +1,42 @@
+# vim:syntax=apparmor
+# Author: James Troup <[e-mail]>
+
+#include <tunables/global>
+
+/usr/local/bin/bprobe {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_admin,
+  capability net_raw,
+  capability setgid,
+  capability setuid,
+  capability sys_module,
+
+  network packet dgram,
+  network packet raw,
+
+  /usr/local/bin/bprobe mr,
+  /usr/local/lib/lib*so* mr,
+
+  /etc/bprobe/* r,
+  /run/bprobe.pid w,
+
+  # These two files are used to determine basic system information
+  # that's sent up to Boundary and used in e.g. dynamic groups
+  /etc/issue r,
+  /sys/devices/system/cpu/ r,
+
+  # for finding an interface
+  @{PROC}/[0-9]*/net/dev r,
+  /sys/class/net/ r,
+
+  # for tracing USB bus, which libpcap supports
+  /dev/usbmon* r,
+  /dev/bus/usb/ r,
+  /dev/bus/usb/** r,
+  /sys/bus/usb/devices/ r,
+
+  # for USB probing (see libpcap-1.1.x/pcap-usb-linux.c:probe_devices())
+  /dev/bus/usb/**/[0-9]* w,
+}

=== added file 'ubuntu/8.04/usr.local.bin.bprobe'
--- ubuntu/8.04/usr.local.bin.bprobe	1970-01-01 00:00:00 +0000
+++ ubuntu/8.04/usr.local.bin.bprobe	2012-09-29 03:20:23 +0000
@@ -0,0 +1,42 @@
+# vim:syntax=apparmor
+# Author: James Troup <[e-mail]>
+
+#include <tunables/global>
+
+/usr/local/bin/bprobe {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_admin,
+  capability net_raw,
+  capability setgid,
+  capability setuid,
+  capability sys_module,
+
+  network packet dgram,
+  network packet raw,
+
+  /usr/local/bin/bprobe mr,
+  /usr/local/lib/lib*so* mr,
+
+  /etc/bprobe/* r,
+  /var/run/bprobe.pid w,
+
+  # These two files are used to determine basic system information
+  # that's sent up to Boundary and used in e.g. dynamic groups
+  /etc/issue r,
+  /sys/devices/system/cpu/ r,
+
+  # for finding an interface
+  @{PROC}/net/dev r,
+  /sys/class/net/ r,
+
+  # for tracing USB bus, which libpcap supports
+  /dev/usbmon* r,
+  /dev/bus/usb/ r,
+  /dev/bus/usb/** r,
+  /sys/bus/usb/devices/ r,
+
+  # for USB probing (see libpcap-1.1.x/pcap-usb-linux.c:probe_devices())
+  /dev/bus/usb/**/[0-9]* w,
+}