Merge lp:~jdstrand/snap-confine/ubuntu-core-launcher.aa-profile into lp:~snappy-dev/snap-confine/trunk

[Jamie Strandboge]

add apparmor profile for ubuntu-core-launcher

add apparmor profile for ubuntu-core-launcher

[lp:~jdstrand/snap-confine/ubuntu-core-launcher.aa-profile]

46. By Jamie Strandboge on 2015-04-21

merge from trunk

[Tyler Hicks (tyhicks)]

Looks good to me. Thanks!

=== modified file 'debian/changelog'
--- debian/changelog	2015-04-21 19:02:39 +0000
+++ debian/changelog	2015-04-21 19:22:19 +0000
@@ -1,3 +1,9 @@
+ubuntu-core-launcher (0.2.9) UNRELEASED; urgency=medium
+
+  * add apparmor profile for ubuntu-core-launcher
+
+ -- Jamie Strandboge <[e-mail]>  Tue, 21 Apr 2015 14:21:15 -0500
+
 ubuntu-core-launcher (0.2.8) vivid; urgency=low
 
   * initial upload to the archive

=== modified file 'debian/control'
--- debian/control	2015-04-19 07:10:28 +0000
+++ debian/control	2015-04-21 19:22:19 +0000
@@ -2,13 +2,13 @@
 Section: utils
 Priority: optional
 Maintainer: Ubuntu Developers <[e-mail]>
-Build-Depends: debhelper (>= 9), libseccomp-dev, libapparmor-dev, libudev-dev
+Build-Depends: debhelper (>= 9), libseccomp-dev, libapparmor-dev, libudev-dev, dh-apparmor
 Standards-Version: 3.9.6
 Vcs: lp:~snappy-dev/ubuntu-core-launcher/trunk
 
 Package: ubuntu-core-launcher
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends}, apparmor
 Description: Launcher for ubuntu-core (snappy) apps
  This package contains the launcher for launching ubuntu-core applications
  on a ubuntu "snappy" system.

=== modified file 'debian/dirs'
--- debian/dirs	2015-04-18 09:57:31 +0000
+++ debian/dirs	2015-04-21 19:22:19 +0000
@@ -1,2 +1,3 @@
 usr/bin
-lib/udev
\ No newline at end of file
+lib/udev
+etc/apparmor.d/force-complain

=== added file 'debian/install'
--- debian/install	1970-01-01 00:00:00 +0000
+++ debian/install	2015-04-21 19:22:19 +0000
@@ -0,0 +1,1 @@
+debian/usr.bin.ubuntu-core-launcher etc/apparmor.d

=== modified file 'debian/rules'
--- debian/rules	2015-04-18 13:44:14 +0000
+++ debian/rules	2015-04-21 19:22:19 +0000
@@ -1,8 +1,11 @@
 #!/usr/bin/make -f
 
 %:
-	dh $@ 
+	dh $@
 
 override_dh_fixperms:
 	dh_fixperms -Xusr/bin/ubuntu-core-launcher
 
+override_dh_installdeb:
+	dh_apparmor --profile-name=usr.bin.ubuntu-core-launcher -pubuntu-core-launcher
+	dh_installdeb

=== added file 'debian/usr.bin.ubuntu-core-launcher'
--- debian/usr.bin.ubuntu-core-launcher	1970-01-01 00:00:00 +0000
+++ debian/usr.bin.ubuntu-core-launcher	2015-04-21 19:22:19 +0000
@@ -0,0 +1,48 @@
+# Author: Jamie Strandboge <[e-mail]>
+#include <tunables/global>
+
+/usr/bin/ubuntu-core-launcher {
+    # We run privileged, so be fanatical about what we include and don't use
+    # any abstractions
+    /etc/ld.so.cache r,
+    /lib/@{multiarch}/libapparmor.so* mr,
+    /lib/@{multiarch}/libc-*.so* mr,
+    /lib/@{multiarch}/libpthread-*.so* mr,
+    /lib/@{multiarch}/libudev.so* mr,
+    /usr/lib/@{multiarch}/libseccomp.so* mr,
+
+    # cgroups
+    capability sys_admin,
+    capability dac_override,
+    /sys/fs/cgroup/devices/snappy.*/ w,
+    /sys/fs/cgroup/devices/snappy.*/tasks w,
+    /sys/fs/cgroup/devices/snappy.*/devices.{allow,deny} w,
+
+    # querying udev
+    /etc/udev/udev.conf r,
+    /sys/devices/**/uevent r,
+    /lib/udev/snappy-app-dev ixr, # drop
+
+    # priv dropping
+    capability setuid,
+    capability setgid,
+
+    # changing profile
+    @{PROC}/[0-9]*/attr/exec w,
+    change_profile -> [^u/]**,
+    change_profile -> [^u/][^n]**,
+    change_profile -> [^u/][^n][^c]**,
+    change_profile -> [^u/][^n][^c][^o]**,
+    change_profile -> [^u/][^n][^c][^o][^n]**,
+    change_profile -> [^u/][^n][^c][^o][^n][^f]**,
+    change_profile -> [^u/][^n][^c][^o][^n][^f][^i]**,
+    change_profile -> [^u/][^n][^c][^o][^n][^f][^i][^n]**,
+    change_profile -> [^u/][^n][^c][^o][^n][^f][^i][^n][^e]**,
+    change_profile -> [^u/][^n][^c][^o][^n][^f][^i][^n][^e][^d]**,
+    # LP: #1446794 - when this bug is fixed, change the above to:
+    # deny change_profile -> {unconfined,/**},
+    # change_profile -> **,
+
+    # reading seccomp filters
+    /var/lib/snappy/seccomp/profiles/* r,
+}