Merge lp:~kgunn72/mir/snappy-packaging-with-secprofile into lp:~mir-team/mir/snappy-packaging

[kevin gunn]

first draft additions to confine the mir snap and client

first draft additions to confine the mir snap and client
used the Qt clock reference app as the means to exercise the mir operation, which my not be exhaustive and other client applications may need to look for AA denials or bad sys calls during debug.

[Jamie Strandboge (jdstrand)]

Things are really coming along! Most of my comments are inline, however I did want to mention that in looking at the mir_demo_server packaging and security policy, I think you can simplify things and have mir_demo_server simply use the default security policy with the @PACKAGE@_client cap. Ie, update the yaml to be:

binaries:
  - name: mir_demo_server
    exec: debs/usr/bin/mir_demo_server
    caps:
      - network-client
      - @PACKAGE@_client

Then do:
$ rm -f overlay/meta/mirdemosvr.apparmor overlay/meta/mirdemosvr.seccomp

Note: framework binaries and services may reference the framework-policy from this snap.

review: Needs Fixing

[Chris Halse Rogers (raof)]

Commented about AUTH_ADMIN requirement. I don't think we actually need chown in the regular case, and the option which *does* need it probably shouldn't be allowed system-wide.

[Daniel van Vugt (vanvugt)]

I think this proposal has stagnated because ~mir-team isn't familiar with any of this.

I say just land it. If anyone on ~mir-team does have a clue about what they're modifying in these areas, they can probably just commit directly to the snappy-packaging branch. Doing a merge proposal seems counter-productive at this early stage of Snappy.

[kevin gunn (kgunn72)]

true on the stagnation, as I did the snappy confinement work but I need help with some of the comments as my technical depth isn't deep enough.

But please don't land it, the point of the MP was to capture security team feeback on the snappy confinement.

[Kevin DuBois (kdub)]

I suppose lets move to work-in-progress then?

[kevin gunn (kgunn72)]

OK, based on the current changes in snappy this is now strictly historical.
All security policy is going to be defined by the system for the "display-server" capability which is based on the confinement work done here, this is happening b/c snappy is deprecating the concept of a framework that provides it's own security policy.

Unmerged revisions

26. By kevin gunn on 2015-07-28

final seccomp change

25. By kevin gunn on 2015-07-28

seccomp updates for demo of clock app

24. By kevin gunn on 2015-07-24

seccomp profile changes, mir launches

23. By kevin gunn on 2015-07-24

final aa profile changes, clock example launches

22. By kevin gunn on 2015-07-22

apparmor profile updates, mir launching

21. By kevin gunn on 2015-07-14

update more aa profile

20. By kevin gunn on 2015-07-14

update from trunk

19. By kevin gunn on 2015-07-14

update apparmor and seccomp files for mir & better server script

18. By kevin gunn on 2015-06-18

mir-comp sec prof updates and add mir-demo-server files

17. By kevin gunn on 2015-06-16

first adds of security profile

=== modified file 'Makefile'
--- Makefile	2015-06-19 06:20:48 +0000
+++ Makefile	2015-07-28 14:59:40 +0000
@@ -15,7 +15,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-SNAPVER:=1
+SNAPVER:=1.1
 VERSION="$(shell apt-cache policy mir-demos | grep '^ \*\*\* ' | cut -c1-7,10-17 --complement | cut -d' ' -f3)snap${SNAPVER}"
 
 all: snap
 
=== modified file 'overlay/meta/framework-policy/apparmor/policygroups/client'
--- overlay/meta/framework-policy/apparmor/policygroups/client	2015-07-09 21:58:15 +0000
+++ overlay/meta/framework-policy/apparmor/policygroups/client	2015-07-28 14:59:40 +0000
@@ -8,9 +8,13 @@
 @{CLICK_DIR}/@PACKAGE@/*/debs/usr/lib/*/mir/client-platform/ r,
 @{CLICK_DIR}/@PACKAGE@/*/debs/usr/lib/*/mir/client-platform/* r,
 
+capability chown,
+capability fowner,
+
 # Socket to talk on
 /run/mir_socket rw,
 unix (connect, send, receive) peer=(label=@PACKAGE@_system-compositor_@VERSION@),
+#unix (receive, send) type=seqpacket addr=none,
 
 # For non-opengl apps
 # https://www.kernel.org/doc/gorman/html/understand/understand015.html
@@ -29,3 +33,5 @@
 
 # FIXME: this is too lenient, please adjust for specific accesses
 /sys/devices/*/*/*/uevent r,
+
+/usr/share/applications/ r,
 
=== modified file 'overlay/meta/framework-policy/seccomp/policygroups/client'
--- overlay/meta/framework-policy/seccomp/policygroups/client	2015-07-09 21:58:15 +0000
+++ overlay/meta/framework-policy/seccomp/policygroups/client	2015-07-28 14:59:40 +0000
@@ -3,3 +3,4 @@
 
 # needed to connect to mir
 socketpair
+lchown
 \ No newline at end of file
 
=== added file 'overlay/meta/mir.apparmor'
--- overlay/meta/mir.apparmor	1970-01-01 00:00:00 +0000
+++ overlay/meta/mir.apparmor	2015-07-28 14:59:40 +0000
@@ -0,0 +1,74 @@
+# Description: mir-compositor apparmor security profile
+# Usage: Mir
+
+#include <tunables/global>
+
+# Specified profile variables
+###VAR###
+
+###PROFILEATTACH### (attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+capability dac_override,
+capability sys_tty_config,
+capability sys_admin,
+
+  # Read-only for the install directory
+  @{CLICK_DIR}/@{APP_PKGNAME}/                   r,
+  @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/    r,
+  @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/**  mrklix,
+
+  # Writable home area
+  owner @{HOMEDIRS}/apps/@{APP_PKGNAME}/   rw,
+  owner @{HOMEDIRS}/apps/@{APP_PKGNAME}/** mrwklix,
+
+  # Read-only system area for other versions
+  /var/lib/apps/@{APP_PKGNAME}/   r,
+  /var/lib/apps/@{APP_PKGNAME}/** mrkix,
+
+  # Writable system area only for this version.
+  /var/lib/apps/@{APP_PKGNAME}/@{APP_VERSION}/   w,
+  /var/lib/apps/@{APP_PKGNAME}/@{APP_VERSION}/** wl,
+
+#  ... specialized confinement ...
+# Socket to talk on
+/run/mir_socket rw,
+unix (receive, send) type=seqpacket addr=none,
+
+# Hardware acceleration
+/dev/dri/card0 rw,
+
+# For non-opengl apps
+/dev/shm/\#* rw,
+
+# udev
+/sys/devices/**/uevent r,
+/sys/devices/**/ r,
+/dev/input/* rw,
+/dev/tty* wr,
+/run/udev/data/* r,
+
+ptrace peer=**,
+/bin/dash mrix,
+/bin/sleep mrix,
+/bin/pidof mrix,
+/bin/sed mrix,
+/bin/cp mrix,
+/sbin/killall5 ixr,
+/usr/bin/expr ixr,
+/usr/bin/chmod ixr,
+/bin/chmod ixr,
+/proc/ r,
+/proc/*/stat r,
+/proc/*/cmdline r,
+/sys/bus/ r,
+/sys/class/ r,
+/sys/class/input/ r,
+/sys/class/drm/ r,
+/etc/udev/udev.conf r,
+capability sys_ptrace,
+capability chown,
+capability fowner,
+capability sys_ptrace,
+}
 
=== added file 'overlay/meta/mir.seccomp'
--- overlay/meta/mir.seccomp	1970-01-01 00:00:00 +0000
+++ overlay/meta/mir.seccomp	2015-07-28 14:59:40 +0000
@@ -0,0 +1,403 @@
+sudo vi# Description: mir-compositor apparmor security profile
+# Usage: Mir
+access
+accept
+faccessat
+
+alarm
+brk
+bind
+# ARM private syscalls
+breakpoint
+cacheflush
+set_tls
+usr26
+usr32
+
+capget
+
+chdir
+fchdir
+
+# We can't effectively block file perms due to open() with O_CREAT, so allow
+# chmod until we have syscall arg filtering (LP: #1446748)
+chmod
+fchmod
+fchmodat
+
+# snappy doesn't currently support per-app UID/GIDs so don't allow chown. To
+# properly support chown, we need to have syscall arg filtering (LP: #1446748)
+# and per-app UID/GIDs.
+#chown
+#chown32
+#fchown
+#fchown32
+#fchownat
+
+# needed for chmod'ing the mir socket so apps can use
+lchown
+#lchown32
+
+clock_getres
+clock_gettime
+clock_nanosleep
+clone
+close
+connect
+creat
+dup
+dup2
+dup3
+epoll_create
+epoll_create1
+epoll_ctl
+epoll_ctl_old
+epoll_pwait
+epoll_wait
+epoll_wait_old
+eventfd
+eventfd2
+execve
+execveat
+_exit
+exit
+exit_group
+fallocate
+
+# requires CAP_SYS_ADMIN
+#fanotify_init
+#fanotify_mark
+
+fcntl
+fcntl64
+flock
+fork
+ftime
+futex
+get_mempolicy
+get_robust_list
+get_thread_area
+getcpu
+getcwd
+getdents
+getdents64
+getegid
+getegid32
+geteuid
+geteuid32
+getgid
+getgid32
+getgroups
+getgroups32
+getitimer
+getpgid
+getpgrp
+getpid
+getppid
+getpriority
+getrandom
+getresgid
+getresgid32
+getresuid
+getresuid32
+
+getrlimit
+ugetrlimit
+
+getrusage
+getsid
+getsockname
+getsockopt
+gettid
+gettimeofday
+getuid
+getuid32
+
+getxattr
+fgetxattr
+lgetxattr
+
+inotify_add_watch
+inotify_init
+inotify_init1
+inotify_rm_watch
+
+# Needed by shell
+ioctl
+
+io_cancel
+io_destroy
+io_getevents
+io_setup
+io_submit
+ioprio_get
+# affects other processes, requires CAP_SYS_ADMIN. Potentially allow with
+# syscall filtering of (at least) IOPRIO_WHO_USER (LP: #1446748)
+#ioprio_set
+
+ipc
+kill
+link
+linkat
+listen
+listxattr
+llistxattr
+flistxattr
+
+lseek
+llseek
+_llseek
+lstat
+lstat64
+
+madvise
+fadvise64
+fadvise64_64
+arm_fadvise64_64
+
+mbind
+mincore
+mkdir
+mkdirat
+mlock
+mlockall
+mmap
+mmap2
+mprotect
+
+# LP: #1448184 - these aren't currently mediated by AppArmor. Deny for now
+#mq_getsetattr
+#mq_notify
+#mq_open
+#mq_timedreceive
+#mq_timedsend
+#mq_unlink
+
+mremap
+msgctl
+msgget
+msgrcv
+msgsnd
+msync
+munlock
+munlockall
+munmap
+
+nanosleep
+
+# LP: #1446748 - deny until we have syscall arg filtering. Alternatively, set
+# RLIMIT_NICE hard limit for apps, launch them under an appropriate nice value
+# and allow this call
+#nice
+
+# LP: #1446748 - support syscall arg filtering for mode_t with O_CREAT
+open
+
+openat
+pause
+pipe
+pipe2
+poll
+ppoll
+
+# LP: #1446748 - support syscall arg filtering
+prctl
+arch_prctl
+
+read
+pread
+pread64
+preadv
+readv
+
+readahead
+readdir
+readlink
+readlinkat
+recvmsg
+remap_file_pages
+
+removexattr
+fremovexattr
+lremovexattr
+
+rename
+renameat
+renameat2
+
+# The man page says this shouldn't be needed, but we've seen denials for it
+# in the wild
+restart_syscall
+
+rmdir
+rt_sigaction
+rt_sigpending
+rt_sigprocmask
+rt_sigqueueinfo
+rt_sigreturn
+rt_sigsuspend
+rt_sigtimedwait
+rt_tgsigqueueinfo
+sched_getaffinity
+sched_getattr
+sched_getparam
+sched_get_priority_max
+sched_get_priority_min
+sched_getscheduler
+sched_rr_get_interval
+# LP: #1446748 - when support syscall arg filtering, enforce pid_t is 0 so the
+# app may only change its own scheduler
+sched_setscheduler
+
+sched_yield
+
+select
+_newselect
+pselect
+pselect6
+
+semctl
+semget
+semop
+semtimedop
+sendfile
+sendfile64
+sendmsg
+sendto
+
+# snappy doesn't currently support per-app UID/GIDs so don't allow this family
+# of syscalls. To properly support these, we need to have syscall arg filtering
+# (LP: #1446748) and per-app UID/GIDs.
+#setgid
+#setgid32
+#setgroups
+#setgroups32
+#setregid
+#setregid32
+#setresgid
+#setresgid32
+#setresuid
+#setresuid32
+#setreuid
+#setreuid32
+#setuid
+#setuid32
+
+# These break isolation but are common and can't be mediated at the seccomp
+# level with arg filtering
+setpgid
+setpgrp
+
+set_thread_area
+setitimer
+
+# apps don't have CAP_SYS_RESOURCE so these can't be abused to raise the hard
+# limits
+setrlimit
+prlimit64
+
+set_mempolicy
+set_robust_list
+setsid
+set_tid_address
+setsockopt
+setxattr
+fsetxattr
+lsetxattr
+
+shmat
+shmctl
+shmdt
+shmget
+signal
+sigaction
+signalfd
+signalfd4
+sigaltstack
+sigpending
+sigprocmask
+sigreturn
+sigsuspend
+sigtimedwait
+sigwaitinfo
+socket
+socketpair
+splice
+
+stat
+stat64
+fstat
+fstat64
+fstatat64
+lstat
+newfstatat
+oldfstat
+oldlstat
+oldstat
+
+statfs
+statfs64
+fstatfs
+fstatfs64
+statvfs
+fstatvfs
+ustat
+
+symlink
+symlinkat
+
+sync
+sync_file_range
+sync_file_range2
+arm_sync_file_range
+fdatasync
+fsync
+syncfs
+sysinfo
+syslog
+tee
+tgkill
+time
+timer_create
+timer_delete
+timer_getoverrun
+timer_gettime
+timer_settime
+timerfd_create
+timerfd_gettime
+timerfd_settime
+times
+tkill
+
+truncate
+truncate64
+ftruncate
+ftruncate64
+
+umask
+
+uname
+olduname
+oldolduname
+
+unlink
+unlinkat
+
+utime
+utimensat
+utimes
+futimesat
+
+vfork
+vmsplice
+wait4
+oldwait4
+waitpid
+waitid
+
+write
+writev
+pwrite
+pwrite64
+pwritev
+
 
=== added file 'overlay/meta/mirdemosvr.apparmor'
--- overlay/meta/mirdemosvr.apparmor	1970-01-01 00:00:00 +0000
+++ overlay/meta/mirdemosvr.apparmor	2015-07-28 14:59:40 +0000
@@ -0,0 +1,45 @@
+# Description: mir-demo-server apparmor security profile
+# Usage: Mir
+
+#include <tunables/global>
+
+# Specified profile variables
+###VAR###
+
+###PROFILEATTACH### (attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  # Read-only for the install directory
+  @{CLICK_DIR}/@{APP_PKGNAME}/                   r,
+  @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/    r,
+  @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/**  mrklix,
+
+  # Writable home area
+  owner @{HOMEDIRS}/apps/@{APP_PKGNAME}/   rw,
+  owner @{HOMEDIRS}/apps/@{APP_PKGNAME}/** mrwklix,
+
+  # Read-only system area for other versions
+  /var/lib/apps/@{APP_PKGNAME}/   r,
+  /var/lib/apps/@{APP_PKGNAME}/** mrkix,
+
+  # Writable system area only for this version.
+  /var/lib/apps/@{APP_PKGNAME}/@{APP_VERSION}/   w,
+  /var/lib/apps/@{APP_PKGNAME}/@{APP_VERSION}/** wl,
+
+#  ... specialized confinement ...
+# Socket to talk on
+/run/mir_socket rw,
+
+# Hardware acceleration
+/dev/dri/card0 rw,
+
+# For non-opengl apps
+/dev/shm/\#* rw,
+
+# udev
+/sys/devices/*/*/*/uevent rw,
+/sys/devices/*/*/*/drm/card0/uevent rw,
+/sys/bus r,
+/sys/class r,
+}
 
=== added file 'overlay/meta/mirdemosvr.seccomp'
--- overlay/meta/mirdemosvr.seccomp	1970-01-01 00:00:00 +0000
+++ overlay/meta/mirdemosvr.seccomp	2015-07-28 14:59:40 +0000
@@ -0,0 +1,393 @@
+# Description: mir-demo-server apparmor security profile
+# Usage: Mir
+access
+accept
+faccessat
+
+alarm
+brk
+
+# ARM private syscalls
+breakpoint
+cacheflush
+set_tls
+usr26
+usr32
+
+capget
+
+chdir
+fchdir
+
+# We can't effectively block file perms due to open() with O_CREAT, so allow
+# chmod until we have syscall arg filtering (LP: #1446748)
+chmod
+fchmod
+fchmodat
+
+# snappy doesn't currently support per-app UID/GIDs so don't allow chown. To
+# properly support chown, we need to have syscall arg filtering (LP: #1446748)
+# and per-app UID/GIDs.
+#chown
+#chown32
+#fchown
+#fchown32
+#fchownat
+#lchown
+#lchown32
+
+clock_getres
+clock_gettime
+clock_nanosleep
+clone
+close
+creat
+dup
+dup2
+dup3
+epoll_create
+epoll_create1
+epoll_ctl
+epoll_ctl_old
+epoll_pwait
+epoll_wait
+epoll_wait_old
+eventfd
+eventfd2
+execve
+execveat
+_exit
+exit
+exit_group
+fallocate
+
+# requires CAP_SYS_ADMIN
+#fanotify_init
+#fanotify_mark
+
+fcntl
+fcntl64
+flock
+fork
+ftime
+futex
+get_mempolicy
+get_robust_list
+get_thread_area
+getcpu
+getcwd
+getdents
+getdents64
+getegid
+getegid32
+geteuid
+geteuid32
+getgid
+getgid32
+getgroups
+getgroups32
+getitimer
+getpgid
+getpgrp
+getpid
+getppid
+getpriority
+getrandom
+getresgid
+getresgid32
+getresuid
+getresuid32
+
+getrlimit
+ugetrlimit
+
+getrusage
+getsid
+gettid
+gettimeofday
+getuid
+getuid32
+
+getxattr
+fgetxattr
+lgetxattr
+
+inotify_add_watch
+inotify_init
+inotify_init1
+inotify_rm_watch
+
+# Needed by shell
+ioctl
+
+io_cancel
+io_destroy
+io_getevents
+io_setup
+io_submit
+ioprio_get
+# affects other processes, requires CAP_SYS_ADMIN. Potentially allow with
+# syscall filtering of (at least) IOPRIO_WHO_USER (LP: #1446748)
+#ioprio_set
+
+ipc
+kill
+link
+linkat
+
+listxattr
+llistxattr
+flistxattr
+
+lseek
+llseek
+_llseek
+lstat
+lstat64
+
+madvise
+fadvise64
+fadvise64_64
+arm_fadvise64_64
+
+mbind
+mincore
+mkdir
+mkdirat
+mlock
+mlockall
+mmap
+mmap2
+mprotect
+
+# LP: #1448184 - these aren't currently mediated by AppArmor. Deny for now
+#mq_getsetattr
+#mq_notify
+#mq_open
+#mq_timedreceive
+#mq_timedsend
+#mq_unlink
+
+mremap
+msgctl
+msgget
+msgrcv
+msgsnd
+msync
+munlock
+munlockall
+munmap
+
+nanosleep
+
+# LP: #1446748 - deny until we have syscall arg filtering. Alternatively, set
+# RLIMIT_NICE hard limit for apps, launch them under an appropriate nice value
+# and allow this call
+#nice
+
+# LP: #1446748 - support syscall arg filtering for mode_t with O_CREAT
+open
+
+openat
+pause
+pipe
+pipe2
+poll
+ppoll
+
+# LP: #1446748 - support syscall arg filtering
+prctl
+arch_prctl
+
+read
+pread
+pread64
+preadv
+readv
+
+readahead
+readdir
+readlink
+readlinkat
+remap_file_pages
+
+removexattr
+fremovexattr
+lremovexattr
+
+rename
+renameat
+renameat2
+
+# The man page says this shouldn't be needed, but we've seen denials for it
+# in the wild
+restart_syscall
+
+rmdir
+rt_sigaction
+rt_sigpending
+rt_sigprocmask
+rt_sigqueueinfo
+rt_sigreturn
+rt_sigsuspend
+rt_sigtimedwait
+rt_tgsigqueueinfo
+sched_getaffinity
+sched_getattr
+sched_getparam
+sched_get_priority_max
+sched_get_priority_min
+sched_getscheduler
+sched_rr_get_interval
+# LP: #1446748 - when support syscall arg filtering, enforce pid_t is 0 so the
+# app may only change its own scheduler
+sched_setscheduler
+
+sched_yield
+
+select
+_newselect
+pselect
+pselect6
+
+semctl
+semget
+semop
+semtimedop
+sendfile
+sendfile64
+
+# snappy doesn't currently support per-app UID/GIDs so don't allow this family
+# of syscalls. To properly support these, we need to have syscall arg filtering
+# (LP: #1446748) and per-app UID/GIDs.
+#setgid
+#setgid32
+#setgroups
+#setgroups32
+#setregid
+#setregid32
+#setresgid
+#setresgid32
+#setresuid
+#setresuid32
+#setreuid
+#setreuid32
+#setuid
+#setuid32
+
+# These break isolation but are common and can't be mediated at the seccomp
+# level with arg filtering
+setpgid
+setpgrp
+
+set_thread_area
+setitimer
+
+# apps don't have CAP_SYS_RESOURCE so these can't be abused to raise the hard
+# limits
+setrlimit
+prlimit64
+
+set_mempolicy
+set_robust_list
+setsid
+set_tid_address
+
+setxattr
+fsetxattr
+lsetxattr
+
+shmat
+shmctl
+shmdt
+shmget
+signal
+sigaction
+signalfd
+signalfd4
+sigaltstack
+sigpending
+sigprocmask
+sigreturn
+sigsuspend
+sigtimedwait
+sigwaitinfo
+splice
+
+stat
+stat64
+fstat
+fstat64
+fstatat64
+lstat
+newfstatat
+oldfstat
+oldlstat
+oldstat
+
+statfs
+statfs64
+fstatfs
+fstatfs64
+statvfs
+fstatvfs
+ustat
+
+symlink
+symlinkat
+
+sync
+sync_file_range
+sync_file_range2
+arm_sync_file_range
+fdatasync
+fsync
+syncfs
+sysinfo
+syslog
+tee
+tgkill
+time
+timer_create
+timer_delete
+timer_getoverrun
+timer_gettime
+timer_settime
+timerfd_create
+timerfd_gettime
+timerfd_settime
+times
+tkill
+
+truncate
+truncate64
+ftruncate
+ftruncate64
+
+umask
+
+uname
+olduname
+oldolduname
+
+unlink
+unlinkat
+
+utime
+utimensat
+utimes
+futimesat
+
+vfork
+vmsplice
+wait4
+oldwait4
+waitpid
+waitid
+
+write
+writev
+pwrite
+pwrite64
+pwritev
+
 
=== modified file 'overlay/meta/package.yaml'
--- overlay/meta/package.yaml	2015-06-11 21:18:28 +0000
+++ overlay/meta/package.yaml	2015-07-28 14:59:40 +0000
@@ -8,4 +8,12 @@
   - name: system-compositor
     description: "system compositor"
     start: bin/server
-    security-template: unconfined
+    security-policy:
+        apparmor: ./meta/mir.apparmor
+        seccomp: ./meta/mir.seccomp
+binaries:
+  - name: mir_demo_server
+    exec: debs/usr/bin/mir_demo_server
+    security-policy:
+        apparmor: ./meta/mirdemosvr.apparmor
+        seccomp: ./meta/mirdemosvr.seccomp