296 lines
38 KiB
HTML
296 lines
38 KiB
HTML
<!DOCTYPE html>
|
|
<html><head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
|
|
<title>test.apparmor</title>
|
|
<meta name="generator" content="KF5::SyntaxHighlighting - Definition (AppArmor Security Profile) - Theme (Breeze Dark)"/>
|
|
</head><body style="background-color:#232629;color:#cfcfc2"><pre>
|
|
<span style="color:#7a7c7d"># </span><span style="color:#3f8058">kate:</span><span style="color:#7a7c7d"> </span><span style="color:#7f8c8d">syntax</span><span style="color:#f44f4f"> AppArmor Security Profile</span><span style="color:#7f8c8d">;</span><span style="color:#7a7c7d"> </span><span style="color:#7f8c8d">replace-tabs</span><span style="color:#7a7c7d"> </span><span style="color:#27ae60">off</span><span style="color:#7f8c8d">;</span>
|
|
|
|
<span style="color:#7a7c7d">#</span>
|
|
<span style="color:#7a7c7d"># Sample AppArmor Profile.</span>
|
|
<span style="color:#7a7c7d"># License: Public Domain</span>
|
|
<span style="color:#7a7c7d">#</span>
|
|
<span style="color:#7a7c7d"># </span><span style="color:#81ca2d;background-color:#4d1f24;font-weight:bold">NOTE</span><span style="color:#7a7c7d">: This profile is not fully functional, since</span>
|
|
<span style="color:#7a7c7d"># it is designed to test the syntax highlighting</span>
|
|
<span style="color:#7a7c7d"># for the KDE's KSyntaxHighlighting framework.</span>
|
|
<span style="color:#7a7c7d">#</span>
|
|
|
|
<span style="color:#27ae60">include </span><span style="color:#27ae60"><tunables/global></span>
|
|
|
|
<span style="color:#7a7c7d"># Variable assignment</span>
|
|
<span style="color:#f67400">@{FOO_LIB}</span><span style="color:#3f8058">=</span>/usr/lib<span style="color:#da4453">{</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">32</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">64}</span>/foo
|
|
<span style="color:#f67400">@{USER_DIR}</span>
|
|
<span style="color:#3f8058">=</span> <span style="color:#f67400">@{HOME}</span>/Public <span style="color:#f67400">@{HOME}</span>/Desktop <span style="color:#da4453;text-decoration:underline">#</span>No-Comment
|
|
<span style="color:#f67400">@{USER_DIR}</span><span style="color:#3f8058"> +=</span> <span style="color:#f67400">@{HOME}</span>/Hello <span style="color:#3daee9">\</span>
|
|
deny owner <span style="color:#da4453;text-decoration:underline">#</span>No-comment aa#aa
|
|
<span style="color:#f67400">${BOOL}</span> <span style="color:#3f8058">=</span> <span style="color:#2980b9">true</span>
|
|
|
|
<span style="color:#7a7c7d"># Alias</span>
|
|
<span style="color:#27aeae;font-weight:bold">alias</span> /usr/ <span style="color:#da4453;font-weight:bold">-></span> /mnt/usr/,
|
|
|
|
<span style="color:#7a7c7d"># ABI feature</span>
|
|
<span style="color:#27aeae;font-weight:bold">abi</span> <span style="color:#27ae60"><abi/3.0></span>,
|
|
<span style="color:#27aeae;font-weight:bold">abi</span> <span style="color:#27ae60"><"includes/abi/4.19"></span>,
|
|
<span style="color:#27aeae;font-weight:bold">abi</span> <span style="color:#27ae60">"simple_tests/includes/abi/4.19"</span>,
|
|
<span style="color:#27aeae;font-weight:bold">abi</span> <span style="color:#27ae60">simple_tests/includes/abi/4.19</span>,
|
|
|
|
<span style="color:#7a7c7d"># Profile for /usr/bin/foo</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">foo</span> /usr/bin/foo <span style="color:#27ae60">flags</span><span style="color:#3f8058">=</span>(<span style="color:#da4453">attach_disconnected</span> <span style="color:#da4453">enforce</span>) <span style="color:#27ae60">xattrs</span><span style="color:#3f8058">=</span>(<span style="color:#2980b9">myvalue</span><span style="color:#3f8058">=</span>foo <span style="color:#2980b9">user.bar</span><span style="color:#3f8058">=</span><span style="color:#3daee9">*</span> <span style="color:#2980b9">user.foo</span><span style="color:#3f8058">=</span><span style="color:#f44f4f">"bar"</span> ) <span style="color:#3f8058">{</span>
|
|
<span style="color:#27ae60">#include </span><span style="color:#27ae60"><abstractions/ubuntu-helpers></span>
|
|
<span style="color:#27ae60">#include</span><span style="color:#27ae60"><abstractions/wayland></span>
|
|
<span style="color:#27ae60">#include</span><span style="color:#27ae60">"/etc/apparmor.d/abstractions/ubuntu-konsole"</span>
|
|
<span style="color:#27ae60"> include </span><span style="color:#27ae60">"/etc/apparmor.d/abstractions/openssl"</span>
|
|
|
|
<span style="color:#27ae60"> include if exists </span><span style="color:#27ae60"><path with spaces></span>
|
|
<span style="color:#27ae60"> include </span><span style="color:#27ae60"><include_tests/includes_okay_helper.include></span> <span style="color:#27ae60">#include </span><span style="color:#27ae60"><includes/base></span>
|
|
/some/file<span style="font-weight:bold"> mr</span>, <span style="color:#27ae60">#include </span><span style="color:#27ae60"><includes/base></span> /bin/true<span style="font-weight:bold"> Px</span>,
|
|
|
|
<span style="color:#7a7c7d"># File rules</span>
|
|
/<span style="color:#da4453">{</span><span style="color:#7f8c8d">,</span><span style="color:#3daee9">**</span><span style="color:#da4453">/}</span><span style="font-weight:bold"> r</span>,
|
|
<span style="color:#27aeae;font-weight:bold">owner</span> /<span style="color:#da4453">{home</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">media</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">mnt</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">srv</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">net}</span>/<span style="color:#3daee9">**</span><span style="font-weight:bold"> r</span>,
|
|
<span style="color:#27aeae;font-weight:bold">owner</span> <span style="color:#f67400">@{USER_DIR}</span>/<span style="color:#3daee9">**</span><span style="font-weight:bold"> rw</span>,
|
|
<span style="font-weight:bold">audit</span> <span style="color:#da4453;font-weight:bold">deny</span> <span style="color:#27aeae;font-weight:bold">owner</span> /<span style="color:#3daee9">**</span>/<span style="color:#3daee9">*</span><span style="font-weight:bold"> mx</span>,
|
|
/<span style="color:#3daee9">**</span>.<span style="color:#da4453">[tT][xX][tT]</span><span style="font-weight:bold"> r</span>, <span style="color:#7a7c7d"># txt</span>
|
|
|
|
<span style="color:#27aeae;font-weight:bold">owner</span> <span style="color:#27aeae;font-weight:bold">file</span> <span style="color:#f67400">@{HOME}</span>/.local/share/foo/<span style="color:#da4453">{</span><span style="color:#7f8c8d">,</span><span style="color:#3daee9">**</span><span style="color:#da4453">}</span><span style="font-weight:bold"> rwkl</span>,
|
|
<span style="color:#27aeae;font-weight:bold">owner</span> <span style="color:#f67400">@{HOME}</span>/.config/<span style="color:#3daee9">*</span>.<span style="color:#da4453">[a-zA-Z0-9]</span><span style="color:#3daee9">*</span> <span style="font-weight:bold"> rwk</span>,
|
|
|
|
<span style="color:#f44f4f">"/usr/share/</span><span style="color:#3daee9">**</span><span style="color:#f44f4f">"</span><span style="font-weight:bold"> r</span>,
|
|
<span style="color:#f44f4f">"/var/lib/flatpak/exports/share/</span><span style="color:#3daee9">**</span><span style="color:#f44f4f">"</span><span style="font-weight:bold"> r</span>,
|
|
<span style="color:#f44f4f">"/var/lib/</span><span style="color:#da4453">{spaces in</span>
|
|
<span style="color:#da4453"> string</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">hello}</span><span style="color:#f44f4f">/a</span><span style="color:#da4453">[</span><span style="color:#7f8c8d">^</span><span style="color:#da4453"> a]</span><span style="color:#f44f4f">a/</span><span style="color:#3daee9">**</span><span style="color:#f44f4f">"</span><span style="font-weight:bold"> r</span>,
|
|
|
|
<span style="color:#da4453;font-weight:bold">allow</span> <span style="color:#27aeae;font-weight:bold">file</span> /etc/nsswitch.conf <span style="font-weight:bold"> r</span>,
|
|
<span style="color:#da4453;font-weight:bold">allow</span> /etc/fstab <span style="font-weight:bold"> r</span>,
|
|
<span style="color:#da4453;font-weight:bold">deny</span> /etc/xdg/<span style="color:#da4453">{autostart</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">systemd}</span>/<span style="color:#3daee9">**</span> <span style="font-weight:bold"> r</span>,
|
|
<span style="color:#da4453;font-weight:bold">deny</span> /boot/<span style="color:#3daee9">**</span> <span style="font-weight:bold"> rwlkmx</span>,
|
|
|
|
<span style="color:#27aeae;font-weight:bold">owner</span> <span style="color:#f67400">@{PROC}</span>/<span style="color:#f67400">@{pid}</span>/<span style="color:#da4453">{cmdline</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">mountinfo</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">mounts</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">stat</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">status</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">vmstat}</span><span style="font-weight:bold"> r</span>,
|
|
/sys/devices/<span style="color:#3daee9">**</span>/uevent<span style="font-weight:bold"> r</span>,
|
|
<span style="color:#f67400">@{FOO_LIB}</span>/<span style="color:#da4453">{</span><span style="color:#f67400">@{multiarch}</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">64}</span>/<span style="color:#3daee9">**</span><span style="font-weight:bold"> mr</span>,
|
|
|
|
/usr/bin/foo <span style="font-weight:bold"> ixr</span>,
|
|
/usr/bin/dolphin <span style="font-weight:bold"> pUx</span>,
|
|
/usr/bin/<span style="color:#3daee9">*</span> <span style="font-weight:bold"> Pixr</span>,
|
|
/usr/bin/khelpcenter<span style="font-weight:bold"> Cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">sanitized_helper</span>,
|
|
/usr/bin/helloworld <span style="font-weight:bold"> cxr</span> <span style="color:#da4453;font-weight:bold">-></span>
|
|
<span style="color:#8e44ad;font-style:italic">hello_world</span>,
|
|
/bin/<span style="color:#3daee9">**</span><span style="font-weight:bold"> px</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">profile</span>,
|
|
|
|
<span style="color:#7a7c7d"># Dbus rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">dbus</span> (<span style="font-weight:bold">send</span>) <span style="color:#da4453;text-decoration:underline">#</span>No-Comment
|
|
<span style="color:#27ae60">bus</span><span style="color:#3f8058">=</span><span style="font-style:italic">system</span>
|
|
<span style="color:#27ae60">path</span><span style="color:#3f8058">=</span>/org/freedesktop/NetworkManager
|
|
<span style="color:#27ae60">interface</span><span style="color:#3f8058">=</span>org.freedesktop.DBus.Introspectable
|
|
<span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>(<span style="color:#2980b9">name</span><span style="color:#3f8058">=</span>org.freedesktop.NetworkManager <span style="color:#2980b9">label</span><span style="color:#3f8058">=</span><span style="font-style:italic">unconfined</span>),
|
|
<span style="color:#27aeae;font-weight:bold">dbus</span> (<span style="font-weight:bold">send</span> <span style="font-weight:bold">receive</span>)
|
|
<span style="color:#27ae60">bus</span><span style="color:#3f8058">=</span><span style="font-style:italic">system</span>
|
|
<span style="color:#27ae60">path</span><span style="color:#3f8058">=</span>/org/freedesktop/NetworkManager
|
|
<span style="color:#27ae60">interface</span><span style="color:#3f8058">=</span>org.freedesktop.NetworkManager
|
|
<span style="color:#27ae60">member</span><span style="color:#3f8058">=</span><span style="color:#da4453">{Introspect</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">state}</span>
|
|
<span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>(<span style="color:#2980b9">name</span><span style="color:#3f8058">=</span><span style="color:#da4453">(org.freedesktop.NetworkManager</span><span style="color:#7f8c8d">|</span><span style="color:#da4453">org.freedesktop.DBus)</span>),
|
|
<span style="color:#27aeae;font-weight:bold">dbus</span> (<span style="font-weight:bold">send</span>)
|
|
<span style="color:#27ae60">bus</span><span style="color:#3f8058">=</span><span style="font-style:italic">session</span>
|
|
<span style="color:#27ae60">path</span><span style="color:#3f8058">=</span>/org/gnome/GConf/Database/<span style="color:#3daee9">*</span>
|
|
<span style="color:#27ae60">member</span><span style="color:#3f8058">=</span><span style="color:#da4453">{AddMatch</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">AddNotify</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">AllEntries</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">LookupExtended</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">RemoveNotify}</span>,
|
|
<span style="color:#27aeae;font-weight:bold">dbus</span> (<span style="font-weight:bold">bind</span>)
|
|
<span style="color:#27ae60">bus</span><span style="color:#3f8058">=</span><span style="font-style:italic">system</span>
|
|
<span style="color:#27ae60">name</span><span style="color:#3f8058">=</span>org.bluez,
|
|
|
|
<span style="color:#7a7c7d"># Signal rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">signal</span> (<span style="font-weight:bold">send</span>) <span style="color:#27ae60">set</span><span style="color:#3f8058">=</span>(<span style="color:#da4453">term</span>) <span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span><span style="color:#f44f4f">"/usr/lib/hello/world</span><span style="color:#3f8058;font-weight:bold">//</span><span style="color:#3f8058"> foo helper</span><span style="color:#f44f4f">"</span>,
|
|
<span style="color:#27aeae;font-weight:bold">signal</span> (<span style="font-weight:bold">send</span>, <span style="font-weight:bold">receive</span>) <span style="color:#27ae60">set</span><span style="color:#3f8058">=</span>(<span style="color:#da4453">int</span> <span style="color:#da4453">exists</span> <span style="color:#da4453">rtmin+8</span>) <span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>/usr/lib/hello/world<span style="color:#3f8058;font-weight:bold">//</span><span style="color:#3f8058">foo-helper</span>,
|
|
|
|
<span style="color:#7a7c7d"># Child profile</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">hello_world</span> <span style="color:#3f8058">{</span>
|
|
<span style="color:#7a7c7d"># File rules (three different ways)</span>
|
|
<span style="color:#27aeae;font-weight:bold">file</span> /usr/lib<span style="color:#da4453">{</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">32</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">64}</span>/helloworld/<span style="color:#3daee9">**</span>.so<span style="font-weight:bold"> mr</span>,
|
|
/usr/lib<span style="color:#da4453">{</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">32</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">64}</span>/helloworld/<span style="color:#3daee9">**</span><span style="font-weight:bold"> r</span>,
|
|
<span style="font-weight:bold"> rk</span> /usr/lib<span style="color:#da4453">{</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">32</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">64}</span>/helloworld/hello,file,
|
|
|
|
<span style="color:#7a7c7d"># Link rules (two ways)</span>
|
|
<span style="font-weight:bold"> l</span> /foo1 <span style="color:#da4453;font-weight:bold">-></span> /bar,
|
|
<span style="color:#27aeae;font-weight:bold">link</span> /foo2 <span style="color:#da4453;font-weight:bold">-></span> bar,
|
|
<span style="color:#27aeae;font-weight:bold">link</span> <span style="color:#27aeae">subset</span> /link<span style="color:#3daee9">*</span> <span style="color:#da4453;font-weight:bold">-></span> /<span style="color:#3daee9">**</span>,
|
|
|
|
<span style="color:#7a7c7d"># Network rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">network</span> <span style="color:#27aeae">inet6</span> <span style="color:#27aeae">tcp</span>,
|
|
<span style="color:#27aeae;font-weight:bold">network</span> <span style="color:#27aeae">netlink</span> <span style="color:#27aeae">dgram</span>,
|
|
<span style="color:#27aeae;font-weight:bold">network</span> <span style="color:#27aeae">bluetooth</span>,
|
|
<span style="color:#27aeae;font-weight:bold">network</span> <span style="font-style:italic">unspec</span> <span style="color:#27aeae">dgram</span>,
|
|
|
|
<span style="color:#7a7c7d"># Capability rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">capability</span> <span style="color:#27aeae">dac_override</span>,
|
|
<span style="color:#27aeae;font-weight:bold">capability</span> <span style="color:#27aeae">sys_admin</span>,
|
|
<span style="color:#27aeae;font-weight:bold">capability</span> <span style="color:#27aeae">sys_chroot</span>,
|
|
|
|
<span style="color:#7a7c7d"># Mount rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">mount</span> <span style="color:#27ae60">options</span><span style="color:#3f8058">=</span>(<span style="font-weight:bold">rw</span> <span style="font-weight:bold">bind</span> <span style="font-weight:bold">remount</span> <span style="font-weight:bold">nodev</span> <span style="font-weight:bold">noexec</span>) <span style="color:#27ae60">vfstype</span><span style="color:#3f8058">=</span><span style="color:#da4453">ecryptfs</span> /home/<span style="color:#3daee9">*</span>/.helloworld/ <span style="color:#da4453;font-weight:bold">-></span> /home/<span style="color:#3daee9">*</span>/helloworld/,
|
|
<span style="color:#27aeae;font-weight:bold">mount</span> <span style="color:#27ae60">options</span> <span style="color:#da4453;font-weight:bold">in</span> (<span style="font-weight:bold">rw</span>, <span style="font-weight:bold">bind</span>) / <span style="color:#da4453;font-weight:bold">-></span> /run/hellowordd/<span style="color:#3daee9">*</span>.mnt,
|
|
<span style="color:#27aeae;font-weight:bold">mount</span> <span style="color:#27ae60">options</span><span style="color:#3f8058">=</span><span style="font-weight:bold">read-only</span> <span style="color:#27ae60">fstype</span><span style="color:#3f8058">=</span><span style="color:#da4453">btrfs</span> /dev/sd<span style="color:#da4453">[a-z][1-9]</span><span style="color:#3daee9">*</span> <span style="color:#da4453;font-weight:bold">-></span> /media/<span style="color:#3daee9">*</span>/<span style="color:#3daee9">*</span>,
|
|
<span style="color:#27aeae;font-weight:bold">umount</span> /home/<span style="color:#3daee9">*</span>/helloworld/,
|
|
|
|
<span style="color:#7a7c7d"># Pivot Root rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">pivot_root</span> <span style="color:#27ae60">oldroot</span><span style="color:#3f8058">=</span>/mnt/root/old/ /mnt/root/,
|
|
<span style="color:#27aeae;font-weight:bold">pivot_root</span> /mnt/root/,
|
|
|
|
<span style="color:#7a7c7d"># Ptrace rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">ptrace</span> (<span style="font-weight:bold">trace</span>) <span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span><span style="font-style:italic">unconfined</span>,
|
|
<span style="color:#27aeae;font-weight:bold">ptrace</span> (<span style="font-weight:bold">read</span>, <span style="font-weight:bold">trace</span>, <span style="font-weight:bold">tracedby</span>) <span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>/usr/lib/hello/helloword,
|
|
|
|
<span style="color:#7a7c7d"># Unix rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> (<span style="font-weight:bold">connect</span> <span style="font-weight:bold">receive</span> <span style="font-weight:bold">send</span>) <span style="color:#27ae60">type</span><span style="color:#3f8058">=</span>(<span style="color:#27aeae">stream</span>) <span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>(<span style="color:#2980b9">addr</span><span style="color:#3f8058">=</span>@/tmp/ibus/dbus-<span style="color:#3daee9">*</span>,<span style="color:#2980b9">label</span><span style="color:#3f8058">=</span><span style="font-style:italic">unconfined</span>),
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> (<span style="font-weight:bold">send</span>,<span style="font-weight:bold">receive</span>) <span style="color:#27ae60">type</span><span style="color:#3f8058">=</span>(<span style="color:#27aeae">stream</span>) <span style="color:#27ae60">protocol</span><span style="color:#3f8058">=</span>0 <span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>(<span style="color:#2980b9">addr</span><span style="color:#3f8058">=</span><span style="font-style:italic">none</span>),
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> <span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>(<span style="color:#2980b9">label</span><span style="color:#3f8058">=</span><span style="color:#f67400">@{profile_name}</span>,<span style="color:#2980b9">addr</span><span style="color:#3f8058">=</span>@helloworld),
|
|
|
|
<span style="color:#7a7c7d"># Rlimit rule</span>
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#27aeae;font-weight:bold">rlimit</span> <span style="color:#27aeae">data</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">100</span><span style="color:#f67400;font-weight:bold">M</span>,
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#27aeae;font-weight:bold">rlimit</span> <span style="color:#27aeae">nproc</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">10</span>,
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#27aeae;font-weight:bold">rlimit</span> <span style="color:#27aeae">memlock</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">2</span><span style="color:#f67400;font-weight:bold">GB</span>,
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#27aeae;font-weight:bold">rlimit</span> <span style="color:#27aeae">rss</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">infinity</span>,
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#27aeae;font-weight:bold">rlimit</span> <span style="color:#27aeae">nice</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">-12</span>,
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#27aeae;font-weight:bold">rlimit</span> <span style="color:#27aeae">nice</span> <span style="color:#da4453;font-weight:bold"><=</span> -<span style="color:#f67400">12</span><span style="color:#f67400;font-weight:bold">K</span>,
|
|
|
|
<span style="color:#7a7c7d"># Change Profile rules</span>
|
|
<span style="color:#27aeae;font-weight:bold">change_profile</span> <span style="color:#27aeae">unsafe</span> /<span style="color:#3daee9">**</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">[^u/]</span><span style="color:#3daee9;font-style:italic">**</span>,
|
|
<span style="color:#27aeae;font-weight:bold">change_profile</span> <span style="color:#27aeae">unsafe</span> /<span style="color:#3daee9">**</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">{u,un,unc,unco,uncon,unconf,unconfi,unconfin,unconfine}</span>,
|
|
<span style="color:#27aeae;font-weight:bold">change_profile</span> /bin/bash <span style="color:#da4453;font-weight:bold">-></span>
|
|
<span style="color:#8e44ad;font-style:italic">new_profile</span><span style="color:#3f8058;font-weight:bold;font-style:italic">//</span><span style="color:#8e44ad;font-style:italic">hat</span>,
|
|
<span style="color:#3f8058">}</span>
|
|
|
|
<span style="color:#7a7c7d"># Hat</span>
|
|
<span style="color:#8e44ad;font-weight:bold"> ^</span><span style="color:#8e44ad">foo-helper</span><span style="color:#3daee9">\/</span> <span style="color:#3f8058">{</span>
|
|
<span style="color:#27aeae;font-weight:bold">network</span> <span style="color:#27aeae">unix</span> <span style="color:#27aeae">stream</span>,
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> <span style="color:#27aeae">stream</span>,
|
|
|
|
/usr/hi<span style="color:#3daee9">\"</span>esc<span style="color:#3daee9">\x23</span>esc<span style="color:#3daee9">\032</span>es<span style="color:#3daee9">\47</span>7esc<span style="color:#3daee9">\*</span>es<span style="color:#3daee9">\{</span>esc<span style="color:#3daee9">\ </span>rw<span style="font-weight:bold"> r</span>, <span style="color:#7a7c7d"># Escape expressions</span>
|
|
|
|
<span style="color:#7a7c7d"># Text after a variable is highlighted as path</span>
|
|
<span style="color:#27aeae;font-weight:bold">file</span> /my/path<span style="font-weight:bold"> r</span>,
|
|
<span style="color:#f67400">@{FOO_LIB}</span>file<span style="font-weight:bold"> r</span>,
|
|
<span style="color:#f67400">@{FOO_LIB}</span>#my/path<span style="font-weight:bold"> r</span>, <span style="color:#7a7c7d">#Comment</span>
|
|
<span style="color:#f67400">@{FOO_LIB}</span>ñ<span style="color:#3daee9">*</span><span style="font-weight:bold"> r</span>,
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> (/path<span style="color:#3daee9">\t</span><span style="color:#da4453">{aa}</span><span style="color:#3daee9">*</span>,*a <span style="color:#f67400">@{var}</span><span style="color:#3daee9">*</span>path,* <span style="color:#f67400">@{var}</span>,*),
|
|
<span style="color:#3f8058">}</span>
|
|
<span style="color:#3f8058">}</span>
|
|
|
|
<span style="color:#7a7c7d"># Syntax Error</span>
|
|
/usr/bin/error (<span style="color:#da4453">complain</span>, <span style="color:#da4453">audit</span>) <span style="color:#3f8058">{</span>
|
|
<span style="color:#27aeae;font-weight:bold">file</span> <span style="color:#da4453;text-decoration:underline">#include</span> /hello<span style="font-weight:bold"> r</span>,
|
|
|
|
<span style="color:#7a7c7d"># Error: Variable open or with characters not allowed</span>
|
|
<span style="color:#da4453;text-decoration:underline">@</span><span style="color:#3f8058">{</span>var
|
|
<span style="color:#da4453;text-decoration:underline">@</span><span style="color:#3f8058">{</span>sdf&s<span style="color:#3f8058">}</span>
|
|
|
|
<span style="color:#7a7c7d"># Error: Open brackets</span>
|
|
/<span style="color:#da4453">{hello{ab</span><span style="color:#7f8c8d">,</span><span style="color:#da4453">cd}worl</span><span style="color:#da4453;text-decoration:underline">d</span> <span style="font-weight:bold"> kr</span>,
|
|
/<span style="color:#da4453">{abc{ab</span><span style="color:#da4453;text-decoration:underline">c</span><span style="font-weight:bold"> kr</span>,
|
|
/<span style="color:#da4453">[ab</span><span style="color:#da4453;text-decoration:underline">c</span> <span style="font-weight:bold"> kr</span>,
|
|
/<span style="color:#da4453">(ab</span><span style="color:#da4453;text-decoration:underline">c</span><span style="font-weight:bold"> kr</span>,
|
|
|
|
<span style="color:#7a7c7d"># Error: Empty brackets</span>
|
|
/hello<span style="color:#da4453;text-decoration:underline">[]</span>hello<span style="color:#da4453;text-decoration:underline">{}</span>hello<span style="color:#da4453;text-decoration:underline">()</span>he <span style="font-weight:bold"> kr</span>,
|
|
|
|
<span style="color:#7a7c7d"># Comments not allowed</span>
|
|
<span style="color:#27aeae;font-weight:bold">dbus</span> (<span style="font-weight:bold">send</span>) <span style="color:#da4453;text-decoration:underline">#</span>No comment
|
|
<span style="color:#27ae60">path</span><span style="color:#3f8058">=</span>/org/hello
|
|
<span style="color:#da4453;text-decoration:underline">#</span><span style="color:#7a7c7d">No comment</span>
|
|
<span style="color:#27ae60">interface</span><span style="color:#3f8058">=</span>org.hello <span style="color:#da4453;text-decoration:underline">#</span>No comment
|
|
<span style="color:#27ae60">peer</span><span style="color:#3f8058">=</span>(<span style="color:#2980b9">name</span><span style="color:#3f8058">=</span>org.hello <span style="color:#da4453;text-decoration:underline">#</span>No comment
|
|
<span style="color:#2980b9">label</span><span style="color:#3f8058">=</span><span style="font-style:italic">unconfined</span>), <span style="color:#7a7c7d">#Comment</span>
|
|
|
|
<span style="color:#7a7c7d"># Don't allow assignment of variables within profiles</span>
|
|
<span style="color:#f67400">@{VARIABLE}</span> <span style="color:#da4453;text-decoration:underline">=</span> val1 val2 val3 <span style="color:#7a7c7d"># Comment</span>
|
|
|
|
<span style="color:#7a7c7d"># Alias rules not allowed within profiles</span>
|
|
<span style="color:#da4453;text-decoration:underline">alias</span> /run/ <span style="color:#da4453;font-weight:bold">-></span> /mnt/run/,
|
|
|
|
<span style="color:#7a7c7d"># Error: Open rule</span>
|
|
/home/<span style="color:#3daee9">*</span>/file<span style="font-weight:bold"> rw</span>
|
|
<span style="color:#27aeae;font-weight:bold;text-decoration:underline">capability</span> <span style="color:#27aeae">dac_override</span>
|
|
<span style="color:#da4453;font-weight:bold;text-decoration:underline">deny</span> <span style="color:#27aeae;font-weight:bold">file</span> /etc/fstab<span style="font-weight:bold"> w</span>
|
|
<span style="font-weight:bold;text-decoration:underline">audit</span> <span style="color:#27aeae;font-weight:bold">network</span> <span style="color:#27aeae">ieee802154</span>,
|
|
|
|
<span style="color:#27aeae;font-weight:bold">dbus</span> (<span style="font-weight:bold">receive</span>
|
|
<span style="color:#27aeae;font-weight:bold;text-decoration:underline">unix</span> <span style="color:#27aeae">stream</span>,
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> <span style="color:#27aeae">stream</span>,
|
|
<span style="color:#3f8058">}</span>
|
|
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">other_tests</span> <span style="color:#3f8058">{</span>
|
|
<span style="color:#7a7c7d"># set rlimit</span>
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#27aeae;font-weight:bold">rlimit</span> <span style="color:#27aeae">nice</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">3</span>,
|
|
<span style="color:#27aeae;font-weight:bold;text-decoration:underline">rlimit</span> <span style="color:#27aeae">nice</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">3</span>, <span style="color:#7a7c7d"># Without "set"</span>
|
|
<span style="color:#27aeae;font-weight:bold">set</span> <span style="color:#7a7c7d">#comment</span>
|
|
<span style="color:#27aeae;font-weight:bold">rlimit</span>
|
|
<span style="color:#27aeae">nice</span> <span style="color:#da4453;font-weight:bold"><=</span> <span style="color:#f67400">3</span>,
|
|
|
|
<span style="color:#7a7c7d"># "remount" keyword</span>
|
|
<span style="color:#27aeae;font-weight:bold">mount</span> <span style="font-weight:bold">remount</span>
|
|
<span style="font-weight:bold">remount</span>,
|
|
<span style="color:#27aeae;font-weight:bold">remount</span> <span style="font-weight:bold">remount</span>
|
|
<span style="font-weight:bold">remount</span>,
|
|
<span style="color:#27aeae;font-weight:bold">dbus</span> remount
|
|
<span style="color:#27aeae;font-weight:bold;text-decoration:underline">remount</span>,
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> remount
|
|
<span style="color:#27aeae;font-weight:bold;text-decoration:underline">remount</span>,
|
|
<span style="color:#7a7c7d"># "unix" keyword</span>
|
|
<span style="color:#27aeae;font-weight:bold">network</span> <span style="color:#27aeae">unix</span>
|
|
<span style="color:#27aeae">unix</span>,
|
|
<span style="color:#27aeae;font-weight:bold">ptrace</span> unix
|
|
<span style="color:#27aeae;font-weight:bold;text-decoration:underline">unix</span>,
|
|
<span style="color:#27aeae;font-weight:bold">unix</span> unix
|
|
<span style="color:#27aeae;font-weight:bold;text-decoration:underline">unix</span>,
|
|
|
|
<span style="color:#7a7c7d"># Transition rules</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">hello</span><span style="color:#3daee9;font-style:italic">*</span>, <span style="color:#7a7c7d"># profile name</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> Cx</span> <span style="color:#da4453;font-weight:bold">-></span> path/, <span style="color:#7a7c7d"># path</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">ab[ad/]hello</span>, <span style="color:#7a7c7d"># profile name</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> Cx</span> <span style="color:#da4453;font-weight:bold">-></span> ab<span style="color:#da4453">[cd/]</span>a<span style="color:#da4453">[ad/]</span>hello/path, <span style="color:#7a7c7d"># path</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> Cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">ab[hello/path</span>, <span style="color:#7a7c7d"># profile name</span>
|
|
|
|
/usr/bin/foo<span style="font-weight:bold"> cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">"hello</span><span style="color:#3daee9;font-style:italic">*</span><span style="color:#8e44ad;font-style:italic">"</span>, <span style="color:#7a7c7d"># profile name</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> Cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#f44f4f">"path/"</span>, <span style="color:#7a7c7d"># path</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">"ab[ad/]hello"</span>, <span style="color:#7a7c7d"># profile name</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> Cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#f44f4f">"ab</span><span style="color:#da4453">[cd/]</span><span style="color:#f44f4f">a</span><span style="color:#da4453">[ad/]</span><span style="color:#f44f4f">hello/path"</span>, <span style="color:#7a7c7d"># path</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> Cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">"ab[hello/path"</span>, <span style="color:#7a7c7d"># profile name</span>
|
|
|
|
/usr/bin/foo<span style="font-weight:bold"> cx</span> <span style="color:#da4453;font-weight:bold">-></span> holas//hello/sa, <span style="color:#7a7c7d"># path</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> cx</span> <span style="color:#da4453;font-weight:bold">-></span> df///dd<span style="color:#3f8058;font-weight:bold">//</span><span style="color:#3f8058">hat</span>, <span style="color:#7a7c7d"># path + hat</span>
|
|
/usr/bin/foo<span style="font-weight:bold"> cx</span> <span style="color:#da4453;font-weight:bold">-></span> <span style="color:#8e44ad;font-style:italic">holas,#sd</span><span style="color:#3daee9;font-style:italic">\323</span><span style="color:#8e44ad;font-style:italic">fsdf</span>, <span style="color:#7a7c7d"># profile name</span>
|
|
|
|
<span style="color:#7a7c7d"># Access modes</span>
|
|
/hello/lib/foo rwklms, <span style="color:#7a7c7d"># s invalid</span>
|
|
/hello/lib/foo rwmaix, <span style="color:#7a7c7d"># w & a incompatible</span>
|
|
/hello/lib/foo kalmw,
|
|
/hello/lib/foo wa,
|
|
<span style="color:#7a7c7d"># OK</span>
|
|
/hello/lib/foo<span style="font-weight:bold"> rrwrwwrwrw</span>,
|
|
/hello/lib/foo<span style="font-weight:bold"> ixixix</span>,
|
|
<span style="color:#7a7c7d"># Incompatible exec permissions</span>
|
|
ixixux, uxuxUxux, ixixixPixix, ixixpx uxuxuxPuxux, UxUxcUxUx,
|
|
pixpixcixix, cxcxcxix, pixpixpux pixpixix xxix xxpux ixixx puxpuxx,
|
|
Cuxcux Pixpix, puxpUx puxPUx xxpix xxcx,
|
|
<span style="color:#7a7c7d"># Test valid permissions</span>
|
|
<span style="font-weight:bold"> r w a k l m l x ix ux Ux px Px cx Cx</span> ,
|
|
<span style="font-weight:bold"> pix Pix cix Cix pux Pux cux Cux pUx PUx cUx CUx</span>,
|
|
<span style="font-weight:bold"> rwklmx raklmx</span>,
|
|
<span style="font-weight:bold"> r rw rwk rwkl rwklm</span>,
|
|
<span style="font-weight:bold"> rwlmix rwlmUx rwlmPx rwlmcx rwlmPUx</span>,
|
|
<span style="font-weight:bold"> rwixixixkl rwUxUxUxkl rwuxuxuxk rwpxpxpxk rwPxPxkl rwcxcxlm rwCxCxk</span>,
|
|
<span style="font-weight:bold"> rwpixpixk rwPixPixkl wrpuxpuxk rwpUxpUxk rwcixcixcixml rwCixCixk rwCuxCuxk rwCUxCUxl</span>,
|
|
|
|
<span style="color:#7a7c7d"># Profile name</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">holas</span> <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> /path <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> holas/abc <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">holas</span><span style="color:#3daee9">\/</span><span style="color:#8e44ad">abc</span> <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span>
|
|
<span style="color:#8e44ad">#holas</span> <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">flags</span><span style="color:#8e44ad;text-decoration:underline">=</span><span style="color:#da4453;text-decoration:underline">(complain)#asd</span> <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">flags</span> <span style="color:#27ae60">flags</span><span style="color:#3f8058">=</span>(<span style="color:#da4453">complain</span>) <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#8e44ad;font-weight:bold">profile</span> <span style="color:#8e44ad">flag</span><span style="color:#8e44ad;text-decoration:underline">s</span><span style="color:#da4453;text-decoration:underline">(complain)</span> <span style="color:#3f8058">{</span> ... <span style="color:#3f8058">}</span>
|
|
<span style="color:#3f8058">}</span>
|
|
</pre></body></html>
|