Git-Mirrors/onionshare
1
0
Fork 0
mirror of https://github.com/onionshare/onionshare.git synced 2025-09-18 11:34:49 -04:00
Code Issues Projects Releases Packages Wiki Activity

Improve AppArmor profiles and enforce them.

Browse source 
Work from Tails Developers, main git repository, currently devel branch.
Upstream commits:

commit 6e7ad41ca9664246856fe9553c202f09a1d1066b
Remove superfluous AppArmor rule.
The pattern `[^.]*` matches a subset of `[^.]**`, so we only need to
keep the latter.

commit b3a827d8e3c3fee78ec18450dfaf38a3d4eaf270
Make onionshare-gui able to access folders beneath $HOME.
Without this change e.g. ~/Documents is inaccessible. To be honest,
this does not makes sense to me, as my interpretation of the old
patterns clearly should allow subfolders and files therein.

commit db2b3a3f73aa01a54c9b7cb5ab83da1d083b7169
WIP: AppArmor profile improvements.
This commit is contained in:
Ulrike Uhlig 2017-01-18 20:58:03 +01:00
parent ebdc92bfa7
commit 6cceac3b3e
3 changed files with 14 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor/abstractions/onionshare
View file

@ -1,5 +1,6 @@
#include <abstractions/base>
#include <abstractions/nameservice>
#include <abstractions/private-files-strict>
#include <abstractions/python>
# Why are these not in abstractions/python?
@ -16,16 +17,13 @@
/sbin/ldconfig rix,
/sbin/ldconfig.real rix,
/bin/uname rix,
/{,lib/live/mount/rootfs/filesystem.squashfs/}etc/mime.types r,
/{,lib/live/mount/rootfs/filesystem.squashfs/}usr/share/onionshare/ r,
/{,lib/live/mount/rootfs/filesystem.squashfs/}usr/share/onionshare/** r,
/etc/mime.types r,
/usr/share/onionshare/ r,
/usr/share/onionshare/** r,
/tmp/ rw,
/tmp/** rw,
# Allow all user data except .gnupg, .ssh and other potential
# places for critically sensitive application data.
audit deny @{HOME}/.* mrwkl,
audit deny @{HOME}/.*/ mrwkl,
audit deny @{HOME}/.*/** mrwkl,
owner @{HOME}/ r,
owner @{HOME}/** r,
# Allow read on almost anything in @{HOME}. Lenient, but
# private-files-strict is in effect.
owner @{HOME}/ r,
owner @{HOME}/[^.]** r,