Conversation
This commit contains fixes many profiles Rules in this commit were generated by running autopkgtest for all packages in Ubuntu Questing. Denials were converted to rules thanks to aa-logprof. Rules have been generalized manually, but due to the very high amount of rules, many rules still need to be improved: Known issues: - Some abstractions where added by aa-logprof, but in many cases they can be too permissive, and adding individual rules would be preferable - There was MANY rules to handle so I only took a small time converting and integrating these rules into profiles. All these rules need to be carefully reviewed This commit is only a preliminary result and the final goal is to integrate such a pipeling into regular package deployment pipelines so that regressions are quickly detected Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
|
The pipeline I used and the untreated results are available there Note: I made this pipeline run on a VM with However, I tried to integrate back changes for this repo in this commit |
|
Hi @emixam16, thanks a lot, that will be massively helpful. As you mentioned, abstraction added by aa-logprof are a bit too much (or out of scope). It is problematic as we need to understand why a rule is needed. Would you be able to send me the full raw logs? Also, autopkgtest tend to require special (test) paths, so they should be taken care separately. For this, I added the apparmor.d/apparmor.d/abstractions/apt Lines 38 to 39 in c9f1471 I am sure I am still missing a lot of these tests only rules (I have limited resources to run autopkgtest). I think it is important to properly and separately covert these rules, to not allow too much in the base profile, and to not miss required rules (because the test version would have given a full Side note for later:
I will continue reviewing the PR, and I some comments later. Thanks again for the work. |
| include <abstractions/libvirt-qemu> | ||
| include <abstractions/mapping/sshd> | ||
| include <abstractions/user-tmp> |
There was a problem hiding this comment.
They are not in the profile. Also, as we both know very well what apparmor_parser does, it is very unlikely these abstractions are needed.
| @{lib_dirs}/@{multiarch}/** mr, | ||
| @{lib_dirs}/snapd/apparmor.d/{,**} r, | ||
| @{lib_dirs}/snapd/apparmor/{,**} r, | ||
| /** r, # Can load rules from anywhere |
There was a problem hiding this comment.
I disagree on this. Giving access to apparmor_parser is an equivalent to giving mac_admin cap, therefore only allowing it to load profiles from "trusted" sources is a good thing.
However, it raises the question of development profile, I personally have:
@{user_projects_dirs}/** r,
In my local addition to this profile. But that does not apply to everyone and thus, it should be behind a condition.
|
The
Note:
Note: this only apply to apparmor 4.1+ so it required a bit of work in the prebuild part to not break older system. Only with this,
Finally, we end up with 3000 to 4000 lines with rules that are not tests related and that are really missing in the profiles. These must be added. This does not apply to the abstraction proposed by logprof as most of them are fully out of scope of the profiles. But abstaction such as the Thanks, again, for the work. This initial integration may take a bit of work, but I think quite quickly we will be able to integrate only the few new rules from canonical CI. |
| include <abstractions/nameservice-strict> | ||
| include <abstractions/python> | ||
| include <abstractions/ssl_certs> | ||
| include <abstractions/evince> |
There was a problem hiding this comment.
Pretty big abstraction. Is it really needed fully?
| @{bin}/touch rix, | ||
|
|
||
| @{bin}/adequate rPx, | ||
| @{tmp}/** mrix, |
There was a problem hiding this comment.
For apt specifically this was the output from the logs:
$ sudo aa_suggest.py -p apt
apt
[/tmp/apt-tmp-index.lo56aA d,] comm=apt-get operation=unlink
[/tmp/apt-tmp-index.yskOBL d,] comm=apt-get operation=unlink
[/tmp/autopkgtest.VN9DvN/build.ili/src/doc/examples/configure-index r,] comm=apt,apt-get operation=file_perm,open
[/tmp/autopkgtest.VN9DvN/build.ili/src/test/integration/varianttable r,] comm=apt-get operation=open
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=rzK1j3I1p6
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=ysaQZPZf49
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=B4S1FZlUKu
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=NPzTmTpVhm
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=2FOAhbcOtY
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=IHzZW5NQYQ
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=mx8oBIFbK9
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=sJoMLyBQ0U
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=3PlH1hoJPR
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=GJ2UkJ0jBq
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=BYFt0w5ua4
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=KGKBKxb7Pl
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=AM0MhFrWM9
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=Ve3Gan7ulr
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=QhaNnN9qkI
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm path_diffs=vGSvLWO13X
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=V7lWn3Yido
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=6pmLA4dPAR
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=5XXtEFCeMe
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=obt5D6h6ot
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=OG8ZrrJXam
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=sO0W9av6Tc
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=9A8bMaBMeC
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=cz8sBbPca6
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=EFBa6xl1C5
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=BVzkGgmygZ
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=40VPVnoPGe
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=cPSHg7hIeY
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=cUuPTWm18x
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=31OF1231WP
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=TzaxoxuhvU
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=22FlGfV5kE
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=5Cq3aTN8mE
[owner /tmp/tmp.??????????/aptconfig.conf r,] operation=file_perm,open path_diffs=gONVrKaHHe
[owner /tmp/tmp.??????????/aptconfig.conf r,] comm=apt-get operation=file_perm,open path_diffs=QbOdRWB1kS
[owner /tmp/tmp.??????????/downloaded/pkg-sha256-bad_1.0.tar.gz{,.??????} rwd,] comm=apt-get operation=chmod,rename_src path_diffs=5Cq3aTN8mE
[owner /tmp/tmp.??????????/downloaded/pkg-sha256-bad_1.0.tar.gz{,.??????} wc,] comm=apt-get operation=rename_dest path_diffs=5Cq3aTN8mE,.FAILED
[owner /tmp/tmp.??????????/downloaded/testpkg_1_all.deb w,] operation=chmod path_diffs=sO0W9av6Tc
[owner /tmp/tmp.??????????/rootdir/etc/apt/apt.conf.d/ r,] comm=apt-get operation=file_perm,open path_diffs=vGSvLWO13X
[owner /tmp/tmp.??????????/rootdir/etc/apt/apt.conf.d/01multiarch.conf r,] comm=apt-get operation=file_perm,open path_diffs=vGSvLWO13X
[owner /tmp/tmp.??????????/rootdir/etc/apt/preferences.d/ r,] comm=apt-get operation=file_perm,open path_diffs=Ad9STY1m3x
[owner /tmp/tmp.??????????/rootdir/etc/apt/sources.list.d/ r,] comm=apt-get operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/rootdir/etc/apt/sources.list.d/apt-test-sid-deb-src.list r,] comm=apt-get operation=file_perm path_diffs=SyjBJeOa84
[owner /tmp/tmp.??????????/rootdir/etc/apt/sources.list.d/apt-test-sid-deb.list r,] comm=apt-get operation=file_perm,open path_diffs=SyjBJeOa84
[owner /tmp/tmp.??????????/rootdir/etc/apt/sources.list.d/apt-test-unstable-deb-src.list r,] comm=apt-get operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/ r,] comm=apt-get operation=file_perm,open path_diffs=iKWDUaFLzR
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/pkgcache.bin d,] comm=apt-get operation=unlink path_diffs=WwWcU6VvdB
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/pkgcache.bin wc,] comm=apt-get operation=rename_dest path_diffs=DB202rnH4O
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/pkgcache.bin d,] comm=apt-get operation=unlink path_diffs=iKWDUaFLzR
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/pkgcache.bin.nZvd3N rwdc,] comm=apt-get operation=chmod,file_perm,mknod,open,rename_src path_diffs=DB202rnH4O
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/srcpkgcache.bin wc,] operation=rename_dest path_diffs=gfKZm9rfvB
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/srcpkgcache.bin wc,] comm=apt-get operation=rename_dest path_diffs=DB202rnH4O
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/srcpkgcache.bin d,] comm=apt-get operation=unlink path_diffs=iKWDUaFLzR
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/srcpkgcache.bin.BmJd7m rwc,] comm=apt-get operation=mknod,open path_diffs=iKWDUaFLzR
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/srcpkgcache.bin.D0jnw8 rwd,] comm=apt-get operation=rename_src path_diffs=DB202rnH4O
[owner /tmp/tmp.??????????/rootdir/var/cache/apt/srcpkgcache.bin.TNUqMg rwdc,] operation=chmod,file_perm,mknod,open,rename_src path_diffs=gfKZm9rfvB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/extended_states r,] comm=apt-get operation=file_perm,open path_diffs=bIJpTkCkgg
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/extended_states r,] comm=apt-get operation=file_perm,open path_diffs=LOv1yM3Sop
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/extended_states r,] comm=apt-get operation=file_perm,open path_diffs=7PKN50Mq9J
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/extended_states.IHWu2k rwdc,] comm=apt-get operation=chmod,mknod,open,rename_src path_diffs=bIJpTkCkgg
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/extended_states.JfOKQQ rwdc,] comm=apt-get operation=chmod,mknod,open,rename_src path_diffs=7PKN50Mq9J
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/extended_states.NXENyG rwdc,] comm=apt-get operation=chmod,mknod,open,rename_src path_diffs=LOv1yM3Sop
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/ r,] comm=apt-get operation=file_perm,open path_diffs=WwWcU6VvdB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/ r,] comm=apt-get operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.6Wg2fWaQ3a_aptarchive_dists_stable_main_binary-amd64_Packages r,] comm=apt-get operation=file_perm,open path_diffs=6Wg2fWaQ3a
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.6Wg2fWaQ3a_aptarchive_dists_stable_main_binary-armel_Packages r,] comm=apt-get operation=file_perm,open path_diffs=6Wg2fWaQ3a
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.6Wg2fWaQ3a_aptarchive_dists_stable_main_i18n_Translation-en r,] comm=apt-get operation=file_perm,open path_diffs=6Wg2fWaQ3a
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.Ad9STY1m3x_aptarchive_dists_unstable_main_binary-all_Packages r,] comm=apt-get operation=file_perm,open path_diffs=Ad9STY1m3x
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.Ad9STY1m3x_aptarchive_dists_unstable_main_binary-i386_Packages r,] comm=apt-get operation=open path_diffs=Ad9STY1m3x
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.Ad9STY1m3x_aptarchive_dists_unstable_main_i18n_Translation-en r,] comm=apt-get operation=file_perm,open path_diffs=Ad9STY1m3x
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.SyjBJeOa84_aptarchive_dists_sid_InRelease r,] comm=apt-get operation=file_perm,open path_diffs=SyjBJeOa84
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.Vk1iXKwluF_aptarchive_dists_unstable_main_binary-amd64_Packages r,] comm=apt-get operation=file_perm path_diffs=Vk1iXKwluF
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/_tmp_tmp.uhtKlAokzv_aptarchive_dists_unstable_main_binary-all_Packages r,] comm=apt-get operation=file_perm path_diffs=uhtKlAokzv
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/localhost:39625_dists_unstable_InRelease r,] comm=apt-get operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/localhost:39625_dists_unstable_main_binary-i386_Packages.lz4 r,] comm=apt-get operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/localhost:39625_dists_unstable_main_i18n_Translation-en.lz4 r,] comm=apt-get operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/localhost:39817_Packages wc,] comm=apt-get operation=rename_dest path_diffs=WwWcU6VvdB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/localhost:40289_InRelease r,] comm=apt-get operation=file_perm,open path_diffs=31OF1231WP
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/localhost:45695_InRelease r,] operation=open path_diffs=s2RZwUm7AB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/localhost:46143_dists_unstable_Release rw,] comm=apt-get operation=chmod,file_perm,open path_diffs=I9NKPISzGc
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/ r,] comm=apt-get operation=file_perm,open path_diffs=WwWcU6VvdB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:39119_dists_unstable_main_source_Sources.gz w,] comm=apt-get operation=chmod path_diffs=vGSvLWO13X
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:39625_dists_unstable_main_binary-i386_Packages.lz4 w,] comm=apt-get operation=chmod path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:39817_Packages rwd,] comm=apt-get operation=rename_src path_diffs=WwWcU6VvdB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:39817_Packages.zst d,] comm=apt-get operation=unlink path_diffs=WwWcU6VvdB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:40289_InRelease rw,] comm=apt-get operation=chmod,file_perm,open path_diffs=31OF1231WP
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:40289_Packages w,] comm=apt-get operation=chmod path_diffs=31OF1231WP
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:40289_Packages.gz w,] comm=apt-get operation=chmod path_diffs=31OF1231WP
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:40289_Release w,] comm=apt-get operation=chmod path_diffs=31OF1231WP
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:40289_Release.gpg w,] comm=apt-get operation=chmod path_diffs=31OF1231WP
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:40567_dists_unstable_main_binary-i386_Packages.gz w,] comm=apt-get operation=chmod path_diffs=KEsQhf2C17
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:42671_redirectme_dists_unstable_main_source_Sources.gz w,] comm=apt-get operation=chmod path_diffs=AoRs61TRnj
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:43177_dists_unstable_main_source_Sources.gz w,] operation=chmod path_diffs=REdljKd1HV
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:43799_dists_unstable_main_source_Sources.xz w,] comm=apt-get operation=chmod path_diffs=a2vY79KqoM
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:44805_dists_unstable_main_binary-amd64_Packages.gz w,] comm=apt-get operation=chmod path_diffs=3PlH1hoJPR
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:44805_dists_unstable_main_source_Sources.gz w,] comm=apt-get operation=chmod path_diffs=3PlH1hoJPR
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:45695_InRelease rw,] operation=chmod,file_perm,open path_diffs=s2RZwUm7AB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:45695_Packages w,] operation=chmod path_diffs=s2RZwUm7AB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:45695_Packages.gz w,] operation=chmod path_diffs=s2RZwUm7AB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:45695_redirectme_Packages.diff_2025-10-06-1201.08.lz4 rwd,] operation=chmod,rename_src path_diffs=s2RZwUm7AB
[owner /tmp/tmp.??????????/rootdir/var/lib/apt/lists/partial/localhost:45695_redirectme_Packages.lz4.ed wc,] operation=rename_dest path_diffs=s2RZwUm7AB
[owner /tmp/tmp.??????????/rootdir/var/lib/dpkg/lock-frontend rwck,] comm=apt-get operation=file_lock,open path_diffs=SyjBJeOa84
[owner /tmp/tmp.??????????/rootdir/var/lib/dpkg/status r,] operation=file_perm,open path_diffs=gfKZm9rfvB
[owner /tmp/tmp.??????????/rootdir/var/lib/dpkg/status r,] comm=apt-get operation=file_perm,open path_diffs=6Wg2fWaQ3a
[owner /tmp/tmp.??????????/rootdir/var/lib/dpkg/status r,] comm=apt-get operation=file_perm,open path_diffs=Ad9STY1m3x
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=TpwVmc1HAq
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=bIJpTkCkgg
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=TLUUe66HLs
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=ysaQZPZf49
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=LOv1yM3Sop
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=B4S1FZlUKu
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=2FOAhbcOtY
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=7PKN50Mq9J
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] operation=file_perm path_diffs=obt5D6h6ot
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] operation=file_perm path_diffs=L6loPI7Vq7
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=9A8bMaBMeC
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=pUMDc4Vhsl
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=BVzkGgmygZ
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=cPSHg7hIeY
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz dc,] operation=mknod,unlink path_diffs=R0LxScDFLi
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=05PryLWk0O
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] comm=apt-get operation=file_perm path_diffs=22FlGfV5kE
[owner /tmp/tmp.??????????/rootdir/var/log/apt/eipp.log.xz w,] operation=file_perm path_diffs=gONVrKaHHe
[owner /tmp/tmp.??????????/rootdir/var/log/apt/history.log wc,] comm=apt-get operation=chmod,file_perm,open path_diffs=pUMDc4Vhsl
[owner /tmp/tmp.??????????/rootdir/var/log/apt/term.log wc,] comm=apt-get operation=chmod,file_perm,open path_diffs=pUMDc4Vhsl
[/usr/share/dpkg/varianttable r,] comm=apt,apt-get operation=file_perm,open
[/{,usr/}bin/gnufalse mrx,] comm=apt-get,false operation=exec,file_mmap path_diffs=usr/
[@{run}/systemd/inhibit/*.ref w,] comm=apt-get operation=file_receive path_diffs=/run,1
[@{run}/systemd/inhibit/*.ref w,] operation=file_receive path_diffs=/run,4
[@{run}/systemd/inhibit/*.ref w,] operation=file_receive path_diffs=/run,5
[@{run}/systemd/inhibit/*.ref w,] operation=file_receive path_diffs=/run,6
apt//dpkg-source
[/etc/dpkg/origins/ubuntu r,] comm=dpkg-source operation=file_perm,open
[owner /tmp/tmp.??????????/downloaded/testpkg-1.0/ c,] comm=dpkg-source operation=mkdir path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/downloaded/testpkg_1.0.tar.xz.tmp-extract.KkfJi/ wc,] comm=dpkg-source operation=chmod,mkdir path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/downloaded/testpkg_1.0.tar.xz.tmp-extract.WxhyX/ wc,] comm=dpkg-source operation=chmod,mkdir path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/downloaded/testpkg_1.0.tar.xz.tmp-extract.WxhyX/testpkg-1.0/ c,] comm=tar operation=mkdir path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/downloaded/testpkg_1.0.tar.xz.tmp-extract.ZvEuf/ wc,] comm=dpkg-source operation=chmod,mkdir path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/downloaded/testpkg_1.0.tar.xz.tmp-extract.xqjxS/ wc,] comm=dpkg-source operation=chmod,mkdir path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/downloaded/testpkg_1.0.tar.xz.tmp-extract.xqjxS/testpkg-1.0/ c,] comm=tar operation=mkdir path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/incoming/testpkg_1.0.dsc r,] comm=dpkg-source operation=file_perm,open path_diffs=2ppKcyfN8h
[owner /tmp/tmp.??????????/incoming/testpkg_1.0.tar.xz r,] comm=dpkg-source,unxz operation=file_perm,open path_diffs=2ppKcyfN8h
[/{,usr/}bin/gnurm mr,] comm=rm operation=file_mmap path_diffs=usr/
apt//dpkg-source▶gnurm
[/{,usr/}bin/gnurm r,] comm=rm operation=file_mmap path_diffs=usr/
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶dpkg
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶dpkg▶dpkg-deb
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶dpkg▶dpkg-deb▶tar
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶dpkg▶gnurm
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶faked-sysv
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶getopt
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶gnucut
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.gplsTTiNxT/rootdir/usr/bin/dpkg▶fakeroot-sysv▶sed
[owner /dev/pts/[0-9]* rw,] comm=dpkg-split operation=file_inherit path_diffs=1
apt▶/tmp/tmp.hgHUqtmpae/rootdir/usr/bin/dpkg▶fakeroot-sysv
[/{,usr/}bin/faked-sysv rx,] comm=fakeroot operation=exec path_diffs=usr/
[UNKNOWN_RULE] comm=sed name=/usr/bin/sed operation=file_mprotect requested_mask=r
[UNKNOWN_RULE] comm=sed name=/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 operation=file_mprotect requested_mask=r
apt▶/tmp/tmp.j8H6lrlEb2/pre-install-pkgs-v3.sh
[owner /tmp/tmp.??????????/pre-install-pkgs-v3.list a,] comm=grep operation=file_inherit path_diffs=j8H6lrlEb2
[/{,usr/}bin/{,e,f}grep mrix,] comm=grep,grep,pre-install-pkg operation=exec,file_mmap path_diffs=usr/
apt▶/tmp/tmp.j8H6lrlEb2/rootdir/usr/bin/dpkg▶fakeroot-sysv
[/{,usr/}bin/gnucut r,] comm=fakeroot operation=getattr path_diffs=usr/
[UNKNOWN_RULE] comm=cut name=/usr/bin/gnucut operation=file_mprotect requested_mask=r
[UNKNOWN_RULE] comm=cut name=/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 operation=file_mprotect requested_mask=r
apt▶/tmp/tmp.j8H6lrlEb2/rootdir/usr/bin/dpkg▶fakeroot-sysv▶gnucut
[UNKNOWN_RULE] comm=cut name=/usr/lib/x86_64-linux-gnu/libc.so.6 operation=file_mprotect requested_mask=r
apt▶gnufalse
[/{,usr/}bin/gnufalse r,] comm=false operation=file_mmap path_diffs=usr/
This distro is not supported. Watch out for inconsistencies.
Based on them, it would translate to rules like:
owner /tmp/tmp.*/aptconfig.conf r,
owner /tmp/tmp.*/rootdir/etc/apt/apt.conf.d/ r,
owner /tmp/tmp.*/rootdir/etc/apt/apt.conf.d/* r,
owner /tmp/tmp.*/rootdir/etc/apt/preferences.d/ r,
owner /tmp/tmp.*/rootdir/etc/apt/sources.list.d/ r,
owner /tmp/tmp.*/rootdir/etc/apt/sources.list.d/* r,
owner /tmp/tmp.*/rootdir/var/cache/apt/ r,
owner /tmp/tmp.*/rootdir/var/cache/apt/* rwdc,
owner /tmp/tmp.*/rootdir/var/lib/apt/extended_states r,
owner /tmp/tmp.*/rootdir/var/lib/apt/extended_states.* rwdc,
owner /tmp/tmp.*/rootdir/var/lib/apt/lists/ r,
owner /tmp/tmp.*/rootdir/var/lib/apt/lists/* r,
owner /tmp/tmp.*/rootdir/var/lib/apt/lists/partial/ r,
owner /tmp/tmp.*/rootdir/var/lib/apt/lists/partial/* rwdc,
owner /tmp/tmp.*/rootdir/var/lib/dpkg/lock-frontend rwck,
owner /tmp/tmp.*/rootdir/var/lib/dpkg/status r,
owner /tmp/tmp.*/rootdir/var/log/apt/* rwdc,
owner /tmp/tmp.*/downloaded/* rwc,
owner /tmp/tmp.*/incoming/* r,
owner /tmp/tmp.*/pre-install-pkgs-v3.list a,
owner /tmp/apt-tmp-index.* d,
But I don't think these directories are created by apt during regular execution. I think these are temporary directories created for testing. I investigated the apt testing source code a bit and it also indicates towards that:
getaptconfig() {
if [ -f ./aptconfig.conf ]; then
echo "$(readlink -f ./aptconfig.conf)"
elif [ -f ../aptconfig.conf ]; then
echo "$(readlink -f ../aptconfig.conf)"
elif [ -f ../../aptconfig.conf ]; then
echo "$(readlink -f ../../aptconfig.conf)"
elif [ -f "${TMPWORKINGDIRECTORY}/aptconfig.conf" ]; then
echo "$(readlink -f "${TMPWORKINGDIRECTORY}/aptconfig.conf")"
fi
}So, I don't think it requires this permission.
There was a problem hiding this comment.
I didn't find any m or x requested operations for the /tmp directory in the logs. So I don't think that's required.
There was a problem hiding this comment.
Thanks for the evaluation, and testing.
I wonder, is it possible to substitute /tmp with /run/user/$uid as temporary directory in tests? /tmp is really outdated by modern security standards.
BTW, you should use:
sudo aa_suggest.py -S AppArmor.d -c -p apt
-S AppArmor.d for proper tunables for this project (non-exhaustive) and -c for actually usable permissions (not what kernel reports)
| @{bin}/gnufalse mrix, | ||
| @{bin}/gnutrue mrix, | ||
|
|
||
| @{tmp}/tmp.*/rootdir/usr/bin/dpkg mrix, |
There was a problem hiding this comment.
Executable /tmp... Any user could write into this path.
There was a problem hiding this comment.
tmp.*/rootdir/usr/bin/dpkg mrix, I'm inclined to believe this is something apt does for testing and not related to how this application functions outside of that.
https://codesearch.debian.net/search?q=getaptconfig+package%3A%5CQapt%5CE&literal=1
https://codesearch.debian.net/search?q=APT_CONFIG+package%3A%5CQapt%5CE&literal=1
|
|
||
| owner @{tmp}/*.template.* rw, | ||
| owner @{tmp}/*.config.* rwPUx, | ||
| owner @{tmp}/** mr, |
There was a problem hiding this comment.
Memory mapping without execution. Is it a failed dpkg-preconfigure run or just notice?
|
|
||
| @{exec_path} mr, | ||
|
|
||
| owner @{etc_ro}/nsswitch.conf r, |
There was a problem hiding this comment.
owner is redundant for this path.
| owner @{gdm_share_dirs}/gvfs-metadata/{,*} rw, | ||
|
|
||
| owner @{HOME}/.local/ w, | ||
| owner @{HOME}/** rw, |
There was a problem hiding this comment.
Combined with network access this could lead to big surprise.
| @{sbin}/ethtool mrix, | ||
|
|
||
| /usr/share/netplan/{,**} r, | ||
| /usr/share/netplan/{,**} rw, |
There was a problem hiding this comment.
Absence of write access here is a failure? Preferably, /usr/share should be touched by package manager only.
| @{lib}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx, | ||
|
|
||
| /etc/openvpn/{,**} r, | ||
| owner @{etc_rw}/openvpn/{,**} rw, |
There was a problem hiding this comment.
This is what MAC protects against: changing of configuration by potentially compromised application.
| @{exec_path} mr, | ||
|
|
||
| @{run}/systemd/sessions/@{int} r, | ||
| @{run}/systemd/sessions/c@{int} r, |
There was a problem hiding this comment.
| @{run}/systemd/sessions/c@{int} r, | |
| @{run}/systemd/sessions/{,@{l}}@{int} r, |
|
|
||
| @{run}/systemd/default-hostname rw, | ||
| @{run}/udev/data/+dmi:* r, # for motherboard info | ||
| @{run}/udev/data/b*:* r, |
| @{bin}/sort mrix, | ||
|
|
||
|
|
||
| owner @{lib}/locale/** mrwlw, |
| /etc/X11/xorg.conf.d/ rw, | ||
| /etc/X11/xorg.conf.d/.#*.conf@{hex} rw, | ||
| /etc/X11/xorg.conf.d/*.conf rw, | ||
| owner @{etc_ro}/ r, |
| @{PROC}/@{pids}/fd/ r, | ||
| @{PROC}/*/[gu]id_map r, | ||
| @{PROC}/*/attr/current r, | ||
| @{PROC}/*/cmdline r, |
|
|
||
| /var/lib/locales/supported.d/{,**} r, | ||
|
|
||
| owner @{etc_ro}/** rw, |
| @{sys}/devices/virtual/block/loop@{int}/{,**} r, | ||
| owner @{sys}/devices/** r, | ||
|
|
||
| owner /var/snap/lxd/common/lxd/disks/docker-storage.img rw, |
|
|
||
| # It wants to ldd all binaries/libs in packages. | ||
| @{bin}/ldd rCx -> ldd, | ||
| owner @{bin}/adequate-** r, |
| @{bin}/gzip mrix, | ||
| @{bin}/ip mrpx, | ||
| @{bin}/python[23].* mrix, | ||
| @{sbin}/ldconfig.real mrix, |
There was a problem hiding this comment.
| @{sbin}/ldconfig.real mrix, | |
| @{sbin}/ldconfig{,.real} mrix, |
|
|
||
| owner @{run}/user/@{uid}/gnupg/*/* rw, | ||
| owner @{run}/user/@{uid}/gnupg/S.gpg-agent rw, | ||
| owner @{run}/user/*/gnupg/*/* rw, |
There was a problem hiding this comment.
These three lines look very similar.
| umount @{run}/netns/*, | ||
| umount @{sys}, | ||
|
|
||
| @{tmp}/** mrix, |
There was a problem hiding this comment.
Completely unpredictable paths for such a mundane tools as ip?
|
|
||
| /usr/share/ruby-addressable/unicode.data r, | ||
|
|
||
| owner @{PROC}/*/task/@{int}/comm rw, |
There was a problem hiding this comment.
| owner @{PROC}/*/task/@{int}/comm rw, | |
| owner @{PROC}/@{pid}/task/@{tid}/comm rw, |
| include <abstractions/fonts> | ||
| include <abstractions/evince> | ||
| include <abstractions/nameservice-strict> | ||
| include <abstractions/evince> |
| @{bin}/gnustat mrix, | ||
| @{bin}/gnutr mrix, | ||
| @{bin}/gnuuniq mrix, | ||
| @{lib}/x86_64-linux-gnu/ld-linux-*.so.* mrix, |
There was a problem hiding this comment.
| @{lib}/x86_64-linux-gnu/ld-linux-*.so.* mrix, | |
| @{lib}/@{multiarch}/ld{,32,64}-*.so.* mrix, |
| @{lib}/dracut/dracut-install rix, | ||
| @{sbin}/blkid rPx, | ||
|
|
||
| @{tmp}/** mrix, |
There was a problem hiding this comment.
Payload straight into initramfs.
|
|
||
| @{tmp}/** mrix, | ||
| @{bin}/3cpio mrix, | ||
| @{bin}/dash ix, |
There was a problem hiding this comment.
| @{bin}/dash ix, | |
| @{sh_path} rix, |
| deny @{PROC}/sys/kernel/random/boot_id r, | ||
|
|
||
| @{lib}/ r, | ||
| /usr/lib64/ r, |
There was a problem hiding this comment.
Does it fail without these rules? It's probably a regular exploration by some library, which is not necessarily needed for mumble to function.
|
|
||
| /tmp/@{word10}/ rw, | ||
| /tmp/** r, | ||
| owner /tmp/** mr, |
|
|
||
| owner @{PROC}/*/fd/ r, | ||
|
|
||
| owner @{run}/user/*/gnupg/*/** rw, |
There was a problem hiding this comment.
| owner @{run}/user/*/gnupg/*/** rw, | |
| owner @{run}/user/@{uid}/gnupg/*/** rw, |
|
|
||
| @{exec_path} mr, | ||
|
|
||
| owner /** r, |
There was a problem hiding this comment.
Wow. Should be user-defined tunable.
| owner @{etc_ro}/group r, | ||
| owner @{etc_ro}/nsswitch.conf r, |
There was a problem hiding this comment.
include <abstractions/nameservice-strict>
|
This is an interesting and necessary approach. However, each rule necessity should be carefully considered - fully automated security does not work. As Alex already said, we should know why it's needed, at least approximately. If we don't operate tech precisely it would be magic.
In addition to |
You are welcome !
I did not save the full logs, therefore, I will not be able to send them for this run of the pipeline. However, given the amount of denials that can be generated, at least for the first runs of this pipeline, I think that relying on logs whould be extremely tedious. Generated non-merged rules/profiles are probably a better middlepoint in most cases. IMO, there is 3 kind of abstractions:
If you agree, my plan is as follows
At the end of the road we very often have to make a tradeoff between usability and security. This especially applies to programs that may technically access the whole system (or a subset of it). In some cases we may be able to restrict the allowed access to a minimum without too much risk of regression, but there is many cases where the line is thinner. I applause the fact apparmor.d wants to keep the security as high as possible and I reckon this repo does a great job at it, but when shipping this package to distribution as we tried in Ubuntu Questing this gets more problematic.
Now I'm not advocating for changing the security/usability tradeoff of this repository just to accommodate distributions, but I think there should be a discussion about this tradeoff with upstream, as upstream uses a different one from this repositiory. Typically, when a binary can access all files in the system but there is a (set of) standard path(s), this repository will probably only allow this(these) path(s) when upstream may allow all possible access and restrict only sensitive access with I think that using two (or more) security levels for profiles, one that reduces the usage of a software to only "standard" cases to reduce the attack surface, and one that allows non-typical but possible usage of a software (e.g using a custom configuration file from a non standard path) would be the best way to keep the level of security of repository, while allowing smooth integration in distributions and therefore massively increase its usage. Now obviously, I know that this suggestion requires a fair amount of work, and I'm not asking this repository to do anything right now, I'm just braindumping ideas that could make this transition easier. I think the most robust way to implement this in practice would be to have sets of abstractions for these two modes and/or rely on variables to know which one to use. Alternatively, although less flexible, your annotation system could be used at build-time to select a security level. If you don't want to implement this within this repository, at least documenting when program could access more resources than currently allowed with comments within the profile, would significantly help distributions, or end-users to adapt profiles to their needs. I know the scope of this PR is big and there is things to do in all directions, but I argue that it could be a good moment to look for these security mode as when some non-standard directories are seen in tests, this is generally evidence that the program could potentially access more (and sometimes way more) than what is currently allowed.
I fully agree with you. I think that automatic tools, like this one, can be useful to detect potential missing permissions, but after that, it is crucial that to manually review in depth every single changes for the reasons you mentioned. |
| @{bin}/gnucat mrix, | ||
| @{bin}/gnudd mrix, | ||
| @{bin}/gnudf mrix, | ||
| @{bin}/gnuecho mrix, | ||
| @{bin}/gnufalse mrix, | ||
| @{bin}/gnuhead mrix, | ||
| @{bin}/gnuid mrix, | ||
| @{bin}/gnutest mrix, |
There was a problem hiding this comment.
Not sure where all of these are coming from, but gnufalse is being used for just testing:
$ grep -r "gnufalse\|/bin/false" .
./test/integration/framework: echo 'Dir::Bin::ischroot "/bin/false";' >> aptconfig.conf
I think others might be used for the same. But needs verification for every statement.
There was a problem hiding this comment.
This part is a bit problematic; giving access to files like the following only in test mode is fine.
apparmor.d/apparmor.d/abstractions/apt
Lines 38 to 39 in c9f1471
Having to handle ix rule of normal binary means that the test script need to be fully profiled too.
There was a problem hiding this comment.
dd seems to be used in a script:
$ grep -r "dd if"
debian/apt.apt-compat.cron.daily: RANDOM=$(( $(dd if=/dev/urandom bs=2 count=1 2> /dev/null | cksum | cut -d' ' -f1) % 32767 ))
test/integration/test-apt-update-expected-size: dd if=/dev/zero of=aptarchive/dists/unstable/InRelease bs=1M count=2 2>/dev/null
test/integration/test-acquire-same-file-multiple-times: dd if="$TESTFILE" of=./downloaded/foo1 bs=500 count=1 2>/dev/null
test/integration/test-acquire-same-file-multiple-times: dd if="$TESTFILE" of=./downloaded/foo2 bs=500 count=1 2>/dev/null
test/integration/test-acquire-same-file-multiple-times: dd if="$TESTFILE" of=./downloaded/foo1 bs=500 count=1 2>/dev/null
test/integration/test-acquire-same-file-multiple-times: dd if="$TESTFILE" of=./downloaded/foo2 bs=500 count=1 2>/dev/null
test/integration/test-partial-file-support: dd if="$1" bs=1 count="$2" of="$3" 2>/dev/null
test/integration/test-bug-lp1445239-download-loop:dd if=/dev/zero of=$TESTFILE bs=100k count=1 2>/dev/null
test/integration/test-bug-lp1445239-download-loop:dd if=/dev/zero of=$TARGET bs=99k count=1 2>/dev/null
test/integration/framework: testsuccess dd if=/dev/zero of="${1}" bs="$(stat -c %s "${1}.bak")" count=1
test/integration/skip-apt-download-progress:testsuccess dd if=/dev/zero of=./aptarchive/$TESTFILE bs=1600k count=1
debian/apt.apt-compat.cron.daily: RANDOM=$(( $(dd if=/dev/urandom bs=2 count=1 2> /dev/null | cksum | cut -d' ' -f1) % 32767 ))
There was a problem hiding this comment.
debian/apt.apt-compat.cron.daily is covered with https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/groups/cron/cron-apt-compat
The use of dd in test/integration/ will be more problematic to handle.
I am not planning to handle the logs manually (although some patterns are easy to spot). I have Also, I am not expecting to fix all issues within this first PR, and with only one run of the test suite. This need to be done step by step: first focusing on test only rules, then after, when they are fewer logs, looking at the other rules.
The plan looks good. As you said, I think you need to fully re-run the full autopkgtest pipeline, especially as some of the issues should now be fixed. Thanks to the test script you provided, I was able to run some part of it myself, in order to check the among of rule that are needed. The result is in #893. I think it should handle most of the test only rules. Including the rules raised by @Vyom-Yadav However, please wait for #893 to be merged (as I am currently busy holidaying, not before next week) before running it again. It also supports new gnu/rust utils path, so it is a must have on Ubuntu 25.10. Also, ensure you build the profiles with
In general, the consoles abstraction is safe to keep. Most capabilities should be legitimate. However, sorry, but all other abstraction seems too wide or simply out of scope ( Things like There are also case, with some recommended way to handle things. For example:
If you have any doubt, do not hesitate to share the full logs with me.
I agree; we do not need to fix all issue in one PR; you can create as many PR as you want, they will be easier to review.
I may be used to this thing more, or I am still lacking the full picture; however with the initial test integration, I do not see that many logs. I did not run the full test suite yet, but, it seems to me that tests specific path are at the origin of 75% of the logs.
Currently, 90% of the issues on Ubuntu are dbus related:
I sincerely hope that the other 10% will be fixed by the integration of autopkgtest test suite. Note 1: As I use Note 2: Looking back at the last two weeks of this project, we also have sustainability issues. In two weeks:
Nothing major, however without serious support and maintenance work from companies (read money), this project will die.
Yes, I fully agree (out of scope of this PR). My plan is to integrate multiple level of security implementation with the support of apparmor condition. I still need to define the levels (possibly a lot) and they should also integrate into thing that would be the apparmor equivalent of the hundred of selinux booleans. We can define them in a separate discussion. Meanwhile, the most paranoid version of the rules should still pass the test suite. Thus, it does not fully apply here. However, while this project is still not stable; it could be interesting to provide a "prod ready" deployment that explicitly relax everything that is known to cause issues (such as dbus). But again the base system has to be the most paranoid one for development reason. |
Sure, I'll wait for that, no issues :)
Sure, I'll split it up in the next run to make the review easier.
I'll save AppArmor logs in the next pipeline run. There might be some valuable insight there.
It is indeed hard to maintain such a huge project, given how fast the Open Source environment evolves. Canonical will increase its effort to support apparmor.d. As we aim to support apparmor.d in Ubuntu 26.04 LTS, we will try to have members of the broader security team to review some profiles in this repository. Additionally, in the longer term: if we manage to enable such a pipeline into packaging CI in a distro-agnostic way, it could save time and automatically detect most regressions. I think that would simplify profiles' maintenance. I will work in this direction. |
- add some tests only paths - add missing rules raised by tests preliminary work before #888 get merged. We aim to get an idea of the rules missing and raised by the tests. Despite autopkgtest tests raising thousands of logs, most of them are tests specific and we seems to be quite good in term of missing rules.
- add some tests only paths - add missing rules raised by tests preliminary work before #888 get merged. We aim to get an idea of the rules missing and raised by the tests. Despite autopkgtest tests raising thousands of logs, most of them are tests specific and we seems to be quite good in term of missing rules.
|
#893 is now merged, fell free to run the test again. Thanks to the script you shared, I was able to almost run the full test suite, so most of the test integration should be already in place now. See https://github.com/roddhjav/apparmor.d/tree/main/tests/autopkgtest. The full integration is detailed under https://apparmor.pujol.io/development/autopkgtest/. I suppose you will use canonical VM and not the ones in this project to run them. So here are some points:
They are still a bit of work and tests to be made, but we don't have that many logs any more, and the result kind of looks good to me to be honest. |
4 participants
This commit contains fixes for many profiles
Rules in this commit were generated by running autopkgtest for all packages in Ubuntu Questing. Denials were converted to rules thanks to aa-logprof.
Rules have been generalized manually, but due to the very high amount of rules, many rules still need to be improved:
Known issues:
This commit is only a preliminary result and my goal is to integrate such a pipeline into regular package deployment pipelines so that regressions are quickly spotted.
All reviews and remarks are welcome.