I2P_Developers/i2p.i2p
3
1
Fork 11
Code Issues 340 Pull Requests 7 Actions 2 Packages Projects Releases Wiki Activity

updates to apparmor profiles

Browse Source 
- hardening (restrict access to proc to owner)
- removing files covered by abstractions
- indentation per apparmor profile style
This commit is contained in:
kytv
2015-04-14 01:00:10 +00:00
parent dd99978b19
commit 11c3230150
3 changed files with 58 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

88
debian/apparmor/i2p vendored
View File

@ -1,4 +1,4 @@
# Last Modified: Thu Jan 29 03:17:01 2015
# Last Modified: Sun Apr 12 22:08:32 2015
# vim:syntax=apparmor et ts=4 sw=4
#include <abstractions/base>
@ -10,54 +10,56 @@
network inet stream,
network inet6 stream,
# Needed for Java
@{PROC} r,
@{PROC}/[0-9]*/net/if_inet6 r,
@{PROC}/[0-9]*/net/ipv6_route r,
@{PROC}/[0-9]*/status r,
/dev/random r,
/dev/urandom r,
/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/** r,
# Needed by Java
owner @{PROC} r,
owner @{PROC}/[0-9]*/ r,
owner @{PROC}/[0-9]*/status r,
/dev/random r,
/dev/urandom r,
/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/** r,
/etc/ssl/certs/java/** r,
/etc/timezone r,
/usr/share/javazi/** r,
/etc/ssl/certs/java/** r,
/etc/timezone r,
/usr/share/javazi/** r,
/etc/java-*-openjdk/** r,
/usr/lib/jvm/default-java/jre/bin/java rix,
/usr/lib/jvm/java-*-openjdk-*/jre/bin/java rix,
/usr/lib/jvm/java-*-openjdk-*/jre/lib/i386/client/classes.jsa m,
/usr/lib/jvm/java-*-openjdk-*/jre/bin/keytool rix,
/etc/java-*-openjdk/** r,
/usr/lib/jvm/default-java/jre/bin/java rix,
/usr/lib/jvm/java-*-openjdk-*/jre/bin/java rix,
/usr/lib/jvm/java-*-openjdk-*/jre/bin/keytool rix,
# Oracle Java is needed on the Raspberry Pi and is included in Raspbian's repositories
/usr/lib/jvm/jdk-*-oracle-*/jre/bin/java rix,
/usr/lib/jvm/jdk-*-oracle-*/jre/bin/keytool rix,
# Oracle Java is needed on the Raspberry Pi and is included in Raspbian's repositories
/usr/lib/jvm/jdk-*-oracle-*/jre/bin/java rix,
/usr/lib/jvm/jdk-*-oracle-*/jre/bin/keytool rix,
# needed for I2P's graphs
/etc/fonts/** r,
/usr/share/java/java-atk-wrapper.jar r,
# */client/classes.jsa is only found (and needed) in 32-bit JVMs.
/usr/lib/jvm/java-*-openjdk-*/jre/lib/i386/client/classes.jsa m,
/usr/lib/jvm/java-*-oracle-*/jre/lib/i386/client/classes.jsa m,
# I2P specific
/etc/default/i2p r,
/usr/share/i2p/** r,
# Used by some plugins
/usr/share/java/eclipse-ecj-*.jar r,
# needed for I2P's graphs
/usr/share/java/java-atk-wrapper.jar r,
# Tanuki java wrapper
/etc/i2p/wrapper.config r,
/usr/sbin/wrapper rix,
/usr/share/java/wrapper*.jar r,
# I2P specific
/usr/share/i2p/** r,
/{,var/}tmp/ rwm,
owner /{,var/}tmp/** rwklm,
# Used by some plugins
/usr/share/java/eclipse-ecj-*.jar r,
# Prevent spamming the logs
deny /dev/tty rw,
deny @{PROC}/[0-9]*/fd/ r,
deny /usr/sbin/ r,
deny /var/cache/fontconfig/ wk,
# Tanuki java wrapper
/etc/i2p/wrapper.config r,
/usr/sbin/wrapper rix,
/usr/share/java/wrapper*.jar r,
# Used by some versions of the Tanuki wrapper, not needed by I2P
deny /usr/share/java/hamcrest*.jar r,
deny /usr/share/java/junit*.jar r,
# 'm' is needed by the I2P-Bote plugin
/{,var/}tmp/ rwm,
owner /{,var/}tmp/** rwklm,
# Prevent spamming the logs
deny /dev/tty rw,
deny @{PROC}/[0-9]*/fd/ r,
deny /usr/sbin/ r,
deny /var/cache/fontconfig/ wk,
# Used by some versions of the Tanuki wrapper, not needed by I2P
deny /usr/share/java/hamcrest*.jar r,
deny /usr/share/java/junit*.jar r,

8
debian/apparmor/usr.bin.i2prouter vendored
View File

@ -1,4 +1,4 @@
# Last Modified: Thu Jan 29 03:17:01 2015
# Last Modified: Sun Apr 12 22:08:32 2015
# vim:syntax=apparmor et ts=8 sw=4
#include <tunables/global>
@ -9,8 +9,10 @@
/usr/bin/i2prouter r,
@{PROC}/[0-9]*/stat r,
@{PROC}/[0-9]*/cmdline r,
@{PROC}/1/comm r,
owner @{PROC}/[0-9]*/ r,
owner @{PROC}/[0-9]*/stat r,
owner @{PROC}/[0-9]*/cmdline r,
@{PROC}/uptime r,
@{PROC}/sys/kernel/pid_max r,