AppArmor Profiles

The system comes with two AppArmor profiles, one for strict mode and one for relaxed mode. The strict profile is used by default, and the relaxed profile can be used by applications that require additional permissions. The following profiles are included with the system.

Strict

#include <tunables/global>

profile weos-app-apparmor-strict flags=(attach_disconnected,mediate_deleted) {
  signal (send,receive) peer=weos-app-apparmor-strict,

network inet stream,
network inet dgram,
network inet6 stream,
network inet6 dgram,
network unix stream,
network unix dgram,

audit deny network raw,
audit deny network packet,
audit deny network alg,

capability chown,
capability dac_override,
capability kill,
capability setgid,
capability setuid,
capability net_bind_service,

/ r,
/** r,

/{usr/,}{bin,sbin}/** ix,
/lib/** ix,
/lib64/** ix,
/opt/**/bin/** ix,

/tmp/** rwl,
/var/tmp/** rwl,
/run/** rwkl,
/dev/shm/** rwl,
/app/data/** rwl,
/opt/app/data/** rwl,
/dev/null rw,
audit deny /dev/zero w,
/dev/zero r,
/dev/urandom r,
/dev/random r,
/dev/full rw,
/dev/tty rw,
/dev/pts/** rw,
/mnt/** rw,
/root/** rw,

audit deny /tmp/** x,
audit deny /var/tmp/** x,
audit deny /run/** x,
audit deny /dev/shm/** x,
audit deny /app/data/** x,
audit deny /opt/app/data/** x,

signal (receive) peer=unconfined,
signal (receive) set=(term,int,hup,chld) peer=runc,
signal (receive) set=(term,int,hup,chld) peer=crun,

audit deny @{PROC}/* w,
audit deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
audit deny @{PROC}/sys/** rw,
audit deny @{PROC}/sysrq-trigger rwklx,
audit deny @{PROC}/kcore rwklx,
audit deny @{PROC}/mem rwklx,
audit deny @{PROC}/kmem rwklx,

audit deny mount,
audit deny umount,

audit deny /sys/** rwklx,

audit deny ptrace,
}

Relaxed

#include <tunables/global>

profile weos-app-apparmor-relaxed flags=(attach_disconnected,mediate_deleted) {
  signal (send,receive) peer=weos-app-apparmor-relaxed,
  ptrace (trace,read) peer=weos-app-apparmor-relaxed,

network,

capability,

file,
umount,

signal (receive) peer=unconfined,

# Override the generic /proc pseudo-directory write deny below.
priority=1 @{PROC}/sys/kernel/shm** w,

audit deny @{PROC}/* w,
audit deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
audit deny @{PROC}/sysrq-trigger rwklx,
audit deny @{PROC}/kcore rwklx,

audit deny mount,

audit deny /sys/[^f]*/** wklx,
audit deny /sys/f[^s]*/** wklx,
audit deny /sys/fs/[^c]*/** wklx,
audit deny /sys/fs/c[^g]*/** wklx,
audit deny /sys/fs/cg[^r]*/** wklx,
audit deny /sys/firmware/** rwklx,
audit deny /sys/devices/virtual/powercap/** rwklx,
audit deny /sys/kernel/security/** rwklx,
}