Ahmet Sait提出的问题 -ubuntu

Ahmet Sait

Asked: 2025-02-12 17:37:36 +0800 CST

É possível conceder o privilégio `userns` a um perfil do AppArmor sem `flags=(unconfined)`?

Basicamente o título.

Tentei adicionar usernsa um perfil do AppArmor, mas parece que não funciona sem unconfinedsinalizador.

Então, posso fazer o seguinte perfil funcionar sem flags=(unconfined), e se não, por quê ?

abi <abi/4.0>,
include <tunables/global>

profile my-app /usr/lib/my-app/app flags=(unconfined) {
    userns,
}

Ahmet Sait

Asked: 2025-02-09 05:05:44 +0800 CST

Qual é a maneira correta de corrigir o aviso "Alguns recursos de segurança do Firefox podem oferecer menos proteção no seu sistema operacional atual" no Firefox usando o AppArmor?

Após uma instalação nova do Kubuntu 24.04.1, substituí o Firefox pela versão do pacote deb. O Firefox me recebeu com um aviso:

Alguns dos recursos de segurança do Firefox podem oferecer menos proteção no seu sistema operacional atual. Como corrigir esse problema

Tentei seguir as instruções no link fornecido sem muita sorte, então percebi que já tenho um perfil do AppArmor para o Firefox:

$ cat /etc/apparmor.d/firefox
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile firefox /{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin} flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/firefox>
}

Este perfil parece vir do apparmorpacote:

$ dpkg -S /etc/apparmor.d/firefox
apparmor: /etc/apparmor.d/firefox

$ apt list apparmor
Listing... Done
apparmor/noble-updates,now 4.0.1really4.0.1-0ubuntu0.24.04.3 amd64 [installed,automatic]

E então vi outro perfil em usr.bin.firefox:

$ cat /etc/apparmor.d/usr.bin.firefox
# vim:syntax=apparmor
# Author: Jamie Strandboge <[email protected]>

# Declare an apparmor variable to help with overrides
@{MOZ_LIBDIR}=/usr/lib/firefox

#include <tunables/global>

# We want to confine the binaries that match:
#  /usr/lib/firefox/firefox
#  /usr/lib/firefox/firefox
# but not:
#  /usr/lib/firefox/firefox.sh
profile firefox /usr/lib/firefox/firefox{,*[^s][^h]} {
  #include <abstractions/audio>
  #include <abstractions/cups-client>
  #include <abstractions/dbus-strict>
  #include <abstractions/dbus-session-strict>
  #include <abstractions/dconf>
  #include <abstractions/fcitx>
  #include <abstractions/gnome>
  #include <abstractions/ibus>
  #include <abstractions/mesa>
  #include <abstractions/nameservice>
  #include <abstractions/openssl>
  #include <abstractions/p11-kit>
  #include <abstractions/ubuntu-unity7-base>
  #include <abstractions/ubuntu-unity7-launcher>

  #include <abstractions/dbus-accessibility-strict>
  dbus (send)
       bus=session
       peer=(name=org.a11y.Bus),
  dbus (receive)
       bus=session
       interface=org.a11y.atspi**,
  dbus (receive, send)
       bus=accessibility,

  # for networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/arp r,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,
  @{PROC}/[0-9]*/net/dev r,
  @{PROC}/[0-9]*/net/wireless r,
  dbus (send)
       bus=system
       path=/org/freedesktop/NetworkManager
       member=state,
  dbus (receive)
       bus=system
       path=/org/freedesktop/NetworkManager,

  # used by third_party/rust/audio_thread_priority
  dbus (send)
       bus=system
       path=/org/freedesktop/RealtimeKit1,

  # should maybe be in abstractions
  /etc/ r,
  /etc/mime.types r,
  /etc/mailcap r,
  /etc/xdg/*buntu/applications/defaults.list    r, # for all derivatives
  /etc/xfce4/defaults.list r,
  /usr/share/xubuntu/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/mimeapps.list r,
  owner @{HOME}/.local/share/applications/mimeinfo.cache r,
  /var/lib/snapd/desktop/applications/mimeinfo.cache r,
  /var/lib/snapd/desktop/applications/*.desktop r,
  owner /tmp/** m,
  owner /var/tmp/** m,
  owner /{,var/}run/shm/shmfd-* rw,
  owner /{dev,run}/shm/org.{chromium,mozilla}.* rwk,
  owner /{dev,run}/shm/wayland.mozilla.ipc.[0-9]* rw,
  /tmp/.X[0-9]*-lock r,
  /etc/udev/udev.conf r,
  # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
  # Possibly move to an abstraction if anything else needs it.
  deny /run/udev/data/** r,
  # let the shell know we launched something
  dbus (send)
     bus=session
     interface=org.gtk.gio.DesktopAppInfo
     member=Launched,

  /etc/timezone r,
  /etc/wildmidi/wildmidi.cfg r,

  # firefox specific
  /etc/firefox*/ r,
  /etc/firefox*/** r,
  /etc/xul-ext/** r,
  /etc/xulrunner-2.0*/ r,
  /etc/xulrunner-2.0*/** r,
  /etc/gre.d/ r,
  /etc/gre.d/* r,

  # noisy
  deny @{MOZ_LIBDIR}/** w,
  deny /usr/lib/firefox-addons/** w,
  deny /usr/lib/xulrunner-addons/** w,
  deny /usr/lib/xulrunner-*/components/*.tmp w,
  deny /.suspended r,
  deny /boot/initrd.img* r,
  deny /boot/vmlinuz* r,
  deny /var/cache/fontconfig/ w,
  deny @{HOME}/.local/share/recently-used.xbel r,

  # TODO: investigate
  deny /usr/bin/gconftool-2 x,

  # These are needed when a new user starts firefox and firefox.sh is used
  @{MOZ_LIBDIR}/** ixr,
  /usr/bin/basename ixr,
  /usr/bin/dirname ixr,
  /usr/bin/pwd ixr,
  /sbin/killall5 ixr,
  /bin/which ixr,
  /usr/bin/tr ixr,
  @{PROC}/ r,
  @{PROC}/[0-9]*/cmdline r,
  @{PROC}/[0-9]*/mountinfo r,
  @{PROC}/[0-9]*/stat r,
  owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
  @{PROC}/[0-9]*/status r,
  @{PROC}/filesystems r,
  @{PROC}/sys/vm/overcommit_memory r,
  # prevent crash LP: #1931602
  /sys/devices/pci[0-9]*/**/{uevent,resource,irq,class} r,
  /sys/devices/platform/**/uevent r,
  /sys/devices/pci*/**/{busnum,idVendor,idProduct} r,
  /sys/devices/pci*/**/{,subsystem_}device r,
  /sys/devices/pci*/**/{,subsystem_}vendor r,
  /sys/devices/system/node/node[0-9]*/meminfo r,
  owner @{HOME}/.cache/thumbnails/** rw,

  /etc/mtab r,
  /etc/fstab r,

  # Needed for the crash reporter
  owner @{PROC}/[0-9]*/environ r,
  owner @{PROC}/[0-9]*/auxv r,
  /etc/lsb-release r,
  /usr/bin/expr ix,
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/** r,

  # about:memory
  owner @{PROC}/[0-9]*/statm r,
  owner @{PROC}/[0-9]*/smaps r,

  # allow access to documentation and other files the user may want to look
  # at in /usr and /opt
  /usr/ r,
  /usr/** r,
  /opt/ r,
  /opt/** r,

  # so browsing directories works
  / r,
  /**/ r,

  # Default profile allows downloads to ~/Downloads and uploads from ~/Public
  owner @{HOME}/ r,
  owner @{HOME}/Public/ r,
  owner @{HOME}/Public/* r,
  owner @{HOME}/Downloads/ r,
  owner @{HOME}/Downloads/* rw,

  # per-user firefox configuration
  owner @{HOME}/.{firefox,mozilla}/ rw,
  owner @{HOME}/.{firefox,mozilla}/** rw,
  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
  owner @{HOME}/.{firefox,mozilla}/plugins/** rm,
  owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm,
  owner @{HOME}/.gnome2/firefox* rwk,
  owner @{HOME}/.cache/mozilla/{,firefox/} rw,
  owner @{HOME}/.cache/mozilla/firefox/** rw,
  owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite* k,
  owner @{HOME}/.config/gtk-3.0/bookmarks r,
  owner @{HOME}/.config/dconf/user w,
  owner /{,var/}run/user/*/dconf/user w,
  dbus (send)
       bus=session
       path=/org/gnome/GConf/Server
       member=GetDefaultDatabase
       peer=(label=unconfined),
  dbus (send)
       bus=session
       path=/org/gnome/GConf/Database/*
       member={AddMatch,AddNotify,AllEntries,LookupExtended,RemoveNotify}
       peer=(label=unconfined),
  dbus (send)
       bus=session
       path=/org/gtk/vfs/mounttracker
       interface=org.gtk.vfs.MountTracker
       member=ListMountableInfo
       peer=(label=unconfined),

  # Allow access to xdg-desktop-portal and xdg-document-portal (LP: #1974449)
  dbus (receive, send)
       bus=session
       interface=org.freedesktop.portal.*
       path=/org/freedesktop/portal/{desktop,documents}{,/**}
       peer=(label=unconfined),

  dbus (receive, send)
       bus=session
       interface=org.freedesktop.DBus.Properties
       path=/org/freedesktop/portal/{desktop,documents}{,/**}
       peer=(label=unconfined),

  # Allow access to the Fcitx portal, supported by fcitx/fcitx5
  dbus (send)
      bus=session
      path=/{,org/freedesktop/portal/}inputmethod
      interface=org.fcitx.Fcitx.InputMethod1
      member={CreateInputContext,Version}
      peer=(name=org.freedesktop.portal.Fcitx),
  dbus (send, receive)
      bus=session
      path=/{,org/freedesktop/portal/}inputcontext/**
      interface=org.fcitx.Fcitx.InputContext1,

  # Allow remote control when running on Wayland
  dbus (send)
       bus=session
       path=/org/freedesktop/DBus
       interface=org.freedesktop.DBus
       member=RequestName
       peer=(name=org.freedesktop.DBus),
  dbus (bind)
       bus=session
       name=org.mozilla.firefox.*,
  dbus (send, receive)
       bus=session
       path=/org/mozilla/firefox/Remote
       interface=org.mozilla.firefox
       member=OpenURL
       peer=(label=firefox),

  # gnome-session
  dbus (send)
       bus=session
       path=/org/gnome/SessionManager
       interface=org.gnome.SessionManager
       member={Inhibit,Uninhibit}
       peer=(label=unconfined),

  # unity screen API
  dbus (send)
       bus=system
       interface="org.freedesktop.DBus.Introspectable"
       path="/com/canonical/Unity/Screen"
       member="Introspect"
       peer=(label=unconfined),
  dbus (send)
       bus=system
       interface="com.canonical.Unity.Screen"
       path="/com/canonical/Unity/Screen"
       member={keepDisplayOn,removeDisplayOnRequest}
       peer=(label=unconfined),

  # freedesktop.org ScreenSaver
  dbus (send)
       bus=session
       path=/{,org/freedesktop/,org.gnome/}Screen{s,S}aver
       interface=org.freedesktop.ScreenSaver
       member={Inhibit,UnInhibit,SimulateUserActivity}
       peer=(label=unconfined),

  # gnome, kde and cinnamon screensaver
  dbus (send)
       bus=session
       path=/{,ScreenSaver}
       interface=org.{gnome.ScreenSaver,kde.screensaver,cinnamon.ScreenSaver}
       member=SimulateUserActivity
       peer=(label=unconfined),

  # UPower
  dbus (send)
       bus=system
       path=/org/freedesktop/UPower
       interface=org.freedesktop.UPower
       member=EnumerateDevices
       peer=(label=unconfined),

  # File browser
  dbus (send)
       bus=session
       interface=org.freedesktop.FileManager1
       path=/org/freedesktop/FileManager1
       member=ShowItems,

  #
  # Extensions
  # /usr/share/.../extensions/... is already covered by '/usr/** r', above.
  # Allow 'x' for downloaded extensions, but inherit policy for safety
  owner @{HOME}/.mozilla/**/extensions/** mixr,

  deny @{MOZ_LIBDIR}/update.test w,
  deny /usr/lib/mozilla/extensions/**/ w,
  deny /usr/lib/xulrunner-addons/extensions/**/ w,
  deny /usr/share/mozilla/extensions/**/ w,
  deny /usr/share/mozilla/ w,

  # Miscellaneous (to be abstracted)
  # Ideally these would use a child profile. They are all ELF executables
  # so running with 'Ux', while not ideal, is ok because we will at least
  # benefit from glibc's secure execute.
  /usr/bin/mkfifo Uxr,  # investigate
  /bin/ps Uxr,
  /bin/uname Uxr,

  /usr/bin/lsb_release Cxr -> lsb_release,
  profile lsb_release {
    #include <abstractions/base>
    #include <abstractions/python>
    /usr/bin/lsb_release r,
    /bin/dash ixr,
    /usr/bin/dpkg-query ixr,
    /usr/include/python2.[4567]/pyconfig.h r,
    /etc/lsb-release r,
    /etc/debian_version r,
    /usr/share/distro-info/*.csv r,
    /var/lib/dpkg/** r,

    /usr/local/lib/python3.[0-9]/dist-packages/ r,
    /usr/bin/ r,
    /usr/bin/python3.[0-9] mr,

    # file_inherit
    deny /tmp/gtalkplugin.log w,
  }

  # Addons
  #include <abstractions/ubuntu-browsers.d/firefox>

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.firefox>
}

Que vem do próprio pacote do Firefox:

$ dpkg -S /etc/apparmor.d/usr.bin.firefox
firefox: /etc/apparmor.d/usr.bin.firefox

$ apt list firefox
Listing... Done
firefox/noble,now 135.0+build2-0ubuntu0.24.04.1~mt2 amd64 [installed]

Neste ponto, parecia que o usr.bin.firefoxarquivo tinha prioridade, então editei /etc/apparmor.d/local/usr.bin.firefoxassim:

$ cat /etc/apparmor.d/local/usr.bin.firefox
userns,

Mas o aviso não desaparece a menos que eu adicione algo flags=(unconfined)ao perfil, o que, até onde eu entendo, significa que nenhuma restrição ao processo será aplicada.

Então a questão é: é possível permitir que o Firefox use namespaces de usuário não privilegiados para sandboxing sem usar o unconfinedsinalizador? Em outras palavras, como posso aplicar regras do AppArmor e ainda permitir usernsprivilégios?

É possível conceder o privilégio `userns` a um perfil do AppArmor sem `flags=(unconfined)`?

Qual é a maneira correta de corrigir o aviso "Alguns recursos de segurança do Firefox podem oferecer menos proteção no seu sistema operacional atual" no Firefox usando o AppArmor?

Existe um comando para listar todos os usuários? Também para adicionar, excluir, modificar usuários, no terminal?

Como excluir um diretório não vazio no Terminal?

Como descompactar um arquivo zip do Terminal?

Como instalo um arquivo .deb por meio da linha de comando?

Como instalo um arquivo .tar.gz (ou .tar.bz2)?

Como listar todos os pacotes instalados

Ahmet Sait's questions