Regression: session names

.github/local/needrestart

@@ -0,0 +1,2 @@
+
+  /var/lib/waagent/** r,

.github/workflows/main.yml

@@ -3,8 +3,19 @@ name: Ubuntu
 on: [push, pull_request, workflow_dispatch]
 
 jobs:
+  check:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Run basic profile linter check
+        run: |
+          make check
+
   build:
     runs-on: ${{ matrix.os }}
+    needs: check
     strategy:
       matrix:
         os:
@@ -83,12 +94,37 @@ jobs:
           sudo apt-get install -y \
             apparmor-profiles apparmor-utils \
             bats bats-support
+          sudo install -Dm0644 .github/local/needrestart /etc/apparmor.d/local/needrestart
 
       - name: Install apparmor.d
         run: |
           sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true
           sudo systemctl restart apparmor.service
 
+      - name: Restart some services to ensure they are confined
+        run: |
+          services=(
+            containerd cron
+            dbus docker
+            ModemManager multipathd
+            networkd-dispatcher
+            packagekit polkit
+            snapd
+            systemd-journald systemd-hostnamed systemd-logind systemd-networkd
+            systemd-resolved systemd-udevd
+            udisks2
+          )
+          sudo systemctl daemon-reload
+          for service in "${services[@]}"; do
+            sudo systemctl restart "$service" || systemctl status "$service.service" || true
+          done
+          sudo ps auxZ | grep -v '\[.*\]'
+          sudo aa-log -s --raw
+
+      - name: Install integration dependencies
+        run: |
+          bash tests/requirements.sh
+
       - name: Run the bats integration tests
         run: |
           make bats
@@ -97,3 +133,8 @@ jobs:
         if: always()
         run: |
           sudo aa-log -s --raw
+
+      - name: Show final processes security context
+        if: always()
+        run: |
+          sudo ps auxZ | grep -v '\[.*\]'

Makefile

@@ -113,7 +113,7 @@ check:
 
 .PHONY: bats
 bats:
-	@bats --print-output-on-failure tests/bats/
+	@bats --timing --print-output-on-failure tests/bats/
 
 .PHONY: manual
 manual:

apparmor.d/abstractions/app/chromium

@@ -186,6 +186,7 @@
         @{PROC}/ r,
         @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pid}/stat r,
+        @{PROC}/@{pid}/statm r,
         @{PROC}/@{pid}/task/@{tid}/status r,
         @{PROC}/pressure/{memory,cpu,io} r,
         @{PROC}/sys/fs/inotify/max_user_watches r,
@@ -201,7 +202,6 @@
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/oom_{,score_}adj rw,
   owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/statm r,
   owner @{PROC}/@{pid}/task/ r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
   owner @{PROC}/@{pid}/task/@{tid}/stat r,

apparmor.d/abstractions/app/firefox

@@ -101,7 +101,7 @@
   owner @{tmp}/Temp-@{uuid}/ rw,
   owner @{tmp}/Temp-@{uuid}/* rwk,
   owner @{tmp}/tmp-*.xpi rw,
-  owner @{tmp}/tmpaddon r,
+  owner @{tmp}/tmpaddon rw,
   owner @{tmp}/tmpaddon-@{int} r,
 
   owner /dev/shm/org.chromium.@{rand6} rw,
@@ -125,7 +125,7 @@
         @{sys}/devices/power/events/energy-* r,
         @{sys}/devices/power/type r,
         @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
-        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{int}.scope/cpu.max r,
+        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/cpu.max r,
   owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/**/cpu.max r,
 
         @{PROC}/@{pid}/net/arp r,

apparmor.d/abstractions/app/sudo

@@ -24,10 +24,10 @@
 
   network netlink raw,   # PAM
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.logi1.Manager
-       member=CreateSession
-       peer=(name=org.freedesktop.login1, label=systemd-logind),
+  unix bind type=stream addr=@@{udbus}/bus/sudo/system,
+
+  #aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
+  #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
 
   dbus (send receive) bus=session path=/org/freedesktop/systemd1
          interface=org.freedesktop.systemd.Manager

apparmor.d/abstractions/app/systemctl

@@ -10,7 +10,7 @@
 
   ptrace read peer=@{p_systemd},
 
-  unix bind type=stream addr=@@{hex16}/bus/systemctl/,
+  unix bind type=stream addr=@@{udbus}/bus/systemctl/,
 
   @{bin}/systemctl mr,
 

apparmor.d/abstractions/attached/base

@@ -7,6 +7,10 @@
 
   abi <abi/4.0>,
 
+  @{att}/@{run}/systemd/journal/dev-log w,
+  @{att}/@{run}/systemd/journal/socket w,
+
+  deny /apparmor/.null rw,
   deny @{att}/apparmor/.null rw,
 
   include if exists <abstractions/attached/base.d>

apparmor.d/abstractions/base.d/complete

@@ -33,6 +33,4 @@
 
   @{PROC}/sys/kernel/core_pattern r,
 
-  deny /apparmor/.null rw,
-
 # vim:syntax=apparmor

apparmor.d/abstractions/bus-accessibility

@@ -7,12 +7,12 @@
   dbus send bus=accessibility path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
-       peer=(name=org.freedesktop.DBus, label=dbus-accessibility),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_accessibility}"),
 
   dbus send bus=accessibility path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-accessibility),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_accessibility}"),
 
   owner @{run}/user/@{uid}/at-spi/ rw,
   owner @{run}/user/@{uid}/at-spi/bus rw,

apparmor.d/abstractions/bus-session

@@ -11,12 +11,12 @@
   dbus send bus=session path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
-       peer=(name=org.freedesktop.DBus, label=dbus-session),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
 
   dbus send bus=session path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-session),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_session}"),
 
   /etc/machine-id r,
   /var/lib/dbus/machine-id r,

apparmor.d/abstractions/bus-system

@@ -7,12 +7,12 @@
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
-       peer=(name=org.freedesktop.DBus, label=dbus-system),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
 
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-system),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
 
   @{run}/dbus/system_bus_socket rw,
 

apparmor.d/abstractions/bus/org.a11y

@@ -36,7 +36,7 @@
   dbus send bus=session path=/org/a11y/bus
        interface=org.a11y.Bus
        member=GetAddress
-       peer=(name=org.a11y.Bus, label=dbus-accessibility),
+       peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"),
 
   dbus send bus=session path=/org/a11y/bus
        interface=org.a11y.Bus

apparmor.d/abstractions/bus/org.freedesktop.hostname1

@@ -14,6 +14,11 @@
        member={Get,GetAll}
        peer=(name=org.freedesktop.hostname1),
 
+  dbus receive bus=system path=/org/freedesktop/hostname1
+       interface=org.freedesktop.DBus.Properties
+       member=PropertiesChanged
+       peer=(name="{@{busname},org.freedesktop.hostname1}", label=systemd-hostnamed),
+
   include if exists <abstractions/bus/org.freedesktop.hostname1.d>
 
 # vim:syntax=apparmor

apparmor.d/abstractions/bus/org.freedesktop.systemd1

@@ -4,7 +4,7 @@
 
   abi <abi/4.0>,
 
-  dbus send bus=system path=/org/freedesktop/systemd1
+  dbus send bus=system path=/org/freedesktop/systemd1{,/**}
        interface=org.freedesktop.DBus.Properties
        member={Get,GetAll}
        peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"),

apparmor.d/abstractions/common/bwrap

@@ -44,8 +44,11 @@
   owner /tmp/newroot/ w,
   owner /tmp/oldroot/ w,
 
-               @{PROC}/sys/kernel/overflowgid r,
-               @{PROC}/sys/kernel/overflowuid r,
+        @{PROC}/sys/kernel/overflowgid r,
+        @{PROC}/sys/kernel/overflowuid r,
+        @{PROC}/sys/user/max_user_namespaces r,
+  owner @{PROC}/@{pid}/fd/ r,
+
         @{att}/@{PROC}/sys/user/max_user_namespaces rw,
   owner @{att}/@{PROC}/@{pid}/cgroup r,
   owner @{att}/@{PROC}/@{pid}/fd/ r,

apparmor.d/abstractions/deny-sensitive-home

@@ -34,7 +34,7 @@
   deny @{HOME}/@{XDG_SSH_DIR}/{,**}       mrwkl,
   deny @{run}/user/@{uid}/keyring**       mrwkl,
   deny @{user_config_dirs}/*-store/{,**}  mrwkl,
-  deny @{user_password_store_dirs}/{,**}  mrwkl,
+  deny @{user_passwordstore_dirs}/{,**}   mrwkl,
   deny @{user_share_dirs}/kwalletd/{,**}  mrwkl,
 
   # Privacy violations

apparmor.d/abstractions/vulkan-strict

@@ -19,6 +19,7 @@
   owner @{user_cache_dirs}/gtk-4.0/vulkan-pipeline-cache/.goutputstream-@{rand6} rw,
   owner @{user_cache_dirs}/gtk-4.0/vulkan-pipeline-cache/@{uuid}.@{int} rw,
   owner @{user_cache_dirs}/radv_builtin_shaders{32,64} r, # Vulkan radv shaders cache
+  owner @{user_cache_dirs}/radv_builtin_shaders{32,64}@{rand6} w,
 
   owner @{user_share_dirs}/vulkan/ rw,
   owner @{user_share_dirs}/vulkan/implicit_layer.d/ rw,

apparmor.d/abstractions/webkit

@@ -0,0 +1,31 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <[email protected]>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Minimal set of rules for webkit UI.
+
+  abi <abi/4.0>,
+
+  mount options=(rw rbind) /bindfile@{rand6} -> /newroot/.flatpak-info,
+
+  @{bin}/xdg-dbus-proxy  rix,
+
+  @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix,
+  @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix,
+
+  owner /bindfile@{rand6} rw,
+  owner @{att}/.flatpak-info r,
+
+  owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw,
+
+  owner @{run}/user/@{uid}/.flatpak/ w,
+  owner @{run}/user/@{uid}/.flatpak/webkit-*/{,bwrapinfo.json} rw,
+
+  owner @{run}/user/@{uid}/webkitgtk/ w,
+  owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-@{rand6} rw,
+  owner @{run}/user/@{uid}/webkitgtk/bus-proxy-@{rand6} rw,
+  owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-@{rand6} rw,
+
+  include if exists <abstractions/webkit.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/wine

@@ -0,0 +1,20 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <[email protected]>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Basic set of resources for wine regardless of the installation method (system or through a game launcher).
+
+  abi <abi/4.0>,
+
+  owner @{user_share_dirs}/applications/wine/ rw,
+  owner @{user_share_dirs}/applications/wine/**/ rw,
+
+  owner @{tmp}/.wine-@{uid}/ rw,
+  owner @{tmp}/.wine-@{uid}/** rwk,
+
+  owner /dev/shm/wine-@{hex6}-fsync rw,
+  owner /dev/shm/wine-@{hex6}@{h}-fsync rw,
+
+  include if exists <abstractions/wine.d>
+
+# vim:syntax=apparmor

apparmor.d/groups/_full/systemd

@@ -138,7 +138,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member=GetConnectionUnixUser
-       peer=(name=org.freedesktop.DBus, label=dbus-system),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
 
   @{bin}/**                         Px,
   @{lib}/**                         Px,

apparmor.d/groups/_full/systemd-user

@@ -32,8 +32,8 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) {
 
   ptrace read peer=@{p_systemd},
 
-  unix bind type=stream addr=@@{hex16}/bus/systemd/bus-system,
-  unix bind type=stream addr=@@{hex16}/bus/systemd/bus-api-user,
+  unix bind type=stream addr=@@{udbus}/bus/systemd/bus-system,
+  unix bind type=stream addr=@@{udbus}/bus/systemd/bus-api-user,
 
   #aa:dbus own bus=session name=org.freedesktop.systemd1
 

apparmor.d/groups/apt/apt

@@ -34,7 +34,9 @@ profile apt @{exec_path} flags=(attach_disconnected) {
 
   signal (send) peer=apt-methods-*,
 
-  unix (bind) type=stream addr=@@{hex16}/bus/apt/system,
+  unix bind type=stream addr=@@{udbus}/bus/apt-get/system,
+  unix bind type=stream addr=@@{udbus}/bus/apt/system,
+
   unix (send, receive) type=stream peer=(label=apt-esm-json-hook),
   unix (send, receive) type=stream peer=(label=snapd),
 
@@ -43,7 +45,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
   dbus send bus=system path=/org/freedesktop/DBus/Bus
        interface=org.freedesktop.DBus
        member={GetConnectionUnixProcessID,GetConnectionUnixUser}
-       peer=(name=org.freedesktop.DBus, label=dbus-system),
+       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
 
   dbus send bus=system
        interface=org.freedesktop.DBus.Introspectable

apparmor.d/groups/apt/apt-methods-file

@@ -30,8 +30,9 @@ profile apt-methods-file @{exec_path} {
 
   @{lib}/apt/apt-helper rix,
 
-  /etc/apt/apt.conf.d/{,*} r,
+  /etc/apt/apt-mirrors.txt r,
   /etc/apt/apt.conf r,
+  /etc/apt/apt.conf.d/{,*} r,
   /etc/apt/mirrors/* r,
 
   /usr/share/dpkg/cputable r,

apparmor.d/groups/apt/apt-methods-mirror

@@ -28,6 +28,7 @@ profile apt-methods-mirror @{exec_path} {
 
   @{exec_path} mr,
 
+  /etc/apt/apt-mirrors.txt r,
   /etc/apt/mirrors/* r,
 
   # For shell pwd

apparmor.d/groups/apt/unattended-upgrade

@@ -33,7 +33,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
 
   signal (send) peer=apt-methods-http,
 
-  unix type=stream addr=@@{hex16}/bus/unattended-upgr/system,
+  unix type=stream addr=@@{udbus}/bus/unattended-upgr/system,
 
   @{exec_path} mr,