1 # 2 # AppArmor tlsdate profile for Debian GNU/Linux 3 # 4 # This program is free software; you can redistribute it and/or 5 # modify it under the terms of version 2 of the GNU General Public 6 # License published by the Free Software Foundation. 7 # 8 9 #include <tunables/global> 10 #include <tunables/multiarch.d> 11 /usr/bin/tlsdate { 12 #include <abstractions/consoles> 13 #include <abstractions/ssl_certs> 14 15 capability sys_time, 16 capability setgid, 17 capability setuid, 18 capability sys_chroot, 19 20 # IPv4 TCP 21 network inet stream, 22 # IPv4 UDP for DNS resolution 23 network inet dgram, 24 # IPv6 TCP 25 network inet6 stream, 26 # IPv6 UDP 27 network inet6 dgram, 28 29 # Required for gethostbyname 30 /etc/resolv.conf r, 31 /run/resolvconf/resolv.conf r, 32 /etc/nsswitch.conf r, 33 /etc/localtime r, 34 /etc/nsswitch.conf r, 35 /etc/hosts r, 36 /etc/host.conf r, 37 38 # Allow reading public certs but not private keys 39 /etc/ssl/certs/* r, 40 /usr/share/ca-certificates/*/** r, 41 42 # Allow reading of /etc/tlsdate/ 43 /etc/tlsdate/*/** r, 44 45 # Required for getpwnam 46 /etc/passwd r, 47 /etc/group r, 48 /proc/sys/kernel/ngroups_max r, 49 50 # Allow reading of libs and /tmp 51 /etc/ld.so.cache r, 52 53 # Random number generation requires these two 54 /dev/random r, 55 /dev/urandom r, 56 57 # Allow mapping of shared libraries 58 /lib{,32,64}/* rm, 59 /usr/lib/* rm, 60 /lib/@{multiarch}/* rm, 61 /usr/lib/@{multiarch}/* rm, 62 63 # We'll allow tlsdate to write a new root to chroot into 64 /tmp/ r, 65 owner /tmp/tlsdate_*/ rw, 66 67 # We'll allow tlsdate to exec tlsdate-helper 68 /usr/bin/tlsdate-helper ixm, 69 /usr/bin/tlsdate ixm, 70 } 71 72 /usr/bin/tlsdate-helper { 73 #include <abstractions/consoles> 74 #include <abstractions/ssl_certs> 75 76 capability sys_time, 77 capability setgid, 78 capability setuid, 79 capability sys_chroot, 80 81 # IPv4 TCP 82 network inet stream, 83 # IPv4 UDP for DNS resolution 84 network inet dgram, 85 # IPv6 TCP 86 network inet6 stream, 87 # IPv6 UDP 88 network inet6 dgram, 89 90 # Required for gethostbyname 91 /etc/resolv.conf r, 92 /run/resolvconf/resolv.conf r, 93 /etc/nsswitch.conf r, 94 /etc/localtime r, 95 /etc/nsswitch.conf r, 96 /etc/hosts r, 97 /etc/host.conf r, 98 99 # Allow reading public certs but not private keys 100 /etc/ssl/certs/* r, 101 /usr/share/ca-certificates/*/** r, 102 103 # Allow reading of /etc/tlsdate/ 104 /etc/tlsdate/*/** r, 105 106 # Required for getpwnam 107 /etc/passwd r, 108 /etc/group r, 109 /proc/sys/kernel/ngroups_max r, 110 111 # Allow reading of libs and /tmp 112 /etc/ld.so.cache r, 113 114 # Random number generation requires these two 115 /dev/random r, 116 /dev/urandom r, 117 118 # Allow mapping of shared libraries 119 /lib{,32,64}/* rm, 120 /usr/lib/* rm, 121 /lib/@{multiarch}/* rm, 122 /usr/lib/@{multiarch}/* rm, 123 124 # We'll allow tlsdate to write a new root to chroot into 125 /tmp/ r, 126 owner /tmp/tlsdate_*/ rw, 127 } 128 129 /usr/sbin/tlsdated { 130 #include <abstractions/consoles> 131 #include <abstractions/ssl_certs> 132 133 capability sys_time, 134 capability setgid, 135 capability setuid, 136 capability sys_chroot, 137 138 # IPv4 TCP 139 network inet stream, 140 # IPv4 UDP for DNS resolution 141 network inet dgram, 142 # IPv6 TCP 143 network inet6 stream, 144 # IPv6 UDP 145 network inet6 dgram, 146 147 # Required for gethostbyname 148 /etc/resolv.conf r, 149 /etc/nsswitch.conf r, 150 /etc/localtime r, 151 /etc/nsswitch.conf r, 152 /etc/hosts r, 153 /etc/host.conf r, 154 155 # Allow reading public certs but not private keys 156 /etc/ssl/certs/* r, 157 /usr/share/ca-certificates/*/** r, 158 159 # Allow reading of /etc/tlsdate/ 160 /etc/tlsdate/*/** r, 161 /etc/tlsdate/tlsdated.conf r, 162 163 # Required for getpwnam 164 /etc/passwd r, 165 /etc/group r, 166 /proc/sys/kernel/ngroups_max r, 167 168 # tlsdated looks into proc for answers 169 /proc/meminfo r, 170 171 # Allow reading of libs and /tmp 172 /etc/ld.so.cache r, 173 174 # Random number generation requires these two 175 /dev/random r, 176 /dev/urandom r, 177 178 # RTC 179 /dev/rtc0 rw, 180 /dev/rtc1 rw, 181 182 # Allow mapping of shared libraries 183 /lib{,32,64}/* rm, 184 /usr/lib/* rm, 185 /lib/@{multiarch}/* rm, 186 /usr/lib/@{multiarch}/* rm, 187 188 # We'll allow tlsdate to write a new root to chroot into 189 /tmp/ r, 190 owner /tmp/tlsdate_*/ rw, 191 192 # We'll allow tlsdated to cache the time here 193 owner /var/cache/tlsdated/* rw, 194 # We'll allow the unprivileged helper to read the time 195 /var/cache/tlsdated/* r, 196 197 # We'll allow tlsdated to exec tlsdate-helper 198 /usr/bin/tlsdate-helper ixm, 199 /usr/bin/tlsdate ixm, 200 } 201
