← Back to branch summary

~mterry/snap-confine/tmpdir-15.04

« back to all changes in this revision

Viewing changes to debian/usr.bin.ubuntu-core-launcher

merged lp:~jdstrand/ubuntu-core-launcher/ubuntu-core-launcher.aa-profile

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/usr.bin.ubuntu-core-launcher
 
1
# Author: Jamie Strandboge <jamie@canonical.com>
 
2
#include <tunables/global>
 
3
 
 
4
/usr/bin/ubuntu-core-launcher {
 
5
    # We run privileged, so be fanatical about what we include and don't use
 
6
    # any abstractions
 
7
    /etc/ld.so.cache r,
 
8
    /lib/@{multiarch}/libapparmor.so* mr,
 
9
    /lib/@{multiarch}/libc-*.so* mr,
 
10
    /lib/@{multiarch}/libpthread-*.so* mr,
 
11
    /lib/@{multiarch}/libudev.so* mr,
 
12
    /usr/lib/@{multiarch}/libseccomp.so* mr,
 
13
 
 
14
    # cgroups
 
15
    capability sys_admin,
 
16
    capability dac_override,
 
17
    /sys/fs/cgroup/devices/snappy.*/ w,
 
18
    /sys/fs/cgroup/devices/snappy.*/tasks w,
 
19
    /sys/fs/cgroup/devices/snappy.*/devices.{allow,deny} w,
 
20
 
 
21
    # querying udev
 
22
    /etc/udev/udev.conf r,
 
23
    /sys/devices/**/uevent r,
 
24
    /lib/udev/snappy-app-dev ixr, # drop
 
25
 
 
26
    # priv dropping
 
27
    capability setuid,
 
28
    capability setgid,
 
29
 
 
30
    # changing profile
 
31
    @{PROC}/[0-9]*/attr/exec w,
 
32
    change_profile -> [^u/]**,
 
33
    change_profile -> [^u/][^n]**,
 
34
    change_profile -> [^u/][^n][^c]**,
 
35
    change_profile -> [^u/][^n][^c][^o]**,
 
36
    change_profile -> [^u/][^n][^c][^o][^n]**,
 
37
    change_profile -> [^u/][^n][^c][^o][^n][^f]**,
 
38
    change_profile -> [^u/][^n][^c][^o][^n][^f][^i]**,
 
39
    change_profile -> [^u/][^n][^c][^o][^n][^f][^i][^n]**,
 
40
    change_profile -> [^u/][^n][^c][^o][^n][^f][^i][^n][^e]**,
 
41
    change_profile -> [^u/][^n][^c][^o][^n][^f][^i][^n][^e][^d]**,
 
42
    # LP: #1446794 - when this bug is fixed, change the above to:
 
43
    # deny change_profile -> {unconfined,/**},
 
44
    # change_profile -> **,
 
45
 
 
46
    # reading seccomp filters
 
47
    /var/lib/snappy/seccomp/profiles/* r,
 
48
}