← Back to branch summary

~ubuntu-branches/ubuntu/wily/apparmor/wily

« back to all changes in this revision

Viewing changes to profiles/apparmor.d/abstractions/ubuntu-browsers.d/java

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2011-04-27 10:38:07 UTC
  • mfrom: (5.1.118 natty)
  • Revision ID: james.westby@ubuntu.com-20110427103807-ym3rhwys6o84ith0
Tags: 2.6.1-2
debian/copyright: clarify for some full organization names.

Show diffs side-by-side

added added

removed removed

Lines of Context:
profiles/apparmor.d/abstractions/ubuntu-browsers.d/java
 
1
# vim:syntax=apparmor
 
2
 
 
3
  # Java plugin
 
4
  owner @{HOME}/.java/deployment/deployment.properties k,
 
5
  /etc/java-*/ r,
 
6
  /etc/java-*/** r,
 
7
  /usr/lib/jvm/java-6-openjdk/jre/lib/*/IcedTeaPlugin.so mr,
 
8
  /usr/lib/jvm/java-6-openjdk/jre/bin/java cx -> browser_openjdk,
 
9
  /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} cx -> browser_java,
 
10
  /usr/lib/jvm/java-*-sun-1.*/jre/lib/*/libnp*.so cx -> browser_java,
 
11
  /usr/lib/j2*-ibm/jre/bin/java cx -> browser_java,
 
12
 
 
13
  # Profile for the supported OpenJDK in Ubuntu. This doesn't require the
 
14
  # unfortunate workarounds of the proprietary Javas, so have a separate
 
15
  # profile.
 
16
  profile browser_openjdk {
 
17
    #include <abstractions/base>
 
18
    #include <abstractions/fonts>
 
19
    #include <abstractions/gnome>
 
20
    #include <abstractions/kde>
 
21
    #include <abstractions/nameservice>
 
22
    #include <abstractions/ssl_certs>
 
23
    #include <abstractions/user-tmp>
 
24
    #include <abstractions/private-files-strict>
 
25
 
 
26
    network inet stream,
 
27
    network inet6 stream,
 
28
    @{PROC}/[0-9]*/net/if_inet6 r,
 
29
    @{PROC}/[0-9]*/net/ipv6_route r,
 
30
 
 
31
    /etc/java-*/ r,
 
32
    /etc/java-*/** r,
 
33
    /etc/lsb-release r,
 
34
    /etc/ssl/certs/java/* r,
 
35
    /etc/timezone r,
 
36
 
 
37
    @{PROC}/[0-9]*/ r,
 
38
    @{PROC}/[0-9]*/fd/ r,
 
39
    @{PROC}/filesystems r,
 
40
    /sys/devices/system/cpu/ r,
 
41
    /sys/devices/system/cpu/** r,
 
42
    /usr/share/** r,
 
43
    /var/lib/dbus/machine-id r,
 
44
 
 
45
    /usr/bin/env ix,
 
46
    /usr/lib/jvm/java-6-openjdk/jre/bin/java ix,
 
47
    /usr/lib/jvm/java-6-openjdk/jre/lib/i386/client/classes.jsa m,
 
48
 
 
49
    # Why would java need this?
 
50
    deny /usr/bin/gconftool-2 x,
 
51
 
 
52
    owner @{HOME}/ r,
 
53
    owner @{HOME}/** rwk,
 
54
  }
 
55
 
 
56
  # Profile for commercial Javas. These need workarounds to work right (eg
 
57
  # Sun's forcing of an executable stack (LP: #535247)).
 
58
  profile browser_java {
 
59
    #include <abstractions/base>
 
60
    #include <abstractions/fonts>
 
61
    #include <abstractions/gnome>
 
62
    #include <abstractions/kde>
 
63
    #include <abstractions/nameservice>
 
64
    #include <abstractions/ssl_certs>
 
65
    #include <abstractions/user-tmp>
 
66
    #include <abstractions/private-files-strict>
 
67
 
 
68
    network inet stream,
 
69
    network inet6 stream,
 
70
    @{PROC}/[0-9]*/net/if_inet6 r,
 
71
    @{PROC}/[0-9]*/net/ipv6_route r,
 
72
    @{PROC}/loadavg r,
 
73
 
 
74
    /etc/debian_version r,
 
75
    /etc/java-*/ r,
 
76
    /etc/java-*/** r,
 
77
    /etc/lsb-release r,
 
78
    /etc/ssl/certs/java/* r,
 
79
    /etc/timezone r,
 
80
 
 
81
    @{PROC}/[0-9]*/ r,
 
82
    @{PROC}/[0-9]*/fd/ r,
 
83
    @{PROC}/filesystems r,
 
84
    /sys/devices/system/cpu/ r,
 
85
    /sys/devices/system/cpu/** r,
 
86
    /usr/share/** r,
 
87
    /var/lib/dbus/machine-id r,
 
88
 
 
89
    /usr/bin/env ix,
 
90
    /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} ix,
 
91
    /usr/lib/jvm/java-*-sun-1.*/jre/lib/i386/client/classes.jsa m,
 
92
    /usr/lib/j2*-ibm/jre/bin/java ix,
 
93
 
 
94
    # noisy, can't write here anyway
 
95
    deny /etc/.java/ w,
 
96
    deny /etc/.java/** w,
 
97
 
 
98
    deny /usr/bin/gconftool-2 x,
 
99
 
 
100
    owner @{HOME}/ r,
 
101
    owner @{HOME}/** rwk,
 
102
 
 
103
    # These are seriously unfortunate, but required due to LP: #535247
 
104
    /etc/passwd m,
 
105
    owner @{HOME}/.java/**/cache/** m,
 
106
    owner /tmp/** m,
 
107
    /usr/lib{,32,64}/jvm/**/*.jar mr,
 
108
    /usr/share/fonts/** m,
 
109
  }