Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

interfaces: misc updates for network-control, firewall-control, unity7 and default policy #2842

Merged
merged 6 commits into from
Feb 16, 2017
Merged

interfaces: misc updates for network-control, firewall-control, unity7 and default policy #2842

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
33aa1e2
interfaces/network-control,firewall-control: allow reading module par…
Feb 13, 2017
7c69dcd
interfaces/unity7,x11: allow 'network netlink raw' (LP: #1663221)
Feb 13, 2017
ca87a4e
interfaces/unity7: allow registering interest in media keys (LP: #166…
Feb 13, 2017
4f54ca6
interfaces: allow /run/user/..., not /dev/user/...
Feb 13, 2017
5aa04e7
Merge branch 'master' of https://github.com/snapcore/snapd into polic…
Feb 14, 2017
af02c81
Revert "interfaces/unity7,x11: allow 'network netlink raw' (LP: #1663…
Feb 14, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions interfaces/apparmor/template.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,8 +343,8 @@ var defaultTemplate = []byte(`
/{dev,run}/shm/sem.snap.@{SNAP_NAME}.* rwk,

# Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
owner /{dev,run}/user/[0-9]*/snap.@{SNAP_NAME}/ rw,
owner /{dev,run}/user/[0-9]*/snap.@{SNAP_NAME}/** mrwklix,
owner /run/user/[0-9]*/snap.@{SNAP_NAME}/ rw,
owner /run/user/[0-9]*/snap.@{SNAP_NAME}/** mrwklix,

# Allow apps from the same package to communicate with each other via an
# abstract or anonymous socket
Expand Down
4 changes: 4 additions & 0 deletions interfaces/builtin/firewall_control.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,10 @@ unix (bind) type=stream addr="@xtables",
@{PROC}/sys/net/netfilter/** r,
@{PROC}/sys/net/nf_conntrack_max r,

# read netfilter module parameters
/sys/module/nf_*/ r,
/sys/module/nf_*/parameters/{,*} r,

# various firewall related sysctl files
@{PROC}/sys/net/ipv4/conf/*/rp_filter w,
@{PROC}/sys/net/ipv{4,6}/conf/*/accept_source_route w,
Expand Down
4 changes: 4 additions & 0 deletions interfaces/builtin/network_control.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,10 @@ network sna,
@{PROC}/sys/net/netfilter/** rw,
@{PROC}/sys/net/nf_conntrack_max rw,

# read netfilter module parameters
/sys/module/nf_*/ r,
/sys/module/nf_*/parameters/{,*} r,

# networking tools
/{,usr/}{,s}bin/arp ixr,
/{,usr/}{,s}bin/arpd ixr,
Expand Down
19 changes: 18 additions & 1 deletion interfaces/builtin/unity7.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ import (
"github.com/snapcore/snapd/interfaces"
)

// http://bazaar.launchpad.net/~ubuntu-security/ubuntu-core-security/trunk/view/head:/data/apparmor/policygroups/ubuntu-core/16.04/unity7
const unity7ConnectedPlugAppArmor = `
# Description: Can access Unity7. Restricted because Unity 7 runs on X and
# requires access to various DBus services and this environment does not prevent
Expand All @@ -34,6 +33,10 @@ const unity7ConnectedPlugAppArmor = `
#include <abstractions/dbus-session-strict>
#include <abstractions/X>

# This is needed by QtSystems on X. For details see:
# https://bugs.launchpad.net/snapd/+bug/1663221/comments/3
network netlink raw,

#include <abstractions/fonts>
/var/cache/fontconfig/ r,
/var/cache/fontconfig/** mr,
Expand Down Expand Up @@ -433,6 +436,20 @@ dbus (receive)
member="{GetAll,GetLayout}"
peer=(label=unconfined),

# Allow requesting interest in receiving media key events. This tells Gnome
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❤️

# settings that our application should be notified when key events we are
# interested in are pressed.
dbus (send)
bus=session
interface=org.gnome.SettingsDaemon.MediaKeys
path=/org/gnome/SettingsDaemon/MediaKeys
peer=(label=unconfined),
dbus (send)
bus=session
interface=org.freedesktop.DBus.Properties
path=/org/gnome/SettingsDaemon/MediaKeys
member="Get{,All}"
peer=(label=unconfined),

# Lttng tracing is very noisy and should not be allowed by confined apps. Can
# safely deny. LP: #1260491
Expand Down