Provide an AppArmor profile for guest session lockdown.

diff --git a/NEWS b/NEWS
index 394827935bfab9acd8d91e29f84ddea77cc85cd4..d3db81f1bf00be37db0f5104fb8aa718c3bab2bc 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ Overview of changes in lightdm 1.1.0
     * Introduce a lightdm-guest-session-wrapper session command which MAC
       systems like AppArmor and SELinux can use for attaching a restrictive
       policy to guest sessions.
+    * Provide an AppArmor profile for guest session lockdown.
 
 Overview of changes in lightdm 1.0.0
 

diff --git a/data/Makefile.am b/data/Makefile.am
index 840982d90171ec52d46777152bbca1b1c2fa9e1a..590dd242c60eae70976a5571852a41211f807f8d 100644 (file)
--- a/data/Makefile.am
+++ b/data/Makefile.am
@@ -6,6 +6,15 @@ dist_conf_DATA = lightdm.conf users.conf keys.conf
 dbusconfdir = $(sysconfdir)/dbus-1/system.d
 dist_dbusconf_DATA = org.freedesktop.DisplayManager.conf
 
+EXTRA_DIST = guest-session.apparmor
+
+apparmor_profiledir = $(sysconfdir)/apparmor.d
+
+install-data-hook:
+       install -d $(DESTDIR)$(apparmor_profiledir)
+       sed 's!LIBEXECDIR!$(libexecdir)!g' < $(srcdir)/guest-session.apparmor \
+               > $(DESTDIR)$(apparmor_profiledir)/lightdm-guest-session
+
 dist_man1_MANS = lightdm.1
 
 DISTCLEANFILES = \

diff --git a/data/guest-session.apparmor b/data/guest-session.apparmor
new file mode 100644 (file)
index 0000000..ebe2ff1
--- /dev/null
+++ b/data/guest-session.apparmor
@@ -0,0 +1,51 @@
+# vim:syntax=apparmor
+# Profile for restricting lightdm guest session 
+# Author: Martin Pitt <martin.pitt@ubuntu.com>
+
+#include <tunables/global>
+
+LIBEXECDIR/lightdm-guest-session-wrapper {
+  #include <abstractions/authentication>
+  #include <abstractions/nameservice>
+  #include <abstractions/wutmp>
+  /etc/compizconfig/config rw, # bug in compiz https://launchpad.net/bugs/697678
+ 
+  / r,
+  /bin/ rmix,
+  /bin/** rmix,
+  /cdrom/ rmix,
+  /cdrom/** rmix,
+  /dev/ r,
+  /dev/** rmw, # audio devices etc.
+  owner /dev/shm/** rmw,
+  /etc/ r,
+  /etc/** rmk,
+  /etc/gdm/Xsession ix,
+  /lib/ r,
+  /lib/** rmixk,
+  /lib32/ r,
+  /lib32/** rmixk,
+  /media/ r,
+  /media/** rmwlixk,  # we want access to USB sticks and the like
+  /opt/ r,
+  /opt/** rmixk,
+  @{PROC}/ r,
+  @{PROC}/* rm,
+  @{PROC}/asound rm,
+  @{PROC}/asound/** rm,
+  owner @{PROC}/** rm,
+  /sbin/ r,
+  /sbin/** rmixk,
+  /sys/ r,
+  /sys/** rm,
+  /tmp/ rw,
+  owner /tmp/** rwlkmix,
+  /usr/ r,
+  /usr/** rmixk,
+  /var/ r,
+  /var/** rmixk,
+  /var/guest-data/** rw, # allow to store files permanently
+  /var/tmp/ rw,
+  owner /var/tmp/** rwlkm,
+  /{,var/}run/** rmwkix, # necessary for writing to sockets, etc.
+}