[apparmor] [PATCH] Entirely rework the Pidgin profile.

[intrigeri at debian.org]

From: intrigeri <intrigeri at boum.org>

Thanks a lot to Simon Deziel <simon.deziel at gmail.com> for working on this
with me.
---
 ubuntu/14.04/usr.bin.pidgin | 120 +++++++++++++++++++++-----------------------
 1 file changed, 58 insertions(+), 62 deletions(-)

diff --git a/ubuntu/14.04/usr.bin.pidgin b/ubuntu/14.04/usr.bin.pidgin
index 5fc462c..16f50bb 100644
--- a/ubuntu/14.04/usr.bin.pidgin
+++ b/ubuntu/14.04/usr.bin.pidgin
@@ -1,76 +1,72 @@
-# 
-#    AppArmor Pidgin profile for Ubuntu 9.04 Jaunty
-#    
-#    This program is free software; you can redistribute it and/or
-#    modify it under the terms of version 2 of the GNU General Public
-#    License published by the Free Software Foundation.
-#
+# vim:syntax=apparmor
 
 #include <tunables/global>
+
 /usr/bin/pidgin {
-	#include <abstractions/audio>
-	#include <abstractions/aspell>
-	#include <abstractions/bash>
-	#include <abstractions/consoles>
-	#include <abstractions/dbus>
-	#include <abstractions/gnome>
-	#include <abstractions/nameservice>
-	#include <abstractions/launchpad-integration>
-	#include <abstractions/user-download>
+  #include <abstractions/audio>
+  #include <abstractions/base>
+  #include <abstractions/bash>
+  #include <abstractions/dbus>
+  #include <abstractions/dbus-session>
+  #include <abstractions/enchant>
+  #include <abstractions/gnome>
+  #include <abstractions/ibus>
+  #include <abstractions/launchpad-integration>
+  #include <abstractions/nameservice>
+  #include <abstractions/private-files-strict>
+  #include <abstractions/ssl_certs>
+  #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-helpers>
+  #include <abstractions/user-download>
 
-	capability sys_ptrace,
+  deny capability sys_ptrace,
 
-	deny @{HOME}/.bash* rw,
-	deny @{HOME}/.cshrc rw,
-	deny @{HOME}/.profile rw,
-	deny @{HOME}/.ssh/* rw,
-	deny @{HOME}/.zshrc rw,
+  owner @{HOME}/.gstreamer*/ rw,
+  owner @{HOME}/.gstreamer*/** rw,
+  owner @{HOME}/.purple/ rw,
+  owner @{HOME}/.purple/** rwk,
+  owner @{HOME}/.{cache,config}/dconf/user rw,
+  owner @{HOME}/.config/indicators/ rw,
+  owner @{HOME}/.config/indicators/** rw,
+  owner @{HOME}/.local/share/applications/ r,
+  owner /{,var/}run/user/[0-9]*/dconf/user rwk,
 
-	owner @{HOME}/.config/enchant/ rw,
-	owner @{HOME}/.config/enchant/* rwk,
-	owner @{HOME}/.local/share/icons/ r,
-	owner @{HOME}/.local/share/mime/* r,
-	owner @{HOME}/.gnome2/nautilus-sendto/** rw,
-	owner @{HOME}/.gstreamer*/ rw,
-	owner @{HOME}/.gstreamer*/** rw,
-	owner @{HOME}/.pulse/ rw,
-	owner @{HOME}/.pulse/** rw,
-	owner @{HOME}/.pulse-cookie rwk,
-	owner @{HOME}/.purple/ rw,
-	owner @{HOME}/.purple/** rwk,
+  /bin/dash rix,
+  /bin/which rix,
 
-	/bin/dash rix,
+  # NB: the preferred browser and proxy settings must be configured
+  # in the GNOME preferences: this profile does not allow running
+  # the corresponding external configuration applications.
+  /usr/bin/gconftool-2 rPix,
+  /usr/bin/gnome-open rmix,
+  /usr/bin/gsettings rix,
+  /usr/bin/gvfs-open rmix,
+  /usr/bin/pidgin r,
+  /usr/bin/xdg-open rmix,
 
-	/{dev,run}/shm/ r,
-	/{dev,run}/shm/* rw,
+  /usr/share/gnome/applications/ r,
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
-	/etc/ r,
-	/etc/pulse/client.conf r,
-	/etc/ssl/certs/ r,
-	/etc/ssl/certs/ssl-cert-snakeoil.pem r,
+  /usr/lib/frei0r-1/*.so rm,
+  /usr/lib/@{multiarch}/libvisual-*/**.so rm,
+  /usr/lib/pidgin/*.so rm,
+  /usr/lib/purple*/*.so rm,
 
-	owner /tmp/orbit-*/* w,
-	owner /tmp/pulse-*/* w,
+  /usr/share/purple/ca-certs/ r,
+  /usr/share/purple/ca-certs/** r,
+  /usr/share/tcltk/** r,
+  /usr/share/themes/ r,
 
-	/usr/bin/gconftool-2 rix,
-	/usr/bin/gnome-default-applications-properties ix,
-	/usr/bin/gnome-network-preferences ix,
-	/usr/bin/gnome-open rmix,
-	/usr/bin/pidgin r,
-	/usr/bin/xdg-open rmix,
+  owner @{PROC}/[0-9]*/auxv r,
+  owner @{PROC}/[0-9]*/fd/ r,
 
-	/usr/lib/ r,
-	/usr/lib/firefox-*/firefox.sh Px,
-	/usr/lib/libvisual-*/**.so rm,
-	/usr/lib/pidgin/*.so rm,
-	/usr/lib/purple*/*.so rm,
+  # For sound notifications
+  owner /tmp/orcexec.* mr,
+  # ... if /tmp is mounted noexec
+  owner @{HOME}/orcexec.* mr,
+  owner /{,var/}run/user/[0-9]*/ r,
+  owner /{,var/}run/user/[0-9]*/orcexec.* mrw,
 
-	/usr/share/ca-certificates/*/** r,
-	/usr/share/enchant/enchant.ordering r,
-	/usr/share/locale-langpack/** rm,
-	/usr/share/purple/ca-certs/ r,
-	/usr/share/purple/ca-certs/** r,
-	/usr/share/myspell/dicts/ r,
-	/usr/share/myspell/dicts/** r,
-	/usr/share/tcltk/** r,
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.bin.pidgin>
 }
-- 
1.9.0