Current File : /var/lib/snapd/apparmor/profiles/snap.firefox.geckodriver
# vim:syntax=apparmor
#include <tunables/global>
#include if exists "/var/lib/snapd/apparmor/snap-tuning"
# snapd supports the concept of 'parallel installs' where snaps with the same
# name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz
# may all be installed on the system. To support this, SNAP_NAME is set to the
# name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg
# 'foo_bar'). The profile name and most rules therefore reference
# SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime
# environment so the snap doesn't have to be aware of the distinction (eg,
# SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with
# SNAP_NAME so the security policy will allow writing to both locations (since
# they are equivalent).
# This is a snap name without the instance key
@{SNAP_NAME}="firefox"
# This is a snap name with instance key
@{SNAP_INSTANCE_NAME}="firefox"
@{SNAP_INSTANCE_DESKTOP}="firefox"
@{SNAP_COMMAND_NAME}="geckodriver"
@{SNAP_REVISION}="5091"
@{PROFILE_DBUS}="snap_2efirefox_2egeckodriver"
@{INSTALL_DIR}="/{,var/lib/snapd/}snap"
profile "snap.firefox.geckodriver" flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/openssl>
# While in later versions of the base abstraction, include this explicitly
# for series 16 and cross-distro
/etc/ld.so.preload r,
# The base abstraction doesn't yet have this
/etc/sysconfig/clock r,
owner @{PROC}/@{pid}/maps k,
# /proc/XXXX/map_files contains the same info than /proc/XXXX/maps, but
# in a format that is simpler to manage, because it doesn't require to
# parse the text data inside a file, but just reading the contents of
# a directory.
# Reading /proc/XXXX/maps is already allowed in the base template
# via <abstractions/base>. Also, only the owner can read it, and the
# kernel limits access to it by requiring 'ptrace' enabled, so allowing
# to access /proc/XXXX/map_files can be considered secure too.
owner @{PROC}/@{pid}/map_files/ r,
# While the base abstraction has rules for encryptfs encrypted home and
# private directories, it is missing rules for directory read on the toplevel
# directory of the mount (LP: #1848919)
owner @{HOME}/.Private/ r,
owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
# for python apps/services
#include <abstractions/python>
/etc/python3.[0-9]*/** r,
# explicitly deny noisy denials to read-only filesystems (see LP: #1496895
# for details)
deny /usr/lib/python3*/{,**/}__pycache__/ w,
deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w,
# bind mount used here (see 'parallel installs', above)
deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/ w,
deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w,
# for perl apps/services
#include <abstractions/perl>
# Missing from perl abstraction
/usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr,
# Note: the following dangerous accesses should not be allowed in most
# policy, but we cannot explicitly deny since other trusted interfaces might
# add them.
# Explicitly deny ptrace for now since it can be abused to break out of the
# seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
#audit deny ptrace (trace),
# Explicitly deny capability mknod so apps can't create devices
#audit deny capability mknod,
# Explicitly deny mount, remount and umount so apps can't modify things in
# their namespace
#audit deny mount,
#audit deny remount,
#audit deny umount,
# End dangerous accesses
# Note: this potentially allows snaps to DoS other snaps via resource
# exhaustion but we can't sensibly mediate this today. In the future we may
# employ cgroup limits, AppArmor rlimit mlock rules or something else.
capability ipc_lock,
# for bash 'binaries' (do *not* use abstractions/bash)
# user-specific bash files
/etc/bash.bashrc r,
/etc/inputrc r,
/etc/environment r,
/etc/profile r,
# user/group/seat lookups
/etc/{passwd,group,nsswitch.conf} r, # very common
/var/lib/extrausers/{passwd,group} r,
/run/systemd/users/[0-9]* r,
/etc/default/nss r,
# libnss-systemd (subset from nameservice abstraction)
#
# https://systemd.io/USER_GROUP_API/
# https://systemd.io/USER_RECORD/
# https://www.freedesktop.org/software/systemd/man/nss-systemd.html
#
# Allow User/Group lookups via common VarLink socket APIs. Applications need
# to either consult all of them or the io.systemd.Multiplexer frontend.
/run/systemd/userdb/ r,
/run/systemd/userdb/io.systemd.Multiplexer rw,
/run/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users
/run/systemd/userdb/io.systemd.Home rw, # systemd-home dirs
/run/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS
/run/systemd/userdb/io.systemd.Machine rw, # systemd-machined
/etc/libnl-3/{classid,pktloc} r, # apps that use libnl
# For snappy reexec on 4.8+ kernels
/usr/lib/snapd/snap-exec m,
# For gdb support
/usr/lib/snapd/snap-gdb-shim ixr,
/usr/lib/snapd/snap-gdbserver-shim ixr,
# For in-snap tab completion
/etc/bash_completion.d/{,*} r,
/usr/lib/snapd/etelpmoc.sh ixr, # marshaller (see complete.sh for out-of-snap unmarshal)
/usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here
# uptime
@{PROC}/uptime r,
@{PROC}/loadavg r,
# Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib
# which is allowed by the base abstraction, but on 14.04 it is an actual file
# so need to add it here. Also allow read locks on the file.
/etc/os-release rk,
/usr/lib/os-release k,
# systemd native journal API (see sd_journal_print(4)). This should be in
# AppArmor's base abstraction, but until it is, include here. We include
# the base journal path as well as the journal namespace pattern path. Each
# journal namespace for quota groups will be prefixed with 'snap-'.
/run/systemd/journal{,.snap-*}/socket w,
/run/systemd/journal{,.snap-*}/stdout rw, # 'r' shouldn't be needed, but journald
# doesn't leak anything so allow
# snapctl and its requirements
/usr/bin/snapctl ixr,
/usr/lib/snapd/snapctl ixr,
@{PROC}/sys/net/core/somaxconn r,
/run/snapd-snap.socket rw,
# Note: for now, don't explicitly deny this noisy denial so --devmode isn't
# broken but eventually we may conditionally deny this since it is an
# information leak.
#deny /{,var/}run/utmp r,
# java
@{PROC}/@{pid}/ r,
@{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/auxv r,
@{PROC}/sys/vm/zone_reclaim_mode r,
/etc/lsb-release r,
/sys/devices/**/read_ahead_kb r,
/sys/devices/system/cpu/** r,
/sys/devices/system/node/node[0-9]*/* r,
/sys/kernel/mm/transparent_hugepage/enabled r,
/sys/kernel/mm/transparent_hugepage/defrag r,
# NOTE: this leaks running process but java seems to want it (even though it
# seems to operate ok without it) and SDL apps crash without it. Allow owner
# match until AppArmor kernel var is available to solve this properly (see
# LP: #1546825 for details). comm is a subset of cmdline, so allow it too.
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
# Per man(5) proc, the kernel enforces that a thread may only modify its comm
# value or those in its thread group.
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
# Allow reading and writing to our file descriptors in /proc which, for
# example, allow access to /dev/std{in,out,err} which are all symlinks to
# /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE)
# linkat() temporary file technique, allow all fds. Importantly, access to
# another task's fd via this proc interface is mediated via 'ptrace (read)'
# (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so
# this rule by itself doesn't allow opening another snap's fds via proc.
owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw,
# Miscellaneous accesses
/dev/{,u}random w,
/etc/machine-id r,
/etc/mime.types r,
/etc/default/keyboard r,
@{PROC}/ r,
@{PROC}/version r,
@{PROC}/version_signature r,
/etc/{,writable/}hostname r,
/etc/{,writable/}localtime r,
/etc/{,writable/}mailname r,
/etc/{,writable/}timezone r,
owner @{PROC}/@{pid}/cgroup rk,
@{PROC}/@{pid}/cpuset r,
@{PROC}/@{pid}/io r,
owner @{PROC}/@{pid}/limits r,
owner @{PROC}/@{pid}/loginuid r,
@{PROC}/@{pid}/smaps r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/statm r,
@{PROC}/@{pid}/status r,
@{PROC}/@{pid}/task/ r,
@{PROC}/@{pid}/task/[0-9]*/smaps r,
@{PROC}/@{pid}/task/[0-9]*/stat r,
@{PROC}/@{pid}/task/[0-9]*/statm r,
@{PROC}/@{pid}/task/[0-9]*/status r,
@{PROC}/sys/fs/pipe-max-size r,
@{PROC}/sys/kernel/hostname r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/ostype r,
@{PROC}/sys/kernel/pid_max r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/sys/kernel/shmmax r,
# Allow apps to introspect the level of dbus mediation AppArmor implements.
/sys/kernel/security/apparmor/features/dbus/mask r,
@{PROC}/sys/fs/file-max r,
@{PROC}/sys/fs/file-nr r,
@{PROC}/sys/fs/inotify/max_* r,
@{PROC}/sys/kernel/pid_max r,
@{PROC}/sys/kernel/random/boot_id r,
@{PROC}/sys/kernel/random/entropy_avail r,
@{PROC}/sys/kernel/random/uuid r,
@{PROC}/sys/kernel/cap_last_cap r,
# Allow access to the uuidd daemon (this daemon is a thin wrapper around
# time and getrandom()/{,u}random and, when available, runs under an
# unprivilged, dedicated user).
/run/uuidd/request rw,
/sys/devices/virtual/tty/{console,tty*}/active r,
/sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r,
/sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r,
/sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.stat r,
/sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r,
/sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r,
/sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r,
/sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r,
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/sys/module/apparmor/parameters/enabled r,
/{,usr/}lib/ r,
# Reads of oom_adj and oom_score_adj are safe
owner @{PROC}/@{pid}/oom_{,score_}adj r,
# Note: for now, don't explicitly deny write access so --devmode isn't broken
# but eventually we may conditionally deny this since it allows the process
# to increase the oom heuristic of other processes (make them more likely to
# be killed). Once AppArmor kernel var is available to solve this properly,
# this can safely be allowed since non-root processes won't be able to
# decrease the value and root processes will only be able to with
# 'capability sys_resource,' which we deny be default.
# deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
# Eases hardware assignment (doesn't give anything away)
/etc/udev/udev.conf r,
/sys/ r,
/sys/bus/ r,
/sys/class/ r,
# this leaks interface names and stats, but not in a way that is traceable
# to the user/device
@{PROC}/net/dev r,
@{PROC}/@{pid}/net/dev r,
# Read-only of this snap
/var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r,
# Read-only of snapd restart state for snapctl specifically
/var/lib/snapd/maintenance.json r,
# Read-only for the install directory
# bind mount used here (see 'parallel installs', above)
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r,
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/ r,
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/** mrklix,
# Read-only install directory for other revisions to help with bugs like
# LP: #1616650 and LP: #1655992
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
# Read-only home area for other versions
# bind mount *not* used here (see 'parallel installs', above)
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/ r,
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/** mrkix,
# Experimental snap folder changes
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/ r,
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/** mrkix,
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/common/** wl,
owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/ r,
owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/** mrkixwl,
# Writable home area for this version.
# bind mount *not* used here (see 'parallel installs', above)
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl,
# Read-only system area for other versions
# bind mount used here (see 'parallel installs', above)
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r,
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
# Writable system area only for this version
# bind mount used here (see 'parallel installs', above)
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl,
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl,
# The ubuntu-core-launcher creates an app-specific private restricted /tmp
# and will fail to launch the app if something goes wrong. As such, we can
# simply allow full access to /tmp.
/tmp/ r,
/tmp/** mrwlkix,
# App-specific access to files and directories in /dev/shm. We allow file
# access in /dev/shm for shm_open() and files in subdirectories for open()
# bind mount *not* used here (see 'parallel installs', above)
/{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix,
# Also allow app-specific access for sem_open()
/{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk,
# Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
# bind mount *not* used here (see 'parallel installs', above)
owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/ rw,
owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
# Allow apps from the same package to communicate with each other via an
# abstract or anonymous socket
unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**",
unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
# Allow apps from the same package to communicate with each other via DBus.
# Note: this does not grant access to the DBus sockets of well known buses
# (will still need to use an appropriate interface for that).
dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
# In addition to the above, dbus-run-session attempts reading these files
# from the snap base runtime.
/usr/share/dbus-1/services/{,*} r,
/usr/share/dbus-1/system-services/{,*} r,
# Allow apps to perform DBus introspection on org.freedesktop.DBus for both
# the system and session buses.
# Note: this does not grant access to the DBus sockets of these buses, but
# we grant it here since it is missing from the dbus abstractions
# (LP: #1866168)
dbus (send)
bus={session,system}
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
# Allow apps from the same package to signal each other via signals
signal peer=snap.@{SNAP_INSTANCE_NAME}.*,
# Allow receiving signals from all snaps (and focus on mediating sending of
# signals)
signal (receive) peer=snap.*,
# Allow receiving signals from unconfined (eg, systemd)
signal (receive) peer=unconfined,
# for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign'
/{,usr/}{,s}bin/udevadm ixr,
/etc/udev/udev.conf r,
/{,var/}run/udev/tags/snappy-assign/ r,
@{PROC}/cmdline r,
/sys/devices/**/uevent r,
# LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above
# requires:
# /run/udev/data/* r,
# but that reveals too much about the system and cannot be granted to apps
# by default at this time.
# For convenience, allow apps to see what is in /dev even though cgroups
# will block most access
/dev/ r,
/dev/**/ r,
# Allow setting up pseudoterminal via /dev/pts system. This is safe because
# the launcher uses a per-app devpts newinstance.
/dev/ptmx rw,
# Do the same with /sys/devices and /sys/class to help people using hw-assign
/sys/devices/ r,
/sys/devices/**/ r,
/sys/class/ r,
/sys/class/**/ r,
# Allow all snaps to chroot
capability sys_chroot,
# Lttng tracing is very noisy and should not be allowed by confined apps. Can
# safely deny for the normal case (LP: #1260491). If/when an lttng-trace
# interface is needed, we can rework this.
deny /{dev,run,var/run}/shm/lttng-ust-* rw,
# Allow read-access on /home/ for navigating to other parts of the
# filesystem. While this allows enumerating users, this is already allowed
# via /etc/passwd and getent.
@{HOMEDIRS}/ r,
# Allow read-access to / for navigating to other parts of the filesystem.
/ r,
# Snap-specific run directory. Bind mount *not* used here
# (see 'parallel installs', above)
/run/snap.@{SNAP_INSTANCE_NAME}/ rw,
/run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
# Snap-specific lock directory and prerequisite navigation permissions.
/run/lock/ r,
/run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw,
/run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
# Default rules for core base runtimes
# The base abstraction doesn't yet have this
/{,usr/}lib/terminfo/** rk,
/usr/share/terminfo/** k,
/usr/share/zoneinfo/** k,
# for python apps/services
/usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr,
# additional accesses needed for newer pythons in later bases
/usr/lib{,32,64}/python3.[0-9]*/**.{pyc,so} mr,
/usr/lib{,32,64}/python3.[0-9]*/**.{egg,py,pth} r,
/usr/lib{,32,64}/python3.[0-9]*/{site,dist}-packages/ r,
/usr/lib{,32,64}/python3.[0-9]*/lib-dynload/*.so mr,
/usr/include/python3.[0-9]*/pyconfig.h r,
# for perl apps/services
/usr/bin/perl{,5*} ixr,
# AppArmor <2.12 doesn't have rules for perl-base, so add them here
/usr/lib/@{multiarch}/perl{,5,-base}/** r,
/usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,
# for bash 'binaries' (do *not* use abstractions/bash)
# user-specific bash files
/{,usr/}bin/bash ixr,
/{,usr/}bin/dash ixr,
/usr/share/terminfo/** r,
# Common utilities for shell scripts
/{,usr/}bin/arch ixr,
/{,usr/}bin/{,g,m}awk ixr,
/{,usr/}bin/base32 ixr,
/{,usr/}bin/base64 ixr,
/{,usr/}bin/basename ixr,
/{,usr/}bin/bunzip2 ixr,
/{,usr/}bin/busctl ixr,
/{,usr/}bin/bzcat ixr,
/{,usr/}bin/bzdiff ixr,
/{,usr/}bin/bzgrep ixr,
/{,usr/}bin/bzip2 ixr,
/{,usr/}bin/cat ixr,
/{,usr/}bin/chgrp ixr,
/{,usr/}bin/chmod ixr,
/{,usr/}bin/chown ixr,
/{,usr/}bin/clear ixr,
/{,usr/}bin/cmp ixr,
/{,usr/}bin/cp ixr,
/{,usr/}bin/cpio ixr,
/{,usr/}bin/cut ixr,
/{,usr/}bin/date ixr,
/{,usr/}bin/dbus-daemon ixr,
/{,usr/}bin/dbus-run-session ixr,
/{,usr/}bin/dbus-send ixr,
/{,usr/}bin/dd ixr,
/{,usr/}bin/diff{,3} ixr,
/{,usr/}bin/dir ixr,
/{,usr/}bin/dirname ixr,
/{,usr/}bin/du ixr,
/{,usr/}bin/echo ixr,
/{,usr/}bin/{,e,f,r}grep ixr,
/{,usr/}bin/env ixr,
/{,usr/}bin/expr ixr,
/{,usr/}bin/false ixr,
/{,usr/}bin/find ixr,
/{,usr/}bin/flock ixr,
/{,usr/}bin/fmt ixr,
/{,usr/}bin/fold ixr,
/{,usr/}bin/getconf ixr,
/{,usr/}bin/getent ixr,
/{,usr/}bin/getopt ixr,
/{,usr/}bin/groups ixr,
/{,usr/}bin/gzip ixr,
/{,usr/}bin/head ixr,
/{,usr/}bin/hostname ixr,
/{,usr/}bin/id ixr,
/{,usr/}bin/igawk ixr,
/{,usr/}bin/infocmp ixr,
/{,usr/}bin/kill ixr,
/{,usr/}bin/ldd ixr,
/{usr/,}lib{,32,64}/ld{,32,64}-*.so ix,
/{usr/,}lib/@{multiarch}/ld{,32,64}-*.so* ix,
/{,usr/}bin/less{,file,pipe} ixr,
/{,usr/}bin/ln ixr,
/{,usr/}bin/line ixr,
/{,usr/}bin/link ixr,
/{,usr/}bin/locale ixr,
/{,usr/}bin/logger ixr,
/{,usr/}bin/ls ixr,
/{,usr/}bin/md5sum ixr,
/{,usr/}bin/mkdir ixr,
/{,usr/}bin/mkfifo ixr,
/{,usr/}bin/mknod ixr,
/{,usr/}bin/mktemp ixr,
/{,usr/}bin/more ixr,
/{,usr/}bin/mv ixr,
/{,usr/}bin/nice ixr,
/{,usr/}bin/nohup ixr,
/{,usr/}bin/numfmt ixr,
/{,usr/}bin/od ixr,
/{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
/{,usr/}bin/paste ixr,
/{,usr/}bin/pgrep ixr,
/{,usr/}bin/printenv ixr,
/{,usr/}bin/printf ixr,
/{,usr/}bin/ps ixr,
/{,usr/}bin/pwd ixr,
/{,usr/}bin/readlink ixr,
/{,usr/}bin/realpath ixr,
/{,usr/}bin/rev ixr,
/{,usr/}bin/rm ixr,
/{,usr/}bin/rmdir ixr,
/{,usr/}bin/run-parts ixr,
/{,usr/}bin/sed ixr,
/{,usr/}bin/seq ixr,
/{,usr/}bin/sha{1,224,256,384,512}sum ixr,
/{,usr/}bin/shuf ixr,
/{,usr/}bin/sleep ixr,
/{,usr/}bin/sort ixr,
/{,usr/}bin/stat ixr,
/{,usr/}bin/stdbuf ixr,
/{,usr/}bin/stty ixr,
/{,usr/}bin/sync ixr,
/{,usr/}bin/systemd-cat ixr,
/{,usr/}bin/tac ixr,
/{,usr/}bin/tail ixr,
/{,usr/}bin/tar ixr,
/{,usr/}bin/tee ixr,
/{,usr/}bin/test ixr,
/{,usr/}bin/tempfile ixr,
/{,usr/}bin/tset ixr,
/{,usr/}bin/touch ixr,
/{,usr/}bin/tput ixr,
/{,usr/}bin/tr ixr,
/{,usr/}bin/true ixr,
/{,usr/}bin/tty ixr,
/{,usr/}bin/uname ixr,
/{,usr/}bin/uniq ixr,
/{,usr/}bin/unlink ixr,
/{,usr/}bin/unxz ixr,
/{,usr/}bin/unzip ixr,
/{,usr/}bin/uptime ixr,
/{,usr/}bin/vdir ixr,
/{,usr/}bin/wc ixr,
/{,usr/}bin/which{,.debianutils} ixr,
/{,usr/}bin/xargs ixr,
/{,usr/}bin/xz ixr,
/{,usr/}bin/yes ixr,
/{,usr/}bin/zcat ixr,
/{,usr/}bin/z{,e,f}grep ixr,
/{,usr/}bin/zip ixr,
/{,usr/}bin/zipgrep ixr,
# lsb-release
/usr/bin/lsb_release ixr,
/usr/bin/ r,
/usr/share/distro-info/*.csv r,
# For printing the cache (we don't allow updating the cache)
/{,usr/}sbin/ldconfig{,.real} ixr,
# Allow all snaps to chroot
/{,usr/}sbin/chroot ixr,
# Rules added by the mount-control interface
capability sys_admin, # for mount
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/self/mountinfo r,
/{,usr/}bin/mount ixr,
/{,usr/}bin/umount ixr,
# mount/umount (via libmount) track some mount info in these files
/run/mount/utab* wrlk,
mount options=(ro,bind,noatime,noexec) "/usr/share/hunspell" -> "/var/snap/firefox/common/host-hunspell{,/}",
umount "/var/snap/firefox/common/host-hunspell{,/}",
# Access for communication with audio recording service done via
# audio-playback interface. The audio service will verify if the audio-record
# interface is connected.
# Allow access to the Wayland compositor server socket
owner /run/user/[0-9]*/wayland-[0-9]* rw,
# Needed when using QT_QPA_PLATFORM=wayland-egl (MESA dri config)
/etc/drirc r,
# Allow communicating with pulseaudio service
/{run,dev}/shm/pulse-shm-* mrwk,
owner /{,var/}run/pulse/ r,
owner /{,var/}run/pulse/native rwk,
owner /{,var/}run/pulse/pid r,
owner /{,var/}run/user/[0-9]*/ r,
owner /{,var/}run/user/[0-9]*/pulse/ r,
/run/udev/data/c116:[0-9]* r,
/run/udev/data/+sound:card[0-9]* r,
# Allow communicating with pulseaudio service on the desktop in classic distro.
# Only on desktop do we need access to /etc/pulse for any PulseAudio client
# to read available client side configuration settings. On an Ubuntu Core
# device those things will be stored inside the snap directory.
/etc/pulse/ r,
/etc/pulse/** r,
owner @{HOME}/.pulse-cookie rk,
owner @{HOME}/.config/pulse/cookie rk,
owner /{,var/}run/user/*/pulse/ r,
owner /{,var/}run/user/*/pulse/native rwk,
owner /{,var/}run/user/*/pulse/pid r,
# Allow communicating with the cups server for printing and configuration.
#include <abstractions/cups-client>
/{,var/}run/cups/printcap r,
# Allow receiving all DBus signal notifications from the daemon (see
# notifier/dbus.c in cups sources)
dbus (receive)
bus=system
path=/org/cups/cupsd/Notifier
interface=org.cups.cupsd.Notifier
peer=(label="{unconfined,/usr/sbin/cupsd,cupsd}"),
# Allow reading login and session information
/{,usr/}bin/who ixr,
/var/log/wtmp rk,
/{,var/}run/utmp rk,
/{,usr/}bin/lastlog ixr,
/var/log/lastlog rk,
/{,usr/}bin/faillog ixr,
/var/log/faillog rk,
# systemd session information (session files, but not .ref files)
/run/systemd/sessions/ r,
/run/systemd/sessions/*[0-9] rk,
# Supported loginctl commands:
# - list-sessions
# - show-session N
# - list-users
# - show-user N
# - list-seats
# - show-seat N
/{,usr/}bin/loginctl ixr,
#include <abstractions/dbus-strict>
# Introspection of org.freedesktop.login1
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
dbus (send)
bus=system
path=/org/freedesktop/login1{,/seat/*,/session/*,/user/*}
interface=org.freedesktop.DBus.Properties
member=Get{,All},
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(label=unconfined),
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={Session,User,Seat}New
peer=(label=unconfined),
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={Session,User,Seat}Removed
peer=(label=unconfined),
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=PrepareFor{Shutdow,Sleep}
peer=(label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=List{Seats,Sessions,Users},
dbus (send)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Get{Seat,Session,User},
# Allow unconfined clients to interact with the player on classic
dbus (receive)
bus=session
path=/org/mpris/MediaPlayer2
peer=(label=unconfined),
dbus (receive)
bus=session
interface=org.freedesktop.DBus.Introspectable
peer=(label=unconfined),
# Description: Allow operating as an MPRIS player.
# DBus accesses
#include <abstractions/dbus-session-strict>
# https://specifications.freedesktop.org/mpris-spec/latest/
# allow binding to the well-known DBus mpris interface based on the snap's name
dbus (bind)
bus=session
name="org.mpris.MediaPlayer2.@{SNAP_INSTANCE_NAME}{,.*}",
# register as a player
dbus (send)
bus=system
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member="{Request,Release}Name"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member="GetConnectionUnix{ProcessID,User}"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=session
path=/org/mpris/MediaPlayer2
interface=org.freedesktop.DBus.Properties
member="{GetAll,PropertiesChanged}"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=session
path=/org/mpris/MediaPlayer2
interface="org.mpris.MediaPlayer2{,.Player}"
peer=(name=org.freedesktop.DBus, label=unconfined),
# we can always connect to ourselves
dbus (receive)
bus=session
path=/org/mpris/MediaPlayer2
peer=(label=@{profile_name}),
# Description: Allow owning a name on DBus public bus
#include <abstractions/dbus-session-strict>
# register on DBus
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member="{Request,Release}Name"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member="GetConnectionUnix{ProcessID,User}"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member="GetConnectionCredentials"
peer=(name=org.freedesktop.DBus, label=unconfined),
# bind to a well-known DBus name: org.mozilla.firefox
dbus (bind)
bus=session
name=org.mozilla.firefox,
# For KDE applications and some other cases, also support alternation for:
# - using org.kde.foo-PID as the 'well-known' name
# - using org.foo.cmd_<num>_<num> as the 'well-known' name
# Note, snapd does not allow declaring a 'well-known' name that ends with
# '-[0-9]+' or that contains '_'. Parallel installs of DBus services aren't
# supported at this time, but if they were, this could allow a parallel
# install'swell-known name to overlap with the normal install.
dbus (bind)
bus=session
name=org.mozilla.firefox{_,-}[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}{,_[1-9]{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9_]}{,[0-9]}},
# For Firefox, support using org.mozilla.firefox.<id> as the 'well-known' name
# where <id> is the base64-encoded profile name.
# See https://bugzilla.mozilla.org/1441894 for a discussion and details.
dbus (bind)
bus=session
name="org.mozilla.firefox.*",
# Allow us to talk to dbus-daemon
dbus (receive)
bus=session
path="/org/mozilla/firefox{,/**}"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=session
path="/org/mozilla/firefox{,/**}"
interface=org.freedesktop.DBus.Properties
peer=(name=org.freedesktop.DBus, label=unconfined),
# Allow us to introspect org.freedesktop.DBus (needed by pydbus)
dbus (send)
bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=org.freedesktop.DBus, label=unconfined),
# Description: Allow reading and writing to joystick devices
#
# Old joystick interface
#
# Per https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/devices.txt
# only js0-js31 is valid so limit the /dev and udev entries to those devices.
/dev/input/js{[0-9],[12][0-9],3[01]} rw,
/run/udev/data/c13:{[0-9],[12][0-9],3[01]} r,
#
# New evdev-joystick interface
#
# Per https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/devices.txt
# the minor is 65 and up so limit udev to that.
/run/udev/data/c13:{6[5-9],[7-9][0-9],[1-9][0-9][0-9]*} r,
# /dev/input/event* is unfortunately not namespaced and includes all input
# devices, including keyboards and mice, which allows input sniffing and
# injection. Until we have inode tagging of devices, we use a glob rule here
# and rely on udev tagging to only add evdev devices to the snap's device
# cgroup that are marked with ENV{ID_INPUT_JOYSTICK}=="1". As such, even though
# AppArmor allows all evdev, the device cgroup does not.
/dev/input/event[0-9]* rw,
# Allow reading for supported event reports for all input devices. See
# https://www.kernel.org/doc/Documentation/input/event-codes.txt
# FIXME: this is a very minor information leak and snapd should instead query
# udev for the specific accesses associated with the above devices.
/sys/devices/**/input[0-9]*/capabilities/* r,
# Description: Allow write access to u2f hidraw devices.
# Use a glob rule and rely on device cgroup for mediation.
/dev/hidraw* rw,
# char 234-254 are used for dynamic assignment, which u2f devices are
/run/udev/data/c23[4-9]:* r,
/run/udev/data/c24[0-9]:* r,
/run/udev/data/c25[0-4]:* r,
# misc required accesses
/run/udev/data/+power_supply:hid* r,
/run/udev/data/c14:[0-9]* r,
/sys/devices/**/i2c*/**/report_descriptor r,
/sys/devices/**/usb*/**/report_descriptor r,
# Description: Can access Unity7. Note, Unity 7 runs on X and requires access
# to various DBus services and this environment does not prevent eavesdropping
# or apps interfering with one another.
#include <abstractions/dbus-strict>
#include <abstractions/dbus-session-strict>
# Allow finding the DBus session bus id (eg, via dbus_bus_get_id())
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetId
peer=(name=org.freedesktop.DBus, label=unconfined),
#include <abstractions/X>
#include <abstractions/fonts>
owner @{HOME}/.local/share/fonts/{,**} r,
/var/cache/fontconfig/ r,
/var/cache/fontconfig/** mr,
# subset of gnome abstraction
/etc/gnome/defaults.list r,
/etc/gtk-*/* r,
/usr/lib{,32,64}/gtk-*/** mr,
/usr/lib{,32,64}/gdk-pixbuf-*/** mr,
/usr/lib/@{multiarch}/gtk-*/** mr,
/usr/lib/@{multiarch}/gdk-pixbuf-*/** mr,
/etc/pango/* r,
/usr/lib{,32,64}/pango/** mr,
/usr/lib/@{multiarch}/pango/** mr,
/usr/share/icons/ r,
/usr/share/icons/** r,
/usr/share/icons/*/index.theme rk,
/usr/share/pixmaps/ r,
/usr/share/pixmaps/** r,
# The snapcraft desktop part may look for schema files in various locations, so
# allow reading system installed schemas.
/usr/share/glib*/schemas/{,*} r,
# Snappy's 'xdg-open' talks to the snapd-xdg-open service which currently works
# only in environments supporting dbus-send (eg, X11). In the future once
# snappy's xdg-open supports all snaps images, this access may move to another
# interface. This is duplicated from desktop for compatibility with existing
# snaps.
/usr/bin/xdg-open ixr,
# While /usr/share/applications comes from the base runtime of the snap, it
# has some things that snaps actually need, so allow access to those and deny
# access to the others. This is duplicated from desktop for compatibility with
# existing snaps.
/usr/share/applications/ r,
/usr/share/applications/mimeapps.list r,
/usr/share/applications/xdg-open.desktop r,
# silence noisy denials from desktop files in core* snaps that aren't usable by
# snaps
deny /usr/share/applications/python*.desktop r,
deny /usr/share/applications/vim.desktop r,
deny /usr/share/applications/snap-handle-link.desktop r, # core16
# This allow access to the first version of the snapd-xdg-open
# version which was shipped outside of snapd
dbus (send)
bus=session
path=/
interface=com.canonical.SafeLauncher
member=OpenURL
peer=(label=unconfined),
# ... and this allows access to the new xdg-open service which
# is now part of snapd itself.
dbus (send)
bus=session
path=/io/snapcraft/Launcher
interface=io.snapcraft.Launcher
member={OpenURL,OpenFile}
peer=(label=unconfined),
# Allow use of snapd's internal 'xdg-settings'
/usr/bin/xdg-settings ixr,
dbus (send)
bus=session
path=/io/snapcraft/Settings
interface=io.snapcraft.Settings
member={Check,CheckSub,Get,GetSub,Set,SetSub}
peer=(label=unconfined),
# input methods (ibus)
# subset of ibus abstraction
/usr/lib/@{multiarch}/gtk-2.0/[0-9]*/immodules/im-ibus.so mr,
owner @{HOME}/.config/ibus/ r,
owner @{HOME}/.config/ibus/bus/ r,
owner @{HOME}/.config/ibus/bus/* r,
# allow communicating with ibus-daemon (this allows sniffing key events)
unix (connect, receive, send)
type=stream
peer=(addr="@/tmp/ibus/dbus-*"),
# abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache)
# This should use this, but due to LP: #1856738 we cannot
#unix (connect, receive, send)
# type=stream
# peer=(addr="@@{HOME}/.cache/ibus/dbus-*"),
unix (connect, receive, send)
type=stream
peer=(addr="@/home/*/.cache/ibus/dbus-*"),
# input methods (mozc)
# allow communicating with mozc server (TODO: investigate if allows sniffing)
unix (connect, receive, send)
type=stream
peer=(addr="@tmp/.mozc.*"),
# input methods (fcitx)
# allow communicating with fcitx dbus service
dbus send
bus=fcitx
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
peer=(name=org.freedesktop.DBus),
owner @{HOME}/.config/fcitx/dbus/* r,
# allow creating an input context
dbus send
bus={fcitx,session}
path=/inputmethod
interface=org.fcitx.Fcitx.InputMethod
member=CreateIC*
peer=(label=unconfined),
# allow setting up and tearing down the input context
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="{Close,Destroy,Enable}IC"
peer=(label=unconfined),
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member=Reset
peer=(label=unconfined),
# allow service to send us signals
dbus receive
bus=fcitx
peer=(label=unconfined),
dbus receive
bus=session
interface=org.fcitx.Fcitx.*
peer=(label=unconfined),
# use the input context
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="Focus{In,Out}"
peer=(label=unconfined),
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="{CommitPreedit,Set*}"
peer=(label=unconfined),
# this is an information leak and allows key and mouse sniffing. If the input
# context path were tied to the process' security label, this would not be an
# issue.
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="{MouseEvent,ProcessKeyEvent}"
peer=(label=unconfined),
# this method does not exist with the sunpinyin backend (at least), so allow
# it for other input methods. This may consitute an information leak (which,
# again, could be avoided if the path were tied to the process' security
# label).
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(label=unconfined),
# Needed by QtSystems on X to detect mouse and keyboard. Note, the 'netlink
# raw' rule is not finely mediated by apparmor so we mediate with seccomp arg
# filtering.
network netlink raw,
/run/udev/data/c13:[0-9]* r,
/run/udev/data/+input:* r,
# subset of freedesktop.org
/usr/share/mime/** r,
owner @{HOME}/.local/share/mime/** r,
owner @{HOME}/.config/user-dirs.* r,
/etc/xdg/user-dirs.conf r,
/etc/xdg/user-dirs.defaults r,
# gtk settings (subset of gnome abstraction)
owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini r,
owner @{HOME}/.config/gtk-3.0/settings.ini r,
# Note: this leaks directory names that wouldn't otherwise be known to the snap
owner @{HOME}/.config/gtk-3.0/bookmarks r,
# accessibility
#include <abstractions/dbus-accessibility-strict>
dbus (send)
bus=session
path=/org/a11y/bus
interface=org.a11y.Bus
member=GetAddress
peer=(label=unconfined),
dbus (send)
bus=session
path=/org/a11y/bus
interface=org.freedesktop.DBus.Properties
member=Get{,All}
peer=(label=unconfined),
# unfortunate, but org.a11y.atspi is not designed for separation
dbus (receive, send)
bus=accessibility
path=/org/a11y/atspi/**
peer=(label=unconfined),
# org.freedesktop.Accounts
dbus (send)
bus=system
path=/org/freedesktop/Accounts
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/Accounts
interface=org.freedesktop.Accounts
member=FindUserById
peer=(label=unconfined),
# Get() is an information leak
# TODO: verify what it is leaking
dbus (receive, send)
bus=system
path=/org/freedesktop/Accounts/User[0-9]*
interface=org.freedesktop.DBus.Properties
member={Get,PropertiesChanged}
peer=(label=unconfined),
# gmenu
# Note: the gmenu DBus api was not designed for application isolation and apps
# may specify anything as their 'path'. For example, these work in the many
# cases:
# - /org/gtk/Application/anonymous{,/**}
# - /com/canonical/unity/gtk/window/[0-9]*
# but libreoffice does:
# - /org/libreoffice{,/**}
# As such, cannot mediate by DBus path so we'll be as strict as we can in the
# other mediated parts
dbus (send)
bus=session
interface=org.gtk.Actions
member=Changed
peer=(label=unconfined),
dbus (receive)
bus=session
interface=org.gtk.Actions
member={Activate,DescribeAll,SetState}
peer=(label=unconfined),
dbus (receive)
bus=session
interface=org.gtk.Menus
member={Start,End}
peer=(label=unconfined),
dbus (send)
bus=session
interface=org.gtk.Menus
member=Changed
peer=(label=unconfined),
# Ubuntu menus
dbus (send)
bus=session
path="/com/ubuntu/MenuRegistrar"
interface="com.ubuntu.MenuRegistrar"
member="{Register,Unregister}{App,Surface}Menu"
peer=(label=unconfined),
# url helper
dbus (send)
bus=session
interface=com.canonical.SafeLauncher.OpenURL
peer=(label=unconfined),
# new url helper (part of snap userd)
dbus (send)
bus=session
interface=io.snapcraft.Launcher.OpenURL
peer=(label=unconfined),
# dbusmenu
dbus (send)
bus=session
path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
interface=com.canonical.dbusmenu
member="{LayoutUpdated,ItemsPropertiesUpdated}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
interface="{com.canonical.dbusmenu,org.freedesktop.DBus.Properties}"
member=Get*
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
interface=com.canonical.dbusmenu
member="{AboutTo*,Event*}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/{MenuBar{,/[0-9A-F]*},com/canonical/{menu/[0-9A-F]*,dbusmenu}}
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/com/canonical/dbusmenu
interface=org.freedesktop.DBus.Properties
member=Get*
peer=(label="{plasmashell,unconfined}"),
# app-indicators
dbus (send)
bus=session
path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member="{GetConnectionUnixProcessID,RequestName,ReleaseName}"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (bind)
bus=session
name=org.kde.StatusNotifierItem-[0-9]*,
dbus (send)
bus=session
path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
dbus (send)
bus=session
path=/{StatusNotifierWatcher,org/ayatana/NotificationItem/*}
interface=org.kde.StatusNotifierWatcher
member=RegisterStatusNotifierItem
peer=(label="{plasmashell,unconfined}"),
dbus (send)
bus=session
path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
interface=org.kde.StatusNotifierItem
member="New{AttentionIcon,Icon,IconThemePath,OverlayIcon,Status,Title,ToolTip}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
interface=org.kde.StatusNotifierItem
member={Activate,ContextMenu,Scroll,SecondaryActivate,ProvideXdgActivationToken,XAyatanaSecondaryActivate}
peer=(label="{plasmashell,unconfined}"),
dbus (send)
bus=session
path=/{StatusNotifierItem/menu,org/ayatana/NotificationItem/*/Menu}
interface=com.canonical.dbusmenu
member="{LayoutUpdated,ItemsPropertiesUpdated}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/{StatusNotifierItem,StatusNotifierItem/menu,org/ayatana/NotificationItem/**}
interface={org.freedesktop.DBus.Properties,com.canonical.dbusmenu}
member={Get*,AboutTo*,Event*}
peer=(label="{plasmashell,unconfined}"),
# notifications
dbus (send)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.Notifications
member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.Notifications
member={ActionInvoked,NotificationClosed,NotificationReplied}
peer=(label="{plasmashell,unconfined}"),
# KDE Plasma's Inhibited property indicating "do not disturb" mode
# https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
dbus (send)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member="Get{,All}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(label="{plasmashell,unconfined}"),
dbus (send)
bus=session
path=/org/ayatana/NotificationItem/*
interface=org.kde.StatusNotifierItem
member=XAyatanaNew*
peer=(label="{plasmashell,unconfined}"),
# unity launcher
dbus (send)
bus=session
path=/com/canonical/unity/launcherentry/[0-9]*
interface=com.canonical.Unity.LauncherEntry
member=Update
peer=(label=unconfined),
dbus (send)
bus=session
path=/com/canonical/unity/launcherentry/[0-9]*
interface=com.canonical.dbusmenu
member="{LayoutUpdated,ItemsPropertiesUpdated}"
peer=(label=unconfined),
dbus (receive)
bus=session
path=/com/canonical/unity/launcherentry/[0-9]*
interface="{com.canonical.dbusmenu,org.freedesktop.DBus.Properties}"
member=Get*
peer=(label=unconfined),
# Support applications which use the unity messaging menu, xdg-mime, etc
# This leaks the names of snaps with desktop files
/var/lib/snapd/desktop/applications/ r,
# Allowing reading only our desktop files (required by (at least) the unity
# messaging menu).
# parallel-installs: this leaks read access to desktop files owned by keyed
# instances of @{SNAP_NAME} to @{SNAP_NAME} snap
/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,
# Explicitly deny access to other snap's desktop files
deny /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,
deny /var/lib/snapd/desktop/applications/[^f]* r,
deny /var/lib/snapd/desktop/applications/f[^i]* r,
deny /var/lib/snapd/desktop/applications/fi[^r]* r,
deny /var/lib/snapd/desktop/applications/fir[^e]* r,
deny /var/lib/snapd/desktop/applications/fire[^f]* r,
deny /var/lib/snapd/desktop/applications/firef[^o]* r,
deny /var/lib/snapd/desktop/applications/firefo[^x]* r,
# Snaps are unable to use the data in mimeinfo.cache (since they can't execute
# the returned desktop file themselves). unity messaging menu doesn't require
# mimeinfo.cache and xdg-mime will fallback to reading the desktop files
# directly to look for MimeType. Since reading the snap's own desktop files is
# allowed, we can safely deny access to this file (and xdg-mime will either
# return one of the snap's mimetypes, or none).
deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,
# then allow talking to Unity DBus service
dbus (send)
bus=session
interface=org.freedesktop.DBus.Properties
path=/com/canonical/indicator/messages/service
member=GetAll
peer=(label=unconfined),
dbus (send)
bus=session
path=/com/canonical/indicator/messages/service
interface=com.canonical.indicator.messages.service
member={Register,Unregister}Application
peer=(label=unconfined),
# When @{SNAP_NAME} == @{SNAP_INSTANCE_NAME}, this rule
# allows the snap to access parallel installs of this snap.
dbus (receive)
bus=session
interface=org.freedesktop.DBus.Properties
path=/com/canonical/indicator/messages/firefox_*_desktop
member=GetAll
peer=(label=unconfined),
# When @{SNAP_NAME} == @{SNAP_INSTANCE_NAME}, this rule
# allows the snap to access parallel installs of this snap.
dbus (receive, send)
bus=session
interface=com.canonical.indicator.messages.application
path=/com/canonical/indicator/messages/firefox_*_desktop
peer=(label=unconfined),
# This rule is meant to be covered by abstractions/dbus-session-strict but
# the unity launcher code has a typo that uses /org/freedesktop/dbus as the
# path instead of /org/freedesktop/DBus, so we need to all it here.
dbus (send)
bus=session
path=/org/freedesktop/dbus
interface=org.freedesktop.DBus
member=NameHasOwner
peer=(name=org.freedesktop.DBus, label=unconfined),
# appmenu
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=ListNames
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=session
path=/com/canonical/AppMenu/Registrar
interface=com.canonical.AppMenu.Registrar
member="{RegisterWindow,UnregisterWindow}"
peer=(label=unconfined),
dbus (send)
bus=session
path=/com/canonical/AppMenu/Registrar
interface=com.canonical.dbusmenu
member=UnregisterWindow
peer=(label=unconfined),
dbus (receive)
bus=session
path=/com/canonical/menu/[0-9]*
interface="{org.freedesktop.DBus.Properties,com.canonical.dbusmenu}"
member="{GetAll,GetLayout}"
peer=(label="{plasmashell,unconfined}"),
# Allow requesting interest in receiving media key events. This tells Gnome
# settings that our application should be notified when key events we are
# interested in are pressed, and allows us to receive those events.
dbus (receive, send)
bus=session
interface=org.gnome.SettingsDaemon.MediaKeys
path=/org/gnome/SettingsDaemon/MediaKeys
peer=(label=unconfined),
dbus (send)
bus=session
interface=org.freedesktop.DBus.Properties
path=/org/gnome/SettingsDaemon/MediaKeys
member="Get{,All}"
peer=(label=unconfined),
# Allow checking status, activating and locking the screensaver
# mate
dbus (send)
bus=session
path="/{,org/mate/}ScreenSaver"
interface=org.mate.ScreenSaver
member="{GetActive,GetActiveTime,Lock,SetActive}"
peer=(label=unconfined),
dbus (receive)
bus=session
path="/{,org/mate/}ScreenSaver"
interface=org.mate.ScreenSaver
member=ActiveChanged
peer=(label=unconfined),
# Unity
dbus (send)
bus=session
interface=com.canonical.Unity.Session
path=/com/canonical/Unity/Session
member="{ActivateScreenSaver,IsLocked,Lock}"
peer=(label=unconfined),
# Allow unconfined to introspect us
dbus (receive)
bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
# gtk2/gvfs gtk_show_uri()
dbus (send)
bus=session
path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo,
dbus (send)
bus=session
path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=LookupMount,
# Description: Can access basic graphical desktop resources. To be used with
# other interfaces (eg, wayland).
#include <abstractions/dbus-strict>
#include <abstractions/dbus-session-strict>
# Allow finding the DBus session bus id (eg, via dbus_bus_get_id())
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetId
peer=(name=org.freedesktop.DBus, label=unconfined),
#include <abstractions/fonts>
owner @{HOME}/.local/share/fonts/{,**} r,
/var/cache/fontconfig/ r,
/var/cache/fontconfig/** mr,
# some applications are known to mmap fonts
/usr/{,local/}share/fonts/** m,
# Allow access to xdg-document-portal file system. Access control is
# handled by bind mounting a snap-specific sub-tree to this location
# (ie, this is /run/user/<uid>/doc/by-app/snap.@{SNAP_INSTANCE_NAME}
# on the host).
owner /run/user/[0-9]*/doc/{,*/} r,
# Allow rw access without owner match to the documents themselves since
# the user guided the access and can specify anything DAC allows.
/run/user/[0-9]*/doc/*/** rw,
# Allow access to xdg-desktop-portal and xdg-document-portal
dbus (receive, send)
bus=session
interface=org.freedesktop.portal.*
path=/org/freedesktop/portal/{desktop,documents}{,/**}
peer=(label=unconfined),
dbus (receive, send)
bus=session
interface=org.freedesktop.DBus.Properties
path=/org/freedesktop/portal/{desktop,documents}{,/**}
peer=(label=unconfined),
# The portals service is normally running and newer versions of
# xdg-desktop-portal include AssumedAppArmor=unconfined. Since older
# systems don't have this and because gtkfilechoosernativeportal.c relies on
# service activation, allow sends to peer=(name=org.freedesktop.portal.{Desktop,Documents})
# for service activation.
dbus (send)
bus=session
interface=org.freedesktop.portal.*
path=/org/freedesktop/portal/desktop{,/**}
peer=(name=org.freedesktop.portal.Desktop),
dbus (send)
bus=session
interface=org.freedesktop.DBus.Properties
path=/org/freedesktop/portal/desktop{,/**}
peer=(name=org.freedesktop.portal.Desktop),
dbus (send)
bus=session
interface=org.freedesktop.portal.*
path=/org/freedesktop/portal/documents{,/**}
peer=(name=org.freedesktop.portal.Documents),
dbus (send)
bus=session
interface=org.freedesktop.DBus.Properties
path=/org/freedesktop/portal/documents{,/**}
peer=(name=org.freedesktop.portal.Documents),
# Allow to get the current idle time only from Mutter
dbus (send)
bus=session
path="/org/gnome/Mutter/IdleMonitor/Core"
interface="org.gnome.Mutter.IdleMonitor"
member="GetIdletime"
peer=(label=unconfined),
# Description: Can access common desktop legacy methods. This gives privileged
# access to the user's input.
# accessibility (a11y)
#include <abstractions/dbus-session-strict>
dbus (send)
bus=session
path=/org/a11y/bus
interface=org.a11y.Bus
member=GetAddress
peer=(label=unconfined),
#include <abstractions/dbus-accessibility-strict>
# Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0
# https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43
owner /{,var/}run/user/[0-9]*/at-spi/bus* rw,
# Allow access to the socket used by speech-dispatcher
owner /{,var/}run/user/[0-9]*/speech-dispatcher/speechd.sock rw,
# Allow the accessibility services in the user session to send us any events
dbus (receive)
bus=accessibility
peer=(label=unconfined),
# Allow querying for capabilities and registering
dbus (send)
bus=accessibility
path="/org/a11y/atspi/accessible/root"
interface="org.a11y.atspi.Socket"
member="Embed"
peer=(name=org.a11y.atspi.Registry, label=unconfined),
dbus (send)
bus=accessibility
path="/org/a11y/atspi/registry"
interface="org.a11y.atspi.Registry"
member="GetRegisteredEvents"
peer=(name=org.a11y.atspi.Registry, label=unconfined),
dbus (send)
bus=accessibility
path="/org/a11y/atspi/registry/deviceeventcontroller"
interface="org.a11y.atspi.DeviceEventController"
member="Get{DeviceEvent,Keystroke}Listeners"
peer=(name=org.a11y.atspi.Registry, label=unconfined),
dbus (send)
bus=accessibility
path="/org/a11y/atspi/registry/deviceeventcontroller"
interface="org.a11y.atspi.DeviceEventController"
member="NotifyListenersSync"
peer=(name=org.a11y.atspi.Registry, label=unconfined),
# org.a11y.atspi is not designed for application isolation and these rules
# can be used to send change events for other processes.
dbus (send)
bus=accessibility
path="/org/a11y/atspi/accessible/root"
interface="org.a11y.atspi.Event.Object"
member="ChildrenChanged"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=accessibility
path="/org/a11y/atspi/accessible/root"
interface="org.a11y.atspi.Accessible"
member="Get*"
peer=(label=unconfined),
dbus (send)
bus=accessibility
path="/org/a11y/atspi/accessible/[0-9]*"
interface="org.a11y.atspi.Event.Object"
member="{ChildrenChanged,PropertyChange,StateChanged,TextCaretMoved}"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
bus=accessibility
path="/org/a11y/atspi/accessible/[0-9]*"
interface="org.freedesktop.DBus.Properties"
member="Get{,All}"
peer=(label=unconfined),
dbus (send)
bus=accessibility
path="/org/a11y/atspi/cache"
interface="org.a11y.atspi.Cache"
member="{Add,Remove}Accessible"
peer=(name=org.freedesktop.DBus, label=unconfined),
# ibus
# subset of ibus abstraction
/usr/lib/@{multiarch}/gtk-2.0/[0-9]*/immodules/im-ibus.so mr,
owner @{HOME}/.config/ibus/ r,
owner @{HOME}/.config/ibus/bus/ r,
owner @{HOME}/.config/ibus/bus/* r,
# allow communicating with ibus-daemon (this allows sniffing key events)
unix (connect, receive, send)
type=stream
peer=(addr="@/tmp/ibus/dbus-*"),
# abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache)
# This should use this, but due to LP: #1856738 we cannot
#unix (connect, receive, send)
# type=stream
# peer=(addr="@@{HOME}/.cache/ibus/dbus-*"),
unix (connect, receive, send)
type=stream
peer=(addr="@/home/*/.cache/ibus/dbus-*"),
# when running with glib >= 2.75.0, ibus uses a regular socket
owner @{HOME}/.cache/ibus/dbus-* rw,
# mozc
# allow communicating with mozc server
unix (connect, receive, send)
type=stream
peer=(addr="@tmp/.mozc.*"),
# fcitx
# allow communicating with fcitx dbus service
dbus send
bus=fcitx
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
peer=(name=org.freedesktop.DBus),
owner @{HOME}/.config/fcitx/dbus/* r,
# allow creating an input context
dbus send
bus={fcitx,session}
path=/inputmethod
interface=org.fcitx.Fcitx.InputMethod
member=CreateIC*
peer=(label=unconfined),
# allow setting up and tearing down the input context
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="{Close,Destroy,Enable}IC"
peer=(label=unconfined),
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member=Reset
peer=(label=unconfined),
# allow service to send us signals
dbus receive
bus=fcitx
peer=(label=unconfined),
dbus receive
bus=session
interface=org.fcitx.Fcitx.*
peer=(label=unconfined),
# use the input context
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="Focus{In,Out}"
peer=(label=unconfined),
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="{CommitPreedit,Set*}"
peer=(label=unconfined),
# this is an information leak and allows key and mouse sniffing. If the input
# context path were tied to the process' security label, this would not be an
# issue.
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.fcitx.Fcitx.InputContext
member="{MouseEvent,ProcessKeyEvent}"
peer=(label=unconfined),
# this method does not exist with the sunpinyin backend (at least), so allow
# it for other input methods. This may consitute an information leak (which,
# again, could be avoided if the path were tied to the process' security
# label).
dbus send
bus={fcitx,session}
path=/inputcontext_[0-9]*
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(label=unconfined),
# gtk2/gvfs gtk_show_uri()
dbus (send)
bus=session
path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=ListMountableInfo,
dbus (send)
bus=session
path=/org/gtk/vfs/mounttracker
interface=org.gtk.vfs.MountTracker
member=LookupMount,
# Support applications which use the unity messaging menu, xdg-mime, etc
# This leaks the names of snaps with desktop files
/var/lib/snapd/desktop/applications/ r,
# Allowing reading only our desktop files (required by (at least) the unity
# messaging menu).
# parallel-installs: this leaks read access to desktop files owned by keyed
# instances of @{SNAP_NAME} to @{SNAP_NAME} snap
/var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,
# Explicitly deny access to other snap's desktop files
deny /var/lib/snapd/desktop/applications/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,
deny /var/lib/snapd/desktop/applications/[^f]* r,
deny /var/lib/snapd/desktop/applications/f[^i]* r,
deny /var/lib/snapd/desktop/applications/fi[^r]* r,
deny /var/lib/snapd/desktop/applications/fir[^e]* r,
deny /var/lib/snapd/desktop/applications/fire[^f]* r,
deny /var/lib/snapd/desktop/applications/firef[^o]* r,
deny /var/lib/snapd/desktop/applications/firefo[^x]* r,
# Snaps are unable to use the data in mimeinfo.cache (since they can't execute
# the returned desktop file themselves). unity messaging menu doesn't require
# mimeinfo.cache and xdg-mime will fallback to reading the desktop files
# directly to look for MimeType. Since reading the snap's own desktop files is
# allowed, we can safely deny access to this file (and xdg-mime will either
# return one of the snap's mimetypes, or none).
deny /var/lib/snapd/desktop/applications/mimeinfo.cache r,
# glib-networking's GLib proxy (different than the portal's proxy service
# org.freedesktop.portal.ProxyResolver). The Lookup API allows specifying
# various URLs (eg, file://, http:// and https://) which will be given to the
# unconfined glib-pacrunner.
dbus (send)
bus=session
path=/org/gtk/GLib/PACRunner
interface=org.gtk.GLib.PACRunner
member=Lookup
peer=(label=unconfined),
# app-indicators
dbus (send)
bus=session
path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
dbus (send)
bus=session
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member="{GetConnectionUnixProcessID,RequestName,ReleaseName}"
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (bind)
bus=session
name=org.kde.StatusNotifierItem-[0-9]*,
dbus (send)
bus=session
path=/StatusNotifierWatcher
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.kde.StatusNotifierWatcher, label=unconfined),
dbus (send)
bus=session
path=/{StatusNotifierWatcher,org/ayatana/NotificationItem/*}
interface=org.kde.StatusNotifierWatcher
member=RegisterStatusNotifierItem
peer=(label="{plasmashell,unconfined}"),
dbus (send)
bus=session
path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
interface=org.kde.StatusNotifierItem
member="New{AttentionIcon,Icon,IconThemePath,OverlayIcon,Status,Title,ToolTip}"
peer=(name=org.freedesktop.DBus, label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/{StatusNotifierItem,org/ayatana/NotificationItem/*}
interface=org.kde.StatusNotifierItem
member={Activate,ContextMenu,Scroll,SecondaryActivate,ProvideXdgActivationToken,XAyatanaSecondaryActivate}
peer=(label="{plasmashell,unconfined}"),
dbus (send)
bus=session
path=/{StatusNotifierItem/menu,org/ayatana/NotificationItem/*/Menu}
interface=com.canonical.dbusmenu
member="{LayoutUpdated,ItemsPropertiesUpdated}"
peer=(name=org.freedesktop.DBus, label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/{StatusNotifierItem,StatusNotifierItem/menu,org/ayatana/NotificationItem/**}
interface={org.freedesktop.DBus.Properties,com.canonical.dbusmenu}
member={Get*,AboutTo*,Event*}
peer=(label="{plasmashell,unconfined}"),
# notifications
dbus (send)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.Notifications
member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
peer=(label=unconfined),
dbus (receive)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.Notifications
member={ActionInvoked,NotificationClosed,NotificationReplied}
peer=(label=unconfined),
# KDE Plasma's Inhibited property indicating "do not disturb" mode
# https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
dbus (send)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member="Get{,All}"
peer=(label=unconfined),
dbus (receive)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(label=unconfined),
dbus (send)
bus=session
path=/org/ayatana/NotificationItem/*
interface=org.kde.StatusNotifierItem
member=XAyatanaNew*
peer=(name=org.freedesktop.DBus, label="{plasmashell,unconfined}"),
# Description: Can access global gsettings of the user's session. Restricted
# because this gives privileged access to sensitive information stored in
# gsettings and allows adjusting settings of other applications. Future GLib
# will not require plugging the interface and will instead probe if running
# under confinement and use a private data store in $SNAP_USER_DATA).
#include <abstractions/dbus-session-strict>
#include <abstractions/dconf>
owner /{,var/}run/user/*/dconf/user w,
owner @{HOME}/.config/dconf/user w,
dbus (receive, send)
bus=session
interface="ca.desrt.dconf.Writer"
peer=(label=unconfined),
# Description: Can access non-hidden files in user's $HOME. This is restricted
# because it gives file access to all of the user's $HOME.
# Note, @{HOME} is the user's $HOME, not the snap's $HOME
# Allow read access to toplevel $HOME for the user
owner @{HOME}/ r,
# Allow read/write access to all files in @{HOME}, except snap application
# data in @{HOME}/snap and toplevel hidden directories in @{HOME}.
owner @{HOME}/[^s.]** rwklix,
owner @{HOME}/s[^n]** rwklix,
owner @{HOME}/sn[^a]** rwklix,
owner @{HOME}/sna[^p]** rwklix,
owner @{HOME}/snap[^/]** rwklix,
# Allow creating a few files not caught above
owner @{HOME}/{s,sn,sna}{,/} rwklix,
# Allow access to @{HOME}/snap/ to allow directory traversals from
# @{HOME}/snap/@{SNAP_INSTANCE_NAME} through @{HOME}/snap to @{HOME}.
# While this leaks snap names, it fixes usability issues for snaps
# that require this transitional interface.
owner @{HOME}/snap/ r,
# Allow access to gvfs mounts for files owned by the user (including hidden
# files; only allow writes to files, not the mount point).
owner /run/user/[0-9]*/gvfs/{,**} r,
owner /run/user/[0-9]*/gvfs/*/** w,
# Disallow writes to the well-known directory included in
# the user's PATH on several distributions
audit deny @{HOME}/bin/{,**} wl,
audit deny @{HOME}/bin wl,
# Description: Can access opengl.
# specific gl libs
/var/lib/snapd/lib/gl{,32}/ r,
/var/lib/snapd/lib/gl{,32}/** rm,
# libdrm data files
/usr/share/libdrm/amdgpu.ids r,
# The nvidia container toolkit needs to traverse the top level libs directory
# in order to discover the libraries and generate a CDI config
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/} r,
# Bi-arch distribution nvidia support
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcuda*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvidia*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvoptix*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}tls/libnvidia*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvcuvid.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}lib{GL,GLESv1_CM,GLESv2,EGL}*nvidia.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libGLdispatch.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}vdpau/libvdpau_nvidia.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnv{rm,dc,imp,os}*.so{,.*} rm,
# CUDA libs
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnpp{c,ig,ial,icc,idei,ist,if,im,itc}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcublas{,Lt}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcufft.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcusolver.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcuparse.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcurand.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libcudnn{,_adv_infer,_adv_train,_cnn_infer,_cnn_train,_ops_infer,_ops_train}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvrtc{,-builtins}*.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}libnvToolsExt.so{,.*} rm,
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}nvidia/wine/*.dll rm,
# Support reading the Vulkan ICD files
/var/lib/snapd/lib/vulkan/ r,
/var/lib/snapd/lib/vulkan/** r,
/var/lib/snapd/hostfs/usr/share/vulkan/icd.d/*nvidia*.json r,
# Support reading the GLVND EGL vendor files
/var/lib/snapd/lib/glvnd/ r,
/var/lib/snapd/lib/glvnd/** r,
/var/lib/snapd/hostfs/usr/share/glvnd/egl_vendor.d/ r,
/var/lib/snapd/hostfs/usr/share/glvnd/egl_vendor.d/*nvidia*.json r,
# Support Nvidia EGL external platform
/var/lib/snapd/hostfs/usr/share/egl/egl_external_platform.d/ r,
/var/lib/snapd/hostfs/usr/share/egl/egl_external_platform.d/*nvidia*.json r,
# Main bi-arch GL libraries
/var/lib/snapd/hostfs/{,usr/}lib{,32,64,x32}/{,@{multiarch}/}{,nvidia*/}lib{OpenGL,GL,GLU,GLESv1_CM,GLESv2,EGL,GLX}.so{,.*} rm,
# Allow access to all cards since a) this is common on hybrid systems, b) ARM
# devices commonly have two devices (such as on the Raspberry Pi 4, one for KMS
# and another that does not) and c) there is nothing saying that /dev/dri/card0
# is the default card or the application is currently using.
/dev/dri/ r,
/dev/dri/card[0-9]* rw,
# nvidia
/etc/vdpau_wrapper.cfg r,
@{PROC}/driver/nvidia/params r,
@{PROC}/modules r,
/dev/nvidia* rw,
unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"),
# driver profiles
/usr/share/nvidia/ r,
/usr/share/nvidia/** r,
# VideoCore/EGL (shared device with VideoCore camera)
/dev/vchiq rw,
# VideoCore Video decoding (required for accelerated MMAL video playback)
/dev/vcsm-cma rw,
# va-api
/dev/dri/renderD[0-9]* rw,
# intel
@{PROC}/sys/dev/i915/perf_stream_paranoid r,
# cuda
@{PROC}/sys/vm/mmap_min_addr r,
@{PROC}/devices r,
/sys/devices/system/memory/block_size_bytes r,
/sys/module/tegra_fuse/parameters/tegra_* r,
unix (bind,listen) type=seqpacket addr="@cuda-uvmfd-[0-9a-f]*",
/{dev,run}/shm/cuda.* rw,
/dev/nvhost-* rw,
/dev/nvmap rw,
# Tegra display driver
/dev/tegra_dc_ctrl rw,
/dev/tegra_dc_[0-9]* rw,
# Xilinx zocl DRM driver
# https://github.com/Xilinx/XRT/tree/master/src/runtime_src/core/edge/drm
/sys/devices/platform/amba{,_pl@[0-9]*}/amba{,_pl@[0-9]*}:zyxclmm_drm/* r,
# Imagination PowerVR driver
/dev/pvr_sync rw,
# ARM Mali driver
/dev/mali[0-9]* rw,
/dev/dma_buf_te rw,
/dev/dma_heap/linux,cma rw,
/dev/dma_heap/system rw,
# NXP i.MX driver
# https://github.com/Freescale/kernel-module-imx-gpu-viv
/dev/galcore rw,
# OpenCL ICD files
/etc/OpenCL/vendors/ r,
/etc/OpenCL/vendors/** r,
# Parallels guest tools 3D acceleration (video toolgate)
@{PROC}/driver/prl_vtg rw,
# /sys/devices
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/config r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/revision r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/resource r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/irq r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/boot_vga r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}class r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}device r,
/sys/devices/{,*pcie-controller/,platform/{soc,scb}/*.pcie/}pci[0-9a-f]*/**/{,subsystem_}vendor r,
/sys/devices/**/drm{,_dp_aux_dev}/** r,
# FIXME: this is an information leak and snapd should instead query udev for
# the specific accesses associated with the above devices.
/sys/bus/pci/devices/ r,
/sys/bus/platform/devices/soc:gpu/ r,
/run/udev/data/+drm:card* r,
/run/udev/data/+pci:[0-9a-f]* r,
/run/udev/data/+platform:soc:gpu* r,
# FIXME: for each device in /dev that this policy references, lookup the
# device type, major and minor and create rules of this form:
# /run/udev/data/<type><major>:<minor> r,
# For now, allow 'c'haracter devices and 'b'lock devices based on
# https://www.kernel.org/doc/Documentation/devices.txt
/run/udev/data/c226:[0-9]* r, # 226 drm
# From https://bugs.launchpad.net/snapd/+bug/1862832
/run/nvidia-xdriver-* rw,
unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"),
# Description: Can access removable storage filesystems
# Allow read-access to /run/ for navigating to removable media.
/run/ r,
# Allow read on /run/media/ for navigating to the mount points. While this
# allows enumerating users, this is already allowed via /etc/passwd and getent.
/{,run/}media/ r,
# Mount points could be in /run/media/<user>/* or /media/<user>/*
/{,run/}media/*/ r,
/{,run/}media/*/** mrwklix,
# Allow read-only access to /mnt to enumerate items.
/mnt/ r,
# Allow write access to anything under /mnt
/mnt/** mrwklix,
# Description: Can access specific personal files or directories in the
# users's home directory.
# This is restricted because it gives file access to arbitrary locations.
owner "@{HOME}/.mozilla/firefox{,/,/**}" rk,
# Description: Can access specific system files or directories.
# This is restricted because it gives file access to arbitrary locations.
"/etc/firefox{,/,/**}" rk,
# Description: Can access specific system files or directories.
# This is restricted because it gives file access to arbitrary locations.
"/var/lib/snapd/hostfs/usr/share/hunspell{,/,/**}" rk,
# Description: Can access the X server. Restricted because X does not prevent
# eavesdropping or apps interfering with one another.
# The X abstraction doesn't check the peer label, but in this case that's
# ok because x11ConnectedSlotAppArmor will limit which clients can connect
# to the slot implementation.
#include <abstractions/X>
#include <abstractions/fonts>
owner @{HOME}/.local/share/fonts/{,**} r,
/var/cache/fontconfig/ r,
/var/cache/fontconfig/** mr,
# Allow access to the user specific copy of the xauth file specified
# in the XAUTHORITY environment variable, that "snap run" creates on
# startup.
owner /run/user/[0-9]*/.Xauthority r,
# Allow reading an Xwayland Xauth file
# (see https://gitlab.gnome.org/GNOME/mutter/merge_requests/626)
owner /run/user/[0-9]*/.mutter-Xwaylandauth.* r,
owner /run/user/[0-9]*/mutter/Xauthority r,
# Allow reading KDE Plasma's Xwayland Xauth file
owner /run/user/[0-9]*/xauth_* r,
# Needed by QtSystems on X to detect mouse and keyboard. Note, the 'netlink
# raw' rule is not finely mediated by apparmor so we mediate with seccomp arg
# filtering.
network netlink raw,
/run/udev/data/c13:[0-9]* r,
/run/udev/data/+input:* r,
# Deny access to ICE granted by abstractions/X
# See: https://bugs.launchpad.net/snapd/+bug/1901489
deny owner @{HOME}/.ICEauthority r,
deny owner /run/user/*/ICEauthority r,
deny unix (connect, receive, send)
type=stream
peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
# Description: Can access the network as a client.
#include <abstractions/nameservice>
/run/systemd/resolve/stub-resolv.conf rk,
/etc/mdns.allow r, # not yet included in the mdns abstraction
network netlink dgram, # not yet included in the nameservice abstraction
# systemd-resolved (not yet included in nameservice abstraction)
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
# https://www.freedesktop.org/wiki/Software/systemd/resolved/
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
# https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
#include <abstractions/dbus-strict>
dbus send
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="Resolve{Address,Hostname,Record,Service}"
peer=(name="org.freedesktop.resolve1"),
# libnss-systemd (D-Bus portion from nameservice abstraction)
# Also allow lookups for systemd-exec's DynamicUsers via D-Bus
# https://www.freedesktop.org/software/systemd/man/systemd.exec.html
dbus send
bus=system
path="/org/freedesktop/systemd1"
interface="org.freedesktop.systemd1.Manager"
member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}"
peer=(name="org.freedesktop.systemd1"),
#include <abstractions/ssl_certs>
@{PROC}/sys/net/core/somaxconn r,
@{PROC}/sys/net/ipv4/tcp_fastopen r,
# Allow using netcat as client
/{,usr/}bin/nc{,.openbsd} ixr,
# Description: Can access the network as a server.
#include <abstractions/nameservice>
/run/systemd/resolve/stub-resolv.conf rk,
network netlink dgram, # not yet included in the nameservice abstraction
# systemd-resolved (not yet included in nameservice abstraction)
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
# https://www.freedesktop.org/wiki/Software/systemd/resolved/
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
# https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
#include <abstractions/dbus-strict>
dbus send
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="Resolve{Address,Hostname,Record,Service}"
peer=(name="org.freedesktop.resolve1"),
#include <abstractions/ssl_certs>
# These probably shouldn't be something that apps should use, but this offers
# no information disclosure since the files are in the read-only part of the
# system.
/etc/hosts.deny r,
/etc/hosts.allow r,
@{PROC}/sys/net/core/somaxconn r,
@{PROC}/sys/net/ipv4/ip_local_port_range r,
# LP: #1496906: java apps need these for some reason and they leak the IPv6 IP
# addresses and routes. Until we find another way to handle them (see the bug
# for some options), we need to allow them to avoid developer confusion.
@{PROC}/@{pid}/net/if_inet6 r,
@{PROC}/@{pid}/net/ipv6_route r,
# java apps attempt this, presumably to handle interface changes, but a
# corresponding seccomp socket rule is required to use netlink. When
# fine-grained netlink mediation is implemented (LP: #1669552), we can perhaps
# allow 'read' with NETLINK_ROUTE, but for now we omit it here and don't
# explicitly deny this noisy denial so --devmode isn't broken. LP: #1499897
#deny network netlink dgram,
# Description: Can access various APIs needed by modern browsers (eg, Google
# Chrome/Chromium and Mozilla) and file paths they expect. This interface is
# transitional and is only in place while upstream's work to change their paths
# and snappy is updated to properly mediate the APIs.
# This allows raising the OOM score of other processes owned by the user.
owner @{PROC}/@{pid}/oom_score_adj rw,
# Chrome/Chromium should be fixed to honor TMPDIR or the snap packaging
# adjusted to use LD_PRELOAD technique from LP: #1577514
/var/tmp/ r,
owner /var/tmp/etilqs_* rw,
# Chrome/Chromium should be modified to use snap.$SNAP_INSTANCE_NAME.* or
# the snap packaging adjusted to use LD_PRELOAD technique from LP: #1577514
owner /{dev,run}/shm/{,.}org.chromium.* mrw,
owner /{dev,run}/shm/{,.}com.google.Chrome.* mrw,
owner /{dev,run}/shm/{,.}com.microsoft.Edge.* mrw,
owner /{dev,run}/shm/.io.nwjs.* mrw,
# Chrome's Singleton API sometimes causes an ouid/fsuid mismatch denial, so
# for now, allow non-owner read on the singleton socket (LP: #1731012). See
# https://forum.snapcraft.io/t/electron-snap-killed-when-using-app-makesingleinstance-api/2667/20
# parallel-installs: $XDG_RUNTIME_DIR is not remapped, need to use SNAP_INSTANCE_NAME
/run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/{,.}org.chromium.*/SS r,
/run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/{,.}com.google.Chrome.*/SS r,
/run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/{,.}com.microsoft.Edge.*/SS r,
# Allow access to Jupyter notebooks.
# This is temporary and will be reverted once LP: #1959417 is fixed upstream.
owner @{HOME}/.local/share/jupyter/** rw,
# Allow reading platform files
/run/udev/data/+platform:* r,
# miscellaneous accesses
@{PROC}/vmstat r,
# Chromium content api sometimes queries about huge pages. Allow status of
# hugepages and transparent_hugepage, but not the pages themselves.
/sys/kernel/mm/{hugepages,transparent_hugepage}/{,**} r,
# Chromium content api in gnome-shell reads this
/etc/opt/chrome/{,**} r,
/etc/chromium/{,**} r,
# Chrome/Chromium should be adjusted to not use gconf. It is only used with
# legacy systems that don't have snapd
deny dbus (send)
bus=session
interface="org.gnome.GConf.Server",
# webbrowser-app/webapp-container tries to read this file to determine if it is
# confined or not, so explicitly deny to avoid noise in the logs.
deny @{PROC}/@{pid}/attr/{,apparmor/}current r,
# This is an information leak but disallowing it leads to developer confusion
# when using the chromium content api file chooser due to a (harmless) glib
# warning and the noisy AppArmor denial.
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/mountinfo r,
# Since snapd still uses SECCOMP_RET_KILL, we have added a workaround rule to
# allow mknod on character devices since chromium unconditionally performs
# a mknod() to create the /dev/nvidiactl device, regardless of if it exists or
# not or if the process has CAP_MKNOD or not. Since we don't want to actually
# grant the ability to create character devices, explicitly deny the
# capability. When snapd uses SECCOMP_RET_ERRNO, we can remove this rule.
# https://forum.snapcraft.io/t/call-for-testing-chromium-62-0-3202-62/2569/46
deny capability mknod,
# Description: Can inhibit and uninhibit screen savers in desktop sessions.
#include <abstractions/dbus-session-strict>
#include <abstractions/dbus-strict>
# gnome-session
dbus (send)
bus=session
path=/org/gnome/SessionManager
interface=org.gnome.SessionManager
member={Inhibit,Uninhibit}
peer=(label=unconfined),
# unity screen API
dbus (send)
bus=system
interface="org.freedesktop.DBus.Introspectable"
path="/com/canonical/Unity/Screen"
member="Introspect"
peer=(label=unconfined),
dbus (send)
bus=system
interface="com.canonical.Unity.Screen"
path="/com/canonical/Unity/Screen"
member={keepDisplayOn,removeDisplayOnRequest}
peer=(label=unconfined),
# freedesktop.org ScreenSaver
# compatibility rule
dbus (send)
bus=session
path=/Screensaver
interface=org.freedesktop.ScreenSaver
member={Inhibit,UnInhibit,SimulateUserActivity}
peer=(label=unconfined),
# xfce4-power-manager -
# https://github.com/xfce-mirror/xfce4-power-manager/blob/0b3ad06ad4f51eae1aea3cdc26f434d8b5ce763e/src/org.freedesktop.PowerManagement.Inhibit.xml
dbus (send)
bus=session
path=/org/freedesktop/PowerManagement/Inhibit
interface=org.freedesktop.PowerManagement.Inhibit
member={Inhibit,UnInhibit}
peer=(label=unconfined),
# API rule
dbus (send)
bus=session
path=/{,org/freedesktop/,org/gnome/}ScreenSaver
interface=org.{freedesktop,gnome}.ScreenSaver
member={Inhibit,UnInhibit,SimulateUserActivity}
peer=(label=unconfined),
# gnome, kde and cinnamon screensaver
dbus (send)
bus=session
path=/{,ScreenSaver}
interface=org.{gnome.ScreenSaver,kde.screensaver,cinnamon.ScreenSaver}
member=SimulateUserActivity
peer=(label=unconfined),
# Description: Can query UPower for power devices, history and statistics.
#include <abstractions/dbus-strict>
# Find all devices monitored by UPower
dbus (send)
bus=system
path=/org/freedesktop/UPower
interface=org.freedesktop.UPower
member=EnumerateDevices
peer=(label=unconfined),
# Read all properties from UPower and devices
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
path=/org/freedesktop/UPower{,/Wakeups,/devices/**}
interface=org.freedesktop.DBus.Properties
member=Get{,All},
dbus (send)
bus=system
path=/org/freedesktop/UPower
interface=org.freedesktop.UPower
member=GetCriticalAction
peer=(label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/UPower
interface=org.freedesktop.UPower
member=GetDisplayDevice
peer=(label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/UPower/devices/**
interface=org.freedesktop.UPower.Device
member={GetHistory,Refresh}
peer=(label=unconfined),
# Receive property changed events
dbus (receive)
bus=system
path=/org/freedesktop/UPower{,/devices/**}
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(label=unconfined),
# Allow clients to introspect the service
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
interface=org.freedesktop.DBus.Introspectable
path=/org/freedesktop/UPower
member=Introspect,
# Description: This interface allows for getting hardware information
# from the system. This is reserved because it allows reading potentially
# sensitive information.
# used by lscpu and 'lspci -A intel-conf1/intel-conf2'
capability sys_rawio,
# see loaded kernel modules
@{PROC}/modules r,
# used by lspci
capability sys_admin,
/etc/modprobe.d/{,*} r,
/{,usr/}lib/modprobe.d/{,*} r,
# for reading the available input devices on the system
/proc/bus/input/devices r,
# files in /sys pertaining to hardware (eg, 'lspci -A linux-sysfs')
/sys/{block,bus,class,devices,firmware}/{,**} r,
# files in /proc/bus/pci (eg, 'lspci -A linux-proc')
@{PROC}/bus/pci/{,**} r,
# power information
/sys/power/{,**} r,
/run/udev/data/+power_supply:* r,
# interrupts
@{PROC}/interrupts r,
# libsensors
/etc/sensors3.conf r,
/etc/sensors.d/{,*} r,
# Needed for udevadm
/run/udev/data/** r,
network netlink raw,
# util-linux
/{,usr/}bin/lsblk ixr,
/{,usr/}bin/lscpu ixr,
/{,usr/}bin/lsmem ixr,
# lsusb
# Note: lsusb and its database have to be shipped in the snap if not on classic
/{,usr/}bin/lsusb ixr,
/var/lib/usbutils/usb.ids r,
/dev/ r,
/dev/bus/usb/{,**/} r,
/etc/udev/udev.conf r,
# lshw -quiet (note, lshw also tries to create /dev/fb-*, but fails gracefully)
@{PROC}/devices r,
@{PROC}/ide/{,**} r,
@{PROC}/scsi/{,**} r,
@{PROC}/device-tree/{,**} r,
/sys/kernel/debug/usb/devices r,
@{PROC}/sys/abi/{,*} r,
# hwinfo --short
@{PROC}/ioports r,
@{PROC}/dma r,
@{PROC}/tty/driver/{,*} r,
@{PROC}/sys/dev/cdrom/info r,
# status of hugepages and transparent_hugepage, but not the pages themselves
/sys/kernel/mm/{hugepages,transparent_hugepage}/{,**} r,
# systemd-detect-virt
/{,usr/}bin/systemd-detect-virt ixr,
# VMs
@{PROC}/cpuinfo r,
@{PROC}/sysinfo r, # Linux on z/VM
@{PROC}/xen/capabilities r,
/sys/hypervisor/properties/features r,
/sys/hypervisor/type r,
# containers
/run/systemd/container r,
# /proc/1/sched in a systemd-nspawn container with '-a' is supposed to show on
# its first line a pid that != 1 and systemd-detect-virt tries to detect this.
# This doesn't seem to be the case on (at least) systemd 240 on Ubuntu. This
# file is somewhat sensitive for arbitrary pids, but is not overly so for pid
# 1. For containers, systemd won't normally look at this file since it has
# access to /run/systemd/container and 'container' from the environment, and
# systemd fails gracefully when it doesn't have access to /proc/1/sched. For
# VMs, systemd requires access to /proc/1/sched in its detection algorithm.
# See src/basic/virt.c from systemd sources for details.
@{PROC}/1/sched r,
# systemd-detect-virt --private-users will look at these and the access is
# better added to system-observe. Since snaps typically only care about
# --container and --vm leave these commented out.
#@{PROC}/@{pid}/uid_map r,
#@{PROC}/@{pid}/gid_map r,
#@{PROC}/@{pid}/setgroups r,
# systemd-detect-virt --chroot requires 'ptrace (read)' on unconfined to
# determine if it is running in a chroot. Like above, this is best granted via
# system-observe.
#ptrace (read) peer=unconfined,
# Description: allows domain, record, service, and service type browsing
# as well as address, host and service resolving
/{,var/}run/avahi-daemon/socket rw,
#include <abstractions/dbus-strict>
dbus (send)
bus=system
path=/
interface=org.freedesktop.DBus.Peer
member=Ping
peer=(name=org.freedesktop.Avahi,label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# Allow accessing DBus properties and resolving
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member={Get*,Resolve*,IsNSSSupportAvailable}
peer=(name=org.freedesktop.Avahi,label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# Allow receiving anything from the slot server
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.Server
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# Don't allow introspection since it reveals too much (path is not service
# specific for unconfined)
# do not use peer=(label=unconfined) here since this is DBus activated
#dbus (send)
# bus=system
# path=/
# interface=org.freedesktop.DBus.Introspectable
# member=Introspect,
# These allows tampering with other snap's browsers, so don't autoconnect for
# now.
# address resolving
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member=AddressResolverNew
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (send)
bus=system
path=/Client*/AddressResolver*
interface=org.freedesktop.Avahi.AddressResolver
member=Free
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.AddressResolver
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# host name resolving
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member=HostNameResolverNew
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (send)
bus=system
path=/Client*/HostNameResolver*
interface=org.freedesktop.Avahi.HostNameResolver
member=Free
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.HostNameResolver
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# service resolving
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member=ServiceResolverNew
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (send)
bus=system
path=/Client*/ServiceResolver*
interface=org.freedesktop.Avahi.ServiceResolver
member=Free
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.ServiceResolver
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# domain browsing
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member=DomainBrowserNew
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (send)
bus=system
path=/Client*/DomainBrowser*
interface=org.freedesktop.Avahi.DomainBrowser
member=Free
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.DomainBrowser
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# record browsing
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member=RecordBrowserNew
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (send)
bus=system
path=/Client*/RecordBrowser*
interface=org.freedesktop.Avahi.RecordBrowser
member=Free
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.RecordBrowser
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# service browsing
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member=ServiceBrowserNew
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (send)
bus=system
path=/Client*/ServiceBrowser*
interface=org.freedesktop.Avahi.ServiceBrowser
member=Free
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.ServiceBrowser
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# Service type browsing
dbus (send)
bus=system
path=/
interface=org.freedesktop.Avahi.Server
member=ServiceTypeBrowserNew
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (send)
bus=system
path=/Client*/ServiceTypeBrowser*
interface=org.freedesktop.Avahi.ServiceTypeBrowser
member=Free
peer=(name=org.freedesktop.Avahi, label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
dbus (receive)
bus=system
interface=org.freedesktop.Avahi.ServiceTypeBrowser
peer=(label="{unconfined,/usr/sbin/avahi-daemon,avahi-daemon}"),
# Description: can access documentation of system packages.
/usr/{,local/}share/doc/{,**} r,
/usr/share/cups/doc-root/{,**} r,
/usr/share/gimp/2.0/help/{,**} r,
/usr/share/gtk-doc/{,**} r,
/usr/share/javascript/{jquery,sphinxdoc}/{,**} r,
/usr/share/libreoffice/help/{,**} r,
/usr/share/sphinx_rtd_theme/{,**} r,
/usr/share/xubuntu-docs/{,**} r,
# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gnome-42-2204/176/**" mrkix,
# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gtk-common-themes/1535/share/icons/default/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Adwaita/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/hicolor/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/HighContrast/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Humanity/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Humanity-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/ubuntu-mono-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/ubuntu-mono-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/DMZ-Black/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/DMZ-White/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-bark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-blue/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-magenta/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-olive/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-purple/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-red/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-sage/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-viridian/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-bark-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-blue-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-magenta-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-olive-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-purple-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-red-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-sage-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-viridian-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Ambiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Radiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-MATE-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-MATE-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-mate/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Yaru-mate-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Nokto-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Dark-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Light-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Papirus-Maia/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/breeze_cursors/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/Breeze_Snow/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-darker/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/elementary-xfce-darkest/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/handhelds/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/redglass/**" mrkix,
"/snap/gtk-common-themes/1535/share/icons/whiteglass/**" mrkix,
# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gtk-common-themes/1535/share/sounds/Yaru/**" mrkix,
"/snap/gtk-common-themes/1535/share/sounds/freedesktop/**" mrkix,
# In addition to the bind mount, add any AppArmor rules so that
# snaps may directly access the slot implementation's files
# read-only.
"/snap/gtk-common-themes/1535/share/themes/Adwaita/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Adwaita-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/HighContrast/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Ambiance/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Radiance/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Arc/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Arc-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Arc-Darker/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Breeze/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Breeze-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-bark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-blue/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-olive/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-purple/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-red/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-sage/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-red-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/elementary/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Ambiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Ambiant-MATE-Dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Radiant-MATE/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-mate/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-aliz/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-azul/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-aliz/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-azul/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-dark-sea/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Matcha-sea/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Greybird/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Greybird-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-compact/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-dark/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-dark-compact/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-light/**" mrkix,
"/snap/gtk-common-themes/1535/share/themes/Materia-light-compact/**" mrkix,
# TODO: should this be somewhere else?
/etc/mailcap r,
# While /usr/share/applications comes from the base runtime of the snap, it
# has some things that snaps actually need, so allow access to those and deny
# access to the others. This is duplicated from desktop for compatibility with
# existing snaps.
/usr/share/applications/ r,
/usr/share/applications/mimeapps.list r,
/usr/share/applications/xdg-open.desktop r,
# silence noisy denials from desktop files in core* snaps that aren't usable by
# snaps
deny /usr/share/applications/python*.desktop r,
deny /usr/share/applications/vim.desktop r,
deny /usr/share/applications/snap-handle-link.desktop r, # core16
# Chromium content api unfortunately needs these for normal operation
owner @{PROC}/@{pid}/fd/[0-9]* w,
# Various files in /run/udev/data needed by Chrome Settings. Leaks device
# information.
# input
/run/udev/data/c1:[0-9]* r, # /dev/psaux
/run/udev/data/c10:[0-9]* r, # /dev/adbmouse
/run/udev/data/c13:[0-9]* r, # /dev/input/*
/run/udev/data/c180:[0-9]* r, # /dev/vrbuttons
/run/udev/data/c4:[0-9]* r, # /dev/tty*, /dev/ttyS*
/run/udev/data/c5:[0-9]* r, # /dev/tty, /dev/console, etc
/run/udev/data/c7:[0-9]* r, # /dev/vcs*
/run/udev/data/+hid:* r,
/run/udev/data/+input:input[0-9]* r,
# screen
/run/udev/data/c29:[0-9]* r, # /dev/fb*
/run/udev/data/+backlight:* r,
/run/udev/data/+leds:* r,
# sound
/run/udev/data/c116:[0-9]* r, # alsa
/run/udev/data/+sound:card[0-9]* r,
# miscellaneous
/run/udev/data/c108:[0-9]* r, # /dev/ppp
/run/udev/data/c189:[0-9]* r, # USB serial converters
/run/udev/data/c89:[0-9]* r, # /dev/i2c-*
/run/udev/data/c81:[0-9]* r, # video4linux (/dev/video*, etc)
/run/udev/data/c202:[0-9]* r, # /dev/cpu/*/msr
/run/udev/data/c203:[0-9]* r, # /dev/cuse
/run/udev/data/+acpi:* r,
/run/udev/data/+hwmon:hwmon[0-9]* r,
/run/udev/data/+i2c:* r,
/sys/devices/**/bConfigurationValue r,
/sys/devices/**/descriptors r,
/sys/devices/**/manufacturer r,
/sys/devices/**/product r,
/sys/devices/**/revision r,
/sys/devices/**/serial r,
/sys/devices/**/vendor r,
/sys/devices/system/node/node[0-9]*/meminfo r,
# Allow getting the manufacturer and model of the
# computer where Chrome/chromium is currently running.
# This is going to be used by the upcoming Hardware Platform
# extension API.
# https://chromium.googlesource.com/chromium/src.git/+/84618eee98fdf7548905e883e63e4f693800fcfa
/sys/devices/virtual/dmi/id/product_name r,
/sys/devices/virtual/dmi/id/sys_vendor r,
# Chromium content api tries to read these. It is an information disclosure
# since these contain the names of snaps. Chromium operates fine without the
# access so just block it.
deny /sys/devices/virtual/block/loop[0-9]*/loop/backing_file r,
deny /sys/devices/virtual/block/dm-[0-9]*/dm/name r,
# networking
/run/udev/data/n[0-9]* r,
/run/udev/data/+bluetooth:hci[0-9]* r,
/run/udev/data/+rfkill:rfkill[0-9]* r,
/run/udev/data/c241:[0-9]* r, # /dev/vhost-vsock
# storage
/run/udev/data/b1:[0-9]* r, # /dev/ram*
/run/udev/data/b7:[0-9]* r, # /dev/loop*
/run/udev/data/b8:[0-9]* r, # /dev/sd*
/run/udev/data/b11:[0-9]* r, # /dev/scd* and sr*
/run/udev/data/b230:[0-9]* r, # /dev/zvol*
/run/udev/data/c21:[0-9]* r, # /dev/sg*
/run/udev/data/+usb:[0-9]* r,
# experimental
/run/udev/data/b252:[0-9]* r,
/run/udev/data/b253:[0-9]* r,
/run/udev/data/b259:[0-9]* r,
/run/udev/data/c24[0-9]:[0-9]* r,
/run/udev/data/c25[0-4]:[0-9]* r,
/sys/bus/**/devices/ r,
# Google Cloud Print
unix (bind)
type=stream
addr="@[0-9A-F]*._service_*",
# Policy needed only when using the chrome/chromium setuid sandbox
capability sys_ptrace,
ptrace (trace) peer=snap.@{SNAP_INSTANCE_NAME}.**,
unix (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.**),
# If this were going to be allowed to all snaps, then for all the following
# rules we would want to wrap in a 'browser_sandbox' profile, but a limitation
# in AppArmor profile transitions prevents this.
#
# @{INSTALL_DIR}/@{SNAP_NAME}/@{SNAP_REVISION}/opt/google/chrome{,-beta,-unstable}/chrome-sandbox cx -> browser_sandbox,
# profile browser_sandbox {
# ...
# # This rule needs to work but generates a parser error
# @{INSTALL_DIR}/@{SNAP_NAME}/@{SNAP_REVISION}/opt/google/chrome/chrome px -> snap.@{SNAP_INSTANCE_NAME}.@{SNAP_APP},
# @{INSTALL_DIR}/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/opt/google/chrome/chrome px -> snap.@{SNAP_INSTANCE_NAME}.@{SNAP_APP},
# ...
# }
# Required for dropping into PID namespace. Keep in mind that until the
# process drops this capability it can escape confinement, but once it
# drops CAP_SYS_ADMIN we are ok.
capability sys_admin,
# All of these are for sanely dropping from root and chrooting
capability chown,
capability fsetid,
capability setgid,
capability setuid,
capability sys_chroot,
# User namespace sandbox
owner @{PROC}/@{pid}/setgroups rw,
owner @{PROC}/@{pid}/uid_map rw,
owner @{PROC}/@{pid}/gid_map rw,
# Webkit uses a particular SHM names # LP: 1578217
owner /{dev,run}/shm/WK2SharedMemory.* mrw,
# Chromium content api on (at least) later versions of Ubuntu just use this
owner /{dev,run}/shm/shmfd-* mrw,
# Clearing the PG_Referenced and ACCESSED/YOUNG bits provides a method to
# measure approximately how much memory a process is using via /proc/self/smaps
# (man 5 proc). This access allows the snap to clear references for pids from
# other snaps and the system, so it is limited to snaps that specify:
# allow-sandbox: true.
owner @{PROC}/@{pid}/clear_refs w,
# Allow setting realtime priorities. Clients require RLIMIT_RTTIME in the first
# place and client authorization is done via PolicyKit. Note that setrlimit()
# is allowed by default seccomp policy but requires 'capability sys_resource',
# which we deny be default.
# http://git.0pointer.net/rtkit.git/tree/README
dbus (send)
bus=system
path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.DBus.Properties
member=Get
peer=(name=org.freedesktop.RealtimeKit1, label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/RealtimeKit1
interface=org.freedesktop.RealtimeKit1
member=MakeThread{HighPriority,Realtime,RealtimeWithPID}
peer=(name=org.freedesktop.RealtimeKit1, label=unconfined),
# Until we have proper device assignment, allow access to all cameras
/dev/video[0-9]* rw,
# VideoCore cameras (shared device with VideoCore/EGL)
/dev/vchiq rw,
# Allow detection of cameras. Leaks plugged in USB device info
/sys/bus/usb/devices/ r,
/sys/devices/pci**/usb*/**/busnum r,
/sys/devices/pci**/usb*/**/devnum r,
/sys/devices/pci**/usb*/**/idVendor r,
/sys/devices/pci**/usb*/**/idProduct r,
/sys/devices/pci**/usb*/**/interface r,
/sys/devices/pci**/usb*/**/modalias r,
/sys/devices/pci**/usb*/**/speed r,
/run/udev/data/c81:[0-9]* r, # video4linux (/dev/video*, etc)
/run/udev/data/+usb:* r,
/sys/class/video4linux/ r,
/sys/devices/pci**/usb*/**/video4linux/** r,
/sys/devices/platform/**/usb*/**/video4linux/** r,
# allow unconfined clients to introspect us on classic
dbus (receive)
bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
# allow us to respond to unconfined clients via "org.mozilla.firefox{,.*}"
# on classic (send should be handled via another snappy interface).
dbus (receive)
bus=session
interface="org.mozilla.firefox{,.*}"
peer=(label=unconfined),
# allow us to respond to unconfined clients via "/org/mozilla/firefox{,/**}" (eg,
# org.freedesktop.*, org.gtk.Application, etc) on classic (send should be
# handled via another snappy interface).
dbus (receive)
bus=session
path="/org/mozilla/firefox{,/**}"
peer=(label=unconfined),
# allow use of user namespaces
userns,
# subset of gnome abstraction
/etc/gtk-3.0/settings.ini r,
owner @{HOME}/.config/gtk-3.0/settings.ini r,
owner @{HOME}/.config/gtk-3.0/*.css r,
# Note: this leaks directory names that wouldn't otherwise be known to the snap
owner @{HOME}/.config/gtk-3.0/bookmarks r,
/usr/share/icons/ r,
/usr/share/icons/** r,
/usr/share/icons/*/index.theme rk,
/usr/share/pixmaps/ r,
/usr/share/pixmaps/** r,
/usr/share/unity/icons/** r,
/usr/share/thumbnailer/icons/** r,
/usr/share/themes/** r,
# The snapcraft desktop part may look for schema files in various locations, so
# allow reading system installed schemas.
/usr/share/glib*/schemas/{,*} r,
/usr/share/gnome/glib*/schemas/{,*} r,
/usr/share/ubuntu/glib*/schemas/{,*} r,
# subset of freedesktop.org
owner @{HOME}/.local/share/mime/** r,
owner @{HOME}/.config/user-dirs.* r,
/etc/xdg/user-dirs.conf r,
/etc/xdg/user-dirs.defaults r,
# gmenu
dbus (send)
bus=session
interface=org.gtk.Actions
member=Changed
peer=(label=unconfined),
# notifications
dbus (send)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.Notifications
member="{GetCapabilities,GetServerInformation,Notify,CloseNotification}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.Notifications
member={ActionInvoked,NotificationClosed,NotificationReplied}
peer=(label="{plasmashell,unconfined}"),
# KDE Plasma's Inhibited property indicating "do not disturb" mode
# https://invent.kde.org/plasma/plasma-workspace/-/blob/master/libnotificationmanager/dbus/org.freedesktop.Notifications.xml#L42
dbus (send)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member="Get{,All}"
peer=(label="{plasmashell,unconfined}"),
dbus (receive)
bus=session
path=/org/freedesktop/Notifications
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(label="{plasmashell,unconfined}"),
# DesktopAppInfo Launched
dbus (send)
bus=session
path=/org/gtk/gio/DesktopAppInfo
interface=org.gtk.gio.DesktopAppInfo
member=Launched
peer=(label=unconfined),
# Allow requesting interest in receiving media key events. This tells Gnome
# settings that our application should be notified when key events we are
# interested in are pressed, and allows us to receive those events.
dbus (receive, send)
bus=session
interface=org.gnome.SettingsDaemon.MediaKeys
path=/org/gnome/SettingsDaemon/MediaKeys
peer=(label=unconfined),
dbus (send)
bus=session
interface=org.freedesktop.DBus.Properties
path=/org/gnome/SettingsDaemon/MediaKeys
member="Get{,All}"
peer=(label=unconfined),
# Allow accessing the GNOME crypto services prompt APIs as used by
# applications using libgcr (such as pinentry-gnome3) for secure pin
# entry to unlock GPG keys etc. See:
# https://developer.gnome.org/gcr/unstable/GcrPrompt.html
# https://developer.gnome.org/gcr/unstable/GcrSecretExchange.html
dbus (send)
bus=session
path=/org/gnome/keyring/Prompter
interface=org.gnome.keyring.internal.Prompter
member="{BeginPrompting,PerformPrompt,StopPrompting}"
peer=(label=unconfined),
# While the DBus path is not snap-specific, by the time an application
# registers the prompt path via DBus, Gcr will check that it isn't
# already in use and send the client an error if it is. See:
# https://github.com/snapcore/snapd/pull/7673#issuecomment-592229711
dbus (receive)
bus=session
path=/org/gnome/keyring/Prompt/p[0-9]*
interface=org.gnome.keyring.internal.Prompter.Callback
member="{PromptReady,PromptDone}"
peer=(label=unconfined),
# Allow use of snapd's internal 'xdg-open'
/usr/bin/xdg-open ixr,
# While /usr/share/applications comes from the base runtime of the snap, it
# has some things that snaps actually need, so allow access to those and deny
# access to the others
/usr/share/applications/ r,
/usr/share/applications/mimeapps.list r,
/usr/share/applications/xdg-open.desktop r,
# silence noisy denials from desktop files in core* snaps that aren't usable by
# snaps
deny /usr/share/applications/python*.desktop r,
deny /usr/share/applications/vim.desktop r,
deny /usr/share/applications/snap-handle-link.desktop r, # core16
dbus (send)
bus=session
path=/
interface=com.canonical.SafeLauncher
member=OpenURL
peer=(label=unconfined),
# ... and this allows access to the new xdg-open service which
# is now part of snapd itself.
dbus (send)
bus=session
path=/io/snapcraft/Launcher
interface=io.snapcraft.Launcher
member={OpenURL,OpenFile}
peer=(label=unconfined),
# Allow checking status, activating and locking the screensaver
# gnome/kde/freedesktop.org
dbus (send)
bus=session
path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
interface="org.{freedesktop,gnome}.ScreenSaver"
member="{GetActive,GetActiveTime,Lock,SetActive}"
peer=(label=unconfined),
dbus (receive)
bus=session
path="/{,org/freedesktop/,org/gnome/}ScreenSaver"
interface="org.{freedesktop,gnome}.ScreenSaver"
member=ActiveChanged
peer=(label=unconfined),
# Allow unconfined to introspect us
dbus (receive)
bus=session
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
# Allow use of snapd's internal 'xdg-settings'
/usr/bin/xdg-settings ixr,
dbus (send)
bus=session
path=/io/snapcraft/Settings
interface=io.snapcraft.Settings
member={Check,CheckSub,Get,GetSub,Set,SetSub}
peer=(label=unconfined),
# These accesses are noisy and applications can't do anything with the found
# icon files, so explicitly deny to silence the denials
deny /var/lib/snapd/desktop/icons/{,**/} r,
# These accesses occur when flatpaks are on the system since it updates
# XDG_DATA_DIRS to contain $HOME/.local/share/flatpak/exports/share. Until
# we have better XDG_DATA_DIRS handling, silence these noisy denials.
# https://github.com/snapcrafters/discord/issues/23#issuecomment-637607843
deny @{HOME}/.local/share/flatpak/exports/share/** r,
# Allow access to the IBus portal (IBUS_USE_PORTAL=1)
dbus (send)
bus=session
path=/org/freedesktop/IBus
interface=org.freedesktop.IBus.Portal
member=CreateInputContext
peer=(name=org.freedesktop.portal.IBus),
dbus (send, receive)
bus=session
path=/org/freedesktop/IBus/InputContext_[0-9]*
interface=org.freedesktop.IBus.InputContext
peer=(label=unconfined),
# Allow access to the Fcitx portal, supported by fcitx/fcitx5
dbus (send)
bus=session
path=/{,org/freedesktop/portal/}inputmethod
interface=org.fcitx.Fcitx.InputMethod1
member={CreateInputContext,Version}
peer=(name=org.freedesktop.portal.Fcitx),
dbus (send, receive)
bus=session
path=/{,org/freedesktop/portal/}inputcontext/**
interface=org.fcitx.Fcitx.InputContext1
peer=(label=unconfined),
# Layout path: /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0
"/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0{,/**}" mrwklix,
# Layout path: /usr/lib/x86_64-linux-gnu/webkit2gtk-4.1
"/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1{,/**}" mrwklix,
# Layout path: /usr/share/alsa
"/usr/share/alsa{,/**}" mrwklix,
# Layout path: /usr/share/libdrm
"/usr/share/libdrm{,/**}" mrwklix,
# Layout path: /usr/share/xml/iso-codes
"/usr/share/xml/iso-codes{,/**}" mrwklix,
}
Mini Shell