# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# LOGPROF-SUGGEST: no
# NEEDS-VARIABLE: appid
# NEEDS-VARIABLE: att
# NEEDS-VARIABLE: profile_dbus

# Default rules for all flatpak applications. Ideally, they should be
# generated with settings from the flatpak metadata.
#
# Security objectives:
#
# 1. Split the sandbox handler (bwrap) from the app profile (fapp)
# 2. Provide defence in depth, as flatpak already provides a sandbox
# 3. The main purpose of this profile is to ensure all processes are confined
#
# Notable security improvements over no profile at all:
#
# - No capabilities (except `dac_override` & `dac_read_search`)
# - Restrict unix socket to profiles defined in apparmor.d
# - Limit dbus system communication to profiles defined in apparmor.d
# - Ensure flatpak-spawn and host-spawn are confined too
# - Filter `/proc/`, `/sys/` access
#
# Keep in mind that the profile is still common for all apps and is therefore
# way more permissive than a per-app profile would be.
#
# Abstractions in `abstractions/flatpak/` closelly follow the sandbox defined by
# flatpak, and are therefore different to they host equivalents, as flatpak apps
# do not have access to the full host filesystem.

  abi <abi/4.0>,

  include <abstractions/flatpak/base>

  # The app base platform, similar to our desktop abstraction, but with flatpak paths
  include <abstractions/flatpak/platform/org.freedesktop>

  # Base app specific rules, they are all included as it is for a generic profile
  include <abstractions/flatpak/baseapp/com.valvesoftware.Steam>
  include <abstractions/flatpak/baseapp/org.chromium.Chromium>
  include <abstractions/flatpak/baseapp/org.mozilla.firefox>

  # Flatpak devices '--device='
  include <abstractions/flatpak/devices/all>
  include <abstractions/flatpak/devices/shm>

  # Flatpack share (IPC, network) with the host '--share='
  include <abstractions/flatpak/shared/ipc>
  include <abstractions/flatpak/shared/network>

  # Flatpack sockets '--socket='
  include <abstractions/flatpak/sockets/cups>
  include <abstractions/flatpak/sockets/fallback-x11>
  include <abstractions/flatpak/sockets/gpg-agent>
  include <abstractions/flatpak/sockets/inherit-wayland-socket>
  include <abstractions/flatpak/sockets/pcsc>
  include <abstractions/flatpak/sockets/pulseaudio>
  include <abstractions/flatpak/sockets/session-bus>
  include <abstractions/flatpak/sockets/ssh-auth>
  include <abstractions/flatpak/sockets/system-bus>
  include <abstractions/flatpak/sockets/wayland>
  include <abstractions/flatpak/sockets/x11>

  # Flatpak features '--feature='
  include <abstractions/flatpak/features/bluetooth>
  include <abstractions/flatpak/features/canbus>
  include <abstractions/flatpak/features/devel>
  include <abstractions/flatpak/features/multiarch>
  include <abstractions/flatpak/features/per-app-dev-shm>

  # Flatpak filesystem access '--filesystem='
  # As a generic profile cannot filter filesystem for each app, this gives
  # full access to the user's home, and read only acccess to host system files.
  # In the limmit of what is allowed by flatpak.
  include <abstractions/flatpak/filesystem>

  # Programming language specific resources
  include <abstractions/java>

  signal (send receive) peer=fapp,
  signal (send receive) peer=fapp//&fbwrap,
  signal (send receive) peer=fbwrap,

  ptrace (read trace) peer=fapp,
  ptrace (read trace) peer=fapp//&fbwrap,
  ptrace (read trace) peer=fbwrap,

  unix (bind listen) type=seqpacket addr=@*,
  unix type=dgram     peer=(label=fbwrap),
  unix type=seqpacket peer=(label=fbwrap),
  unix type=stream    peer=(label=fbwrap),
  unix type=stream    peer=(label=unconfined),

  # apply_extra
  /app/extra/** w,

  # Qt runtime translations, remapped inside the flatpak sandbox
  /usr/translations/{,**} r,

  /etc/issue r,
  /etc/os-release r,

  # Self-introspection within the sandbox's own low-pid namespace
  @{PROC}/[0-9]*/ r,
  @{PROC}/[0-9]*/mountinfo r,
  @{PROC}/[0-9]*/mounts r,
  @{PROC}/[0-9]*/net/arp r,
  @{PROC}/[0-9]*/oom_score r,
  @{PROC}/[0-9]*/task/[0-9]*/comm rw,
  @{PROC}/[0-9]*/statm r,

  # Some apps O_CREAT-open files that already exist (e.g. AnyDesk's /proc/cpuinfo probe)
  @{PROC}/cpuinfo rw,

  # Hardware/platform device identification (e.g. Electron gamepad enumeration)
  @{sys}/devices/platform/uevent r,
  @{sys}/devices/platform/**/uevent r,

  # Network/PCI device enumeration (e.g. lspci, reading a MAC address)
  @{sys}/bus/pci/slots/ r,
  @{sys}/bus/pci/slots/*/address r,
  @{sys}/devices/@{pci}/label r,
  @{sys}/devices/@{pci}/net/*/address r,
  @{PROC}/bus/pci/devices r,

  # CPU topology/capability enumeration
  @{sys}/devices/system/cpu/cpu@{int}/cache/index@{int}/number_of_sets r,
  @{sys}/devices/system/cpu/cpu@{int}/hotplug/state r,
  @{sys}/devices/system/cpu/cpu@{int}/topology/core_id r,
  @{sys}/devices/system/cpu/cpu@{int}/topology/core_siblings r,
  @{sys}/devices/system/cpu/hotplug/states r,
  @{sys}/devices/system/cpu/vulnerabilities/ r,
  @{sys}/devices/system/cpu/vulnerabilities/* r,

  /dev/urandom rw,

  # Gamepad/joystick enumeration (e.g. browser Gamepad API implementations)
  /dev/input/by-id/ r,
  /dev/input/by-path/ r,

  # Qt theme engine plugin, from the shared freedesktop runtime
  /usr/share/runtime/lib/plugins/Kvantum/styles/*.so m,

  include if exists <abstractions/app/flatpak.d>

# vim:syntax=apparmor
