FM / apparmor.d

/etc/apparmor.d

Name	Size	Mode	Actions
abi/	-	0755	rm
abstractions/	-	0755	rm
disable/	-	0755	rm
force-complain/	-	0755	rm
local/	-	0755	rm
rsyslog.d/	-	0755	rm
tunables/	-	0755	rm
1password	354	0644	edit dl rm
balena-etcher	374	0644	edit dl rm
brave	348	0644	edit dl rm
buildah	342	0644	edit dl rm
busybox	342	0644	edit dl rm
cam	330	0644	edit dl rm
ch-checkns	351	0644	edit dl rm
ch-run	339	0644	edit dl rm
chrome	349	0644	edit dl rm
code	349	0644	edit dl rm
crun	333	0644	edit dl rm
devhelp	342	0644	edit dl rm
Discord	352	0644	edit dl rm
element-desktop	368	0644	edit dl rm
epiphany	356	0644	edit dl rm
evolution	348	0644	edit dl rm
firefox	410	0644	edit dl rm
flatpak	342	0644	edit dl rm
foliate	342	0644	edit dl rm
geary	336	0644	edit dl rm
github-desktop	378	0644	edit dl rm
goldendict	353	0644	edit dl rm
ipa_verify	351	0644	edit dl rm
kchmviewer	353	0644	edit dl rm
keybase	346	0644	edit dl rm
lc-compliance	360	0644	edit dl rm
libcamerify	354	0644	edit dl rm
linux-sandbox	383	0644	edit dl rm
loupe	336	0644	edit dl rm
lsb_release	1379	0644	edit dl rm
lxc-attach	351	0644	edit dl rm
lxc-create	351	0644	edit dl rm
lxc-destroy	354	0644	edit dl rm
lxc-execute	354	0644	edit dl rm
lxc-stop	345	0644	edit dl rm
lxc-unshare	354	0644	edit dl rm
lxc-usernsexec	363	0644	edit dl rm
mmdebstrap	351	0644	edit dl rm
MongoDB_Compass	386	0644	edit dl rm
msedge	352	0644	edit dl rm
nautilus	346	0644	edit dl rm
notepadqq	402	0644	edit dl rm
nvidia_modprobe	1213	0644	edit dl rm
obsidian	350	0644	edit dl rm
opam	333	0644	edit dl rm
opera	355	0644	edit dl rm
pageedit	347	0644	edit dl rm
plasmashell	680	0644	edit dl rm
podman	339	0644	edit dl rm
polypane	350	0644	edit dl rm
privacybrowser	365	0644	edit dl rm
qcam	333	0644	edit dl rm
qmapshack	348	0644	edit dl rm
QtWebEngineProcess	404	0644	edit dl rm
qutebrowser	354	0644	edit dl rm
rootlesskit	354	0644	edit dl rm
rpm	330	0644	edit dl rm
rssguard	347	0644	edit dl rm
runc	334	0644	edit dl rm
sbuild	339	0644	edit dl rm
sbuild-abort	357	0644	edit dl rm
sbuild-adduser	364	0644	edit dl rm
sbuild-apt	351	0644	edit dl rm
sbuild-checkpackages	381	0644	edit dl rm
sbuild-clean	357	0644	edit dl rm
sbuild-createchroot	378	0644	edit dl rm
sbuild-destroychroot	382	0644	edit dl rm
sbuild-distupgrade	375	0644	edit dl rm
sbuild-hold	354	0644	edit dl rm
sbuild-shell	365	0644	edit dl rm
sbuild-unhold	360	0644	edit dl rm
sbuild-update	360	0644	edit dl rm
sbuild-upgrade	363	0644	edit dl rm
scide	355	0644	edit dl rm
signal-desktop	366	0644	edit dl rm
slack	342	0644	edit dl rm
slirp4netns	354	0644	edit dl rm
steam	363	0644	edit dl rm
stress-ng	348	0644	edit dl rm
surfshark	354	0644	edit dl rm
systemd-coredump	377	0644	edit dl rm
thunderbird	354	0644	edit dl rm
toybox	335	0644	edit dl rm
transmission	2400	0644	edit dl rm
trinity	342	0644	edit dl rm
tup	330	0644	edit dl rm
tuxedo-control-center	400	0644	edit dl rm
ubuntu_pro_apt_news	2064	0644	edit dl rm
ubuntu_pro_esm_cache	7217	0644	edit dl rm
unix-chkpwd	881	0644	edit dl rm
unprivileged_userns	699	0644	edit dl rm
userbindmount	360	0644	edit dl rm
usr.bin.man	3448	0644	edit dl rm
usr.bin.tcpdump	1687	0644	edit dl rm
usr.lib.snapd.snap-confine.real	31701	0644	edit dl rm
usr.sbin.chronyd	2838	0644	edit dl rm
usr.sbin.mysqld	2006	0644	edit dl rm
usr.sbin.rsyslogd	1872	0644	edit dl rm
uwsgi-core	351	0644	edit dl rm
vdens	336	0644	edit dl rm
virtiofsd	352	0644	edit dl rm
vivaldi-bin	358	0644	edit dl rm
vpnns	336	0644	edit dl rm
wike	333	0644	edit dl rm
wpcom	346	0644	edit dl rm

Edit: /etc/apparmor.d/usr.bin.man (3448B)

# vim:syntax=apparmor

#include <tunables/global>

/usr/bin/man {
  #include <abstractions/base>

# Use a special profile when man calls anything groff-related.  We only
  # include the programs that actually parse input data in a non-trivial
  # way, not wrappers such as groff and nroff, since the latter would need a
  # broader profile.
  /usr/bin/eqn rmCx -> &man_groff,
  /usr/bin/grap rmCx -> &man_groff,
  /usr/bin/pic rmCx -> &man_groff,
  /usr/bin/preconv rmCx -> &man_groff,
  /usr/bin/refer rmCx -> &man_groff,
  /usr/bin/tbl rmCx -> &man_groff,
  /usr/bin/troff rmCx -> &man_groff,
  /usr/bin/vgrind rmCx -> &man_groff,

# Similarly, use a special profile when man calls decompressors and other
  # simple filters.
  /{,usr/}bin/bzip2 rmCx -> &man_filter,
  /{,usr/}bin/gzip rmCx -> &man_filter,
  /usr/bin/col rmCx -> &man_filter,
  /usr/bin/compress rmCx -> &man_filter,
  /usr/bin/iconv rmCx -> &man_filter,
  /usr/bin/lzip.lzip rmCx -> &man_filter,
  /usr/bin/tr rmCx -> &man_filter,
  /usr/bin/xz rmCx -> &man_filter,

# Allow basically anything in terms of file system access, subject to DAC.
  # The purpose of this profile isn't to confine man itself (that might be
  # nice in the future, but is tricky since it's quite configurable), but to
  # confine the processes it calls that parse untrusted data.
  /** mrixwlk,
  unix,

capability setuid,
  capability setgid,

# Ordinary permission checks sometimes involve checking whether the
  # process has this capability, which can produce audit log messages.
  # Silence them.
  deny capability dac_override,
  deny capability dac_read_search,

signal peer=@{profile_name},
  signal peer=/usr/bin/man//&man_groff,
  signal peer=/usr/bin/man//&man_filter,

# Site-specific additions and overrides.  See local/README for details.
  #include <local/usr.bin.man>
}

profile man_groff {
  #include <abstractions/base>
  # Recent kernels revalidate open FDs, and there are often some still
  # open on TTYs.  This is temporary until man learns to close irrelevant
  # open FDs before execve.
  #include <abstractions/consoles>
  # man always runs its groff pipeline with the input file open on stdin,
  # so we can skip <abstractions/user-manpages>.

/usr/bin/eqn rm,
  /usr/bin/grap rm,
  /usr/bin/pic rm,
  /usr/bin/preconv rm,
  /usr/bin/refer rm,
  /usr/bin/tbl rm,
  /usr/bin/troff rm,
  /usr/bin/vgrind rm,

/etc/groff/** r,
  /etc/papersize r,
  /usr/lib/groff/site-tmac/** r,
  /usr/share/groff/** r,

/tmp/groff* rw,

signal peer=/usr/bin/man,
  # @{profile_name} doesn't seem to work here.
  signal peer=/usr/bin/man//&man_groff,
}

profile man_filter {
  #include <abstractions/base>
  # Recent kernels revalidate open FDs, and there are often some still
  # open on TTYs.  This is temporary until man learns to close irrelevant
  # open FDs before execve.
  #include <abstractions/consoles>

/{,usr/}bin/bzip2 rm,
  /{,usr/}bin/gzip rm,
  /usr/bin/col rm,
  /usr/bin/compress rm,
  /usr/bin/iconv rm,
  /usr/bin/lzip.lzip rm,
  /usr/bin/tr rm,
  /usr/bin/xz rm,

# Manual pages can be more or less anywhere, especially with "man -l", and
  # there's no harm in allowing wide read access here since the worst it can
  # do is feed data to the invoking man process.
  /** r,

# Allow writing cat pages.
  /var/cache/man/** w,

signal peer=/usr/bin/man,
  # @{profile_name} doesn't seem to work here.
  signal peer=/usr/bin/man//&man_filter,
}

cmd: