home *** CD-ROM | disk | FTP | other *** search
- # vim:syntax=apparmor
- # Last Modified: Thu Aug 2 12:54:46 2007
- # Author: Martin Pitt <martin.pitt@ubuntu.com>
-
- #include <tunables/global>
-
- /usr/sbin/cupsd {
- #include <abstractions/base>
- #include <abstractions/bash>
- #include <abstractions/authentication>
- #include <abstractions/dbus>
- #include <abstractions/fonts>
- #include <abstractions/nameservice>
- #include <abstractions/perl>
- #include <abstractions/user-tmp>
-
- capability chown,
- capability fowner,
- capability fsetid,
- capability kill,
- capability net_bind_service,
- capability setgid,
- capability setuid,
-
- # nasty, but we limit file access pretty tightly, and cups chowns a
- # lot of files to 'lp' which it cannot read/write afterwards any
- # more
- capability dac_override,
-
- # the bluetooth backend needs this
- network bluetooth,
-
- # the dnssd backend uses those
- network x25 seqpacket,
- network ax25 dgram,
- network netrom seqpacket,
- network rose dgram,
- network ipx dgram,
- network appletalk dgram,
- network econet dgram,
- network ash dgram,
-
- /bin/bash ixr,
- /bin/dash ixr,
- /bin/hostname ixr,
- /dev/lp* rw,
- deny /dev/tty rw, # silence noise
- /dev/ttyS* rw,
- /dev/usb/lp* rw,
- /dev/bus/usb/ r,
- /dev/bus/usb/** rw,
- /dev/parport* rw,
- /etc/cups/ rw,
- /etc/cups/** rw,
- /etc/foomatic/* r,
- /etc/gai.conf r,
- /etc/papersize r,
- /etc/pnm2ppa.conf r,
- /etc/printcap rwl,
- /etc/ssl/** r,
- @{PROC}/net/ r,
- @{PROC}/net/* r,
- @{PROC}/sys/dev/parport/** r,
- @{PROC}/*/net/ r,
- @{PROC}/*/net/** r,
- @{PROC}/sys/crypto/** r,
- /sys/** r,
- /usr/bin/* ixr,
- /usr/sbin/* ixr,
- /bin/* ixr,
- /sbin/* ixr,
- /usr/lib/** rm,
-
- # backends which come with CUPS can be confined
- /usr/lib/cups/backend/bluetooth ixr,
- /usr/lib/cups/backend/dnssd ixr,
- /usr/lib/cups/backend/http ixr,
- /usr/lib/cups/backend/ipp ixr,
- /usr/lib/cups/backend/lpd ixr,
- /usr/lib/cups/backend/parallel ixr,
- /usr/lib/cups/backend/scsi ixr,
- /usr/lib/cups/backend/serial ixr,
- /usr/lib/cups/backend/snmp ixr,
- /usr/lib/cups/backend/socket ixr,
- /usr/lib/cups/backend/usb ixr,
- # we treat cups-pdf specially, since it needs to write into /home
- # and thus needs extra paranoia
- /usr/lib/cups/backend/cups-pdf Px,
- # third party backends get no restrictions as they often need high
- # privileges and this is beyond our control
- /usr/lib/cups/backend/* Ux,
-
- /usr/lib/cups/cgi-bin/* ixr,
- /usr/lib/cups/daemon/* ixr,
- /usr/lib/cups/monitor/* ixr,
- /usr/lib/cups/notifier/* ixr,
- # filters and drivers (PPD generators) are always run as non-root,
- # and there are a lot of third-party drivers which we cannot predict
- /usr/lib/cups/filter/* Uxr,
- /usr/lib/cups/driver/* Uxr,
- /usr/local/share/** r,
- /usr/share/** r,
- /var/cache/cups/ rw,
- /var/cache/cups/** rwk,
- /var/log/cups/ rw,
- /var/log/cups/* rw,
- /var/run/avahi-daemon/socket rw,
- /var/run/cups/ rw,
- /var/run/cups/** rw,
- /var/spool/cups/ rw,
- /var/spool/cups/** rw,
-
- # third-party printer drivers; no known structure here
- /opt/** rix,
-
- # FIXME: no policy ATM for hplip and Brother drivers
- /usr/bin/hpijs Ux,
- /usr/Brother/** Ux,
-
- # Kerberos authentication
- /etc/krb5.conf r,
- deny /etc/krb5.conf w,
- /etc/krb5.keytab rk,
- /etc/cups/krb5.keytab rwk,
- /tmp/krb5cc* k,
-
- # likewise authentication
- /etc/likewise r,
- /etc/likewise/* r,
- }
-
- # separate profile since this needs to write into /home
- /usr/lib/cups/backend/cups-pdf {
- #include <abstractions/base>
- #include <abstractions/fonts>
- #include <abstractions/nameservice>
- #include <abstractions/user-tmp>
-
- capability chown,
- capability fowner,
- capability fsetid,
- capability setgid,
- capability setuid,
-
- # unfortunate, but required for when $HOME is 700
- capability dac_override,
-
- /bin/dash ixr,
- /bin/bash ixr,
- /bin/cp ixr,
- /etc/papersize r,
- /etc/cups/cups-pdf.conf r,
- @{HOME}/PDF/ rw,
- @{HOME}/PDF/* rw,
- /usr/bin/gs ixr,
- /usr/lib/cups/backend/cups-pdf mr,
- /usr/lib/ghostscript/** mr,
- /usr/share/** r,
- /var/log/cups/cups-pdf_log w,
- /var/spool/cups-pdf/** rw,
- }
-