# vim:syntax=apparmor

#include <tunables/global>

# Specified profile variables
@{APP_APPNAME}="pushHelper"
@{APP_ID_DBUS}="com_2eubuntu_2ereminders_5fpushHelper_5f0_2e5_2e552"
@{APP_PKGNAME_DBUS}="com_2eubuntu_2ereminders"
@{APP_PKGNAME}="com.ubuntu.reminders"
@{APP_VERSION}="0.5.552"
@{CLICK_DIR}="{/custom/click,/opt/click.ubuntu.com}"

profile "com.ubuntu.reminders_pushHelper_0.5.552" {
  #include <abstractions/base>

  # Apps fail to start when linked against newer curl/gnutls if we don't allow
  # this. (LP: #1350152)
  #include <abstractions/openssl>

  # Allow connecting to session bus and where to connect to services
  #include <abstractions/dbus-session-strict>

  # Deny potentially dangerous access
  deny dbus bus=session
            path=/com/canonical/[Uu]nity/[Dd]ebug**,
  audit deny dbus bus=session
                  interface="com.canonical.snapdecisions",
  deny dbus (send)
       bus=session
       interface="org.gnome.GConf.Server",

  # LP: #1433590
  deny dbus bus=system
            path="/org/freedesktop/Accounts",

  # Push helpers shouldn't have access to the clipboard (LP: #1371170)
  audit deny dbus (receive, send)
       bus=session
       path="/com/canonical/QtMir/Clipboard",

  # Push helpers shouldn't use URL dispatcher directly
  audit deny dbus (send)
       bus=session
       path="/com/canonical/URLDispatcher"
       interface="com.canonical.URLDispatcher"
       member="DispatchURL",

  # Don't allow apps to access scope endpoints
  audit deny /run/user/[0-9]*/zmq/   rw,
  audit deny /run/user/[0-9]*/zmq/** rwk,

  # Explicitly deny dangerous access
  audit deny /dev/input/** rw,
  deny /dev/fb0 rw, # don't use 'audit' since it is too noisy with the camera

  # Lttng tracing. Can safely deny. LP: #1260491
  deny /{,var/}run/shm/lttng-ust-* r,

  #
  # Application install dirs
  #

  # Click packages
  @{CLICK_DIR}/@{APP_PKGNAME}/                   r,
  @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/    r,
  @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/**  mrklix,

  # Packages shipped as debs have their install directory in /usr/share
  /usr/share/@{APP_PKGNAME}/ r,
  /usr/share/@{APP_PKGNAME}/** mrklix,

  #
  # Application writable dirs
  #
  # Allow writes to various (application-specific) XDG directories
  owner @{HOME}/.cache/@{APP_PKGNAME}/                  rw,      # subdir of XDG_CACHE_HOME
  owner @{HOME}/.cache/@{APP_PKGNAME}/**                mrwkl,
  owner @{HOME}/.config/@{APP_PKGNAME}/                 rw,      # subdir of XDG_CONFIG_HOME
  owner @{HOME}/.config/@{APP_PKGNAME}/**               mrwkl,
  owner @{HOME}/.local/share/@{APP_PKGNAME}/            rw,      # subdir of XDG_DATA_HOME
  owner @{HOME}/.local/share/@{APP_PKGNAME}/**          mrwklix,
  owner /{,var/}run/user/*/@{APP_PKGNAME}/              rw,      # subdir of XDG_RUNTIME_DIR
  owner /{,var/}run/user/*/@{APP_PKGNAME}/**            mrwkl,
  owner /{,var/}run/user/*/confined/@{APP_PKGNAME}/     rw,      # subdir of XDG_RUNTIME_DIR (for TMPDIR)
  owner /{,var/}run/user/*/confined/@{APP_PKGNAME}/**   mrwkl,

  # Allow writes to application-specific QML cache directories
  owner @{HOME}/.cache/QML/Apps/@{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION}/   rw,
  owner @{HOME}/.cache/QML/Apps/@{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION}/** mrwkl,

  # No abstractions specified

  # Rules specified via policy groups
  # Description: Can use Online Accounts.
  # Usage: common
  /usr/share/accounts/** r,
  
  dbus (receive, send)
       bus=session
       path=/com/google/code/AccountsSSO/SingleSignOn
       interface=com.google.code.AccountsSSO.SingleSignOn.AuthService
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       path=/com/google/code/AccountsSSO/SingleSignOn{,/**}
       interface=org.freedesktop.DBus.Properties
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       interface=com.google.code.AccountsSSO.SingleSignOn.AuthSession
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       interface=com.google.code.AccountsSSO.SingleSignOn.Identity
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       interface=com.ubuntu.OnlineAccountsUi
       peer=(label=unconfined),
  dbus (receive)
       bus=session
       interface=com.google.code.AccountsSSO.Accounts
       peer=(label=unconfined),
  
  # p2p support uses a named unix socket, available only to unconfined apps.
  deny /{,var/}run/user/*/signond/socket rw,
  
  # read access to accounts.db is ok
  owner @{HOME}/.config/libaccounts-glib/accounts.db* rk,
  # FIXME: LP: #1220713 - online accounts currently tries rw and falls back to
  #        ro. This can go away once an access() LSM hook is implemented. For
  #        now, just silence the denial.
  deny @{HOME}/.config/libaccounts-glib/accounts.db* w,
  
  # apps will dereference the symlinks in this directory to access their own
  # accounts provider (which is in an app-specific directory). This is not an
  # information leak on its own because users of this policy group have read
  # access to accounts.db.
  owner @{HOME}/.local/share/accounts/** r,
  
  # Note: this API should *not* be allowed to normal apps, only the
  # webapp-container. As such, we can't explicitly deny access here but it is
  # listed as a comment to make sure it isn't accidentally added in the future.
  # audit deny dbus (receive, send)
  #                 bus=session
  #                 interface=com.nokia.singlesignonui
  #                 member=cookiesForIdentity,
  
  # Online Accounts v2 API
  dbus (receive, send)
       bus=session
       interface=com.ubuntu.OnlineAccounts.Manager
       peer=(label=unconfined),

  # Description: Can access the calendar. This policy group is reserved for
  #  vetted applications only in this version of the policy. Once LP: #1227824
  #  is fixed, this can be moved out of reserved status.
  # Usage: reserved
  
  # The gsettings entries for EDS aren't required for the calendar, so
  # just silence these
  # TODO: remove when we have gsettings mediation
  deny /{,var/}run/user/*/dconf/user r,
  deny /{,var/}run/user/*/dconf/user w,
  deny @{HOME}/.config/dconf/user    r,
  
  dbus (receive, send)
       bus=session
       path=/org/gnome/evolution/dataserver/SourceManager{,/**}
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       path=/org/gnome/evolution/dataserver/CalendarFactory
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       path=/org/gnome/evolution/dataserver/Calendar/**
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       path=/org/gnome/evolution/dataserver/CalendarView/**
       peer=(label=unconfined),
  
  # This interface was created specifically to allow alarms to confined apps
  dbus (receive, send)
       bus=session
       path=/com/canonical/indicator/datetime/AlarmProperties{,**}
       interface=com.canonical.indicator.datetime.AlarmProperties
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       path=/com/canonical/indicator/datetime/AlarmProperties{,**}
       interface=org.freedesktop.DBus.{Introspectable,Properties}
       peer=(label=unconfined),
  
  # LP: #1319546. Apps shouldn't talk directly to sync-monitor, but allow it for
  # now for trusted apps until sync-monitor is integrated with push
  # notifications. IMPORTANT: this policy group cannot be moved to 'common'
  # status until this rule is removed.
  dbus (receive, send)
       bus=session
       path=/com/canonical/SyncMonitor{,/**}
       peer=(label=unconfined),

  # Description: Can access the network
  # Usage: common
  #include <abstractions/nameservice>
  
  # DownloadManager
  dbus (send)
       bus=session
       interface="org.freedesktop.DBus.Introspectable"
       path=/
       member=Introspect
       peer=(label=unconfined),
  dbus (send)
       bus=session
       interface="org.freedesktop.DBus.Introspectable"
       path=/com/canonical/applications/download/**
       member=Introspect
       peer=(label=unconfined),
  # Allow DownloadManager to send us signals, etc
  dbus (receive)
       bus=session
       interface=com.canonical.applications.Download{,er}Manager
       peer=(label=unconfined),
  # Restrict apps to just their own downloads
  owner @{HOME}/.local/share/ubuntu-download-manager/@{APP_PKGNAME}/   rw,
  owner @{HOME}/.local/share/ubuntu-download-manager/@{APP_PKGNAME}/** rwk,
  dbus (receive, send)
       bus=session
       path=/com/canonical/applications/download/@{APP_ID_DBUS}/**
       interface=com.canonical.applications.Download
       peer=(label=unconfined),
  dbus (receive, send)
       bus=session
       path=/com/canonical/applications/download/@{APP_ID_DBUS}/**
       interface=com.canonical.applications.GroupDownload
       peer=(label=unconfined),
  # Be explicit about the allowed members we can send to
  dbus (send)
       bus=session
       path=/
       interface=com.canonical.applications.DownloadManager
       member=createDownload
       peer=(label=unconfined),
  dbus (send)
       bus=session
       path=/
       interface=com.canonical.applications.DownloadManager
       member=createDownloadGroup
       peer=(label=unconfined),
  dbus (send)
       bus=session
       path=/
       interface=com.canonical.applications.DownloadManager
       member=getAllDownloads
       peer=(label=unconfined),
  dbus (send)
       bus=session
       path=/
       interface=com.canonical.applications.DownloadManager
       member=getAllDownloadsWithMetadata
       peer=(label=unconfined),
  dbus (send)
       bus=session
       path=/
       interface=com.canonical.applications.DownloadManager
       member=defaultThrottle
       peer=(label=unconfined),
  dbus (send)
       bus=session
       path=/
       interface=com.canonical.applications.DownloadManager
       member=isGSMDownloadAllowed
       peer=(label=unconfined),
  # Explicitly deny DownloadManager APIs apps shouldn't have access to in order
  # to make sure they aren't accidentally added in the future (see LP: #1277578
  # for details)
  audit deny dbus (send)
       bus=session
       interface=com.canonical.applications.DownloadManager
       member=allowGSMDownload,
  audit deny dbus (send)
       bus=session
       interface=com.canonical.applications.DownloadManager
       member=createMmsDownload,
  audit deny dbus (send)
       bus=session
       interface=com.canonical.applications.DownloadManager
       member=exit,
  audit deny dbus (send)
       bus=session
       interface=com.canonical.applications.DownloadManager
       member=setDefaultThrottle,
  
  # We want to explicitly deny access to NetworkManager because its DBus API
  # gives away too much
  deny dbus (receive, send)
       bus=system
       path=/org/freedesktop/NetworkManager,
  deny dbus (receive, send)
       bus=system
       peer=(name=org.freedesktop.NetworkManager),
  
  # Do the same for ofono (LP: #1226844)
  deny dbus (receive, send)
       bus=system
       interface="org.ofono.Manager",

  # Description: Can use push notifications as a client
  # Usage: common
  
  dbus (receive, send)
       bus=session
       interface=com.ubuntu.PushNotifications
       path=/com/ubuntu/PushNotifications/@{APP_PKGNAME_DBUS}{,/**}
       peer=(label=unconfined),
  
  dbus (receive, send)
       bus=session
       interface=com.ubuntu.Postal
       path=/com/ubuntu/Postal/@{APP_PKGNAME_DBUS}{,/**}
       peer=(label=unconfined),
  
  # Some push helpers are written in python. This isn't strictly allowed since
  # frameworks don't support yet, but silence these to avoid confusion
  deny /usr/local/lib/python*/** r,

  # Description: Can use the UbuntuWebview
  # Usage: common
  
    # UbuntuWebview
    /usr/share/qtdeclarative5-ubuntu-ui-extras-browser-plugin/ r,
    /usr/share/qtdeclarative5-ubuntu-ui-extras-browser-plugin/** r,
    /usr/share/qtdeclarative5-ubuntu-web-plugin/ r,
    /usr/share/qtdeclarative5-ubuntu-web-plugin/** r,
  
    ptrace (read, trace) peer=@{profile_name},
    signal peer=@{profile_name}//oxide_helper,
  
    # Allow communicating with sandbox
    unix (receive, send) peer=(label=@{profile_name}//oxide_helper),
  
    # LP: #1260090 - when this bug is fixed, oxide_renderer can become a
    # child profile of this profile, then we'll use Cx here and Px in
    # chrome_sandbox. Ideally, chrome-sandbox and oxide-renderer would ship
    # as standalone profiles and we would just Px/px to them, but this is not
    # practical because oxide-renderer needs to access app-specific files
    # and shm files (when 1260103 is fixed). For now, have a single helper
    # profile for chrome-sandbox and oxide-renderer.
    /usr/lib/@{multiarch}/oxide-qt/oxide-renderer Cxmr -> oxide_helper,
    /usr/lib/@{multiarch}/oxide-qt/chrome-sandbox cxmr -> oxide_helper,
  
    /usr/lib/@{multiarch}/oxide-qt/* r,
    @{PROC}/[0-9]*/task/[0-9]*/stat r,
  
    # LP: #1275917 (not a problem, but unnecessary)
    /usr/share/glib-2.0/schemas/gschemas.compiled r,
  
    # LP: #1260044
    deny /usr/lib/@{multiarch}/qt5/bin/locales/ w,
    deny /usr/bin/locales/ w,
  
    # LP: #1260101
    deny /run/user/[0-9]*/dconf/user rw,
    deny owner @{HOME}/.config/dconf/user r,
    deny /custom/etc/dconf_profile r,
  
    # LP: #1357371 (webapp-container needs corresponding 'bind' call on
    # org.freedesktop.Application, which we block elsewhere. webapp-container
    # shouldn't be doing this under confinement, but we allow this rule in
    # content_exchange, so just allow it to avoid confusion)
    dbus (send)
         bus=session
         path=/org/freedesktop/DBus
         interface=org.freedesktop.DBus
         member=RequestName
         peer=(label=unconfined),
  
    # LP: #1260048 - only allow 'r' for now, since 'w' allow for db poisoning
    owner @{HOME}/.pki/nssdb/ r,
    owner @{HOME}/.pki/nssdb/** rk,
    deny @{HOME}/.pki/nssdb/ w,
    deny @{HOME}/.pki/nssdb/** w,
  
    # LP: #
    /sys/bus/pci/devices/ r,
    /sys/devices/system/cpu/ r,
    /sys/devices/system/cpu/cpu[0-9]*/cpufreq/cpuinfo_max_freq r,
    /sys/devices/pci[0-9]*/**/class r,
    /sys/devices/pci[0-9]*/**/device r,
    /sys/devices/pci[0-9]*/**/irq r,
    /sys/devices/pci[0-9]*/**/resource r,
    /sys/devices/pci[0-9]*/**/vendor r,
    /sys/devices/pci[0-9]*/**/removable r,
    /sys/devices/pci[0-9]*/**/uevent r,
    /sys/devices/pci[0-9]*/**/block/**/size r,
    /etc/udev/udev.conf r,
  
    # LP: #1260098
    /tmp/ r,
    /var/tmp/ r,
  
    # LP: #1260103
    owner /run/shm/.org.chromium.Chromium.* rwk,
  
    # LP: #1260090 - when this bug is fixed, oxide_renderer can become a
    # child profile of this profile, then we can use Cx here and Px in
    # chrome_sandbox. Ideally, chrome-sandbox and oxide-renderer would ship
    # as standalone profiles and we would just Px/px to them, but this is not
    # practical because oxide-renderer needs to access app-specific files
    # and shm files (when 1260103 is fixed). For now, have a single helper
    # profile for chrome-sandbox and oxide-renderer.
    profile oxide_helper (attach_disconnected) {
      #
      # Shared by chrome-sandbox and oxide-helper
      #
      #include <abstractions/base>
  
      # So long as we don't give /dev/binder, this should be 'ok'
      /{,android/}vendor/lib/*.so        mr,
      /{,android/}system/lib/*.so        mr,
      /{,android/}system/vendor/lib/*.so mr,
      /{,android/}system/build.prop      r,
      /dev/socket/property_service rw, # attach_disconnected path
  
      @{PROC}/ r,
      @{PROC}/[0-9]*/ r,
      @{PROC}/[0-9]*/fd/ r,
      @{PROC}/[0-9]*/auxv r,
      owner @{PROC}/[0-9]*/status r,
      owner @{PROC}/[0-9]*/task/ r,
      owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
      /sys/devices/system/cpu/ r,
      /sys/devices/system/cpu/cpu[0-9]*/cpufreq/cpuinfo_max_freq r,
  
      #
      # chrome-sandbox specific
      #
      # Required for dropping into PID namespace. Keep in mind that until the
      # process drops this capability it can escape confinement, but once it
      # drops CAP_SYS_ADMIN we are ok.
      capability sys_admin,
  
      # All of these are for sanely dropping from root and chrooting
      capability chown,
      capability fsetid,
      capability setgid,
      capability setuid,
      capability dac_override,
      capability dac_read_search,
      capability sys_chroot,
  
      capability sys_ptrace,
      ptrace (read, readby),
      signal peer=@{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION},
  
      unix peer=(label=@{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION}),
      unix (create),
      unix peer=(label=@{profile_name}),
      unix (getattr, getopt, setopt, shutdown),
  
      # LP: #1260115
      deny @{PROC}/[0-9]*/oom_adj w,
      deny @{PROC}/[0-9]*/oom_score_adj w,
  
      /usr/lib/@{multiarch}/oxide-qt/oxide-renderer rmix,
  
      #
      # oxide-renderer specific
      #
      #include <abstractions/fonts>
      @{PROC}/sys/kernel/shmmax r,
      @{PROC}/sys/kernel/yama/ptrace_scope r,
      deny /etc/passwd r,
      deny /tmp/ r,
      deny /var/tmp/ r,
  
      /usr/lib/@{multiarch}/oxide-qt/chrome-sandbox rmix,
  
      # The renderer may need access to app-specific files, such as WebCore
      # databases
      owner @{HOME}/.local/share/@{APP_PKGNAME}/   rw,
      owner @{HOME}/.local/share/@{APP_PKGNAME}/** mrwkl,
  
      # LP: #1260103
      /run/shm/.org.chromium.Chromium.* rwk,
  
      # LP: #1260048
      owner @{HOME}/.pki/nssdb/ rw,
      owner @{HOME}/.pki/nssdb/** rwk,
  
      # LP: #1260044
      deny /usr/lib/@{multiarch}/oxide-qt/locales/ w,
    }

  # No read paths specified

  # No write paths specified
}
