skype 4 ja apparmor

[ops]

Lisasin /etc/apparmor.d kataloogi sellise faili: usr.bin.skype

Kood: Vali kõik

#include <tunables/global>

/usr/bin/skype {

    #include <abstractions/base>
    #include <abstractions/user-tmp>
    #include <abstractions/audio>
    #include <abstractions/nameservice>
    #include <abstractions/ssl_certs>
    #include <abstractions/fonts>
    #include <abstractions/X>
    #include <abstractions/freedesktop.org>
    #include <abstractions/kde>
    #include <abstractions/gnome>

    /usr/bin/skype mr,
    /opt/skype/skype pix,
    /opt/skype/** kmr,
    /usr/share/fonts/X11/** m,

    @{PROC}/*/net/arp r,
    @{PROC}/sys/kernel/ostype r,
    @{PROC}/sys/kernel/osrelease r,

    /dev/ r,
    /dev/tty rw,
        /dev/snd/* mrw,
        /dev/shm/ r,
        /dev/shm/pulse-shm-* mrw,
    /etc/pulse/client.conf r,
    /dev/pts/* rw,
    /dev/video* mrw,
    /var/lib/dbus/machine-id r,
    @{HOME}/Downloads/* krw,
    @{HOME}/Downloads/ krw,

    /etc/xdg/Trolltech.conf rk,
    /usr/share/locale-langpack/* mr,
    /usr/share/glib-2.0/schemas/gschemas.compiled rm,
    /sys/devices/system/cpu/cpu0/cpufreq/* r,

    @{HOME}/.Skype/ rw,
    @{HOME}/.Skype/** krw,
    /usr/share/skype/** kmr,
    /usr/share/skype/sounds/*.wav kr,

    deny @{HOME}/.mozilla/ r, # no idea what it needs there
    deny @{PROC}/[0-9]*/fd/ r,
    deny @{PROC}/[0-9]*/task/ r,
    deny @{PROC}/[0-9]*/task/** r,

}

Andsin sellised käsud:

$ sudo aa-enforce skype
$ sudo /etc/init.d/apparmor restart

Ja nüüd kasutan Skype4 ja usaldan Microsofti toodet ka Linuxis!

viide originaalile:
http://eternalwalkabout.wordpress.com/2 ... -apparmor/

KUI EI TÖÖTA KORRALIKULT, SIIS SAAB PROFIILIST ÄRA KUSTUTADA!

[zorroh]

mõned kriitikud ütlevad, et kuna AppArmor ja Skype on Microsoftiga seotud, et siis tuleks vältida mõlemat AppArmori taga on Novell, mis omakorda on partner Microsoftiga

netis on päris palju arutelu AppArmor vs SELinux..

igatahes AppArmor peaks kiiresti ja lihtsasti kohaldatav olema suse, mandriva ja ubuntule.

Fedora ja selle forkide puhul on vast lihtsam kasutada SELinux.

[gnu]

Ärme hakkame libajuttu ajama. Skype ei ole avatud lähtekoodiga ja on binaar, apparmor aga on ka lähtekoodina ja GPL-i litsentsi peal.

Ma tegin uue skype profiili apparmoris(sudo aa-genprof skype), sest lxde ei vaja paljusi teisi sätteid, mis kde ja gnome.

Läks logimiseks ja toksimiseks küll, ennem kui korralikult käima sai.

Skype on selline programm, mis kohe tahab .mozilla profiile.

[tris]

Peaks töötama. Vähemalt programm ei saa nuhkida su kasutajakontot.

Kood: Vali kõik

#include <tunables/global>

/usr/bin/skype {
  #include <abstractions/audio>
  #include <abstractions/consoles>
  #include <abstractions/dbus-session>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/video>

  # Executables
  /usr/bin/skype ixmr,
  /usr/lib{,32}/skype/skype ixmr,
  /usr/bin/xdg-open PUxmr,
  /usr/bin/kde4-config PUxmr,

  # Configuration files
  owner @{HOME}/.Skype/ rw,
  owner @{HOME}/.Skype/** krw,
  owner @{HOME}/.config/Skype/ rw,
  owner @{HOME}/.config/Skype/** krw,

  # Downloads/uploads directory
  owner @{HOME}/Public/ rw,
  owner @{HOME}/Public/** krw,
  owner @{HOME}/Avalik/ rw,
  owner @{HOME}/Avalik/** krw,


  # Libraries
  /usr/lib{,32}/libv4l/v4l2convert.so mr,
  /usr/share/skype/lib/libQtWebKit.so.4 mr,

  # Shared data
  /usr/share/skype/ r,
  /usr/share/skype/** r,

  # Devices
  /dev/ r,
  /dev/video[0-9]* mrw,

  # System information
  /etc/machine-id r,
  @{PROC}/sys/kernel/{ostype,osrelease} r,
  @{PROC}/sys/vm/overcommit_memory r,
  @{PROC}/[0-9]*/net/arp r,
  owner @{PROC}/[0-9]*/cmdline r,
  owner @{PROC}/[0-9]*/status r,
  owner @{PROC}/[0-9]*/task/ r,
  owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
  owner @{PROC}/[0-9]*/fd/ r,
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/cpu[0-9]*/cpufreq/scaling_{cur_freq,max_freq} r,
  /sys/devices/pci*/*/usb[0-9]*/*/*/modalias r,
  /sys/devices/pci*/*/usb[0-9]*/*/*/video4linux/video[0-9]*/dev r,
  /sys/devices/pci*/*/usb[0-9]*/*/{idVendor,idProduct,speed} r,

  # This probably should go to appropriate abstractions
  /etc/asound.conf r,
  owner @{HOME}/.config/fontconfig/fonts.conf r,
  owner @{HOME}/.config/gtk-3.0/bookmarks r,
  owner @{HOME}/.config/oxygen-gtk/argb-apps.conf rw,
  owner @{HOME}/.config/pulse/cookie krw,
  owner @{HOME}/.icons/** r,
  owner @{HOME}/.kde4/share/config/kdeglobals krw,
  owner @{HOME}/.kde4/share/config/gtkrc-2.0 r,
  owner @{HOME}/.kde4/share/config/oxygenrc r,
  /usr/share/icons/*/index.theme kr,
  /usr/share/nvidia/nvidia-application-profiles-*-rc r,

  # Denials
  deny owner @{HOME}/.mozilla/ r,
  deny owner @{HOME}/.mozilla/** r,
  deny /sys/devices/virtual/dmi/** r,
}