mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-08-13 16:42:29 +02:00
0a275f3207
Tested on real AppArmor (enforce): boots clean, ports 80/81 HTTP 200, zero denials. Refs #2777
90 lines
2.7 KiB
Plaintext
90 lines
2.7 KiB
Plaintext
#include <tunables/global>
|
|
|
|
profile nginx-proxy-manager flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/openssl>
|
|
|
|
# Blanket file access, following the official Home Assistant add-on AppArmor
|
|
# template. Confinement is enforced through the capability allow-list and the
|
|
# explicit deny rules below rather than by enumerating every path. Enumerating
|
|
# paths is impractical here: this add-on wraps the s6-overlay based
|
|
# jc21/nginx-proxy-manager image, whose boot runs useradd/groupadd, certbot,
|
|
# nginx and a Node.js backend across a deep exec chain (issue #2777).
|
|
file,
|
|
|
|
# Signals used by the s6-overlay supervision tree.
|
|
signal (send) set=(kill,term,int,hup,cont),
|
|
|
|
# Network
|
|
network inet stream,
|
|
network inet dgram,
|
|
network inet6 stream,
|
|
network inet6 dgram,
|
|
network unix stream,
|
|
network unix dgram,
|
|
|
|
# Capabilities required by the boot chain.
|
|
# - chown/fowner/fsetid/dac_override: file ownership and mode changes
|
|
# - setgid/setuid/setfcap: useradd/groupadd and privilege drops (s6-setuidgid)
|
|
# - net_bind_service: bind ports 80/443/81
|
|
# - sys_chroot: s6/nginx
|
|
# - kill: s6 service supervision
|
|
# - audit_write: PAM/useradd audit records
|
|
# - sys_resource: raise limits
|
|
capability audit_write,
|
|
capability chown,
|
|
capability dac_override,
|
|
capability fowner,
|
|
capability fsetid,
|
|
capability kill,
|
|
capability net_bind_service,
|
|
capability setfcap,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_chroot,
|
|
capability sys_resource,
|
|
|
|
# Deny dangerous capabilities outright.
|
|
deny capability dac_read_search,
|
|
deny capability linux_immutable,
|
|
deny capability mac_admin,
|
|
deny capability mac_override,
|
|
deny capability sys_admin,
|
|
deny capability sys_boot,
|
|
deny capability sys_module,
|
|
deny capability sys_rawio,
|
|
deny capability syslog,
|
|
|
|
# S6-Overlay boot chain and the add-on entrypoint.
|
|
# The run.sh shebang is "#!/usr/bin/with-contenv bash", and with-contenv
|
|
# execs "/usr/bin/env bash"; without exec access here AppArmor denied it with
|
|
# "/usr/bin/env: 'bash': Permission denied" (issue #2777).
|
|
/init ix,
|
|
/bin/** ix,
|
|
/usr/bin/** ix,
|
|
/sbin/** ix,
|
|
/usr/sbin/** ix,
|
|
/usr/local/bin/** ix,
|
|
/usr/local/sbin/** ix,
|
|
/opt/** ix,
|
|
/run/{s6,s6-rc*,service}/** ix,
|
|
/package/** ix,
|
|
/command/** ix,
|
|
/npm-addon-init.sh ix,
|
|
/etc/s6-overlay/** rwix,
|
|
/etc/services.d/** rwix,
|
|
/etc/cont-init.d/** rwix,
|
|
/etc/cont-finish.d/** rwix,
|
|
/run/{,**} rwk,
|
|
/dev/tty rw,
|
|
|
|
# Deny sensitive system areas.
|
|
deny /root/** rwkl,
|
|
deny /home/** rwkl,
|
|
deny /proc/sysrq-trigger rwkl,
|
|
deny /sys/firmware/** rwkl,
|
|
deny /sys/kernel/security/** rwkl,
|
|
deny /sys/kernel/debug/** rwkl,
|
|
}
|