☰

Apparmor 简介

tag-icon • tag-icon 16.04 skype apparmor
Apparmor 简介

今天，旧版 Skype 4.3 和一些最新移动版本之间的通话无法正常进行。如果我需要升级到最新的 Skype for linux，我在哪里可以找到适用于新/usr/bin/skypeforlinux版本 5.3 的 apparmour？谢谢！

答案1

您自己回答了这个问题，ubuntu 没有为 skypeforlinux 维护配置文件。您必须自己编写或从互联网上查找并改编一个。

https://packages.ubuntu.com/search?suite=yakkety&arch=any&mode=filename&searchon=contents&keywords=skypeforlinux

在我看来，最好写你自己的个人资料，看看https://www.howtogeek.com/118328/how-to-create-apparmor-profiles-to-lock-down-programs-on-ubuntu/

没有人可以告诉你该接受什么，该阻止什么，这是由你自己决定的。

通过谷歌搜索，您可以在 git hub 和其他地方找到多个配置文件。您需要查看这些配置文件的准确性、路径和您的需求，但这些可能是个不错的起点。

https://www.google.com/search?q=apparmor+profile+skypeforlinux&oq=apparmor+profile+skypeforlinux&aqs=chrome..69i57j69i60l3.15031j0j9&sourceid=chrome&ie=UTF-8

列表上的第一项：https://github.com/mk-fg/apparmor-profiles/blob/master/profiles/opt.skypeforlinux

#include <tunables/global>

/opt/skypeforlinux/skypeforlinux {

    #include <abstractions/base>
    #include <abstractions/consoles>
    #include <abstractions/nameservice>
    #include <abstractions/ssl_certs>
    #include <abstractions/fonts>
    #include <abstractions/X>
    #include <abstractions/freedesktop.org>
    #include <abstractions/user-download>
    #include <abstractions/user-tmp>
    #include <abstractions/pulse>
    #include <abstractions/node-webkit>
    #include <abstractions/site/base>
    #include <abstractions/site/de>

    /etc/os-release r,
    /sys/devices/virtual/tty/tty*/active r,
    deny /dev/video0 rw,

    /opt/skypeforlinux/** kmr,
    /opt/skypeforlinux/skypeforlinux ix,

    owner @{HOME}/.config/skypeforlinux/ rw,
    owner @{HOME}/.config/skypeforlinux/** krwm,
    owner @{HOME}/[dD]ownload{,s}/** k,

    deny /etc/passwd rm,
    deny /proc/sys/kernel/yama/ptrace_scope r, # no clue

    # Site-local thing
    /etc/core/app/sec/openssl.cnf r,

    network,

}

还有其他选项，您可能需要根据您的需要和 Ubuntu 的路径修改这些配置文件（例如，我不知道 skypeforlinux 是否安装在 /opt 上，如在此配置文件中或其他地方）。

下面是另一个：https://gogs.dsprenkels.com/dsprenkels/apparmor-profiles/src/bf7f56166f4084d07797195fc7739be19bd9ada1/usr.bin.skypeforlinux

# Last Modified: Tue Apr 11 23:47:05 2017
#include <tunables/global>

/usr/bin/skypeforlinux {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/dbus-session>
  #include <abstractions/fonts>
  #include <abstractions/freedesktop.org>
  #include <abstractions/gnome>
  #include <abstractions/nameservice>

  /usr/bin/skypeforlinux r,
  /bin/dash ix,
  /bin/mkdir rix,
  /bin/readlink rix,
  /usr/bin/dirname rix,
  /usr/bin/nohup rix,

  /dev/shm/* rw,
  /etc/udev/udev.conf r,
  owner @{HOME}/.Xauthority r,
  owner @{HOME}/.config/skypeforlinux/ rw,
  owner @{HOME}/.config/skypeforlinux/** rw,
  /sys/bus/pci/devices/ r,
  /sys/devices/** r,
  "/tmp/skypeforlinux Crashes/" w,
  /usr/share/glib-2.0/schemas/gschemas.compiled r,
  /usr/share/skypeforlinux/** r,
  /usr/share/skypeforlinux/skypeforlinux rix,
  /{run,dev}/shm/pulse-shm* rwk,

}

答案2

我刚刚使用 Ubuntu 16.04 和 Skype 8.16.04 创建了一个有效的 Apparmor 配置文件。并想与您分享。我花了两天时间，因为我试图尽可能地锁定它。据我所知，所有这些都是必需的，否则某些功能可能无法工作。我将在代码中对其中一些进行评论。请注意，此配置文件反映了版本 340 中带有专有驱动程序的 nvidia 图形适配器的使用情况。其他场景需要调整。任何未注释的内容似乎都是启动 Skype 所必需的。如果配置文件不起作用，请先尝试删除我的注释。实际上，我不知道 #include 指令后是否允许注释。

亲切的问候，

基督教

# Last Modified: Thu Feb 22 14:05:09 2018
#include <tunables/global>

/usr/bin/skypeforlinux {            #my installation path. 
                                    #profile:usr.bin.skypeforlinux

  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/dbus>              #impossible to take 
                                            #restricted 
                                            #versions of dbus 
                                            #abstractions 
                                            #without being logged out 
                                            #after every use
  #include <abstractions/dbus-session>      #same here
  #include <abstractions/fonts>
  #include <abstractions/freedesktop.org>   #nothing at all without 
                                            #these
  #include <abstractions/gnome>             #same here
  #include <abstractions/nameservice>       #and here
  #include <abstractions/ibus>              #no keyboard input witout 
                                            #this

  network inet dgram,
  network inet stream,
  network inet6 dgram,
  network inet6 stream,
  network netlink dgram,
  network netlink raw,

  deny /etc/issue r,                          #at least something not 
                                              #necessary
  deny /etc/passwd r,

  /bin/dash rix,
  /bin/mkdir rix,
  /bin/readlink rix,
  /dev/ r,
  /dev/disk/by-id/ r,
  /dev/nvidia0 rw,                         #nvidia/propietary driver 
                                           #specific
  /dev/nvidiactl rw,                       #same here
  /dev/shm/* rwl,
  /dev/video0 rw,
  /etc/hostname r,
  /etc/udev/udev.conf r,
  @{HOME}/ w,                              #Skype won't start if 
                                           #"owner" 
                                           #is set in order to 
                                           #restrict 
                                           #profile access to its 
                                           #owner
  @{HOME}/.Skype/ r,
  @{HOME}/.Skype/** rw,
  @{HOME}/.Xauthority r,
  @{HOME}/.config/dconf/* r,
  @{HOME}/.config/skypeforlinux/ r,
  @{HOME}/.config/skypeforlinux/** rw,
  @{HOME}/.config/user-dirs.dirs r,
  @{HOME}/.nv/GLCache/ r,                  #nvidia/propietary driver 
                                           #specific
  @{HOME}/.nv/GLCache/** rw,               #same here
  @{HOME}/.pki/nssdb/* rw,
  @{HOME}/.rnd r,
  @{HOME}/skype-export/ w,                 #allows chat export from 
                                           #version 4.3
  @{HOME}/skype-export/** w,               #same here
  @{PROC}/ r,
  @{PROC}/*/fd/ r,
  @{PROC}/*/oom_score_adj w,
  @{PROC}/*/status r,
  @{PROC}/*/task/ r,
  @{PROC}/*/task/** r,
  @{PROC}/cpuinfo r,
  @{PROC}/driver/nvidia/params r,           #nvidia/propietary driver 
                                            #specific
  @{PROC}/filesystems r,
  @{PROC}/modules r,
  @{PROC}/stat r,
  @{PROC}/sys/kernel/osrelease r,
  @{PROC}/sys/kernel/ostype r,
  @{PROC}/sys/kernel/yama/ptrace_scope r,
  @{PROC}/version r,
  /run/user/** rw,
  /sys/bus/pci/devices/ r,
  /sys/class/net/ r,
  /sys/devices/** r,
  /tmp/ rw,                      #usage of temp dir abstractions 
                                 #impossible. Skype won't start with 
                                 #"owner" set to restrict access to 
                                 #other temp files
  /tmp/** rw,                    #same here
  /usr/bin/dirname rix,
  /usr/bin/locale rix,
  /usr/bin/nohup rix,
  /usr/bin/skypeforlinux r,
  /usr/bin/xdg-open rix,
  /usr/share/glib-2.0/schemas/gschemas.compiled r,
  /usr/share/nvidia-340/* r,
  /usr/share/skypeforlinux/** r,
  /usr/share/skypeforlinux/skypeforlinux rix,
  /var/tmp/ rw,                 #same temp dir issue described above
  /var/tmp/** rw,               #same here

  ^/usr/bin/nohup {
    /dev/shm/* mrw,
    /usr/share/skypeforlinux/skypeforlinux rix, #always use ix on all 
                                                #executables, any 
                                                #child 
                                                #with scrubbed 
                                                #environment 
                                                #won't do the job

  }
}

答案3

我见过的最好、最简单的个人资料这里：完全阻止主目录访问。我仅删除了以下行以阻止~/.config/访问：

#include <abstractions/xdg-desktop> и

并被授予访问权限~/Downloads/Skype

owner @{HOME}/[dD]ownload{,s}/Skype/ rw,
owner @{HOME}/[dD]ownload{,s}/Skype/** rw,

Apparmor 简介

#include <tunables/global>
/usr/bin/skypeforlinux {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/freedesktop.org>
  #include <abstractions/X>

  /dev/ r,
  /dev/dri/ r,
  /dev/snd/ r,
  /etc/ssl/* r,
  /etc/drirc r,
  /dev/video* rw,
  /dev/video[0-9]* m,
  /dev/shm/* m, # mmaps /dev/shm/eiSAHx, video does not work without it
  owner /dev/shm/* rw, # downgraded from `/dev/shm/{shm,cnd}-[0-9]*-[0-9]` and `/dev/shm/.org.chromium.Chromium.*` into `/dev/shm/XU9NZ3`
  owner /dev/shm/sem.* l -> /dev/shm/, # detected on Debian 8 (jessie)
  /sys{/,/**} r,
  /etc/machine-id r,
  /etc/udev/udev.conf r,
  /etc/alsa-pulse.conf r,
  /etc/asound-pulse.conf r,
  /var/lib/dbus/machine-id r,
  /etc/pulse/client.conf.d{/,/**} r,

  /dev/dri/* rm,
  /dev/snd/* rm,
  /usr/share/** rm,
  /run/nscd/group rm,
  /usr/lib64/dri/* rm,

  /bin/* rix,
  /usr/bin/* rix,

  /usr/share/skypeforlinux/** rmix,

  /dev/tty rw,
  /dev/dri/** rw,
  /dev/pts/** rw,
  /dev/snd/** rw,
  /tmp{/,/**} rw,

  /dev/shm/** rmw,

  owner @{HOME}/.config/skypeforlinux{/,/**} rkmw,
  owner @{HOME}/[dD]ownload{,s}/ r,     # allow to browse Download dir
  owner @{HOME}/[dD]ownload{,s}/Skype/ rw,
  owner @{HOME}/[dD]ownload{,s}/Skype/** rw,
}

相关内容