![Apparmor 简介](https://linux22.com/image/1002131/Apparmor%20%E7%AE%80%E4%BB%8B.png)
今天,旧版 Skype 4.3 和一些最新移动版本之间的通话无法正常进行。如果我需要升级到最新的 Skype for linux,我在哪里可以找到适用于新/usr/bin/skypeforlinux
版本 5.3 的 apparmour?谢谢!
答案1
您自己回答了这个问题,ubuntu 没有为 skypeforlinux 维护配置文件。您必须自己编写或从互联网上查找并改编一个。
在我看来,最好写你自己的个人资料,看看https://www.howtogeek.com/118328/how-to-create-apparmor-profiles-to-lock-down-programs-on-ubuntu/
没有人可以告诉你该接受什么,该阻止什么,这是由你自己决定的。
通过谷歌搜索,您可以在 git hub 和其他地方找到多个配置文件。您需要查看这些配置文件的准确性、路径和您的需求,但这些可能是个不错的起点。
列表上的第一项:https://github.com/mk-fg/apparmor-profiles/blob/master/profiles/opt.skypeforlinux
#include <tunables/global>
/opt/skypeforlinux/skypeforlinux {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice>
#include <abstractions/ssl_certs>
#include <abstractions/fonts>
#include <abstractions/X>
#include <abstractions/freedesktop.org>
#include <abstractions/user-download>
#include <abstractions/user-tmp>
#include <abstractions/pulse>
#include <abstractions/node-webkit>
#include <abstractions/site/base>
#include <abstractions/site/de>
/etc/os-release r,
/sys/devices/virtual/tty/tty*/active r,
deny /dev/video0 rw,
/opt/skypeforlinux/** kmr,
/opt/skypeforlinux/skypeforlinux ix,
owner @{HOME}/.config/skypeforlinux/ rw,
owner @{HOME}/.config/skypeforlinux/** krwm,
owner @{HOME}/[dD]ownload{,s}/** k,
deny /etc/passwd rm,
deny /proc/sys/kernel/yama/ptrace_scope r, # no clue
# Site-local thing
/etc/core/app/sec/openssl.cnf r,
network,
}
还有其他选项,您可能需要根据您的需要和 Ubuntu 的路径修改这些配置文件(例如,我不知道 skypeforlinux 是否安装在 /opt 上,如在此配置文件中或其他地方)。
# Last Modified: Tue Apr 11 23:47:05 2017
#include <tunables/global>
/usr/bin/skypeforlinux {
#include <abstractions/audio>
#include <abstractions/base>
#include <abstractions/bash>
#include <abstractions/dbus-session>
#include <abstractions/fonts>
#include <abstractions/freedesktop.org>
#include <abstractions/gnome>
#include <abstractions/nameservice>
/usr/bin/skypeforlinux r,
/bin/dash ix,
/bin/mkdir rix,
/bin/readlink rix,
/usr/bin/dirname rix,
/usr/bin/nohup rix,
/dev/shm/* rw,
/etc/udev/udev.conf r,
owner @{HOME}/.Xauthority r,
owner @{HOME}/.config/skypeforlinux/ rw,
owner @{HOME}/.config/skypeforlinux/** rw,
/sys/bus/pci/devices/ r,
/sys/devices/** r,
"/tmp/skypeforlinux Crashes/" w,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/skypeforlinux/** r,
/usr/share/skypeforlinux/skypeforlinux rix,
/{run,dev}/shm/pulse-shm* rwk,
}
答案2
我刚刚使用 Ubuntu 16.04 和 Skype 8.16.04 创建了一个有效的 Apparmor 配置文件。并想与您分享。我花了两天时间,因为我试图尽可能地锁定它。据我所知,所有这些都是必需的,否则某些功能可能无法工作。我将在代码中对其中一些进行评论。请注意,此配置文件反映了版本 340 中带有专有驱动程序的 nvidia 图形适配器的使用情况。其他场景需要调整。任何未注释的内容似乎都是启动 Skype 所必需的。如果配置文件不起作用,请先尝试删除我的注释。实际上,我不知道 #include 指令后是否允许注释。
亲切的问候,
基督教
# Last Modified: Thu Feb 22 14:05:09 2018
#include <tunables/global>
/usr/bin/skypeforlinux { #my installation path.
#profile:usr.bin.skypeforlinux
#include <abstractions/audio>
#include <abstractions/base>
#include <abstractions/bash>
#include <abstractions/dbus> #impossible to take
#restricted
#versions of dbus
#abstractions
#without being logged out
#after every use
#include <abstractions/dbus-session> #same here
#include <abstractions/fonts>
#include <abstractions/freedesktop.org> #nothing at all without
#these
#include <abstractions/gnome> #same here
#include <abstractions/nameservice> #and here
#include <abstractions/ibus> #no keyboard input witout
#this
network inet dgram,
network inet stream,
network inet6 dgram,
network inet6 stream,
network netlink dgram,
network netlink raw,
deny /etc/issue r, #at least something not
#necessary
deny /etc/passwd r,
/bin/dash rix,
/bin/mkdir rix,
/bin/readlink rix,
/dev/ r,
/dev/disk/by-id/ r,
/dev/nvidia0 rw, #nvidia/propietary driver
#specific
/dev/nvidiactl rw, #same here
/dev/shm/* rwl,
/dev/video0 rw,
/etc/hostname r,
/etc/udev/udev.conf r,
@{HOME}/ w, #Skype won't start if
#"owner"
#is set in order to
#restrict
#profile access to its
#owner
@{HOME}/.Skype/ r,
@{HOME}/.Skype/** rw,
@{HOME}/.Xauthority r,
@{HOME}/.config/dconf/* r,
@{HOME}/.config/skypeforlinux/ r,
@{HOME}/.config/skypeforlinux/** rw,
@{HOME}/.config/user-dirs.dirs r,
@{HOME}/.nv/GLCache/ r, #nvidia/propietary driver
#specific
@{HOME}/.nv/GLCache/** rw, #same here
@{HOME}/.pki/nssdb/* rw,
@{HOME}/.rnd r,
@{HOME}/skype-export/ w, #allows chat export from
#version 4.3
@{HOME}/skype-export/** w, #same here
@{PROC}/ r,
@{PROC}/*/fd/ r,
@{PROC}/*/oom_score_adj w,
@{PROC}/*/status r,
@{PROC}/*/task/ r,
@{PROC}/*/task/** r,
@{PROC}/cpuinfo r,
@{PROC}/driver/nvidia/params r, #nvidia/propietary driver
#specific
@{PROC}/filesystems r,
@{PROC}/modules r,
@{PROC}/stat r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/ostype r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/version r,
/run/user/** rw,
/sys/bus/pci/devices/ r,
/sys/class/net/ r,
/sys/devices/** r,
/tmp/ rw, #usage of temp dir abstractions
#impossible. Skype won't start with
#"owner" set to restrict access to
#other temp files
/tmp/** rw, #same here
/usr/bin/dirname rix,
/usr/bin/locale rix,
/usr/bin/nohup rix,
/usr/bin/skypeforlinux r,
/usr/bin/xdg-open rix,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/nvidia-340/* r,
/usr/share/skypeforlinux/** r,
/usr/share/skypeforlinux/skypeforlinux rix,
/var/tmp/ rw, #same temp dir issue described above
/var/tmp/** rw, #same here
^/usr/bin/nohup {
/dev/shm/* mrw,
/usr/share/skypeforlinux/skypeforlinux rix, #always use ix on all
#executables, any
#child
#with scrubbed
#environment
#won't do the job
}
}
答案3
我见过的最好、最简单的个人资料这里:完全阻止主目录访问。我仅删除了以下行以阻止~/.config/
访问:
#include <abstractions/xdg-desktop> и
并被授予访问权限~/Downloads/Skype
owner @{HOME}/[dD]ownload{,s}/Skype/ rw,
owner @{HOME}/[dD]ownload{,s}/Skype/** rw,
Apparmor 简介
#include <tunables/global>
/usr/bin/skypeforlinux {
#include <abstractions/audio>
#include <abstractions/base>
#include <abstractions/fonts>
#include <abstractions/gnome>
#include <abstractions/kde>
#include <abstractions/nameservice>
#include <abstractions/user-tmp>
#include <abstractions/freedesktop.org>
#include <abstractions/X>
/dev/ r,
/dev/dri/ r,
/dev/snd/ r,
/etc/ssl/* r,
/etc/drirc r,
/dev/video* rw,
/dev/video[0-9]* m,
/dev/shm/* m, # mmaps /dev/shm/eiSAHx, video does not work without it
owner /dev/shm/* rw, # downgraded from `/dev/shm/{shm,cnd}-[0-9]*-[0-9]` and `/dev/shm/.org.chromium.Chromium.*` into `/dev/shm/XU9NZ3`
owner /dev/shm/sem.* l -> /dev/shm/, # detected on Debian 8 (jessie)
/sys{/,/**} r,
/etc/machine-id r,
/etc/udev/udev.conf r,
/etc/alsa-pulse.conf r,
/etc/asound-pulse.conf r,
/var/lib/dbus/machine-id r,
/etc/pulse/client.conf.d{/,/**} r,
/dev/dri/* rm,
/dev/snd/* rm,
/usr/share/** rm,
/run/nscd/group rm,
/usr/lib64/dri/* rm,
/bin/* rix,
/usr/bin/* rix,
/usr/share/skypeforlinux/** rmix,
/dev/tty rw,
/dev/dri/** rw,
/dev/pts/** rw,
/dev/snd/** rw,
/tmp{/,/**} rw,
/dev/shm/** rmw,
owner @{HOME}/.config/skypeforlinux{/,/**} rkmw,
owner @{HOME}/[dD]ownload{,s}/ r, # allow to browse Download dir
owner @{HOME}/[dD]ownload{,s}/Skype/ rw,
owner @{HOME}/[dD]ownload{,s}/Skype/** rw,
}