我正在尝试寻找一个 apparmor 配置文件模板,用于将 dropbox 操作限制在我的文件上。如果可能的话,我还想阻止它尝试同步.git
目录,因为目录中的文件数量巨大。
答案1
我找到了一个方法。(其实我已经有了,只是想分享一下)
1)将以下文件粘贴到/etc/apparmor.d/dropbox
。
# vim:syntax=apparmor
# Last Modified: Sun Jan 3 19:03:04 2016
#include <tunables/global>
profile dropbox /{usr/bin/dropbox,home/*/.dropbox-*/**,home/*/.dropbox-dist/dropboxd} {
#include <abstractions/dbus>
#include <abstractions/dbus-accessibility>
#include <abstractions/dbus-session-strict>
#include <abstractions/gnome>
#include <abstractions/ubuntu-unity7-base>
#include <abstractions/dconf>
#include <abstractions/base>
#include <abstractions/nameservice>
#include <abstractions/python>
#include <abstractions/ubuntu-konsole>
capability sys_ptrace,
# Comment the follwoing line to allow Dropbox to (fully) sync directories called: '.git'
audit deny /**/.git/objects/** rwx,
# Comment the follwoing line to allow Dropbox to sync directories called: 'no_dropbox'
audit deny /**/no_dropbox/** rwx,
# Comment the follwoing line to allow Dropbox to sync directories called 'Secure' that under your home folder.
audit deny /home/*/Secure/** rwx,
dbus,
# A work arround to allow symbolic links to the golang folder
/home/*/go/** rw,
/bin/bash r,
/bin/dash r,
/bin/readlink Cx,
/bin/uname r,
/etc/lsb-release r,
/etc/python*/** r,
/home/*/.Xauthority r,
/home/*/.config/autostart/dropbox.desktop rw,
/home/*/.dropbox-dist/** rwlkix,
/home/*/.dropbox/** rwlk,
/home/*/Dropbox/ rwlk,
/home/*/Dropbox/** rwlk,
/proc/ r,
/proc/*/fd/ r,
/proc/*/io r,
/proc/*/mounts r,
/proc/*/net/tcp r,
/proc/*/net/tcp6 r,
/proc/*/net/udp r,
/proc/*/net/udp6 r,
/proc/*/stat r,
/proc/*/statm r,
/proc/*/status r,
/proc/meminfo r,
/proc/version r,
/proc/vmstat r,
/run/uuidd/request rw,
/tmp/* rwl,
/usr/ r,
/usr/bin/ r,
/usr/bin/dirname rPix,
/usr/bin/dropbox rPix,
/usr/bin/gettext r,
/usr/bin/locale r,
/usr/bin/lsb_release r,
/usr/bin/python3 r,
/usr/bin/python3.4 r,
/usr/bin/readlink rPix,
/usr/bin/sudo r,
/usr/lib/ r,
/usr/lib{,32,64}/** mra,
/usr/local/lib/python3.4/*/ r,
/var/tmp/** rwlk,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
owner /{,var/}run/user/*/dconf/user w,
profile /bin/readlink flags=(complain) {
#include <abstractions/base>
/bin/readlink mr,
}
}
2)通过命令加载:sudo apparmor_parser -r /etc/apparmor.d/dropbox
。
3)在强制模式下启用它:sudo aa-enforce /etc/apparmor.d/dropbox
。
4)通过GUI或以下命令重新启动dropbox dropbox stop && dropbox start
:。
5)完成了!