Hi,

as you might know, AppArmor confines programs according to a set of
rules that specify what files a given program can access. This approach
helps protect the system against both known and unknown vulnerabilities.
In several distributions such as Ubuntu or Tails, AppArmor is enabled by
default.

There is an AppArmor profile for Pulseaudio available upstream:
https://git.launchpad.net/apparmor-profiles/tree/ubuntu/17.04/usr.bin.pulseaudio
I've asked the original authors if this profile is ready to be included
and they confirmed. In any case, this profile is only active if people
have installed AppArmor in first case, so it should never break the
package for users without AppArmor.

The profile can be included in the Pulseaudio packaging quite easily.
All the necessary steps are documented here:
https://wiki.debian.org/AppArmor/Contribute/FirstTimeProfileImport

Please also see examples in the packages torbrowser-launcher or in
Icedove
(https://anonscm.debian.org/cgit/pkg-mozilla/icedove.git/tree/debian).

I'll try to prepare a patch to make it easier for you to integrate it.

Cheers!
u.

Hi,

I have some doubts:

1. What is the benefit of shipping the profile info in pulseaudio
versus shipping it in the apparmor-profiles package?
2. Wouldn't that benefit be best achieved if the profile was shipped
by (pulse) upstream?

I'm wary of being in charge of stuff I don't use, and I would think
upstream would be as well. Would apparmor maintainers be willing to
step in to help when problems appear with the profile?

That would be great.

Hi Felipe,

thank you for your answer.

Felipe Sateler:

The ultimate aim of the Debian AppArmor team is to have all profiles
shipped in their respective packages. Why? Because the package
maintainers are the ones who know how their package should work and they
are ideally placed to see when something is wrong.

This is also what Ubuntu is doing by the way. They have enabled AppArmor
by default since years to provide users with Mandatory Access Control.

Furthermore, the apparmor-profiles-extra package is supposed to disappear.

You should use this kind of stuff ;)
It's super easy to setup see https://wiki.debian.org/AppArmor/HowToUse

Absolutely. To help you here, we (the AppArmor team) have set up this
documentation: https://wiki.debian.org/AppArmor/Debug If ever people
report bugs against Pulseaudio related to AppArmor, you can invoke help
by the AppArmor team by usertagging such bugs so they will appear on our
radar.

Furthermore, the upstream authors are very responsive, and I'm convinced
they react quickly. FYI upstream can be contacted through
apparmor@lists.ubuntu.com

Ack.

Cheers!
ulrike

tags + patch

Hi,

Please find a patch attached.

The will simply to copy the file to /etc/apparmor.d/ and only if the
user has AppArmor installed and enabled, this will then confine the
pulseaudio executable. Furthremore, dh_apparmor should create an empty
file /etc/apparmor.d/local/usr.bin.pulseaudio which can be used for
local overrides.

FYI I've not tried to build the package with this modification.

Let me know if it works out :)

Cheers!
ulrike

Thanks.


+ # install apparmor profile
+ cp debian/apparmor/usr.bin.pulseaudio
debian/pulseaudio/etc/apparmor.d/usr.bin.pulseaudio

This would install the file with whatever umask is currently set.
Which permissions should the file have? root:root 644 ?

Hi!

Felipe Sateler:

Thanks for making this clear.

Yes. root:root 644 is correct.

Cheers!
u.

Thanks. I have changed this to install -m 644 instead of cp.

BTW, I still would like an answer to this question:

Wouldn't that benefit be best achieved if the profile was shipped
by (pulse) upstream?

AFAICT, this file should be distro-agnostic, so it should be safe to
ship in the upstream package, wouldn't it?

Hi Felipe,

Perfect.

The apparmor profile itself could indeed be part of the upstream package.

Currently, these profiles are worked on collectively by people from
Ubuntu, Debian/Tails and OpenSuSe and we use a shared Git repository
between our three distributions.

For torbrowser-launcher we upstreamed the profile for example, also
because upstream is very responsive about patches. But I have no other
examples in mind where this would be the case.

Would you care to ask upstream if they'd like to include it?

Cheers!
ulrike

Better late than never, I have asked upstream and they are receptive
to adding the profile there. Could you please propose a patch on the
upstream mailing list?

https://lists.freedesktop.org/mailman/listinfo/pulseaudio-discuss