File: /var/lib/snapd/apparmor/profiles/snap.network-manager.networkmanager
# vim:syntax=apparmor
#include <tunables/global>
#include if exists "/etc/apparmor.d/tunables/home.d"
#include if exists "/var/lib/snapd/apparmor/snap-tuning"
# snapd supports the concept of 'parallel installs' where snaps with the same
# name are differentiated by '_<instance>' such that foo, foo_bar and foo_baz
# may all be installed on the system. To support this, SNAP_NAME is set to the
# name (eg, 'foo') while SNAP_INSTANCE_NAME is set to the instance name (eg
# 'foo_bar'). The profile name and most rules therefore reference
# SNAP_INSTANCE_NAME. In some cases, snapd will adjust the snap's runtime
# environment so the snap doesn't have to be aware of the distinction (eg,
# SNAP, SNAP_DATA and SNAP_COMMON are all bind mounted onto a directory with
# SNAP_NAME so the security policy will allow writing to both locations (since
# they are equivalent).
# The template is applied to all the snaps regardless of their base snaps. Some base
# snaps, notably core26, chose to ship uutils-coreutils as their native installation
# location used by cargo.
# The usr/bin/gnu rule deliberately doesn't have a trailing slash
# This is to support paths like /usr/bin/ls -> /usr/bin/gnuls
@{SNAP_COREUTIL_DIRS}="/{bin/,usr/bin/,usr/bin/gnu,usr/lib/cargo/bin/coreutils/}"
# This is a snap name without the instance key
@{SNAP_NAME}="network-manager"
# This is a snap name with instance key
@{SNAP_INSTANCE_NAME}="network-manager"
@{SNAP_INSTANCE_DESKTOP}="network-manager"
@{SNAP_COMMAND_NAME}="networkmanager"
@{SNAP_REVISION}="981"
@{PROFILE_DBUS}="snap_2enetwork_2dmanager_2enetworkmanager"
@{INSTALL_DIR}="/{,var/lib/snapd/}snap"
profile "snap.network-manager.networkmanager" flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/openssl>
# While in later versions of the base abstraction, include this explicitly
# for series 16 and cross-distro
/etc/ld.so.preload r,
# The base abstraction doesn't yet have this
/etc/sysconfig/clock r,
owner @{PROC}/@{pid}/maps k,
# /proc/XXXX/map_files contains the same info than /proc/XXXX/maps, but
# in a format that is simpler to manage, because it doesn't require to
# parse the text data inside a file, but just reading the contents of
# a directory.
# Reading /proc/XXXX/maps is already allowed in the base template
# via <abstractions/base>. Also, only the owner can read it, and the
# kernel limits access to it by requiring 'ptrace' enabled, so allowing
# to access /proc/XXXX/map_files can be considered secure too.
owner @{PROC}/@{pid}/map_files/ r,
# While the base abstraction has rules for encryptfs encrypted home and
# private directories, it is missing rules for directory read on the toplevel
# directory of the mount (LP: #1848919)
owner @{HOME}/.Private/ r,
owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
# for python apps/services
#include <abstractions/python>
/etc/python3.[0-9]*/** r,
# explicitly deny noisy denials to read-only filesystems (see LP: #1496895
# for details)
deny /usr/lib/python3*/{,**/}__pycache__/ w,
deny /usr/lib/python3*/{,**/}__pycache__/**.pyc.[0-9]* w,
# bind mount used here (see 'parallel installs', above)
deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/ w,
deny @{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/__pycache__/*.pyc.[0-9]* w,
# for perl apps/services
#include <abstractions/perl>
# Missing from perl abstraction
/usr/lib/@{multiarch}/perl{,5,-base}/auto/**.so* mr,
# Note: the following dangerous accesses should not be allowed in most
# policy, but we cannot explicitly deny since other trusted interfaces might
# add them.
# Explicitly deny ptrace for now since it can be abused to break out of the
# seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
#audit deny ptrace (trace),
# Explicitly deny capability mknod so apps can't create devices
#audit deny capability mknod,
# Explicitly deny mount, remount and umount so apps can't modify things in
# their namespace
#audit deny mount,
#audit deny remount,
#audit deny umount,
# End dangerous accesses
# Note: this potentially allows snaps to DoS other snaps via resource
# exhaustion but we can't sensibly mediate this today. In the future we may
# employ cgroup limits, AppArmor rlimit mlock rules or something else.
capability ipc_lock,
# for bash 'binaries' (do *not* use abstractions/bash)
# user-specific bash files
/etc/bash.bashrc r,
/etc/inputrc r,
/etc/environment r,
/etc/profile r,
# user/group/seat lookups
/etc/{passwd,group,nsswitch.conf} r, # very common
/var/lib/extrausers/{passwd,group} r,
/run/systemd/users/[0-9]* r,
/etc/default/nss r,
# libnss-systemd (subset from nameservice abstraction)
#
# https://systemd.io/USER_GROUP_API/
# https://systemd.io/USER_RECORD/
# https://www.freedesktop.org/software/systemd/man/nss-systemd.html
#
# Allow User/Group lookups via common VarLink socket APIs. Applications need
# to either consult all of them or the io.systemd.Multiplexer frontend.
/run/systemd/userdb/ r,
/run/systemd/userdb/io.systemd.Multiplexer rw,
/run/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users
/run/systemd/userdb/io.systemd.Home rw, # systemd-home dirs
/run/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS
/run/systemd/userdb/io.systemd.Machine rw, # systemd-machined
/etc/libnl-3/{classid,pktloc} r, # apps that use libnl
# For snappy reexec on 4.8+ kernels
/usr/lib/snapd/snap-exec m,
# For gdb support
/usr/lib/snapd/snap-gdbserver-shim ixr,
# For in-snap tab completion
/etc/bash_completion.d/{,*} r,
/usr/lib/snapd/etelpmoc.sh ixr, # marshaller (see complete.sh for out-of-snap unmarshal)
/usr/share/bash-completion/bash_completion r, # user-provided completions (run in-snap) may use functions from here
# uptime
@{PROC}/uptime r,
@{PROC}/loadavg r,
# Allow reading /etc/os-release. On Ubuntu 16.04+ it is a symlink to /usr/lib
# which is allowed by the base abstraction, but on 14.04 it is an actual file
# so need to add it here. Also allow read locks on the file.
/etc/os-release rk,
/usr/lib/os-release k,
# Debian version of the host OS which might be required in AppArmor-secured Debian
/etc/debian_version r,
# systemd native journal API (see sd_journal_print(4)). This should be in
# AppArmor's base abstraction, but until it is, include here. We include
# the base journal path as well as the journal namespace pattern path. Each
# journal namespace for quota groups will be prefixed with 'snap-'.
/run/systemd/journal{,.snap-*}/socket w,
/run/systemd/journal{,.snap-*}/stdout rw, # 'r' shouldn't be needed, but journald
# doesn't leak anything so allow
/run/systemd/journal{,.snap-*}/dev-log w,
# snapctl and its requirements
/usr/bin/snapctl ixr,
/usr/lib/snapd/snapctl ixr,
@{PROC}/sys/net/core/somaxconn r,
/run/snapd-snap.socket rw,
# Note: for now, don't explicitly deny this noisy denial so --devmode isn't
# broken but eventually we may conditionally deny this since it is an
# information leak.
#deny /{,var/}run/utmp r,
# Allow reading the maximum number of open file descriptors.
@{PROC}/sys/fs/nr_open r,
# java
@{PROC}/@{pid}/ r,
@{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/auxv r,
@{PROC}/sys/vm/zone_reclaim_mode r,
/etc/lsb-release r,
/sys/devices/**/read_ahead_kb r,
/sys/devices/system/cpu/** r,
/sys/devices/system/node/node[0-9]*/* r,
/sys/kernel/mm/transparent_hugepage/enabled r,
/sys/kernel/mm/transparent_hugepage/defrag r,
# NOTE: this leaks running process but java seems to want it (even though it
# seems to operate ok without it) and SDL apps crash without it. Allow owner
# match until AppArmor kernel var is available to solve this properly (see
# LP: #1546825 for details). comm is a subset of cmdline, so allow it too.
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
# Per man(5) proc, the kernel enforces that a thread may only modify its comm
# value or those in its thread group.
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
# Allow reading and writing to our file descriptors in /proc which, for
# example, allow access to /dev/std{in,out,err} which are all symlinks to
# /proc/self/fd/{0,1,2} respectively. To support the open(..., O_TMPFILE)
# linkat() temporary file technique, allow all fds. Importantly, access to
# another task's fd via this proc interface is mediated via 'ptrace (read)'
# (readonly) and 'ptrace (trace)' (read/write) which is denied by default, so
# this rule by itself doesn't allow opening another snap's fds via proc.
owner @{PROC}/@{pid}/{,task/@{tid}}fd/[0-9]* rw,
# Miscellaneous accesses
/dev/{,u}random w,
/etc/machine-id r,
/etc/mime.types r,
/etc/default/keyboard r,
@{PROC}/ r,
@{PROC}/version r,
@{PROC}/version_signature r,
/etc/{,writable/}hostname r,
/etc/{,writable/}localtime r,
/etc/{,writable/}mailname r,
/etc/{,writable/}timezone r,
owner @{PROC}/@{pid}/cgroup rk,
@{PROC}/@{pid}/cpuset r,
@{PROC}/@{pid}/io r,
owner @{PROC}/@{pid}/fdinfo/* r,
owner @{PROC}/@{pid}/limits r,
owner @{PROC}/@{pid}/loginuid r,
owner @{PROC}/@{pid}/sessionid r,
@{PROC}/@{pid}/smaps r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/statm r,
@{PROC}/@{pid}/status r,
@{PROC}/@{pid}/task/ r,
@{PROC}/@{pid}/task/[0-9]*/smaps r,
@{PROC}/@{pid}/task/[0-9]*/stat r,
@{PROC}/@{pid}/task/[0-9]*/statm r,
@{PROC}/@{pid}/task/[0-9]*/status r,
@{PROC}/sys/fs/pipe-max-size r,
@{PROC}/sys/kernel/hostname r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/ostype r,
@{PROC}/sys/kernel/pid_max r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/sys/kernel/shmmax r,
# Allow apps to introspect the level of dbus mediation AppArmor implements.
/sys/kernel/security/apparmor/features/dbus/mask r,
@{PROC}/sys/fs/file-max r,
@{PROC}/sys/fs/file-nr r,
@{PROC}/sys/fs/inotify/max_* r,
@{PROC}/sys/kernel/pid_max r,
@{PROC}/sys/kernel/random/boot_id r,
@{PROC}/sys/kernel/random/entropy_avail r,
@{PROC}/sys/kernel/random/uuid r,
@{PROC}/sys/kernel/cap_last_cap r,
# Allow access to the uuidd daemon (this daemon is a thin wrapper around
# time and getrandom()/{,u}random and, when available, runs under an
# unprivilged, dedicated user).
/run/uuidd/request rw,
/sys/devices/virtual/tty/{console,tty*}/active r,
/sys/fs/cgroup/memory/{,user.slice/}memory.limit_in_bytes r,
/sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.limit_in_bytes r,
/sys/fs/cgroup/memory/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.stat r,
/sys/fs/cgroup/system.slice/snap.@{SNAP_INSTANCE_NAME}{,.*}/memory.max r,
/sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_{period,quota}_us r,
/sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.cfs_{period,quota}_us r,
/sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.shares r,
/sys/fs/cgroup/cpu,cpuacct/{,**/}snap.@{SNAP_INSTANCE_NAME}{,.*}/cpu.shares r,
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/sys/module/apparmor/parameters/enabled r,
/{,usr/}lib/ r,
# Reads of oom_adj and oom_score_adj are safe
owner @{PROC}/@{pid}/oom_{,score_}adj r,
# Note: for now, don't explicitly deny write access so --devmode isn't broken
# but eventually we may conditionally deny this since it allows the process
# to increase the oom heuristic of other processes (make them more likely to
# be killed). Once AppArmor kernel var is available to solve this properly,
# this can safely be allowed since non-root processes won't be able to
# decrease the value and root processes will only be able to with
# 'capability sys_resource,' which we deny be default.
# deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
# Eases hardware assignment (doesn't give anything away)
/etc/udev/udev.conf r,
/sys/ r,
/sys/bus/ r,
/sys/class/ r,
# this leaks interface names and stats, but not in a way that is traceable
# to the user/device
@{PROC}/net/dev r,
@{PROC}/@{pid}/net/dev r,
# Read-only of this snap
/var/lib/snapd/snaps/@{SNAP_NAME}_*.snap r,
# Read-only of snapd restart state for snapctl specifically
/var/lib/snapd/maintenance.json r,
# Read-only for the install directory
# bind mount used here (see 'parallel installs', above)
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r,
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/ r,
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}}/** mrklix,
# Read-only install directory for other revisions to help with bugs like
# LP: #1616650 and LP: #1655992
@{INSTALL_DIR}/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
# Read-only home area for other versions
# bind mount *not* used here (see 'parallel installs', above)
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/ r,
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/** mrkix,
# Experimental snap folder changes
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/ r,
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/** mrkix,
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
owner @{HOME}/.snap/data/@{SNAP_INSTANCE_NAME}/common/** wl,
owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/ r,
owner @{HOME}/Snap/@{SNAP_INSTANCE_NAME}/** mrkixwl,
# Writable home area for this version.
# bind mount *not* used here (see 'parallel installs', above)
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/@{SNAP_REVISION}/** wl,
owner @{HOME}/snap/@{SNAP_INSTANCE_NAME}/common/** wl,
# Read-only system area for other versions
# bind mount used here (see 'parallel installs', above)
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/ r,
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** mrkix,
# Writable system area only for this version
# bind mount used here (see 'parallel installs', above)
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/** wl,
/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/** wl,
# The snap-confine program creates an app-specific private restricted /tmp
# and will fail to launch the app if something goes wrong. As such, we can
# simply allow full access to /tmp.
/tmp/ r,
/tmp/** mrwlkix,
# App-specific access to files and directories in /dev/shm. We allow file
# access in /dev/shm for shm_open() and files in subdirectories for open()
# bind mount *not* used here (see 'parallel installs', above)
/{dev,run}/shm/snap.@{SNAP_INSTANCE_NAME}.** mrwlkix,
# Also allow app-specific access for sem_open()
/{dev,run}/shm/sem.snap.@{SNAP_INSTANCE_NAME}.* mrwlk,
# Snap-specific XDG_RUNTIME_DIR that is based on the UID of the user
# bind mount *not* used here (see 'parallel installs', above)
owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/ rw,
owner /run/user/[0-9]*/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
# Allow apps from the same package to communicate with each other via an
# abstract or anonymous socket
unix (bind, listen) addr="@snap.@{SNAP_INSTANCE_NAME}.**",
unix peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
# Allow apps from the same package to communicate with each other via DBus.
# Note: this does not grant access to the DBus sockets of well known buses
# (will still need to use an appropriate interface for that).
dbus (receive, send) peer=(label=snap.@{SNAP_INSTANCE_NAME}.*),
# In addition to the above, dbus-run-session attempts reading these files
# from the snap base runtime.
/usr/share/dbus-1/services/{,*} r,
/usr/share/dbus-1/system-services/{,*} r,
# Allow apps to perform DBus introspection on org.freedesktop.DBus for both
# the system and session buses.
# Note: this does not grant access to the DBus sockets of these buses, but
# we grant it here since it is missing from the dbus abstractions
# (LP: #1866168)
dbus (send)
bus={session,system}
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus.Introspectable
member=Introspect
peer=(label=unconfined),
# Allow apps from the same package to signal each other via signals
signal peer=snap.@{SNAP_INSTANCE_NAME}.*,
# Allow receiving signals from all snaps (and focus on mediating sending of
# signals)
signal (receive) peer=snap.*,
# Allow receiving signals from unconfined (eg, systemd)
signal (receive) peer=unconfined,
# for 'udevadm trigger --verbose --dry-run --tag-match=snappy-assign'
/{,usr/}{,s}bin/udevadm ixr,
/etc/udev/udev.conf r,
/{,var/}run/udev/tags/snappy-assign/ r,
@{PROC}/cmdline r,
/sys/devices/**/uevent r,
# LP: #1447237: adding '--property-match=SNAPPY_APP=<pkgname>' to the above
# requires:
# /run/udev/data/* r,
# but that reveals too much about the system and cannot be granted to apps
# by default at this time.
# For convenience, allow apps to see what is in /dev even though cgroups
# will block most access
/dev/ r,
/dev/**/ r,
# Allow setting up pseudoterminal via /dev/pts system. This is safe because
# the launcher uses a per-app devpts newinstance.
/dev/ptmx rw,
# Do the same with /sys/devices and /sys/class to help people using hw-assign
/sys/devices/ r,
/sys/devices/**/ r,
/sys/class/ r,
/sys/class/**/ r,
# Allow all snaps to chroot
capability sys_chroot,
# Lttng tracing is very noisy and should not be allowed by confined apps. Can
# safely deny for the normal case (LP: #1260491). If/when an lttng-trace
# interface is needed, we can rework this.
deny /{dev,run,var/run}/shm/lttng-ust-* rw,
# Allow read-access on /home/ for navigating to other parts of the
# filesystem. While this allows enumerating users, this is already allowed
# via /etc/passwd and getent.
@{HOMEDIRS}/ r,
# Allow read-access to / for navigating to other parts of the filesystem.
/ r,
# Snap-specific run directory. Bind mount *not* used here
# (see 'parallel installs', above)
/run/snap.@{SNAP_INSTANCE_NAME}/ rw,
/run/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
# Snap-specific lock directory and prerequisite navigation permissions.
/run/lock/ r,
/run/lock/snap.@{SNAP_INSTANCE_NAME}/ rw,
/run/lock/snap.@{SNAP_INSTANCE_NAME}/** mrwklix,
# Allow listing and reading systemd-provided credentials.
/run/credentials/ r,
/run/credentials/snap.@{SNAP_INSTANCE_NAME}.*.service/ r,
/run/credentials/snap.@{SNAP_INSTANCE_NAME}.*.service/** r,
# Work around for https://gitlab.com/apparmor/apparmor/-/issues/571
# which prevents access to mmap MAP_HUGETLB.
allow file / rwm,
# Default rules for core base runtimes
# The base abstraction doesn't yet have this
/{,usr/}lib/terminfo/** rk,
/usr/share/terminfo/** k,
/usr/share/zoneinfo/** k,
# for python apps/services
/usr/bin/python{,2,2.[0-9]*,3,3.[0-9]*} ixr,
# additional accesses needed for newer pythons in later bases
/usr/lib{,32,64}/python3.[0-9]*/**.{pyc,so} mr,
/usr/lib{,32,64}/python3.[0-9]*/**.{egg,py,pth} r,
/usr/lib{,32,64}/python3.[0-9]*/{site,dist}-packages/ r,
/usr/lib{,32,64}/python3.[0-9]*/lib-dynload/*.so mr,
/usr/include/python3.[0-9]*/pyconfig.h r,
# for perl apps/services
/usr/bin/perl{,5*} ixr,
# AppArmor <2.12 doesn't have rules for perl-base, so add them here
/usr/lib/@{multiarch}/perl{,5,-base}/** r,
/usr/lib/@{multiarch}/perl{,5,-base}/[0-9]*/**.so* mr,
# for bash 'binaries' (do *not* use abstractions/bash)
# user-specific bash files
/{,usr/}bin/bash ixr,
/{,usr/}bin/dash ixr,
/usr/share/terminfo/** r,
# Common utilities for shell scripts
# Support coreutils paths (LP: #2123870)
@{SNAP_COREUTIL_DIRS}arch ixr,
/{,usr/}bin/{,g,m}awk ixr,
@{SNAP_COREUTIL_DIRS}base32 ixr,
@{SNAP_COREUTIL_DIRS}base64 ixr,
@{SNAP_COREUTIL_DIRS}basename ixr,
/{,usr/}bin/bunzip2 ixr,
/{,usr/}bin/busctl ixr,
/{,usr/}bin/bzcat ixr,
/{,usr/}bin/bzdiff ixr,
/{,usr/}bin/bzgrep ixr,
/{,usr/}bin/bzip2 ixr,
@{SNAP_COREUTIL_DIRS}cat ixr,
@{SNAP_COREUTIL_DIRS}chgrp ixr,
@{SNAP_COREUTIL_DIRS}chmod ixr,
@{SNAP_COREUTIL_DIRS}chown ixr,
/{,usr/}bin/clear ixr,
/{,usr/}bin/cmp ixr,
@{SNAP_COREUTIL_DIRS}cp ixr,
/{,usr/}bin/cpio ixr,
@{SNAP_COREUTIL_DIRS}cut ixr,
@{SNAP_COREUTIL_DIRS}date ixr,
/{,usr/}bin/dbus-daemon ixr,
/{,usr/}bin/dbus-run-session ixr,
/{,usr/}bin/dbus-send ixr,
@{SNAP_COREUTIL_DIRS}dd ixr,
/{,usr/}bin/diff{,3} ixr,
@{SNAP_COREUTIL_DIRS}dir ixr,
@{SNAP_COREUTIL_DIRS}dirname ixr,
@{SNAP_COREUTIL_DIRS}du ixr,
@{SNAP_COREUTIL_DIRS}echo ixr,
/{,usr/}bin/{,e,f,r}grep ixr,
@{SNAP_COREUTIL_DIRS}env ixr,
@{SNAP_COREUTIL_DIRS}expr ixr,
@{SNAP_COREUTIL_DIRS}false ixr,
/{,usr/}bin/find ixr,
/{,usr/}bin/flock ixr,
@{SNAP_COREUTIL_DIRS}fmt ixr,
@{SNAP_COREUTIL_DIRS}fold ixr,
/{,usr/}bin/free ixr,
/{,usr/}bin/getconf ixr,
/{,usr/}bin/getent ixr,
/{,usr/}bin/getopt ixr,
@{SNAP_COREUTIL_DIRS}groups ixr,
/{,usr/}bin/gzip ixr,
@{SNAP_COREUTIL_DIRS}head ixr,
/{,usr/}bin/hostname ixr,
@{SNAP_COREUTIL_DIRS}id ixr,
/{,usr/}bin/igawk ixr,
/{,usr/}bin/infocmp ixr,
@{SNAP_COREUTIL_DIRS}install ixr,
/{,usr/}bin/kill ixr,
/{,usr/}bin/ldd ixr,
/{usr/,}lib{,32,64}/ld{,32,64}-*.so ix,
/{usr/,}lib/@{multiarch}/ld{,32,64}-*.so* ix,
/{,usr/}bin/less{,file,pipe} ixr,
/{,usr/}bin/line ixr,
@{SNAP_COREUTIL_DIRS}link ixr,
@{SNAP_COREUTIL_DIRS}ln ixr,
/{,usr/}bin/locale ixr,
/{,usr/}bin/logger ixr,
@{SNAP_COREUTIL_DIRS}ls ixr,
@{SNAP_COREUTIL_DIRS}md5sum ixr,
@{SNAP_COREUTIL_DIRS}mkdir ixr,
@{SNAP_COREUTIL_DIRS}mkfifo ixr,
@{SNAP_COREUTIL_DIRS}mknod ixr,
@{SNAP_COREUTIL_DIRS}mktemp ixr,
/{,usr/}bin/more ixr,
@{SNAP_COREUTIL_DIRS}mv ixr,
@{SNAP_COREUTIL_DIRS}nice ixr,
@{SNAP_COREUTIL_DIRS}nohup ixr,
@{SNAP_COREUTIL_DIRS}numfmt ixr,
@{SNAP_COREUTIL_DIRS}od ixr,
/{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
@{SNAP_COREUTIL_DIRS}paste ixr,
/{,usr/}bin/pgrep ixr,
@{SNAP_COREUTIL_DIRS}printenv ixr,
@{SNAP_COREUTIL_DIRS}printf ixr,
/{,usr/}bin/ps ixr,
@{SNAP_COREUTIL_DIRS}pwd ixr,
@{SNAP_COREUTIL_DIRS}readlink ixr,
@{SNAP_COREUTIL_DIRS}realpath ixr,
/{,usr/}bin/rev ixr,
@{SNAP_COREUTIL_DIRS}rm ixr,
@{SNAP_COREUTIL_DIRS}rmdir ixr,
/{,usr/}bin/run-parts ixr,
/{,usr/}bin/sed ixr,
@{SNAP_COREUTIL_DIRS}seq ixr,
/{,usr/}bin/setpriv ixr,
@{SNAP_COREUTIL_DIRS}sha{1,224,256,384,512}sum ixr,
@{SNAP_COREUTIL_DIRS}shuf ixr,
@{SNAP_COREUTIL_DIRS}sleep ixr,
@{SNAP_COREUTIL_DIRS}sort ixr,
@{SNAP_COREUTIL_DIRS}stat ixr,
@{SNAP_COREUTIL_DIRS}stdbuf ixr,
@{SNAP_COREUTIL_DIRS}stty ixr,
@{SNAP_COREUTIL_DIRS}sync ixr,
/{,usr/}bin/systemd-cat ixr,
/{,usr/}bin/systemd-creds ixr,
@{SNAP_COREUTIL_DIRS}tac ixr,
@{SNAP_COREUTIL_DIRS}tail ixr,
/{,usr/}bin/tar ixr,
@{SNAP_COREUTIL_DIRS}tee ixr,
@{SNAP_COREUTIL_DIRS}test ixr,
/{,usr/}bin/tempfile ixr,
/{,usr/}bin/tset ixr,
@{SNAP_COREUTIL_DIRS}touch ixr,
/{,usr/}bin/tput ixr,
@{SNAP_COREUTIL_DIRS}tr ixr,
@{SNAP_COREUTIL_DIRS}true ixr,
@{SNAP_COREUTIL_DIRS}tty ixr,
@{SNAP_COREUTIL_DIRS}uname ixr,
@{SNAP_COREUTIL_DIRS}uniq ixr,
@{SNAP_COREUTIL_DIRS}unlink ixr,
/{,usr/}bin/unxz ixr,
/{,usr/}bin/unzip ixr,
/{,usr/}bin/uptime ixr,
@{SNAP_COREUTIL_DIRS}vdir ixr,
/{,usr/}bin/vim.tiny ixr,
@{SNAP_COREUTIL_DIRS}wc ixr,
/{,usr/}bin/which{,.debianutils} ixr,
/{,usr/}bin/xargs ixr,
/{,usr/}bin/xz ixr,
@{SNAP_COREUTIL_DIRS}yes ixr,
/{,usr/}bin/zcat ixr,
/{,usr/}bin/z{,e,f}grep ixr,
/{,usr/}bin/zip ixr,
/{,usr/}bin/zipgrep ixr,
# lsb-release
/usr/bin/lsb_release ixr,
/usr/bin/ r,
/usr/share/distro-info/*.csv r,
# For printing the cache (we don't allow updating the cache)
/{,usr/}sbin/ldconfig{,.real} ixr,
# Allow all snaps to chroot
# chroot can be on either coreutil paths or sbin depending on the Ubuntu release
@{SNAP_COREUTIL_DIRS}chroot ixr,
/{,usr/}sbin/chroot ixr,
# Allow pidof (and killall5, as pidof can be a symlink to killall5 in some distros)
/{,usr/}bin/pidof ixr,
/{,usr/}sbin/killall5 ixr,
# Allow access to the unconfined ModemManager service on classic.
dbus (receive, send)
bus=system
path=/org/freedesktop/ModemManager1{,/**}
interface=org.freedesktop.ModemManager1*
peer=(label=unconfined),
dbus (receive, send)
bus=system
path=/org/freedesktop/ModemManager1{,/**}
interface=org.freedesktop.DBus.*
peer=(label=unconfined),
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
path=/org/freedesktop/ModemManager1{,/**}
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
dbus (send)
bus=system
path=/org/freedesktop/ModemManager1{,/**}
interface=org.freedesktop.DBus.Properties
member="Get{,All}",
# Allow connected clients to interact with the service
# Allow traffic to/from our DBus path
dbus (receive, send)
bus=system
path=/org/freedesktop/NetworkManager{,/**}
peer=(label="snap.network-manager{.nmcli,.nmtui,.nmtui-connect,.nmtui-edit,.nmtui-hostname}"),
# Later versions of NetworkManager implement org.freedesktop.DBus.ObjectManager
# for clients to easily obtain all (and be alerted to added/removed) objects
# from the service.
dbus (receive, send)
bus=system
path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
peer=(label="snap.network-manager{.nmcli,.nmtui,.nmtui-connect,.nmtui-edit,.nmtui-hostname}"),
# Explicitly deny ptrace to silence noisy denials. These denials happen when NM
# tries to access /proc/<peer_pid>/stat. What apparmor prevents is showing
# internal process addresses that live in that file, but that has no adverse
# effects for NetworkManager, which just wants to find out the start time of the
# process.
deny ptrace (trace,read) peer="snap.network-manager{.nmcli,.nmtui,.nmtui-connect,.nmtui-edit,.nmtui-hostname}",
# Allow reading login and session information
# Support coreutils paths (LP: #2123870)
@{SNAP_COREUTIL_DIRS}who ixr,
/var/log/wtmp rk,
/{,var/}run/utmp rk,
/{,usr/}bin/lastlog ixr,
/var/log/lastlog rk,
/{,usr/}bin/faillog ixr,
/var/log/faillog rk,
# systemd session information (session files, but not .ref files)
/run/systemd/sessions/ r,
/run/systemd/sessions/*[0-9] rk,
# Supported loginctl commands:
# - list-sessions
# - show-session N
# - list-users
# - show-user N
# - list-seats
# - show-seat N
/{,usr/}bin/loginctl ixr,
#include <abstractions/dbus-strict>
# Introspection of org.freedesktop.login1
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
path=/org/freedesktop/login1{,/seat/*,/session/*,/user/*}
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
dbus (send)
bus=system
path=/org/freedesktop/login1{,/seat/*,/session/*,/user/*}
interface=org.freedesktop.DBus.Properties
member=Get{,All},
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(label=unconfined),
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={Session,User,Seat}New
peer=(label=unconfined),
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member={Session,User,Seat}Removed
peer=(label=unconfined),
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=PrepareFor{Shutdow,Sleep}
peer=(label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=List{Seats,Sessions,Users},
dbus (send)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Get{Seat,Session,User},
# Description: Allow operating as the NetworkManager service. This gives
# privileged access to the system.
capability net_admin,
capability net_bind_service,
capability net_raw,
network netlink,
network bridge,
network inet,
network inet6,
network packet,
@{PROC}/@{pid}/net/ r,
@{PROC}/@{pid}/net/** r,
# used by sysctl, et al
@{PROC}/sys/ r,
@{PROC}/sys/net/ r,
@{PROC}/sys/net/core/ r,
@{PROC}/sys/net/core/** rw,
@{PROC}/sys/net/ipv{4,6}/ r,
@{PROC}/sys/net/ipv{4,6}/** rw,
@{PROC}/sys/net/netfilter/ r,
@{PROC}/sys/net/netfilter/** rw,
@{PROC}/sys/net/nf_conntrack_max rw,
@{PROC}/sys/net/mptcp/ r,
@{PROC}/sys/net/mptcp/** rw,
# Needed for systemd's dhcp implementation
@{PROC}/sys/kernel/random/boot_id r,
/sys/devices/**/**/net/**/phys_port_id r,
/sys/devices/**/**/net/**/dev_id r,
/sys/devices/virtual/net/**/phys_port_id r,
/sys/devices/virtual/net/**/dev_id r,
/sys/devices/**/net/**/ifindex r,
# access to bridge sysfs interfaces for bridge settings
/sys/devices/virtual/net/*/bridge/* rw,
/dev/rfkill rw,
/run/udev/data/* r,
# Allow access to read the gnutls config
/etc/gnutls/config r,
# Allow read and write access for all netplan configuration files
# as NetworkManager will start using them to store the network
# configuration instead of using its own internal keyfile based
# format.
/etc/netplan/{,**} rw,
# Allow access to configuration files generated on the fly
# from netplan and let NetworkManager store its configuration
# in the same place.
/run/NetworkManager/{,**} rw,
# Needed by the ifupdown plugin to check which interfaces can
# be managed an which not.
/etc/network/interfaces r,
# Needed for systemd's dhcp implementation
/etc/machine-id r,
# Needed to use resolvconf from core
/{,usr/}sbin/resolvconf ixr,
/run/resolvconf/{,**} rk,
/run/resolvconf/** w,
/etc/resolvconf/{,**} r,
/{,usr/}lib/resolvconf/* ix,
# NM peeks into ifupdown configuration
/run/network/ifstate* r,
# Required by resolvconf
/{,usr/}bin/run-parts ixr,
/etc/resolvconf/update.d/* ix,
#include <abstractions/nameservice>
/run/systemd/resolve/stub-resolv.conf r,
# DBus accesses
#include <abstractions/dbus-strict>
# systemd-resolved (not yet included in nameservice abstraction)
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
# https://www.freedesktop.org/software/systemd/man/org.freedesktop.resolve1.html
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
# https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
# In the case of NM, the destination is not the well-known DBus name,
# instead it tracks the name owner and sends the message to the
# the owner's connection name, so we cannot have the name= restriction
# in peer=...
dbus send
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="Resolve{Address,Hostname,Record,Service}"
peer=(label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="SetLink{DefaultRoute,DNSOverTLS,DNS,DNSEx,DNSSEC,DNSSECNegativeTrustAnchors,MulticastDNS,Domains,LLMNR}"
peer=(label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="GetLink"
peer=(name="org.freedesktop.resolve1", label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1/link/*"
interface="org.freedesktop.resolve1.Link"
member="Set{DNS,DNSSEC,DNSSECNegativeTrustAnchors,MulticastDNS,Domains,LLMNR}"
peer=(name="org.freedesktop.resolve1", label=unconfined),
dbus (send)
bus=system
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member={Request,Release}Name
peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (receive, send)
bus=system
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetConnectionUnixProcessID
peer=(label=unconfined),
dbus (receive, send)
bus=system
path=/org/freedesktop/DBus
interface=org.freedesktop.DBus
member=GetConnectionUnixUser
peer=(label=unconfined),
# Allow binding the service to the requested connection name
dbus (bind)
bus=system
name="org.freedesktop.NetworkManager",
# Allow binding OpenVPN names
dbus (bind)
bus=system
name="org.freedesktop.NetworkManager.openvpn.*",
# Allow traffic to/from our path and interface with any method for unconfined
# clients to talk to our service.
dbus (receive, send)
bus=system
path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.NetworkManager*
peer=(label=unconfined),
# Allow traffic to/from org.freedesktop.DBus for NetworkManager service
dbus (receive, send)
bus=system
path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.DBus.*
peer=(label=unconfined),
# Allow ObjectManager methods from and signals to unconfined clients.
dbus (receive, send)
bus=system
path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
peer=(label=unconfined),
# Allow access to hostname system service
dbus (receive, send)
bus=system
path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
peer=(label=unconfined),
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member="Get{,All}",
dbus(receive, send)
bus=system
path=/org/freedesktop/hostname1
interface=org.freedesktop.hostname1
member={Set,SetStatic}Hostname
peer=(label=unconfined),
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
path=/org/freedesktop/hostname1
interface=org.freedesktop.hostname1
member={Set,SetStatic}Hostname,
# Sleep monitor inside NetworkManager needs this
# do not use peer=(label=unconfined) here since this is DBus activated
dbus (send)
bus=system
path=/org/freedesktop/login1
member=Inhibit
interface=org.freedesktop.login1.Manager,
dbus (receive)
bus=system
path=/org/freedesktop/login1
member=PrepareForSleep
interface=org.freedesktop.login1.Manager
peer=(label=unconfined),
dbus (receive)
bus=system
path=/org/freedesktop/login1
interface=org.freedesktop.login1.Manager
member=Session{New,Removed}
peer=(label=unconfined),
# Allow access to wpa-supplicant for managing WiFi networks
dbus (receive, send)
bus=system
path=/fi/w1/wpa_supplicant1{,/**}
interface=fi.w1.wpa_supplicant1*
peer=(label=unconfined),
dbus (receive, send)
bus=system
path=/fi/w1/wpa_supplicant1{,/**}
interface=org.freedesktop.DBus.*
peer=(label=unconfined),
# Description: Allow operating ppp daemon. This gives privileged access to the
# ppp daemon.
# Needed for modem connections using PPP
/usr/sbin/pppd ix,
/etc/ppp/** rwix,
/dev/ppp rw,
/dev/tty[^0-9]* rw,
/run/lock/*tty[^0-9]* rw,
/run/ppp* rwk,
/var/run/ppp* rwk,
/var/log/ppp* rw,
/{,usr/}bin/run-parts ix,
@{PROC}/@{pid}/loginuid r,
capability setgid,
capability setuid,
# Allow to determine whether a tty device is a serial port or not.
@{PROC}/tty/drivers r,
# Description: Allow using ModemManager service. This gives privileged access
# to the ModemManager service.
#include <abstractions/dbus-strict>
# Allow all access to ModemManager service
dbus (receive, send)
bus=system
path=/org/freedesktop/ModemManager1{,/**}
interface=org.freedesktop.ModemManager1*
peer=(label="snap.snapd."),
dbus (receive, send)
bus=system
path=/org/freedesktop/ModemManager1{,/**}
interface=org.freedesktop.DBus.*
peer=(label="snap.snapd."),
dbus (receive, send)
bus=system
path=/org/freedesktop
interface=org.freedesktop.DBus.ObjectManager
peer=(label="snap.snapd."),
# Allow to determine whether a tty device is a serial port or not.
@{PROC}/tty/drivers r,
# allow communicating with the mbim and qmi proxy servers, which provide
# support for talking to WWAN modems and devices which speak the Mobile
# Interface Broadband Model (MBIM) and Qualcomm MSM Interface (QMI)
# protocols respectively
unix (connect, receive, send) type=stream peer=(addr="@{mbim,qmi}-proxy"),
# Description: Can configure firewall. This is restricted because it gives
# privileged access to networking and should only be used with trusted apps.
#include <abstractions/nameservice>
/run/systemd/resolve/stub-resolv.conf rk,
# systemd-resolved (not yet included in nameservice abstraction)
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
# https://www.freedesktop.org/wiki/Software/systemd/resolved/
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
# https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
#include <abstractions/dbus-strict>
dbus send
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="Resolve{Address,Hostname,Record,Service}"
peer=(name="org.freedesktop.resolve1"),
capability net_admin,
/{,usr/}{,s}bin/iptables{,-save,-restore} ixr,
/{,usr/}{,s}bin/ip6tables{,-save,-restore} ixr,
/{,usr/}{,s}bin/iptables-apply ixr,
/{,usr/}{,s}bin/xtables{,-legacy,-nft}-multi ixr, # ip[6]tables*
# ping - child profile would be nice but seccomp causes problems with that
/{,usr/}{,s}bin/ping ixr,
/{,usr/}{,s}bin/ping6 ixr,
capability net_raw,
capability setuid,
network inet raw,
network inet6 raw,
# iptables (note, we don't want to allow loading modules, but
# we can allow reading @{PROC}/sys/kernel/modprobe).
@{PROC}/sys/kernel/modprobe r,
unix (bind, listen) type=stream addr="@xtables",
/{,var/}run/xtables.lock rwk,
@{PROC}/@{pid}/net/ r,
@{PROC}/@{pid}/net/** r,
# nft accesses these for routing expressions and device groups
/etc/iproute2/ r,
/etc/iproute2/rt_marks r,
/etc/iproute2/rt_realms r,
/etc/iproute2/group r,
# sysctl
/{,usr/}{,s}bin/sysctl ixr,
@{PROC}/sys/ r,
@{PROC}/sys/net/ r,
@{PROC}/sys/net/core/ r,
@{PROC}/sys/net/core/** r,
@{PROC}/sys/net/ipv{4,6}/ r,
@{PROC}/sys/net/ipv{4,6}/** r,
@{PROC}/sys/net/netfilter/ r,
@{PROC}/sys/net/netfilter/** r,
@{PROC}/sys/net/nf_conntrack_max r,
# check the state of the Kmod modules
/sys/module/arp_tables/ r,
/sys/module/arp_tables/initstate r,
/sys/module/br_netfilter/ r,
/sys/module/br_netfilter/initstate r,
/sys/module/iptable_filter/ r,
/sys/module/iptable_filter/initstate r,
/sys/module/ip6table_filter/ r,
/sys/module/ip6table_filter/initstate r,
/sys/module/nf_*/initstate r,
# read netfilter module parameters
/sys/module/nf_*/ r,
/sys/module/nf_*/parameters/{,*} r,
# write netfilter module parameters
/sys/module/nf_conntrack/parameters/hashsize w,
# various firewall related sysctl files
@{PROC}/sys/net/bridge/bridge-nf-call-arptables rw,
@{PROC}/sys/net/bridge/bridge-nf-call-iptables rw,
@{PROC}/sys/net/bridge/bridge-nf-call-ip6tables rw,
@{PROC}/sys/net/bridge/bridge-nf-filter-pppoe-tagged rw,
@{PROC}/sys/net/bridge/bridge-nf-filter-vlan-tagged rw,
@{PROC}/sys/net/bridge/bridge-nf-pass-vlan-input-dev rw,
@{PROC}/sys/net/ipv4/conf/*/rp_filter w,
@{PROC}/sys/net/ipv{4,6}/conf/*/accept_source_route w,
@{PROC}/sys/net/ipv{4,6}/conf/*/accept_redirects w,
@{PROC}/sys/net/ipv4/icmp_echo_ignore_broadcasts w,
@{PROC}/sys/net/ipv4/icmp_ignore_bogus_error_responses w,
@{PROC}/sys/net/ipv4/icmp_echo_ignore_all w,
@{PROC}/sys/net/ipv4/ip_forward w,
@{PROC}/sys/net/ipv4/conf/*/log_martians w,
@{PROC}/sys/net/ipv4/tcp_syncookies w,
@{PROC}/sys/net/ipv6/conf/*/forwarding w,
@{PROC}/sys/net/netfilter/nf_conntrack_helper rw,
@{PROC}/sys/net/netfilter/nf_conntrack_max rw,
@{PROC}/sys/net/netfilter/nf_conntrack_tcp_timeout_close_wait rw,
@{PROC}/sys/net/netfilter/nf_conntrack_tcp_timeout_established rw,
# Description: Can configure networking and network namespaces via the standard
# 'ip netns' command (man ip-netns(8)). This interface is restricted because it
# gives wide, privileged access to networking and should only be used with
# trusted apps.
#include <abstractions/nameservice>
/run/systemd/resolve/stub-resolv.conf rk,
# systemd-resolved (not yet included in nameservice abstraction)
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
# https://www.freedesktop.org/software/systemd/man/org.freedesktop.resolve1.html
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
# https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
#include <abstractions/dbus-strict>
dbus send
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="Resolve{Address,Hostname,Record,Service}"
peer=(name="org.freedesktop.resolve1", label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="SetLink{DefaultRoute,DNSOverTLS,DNS,DNSEx,DNSSEC,DNSSECNegativeTrustAnchors,MulticastDNS,Domains,LLMNR}"
peer=(name="org.freedesktop.resolve1", label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="GetLink"
peer=(name="org.freedesktop.resolve1", label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1/link/*"
interface="org.freedesktop.resolve1.Link"
member="Set{DNS,DNSSEC,DNSSECNegativeTrustAnchors,MulticastDNS,Domains,LLMNR}"
peer=(name="org.freedesktop.resolve1", label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="FlushCaches"
peer=(name="org.freedesktop.resolve1", label=unconfined),
dbus (send)
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.DBus.Peer"
member="Ping"
peer=(name="org.freedesktop.resolve1", label=unconfined),
# required by resolvectl command
dbus (send)
bus=system
path="/org/freedesktop/resolve1"
interface=org.freedesktop.DBus.Properties
member=Get{,All}
peer=(label=unconfined),
# required by resolvectl command
dbus (receive)
bus=system
path="/org/freedesktop/resolve1"
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged
peer=(label=unconfined),
# required by resolvectl command
dbus (send)
bus=system
path="/org/freedesktop/resolve1/link/*"
interface="org.freedesktop.DBus.Properties"
member=Get{,All}
peer=(label=unconfined),
# required by resolvectl command
dbus (receive)
bus=system
path="/org/freedesktop/resolve1/link/*"
interface="org.freedesktop.DBus.Properties"
member=PropertiesChanged
peer=(label=unconfined),
# Allow access to wpa-supplicant for managing WiFi networks
dbus (receive, send)
bus=system
path=/fi/w1/wpa_supplicant1{,/**}
interface=fi.w1.wpa_supplicant1*
peer=(label=unconfined),
dbus (receive, send)
bus=system
path=/fi/w1/wpa_supplicant1{,/**}
interface=org.freedesktop.DBus.*
peer=(label=unconfined),
#include <abstractions/ssl_certs>
capability net_admin,
capability net_raw,
capability setuid, # ping
capability net_broadcast, # openvswitchd
# Allow protocols except those that we blacklist in
# /etc/modprobe.d/blacklist-rare-network.conf
network appletalk,
network bridge,
network inet,
network inet6,
network ipx,
network packet,
network pppox,
network sna,
@{PROC}/@{pid}/net/ r,
@{PROC}/@{pid}/net/** r,
# used by sysctl, et al
@{PROC}/sys/ r,
@{PROC}/sys/net/ r,
@{PROC}/sys/net/core/ r,
@{PROC}/sys/net/core/** rw,
@{PROC}/sys/net/ipv{4,6}/ r,
@{PROC}/sys/net/ipv{4,6}/** rw,
@{PROC}/sys/net/netfilter/ r,
@{PROC}/sys/net/netfilter/** rw,
@{PROC}/sys/net/nf_conntrack_max rw,
# For advanced wireless configuration
/sys/kernel/debug/ieee80211/ r,
/sys/kernel/debug/ieee80211/** rw,
# read netfilter module parameters
/sys/module/nf_*/ r,
/sys/module/nf_*/parameters/{,*} r,
# networking tools
/{,usr/}{,s}bin/arp ixr,
/{,usr/}{,s}bin/arpd ixr,
/{,usr/}{,s}bin/bridge ixr,
/{,usr/}{,s}bin/dhclient Pxr, # use ixr instead if want to limit to snap dirs
/{,usr/}{,s}bin/dhclient-script ixr,
/{,usr/}{,s}bin/ifconfig ixr,
/{,usr/}{,s}bin/ifdown ixr,
/{,usr/}{,s}bin/ifquery ixr,
/{,usr/}{,s}bin/ifup ixr,
/{,usr/}{,s}bin/ip ixr,
/{,usr/}{,s}bin/ipmaddr ixr,
/{,usr/}{,s}bin/iptunnel ixr,
/{,usr/}{,s}bin/iw ixr,
/{,usr/}{,s}bin/nameif ixr,
/{,usr/}{,s}bin/netstat ixr, # -p not supported
/{,usr/}{,s}bin/nstat ixr,
/{,usr/}{,s}bin/ping ixr,
/{,usr/}{,s}bin/ping6 ixr,
/{,usr/}{,s}bin/pppd ixr,
/{,usr/}{,s}bin/pppdump ixr,
/{,usr/}{,s}bin/pppoe-discovery ixr,
#/{,usr/}{,s}bin/pppstats ixr, # needs sys_module
/{,usr/}{,s}bin/resolvectl ixr,
/{,usr/}{,s}bin/route ixr,
/{,usr/}{,s}bin/routef ixr,
/{,usr/}{,s}bin/routel ixr,
/{,usr/}{,s}bin/rtacct ixr,
/{,usr/}{,s}bin/rtmon ixr,
/{,usr/}{,s}bin/ss ixr,
/{,usr/}{,s}bin/sysctl ixr,
/{,usr/}{,s}bin/tc ixr,
/{,usr/}{,s}bin/wpa_action ixr,
/{,usr/}{,s}bin/wpa_cli ixr,
/{,usr/}{,s}bin/wpa_passphrase ixr,
/{,usr/}{,s}bin/wpa_supplicant ixr,
/dev/rfkill rw,
/sys/class/rfkill/ r,
/sys/devices/{pci[0-9a-f]*,platform,virtual}/**/rfkill[0-9]*/{,**} r,
/sys/devices/{pci[0-9a-f]*,platform,virtual}/**/rfkill[0-9]*/state w,
# For reading the address of a particular ethernet interface
/sys/devices/{pci[0-9a-f]*,platform,virtual}/**/net/*/address r,
# arp
network netlink dgram,
# ip, et al
/etc/iproute2/{,**} r,
/etc/iproute2/rt_{protos,realms,scopes,tables} w,
/etc/iproute2/rt_{protos,tables}.d/* w,
# ping - child profile would be nice but seccomp causes problems with that
/{,usr/}{,s}bin/ping ixr,
/{,usr/}{,s}bin/ping6 ixr,
network inet raw,
network inet6 raw,
# pppd
capability setuid,
@{PROC}/@{pid}/loginuid r,
@{PROC}/@{pid}/mounts r,
# static host tables
/etc/hosts w,
# resolvconf
/{,usr/}sbin/resolvconf ixr,
/run/resolvconf/{,**} rwk,
/etc/resolvconf/{,**} r,
/{,usr/}lib/resolvconf/* ix,
# Required by resolvconf
/{,usr/}bin/run-parts ixr,
/etc/resolvconf/update.d/* ix,
# wpa_suplicant
/{,var/}run/wpa_supplicant/ w,
/{,var/}run/wpa_supplicant/** rw,
/etc/wpa_supplicant/{,**} ixr,
#ifup,ifdown, dhclient
/{,var/}run/dhclient.*.pid rw,
/var/lib/dhcp/ r,
/var/lib/dhcp/** rw,
/run/network/ifstate* rw,
/run/network/.ifstate* rw,
/run/network/ifup-* rw,
/run/network/ifdown-* rw,
# route
/etc/networks r,
/etc/ethers r,
/etc/rpc r,
# TUN/TAP - https://www.kernel.org/doc/Documentation/networking/tuntap.txt
#
# We only need to tag /dev/net/tun since the tap[0-9]* and tun[0-9]* devices
# are virtual and don't show up in /dev
/dev/net/tun rw,
# Access to sysfs interfaces for tun/tap/mstp/bchat device settings.
/sys/devices/virtual/net/{tap*,mstp*,bchat*}/** rw,
# access to bridge sysfs interfaces for bridge settings
/sys/devices/virtual/net/*/bridge/* rw,
# Network namespaces via 'ip netns'. In order to create network namespaces
# that persist outside of the process and be entered (eg, via
# 'ip netns exec ...') the ip command uses mount namespaces such that
# applications can open the /run/netns/NAME object and use it with setns(2).
# For 'ip netns exec' it will also create a mount namespace and bind mount
# network configuration files into /etc in that namespace. See man ip-netns(8)
# for details.
capability sys_admin, # for setns()
network netlink raw,
/ r,
/run/netns/ rk, # no 'w' since snap-confine will create this for us
/run/netns/* rw,
mount options=(rw, rshared) -> /run/netns/,
mount options=(rw, bind) /run/netns/ -> /run/netns/,
mount options=(rw, bind) / -> /run/netns/*,
umount /run/netns/*,
umount /,
# 'ip netns identify <pid>' and 'ip netns pids foo'. Intenionally omit 'ptrace
# (trace)' here since ip netns doesn't actually need to trace other processes.
capability sys_ptrace,
# 'ip netns exec foo /bin/sh'
mount options=(rw, rslave) /,
mount options=(rw, rslave), # LP: #1648245
mount fstype=sysfs,
umount /sys/,
# Eg, nsenter --net=/run/netns/... <command>
/{,usr/}{,s}bin/nsenter ixr,
# Description: Can query network status information. This is restricted because
# it gives privileged read-only access to networking information and should
# only be used with trusted apps.
# network-observe can't allow this otherwise we are basically network-control,
# but don't explicitly deny since someone might try to use network-control with
# network-observe and that shouldn't fail weirdly
#capability net_admin,
#include <abstractions/nameservice>
/run/systemd/resolve/stub-resolv.conf r,
# systemd-resolved (not yet included in nameservice abstraction)
#
# Allow access to the safe members of the systemd-resolved D-Bus API:
#
# https://www.freedesktop.org/wiki/Software/systemd/resolved/
#
# This API may be used directly over the D-Bus system bus or it may be used
# indirectly via the nss-resolve plugin:
#
# https://www.freedesktop.org/software/systemd/man/nss-resolve.html
#
#include <abstractions/dbus-strict>
dbus send
bus=system
path="/org/freedesktop/resolve1"
interface="org.freedesktop.resolve1.Manager"
member="Resolve{Address,Hostname,Record,Service}"
peer=(name="org.freedesktop.resolve1"),
#include <abstractions/ssl_certs>
# see loaded kernel modules
@{PROC}/modules r,
@{PROC}/@{pid}/net/ r,
@{PROC}/@{pid}/net/** r,
# used by sysctl, et al (sysctl net)
@{PROC}/sys/ r,
@{PROC}/sys/net/ r,
@{PROC}/sys/net/core/ r,
@{PROC}/sys/net/core/** r,
@{PROC}/sys/net/ipv{4,6}/ r,
@{PROC}/sys/net/ipv{4,6}/** r,
@{PROC}/sys/net/netfilter/ r,
@{PROC}/sys/net/netfilter/** r,
@{PROC}/sys/net/nf_conntrack_max r,
# networking tools
/{,usr/}{,s}bin/arp ixr,
/{,usr/}{,s}bin/bridge ixr,
/{,usr/}{,s}bin/ifconfig ixr,
/{,usr/}{,s}bin/ip ixr,
/{,usr/}{,s}bin/ipmaddr ixr,
/{,usr/}{,s}bin/iptunnel ixr,
/{,usr/}{,s}bin/netstat ixr, # -p not supported
/{,usr/}{,s}bin/nstat ixr, # allows zeroing
#/{,usr/}{,s}bin/pppstats ixr, # needs sys_module
/{,usr/}{,s}bin/route ixr,
/{,usr/}{,s}bin/routel ixr,
/{,usr/}{,s}bin/rtacct ixr,
/{,usr/}{,s}bin/ss ixr,
/{,usr/}{,s}bin/sysctl ixr,
/{,usr/}{,s}bin/tc ixr,
# arp
network netlink dgram,
# ip, et al
/etc/iproute2/{,**} r,
# ping - child profile would be nice but seccomp causes problems with that
/{,usr/}{,s}bin/ping ixr,
/{,usr/}{,s}bin/ping6 ixr,
capability net_raw,
capability setuid,
network inet raw,
network inet6 raw,
# route
/etc/networks r,
/etc/ethers r,
/etc/rpc r,
# network devices
/sys/devices/**/net/** rk,
# for receiving kobject_uevent() net messages from the kernel
network netlink raw,
# Description: Can read netplan configuration files
# Allow use of the netplan binary from the base snap. With this interface, this
# is expected to be able to only get information about the current network
# configuration and not generate or apply it like is allowed with
# network-setup-control.
/usr/sbin/netplan ixr,
# core18+ has /usr/sbin/netplan as a symlink to this script
/usr/share/netplan/netplan.script ixr,
# netplan related files
/usr/share/netplan/ r,
/usr/share/netplan/** r,
# Netplan uses busctl internally, so allow using that as well
/usr/bin/busctl ixr,
# from systemd 254 onward, busctl binds to a unix socket upon startup to
# facilitate debugging
unix (bind) type=stream addr="@[0-9a-fA-F]*/bus/busctl/*",
/etc/netplan/{,**} r,
/etc/network/{,**} r,
/etc/systemd/network/{,**} r,
/run/systemd/network/{,**} r,
/run/NetworkManager/conf.d/{,**} r,
/run/udev/rules.d/ r,
/run/udev/rules.d/[0-9]*-netplan-* r,
#include <abstractions/dbus-strict>
# Allow use of Netplan Info API, used to get information on available netplan
# features and version
dbus (send)
bus=system
interface=io.netplan.Netplan
path=/io/netplan/Netplan
member=Info
peer=(label=unconfined),
# Description: Can read/write netplan configuration files
# Allow use of the netplan binary from the base snap. With this interface, this
# is expected to be able to apply and generate new network configuration, as
# well as get information about the current network configuration.
/usr/sbin/netplan ixr,
# core18+ has /usr/sbin/netplan as a symlink to this script
/usr/share/netplan/netplan.script ixr,
# netplan related files
/usr/share/netplan/ r,
/usr/share/netplan/** r,
# Netplan uses busctl internally, so allow using that as well
/usr/bin/busctl ixr,
# from systemd 254 onward, busctl binds to a unix socket upon startup to
# facilitate debugging
unix (bind) type=stream addr="@[0-9a-fA-F]*/bus/busctl/*",
/etc/netplan/{,**} rw,
/etc/network/{,**} rw,
/etc/systemd/network/{,**} rw,
# netplan generate
/run/ r,
/run/systemd/network/{,**} r,
/run/systemd/network/*-netplan-* w,
/run/NetworkManager/conf.d/{,**} r,
/run/NetworkManager/conf.d/*netplan*.conf* w,
/run/udev/rules.d/ rw, # needed for cloud-init
/run/udev/rules.d/[0-9]*-netplan-* rw,
#include <abstractions/dbus-strict>
# Allow use of Netplan API, used to configure network using dbus
# (see https://netplan.readthedocs.io/en/stable/netplan-dbus/)
dbus (send)
bus=system
interface=io.netplan.Netplan
path=/io/netplan/Netplan
member={Generate,Apply,Info,Config}
peer=(label=unconfined),
# This is the interface for configuration objects
dbus (send)
bus=system
interface=io.netplan.Netplan.Config
path=/io/netplan/Netplan/config/*
member={Get,Set,Try,Cancel,Apply}
peer=(label=unconfined),
# Description: This interface allows for getting hardware information
# from the system. This is reserved because it allows reading potentially
# sensitive information.
# used by lscpu and 'lspci -A intel-conf1/intel-conf2'
capability sys_rawio,
# see loaded kernel modules
@{PROC}/modules r,
# used by lspci
capability sys_admin,
/etc/modprobe.d/{,*} r,
/{,usr/}lib/modprobe.d/{,*} r,
# for reading the available input devices on the system
/proc/bus/input/devices r,
# files in /sys pertaining to hardware (eg, 'lspci -A linux-sysfs')
/sys/{block,bus,class,devices,firmware}/{,**} r,
# files in /proc/bus/pci (eg, 'lspci -A linux-proc')
@{PROC}/bus/pci/{,**} r,
# power information
/sys/power/{,**} r,
/run/udev/data/+power_supply:* r,
# interrupts
@{PROC}/interrupts r,
# libsensors
/etc/sensors3.conf r,
/etc/sensors.d/{,*} r,
# Needed for udevadm
/run/udev/data/** r,
network netlink raw,
# util-linux
/{,usr/}bin/lsblk ixr,
/{,usr/}bin/lscpu ixr,
/{,usr/}bin/lsmem ixr,
# lsusb
# Note: lsusb and its database have to be shipped in the snap if not on classic
/{,usr/}bin/lsusb ixr,
/var/lib/usbutils/usb.ids r,
/dev/ r,
/dev/bus/usb/{,**/} r,
/etc/udev/udev.conf r,
# lshw -quiet (note, lshw also tries to create /dev/fb-*, but fails gracefully)
@{PROC}/devices r,
@{PROC}/ide/{,**} r,
@{PROC}/scsi/{,**} r,
@{PROC}/device-tree/{,**} r,
/sys/kernel/debug/usb/devices r,
@{PROC}/sys/abi/{,*} r,
# hwinfo --short
@{PROC}/ioports r,
@{PROC}/dma r,
@{PROC}/tty/driver/{,*} r,
@{PROC}/sys/dev/cdrom/info r,
# status of ksm (Kernel Samepage Merging), hugepages and transparent_hugepage, but not the pages themselves
/sys/kernel/mm/{ksm,hugepages,transparent_hugepage}/{,**} r,
# systemd-detect-virt
/{,usr/}bin/systemd-detect-virt ixr,
# VMs
@{PROC}/cpuinfo r,
@{PROC}/sysinfo r, # Linux on z/VM
@{PROC}/xen/capabilities r,
/sys/hypervisor/properties/features r,
/sys/hypervisor/type r,
# containers
/run/systemd/container r,
# /proc/1/sched in a systemd-nspawn container with '-a' is supposed to show on
# its first line a pid that != 1 and systemd-detect-virt tries to detect this.
# This doesn't seem to be the case on (at least) systemd 240 on Ubuntu. This
# file is somewhat sensitive for arbitrary pids, but is not overly so for pid
# 1. For containers, systemd won't normally look at this file since it has
# access to /run/systemd/container and 'container' from the environment, and
# systemd fails gracefully when it doesn't have access to /proc/1/sched. For
# VMs, systemd requires access to /proc/1/sched in its detection algorithm.
# See src/basic/virt.c from systemd sources for details.
@{PROC}/1/sched r,
# systemd-detect-virt --private-users will look at these and the access is
# better added to system-observe. Since snaps typically only care about
# --container and --vm leave these commented out.
#@{PROC}/@{pid}/uid_map r,
#@{PROC}/@{pid}/gid_map r,
#@{PROC}/@{pid}/setgroups r,
# systemd-detect-virt --chroot requires 'ptrace (read)' on unconfined to
# determine if it is running in a chroot. Like above, this is best granted via
# system-observe.
#ptrace (read) peer=unconfined,
# Layout path: /etc/NetworkManager
"/etc/NetworkManager{,/**}" mrwklix,
# Layout path: /usr/lib/NetworkManager
"/usr/lib/NetworkManager{,/**}" mrwklix,
# Layout path: /usr/lib/libnm.so.0
# (no extra permissions required for symlink)
# Layout path: /usr/sbin/openvpn
# (no extra permissions required for symlink)
# Layout path: /var/lib/NetworkManager
"/var/lib/NetworkManager{,/**}" mrwklix,
network xdp,
# While commands like 'ps', 'ip netns identify <pid>', 'ip netns pids foo', etc
# trigger a 'ptrace (trace)' denial, they aren't actually tracing other
# processes. Unfortunately, the kernel overloads trace such that the LSMs are
# unable to distinguish between tracing other processes and other accesses.
# ptrace (trace) can be used to break out of the seccomp sandbox unless the
# kernel has 93e35efb8de45393cf61ed07f7b407629bf698ea (in 4.8+). Until snapd
# has full ptrace support conditional on kernel support, explicitly deny to
# silence noisy denials/avoid confusion and accidentally giving away this
# dangerous access frivolously.
deny ptrace (trace),
deny capability sys_ptrace,
# The rtnetlink kernel interface can trigger the loading of kernel modules,
# first attempting to operate on a network module (this requires the net_admin
# capability) and falling back to loading ordinary modules (and this requires
# the sys_module capability). For reference, see the dev_load() function in:
# https://kernel.ubuntu.com/git/ubuntu/ubuntu-focal.git/tree/net/core/dev_ioctl.c?h=v5.13#n354
# The following rule is used to silence the denials for attempting to load
# generic kernel modules, while still allowing the loading of network modules.
deny capability sys_module,
}