From 1bc84f3e53f66abf4ee246e89f20f72626a199de Mon Sep 17 00:00:00 2001 From: smitsohu Date: Mon, 26 Mar 2018 18:59:29 +0200 Subject: rework akonadi integration the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). --- etc/akonadi_control.profile | 12 ++++++++---- etc/disable-programs.inc | 3 ++- etc/kmail.profile | 14 ++++++++------ etc/knotes.profile | 3 ++- 4 files changed, 20 insertions(+), 12 deletions(-) diff --git a/etc/akonadi_control.profile b/etc/akonadi_control.profile index 0443774dd..296b25b83 100644 --- a/etc/akonadi_control.profile +++ b/etc/akonadi_control.profile @@ -7,9 +7,13 @@ include /etc/firejail/globals.local noblacklist ${HOME}/.cache/akonadi* noblacklist ${HOME}/.config/akonadi* noblacklist ${HOME}/.config/baloorc -noblacklist ${HOME}/.local/share/akonadi/* +noblacklist ${HOME}/.config/emailidentities +noblacklist ${HOME}/.config/kmail2rc +noblacklist ${HOME}/.local/share/akonadi* noblacklist ${HOME}/.local/share/contacts noblacklist ${HOME}/.local/share/local-mail +noblacklist ${HOME}/.local/share/notes +noblacklist /tmp/akonadi-* noblacklist /usr/sbin include /etc/firejail/disable-common.inc @@ -19,8 +23,8 @@ include /etc/firejail/disable-programs.inc include /etc/firejail/whitelist-var-common.inc -# depending on your setup it might be possible to -# enable some of the commented options below +# the default mysqld-akonadi apparmor profile in debian and ubuntu +# is not compatible with the commented options below # apparmor caps.drop all @@ -30,7 +34,7 @@ netfilter nodvd nogroups # nonewprivs -# noroot +noroot nosound notv novideo diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index de88cbc24..96cc9b48c 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc @@ -349,7 +349,7 @@ blacklist ${HOME}/.local/share/SuperHexagon blacklist ${HOME}/.local/share/TelegramDesktop blacklist ${HOME}/.local/share/Terraria blacklist ${HOME}/.local/share/TpLogger -blacklist ${HOME}/.local/share/akonadi/* +blacklist ${HOME}/.local/share/akonadi* blacklist ${HOME}/.local/share/akregator blacklist ${HOME}/.local/share/aspyr-media blacklist ${HOME}/.local/share/baloo @@ -495,6 +495,7 @@ blacklist ${HOME}/.xpdfrc blacklist ${HOME}/.zoom blacklist ${HOME}/Arduino blacklist ${HOME}/wallet.dat +blacklist /tmp/akonadi-* blacklist /tmp/ssh-* # ~/.cache directory diff --git a/etc/kmail.profile b/etc/kmail.profile index 952af55c8..e33eae84f 100644 --- a/etc/kmail.profile +++ b/etc/kmail.profile @@ -5,20 +5,22 @@ include /etc/firejail/kmail.local # Persistent global definitions include /etc/firejail/globals.local -# if akonadi has a mysql backend, starting it inside this sandbox will fail. -# one solution is to have akonadi already running when kmail is launched +# kmail has problems launching akonadi in debian and ubuntu. +# one solution is to have akonadi already running when kmail is started noblacklist ${HOME}/.cache/akonadi* noblacklist ${HOME}/.config/akonadi* noblacklist ${HOME}/.config/baloorc noblacklist ${HOME}/.config/emailidentities noblacklist ${HOME}/.config/kmail2rc -noblacklist ${HOME}/.local/share/akonadi/* +noblacklist ${HOME}/.gnupg +noblacklist ${HOME}/.local/share/akonadi* noblacklist ${HOME}/.local/share/contacts noblacklist ${HOME}/.local/share/emailidentities noblacklist ${HOME}/.local/share/kmail2 noblacklist ${HOME}/.local/share/local-mail -noblacklist ${HOME}/.gnupg +noblacklist ${HOME}/.local/share/notes +noblacklist /tmp/akonadi-* include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc @@ -36,8 +38,8 @@ nosound notv novideo protocol unix,inet,inet6,netlink -# we need to allow chroot and ioprio_set system calls -seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice +# we need to allow chroot, io_getevents, ioprio_set, io_setup, io_submit system calls +seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice # tracelog # writable-run-user is needed for signing and encrypting emails writable-run-user diff --git a/etc/knotes.profile b/etc/knotes.profile index 091c3a8e5..85b267f8b 100644 --- a/etc/knotes.profile +++ b/etc/knotes.profile @@ -7,7 +7,8 @@ include /etc/firejail/globals.local noblacklist ${HOME}/.config/akonadi* noblacklist ${HOME}/.config/knotesrc -noblacklist ${HOME}/.local/share/akonadi/* +noblacklist ${HOME}/.local/share/akonadi* +noblacklist /tmp/akonadi-* include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc -- cgit v1.2.3-70-g09d2