Hi,
Given Buster shipped with AppArmor enabled by default, arguably this
bug should be RC. I confirm this bug and adding these rules should fix
this:
owner @{HOME}/.local/share/Ricochet/ rw,
owner @{HOME}/.local/share/Ricochet/** mrwlk,
Constantin, can you please try this out? You'll need to reload the
profile after modifying it:
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.ricochet
Now, on a current Debian sid default GNOME (+ Wayland) desktop, the
profile denies tons of other stuff which triggers tons of noise in the
logs. The attached profile fixes some (not all) of it but I'm not
familiar enough with Ricochet to tell whether the denied access should
be allowed or silently denied (with "deny" rules) so I'll let folks
more familiar with Ricochet look into the fine details — and that
should be for another bug anyway.
# Last Modified: Mon Jul 17 00:25:38 2017
#include <tunables/global>
# AppArmor Ricochet profile for Debian GNU/Linux
# This profile is Free Software and released under the same license as Ricochet
# itself.
#
# Copyleft 2015 Jacob Appelbaum <[email protected]>
#
/usr/bin/ricochet {
#include <abstractions/audio>
#include <abstractions/dconf>
#include <abstractions/kde>
#include <abstractions/nameservice>
#include <abstractions/openssl>
#include <abstractions/wayland>
/usr/lib/** mr,
# Allow TCP connections
network inet stream,
network inet6 stream,
# Allow Ricochet to exec pulseaudio
# This makes me very sad...
# as it seems that you can't isolate playing and recording :(
/usr/bin/pulseaudio rix,
# Allow Ricochet to exec tor
/usr/bin/tor rix,
# Tor in turn needs various things
/usr/share/tor/geoip r,
/usr/share/tor/geoip6 r,
/proc/sys/kernel/random/uuid r,
/sys/devices/system/cpu/ r,
# Allow Ricochet to read tor daemons auth cookie
/run/tor/control.authcookie r,
# Allow Ricochet to read itself
/usr/bin/ricochet r,
/proc/[0-9]*/cmdline r,
/proc/[0-9]*/environ r,
# Allow Ricochet to generate audio
owner /{dev,run}/shm/pulse-shm* m,
# Allow Ricochet to draw the UX
/dev/dri/ r,
/sys/devices/pci[0-9]*/**/config r,
/sys/devices/pci[0-9]*/**/uevent r,
/run/udev/data/* r,
# Allow Ricochet to load GTK themes
/usr/share/themes/* r,
/usr/share/themes/**/* r,
owner @{HOME}/.gtkrc-2.0 r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
# Allow Ricochet to look up all your machine's PII
# Why does it need this stuff? BAD NEWS BEARS
/etc/machine-id r,
/var/lib/dbus/machine-id r,
owner @{HOME}/.local/share/Ricochet/ rw,
owner @{HOME}/.local/share/Ricochet/** mrwlk,
owner @{HOME}/.cache/Ricochet/ rw,
owner @{HOME}/.cache/Ricochet/** rwl,
}
