FYI AppArmor profile for GnuPG

Malte Gell <[email protected]> Tue, 13 Sep 2016 09:37:42 +0200

Newsgroups	gmane.linux.suse.security
Message-ID	<[email protected]>

Dear List,

GnuPG is a crucial security tool on any Linux system and its importance
may make it prone to attacks. Thus it´s wise to have an AA profile for it.

This AA profile for GnuPG supports the graphical pinentry programs and
it supports SmartCard use. It also works with the Thunderbird addon
Enigmail.

This profile may need additional permissions if you use GnuPG with other
mail clients besides Thunderbird. I only made it work for Thunderbird.

usr.bin.gpg2.TXT (text/plain, 1.6 KB)

# Last Modified: Wed Aug 27 17:34:38 2014
# vim:syntax=apparmor
#include <tunables/global>

/usr/bin/gpg2 {
  #include <abstractions/X>
  #include <abstractions/apache2-common>
  #include <abstractions/base>
  #include <abstractions/kde>
  #include <abstractions/kde.local>


  audit capability  ipc_lock,
  capability ipc_lock,



  /dev/tty rw,
  /dev/random rw,
  /dev/urandom rw,

  /etc/gnupg/ r,
  /etc/gnupg/** r,
  /etc/inputrc r,
  /etc/ld.so.preload r,
  /etc/ssl r,
  /etc/ssl/** r,
  owner  /home/*/ r,
  owner  /home/*/** r,
  # owner  /home/*/**/{*.pdf,*.asc,*.txt,*.png,*.jpg,*.msg} r,
  /home/*/.ICEauthority r,
  /home/*/.Xauthority r,
  owner /home/*/.gnupg/ rw,
  owner /home/*/.gnupg/** rwk,
  owner /home/*/.gnupg/pubring* rwkl,
  owner /home/*/.gnupg/secring* rwkl,
  owner /home/*/.gnupg/trustdb.gpg.lock rwkl,
  owner /home/*/.gnupg/trustdb.gpg rwkl,
  /home/*/*ownload*/ rw,
  /home/*/*ownload*/** rw,
  /home/*/.thunderbird/ r,
  audit /home/*/.thunderbird/** r,
owner  /home/*/tmp/ rw,
owner  /home/*/tmp/** rw,
  /opt/lib/lib*so* mr,
  /tmp/ r,
  owner /tmp/* rw,
  owner /tmp/** rw,
  owner /tmp/gpg* rw,
  /var/cache/ r,
  /var/cache/** r,
  /var/cache/** rw,
  /usr/bin/gpg rix,
  /usr/bin/gpg* rix,
  /usr/bin/gpg-agent rix,
  /usr/bin/gpg2 rix,
  /usr/bin/pinentry* rix,
  /usr/bin/kbxutil rix,
  /usr/bin/scdaemon rix,
  /usr/bin/watchgnupg rix,
  /usr/lib64/gpg2keys_hkp rix,
  /usr/lib64/gnupg-pcsc-wrapper r,
  /usr/lib64/gpg* r,
  /usr/sbin/addgnupghome rix,
  /usr/sbin/applygnupgdefaults rix,
  /usr/share/terminfo/x/xterm r,
  /usr/share/gnupg/* r,

}