FYI AppArmor profile for VirtualBox
Malte Gell <[email protected]> Tue, 13 Sep 2016 10:01:54 +0200
| Newsgroups | gmane.linux.suse.security |
|---|---|
| Message-ID | <[email protected]> |
To me there is no reason to trust guest systems I run in VirtualBox, especially software from the city of Redmond always enjoys my distrust. Thus, I created an AA profile for VirtualBox. BTW, all profiles I posted work with Leap 42.1, I use them daily. The VirtualBox profile supports USB access if you install that guest USB thing from Oracle. This profile works fine for me with MS Windows 7 as guest OS. If you use other guest OS, the profile *may* need adjustments.
usr.lib.virtualbox.VirtualBox.TXT
(text/plain, 2.3 KB)
# Last Modified: Sat Mar 31 15:33:21 2012
#include <tunables/global>
/usr/lib/virtualbox/VirtualBox {
#include <abstractions/audio>
#include <abstractions/base>
#include <abstractions/bash>
#include <abstractions/cups-client>
#include <abstractions/dbus-session>
#include <abstractions/fonts>
#include <abstractions/nameservice>
#include <abstractions/kde>
#include <abstractions/kde.local>
#include <abstractions/X>
capability net_raw,
capability sys_ptrace,
network inet raw,
network inet stream,
network inet6 stream,
/bin/bash rix,
/bin/dash rix,
/bin/which rix,
/dev/video* rw,
/dev/ati/* rw,
/dev/vboxdrv rw,
/dev/vboxusb/ rw,
/dev/vboxusb/** rw,
/dev/sr0 rw,
/etc/udev/udev.conf r,
/etc/xdg/Trolltech.conf rk,
"/home/*/VirtualBox VMs/" rw,
"/home/*/VirtualBox VMs/**" rw,
# Change to where you put your virtual drives
/home/virtualbox-drives/ rw,
/home/virtualbox-drives/** rw,
#
/home/*/.ICEauthority r,
/home/*/.VirtualBox/ r,
/home/*/.VirtualBox/* rw,
/home/*/.Xauthority r,
/home/*/.cache/dconf/user rw,
/home/*/.config/Trolltech.conf rk,
/home/*/.config/VirtualBox/ rw,
/home/*/.config/VirtualBox/** rw,
/home/*/.config/dconf/user r,
/home/*/.icons/ r,
/home/*/.icons/** r,
/home/*/.local/share/* r,
"/home/*/Documents/OS Images/*" r,
"/home/*/VirtualBox VMs/**" rw,
/lib/** r,
/lib32/** r,
/lib64/** r,
/proc/ r,
/proc/*/cmdline r,
/proc/*/io r,
/proc/*/oom_score_adj rw,
/proc/*/stat r,
/proc/*/statm r,
/proc/*/status r,
/proc/*/task/** r,
/proc/ati/* r,
/proc/meminfo r,
/proc/modules r,
/proc/sys/kernel/** r,
/proc/tty/drivers r,
/proc/uptime r,
/proc/version r,
/proc/*/mountinfo r,
/run/resolvconf/* r,
/run/udev/data/** r,
/sys/bus/usb/ rw,
/sys/bus/usb/** rw,
/sys/block/ r,
/sys/class/*/ r,
/sys/devices/** r,
owner /tmp/** wk,
/usr/lib/virtualbox/VBoxSVC rix,
/usr/lib/virtualbox/VBoxTestOGL rix,
/usr/lib/virtualbox/VBoxXPCOMIPCD rix,
/usr/lib/virtualbox/VirtualBox rix,
/usr/lib{,32,64}/** mr,
/usr/share/glib-2.0/** r,
/usr/share/icons/ r,
/usr/share/icons/** rk,
/usr/share/icu/ r,
/usr/share/icu/** r,
/usr/share/fonts-config/ r,
/usr/share/fonts-config/** r,
/usr/share/*fonts*/ r,
/usr/share/*fonts*/** r,
/usr/share/ghostscript/fonts/ r,
/usr/share/ghostscript/fonts/** r,
/usr/share/mime/* r,
/usr/share/pixmaps/ r,
/usr/share/themes/** r,
/usr/share/virtualbox/** r,
owner /tmp/xauth* rk,
owner /{run,dev}/shm/* rk,
/{run,dev}/shm/* w,
}