home *** CD-ROM | disk | FTP | other *** search
/ Personal Computer World 2009 February / PCWFEB09.iso / Software / Linux / Kubuntu 8.10 / kubuntu-8.10-desktop-i386.iso / casper / filesystem.squashfs / etc / apparmor.d / usr.sbin.cupsd
Text File  |  2008-10-20  |  3KB  |  137 lines
  1. # vim:syntax=apparmor
  2. # Last Modified: Thu Aug  2 12:54:46 2007
  3. # Author: Martin Pitt <martin.pitt@ubuntu.com>
  4.  
  5. #include <tunables/global>
  6.  
  7. /usr/sbin/cupsd {
  8.   #include <abstractions/base>
  9.   #include <abstractions/bash>
  10.   #include <abstractions/authentication>
  11.   #include <abstractions/dbus>
  12.   #include <abstractions/fonts>
  13.   #include <abstractions/nameservice>
  14.   #include <abstractions/perl>
  15.   #include <abstractions/user-tmp>
  16.  
  17.   capability chown,
  18.   capability fowner,
  19.   capability fsetid,
  20.   capability kill,
  21.   capability net_bind_service,
  22.   capability setgid,
  23.   capability setuid,
  24.  
  25.   # nasty, but we limit file access pretty tightly, and cups chowns a
  26.   # lot of files to 'lp' which it cannot read/write afterwards any
  27.   # more
  28.   capability dac_override,
  29.  
  30.   # the bluetooth backend needs this
  31.   network bluetooth,
  32.  
  33.   /bin/bash ixr,
  34.   /bin/dash ixr,
  35.   /bin/hostname ixr,
  36.   /dev/lp* rw,
  37.   /dev/ttyS* rw,
  38.   /dev/usb/lp* rw,
  39.   /dev/parport* rw,
  40.   /etc/cups/ rw,
  41.   /etc/cups/** rw,
  42.   /etc/foomatic/* r,
  43.   /etc/gai.conf r,
  44.   /etc/shadow m,
  45.   /etc/passwd m,
  46.   /etc/group m,
  47.   /etc/papersize r,
  48.   /etc/pnm2ppa.conf r,
  49.   /etc/printcap rwl,
  50.   /etc/ssl/** r,
  51.   @{PROC}/net/ r,
  52.   @{PROC}/net/* r,
  53.   @{PROC}/sys/dev/parport/** r,
  54.   /sys/** r,
  55.   /usr/bin/* ixr,
  56.   /usr/sbin/* ixr,
  57.   /bin/* ixr,
  58.   /sbin/* ixr,
  59.   /usr/lib/** rm,
  60.  
  61.   # backends which come with CUPS can be confined
  62.   /usr/lib/cups/backend/bluetooth ixr,
  63.   /usr/lib/cups/backend/dnssd ixr,
  64.   /usr/lib/cups/backend/http ixr,
  65.   /usr/lib/cups/backend/ipp ixr,
  66.   /usr/lib/cups/backend/lpd ixr,
  67.   /usr/lib/cups/backend/parallel ixr,
  68.   /usr/lib/cups/backend/scsi ixr,
  69.   /usr/lib/cups/backend/serial ixr,
  70.   /usr/lib/cups/backend/snmp ixr,
  71.   /usr/lib/cups/backend/socket ixr,
  72.   /usr/lib/cups/backend/usb ixr,
  73.   # we treat cups-pdf specially, since it needs to write into /home
  74.   # and thus needs extra paranoia
  75.   /usr/lib/cups/backend/cups-pdf Px,
  76.   # third party backends get no restrictions as they often need high
  77.   # privileges and this is beyond our control
  78.   /usr/lib/cups/backend/* Ux,
  79.  
  80.   /usr/lib/cups/cgi-bin/* ixr,
  81.   /usr/lib/cups/daemon/* ixr,
  82.   /usr/lib/cups/monitor/* ixr,
  83.   /usr/lib/cups/notifier/* ixr,
  84.   # filters and drivers (PPD generators) are always run as non-root,
  85.   # and there are a lot of third-party drivers which we cannot predict
  86.   /usr/lib/cups/filter/* Uxr, 
  87.   /usr/lib/cups/driver/* Uxr,
  88.   /usr/local/share/** r,
  89.   /usr/share/** r,
  90.   /var/cache/cups/ rw,
  91.   /var/cache/cups/** rwk,
  92.   /var/log/cups/ rw,
  93.   /var/log/cups/* rw,
  94.   /var/run/avahi-daemon/socket rw,
  95.   /var/run/cups/ rw,
  96.   /var/run/cups/** rw,
  97.   /var/spool/cups/ rw,
  98.   /var/spool/cups/** rw,
  99.  
  100.   # third-party printer drivers; no known structure here
  101.   /opt/** rix,
  102.  
  103.   # FIXME: no policy ATM for hplip
  104.   /usr/bin/hpijs Ux,
  105.  
  106.   # Kerberos authentication
  107.   /etc/krb5.conf r,
  108.   /etc/cups/krb5.keytab rw,
  109. }
  110.  
  111. # separate profile since this needs to write into /home
  112. /usr/lib/cups/backend/cups-pdf {
  113.   #include <abstractions/base>
  114.   #include <abstractions/fonts>
  115.   #include <abstractions/nameservice>
  116.   #include <abstractions/user-tmp>
  117.  
  118.   capability chown,
  119.   capability fowner,
  120.   capability fsetid,
  121.   capability setgid,
  122.   capability setuid,
  123.  
  124.   /bin/dash ixr,
  125.   /bin/bash ixr,
  126.   /etc/papersize r,
  127.   /etc/cups/cups-pdf.conf r,
  128.   @{HOME}/PDF/ rw,
  129.   @{HOME}/PDF/* rw,
  130.   /usr/bin/gs ixr,
  131.   /usr/lib/cups/backend/cups-pdf mr,
  132.   /usr/lib/ghostscript/** mr,
  133.   /usr/share/** r,
  134.   /var/log/cups/cups-pdf_log w,
  135.   /var/spool/cups-pdf/** rw,
  136. }
  137.