Icedove et Apparmor

Salut,
Ce matin mise à jour de

Start-Date: 2016-08-01  09:05:15
Commandline: packagekit role='update-packages'
Requested-By: guy (1001)
Upgrade: icedove:amd64 (1:45.1.0-1, 1:45.2.0-2), chromium-inspector:amd64 (51.0.2704.79-1~deb8u1, 52.0.2743.82-1~deb8u1), libc6:amd64 (2.23-2, 2.23-4), libc6:i386 (2.23-2, 2.23-4), locales:amd64 (2.23-2, 2.23-4), iceowl-l10n-fr:amd64 (1:45.1.0-1, 1:45.2.0-2), libc-l10n:amd64 (2.23-2, 2.23-4), icedove-l10n-fr:amd64 (1:45.1.0-1, 1:45.2.0-2), libc-bin:amd64 (2.23-2, 2.23-4), libidn11:amd64 (1.32-3.1, 1.33-1), libidn11:i386 (1.32-3.1, 1.33-1), multiarch-support:amd64 (2.23-2, 2.23-4), iceowl-extension:amd64 (1:45.1.0-1, 1:45.2.0-2)
End-Date: 2016-08-01  09:06:01

Et depuis apparmor se plaint quand je lance Icedove qu’il interdit l’accès à mon mail local
/var/mail

Aug  1 09:25:33 debian kernel: [  539.165200] audit_printk_skb: 162 callbacks suppressed
Aug  1 09:25:33 debian kernel: [  539.165205] audit: type=1400 audit(1470036333.163:66): apparmor="DENIED" operation="open" profile="icedove" name="/var/mail/guy" pid=6134 comm="icedove" requested_mask="r" denied_mask="r" fsuid=1001 ouid=1001

la syntaxe du profile est nébuleuse pour moi

cat /etc/apparmor.d/usr.bin.icedove
# vim:syntax=apparmor
# Author: Simon Deziel <simon.deziel at gmail_com>
# This apparmor profile is derived from firefox profile
# by Jamie Strandboge <jamie@canonical.com>

# Declare an apparmor variable to help with overrides
@{MOZ_LIBDIR}=/usr/lib/icedove

#include <tunables/global>

profile icedove /usr/lib/icedove/icedove {
  #include <abstractions/audio>
  #include <abstractions/aspell>
  #include <abstractions/cups-client>
  # TODO: finetune this for required accesses
  #include <abstractions/dbus>
  #include <abstractions/dbus-accessibility>
  #include <abstractions/dbus-session>
  #include <abstractions/gnome>
  #include <abstractions/ibus>
  #include <abstractions/nameservice>
  #include <abstractions/p11-kit>
  #include <abstractions/private-files>
  #include <abstractions/ssl_certs>
  #include <abstractions/ubuntu-browsers>
  #include <abstractions/ubuntu-helpers>

  # for crash reports?
  ptrace (read,trace) peer=@{profile_name},

  # Pulseaudio
  /usr/bin/pulseaudio Pixr,

  owner @{HOME}/.{cache,config}/dconf/user rw,
  owner /run/user/[0-9]*/dconf/user rw,
  owner @{HOME}/.config/gtk-3.0/bookmarks r,
  deny owner @{HOME}/.local/share/gvfs-metadata/* r,

  # potentially extremely sensitive files
  audit deny @{HOME}/.gnupg/** mrwkl,
  audit deny @{HOME}/.ssh/** mrwkl,

  # rw access to HOME is useful when sending/receiving attachments
  owner @{HOME}/** rw,

  # Required for LVM setups
  /sys/devices/virtual/block/dm-[0-9]*/uevent r,

  # Addons (too lax for icedove)
  ##include <abstractions/ubuntu-browsers.d/firefox>

  # for networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,
  @{PROC}/[0-9]*/net/dev r,
  @{PROC}/[0-9]*/net/wireless r,

  # should maybe be in abstractions
  /etc/ r,
  /etc/mime.types r,
  /etc/mailcap r,
  /etc/xdg/*buntu/applications/defaults.list    r, # for all derivatives
  /etc/xfce4/defaults.list r,
  /usr/share/xubuntu/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/mimeapps.list r,
  owner @{HOME}/.local/share/applications/mimeinfo.cache r,
  owner /tmp/** m,
  owner /var/tmp/** m,
  /tmp/.X[0-9]*-lock r,
  /etc/udev/udev.conf r,
  # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
  # Possibly move to an abstraction if anything else needs it.
  deny /run/udev/data/** r,

  /etc/timezone r,
  /etc/wildmidi/wildmidi.cfg r,

  # icedove specific
  /etc/icedove/ r,
  /etc/icedove/** r,
  /etc/xul-ext/** r,
  /etc/xulrunner-2.0*/ r,
  /etc/xulrunner-2.0*/** r,
  /etc/gre.d/ r,
  /etc/gre.d/* r,

  # noisy
  deny @{MOZ_LIBDIR}/** w,
  deny /usr/lib/icedove-addons/** w,
  deny /usr/lib/xulrunner-addons/** w,
  deny /usr/lib/xulrunner-*/components/*.tmp w,
  deny /.suspended r,
  deny /boot/initrd.img* r,
  deny /boot/vmlinuz* r,
  deny /var/cache/fontconfig/ w,
  deny @{HOME}/.local/share/recently-used.xbel r,
  deny @{HOME}/.* r,

  # TODO: investigate
  deny /usr/bin/gconftool-2 x,

  owner @{PROC}/[0-9]*/mountinfo r,
  owner @{PROC}/[0-9]*/stat r,
  owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
  /sys/devices/pci[0-9]*/**/uevent r,
  /etc/mtab r,
  /etc/fstab r,

  # Needed for the crash reporter
  owner @{PROC}/[0-9]*/environ r,
  owner @{PROC}/[0-9]*/auxv r,
  /etc/lsb-release r,
  /usr/bin/expr ix,
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/** r,

  # about:memory
  owner @{PROC}/[0-9]*/statm r,
  owner @{PROC}/[0-9]*/smaps r,

  # Needed for container to work in xul builds
  /usr/lib/xulrunner-*/plugin-container ixr,

  # allow access to documentation and other files the user may want to look
  # at in /usr and /opt
  /usr/ r,
  /usr/** r,
  /opt/ r,
  /opt/** r,

  # so browsing directories works
  / r,
  /**/ r,

  # per-user icedove configuration
  owner @{HOME}/.icedove/ rw,
  owner @{HOME}/.icedove/** rw,
  owner @{HOME}/.icedove/**/storage.sdb k,
  owner @{HOME}/.icedove/**/*.{db,parentlock,sqlite}* k,
  owner @{HOME}/.icedove/plugins/** rm,
  owner @{HOME}/.icedove/**/plugins/** rm,
  owner @{HOME}/.cache/icedove/ rw,
  owner @{HOME}/.cache/icedove/** rw,

  #
  # Extensions
  # /usr/share/.../extensions/... is already covered by '/usr/** r', above.
  # Allow 'x' for downloaded extensions, but inherit policy for safety
  owner @{HOME}/.icedove/**/extensions/** mixrw,
  owner @{HOME}/.mozilla/extensions/**        mixr,
  /usr/share/xul-ext/**/*.sqlite              rk,
  /usr/lib/xul-ext/**/*.sqlite                rk,
  /usr/lib/icedove-addons/extensions/**/*.sqlite rk,

  deny @{MOZ_LIBDIR}/update.test w,
  deny /usr/lib/mozilla/extensions/**/ w,
  deny /usr/lib/xulrunner-addons/extensions/**/ w,
  deny /usr/share/mozilla/extensions/**/ w,
  deny /usr/share/mozilla/ w,

  # Miscellaneous (to be abstracted)
  # Ideally these would use a child profile. They are all ELF executables
  # so running with 'Ux', while not ideal, is ok because we will at least
  # benefit from glibc's secure execute.
  /usr/bin/mkfifo Uxr,  # investigate
  /bin/ps Uxr,
  /bin/uname Uxr,
  /usr/bin/locale Uxr,

  /usr/bin/gpg Cx -> gpg,

  profile gpg {
    #include <abstractions/base>

    # Required to import keys from keyservers
    #include <abstractions/nameservice>
    #include <abstractions/p11-kit>

    # For smartcards?
    /dev/bus/usb/ r,
    /dev/bus/usb/[0-9]*/ r,
    /dev/bus/usb/[0-9]*/[0-9]* r,

    # LDAP key servers
    /etc/ldap/ldap.conf r,

    /usr/bin/gpg mr,
    /usr/lib/gnupg/gpgkeys_* ix,
    owner @{HOME}/.gnupg r,
    owner @{HOME}/.gnupg/gpg.conf r,
    owner @{HOME}/.gnupg/random_seed rwk,
    owner @{HOME}/.gnupg/pubring.gpg{,~} rw,
    owner @{HOME}/.gnupg/secring.gpg rw,
    owner @{HOME}/.gnupg/trustdb.gpg rw,
    owner @{HOME}/.gnupg/*.gpg.{lock,tmp} rwl,
    owner @{HOME}/.gnupg/.#*[0-9]  rw,
    owner @{HOME}/.gnupg/.#*[0-9]x rwl,
    owner @{HOME}/** r,

    owner /run/user/[0-9]*/keyring-*/gpg rw,

    # for inline pgp
    owner /tmp/encfile rw,
    owner /tmp/encfile-[0-9]* rw,
  }

  /usr/bin/gpg2              Cx -> gpg2,
  /usr/bin/gpgconf           Cx -> gpg2,
  /usr/bin/gpg-connect-agent Cx -> gpg2,

  # TB tries to create this file but has no business doing so
  deny @{HOME}/.gnupg/gpg-agent.conf w,

  profile gpg2 {
    #include <abstractions/base>

    # Required to import keys from keyservers
    #include <abstractions/nameservice>
    #include <abstractions/p11-kit>
    /usr/lib/gnupg2/gpg2keys_hkp ix,

    # silence noise from enigmail 1.9+
    deny owner @{HOME}/.icedove/*/.parentlock w,
    deny owner @{HOME}/.icedove/*/panacea.dat w,
    deny owner @{HOME}/.icedove/*/*.mab w,
    deny owner @{HOME}/.icedove/**/*.msf w,
    deny owner @{HOME}/.cache/icedove/**/_CACHE_* w,

    /usr/share/xul-ext/enigmail/chrome/enigmail.jar r,

    # For smartcards?
    /dev/bus/usb/ r,
    /dev/bus/usb/[0-9]*/ r,
    /dev/bus/usb/[0-9]*/[0-9]* r,

    # LDAP key servers
    /etc/ldap/ldap.conf r,

    /usr/bin/gpg-connect-agent mr,
    owner @{HOME}/.gnupg/S.gpg-agent rw,
    owner @{HOME}/.gnupg/S.dirmngr rw,

    /usr/bin/gpg2 mr,
    owner @{HOME}/.gnupg/ rw,
    owner @{HOME}/.gnupg/gpg.conf r,
    owner @{HOME}/.gnupg/random_seed rwk,
    owner @{HOME}/.gnupg/pubring.gpg{,~} rw,
    owner @{HOME}/.gnupg/secring.gpg rw,
    owner @{HOME}/.gnupg/trustdb.gpg rw,
    owner @{HOME}/.gnupg/*.gpg.{lock,tmp} rwl,
    owner @{HOME}/.gnupg/.gpg-*.lock rwl,
    owner @{HOME}/.gnupg/gnupg_spawn_*.lock rwl,
    owner @{HOME}/.gnupg/.#lk0x[0-9a-f]* rwl,
    owner @{HOME}/.gnupg/.gpg-v[0-9]*-migrated rw,
    owner @{HOME}/** r,
    owner @{PROC}/@{pids}/mountinfo r,

    # for inline pgp
    owner /tmp/encfile rw,
    owner /tmp/encfile-[0-9]* rw,

    # for signature generation
    owner /tmp/nsemail.eml w,
    owner /tmp/nsemail-[0-9]*.eml w,

    # for signature verifications
    owner /tmp/data.sig r,
    owner /tmp/data-[0-9]*.sig r,

    owner /tmp/gpg-[a-zA-Z0-9]*/S.gpg-agent rw,
  }

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.icedove>

}

Que faut il ajouter pour autoriser /var/mail?

une ligne du genre ???

/var/mail/** r,

Dans /etc/apparmor.d/usr.bin.icedove j’ai ajouté

# allow access to local mail
  /var/mail/ rwlk,
  /var/mail/** rwlk,

grâce aux infos lues ici:

https://www.suse.com/documentation/sles11/singlehtml/apparmor_quickstart/apparmor_quickstart.html

Plus d’erreurs Apparmor mais je vérifierai demain matin car ça me sert uniquement à vérifier les mails envoyés par root pour les mises à jour comme celui-là:

Sujet :
Anacron job 'cron.daily' on debian
De :
Anacron <root@localhost.localdomain>
Date :
01/08/2016 09:03
Pour :
root@localhost.localdomain

/etc/cron.daily/apt-compat:
verbose level 1
check_stamp: interval=86400, now=1470002400, stamp=1470002400, delta=86400 (sec)
download updated metadata (success).
send dbus signal (success)
check_stamp: interval=86400, now=1470002400, stamp=1470002400, delta=86400 (sec)
download upgradable (success)
unattended-upgrade (not run)
check_stamp: interval=0
clean (not run)
check_stamp: interval=604800, now=1470002400, stamp=1469656800, delta=432000 (sec)
autoclean (not run)
aged: ctime <30 and mtime <30 and ctime>2 and mtime>2
end remove by archive size: size=149396 < 512000