[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Re: [libreoffice-users] AppArmor profile of LibreOffice


On 10/24/19 10:41 PM, libreoffice-ml.mbourne@spamgourmet.com wrote:

I don't know all that much about configuring AppArmor, but for what it's worth for me on Linux Mint Sylvia 18.3 (still supported, although older than your Tara 19.0) using the LibreOffice PPA for its newer versions of LibreOffice (currently 6.2.8)... Gys wrote:
Hi, in my Linux Mint Tara aa-status lists 3 profiles related to LibreOffice : libreoffice-xpdfimport (enforce) libreoffice-senddoc (enforce) libreoffice-oopslash (complain)
I have: libreoffice-senddoc (enforce) libreoffice-soffice//gpg (enforce) libreoffice-xpdfimport (enforce) libreoffice-oopslash (complain) libreoffice-soffice (complain)
In the kernel log libreoffice-oopslash is complaining about a lot of things.
Looking at my logs from the last week, I see a few "audit" messages relating to libreoffice-soffice and libreoffice-oopslash. Looks like a cluster of about 10 entries for libreoffice-soffice each time I start LibreOffice, with a few others for soffice and oopslash in between - but I don't tend to be using it continuously for hours on end.
Both the program and the profile in Nemo is oosplash usr/lib/libreoffice/program/oosplash /etc/apparmor.d/usr.lib.libreoffice.program.oosplash Search oopslash in / in Nemo gives no results Questions 1) Is the "p" and "s" reversal a typo ?
As mentioned at the start, I'm no expert on AppArmor, but it does look suspiciously like a typo. I guess it might only affect the displayed name of the profile though, since the executable it applies to appears to be correctly spelled "oosplash":
profile libreoffice-oopslash /usr/lib/libreoffice/program/oosplash flags=(complain) {...}
2) Why is there no profile for /usr/lib/libreoffice/program/soffice.bin ?
For me the </etc/apparmor.d/usr.lib.libreoffice.program.*> files, including one for soffice.bin, are provided by the libreoffice-common package, which I've installed from the PPA. From a quick look at the .deb packages from libreoffice.org it doesn't look like any of them contain AppArmor profiles, so I'd guess they're added by the Ubuntu/PPA package maintainer. Perhaps the PPA maintainer adds a profile for soffice.bin while the Ubuntu one doesn't.
3) Is there anyone here with a working AppArmor profile for LibreOffice and would you be so kind to share ?
I've attached the libreoffice-soffice profile installed on my system (with a .txt extension added - hopefully enough to get it through the mailing list). No guarantee it will work with your version though. It does say in comments near the top:
# This profile should enable the average LibreOffice user to get their # work done while blocking some advanced usage # ...
so I guess some complaints in "complain" mode may be expected.
4) I looked on-line but could not find an updated AppArmor profile for LibreOffice or even the profile shipped with Version: 6.0.7.3 Build ID: 1:6.0.7-0ubuntu0.18.04.10 (?)
I've no idea who actually maintains them. From a quick look, it doesn't look like any of the .deb files downloaded from libreoffice.org contains AppArmor profiles, so I'm guessing they're added by the Ubuntu/PPA package maintainer.
Hi Mark,

thank you for your kind reply. My first answer to you bounched. I don't know why, so maybe it's here now twice.

I don't have a PPA for LibreOffice. Could you please share the link ?

I'm slowly moving to Mint from Win10 since a year ago so I'm no expert in AppArmor either. I have studied the manual and finally got Clamd through AppArmor.

I tooked at the AppArmor manual (again) and it says indeed : "the convention" is to name the files in that particular way. So, you are right. If I name the file : KindlyProvidedByMark.txt it may also work. I had a look inside my version and there is also the line :

profile libreoffice-oopslash /usr/lib/libreoffice/program/oosplash flags=(complain)

I just changed the name of the oosplash profile to adhere to the AppArmore convention.

I have been looking at all kind of LibreOffice sources. You are right, I should have looked at the package distributors. I found a lot of #tickets about the AA-confinement there. I'm now thinking that this subject is so complicated that I wonder if it really adds to the security of my machine if I change it myself and maybe the best option is to wait for the update from the package distributers which will include an update for the AA-profile (I hope)

I'm using your libreoffice-soffice profile for a few days now.The complain : "denied soffice is unconfined" have disappeared with a lot of other ones. In the last days I have not seen any complains pertaining to LibreOffice.In the meantime I think I will just ignore further LibreOffice complaints.

Your libreoffice-soffice profile made it through this mailing list. It is now also in the list archive. Which is nice for future reference.

Thx again Gys


--
To unsubscribe e-mail to: users+unsubscribe@global.libreoffice.org
Problems? https://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: https://wiki.documentfoundation.org/Netiquette
List archive: https://listarchives.libreoffice.org/global/users/
Privacy Policy: https://www.documentfoundation.org/privacy

Follow-Ups:
Re: [libreoffice-users] AppArmor profile of LibreOfficelibreoffice-ml.mbourne@spamgourmet.com
Privacy Policy | Impressum (Legal Info) | Copyright information: Unless otherwise specified, all text and images on this website are licensed under the Creative Commons Attribution-Share Alike 3.0 License. This does not include the source code of LibreOffice, which is licensed under the Mozilla Public License (MPLv2). "LibreOffice" and "The Document Foundation" are registered trademarks of their corresponding registered owners or are in actual use as trademarks in one or more countries. Their respective logos and icons are also subject to international copyright laws. Use thereof is explained in our trademark policy.