AppArmor.txt Working in HassOS 5.10

adamoutler · January 10, 2021, 7:38pm

Hi guys. I was working with the guide from the developer site to create an apparmor.txt file. The provided examlle did not work. It appears the guide is incomplete and leaves you with an inoperable setup when using the default example.

I hacked on it for a while and came up with this minimum addon AppArmor

github.com

adamoutler/HassOSArgonOneAddon/blob/eec91719f389350ee243e6ee8acb92d71f6a8329/argonOne/apparmor.txt

#include <tunables/global>

profile deskpipro flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  
  capability,
  file,

  capability setgid,
  capability setuid,

  # S6-Overlay
  /bin/** ix,
  /usr/bin/** ix,
  /usr/lib/bashio/** ix,
  /etc/s6/** rix,
  /run/s6/** rix,
  /etc/services.d/** rwix,
  /etc/cont-init.d/** rwix,
  /etc/cont-finish.d/** rwix,

This file has been truncated. show original

Additionally there is some weirdness where the level 6 rating is only applied after the Addon is installed, but it works to get that Level 6!

lmagyar1973 · January 30, 2021, 9:29pm

@adamoutler You saved my day!

Would you like to push a commit to the documentation? https://github.com/home-assistant/developers.home-assistant/blob/005e033b4ae1bc9c44f96b86da6448f2a87eec1f/docs/add-ons/presentation.md

adamoutler · January 30, 2021, 11:30pm

Thanks for the suggestion. I did a pull request with some significant changes here https://github.com/home-assistant/developers.home-assistant/pull/789/files?short_path=279bb33#diff-279bb33d8526a55470f6d9e9307e333100b636aa63badcec72fd2db3c89fe73f