AppArmor for Dropbox

Question

Estou tentando encontrar um modelo de perfil apparmor para limitar as ações da caixa de depósito aos meus arquivos. Se possível, eu também gostaria de provar que ele tenta sincronizar os diretórios .git , devido ao grande número de arquivos.

    

Answer 1

Eu encontrei um jeito. (Na verdade, eu já tinha, mas só queria compartilhá-lo)

1) Cole o seguinte arquivo em /etc/apparmor.d/dropbox .

# vim:syntax=apparmor
# Last Modified: Sun Jan  3 19:03:04 2016
#include <tunables/global>  

profile dropbox /{usr/bin/dropbox,home/*/.dropbox-*/**,home/*/.dropbox-dist/dropboxd} {
    #include <abstractions/dbus>
    #include <abstractions/dbus-accessibility>
    #include <abstractions/dbus-session-strict>
    #include <abstractions/gnome>
    #include <abstractions/ubuntu-unity7-base>
    #include <abstractions/dconf>
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/python>
    #include <abstractions/ubuntu-konsole>

    capability sys_ptrace,

    # Comment the follwoing line to allow Dropbox to (fully) sync directories called: '.git'
    audit deny /**/.git/objects/** rwx,
    # Comment the follwoing line to allow Dropbox to sync directories called: 'no_dropbox'
    audit deny /**/no_dropbox/** rwx,
    # Comment the follwoing line to allow Dropbox to sync directories called 'Secure' that under your home folder.
    audit deny /home/*/Secure/** rwx,

    dbus,

    # A work arround to allow symbolic links to the golang folder
    /home/*/go/** rw,

    /bin/bash r,
    /bin/dash r,
    /bin/readlink Cx,
    /bin/uname r,
    /etc/lsb-release r,
    /etc/python*/** r,
    /home/*/.Xauthority r,
    /home/*/.config/autostart/dropbox.desktop rw,
    /home/*/.dropbox-dist/** rwlkix,
    /home/*/.dropbox/** rwlk,
    /home/*/Dropbox/ rwlk,
    /home/*/Dropbox/** rwlk,
    /proc/ r,
    /proc/*/fd/ r,
    /proc/*/io r,
    /proc/*/mounts r,
    /proc/*/net/tcp r,
    /proc/*/net/tcp6 r,
    /proc/*/net/udp r,
    /proc/*/net/udp6 r,
    /proc/*/stat r,
    /proc/*/statm r,
    /proc/*/status r,
    /proc/meminfo r,
    /proc/version r,
    /proc/vmstat r,
    /run/uuidd/request rw,
    /tmp/* rwl,
    /usr/ r,
    /usr/bin/ r,
    /usr/bin/dirname rPix,
    /usr/bin/dropbox rPix,
    /usr/bin/gettext r,
    /usr/bin/locale r,
    /usr/bin/lsb_release r,
    /usr/bin/python3 r,
    /usr/bin/python3.4 r,
    /usr/bin/readlink rPix,
    /usr/bin/sudo r,
    /usr/lib/ r,
    /usr/lib{,32,64}/** mra,
    /usr/local/lib/python3.4/*/ r,
    /var/tmp/** rwlk,
    /usr/share/glib-2.0/schemas/gschemas.compiled r,
    owner /{,var/}run/user/*/dconf/user w,

    profile /bin/readlink flags=(complain) {
        #include <abstractions/base>

        /bin/readlink mr,

    }
}

2) Carregue através do comando: sudo apparmor_parser -r /etc/apparmor.d/dropbox .

3) Habilite-o no modo enforce: sudo aa-enforce /etc/apparmor.d/dropbox .

4) Reinicie o dropbox, através da GUI ou pelo seguinte comando: dropbox stop && dropbox start .

5) Está feito!