Alex (0bf6c829) at 20 Mar 23:42

Alex (6aea9240) at 20 Mar 23:42

... and 1 more commit

Alex (52383c08) at 20 Mar 23:33

... and 1 more commit

Alex (d8b6f803) at 20 Mar 15:37

Alex (672e64dd) at 20 Mar 10:59

... and 2 more commits

Alex (70134896) at 20 Mar 10:26

Alex (36e32701) at 20 Mar 10:06

... and 3 more commits

Alex (d348e10b) at 16 Mar 23:40

Alex (d779c386) at 16 Mar 23:34

Alex (d0a68012) at 16 Mar 23:11

Alex (c783ce93) at 16 Mar 22:54

Alex (192d04ea) at 16 Mar 17:02

... and 84 more commits

I kind of disagree with the content of this abstraction. The main issue is that it is a mismatch of multiple things.

• Gstreamer usually needs graphics acceleration, thus, it will kind of always be used in a profile alongside with something like graphics. Rules also required for common graphics access should thus, not be here (e.g. igfx_user_feature, /sys/class/drm/, /sys/devices/system/node/ ...)
• Similarly, it should not include rules needed for usb access.
• Same for the X abstraction. It should not be here, but in the calling profile if required (spoiler alert: the calling profile will need it anyway).
• Most of orcexec can be safely denied as long as you keep one (it allows us to deny the one on the shared path /tmp/)

From a security point of view, it does not matter that much, as the rules would be included anyway. However, from a maintainability and transparency point, it is a huge concern as with such an abstraction we cannot say any more that these are the minimal set of rules for gstreamer, but something like that should be ok in most case.

For reference in apparmor.d see:

1. https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/abstractions/gstreamer
2. https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/abstractions/gstreamer-registry
3. gstreamer-registry was a failed test, it could now be merged with gstreamer: I tested confining gstreamer and gstreamer plugin separately, but it turns out to be completely useless as they both need the same access.

Alex (ad8b1fa1) at 03 Mar 21:03

Alex (cc25e263) at 03 Mar 21:02

... and 28 more commits

Alex (e5ee7b0d) at 27 Feb 22:45

... and 1 more commit

Alex (e9d5b73c) at 27 Feb 21:01

... and 2 more commits

Alex (ce94eac0) at 27 Feb 19:43

... and 6 more commits