skypeforlinux profile

[V]

Hello,

I'm trying to adapt an old usr.bin.skype profile to new usr.share.skypeforlinux.skypeforlinux. I have allowed everything according to dmesg audit log, however I am not very experienced so I could have left some dangerous listings there.

I'd like someone experienced to check my profile and fix possible security issues.

Thanks in advance.

[V (vbooka1)]

I have noticed that skypeforlinux does not show any characters except basic latin chars. strace-d the process and found out that it wants to mmap many fonts. I have added all required fonts to allowed list however there are still EACCES (Permission Denied) errors in the log.

$ strace -f -T /usr/share/skypeforlinux/skypeforlinux >log 2>&1
^C
$ grep EACCES log | grep -v ' resumed'
[pid 19181] mmap(NULL, 305872, PROT_READ, MAP_PRIVATE, 26</usr/share/fonts/truetype/NotoSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000017>
[pid 19181] mmap(NULL, 305872, PROT_READ, MAP_PRIVATE, 75</usr/share/fonts/truetype/NotoSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000019>
[pid 19181] mmap(NULL, 305872, PROT_READ, MAP_PRIVATE, 75</usr/share/fonts/truetype/NotoSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000018>
[pid 19216] mmap(NULL, 152408, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSerif-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000016>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000019>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000019>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000018>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000018>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000019>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000015>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000013>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000013>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000018>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000014>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000019>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000015>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denied) <0.000014>
[pid 19216] mmap(NULL, 139764, PROT_READ, MAP_SHARED, 46</usr/share/fonts/truetype/LiberationSans-Regular.ttf>, 0) = -1 EACCES (Permission denie...

[V (vbooka1)]

Sorry, my mistake - I have copied the rules from old usr.bin.skype profile and one of them was "deny /usr/share/fonts/** m,"

Attached the new profile version, hope someone will read it and make it more secure.

[Vincas Dargis (talkless)]

I've been working on skypeforlinux for some time:

https://gitlab.com/Talkless/apparmor/blob/skypeforlinux/profiles/apparmor/profiles/extras/usr.bin.skypeforlinux

It has some big issues with all these mmaps of data files, reported Electron bug:

https://github.com/electron/electron/issues/10589