session required pam_apparmor.so

# Last Modified: Thu May 27 11:06:56 2010
#include <tunables/global>

/usr/sbin/sshd flags=(complain) {
  #include <abstractions/authentication>
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/nameservice>
  #include <abstractions/wutmp>

  capability setgid,
  capability setuid,
  capability sys_chroot,
  capability audit_control,
  capability sys_admin,
  capability dac_override,
  

  /usr/sbin/sshd rix,

  /etc/ssh/sshd_config r,  
  /etc/ssh/ssh_host_dsa_key r,
  /etc/ssh_host_rsa_key r,
  /etc/ssh/ssh_host_rsa_key r,
  /etc/ssh/moduli r,
  
  /var/run/sshd.init.pid rw,

  /etc/hosts.allow r,
  /etc/hosts.deny r,

  /home/*/.ssh/* r,
  /root/*/.ssh/* r,
  
  /etc/environment r,

  /proc/** rw,

  
  /bin/bash mrix,
  / r,
  /dev/tty rw,
  /dev/urandom r,
  /etc/ld.so.cache r,
  /etc/security/namespace.init rix,
  /lib/** rmix,
  /tmp/ r,
  /tmp-inst/ r,
  /var/ r,
  /var/tmp/ r,
  /var/tmp/tmp-inst/ r,

  ^AUTHENTICATED  {


  }

  ^EXEC {


  }

  ^PRIVSEP  {


  }

  ^PRIVSEP_MONITOR  {


  }

  ^root flags=(complain) {
    #include <abstractions/authentication>
    #include <abstractions/base>
    #include <abstractions/bash>
    #include <abstractions/consoles>
    #include <abstractions/nameservice>
    #include <abstractions/php5>
    #include <abstractions/wutmp>

    capability dac_override,
    capability net_bind_service,
    capability setgid,
    capability setuid,
    capability sys_admin,
    capability sys_ptrace,
    capability sys_tty_config,
    capability sys_nice,

    / mrwlkix,
    /** mrwlkix,

  }

  ^users {
    #include <abstractions/base>
    #include <abstractions/bash>
    #include <abstractions/consoles>
    #include <abstractions/nameservice>
    #include <abstractions/php5>
    #include <abstractions/user-tmp>
    #include <abstractions/wutmp>
    #include <abstractions/kde>
    #include <abstractions/user-manpages>    
    
    capability chown,
    capability fowner,    
    capability setgid,
    capability setuid,    

#load with own profile. 
    /usr/bin/passwd px,
    /usr/sbin/traceroute px,
    /bin/ping px,

#load with current profile
    /bin/** rix,
    /usr/bin/** rix,
    
    /lib/ld-*.so mr,
    /lib/lib*so* mr,
    /usr/lib/** mr,

#read and write own files
    owner /home/** rw,

#see only our proc    
    owner /proc/*/** r,
    /proc/ r,
    /proc/* r,            

#read on login from ssh 
    /etc/security/pam_env.conf r,
    /etc/manpath.config r,
    /etc/bash_command_not_found r,
    /etc/environment r,
    /etc/motd r,
    /usr/share/X11/XKeysymDB r,
    /etc/opt/ r,
    /opt/ r,        
    /etc/sysconfig/* r,
    /etc/ssh/ssh_config r,

#on login from ssh    
    /dev/ptmx rw,
    /var/log/wtmp wk,

#man
    /var/cache/man/** rk,
    /usr/share/groff/** r,
    
    /usr/lib/man-db/man rix,
    /usr/local/man/ r,
    /usr/share/man/ r,
    
    /usr/lib/man-db/manconv rix,
    /etc/lesskey.bin r,
    
    

  }
}