AppArmor for Dropbox

Question

I'm trying to find an apparmor profile template for limiting dropbox actions to my files. If possible, I would also like to provent it from trying to sync .git directories, due their huge number of files.

Answer 1

I've found a way. (In fact, I already had it, but just wanted to share it)

1) Paste the following file to /etc/apparmor.d/dropbox.

# vim:syntax=apparmor
# Last Modified: Sun Jan  3 19:03:04 2016
#include <tunables/global>  

profile dropbox /{usr/bin/dropbox,home/*/.dropbox-*/**,home/*/.dropbox-dist/dropboxd} {
    #include <abstractions/dbus>
    #include <abstractions/dbus-accessibility>
    #include <abstractions/dbus-session-strict>
    #include <abstractions/gnome>
    #include <abstractions/ubuntu-unity7-base>
    #include <abstractions/dconf>
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/python>
    #include <abstractions/ubuntu-konsole>

    capability sys_ptrace,

    # Comment the follwoing line to allow Dropbox to (fully) sync directories called: '.git'
    audit deny /**/.git/objects/** rwx,
    # Comment the follwoing line to allow Dropbox to sync directories called: 'no_dropbox'
    audit deny /**/no_dropbox/** rwx,
    # Comment the follwoing line to allow Dropbox to sync directories called 'Secure' that under your home folder.
    audit deny /home/*/Secure/** rwx,

    dbus,

    # A work arround to allow symbolic links to the golang folder
    /home/*/go/** rw,

    /bin/bash r,
    /bin/dash r,
    /bin/readlink Cx,
    /bin/uname r,
    /etc/lsb-release r,
    /etc/python*/** r,
    /home/*/.Xauthority r,
    /home/*/.config/autostart/dropbox.desktop rw,
    /home/*/.dropbox-dist/** rwlkix,
    /home/*/.dropbox/** rwlk,
    /home/*/Dropbox/ rwlk,
    /home/*/Dropbox/** rwlk,
    /proc/ r,
    /proc/*/fd/ r,
    /proc/*/io r,
    /proc/*/mounts r,
    /proc/*/net/tcp r,
    /proc/*/net/tcp6 r,
    /proc/*/net/udp r,
    /proc/*/net/udp6 r,
    /proc/*/stat r,
    /proc/*/statm r,
    /proc/*/status r,
    /proc/meminfo r,
    /proc/version r,
    /proc/vmstat r,
    /run/uuidd/request rw,
    /tmp/* rwl,
    /usr/ r,
    /usr/bin/ r,
    /usr/bin/dirname rPix,
    /usr/bin/dropbox rPix,
    /usr/bin/gettext r,
    /usr/bin/locale r,
    /usr/bin/lsb_release r,
    /usr/bin/python3 r,
    /usr/bin/python3.4 r,
    /usr/bin/readlink rPix,
    /usr/bin/sudo r,
    /usr/lib/ r,
    /usr/lib{,32,64}/** mra,
    /usr/local/lib/python3.4/*/ r,
    /var/tmp/** rwlk,
    /usr/share/glib-2.0/schemas/gschemas.compiled r,
    owner /{,var/}run/user/*/dconf/user w,

    profile /bin/readlink flags=(complain) {
        #include <abstractions/base>

        /bin/readlink mr,

    }
}

2) Load it via the command: sudo apparmor_parser -r /etc/apparmor.d/dropbox.

3) Enable it on enforce mode: sudo aa-enforce /etc/apparmor.d/dropbox.

4) Restart dropbox, either via the GUI or by the following command: dropbox stop && dropbox start.

5) It's done!