3

I'm trying to find an apparmor profile template for limiting dropbox actions to my files. If possible, I would also like to provent it from trying to sync .git directories, due their huge number of files.

4

I've found a way. (In fact, I already had it, but just wanted to share it)

1) Paste the following file to /etc/apparmor.d/dropbox.

# vim:syntax=apparmor
# Last Modified: Sun Jan  3 19:03:04 2016
#include <tunables/global>  

profile dropbox /{usr/bin/dropbox,home/*/.dropbox-*/**,home/*/.dropbox-dist/dropboxd} {
    #include <abstractions/dbus>
    #include <abstractions/dbus-accessibility>
    #include <abstractions/dbus-session-strict>
    #include <abstractions/gnome>
    #include <abstractions/ubuntu-unity7-base>
    #include <abstractions/dconf>
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/python>
    #include <abstractions/ubuntu-konsole>

    capability sys_ptrace,

    # Comment the follwoing line to allow Dropbox to (fully) sync directories called: '.git'
    audit deny /**/.git/objects/** rwx,
    # Comment the follwoing line to allow Dropbox to sync directories called: 'no_dropbox'
    audit deny /**/no_dropbox/** rwx,
    # Comment the follwoing line to allow Dropbox to sync directories called 'Secure' that under your home folder.
    audit deny /home/*/Secure/** rwx,

    dbus,

    # A work arround to allow symbolic links to the golang folder
    /home/*/go/** rw,

    /bin/bash r,
    /bin/dash r,
    /bin/readlink Cx,
    /bin/uname r,
    /etc/lsb-release r,
    /etc/python*/** r,
    /home/*/.Xauthority r,
    /home/*/.config/autostart/dropbox.desktop rw,
    /home/*/.dropbox-dist/** rwlkix,
    /home/*/.dropbox/** rwlk,
    /home/*/Dropbox/ rwlk,
    /home/*/Dropbox/** rwlk,
    /proc/ r,
    /proc/*/fd/ r,
    /proc/*/io r,
    /proc/*/mounts r,
    /proc/*/net/tcp r,
    /proc/*/net/tcp6 r,
    /proc/*/net/udp r,
    /proc/*/net/udp6 r,
    /proc/*/stat r,
    /proc/*/statm r,
    /proc/*/status r,
    /proc/meminfo r,
    /proc/version r,
    /proc/vmstat r,
    /run/uuidd/request rw,
    /tmp/* rwl,
    /usr/ r,
    /usr/bin/ r,
    /usr/bin/dirname rPix,
    /usr/bin/dropbox rPix,
    /usr/bin/gettext r,
    /usr/bin/locale r,
    /usr/bin/lsb_release r,
    /usr/bin/python3 r,
    /usr/bin/python3.4 r,
    /usr/bin/readlink rPix,
    /usr/bin/sudo r,
    /usr/lib/ r,
    /usr/lib{,32,64}/** mra,
    /usr/local/lib/python3.4/*/ r,
    /var/tmp/** rwlk,
    /usr/share/glib-2.0/schemas/gschemas.compiled r,
    owner /{,var/}run/user/*/dconf/user w,

    profile /bin/readlink flags=(complain) {
        #include <abstractions/base>

        /bin/readlink mr,

    }
}

2) Load it via the command: sudo apparmor_parser -r /etc/apparmor.d/dropbox.

3) Enable it on enforce mode: sudo aa-enforce /etc/apparmor.d/dropbox.

4) Restart dropbox, either via the GUI or by the following command: dropbox stop && dropbox start.

5) It's done!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.