1

Today calls stopped to work in old skype 4.3 with some newest mobile versions. If I need to upgrade to newest Skype for linux, where can I get apparmour for new /usr/bin/skypeforlinux version 5.3? Thanks!

4
  • As the skype package is not maintained by ubuntu you have to write your own or contact the person who maintains skypeforlinux . – Panther Aug 10 '17 at 16:28
  • @bodhi.zazen apparmour sample profile for old skype shipped with apparmour deb package within ubuntu, so Your answer is not correct. – Aleksey Kontsevich Aug 10 '17 at 16:32
  • First, it is a comment not an answer. Second you answered you own question, if there is no skype profile in the ubuntu apparmor package for skypeforlinux, ubuntu does not maintain an apparmor profile for skypeforlinux and you have to write your own. – Panther Aug 10 '17 at 16:37
  • You can search yourself if you wish - packages.ubuntu.com/… – Panther Aug 10 '17 at 16:38
2

You answered your own question, ubuntu does not maintain a profile for skypeforlinux. You have to write your own or find and adapt one from the internet.

https://packages.ubuntu.com/search?suite=yakkety&arch=any&mode=filename&searchon=contents&keywords=skypeforlinux

IMO, best to write your own profile, see https://www.howtogeek.com/118328/how-to-create-apparmor-profiles-to-lock-down-programs-on-ubuntu/

No one can tell you what to accept and what to block, that is for you to decide.

A google search yields several profiles on git hub and elsewhere. You need to review these profiles for accuracy, paths, and your needs but these may be a place to start.

https://www.google.com/search?q=apparmor+profile+skypeforlinux&oq=apparmor+profile+skypeforlinux&aqs=chrome..69i57j69i60l3.15031j0j9&sourceid=chrome&ie=UTF-8

First on the list : https://github.com/mk-fg/apparmor-profiles/blob/master/profiles/opt.skypeforlinux

#include <tunables/global>

/opt/skypeforlinux/skypeforlinux {

    #include <abstractions/base>
    #include <abstractions/consoles>
    #include <abstractions/nameservice>
    #include <abstractions/ssl_certs>
    #include <abstractions/fonts>
    #include <abstractions/X>
    #include <abstractions/freedesktop.org>
    #include <abstractions/user-download>
    #include <abstractions/user-tmp>
    #include <abstractions/pulse>
    #include <abstractions/node-webkit>
    #include <abstractions/site/base>
    #include <abstractions/site/de>

    /etc/os-release r,
    /sys/devices/virtual/tty/tty*/active r,
    deny /dev/video0 rw,

    /opt/skypeforlinux/** kmr,
    /opt/skypeforlinux/skypeforlinux ix,

    owner @{HOME}/.config/skypeforlinux/ rw,
    owner @{HOME}/.config/skypeforlinux/** krwm,
    owner @{HOME}/[dD]ownload{,s}/** k,

    deny /etc/passwd rm,
    deny /proc/sys/kernel/yama/ptrace_scope r, # no clue

    # Site-local thing
    /etc/core/app/sec/openssl.cnf r,

    network,

}

There are other options as well and you likely need to modify these profiles for you needs and paths for Ubuntu (I dont know for example is skypeforlinux is installed on /opt as in this profile or somewhere else.

Here is another: https://gogs.dsprenkels.com/dsprenkels/apparmor-profiles/src/bf7f56166f4084d07797195fc7739be19bd9ada1/usr.bin.skypeforlinux

# Last Modified: Tue Apr 11 23:47:05 2017
#include <tunables/global>

/usr/bin/skypeforlinux {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/dbus-session>
  #include <abstractions/fonts>
  #include <abstractions/freedesktop.org>
  #include <abstractions/gnome>
  #include <abstractions/nameservice>

  /usr/bin/skypeforlinux r,
  /bin/dash ix,
  /bin/mkdir rix,
  /bin/readlink rix,
  /usr/bin/dirname rix,
  /usr/bin/nohup rix,

  /dev/shm/* rw,
  /etc/udev/udev.conf r,
  owner @{HOME}/.Xauthority r,
  owner @{HOME}/.config/skypeforlinux/ rw,
  owner @{HOME}/.config/skypeforlinux/** rw,
  /sys/bus/pci/devices/ r,
  /sys/devices/** r,
  "/tmp/skypeforlinux Crashes/" w,
  /usr/share/glib-2.0/schemas/gschemas.compiled r,
  /usr/share/skypeforlinux/** r,
  /usr/share/skypeforlinux/skypeforlinux rix,
  /{run,dev}/shm/pulse-shm* rwk,

}
3
  • These profiles are too old and do not work with newest skypeforlinux. – Aleksey Kontsevich Nov 16 '17 at 16:19
  • @AlekseyKontsevich - This is the disadvantage of apparmor. Neither skypeforlinux or Ubuntu maintans an apparmor profile. You have to write your own, I suggest starting with one of the profiles in this answer and start writing. If you have a specific question or problem ask, but it is unlikely someone is going to install skype and write a profile for you at this time. – Panther Nov 16 '17 at 16:45
  • Better use Matrix Riot for now ;) Just need to convince clients to use it. – Aleksey Kontsevich Nov 17 '17 at 17:52
0

I just created a working Apparmor profile with Ubuntu 16.04 and Skype 8.16.04. and want to share it with you. It took me two days because I tried to lock it down as much as possible. As far as i found, all of these are necessary because otherwise some funktions may not work. I'm going to comment on some of these in the code. Please note that this profile reflects usage of an nvidia graphics adapter with propietary driver in version 340. Other scenarios need adaption. Anything not commented seems necessary in order for Skype to start. If the profile as is doesn't work out, try deleting my comments at first. Actually, I don't know whether comments are allowed after an #include directive.

Kind regards,

christian

# Last Modified: Thu Feb 22 14:05:09 2018
#include <tunables/global>

/usr/bin/skypeforlinux {            #my installation path. 
                                    #profile:usr.bin.skypeforlinux

  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/dbus>              #impossible to take 
                                            #restricted 
                                            #versions of dbus 
                                            #abstractions 
                                            #without being logged out 
                                            #after every use
  #include <abstractions/dbus-session>      #same here
  #include <abstractions/fonts>
  #include <abstractions/freedesktop.org>   #nothing at all without 
                                            #these
  #include <abstractions/gnome>             #same here
  #include <abstractions/nameservice>       #and here
  #include <abstractions/ibus>              #no keyboard input witout 
                                            #this

  network inet dgram,
  network inet stream,
  network inet6 dgram,
  network inet6 stream,
  network netlink dgram,
  network netlink raw,

  deny /etc/issue r,                          #at least something not 
                                              #necessary
  deny /etc/passwd r,

  /bin/dash rix,
  /bin/mkdir rix,
  /bin/readlink rix,
  /dev/ r,
  /dev/disk/by-id/ r,
  /dev/nvidia0 rw,                         #nvidia/propietary driver 
                                           #specific
  /dev/nvidiactl rw,                       #same here
  /dev/shm/* rwl,
  /dev/video0 rw,
  /etc/hostname r,
  /etc/udev/udev.conf r,
  @{HOME}/ w,                              #Skype won't start if 
                                           #"owner" 
                                           #is set in order to 
                                           #restrict 
                                           #profile access to its 
                                           #owner
  @{HOME}/.Skype/ r,
  @{HOME}/.Skype/** rw,
  @{HOME}/.Xauthority r,
  @{HOME}/.config/dconf/* r,
  @{HOME}/.config/skypeforlinux/ r,
  @{HOME}/.config/skypeforlinux/** rw,
  @{HOME}/.config/user-dirs.dirs r,
  @{HOME}/.nv/GLCache/ r,                  #nvidia/propietary driver 
                                           #specific
  @{HOME}/.nv/GLCache/** rw,               #same here
  @{HOME}/.pki/nssdb/* rw,
  @{HOME}/.rnd r,
  @{HOME}/skype-export/ w,                 #allows chat export from 
                                           #version 4.3
  @{HOME}/skype-export/** w,               #same here
  @{PROC}/ r,
  @{PROC}/*/fd/ r,
  @{PROC}/*/oom_score_adj w,
  @{PROC}/*/status r,
  @{PROC}/*/task/ r,
  @{PROC}/*/task/** r,
  @{PROC}/cpuinfo r,
  @{PROC}/driver/nvidia/params r,           #nvidia/propietary driver 
                                            #specific
  @{PROC}/filesystems r,
  @{PROC}/modules r,
  @{PROC}/stat r,
  @{PROC}/sys/kernel/osrelease r,
  @{PROC}/sys/kernel/ostype r,
  @{PROC}/sys/kernel/yama/ptrace_scope r,
  @{PROC}/version r,
  /run/user/** rw,
  /sys/bus/pci/devices/ r,
  /sys/class/net/ r,
  /sys/devices/** r,
  /tmp/ rw,                      #usage of temp dir abstractions 
                                 #impossible. Skype won't start with 
                                 #"owner" set to restrict access to 
                                 #other temp files
  /tmp/** rw,                    #same here
  /usr/bin/dirname rix,
  /usr/bin/locale rix,
  /usr/bin/nohup rix,
  /usr/bin/skypeforlinux r,
  /usr/bin/xdg-open rix,
  /usr/share/glib-2.0/schemas/gschemas.compiled r,
  /usr/share/nvidia-340/* r,
  /usr/share/skypeforlinux/** r,
  /usr/share/skypeforlinux/skypeforlinux rix,
  /var/tmp/ rw,                 #same temp dir issue described above
  /var/tmp/** rw,               #same here

  ^/usr/bin/nohup {
    /dev/shm/* mrw,
    /usr/share/skypeforlinux/skypeforlinux rix, #always use ix on all 
                                                #executables, any 
                                                #child 
                                                #with scrubbed 
                                                #environment 
                                                #won't do the job

  }
}
2
  • Does You profile allow skypeforlinux to access home directory? Old official apparmor profile for 4.3 forbids this, new one allows. – Aleksey Kontsevich Feb 22 '18 at 19:59
  • Your profile does not work for me: > skypeforlinux /usr/bin/skypeforlinux: line 3: /usr/bin/readlink: Permission denied dirname: missing operand Try 'dirname --help' for more information. /usr/bin/skypeforlinux: line 4: /usr/bin/readlink: Permission denied /usr/bin/skypeforlinux: line 9: /usr/bin/mkdir: Permission denied – Aleksey Kontsevich Feb 28 '18 at 14:58
0

Best and simplest profile I've ever seen found here: totally blocks home dir access. I only removed following line to prevent ~/.config/ access as suggested:

#include <abstractions/xdg-desktop> и

and granted access to ~/Downloads/Skype

owner @{HOME}/[dD]ownload{,s}/Skype/ rw,
owner @{HOME}/[dD]ownload{,s}/Skype/** rw,

Apparmor Profile

#include <tunables/global>
/usr/bin/skypeforlinux {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/freedesktop.org>
  #include <abstractions/X>

  /dev/ r,
  /dev/dri/ r,
  /dev/snd/ r,
  /etc/ssl/* r,
  /etc/drirc r,
  /dev/video* rw,
  /dev/video[0-9]* m,
  /dev/shm/* m, # mmaps /dev/shm/eiSAHx, video does not work without it
  owner /dev/shm/* rw, # downgraded from `/dev/shm/{shm,cnd}-[0-9]*-[0-9]` and `/dev/shm/.org.chromium.Chromium.*` into `/dev/shm/XU9NZ3`
  owner /dev/shm/sem.* l -> /dev/shm/, # detected on Debian 8 (jessie)
  /sys{/,/**} r,
  /etc/machine-id r,
  /etc/udev/udev.conf r,
  /etc/alsa-pulse.conf r,
  /etc/asound-pulse.conf r,
  /var/lib/dbus/machine-id r,
  /etc/pulse/client.conf.d{/,/**} r,

  /dev/dri/* rm,
  /dev/snd/* rm,
  /usr/share/** rm,
  /run/nscd/group rm,
  /usr/lib64/dri/* rm,

  /bin/* rix,
  /usr/bin/* rix,

  /usr/share/skypeforlinux/** rmix,

  /dev/tty rw,
  /dev/dri/** rw,
  /dev/pts/** rw,
  /dev/snd/** rw,
  /tmp{/,/**} rw,

  /dev/shm/** rmw,

  owner @{HOME}/.config/skypeforlinux{/,/**} rkmw,
  owner @{HOME}/[dD]ownload{,s}/ r,     # allow to browse Download dir
  owner @{HOME}/[dD]ownload{,s}/Skype/ rw,
  owner @{HOME}/[dD]ownload{,s}/Skype/** rw,
} 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.