UbuntuSecurity

Akima's simple guide to LÖVE security sandboxing for Ubuntu users.

Overview

AppArmor is a piece of security software that is already present on your Ubuntu computer and already configured by default to protect some software services running on your machine.

This page provides straight forward instructions that explain how to secure the LÖVE engine using an AppArmor profile. The effect of securing the LÖVE engine will be that .love games will have very restricted access to your computer so they can only execute, read or write the files that are likely to be necessary. The games will not be able to access your private files and will not be able to start any other executables on your system.

One drawback of security sandboxing the LÖVE engine is that some .love games may try to do things which the AppArmor profile does not permit. This may partially or completely stop the .love game from working. Nothing bad can happen to your computer or your files as a result of a .love game being denied permission to do something though.

Disclaimer: Until otherwise stated, this LÖVE security enhancement is not endorsed or supported by the LÖVE development team.

Requirements

You must be using an officially packaged .deb install of LÖVE. They can be downloaded on the LÖVE home page.

The following setups have been tested and are confirmed working:

LÖVE versions:

• 0.6.2
• 0.7.1

Ubuntu versions:

• Ubuntu Desktop 10.04 (64bit).

The apparmor profile should work on other Canonical supported versions of Ubuntu Desktop.

The Instructions

1) Save the apparmor profile. To do that: select and copy the apparmor profile text below, paste it into a text editor and save it to a file called usr.bin.love in the root of your home directory: eg: /home/your_user_name/usr.bin.love

# Last Modified: Mon Mar  28 21:50:00 2011
#include <tunables/global>

/usr/bin/love {
  #include <abstractions/X>
  #include <abstractions/audio>
  #include <abstractions/base>

  # Read access to the LOVE executable
  /usr/bin/love r,

  # Read access to misc files required by LOVE
  /etc/openal/alsoft.conf r,
  owner /proc/*/cmdline r,
  /var/lib/dbus/machine-id r,
  owner /var/run/gdm/auth*/database r,

  # Read access to all files with a .love extension
  /**.love r,

  # Read & write access to user .love settings directories
  owner @{HOME}/.love/ rw,
  owner @{HOME}/.love/** rw,

}

2) Open a terminal. You should be able to find Gnome Terminal under: Applications -> Accessories -> Terminal

3) Activate the profile. One line at a time enter each of these commands into the terminal:

sudo mv ~/usr.bin.love /etc/apparmor.d
sudo chown root:root /etc/apparmor.d/usr.bin.love
sudo apparmor_parser --add /etc/apparmor.d/usr.bin.love

(note: each command uses sudo to elevate your user to an administrator. When you enter the first command, using sudo for the first time, you will be prompted for your password. This is normal.)

4) (optional step). If you want to receive desktop notifications when AppArmor restricts a .love game from doing something that is not permitted then install the apparmor-notify package. To do this, simply enter this command into the terminal:

sudo apt-get install apparmor-notify

Removing the profile

If you ever want to remove the AppArmor security profile you added and go back to how it was before, it is quite simple. Open a terminal again and one line at a time enter each of these commands into the terminal:

sudo apparmor_parser --remove /etc/apparmor.d/usr.bin.love
sudo rm /etc/apparmor.d/usr.bin.love

That's it!

Advanced Geek AppArmor Stuff

This section is for people who want to know more about AppArmor and perhaps customize, extend or otherwise improve their AppArmor profile.

An AppArmor profile simply contains a series of instructions telling AppArmor what a piece of software can and cannot do. If you want to understand the rules inside a profile better read the apparmor.d man page.

If you want to allow .love files to have TCP and UDP network access as well as the ability to resolve hostnames to ip addresses the make then following changes to the AppArmor profile given in The Instructions: Add the following line underneith the other #includes:

  #include <abstractions/nameservice>

After the line:

owner @{HOME}/.love/** rw,

...add the following lines:

  # Network access (uncomment to enable)
  network udp,
  network tcp,

A good place to learn more is the Ubuntu AppArmor wiki page.

Bugs

Found a bug? Have a problem? Got a suggested update for this page? Then post in the forums or PM Akima!

If you confirm the apparmor profile to work on an unlisted copy of the LÖVE engine or Ubuntu then update the "Requirements" section of this page accordingly.

Known Working Games

The following .love files have been tested and work fine in the AppArmor sandbox:

• Dave Gone Apeshit 1.2
• AutoBenchmark 0.90
• Desert Loot