19 October 2025

Sandbox IntelliJ IDEA with AppArmor

If you have a Linux system with AppArmor, you can use it to sandbox IntelliJ IDEA.

Do not install IntelliJ with snap, download the .tar.gz archive instead and unpack it in /opt/JetBrains/.

Then add this file to /etc/apparmor.d.

#include <tunables/global>

profile idea /opt/JetBrains/idea*/bin/* {
    #include <abstractions/base>
    #include <abstractions/consoles>
    #include <abstractions/nameservice>
    #include <abstractions/ssl_certs>
    #include <abstractions/gnome>
    #include <abstractions/xdg-open>
    #include <abstractions/dbus-session>
    
    /etc/** r,
    /dev/** r,
    /dev/ptmx rw,
    @{PROC}/ r,
    @{PROC}/** r,
    /sys/** r,
    /bin/* rixm,
    /usr/bin/{[^s]*,?[^n]*,??[^a]*,???[^p]*} rixm,
    /usr/local/bin/** rixm,
    /usr/include/** r,
    /usr/lib/ r,
    /usr/lib/** rixm,
    /usr/lib64/ r,
    /usr/lib64/** rixm,
    /usr/libexec/** rixm,
    /usr/sbin/* rixm,
    /usr/share/** r,

    /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx -> snap_browsers,

    owner @{PROC}/@{pid}/coredump_filter rw,
    owner /tmp/ r,
    owner /tmp/** rwlkix,
    owner /var/tmp/ r,
    owner /var/tmp/** rwlkix,
    owner /run/user/@{uid}/at-spi/* rw,
    owner /run/user/@{uid}/bus rw,
    owner /run/user/@{uid}/dconf/user rw,
    owner /run/user/@{uid}/gdm/Xauthority r,
    owner /run/user/@{uid}/keyring/ssh rw,

    /opt/JetBrains/** rixm,

    / r,
    /home/ r,
    owner @{HOME}/ r,
    owner @{HOME}/.bashrc r,
    owner @{HOME}/.bash_aliases r,
    owner @{HOME}/.cache/JNA/*/ r,
    owner @{HOME}/.cache/JetBrains/ r,
    owner @{HOME}/.cache/JetBrains/** rwklix,
    owner @{HOME}/.cache/ibus/* rw,
    owner @{HOME}/.config/JetBrains/ r,
    owner @{HOME}/.config/JetBrains/** rwkl,
    owner @{HOME}/.config/dconf/user r,
    owner @{HOME}/.config/ibus/bus/ r,
    owner @{HOME}/.config/ibus/bus/* r,
    owner @{HOME}/.gitconfig r,
    owner @{HOME}/.gitignore r,
    owner @{HOME}/.gradle/ r,
    owner @{HOME}/.gradle/** rwklixm,
    owner @{HOME}/.inputrc r,
    owner @{HOME}/.ivy2/** rwkl,
    owner @{HOME}/.java/** rwkl,
    owner @{HOME}/.junie/ r,
    owner @{HOME}/.junie/** rwkl,
    owner @{HOME}/.local/bin/* rix,
    owner @{HOME}/.local/share/JetBrains/ r,
    owner @{HOME}/.local/share/JetBrains/** rwklix,
    owner @{HOME}/.local/share/kotlin/** rwklix,
    owner @{HOME}/.m2/ r,
    owner @{HOME}/.m2/** rwkl,
    owner @{HOME}/.profile r,
    owner @{HOME}/.ssh/ r,
    owner @{HOME}/.ssh/config r,
    owner @{HOME}/.ssh/known_hosts* r,
    owner @{HOME}/.ssh/*.pub r,
    owner @{HOME}/src/ r,
    owner @{HOME}/src/** rwklix,

    signal (send,receive) set=(int,term,kill) peer=idea,

    ptrace peer=idea,

	profile snap_browsers {
	  #include <abstractions/base>
	  #include <abstractions/dbus-session-strict>

	  /etc/passwd r,
	  /etc/nsswitch.conf r,
	  /etc/fstab r,
 	  /etc/local/fstab r,

	  # noisy
	  deny owner /run/user/[0-9]*/gdm/Xauthority r, # not needed on Ubuntu

	  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrix, # re-exec
	  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/info r,
	  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snapd r,
	  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-seccomp rPix,
	  /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/lib/snapd/snap-confine Pix,
	  /var/lib/snapd/system-key r,
	  /run/snapd.socket rw,

	  /usr/bin/systemctl ix,

	  @{PROC}/version r,
	  @{PROC}/cmdline r,
	  @{PROC}/sys/net/core/somaxconn r,
	  @{PROC}/sys/kernel/seccomp/actions_avail r,
	  @{PROC}/sys/kernel/random/uuid r,
	  owner @{PROC}/@{pid}/cgroup r,
	  owner @{PROC}/@{pid}/mountinfo r,
	  owner @{HOME}/.snap/auth.json r, # if exists, required

	  dbus send bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="StartTransientUnit" peer=(name="org.freedesktop.systemd1"),
	  dbus receive bus="session" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="JobRemoved",

	  /sys/fs/cgroup/cgroup.controllers r,
	  /sys/kernel/security/apparmor/features/ r,
          /sys/kernel/security/apparmor/features/** r,

	  # allow launching official browser snaps.
	  /snap/{brave,chromium,firefox,opera}/[0-9]*/meta/{snap.yaml,hooks/} r,
	  /var/lib/snapd/sequence/{brave,chromium,firefox,opera}.json r,
	  /var/lib/snapd/inhibit/{brave,chromium,firefox,opera}.lock rk,
	}

}

Then run sudo service apparmor reload to activate it (it will be loaded automatically on boot). This is tested on Ubuntu desktop 24.04.

14 September 2025

Secure your Go builds with AppArmor

If you have a Linux system with AppArmor, you can use it to secure your Go builds.

First install Go in /usr/local/go as in the the instructions.

Then add this file to /etc/apparmor.d, replace ${HOME} with your home directory.

#include <tunables/global>

profile go /usr/local/go/bin/go {
    #include <abstractions/base>
    #include <abstractions/consoles>
    /tmp/ r,
    /tmp/** rwkix,
    @{PROC}/** r,
    /sys/** r,
    /dev/** r,
    /etc/** r,
    /usr/** r,
    /bin/** ix,
    /usr/bin/** ix,
    /usr/libexec/** ix,
    /usr/lib/** ix,

    /usr/local/go/** rix,

    owner @{HOME}/.config/go/** rw,
    owner @{HOME}/.cache/go-build/** rwkix,
    owner @{HOME}/.cache/JetBrains/IntelliJIdea*/tmp/GoLand/** rwkix,
    owner @{HOME}/.cache/JetBrains/IntelliJIdea*/coverage/** rwk,
    owner @{HOME}/.local/share/JetBrains/IntelliJIdea*/go-plugin/** rix,
    owner @{HOME}/.config/dlv/** r,
    owner @{HOME}/.gitconfig r,
    owner @{HOME}/.gitignore r,
    owner @{HOME}/go/** rwkl,
    owner @{HOME}/go/bin/* rwklix,
    owner @{HOME}/src/** rwk,

    /etc/resolv.conf r,
    @{PROC}/sys/net/** r,
    /run/systemd/resolve/** r,
    network,

    signal (receive) set=(int,term,kill),

    ptrace,
}

profile go-fmt /usr/local/go/bin/gofmt {
    #include <abstractions/base>
    #include <abstractions/consoles>
    /tmp/** rwkix,

    /usr/local/go/** rix,

    owner @{HOME}/.config/go/** rw,
    owner @{HOME}/.cache/JetBrains/IntelliJIdea*/tmp/GoLand/** rwk,
    owner @{HOME}/go/** rwk,
    owner @{HOME}/src/** rwk,

    signal (receive) set=(int,term,kill),
}

profile go-bin ${HOME}/{go/bin/*,.cache/go-build/**,.cache/JetBrains/IntelliJIdea*/tmp/GoLand/*} {
    #include <abstractions/base>
    #include <abstractions/consoles>
    /etc/** r,
    /bin/** ix,
    /usr/bin/** ix,
    /tmp/ r,
    /tmp/** rwk,

    /usr/local/go/** rix,

    owner @{HOME}/.config/go/** r,
    owner @{HOME}/.cache/go-build/** rix,
    owner @{HOME}/.cache/JetBrains/IntelliJIdea*/tmp/GoLand/** rix,
    owner @{HOME}/go/** r,
    owner @{HOME}/go/bin/* rix,
    owner @{HOME}/src/** r,

    /etc/resolv.conf r,
    @{PROC}/sys/net/** r,
    /run/systemd/resolve/** r,
    network,

    signal (receive) set=(int,term,kill),

    ptrace (tracedby, readby) peer=go,
}

Then run sudo service apparmor reload to activate it (it will be loaded automatically on boot). This is tested un Ubuntu desktop 24.04. It will also enable use of the Go plugin to IntelliJ IDEA.

14 September 2025

Secure your Rust builds with AppArmor

If you have a Linux system with AppArmor, you can use it to secure your Rust builds.

First install Rust with rustup in ~/.cargo/bin.

Then add this file to /etc/apparmor.d, replace ${HOME} with your home directory.

#include <tunables/global>

profile cargo-bin ${HOME}/{.cargo/bin/*,.local/share/JetBrains/IntelliJIdea*/intellij-rust/bin/linux/x64/*} {
    #include <abstractions/base>
    #include <abstractions/consoles>

    @{PROC}** r,
    /sys/** r,
    /usr/bin/** ix,
    /usr/include/** r,
    /usr/libexec/** rix,
    /usr/share/** r,
    /tmp/ r,
    /tmp/** rwkix,

    owner @{HOME}/.gitconfig r,
    owner @{HOME}/.gitignore r,
    owner @{HOME}/.rustup/** r,
    owner @{HOME}/.rustup/toolchains/** rix,
    owner @{HOME}/.cargo/ r,
    owner @{HOME}/.cargo/** rwkl,
    owner @{HOME}/.cargo/bin/** rwklix,
    owner @{HOME}/.local/share/JetBrains/IntelliJIdea*/intellij-rust/** r,
    owner @{HOME}/.local/share/JetBrains/IntelliJIdea*/intellij-rust/bin/linux/x64/* rix,
    owner @{HOME}/.cache/JetBrains/IntelliJIdea*/intellij-rust/** rwk,
    owner @{HOME}/src/** rwklix,

    /etc/resolv.conf r,
    @{PROC}/sys/net/** r,
    network,
    /run/systemd/resolve/** r,

    signal (receive) set=(int,term,kill),
}

profile rustup ${HOME}/.cargo/bin/rustup {
    #include <abstractions/base>
    #include <abstractions/consoles>

    /etc/** r,
    @{PROC}** r,
    /sys/** r,
    /usr/bin/** ix,
    /usr/include/** r,
    /usr/libexec/** rix,
    /usr/share/** r,
    /tmp/ r,
    /tmp/** rwkix,

    owner @{HOME}/.gitconfig r,
    owner @{HOME}/.gitignore r,
    owner @{HOME}/.rustup/** rwkl,
    owner @{HOME}/.rustup/toolchains/** rwklix,
    owner @{HOME}/.cargo/ r,
    owner @{HOME}/.cargo/** rwkl,
    owner @{HOME}/.cargo/bin/** rwklix,
    owner @{HOME}/.local/share/JetBrains/IntelliJIdea*/intellij-rust/** r,
    owner @{HOME}/.local/share/JetBrains/IntelliJIdea*/intellij-rust/bin/linux/x64/* rix,
    owner @{HOME}/.cache/JetBrains/IntelliJIdea*/intellij-rust/** rwk,
    owner @{HOME}/src/** rwklix,

    /etc/resolv.conf r,
    @{PROC}/sys/net/** r,
    network,
    /run/systemd/resolve/** r,

    signal (receive) set=(int,term,kill),
}

Then run sudo service apparmor reload to activate it (it will be loaded automatically on boot). This is tested un Ubuntu desktop 24.04. It will also enable use of the Rust plugin to IntelliJ IDEA.

14 September 2025

Secure your Gradle builds with AppArmor

If you have a Linux system with AppArmor, you can use it to secure your Gradle builds.

Here is how I installed it on Ubuntu Linux:

Make sure you have a Java Development Kit installed.
Set the JAVA_HOME environment variable to point to your JDK by creating a file /etc/profile.d/java.sh with this content:
```
#!/bin/sh
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64
```
Make a manual installation of Gradle in /opt/gradle.

Make it available in PATH:

$ cd /usr/bin
$ sudo ln -s ../../opt/gradle/gradle-8.14.3/bin/gradle .

13 September 2025

Speed-up and secure your Maven builds with Maven Daemon

You can speed-up Maven builds considerably by using Maven Daemon.

Here is how I installed it on Ubuntu Linux:

Make sure you have a Java Development Kit installed.
Set the JAVA_HOME environment variable to point to your JDK by creating a file /etc/profile.d/java.sh with this content:
```
#!/bin/sh
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64
```
Download Maven Daemon.
Unpack it into /opt

Make it available in PATH:

$ cd /usr/bin
$ sudo ln -s ../../opt/maven-mvnd-1.0.2-linux-amd64/bin/mvnd .
$ sudo ln -s mvnd mvn

You can configure IntelliJ IDEA to use it by setting Maven home path to /opt/maven-mvnd-1.0.2-linux-amd64. You need to do this for all existing Maven projects you have. Also make sure that the registry setting maven.use.scripts is true.