Phase 12: Security Hardening

# Define the deny rules (credential stores + SSH keys)
DENY_RULES='  # Credential store lockdown (CR-2026-04-04)
  deny owner @{HOME}/.secrets/ rw,
  deny owner @{HOME}/.secrets/** rw,
  deny owner @{HOME}/.gnupg/ rw,
  deny owner @{HOME}/.gnupg/** rw,
  deny owner @{HOME}/.age/ rw,
  deny owner @{HOME}/.age/** rw,
  deny owner @{HOME}/.local/share/gopass/ rw,
  deny owner @{HOME}/.local/share/gopass/** rw,
  deny owner @{HOME}/.ssh/id_* rw,'

# Write deny rules to all three browser local overrides
for browser in firefox chrome chromium; do
    echo "${DENY_RULES}" | sudo tee /etc/apparmor.d/local/${browser} > /dev/null
    echo "WROTE /etc/apparmor.d/local/${browser}"
done

# Verify all three files
for browser in firefox chrome chromium; do
    printf "\n=== %s ===\n" "${browser}"
    cat /etc/apparmor.d/local/${browser}
done

# BEFORE -- confirm current state (all should show "unconfined")
for browser in firefox chrome chromium; do
    printf "%-12s " "${browser}:"
    grep 'flags=' /etc/apparmor.d/${browser}
done

# APPLY -- remove flags=(unconfined), add allow-all baseline rules
# Firefox
sudo sed -i 's| flags=(unconfined) {| {|' /etc/apparmor.d/firefox
sudo sed -i '/userns,/a\  # Allow-all baseline (confined — deny rules now enforced)\n  capability,\n  network,\n  signal,\n  ptrace,\n  dbus,\n  unix,\n  mount,\n  umount,\n  pivot_root,\n  / r,\n  /** rwlkm,\n  /** ix,' /etc/apparmor.d/firefox

# Chrome
sudo sed -i 's| flags=(unconfined) {| {|' /etc/apparmor.d/chrome
sudo sed -i '/userns,/a\  # Allow-all baseline (confined — deny rules now enforced)\n  capability,\n  network,\n  signal,\n  ptrace,\n  dbus,\n  unix,\n  mount,\n  umount,\n  pivot_root,\n  / r,\n  /** rwlkm,\n  /** ix,' /etc/apparmor.d/chrome

# Chromium
sudo sed -i 's| flags=(unconfined) {| {|' /etc/apparmor.d/chromium
sudo sed -i '/userns,/a\  # Allow-all baseline (confined — deny rules now enforced)\n  capability,\n  network,\n  signal,\n  ptrace,\n  dbus,\n  unix,\n  mount,\n  umount,\n  pivot_root,\n  / r,\n  /** rwlkm,\n  /** ix,' /etc/apparmor.d/chromium

# VERIFY -- confirm unconfined flag removed, baseline rules added
for browser in firefox chrome chromium; do
    printf "\n=== %s ===\n" "${browser}"
    cat /etc/apparmor.d/${browser}
done

# Reload modified profiles into kernel
for browser in firefox chrome chromium; do
    sudo apparmor_parser -r /etc/apparmor.d/${browser}
    echo "RELOADED ${browser}"
done

# Force enforce mode
for browser in firefox chrome chromium; do
    sudo aa-enforce /etc/apparmor.d/${browser}
    echo "ENFORCED ${browser}"
done

# Verify -- browsers should appear under enforce, NOT unconfined
sudo aa-status | awk '/in enforce/{p="enforce"} /in complain/{p="complain"} /in unconfined/{p="unconfined"} /firefox|chrome|chromium/{print p": "$0}'

# APPLY -- add attach_disconnected flag (idempotent: skips if already present)
for browser in firefox chrome chromium; do
    if grep -q 'attach_disconnected' /etc/apparmor.d/${browser}; then
        echo "SKIP  ${browser} (already has flag)"
    else
        sudo sed -i "s|^profile ${browser} \(.*\) {|profile ${browser} \1 flags=(attach_disconnected) {|" /etc/apparmor.d/${browser}
        echo "PATCH ${browser}"
    fi
done

# VERIFY -- all three should show flags=(attach_disconnected)
grep '^profile' /etc/apparmor.d/{firefox,chrome,chromium}

# Reload + re-enforce all three
for browser in firefox chrome chromium; do
    sudo apparmor_parser -r /etc/apparmor.d/${browser} && sudo aa-enforce /etc/apparmor.d/${browser}
    echo "DONE ${browser}"
done

# Confirm no more bwrap denials (launch a browser first, browse for 30s)
sudo journalctl -k --since "1 minute ago" | grep -i 'apparmor.*DENIED' | tail -5

# Launch Firefox and verify it works
firefox &

# Check for denials in audit log (should see denies for credential paths IF Firefox tried)
sudo journalctl -k --since "5 minutes ago" | grep -i 'apparmor.*DENIED' | tail -10

# If Firefox breaks: emergency rollback to complain mode (2-second fix)
# sudo aa-complain /etc/apparmor.d/firefox

# After pacman update: check for .pacnew files
find /etc/apparmor.d/ -name "*.pacnew" | head

# Re-apply our changes (remove unconfined, add baseline)
# Or diff the .pacnew against our version and merge