Reorganise the directories.
This commit is contained in:
Alexandre Pujol
parent
91b15fcc73
commit
091d20d086
715 changed files with 0 additions and 0 deletions
113
apparmor.d/groups/cron/cron
Normal file
113
apparmor.d/groups/cron/cron
Normal file
|
|
@ -0,0 +1,113 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}sbin/cron
|
||||
profile cron @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
capability dac_read_search,
|
||||
capability audit_write,
|
||||
capability sys_resource,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/nice rix,
|
||||
/{usr/,}bin/ionice rix,
|
||||
|
||||
/etc/crontab r,
|
||||
|
||||
# All stuff that is executed via the /etc/cron.d/ dir
|
||||
/etc/cron.d/{,*} r,
|
||||
/{usr/,}sbin/cron-apt rPx,
|
||||
/{usr/,}bin/debsecan rPx,
|
||||
/{usr/,}lib/@{multiarch}/e2fsprogs/e2scrub_all_cron rPUx,
|
||||
/{usr/,}sbin/e2scrub_all rPUx,
|
||||
/etc/cron.daily/popularity-contest rPx,
|
||||
/{usr/,}lib/sysstat/debian-sa1 rPUx,
|
||||
|
||||
# All stuff that is executed via the user crontab files
|
||||
/{usr/,}bin/apt-file rPx,
|
||||
/{usr/,}bin/apt-key rPx,
|
||||
/{usr/,}bin/rsync rPUx,
|
||||
/usr/share/rsync/scripts/rrsync rPUx,
|
||||
/{usr/,}bin/gpg rPx,
|
||||
/{usr/,}sbin/update-pciids rPx,
|
||||
/{usr/,}bin/borg rPx,
|
||||
|
||||
# Cron scripts in the /etc/cron.*/ dir to execute
|
||||
/{usr/,}bin/run-parts rCx -> run-parts,
|
||||
|
||||
# Send results using email
|
||||
/{usr/,}sbin/exim4 rPx,
|
||||
|
||||
/var/spool/cron/crontabs/{,*} r,
|
||||
|
||||
owner @{run}/crond.pid rwk,
|
||||
owner @{run}/crond.reboot rw,
|
||||
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
|
||||
/etc/environment r,
|
||||
|
||||
/etc/default/locale r,
|
||||
|
||||
@{PROC}/1/limits r,
|
||||
/etc/security/limits.d/ r,
|
||||
|
||||
profile run-parts {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/run-parts mr,
|
||||
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/ r,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/apt-listbugs rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/apt-show-versions rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/bsdmainutils rPUx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/debtags rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/exim4-base rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/logrotate rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/mlocate rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/dlocate rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/passwd rPUx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/apt-compat rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/aptitude rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/debsums rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/dpkg rPUx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/man-db rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/popularity-contest rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/sysstat rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/spamassassin rPUx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/vrms rPUx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/apt-xapian-index rPx,
|
||||
/etc/cron.{hourly,daily,weekly,monthly}/tor rPUx,
|
||||
|
||||
#/etc/cron.{hourly,daily,weekly,monthly}/opera-browser rPUx,
|
||||
#/etc/cron.{hourly,daily,weekly,monthly}/google-chrome{,-beta,-unstable} rPUx,
|
||||
#/opt/google/chrome{,-beta,-unstable}/cron/google-chrome{,-beta,-unstable} rPUx,
|
||||
#/opt/brave.com/brave/cron/brave-browser{,-beta,-dev} rPUx,
|
||||
#/opt/brave.com/brave{,-beta,-dev}/cron/brave-browser{,-beta,-dev} rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
include if exists <local/cron_run-parts>
|
||||
}
|
||||
|
||||
include if exists <local/cron>
|
||||
}
|
||||
89
apparmor.d/groups/cron/cron-apt
Normal file
89
apparmor.d/groups/cron/cron-apt
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}sbin/cron-apt
|
||||
profile cron-apt @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# Needed?
|
||||
capability setgid,
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/dotlockfile rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/mktemp rix,
|
||||
/{usr/,}bin/diff rix,
|
||||
/{usr/,}bin/mkdir rix,
|
||||
/{usr/,}bin/rmdir rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/md5sum rix,
|
||||
/{usr/,}bin/stat rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
/{usr/,}bin/expr rix,
|
||||
/{usr/,}bin/cp rix,
|
||||
/{usr/,}bin/dd rix,
|
||||
/{usr/,}bin/cksum rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/sleep rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/logger rix,
|
||||
/{usr/,}bin/ls rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/uname rix,
|
||||
/{usr/,}bin/fold rix,
|
||||
|
||||
/{usr/,}bin/apt-get rPx,
|
||||
/{usr/,}bin/apt-file rPx,
|
||||
/{usr/,}bin/aptitude{,-curses} rPx,
|
||||
/{usr/,}sbin/exim4 rPx,
|
||||
|
||||
/usr/share/cron-apt/{,*} r,
|
||||
|
||||
/etc/cron-apt/{,*/} r,
|
||||
/etc/cron-apt/config r,
|
||||
/etc/cron-apt/refrain r,
|
||||
/etc/cron-apt/action.d/[0-9]-* r,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
/etc/ r,
|
||||
/root/ r,
|
||||
|
||||
/var/lib/cron-apt/ rw,
|
||||
/var/lib/cron-apt/** rwl -> /var/lib/cron-apt/**,
|
||||
|
||||
# Logs
|
||||
/var/log/cron-apt/ r,
|
||||
/var/log/cron-apt/error w,
|
||||
/var/log/cron-apt/temp rw,
|
||||
/var/log/cron-apt/mail rw,
|
||||
/var/log/cron-apt/lastfullmessage rw,
|
||||
|
||||
# For the "ls" command
|
||||
/{usr/,}lib/locale/locale-archive r,
|
||||
|
||||
# TMP
|
||||
/tmp/ r,
|
||||
owner /tmp/cron-apt.*/ rw,
|
||||
owner /tmp/cron-apt.*/difftemp rw,
|
||||
owner /tmp/cron-apt.*/lockfile rw,
|
||||
owner /tmp/cron-apt.*/initlog rw,
|
||||
owner /tmp/cron-apt.*/status rw,
|
||||
owner /tmp/cron-apt.*/run{log,error,mail,syslog} rw,
|
||||
owner /tmp/cron-apt.*/action{log,error,mail,syslog} rw,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
include if exists <local/cron-apt>
|
||||
}
|
||||
28
apparmor.d/groups/cron/cron-apt-compat
Normal file
28
apparmor.d/groups/cron/cron-apt-compat
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/apt-compat
|
||||
profile cron-apt-compat @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}sbin/on_ac_power rPx,
|
||||
|
||||
/{usr/,}bin/apt-config rPx,
|
||||
/{usr/,}lib/apt/apt.systemd.daily rPx,
|
||||
|
||||
/{usr/,}bin/dd rix,
|
||||
/{usr/,}bin/cksum rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/sleep rix,
|
||||
|
||||
include if exists <local/cron-apt-compat>
|
||||
}
|
||||
38
apparmor.d/groups/cron/cron-apt-listbugs
Normal file
38
apparmor.d/groups/cron/cron-apt-listbugs
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/apt-listbugs
|
||||
profile cron-apt-listbugs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}lib/ruby/vendor_ruby/aptlistbugs/prefclean rCx -> prefclean,
|
||||
|
||||
@{run}/systemd/system r,
|
||||
|
||||
|
||||
profile prefclean {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}lib/ruby/vendor_ruby/aptlistbugs/prefclean mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/mktemp rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/cp rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
|
||||
/var/spool/apt-listbugs/lastprefclean rw,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/cron-apt-listbugs>
|
||||
}
|
||||
22
apparmor.d/groups/cron/cron-apt-show-versions
Normal file
22
apparmor.d/groups/cron/cron-apt-show-versions
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/apt-show-versions
|
||||
profile cron-apt-show-versions @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/apt-show-versions rPx,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
|
||||
include if exists <local/cron-apt-show-versions>
|
||||
}
|
||||
30
apparmor.d/groups/cron/cron-apt-xapian-index
Normal file
30
apparmor.d/groups/cron/cron-apt-xapian-index
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/apt-xapian-index
|
||||
profile cron-apt-xapian-index @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
|
||||
/{usr/,}bin/nice rix,
|
||||
/{usr/,}bin/ionice rix,
|
||||
|
||||
/{usr/,}sbin/ r,
|
||||
/{usr/,}sbin/update-apt-xapian-index rPx,
|
||||
/{usr/,}sbin/on_ac_power rPx,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
|
||||
include if exists <local/cron-apt-xapian-index>
|
||||
}
|
||||
35
apparmor.d/groups/cron/cron-aptitude
Normal file
35
apparmor.d/groups/cron/cron-aptitude
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/aptitude
|
||||
profile cron-aptitude @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/cp rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
|
||||
/{usr/,}bin/savelog rix,
|
||||
/{usr/,}bin/cmp rix,
|
||||
|
||||
/{usr/,}bin/gzip rix,
|
||||
|
||||
/var/lib/aptitude/pkgstates r,
|
||||
|
||||
/var/backups/ r,
|
||||
/var/backups/* rw,
|
||||
|
||||
include if exists <local/cron-aptitude>
|
||||
}
|
||||
48
apparmor.d/groups/cron/cron-debsums
Normal file
48
apparmor.d/groups/cron/cron-debsums
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/debsums
|
||||
profile cron-debsums @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/true rix,
|
||||
/{usr/,}bin/logger rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
|
||||
/{usr/,}bin/ionice rix,
|
||||
|
||||
/{usr/,}bin/debsums rPx,
|
||||
/{usr/,}bin/tee rCx -> tee,
|
||||
|
||||
/etc/ r,
|
||||
/etc/default/debsums r,
|
||||
/etc/debsums-ignore r,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
|
||||
|
||||
profile tee {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
# Needed to write to /proc/self/fd/3
|
||||
capability dac_override,
|
||||
|
||||
/{usr/,}bin/tee mr,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/3 rw,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/cron-debsums>
|
||||
}
|
||||
19
apparmor.d/groups/cron/cron-debtags
Normal file
19
apparmor.d/groups/cron/cron-debtags
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/debtags
|
||||
profile cron-debtags @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/usr/bin/debtags rPx,
|
||||
|
||||
include if exists <local/cron-debtags>
|
||||
}
|
||||
19
apparmor.d/groups/cron/cron-dlocate
Normal file
19
apparmor.d/groups/cron/cron-dlocate
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/dlocate
|
||||
profile cron-dlocate @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}sbin/update-dlocatedb rPx,
|
||||
|
||||
include if exists <local/cron-dlocate>
|
||||
}
|
||||
36
apparmor.d/groups/cron/cron-exim4-base
Normal file
36
apparmor.d/groups/cron/cron-exim4-base
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.daily/exim4-base
|
||||
profile cron-exim4-base @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/logger rix,
|
||||
/{usr/,}bin/mail rix,
|
||||
/{usr/,}bin/hostname rix,
|
||||
/{usr/,}bin/xargs rix,
|
||||
/{usr/,}bin/find rix,
|
||||
/{usr/,}sbin/eximstats rix,
|
||||
|
||||
/{usr/,}sbin/exim4 rPx,
|
||||
|
||||
/etc/default/exim4 r,
|
||||
|
||||
/var/spool/exim4/db/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/cron-exim4-base>
|
||||
}
|
||||
22
apparmor.d/groups/cron/cron-ipset-autoban-save
Normal file
22
apparmor.d/groups/cron/cron-ipset-autoban-save
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/ipset_autoban_save
|
||||
profile cron-ipset-autoban-save @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}sbin/ipset rix,
|
||||
|
||||
/etc/peerblock/autoban rw,
|
||||
|
||||
include if exists <local/cron-ipset-autoban-save>
|
||||
}
|
||||
24
apparmor.d/groups/cron/cron-logrotate
Normal file
24
apparmor.d/groups/cron/cron-logrotate
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/logrotate
|
||||
profile cron-logrotate @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}sbin/logrotate rPx,
|
||||
|
||||
/{usr/,}bin/logger rix,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
|
||||
include if exists <local/cron-logrotate>
|
||||
}
|
||||
37
apparmor.d/groups/cron/cron-man-db
Normal file
37
apparmor.d/groups/cron/cron-man-db
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/man-db
|
||||
profile cron-man-db @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# For start-stop-daemon
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}sbin/start-stop-daemon rix,
|
||||
/{usr/,}bin/xargs rix,
|
||||
/{usr/,}bin/find rix,
|
||||
|
||||
/{usr/,}bin/mandb rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/var/cache/man/ r,
|
||||
/var/cache/man/** r,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
|
||||
include if exists <local/cron-man-db>
|
||||
}
|
||||
30
apparmor.d/groups/cron/cron-mlocate
Normal file
30
apparmor.d/groups/cron/cron-mlocate
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/mlocate
|
||||
profile cron-mlocate @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/true rix,
|
||||
/{usr/,}bin/flock rix,
|
||||
/{usr/,}bin/nocache rix,
|
||||
/{usr/,}bin/ionice rix,
|
||||
/{usr/,}bin/nice rix,
|
||||
|
||||
/{usr/,}bin/updatedb.mlocate rPx,
|
||||
/{usr/,}sbin/on_ac_power rPx,
|
||||
|
||||
@{run}/mlocate.daily.lock rwk,
|
||||
|
||||
include if exists <local/cron-mlocate>
|
||||
}
|
||||
154
apparmor.d/groups/cron/cron-popularity-contest
Normal file
154
apparmor.d/groups/cron/cron-popularity-contest
Normal file
|
|
@ -0,0 +1,154 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/popularity-contest
|
||||
profile cron-popularity-contest @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}sbin/popularity-contest rPx,
|
||||
|
||||
/{usr/,}bin/logger rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/mktemp rix,
|
||||
/{usr/,}bin/mkdir rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
/{usr/,}bin/setsid rix,
|
||||
|
||||
# To send reports via TOR
|
||||
/{usr/,}bin/torify rix,
|
||||
/{usr/,}bin/torsocks rix,
|
||||
/{usr/,}sbin/getcap rix,
|
||||
|
||||
/usr/share/popularity-contest/popcon-upload rCx -> popcon-upload,
|
||||
/{usr/,}bin/gpg rCx -> gpg,
|
||||
/{usr/,}sbin/runuser rCx -> runuser,
|
||||
/{usr/,}bin/savelog rCx -> savelog,
|
||||
|
||||
/usr/share/popularity-contest/ r,
|
||||
/usr/share/popularity-contest/default.conf r,
|
||||
|
||||
/etc/popularity-contest.conf r,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
/root/ r,
|
||||
|
||||
/var/log/ r,
|
||||
/var/log/popularity-contest{,.new} rw,
|
||||
/var/log/popularity-contest{,.new}.gpg rw,
|
||||
|
||||
# Store last successful http submission timestamp
|
||||
/var/lib/popularity-contest/ rw,
|
||||
/var/lib/popularity-contest/lastsub rw,
|
||||
|
||||
owner /tmp/tmp.*/ rw,
|
||||
owner /tmp/tmp.*/random_seed w,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
|
||||
profile savelog {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/savelog mr,
|
||||
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/gzip rix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/var/log/ r,
|
||||
/var/log/popularity-contest.[0-9]*.gz rw,
|
||||
/var/log/popularity-contest.[0-9]* rw,
|
||||
/var/log/popularity-contest rw,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
}
|
||||
|
||||
profile runuser {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/authentication>
|
||||
|
||||
/{usr/,}sbin/runuser mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}sbin/popularity-contest rPx,
|
||||
|
||||
owner @{PROC}/@{pids}/loginuid r,
|
||||
@{PROC}/1/limits r,
|
||||
|
||||
/etc/security/limits.d/ r,
|
||||
|
||||
/var/log/popularity-contest.new w,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
/{usr/,}bin/gpg mr,
|
||||
|
||||
/usr/share/popularity-contest/debian-popcon.gpg r,
|
||||
|
||||
/var/log/popularity-contest.new r,
|
||||
/var/log/popularity-contest.new.gpg rw,
|
||||
|
||||
owner /tmp/tmp.*/** rwkl -> /tmp/tmp.*/**,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
}
|
||||
|
||||
profile popcon-upload {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/perl>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
/usr/share/popularity-contest/popcon-upload r,
|
||||
/{usr/,}bin/perl r,
|
||||
|
||||
/{usr/,}bin/gzip rix,
|
||||
|
||||
/var/log/ r,
|
||||
/var/log/popularity-contest.new.gpg r,
|
||||
|
||||
# file_inherit
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/cron-popularity-contest>
|
||||
}
|
||||
59
apparmor.d/groups/cron/crontab
Normal file
59
apparmor.d/groups/cron/crontab
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/crontab
|
||||
profile crontab @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
# When editing the crontab file
|
||||
/{usr/,}bin/sensible-editor rCx -> editor,
|
||||
/{usr/,}bin/vim.* rCx -> editor,
|
||||
|
||||
/var/spool/cron/ r,
|
||||
/var/spool/cron/crontabs/ rw,
|
||||
owner /var/spool/cron/crontabs/* rw,
|
||||
|
||||
owner /tmp/crontab.*/{,crontab} rw,
|
||||
|
||||
|
||||
profile editor {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability fsetid,
|
||||
|
||||
/{usr/,}bin/sensible-editor mr,
|
||||
/{usr/,}bin/vim.* mrix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/which rix,
|
||||
|
||||
owner @{HOME}/.selected_editor r,
|
||||
|
||||
/usr/share/vim/{,**} r,
|
||||
/etc/vim/{,**} r,
|
||||
owner @{HOME}/.viminfo{,.tmp} rw,
|
||||
|
||||
owner @{HOME}/.fzf/plugin/ r,
|
||||
owner @{HOME}/.fzf/plugin/fzf.vim r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/crontab.*/crontab rw,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/crontab>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue