Reorganise the directories.
This commit is contained in:
Alexandre Pujol
parent
91b15fcc73
commit
091d20d086
715 changed files with 0 additions and 0 deletions
36
apparmor.d/groups/gpg/dirmngr
Normal file
36
apparmor.d/groups/gpg/dirmngr
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/dirmngr
|
||||
profile dirmngr @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.gnupg/ rw,
|
||||
owner @{HOME}/.gnupg/dirmngr.conf r,
|
||||
owner @{HOME}/.gnupg/dirmngr_ldapservers.conf r,
|
||||
owner @{HOME}/.gnupg/crls.d/ rw,
|
||||
owner @{HOME}/.gnupg/crls.d/DIR.txt rw,
|
||||
|
||||
/usr/share/gnupg/sks-keyservers.netCA.pem r,
|
||||
|
||||
owner @{run}/user/[0-9]*/gnupg/ rw,
|
||||
owner @{run}/user/[0-9]*/gnupg/S.dirmngr rw,
|
||||
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
|
||||
include if exists <local/dirmngr>
|
||||
}
|
||||
79
apparmor.d/groups/gpg/gpg
Normal file
79
apparmor.d/groups/gpg/gpg
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/gpg
|
||||
profile gpg @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}bin/gpgconf rPx,
|
||||
/{usr/,}bin/gpg-connect-agent rPx,
|
||||
/{usr/,}bin/gpg-agent rPx,
|
||||
/{usr/,}bin/dirmngr rPx,
|
||||
/{usr/,}bin/gpgsm rPx,
|
||||
/{usr/,}lib/gnupg/scdaemon rPx,
|
||||
|
||||
# GPG config files
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.gnupg/ rw,
|
||||
owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**,
|
||||
|
||||
owner /var/lib/*/gnupg/ rw,
|
||||
owner /var/lib/*/gnupg/** rwkl -> /var/lib/*/gnupg/**,
|
||||
|
||||
owner /var/lib/*/.gnupg/ rw,
|
||||
owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**,
|
||||
|
||||
# For flatpak
|
||||
owner /tmp/ostree-gpg-*/ r,
|
||||
owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
|
||||
|
||||
# For ToR Browser
|
||||
owner @{HOME}/.local/share/torbrowser/gnupg_homedir/ r,
|
||||
owner @{HOME}/.local/share/torbrowser/gnupg_homedir/** rwkl -> @{HOME}/.local/share/torbrowser/gnupg_homedir/**,
|
||||
|
||||
# For spamassassin
|
||||
owner /var/lib/spamassassin/sa-update-keys/** rwkl -> /var/lib/spamassassin/sa-update-keys/**,
|
||||
|
||||
# For lintian
|
||||
owner /tmp/temp-lintian-lab-*/**/debian/upstream/signing-key.asc r,
|
||||
owner /tmp/lintian-pool-*/**/debian/upstream/signing-key.asc r,
|
||||
owner /tmp/*/.#lk0x[0-9a-f]*.*.@{pid} rw,
|
||||
owner /tmp/*/.#lk0x[0-9a-f]*.*.@{pid}x rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
|
||||
owner /tmp/*/trustdb.gpg rw,
|
||||
owner /tmp/*/trustdb.gpg.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
|
||||
owner /tmp/*/pubring.kbx rw,
|
||||
owner /tmp/*/pubring.kbx.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
|
||||
owner /tmp/*/gnupg_spawn_agent_sentinel.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
|
||||
owner /tmp/*.gpg rw,
|
||||
owner /tmp/*.gpg~ w,
|
||||
owner /tmp/*.gpg.tmp rw,
|
||||
owner /tmp/*.gpg.lock rwl -> /tmp/.#lk0x[0-9a-f]*.*.@{pid},
|
||||
owner /tmp/.#lk0x[0-9a-f]*.*.@{pid} rw,
|
||||
owner /tmp/.#lk0x[0-9a-f]*.*.@{pid}x rwl -> /tmp/.#lk0x[0-9a-f]*.*.@{pid},
|
||||
owner @{run}/user/[0-9]*/gnupg/d.*/ rw,
|
||||
|
||||
# Verify files
|
||||
owner @{HOME}/** r,
|
||||
owner /media/*/** r,
|
||||
|
||||
owner @{PROC}/@{pid}/task/@{tid}/stat rw,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/etc/inputrc r,
|
||||
|
||||
# file_inherit
|
||||
/tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
include if exists <local/gpg>
|
||||
}
|
||||
53
apparmor.d/groups/gpg/gpg-agent
Normal file
53
apparmor.d/groups/gpg/gpg-agent
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/gpg-agent
|
||||
profile gpg-agent @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (receive) peer=pinentry-*,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/gnupg/scdaemon rPx,
|
||||
|
||||
/usr/share/gnupg/* r,
|
||||
|
||||
owner @{HOME}/.gnupg/ rw,
|
||||
owner @{HOME}/.gnupg/gpg-agent.conf r,
|
||||
owner @{HOME}/.gnupg/private-keys-v1.d/ rw,
|
||||
owner @{HOME}/.gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
|
||||
|
||||
owner /var/lib/*/.gnupg/ rw,
|
||||
owner /var/lib/*/.gnupg/private-keys-v1.d/ rw,
|
||||
owner /var/lib/*/.gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
|
||||
owner /var/lib/*/.gnupg/S.gpg-agent rw,
|
||||
|
||||
owner /var/lib/*/gnupg/ rw,
|
||||
owner /var/lib/*/gnupg/private-keys-v1.d/ rw,
|
||||
owner /var/lib/*/gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
|
||||
owner /var/lib/*/gnupg/S.gpg-agent rw,
|
||||
|
||||
# For debuild
|
||||
owner /tmp/dpkg-import-key.*/private-keys-v1.d/ w,
|
||||
owner @{run}/user/[0-9]*/gnupg/d.*/S.gpg-agent{,.extra,.browser,.ssh} w,
|
||||
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
|
||||
# PIN-entry apps
|
||||
/{usr/,}bin/pinentry-* rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
# Silencer
|
||||
deny /{usr/,}bin/.gnupg/ w,
|
||||
|
||||
include if exists <local/gpg-agent>
|
||||
}
|
||||
19
apparmor.d/groups/gpg/gpg-connect-agent
Normal file
19
apparmor.d/groups/gpg/gpg-connect-agent
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/gpg-connect-agent
|
||||
profile gpg-connect-agent @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/inputrc r,
|
||||
|
||||
include if exists <local/gpg-connect-agent>
|
||||
}
|
||||
38
apparmor.d/groups/gpg/gpgconf
Normal file
38
apparmor.d/groups/gpg/gpgconf
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/gpgconf
|
||||
profile gpgconf @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}bin/gpg-connect-agent rPx,
|
||||
/{usr/,}bin/gpg rPx,
|
||||
/{usr/,}bin/gpg-agent rPx,
|
||||
/{usr/,}bin/dirmngr rPx,
|
||||
/{usr/,}bin/gpgsm rPx,
|
||||
/{usr/,}lib/gnupg/scdaemon rPx,
|
||||
|
||||
/{usr/,}bin/pinentry-* rPx,
|
||||
|
||||
owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**,
|
||||
|
||||
owner @{PROC}/@{pid}/task/@{tid}/stat rw,
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/etc/inputrc r,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/gpgconf>
|
||||
}
|
||||
23
apparmor.d/groups/gpg/gpgsm
Normal file
23
apparmor.d/groups/gpg/gpgsm
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/gpgsm
|
||||
profile gpgsm @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
deny /usr/bin/.gnupg/ w,
|
||||
|
||||
owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**,
|
||||
|
||||
owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**,
|
||||
|
||||
include if exists <local/gpgsm>
|
||||
}
|
||||
27
apparmor.d/groups/gpg/scdaemon
Normal file
27
apparmor.d/groups/gpg/scdaemon
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/gnupg/scdaemon
|
||||
profile scdaemon @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/devices-usb>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.gnupg/scdaemon.conf r,
|
||||
|
||||
owner @{run}/user/[0-9]*/gnupg/S.scdaemon rw,
|
||||
|
||||
@{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/bConfigurationValue r,
|
||||
|
||||
include if exists <local/scdaemon>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue