felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

General update

Browse source
This commit is contained in:
Jeroen Rijken 2022-08-01 18:31:32 +02:00 • committed by Alex
parent 575d781c88
commit 099a97cb36
26 changed files with 137 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

12
apparmor.d/profiles-m-r/mkinitramfs
View file

@ -1,6 +1,7 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -53,10 +54,11 @@ profile mkinitramfs @{exec_path} {
/{usr/,}bin/xz rix,
/{usr/,}bin/zstd rix,
/{usr/,}bin/ldd rCx -> ldd,
/{usr/,}sbin/ldconfig rCx -> ldconfig,
/{usr/,}bin/find rCx -> find,
/{usr/,}bin/kmod rCx -> kmod,
/{usr/,}bin/ldd rCx -> ldd,
/{usr/,}lib{32,64}/ld-linux.so.2 rCx -> ldd,
/{usr/,}sbin/ldconfig rCx -> ldconfig,
/{usr/,}bin/find rCx -> find,
/{usr/,}bin/kmod rCx -> kmod,
/{usr/,}bin/dpkg rPx -> child-dpkg,
/{usr/,}bin/linux-version rPx,
@ -103,7 +105,7 @@ profile mkinitramfs @{exec_path} {
/{usr/,}lib/initramfs-tools/bin/* mr,
/{usr/,}lib/@{multiarch}/ld-*.so* rix,
/{usr/,}lib{,x}32/ld-*.so rix,
/{usr/,}lib{,x}32/ld-*.so{,.2} rix,
}

1
apparmor.d/profiles-m-r/mount-zfs
View file

@ -12,6 +12,7 @@ profile mount-zfs @{exec_path} flags=(complain) {
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability dac_read_search,
capability sys_admin, # To mount anything.
@{exec_path} mr,

4
apparmor.d/profiles-m-r/run-parts
View file

@ -1,6 +1,7 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -142,6 +143,7 @@ profile run-parts @{exec_path} {
profile kernel {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_module,
@ -151,7 +153,7 @@ profile run-parts @{exec_path} {
/{usr/,}bin/chmod rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/dirname rix,
/{usr/,}bin/gawk rix,
/{usr/,}bin/{,m,g}awk rix,
/{usr/,}bin/kmod rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/rm rix,