felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles) add initial support for ubuntu 22.04

Browse source
This commit is contained in:
Alexandre Pujol 2022-05-21 16:49:45 +01:00
parent 3ac7d41bf5
commit 0dbe0d2790
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
33 changed files with 253 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-hostnamed
profile systemd-hostnamed @{exec_path} {
profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/systemd-common>

2
apparmor.d/groups/systemd/systemd-localed
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-localed
profile systemd-localed @{exec_path} {
profile systemd-localed @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/systemd-common>

62
apparmor.d/groups/systemd/systemd-logind
View file

@ -7,14 +7,16 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-logind
profile systemd-logind @{exec_path} flags=(complain) {
profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/disks-write>
include <abstractions/devices-usb>
include <abstractions/systemd-common>
capability chown,
capability dac_override,
capability dac_read_search,
capability fowner,
capability sys_admin,
capability sys_tty_config,
@ -42,6 +44,10 @@ profile systemd-logind @{exec_path} flags=(complain) {
@{run}/udev/tags/uaccess/ r,
@{run}/udev/static_node-tags/uaccess/ r,
@{run}/udev/data/+backlight:intel_backlight r,
@{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+pci* r,
@{run}/udev/data/c10:[0-9]* r,
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@ -52,46 +58,35 @@ profile systemd-logind @{exec_path} flags=(complain) {
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
@{run}/udev/data/+backlight:intel_backlight r,
@{run}/udev/data/+pci* r,
@{run}/systemd/inhibit/ rw,
@{run}/systemd/inhibit/.#* rw,
@{run}/systemd/inhibit/[0-9]*{,.ref} rw,
@{run}/systemd/seats/ rw,
@{run}/systemd/seats/.#seat* rw,
@{run}/systemd/seats/seat[0-9]* rw,
@{run}/systemd/inhibit/ rw,
@{run}/systemd/inhibit/[0-9]*{,.ref} rw,
@{run}/systemd/inhibit/.#* rw,
@{run}/systemd/sessions/ rw,
@{run}/systemd/sessions/[0-9]*{,.ref} rw,
@{run}/systemd/sessions/.#* rw,
@{run}/systemd/users/ rw,
@{run}/systemd/users/@{uid} rw,
@{run}/systemd/users/.#* rw,
@{run}/systemd/sessions/[0-9]*{,.ref} rw,
@{run}/systemd/userdb/ r,
@{run}/systemd/users/ rw,
@{run}/systemd/users/.#* rw,
@{run}/systemd/users/@{uid} rw,
/dev/input/event[0-9]* rw, # Input devices (keyboard, mouse, etc)
/dev/dri/card[0-9]* rw,
/dev/tty[0-9]* rw,
/dev/nvme* r,
/dev/shm/{,**/} r,
/dev/mqueue/ r,
@{sys}/module/vt/parameters/default_utf8 r,
@{sys}/fs/cgroup/memory/memory.limit_in_bytes r,
@{sys}/fs/cgroup/memory.max r,
@{sys}/devices/virtual/tty/tty[0-9]*/active r,
@{sys}/devices/**/{uevent,enabled,status} r,
@{sys}/devices/**/brightness rw,
@{run}/systemd/journal/socket rw,
@{run}/systemd/notify rw,
@{sys}/class/drm/ r,
@{sys}/power/{state,resume_offset,resume,disk} r,
@{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndications-@{uuid} r,
@{sys}/devices/**/{uevent,enabled,status} r,
@{sys}/devices/**/brightness rw,
@{sys}/devices/virtual/tty/tty[0-9]*/active r,
@{sys}/firmware/efi/efivars/LoaderEntries-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderFeatures-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndications-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r,
@{sys}/fs/cgroup/memory.max r,
@{sys}/fs/cgroup/memory/memory.limit_in_bytes r,
@{sys}/module/vt/parameters/default_utf8 r,
@{sys}/power/{state,resume_offset,resume,disk} r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/comm r,
@ -103,5 +98,12 @@ profile systemd-logind @{exec_path} flags=(complain) {
@{PROC}/swaps r,
@{PROC}/sysvipc/{shm,sem,msg} r,
/dev/dri/card[0-9]* rw,
/dev/input/event[0-9]* rw, # Input devices (keyboard, mouse, etc)
/dev/mqueue/ r,
/dev/nvme* r,
/dev/shm/{,**/} rw,
/dev/tty[0-9]* rw,
include if exists <local/systemd-logind>
}

3
apparmor.d/groups/systemd/systemd-timedated
View file

@ -7,8 +7,9 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-timedated
profile systemd-timedated @{exec_path} {
profile systemd-timedated @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/systemd-common>
capability sys_time,

4
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -28,10 +28,10 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
owner /var/lib/systemd/timesync/clock rw,
owner @{run}/systemd/journal/socket w,
owner @{run}/systemd/notify rw,
owner @{run}/systemd/timesync/synchronized rw,
@{run}/systemd/netif/state r,
@{run}/resolvconf/*.conf r,
@{run}/systemd/netif/state r,
@{run}/systemd/notify rw,
include if exists <local/systemd-timesyncd>
}

24
apparmor.d/groups/systemd/systemd-udevd
View file

@ -11,8 +11,8 @@ include <tunables/global>
@{exec_path} += /{usr/,}lib/systemd/systemd-udevd
profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/systemd-common>
capability chown,
@ -49,13 +49,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
/{usr/,}{s,}bin/* rPUx,
/{usr/,}lib/udev/* rPUx,
/{usr/,}lib/systemd/systemd-* rPx,
/{usr/,}lib/crda/* rPUx,
/{usr/,}lib/gdm-runtime-config rPx,
/{usr,/}lib/pm-utils/power.d/* PUx,
/usr/share/hplip/config_usb_printer.py rPUx,
/{usr,/}lib/pm-utils/power.d/* rPUx,
/{usr,/}lib/snapd/snap-device-helper rPx, # TODO: but later
/{usr/,}lib/crda/* rPUx,
/{usr/,}lib/gdm-runtime-config rPx,
/{usr/,}lib/systemd/systemd-* rPx,
/{usr/,}lib/udev/* rPUx,
/usr/share/hplip/config_usb_printer.py rPUx,
/etc/console-setup/*.sh rPUx,
@ -83,20 +83,18 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
@{run}/udev/** rw,
@{run}/systemd/seats/seat[0-9]* r,
@{run}/systemd/notify rw,
@{sys}/** rw,
/dev/ rw,
/dev/** rwk,
owner @{PROC}/@{pid}/loginuid r,
owner @{PROC}/@{pid}/oom_score_adj rw,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/devices r,
# file_inherit
owner @{HOME}/.xsession-errors w,
/dev/ rw,
/dev/** rwk,
deny /apparmor/.null rw,