felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles) add initial support for ubuntu 22.04

Browse source
This commit is contained in:
Alexandre Pujol 2022-05-21 16:49:45 +01:00
parent 3ac7d41bf5
commit 0dbe0d2790
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
33 changed files with 253 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

24
apparmor.d/groups/systemd/systemd-udevd
View file

@ -11,8 +11,8 @@ include <tunables/global>
@{exec_path} += /{usr/,}lib/systemd/systemd-udevd
profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/systemd-common>
capability chown,
@ -49,13 +49,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
/{usr/,}{s,}bin/* rPUx,
/{usr/,}lib/udev/* rPUx,
/{usr/,}lib/systemd/systemd-* rPx,
/{usr/,}lib/crda/* rPUx,
/{usr/,}lib/gdm-runtime-config rPx,
/{usr,/}lib/pm-utils/power.d/* PUx,
/usr/share/hplip/config_usb_printer.py rPUx,
/{usr,/}lib/pm-utils/power.d/* rPUx,
/{usr,/}lib/snapd/snap-device-helper rPx, # TODO: but later
/{usr/,}lib/crda/* rPUx,
/{usr/,}lib/gdm-runtime-config rPx,
/{usr/,}lib/systemd/systemd-* rPx,
/{usr/,}lib/udev/* rPUx,
/usr/share/hplip/config_usb_printer.py rPUx,
/etc/console-setup/*.sh rPUx,
@ -83,20 +83,18 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
@{run}/udev/** rw,
@{run}/systemd/seats/seat[0-9]* r,
@{run}/systemd/notify rw,
@{sys}/** rw,
/dev/ rw,
/dev/** rwk,
owner @{PROC}/@{pid}/loginuid r,
owner @{PROC}/@{pid}/oom_score_adj rw,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/devices r,
# file_inherit
owner @{HOME}/.xsession-errors w,
/dev/ rw,
/dev/** rwk,
deny /apparmor/.null rw,