felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): add the fusermount abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2025-04-06 15:30:10 +02:00
parent 9aaf109383
commit 1009de7e6c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
15 changed files with 67 additions and 179 deletions
Download patch file Download diff file Expand all files Collapse all files

13
apparmor.d/groups/bluetooth/obexautofs
View file

@ -36,20 +36,13 @@ profile obexautofs @{exec_path} {
profile fusermount {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability sys_admin,
include <abstractions/app/fusermount>
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/,
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
umount @{HOME}/*/,
umount @{HOME}/*/*/,
include if exists <local/obexautofs_fusermount>
}

15
apparmor.d/groups/bluetooth/obexfs
View file

@ -27,26 +27,17 @@ profile obexfs @{exec_path} {
/dev/fuse rw,
profile fusermount {
include <abstractions/base>
include <abstractions/nameservice-strict>
# To mount anything:
capability sys_admin,
include <abstractions/app/fusermount>
network bluetooth stream,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
/dev/fuse rw,
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/,
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/*/,
@{PROC}/@{pid}/mounts r,
umount @{HOME}/*/,
umount @{HOME}/*/*/,
include if exists <local/obexfs_fusermount>
}

13
apparmor.d/groups/flatpak/flatpak
View file

@ -144,22 +144,11 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
profile fusermount {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_admin,
include <abstractions/app/fusermount>
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/flatpak_fusermount>
}

16
apparmor.d/groups/freedesktop/xdg-document-portal
View file

@ -63,10 +63,11 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
profile fusermount flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/app/fusermount>
capability sys_admin,
capability dac_read_search,
capability dac_override,
capability setuid,
mount options=(rw, rprivate) -> /,
mount options=(rw, rbind) @{run}/user/@{uid}/ -> /,
@ -76,16 +77,13 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
unix (send receive) type=stream peer=(label=xdg-document-portal),
@{bin}/fusermount{,3} mr,
/etc/fuse{,3}.conf r,
@{bin}/mount rix,
@{bin}/umount rix,
owner @{run}/user/@{uid}/doc/ rw,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
@{att}/dev/tty@{int} rw,
@{run}/mount/utab r,
@{run}/mount/utab.* rwk,
include if exists <local/xdg-document-portal_fusermount>
}

12
apparmor.d/groups/gnome/gnome-software
View file

@ -164,21 +164,11 @@ profile gnome-software @{exec_path} {
profile fusermount {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability sys_admin,
include <abstractions/app/fusermount>
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/gnome-software_fusermount>
}

15
apparmor.d/groups/gvfs/gvfsd-fuse
View file

@ -40,24 +40,17 @@ profile gvfsd-fuse @{exec_path} {
profile fusermount {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/app/fusermount>
capability dac_read_search,
capability sys_admin, # To mount anything
capability setuid,
mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/gvfs/,
umount @{run}/user/@{uid}/**/,
unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse),
@{bin}/fusermount{,3} mr,
/etc/fuse{,3}.conf r,
/etc/machine-id r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
@{bin}/mount rix,
@{bin}/umount rix,
include if exists <local/gvfsd-fuse_fusermount>
}

12
apparmor.d/groups/ssh/sshfs
View file

@ -31,9 +31,7 @@ profile sshfs @{exec_path} flags=(complain) {
profile fusermount flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability sys_admin,
include <abstractions/app/fusermount>
mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/,
mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/*/,
@ -51,14 +49,6 @@ profile sshfs @{exec_path} flags=(complain) {
unix (connect, send, receive) type=stream peer=(label="sshfs",addr=none),
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
include if exists <local/sshfs_fusermount>
}