felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): add the fusermount abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2025-04-06 15:30:10 +02:00
parent 9aaf109383
commit 1009de7e6c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
15 changed files with 67 additions and 179 deletions
Download patch file Download diff file Expand all files Collapse all files

13
apparmor.d/profiles-s-z/s3fs
View file

@ -38,10 +38,7 @@ profile s3fs @{exec_path} {
profile fusermount {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability dac_read_search,
capability sys_admin,
include <abstractions/app/fusermount>
network inet stream,
network inet6 stream,
@ -52,19 +49,11 @@ profile s3fs @{exec_path} {
umount @{MOUNTS}/,
umount @{MOUNTS}/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{MOUNTS}/ r,
@{MOUNTS}/*/ r,
owner @{tmp}/s3fstmp.* rw,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/s3fs_fusermount>
}

15
apparmor.d/profiles-s-z/wechat-appimage
View file

@ -69,27 +69,14 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) {
profile fusermount {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability dac_override,
capability dac_read_search,
capability sys_admin,
include <abstractions/app/fusermount>
mount fstype=fuse.wechat-appimage.AppImage options=(ro nodev nosuid) -> @{tmp}/.mount_wechat@{word6}/,
umount @{tmp}/.mount_wechat@{word6}/,
@{bin}/fusermount{,3} mr,
@{lib_dirs}/wechat-appimage.AppImage r,
@{PROC}/@{pid}/mounts r,
/etc/fuse.conf r,
/dev/fuse rw,
include if exists <local/wechat-appimage_fusermount>
}