felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2023-09-05 16:42:06 +01:00
parent 1fb5475ad1
commit 155ef6bef1
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
24 changed files with 83 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

12
apparmor.d/groups/bus/dbus-daemon
View file

@ -21,6 +21,11 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
capability setuid,
capability sys_resource,
network netlink raw,
network bluetooth stream,
network bluetooth seqpacket,
signal (receive) set=(term hup kill) peer=at-spi-bus-launcher,
signal (receive) set=(term hup kill) peer=dbus-run-session,
signal (receive) set=(term hup kill) peer=gdm*,
@ -29,13 +34,10 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term hup kill) peer=dconf-service,
signal (send) set=(term hup kill) peer=xdg-permission-store,
network netlink raw,
network bluetooth stream,
network bluetooth seqpacket,
ptrace (read),
unix (send receive accept) type=stream,
@{exec_path} mr,
@{bin}/ r,

3
apparmor.d/groups/freedesktop/polkit-agent-helper
View file

@ -25,9 +25,10 @@ profile polkit-agent-helper @{exec_path} {
network netlink raw,
signal (receive) set=(term, kill) peer=polkit-*-authentication-agent,
signal (receive) set=(term, kill) peer=gnome-shell,
signal (receive) set=(term, kill) peer=pkexec,
signal (receive) set=(term, kill) peer=pkttyagent,
signal (receive) set=(term, kill) peer=polkit-*-authentication-agent,
dbus (send) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.DBus.Properties

2
apparmor.d/groups/gnome/nautilus
View file

@ -59,6 +59,8 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
/usr/share/thumbnailers/{,**} r,
/usr/share/tracker*/{,**} r,
/etc/fstab r,
/var/cache/fontconfig/ r,
/var/lib/snapd/desktop/icons/{,**} r,

2
apparmor.d/groups/kde/kioslave5
View file

@ -19,9 +19,9 @@ profile kioslave5 @{exec_path} {
include <abstractions/openssl>
include <abstractions/qt5>
include <abstractions/ssl_certs>
include <abstractions/thumbnails-cache-read>
include <abstractions/trash>
include <abstractions/vulkan>
include <abstractions/thumbnails-cache-read>
network inet dgram,
network inet6 dgram,

15
apparmor.d/groups/systemd/hostnamectl
View file

@ -19,6 +19,21 @@ profile hostnamectl @{exec_path} {
member=Set*Hostname
peer=(name=org.freedesktop.hostname1),
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.DBus.Properties
member={Get,GetAll}
peer=(name=org.freedesktop.hostname1),
dbus send bus=system path=/org/freedesktop/hostname1
interface=org.freedesktop.hostname1
member=Set*Hostname
peer=(name=org.freedesktop.hostname1),
dbus send bus=system path=/org/freedesktop/systemd1
interface=org.freedesktop.DBus.Properties
member=GetAll
peer=(name=org.freedesktop.systemd1),
@{exec_path} mr,
/etc/machine-id r,

1
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -54,6 +54,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/dmi/id/{product_name,product_version,chassis_type} r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/dmi/id/uevent r,
@{sys}/firmware/acpi/pm_profile r,
@{sys}/firmware/dmi/entries/*/raw r,
include if exists <local/systemd-hostnamed>

2
apparmor.d/groups/systemd/systemd-machine-id-setup
View file

@ -19,7 +19,7 @@ profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) {
ptrace (read),
mount /,
mount flags=(rw rslave) -> /,
umount /etc/machine-id,
@{exec_path} mr,

3
apparmor.d/groups/systemd/systemd-networkd
View file

@ -65,7 +65,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
owner @{run}/systemd/netif/.#state* rw,
owner @{run}/systemd/netif/leases/{,*} rw,
owner @{run}/systemd/netif/links/{,*} rw,
owner @{run}/systemd/netif/lldp/ rw,
owner @{run}/systemd/netif/lldp/{,*} rw,
owner @{run}/systemd/netif/state rw,
@{run}/udev/data/n@{int} r,
@ -74,6 +74,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
@{sys}/devices/pci[0-9]*/**/ r,
@{sys}/devices/virtual/dmi/id/{sys,board,bios}_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/product_version r,
@{PROC}/sys/net/ipv{4,6}/** rw,

1
apparmor.d/groups/systemd/systemd-oomd
View file

@ -33,6 +33,7 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
@{sys}/fs/cgroup/cgroup.controllers r,
@{sys}/fs/cgroup/memory.pressure r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}0.service/memory.* r,
@{PROC}/pressure/{cpu,io,memory} r,

4
apparmor.d/groups/systemd/systemd-remount-fs
View file

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -30,6 +30,8 @@ profile systemd-remount-fs @{exec_path} {
@{run}/mount/utab.@{rand6} rw,
@{run}/mount/utab.lock rwk,
@{sys}/devices/virtual/block/dm-@{int}/dm/name r,
@{PROC}/ r,
@{PROC}/1/cmdline r,

11
apparmor.d/groups/systemd/systemd-udevd
View file

@ -37,23 +37,28 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
@{bin}/{,ba,da}sh rix,
@{bin}/{,e}grep rix,
@{bin}/*-print-pci-ids rix,
@{bin}/cat rix,
@{bin}/chgrp rix,
@{bin}/chmod rix,
@{bin}/cut rix,
@{bin}/dmsetup rPUx,
@{bin}/ln rix,
@{bin}/logger rix,
@{bin}/lvm rPx,
@{bin}/mknod rPx,
@{bin}/multipath rPx,
@{bin}/nohup rix,
@{bin}/perl rix,
@{bin}/readlink rix,
@{bin}/sed rix,
@{bin}/setfacl rix,
@{bin}/sg_inq rix,
@{bin}/snap rPx,
@{bin}/unshare rix,
@{bin}/lvm rPx,
@{bin}/systemctl rCx -> systemctl,
@{bin}/touch rix,
@{bin}/unshare rix,
@{bin}/systemctl rCx -> systemctl,
@{lib}/crda/* rPUx,
@{lib}/gdm-runtime-config rPx,
@{lib}/nfsrahead rPUx,