felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Various small fixes

Browse source
This commit is contained in:
Jeroen Rijken 2022-09-01 15:37:10 +02:00
parent 2262ae0896
commit 1665b0516f
3 changed files with 42 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/profiles-a-f/blkdeactivate
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}sbin/blkdeactivate
profile blkdeactivate @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} rm,
/{usr/,}sbin/dmsetup rPUx,
@ -18,6 +19,10 @@ profile blkdeactivate @{exec_path} flags=(complain) {
/{usr/,}bin/sort rix,
/{usr/,}bin/umount rPx,
@{sys}/devices/virtual/block/*/holders/ r,
/dev/tty rw,
include if exists <local/blkdeactivate>
}

68
apparmor.d/profiles-a-f/dkms
View file

@ -23,47 +23,47 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
unix (receive) type=stream,
@{exec_path} r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/head rix,
/{usr/,}bin/ls rix,
/{usr/,}bin/uname rix,
/{usr/,}bin/nproc rix,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/cp rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/date rix,
/{usr/,}bin/diff rix,
/{usr/,}bin/wc rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/echo rix,
/{usr/,}bin/find rix,
/{usr/,}bin/getconf rix,
/{usr/,}bin/grep rix,
/{usr/,}bin/head rix,
/{usr/,}bin/kmod rCx -> kmod,
/{usr/,}bin/ln rix,
/{usr/,}bin/ls rix,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/make rix,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/nproc rix,
/{usr/,}bin/pwd rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/uname rix,
/{usr/,}bin/wc rix,
/{usr/,}bin/xargs rix,
/{usr/,}bin/{,@{multiarch}-}* rix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/{,g,m}awk rix,
/{usr/,}bin/cp rix,
/{usr/,}bin/date rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/echo rix,
/{usr/,}bin/pwd rix,
/{usr/,}bin/getconf rix,
/{usr/,}bin/xargs rix,
/{usr/,}{,s}bin/update-secureboot-policy rPUx,
/{usr/,}bin/make rix,
/{usr/,}bin/{,@{multiarch}-}* rix,
/{usr/,}lib/gcc/@{multiarch}/[0-9]*/* rix,
/{usr/,}lib/llvm-[0-9]*/bin/clang rix,
/{usr/,}bin/kmod rCx -> kmod,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}lib/linux-kbuild-*/scripts/** rix,
/{usr/,}lib/modules/*/build/scripts/** rix,
/{usr/,}lib/linux-kbuild-*/tools/objtool/objtool rix,
/{usr/,}lib/gcc/@{multiarch}/[0-9]*/* rix,
/{usr/,}lib/linux-kbuild-*/scripts/** rix,
/{usr/,}lib/linux-kbuild-*/tools/objtool/objtool rix,
/{usr/,}lib/llvm-[0-9]*/bin/clang rix,
/{usr/,}lib/modules/*/build/scripts/** rix,
/{usr/,}lib/modules/*/build/tools/objtool/objtool rix,
/var/lib/dkms/**/configure rix,
/var/lib/dkms/**/dkms.postbuild rix,
/ r,
@ -113,6 +113,8 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
@{PROC}/cmdline r,
/etc/depmod.d/{,*} r,
/{usr/,}lib/modules/*/modules.* rw,
/var/lib/dkms/**/module/*.ko r,

3
apparmor.d/profiles-g-l/lvm
View file

@ -14,6 +14,7 @@ profile lvm @{exec_path} flags=(complain) {
include <abstractions/disks-write>
capability sys_admin,
capability sys_nice,
deny capability net_admin,
@{exec_path} rm,
@ -24,8 +25,8 @@ profile lvm @{exec_path} flags=(complain) {
@{run}/lock/lvm/* rwk,
@{sys}/bus/ r,
@{sys}/devices/virtual/bdi/**/read_ahead_kb r,
@{sys}/class/ r,
@{sys}/devices/virtual/bdi/**/read_ahead_kb r,
@{PROC}/devices r,
owner @{PROC}/@{pid}/cmdline r,