feat(fsp): add/update systemd drop in files with AppArmorProfile set to the target profile.

2025-05-29 23:20:32 +02:00 · 2025-05-29 23:20:32 +02:00 · 1aa0142a6a
commit 1aa0142a6a
parent 8ff829542d
31 changed files with 52 additions and 12 deletions
--- a/systemd/full/system/apport-coredump-hook@.service
+++ b/systemd/full/system/apport-coredump-hook@.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&apport
--- a/systemd/full/system/apt-news.service
+++ b/systemd/full/system/apt-news.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&apt_news
--- a/systemd/full/system/bluetooth.service
+++ b/systemd/full/system/bluetooth.service
@ -1,2 +1,2 @@
 [Service]
-NoNewPrivileges=no
+AppArmorProfile=&bluetoothd
--- a/systemd/full/system/cloud-init-hotplugd.service
+++ b/systemd/full/system/cloud-init-hotplugd.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&cloud-init-hotplugd.service
--- a/systemd/full/system/colord.service
+++ b/systemd/full/system/colord.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&colord
--- a/systemd/full/system/debug-shell.service
+++ b/systemd/full/system/debug-shell.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=debug-shell.service
--- a/systemd/full/system/dmesg.service
+++ b/systemd/full/system/dmesg.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=dmesg.service
--- a/systemd/full/system/fwupd.service
+++ b/systemd/full/system/fwupd.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&fwupd
--- a/systemd/full/system/grub-common.service
+++ b/systemd/full/system/grub-common.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=grub-common.service
--- a/systemd/full/system/ldconfig.service
+++ b/systemd/full/system/ldconfig.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=ldconfig.service
--- a/systemd/full/system/logrotate.service
+++ b/systemd/full/system/logrotate.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&logrotate
--- a/systemd/full/system/low-memory-monitor.service
+++ b/systemd/full/system/low-memory-monitor.service
@ -1,3 +0,0 @@
-[Service]
-NoNewPrivileges=no
-
--- a/systemd/full/system/man-db.service
+++ b/systemd/full/system/man-db.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=man-db.service
--- a/systemd/full/system/paccache.service
+++ b/systemd/full/system/paccache.service
@ -1,2 +0,0 @@
-[Service]
-NoNewPrivileges=no
--- a/systemd/full/system/passim.service
+++ b/systemd/full/system/passim.service
@ -1,2 +0,0 @@
-[Service]
-NoNewPrivileges=no
--- a/systemd/full/system/pcscd.service
+++ b/systemd/full/system/pcscd.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&pcscd
--- a/systemd/full/system/power-profiles-daemon.service
+++ b/systemd/full/system/power-profiles-daemon.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&power-profiles-daemon
--- a/systemd/full/system/reflector.service
+++ b/systemd/full/system/reflector.service
@ -1,2 +0,0 @@
-[Service]
-NoNewPrivileges=no
--- a/systemd/full/system/rsyslog.service
+++ b/systemd/full/system/rsyslog.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&rsyslogd
--- a/systemd/full/system/secureboot-db.service
+++ b/systemd/full/system/secureboot-db.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=secureboot-db.service
--- a/systemd/full/system/shadow.service
+++ b/systemd/full/system/shadow.service
@ -1,3 +1,2 @@
 [Service]
-NoNewPrivileges=no
-
+AppArmorProfile=&shadow.service
--- a/systemd/full/system/snapd.system-shutdown.service
+++ b/systemd/full/system/snapd.system-shutdown.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=snapd.system-shutdown.service
--- a/systemd/full/system/system-update-cleanup.service
+++ b/systemd/full/system/system-update-cleanup.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=system-update-cleanup.service
--- a/systemd/full/system/systemd-coredump@.service
+++ b/systemd/full/system/systemd-coredump@.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-coredump
--- a/systemd/full/system/systemd-initctl.service
+++ b/systemd/full/system/systemd-initctl.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-initctl
--- a/systemd/full/system/systemd-journal-remote.service
+++ b/systemd/full/system/systemd-journal-remote.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-journal-remote
--- a/systemd/full/system/systemd-nsresourced.service
+++ b/systemd/full/system/systemd-nsresourced.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-nsresourced
--- a/systemd/full/system/systemd-oomd.service
+++ b/systemd/full/system/systemd-oomd.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-oomd
--- a/systemd/full/system/systemd-rfkill.service
+++ b/systemd/full/system/systemd-rfkill.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-rfkill
--- a/systemd/full/system/systemd-timesyncd.service
+++ b/systemd/full/system/systemd-timesyncd.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-timesyncd
--- a/systemd/full/system/usb_modeswitch@.service
+++ b/systemd/full/system/usb_modeswitch@.service
@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=usb_modeswitch.service