felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-11-20 11:42:08 +00:00
parent 0837c158cb
commit 1fa427ca81
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
8 changed files with 34 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

42
apparmor.d/groups/systemd/coredumpctl
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -21,10 +22,8 @@ profile coredumpctl @{exec_path} flags=(complain) {
/{usr/,}bin/more rPx -> child-pager,
/{usr/,}bin/pager rPx -> child-pager,
owner /tmp/*.coredump w,
owner /tmp/core.* w,
owner /var/tmp/coredump-* rw,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/var/lib/systemd/coredump/core.*.[0-9]*.@{hex}.[0-9]*.[0-9]*.zst r,
@ -34,39 +33,38 @@ profile coredumpctl @{exec_path} flags=(complain) {
/{run,var}/log/journal/@{hex}/system.journal* r,
/{run,var}/log/journal/@{hex}/system@@{hex}.journal* r,
owner @{PROC}/@{pid}/cgroup r,
owner /tmp/*.coredump w,
owner /tmp/core.* w,
owner /var/tmp/coredump-* rw,
@{PROC}/1/cgroup r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{PROC}/@{pid}/cgroup r,
profile gdb {
include <abstractions/base>
include <abstractions/python>
include <abstractions/openssl>
include <abstractions/python>
ptrace (trace),
/{usr/,}bin/gdb mr,
/{usr/,}bin/gdb mr,
/{usr/,}bin/iconv rix,
/{usr/,}bin/iconv rix,
/{usr/,}bin/* r,
/{usr/,}sbin/* r,
/{usr/,}{s,}bin/* r,
@{PROC}/@{pids}/fd/ r,
/etc/inputrc r,
/etc/gdb/** r,
/usr/share/gdb/{,**} r,
/usr/share/glib-2.0/gdb/{,**} r,
/usr/share/gcc-[0-9]*/python/{,**} r,
/usr/share/gcc/** r,
/usr/share/gdb/{,**} r,
/usr/share/glib-2.0/gdb/{,**} r,
/usr/share/terminfo/x/xterm-256color r,
/etc/inputrc r,
/etc/gdb/** r,
owner /var/tmp/coredump-* rw,
@{PROC}/@{pids}/fd/ r,
# Silencer
deny /usr/share/** w,

3
apparmor.d/groups/systemd/systemd-backlight
View file

@ -24,6 +24,7 @@ profile systemd-backlight @{exec_path} {
@{run}/udev/data/+leds:*backlight* r,
@{sys}/bus/ r,
@{sys}/bus/pci/devices/ r,
@{sys}/class/ r,
@{sys}/class/backlight/ r,
@ -34,7 +35,7 @@ profile systemd-backlight @{exec_path} {
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{max_brightness,actual_brightness} r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{uevent,type} r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/brightness rw,
@{sys}/devices/pci[0-9]*/*/uevent r,
@{sys}/devices/pci[0-9]*/**/uevent r,
@{sys}/devices/platform/**/leds/*backlight*/brightness rw,
@{sys}/devices/platform/**/leds/*backlight*/max_brightness r,