felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): merge the two packagekitd profiles in one.

Browse source
This commit is contained in:
Alexandre Pujol 2022-12-09 19:12:19 +00:00
parent 90dc848766
commit 2246e8ae63
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 52 additions and 132 deletions
Download patch file Download diff file Expand all files Collapse all files

116
apparmor.d/groups/ubuntu/packagekitd
View file

@ -1,116 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{libexec}/packagekitd
profile packagekitd @{exec_path} {
include <abstractions/base>
include <abstractions/apt-common>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
capability chown,
capability dac_override,
capability dac_read_search,
capability fowner,
capability kill,
capability setgid,
capability setuid,
capability sys_nice,
network netlink raw,
signal send set=int peer=apt-methods-*,
dbus (send,receive) bus=system path=/org/freedesktop/PackageKit
interface=org.freedesktop.{DBus.*,PackageKit},
dbus send bus=system path=/[0-9]*_@{hex}
interface=org.freedesktop.{DBus.Properties,PackageKit.Transaction}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.DBus.Properties
member=GetAll,
dbus send bus=system path=/org/freedesktop/DBus{,/Bus}
interface=org.freedesktop.DBus
member={RequestName,GetConnectionUnixUser},
dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.PolicyKit[0-9].Authority
member=CheckAuthorization,
dbus receive bus=system path=/[0-9]*_@{hex}
interface=org.freedesktop.{DBus.Properties,PackageKit.Transaction},
# peer=(name=org.freedesktop.DBus),
dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
interface=org.freedesktop.PolicyKit[0-9].Authority
member=Changed,
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged},
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.DBus.Properties
member=PropertiesChanged,
dbus receive bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager
member={SessionNew,PrepareForShutdown,SessionRemoved,UserNew,UserRemoved,PrepareForSleep}
peer=(name=:*, label=systemd-logind),
dbus bind bus=system
name=org.freedesktop.PackageKit,
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/appstreamcli rPx,
/{usr/,}bin/dpkg rPx -> child-dpkg,
/{usr/,}bin/echo rix,
/{usr/,}bin/gdbus rix,
/{usr/,}bin/ischroot rix,
/{usr/,}bin/test rix,
/{usr/,}bin/touch rix,
/{usr/,}lib/apt/methods/* rPx,
/{usr/,}lib/cnf-update-db rPx,
/{usr/,}lib/update-notifier/update-motd-updates-available rPx,
/usr/share/dpkg/tupletable r,
/usr/share/dpkg/cputable r,
/etc/PackageKit/PackageKit.conf r,
/etc/machine-id r,
/var/lib/dbus/machine-id r,
/var/cache/apt/ r,
/var/cache/apt/** rwk,
/var/cache/PackageKit/downloads/ r,
/var/lib/apt/lists/** rw,
/var/lib/apt/lists/lock rwk,
/var/lib/apt/periodic/update-success-stamp rw,
/var/lib/dpkg/info/{,*} r,
/var/lib/PackageKit/{,*} rw,
/var/lib/PackageKit/transactions.db rwk,
owner @{run}/systemd/users/@{uid} r,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/mountinfo r,
include if exists <local/packagekitd>
}