feat(profile): various improvements and update.

2024-12-25 00:05:36 +01:00 · 2024-12-25 00:05:36 +01:00 · 2560e9645f
commit 2560e9645f
parent 57ddfd29ce
20 changed files with 22 additions and 16 deletions
--- a/apparmor.d/groups/systemd/bootctl
+++ b/apparmor.d/groups/systemd/bootctl
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{bin}/bootctl
-profile bootctl @{exec_path} {
+profile bootctl @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/disks-read>
--- a/apparmor.d/groups/systemd/busctl
+++ b/apparmor.d/groups/systemd/busctl
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{bin}/busctl
-profile busctl @{exec_path} {
+profile busctl @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/bus-accessibility>
  include <abstractions/bus-session>
--- a/apparmor.d/groups/systemd/systemd-backlight
+++ b/apparmor.d/groups/systemd/systemd-backlight
@ -8,7 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-backlight
-profile systemd-backlight @{exec_path} {
+profile systemd-backlight @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/systemd>

--- a/apparmor.d/groups/systemd/systemd-cryptsetup
+++ b/apparmor.d/groups/systemd/systemd-cryptsetup
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{bin}/systemd-cryptsetup @{lib}/systemd/systemd-cryptsetup
-profile systemd-cryptsetup @{exec_path} {
+profile systemd-cryptsetup @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/systemd>
  include <abstractions/disks-write>
--- a/apparmor.d/groups/systemd/systemd-generator-user-autostart
+++ b/apparmor.d/groups/systemd/systemd-generator-user-autostart
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/user-generators/systemd-xdg-autostart-generator
-profile systemd-generator-user-autostart @{exec_path} {
+profile systemd-generator-user-autostart @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/systemd>
  include <abstractions/nameservice-strict>
--- a/apparmor.d/groups/systemd/systemd-generator-user-environment
+++ b/apparmor.d/groups/systemd/systemd-generator-user-environment
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/user-environment-generators/*
-profile systemd-generator-user-environment @{exec_path} {
+profile systemd-generator-user-environment @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/systemd>
  include <abstractions/nameservice-strict>
--- a/apparmor.d/groups/systemd/systemd-journald
+++ b/apparmor.d/groups/systemd/systemd-journald
@ -8,7 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-journald
-profile systemd-journald @{exec_path} {
+profile systemd-journald @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/common/systemd>
--- a/apparmor.d/groups/systemd/systemd-machined
+++ b/apparmor.d/groups/systemd/systemd-machined
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-machined
-profile systemd-machined @{exec_path} {
+profile systemd-machined @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/bus-system>
  include <abstractions/nameservice-strict>
--- a/apparmor.d/groups/systemd/systemd-random-seed
+++ b/apparmor.d/groups/systemd/systemd-random-seed
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-random-seed
-profile systemd-random-seed @{exec_path} {
+profile systemd-random-seed @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/systemd>

--- a/apparmor.d/groups/systemd/systemd-update-done
+++ b/apparmor.d/groups/systemd/systemd-update-done
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-update-done
-profile systemd-update-done @{exec_path} {
+profile systemd-update-done @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>

  capability net_admin,
--- a/apparmor.d/groups/systemd/systemd-update-utmp
+++ b/apparmor.d/groups/systemd/systemd-update-utmp
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-update-utmp
-profile systemd-update-utmp @{exec_path} {
+profile systemd-update-utmp @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/systemd>
  include <abstractions/wutmp>
--- a/apparmor.d/groups/systemd/systemd-user-runtime-dir
+++ b/apparmor.d/groups/systemd/systemd-user-runtime-dir
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-user-runtime-dir
-profile systemd-user-runtime-dir @{exec_path} {
+profile systemd-user-runtime-dir @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/bus-system>
  include <abstractions/bus/org.freedesktop.login1>
--- a/apparmor.d/groups/systemd/systemd-user-sessions
+++ b/apparmor.d/groups/systemd/systemd-user-sessions
@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>

@{exec_path} = @{lib}/systemd/systemd-user-sessions
-profile systemd-user-sessions @{exec_path} {
+profile systemd-user-sessions @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/systemd>