felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(profiles): use @{bin} and @{lib} in profiles (3)

Browse source
This commit is contained in:
Alexandre Pujol 2023-07-09 14:09:55 +01:00
parent 2eed3b725f
commit 27daa7c9bb
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
355 changed files with 1473 additions and 1472 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/grub/grub-bios-setup
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-bios-setup
@{exec_path} = @{bin}/grub-bios-setup
profile grub-bios-setup @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

8
apparmor.d/groups/grub/grub-check-signatures
View file

@ -13,10 +13,10 @@ profile grub-check-signatures @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{m,g,}awk rix,
/{usr/,}bin//mktemp rix,
/{usr/,}bin//od rix,
@{bin}/{,ba,da}sh rix,
@{bin}/{m,g,}awk rix,
@{bin}//mktemp rix,
@{bin}//od rix,
/usr/share/debconf/frontend rPx,

2
apparmor.d/groups/grub/grub-editenv
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-editenv
@{exec_path} = @{bin}/grub-editenv
profile grub-editenv @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-file
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-file
@{exec_path} = @{bin}/grub-file
profile grub-file @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-fstest
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-fstest
@{exec_path} = @{bin}/grub-fstest
profile grub-fstest @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-glue-efi
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-glue-efi
@{exec_path} = @{bin}/grub-glue-efi
profile grub-glue-efi @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

12
apparmor.d/groups/grub/grub-install
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-install
@{exec_path} = @{bin}/grub-install
profile grub-install @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
@ -18,11 +18,11 @@ profile grub-install @{exec_path} flags=(complain) {
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/efibootmgr rix,
/{usr/,}bin/kmod rPx,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/udevadm rPx,
@{bin}/{,ba,da}sh rix,
@{bin}/efibootmgr rix,
@{bin}/kmod rPx,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/udevadm rPx,
/usr/share/grub/{,**} r,

2
apparmor.d/groups/grub/grub-kbdcomp
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-kbdcomp
@{exec_path} = @{bin}/grub-kbdcomp
profile grub-kbdcomp @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-macbless
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-macbless
@{exec_path} = @{bin}/grub-macbless
profile grub-macbless @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-menulst2cfg
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-menulst2cfg
@{exec_path} = @{bin}/grub-menulst2cfg
profile grub-menulst2cfg @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

78
apparmor.d/groups/grub/grub-mkconfig
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-mkconfig
@{exec_path} = @{bin}/grub-mkconfig
profile grub-mkconfig @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -19,44 +19,44 @@ profile grub-mkconfig @{exec_path} {
/{usr/,}{local/,}{s,}bin/zfs rPx,
/{usr/,}{local/,}{s,}bin/zpool rPx,
/{usr/,}{s,}bin/dmsetup rPUx,
/{usr/,}{s,}bin/grub-probe rPx,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{e,f,}grep rix,
/{usr/,}bin/{m,g,}awk rix,
/{usr/,}bin/basename rix,
/{usr/,}bin/btrfs rPx,
/{usr/,}bin/cat rix,
/{usr/,}bin/chmod rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/date rix,
/{usr/,}bin/dirname rix,
/{usr/,}bin/dpkg rPx,
/{usr/,}bin/find rix,
/{usr/,}bin/findmnt rPx,
/{usr/,}bin/gettext rix,
/{usr/,}bin/grub-mkrelpath rPx,
/{usr/,}bin/grub-script-check rPx,
/{usr/,}bin/head rix,
/{usr/,}bin/id rPx,
/{usr/,}bin/ls rix,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/mount rPx,
/{usr/,}bin/mountpoint rix,
/{usr/,}bin/os-prober rPx,
/{usr/,}bin/paste rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/sort rix,
/{usr/,}bin/stat rix,
/{usr/,}bin/tail rix,
/{usr/,}bin/tr rix,
/{usr/,}bin/umount rPx,
/{usr/,}bin/uname rix,
/{usr/,}bin/which{.debianutils,} rix,
@{bin}/dmsetup rPUx,
@{bin}/grub-probe rPx,
@{bin}/{,ba,da}sh rix,
@{bin}/{e,f,}grep rix,
@{bin}/{m,g,}awk rix,
@{bin}/basename rix,
@{bin}/btrfs rPx,
@{bin}/cat rix,
@{bin}/chmod rix,
@{bin}/cut rix,
@{bin}/date rix,
@{bin}/dirname rix,
@{bin}/dpkg rPx,
@{bin}/find rix,
@{bin}/findmnt rPx,
@{bin}/gettext rix,
@{bin}/grub-mkrelpath rPx,
@{bin}/grub-script-check rPx,
@{bin}/head rix,
@{bin}/id rPx,
@{bin}/ls rix,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/mktemp rix,
@{bin}/mount rPx,
@{bin}/mountpoint rix,
@{bin}/os-prober rPx,
@{bin}/paste rix,
@{bin}/readlink rix,
@{bin}/rm rix,
@{bin}/rmdir rix,
@{bin}/sed rix,
@{bin}/sort rix,
@{bin}/stat rix,
@{bin}/tail rix,
@{bin}/tr rix,
@{bin}/umount rPx,
@{bin}/uname rix,
@{bin}/which{.debianutils,} rix,
/etc/grub.d/{**,} rix,
/boot/{**,} r,

2
apparmor.d/groups/grub/grub-mkdevicemap
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-mkdevicemap
@{exec_path} = @{bin}/grub-mkdevicemap
profile grub-mkdevicemap @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mkfont
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mkfont
@{exec_path} = @{bin}/grub-mkfont
profile grub-mkfont @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mkimage
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mkimage
@{exec_path} = @{bin}/grub-mkimage
profile grub-mkimage @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mklayout
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mklayout
@{exec_path} = @{bin}/grub-mklayout
profile grub-mklayout @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mknetdir
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mknetdir
@{exec_path} = @{bin}/grub-mknetdir
profile grub-mknetdir @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mkpasswd-pbkdf2
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mkpasswd-pbkdf2
@{exec_path} = @{bin}/grub-mkpasswd-pbkdf2
profile grub-mkpasswd-pbkdf2 @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mkrelpath
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-mkrelpath
@{exec_path} = @{bin}/grub-mkrelpath
profile grub-mkrelpath @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mkrescue
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mkrescue
@{exec_path} = @{bin}/grub-mkrescue
profile grub-mkrescue @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mkstandalone
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mkstandalone
@{exec_path} = @{bin}/grub-mkstandalone
profile grub-mkstandalone @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-mount
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-mount
@{exec_path} = @{bin}/grub-mount
profile grub-mount @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

22
apparmor.d/groups/grub/grub-multi-install
View file

@ -6,23 +6,23 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/grub/grub-multi-install
@{exec_path} = @{lib}/grub/grub-multi-install
profile grub-multi-install @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
/{usr/,}{s,}bin/grub-install rPx,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/dpkg-query rpx,
/{usr/,}bin/readlink rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/sort rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/udevadm rPx,
@{bin}/grub-install rPx,
@{bin}/{,ba,da}sh rix,
@{bin}/{,e}grep rix,
@{bin}/cat rix,
@{bin}/dpkg-query rpx,
@{bin}/readlink rix,
@{bin}/sed rix,
@{bin}/sort rix,
@{bin}/touch rix,
@{bin}/udevadm rPx,
/usr/share/debconf/frontend rPx,
/usr/lib/terminfo/x/xterm-256color r,

2
apparmor.d/groups/grub/grub-ntldr-img
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-ntldr-img
@{exec_path} = @{bin}/grub-ntldr-img
profile grub-ntldr-img @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

8
apparmor.d/groups/grub/grub-probe
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-probe
@{exec_path} = @{bin}/grub-probe
profile grub-probe @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -18,9 +18,9 @@ profile grub-probe @{exec_path} {
@{exec_path} mr,
/{usr/,}{local/,}{s,}bin/zpool rPx,
/{usr/,}{s,}bin/lvm rPx,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/udevadm rPx,
@{bin}/lvm rPx,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/udevadm rPx,
/ r,
/usr/share/grub/* r,

2
apparmor.d/groups/grub/grub-reboot
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-reboot
@{exec_path} = @{bin}/grub-reboot
profile grub-reboot @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-render-label
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-render-label
@{exec_path} = @{bin}/grub-render-label
profile grub-render-label @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-script-check
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-script-check
@{exec_path} = @{bin}/grub-script-check
profile grub-script-check @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-set-default
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/grub-set-default
@{exec_path} = @{bin}/grub-set-default
profile grub-set-default @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-syslinux2cfg
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/grub-syslinux2cfg
@{exec_path} = @{bin}/grub-syslinux2cfg
profile grub-syslinux2cfg @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

6
apparmor.d/groups/grub/update-grub
View file

@ -6,14 +6,14 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/update-grub{2,}
@{exec_path} = @{bin}/update-grub{2,}
profile update-grub @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}{s,}bin/grub-mkconfig rPx,
@{bin}/{,ba,da}sh rix,
@{bin}/grub-mkconfig rPx,
include if exists <local/update-grub>
}