felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): restrict some access to @{PROC}/@{pid}.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-25 14:00:29 +01:00
parent 90a8e44d20
commit 28b32f1ae3
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
10 changed files with 31 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/groups/gnome/gnome-shell
View file

@ -347,23 +347,23 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/cpu.max r,
@{PROC}/ r,
@{PROC}/@{pid}/attr/current r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/cmdline r,
@{PROC}/@{pid}/net/* r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/@{tid}/stat r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/1/cgroup r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
@{PROC}/vmstat r,
owner @{PROC}/@{pid}/attr/current r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/@{pid}/cmdline r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
/dev/input/event@{int} rw,
/dev/media@{int} rw,