felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update apparmor profiles

Browse source
This commit is contained in:
Mikhail Morfikov 2021-09-07 01:24:39 +02:00 • committed by Alexandre Pujol
parent efda369670
commit 2a6b2bd189
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
70 changed files with 221 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/abstractions/apt-common
View file

@ -11,7 +11,8 @@
/etc/apt/preferences.d/{,*} r,
/etc/apt/sources.list r,
/etc/apt/sources.list.d/{,*.list} r,
/etc/apt/sources.list.d/ r,
/etc/apt/sources.list.d/*.{sources,list} r,
/var/lib/apt/lists/{,**} r,
/var/lib/apt/extended_states r,

5
apparmor.d/abstractions/libvirt-qemu
View file

@ -16,9 +16,11 @@
ptrace (readby, tracedby) peer=libvirtd,
ptrace (readby, tracedby) peer=/usr/sbin/libvirtd,
ptrace (readby, tracedby) peer=virtqemud,
signal (receive) peer=libvirtd,
signal (receive) peer=/usr/sbin/libvirtd,
signal (receive) peer=virtqemud,
/dev/kvm rw,
/dev/net/tun rw,
@ -35,6 +37,8 @@
@{PROC}/sys/vm/overcommit_memory r,
# detect hardware capabilities via qemu_getauxval
owner @{PROC}/*/auxv r,
# allow reading libnl's classid file
/etc/libnl{,-3}/classid r,
# For hostdev access. The actual devices will be added dynamically
/sys/bus/usb/devices/ r,
@ -221,6 +225,7 @@
# allow connect with openGraphicsFD to work
unix (send, receive) type=stream addr=none peer=(label=libvirtd),
unix (send, receive) type=stream addr=none peer=(label=/usr/sbin/libvirtd),
unix (send, receive) type=stream addr=none peer=(label=virtqemud),
# for gathering information about available host resources
/sys/devices/system/cpu/ r,