felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): add kernel update/install profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-19 00:00:44 +02:00
parent 6650f45ee0
commit 31e90e6c58
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 168 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

60
apparmor.d/profiles-g-l/kdump-config Normal file
View file

@ -0,0 +1,60 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{sbin}/kdump-config
profile kdump-config @{exec_path} {
include <abstractions/base>
ptrace readby peer=systemd-journald,
@{exec_path} mr,
@{sh_path} ix,
@{bin}/basename ix,
@{bin}/cut ix,
@{bin}/file ix,
@{bin}/find ix,
@{bin}/grep ix,
@{bin}/hexdump ix,
@{bin}/ln ix,
@{bin}/logger ix,
@{bin}/rev ix,
@{bin}/run-parts ix,
@{bin}/sed ix,
@{sbin}/kexec Cx -> kexec,
@{sbin}/sysctl Cx -> sysctl,
/etc/kernel/postinst.d/kdump-tools rPx,
owner /var/lib/kdump/{,**} rw,
profile sysctl {
include <abstractions/base>
@{sbin}/sysctl mr,
@{PROC}/sys/kernel/panic_on_oops rw,
include if exists <local/kdump-config_sysctl>
}
profile kexec {
include <abstractions/base>
capability sys_admin,
capability sys_boot,
@{sbin}/kexec mr,
include if exists <local/kdump-config_kexec>
}
include if exists <local/kdump-config>
}
# vim:syntax=apparmor

71
apparmor.d/profiles-g-l/kernel Normal file
View file

@ -0,0 +1,71 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /etc/kernel/{,header_}postinst.d/* /etc/kernel/postrm.d/*
@{exec_path} += /etc/kernel/preinst.d/* /etc/kernel/prerm.d/*
profile kernel @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_module,
@{exec_path} mr,
@{sh_path} rix,
@{bin}/{,e}grep rix,
@{bin}/{,m,g}awk rix,
@{bin}/cat rix,
@{bin}/chmod rix,
@{bin}/cut rix,
@{bin}/dirname rix,
@{bin}/kmod rix,
@{bin}/mv rix,
@{bin}/rm rix,
@{bin}/rmdir rix,
@{bin}/sed rix,
@{bin}/sort rix,
@{bin}/touch rix,
@{bin}/tr rix,
@{bin}/uname rix,
@{bin}/which rix,
@{bin}/apt-config rPx,
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/systemd-detect-virt rPx,
@{bin}/update-alternatives rPx,
@{sbin}/dkms rPx,
@{sbin}/update-grub rPx,
@{sbin}/update-initramfs rPx,
@{lib}/dkms/dkms_autoinstaller rPx,
@{lib}/modules/*/updates/ w,
@{lib}/modules/*/updates/dkms/ w,
/etc/kernel/header_postinst.d/* r,
/etc/kernel/{postinst,postrm,preinst,prerm}.d/* r,
# For shell pwd
/ r,
/boot/ r,
/etc/apt/apt.conf.d/ r,
/etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw,
/etc/modprobe.d/ r,
/etc/modprobe.d/*.conf r,
@{run}/reboot-required w,
@{run}/reboot-required.pkgs rw,
@{PROC}/devices r,
@{PROC}/cmdline r,
include if exists <local/kernel>
}
# vim:syntax=apparmor

34
apparmor.d/profiles-g-l/kernel-postinst-kdump Normal file
View file

@ -0,0 +1,34 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /etc/kernel/postinst.d/kdump-tools
profile kernel-postinst-kdump @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
@{bin}/du rix,
@{bin}/find rix,
@{bin}/gawk rix,
@{bin}/mv rix,
@{bin}/rm rix,
@{bin}/sync rix,
@{sbin}/mkinitramfs rPx,
owner /var/lib/kdump/* w,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**,
owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw,
include if exists <local/kernel-postinst-kdump>
}
# vim:syntax=apparmor