felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update apparmor profiles

Browse source 
Signed-off-by: Alexandre Pujol <alexandre@pujol.io>
This commit is contained in:
Mikhail Morfikov 2021-12-08 12:59:46 +01:00 • committed by Alexandre Pujol
parent 44aca3ba51
commit 3430e3df90
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
56 changed files with 146 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/profiles-g-l/hdparm
View file

@ -9,6 +9,8 @@ include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/hdparm
profile hdparm @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/user-download-strict>
include <abstractions/private-files-strict>
include <abstractions/disks-read>
# To remove the following errors:
@ -27,8 +29,10 @@ profile hdparm @{exec_path} flags=(complain) {
@{PROC}/devices r,
# Image files
@{HOME}/** r,
@{MOUNTS}/*/** r,
@{HOME}/**.{iso,img,bin,mdf,nrg} r,
@{MOUNTS}/*/**.{iso,img,bin,mdf,nrg} r,
@{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
@{MOUNTS}/*/**.{ISO,IMG,BIN,MDF,NRG} r,
include if exists <local/hdparm>
}

3
apparmor.d/profiles-g-l/hypnotix
View file

@ -25,6 +25,7 @@ profile hypnotix @{exec_path} {
include <abstractions/mesa>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/private-files-strict>
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/python>
@ -85,7 +86,7 @@ profile hypnotix @{exec_path} {
/etc/machine-id r,
# Silencer
/{usr/,}lib/hypnotix/** w,
deny /{usr/,}lib/hypnotix/** w,
profile xdg-screensaver {

10
apparmor.d/profiles-g-l/jmtpfs
View file

@ -17,12 +17,18 @@ profile jmtpfs @{exec_path} {
/{usr/,}bin/fusermount{,3} rCx -> fusermount,
owner /tmp/tmp* rw,
owner /tmp/#[0-9]* rw,
# Mount points
owner @{HOME}/*/ r,
owner @{HOME}/*/*/ r,
owner @{HOME}/.cache/*/mtp{,-[0-9]*}/ rw,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/*/,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/.cache/*/*/,
/etc/magic r,
@ -36,10 +42,14 @@ profile jmtpfs @{exec_path} {
# To mount anything:
capability sys_admin,
#
capability dac_read_search,
/{usr/,}bin/fusermount{,3} mr,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/*/,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/.cache/*/*/,
/etc/fuse.conf r,

5
apparmor.d/profiles-g-l/kmod
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -48,7 +48,8 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
# Initframs
owner /tmp/mkinitcpio.*/{,**} rw,
#owner @{PROC}/@{pid}/fd/1 w,
owner @{run}/tmpfiles.d/ w,
owner @{run}/tmpfiles.d/static-nodes.conf w,
# For local kernel build
owner /tmp/depmod.*/lib/modules/*/ r,