felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): initramfs: add hooks and scripts.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-25 00:47:02 +02:00
parent baeecbffcb
commit 39f22670a4
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 146 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

86
apparmor.d/profiles-m-r/initramfs-hooks Normal file
View file

@ -0,0 +1,86 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /usr/share/initramfs-tools/hooks/** /etc/initramfs-tools/hooks/**
profile initramfs-hooks @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@{sh_path} rix,
@{coreutils_path} rix,
@{bin}/ischroot Px,
@{bin}/ldd Cx -> ldd,
@{bin}/plymouth Px,
@{bin}/update-alternatives Px,
@{sbin}/blkid Px,
@{lib}/dracut/dracut-install Px,
@{lib}/initramfs-tools/bin/busybox ix,
@{lib}/klibc/bin/fstype ix,
/usr/share/mdadm/mkconf Px,
@{bin}/* r,
@{sbin}/* r,
@{lib}/ r,
@{lib}/** r,
/usr/share/initramfs-tools/{,**} r,
/usr/share/plymouth/{,**} r,
/usr/share/cryptsetup/initramfs/{,**} r,
/etc/console-setup/{,**} r,
/etc/cryptsetup-initramfs/{,**} r,
/etc/crypttab r,
/etc/default/* r,
/etc/fstab r,
/etc/iscsi/*.iscsi r,
/etc/lvm/{,**} r,
/etc/mdadm/mdadm.conf r,
/etc/systemd/network/{,**} r,
/etc/udev/{,**} r,
/ r,
@{efi}/config-* r,
/var/tmp/ r,
/var/tmp/modules_@{rand6} rw,
owner /var/tmp/mkinitramfs_@{rand6} rw,
owner /var/tmp/mkinitramfs_@{rand6}/ rw,
owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**,
owner /var/tmp/mkinitramfs-@{rand6} rw,
owner /var/tmp/mkinitramfs-*_@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/** rwl -> /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/**,
owner /tmp/tmp.@{rand10}/mkinitramfs-@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs-*_@{rand6} rw,
@{sys}/firmware/efi/efivars/ r,
@{PROC}/@{pid}/mounts r,
@{PROC}/cmdline r,
@{PROC}/swaps r,
profile ldd {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{bin}/ldd mr,
@{bin}/* mr,
@{lib}/@{multiarch}/ld-linux-*so* mrix,
@{lib}/ld-linux.so* mr,
include if exists <local/initramfs-hooks_ldd>
}
include if exists <local/initramfs-hooks>
}
# vim:syntax=apparmor

55
apparmor.d/profiles-m-r/initramfs-scripts Normal file
View file

@ -0,0 +1,55 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /usr/share/initramfs-tools/scripts/** /etc/initramfs-tools/scripts/**
profile initramfs-scripts @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
@{sh_path} rix,
@{coreutils_path} rix,
@{sbin}/blkid Px,
@{bin}/dd ix,
@{bin}/debconf-escape Px,
@{bin}/ischroot Px,
@{bin}/ldd Cx -> ldd,
@{bin}/plymouth Px,
@{bin}/update-alternatives Px,
@{lib}/dracut/dracut-install Px,
@{lib}/initramfs-tools/bin/busybox Px,
/usr/share/mdadm/mkconf Px,
/usr/share/initramfs-tools/{,**} r,
/etc/cryptsetup-initramfs/{,**} r,
/etc/crypttab r,
/etc/default/console-setup r,
/etc/fstab r,
/etc/initramfs-tools/{,**} r,
/etc/mdadm/mdadm.conf r,
/etc/udev/rules.d/{,**} r,
/var/tmp/modules_@{rand6} rw,
owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**,
profile ldd {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{bin}/ldd mr,
@{lib}/@{multiarch}/ld-linux-*so* mrix,
@{lib}/ld-linux.so* mr,
include if exists <local/initramfs-scripts_ldd>
}
include if exists <local/initramfs-scripts>
}
# vim:syntax=apparmor

10
apparmor.d/profiles-m-r/mkinitramfs
View file

@ -66,11 +66,10 @@ profile mkinitramfs @{exec_path} {
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/linux-version rPx,
# What to do with it? (#FIXME#)
/usr/share/initramfs-tools/hooks/* rPUx,
/usr/share/initramfs-tools/scripts/*/* rPUx,
/etc/initramfs-tools/hooks/* rPUx,
/etc/initramfs-tools/scripts/*/* rPUx,
/usr/share/initramfs-tools/hooks/** rPx,
/usr/share/initramfs-tools/scripts/** rPx,
/etc/initramfs-tools/hooks/** rPx,
/etc/initramfs-tools/scripts/** rPx,
/usr/share/initramfs-tools/{,**} r,
/etc/initramfs-tools/{,**} r,
@ -106,6 +105,7 @@ profile mkinitramfs @{exec_path} {
@{sys}/devices/platform/**/ r,
@{sys}/devices/platform/**/modalias r,
@{sys}/module/compression r,
@{sys}/module/firmware_class/parameters/path r,
@{PROC}/cmdline r,
@{PROC}/modules r,