felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): add more programs to the list of sbin program.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-01 15:17:03 +02:00
parent dc816178f5
commit 3a568ba307
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
44 changed files with 338 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/apparmor/aa-notify
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/aa-notify @{exec_path} = @{sbin}/aa-notify
profile aa-notify @{exec_path} { profile aa-notify @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-session> include <abstractions/bus-session>

2
apparmor.d/groups/apparmor/aa-unconfined
View file

@ -21,7 +21,7 @@ profile aa-unconfined @{exec_path} flags=(attach_disconnected) {
@{bin}/ r, @{bin}/ r,
@{bin}/netstat Px, @{bin}/netstat Px,
@{bin}/ss Px, @{sbin}/ss Px,
/usr/share/terminfo/** r, /usr/share/terminfo/** r,

2
apparmor.d/groups/apt/unattended-upgrade
View file

@ -55,7 +55,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
@{bin}/etckeeper rPx, @{bin}/etckeeper rPx,
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{sbin}/on_ac_power rPx, @{sbin}/on_ac_power rPx,
@{bin}/sendmail rPUx, @{sbin}/sendmail rPUx,
@{lib}/apt/methods/http{,s} rPx, @{lib}/apt/methods/http{,s} rPx,
@{lib}/needrestart/apt-pinvoke rPx, @{lib}/needrestart/apt-pinvoke rPx,
@{lib}/update-notifier/update-motd-updates-available rPx, @{lib}/update-notifier/update-motd-updates-available rPx,

2
apparmor.d/groups/display-manager/xdm-xsession
View file

@ -20,7 +20,7 @@ profile xdm-xsession @{exec_path} {
@{bin}/basename rix, @{bin}/basename rix,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/checkproc rix, @{sbin}/checkproc rix,
@{bin}/dirname rix, @{bin}/dirname rix,
@{bin}/fortune rPUx, @{bin}/fortune rPUx,
@{bin}/gpg-agent rPx, @{bin}/gpg-agent rPx,

2
apparmor.d/groups/filesystem/btrfs-convert
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/btrfs-convert @{exec_path} = @{sbin}/btrfs-convert
profile btrfs-convert @{exec_path} { profile btrfs-convert @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/btrfs-image
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/btrfs-image @{exec_path} = @{sbin}/btrfs-image
profile btrfs-image @{exec_path} { profile btrfs-image @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/btrfstune
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/btrfstune @{exec_path} = @{sbin}/btrfstune
profile btrfstune @{exec_path} { profile btrfstune @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

4
apparmor.d/groups/filesystem/mount-nfs
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/mount.nfs @{exec_path} = @{sbin}/mount.nfs
profile mount-nfs @{exec_path} flags=(complain) { profile mount-nfs @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -42,7 +42,7 @@ profile mount-nfs @{exec_path} flags=(complain) {
@{sh_path} rix, @{sh_path} rix,
@{bin}/flock rix, @{bin}/flock rix,
@{bin}/start-statd rix, @{sbin}/start-statd rix,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,
/etc/fstab r, /etc/fstab r,

2
apparmor.d/groups/filesystem/nfsdcld
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/nfsdcld @{exec_path} = @{sbin}/nfsdcld
profile nfsdcld @{exec_path} { profile nfsdcld @{exec_path} {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/groups/freedesktop/plymouth-set-default-theme
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/plymouth-set-default-theme @{exec_path} = @{sbin}/plymouth-set-default-theme
profile plymouth-set-default-theme @{exec_path} flags=(attach_disconnected) { profile plymouth-set-default-theme @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/groups/gnome/gnome-initial-setup
View file

@ -37,7 +37,7 @@ profile gnome-initial-setup @{exec_path} {
@{bin}/dpkg rPx -> child-dpkg, @{bin}/dpkg rPx -> child-dpkg,
@{bin}/locale rix, @{bin}/locale rix,
@{bin}/lscpu rPx, @{bin}/lscpu rPx,
@{bin}/lspci rPx, @{sbin}/lspci rPx,
@{bin}/xrandr rPx, @{bin}/xrandr rPx,
@{lib}/gnome-initial-setup-goa-helper rix, @{lib}/gnome-initial-setup-goa-helper rix,

2
apparmor.d/groups/grub/grub-install
View file

@ -19,7 +19,7 @@ profile grub-install @{exec_path} flags=(complain) {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/efibootmgr rix, @{sbin}/efibootmgr rix,
@{bin}/kmod rPx, @{bin}/kmod rPx,
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/udevadm rPx, @{bin}/udevadm rPx,

2
apparmor.d/groups/grub/grub-mkconfig
View file

@ -21,7 +21,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
@{bin}/{e,f,}grep rix, @{bin}/{e,f,}grep rix,
@{bin}/{m,g,}awk rix, @{bin}/{m,g,}awk rix,
@{bin}/basename rix, @{bin}/basename rix,
@{bin}/btrfs rPx, @{sbin}/btrfs rPx,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/chmod rix, @{bin}/chmod rix,
@{bin}/cut rix, @{bin}/cut rix,

2
apparmor.d/groups/gvfs/gvfsd-wsdd
View file

@ -19,7 +19,7 @@ profile gvfsd-wsdd @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/env r, @{bin}/env r,
@{bin}/wsdd rPx, @{sbin}/wsdd rPx,
@{run}/mount/utab r, @{run}/mount/utab r,
owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw, owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,

2
apparmor.d/groups/kde/sddm
View file

@ -76,7 +76,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{shells_path} rix, @{shells_path} rix,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/checkproc rix, @{sbin}/checkproc rix,
@{bin}/disable-paste rix, @{bin}/disable-paste rix,
@{bin}/locale rix, @{bin}/locale rix,
@{bin}/manpath rix, @{bin}/manpath rix,

2
apparmor.d/groups/kde/systemsettings
View file

@ -29,7 +29,7 @@ profile systemsettings @{exec_path} {
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/eglinfo rPUx, @{bin}/eglinfo rPUx,
@{bin}/kcminit rPx, @{bin}/kcminit rPx,
@{bin}/lspci rPx, @{sbin}/lspci rPx,
@{bin}/openssl rix, @{bin}/openssl rix,
@{bin}/pactl rPx, @{bin}/pactl rPx,
@{bin}/plasma-discover rPx, @{bin}/plasma-discover rPx,

2
apparmor.d/groups/pacman/mkinitcpio
View file

@ -47,7 +47,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
@{bin}/{modinfo,rmmod} rPx, @{bin}/{modinfo,rmmod} rPx,
@{sbin}/modprobe rPx, @{sbin}/modprobe rPx,
@{bin}/plymouth rPx, @{bin}/plymouth rPx,
@{bin}/plymouth-set-default-theme rPx, @{sbin}/plymouth-set-default-theme rPx,
@{bin}/sbctl rPx, @{bin}/sbctl rPx,
@{bin}/sync rPx, @{bin}/sync rPx,

2
apparmor.d/groups/pacman/pacman
View file

@ -74,7 +74,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
@{bin}/gtk{,4}-update-icon-cache rPx, @{bin}/gtk{,4}-update-icon-cache rPx,
@{sbin}/iconvconfig rix, @{sbin}/iconvconfig rix,
@{bin}/install-catalog rPx, @{bin}/install-catalog rPx,
@{bin}/install-info rPx, @{sbin}/install-info rPx,
@{sbin}/iscsi-iname rix, @{sbin}/iscsi-iname rix,
@{bin}/journalctl rPx, @{bin}/journalctl rPx,
@{bin}/killall rix, @{bin}/killall rix,

4
apparmor.d/groups/steam/steam
View file

@ -71,7 +71,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/ldd rix, @{bin}/ldd rix,
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/lsof rix, @{bin}/lsof rix,
@{bin}/lspci rCx -> lspci, @{sbin}/lspci rCx -> lspci,
@{bin}/tar rix, @{bin}/tar rix,
@{bin}/which{,.debianutils} rix, @{bin}/which{,.debianutils} rix,
@{bin}/xdg-icon-resource rPx, @{bin}/xdg-icon-resource rPx,
@ -408,7 +408,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
unix receive type=stream, unix receive type=stream,
@{bin}/lspci mr, @{sbin}/lspci mr,
owner @{HOME}/.steam/steam.pipe r, owner @{HOME}/.steam/steam.pipe r,

2
apparmor.d/groups/systemd/systemd-udevd
View file

@ -45,7 +45,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected) {
@{bin}/ddcutil rPx, @{bin}/ddcutil rPx,
@{sbin}/dmsetup rPx, @{sbin}/dmsetup rPx,
@{sbin}/ethtool rix, @{sbin}/ethtool rix,
@{bin}/issue-generator rPx, @{sbin}/issue-generator rPx,
@{sbin}/kdump-config rPUx, @{sbin}/kdump-config rPUx,
@{bin}/kmod rPx, @{bin}/kmod rPx,
@{bin}/logger rix, @{bin}/logger rix,

2
apparmor.d/groups/utils/lspci
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/lspci @{exec_path} = @{sbin}/lspci
profile lspci @{exec_path} flags=(attach_disconnected) { profile lspci @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/profiles-a-f/adequate
View file

@ -34,7 +34,7 @@ profile adequate @{exec_path} flags=(complain) {
# shared object file): ignored. # shared object file): ignored.
@{bin}/dpkg-query rpx, @{bin}/dpkg-query rpx,
# #
@{bin}/update-alternatives rPx, @{sbin}/update-alternatives rPx,
/var/lib/adequate/pending rwk, /var/lib/adequate/pending rwk,

2
apparmor.d/profiles-a-f/atd
View file

@ -27,7 +27,7 @@ profile atd @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/sendmail rPUx, @{sbin}/sendmail rPUx,
@{bin}/exim4 rPx, @{bin}/exim4 rPx,
@{etc_ro}/environment r, @{etc_ro}/environment r,

2
apparmor.d/profiles-a-f/chronyd
View file

@ -8,7 +8,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/chronyd @{exec_path} = @{sbin}/chronyd
profile chronyd @{exec_path} flags=(attach_disconnected) { profile chronyd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/profiles-a-f/crda
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/crda @{exec_path} = @{sbin}/crda
profile crda @{exec_path} { profile crda @{exec_path} {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/profiles-a-f/fatresize
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/fatresize @{exec_path} = @{sbin}/fatresize
profile fatresize @{exec_path} { profile fatresize @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

6
apparmor.d/profiles-g-l/gpartedbin
View file

@ -39,9 +39,9 @@ profile gpartedbin @{exec_path} flags=(attach_disconnected) {
@{bin}/udevadm rCx -> udevadm, @{bin}/udevadm rCx -> udevadm,
@{bin}/umount rCx -> umount, @{bin}/umount rCx -> umount,
@{bin}/btrfs rPx, @{sbin}/btrfs rPx,
@{bin}/btrfstune rPx, @{sbin}/btrfstune rPx,
@{bin}/dmraid rPUx, @{sbin}/dmraid rPUx,
@{sbin}/dmsetup rPUx, @{sbin}/dmsetup rPUx,
@{sbin}/dumpe2fs rPx, @{sbin}/dumpe2fs rPx,
@{sbin}/e2fsck rPx, @{sbin}/e2fsck rPx,

2
apparmor.d/profiles-g-l/hardinfo
View file

@ -53,7 +53,7 @@ profile hardinfo @{exec_path} {
@{bin}/glxinfo rPx, @{bin}/glxinfo rPx,
@{bin}/xdpyinfo rPx, @{bin}/xdpyinfo rPx,
@{bin}/lspci rPx, @{sbin}/lspci rPx,
@{bin}/lsusb rPx, @{bin}/lsusb rPx,
@{bin}/netstat rPx, @{bin}/netstat rPx,
@{bin}/qtchooser rPx, @{bin}/qtchooser rPx,

6
apparmor.d/profiles-g-l/hw-probe
View file

@ -24,7 +24,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) {
@{bin}/{,e}grep rix, @{bin}/{,e}grep rix,
@{bin}/{m,g,}awk rix, @{bin}/{m,g,}awk rix,
@{bin}/dd rix, @{bin}/dd rix,
@{bin}/efibootmgr rix, @{sbin}/efibootmgr rix,
@{bin}/efivar rix, @{bin}/efivar rix,
@{bin}/find rix, @{bin}/find rix,
@{bin}/md5sum rix, @{bin}/md5sum rix,
@ -53,7 +53,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) {
@{bin}/glxinfo rPx, @{bin}/glxinfo rPx,
@{bin}/hciconfig rPx, @{bin}/hciconfig rPx,
@{sbin}/hdparm rPx, @{sbin}/hdparm rPx,
@{bin}/hwinfo rPx, @{sbin}/hwinfo rPx,
@{bin}/i2cdetect rPx, @{bin}/i2cdetect rPx,
@{sbin}/ifconfig rCx -> netconfig, @{sbin}/ifconfig rCx -> netconfig,
@{bin}/inxi rPx, @{bin}/inxi rPx,
@ -65,7 +65,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) {
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/lsblk rPx, @{bin}/lsblk rPx,
@{bin}/lscpu rPx, @{bin}/lscpu rPx,
@{bin}/lspci rPx, @{sbin}/lspci rPx,
@{bin}/lsusb rPx, @{bin}/lsusb rPx,
@{bin}/memtester rPx, @{bin}/memtester rPx,
@{bin}/nmcli rPx, @{bin}/nmcli rPx,

4
apparmor.d/profiles-g-l/hwinfo
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/hwinfo @{exec_path} = @{sbin}/hwinfo
profile hwinfo @{exec_path} { profile hwinfo @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-read> include <abstractions/disks-read>
@ -29,7 +29,7 @@ profile hwinfo @{exec_path} {
@{bin}/udevadm rCx -> udevadm, @{bin}/udevadm rCx -> udevadm,
@{sbin}/acpidump rPUx, @{sbin}/acpidump rPUx,
@{bin}/dmraid rPUx, @{sbin}/dmraid rPUx,
/usr/share/hwinfo/{,**} r, /usr/share/hwinfo/{,**} r,

2
apparmor.d/profiles-g-l/install-info
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/install-info @{exec_path} = @{sbin}/install-info
profile install-info @{exec_path} { profile install-info @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/profiles-g-l/inxi
View file

@ -51,7 +51,7 @@ profile inxi @{exec_path} {
@{bin}/glxinfo rPx, @{bin}/glxinfo rPx,
@{bin}/hddtemp rPx, @{bin}/hddtemp rPx,
@{bin}/lsblk rPx, @{bin}/lsblk rPx,
@{bin}/lspci rPx, @{sbin}/lspci rPx,
@{bin}/lsusb rPx, @{bin}/lsusb rPx,
@{bin}/openbox rPx, @{bin}/openbox rPx,
@{bin}/ps rPx, @{bin}/ps rPx,

2
apparmor.d/profiles-g-l/irqbalance
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/irqbalance @{exec_path} = @{sbin}/irqbalance
profile irqbalance @{exec_path} flags=(attach_disconnected) { profile irqbalance @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/profiles-g-l/issue-generator
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/issue-generator @{exec_path} = @{sbin}/issue-generator
profile issue-generator @{exec_path} { profile issue-generator @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/profiles-m-r/monitorix
View file

@ -41,7 +41,7 @@ profile monitorix @{exec_path} {
@{bin}/tail rix, @{bin}/tail rix,
@{bin}/{m,g,}awk rix, @{bin}/{m,g,}awk rix,
@{bin}/free rix, @{bin}/free rix,
@{bin}/ss rix, @{sbin}/ss rix,
@{bin}/who rix, @{bin}/who rix,
@{sbin}/lvm rix, @{sbin}/lvm rix,
@{sbin}/xtables-nft-multi rix, @{sbin}/xtables-nft-multi rix,

4
apparmor.d/profiles-m-r/os-prober
View file

@ -27,10 +27,10 @@ profile os-prober @{exec_path} flags=(attach_disconnected) {
@{sh_path} rix, @{sh_path} rix,
@{bin}/{e,f,}grep rix, @{bin}/{e,f,}grep rix,
@{sbin}/blkid rPx, @{sbin}/blkid rPx,
@{bin}/btrfs rPx, @{sbin}/btrfs rPx,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/cut rix, @{bin}/cut rix,
@{bin}/dmraid rPUx, @{sbin}/dmraid rPUx,
@{bin}/find rix, @{bin}/find rix,
@{bin}/grub-mount rPx, @{bin}/grub-mount rPx,
@{sbin}/grub-probe rPx, @{sbin}/grub-probe rPx,

2
apparmor.d/profiles-m-r/packagekitd
View file

@ -63,7 +63,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
@{bin}/dpkg rPx -> child-dpkg, #aa:only apt @{bin}/dpkg rPx -> child-dpkg, #aa:only apt
@{bin}/fc-cache rPx, @{bin}/fc-cache rPx,
@{bin}/glib-compile-schemas rPx, @{bin}/glib-compile-schemas rPx,
@{bin}/install-info rPx, @{sbin}/install-info rPx,
@{bin}/rpm rPUx, #aa:only opensuse @{bin}/rpm rPUx, #aa:only opensuse
@{bin}/rpmdb2solv rPUx, #aa:only opensuse @{bin}/rpmdb2solv rPUx, #aa:only opensuse
@{bin}/systemd-inhibit rPx, @{bin}/systemd-inhibit rPx,

2
apparmor.d/profiles-m-r/rngd
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/rngd @{exec_path} = @{sbin}/rngd
profile rngd @{exec_path} flags=(attach_disconnected) { profile rngd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/devices-usb> include <abstractions/devices-usb>

2
apparmor.d/profiles-s-z/setpci
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/setpci @{exec_path} = @{sbin}/setpci
profile setpci @{exec_path} flags=(complain) { profile setpci @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/profiles-s-z/ss
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/ss @{exec_path} = @{sbin}/ss
profile ss @{exec_path} { profile ss @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/profiles-s-z/tomb
View file

@ -66,7 +66,7 @@ profile tomb @{exec_path} {
@{bin}/tr rix, @{bin}/tr rix,
@{bin}/zsh rix, @{bin}/zsh rix,
@{bin}/btrfs rPx, @{sbin}/btrfs rPx,
@{sbin}/cryptsetup rPUx, @{sbin}/cryptsetup rPUx,
@{bin}/e2fsc rPUx, @{bin}/e2fsc rPUx,
@{sbin}/fsck rPx, @{sbin}/fsck rPx,

2
apparmor.d/profiles-s-z/update-alternatives
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/update-alternatives @{exec_path} = @{sbin}/update-alternatives
profile update-alternatives @{exec_path} { profile update-alternatives @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/profiles-s-z/wsdd
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/wsdd @{exec_path} = @{sbin}/wsdd
profile wsdd @{exec_path} { profile wsdd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/python> include <abstractions/python>

287
tests/sbin.list
View file

@ -9,22 +9,29 @@ aa-genprof
aa-load aa-load
aa-logprof aa-logprof
aa-mergeprof aa-mergeprof
aa-notify
aa-remove-unknown aa-remove-unknown
aa-status aa-status
aa-teardown aa-teardown
aa-unconfined aa-unconfined
aa-update-browser aa-update-browser
accessdb accessdb
acpi_genl
acpid acpid
acpidump
add-shell add-shell
addgnupghome addgnupghome
addgroup addgroup
addpart
adduser adduser
agetty agetty
alsa alsa
alsa-info alsa-info
alsa-info.sh
alsa-init
alsabat-test alsabat-test
alsactl alsactl
alternatives
anacron anacron
apparmor_parser apparmor_parser
apparmor_status apparmor_status
@ -44,13 +51,17 @@ atd
audisp-af_unix audisp-af_unix
audisp-filter audisp-filter
audisp-syslog audisp-syslog
audit
auditctl auditctl
auditd auditd
augenrules augenrules
aureport aureport
ausearch ausearch
autodep
automount
autrace autrace
avahi-daemon avahi-daemon
avahi-dnsconfd
badblocks badblocks
bashreadline-bpfcc bashreadline-bpfcc
bashreadline.bt bashreadline.bt
@ -71,17 +82,26 @@ bitesize.bt
blkdeactivate blkdeactivate
blkdiscard blkdiscard
blkid blkid
blkmapd
blkpr blkpr
blkzone blkzone
blockdev blockdev
blogctl
blogd
blogger
bluetoothd bluetoothd
bpflist-bpfcc bpflist-bpfcc
bpftool bpftool
bridge bridge
brltty brltty
brltty-setup brltty-setup
btrfs
btrfs-convert
btrfs-image
btrfsck
btrfsdist-bpfcc btrfsdist-bpfcc
btrfsslower-bpfcc btrfsslower-bpfcc
btrfstune
cache_check cache_check
cache_dump cache_dump
cache_metadata_size cache_metadata_size
@ -97,16 +117,22 @@ cfdisk
cgdisk cgdisk
chat chat
chcpu chcpu
check_mail_queue
check-bios-nx check-bios-nx
checkproc
chgpasswd chgpasswd
chkstat-polkit
chmem chmem
chpasswd chpasswd
chronyd
chroot chroot
cifs.idmap cifs.idmap
cifs.upcall cifs.upcall
cobjnew-bpfcc cobjnew-bpfcc
coldreboot coldreboot
compactsnoop-bpfcc compactsnoop-bpfcc
complain
config.postfix
cpgr cpgr
cppw cppw
cpudist-bpfcc cpudist-bpfcc
@ -116,6 +142,8 @@ cracklib-check
cracklib-format cracklib-format
cracklib-packer cracklib-packer
cracklib-unpacker cracklib-unpacker
cracklib-update
crda
create-cracklib-dict create-cracklib-dict
criticalstat-bpfcc criticalstat-bpfcc
cron cron
@ -123,7 +151,10 @@ cryptdisks_start
cryptdisks_stop cryptdisks_stop
cryptsetup cryptsetup
ctrlaltdel ctrlaltdel
ctstat
cups-browsed cups-browsed
cups-genppd.5.3
cups-genppdupdate
cupsaccept cupsaccept
cupsctl cupsctl
cupsd cupsd
@ -137,20 +168,27 @@ dcb
dcsnoop-bpfcc dcsnoop-bpfcc
dcsnoop.bt dcsnoop.bt
dcstat-bpfcc dcstat-bpfcc
ddns-confgen
deadlock-bpfcc deadlock-bpfcc
debugfs debugfs
debugfs.reiserfs debugfs.reiserfs
debugreiserfs debugreiserfs
decode
defrag.f2fs defrag.f2fs
delgroup delgroup
delpart
deluser deluser
depmod depmod
devlink devlink
dhcpcd dhcpcd
dirtop-bpfcc dirtop-bpfcc
disable
dkms dkms
dmevent_tool
dmeventd dmeventd
dmfilemapd
dmidecode dmidecode
dmraid
dmsetup dmsetup
dmstats dmstats
dnsmasq dnsmasq
@ -172,6 +210,7 @@ e2scrub_all
e2undo e2undo
e4crypt e4crypt
e4defrag e4defrag
eapol_test
ebtables ebtables
ebtables-nft ebtables-nft
ebtables-nft-restore ebtables-nft-restore
@ -179,11 +218,17 @@ ebtables-nft-save
ebtables-restore ebtables-restore
ebtables-save ebtables-save
ebtables-translate ebtables-translate
ec_access
efibootdump
efibootmgr
enforce
era_check era_check
era_dump era_dump
era_invalidate era_invalidate
era_restore era_restore
ethtool ethtool
eventlogadm
exec
execsnoop-bpfcc execsnoop-bpfcc
execsnoop.bt execsnoop.bt
exfat2img exfat2img
@ -196,7 +241,11 @@ f2fscrypt
f2fslabel f2fslabel
f2fsslower-bpfcc f2fsslower-bpfcc
faillock faillock
fancontrol
fatlabel fatlabel
fatresize
fbtest
fdformat
fdisk fdisk
fibmap.f2fs fibmap.f2fs
filefrag filefrag
@ -207,6 +256,8 @@ filetop-bpfcc
findfs findfs
firewalld firewalld
fixparts fixparts
flushb
fonts-config
fsadm fsadm
fsck fsck
fsck.btrfs fsck.btrfs
@ -229,17 +280,23 @@ funccount-bpfcc
funcinterval-bpfcc funcinterval-bpfcc
funclatency-bpfcc funclatency-bpfcc
funcslower-bpfcc funcslower-bpfcc
g13-syshelp
gdisk gdisk
gdm
gdm3 gdm3
genl genl
genprof
getcap getcap
gethostlatency-bpfcc gethostlatency-bpfcc
gethostlatency.bt gethostlatency.bt
getpcaps getpcaps
getsysinfo
getty getty
getweb getweb
gnome-menus-blacklist gnome-menus-blacklist
gpart
gparted gparted
gpm
groupadd groupadd
groupdel groupdel
groupmems groupmems
@ -255,16 +312,36 @@ grub-mkdevicemap
grub-probe grub-probe
grub-reboot grub-reboot
grub-set-default grub-set-default
grub2-bios-setup
grub2-check-default
grub2-install
grub2-macbless
grub2-mkconfig
grub2-ofpathname
grub2-once
grub2-probe
grub2-reboot
grub2-set-default
grub2-sparc64-setup
grub2-switch-to-blscfg
halt halt
hardirqs-bpfcc hardirqs-bpfcc
hc-ifscan hc-ifscan
hdparm hdparm
hwclock hwclock
hwinfo
iconvconfig iconvconfig
ifconfig ifconfig
ifrename
ifstat
import-openSUSE-build-key
init init
inject-bpfcc inject-bpfcc
inputattach
insmod insmod
install_acx100_firmware
install_intersil_firmware
install-info
install-sgmlcatalog install-sgmlcatalog
installkernel installkernel
integritysetup integritysetup
@ -273,6 +350,7 @@ ip
ip6tables ip6tables
ip6tables-apply ip6tables-apply
ip6tables-legacy ip6tables-legacy
ip6tables-legacy-batch
ip6tables-legacy-restore ip6tables-legacy-restore
ip6tables-legacy-save ip6tables-legacy-save
ip6tables-nft ip6tables-nft
@ -292,6 +370,7 @@ ipset-translate
iptables iptables
iptables-apply iptables-apply
iptables-legacy iptables-legacy
iptables-legacy-batch
iptables-legacy-restore iptables-legacy-restore
iptables-legacy-save iptables-legacy-save
iptables-nft iptables-nft
@ -302,6 +381,8 @@ iptables-restore-translate
iptables-save iptables-save
iptables-translate iptables-translate
iptunnel iptunnel
irqbalance
irqbalance-ui
isadump isadump
isaset isaset
iscsi_discovery iscsi_discovery
@ -311,6 +392,8 @@ iscsid
iscsistart iscsistart
isosize isosize
ispell-autobuildhash ispell-autobuildhash
isserial
issue-generator
iucode_tool iucode_tool
iucode-tool iucode-tool
iw iw
@ -327,15 +410,19 @@ javaobjnew-bpfcc
javastat-bpfcc javastat-bpfcc
javathreads-bpfcc javathreads-bpfcc
kbdrate kbdrate
kbdsettings
kdump-config kdump-config
kerneloops kerneloops
kexec kexec
kexec-bootloader
kexec-load-kernel kexec-load-kernel
key.dns_resolver key.dns_resolver
killall5 killall5
killproc
killsnoop-bpfcc killsnoop-bpfcc
killsnoop.bt killsnoop.bt
klockstat-bpfcc klockstat-bpfcc
klogd
kpartx kpartx
kvm-ok kvm-ok
kvmexit-bpfcc kvmexit-bpfcc
@ -347,9 +434,12 @@ libgvc6-config-update
libvirt-dbus libvirt-dbus
libvirtd libvirtd
llcstat-bpfcc llcstat-bpfcc
lnstat
loads.bt loads.bt
locale-gen locale-gen
logprof
logrotate logrotate
logrotate-all
logsave logsave
losetup losetup
lpadmin lpadmin
@ -357,6 +447,7 @@ lpc
lpinfo lpinfo
lpmove lpmove
lsmod lsmod
lspci
lspcmcia lspcmcia
luksformat luksformat
lvchange lvchange
@ -365,7 +456,9 @@ lvcreate
lvdisplay lvdisplay
lvextend lvextend
lvm lvm
lvm_import_vdo
lvmconfig lvmconfig
lvmdevices
lvmdiskscan lvmdiskscan
lvmdump lvmdump
lvmpolld lvmpolld
@ -377,16 +470,21 @@ lvrename
lvresize lvresize
lvs lvs
lvscan lvscan
lwepgen
lxc lxc
lxd lxd
make-bcache make-bcache
make-ssl-cert make-ssl-cert
mariadbd
mcelog
mdadm mdadm
mdflush-bpfcc mdflush-bpfcc
mdflush.bt mdflush.bt
mdmon mdmon
memleak-bpfcc memleak-bpfcc
mii-tool mii-tool
mk_isdnhwdb
mkdict
mkdosfs mkdosfs
mke2fs mke2fs
mkfs mkfs
@ -406,10 +504,13 @@ mkfs.reiserfs
mkfs.vfat mkfs.vfat
mkfs.xfs mkfs.xfs
mkhomedir_helper mkhomedir_helper
mkill
mkinitramfs mkinitramfs
mklost+found mklost+found
mkntfs mkntfs
mkpostfixcert
mkreiserfs mkreiserfs
mksubvolume
mkswap mkswap
ModemManager ModemManager
modinfo modinfo
@ -419,14 +520,18 @@ mount.ddi
mount.fuse mount.fuse
mount.fuse3 mount.fuse3
mount.lowntfs-3g mount.lowntfs-3g
mount.nfs
mount.nfs4
mount.ntfs mount.ntfs
mount.ntfs-3g mount.ntfs-3g
mount.smb3 mount.smb3
mountsnoop-bpfcc mountsnoop-bpfcc
mountstats
mpathpersist mpathpersist
multipath multipath
multipathc multipathc
multipathd multipathd
mysqld
mysqld_qslower-bpfcc mysqld_qslower-bpfcc
nameif nameif
naptime.bt naptime.bt
@ -436,12 +541,21 @@ netqtop-bpfcc
NetworkManager NetworkManager
newusers newusers
nfnl_osf nfnl_osf
nfsconf
nfsdcld
nfsdist-bpfcc nfsdist-bpfcc
nfsidmap
nfsiostat
nfsslower-bpfcc nfsslower-bpfcc
nfsstat
nft nft
nmbd
nodegc-bpfcc nodegc-bpfcc
nodestat-bpfcc nodestat-bpfcc
nologin nologin
notify
nss-mdns-config
nstat
ntfsclone ntfsclone
ntfscp ntfscp
ntfslabel ntfslabel
@ -452,22 +566,28 @@ offwaketime-bpfcc
on_ac_power on_ac_power
oomkill-bpfcc oomkill-bpfcc
oomkill.bt oomkill.bt
openconnect
opensnoop-bpfcc opensnoop-bpfcc
opensnoop.bt opensnoop.bt
openvpn openvpn
overlayroot-chroot overlayroot-chroot
ownership ownership
packer
pam_extrausers_chkpwd pam_extrausers_chkpwd
pam_extrausers_update pam_extrausers_update
pam_getenv pam_getenv
pam_namespace_helper pam_namespace_helper
pam_timestamp_check pam_timestamp_check
pam-auth-update pam-auth-update
pam-config
paperconfig paperconfig
parse.f2fs parse.f2fs
parted parted
partprobe partprobe
partx
pbl
pccardctl pccardctl
pcilmr
pcscd pcscd
pdata_tools pdata_tools
perlcalls-bpfcc perlcalls-bpfcc
@ -476,11 +596,26 @@ perlstat-bpfcc
phpcalls-bpfcc phpcalls-bpfcc
phpflow-bpfcc phpflow-bpfcc
phpstat-bpfcc phpstat-bpfcc
pidofproc
pidpersec-bpfcc pidpersec-bpfcc
pidpersec.bt pidpersec.bt
pivot_root pivot_root
plipconfig plipconfig
pluginviewer
plymouth-set-default-theme
plymouthd plymouthd
postalias
postcat
postconf
postdrop
postfix
postkick
postlock
postlog
postmap
postmulti
postqueue
postsuper
poweroff poweroff
ppchcalls-bpfcc ppchcalls-bpfcc
pppd pppd
@ -502,18 +637,96 @@ pvscan
pwck pwck
pwconv pwconv
pwhistory_helper pwhistory_helper
pwmconfig
pwunconv pwunconv
pythoncalls-bpfcc pythoncalls-bpfcc
pythonflow-bpfcc pythonflow-bpfcc
pythongc-bpfcc pythongc-bpfcc
pythonstat-bpfcc pythonstat-bpfcc
qemu-ga qemu-ga
qmqp-source
rarp rarp
rcapparmor
rcauditd
rcautofs
rcavahi-daemon
rcavahi-dnsconfd
rcblk-availability
rcbolt
rcbtrfsmaintenance-refresh
rcca-certificates
rcchrony-wait
rcchronyd
rccolord
rccron
rccups
rccups-browsed
rccups-lpd
rcdbus
rcdisplay-manager
rcdm-event
rcdnsmasq
rcfancontrol
rcfirewalld
rcflatpak-system-helper
rcfstrim
rcfwupd
rcfwupd-offline-update
rcfwupd-refresh
rcgpm
rcirqbalance
rcissue-add-ssh-keys
rcissue-generator
rckexec-load
rclm_sensors
rclogrotate
rclvm2-lvmpolld
rclvm2-monitor
rcmariadb
rcmcelog
rcmdmonitor
rcModemManager
rcmultipathd
rcmysql
rcnetwork
rcnfs-client
rcnmb
rcopenvpn
rcostree-prepare-root
rcostree-remount
rcpackagekit
rcpackagekit-offline-update
rcpcscd
rcpkcs11_eventmgr
rcpostfix
rcrng-tools
rcrpcbind
rcrsyncd
rcrtkit-daemon
rcsddm
rcsmartd
rcsmb
rcsnmpd
rcsnmptrapd
rcspeech-dispatcherd
rcspice-vdagentd
rcsshd
rctuned
rcudisks2
rcupower
rcusbmuxd
rcwpa_supplicant
rcwsdd
rcxdm
rcxvnc
rdma
rdmaucma-bpfcc rdmaucma-bpfcc
rdmsr rdmsr
readahead-bpfcc readahead-bpfcc
readprofile readprofile
reboot reboot
refresh_initrd
regdbdump
reiserfsck reiserfsck
reiserfstune reiserfstune
remove-default-ispell remove-default-ispell
@ -524,17 +737,33 @@ reset-trace-bpfcc
resize_reiserfs resize_reiserfs
resize.f2fs resize.f2fs
resize2fs resize2fs
resizepart
resolvconf resolvconf
rfkill rfkill
rmmod rmmod
rmt rmt
rmt-tar rmt-tar
rndc
rndc-confgen
rngd
route route
routel
rpc.gssd
rpc.idmapd
rpc.statd
rpc.svcgssd
rpcbind
rpcctl
rpcdebug
rpcinfo
rpmconfigcheck
rsyncd
rsyslogd rsyslogd
rtacct rtacct
rtcwake rtcwake
rtkitctl rtkitctl
rtmon rtmon
rtstat
rubycalls-bpfcc rubycalls-bpfcc
rubyflow-bpfcc rubyflow-bpfcc
rubygc-bpfcc rubygc-bpfcc
@ -547,38 +776,67 @@ runqlen-bpfcc
runqlen.bt runqlen.bt
runqslower-bpfcc runqslower-bpfcc
runuser runuser
rvmtab
saned saned
sasldblistusers2
saslpasswd2
save_y2logs
schema2ldif
select-default-ispell select-default-ispell
select-default-wordlist select-default-wordlist
sendmail
sensors-detect sensors-detect
service service
set_polkit_default_privs
setcap setcap
setconsole
setpci
setuids.bt setuids.bt
setup-nsssysinit.sh
setvesablank setvesablank
setvtrgb setvtrgb
sfdisk sfdisk
sgdisk sgdisk
shadowconfig shadowconfig
shim-install
shmsnoop-bpfcc shmsnoop-bpfcc
showconsole
showmount
shutdown shutdown
skdump
sktest
slabratetop-bpfcc slabratetop-bpfcc
slattach slattach
sload.f2fs sload.f2fs
sm-notify
smart_agetty
smartctl smartctl
smartd smartd
smbd
smtp-sink
smtp-source
snapperd
snmpd
snmptrapd
sofdsnoop-bpfcc sofdsnoop-bpfcc
softirqs-bpfcc softirqs-bpfcc
solisten-bpfcc solisten-bpfcc
spice-vdagentd spice-vdagentd
ss
sshd sshd
sshd-gen-keys-start
ssllatency.bt ssllatency.bt
sslsniff-bpfcc sslsniff-bpfcc
sslsnoop.bt sslsnoop.bt
sssd sssd
stackcount-bpfcc stackcount-bpfcc
start_daemon
start-statd
start-stop-daemon start-stop-daemon
startproc
statsnoop-bpfcc statsnoop-bpfcc
statsnoop.bt statsnoop.bt
status
sudo_logsrvd sudo_logsrvd
sudo_sendlog sudo_sendlog
sulogin sulogin
@ -590,9 +848,11 @@ switch_root
sync-available sync-available
syncsnoop-bpfcc syncsnoop-bpfcc
syncsnoop.bt syncsnoop.bt
sysconf_addword
syscount-bpfcc syscount-bpfcc
syscount.bt syscount.bt
sysctl sysctl
sysusers2shadow
tarcat tarcat
tc tc
tclcalls-bpfcc tclcalls-bpfcc
@ -638,20 +898,30 @@ tlp
tplist-bpfcc tplist-bpfcc
trace-bpfcc trace-bpfcc
traceroute traceroute
tsig-keygen
ttysnoop-bpfcc ttysnoop-bpfcc
tune.exfat tune.exfat
tune2fs tune2fs
tuned
tuned-adm
tunefs.reiserfs tunefs.reiserfs
tunelp
u-d-c-print-pci-ids u-d-c-print-pci-ids
ucalls ucalls
uflow uflow
ufw ufw
ugc ugc
umount.nfs
umount.nfs4
umount.udisks2 umount.udisks2
unconfined
undump.bt undump.bt
unix_chkpwd unix_chkpwd
unix_update unix_update
unix2_chkpwd
uobjnew uobjnew
update-alternatives
update-bootloader
update-ca-certificates update-ca-certificates
update-catalog update-catalog
update-cracklib update-cracklib
@ -693,6 +963,7 @@ ustat
uthreads uthreads
uuidd uuidd
validlocale validlocale
vconfig
vcstime vcstime
vdpa vdpa
veritysetup veritysetup
@ -711,6 +982,7 @@ vgexport
vgextend vgextend
vgimport vgimport
vgimportclone vgimportclone
vgimportdevices
vgmerge vgmerge
vgmknodes vgmknodes
vgreduce vgreduce
@ -719,22 +991,30 @@ vgrename
vgs vgs
vgscan vgscan
vgsplit vgsplit
vhangup
vigr vigr
vipw vipw
virt-what
virtiostat-bpfcc virtiostat-bpfcc
virtlockd virtlockd
virtlogd virtlogd
visudo visudo
vmcore-dmesg vmcore-dmesg
vncsession
vpddecode vpddecode
vpnc
vpnc-disconnect
wakeuptime-bpfcc wakeuptime-bpfcc
wipefs wipefs
wiper.sh
wpa_action wpa_action
wpa_cli wpa_cli
wpa_passphrase
wpa_supplicant wpa_supplicant
wqlat-bpfcc wqlat-bpfcc
writeback.bt writeback.bt
wrmsr wrmsr
wsdd
xfs_admin xfs_admin
xfs_bmap xfs_bmap
xfs_copy xfs_copy
@ -750,6 +1030,7 @@ xfs_mdrestore
xfs_metadump xfs_metadump
xfs_mkfile xfs_mkfile
xfs_ncheck xfs_ncheck
xfs_property
xfs_quota xfs_quota
xfs_repair xfs_repair
xfs_rtcp xfs_rtcp
@ -759,11 +1040,17 @@ xfs_spaceman
xfsdist-bpfcc xfsdist-bpfcc
xfsdist.bt xfsdist.bt
xfsslower-bpfcc xfsslower-bpfcc
xkbctrl
xtables-legacy-multi xtables-legacy-multi
xtables-monitor xtables-monitor
xtables-nft-multi xtables-nft-multi
yast
yast2
zdump
zerofree zerofree
zfsdist-bpfcc zfsdist-bpfcc
zfsslower-bpfcc zfsslower-bpfcc
zic zic
zramctl zramctl
zypp-refresh
zypper-log