felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): add deb-systemd-* profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-04-13 20:40:19 +02:00
parent e9c652f387
commit 3d20c579e7
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 70 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

39
apparmor.d/groups/apt/deb-systemd-helper Normal file
View file

@ -0,0 +1,39 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/deb-systemd-helper
profile deb-systemd-helper @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl>
@{exec_path} mr,
@{bin}/systemctl rCx -> systemctl,
/var/lib/systemd/deb-systemd-helper-enabled/** rw,
/var/lib/systemd/deb-systemd-helper-masked/ rw,
profile systemctl {
include <abstractions/base>
include <abstractions/app/systemctl>
/etc/ r,
/etc/systemd/ r,
/etc/systemd/system/ r,
/etc/systemd/system/* rw,
/etc/systemd/system/*.wants/ r,
/etc/systemd/system/*.wants/* rw,
include if exists <local/deb-systemd-helper_systemctl>
}
include if exists <local/deb-systemd-helper>
}
# vim:syntax=apparmor

29
apparmor.d/groups/apt/deb-systemd-invoke Normal file
View file

@ -0,0 +1,29 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/deb-systemd-invoke
profile deb-systemd-invoke @{exec_path} {
include <abstractions/base>
include <abstractions/app/systemctl>
include <abstractions/perl>
capability net_admin,
capability sys_resource,
signal send set=(cont term) peer=systemd-tty-ask-password-agent,
@{exec_path} mr,
@{sh_path} rix,
@{bin}/systemctl rix,
@{bin}/systemd-tty-ask-password-agent rPx,
include if exists <local/deb-systemd-invoke>
}
# vim:syntax=apparmor

2
dists/flags/main.flags
View file

@ -75,6 +75,8 @@ cups-notifier-rss complain
cups-pk-helper-mechanism complain
cupsd attach_disconnected,complain
ddcutil complain
deb-systemd-helper complain
deb-systemd-invoke complain
dino attach_disconnected,complain
discord complain
discord-chrome-sandbox complain