felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): add more systemd-generator profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-30 00:05:34 +02:00
parent d9cfef3e5d
commit 3d76c98c4b
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
6 changed files with 161 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor.d/groups/systemd-generators/systemd-generator-environment-snapd Normal file
View file

@ -0,0 +1,18 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-environment-generators/snapd-env-generator
profile systemd-generator-environment-snapd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/systemd-generator-environment-snapd>
}
# vim:syntax=apparmor

31
apparmor.d/groups/systemd-generators/systemd-generator-import Normal file
View file

@ -0,0 +1,31 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-import-generator
profile systemd-generator-import @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
capability sys_ptrace,
ptrace read peer=@{p_systemd},
@{exec_path} mr,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
/ r,
/dev/kmsg w,
include if exists <local/systemd-generator-import>
}
# vim:syntax=apparmor

27
apparmor.d/groups/systemd-generators/systemd-generator-openvpn Normal file
View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/openvpn-generator
profile systemd-generator-openvpn @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,
@{sh_path} r,
@{bin}/ls ix,
@{bin}/mkdir ix,
/etc/default/openvpn r,
/etc/openvpn/ r,
@{run}/systemd/generator/openvpn.service.wants/{,**} w,
include if exists <local/systemd-generator-openvpn>
}
# vim:syntax=apparmor

48
apparmor.d/groups/systemd-generators/systemd-generator-ssh Normal file
View file

@ -0,0 +1,48 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-ssh-generator
profile systemd-generator-ssh @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
capability net_admin,
network vsock stream,
ptrace read peer=@{p_systemd},
@{exec_path} mr,
@{sbin}/sshd r,
@{run}/ r,
@{run}/systemd/ r,
@{run}/systemd/generator/ r,
@{run}/systemd/generator/sockets.target.wants/ rw,
@{run}/systemd/generator/sockets.target.wants/*.socket w,
@{run}/systemd/generator/sshd-*.service w,
@{run}/systemd/generator/sshd-*.socket rw,
@{run}/systemd/system/ r,
@{run}/systemd/transient/ r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/cgroup r,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
/dev/kmsg w,
/dev/vsock r,
include if exists <local/systemd-generator-ssh>
}
# vim:syntax=apparmor

30
apparmor.d/groups/systemd-generators/systemd-generator-tpm2 Normal file
View file

@ -0,0 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-tpm2-generator
profile systemd-generator-tpm2 @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
ptrace read peer=@{p_systemd},
@{exec_path} mr,
@{sys}/class/tpmrm/ r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/cgroup r,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
/dev/kmsg w,
include if exists <local/systemd-generator-tpm2>
}
# vim:syntax=apparmor

9
dists/flags/main.flags
View file

@ -329,19 +329,24 @@ systemd-generator-debug attach_disconnected,complain
systemd-generator-ds-identify attach_disconnected,complain
systemd-generator-environment-arch complain
systemd-generator-environment-flatpak complain
systemd-generator-environment-snapd attach_disconnected,complain
systemd-generator-friendly-recover attach_disconnected,complain
systemd-generator-fstab attach_disconnected,complain
systemd-generator-getty attach_disconnected,complain
systemd-generator-gpt-auto attach_disconnected,complain
systemd-generator-hibernate-resume attach_disconnected,complain
systemd-generator-import attach_disconnected,complain
systemd-generator-integritysetup attach_disconnected,complain
systemd-generator-openvpn attach_disconnected,complain
systemd-generator-ostree attach_disconnected,complain
systemd-generator-rc-local attach_disconnected,complain
systemd-generator-run attach_disconnected,complain
systemd-generator-snapd attach_disconnected,complain
systemd-generator-ssh attach_disconnected,complain
systemd-generator-sshd-socket attach_disconnected,complain
systemd-generator-system-update attach_disconnected,complain
systemd-generator-sysv attach_disconnected,complain
systemd-generator-tpm2 attach_disconnected,complain
systemd-generator-user-autostart attach_disconnected,complain
systemd-generator-user-environment attach_disconnected,complain
systemd-generator-veritysetup attach_disconnected,complain
@ -350,8 +355,8 @@ systemd-homework complain
systemd-inhibit attach_disconnected,complain
systemd-journald attach_disconnected,mediate_deleted
systemd-mount complain
systemd-network-generator complain
systemd-nsresourced complain
systemd-network-generator attach_disconnected,complain
systemd-nsresourced attach_disconnected,complain
systemd-nsresourcework complain
systemd-portabled complain
systemd-resolve complain