felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update runsv

Browse source
This commit is contained in:
Besanon 2024-06-06 18:40:43 +02:00 • committed by GitHub
parent 4f4dfba175
commit 3de225a122
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 61 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

29
apparmor.d/groups/runit/runsv
View file

@ -8,8 +8,8 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_pathrunsv} = @{bin}/runsv
profile runsv @{exec_pathrunsv} flags=(attach_disconnected) {
@{exec_path} = @{bin}/runsv
profile runsv @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-session>
include <abstractions/bus-system>
@ -53,7 +53,7 @@ profile runsv @{exec_pathrunsv} flags=(attach_disconnected) {
ptrace (read) peer=@{p_systemd},
ptrace (trace) peer=@{profile_name},
@{exec_pathrunsv} mr,
@{exec_path} mr,
@{bin}/sv rPx,
@{bin}/vlogger rPx,
@ -79,25 +79,25 @@ profile runsv @{exec_pathrunsv} flags=(attach_disconnected) {
@{bin}/chpst rPx,
@{bin}/mkdir rix,
@{bin}/mktemp rix,
@{bin}/dbus-send rix, # alt: rix
@{bin}/utmpset rix, # alt: rix
@{bin}/dbus-send rix,
@{bin}/utmpset rix,
@{lib}exec/elogind/elogind rPx,
@{lib}exec/elogind/elogind.wrapper rPx, # alt: rix
@{bin}/bash rPx, # alt: rix
@{bin}/tr rPx, # alt:rix
@{lib}exec/elogind/elogind.wrapper rPx,
@{bin}/bash rPx,
@{bin}/tr rPx,
@{bin}/rm rix,
@{bin}/touch rix,
@{bin}/flock rix,
@{bin}/cat rix,
@{bin}/grep rPx, # alt:rix
@{bin}/grep rPx,
@{bin}/mountpoint rix,
@{bin}/systemctl rCx -> systemctl,
/etc/sv/**/run rix, # rix,
/etc/sv/**/**/run rix, # rix,
/etc/sv/**/finish rix, # rix,
/etc/sv/**/run rix, # rix,
/etc/sv/dbus/check rix, # rix,
/etc/sv/**/run rix,
/etc/sv/**/**/run rix,
/etc/sv/**/finish rix,
/etc/sv/**/run rix,
/etc/sv/dbus/check rix,
mount fstype=tmpfs -> @{run}/systemd/,
mount fstype=tmpfs -> @{run}/user/,
@ -173,5 +173,6 @@ profile runsv @{exec_pathrunsv} flags=(attach_disconnected) {
}
include if exists <local/runsv>
}