felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): systemd: add some generators

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-04 20:05:54 +02:00
parent 4e21ef53e6
commit 3e0c3067d8
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
6 changed files with 135 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

23
apparmor.d/groups/systemd/systemd-generator-friendly-recovery Normal file
View file

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/friendly-recovery
profile systemd-generator-friendly-recovery @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/cat rix,
@{PROC}/cmdline r,
include if exists <local/systemd-generator-friendly-recovery>
}
# vim:syntax=apparmor

28
apparmor.d/groups/systemd/systemd-generator-rc-local Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-rc-local-generator
profile systemd-generator-rc-local @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
ptrace read peer=@{p_systemd},
@{exec_path} mr,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/cgroup r,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
/dev/kmsg w,
include if exists <local/systemd-generator-rc-local>
}
# vim:syntax=apparmor

20
apparmor.d/groups/systemd/systemd-generator-snapd Normal file
View file

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/snapd-generator
profile systemd-generator-snapd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,
@{PROC}/1/mountinfo r,
include if exists <local/systemd-generator-snapd>
}
# vim:syntax=apparmor

28
apparmor.d/groups/systemd/systemd-generator-sshd-socket Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/sshd-socket-generator
profile systemd-generator-sshd-socket @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,
network netlink raw,
@{exec_path} mr,
@{etc_ro}/ssh/sshd_config r,
@{etc_ro}/ssh/sshd_config.d/{,*} r,
@{run}/systemd/generator/ssh.socket.d/{,*} rw,
include if exists <local/systemd-generator-sshd-socket>
}
# vim:syntax=apparmor

31
apparmor.d/groups/systemd/systemd-generator-sysv Normal file
View file

@ -0,0 +1,31 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-sysv-generator
profile systemd-generator-sysv @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
ptrace read peer=@{p_systemd},
@{exec_path} mr,
/etc/init.d/{,**} r,
/etc/rc@{int}.d/{,**} r,
@{run}/systemd/generator.late/* w,
@{PROC}/@{pid}/cgroup r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
/dev/kmsg w,
include if exists <local/systemd-generator-sysv>
}
# vim:syntax=apparmor