felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): systemd: add some generators

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-04 20:05:54 +02:00
parent 4e21ef53e6
commit 3e0c3067d8
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
6 changed files with 135 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

23
apparmor.d/groups/systemd/systemd-generator-friendly-recovery Normal file
View file

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/friendly-recovery
profile systemd-generator-friendly-recovery @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/cat rix,
@{PROC}/cmdline r,
include if exists <local/systemd-generator-friendly-recovery>
}
# vim:syntax=apparmor

28
apparmor.d/groups/systemd/systemd-generator-rc-local Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-rc-local-generator
profile systemd-generator-rc-local @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
ptrace read peer=@{p_systemd},
@{exec_path} mr,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/cgroup r,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
/dev/kmsg w,
include if exists <local/systemd-generator-rc-local>
}
# vim:syntax=apparmor

20
apparmor.d/groups/systemd/systemd-generator-snapd Normal file
View file

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/snapd-generator
profile systemd-generator-snapd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,
@{PROC}/1/mountinfo r,
include if exists <local/systemd-generator-snapd>
}
# vim:syntax=apparmor

28
apparmor.d/groups/systemd/systemd-generator-sshd-socket Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/sshd-socket-generator
profile systemd-generator-sshd-socket @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,
network netlink raw,
@{exec_path} mr,
@{etc_ro}/ssh/sshd_config r,
@{etc_ro}/ssh/sshd_config.d/{,*} r,
@{run}/systemd/generator/ssh.socket.d/{,*} rw,
include if exists <local/systemd-generator-sshd-socket>
}
# vim:syntax=apparmor

31
apparmor.d/groups/systemd/systemd-generator-sysv Normal file
View file

@ -0,0 +1,31 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-sysv-generator
profile systemd-generator-sysv @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
ptrace read peer=@{p_systemd},
@{exec_path} mr,
/etc/init.d/{,**} r,
/etc/rc@{int}.d/{,**} r,
@{run}/systemd/generator.late/* w,
@{PROC}/@{pid}/cgroup r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
/dev/kmsg w,
include if exists <local/systemd-generator-sysv>
}
# vim:syntax=apparmor

5
dists/flags/main.flags
View file

@ -329,14 +329,19 @@ systemd-generator-debug attach_disconnected,complain
systemd-generator-ds-identify attach_disconnected,complain
systemd-generator-environment-arch complain
systemd-generator-environment-flatpak complain
systemd-generator-friendly-recover attach_disconnected,complain
systemd-generator-fstab attach_disconnected,complain
systemd-generator-getty attach_disconnected,complain
systemd-generator-gpt-auto attach_disconnected,complain
systemd-generator-hibernate-resume attach_disconnected,complain
systemd-generator-integritysetup attach_disconnected,complain
systemd-generator-ostree attach_disconnected,complain
systemd-generator-rc-local attach_disconnected,complain
systemd-generator-run attach_disconnected,complain
systemd-generator-snapd attach_disconnected,complain
systemd-generator-sshd-socket attach_disconnected,complain
systemd-generator-system-update attach_disconnected,complain
systemd-generator-sysv attach_disconnected,complain
systemd-generator-user-autostart attach_disconnected,complain
systemd-generator-user-environment attach_disconnected,complain
systemd-generator-veritysetup attach_disconnected,complain