felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2024-01-21 11:56:02 +00:00
parent 05b47adb13
commit 42fc4622ed
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
42 changed files with 154 additions and 94 deletions
Download patch file Download diff file Expand all files Collapse all files

50
apparmor.d/profiles-m-r/mount-nfs
View file

@ -25,31 +25,6 @@ profile mount-nfs @{exec_path} flags=(complain) {
network inet stream,
network inet6 stream,
@{exec_path} mr,
@{bin}/{,ba,da}sh rix,
@{bin}/flock rix,
@{bin}/start-statd rix,
/usr/bin/systemctl rPx -> child-systemctl,
/etc/fstab r,
/etc/netconfig r,
/etc/rpc r,
@{PROC}/filesystems r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{run}/mount/utab{,.*} rw,
owner @{run}/mount/utab.lock wk,
owner @{run}/rpc.statd.lock wk,
# Mount points
@{MOUNTDIRS}/ r,
@{MOUNTS}/ r,
@{MOUNTS}/*/ r,
# Allow to mount smb/cifs disks only under the /media/ dirs
mount fstype=nfs -> @{MOUNTDIRS}/,
mount fstype=nfs -> @{MOUNTS}/,
@ -63,5 +38,30 @@ profile mount-nfs @{exec_path} flags=(complain) {
umount /,
umount /*/,
@{exec_path} mr,
@{bin}/{,ba,da}sh rix,
@{bin}/flock rix,
@{bin}/start-statd rix,
/usr/bin/systemctl rPx -> child-systemctl,
/etc/fstab r,
/etc/netconfig r,
/etc/nfsmount.conf rk,
/etc/rpc r,
# Mount points
@{MOUNTDIRS}/ r,
@{MOUNTS}/ r,
@{MOUNTS}/*/ r,
owner @{run}/mount/utab.lock wk,
owner @{run}/mount/utab{,.*} rw,
owner @{run}/rpc.statd.lock wk,
@{PROC}/filesystems r,
owner @{PROC}/@{pid}/mountinfo r,
include if exists <local/mount-nfs>
}