felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

General updates

Browse source
This commit is contained in:
Jeroen Rijken 2022-07-23 13:22:56 +02:00 • committed by Alex
parent 33da7af6e8
commit 465a31c638
9 changed files with 78 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/profiles-s-z/smartd
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -17,6 +18,7 @@ profile smartd @{exec_path} {
# Unable to register SCSI device /dev/disk/by-id/ata-* at line * of file /etc/smartd.conf
# Device: /dev/disk/by-id/ata-*, not available
capability sys_rawio,
capability sys_admin,
# Needed?
deny capability net_admin,
@ -39,5 +41,7 @@ profile smartd @{exec_path} {
/dev/ r,
@{PROC}/devices r,
/run/systemd/notify rw,
include if exists <local/smartd>
}

10
apparmor.d/profiles-s-z/thermald
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2020 Mikhail Morfikov
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -9,9 +10,14 @@ include <tunables/global>
@{exec_path} = /{usr/,}sbin/thermald
profile thermald @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-strict>
capability sys_boot,
dbus (bind)
bus=system
name=org.freedesktop.thermald,
@{exec_path} mr,
owner @{run}/thermald/ rw,
@ -50,11 +56,11 @@ profile thermald @{exec_path} {
@{sys}/devices/virtual/powercap/intel-rapl/ r,
@{sys}/devices/virtual/powercap/intel-rapl/**/name r,
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/ r,
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/* r,
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/{,*} r,
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/constraint_*_time_window_us w,
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/constraint_*_power_limit_uw w,
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/enabled w,
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/intel-rapl:[0-9]*:[0-9]*/{,*} r,
include if exists <local/thermald>
}