felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-10-01 18:45:08 +01:00
parent 79cd5f09f7
commit 4681a495b3
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
22 changed files with 76 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/profiles-m-r/mandb
View file

@ -27,8 +27,8 @@ profile mandb @{exec_path} flags=(complain) {
/usr/local/man/{,**} r,
/usr/local/share/man/{,**} r,
/usr/{,/share}/man/{,**} r,
/usr/local/{,/share/}/man/{,**} r,
/usr/{,share/}man/{,**} r,
/usr/local/{,share/}man/{,**} r,
/usr/share/**/man/man[0-9]*/*.[0-9]*.gz r,

4
apparmor.d/profiles-m-r/mtools
View file

@ -28,8 +28,8 @@ profile mtools @{exec_path} {
owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
owner /dev/shm/*/**.{iso,img,bin,mdf,nrg} rwk,
owner /dev/shm/*/**.{ISO,IMG,BIN,MDF,NRG} rwk,
/dev/shm/*/**.{iso,img,bin,mdf,nrg} rwk,
/dev/shm/*/**.{ISO,IMG,BIN,MDF,NRG} rwk,
include if exists <local/mtools>
}

6
apparmor.d/profiles-m-r/pacmd
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -13,12 +14,15 @@ profile pacmd @{exec_path} {
include <abstractions/audio>
#capability sys_ptrace,
ptrace peer=pulseaudio,
ptrace (read) peer=pipewire,
signal (send) peer=pulseaudio,
/{usr/,}bin/pacmd mr,
@{exec_path} mr,
/app/lib/libzypak*.so* mr,
owner @{PROC}/@{pids}/stat r,

7
apparmor.d/profiles-m-r/pactl
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -9,16 +10,18 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pactl
profile pactl @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/audio>
include <abstractions/consoles>
@{exec_path} mr,
owner @{HOME}/.Xauthority r,
/app/lib/libzypak*.so* mr,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
owner @{HOME}/.Xauthority r,
owner @{user_config_dirs}/pulse/ rw,
# file_inherit

6
apparmor.d/profiles-m-r/pass-import
View file

@ -11,6 +11,12 @@ profile pass-import @{exec_path} {
include <abstractions/base>
include <abstractions/python>
include <abstractions/openssl>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
@{exec_path} mr,

4
apparmor.d/profiles-m-r/run-parts
View file

@ -15,7 +15,8 @@ profile run-parts @{exec_path} {
@{exec_path} mr,
/usr/share/update-notifier/notify-reboot-required rPx,
/usr/share/update-notifier/notify-reboot-required rPx,
/usr/share/update-notifier/notify-updates-outdated rPx,
# Crontrab
/etc/cron.{hourly,daily,weekly,monthly}/ r,
@ -133,6 +134,7 @@ profile run-parts @{exec_path} {
/{usr/,}lib/update-notifier/update-motd-fsck-at-reboot rPx,
/{usr/,}lib/update-notifier/update-motd-reboot-required rix,
/usr/share/unattended-upgrades/update-motd-unattended-upgrades rix,
/usr/share/update-notifier/notify-updates-outdated rPx,
/ r,
/etc/default/motd-news r,