felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): rewrite debconf & add debconf-frontend.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-18 23:31:03 +02:00
parent 390cc27ab8
commit 49155625a5
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
12 changed files with 92 additions and 224 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/apt/aptitude
View file

@ -169,7 +169,7 @@ profile aptitude @{exec_path} flags=(complain) {
profile pager {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/app/pager>
owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,

32
apparmor.d/groups/apt/debconf-apt-progress
View file

@ -10,42 +10,12 @@ include <tunables/global>
@{exec_path} = @{bin}/debconf-apt-progress
profile debconf-apt-progress @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/perl>
include <abstractions/common/debconf>
@{exec_path} r,
@{bin}/apt-get rPx,
# Think what to do about this (#FIXME#)
/usr/share/debconf/frontend rPx,
#/usr/share/debconf/frontend rCx -> frontend,
profile frontend flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl>
include <abstractions/nameservice-strict>
/usr/share/debconf/frontend r,
@{bin}/debconf-apt-progress rPx,
@{sh_path} rix,
@{bin}/stty rix,
@{bin}/locale rix,
# The following is needed when debconf uses dialog/whiptail frontend.
@{bin}/whiptail rPx,
/etc/debconf.conf r,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk,
/usr/share/debconf/templates/adequate.templates r,
/etc/shadow r,
include if exists <local/debconf-apt-progress_frontend>
}
include if exists <local/debconf-apt-progress>
}

75
apparmor.d/groups/apt/debconf-frontend Normal file
View file

@ -0,0 +1,75 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /usr/share/debconf/frontend
profile debconf-frontend @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/common/debconf>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
capability dac_read_search,
@{exec_path} r,
@{sh_path} rix,
@{bin}/hostname ix,
@{bin}/locale ix,
@{bin}/lsb_release Px -> lsb_release,
@{bin}/stty ix,
@{sbin}/update-secureboot-policy Px,
# debconf apps
@{bin}/adequate Px,
@{bin}/debconf-apt-progress Px,
@{bin}/linux-check-removal Px,
@{bin}/ucf Px,
@{bin}/whiptail Px,
@{sbin}/aspell-autobuildhash Px,
@{sbin}/pam-auth-update Px,
@{lib}/tasksel/tasksel-debconf Px -> tasksel,
/usr/share/debian-security-support/check-support-status.hook Px,
# Grub
@{lib}/grub/grub-multi-install Px,
/usr/share/grub/grub-check-signatures Px,
# Package maintainer's scripts
/var/lib/dpkg/info/*.@{dpkg_script_ext} Px,
/var/lib/dpkg/info/*.control r,
/var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px,
# DKMS scipts
@{lib}/dkms/common.postinst rPUx,
@{lib}/dkms/dkms-* rPUx,
@{lib}/dkms/dkms_* rPUx,
/usr/share/debconf/{,**} r,
/etc/inputrc r,
/etc/shadow r,
owner /var/cache/debconf/* rwk,
owner @{tmp}/file* w,
owner @{tmp}/tmp.@{rand10} rw,
owner @{tmp}/updateppds.@{rand6} rw,
@{HOME}/.Xauthority r,
@{run}/user/@{uid}/pk-debconf-socket rw,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/debconf-frontend>
}
# vim:syntax=apparmor

2
apparmor.d/groups/apt/dpkg-script-apparmor
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/apparmor*
profile dpkg-script-apparmor @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
include <abstractions/consoles>
@{exec_path} mrix,

2
apparmor.d/groups/apt/dpkg-script-linux
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/linux*
profile dpkg-script-linux @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
@{exec_path} mrix,

2
apparmor.d/groups/apt/dpkg-script-systemd
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/systemd*
profile dpkg-script-systemd @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
include <abstractions/consoles>
@{exec_path} mrix,

2
apparmor.d/groups/apt/dpkg-scripts
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/**
profile dpkg-scripts @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
include <abstractions/disks-read>
capability chown,

10
apparmor.d/groups/grub/grub-check-signatures
View file

@ -9,18 +9,14 @@ include <tunables/global>
@{exec_path} = /usr/share/grub/grub-check-signatures
profile grub-check-signatures @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/common/debconf>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,
@{bin}//mktemp rix,
@{bin}//od rix,
/usr/share/debconf/frontend rPx,
/usr/share/debconf/confmodule r,
@{bin}/mktemp rix,
@{bin}/od rix,
owner @{tmp}/tmp.@{rand10}/ rw,

2
apparmor.d/groups/grub/grub-multi-install
View file

@ -24,7 +24,7 @@ profile grub-multi-install @{exec_path} {
@{bin}/sort rix,
@{bin}/touch rix,
@{bin}/udevadm rPx,
/usr/share/debconf/frontend rPx,
/usr/share/debconf/frontend rix,
/usr/lib/terminfo/x/xterm-256color r,
/usr/share/debconf/confmodule r,