felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(profile): ufw: allow kmod.

Browse source 
fix #765
This commit is contained in:
Alexandre Pujol 2025-06-16 21:50:22 +02:00
parent 8118bf3d23
commit 4cb6de3d2d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
apparmor.d/groups/firewall/ufw
View file

@ -32,11 +32,13 @@ profile ufw @{exec_path} flags=(attach_disconnected) {
@{python_path} rix, @{python_path} rix,
@{bin}/ r, @{bin}/ r,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/echo rix,
@{bin}/env r, @{bin}/env r,
@{bin}/kmod rCx -> kmod,
@{lib}/ufw/ufw-init rix,
@{sbin}/sysctl rix, @{sbin}/sysctl rix,
@{sbin}/xtables-legacy-multi rix, @{sbin}/xtables-legacy-multi rix,
@{sbin}/xtables-nft-multi rix, @{sbin}/xtables-nft-multi rix,
@{lib}/ufw/ufw-init rix,
/etc/default/ufw rw, /etc/default/ufw rw,
/etc/ufw/ rw, /etc/ufw/ rw,
@ -56,6 +58,18 @@ profile ufw @{exec_path} flags=(attach_disconnected) {
@{PROC}/sys/net/ipv{4,6}/** rw, @{PROC}/sys/net/ipv{4,6}/** rw,
@{PROC}/sys/kernel/modprobe r, @{PROC}/sys/kernel/modprobe r,
profile kmod flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/kmod>
capability sys_module,
@{sys}/module/compression r,
@{sys}/module/*/initstate r,
include if exists <local/ufw_kmod>
}
include if exists <local/ufw> include if exists <local/ufw>
} }