feat: profiles and integration tests improvments.

Add the udbus variable to be used in `unix bind` rule for dbus.
This commit is contained in:
Alexandre Pujol 2024-11-19 19:04:27 +00:00
parent b4bcb2f16e
commit 4e5f4cb06a
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
43 changed files with 81 additions and 47 deletions

View file

@ -50,7 +50,7 @@ profile snapd @{exec_path} {
ptrace (read) peer=snap,
ptrace (read) peer=@{p_systemd},
unix (bind) type=stream addr=@@{hex16}/bus/systemctl/,
unix (bind) type=stream addr=@@{udbus}/bus/systemctl/,
dbus send bus=system path=/org/freedesktop/
interface=org.freedesktop.login1.Manager

View file

@ -31,8 +31,6 @@ profile sudo @{exec_path} flags=(attach_disconnected) {
signal (send) set=(winch) peer=pacman,
signal (send) set=(winch, hup, term) peer=rpm,
unix bind type=stream addr=@@{hex16}/bus/sudo/system/,
@{bin}/@{shells} rUx,
@{lib}/** PUx,
/opt/*/** PUx,

View file

@ -113,9 +113,11 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
@{run}/cryptsetup/ r,
@{run}/cryptsetup/L* rwk,
@{run}/udev/data/+acpi:* r, # for acpi
@{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.)
@{run}/udev/data/+platform:* r,
@{run}/udev/data/+scsi:* r,
@{run}/udev/data/+vmbus:* r,
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
@{sys}/bus/ r,
@ -128,6 +130,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/@{pci}/{ata,usb,mmc,virtio}[0-9]/{,**/}uevent w,
@{sys}/devices/@{pci}/{ata,usb,mmc}[0-9]/{,**/}remove rw,
@{sys}/devices/@{pci}/uevent r,
@{sys}/devices/**/net/*/ r,
@{sys}/devices/**/uevent r,
@{sys}/devices/virtual/bdi/**/read_ahead_kb r,
@{sys}/devices/virtual/block/*/{,**} rw,
@{sys}/devices/virtual/block/loop@{int}/uevent rw,