felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'tunables' of https://github.com/nobody43/apparmor.d into nobody43-tunables

Browse source 
* 'tunables' of https://github.com/nobody43/apparmor.d:
  dbus temp tails
  Update apparmor.d
  Update gdm-runtime-config
  more unrelated changes
  adjust date-time
  random tails
  rename to int, convert more profiles
  fixes
  tunables
This commit is contained in:
Alexandre Pujol 2023-08-17 20:01:53 +01:00
parent 7b018a60bd
commit 557d905543
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
198 changed files with 560 additions and 507 deletions
Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/groups/systemd/coredumpctl
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/coredumpctl
@{exec_path} = @{bin}/coredumpctl
profile coredumpctl @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@ -30,10 +30,10 @@ profile coredumpctl @{exec_path} flags=(complain) {
/var/lib/systemd/coredump/core.*.[0-9]*.@{hex}.[0-9]*.[0-9]*.zst r,
/{run,var}/log/journal/ r,
/{run,var}/log/journal/@{hex}/ r,
/{run,var}/log/journal/@{hex}/user-@{hex}.journal* r,
/{run,var}/log/journal/@{hex}/system.journal* r,
/{run,var}/log/journal/@{hex}/system@@{hex}.journal* r,
/{run,var}/log/journal/@{md5}/ r,
/{run,var}/log/journal/@{md5}/user-@{hex}.journal* r,
/{run,var}/log/journal/@{md5}/system.journal* r,
/{run,var}/log/journal/@{md5}/system@@{hex}.journal* r,
owner /tmp/*.coredump w,
owner /tmp/core.* w,

14
apparmor.d/groups/systemd/journalctl
View file

@ -34,13 +34,13 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
/var/lib/systemd/catalog/.#database* rw,
/{run,var}/log/journal/ r,
/{run,var}/log/journal/@{hex}/ r,
/{run,var}/log/journal/@{hex}/system.journal* r,
/{run,var}/log/journal/@{hex}/system@@{hex}.journal* rw,
/{run,var}/log/journal/@{hex}/user-@{hex}.journal* rw,
owner /{run,var}/log/journal/@{hex}/fss wl -> /var/log/journal/@{hex}/fss.tmp.*,
owner /{run,var}/log/journal/@{hex}/fss.tmp.* rw,
owner /var/tmp/#[0-9]* rw,
/{run,var}/log/journal/@{md5}/ r,
/{run,var}/log/journal/@{md5}/system.journal* r,
/{run,var}/log/journal/@{md5}/system@@{hex}.journal* rw,
/{run,var}/log/journal/@{md5}/user-@{hex}.journal* rw,
owner /{run,var}/log/journal/@{md5}/fss wl -> /var/log/journal/@{md5}/fss.tmp.*,
owner /{run,var}/log/journal/@{md5}/fss.tmp.* rw,
owner /var/tmp/#@{int} rw,
@{run}/host/container-manager r,
@{run}/systemd/journal/io.systemd.journal rw,

8
apparmor.d/groups/systemd/networkctl
View file

@ -42,10 +42,10 @@ profile networkctl @{exec_path} flags=(attach_disconnected) {
# To be able to read logs
@{run}/log/ r,
/{run,var}/log/journal/ r,
/{run,var}/log/journal/@{hex}/ r,
/{run,var}/log/journal/@{hex}/user-@{hex}.journal* r,
/{run,var}/log/journal/@{hex}/system.journal* r,
/{run,var}/log/journal/@{hex}/system@@{hex}.journal* r,
/{run,var}/log/journal/@{md5}/ r,
/{run,var}/log/journal/@{md5}/user-@{hex}.journal* r,
/{run,var}/log/journal/@{md5}/system.journal* r,
/{run,var}/log/journal/@{md5}/system@@{hex}.journal* r,
@{run}/systemd/netif/links/[0-9]* r,
@{run}/systemd/netif/state r,

2
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -42,7 +42,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
@{etc_rw}/.#hostname* rw,
@{etc_rw}/hostname rw,
/etc/.#machine-info?????? rw,
/etc/.#machine-info@{rand6} rw,
/etc/machine-info rw,
@{run}/systemd/default-hostname rw,

2
apparmor.d/groups/systemd/systemd-journald
View file

@ -30,7 +30,7 @@ profile systemd-journald @{exec_path} {
@{run}/log/ rw,
/{run,var}/log/journal/ rw,
/{run,var}/log/journal/@{hex}/{,*} rwl -> /{run,var}/log/journal/@{hex}/**,
/{run,var}/log/journal/@{md5}/{,*} rw -> /{run,var}/log/journal/@{md5}/**,
owner @{run}/systemd/journal/{,**} rw,
owner @{run}/systemd/notify rw,

2
apparmor.d/groups/systemd/systemd-remount-fs
View file

@ -27,7 +27,7 @@ profile systemd-remount-fs @{exec_path} {
@{run}/host/container-manager r,
@{run}/mount/utab rw,
@{run}/mount/utab.?????? rw,
@{run}/mount/utab.@{rand6} rw,
@{run}/mount/utab.lock rwk,
@{PROC}/ r,

8
apparmor.d/groups/systemd/systemd-user-generators-autostart
View file

@ -10,14 +10,18 @@ include <tunables/global>
profile systemd-user-generators-autostart @{exec_path} {
include <abstractions/base>
ptrace (read) peer=unconfined,
@{exec_path} mr,
/etc/xdg/autostart/*.desktop r,
/etc/xdg/autostart/{,*.desktop} r,
owner @{run}/user/@{uid}/systemd/generator.late/{,**} rw,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/1/environ r,
@{PROC}/@{pids}/cgroup r,
include if exists <local/systemd-user-generators-autostart>
}
}