feat(profiles): general update.
This commit is contained in:
Alexandre Pujol
parent
3ff8e3847d
commit
558cb68f23
27 changed files with 155 additions and 150 deletions
|
|
@ -11,6 +11,8 @@ include <tunables/global>
|
|||
profile gparted @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
/{usr/,}{s,}bin/ r,
|
||||
|
|
@ -34,8 +36,8 @@ profile gparted @{exec_path} {
|
|||
@{run}/udev/rules.d/ rw,
|
||||
@{run}/udev/rules.d/90-udisks-inhibit.rules rw,
|
||||
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}{s,}bin/killall5 rCx -> killall,
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}{s,}bin/killall5 rCx -> killall,
|
||||
|
||||
/{usr/,}bin/ps rPx,
|
||||
/{usr/,}bin/xhost rPx,
|
||||
|
|
@ -49,6 +51,9 @@ profile gparted @{exec_path} {
|
|||
/usr/local/bin/ r,
|
||||
/usr/local/sbin/ r,
|
||||
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -13,149 +13,93 @@ include <tunables/global>
|
|||
profile gpartedbin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
|
||||
# Needed to inform the system of newly created/removed partitions.
|
||||
# ioctl(3, BLKRRPART) = -1 EACCES (Permission denied)
|
||||
#
|
||||
# Error: Partition(s) * on /dev/sd* have been written, but we have been unable to inform the
|
||||
# kernel of the change, probably because it/they are in use. As a result, the old partition(s)
|
||||
# will remain in use. You should reboot now before making further changes.
|
||||
capability sys_admin,
|
||||
|
||||
#
|
||||
capability dac_read_search,
|
||||
|
||||
# Needed? (##FIXME##)
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
# Needed?
|
||||
deny capability sys_nice,
|
||||
# deny capability sys_nice,
|
||||
|
||||
# Needed?
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}{s,}bin/blkid rPx,
|
||||
/{usr/,}{s,}bin/dmidecode rPx,
|
||||
/{usr/,}{s,}bin/hdparm rPx,
|
||||
/{usr/,}{s,}bin/blkid rPx,
|
||||
/{usr/,}bin/kmod rPx,
|
||||
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}bin/mount rCx -> mount,
|
||||
/{usr/,}bin/umount rCx -> umount,
|
||||
/{usr/,}bin/mount rCx -> mount,
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}bin/umount rCx -> umount,
|
||||
|
||||
# RAID
|
||||
/{usr/,}{s,}bin/dmraid rPUx,
|
||||
|
||||
# Device mapper
|
||||
/{usr/,}{s,}bin/dmsetup rPUx,
|
||||
|
||||
# LVM
|
||||
/{usr/,}{s,}bin/dumpe2fs rPx,
|
||||
/{usr/,}{s,}bin/e2fsck rPx,
|
||||
/{usr/,}{s,}bin/e2image rPx,
|
||||
/{usr/,}{s,}bin/fsck.btrfs rPx,
|
||||
/{usr/,}{s,}bin/fsck.fat rPx,
|
||||
/{usr/,}{s,}bin/lvm rPUx,
|
||||
|
||||
# NTFS
|
||||
# The following tools link to mkntfs:
|
||||
# mkfs.ntfs
|
||||
/{usr/,}{s,}bin/mke2fs rPx,
|
||||
/{usr/,}{s,}bin/mkntfs rPx,
|
||||
/{usr/,}{s,}bin/mkswap rPx,
|
||||
/{usr/,}{s,}bin/ntfslabel rPx,
|
||||
/{usr/,}{s,}bin/ntfsresize rPx,
|
||||
/{usr/,}bin/ntfsinfo rPx,
|
||||
|
||||
# FAT16/32
|
||||
# The following tools link to mtools:
|
||||
# mattrib, mbadblocks, mcat, mcd, mclasserase, mcopy, mdel,
|
||||
# mdeltree, mdir, mdu, mformat, minfo, mlabel, mmd, mmount,
|
||||
# mmove, mpartition, mrd, mren, mshortname, mshowfat,
|
||||
# mtoolstest, mtype, mzip
|
||||
/{usr/,}bin/mtools rPx,
|
||||
# The following tools link to mkfs.fat:
|
||||
# mkdosfs, mkfs.msdos, mkfs.vfat
|
||||
/{usr/,}{s,}bin/mkfs.fat rPx,
|
||||
# The following tools link to fsck.fat:
|
||||
# dosfsck, fsck.msdos, fsck.vfat
|
||||
/{usr/,}{s,}bin/fsck.fat rPx,
|
||||
|
||||
# EXT2/3/4
|
||||
# The following tools link to mke2fs:
|
||||
# mkfs.ext2, mkfs.ext3, mkfs.ext4
|
||||
/{usr/,}{s,}bin/mke2fs rPx,
|
||||
# The following tools link to e2fsck:
|
||||
# fsck.ext2, fsck.ext3, fsck.ext4
|
||||
/{usr/,}{s,}bin/e2fsck rPx,
|
||||
/{usr/,}{s,}bin/resize2fs rPx,
|
||||
# The following tools link to dumpe2fs:
|
||||
# e2mmpstatus
|
||||
/{usr/,}{s,}bin/dumpe2fs rPx,
|
||||
# The following tools link to tune2fs:
|
||||
# e2label
|
||||
/{usr/,}{s,}bin/tune2fs rPx,
|
||||
/{usr/,}{s,}bin/e2image rPx,
|
||||
|
||||
# BTRFS
|
||||
/{usr/,}{s,}bin/mkfs.btrfs rPx,
|
||||
# The following tools link to btrfs:
|
||||
# btrfsck
|
||||
/{usr/,}bin/btrfs rPx,
|
||||
/{usr/,}bin/btrfstune rPx,
|
||||
/{usr/,}{s,}bin/fsck.btrfs rPx,
|
||||
/{usr/,}{s,}bin/mkfs.btrfs rPx,
|
||||
|
||||
# SWAP
|
||||
/{usr/,}{s,}bin/mkswap rPx,
|
||||
/{usr/,}{s,}bin/swaplabel rPx,
|
||||
/{usr/,}{s,}bin/swapon rPx,
|
||||
/{usr/,}{s,}bin/swapoff rPx,
|
||||
/{usr/,}{s,}bin/swapon rPx,
|
||||
/{usr/,}{s,}bin/tune2fs rPx,
|
||||
/{usr/,}bin/btrfs rPx,
|
||||
/{usr/,}bin/btrfstune rPx,
|
||||
/{usr/,}bin/mdadm rPUx,
|
||||
/{usr/,}bin/mkfs.* rPx,
|
||||
/{usr/,}bin/mtools rPx,
|
||||
/{usr/,}bin/ntfsinfo rPx,
|
||||
/{usr/,}bin/xfs_io rPUx,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
|
||||
/{usr/,}bin/xdg-open rCx -> child-open,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> child-open,
|
||||
|
||||
@{PROC}/version r,
|
||||
@{PROC}/swaps r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/devices r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/dev/mapper/control rw,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
# For fsck of the btrfs filesystem
|
||||
owner /tmp/gparted-*/ rw,
|
||||
|
||||
# Started as root so without "owner".
|
||||
@{HOME}/.Xauthority r,
|
||||
|
||||
# For saving reports
|
||||
@{HOME}/.Xauthority r,
|
||||
owner @{HOME}/*.htm w,
|
||||
|
||||
owner /tmp/gparted-*/ rw,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
@{PROC}/devices r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/swaps r,
|
||||
@{PROC}/version r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/mapper/control rw,
|
||||
|
||||
profile mount {
|
||||
include <abstractions/base>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
/{usr/,}bin/mount mr,
|
||||
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> /tmp/gparted-*/,
|
||||
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> /boot/,
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/,
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/,
|
||||
|
||||
/{usr/,}bin/mount mr,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/dev r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/{s,v}d[a-z][0-9]*/ r,
|
||||
|
|
@ -171,24 +115,25 @@ profile gpartedbin @{exec_path} {
|
|||
|
||||
capability sys_admin,
|
||||
|
||||
/{usr/,}bin/umount mr,
|
||||
|
||||
umount /tmp/gparted-*/,
|
||||
|
||||
umount /boot/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
/{usr/,}bin/umount mr,
|
||||
|
||||
owner @{run}/mount/ rw,
|
||||
owner @{run}/mount/utab{,.*} rw,
|
||||
owner @{run}/mount/utab.lock wk,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
}
|
||||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
|
|
@ -196,42 +141,17 @@ profile gpartedbin @{exec_path} {
|
|||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
# file_inherit
|
||||
include <abstractions/disks-write> # lots of files in this abstraction get inherited
|
||||
/dev/mapper/control rw,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/gpartedbin>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -43,5 +43,7 @@ profile ip @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/net/igmp{,6} r,
|
||||
owner @{PROC}/sys/net/ipv{4,6}/route/flush w,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/ip>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/login
|
||||
profile login @{exec_path} flags=(complain) {
|
||||
profile login @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/consoles>
|
||||
|
|
@ -28,6 +28,8 @@ profile login @{exec_path} flags=(complain) {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
ptrace read,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/login1
|
||||
interface=org.freedesktop.login1.*
|
||||
peer=(name=org.freedesktop.login1),
|
||||
|
|
|
|||
|
|
@ -24,5 +24,9 @@ profile lsblk @{exec_path} {
|
|||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
# File Inherit
|
||||
deny network inet stream,
|
||||
deny network inet6 stream,
|
||||
|
||||
include if exists <local/lsblk>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,6 +13,8 @@ profile lvm @{exec_path} {
|
|||
include <abstractions/dbus-strict>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
|
|
@ -23,8 +25,9 @@ profile lvm @{exec_path} {
|
|||
|
||||
@{etc_rw}/lvm/** rwkl,
|
||||
|
||||
@{run}/lvm/** rwk,
|
||||
@{run}/lock/lvm/ rw,
|
||||
@{run}/lock/lvm/* rwk,
|
||||
@{run}/lvm/** rwk,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue