felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(tunable): add the archive_path variable.

Browse source
This commit is contained in:
Alexandre Pujol 2025-06-01 16:02:20 +02:00
parent eb84df319d
commit 55e4b27c2b
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
6 changed files with 13 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/profiles-a-f/atool
View file

@ -19,9 +19,9 @@ profile atool @{exec_path} {
@{bin}/7z rix, @{bin}/7z rix,
@{bin}/arc rix, @{bin}/arc rix,
@{bin}/arj rix, @{bin}/arj rix,
@{bin}/bzip2 rix,
@{bin}/bzip2 rix,
@{bin}/bzip rix, @{bin}/bzip rix,
@{bin}/bzip2 rix,
@{bin}/bzip2 rix,
@{bin}/compress rix, @{bin}/compress rix,
@{bin}/cpio rix, @{bin}/cpio rix,
@{bin}/gunzip rix, @{bin}/gunzip rix,
@ -30,16 +30,15 @@ profile atool @{exec_path} {
@{bin}/jar rix, @{bin}/jar rix,
@{bin}/lha rix, @{bin}/lha rix,
@{bin}/lrunzip rix, @{bin}/lrunzip rix,
@{bin}/lrz rix,
@{bin}/lrzcat rix, @{bin}/lrzcat rix,
@{bin}/lrzip rix, @{bin}/lrzip rix,
@{bin}/lrz rix,
@{bin}/lrztar rix, @{bin}/lrztar rix,
@{bin}/lrzuntar rix, @{bin}/lrzuntar rix,
@{bin}/lzip rix, @{bin}/lzip rix,
@{bin}/lzma rix, @{bin}/lzma rix,
@{bin}/lzop rix, @{bin}/lzop rix,
@{bin}/lzop rix, @{bin}/lzop rix,
@{lib}/p7zip/7z rix,
@{bin}/rar rix, @{bin}/rar rix,
@{bin}/tar rix, @{bin}/tar rix,
@{bin}/unace rix, @{bin}/unace rix,
@ -48,6 +47,7 @@ profile atool @{exec_path} {
@{bin}/unzip rix, @{bin}/unzip rix,
@{bin}/xz rix, @{bin}/xz rix,
@{bin}/zip rix, @{bin}/zip rix,
@{lib}/p7zip/7z rix,
/etc/atool.conf r, /etc/atool.conf r,
owner @{HOME}/.atoolrc r, owner @{HOME}/.atoolrc r,

14
apparmor.d/profiles-a-f/file-roller
View file

@ -26,19 +26,7 @@ profile file-roller @{exec_path} {
@{bin}/rm rix, @{bin}/rm rix,
# Archivers # Archivers
@{bin}/7z rix, @{archive_path} rix,
@{bin}/7zz rix,
@{bin}/ar rix,
@{bin}/bzip2 rix,
@{bin}/cpio rix,
@{bin}/gzip rix,
@{bin}/tar rix,
@{bin}/unrar-nonfree rix,
@{bin}/unzip rix,
@{bin}/xz rix,
@{bin}/zip rix,
@{bin}/zstd rix,
@{lib}/p7zip/7z rix,
# Full access to user's data # Full access to user's data
@{MOUNTS}/** rw, @{MOUNTS}/** rw,

6
apparmor.d/profiles-s-z/unmkinitramfs
View file

@ -18,22 +18,18 @@ profile unmkinitramfs @{exec_path} {
@{exec_path} r, @{exec_path} r,
@{sh_path} rix, @{sh_path} rix,
@{archive_path} rix,
@{bin}/{,e}grep rix, @{bin}/{,e}grep rix,
@{bin}/bzip2 rix,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/cpio rix,
@{bin}/dd rix, @{bin}/dd rix,
@{bin}/getopt rix, @{bin}/getopt rix,
@{bin}/gzip rix,
@{bin}/lz4cat rix, @{bin}/lz4cat rix,
@{bin}/lzma rix, @{bin}/lzma rix,
@{bin}/lzop rix, @{bin}/lzop rix,
@{bin}/mkdir rix, @{bin}/mkdir rix,
@{bin}/mktemp rix, @{bin}/mktemp rix,
@{bin}/rm rix, @{bin}/rm rix,
@{bin}/xz rix,
@{bin}/xzcat rix, @{bin}/xzcat rix,
@{bin}/zstd rix,
/boot/ r, /boot/ r,
owner /boot/initrd.img-* r, owner /boot/initrd.img-* r,

13
apparmor.d/profiles-s-z/xarchiver
View file

@ -28,18 +28,7 @@ profile xarchiver @{exec_path} {
@{bin}/cp rix, @{bin}/cp rix,
# Archivers # Archivers
@{bin}/7z rix, @{archive_path} rix,
@{lib}/p7zip/7z rix,
@{bin}/unrar-nonfree rix,
@{bin}/zip rix,
@{bin}/unzip rix,
@{bin}/tar rix,
@{bin}/xz rix,
@{bin}/bzip2 rix,
@{bin}/cpio rix,
@{bin}/gzip rix,
@{bin}/zstd rix,
# For deb packages
@{bin}/{,@{multiarch}-}ar rix, @{bin}/{,@{multiarch}-}ar rix,
@{open_path} rPx -> child-open, @{open_path} rPx -> child-open,

3
apparmor.d/tunables/multiarch.d/paths
View file

@ -72,4 +72,7 @@
# Backup # Backup
@{backup_path} = @{bin}/@{backup_names} @{lib}/deja-dup/deja-dup-monitor @{backup_path} = @{bin}/@{backup_names} @{lib}/deja-dup/deja-dup-monitor
# Archives
@{archive_path} = @{bin}/@{archive_names} @{lib}/p7zip/7z
# vim:syntax=apparmor # vim:syntax=apparmor

3
apparmor.d/tunables/multiarch.d/programs
View file

@ -96,4 +96,7 @@
# Backup # Backup
@{backup_names} = deja-dup borg @{backup_names} = deja-dup borg
# Archives
@{archive_names} = 7z 7zz ar bzip2 cpio gzip lzip rar tar unrar-nonfree unzip xz zip zstd
# vim:syntax=apparmor # vim:syntax=apparmor