From 56afb90084a47f1bce2f83a4f118df32fe1e9127 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 18 Jun 2022 21:56:09 +0100 Subject: [PATCH] fix(profiles): fix some abstraction definitions. --- .../abstractions/dbus-session-strict.d/complete | 4 +++- apparmor.d/abstractions/disks-read | 8 +++----- apparmor.d/abstractions/disks-write | 17 +++++------------ 3 files changed, 11 insertions(+), 18 deletions(-) diff --git a/apparmor.d/abstractions/dbus-session-strict.d/complete b/apparmor.d/abstractions/dbus-session-strict.d/complete index 8578e7d2d..1dc40e4c9 100644 --- a/apparmor.d/abstractions/dbus-session-strict.d/complete +++ b/apparmor.d/abstractions/dbus-session-strict.d/complete @@ -2,7 +2,9 @@ # Copyright (C) 2022 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - unix (bind, listen) type=stream addr="@/tmp/dbus-*", + unix (connect, send, receive, accept) + type=stream + addr="@/tmp/dbus-*", unix (connect, receive, send, accept) type=stream diff --git a/apparmor.d/abstractions/disks-read b/apparmor.d/abstractions/disks-read index 146a45bef..97bae8b72 100644 --- a/apparmor.d/abstractions/disks-read +++ b/apparmor.d/abstractions/disks-read @@ -86,15 +86,13 @@ # changes, it's better to allow the whole range (240-254) instead of the single major numbers # visible in the /proc/devices file. # [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt - @{run}/udev/data/b252:[0-9]* r, - @{run}/udev/data/b253:[0-9]* r, + @{run}/udev/data/b24[0-9]:[0-9]* r, + @{run}/udev/data/b25[0-4]:[0-9]* r, @{run}/udev/data/b259:[0-9]* r, - @{run}/udev/data/c24[0-9]:[0-9]* r, - @{run}/udev/data/c25[0-4]:[0-9]* r, - @{run}/udev/data/b230:[0-9]* r, # /dev/zvol* @{run}/udev/data/b11:[0-9]* r, # for /dev/sr* @{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk* + @{run}/udev/data/b230:[0-9]* r, # for /dev/zvol* @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* diff --git a/apparmor.d/abstractions/disks-write b/apparmor.d/abstractions/disks-write index e72a89060..fd5c7b734 100644 --- a/apparmor.d/abstractions/disks-write +++ b/apparmor.d/abstractions/disks-write @@ -68,23 +68,16 @@ # changes, it's better to allow the whole range (240-254) instead of the single major numbers # visible in the /proc/devices file. # [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt - @{run}/udev/data/b252:[0-9]* r, - @{run}/udev/data/b253:[0-9]* r, + @{run}/udev/data/b24[0-9]:[0-9]* r, + @{run}/udev/data/b25[0-4]:[0-9]* r, @{run}/udev/data/b259:[0-9]* r, - @{run}/udev/data/c24[0-9]:[0-9]* r, - @{run}/udev/data/c25[0-4]:[0-9]* r, - @{run}/udev/data/b230:[0-9]* r, # /dev/zvol* @{run}/udev/data/b11:[0-9]* r, # for /dev/sr* @{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk* - @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* - @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* - - @{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk* - @{run}/udev/data/b11:[0-9]* r, # for /dev/sr* - @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* - @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* @{run}/udev/data/b2:[0-9]* r, # for /dev/fd* + @{run}/udev/data/b230:[0-9]* r, # for /dev/zvol* + @{run}/udev/data/b7:[0-9]* r, # for /dev/loop* + @{run}/udev/data/b8:[0-9]* r, # for /dev/sd* @{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**