felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update systemd-homework/homed as they get stacked.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-29 23:40:49 +02:00
parent 28d9d48de4
commit 581a55c726
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
2 changed files with 73 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
apparmor.d/groups/systemd/systemd-homed
View file

@ -14,6 +14,8 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
include <abstractions/nameservice-strict>
include <abstractions/common/systemd>
userns,
capability chown,
capability dac_override,
capability dac_read_search,
@ -24,6 +26,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
capability setpcap,
capability setuid,
capability sys_admin,
capability sys_ptrace,
capability sys_resource,
network inet dgram,
@ -32,16 +35,24 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
network inet6 raw,
network netlink raw,
mount options=(rw, rslave) -> @{run}/,
mount /dev/dm-@{int} -> @{run}/systemd/user-home-mount/,
mount -> @{run}/systemd/user-home-mount/,
mount options=(rw private) -> @{run}/systemd/user-home-mount/,
mount options=(rw rslave) -> @{run}/,
umount @{run}/systemd/user-home-mount/,
signal (send receive) set=kill peer=systemd-homed//&systemd-homework,
ptrace read peer=systemd-homed//&systemd-homework,
unix bind type=stream addr=@@{udbus}/bus/systemd-homed/system,
#aa:dbus own bus=system name=org.freedesktop.home1
#aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd
@{exec_path} mr,
@{lib}/systemd/systemd-homework rPx -> systemd-homed//&systemd-homework,
@{lib}/systemd/systemd-homework rPx -> &systemd-homework,
@{sbin}/mkfs.btrfs rPx,
@{sbin}/mkfs.fat rPx,
@{sbin}/mke2fs rPx,
@ -74,9 +85,12 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pid}/cgroup r,
@{PROC}/devices r,
@{PROC}/pressure/* r,
@{PROC}/swaps r,
@{PROC}/sys/fs/nr_open r,
@{PROC}/sysvipc/{shm,sem,msg} r,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/uid_map w,
/dev/loop-control rwk,

58
apparmor.d/groups/systemd/systemd-homework
View file

@ -7,14 +7,68 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-homework
profile systemd-homework @{exec_path} {
profile systemd-homework @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/common/systemd>
include <abstractions/disks-write>
include <abstractions/nameservice-strict>
userns,
capability chown,
capability fowner,
capability fsetid,
capability setfcap,
capability setgid,
capability setuid,
capability sys_admin,
capability sys_resource,
network netlink raw,
mount options=(rw rslave) -> @{run}/,
mount -> @{run}/systemd/user-home-mount/,
umount @{run}/systemd/user-home-mount/,
signal (send receive) set=kill peer=systemd-homed//&systemd-homework,
ptrace read peer=systemd-homed//&systemd-homework,
@{exec_path} mr,
@{sbin}/mkfs.btrfs rPx,
@{sbin}/mkfs.fat rPx,
@{sbin}/mke2fs rPx,
/etc/machine-id r,
/etc/skel/{,**} r,
/var/cache/systemd/home/{,**} rw,
@{HOMEDIRS}/ r,
@{HOMEDIRS}/.#homework@{user}.* rw,
@{HOMEDIRS}/@{user}.home rw,
@{run}/ r,
@{run}/cryptsetup/ r,
@{run}/cryptsetup/* rwk,
@{run}/systemd/user-home-mount/ rw,
@{run}/systemd/user-home-mount/@{user}/{,**} rw,
@{sys}/fs/ r,
@{PROC}/devices r,
@{PROC}/swaps r,
@{PROC}/sys/fs/nr_open r,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/uid_map w,
/dev/loop-control rwk,
/dev/loop@{int} rw,
/dev/mapper/control rw,
include if exists <local/systemd-homework>
}