refractor: move more profiles to groups.
This commit is contained in:
Alexandre Pujol
parent
5aab9da030
commit
5870e1ee40
48 changed files with 0 additions and 0 deletions
|
|
@ -1,66 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/{btrfs,btrfsck}
|
||||
profile btrfs @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
capability sys_admin,
|
||||
capability fowner,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/var/lib/btrfs/ rw,
|
||||
/var/lib/btrfs/scrub.progress.@{uuid} rw,
|
||||
/var/lib/btrfs/scrub.status.@{uuid}{,_tmp} rwk,
|
||||
|
||||
/ r,
|
||||
/.snapshots/ r,
|
||||
/boot/ r,
|
||||
/boot/**/ r,
|
||||
/home/ r,
|
||||
/opt/ r,
|
||||
/root/ r,
|
||||
/srv/ r,
|
||||
/usr/local/ r,
|
||||
/var/ r,
|
||||
@{MOUNTS}/ r,
|
||||
@{MOUNTS}/ext2_saved/ rw,
|
||||
@{MOUNTS}/ext2_saved/image rw,
|
||||
@{MOUNTS}/*/ r,
|
||||
@{MOUNTS}/*/ext2_saved/ rw,
|
||||
@{MOUNTS}/*/ext2_saved/image rw,
|
||||
|
||||
# To be able to manage btrfs volumes
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
# For fsck of the btrfs filesystem directly from gparted
|
||||
owner @{tmp}/gparted-*/ rw,
|
||||
|
||||
@{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
@{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
@{run}/snapper-tools-*/ r,
|
||||
@{run}/snapper-tools-@{rand6}/@/.snapshots/@{int}/snapshot r,
|
||||
|
||||
@{sys}/fs/btrfs/@{uuid}/** r,
|
||||
|
||||
@{PROC}/partitions r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/btrfs-control rw,
|
||||
/dev/pts/@{int} rw,
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/btrfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/btrfs-convert
|
||||
profile btrfs-convert @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/btrfs-convert>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/btrfs-find-root
|
||||
profile btrfs-find-root @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
include if exists <local/btrfs-find-root>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/btrfs-image
|
||||
profile btrfs-image @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# Image files
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/btrfs-image>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/btrfs-map-logical
|
||||
profile btrfs-map-logical @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
include if exists <local/btrfs-map-logical>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/btrfs-select-super
|
||||
profile btrfs-select-super @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/btrfs-select-super>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/btrfstune
|
||||
profile btrfstune @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/partitions r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
owner @{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
|
||||
include if exists <local/btrfstune>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/filecap
|
||||
profile filecap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# The default behavior is to check only the directories in the PATH environmental variable.
|
||||
@{bin}/ r,
|
||||
@{bin}/* r,
|
||||
/usr/local/sbin/ r,
|
||||
/usr/local/sbin/* r,
|
||||
/usr/local/bin/ r,
|
||||
/usr/local/bin/* r,
|
||||
|
||||
# It's also possible to check any dir/file in the system by using the "-a" flag.
|
||||
#capability dac_read_search,
|
||||
#/ r,
|
||||
#/** r,
|
||||
|
||||
include if exists <local/filecap>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fsck.btrfs
|
||||
profile fsck.btrfs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
@{sh_path} rix,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
include if exists <local/fsck.btrfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fsck.fat @{bin}/fsck.msdos @{bin}/fsck.vfat @{bin}/dosfsck
|
||||
profile fsck.fat @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
owner @{run}/systemd/fsck.progress rw,
|
||||
|
||||
include if exists <local/fsck.fat>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue