felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(profile): fixes some issues raised by tests.

Browse source
This commit is contained in:
Alexandre Pujol 2025-07-22 23:54:40 +02:00 • committed by Alex
parent 94bae18c2c
commit 5adc290870
4 changed files with 35 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/abstractions/base.d/complete
View file

@ -10,6 +10,7 @@
# Allow to receive some signals from new well-known profiles
signal (receive) peer=btop,
signal (receive) peer=htop,
signal (receive) peer=pkill,
signal (receive) peer=sudo,
signal (receive) peer=top,
signal (receive) set=(cont,term,kill,stop) peer=systemd-shutdown,

38
apparmor.d/groups/utils/lsfd
View file

@ -11,15 +11,25 @@ profile lsfd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability bpf,
capability checkpoint_restore,
capability dac_read_search,
capability net_admin,
capability sys_admin,
capability sys_chroot,
capability sys_ptrace,
capability sys_resource,
capability syslog,
network inet dgram,
network inet stream,
network inet6 dgram,
network inet6 raw,
network inet6 stream,
network inet6 stream,
network netlink dgram,
network netlink raw,
network packet dgram,
ptrace read,
ptrace trace,
@ -38,20 +48,20 @@ profile lsfd @{exec_path} flags=(attach_disconnected) {
@{sys}/kernel/cpu_byteorder r,
@{PROC}/ r,
@{PROC}/@{pid}/ r,
@{PROC}/@{pid}/comm r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/fdinfo/@{int} r,
@{PROC}/@{pid}/mountinfo r,
@{PROC}/@{pid}/net/* r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/ r,
@{PROC}/devices r,
@{PROC}/misc r,
@{PROC}/partitions r,
@{PROC}/tty/drivers r,
owner @{PROC}/@{pid}/syscall r,
@{PROC}/ r,
@{PROC}/@{pid}/ r,
@{PROC}/@{pid}/comm r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/fdinfo/@{int} r,
@{PROC}/@{pid}/mountinfo r,
@{PROC}/@{pid}/net/* r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/syscall r,
@{PROC}/@{pid}/task/ r,
@{PROC}/devices r,
@{PROC}/misc r,
@{PROC}/partitions r,
@{PROC}/tty/drivers r,
include if exists <local/lsfd>
}

2
apparmor.d/groups/utils/lsipc
View file

@ -27,6 +27,8 @@ profile lsipc @{exec_path} {
@{PROC}/sysvipc/sem r,
@{PROC}/sysvipc/shm r,
/dev/mqueue/ r,
include if exists <local/lsipc>
}

16
apparmor.d/profiles-m-r/mkinitramfs
View file

@ -93,14 +93,14 @@ profile mkinitramfs @{exec_path} {
owner /var/lib/kdump/initramfs-tools/** rw,
owner /var/lib/kdump/initrd.* rw,
/var/tmp/ r,
/var/tmp/mkinitramfs_@{rand6}/** w,
/var/tmp/modules_@{rand6} rw,
owner /var/tmp/mkinitramfs_@{rand6} rw,
owner /var/tmp/mkinitramfs_@{rand6}/ rw,
owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**,
owner /var/tmp/mkinitramfs-@{rand6} rw,
owner /var/tmp/mkinitramfs-*_@{rand6} rw,
/var/tmp/ r,
/var/tmp/mkinitramfs_@{rand6}/** w,
/var/tmp/modules_@{rand6} rw,
/var/tmp/mkinitramfs_@{rand6} rw,
/var/tmp/mkinitramfs_@{rand6}/ rw,
/var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**,
/var/tmp/mkinitramfs-@{rand6} rw,
/var/tmp/mkinitramfs-*_@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw,