feat(profile): general update.
This commit is contained in:
Alexandre Pujol
parent
9a612f754c
commit
5ea6ede589
21 changed files with 49 additions and 19 deletions
|
|
@ -31,6 +31,8 @@ profile apt-methods-http @{exec_path} {
|
|||
signal (receive) peer=unattended-upgrade,
|
||||
signal (receive) peer=update-manager,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# apt-helper gets "no new privs" so "rix" it
|
||||
|
|
|
|||
|
|
@ -17,8 +17,8 @@ profile child-dpkg {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
# Needed?
|
||||
deny capability setgid,
|
||||
capability dac_read_search,
|
||||
capability setgid,
|
||||
|
||||
/{usr/,}bin/dpkg mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -42,12 +42,14 @@ profile evolution-calendar-factory @{exec_path} {
|
|||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
owner @{user_share_dirs}/evolution/calendar/{,**} rwk,
|
||||
owner @{user_share_dirs}/evolution/tasks/system/ w,
|
||||
owner @{user_share_dirs}/evolution/tasks/system/tasks.ics r,
|
||||
owner @{user_cache_dirs}/evolution/calendar/{,**} rwk,
|
||||
owner @{user_cache_dirs}/evolution/tasks/{,**} rwk,
|
||||
|
||||
owner @{user_share_dirs}/evolution/calendar/{,**} rwk,
|
||||
owner @{user_share_dirs}/evolution/tasks/system/ w,
|
||||
owner @{user_share_dirs}/evolution/tasks/system/tasks.ics* rw,
|
||||
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
|
|
|
|||
|
|
@ -84,6 +84,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
owner @{run}/user/@{uid}/keyring/control rw,
|
||||
|
||||
@{run}/cockpit/active.motd r,
|
||||
@{run}/faillock/[a-zA-z0-9]* rwk,
|
||||
@{run}/gdm{3,}/custom.conf r,
|
||||
@{run}/motd.d/{,*} r,
|
||||
|
|
|
|||
|
|
@ -13,10 +13,10 @@ profile networkctl @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/dbus-strict>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_module,
|
||||
|
||||
# Needed? (#FIXME#)
|
||||
audit capability sys_resource,
|
||||
audit capability sys_module,
|
||||
|
||||
signal send peer=child-pager,
|
||||
|
||||
|
|
@ -27,7 +27,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected) {
|
|||
dbus send bus=system path=/org/freedesktop/network[0-9]
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
peer=(name=org.freedesktop.network[0-9]),
|
||||
peer=(name=org.freedesktop.network1),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,6 +14,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted
|
|||
include <abstractions/openssl>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
capability setgid,
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ profile update-motd-updates-available @{exec_path} {
|
|||
/etc/machine-id r,
|
||||
|
||||
/var/lib/update-notifier/{,*} rw,
|
||||
/var/lib/ubuntu-advantage/apt-esm/var/cache/apt/pkgcache.bin* rw,
|
||||
/var/lib/ubuntu-advantage/apt-esm/var/cache/apt/*pkgcache.bin* rw,
|
||||
|
||||
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -23,6 +23,7 @@ profile cockpit-bridge @{exec_path} {
|
|||
|
||||
signal (send) set=term peer=cockpit-pcp,
|
||||
signal (send) set=term peer=dbus-daemon,
|
||||
signal (send) set=term peer=journalctl,
|
||||
signal (send) set=term peer=ssh-agent,
|
||||
signal (send) set=term peer=sudo,
|
||||
signal (send) set=term peer=unconfined,
|
||||
|
|
@ -36,9 +37,11 @@ profile cockpit-bridge @{exec_path} {
|
|||
/usr/share/cockpit/{,**} r,
|
||||
|
||||
/etc/cockpit/{,**} r,
|
||||
/etc/login.defs r,
|
||||
/etc/machine-id r,
|
||||
/etc/motd r,
|
||||
/etc/shadow r,
|
||||
/etc/shells r,
|
||||
|
||||
owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -11,10 +11,13 @@ profile docker-proxy @{exec_path} {
|
|||
include <abstractions/base>
|
||||
|
||||
capability net_admin,
|
||||
capability net_bind_service,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
signal (receive) set=int peer=dockerd,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
|
||||
|
|
|
|||
|
|
@ -47,6 +47,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
|
|||
ptrace (read) peer=docker-*,
|
||||
ptrace (read) peer=unconfined,
|
||||
|
||||
signal (send) set=int peer=docker-proxy,
|
||||
signal (send) set=kill peer=docker-*,
|
||||
signal (send) set=term peer=containerd,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,6 +14,8 @@ profile virtinterfaced @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read) peer=virtqemud,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/gconv/gconv-modules rm,
|
||||
|
|
@ -33,6 +35,8 @@ profile virtinterfaced @{exec_path} flags=(attach_disconnected) {
|
|||
@{sys}/class/ r,
|
||||
@{sys}/class/net/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/net/{,**} r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]*/meminfo r,
|
||||
@{sys}/devices/virtual/net/{,**} r,
|
||||
|
||||
owner @{PROC}/@{pids}/stat r,
|
||||
|
|
|
|||
|
|
@ -17,11 +17,13 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read) peer=virtqemud,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/mdevctl rPx,
|
||||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
/usr/share/hwdata/*.ids r,
|
||||
|
||||
/etc/mdevctl.d/{,**} r,
|
||||
|
||||
|
|
@ -46,7 +48,8 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
@{run}/udev/data/c1:[0-9]* r, # For RAM disk
|
||||
@{run}/udev/data/c10:[0-9]* r, # For non-serial mice, misc features
|
||||
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
|
||||
@{run}/udev/data/c13:[0-9]* r, # For /dev/input/*
|
||||
@{run}/udev/data/c29:[0-9]* r, # For /dev/fb[0-9]*
|
||||
@{run}/udev/data/c90:[0-9]* r, # For RAM, ROM, Flash
|
||||
@{run}/udev/data/c116:[0-9]* r, # For ALSA
|
||||
@{run}/udev/data/c226:[0-9]* r, # For /dev/dri/card[0-9]*
|
||||
|
|
@ -68,7 +71,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
|
|||
@{sys}/devices/pci[0-9]*/**/sriov_totalvfs r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]*/meminfo r,
|
||||
@{sys}/devices/virtual/dmi/id/{product_name,sys_vendor,board_vendor,bios_vendor,bios_date} r,
|
||||
@{sys}/devices/virtual/dmi/id/{product_name,sys_vendor,board_vendor,bios_vendor,bios_date,bios_version,product_version} r,
|
||||
@{sys}/devices/virtual/net/{,**} r,
|
||||
@{sys}/kernel/iommu_groups/ r,
|
||||
@{sys}/kernel/iommu_groups/[0-9]*/devices/ r,
|
||||
|
|
|
|||
|
|
@ -14,13 +14,17 @@ profile virtsecretd @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read) peer=virtqemud,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{user_config_dirs}/libvirt/secrets/ rw,
|
||||
owner @{user_config_dirs}/libvirt/secrets/run/{,*} rwk,
|
||||
|
||||
@{run}/systemd/inhibit/*.ref rw,
|
||||
owner @{run}/user/@{uid}/libvirt/common/system.token rwk,
|
||||
owner @{run}/user/@{uid}/libvirt/secrets/ rw,
|
||||
owner @{run}/user/@{uid}/libvirt/secrets/run rw,
|
||||
owner @{run}/user/@{uid}/libvirt/secrets/run/* rwk,
|
||||
owner @{run}/user/@{uid}/libvirt/secrets/run/{,*} rwk,
|
||||
owner @{run}/user/@{uid}/libvirt/virtsecretd* rwk,
|
||||
|
||||
@{run}/utmp rk,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue