felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Profile update after tests on Arch.

Browse source
This commit is contained in:
Alexandre Pujol 2021-04-02 10:18:29 +01:00
parent e4266d9cda
commit 604b184c9d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
28 changed files with 121 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/systemd/child-systemctl
View file

@ -19,6 +19,7 @@ profile child-systemctl {
include <abstractions/wutmp>
capability sys_ptrace,
capability net_admin,
ptrace (read),

13
apparmor.d/groups/systemd/systemd-analyze
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -17,7 +18,11 @@ profile systemd-analyze @{exec_path} {
signal (send) peer=child-pager,
network inet dgram,
network netlink raw,
@{exec_path} mr,
/{usr/,}lib/systemd/system-environment-generators/* rix,
/{usr/,}bin/pager rPx -> child-pager,
/{usr/,}bin/less rPx -> child-pager,
@ -35,6 +40,7 @@ profile systemd-analyze @{exec_path} {
@{sys}/fs/cgroup/{,**} r,
@{sys}/fs/cgroup/{systemd,unified}/**/cgroup.procs rw,
@{sys}/fs/cgroup/unified/**/init.scope/ rw,
@{sys}/firmware/acpi/tables/FPDT r,
@{sys}/module/**/uevent r,
@ -50,6 +56,13 @@ profile systemd-analyze @{exec_path} {
/usr/ r,
/etc/default/locale r,
/etc/locale.conf r,
@{sys}/firmware/efi/efivars/LoaderTimeInitUSec-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,
@{sys}/firmware/efi/efivars/LoaderTimeExecUSec-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,
/dev/tty rw,
/dev/pts/1 rw,
include if exists <local/systemd-analyze>
}

4
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -21,6 +22,9 @@ profile systemd-hostnamed @{exec_path} {
@{sys}/devices/virtual/dmi/id/board_vendor r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/virtual/dmi/id/uevent r,
@{run}/udev/data/+dmi:id r,
/etc/hostname rw,
/etc/.#hostname* rw,

3
apparmor.d/groups/systemd/systemd-journalctl
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -13,6 +14,8 @@ profile systemd-journalctl @{exec_path} {
include <abstractions/systemd-common>
capability sys_resource,
capability dac_read_search,
capability dac_override,
signal (send) peer=child-pager,

4
apparmor.d/groups/systemd/systemd-journald
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -15,6 +16,7 @@ profile systemd-journald @{exec_path} {
capability syslog,
capability sys_ptrace,
capability dac_read_search,
capability kill,
@{exec_path} mr,
@ -33,6 +35,7 @@ profile systemd-journald @{exec_path} {
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
@{run}/udev/data/c10:224 r, # for /dev/tpm0
@{run}/udev/data/c243:0 r,
@{run}/udev/data/+usb:* r,
@{run}/udev/data/+pci:* r,
@{run}/udev/data/+hid:* r,
@ -42,6 +45,7 @@ profile systemd-journald @{exec_path} {
@{run}/udev/data/+usb-serial:* r,
@{run}/udev/data/+platform:regulatory.[0-9]* r,
@{run}/udev/data/+platform:simple-framebuffer.[0-9]* r,
@{run}/udev/data/+platform:iTCO_wdt r,
@{sys}/devices/**/uevent r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,

6
apparmor.d/groups/systemd/systemd-localed
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -21,7 +22,12 @@ profile systemd-localed @{exec_path} {
/etc/default/locale rw,
/etc/default/.#locale* rw,
/etc/locale.conf r,
/etc/vconsole.conf r,
/usr/share/systemd/language-fallback-map r,
/usr/share/X11/xkb/rules/evdev r,
/etc/X11/xorg.conf.d/*.conf r,
}

4
apparmor.d/groups/systemd/systemd-rfkill
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -11,8 +12,7 @@ profile systemd-rfkill @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
# Needed?
audit deny capability net_admin,
capability net_admin,
network netlink raw,

4
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -12,6 +13,9 @@ profile systemd-timesyncd @{exec_path} {
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,
capability sys_time,
@{exec_path} mr,