felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): ssh: cleanup.

Browse source
This commit is contained in:
Alexandre Pujol 2025-08-28 21:27:58 +02:00
parent c9813dc34f
commit 61d8cee932
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/ssh/ssh-agent
View file

@ -13,6 +13,7 @@ profile ssh-agent @{exec_path} {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
signal receive set=term peer=cockpit-bridge, signal receive set=term peer=cockpit-bridge,
signal receive set=term peer=cockpit-session,
signal receive set=term peer=gnome-keyring-daemon, signal receive set=term peer=gnome-keyring-daemon,
@{exec_path} mr, @{exec_path} mr,

3
apparmor.d/groups/ssh/ssh-keygen
View file

@ -18,7 +18,8 @@ profile ssh-keygen @{exec_path} {
/etc/ssh/moduli rw, /etc/ssh/moduli rw,
/etc/ssh/ssh_host_*_key* rw, /etc/ssh/ssh_host_*_key* rw,
owner @{HOME}/@{XDG_SSH_DIR}/{,*} rw, owner @{HOME}/@{XDG_SSH_DIR}/ rw,
owner @{HOME}/@{XDG_SSH_DIR}/* rwl -> @{HOME}/@{XDG_SSH_DIR}/*,
owner /tmp/snapd@{int}/*_*{,.pub} w, owner /tmp/snapd@{int}/*_*{,.pub} w,
owner /tmp/snapd@{int}/*.key{,.pub} w, owner /tmp/snapd@{int}/*.key{,.pub} w,

2
apparmor.d/groups/ssh/sshd
View file

@ -102,7 +102,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
owner @{user_download_dirs}/{,**} rwl, owner @{user_download_dirs}/{,**} rwl,
owner @{user_sync_dirs}/{,**} rwl, owner @{user_sync_dirs}/{,**} rwl,
@{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r, @{HOME}/@{XDG_SSH_DIR}/authorized_keys* r,
owner @{user_cache_dirs}/{,motd*} rw, owner @{user_cache_dirs}/{,motd*} rw,
@{att}/@{run}/systemd/sessions/@{int}.ref rw, @{att}/@{run}/systemd/sessions/@{int}.ref rw,

2
apparmor.d/groups/ssh/sshfs
View file

@ -18,7 +18,7 @@ profile sshfs @{exec_path} flags=(complain) {
mount fstype=fuse.sshfs -> @{MOUNTS}/*/, mount fstype=fuse.sshfs -> @{MOUNTS}/*/,
mount fstype=fuse.sshfs -> @{MOUNTS}/*/*/, mount fstype=fuse.sshfs -> @{MOUNTS}/*/*/,
unix (connect, send, receive) type=stream peer=(label="sshfs//fusermount",addr=none), unix (connect, send, receive) type=stream peer=(label="sshfs//fusermount"),
@{exec_path} mr, @{exec_path} mr,