felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-05 22:47:37 +01:00
parent 671dcca38d
commit 63e5980d8d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
33 changed files with 177 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

43
apparmor.d/profiles-m-r/needrestart
View file

@ -7,28 +7,53 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/needrestart
profile needrestart @{exec_path} {
profile needrestart @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/perl>
include <abstractions/python>
include <abstractions/wutmp>
capability checkpoint_restore,
capability dac_read_search,
capability sys_ptrace,
ptrace (read),
@{exec_path} mr,
@{exec_path} mrix,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}bin/who rix,
/usr/share/debconf/frontend rix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/dpkg-query rpx,
/{usr/,}bin/locale rix,
/{usr/,}bin/python3.[0-9]* rix,
/{usr/,}bin/stty rix,
/{usr/,}bin/systemctl rPx,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}bin/udevadm rPx,
/{usr/,}bin/whiptail rPx,
/{usr/,}bin/who rix,
/{usr/,}lib/needrestart/iucode-scan-versions rPx,
/usr/share/debconf/frontend rix,
/usr/share/needrestart/{,**} r,
/usr/share/unattended-upgrades/unattended-upgrade-shutdown r,
/etc/debconf.conf r,
/etc/needrestart/{,**} r,
/etc/needrestart/hook.d/* rix,
/etc/needrestart/restart.d/* rix,
/etc/shadow r,
@{PROC}/ r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/environ r,
@{PROC}/@{pids}/stat r,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pids}/cgroup r,
@{PROC}/ r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/environ r,
@{PROC}/@{pids}/maps r,
@{PROC}/@{pids}/stat r,
/dev/ r,
/dev/**/ r,