felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(tunable): add the new @{user} variable

Browse source
This commit is contained in:
Alexandre Pujol 2024-05-07 17:41:34 +01:00
parent 1842f8a4d5
commit 66c8f42d94
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/profiles-a-f/arduino
View file

@ -68,8 +68,8 @@ profile arduino @{exec_path} {
/tmp/ r, /tmp/ r,
owner @{tmp}/cc*.{s,res,c,o,ld,le} rw, owner @{tmp}/cc*.{s,res,c,o,ld,le} rw,
owner @{tmp}/hsperfdata_*/ rw, owner @{tmp}/hsperfdata_@{user}/ rw,
owner @{tmp}/hsperfdata_*/@{pid} rw, owner @{tmp}/hsperfdata_@{user}/@{pid} rw,
owner @{tmp}/untitled[0-9]*.tmp rw, owner @{tmp}/untitled[0-9]*.tmp rw,
owner @{tmp}/untitled[0-9]*.tmp/{,**} rw, owner @{tmp}/untitled[0-9]*.tmp/{,**} rw,
owner @{tmp}/console[0-9]*.tmp rw, owner @{tmp}/console[0-9]*.tmp rw,

4
apparmor.d/profiles-g-l/hardinfo
View file

@ -154,8 +154,8 @@ profile hardinfo @{exec_path} {
@{sys}/fs/cgroup/{,**} r, @{sys}/fs/cgroup/{,**} r,
owner @{tmp}/hsperfdata_*/ rw, owner @{tmp}/hsperfdata_@{user}/ rw,
owner @{tmp}/hsperfdata_*/@{pid} rw, owner @{tmp}/hsperfdata_@{user}/@{pid} rw,
} }

4
apparmor.d/profiles-g-l/jdownloader
View file

@ -61,8 +61,8 @@ profile jdownloader @{exec_path} {
owner @{HOME}/.install4j rw, owner @{HOME}/.install4j rw,
owner @{tmp}/hsperfdata_*/ rw, owner @{tmp}/hsperfdata_@{user}/ rw,
owner @{tmp}/hsperfdata_*/@{pid} rw, owner @{tmp}/hsperfdata_@{user}/@{pid} rw,
# If the @{JD_INSTALLDIR}/tmp/ dir can't be accessed, the /tmp/ dir will be used instead # If the @{JD_INSTALLDIR}/tmp/ dir can't be accessed, the /tmp/ dir will be used instead
owner @{tmp}/SevenZipJBinding-*/ rw, owner @{tmp}/SevenZipJBinding-*/ rw,
owner @{tmp}/SevenZipJBinding-*/lib7-Zip-JBinding.so mrw, owner @{tmp}/SevenZipJBinding-*/lib7-Zip-JBinding.so mrw,

7
apparmor.d/tunables/multiarch.d/system
View file

@ -33,6 +33,11 @@
# Universally unique identifier # Universally unique identifier
@{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h} @{uuid}=@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}[-_]@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}@{h}
# Username & group valid characters
@{u}=[a-z0-9_]
@{user}=[a-z_]{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}{@{u},}
@{group}=@{user}
# Shortcut for PCI device # Shortcut for PCI device
@{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h} @{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h}
@{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h} @{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h}
@ -48,7 +53,7 @@
# @{MOUNTDIRS} is a space-separated list of where user mount directories # @{MOUNTDIRS} is a space-separated list of where user mount directories
# are stored, for programs that must enumerate all mount directories on a # are stored, for programs that must enumerate all mount directories on a
# system. # system.
@{MOUNTDIRS}=/media/ @{run}/media/*/ /mnt/ @{MOUNTDIRS}=/media/ @{run}/media/@{user}/ /mnt/
# @{MOUNTS} is a space-separated list of all user mounted directories. # @{MOUNTS} is a space-separated list of all user mounted directories.
@{MOUNTS}=@{MOUNTDIRS}/*/ @{run}/user/@{uid}/gvfs/ @{MOUNTS}=@{MOUNTDIRS}/*/ @{run}/user/@{uid}/gvfs/