felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update pkexec.

Browse source
This commit is contained in:
Alexandre Pujol 2024-10-16 19:22:52 +01:00
parent 682c98b320
commit 6e2d817805
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 7 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/abstractions/app/pkexec
View file

@ -1,6 +1,7 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
# LOGPROF-SUGGEST: no
# Minimal set of rules for pkexec. # Minimal set of rules for pkexec.
@ -18,6 +19,7 @@
capability net_admin, capability net_admin,
capability setgid, capability setgid,
capability setuid, capability setuid,
capability sys_ptrace,
capability sys_resource, capability sys_resource,
network netlink raw, # PAM network netlink raw, # PAM
@ -26,8 +28,6 @@
@{bin}/pkexec mr, @{bin}/pkexec mr,
@{etc_ro}/environment r,
@{etc_ro}/security/limits.d/{,*} r,
/etc/shells r, /etc/shells r,
owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/loginuid r,

2
apparmor.d/groups/ubuntu/update-notifier
View file

@ -72,8 +72,6 @@ profile update-notifier @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/pkexec> include <abstractions/app/pkexec>
capability sys_ptrace,
ptrace read peer=update-notifier, ptrace read peer=update-notifier,
@{lib}/update-notifier/package-system-locked Px, @{lib}/update-notifier/package-system-locked Px,

10
apparmor.d/profiles-m-r/pkexec
View file

@ -8,15 +8,15 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/pkexec @{exec_path} = @{bin}/pkexec
profile pkexec @{exec_path} flags=(complain) { profile pkexec @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/pkexec> include <abstractions/app/pkexec>
audit capability sys_nice, capability sys_nice,
signal (send) set=(term, kill) peer=polkit-agent-helper, signal send set=(term, kill) peer=polkit-agent-helper,
ptrace (read), ptrace read,
@{exec_path} mr, @{exec_path} mr,
@ -28,7 +28,7 @@ profile pkexec @{exec_path} flags=(complain) {
/etc/default/locale r, /etc/default/locale r,
@{PROC}/@{pid}/fdinfo/@{int} r, @{PROC}/@{pid}/fdinfo/@{int} r,
@{PROC}/@{pids}/stat r, @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
include if exists <local/pkexec> include if exists <local/pkexec>