felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update profiles for apparmor3

Browse source
This commit is contained in:
Mikhail Morfikov 2020-12-10 22:33:39 +01:00
parent 503cf496bf
commit 7067edcf70
No known key found for this signature in database
GPG key ID: 32D9CB634796CCA1
776 changed files with 6867 additions and 5199 deletions
Download patch file Download diff file Expand all files Collapse all files

34
apparmor.d/openvpn
View file

@ -19,21 +19,25 @@
# DNS/resolver script is stored in: /etc/openvpn/update-resolv-conf{,.sh}
# If a user wants to type user/pass interactively, systemd-ask-password is invoked for that.
#abi <abi/3.0>,
abi <abi/3.0>,
#include <tunables/global>
include <tunables/global>
@{exec_path} = /{usr/,}sbin/openvpn
profile openvpn @{exec_path} {
#include <abstractions/base>
#include <abstractions/nameservice-strict>
#include <abstractions/openssl>
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
capability net_admin,
# These are needed when user/group are set in a OpenVPN config file
capability setuid,
capability setgid,
network inet stream,
network inet6 stream,
network netlink raw,
@{exec_path} mr,
# OpenVPN config
@ -56,8 +60,8 @@ profile openvpn @{exec_path} {
profile systemd-ask-password {
#include <abstractions/base>
#include <abstractions/consoles>
include <abstractions/base>
include <abstractions/consoles>
/{usr/,}bin/systemd-ask-password mr,
@ -67,9 +71,9 @@ profile openvpn @{exec_path} {
}
profile update-resolv {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice-strict>
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability net_admin,
@ -87,12 +91,14 @@ profile openvpn @{exec_path} {
}
profile force-user-traffic-via-vpn {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice-strict>
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability net_admin,
network netlink raw,
/etc/openvpn/ r,
/etc/openvpn/force-user-traffic-via-vpn.sh r,
@ -114,5 +120,5 @@ profile openvpn @{exec_path} {
}
#include if exists <local/openvpn>
include if exists <local/openvpn>
}