felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): start implementing systemctl subprofile instead of using child-systemctl.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-05 17:45:02 +00:00
parent a7e37528d5
commit 70963a50b6
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
11 changed files with 75 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/network/NetworkManager
View file

@ -94,7 +94,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
@{bin}/kmod rPx,
@{bin}/netconfig rPUx,
@{bin}/resolvconf rPx,
@{bin}/systemctl rPx -> child-systemctl,
@{bin}/systemctl rCx -> systemctl,
@{lib}/{,NetworkManager/}nm-daemon-helper rPx,
@{lib}/{,NetworkManager/}nm-dhcp-helper rPx,
@{lib}/{,NetworkManager/}nm-dispatcher rPx,
@ -153,5 +153,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
/dev/rfkill rw,
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include if exists <local/NetworkManager_systemctl>
}
include if exists <local/NetworkManager>
}

6
apparmor.d/groups/network/netplan.script
View file

@ -49,14 +49,10 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
profile systemctl {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/systemctl>
capability net_admin,
@{bin}/systemctl mr,
owner @{run}/systemd/private rw,
include if exists <local/netplan.script_systemctl>
}