felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): start implementing systemctl subprofile instead of using child-systemctl.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-05 17:45:02 +00:00
parent a7e37528d5
commit 70963a50b6
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
11 changed files with 75 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

11
apparmor.d/profiles-m-r/needrestart
View file

@ -31,7 +31,7 @@ profile needrestart @{exec_path} flags=(attach_disconnected) {
@{bin}/python3.@{int} rix,
@{bin}/sed rix,
@{bin}/stty rix,
@{bin}/systemctl rPx -> child-systemctl,
@{bin}/systemctl rCx -> systemctl,
@{bin}/systemd-detect-virt rPx,
@{bin}/udevadm rPx,
@{bin}/unix_chkpwd rPx,
@ -72,5 +72,14 @@ profile needrestart @{exec_path} flags=(attach_disconnected) {
/dev/ r,
/dev/**/ r,
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
capability net_admin,
include if exists <local/needrestart_systemctl>
}
include if exists <local/needrestart>
}