felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): improve signal across profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-03-30 18:54:27 +02:00
parent 73e3ac6cbd
commit 71a8bf6be8
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/groups/pacman/makepkg
View file

@ -86,8 +86,9 @@ profile makepkg @{exec_path} {
ptrace read, ptrace read,
signal send set=winch peer=pacman, signal send set=(term winch) peer=pacman,
signal send set=winch peer=pacman//systemctl, signal send set=(term winch) peer=pacman//systemctl,
signal send set=(term winch) peer=systemd-tty-ask-password-agent,
@{bin}/pacman Px, @{bin}/pacman Px,

4
apparmor.d/groups/pacman/pacman
View file

@ -41,7 +41,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
ptrace read, ptrace read,
signal send, signal send,
signal receive set=winch peer=makepkg//sudo, signal receive set=(term winch) peer=makepkg//sudo,
@{exec_path} mrix, @{exec_path} mrix,
@ -200,7 +200,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
signal send set=cont peer=child-pager, signal send set=cont peer=child-pager,
signal send set=(cont term) peer=systemd-tty-ask-password-agent, signal send set=(cont term) peer=systemd-tty-ask-password-agent,
signal receive set=winch peer=makepkg//sudo, signal receive set=(term winch) peer=makepkg//sudo,
@{pager_path} rPx -> child-pager, @{pager_path} rPx -> child-pager,
@{bin}/systemd-tty-ask-password-agent rPx, @{bin}/systemd-tty-ask-password-agent rPx,

1
apparmor.d/groups/systemd/systemd-tty-ask-password-agent
View file

@ -18,6 +18,7 @@ profile systemd-tty-ask-password-agent @{exec_path} {
capability sys_resource, capability sys_resource,
signal receive set=(term cont) peer=*//systemctl, signal receive set=(term cont) peer=*//systemctl,
signal receive set=(term cont) peer=deb-systemd-invoke,
signal receive set=(term cont) peer=default, signal receive set=(term cont) peer=default,
signal receive set=(term cont) peer=logrotate, signal receive set=(term cont) peer=logrotate,
signal receive set=(term cont) peer=role_*, signal receive set=(term cont) peer=role_*,