felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2023-08-27 14:54:04 +01:00
parent 19331acaa9
commit 75ef5ef6ad
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
48 changed files with 205 additions and 141 deletions
Download patch file Download diff file Expand all files Collapse all files

11
apparmor.d/profiles-g-l/git
View file

@ -33,10 +33,13 @@ profile git @{exec_path} {
# the most similar commands, which it thinks can be used instead. Git binaries are all under
# /usr/bin/ , so allow only this location.
@{bin}/ r,
deny /{usr/,}sbin/ r,
deny /usr/local/{s,}bin/ r,
deny @{bin}/*/ r,
deny /usr/games/ r,
deny /usr/local/{s,}bin/ r,
deny /usr/local/games/ r,
deny /var/lib/flatpak/exports/bin/ r,
deny owner @{HOME}/.go/bin/ r,
deny owner @{user_bin_dirs}/ r,
# These are needed for "git submodule update"
@{bin}/{,ba,da}sh rix,
@ -97,7 +100,7 @@ profile git @{exec_path} {
owner /tmp/* rw,
owner /tmp/tmp*/ rw, # For TWRP-device-tree-generator
owner /tmp/tmp*/** rwkl -> /tmp/tmp*/**,
owner /tmp/.git_vtag_tmp* rw, # For git log --show-signature
owner /tmp/.git_vtag_tmp@{rand6} rw, # For git log --show-signature
owner /tmp/git-commit-msg-.txt rw, # For android studio
deny @{user_share_dirs}/gvfs-metadata/* r,
@ -112,7 +115,7 @@ profile git @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
owner /tmp/.git_vtag_tmp* r,
owner /tmp/.git_vtag_tmp@{rand6} r,
deny @{user_share_dirs}/gvfs-metadata/* r,