felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): new definition for MOUNTs, add MOUNTDIRS.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-12 22:51:37 +01:00
parent 9493e783ce
commit 779853dc7f
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
62 changed files with 198 additions and 203 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/profiles-g-l/gdisk
View file

@ -24,13 +24,13 @@ profile gdisk @{exec_path} {
# For disk images
owner @{HOME}/**.{iso,img,bin,mdf,nrg} rwk,
owner @{MOUNTS}/*/**.{iso,img,bin,mdf,nrg} rwk,
owner @{MOUNTS}/**.{iso,img,bin,mdf,nrg} rwk,
owner @{HOME}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
owner @{MOUNTS}/*/**.{ISO,IMG,BIN,MDF,NRG} rwk,
owner @{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} rwk,
# For backups
owner @{HOME}/**.{bak,back} rwk,
owner @{MOUNTS}/*/**.{bak,back} rwk,
owner @{MOUNTS}/**.{bak,back} rwk,
include if exists <local/gdisk>
}

4
apparmor.d/profiles-g-l/gpartedbin
View file

@ -153,8 +153,8 @@ profile gpartedbin @{exec_path} {
mount /dev/{s,v}d[a-z]*[0-9]* -> /tmp/gparted-*/,
mount /dev/{s,v}d[a-z]*[0-9]* -> /boot/,
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/,
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/,
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/*/,
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/ r,
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/dev r,
@ -176,8 +176,8 @@ profile gpartedbin @{exec_path} {
umount /tmp/gparted-*/,
umount /boot/,
umount @{MOUNTS}/,
umount @{MOUNTS}/*/,
umount @{MOUNTS}/*/*/,
owner @{PROC}/@{pid}/mountinfo r,

4
apparmor.d/profiles-g-l/hdparm
View file

@ -30,9 +30,9 @@ profile hdparm @{exec_path} flags=(complain) {
# Image files
@{HOME}/**.{iso,img,bin,mdf,nrg} r,
@{MOUNTS}/*/**.{iso,img,bin,mdf,nrg} r,
@{MOUNTS}/**.{iso,img,bin,mdf,nrg} r,
@{HOME}/**.{ISO,IMG,BIN,MDF,NRG} r,
@{MOUNTS}/*/**.{ISO,IMG,BIN,MDF,NRG} r,
@{MOUNTS}/**.{ISO,IMG,BIN,MDF,NRG} r,
include if exists <local/hdparm>
}

2
apparmor.d/profiles-g-l/keepassxc-proxy
View file

@ -29,7 +29,7 @@ profile keepassxc-proxy @{exec_path} {
#
deny owner @{HOME}/.mozilla/** rw,
deny owner @{user_cache_dirs}/mozilla/** rw,
deny owner @{MOUNTS}/*/.mozilla/** rw,
deny owner @{MOUNTS}/.mozilla/** rw,
deny owner /tmp/firefox*/.parentlock rw,
deny owner /tmp/tmp-*.xpi rw,
deny owner /tmp/tmpaddon r,