felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): new definition for MOUNTs, add MOUNTDIRS.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-12 22:51:37 +01:00
parent 9493e783ce
commit 779853dc7f
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
62 changed files with 198 additions and 203 deletions
Download patch file Download diff file Expand all files Collapse all files

51
apparmor.d/profiles-m-r/ntfs-3g
View file

@ -23,36 +23,35 @@ profile ntfs-3g @{exec_path} {
@{exec_path} mr,
@{PROC}/@{pids}/task/@{tid}/status r,
owner @{PROC}/@{pid}/mounts r,
/{usr/,}bin/kmod rPx, # To load the fuse kernel module
# Mount points
@{MOUNTDIRS}/ r,
@{MOUNTS}/ r,
@{MOUNTS}/*/ r,
# Allow to mount ntfs disks only under the /media/, /run/media, and /mnt/ dirs
mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTDIRS},
mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/,
mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/,
mount fstype=fuseblk /dev/mmcblk[0-9]*p[0-9]* -> @{MOUNTS}/,
mount fstype=fuseblk /dev/mmcblk[0-9]*p[0-9]* -> @{MOUNTS}/*/,
# Allow to mount encrypted partition
mount fstype=fuseblk /dev/dm-[0-9]* -> @{MOUNTDIRS}/,
mount fstype=fuseblk /dev/dm-[0-9]* -> @{MOUNTS}/,
mount fstype=fuseblk /dev/dm-[0-9]* -> @{MOUNTS}/*/,
umount @{MOUNTDIRS}/,
umount @{MOUNTS}/,
umount @{MOUNTS}/*/,
@{PROC}/@{pids}/mountinfo r,
@{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/swaps r,
owner @{PROC}/@{pid}/mounts r,
/dev/fuse rw,
# Mount points
@{MOUNTS}/*/ r,
@{MOUNTS}/*/*/ r,
# Allow to mount ntfs disks only under the /media/, /run/media, and /mnt/ dirs
mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/,
mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/*/,
mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> /mnt/,
mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> /mnt/*/,
mount fstype=fuseblk /dev/mmcblk[0-9]*p[0-9]* -> @{MOUNTS}/*/,
mount fstype=fuseblk /dev/mmcblk[0-9]*p[0-9]* -> @{MOUNTS}/*/*/,
# Allow to mount encrypted partition
mount fstype=fuseblk /dev/dm-[0-9]* -> @{MOUNTS}/*/,
mount fstype=fuseblk /dev/dm-[0-9]* -> @{MOUNTS}/*/*/,
mount fstype=fuseblk /dev/dm-[0-9]* -> /mnt/,
mount fstype=fuseblk /dev/dm-[0-9]* -> /mnt/*/,
umount @{MOUNTS}/*/,
umount /mnt/*/,
# kmod is used to load the fuse kernel module
/{usr/,}bin/kmod rPx,
include if exists <local/ntfs-3g>
}