felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove complain

Browse source
This commit is contained in:
nobodysu 2022-10-18 21:16:49 +03:00
parent d4987b5bab
commit 790c4d6b71
13 changed files with 19 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/network/NetworkManager
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{,s}bin/NetworkManager
profile NetworkManager @{exec_path} flags=(complain attach_disconnected) {
profile NetworkManager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-network-manager-strict>
include <abstractions/dbus-strict>
@ -104,6 +104,7 @@ profile NetworkManager @{exec_path} flags=(complain attach_disconnected) {
/ r,
/etc/ r,
/etc/machine-id r,
@{etc_rw}/resolv.conf rw,
@{etc_rw}/resolv.conf.[0-9A-Z]* rw,
/etc/network/interfaces r,
@ -112,7 +113,7 @@ profile NetworkManager @{exec_path} flags=(complain attach_disconnected) {
/etc/NetworkManager/{,**} r,
/etc/NetworkManager/system-connections/{,**} w,
/etc/machine-id r,
/var/lib/iwd/*open* rw,
/var/lib/NetworkManager/{,**} rw,
@{sys}/bus/ r,
@ -135,6 +136,7 @@ profile NetworkManager @{exec_path} flags=(complain attach_disconnected) {
@{sys}/devices/pci[0-9]*/**/net/*/{,**} r,
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/net/{,**} r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/stat r,
@{PROC}/1/environ r,

2
apparmor.d/groups/network/mullvad-daemon
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = "/opt/Mullvad VPN/resources/mullvad-daemon"
profile mullvad-daemon @{exec_path} flags=(attach_disconnected complain) {
profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>

4
apparmor.d/groups/network/tailscaled
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{,s}bin/tailscaled
profile tailscaled @{exec_path} flags=(attach_disconnected complain) {
profile tailscaled @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
@ -63,7 +63,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected complain) {
/dev/net/tun rw,
profile systemctl flags=(attach_disconnected complain) {
profile systemctl {
include <abstractions/base>
capability mknod,

2
apparmor.d/groups/systemd/systemd-timedated
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-timedated
profile systemd-timedated @{exec_path} flags=(attach_disconnected complain) {
profile systemd-timedated @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/systemd-common>

2
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-timesyncd
profile systemd-timesyncd @{exec_path} flags=(complain attach_disconnected) {
profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>

4
apparmor.d/groups/virt/libvirtd
View file

@ -15,7 +15,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/libvirtd
profile libvirtd @{exec_path} flags=(attach_disconnected complain) {
profile libvirtd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus>
@ -248,7 +248,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected complain) {
audit deny @{sys}/kernel/security/apparmor/matching rwxl,
audit deny @{sys}/kernel/security/apparmor/.* rwxl,
profile qemu_bridge_helper flags=(attach_disconnected complain) {
profile qemu_bridge_helper {
include <abstractions/base>
capability net_admin,

2
apparmor.d/groups/virt/virt-aa-helper
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/libvirt/virt-aa-helper
profile virt-aa-helper @{exec_path} flags=(complain ) {
profile virt-aa-helper @{exec_path} {
include <abstractions/base>
include <abstractions/openssl>

2
apparmor.d/profiles-a-f/blkid
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/blkid
profile blkid @{exec_path} flags=(complain ) {
profile blkid @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/disks-read>

4
apparmor.d/profiles-a-f/dhclient-script
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/dhclient-script
profile dhclient-script @{exec_path} flags=(complain ) {
profile dhclient-script @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice>
include <abstractions/openssl>
@ -68,7 +68,7 @@ profile dhclient-script @{exec_path} flags=(complain ) {
owner @{PROC}/@{pid}/loginuid r,
@{PROC}/sys/net/ipv6/conf/*/stable_secret w,
profile run-parts flags=(complain ) {
profile run-parts {
include <abstractions/base>
/{usr/,}bin/run-parts mr,

2
apparmor.d/profiles-g-l/lvm
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvm
profile lvm @{exec_path} flags=(complain) {
profile lvm @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-strict>

2
apparmor.d/profiles-g-l/lvmconfig
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvmconfig
profile lvmconfig @{exec_path} flags=(complain) {
profile lvmconfig @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/profiles-m-r/polipo
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/polipo
profile polipo @{exec_path} flags=(complain ) {
profile polipo @{exec_path} {
include <abstractions/base>
@{exec_path} mr,

2
apparmor.d/profiles-m-r/resolvconf
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}sbin/resolvconf
profile resolvconf @{exec_path} flags=(complain) {
profile resolvconf @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>