felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(profiles): use @{bin} and @{lib} in profiles (6)

Browse source
This commit is contained in:
Alexandre Pujol 2023-07-09 14:46:56 +01:00
parent fcedbbfd95
commit 7c2c806ffa
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
156 changed files with 828 additions and 791 deletions
Download patch file Download diff file Expand all files Collapse all files

76
apparmor.d/profiles-m-r/man
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/man
@{exec_path} = @{bin}/man
profile man @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -19,30 +19,30 @@ profile man @{exec_path} {
# Use a special profile when man calls anything groff-related. We only include
# the programs that actually parse input data in a non-trivial way, not
# wrappers such as groff and nroff, since they would need a broader profile.
/{usr/,}bin/eqn rCx -> man_groff,
/{usr/,}bin/grap rCx -> man_groff,
/{usr/,}bin/pic rCx -> man_groff,
/{usr/,}bin/preconv rCx -> man_groff,
/{usr/,}bin/refer rCx -> man_groff,
/{usr/,}bin/tbl rCx -> man_groff,
/{usr/,}bin/troff rCx -> man_groff,
/{usr/,}bin/vgrind rCx -> man_groff,
@{bin}/eqn rCx -> man_groff,
@{bin}/grap rCx -> man_groff,
@{bin}/pic rCx -> man_groff,
@{bin}/preconv rCx -> man_groff,
@{bin}/refer rCx -> man_groff,
@{bin}/tbl rCx -> man_groff,
@{bin}/troff rCx -> man_groff,
@{bin}/vgrind rCx -> man_groff,
# Use a special profile when man calls decompressors and other simple filters.
/{usr/,}bin/bzip2 rCx -> man_filter,
/{usr/,}bin/gzip rCx -> man_filter,
/{usr/,}bin/col rCx -> man_filter,
/{usr/,}bin/compress rCx -> man_filter,
/{usr/,}bin/iconv rCx -> man_filter,
/{usr/,}bin/lzip.lzip rCx -> man_filter,
/{usr/,}bin/tr rCx -> man_filter,
/{usr/,}bin/xz rCx -> man_filter,
@{bin}/bzip2 rCx -> man_filter,
@{bin}/gzip rCx -> man_filter,
@{bin}/col rCx -> man_filter,
@{bin}/compress rCx -> man_filter,
@{bin}/iconv rCx -> man_filter,
@{bin}/lzip.lzip rCx -> man_filter,
@{bin}/tr rCx -> man_filter,
@{bin}/xz rCx -> man_filter,
/{usr/,}bin/pager rPx -> child-pager,
/{usr/,}bin/less rPx -> child-pager,
/{usr/,}bin/more rPx -> child-pager,
@{bin}/pager rPx -> child-pager,
@{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager,
/{usr/,}bin/locale rix,
@{bin}/locale rix,
/usr/share/groff/{,**} r,
@ -64,16 +64,16 @@ profile man_groff {
signal peer=man,
/{usr/,}bin/eqn mr,
/{usr/,}bin/grap mr,
/{usr/,}bin/pic mr,
/{usr/,}bin/preconv mr,
/{usr/,}bin/refer mr,
/{usr/,}bin/tbl mr,
/{usr/,}bin/troff mr,
/{usr/,}bin/vgrind mr,
@{bin}/eqn mr,
@{bin}/grap mr,
@{bin}/pic mr,
@{bin}/preconv mr,
@{bin}/refer mr,
@{bin}/tbl mr,
@{bin}/troff mr,
@{bin}/vgrind mr,
/{usr/,}lib/groff/site-tmac/** r,
@{lib}/groff/site-tmac/** r,
/usr/share/groff/** r,
/etc/groff/** r,
@ -91,14 +91,14 @@ profile man_filter {
signal peer=man,
/{usr/,}bin/bzip2 mr,
/{usr/,}bin/gzip mr,
/{usr/,}bin/col mr,
/{usr/,}bin/compress mr,
/{usr/,}bin/iconv mr,
/{usr/,}bin/lzip.lzip mr,
/{usr/,}bin/tr mr,
/{usr/,}bin/xz mr,
@{bin}/bzip2 mr,
@{bin}/gzip mr,
@{bin}/col mr,
@{bin}/compress mr,
@{bin}/iconv mr,
@{bin}/lzip.lzip mr,
@{bin}/tr mr,
@{bin}/xz mr,
# Manual pages can be more or less anywhere, especially with "man -l", and
# there's no harm in allowing wide read access here since the worst it can