felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add new profiles

Browse source
This commit is contained in:
nobody43 2023-01-06 03:55:12 +03:00 • committed by Alex
parent 7a24f98f48
commit 80de79b66a
10 changed files with 324 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
apparmor.d/profiles-s-z/sslocal Normal file
View file

@ -0,0 +1,31 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
# shadowsocks-rust only:
# https://github.com/shadowsocks/shadowsocks-rust
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{,usr/}{,local/}bin/sslocal
profile sslocal @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/consoles>
@{exec_path} mr,
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
/etc/shadowsocks-rust/local/*/ss.json{,5} r,
owner @{user_config_dirs}/shadowsocks-rust/local/*/ss.json{,5} r,
owner @{PROC}/@{pid}/cgroup r,
include if exists <local/sslocal>
}

31
apparmor.d/profiles-s-z/ssmanager Normal file
View file

@ -0,0 +1,31 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
# shadowsocks-rust only:
# https://github.com/shadowsocks/shadowsocks-rust
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{,usr/}{,local/}bin/ssmanager
profile ssmanager @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/consoles>
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
@{exec_path} mr,
/etc/shadowsocks-rust/server/*/ss.json{,5} r,
owner @{user_config_dirs}/shadowsocks-rust/server/*/ss.json{,5} r,
owner @{PROC}/@{pid}/cgroup r,
include if exists <local/ssmanager>
}

30
apparmor.d/profiles-s-z/ssserver Normal file
View file

@ -0,0 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
# shadowsocks-rust only:
# https://github.com/shadowsocks/shadowsocks-rust
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{,usr/}{,local/}bin/ssserver
profile ssserver @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
/etc/shadowsocks-rust/server/*/ss.json{,5} r,
owner @{user_config_dirs}/shadowsocks-rust/server/*/ss.json{,5} r,
owner @{PROC}/@{pid}/cgroup r,
include if exists <local/ssserver>
}

18
apparmor.d/profiles-s-z/ssservice Normal file
View file

@ -0,0 +1,18 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
# shadowsocks-rust only:
# https://github.com/shadowsocks/shadowsocks-rust
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{,usr/}{,local/}bin/ssservice
profile ssservice @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/ssservice>
}

26
apparmor.d/profiles-s-z/ssurl Normal file
View file

@ -0,0 +1,26 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
# shadowsocks-rust only:
# https://github.com/shadowsocks/shadowsocks-rust
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{,usr/}{,local/}bin/ssurl
profile ssurl @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
deny capability dac_override,
@{exec_path} mr,
/etc/shadowsocks-rust/{server,local}/*/ss.json{,5} r,
owner @{user_config_dirs}/shadowsocks-rust/{server,local}/*/ss.json{,5} r,
include if exists <local/ssurl>
}

38
apparmor.d/profiles-s-z/yadifad Normal file
View file

@ -0,0 +1,38 @@
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
include <tunables/global>
@{exec_path} = /{,usr/}{,s}bin/yadifad
profile yadifad @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/nis>
capability dac_override,
capability chown,
capability setgid,
capability setuid,
network inet dgram,
network inet6 dgram,
network netlink raw,
@{exec_path} mr,
/etc/yadifa/yadifad.conf r,
/var/lib/yadifa/** r,
owner /var/lib/yadifa/ydf.?????? rw,
owner /var/lib/yadifa/keys/ydf.?????? rw,
owner /var/lib/yadifa/xfr/ydf.?????? rw,
/var/log/yadifa/*.log rw,
/var/log/yadifa/ydf.?????? rw,
owner @{run}/yadifa/yadifad.pid rwk,
owner @{run}/yadifa/ydf.?????? rw,
include if exists <local/yadifad>
}