felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): add initial userns rule.

Browse source 
Require apparmor 4 to be enabled.
This commit is contained in:
Alexandre Pujol 2023-11-19 11:19:24 +00:00
parent 6dc990ac02
commit 88555a12d0
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
5 changed files with 11 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/chromium
View file

@ -31,6 +31,8 @@
include <abstractions/vulkan>
include <abstractions/wayland>
# userns,
capability setgid,
capability setuid,
capability sys_admin,

2
apparmor.d/groups/virt/virtiofsd
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile virtiofsd @{exec_path} {
include <abstractions/base>
# userns,
capability chown,
capability dac_override,
capability dac_read_search,

2
apparmor.d/profiles-s-z/slirp4netns
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile slirp4netns @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
# userns,
capability net_admin,
capability setpcap,
capability sys_admin,

2
apparmor.d/profiles-s-z/thunderbird
View file

@ -35,6 +35,8 @@ profile thunderbird @{exec_path} {
include <abstractions/vulkan>
include <abstractions/wayland>
# userns,
capability sys_admin, # If kernel.unprivileged_userns_clone = 1
capability sys_chroot, # If kernel.unprivileged_userns_clone = 1