felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update kdump profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-25 00:52:38 +02:00
parent c70f9b22fc
commit 8b542434bd
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 122 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

49
apparmor.d/profiles-g-l/kdump-config
View file

@ -7,32 +7,69 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{sbin}/kdump-config
profile kdump-config @{exec_path} {
profile kdump-config @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
ptrace readby peer=systemd-journald,
capability sys_admin,
ptrace readby peer=@{p_systemd_journald},
@{exec_path} mr,
@{sh_path} ix,
@{sh_path} rix,
@{bin}/basename ix,
@{bin}/cat ix,
@{bin}/cmp ix,
@{bin}/cp ix,
@{bin}/cut ix,
@{bin}/file ix,
@{bin}/find ix,
@{bin}/flock ix,
@{bin}/grep ix,
@{bin}/hexdump ix,
@{bin}/ln ix,
@{bin}/logger ix,
@{bin}/plymouth Px,
@{bin}/readlink ix,
@{bin}/rev ix,
@{bin}/run-parts ix,
@{bin}/sed ix,
@{bin}/systemctl Cx -> systemctl,
@{bin}/uname ix,
@{sbin}/kexec Cx -> kexec,
@{sbin}/sysctl Cx -> sysctl,
/etc/kernel/postinst.d/kdump-tools rPx,
/etc/kdump/{,**} r,
/etc/default/kdump-tools r,
/etc/magic r,
/ r,
@{efi}/ r,
/var/crash/kdump_lock wk,
/var/crash/kexec_cmd w,
owner /var/lib/kdump/{,**} rw,
@{sys}/firmware/efi/efivars/ r,
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
@{sys}/firmware/efi/efivars/SetupMode-@{uuid} r,
@{sys}/kernel/kexec_crash_loaded r,
@{PROC}/cmdline r,
@{PROC}/iomem r,
profile systemctl flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/systemctl>
capability net_admin,
capability sys_ptrace,
include if exists <local/kdump-config_systemctl>
}
profile sysctl {
include <abstractions/base>
@ -51,6 +88,12 @@ profile kdump-config @{exec_path} {
@{sbin}/kexec mr,
@{efi}/* r,
owner /var/lib/kdump/* r,
@{PROC}/iomem r,
include if exists <local/kdump-config_kexec>
}

38
apparmor.d/profiles-g-l/kdump-tools-init Normal file
View file

@ -0,0 +1,38 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /etc/init.d/kdump-tools
profile kdump-tools-init @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
@{exec_path} mr,
@{sh_path} mr,
@{bin}/cat ix,
@{bin}/plymouth Px,
@{bin}/run-parts ix,
@{bin}/systemctl Cx -> systemctl,
@{sbin}/kdump-config Px,
/etc/default/kdump-tools r,
@{PROC}/cmdline r,
profile systemctl flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app/systemctl>
capability net_admin,
include if exists <local/kdump-tools-init_systemctl>
}
include if exists <local/kdump-tools-init>
}
# vim:syntax=apparmor

36
apparmor.d/profiles-g-l/kdump_mem_estimator Normal file
View file

@ -0,0 +1,36 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /usr/share/kdump-tools/kdump_mem_estimator
profile kdump_mem_estimator @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
@{sh_path} r,
@{bin}/cat ix,
@{bin}/mkdir ix,
@{bin}/uname ix,
@{bin}/systemctl Cx -> systemctl,
@{bin}/uname ix,
owner /var/lib/kdump/mem* w,
profile systemctl {
include <abstractions/base>
include <abstractions/app/systemctl>
capability net_admin,
include if exists <local/kdump_mem_estimator_systemctl>
}
include if exists <local/kdump_mem_estimator>
}
# vim:syntax=apparmor