refractor: move more profiles to groups.
This commit is contained in:
Alexandre Pujol
parent
33681e14f2
commit
8ba3dbd90f
38 changed files with 3 additions and 2 deletions
43
apparmor.d/groups/filesystem/mke2fs
Normal file
43
apparmor.d/groups/filesystem/mke2fs
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mke2fs @{bin}/mkfs.ext2 @{bin}/mkfs.ext3 @{bin}/mkfs.ext4
|
||||
profile mke2fs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# To check for badblocks
|
||||
@{sh_path} rix,
|
||||
@{bin}/badblocks rPx,
|
||||
|
||||
/usr/share/file/misc/magic.mgc r,
|
||||
|
||||
/etc/mke2fs.conf r,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
# For virt-resize
|
||||
owner /var/tmp/.guestfs-@{int}/** rwk,
|
||||
|
||||
owner @{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mke2fs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
32
apparmor.d/groups/filesystem/mkfs-btrfs
Normal file
32
apparmor.d/groups/filesystem/mkfs-btrfs
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mkfs.btrfs
|
||||
profile mkfs-btrfs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/dev/btrfs-control rw,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
@{run}/blkid/blkid.* rw,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mkfs-btrfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
26
apparmor.d/groups/filesystem/mkfs-fat
Normal file
26
apparmor.d/groups/filesystem/mkfs-fat
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/{mkfs.fat,mkfs.msdos,mkfs.vfat,mkdosfs}
|
||||
profile mkfs-fat @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mkfs-fat>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
24
apparmor.d/groups/filesystem/mkntfs
Normal file
24
apparmor.d/groups/filesystem/mkntfs
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/{mkntfs,mkfs.ntfs}
|
||||
profile mkntfs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pids}/mounts r,
|
||||
|
||||
include if exists <local/mkntfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
28
apparmor.d/groups/filesystem/mkswap
Normal file
28
apparmor.d/groups/filesystem/mkswap
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mkswap
|
||||
profile mkswap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability mknod,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /swapfile rw,
|
||||
owner /swap/swapfile rw,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mkswap>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
72
apparmor.d/groups/filesystem/mount
Normal file
72
apparmor.d/groups/filesystem/mount
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount
|
||||
profile mount @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability chown,
|
||||
capability dac_read_search,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
mount,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
signal (receive) set=(term, kill),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/lowntfs-3g rPx,
|
||||
@{bin}/mount.* rPx,
|
||||
@{bin}/ntfs-3g rPx,
|
||||
@{bin}/sshfs rPx,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/snapd/snaps/*.snap r,
|
||||
|
||||
# Mount points
|
||||
@{HOME}/ rw,
|
||||
@{HOME}/*/ rw,
|
||||
@{HOME}/*/*/ rw,
|
||||
@{MOUNTS}/ rw,
|
||||
@{MOUNTS}/*/ rw,
|
||||
@{MOUNTS}/*/*/ rw,
|
||||
|
||||
# Mount iso/img files
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
@{run}/ r,
|
||||
owner @{run}/mount/ rw,
|
||||
owner @{run}/mount/utab{,.*} rwk,
|
||||
|
||||
/tmp/sanity-squashfs-@{int} rw,
|
||||
/tmp/syscheck-squashfs-@{int} rw,
|
||||
|
||||
@{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
# The special /dev/loop-control file can be used to create and destroy loop
|
||||
# devices or to find the first available loop device.
|
||||
/dev/loop-control rw,
|
||||
|
||||
include if exists <local/mount>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
58
apparmor.d/groups/filesystem/mount-cifs
Normal file
58
apparmor.d/groups/filesystem/mount-cifs
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount.cifs
|
||||
profile mount-cifs @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_admin,
|
||||
capability setpcap,
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
mount fstype=cifs -> @{HOME}/*/,
|
||||
mount fstype=cifs -> @{HOME}/*/*/,
|
||||
mount fstype=cifs -> @{MOUNTDIRS}/,
|
||||
mount fstype=cifs -> @{MOUNTS}/,
|
||||
mount fstype=cifs -> @{MOUNTS}/*/,
|
||||
mount fstype=cifs -> @{MOUNTS}/*/*/,
|
||||
|
||||
umount @{HOME}/*/,
|
||||
umount @{HOME}/*/*/,
|
||||
umount @{MOUNTDIRS}/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
umount @{MOUNTS}/*/*/,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/systemd-ask-password rPUx,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/sync-credentials r,
|
||||
|
||||
owner @{HOME}/.smbcredentials r,
|
||||
|
||||
# Mount points
|
||||
@{HOME}/*/ r,
|
||||
@{HOME}/*/*/ r,
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
@{MOUNTS}/*/ r,
|
||||
@{MOUNTS}/*/*/ r,
|
||||
|
||||
include if exists <local/mount-cifs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
74
apparmor.d/groups/filesystem/mount-nfs
Normal file
74
apparmor.d/groups/filesystem/mount-nfs
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount.nfs
|
||||
profile mount-nfs @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To be able to mount anything
|
||||
capability sys_admin,
|
||||
|
||||
capability chown,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability net_bind_service,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
# Allow to mount smb/cifs disks only under the /media/ dirs
|
||||
mount fstype=nfs -> @{MOUNTDIRS}/,
|
||||
mount fstype=nfs -> @{MOUNTS}/,
|
||||
mount fstype=nfs -> @{MOUNTS}/*/,
|
||||
mount fstype=nfs -> /,
|
||||
mount fstype=nfs -> /*/,
|
||||
|
||||
umount @{MOUNTDIRS}/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
umount /,
|
||||
umount /*/,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/flock rix,
|
||||
@{bin}/start-statd rix,
|
||||
@{bin}/systemctl rCx -> systemctl,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/netconfig r,
|
||||
/etc/nfsmount.conf rk,
|
||||
/etc/rpc r,
|
||||
|
||||
# Mount points
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
@{MOUNTS}/*/ r,
|
||||
|
||||
owner @{run}/mount/utab.lock wk,
|
||||
owner @{run}/mount/utab{,.*} rw,
|
||||
owner @{run}/rpc.statd.lock wk,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/mount-nfs_systemctl>
|
||||
}
|
||||
|
||||
include if exists <local/mount-nfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
48
apparmor.d/groups/filesystem/mount-zfs
Normal file
48
apparmor.d/groups/filesystem/mount-zfs
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount.zfs
|
||||
profile mount-zfs @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
capability sys_admin, # To mount anything.
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/dev/pts/@{int} rw,
|
||||
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
@{MOUNTS}/*/ r,
|
||||
|
||||
mount fstype=zfs -> @{MOUNTDIRS}/,
|
||||
mount fstype=zfs -> @{MOUNTS}/,
|
||||
mount fstype=zfs -> @{MOUNTS}/*/,
|
||||
mount fstype=zfs -> /,
|
||||
mount fstype=zfs -> /**/,
|
||||
mount fstype=zfs -> /tmp/zfsmnt.*/,
|
||||
mount fstype=zfs -> /tmp/zfsmnt.*/*/,
|
||||
|
||||
umount @{MOUNTDIRS}/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
umount /,
|
||||
umount /*/,
|
||||
umount /tmp/zfsmnt.*/,
|
||||
umount /tmp/zfsmnt.*/*/,
|
||||
|
||||
@{PROC}/@{pids}/mounts r,
|
||||
|
||||
/dev/zfs rw,
|
||||
|
||||
include if exists <local/mount-zfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue