refractor: move more profiles to groups.
This commit is contained in:
Alexandre Pujol
parent
33681e14f2
commit
8ba3dbd90f
38 changed files with 3 additions and 2 deletions
28
apparmor.d/groups/firewall/firewall-applet
Normal file
28
apparmor.d/groups/firewall/firewall-applet
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/firewall-applet
|
||||
profile firewall-applet @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/python>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/ r,
|
||||
@{bin}/python3.@{int} r,
|
||||
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/firewall-applet>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
29
apparmor.d/groups/firewall/firewall-config
Normal file
29
apparmor.d/groups/firewall/firewall-config
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/firewall-config
|
||||
profile firewall-config @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
include <abstractions/python>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{open_path} rPx -> child-open-help,
|
||||
|
||||
/usr/share/firewalld/__pycache__/ rw,
|
||||
|
||||
/usr/share/firewalld/{,**} r,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/firewall-config>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
74
apparmor.d/groups/firewall/firewalld
Normal file
74
apparmor.d/groups/firewall/firewalld
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/firewalld
|
||||
profile firewalld @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/kmod>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
include <abstractions/bus/org.freedesktop.PolicyKit1>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
capability net_raw,
|
||||
capability setpcap,
|
||||
capability sys_module,
|
||||
|
||||
network inet raw,
|
||||
network inet6 raw,
|
||||
network netlink raw,
|
||||
|
||||
#aa:dbus own bus=system name=org.fedoraproject.FirewallD1
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/ r,
|
||||
@{bin}/alts rix,
|
||||
@{bin}/ebtables-legacy rix,
|
||||
@{bin}/ebtables-legacy-restore rix,
|
||||
@{bin}/false rix,
|
||||
@{bin}/ipset rix,
|
||||
@{bin}/kmod rix,
|
||||
@{bin}/modprobe rix,
|
||||
@{bin}/xtables-legacy-multi rix,
|
||||
@{bin}/xtables-nft-multi rix,
|
||||
|
||||
/usr/local/lib/python3.@{int}/dist-packages/ r,
|
||||
|
||||
/usr/share/iproute2/{,**} r,
|
||||
/usr/share/libalternatives/{,**} r,
|
||||
|
||||
/etc/firewalld/{,**} rw,
|
||||
/etc/iproute2/group r,
|
||||
/etc/iproute2/rt_realms r,
|
||||
|
||||
/var/lib/ebtables/lock rwk,
|
||||
|
||||
/var/log/firewalld rw,
|
||||
|
||||
@{run}/firewalld/{,*} rw,
|
||||
@{run}/modprobe.d/{,*.conf} r,
|
||||
@{run}/xtables.lock rwk,
|
||||
|
||||
@{sys}/module/compression r,
|
||||
@{sys}/module/*/initstate r,
|
||||
|
||||
@{PROC}/sys/kernel/modprobe r,
|
||||
@{PROC}/sys/net/ipv{4,6}/ip_forward rw,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pids}/net/ip_tables_names r,
|
||||
|
||||
include if exists <local/firewalld>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
36
apparmor.d/groups/firewall/nft
Normal file
36
apparmor.d/groups/firewall/nft
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/nft
|
||||
profile nft @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/iproute2/{,**} r,
|
||||
|
||||
/etc/iproute2/** r,
|
||||
/etc/nftables.conf r,
|
||||
/etc/nftables/{,**} r,
|
||||
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
include if exists <local/nft>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
62
apparmor.d/groups/firewall/ufw
Normal file
62
apparmor.d/groups/firewall/ufw
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 EricLin <ericlin050914@gmail.com>
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/ufw
|
||||
profile ufw @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/attached/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
capability net_raw,
|
||||
capability sys_ptrace,
|
||||
|
||||
network inet dgram,
|
||||
network inet raw,
|
||||
network inet6 dgram,
|
||||
network inet6 raw,
|
||||
network netlink raw,
|
||||
|
||||
ptrace read,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/ r,
|
||||
@{bin}/cat ix,
|
||||
@{bin}/env r,
|
||||
@{bin}/python3.@{int} ix,
|
||||
@{bin}/sysctl ix,
|
||||
@{bin}/xtables-legacy-multi ix,
|
||||
@{bin}/xtables-nft-multi ix,
|
||||
@{lib}/ufw/ufw-init ix,
|
||||
|
||||
/etc/default/ufw rw,
|
||||
/etc/ufw/ rw,
|
||||
/etc/ufw/** rwk,
|
||||
|
||||
@{run}/xtables.lock rwk,
|
||||
owner @{run}/ufw.lock rwk,
|
||||
|
||||
owner @{tmp}/@{word8} rw,
|
||||
owner @{tmp}/tmp@{word8} rw,
|
||||
owner /var/tmp/@{word8} rw,
|
||||
owner /var/tmp/tmp@{word8} rw,
|
||||
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/@{pid}/net/ip_tables_names r,
|
||||
@{PROC}/@{pid}/stat r,
|
||||
@{PROC}/sys/net/ipv{4,6}/** rw,
|
||||
@{PROC}/sys/kernel/modprobe r,
|
||||
|
||||
include if exists <local/ufw>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue