refractor: move more profiles to groups.
This commit is contained in:
Alexandre Pujol
parent
33681e14f2
commit
8ba3dbd90f
38 changed files with 3 additions and 2 deletions
|
|
@ -1,43 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mke2fs @{bin}/mkfs.ext2 @{bin}/mkfs.ext3 @{bin}/mkfs.ext4
|
||||
profile mke2fs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# To check for badblocks
|
||||
@{sh_path} rix,
|
||||
@{bin}/badblocks rPx,
|
||||
|
||||
/usr/share/file/misc/magic.mgc r,
|
||||
|
||||
/etc/mke2fs.conf r,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
# For virt-resize
|
||||
owner /var/tmp/.guestfs-@{int}/** rwk,
|
||||
|
||||
owner @{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mke2fs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mkfs.btrfs
|
||||
profile mkfs-btrfs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/dev/btrfs-control rw,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
@{run}/blkid/blkid.* rw,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mkfs-btrfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/{mkfs.fat,mkfs.msdos,mkfs.vfat,mkdosfs}
|
||||
profile mkfs-fat @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# A place for file images
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mkfs-fat>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/{mkntfs,mkfs.ntfs}
|
||||
profile mkntfs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pids}/mounts r,
|
||||
|
||||
include if exists <local/mkntfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mkswap
|
||||
profile mkswap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability mknod,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /swapfile rw,
|
||||
owner /swap/swapfile rw,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/mkswap>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,72 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount
|
||||
profile mount @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability chown,
|
||||
capability dac_read_search,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
mount,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
signal (receive) set=(term, kill),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/lowntfs-3g rPx,
|
||||
@{bin}/mount.* rPx,
|
||||
@{bin}/ntfs-3g rPx,
|
||||
@{bin}/sshfs rPx,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/snapd/snaps/*.snap r,
|
||||
|
||||
# Mount points
|
||||
@{HOME}/ rw,
|
||||
@{HOME}/*/ rw,
|
||||
@{HOME}/*/*/ rw,
|
||||
@{MOUNTS}/ rw,
|
||||
@{MOUNTS}/*/ rw,
|
||||
@{MOUNTS}/*/*/ rw,
|
||||
|
||||
# Mount iso/img files
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
@{run}/ r,
|
||||
owner @{run}/mount/ rw,
|
||||
owner @{run}/mount/utab{,.*} rwk,
|
||||
|
||||
/tmp/sanity-squashfs-@{int} rw,
|
||||
/tmp/syscheck-squashfs-@{int} rw,
|
||||
|
||||
@{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
# The special /dev/loop-control file can be used to create and destroy loop
|
||||
# devices or to find the first available loop device.
|
||||
/dev/loop-control rw,
|
||||
|
||||
include if exists <local/mount>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,58 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount.cifs
|
||||
profile mount-cifs @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_admin,
|
||||
capability setpcap,
|
||||
|
||||
network inet dgram,
|
||||
network inet stream,
|
||||
network inet6 dgram,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
mount fstype=cifs -> @{HOME}/*/,
|
||||
mount fstype=cifs -> @{HOME}/*/*/,
|
||||
mount fstype=cifs -> @{MOUNTDIRS}/,
|
||||
mount fstype=cifs -> @{MOUNTS}/,
|
||||
mount fstype=cifs -> @{MOUNTS}/*/,
|
||||
mount fstype=cifs -> @{MOUNTS}/*/*/,
|
||||
|
||||
umount @{HOME}/*/,
|
||||
umount @{HOME}/*/*/,
|
||||
umount @{MOUNTDIRS}/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
umount @{MOUNTS}/*/*/,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/systemd-ask-password rPUx,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/sync-credentials r,
|
||||
|
||||
owner @{HOME}/.smbcredentials r,
|
||||
|
||||
# Mount points
|
||||
@{HOME}/*/ r,
|
||||
@{HOME}/*/*/ r,
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
@{MOUNTS}/*/ r,
|
||||
@{MOUNTS}/*/*/ r,
|
||||
|
||||
include if exists <local/mount-cifs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,74 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount.nfs
|
||||
profile mount-nfs @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To be able to mount anything
|
||||
capability sys_admin,
|
||||
|
||||
capability chown,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability net_bind_service,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
# Allow to mount smb/cifs disks only under the /media/ dirs
|
||||
mount fstype=nfs -> @{MOUNTDIRS}/,
|
||||
mount fstype=nfs -> @{MOUNTS}/,
|
||||
mount fstype=nfs -> @{MOUNTS}/*/,
|
||||
mount fstype=nfs -> /,
|
||||
mount fstype=nfs -> /*/,
|
||||
|
||||
umount @{MOUNTDIRS}/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
umount /,
|
||||
umount /*/,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/flock rix,
|
||||
@{bin}/start-statd rix,
|
||||
@{bin}/systemctl rCx -> systemctl,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/netconfig r,
|
||||
/etc/nfsmount.conf rk,
|
||||
/etc/rpc r,
|
||||
|
||||
# Mount points
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
@{MOUNTS}/*/ r,
|
||||
|
||||
owner @{run}/mount/utab.lock wk,
|
||||
owner @{run}/mount/utab{,.*} rw,
|
||||
owner @{run}/rpc.statd.lock wk,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/mount-nfs_systemctl>
|
||||
}
|
||||
|
||||
include if exists <local/mount-nfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/mount.zfs
|
||||
profile mount-zfs @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
capability sys_admin, # To mount anything.
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/dev/pts/@{int} rw,
|
||||
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
@{MOUNTS}/*/ r,
|
||||
|
||||
mount fstype=zfs -> @{MOUNTDIRS}/,
|
||||
mount fstype=zfs -> @{MOUNTS}/,
|
||||
mount fstype=zfs -> @{MOUNTS}/*/,
|
||||
mount fstype=zfs -> /,
|
||||
mount fstype=zfs -> /**/,
|
||||
mount fstype=zfs -> /tmp/zfsmnt.*/,
|
||||
mount fstype=zfs -> /tmp/zfsmnt.*/*/,
|
||||
|
||||
umount @{MOUNTDIRS}/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
umount /,
|
||||
umount /*/,
|
||||
umount /tmp/zfsmnt.*/,
|
||||
umount /tmp/zfsmnt.*/*/,
|
||||
|
||||
@{PROC}/@{pids}/mounts r,
|
||||
|
||||
/dev/zfs rw,
|
||||
|
||||
include if exists <local/mount-zfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/nft
|
||||
profile nft @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/iproute2/{,**} r,
|
||||
|
||||
/etc/iproute2/** r,
|
||||
/etc/nftables.conf r,
|
||||
/etc/nftables/{,**} r,
|
||||
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
include if exists <local/nft>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/obex-folder-listing
|
||||
profile obex-folder-listing @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/private-files-strict>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/**/ r,
|
||||
owner @{MOUNTS}/ r,
|
||||
owner @{MOUNTS}/**/ r,
|
||||
|
||||
include if exists <local/obex-folder-listing>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/obexautofs
|
||||
profile obexautofs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/devices-usb>
|
||||
|
||||
network bluetooth seqpacket,
|
||||
network bluetooth stream,
|
||||
network bluetooth raw,
|
||||
network netlink raw,
|
||||
|
||||
mount fstype=fuse.obexautofs -> @{HOME}/*/,
|
||||
mount fstype=fuse.obexautofs -> @{HOME}/*/*/,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/fusermount{,3} rCx -> fusermount,
|
||||
|
||||
owner @{HOME}/*/ r,
|
||||
owner @{HOME}/*/*/ r,
|
||||
|
||||
@{sys}/devices/@{pci}/usb@{int}/bConfigurationValue r,
|
||||
@{sys}/devices/@{pci}/usb@{int}/**/bConfigurationValue r,
|
||||
@{sys}/devices/@{pci}/usb@{int}/{uevent,busnum,devnum,speed,descriptors} r,
|
||||
@{sys}/devices/@{pci}/usb@{int}/**/{uevent,busnum,devnum,speed,descriptors} r,
|
||||
|
||||
/dev/fuse rw,
|
||||
|
||||
profile fusermount {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/,
|
||||
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/*/,
|
||||
|
||||
@{bin}/fusermount{,3} mr,
|
||||
|
||||
/etc/fuse.conf r,
|
||||
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/fuse rw,
|
||||
|
||||
include if exists <local/obexautofs_fusermount>
|
||||
}
|
||||
|
||||
include if exists <local/obexautofs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/obexctl
|
||||
profile obexctl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/inputrc r,
|
||||
|
||||
owner @{user_cache_dirs}/.obexctl_history rw,
|
||||
owner @{user_cache_dirs}/.obexctl_history-@{pid}.tmp rw,
|
||||
|
||||
include if exists <local/obexctl>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{lib}/bluetooth/obexd
|
||||
profile obexd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus-session>
|
||||
include <abstractions/user-download-strict>
|
||||
|
||||
network bluetooth stream,
|
||||
network bluetooth seqpacket,
|
||||
|
||||
#aa:dbus own bus=session name=org.bluez.obex
|
||||
|
||||
dbus receive bus=system path=/org/bluez/obex/@{uuid}
|
||||
interface=org.bluez.Profile1
|
||||
member=Release
|
||||
peer=(name=:*, label=bluetoothd),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{user_cache_dirs}/ rw,
|
||||
owner @{user_cache_dirs}/obexd/{,**} rw,
|
||||
|
||||
owner @{HOME}/bluetooth/* rw,
|
||||
|
||||
include if exists <local/obexd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/obexfs
|
||||
profile obexfs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
network bluetooth raw,
|
||||
network bluetooth seqpacket,
|
||||
network bluetooth stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/fusermount{,3} rCx -> fusermount,
|
||||
|
||||
owner @{HOME}/*/ r,
|
||||
owner @{HOME}/*/*/ r,
|
||||
|
||||
mount fstype=fuse.obexfs -> @{HOME}/*/,
|
||||
mount fstype=fuse.obexfs -> @{HOME}/*/*/,
|
||||
|
||||
/dev/fuse rw,
|
||||
|
||||
|
||||
profile fusermount {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To mount anything:
|
||||
capability sys_admin,
|
||||
|
||||
network bluetooth stream,
|
||||
|
||||
@{bin}/fusermount{,3} mr,
|
||||
|
||||
/etc/fuse.conf r,
|
||||
|
||||
/dev/fuse rw,
|
||||
|
||||
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/,
|
||||
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/*/,
|
||||
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/obexfs_fusermount>
|
||||
}
|
||||
|
||||
include if exists <local/obexfs>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/obexpush_atd
|
||||
profile obexpush-atd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/obexpush-atd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/obexpushd
|
||||
profile obexpushd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
# For listening on tcp/*:650
|
||||
capability net_bind_service,
|
||||
|
||||
network bluetooth stream,
|
||||
network irda stream,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# For receiving files
|
||||
owner @{HOME}/bluetooth/* w,
|
||||
|
||||
include if exists <local/obexpushd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue