felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): minor improvments.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-10 14:56:18 +00:00
parent a8b8bf52f8
commit 8f1fff89ab
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
2 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/abstractions/bwrap
View file

@ -4,7 +4,9 @@
# Minimal set of rules for bwrap # Minimal set of rules for bwrap
# A profile using this abstaction still needs to include: @{bin}/bwrap rix, # A profile using this abstaction still needs to set:
# - the attach_disconnected flag
# - bwrap execution: '@{bin}/bwrap rix,'
capability net_admin, capability net_admin,
capability setpcap, capability setpcap,
@ -36,10 +38,6 @@
owner /tmp/newroot/ w, owner /tmp/newroot/ w,
owner /tmp/oldroot/ w, owner /tmp/oldroot/ w,
@{sys}/fs/cgroup/user.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
@{PROC}/sys/kernel/overflowgid r, @{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r, @{PROC}/sys/kernel/overflowuid r,

4
apparmor.d/abstractions/user-read
View file

@ -5,8 +5,10 @@
# This abstraction gives read access on all defined user directories. It should # This abstraction gives read access on all defined user directories. It should
# only be used if access to **ALL** folders is required. # only be used if access to **ALL** folders is required.
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r, owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r, owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r, owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r, owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r,