felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): add profile for some named minimal systemd service.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-29 23:13:04 +02:00
parent a194f28c21
commit 8ff829542d
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
11 changed files with 310 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
apparmor.d/groups/systemd-service/cloud-init-hotplugd.service Normal file
View file

@ -0,0 +1,22 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# /bin/bash -c 'read args <&3; echo "args=$args"; \
# exec /usr/bin/cloud-init devel hotplug-hook $args; \
# exit 0'
abi <abi/4.0>,
include <tunables/global>
profile cloud-init-hotplugd.service {
include <abstractions/base>
@{sh_path} ix,
@{bin}/cloud-init Px,
include if exists <local/cloud-init-hotplugd.service>
}
# vim:syntax=apparmor

19
apparmor.d/groups/systemd-service/debug-shell.service Normal file
View file

@ -0,0 +1,19 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# ExecStart=/usr/bin/bash
abi <abi/4.0>,
include <tunables/global>
profile debug-shell.service {
include <abstractions/base>
all,
include if exists <local/debug-shell.service>
}
# vim:syntax=apparmor

62
apparmor.d/groups/systemd-service/dmesg.service Normal file
View file

@ -0,0 +1,62 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# ExecStartPre=-/usr/bin/savelog -m640 -q -p -n -c 5 /var/log/dmesg
# ExecStart=/bin/journalctl --boot 0 --dmesg --output short-monotonic --quiet --no-pager --no-hostname
# ExecStartPost=/bin/chgrp adm /var/log/dmesg
# ExecStartPost=/bin/chmod 0640 /var/log/dmesg
abi <abi/4.0>,
include <tunables/global>
profile dmesg.service flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability chown,
capability fsetid,
ptrace read peer=@{p_systemd},
@{sh_path} r,
@{bin}/basename ix,
@{bin}/chgrp rix,
@{bin}/chmod rix,
@{bin}/chown ix,
@{bin}/date ix,
@{bin}/dirname ix,
@{bin}/gzip ix,
@{bin}/gzip ix,
@{bin}/journalctl r,
@{bin}/ln ix,
@{bin}/mv ix,
@{bin}/rm ix,
@{bin}/savelog rix,
@{bin}/touch ix,
/etc/machine-id r,
/var/log/ r,
/var/log/dmesg rw,
/var/log/dmesg.* rwl -> /var/log/dmesg,
/{run,var}/log/journal/ r,
/{run,var}/log/journal/@{hex32}/ r,
/{run,var}/log/journal/@{hex32}/system.journal* r,
/{run,var}/log/journal/@{hex32}/system@@{hex}-@{hex}.journal* rw,
/{run,var}/log/journal/@{hex32}/system@@{hex32}-@{hex16}-@{hex16}.journal* rw,
/{run,var}/log/journal/@{hex32}/user-@{hex}.journal* rw,
/{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex}-@{hex}.journal* rw,
/{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal* rw,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
include if exists <local/dmesg.service>
}
# vim:syntax=apparmor

28
apparmor.d/groups/systemd-service/grub-common.service Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# ExecStartPre=/bin/sh -c '[ -s /boot/grub/grubenv ] || rm -f /boot/grub/grubenv; mkdir -p /boot/grub'
# ExecStart=grub-editenv /boot/grub/grubenv unset recordfail
# ExecStartPost=/bin/sh -c 'if grub-editenv /boot/grub/grubenv list | grep -q initrdless_boot_fallback_triggered=1; then echo "grub: GRUB_FORCE_PARTUUID set, initrdless boot paniced, fallback triggered."; fi'
abi <abi/4.0>,
include <tunables/global>
profile grub-common.service {
include <abstractions/base>
@{sh_path} rix,
@{bin}/grep ix,
@{bin}/grub-editenv rix,
@{bin}/mkdir ix,
@{bin}/rm ix,
/boot/grub/ w,
/boot/grub/grubenv rw,
include if exists <local/grub-common.service>
}
# vim:syntax=apparmor

23
apparmor.d/groups/systemd-service/ldconfig.service Normal file
View file

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# /sbin/ldconfig -X
abi <abi/4.0>,
include <tunables/global>
profile ldconfig.service {
include <abstractions/base>
@{lib}/ r,
@{sbin}/ldconfig r,
/var/cache/ldconfig/aux-cache rw,
/var/cache/ldconfig/aux-cache~ rw,
include if exists <local/ldconfig.service>
}
# vim:syntax=apparmor

39
apparmor.d/groups/systemd-service/man-db.service Normal file
View file

@ -0,0 +1,39 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# ExecStart=+/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
# ExecStart=/usr/bin/mandb --quiet
abi <abi/4.0>,
include <tunables/global>
profile man-db.service flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{bin}/install ix,
@{bin}/mandb r,
/usr/{,local/}share/man/{,**} r,
/etc/man_db.conf r,
/etc/manpath.config r,
/usr/share/man/{,**} r,
/usr/local/man/{,**} r,
/usr/local/share/man/{,**} r,
/usr/{,share/}man/{,**} r,
/usr/local/{,share/}man/{,**} r,
/usr/share/**/man/man@{u8}/*.@{int}.gz r,
owner /var/cache/man/ rw,
owner /var/cache/man/** rwk,
include if exists <local/man-db.service>
}
# vim:syntax=apparmor

27
apparmor.d/groups/systemd-service/secureboot-db.service Normal file
View file

@ -0,0 +1,27 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# ExecStartPre=-/usr/bin/chattr -i /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c
# ExecStartPre=-/usr/bin/chattr -i /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f
# ExecStartPre=-/usr/bin/chattr -i /sys/firmware/efi/efivars/dbx-d719b2cb-3d3a-4596-a3bc-dad00e67656f
# ExecStart=/usr/bin/sbkeysync --no-default-keystores --keystore /usr/share/secureboot/updates --verbose
abi <abi/4.0>,
include <tunables/global>
profile secureboot-db.service flags=(complain) {
include <abstractions/base>
@{bin}/chattr ix,
@{bin}/sbkeysync PUx,
@{sys}/firmware/efi/efivars/KEK-@{uuid} rw,
@{sys}/firmware/efi/efivars/db-@{uuid} rw,
@{sys}/firmware/efi/efivars/dbx-@{uuid} rw,
include if exists <local/secureboot-db.service>
}
# vim:syntax=apparmor

23
apparmor.d/groups/systemd-service/shadow.service Normal file
View file

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
profile shadow.service flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{sh_path} rix,
@{sbin}/grpck Px -> &grpck,
@{sbin}/pwck Px -> &pwck,
/etc/machine-id r,
/etc/shadow r,
include if exists <local/shadow.service>
}
# vim:syntax=apparmor

28
apparmor.d/groups/systemd-service/snapd.system-shutdown.service Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# /bin/mount /run -o remount,exec
# /bin/mkdir -p /run/initramfs
# /bin/cp /usr/lib/snapd/system-shutdown /run/initramfs/shutdown
abi <abi/4.0>,
include <tunables/global>
profile snapd.system-shutdown.service {
include <abstractions/base>
audit @{bin}/cp ix,
audit @{bin}/mkdir ix,
audit @{bin}/mount ix,
@{lib}/snapd/system-shutdown r,
@{run}/initramfs/ rw,
@{run}/initramfs/shutdown rw,
include if exists <local/snapd.system-shutdown.service>
}
# vim:syntax=apparmor

22
apparmor.d/groups/systemd-service/system-update-cleanup.service Normal file
View file

@ -0,0 +1,22 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# ExecStart=rm -fv /system-update /etc/system-update
abi <abi/4.0>,
include <tunables/global>
profile system-update-cleanup.service {
include <abstractions/base>
@{bin}/rm ix,
/etc/system-update w,
/system-update w,
include if exists <local/system-update-cleanup.service>
}
# vim:syntax=apparmor

17
apparmor.d/groups/systemd-service/usb_modeswitch.service Normal file
View file

@ -0,0 +1,17 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
profile usb_modeswitch.service {
include <abstractions/base>
@{sbin}/usb_modeswitch_dispatcher ix,
include if exists <local/usb_modeswitch.service>
}
# vim:syntax=apparmor