felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LVM and general update (#68)

Browse source 
* Small fixes

* General update

* Add LVM

* Various small fixes

* Add profile

* Typo

* sbin to regex

* Date and time to extends

* Read cmdline

* Remove grep duplicate

* Small fixes

* Typo

* Permissions for warning scripts

* Add net_admin for multipath
This commit is contained in:
Jeroen 2022-09-06 23:01:17 +02:00 • committed by GitHub
parent 1649b427f8
commit 9818daba5f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
19 changed files with 237 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

39
apparmor.d/profiles-g-l/lvm Normal file
View file

@ -0,0 +1,39 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvm
profile lvm @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/dbus-strict>
include <abstractions/disks-write>
capability sys_admin,
capability sys_nice,
capability net_admin,
@{exec_path} rm,
/etc/lvm/** r,
@{run}/lvm/** rwk,
@{run}/lock/lvm/* rwk,
@{sys}/bus/ r,
@{sys}/class/ r,
@{sys}/devices/virtual/bdi/**/read_ahead_kb r,
@{PROC}/devices r,
owner @{PROC}/@{pid}/cmdline r,
@{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
/dev/mapper/control rw,
include if exists <local/lvm>
}

20
apparmor.d/profiles-g-l/lvmconfig Normal file
View file

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvmconfig
profile lvmconfig @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} rm,
/etc/lvm/** rw,
include if exists <local/lvmconfig>
}

19
apparmor.d/profiles-g-l/lvmdump Normal file
View file

@ -0,0 +1,19 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvmdump
profile lvmdump @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/disks-read>
@{exec_path} rm,
include if exists <local/lvmdump>
}

22
apparmor.d/profiles-g-l/lvmpolld Normal file
View file

@ -0,0 +1,22 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvmpolld
profile lvmpolld @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
@{exec_path} rm,
/{usr/,}bin/grep rix,
/{usr/,}bin/umount rPx,
@{run}/lvmpolld.pid rwk,
include if exists <local/lvmpolld>
}