refractor: move more profiles to groups.
This commit is contained in:
Alexandre Pujol
parent
fadc08b1ea
commit
9d74168be2
51 changed files with 0 additions and 0 deletions
48
apparmor.d/groups/cron/anacron
Normal file
48
apparmor.d/groups/cron/anacron
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/anacron
|
||||
profile anacron @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (receive) set=(usr1) peer=@{p_systemd},
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/run-parts rCx -> run-parts,
|
||||
@{bin}/exim4 rPx,
|
||||
|
||||
/ r,
|
||||
/etc/anacrontab r,
|
||||
|
||||
/var/spool/anacron/cron.* rwk,
|
||||
|
||||
@{HOME}/ r,
|
||||
|
||||
/tmp/file* rw,
|
||||
|
||||
profile run-parts {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/run-parts mr,
|
||||
|
||||
/etc/cron.*/ r,
|
||||
/etc/cron.*/* rPUx,
|
||||
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/file@{rand6} rw,
|
||||
|
||||
include if exists <local/anacron_run-parts>
|
||||
}
|
||||
|
||||
include if exists <local/anacron>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
140
apparmor.d/groups/procps/htop
Normal file
140
apparmor.d/groups/procps/htop
Normal file
|
|
@ -0,0 +1,140 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/htop
|
||||
profile htop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
capability kill,
|
||||
capability sys_nice,
|
||||
capability sys_ptrace,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
signal (send),
|
||||
signal (receive) set=(hup) peer=gnome-terminal-server,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/lsof rix,
|
||||
|
||||
/usr/share/terminfo/** r,
|
||||
|
||||
/etc/sensors.d/ r,
|
||||
/etc/sensors3.conf r,
|
||||
|
||||
owner @{user_config_dirs}/ rw,
|
||||
owner @{user_config_dirs}/htop/ rw,
|
||||
owner @{user_config_dirs}/htop/* rw,
|
||||
|
||||
owner @{PROC}/@{pid}/smaps_rollup r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/diskstats r,
|
||||
@{PROC}/loadavg r,
|
||||
@{PROC}/pressure/cpu r,
|
||||
@{PROC}/pressure/io r,
|
||||
@{PROC}/pressure/memory r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/pid_max r,
|
||||
@{PROC}/sys/kernel/sched_autogroup_enabled r,
|
||||
@{PROC}/tty/drivers r,
|
||||
@{PROC}/uptime r,
|
||||
|
||||
@{PROC}/@{pids}/ r,
|
||||
@{PROC}/@{pids}/attr/current r,
|
||||
@{PROC}/@{pids}/autogroup rw,
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/comm r,
|
||||
@{PROC}/@{pids}/environ r,
|
||||
@{PROC}/@{pids}/io r,
|
||||
@{PROC}/@{pids}/mounts r,
|
||||
@{PROC}/@{pids}/net/dev r,
|
||||
@{PROC}/@{pids}/oom_{,score_}adj r,
|
||||
@{PROC}/@{pids}/oom_score r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/@{pids}/statm r,
|
||||
@{PROC}/@{pids}/wchan r,
|
||||
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/attr/current r,
|
||||
@{PROC}/@{pids}/task/@{tid}/cgroup r,
|
||||
@{PROC}/@{pids}/task/@{tid}/cmdline r,
|
||||
@{PROC}/@{pids}/task/@{tid}/comm r,
|
||||
@{PROC}/@{pids}/task/@{tid}/environ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/io r,
|
||||
@{PROC}/@{pids}/task/@{tid}/oom_{,score_}adj r,
|
||||
@{PROC}/@{pids}/task/@{tid}/oom_score r,
|
||||
@{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
@{PROC}/@{pids}/task/@{tid}/statm r,
|
||||
@{PROC}/@{pids}/task/@{tid}/status r,
|
||||
@{PROC}/@{pids}/task/@{tid}/wchan r,
|
||||
|
||||
@{sys}/bus/dax/devices/ r,
|
||||
@{sys}/bus/i2c/devices/ r,
|
||||
@{sys}/bus/soc/devices/ r,
|
||||
@{sys}/class/hwmon/ r,
|
||||
@{sys}/class/i2c-adapter/ r,
|
||||
@{sys}/class/power_supply/ r,
|
||||
@{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r,
|
||||
@{sys}/devices/**/hwmon@{int}/ r,
|
||||
@{sys}/devices/**/hwmon@{int}/{name,temp*} r,
|
||||
@{sys}/devices/**/hwmon@{int}/**/ r,
|
||||
@{sys}/devices/**/hwmon@{int}/**/{name,temp*} r,
|
||||
@{sys}/devices/**/hwmon/ r,
|
||||
@{sys}/devices/**/hwmon/{name,temp*} r,
|
||||
@{sys}/devices/**/hwmon/**/ r,
|
||||
@{sys}/devices/**/hwmon/**/{name,temp*} r,
|
||||
@{sys}/devices/**/power_supply/**/{uevent,type,online} r,
|
||||
@{sys}/devices/*/name r,
|
||||
@{sys}/devices/i2c-@{int}/name r,
|
||||
@{sys}/devices/platform/*/i2c-@{int}/name r,
|
||||
@{sys}/devices/system/cpu/cpu@{int}/** r,
|
||||
@{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_{cur,min,max}_freq r,
|
||||
@{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{cur,min,max}_freq r,
|
||||
@{sys}/devices/system/node/node@{int}/cpumap r,
|
||||
@{sys}/devices/system/node/node@{int}/hugepages/ r,
|
||||
@{sys}/devices/system/node/node@{int}/hugepages/hugepages-*/nr_hugepages r,
|
||||
@{sys}/devices/system/node/node@{int}/meminfo r,
|
||||
@{sys}/devices/system/node/online r,
|
||||
@{sys}/devices/virtual/block/zram@{int}/{disksize,mm_stat} r,
|
||||
@{sys}/devices/virtual/dmi/id/ r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_date r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_version r,
|
||||
@{sys}/devices/virtual/dmi/id/chassis_asset_tag r,
|
||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
||||
@{sys}/devices/virtual/dmi/id/chassis_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/chassis_version r,
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/product_version r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/thermal/thermal_zone@{int}/temp r,
|
||||
@{sys}/fs/cgroup/cgroup.controllers r,
|
||||
@{sys}/fs/cgroup/cpuset.cpus.effective r,
|
||||
@{sys}/fs/cgroup/cpuset.mems.effective r,
|
||||
@{sys}/kernel/mm/hugepages/ r,
|
||||
@{sys}/kernel/mm/hugepages/hugepages-*/nr_hugepages r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
owner @{PROC}/@{pid}/cpuset r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/htop>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
57
apparmor.d/groups/procps/ps
Normal file
57
apparmor.d/groups/procps/ps
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/ps
|
||||
profile ps @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{run}/systemd/sessions/* r,
|
||||
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node@{int}/cpumap r,
|
||||
@{sys}/devices/system/node/node@{int}/meminfo r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/attr/current r,
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/environ r,
|
||||
@{PROC}/@{pids}/loginuid r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/@{pids}/statm r,
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/cmdline r,
|
||||
@{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
@{PROC}/@{pids}/task/@{tid}/status r,
|
||||
@{PROC}/@{pids}/wchan r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/pid_max r,
|
||||
@{PROC}/sys/vm/min_free_kbytes r,
|
||||
@{PROC}/tty/drivers r,
|
||||
@{PROC}/uptime r,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
include if exists <local/ps>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
39
apparmor.d/groups/procps/sysctl
Normal file
39
apparmor.d/groups/procps/sysctl
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# TODO: Rethink this profile. Should not be called by another profile.
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/sysctl
|
||||
profile sysctl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
capability sys_ptrace,
|
||||
capability sys_resource,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/sysctl.conf r,
|
||||
/etc/sysctl.d/{,**} r,
|
||||
/usr/lib/sysctl.d/{,**} r,
|
||||
|
||||
@{PROC}/sys/ r,
|
||||
@{PROC}/sys/** rw,
|
||||
|
||||
# Inherit Silencer
|
||||
deny network inet6 stream,
|
||||
deny network inet stream,
|
||||
|
||||
/etc/ufw/sysctl.conf r, # Add support for ufw
|
||||
|
||||
include if exists <local/sysctl>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
70
apparmor.d/groups/procps/top
Normal file
70
apparmor.d/groups/procps/top
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/top
|
||||
profile top @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability dac_read_search,
|
||||
capability kill,
|
||||
capability sys_nice,
|
||||
capability sys_ptrace,
|
||||
|
||||
signal send,
|
||||
|
||||
ptrace read,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/terminfo/** r,
|
||||
|
||||
/etc/topdefaultrc r,
|
||||
/etc/toprc r,
|
||||
|
||||
owner @{user_config_dirs}/procps/ rw,
|
||||
owner @{user_config_dirs}/procps/toprc rw,
|
||||
|
||||
@{run}/systemd/sessions/ r,
|
||||
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node@{int}/cpumap r,
|
||||
@{sys}/devices/system/node/node@{int}/meminfo r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/environ r,
|
||||
@{PROC}/@{pids}/oom_{,score_}adj r,
|
||||
@{PROC}/@{pids}/oom_score r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/@{pids}/statm r,
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/cgroup r,
|
||||
@{PROC}/@{pids}/task/@{tid}/cmdline r,
|
||||
@{PROC}/@{pids}/task/@{tid}/environ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/oom_{,score_}adj r,
|
||||
@{PROC}/@{pids}/task/@{tid}/oom_score r,
|
||||
@{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
@{PROC}/@{pids}/task/@{tid}/statm r,
|
||||
@{PROC}/@{pids}/task/@{tid}/status r,
|
||||
@{PROC}/@{pids}/task/@{tid}/wchan r,
|
||||
@{PROC}/@{pids}/wchan r,
|
||||
@{PROC}/loadavg r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/pid_max r,
|
||||
@{PROC}/tty/drivers r,
|
||||
@{PROC}/uptime r,
|
||||
|
||||
include if exists <local/top>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
25
apparmor.d/groups/procps/uptime
Normal file
25
apparmor.d/groups/procps/uptime
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/uptime
|
||||
profile uptime @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/uptime r,
|
||||
@{PROC}/loadavg r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
include if exists <local/uptime>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
39
apparmor.d/groups/procps/w
Normal file
39
apparmor.d/groups/procps/w
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/w
|
||||
profile w @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node@{int}/meminfo r,
|
||||
|
||||
@{run}/systemd/sessions/ r,
|
||||
@{run}/systemd/sessions/* r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/loadavg r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/uptime r,
|
||||
|
||||
include if exists <local/w>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
40
apparmor.d/groups/shadow/chage
Normal file
40
apparmor.d/groups/shadow/chage
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chage
|
||||
profile chage @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{passwd,shadow} rw,
|
||||
/etc/{passwd,shadow}.@{pid} w,
|
||||
/etc/{passwd,shadow}- w,
|
||||
/etc/{passwd,shadow}+ rw,
|
||||
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/shadow.lock wl -> /etc/shadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/chage>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
38
apparmor.d/groups/shadow/chpasswd
Normal file
38
apparmor.d/groups/shadow/chpasswd
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chpasswd
|
||||
profile chpasswd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability setuid,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/.pwd.lock wk,
|
||||
/etc/passwd rw,
|
||||
/etc/passwd.@{int} w,
|
||||
/etc/passwd.lock l -> /etc/passwd.@{int},
|
||||
/etc/passwd.lock w,
|
||||
/etc/shadow rw,
|
||||
/etc/shadow- w,
|
||||
/etc/shadow.@{int} w,
|
||||
/etc/shadow.lock l -> /etc/shadow.@{int},
|
||||
/etc/shadow.lock w,
|
||||
/etc/shadow+ rw,
|
||||
|
||||
include if exists <local/chpasswd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
48
apparmor.d/groups/shadow/gpasswd
Normal file
48
apparmor.d/groups/shadow/gpasswd
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/gpasswd
|
||||
profile gpasswd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
# To set the right permission to the files in the /etc/ dir.
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
# gpasswd is a SETUID binary
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{group,gshadow} rw,
|
||||
/etc/{group,gshadow}.@{pid} w,
|
||||
/etc/{group,gshadow}- w,
|
||||
/etc/{group,gshadow}+ rw,
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/gpasswd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
41
apparmor.d/groups/shadow/groupadd
Normal file
41
apparmor.d/groups/shadow/groupadd
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/groupadd
|
||||
profile groupadd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
@{bin}/nscd rix,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{group,gshadow} rw,
|
||||
/etc/{group,gshadow}- w,
|
||||
/etc/{group,gshadow}.@{pid} w,
|
||||
/etc/{group,gshadow}+ rw,
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/groupadd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
44
apparmor.d/groups/shadow/groupdel
Normal file
44
apparmor.d/groups/shadow/groupdel
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/groupdel
|
||||
profile groupdel @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
# To set the right permission to the files in the /etc/ dir.
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
@{bin}/nscd rix,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{group,gshadow} rw,
|
||||
/etc/{group,gshadow}.@{pid} w,
|
||||
/etc/{group,gshadow}- w,
|
||||
/etc/{group,gshadow}+ rw,
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/groupdel>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
45
apparmor.d/groups/shadow/groupmod
Normal file
45
apparmor.d/groups/shadow/groupmod
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/groupmod
|
||||
profile groupmod @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
# To set the right permission to the files in the /etc/ dir.
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{passwd,gshadow,group} rw,
|
||||
/etc/{passwd,gshadow,group}.@{pid} w,
|
||||
/etc/{passwd,gshadow,group}- w,
|
||||
/etc/{passwd,gshadow,group}+ rw,
|
||||
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/groupmod>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
38
apparmor.d/groups/shadow/grpck
Normal file
38
apparmor.d/groups/shadow/grpck
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/grpck
|
||||
profile grpck @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To set the right permission to the files in the /etc/ dir.
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{gshadow,group} rw,
|
||||
/etc/{gshadow,group}.@{pid} rw,
|
||||
/etc/{gshadow,group}- w,
|
||||
/etc/{gshadow,group}+ rw,
|
||||
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/grpck>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
27
apparmor.d/groups/shadow/lastlog
Normal file
27
apparmor.d/groups/shadow/lastlog
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lastlog
|
||||
profile lastlog @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/var/log/lastlog r,
|
||||
|
||||
include if exists <local/lastlog>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
31
apparmor.d/groups/shadow/newgidmap
Normal file
31
apparmor.d/groups/shadow/newgidmap
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/newgidmap
|
||||
profile newgidmap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_override,
|
||||
capability setgid,
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/subgid r,
|
||||
|
||||
@{PROC}/@{pids}/ r,
|
||||
@{PROC}/@{pids}/logingid r,
|
||||
@{PROC}/@{pids}/loginuid r,
|
||||
@{PROC}/@{pids}/gid_map w,
|
||||
|
||||
include if exists <local/newgidmap>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
31
apparmor.d/groups/shadow/newuidmap
Normal file
31
apparmor.d/groups/shadow/newuidmap
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/newuidmap
|
||||
profile newuidmap @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_override,
|
||||
capability setuid,
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/subuid r,
|
||||
|
||||
@{PROC}/@{pids}/ r,
|
||||
@{PROC}/@{pids}/logingid r,
|
||||
@{PROC}/@{pids}/loginuid r,
|
||||
@{PROC}/@{pids}/uid_map w,
|
||||
|
||||
include if exists <local/newuidmap>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
46
apparmor.d/groups/shadow/passwd
Normal file
46
apparmor.d/groups/shadow/passwd
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/passwd
|
||||
profile passwd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability net_admin,
|
||||
capability setuid,
|
||||
|
||||
signal receive set=(term kill) peer=gnome-control-center,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/nshadow rw,
|
||||
/etc/shadow rw,
|
||||
/etc/shadow- rw,
|
||||
/etc/shadow.@{int} rw,
|
||||
/etc/shadow.lock rwl,
|
||||
/etc/shadow+ rw,
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/passwd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/shadow/pwck
Normal file
34
apparmor.d/groups/shadow/pwck
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/pwck
|
||||
profile pwck @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/nscd rix,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/.pwd.lock wk,
|
||||
/etc/passwd rw,
|
||||
/etc/passwd.@{int} rw,
|
||||
/etc/passwd.lock wl,
|
||||
/etc/shadow rw,
|
||||
/etc/shadow.@{int} rw,
|
||||
/etc/shadow.lock wl,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
||||
include if exists <local/pwck>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
78
apparmor.d/groups/shadow/useradd
Normal file
78
apparmor.d/groups/shadow/useradd
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/useradd
|
||||
profile useradd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/nscd rix,
|
||||
@{bin}/usermod rPx,
|
||||
|
||||
@{bin}/pam_tally2 rCx -> pam_tally2,
|
||||
|
||||
/etc/default/useradd r,
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid} rw,
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid}- w,
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid}.@{pid} w,
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid}+ rw,
|
||||
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/shadow.lock wl -> /etc/shadow.@{pid},
|
||||
/etc/subgid.lock wl -> /etc/subgid.@{pid},
|
||||
/etc/subuid.lock wl -> /etc/subuid.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
/var/log/faillog rw,
|
||||
/var/log/lastlog rw,
|
||||
|
||||
# To create user dirs and copy files from /etc/skel/ to them
|
||||
@{HOME}/ rw,
|
||||
@{HOME}/** wl,
|
||||
@{HOME}/**/ r,
|
||||
/var/lib/*/{,*} rw,
|
||||
/etc/skel/{,.**} r,
|
||||
|
||||
profile pam_tally2 {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability audit_write,
|
||||
|
||||
@{bin}/pam_tally2 mr,
|
||||
|
||||
/var/log/tallylog rw,
|
||||
|
||||
include if exists <local/useradd_pam_tally2>
|
||||
}
|
||||
|
||||
include if exists <local/useradd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
59
apparmor.d/groups/shadow/userdel
Normal file
59
apparmor.d/groups/shadow/userdel
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/userdel
|
||||
profile userdel @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability fsetid,
|
||||
capability sys_ptrace,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid} rw,
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid}.@{pid} w,
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid}- w,
|
||||
/etc/{passwd,shadow,gshadow,group,subuid,subgid}+ rw,
|
||||
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/shadow.lock wl -> /etc/shadow.@{pid},
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
/etc/subuid.lock wl -> /etc/subuid.@{pid},
|
||||
/etc/subgid.lock wl -> /etc/subgid.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
# To remove user home files
|
||||
@{HOME}/{,**} rw,
|
||||
/var/ r,
|
||||
/var/lib/ r,
|
||||
/var/lib/*/{,**} rw,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
|
||||
include if exists <local/userdel>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
60
apparmor.d/groups/shadow/usermod
Normal file
60
apparmor.d/groups/shadow/usermod
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/usermod
|
||||
profile usermod @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability sys_ptrace,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/nscd rix,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
/etc/subuid r,
|
||||
|
||||
/etc/{passwd,shadow,gshadow,group} rw,
|
||||
/etc/{passwd,shadow,gshadow,group}.@{pid} w,
|
||||
/etc/{passwd,shadow,gshadow,group}- w,
|
||||
/etc/{passwd,shadow,gshadow,group}+ rw,
|
||||
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/group.lock wl -> /etc/group.@{pid},
|
||||
/etc/shadow.lock wl -> /etc/shadow.@{pid},
|
||||
/etc/gshadow.lock wl -> /etc/gshadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
# To create and move user dirs
|
||||
@{HOME}/{,**} rw,
|
||||
/var/ r,
|
||||
/var/lib/ r,
|
||||
/var/lib/*/{,**} rw,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
|
||||
include if exists <local/usermod>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
47
apparmor.d/groups/utils/agetty
Normal file
47
apparmor.d/groups/utils/agetty
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/agetty
|
||||
profile agetty @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability checkpoint_restore,
|
||||
capability fsetid,
|
||||
capability sys_admin,
|
||||
capability sys_tty_config,
|
||||
capability chown,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/login rPx,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
@{etc_ro}/login.defs.d/{,*} r,
|
||||
@{etc_rw}/issue r,
|
||||
/{,usr/}lib/os-release r,
|
||||
/{etc,run,lib,usr/lib}/issue r,
|
||||
/{etc,run,lib,usr/lib}/issue.d/{,*} r,
|
||||
/etc/inittab r,
|
||||
/etc/os-release r,
|
||||
|
||||
@{run}/credentials/getty@tty@{int}.service/ r,
|
||||
@{run}/credentials/serial-getty@ttyS@{int}.service/ r,
|
||||
owner @{run}/agetty.reload rw,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
owner /dev/ttyGS@{int} rw,
|
||||
owner /dev/ttyS@{int} rw,
|
||||
|
||||
include if exists <local/agetty>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
53
apparmor.d/groups/utils/blkid
Normal file
53
apparmor.d/groups/utils/blkid
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/blkid
|
||||
profile blkid @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/blkid.conf r,
|
||||
|
||||
# When the system doesn't have the /run/ dir, the cache file is placed under /etc/
|
||||
@{etc_rw}/blkid.tab{,-@{rand6}} rw,
|
||||
@{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab,
|
||||
|
||||
/.ismount-test-file rw,
|
||||
|
||||
# Image files
|
||||
@{user_img_dirs}/{,**} r,
|
||||
|
||||
# The standard location of the cache file
|
||||
# Without owner here if this tool should be used as a regular user
|
||||
@{run}/blkid/ rw,
|
||||
@{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
@{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
|
||||
@{run}/cloud-init/ds-identify.log w, # file_inherit
|
||||
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/swaps r,
|
||||
|
||||
# Other possible location of the cache file
|
||||
/dev/.blkid.tab.old rwl -> /dev/.blkid.tab,
|
||||
/dev/.blkid.tab{,-@{rand6}} rw,
|
||||
/dev/blkid.tab.old rwl -> /dev/blkid.tab,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/blkid>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
24
apparmor.d/groups/utils/blockdev
Normal file
24
apparmor.d/groups/utils/blockdev
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/blockdev
|
||||
profile blockdev @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/partitions r,
|
||||
|
||||
include if exists <local/blockdev>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
49
apparmor.d/groups/utils/chfn
Normal file
49
apparmor.d/groups/utils/chfn
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chfn
|
||||
profile chfn @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
# To set the right permission to the files in the /etc/ dir.
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
# chfn is a SETUID binary
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
/etc/passwd rw,
|
||||
/etc/passwd- w,
|
||||
/etc/passwd+ rw,
|
||||
/etc/passwd.@{pid} w,
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/chfn>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
54
apparmor.d/groups/utils/chsh
Normal file
54
apparmor.d/groups/utils/chsh
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chsh
|
||||
profile chsh @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability net_admin,
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
unix type=stream addr=@@{udbus}/bus/chsh/system,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/shells r,
|
||||
|
||||
/etc/.chsh.@{rand6} rw,
|
||||
/etc/passwd rw,
|
||||
/etc/passwd- w,
|
||||
/etc/passwd.@{pid} w,
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/passwd.OLD wl -> /etc/passwd,
|
||||
/etc/passwd+ rw,
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/chsh>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
30
apparmor.d/groups/utils/df
Normal file
30
apparmor.d/groups/utils/df
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/df
|
||||
profile df @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/icons/*/index.theme r,
|
||||
|
||||
# For dir stats
|
||||
/ r,
|
||||
/**/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
include if exists <local/df>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/eject
Normal file
34
apparmor.d/groups/utils/eject
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/eject
|
||||
profile eject @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
|
||||
@{lib}/eject/dmcrypt-get-device rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
include if exists <local/eject>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
32
apparmor.d/groups/utils/findmnt
Normal file
32
apparmor.d/groups/utils/findmnt
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/findmnt
|
||||
profile findmnt @{exec_path} flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability dac_read_search,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/mtab r,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
|
||||
# File Inherit
|
||||
deny unix (receive) type=stream,
|
||||
|
||||
include if exists <local/findmnt>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
44
apparmor.d/groups/utils/fsck
Normal file
44
apparmor.d/groups/utils/fsck
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fsck
|
||||
profile fsck @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/e2fsck rPx,
|
||||
@{bin}/fsck.* rPx,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# When a mount dir is passed to fsck as an argument.
|
||||
@{HOME}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
/boot/ r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
@{run}/systemd/fsck.progress rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
owner @{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
owner @{run}/fsck/ rw,
|
||||
owner @{run}/fsck/*.lock rwk,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
@{PROC}/partitions r,
|
||||
|
||||
include if exists <local/fsck>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
32
apparmor.d/groups/utils/fstrim
Normal file
32
apparmor.d/groups/utils/fstrim
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fstrim
|
||||
profile fstrim @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability dac_override,
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
@{HOMEDIRS}/ r,
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
/ r,
|
||||
/boot/ r,
|
||||
/boot/efi/ r,
|
||||
/var/ r,
|
||||
|
||||
include if exists <local/fstrim>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
44
apparmor.d/groups/utils/locale-gen
Normal file
44
apparmor.d/groups/utils/locale-gen
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/locale-gen
|
||||
profile locale-gen @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/perl>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/cat rix,
|
||||
@{bin}/gzip rix,
|
||||
@{bin}/localedef rix,
|
||||
@{bin}/rm rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/sort rix,
|
||||
|
||||
@{lib}/locale/locale-archive rwl,
|
||||
@{lib}/locale/locale-archive* rw,
|
||||
|
||||
/usr/share/i18n/{,**} r,
|
||||
|
||||
/etc/locale.gen r,
|
||||
|
||||
/var/lib/locales/supported.d/{,**} r,
|
||||
|
||||
# Inherit Silencer
|
||||
deny network inet6 stream,
|
||||
deny network inet stream,
|
||||
|
||||
include if exists <local/locale-gen>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
79
apparmor.d/groups/utils/login
Normal file
79
apparmor.d/groups/utils/login
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/login
|
||||
profile login @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability kill,
|
||||
capability net_admin,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_resource,
|
||||
capability sys_tty_config,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
signal (send) set=(hup term),
|
||||
|
||||
unix type=stream addr=@@{udbus}/bus/login/system,
|
||||
|
||||
ptrace read,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/@{shells} rUx,
|
||||
|
||||
@{etc_ro}/environment r,
|
||||
@{etc_ro}/security/group.conf r,
|
||||
@{etc_ro}/security/limits.conf r,
|
||||
@{etc_ro}/security/limits.d/{,*} r,
|
||||
@{etc_ro}/security/pam_env.conf r,
|
||||
/etc/default/locale r,
|
||||
/etc/legal r,
|
||||
/etc/machine-id r,
|
||||
/etc/motd r,
|
||||
/etc/motd.d/ r,
|
||||
/etc/shells r,
|
||||
|
||||
/var/lib/faillock/@{user} rwk,
|
||||
/var/log/btmp{,.@{int}} r,
|
||||
|
||||
owner @{user_cache_dirs}/motd.legal-displayed rw,
|
||||
|
||||
@{run}/credentials/getty@tty@{int}.service/ r,
|
||||
@{run}/dbus/system_bus_socket rw,
|
||||
@{run}/faillock/@{user} rwk,
|
||||
@{run}/motd.d/{,*} r,
|
||||
@{run}/motd.dynamic{,.new} rw,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/1/limits r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/login>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
29
apparmor.d/groups/utils/losetup
Normal file
29
apparmor.d/groups/utils/losetup
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/losetup
|
||||
profile losetup @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
||||
unix (receive) type=stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/**/usb[0-9]/{,**} r,
|
||||
|
||||
/dev/loop-control rw,
|
||||
/dev/loop[0-9]* rw,
|
||||
|
||||
include if exists <local/losetup>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/lsblk
Normal file
34
apparmor.d/groups/utils/lsblk
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lsblk
|
||||
profile lsblk @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
audit capability dac_override,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
# File Inherit
|
||||
deny network inet stream,
|
||||
deny network inet6 stream,
|
||||
|
||||
include if exists <local/lsblk>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/lscpu
Normal file
34
apparmor.d/groups/utils/lscpu
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lscpu
|
||||
profile lscpu @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/system/cpu/{,**} r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node@{int}/cpumap r,
|
||||
@{sys}/firmware/dmi/tables/DMI r,
|
||||
@{sys}/kernel/cpu_byteorder r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/bus/pci/devices r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
deny network unix stream,
|
||||
|
||||
include if exists <local/lscpu>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
51
apparmor.d/groups/utils/lspci
Normal file
51
apparmor.d/groups/utils/lspci
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lspci
|
||||
profile lspci @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/app/lib/libzypak-preload-host*.so rm,
|
||||
|
||||
/usr/share/hwdata/pci.ids r,
|
||||
/usr/share/misc/pci.ids r,
|
||||
/usr/share/misc/pci.ids.gz r,
|
||||
/usr/share/pci.ids r,
|
||||
|
||||
@{run}/modprobe.d/{,*.conf} r,
|
||||
/etc/modprobe.d/{,*.conf} r,
|
||||
/etc/udev/hwdb.bin r,
|
||||
|
||||
owner @{HOME}/.pciids-cache.tmp-*-@{pid} rw,
|
||||
owner @{HOME}/.pciids-cache rw,
|
||||
owner @{user_cache_dirs}/pci-ids rw,
|
||||
|
||||
@{sys}/bus/pci/devices/ r,
|
||||
@{sys}/bus/pci/slots/ r,
|
||||
@{sys}/bus/pci/slots/@{int}-@{int}/address r,
|
||||
@{sys}/bus/pci/slots/@{int}/address r,
|
||||
@{sys}/devices/@{pci}/** r,
|
||||
@{sys}/module/compression r,
|
||||
|
||||
@{PROC}/bus/pci/devices r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/ioports r,
|
||||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
include if exists <local/lspci>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
35
apparmor.d/groups/utils/newgrp
Normal file
35
apparmor.d/groups/utils/newgrp
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/newgrp
|
||||
profile newgrp @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability audit_write,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/@{shells} rUx,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{passwd,group,shadow,gshadow} r,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/newgrp>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
22
apparmor.d/groups/utils/nologin
Normal file
22
apparmor.d/groups/utils/nologin
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/nologin
|
||||
profile nologin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/nologin>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/pstree
Normal file
34
apparmor.d/groups/utils/pstree
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/pstree
|
||||
profile pstree @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/terminfo/** r,
|
||||
|
||||
@{PROC} r,
|
||||
@{PROC}/@{pids}/attr/current r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
@{PROC}/uptime r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
include if exists <local/pstree>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
36
apparmor.d/groups/utils/su
Normal file
36
apparmor.d/groups/utils/su
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/su
|
||||
profile su @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app-launcher-root>
|
||||
include <abstractions/app/sudo>
|
||||
|
||||
capability chown, # pseudo-terminal
|
||||
|
||||
signal (send) set=(term,kill),
|
||||
signal (receive) set=(int,quit,term),
|
||||
signal (receive) set=(cont,hup) peer=sudo,
|
||||
|
||||
unix (bind) type=dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/@{shells} rUx,
|
||||
@{bin}/nologin rPx,
|
||||
|
||||
@{etc_ro}/default/su r,
|
||||
|
||||
@{HOME}/.xauth@{rand6} rw,
|
||||
|
||||
include if exists <local/su>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
31
apparmor.d/groups/utils/sulogin
Normal file
31
apparmor.d/groups/utils/sulogin
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/sulogin
|
||||
profile sulogin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# The shell is not confined on purpose.
|
||||
@{bin}/@{shells} rUx,
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
@{PROC}/consoles r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/sulogin>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
32
apparmor.d/groups/utils/swapon
Normal file
32
apparmor.d/groups/utils/swapon
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/swapon @{bin}/swapoff
|
||||
profile swapon @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
owner /swap.img rw,
|
||||
owner /swap/swapfile rw,
|
||||
owner /swapfile rw,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
|
||||
/dev/pts/@{int} rw,
|
||||
|
||||
include if exists <local/swapon>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
22
apparmor.d/groups/utils/sync
Normal file
22
apparmor.d/groups/utils/sync
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/sync
|
||||
profile sync @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# All paths where sync can be used to flush all write operations on a single file to disk
|
||||
/{,**} rw,
|
||||
|
||||
include if exists <local/sync>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
26
apparmor.d/groups/utils/uname
Normal file
26
apparmor.d/groups/utils/uname
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/uname
|
||||
profile uname @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{att}/dev/tty@{int} rw,
|
||||
|
||||
deny network,
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/* r,
|
||||
deny owner @{user_share_dirs}/zed/**/data.mdb rw,
|
||||
|
||||
include if exists <local/uname>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
24
apparmor.d/groups/utils/users
Normal file
24
apparmor.d/groups/utils/users
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/users
|
||||
profile users @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/var/log/wtmp rk,
|
||||
|
||||
@{run}/utmp rk,
|
||||
|
||||
include if exists <local/users>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
26
apparmor.d/groups/utils/uuidd
Normal file
26
apparmor.d/groups/utils/uuidd
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/uuidd
|
||||
profile uuidd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
network inet dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /var/lib/libuuid/clock.txt rwk,
|
||||
|
||||
@{run}/uuidd/request rw,
|
||||
@{att}/@{run}/uuidd/request rw,
|
||||
|
||||
include if exists <local/uuidd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
25
apparmor.d/groups/utils/uuidgen
Normal file
25
apparmor.d/groups/utils/uuidgen
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/uuidgen
|
||||
profile uuidgen @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
network inet dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /var/lib/libuuid/clock.txt w,
|
||||
|
||||
@{run}/uuidd/request w,
|
||||
|
||||
include if exists <local/uuidgen>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
27
apparmor.d/groups/utils/who
Normal file
27
apparmor.d/groups/utils/who
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/who
|
||||
profile who @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability kill,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
deny owner @{user_share_dirs}/zed/**/data.mdb rw,
|
||||
|
||||
include if exists <local/who>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue