refractor: move more profiles to groups.
This commit is contained in:
Alexandre Pujol
parent
fadc08b1ea
commit
9d74168be2
51 changed files with 0 additions and 0 deletions
47
apparmor.d/groups/utils/agetty
Normal file
47
apparmor.d/groups/utils/agetty
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/agetty
|
||||
profile agetty @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability checkpoint_restore,
|
||||
capability fsetid,
|
||||
capability sys_admin,
|
||||
capability sys_tty_config,
|
||||
capability chown,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/login rPx,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
@{etc_ro}/login.defs.d/{,*} r,
|
||||
@{etc_rw}/issue r,
|
||||
/{,usr/}lib/os-release r,
|
||||
/{etc,run,lib,usr/lib}/issue r,
|
||||
/{etc,run,lib,usr/lib}/issue.d/{,*} r,
|
||||
/etc/inittab r,
|
||||
/etc/os-release r,
|
||||
|
||||
@{run}/credentials/getty@tty@{int}.service/ r,
|
||||
@{run}/credentials/serial-getty@ttyS@{int}.service/ r,
|
||||
owner @{run}/agetty.reload rw,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
owner /dev/ttyGS@{int} rw,
|
||||
owner /dev/ttyS@{int} rw,
|
||||
|
||||
include if exists <local/agetty>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
53
apparmor.d/groups/utils/blkid
Normal file
53
apparmor.d/groups/utils/blkid
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/blkid
|
||||
profile blkid @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/blkid.conf r,
|
||||
|
||||
# When the system doesn't have the /run/ dir, the cache file is placed under /etc/
|
||||
@{etc_rw}/blkid.tab{,-@{rand6}} rw,
|
||||
@{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab,
|
||||
|
||||
/.ismount-test-file rw,
|
||||
|
||||
# Image files
|
||||
@{user_img_dirs}/{,**} r,
|
||||
|
||||
# The standard location of the cache file
|
||||
# Without owner here if this tool should be used as a regular user
|
||||
@{run}/blkid/ rw,
|
||||
@{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
@{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
|
||||
@{run}/cloud-init/ds-identify.log w, # file_inherit
|
||||
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/swaps r,
|
||||
|
||||
# Other possible location of the cache file
|
||||
/dev/.blkid.tab.old rwl -> /dev/.blkid.tab,
|
||||
/dev/.blkid.tab{,-@{rand6}} rw,
|
||||
/dev/blkid.tab.old rwl -> /dev/blkid.tab,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/blkid>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
24
apparmor.d/groups/utils/blockdev
Normal file
24
apparmor.d/groups/utils/blockdev
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/blockdev
|
||||
profile blockdev @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/partitions r,
|
||||
|
||||
include if exists <local/blockdev>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
49
apparmor.d/groups/utils/chfn
Normal file
49
apparmor.d/groups/utils/chfn
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chfn
|
||||
profile chfn @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
# To set the right permission to the files in the /etc/ dir.
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
# chfn is a SETUID binary
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
/etc/passwd rw,
|
||||
/etc/passwd- w,
|
||||
/etc/passwd+ rw,
|
||||
/etc/passwd.@{pid} w,
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/chfn>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
54
apparmor.d/groups/utils/chsh
Normal file
54
apparmor.d/groups/utils/chsh
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chsh
|
||||
profile chsh @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability net_admin,
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
unix type=stream addr=@@{udbus}/bus/chsh/system,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/shells r,
|
||||
|
||||
/etc/.chsh.@{rand6} rw,
|
||||
/etc/passwd rw,
|
||||
/etc/passwd- w,
|
||||
/etc/passwd.@{pid} w,
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/passwd.OLD wl -> /etc/passwd,
|
||||
/etc/passwd+ rw,
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/chsh>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
30
apparmor.d/groups/utils/df
Normal file
30
apparmor.d/groups/utils/df
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/df
|
||||
profile df @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/icons/*/index.theme r,
|
||||
|
||||
# For dir stats
|
||||
/ r,
|
||||
/**/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
include if exists <local/df>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/eject
Normal file
34
apparmor.d/groups/utils/eject
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/eject
|
||||
profile eject @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
|
||||
@{lib}/eject/dmcrypt-get-device rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
include if exists <local/eject>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
32
apparmor.d/groups/utils/findmnt
Normal file
32
apparmor.d/groups/utils/findmnt
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/findmnt
|
||||
profile findmnt @{exec_path} flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability dac_read_search,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/mtab r,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
|
||||
# File Inherit
|
||||
deny unix (receive) type=stream,
|
||||
|
||||
include if exists <local/findmnt>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
44
apparmor.d/groups/utils/fsck
Normal file
44
apparmor.d/groups/utils/fsck
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fsck
|
||||
profile fsck @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/e2fsck rPx,
|
||||
@{bin}/fsck.* rPx,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# When a mount dir is passed to fsck as an argument.
|
||||
@{HOME}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
/boot/ r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
@{run}/systemd/fsck.progress rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
owner @{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
owner @{run}/fsck/ rw,
|
||||
owner @{run}/fsck/*.lock rwk,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
@{PROC}/partitions r,
|
||||
|
||||
include if exists <local/fsck>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
32
apparmor.d/groups/utils/fstrim
Normal file
32
apparmor.d/groups/utils/fstrim
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fstrim
|
||||
profile fstrim @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability dac_override,
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
@{HOMEDIRS}/ r,
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
/ r,
|
||||
/boot/ r,
|
||||
/boot/efi/ r,
|
||||
/var/ r,
|
||||
|
||||
include if exists <local/fstrim>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
44
apparmor.d/groups/utils/locale-gen
Normal file
44
apparmor.d/groups/utils/locale-gen
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/locale-gen
|
||||
profile locale-gen @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/perl>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/cat rix,
|
||||
@{bin}/gzip rix,
|
||||
@{bin}/localedef rix,
|
||||
@{bin}/rm rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/sort rix,
|
||||
|
||||
@{lib}/locale/locale-archive rwl,
|
||||
@{lib}/locale/locale-archive* rw,
|
||||
|
||||
/usr/share/i18n/{,**} r,
|
||||
|
||||
/etc/locale.gen r,
|
||||
|
||||
/var/lib/locales/supported.d/{,**} r,
|
||||
|
||||
# Inherit Silencer
|
||||
deny network inet6 stream,
|
||||
deny network inet stream,
|
||||
|
||||
include if exists <local/locale-gen>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
79
apparmor.d/groups/utils/login
Normal file
79
apparmor.d/groups/utils/login
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/login
|
||||
profile login @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability kill,
|
||||
capability net_admin,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability sys_resource,
|
||||
capability sys_tty_config,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
signal (send) set=(hup term),
|
||||
|
||||
unix type=stream addr=@@{udbus}/bus/login/system,
|
||||
|
||||
ptrace read,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/@{shells} rUx,
|
||||
|
||||
@{etc_ro}/environment r,
|
||||
@{etc_ro}/security/group.conf r,
|
||||
@{etc_ro}/security/limits.conf r,
|
||||
@{etc_ro}/security/limits.d/{,*} r,
|
||||
@{etc_ro}/security/pam_env.conf r,
|
||||
/etc/default/locale r,
|
||||
/etc/legal r,
|
||||
/etc/machine-id r,
|
||||
/etc/motd r,
|
||||
/etc/motd.d/ r,
|
||||
/etc/shells r,
|
||||
|
||||
/var/lib/faillock/@{user} rwk,
|
||||
/var/log/btmp{,.@{int}} r,
|
||||
|
||||
owner @{user_cache_dirs}/motd.legal-displayed rw,
|
||||
|
||||
@{run}/credentials/getty@tty@{int}.service/ r,
|
||||
@{run}/dbus/system_bus_socket rw,
|
||||
@{run}/faillock/@{user} rwk,
|
||||
@{run}/motd.d/{,*} r,
|
||||
@{run}/motd.dynamic{,.new} rw,
|
||||
@{run}/systemd/sessions/*.ref rw,
|
||||
|
||||
@{PROC}/@{pids}/cgroup r,
|
||||
@{PROC}/1/limits r,
|
||||
owner @{PROC}/@{pid}/loginuid rw,
|
||||
owner @{PROC}/@{pid}/uid_map r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/login>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
29
apparmor.d/groups/utils/losetup
Normal file
29
apparmor.d/groups/utils/losetup
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/losetup
|
||||
profile losetup @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
||||
unix (receive) type=stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/**/usb[0-9]/{,**} r,
|
||||
|
||||
/dev/loop-control rw,
|
||||
/dev/loop[0-9]* rw,
|
||||
|
||||
include if exists <local/losetup>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/lsblk
Normal file
34
apparmor.d/groups/utils/lsblk
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lsblk
|
||||
profile lsblk @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
audit capability dac_override,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
# File Inherit
|
||||
deny network inet stream,
|
||||
deny network inet6 stream,
|
||||
|
||||
include if exists <local/lsblk>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/lscpu
Normal file
34
apparmor.d/groups/utils/lscpu
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lscpu
|
||||
profile lscpu @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/system/cpu/{,**} r,
|
||||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node@{int}/cpumap r,
|
||||
@{sys}/firmware/dmi/tables/DMI r,
|
||||
@{sys}/kernel/cpu_byteorder r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/bus/pci/devices r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
deny network unix stream,
|
||||
|
||||
include if exists <local/lscpu>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
51
apparmor.d/groups/utils/lspci
Normal file
51
apparmor.d/groups/utils/lspci
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/lspci
|
||||
profile lspci @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/app/lib/libzypak-preload-host*.so rm,
|
||||
|
||||
/usr/share/hwdata/pci.ids r,
|
||||
/usr/share/misc/pci.ids r,
|
||||
/usr/share/misc/pci.ids.gz r,
|
||||
/usr/share/pci.ids r,
|
||||
|
||||
@{run}/modprobe.d/{,*.conf} r,
|
||||
/etc/modprobe.d/{,*.conf} r,
|
||||
/etc/udev/hwdb.bin r,
|
||||
|
||||
owner @{HOME}/.pciids-cache.tmp-*-@{pid} rw,
|
||||
owner @{HOME}/.pciids-cache rw,
|
||||
owner @{user_cache_dirs}/pci-ids rw,
|
||||
|
||||
@{sys}/bus/pci/devices/ r,
|
||||
@{sys}/bus/pci/slots/ r,
|
||||
@{sys}/bus/pci/slots/@{int}-@{int}/address r,
|
||||
@{sys}/bus/pci/slots/@{int}/address r,
|
||||
@{sys}/devices/@{pci}/** r,
|
||||
@{sys}/module/compression r,
|
||||
|
||||
@{PROC}/bus/pci/devices r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/ioports r,
|
||||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
include if exists <local/lspci>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
35
apparmor.d/groups/utils/newgrp
Normal file
35
apparmor.d/groups/utils/newgrp
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/newgrp
|
||||
profile newgrp @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability audit_write,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/@{shells} rUx,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{passwd,group,shadow,gshadow} r,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/newgrp>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
22
apparmor.d/groups/utils/nologin
Normal file
22
apparmor.d/groups/utils/nologin
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/nologin
|
||||
profile nologin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/nologin>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
34
apparmor.d/groups/utils/pstree
Normal file
34
apparmor.d/groups/utils/pstree
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/pstree
|
||||
profile pstree @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/terminfo/** r,
|
||||
|
||||
@{PROC} r,
|
||||
@{PROC}/@{pids}/attr/current r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/@{pids}/task/ r,
|
||||
@{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
@{PROC}/uptime r,
|
||||
owner @{PROC}/@{pid}/cmdline r,
|
||||
|
||||
include if exists <local/pstree>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
36
apparmor.d/groups/utils/su
Normal file
36
apparmor.d/groups/utils/su
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/su
|
||||
profile su @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app-launcher-root>
|
||||
include <abstractions/app/sudo>
|
||||
|
||||
capability chown, # pseudo-terminal
|
||||
|
||||
signal (send) set=(term,kill),
|
||||
signal (receive) set=(int,quit,term),
|
||||
signal (receive) set=(cont,hup) peer=sudo,
|
||||
|
||||
unix (bind) type=dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/@{shells} rUx,
|
||||
@{bin}/nologin rPx,
|
||||
|
||||
@{etc_ro}/default/su r,
|
||||
|
||||
@{HOME}/.xauth@{rand6} rw,
|
||||
|
||||
include if exists <local/su>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
31
apparmor.d/groups/utils/sulogin
Normal file
31
apparmor.d/groups/utils/sulogin
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/sulogin
|
||||
profile sulogin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# The shell is not confined on purpose.
|
||||
@{bin}/@{shells} rUx,
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
@{PROC}/consoles r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/sulogin>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
32
apparmor.d/groups/utils/swapon
Normal file
32
apparmor.d/groups/utils/swapon
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/swapon @{bin}/swapoff
|
||||
profile swapon @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
owner /swap.img rw,
|
||||
owner /swap/swapfile rw,
|
||||
owner /swapfile rw,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
|
||||
/dev/pts/@{int} rw,
|
||||
|
||||
include if exists <local/swapon>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
22
apparmor.d/groups/utils/sync
Normal file
22
apparmor.d/groups/utils/sync
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/sync
|
||||
profile sync @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# All paths where sync can be used to flush all write operations on a single file to disk
|
||||
/{,**} rw,
|
||||
|
||||
include if exists <local/sync>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
26
apparmor.d/groups/utils/uname
Normal file
26
apparmor.d/groups/utils/uname
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/uname
|
||||
profile uname @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{att}/dev/tty@{int} rw,
|
||||
|
||||
deny network,
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/* r,
|
||||
deny owner @{user_share_dirs}/zed/**/data.mdb rw,
|
||||
|
||||
include if exists <local/uname>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
24
apparmor.d/groups/utils/users
Normal file
24
apparmor.d/groups/utils/users
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/users
|
||||
profile users @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/var/log/wtmp rk,
|
||||
|
||||
@{run}/utmp rk,
|
||||
|
||||
include if exists <local/users>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
26
apparmor.d/groups/utils/uuidd
Normal file
26
apparmor.d/groups/utils/uuidd
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/uuidd
|
||||
profile uuidd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
network inet dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /var/lib/libuuid/clock.txt rwk,
|
||||
|
||||
@{run}/uuidd/request rw,
|
||||
@{att}/@{run}/uuidd/request rw,
|
||||
|
||||
include if exists <local/uuidd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
25
apparmor.d/groups/utils/uuidgen
Normal file
25
apparmor.d/groups/utils/uuidgen
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/uuidgen
|
||||
profile uuidgen @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
network inet dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /var/lib/libuuid/clock.txt w,
|
||||
|
||||
@{run}/uuidd/request w,
|
||||
|
||||
include if exists <local/uuidgen>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
27
apparmor.d/groups/utils/who
Normal file
27
apparmor.d/groups/utils/who
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/who
|
||||
profile who @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability kill,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
|
||||
deny owner @{user_share_dirs}/zed/**/data.mdb rw,
|
||||
|
||||
include if exists <local/who>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
31
apparmor.d/groups/utils/zramctl
Normal file
31
apparmor.d/groups/utils/zramctl
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/zramctl
|
||||
profile zramctl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/virtual/block/zram@{int}/ r,
|
||||
@{sys}/devices/virtual/block/zram@{int}/comp_algorithm r,
|
||||
@{sys}/devices/virtual/block/zram@{int}/disksize r,
|
||||
@{sys}/devices/virtual/block/zram@{int}/max_comp_streams r,
|
||||
@{sys}/devices/virtual/block/zram@{int}/mm_stat r,
|
||||
|
||||
@{PROC}/swaps r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/zram@{int} rw,
|
||||
|
||||
include if exists <local/zramctl>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue