refractor: move more profiles to groups.
This commit is contained in:
Alexandre Pujol
parent
fadc08b1ea
commit
9d74168be2
51 changed files with 0 additions and 0 deletions
|
|
@ -1,47 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/agetty
|
||||
profile agetty @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability checkpoint_restore,
|
||||
capability fsetid,
|
||||
capability sys_admin,
|
||||
capability sys_tty_config,
|
||||
capability chown,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/login rPx,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
@{etc_ro}/login.defs.d/{,*} r,
|
||||
@{etc_rw}/issue r,
|
||||
/{,usr/}lib/os-release r,
|
||||
/{etc,run,lib,usr/lib}/issue r,
|
||||
/{etc,run,lib,usr/lib}/issue.d/{,*} r,
|
||||
/etc/inittab r,
|
||||
/etc/os-release r,
|
||||
|
||||
@{run}/credentials/getty@tty@{int}.service/ r,
|
||||
@{run}/credentials/serial-getty@ttyS@{int}.service/ r,
|
||||
owner @{run}/agetty.reload rw,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
owner /dev/ttyGS@{int} rw,
|
||||
owner /dev/ttyS@{int} rw,
|
||||
|
||||
include if exists <local/agetty>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/anacron
|
||||
profile anacron @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
signal (receive) set=(usr1) peer=@{p_systemd},
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
@{bin}/run-parts rCx -> run-parts,
|
||||
@{bin}/exim4 rPx,
|
||||
|
||||
/ r,
|
||||
/etc/anacrontab r,
|
||||
|
||||
/var/spool/anacron/cron.* rwk,
|
||||
|
||||
@{HOME}/ r,
|
||||
|
||||
/tmp/file* rw,
|
||||
|
||||
profile run-parts {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/run-parts mr,
|
||||
|
||||
/etc/cron.*/ r,
|
||||
/etc/cron.*/* rPUx,
|
||||
|
||||
owner @{tmp}/#@{int} rw,
|
||||
owner @{tmp}/file@{rand6} rw,
|
||||
|
||||
include if exists <local/anacron_run-parts>
|
||||
}
|
||||
|
||||
include if exists <local/anacron>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/blkid
|
||||
profile blkid @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/blkid.conf r,
|
||||
|
||||
# When the system doesn't have the /run/ dir, the cache file is placed under /etc/
|
||||
@{etc_rw}/blkid.tab{,-@{rand6}} rw,
|
||||
@{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab,
|
||||
|
||||
/.ismount-test-file rw,
|
||||
|
||||
# Image files
|
||||
@{user_img_dirs}/{,**} r,
|
||||
|
||||
# The standard location of the cache file
|
||||
# Without owner here if this tool should be used as a regular user
|
||||
@{run}/blkid/ rw,
|
||||
@{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
@{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
|
||||
@{run}/cloud-init/ds-identify.log w, # file_inherit
|
||||
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/swaps r,
|
||||
|
||||
# Other possible location of the cache file
|
||||
/dev/.blkid.tab.old rwl -> /dev/.blkid.tab,
|
||||
/dev/.blkid.tab{,-@{rand6}} rw,
|
||||
/dev/blkid.tab.old rwl -> /dev/blkid.tab,
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
include if exists <local/blkid>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/blockdev
|
||||
profile blockdev @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{PROC}/partitions r,
|
||||
|
||||
include if exists <local/blockdev>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chage
|
||||
profile chage @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/{passwd,shadow} rw,
|
||||
/etc/{passwd,shadow}.@{pid} w,
|
||||
/etc/{passwd,shadow}- w,
|
||||
/etc/{passwd,shadow}+ rw,
|
||||
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/shadow.lock wl -> /etc/shadow.@{pid},
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/chage>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chfn
|
||||
profile chfn @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
# To write records to the kernel auditing log.
|
||||
capability audit_write,
|
||||
|
||||
# To set the right permission to the files in the /etc/ dir.
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
|
||||
# chfn is a SETUID binary
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
/etc/passwd rw,
|
||||
/etc/passwd- w,
|
||||
/etc/passwd+ rw,
|
||||
/etc/passwd.@{pid} w,
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
include if exists <local/chfn>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chpasswd
|
||||
profile chpasswd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability setuid,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{etc_ro}/login.defs r,
|
||||
|
||||
/etc/.pwd.lock wk,
|
||||
/etc/passwd rw,
|
||||
/etc/passwd.@{int} w,
|
||||
/etc/passwd.lock l -> /etc/passwd.@{int},
|
||||
/etc/passwd.lock w,
|
||||
/etc/shadow rw,
|
||||
/etc/shadow- w,
|
||||
/etc/shadow.@{int} w,
|
||||
/etc/shadow.lock l -> /etc/shadow.@{int},
|
||||
/etc/shadow.lock w,
|
||||
/etc/shadow+ rw,
|
||||
|
||||
include if exists <local/chpasswd>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/chsh
|
||||
profile chsh @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability audit_write,
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability net_admin,
|
||||
capability setuid,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
unix type=stream addr=@@{udbus}/bus/chsh/system,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/shells r,
|
||||
|
||||
/etc/.chsh.@{rand6} rw,
|
||||
/etc/passwd rw,
|
||||
/etc/passwd- w,
|
||||
/etc/passwd.@{pid} w,
|
||||
/etc/passwd.lock wl -> /etc/passwd.@{pid},
|
||||
/etc/passwd.OLD wl -> /etc/passwd,
|
||||
/etc/passwd+ rw,
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
# A process first uses lckpwdf() to lock the lock file, thereby gaining exclusive rights to
|
||||
# modify the /etc/passwd or /etc/shadow password database.
|
||||
/etc/.pwd.lock rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/chsh>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/df
|
||||
profile df @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/usr/share/icons/*/index.theme r,
|
||||
|
||||
# For dir stats
|
||||
/ r,
|
||||
/**/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
include if exists <local/df>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/eject
|
||||
profile eject @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
|
||||
@{lib}/eject/dmcrypt-get-device rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
include if exists <local/eject>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/findmnt
|
||||
profile findmnt @{exec_path} flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability dac_read_search,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
/etc/mtab r,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
|
||||
# File Inherit
|
||||
deny unix (receive) type=stream,
|
||||
|
||||
include if exists <local/findmnt>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fsck
|
||||
profile fsck @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability sys_rawio,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{bin}/e2fsck rPx,
|
||||
@{bin}/fsck.* rPx,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# When a mount dir is passed to fsck as an argument.
|
||||
@{HOME}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
/boot/ r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
@{run}/systemd/fsck.progress rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
owner @{run}/blkid/blkid.tab{,-@{rand6}} rw,
|
||||
owner @{run}/fsck/ rw,
|
||||
owner @{run}/fsck/*.lock rwk,
|
||||
|
||||
@{PROC}/@{pids}/mountinfo r,
|
||||
@{PROC}/partitions r,
|
||||
|
||||
include if exists <local/fsck>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/4.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{bin}/fstrim
|
||||
profile fstrim @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability dac_override,
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
@{HOMEDIRS}/ r,
|
||||
@{MOUNTDIRS}/ r,
|
||||
@{MOUNTS}/ r,
|
||||
/ r,
|
||||
/boot/ r,
|
||||
/boot/efi/ r,
|
||||
/var/ r,
|
||||
|
||||
include if exists <local/fstrim>
|
||||
}
|
||||
|
||||
# vim:syntax=apparmor
|
||||
Loading…
Add table
Add a link
Reference in a new issue