felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2023-12-13 20:09:52 +00:00
parent ecb7f2e79f
commit a1b86b56d2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
31 changed files with 75 additions and 131 deletions
Download patch file Download diff file Expand all files Collapse all files

23
apparmor.d/profiles-g-l/haveged
View file

@ -1,32 +1,31 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2009-2012 Steve Kostecke <steve@debian.org>;
# 2011-2014 Jérémy Bobbio <lunar@debian.org>;
# 2020 krathalan https://git.sr.ht/~krathalan/apparmor-profiles/
# Copyright (C) 2011-2014 Jérémy Bobbio <lunar@debian.org>;
# Copyright (C) 2020 krathalan https://git.sr.ht/~krathalan/apparmor-profiles/
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-3.0-only
# Version of program profiled: 1.9.14
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/haveged
profile haveged @{exec_path} {
include <abstractions/base>
# Required for ioctl RNDADDENTROPY
capability sys_admin,
owner @{PROC}/@{pid}/status r,
@{exec_path} mr,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/poolsize r,
@{PROC}/sys/kernel/random/write_wakeup_threshold w,
/dev/random w,
@{sys}/devices/system/cpu/cpu@{int}/cache/ r,
@{sys}/devices/system/cpu/cpu@{int}/cache/index*/{type,size,level} r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/poolsize r,
@{PROC}/sys/kernel/random/write_wakeup_threshold w,
owner @{PROC}/@{pid}/status r,
/dev/random w,
include if exists <local/haveged>
}

1
apparmor.d/profiles-g-l/id
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,

14
apparmor.d/profiles-g-l/ifconfig
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -12,23 +13,20 @@ profile ifconfig @{exec_path} {
include <abstractions/consoles>
include <abstractions/nameservice-strict>
# To be able to manage network interfaces.
capability net_admin,
# Needed?
audit deny capability sys_module,
capability sys_module,
network inet dgram,
network inet6 dgram,
@{exec_path} mr,
@{PROC}/net/dev r,
@{PROC}/net/if_inet6 r,
/etc/networks r,
@{PROC}/@{pid}/net/dev r,
@{PROC}/@{pid}/net/if_inet6 r,
/etc/networks r,
@{PROC}/net/dev r,
@{PROC}/net/if_inet6 r,
include if exists <local/ifconfig>
}

4
apparmor.d/profiles-g-l/initd-kmod
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -27,7 +28,6 @@ profile initd-kmod @{exec_path} {
/etc/modules-load.d/*.conf r,
/etc/modules r,
profile run-parts {
include <abstractions/base>
@ -35,6 +35,7 @@ profile initd-kmod @{exec_path} {
/etc/modules-load.d/ r,
include if exists <local/initd-kmod_run-parts>
}
profile systemctl {
@ -54,6 +55,7 @@ profile initd-kmod @{exec_path} {
owner @{run}/systemd/ask-password/ rw,
owner @{run}/systemd/ask-password-block/* rw,
include if exists <local/initd-kmod_systemctl>
}
include if exists <local/initd-kmod>

3
apparmor.d/profiles-g-l/jitterentropy-rngd
View file

@ -15,7 +15,10 @@ profile jitterentropy-rngd @{exec_path} {
@{exec_path} mr,
@{PROC}/sys/kernel/random/entropy_avail r,
@{PROC}/sys/kernel/random/poolsize r,
@{PROC}/sys/kernel/random/write_wakeup_threshold r,
/dev/random w,
include if exists <local/jitterentropy-rngd>
}

1
apparmor.d/profiles-g-l/keepassxc-proxy
View file

@ -27,6 +27,7 @@ profile keepassxc-proxy @{exec_path} {
owner @{run}/user/@{pid}/app/ w,
owner @{run}/user/@{pid}/org.keepassxc.KeePassXC.BrowserServer rw,
owner @{run}/user/@{pid}/org.keepassxc.KeePassXC/ rw,
owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/ rw,
# file_inherit
deny owner @{run}/user/@{uid}/.[a-zA-Z]*/{,s} rw,

4
apparmor.d/profiles-g-l/logrotate
View file

@ -46,8 +46,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
@{bin}/mysqladmin rPUx,
@{bin}/systemd-tty-ask-password-agent rPx,
@{lib}/php/php[7-8].[3-4]-fpm-reopenlogs rPUx,
/etc/init.d/nginx rPUx,
@{bin}/squid rPUx,
/etc/init.d/nginx rPUx,
@{bin}/squid rPUx,
@{bin}/pgrep rCx -> pgrep,