Move debian only profiles.
This commit is contained in:
Alexandre Pujol
parent
717505daf5
commit
a4fe3209c9
9 changed files with 0 additions and 0 deletions
27
apparmor.d/groups/apt/command-not-found
Normal file
27
apparmor.d/groups/apt/command-not-found
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /usr/share/command-not-found/command-not-found
|
||||
@{exec_path} += /{usr/,}bin/command-not-found
|
||||
profile command-not-found @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/apt-common>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/python3.[0-9]* r,
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
|
||||
/var/lib/command-not-found/commands.db rwk,
|
||||
|
||||
/usr/share/command-not-found/{,**} r,
|
||||
|
||||
include if exists <local/command-not-found>
|
||||
}
|
||||
27
apparmor.d/groups/apt/debconf-show
Normal file
27
apparmor.d/groups/apt/debconf-show
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/debconf-show
|
||||
profile debconf-show @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/perl>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/perl r,
|
||||
|
||||
/{usr/,}bin/locale rix,
|
||||
|
||||
/etc/debconf.conf r,
|
||||
|
||||
/var/cache/debconf/{config,passwords,templates}.dat r,
|
||||
|
||||
/etc/shadow r,
|
||||
|
||||
include if exists <local/debconf-show>
|
||||
}
|
||||
29
apparmor.d/groups/apt/deborphan
Normal file
29
apparmor.d/groups/apt/deborphan
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/deborphan
|
||||
profile deborphan @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/var/lib/deborphan/keep rw,
|
||||
|
||||
/var/lib/dpkg/status r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.synaptic/selections.{update,proceed} w,
|
||||
|
||||
include if exists <local/deborphan>
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
50
apparmor.d/groups/apt/debsecan
Normal file
50
apparmor.d/groups/apt/debsecan
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/debsecan
|
||||
profile debsecan @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/python>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/python3.[0-9]* r,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
# Send results using email
|
||||
/{usr/,}{s,}bin/exim4 rPx,
|
||||
|
||||
/etc/apt/apt.conf.d/{,*} r,
|
||||
/etc/apt/apt.conf r,
|
||||
|
||||
/etc/default/debsecan rw,
|
||||
|
||||
/usr/share/dpkg/cputable r,
|
||||
/usr/share/dpkg/tupletable r,
|
||||
|
||||
/var/lib/dpkg/status r,
|
||||
|
||||
/var/lib/debsecan/history{,.*} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
# file_inherit
|
||||
/tmp/#[0-9]*[0-9] rw,
|
||||
|
||||
include if exists <local/debsecan>
|
||||
}
|
||||
64
apparmor.d/groups/apt/debsign
Normal file
64
apparmor.d/groups/apt/debsign
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{BUILD_DIR} = @{MOUNTS}/debuilder/
|
||||
|
||||
@{exec_path} = /{usr/,}bin/debsign
|
||||
profile debsign @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/mktemp rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
/{usr/,}bin/cp rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/head rix,
|
||||
/{usr/,}bin/cu rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/stty rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/getopt rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/cmp rix,
|
||||
|
||||
/{usr/,}bin/md5sum rix,
|
||||
/{usr/,}bin/sha{1,256,512}sum rix,
|
||||
|
||||
/{usr/,}bin/perl rix,
|
||||
|
||||
/etc/devscripts.conf r,
|
||||
owner @{HOME}/.devscripts r,
|
||||
|
||||
# For package building
|
||||
owner @{BUILD_DIR}/** rwkl -> @{BUILD_DIR}/**,
|
||||
|
||||
owner /tmp/debsign.*/ rw,
|
||||
owner /tmp/debsign.*/*.{dsc,changes,buildinfo}{,.asc} rw,
|
||||
|
||||
|
||||
/{usr/,}bin/gpg rCx -> gpg,
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/gpg mr,
|
||||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/ r,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
owner /tmp/debsign.*/*.{dsc,changes,buildinfo} r,
|
||||
owner /tmp/debsign.*/*.{dsc,changes,buildinfo}.asc rw,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/debsign>
|
||||
}
|
||||
51
apparmor.d/groups/apt/debsums
Normal file
51
apparmor.d/groups/apt/debsums
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/debsums
|
||||
profile debsums @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/perl>
|
||||
|
||||
# Needed to read files owned by other users than root.
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
|
||||
/etc/dpkg/dpkg.cfg.d/{,*} r,
|
||||
/etc/dpkg/dpkg.cfg r,
|
||||
|
||||
/var/lib/dpkg/info/* r,
|
||||
|
||||
/etc/locale.nopurge r,
|
||||
|
||||
# Do not strip env to avoid errors like the following:
|
||||
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
|
||||
# shared object file): ignored.
|
||||
/{usr/,}bin/dpkg-query rpx,
|
||||
#
|
||||
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
||||
/{usr/,}bin/dpkg-divert rPx -> child-dpkg-divert,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
/root/ r,
|
||||
|
||||
# Scanning files
|
||||
/{usr/,}bin/{,*} r,
|
||||
/{usr/,}sbin/{,*} r,
|
||||
/usr/{,**} r,
|
||||
/etc/{,**} r,
|
||||
/var/lib/{,**} r,
|
||||
/opt/{,**} r,
|
||||
/boot/{,**} r,
|
||||
|
||||
include if exists <local/debsums>
|
||||
}
|
||||
45
apparmor.d/groups/apt/debtags
Normal file
45
apparmor.d/groups/apt/debtags
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{BUILD_DIR} = @{MOUNTS}/debuilder/
|
||||
|
||||
@{exec_path} = /{usr/,}bin/debtags
|
||||
profile debtags @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/python>
|
||||
|
||||
#capability sys_tty_config,
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/python3.[0-9]* r,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/usr/share/debtags/vocabulary r,
|
||||
/var/lib/debtags/vocabulary rw,
|
||||
/var/lib/debtags/package-tags rw,
|
||||
/var/lib/debtags/tmp* rw,
|
||||
|
||||
/var/cache/apt/ r,
|
||||
/var/cache/apt/** rwk,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
@{BUILD_DIR}/** rwkl -> @{BUILD_DIR}/**,
|
||||
|
||||
# file_inherit
|
||||
/var/log/cron-apt/temp w ,
|
||||
|
||||
include if exists <local/debtags>
|
||||
}
|
||||
84
apparmor.d/groups/apt/querybts
Normal file
84
apparmor.d/groups/apt/querybts
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/querybts
|
||||
profile querybts @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/python3.[0-9]* r,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/stty rix,
|
||||
/{usr/,}{s,}bin/ldconfig rix,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
|
||||
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
||||
|
||||
/etc/reportbug.conf r,
|
||||
owner @{HOME}/.reportbugrc r,
|
||||
|
||||
/etc/mime.types r,
|
||||
/etc/inputrc r,
|
||||
|
||||
/etc/dpkg/origins/ r,
|
||||
/etc/dpkg/origins/debian r,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/querybts>
|
||||
}
|
||||
145
apparmor.d/groups/apt/reportbug
Normal file
145
apparmor.d/groups/apt/reportbug
Normal file
|
|
@ -0,0 +1,145 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/reportbug
|
||||
profile reportbug @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/wayland>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/python>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/deny-dconf>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/python3.[0-9]* r,
|
||||
|
||||
/usr/share/reportbug/handle_bugscript rix,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}{s,}bin/ldconfig rix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/stty rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/locale rix,
|
||||
/{usr/,}bin/aa-enabled rix,
|
||||
/{usr/,}{s,}bin/selinuxenabled rix,
|
||||
/{usr/,}bin/md5sum rix,
|
||||
|
||||
/{usr/,}bin/debconf-show rPx,
|
||||
/{usr/,}bin/debsums rPx,
|
||||
/{usr/,}bin/dlocate rPx,
|
||||
/{usr/,}bin/apt-cache rPx,
|
||||
# Do not strip env to avoid errors like the following:
|
||||
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
|
||||
# shared object file): ignored.
|
||||
/{usr/,}bin/dpkg-query rpx,
|
||||
#
|
||||
/{usr/,}{s,}bin/exim4 rPx,
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
||||
/{usr/,}bin/systemctl rPx -> child-systemctl,
|
||||
/{usr/,}bin/pager rPx -> child-pager,
|
||||
/{usr/,}bin/less rPx -> child-pager,
|
||||
/{usr/,}bin/more rPx -> child-pager,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}bin/run-parts rCx -> run-parts,
|
||||
/{usr/,}bin/gpg rCx -> gpg,
|
||||
|
||||
# For sending additional information
|
||||
/etc/** r,
|
||||
|
||||
/etc/reportbug.conf r,
|
||||
owner @{HOME}/.reportbugrc{,~} rw,
|
||||
|
||||
# For shell pwd
|
||||
owner @{HOME}/ r,
|
||||
|
||||
# Think what to do with it (#FIXME#)
|
||||
/usr/share/bug/*/{control,presubj} r,
|
||||
/usr/share/bug/* rPUx,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/X11/xkb/** r,
|
||||
|
||||
/{usr/,}lib/python3/dist-packages/pylocales/locales.db rk,
|
||||
|
||||
@{PROC}/1/cgroup r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/sys/kernel/tainted r,
|
||||
|
||||
@{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
owner /tmp/reportbug-*-[0-9]*-@{pid}-* rw,
|
||||
owner /tmp/[a-z0-9]* rw,
|
||||
owner /var/tmp/*.bug{,~} rw,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
|
||||
|
||||
profile run-parts {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/run-parts mr,
|
||||
|
||||
}
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/gpg mr,
|
||||
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
owner /tmp/reportbug-*-{signed,unsigned}-[0-9]*-[0-9]*-* rw,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/reportbug>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue