general_initial

apparmor.d/profiles-g-l/loginctl

@@ -0,0 +1,29 @@
+# apparmor.d - Full set of apparmor profiles
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{,usr/}bin/loginctl
+profile loginctl @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/dbus-strict>
+
+  capability sys_resource,
+  capability net_admin,
+
+  @{exec_path} mr,
+
+  dbus (send) bus=system path=/org/freedesktop/login[0-9]*
+       interface=org.freedesktop.login[0-9]*.Manager
+       member={ListSessions,GetSession}
+       peer=(name=org.freedesktop.login[0-9]* label=systemd-logind),
+
+  dbus (send) bus=system path=/org/freedesktop/login[0-9]*/session/**
+       interface=org.freedesktop.DBus.Properties
+       member={Get,GetAll}
+       peer=(name=org.freedesktop.login[0-9]* label=systemd-logind),
+
+  include if exists <local/loginctl>
+}

apparmor.d/profiles-g-l/logrotate

@@ -46,6 +46,10 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/mysqladmin                        rPUx,
   /{usr/,}bin/systemd-tty-ask-password-agent    rPx,
   /{usr/,}lib/php/php[7-8].[3-4]-fpm-reopenlogs rPUx,
+  /etc/init.d/nginx                             rPUx,
+  /{usr/,}{s,}bin/squid                         rPUx,
+
+  /{usr/,}bin/pgrep rCx -> pgrep,
 
   # no new privs
   #/{usr/,}bin/systemctl              rCx -> systemctl,
@@ -98,5 +102,18 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
     include if exists <local/logrotate_systemctl>
   }
 
+  profile pgrep {
+    include <abstractions/base>
+
+    /{usr/,}bin/pgrep mr,
+
+    # The /proc/ dir and the cmdline file have to be radable to avoid pgrep segfault.
+         @{PROC}/ r,
+         @{PROC}/@{pids}/cmdline r,
+         @{PROC}/sys/kernel/osrelease r,
+
+    include if exists <local/logrotate_pgrep>
+  }
+
   include if exists <local/logrotate>
 }