felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update some systemd profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-25 01:28:08 +02:00
parent 592b3abe30
commit b479013f91
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
8 changed files with 27 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

22
apparmor.d/groups/systemd/bootctl
View file

@ -25,17 +25,17 @@ profile bootctl @{exec_path} flags=(attach_disconnected) {
@{pager_path} rPx -> child-pager,
/{boot,efi}/ r,
/{boot,efi}/EFI/{,**} r,
/{boot,efi}/EFI/BOOT/.#BOOT*.EFI@{hex} rw,
/{boot,efi}/EFI/BOOT/BOOTX64.EFI w,
/{boot,efi}/EFI/systemd/.#systemd-boot*.efi@{hex} rw,
/{boot,efi}/EFI/systemd/systemd-boot*.efi w,
/{boot,efi}/loader/.#bootctlrandom-seed@{hex} rw,
/{boot,efi}/loader/.#entries.srel* w,
/{boot,efi}/loader/{,**} r,
/{boot,efi}/loader/entries.srel w,
/{boot,efi}/loader/random-seed w,
@{efi}/ r,
@{efi}/EFI/{,**} r,
@{efi}/EFI/BOOT/.#BOOT*.EFI@{hex} rw,
@{efi}/EFI/BOOT/BOOTX64.EFI w,
@{efi}/EFI/systemd/.#systemd-boot*.efi@{hex} rw,
@{efi}/EFI/systemd/systemd-boot*.efi w,
@{efi}/loader/.#bootctlrandom-seed@{hex} rw,
@{efi}/loader/.#entries.srel* w,
@{efi}/loader/{,**} r,
@{efi}/loader/entries.srel w,
@{efi}/loader/random-seed w,
/etc/kernel/entry-token r,
/etc/machine-id r,

3
apparmor.d/groups/systemd/systemd-generator-sysv
View file

@ -17,9 +17,10 @@ profile systemd-generator-sysv @{exec_path} flags=(attach_disconnected) {
/etc/init.d/{,**} r,
/etc/rc@{int}.d/{,**} r,
@{run}/systemd/generator.late/* w,
@{run}/systemd/generator.late/** w,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/environ r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,

2
apparmor.d/groups/systemd/systemd-localed
View file

@ -14,7 +14,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) {
include <abstractions/consoles>
include <abstractions/common/systemd>
unix (bind) type=stream addr=@@{udbus}/bus/systemd-localed/system,
unix bind type=stream addr=@@{udbus}/bus/systemd-localed/system,
#aa:dbus own bus=system name=org.freedesktop.locale1

7
apparmor.d/groups/systemd/systemd-logind
View file

@ -12,11 +12,11 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.PolicyKit1>
include <abstractions/common/systemd>
include <abstractions/consoles>
include <abstractions/devices-usb>
include <abstractions/disks-write>
include <abstractions/nameservice-strict>
include <abstractions/common/systemd>
capability chown,
capability dac_override,
@ -50,8 +50,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
/etc/systemd/sleep.conf.d/{,**} r,
/ r,
/boot/{,**} r,
/efi/{,**} r,
@{efi}/{,**} r,
/swap.img r,
/swap/swapfile r,
/swapfile r,
@ -140,8 +139,6 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
/dev/dri/card@{int} rw,
/dev/input/event@{int} rw, # Input devices (keyboard, mouse, etc)
/dev/mqueue/ r,
/dev/tty@{int} rw,
owner @{att}/dev/tty@{int} rw,
owner /dev/shm/{,**/} rw,
include if exists <local/systemd-logind>

2
apparmor.d/groups/systemd/systemd-network-generator
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/systemd-network-generator
profile systemd-network-generator @{exec_path} {
profile systemd-network-generator @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/common/systemd>

9
apparmor.d/groups/systemd/systemd-networkd
View file

@ -31,6 +31,8 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
unix bind type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network,
signal receive set=usr2 peer=@{p_systemd},
#aa:dbus own bus=system name=org.freedesktop.network1
dbus send bus=system path=/org/freedesktop/hostname1
@ -47,14 +49,18 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
/var/lib/dbus/machine-id r,
/etc/machine-id r,
/etc/systemd/networkd.conf r,
/etc/systemd/network.conf r,
/etc/systemd/network/{,**} r,
/etc/systemd/networkd.conf r,
/etc/systemd/networkd.conf.d/{,**} r,
/etc/networkd-dispatcher/carrier.d/{,*} r,
@{att}/ r,
@{att}/@{run}/systemd/notify rw,
@{run}/mount/utab r,
owner @{att}/var/lib/systemd/network/ r,
@{run}/systemd/network/ r,
@ -75,6 +81,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pid}/cgroup r,
@{PROC}/pressure/* r,
@{PROC}/sys/net/ipv{4,6}/** rw,
@{PROC}/version_signature r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/mountinfo r,

3
apparmor.d/groups/systemd/systemd-remount-fs
View file

@ -28,8 +28,7 @@ profile systemd-remount-fs @{exec_path} flags=(attach_disconnected) {
@{run}/host/container-manager r,
@{run}/mount/utab rw,
@{run}/mount/utab.@{rand6} rw,
@{run}/mount/utab.lock rwk,
@{run}/mount/utab.* rwk,
@{sys}/devices/virtual/block/dm-@{int}/dm/name r,

2
apparmor.d/groups/systemd/systemd-timedated
View file

@ -15,7 +15,7 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) {
capability sys_time,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-timedat/system,
unix bind type=stream addr=@@{udbus}/bus/systemd-timedat/system,
#aa:dbus own bus=system name=org.freedesktop.timedate1