felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): minor improvements.

Browse source
This commit is contained in:
Alexandre Pujol 2025-03-07 00:07:11 +01:00
parent da7958a2f9
commit b623dc4a77
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
13 changed files with 22 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/app/sudo
View file

@ -24,8 +24,6 @@
network netlink raw, # PAM
unix bind type=stream addr=@@{udbus}/bus/sudo/system,
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind

2
apparmor.d/groups/apt/command-not-found
View file

@ -21,7 +21,7 @@ profile command-not-found @{exec_path} {
@{python_path} r,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/snap rPUx,
@{bin}/snap rPx,
@{lib}/@{python_name}/dist-packages/CommandNotFound/**/__pycache__/*.cpython-@{int}.pyc.@{int} w,

2
apparmor.d/groups/gnome/gnome-logs
View file

@ -27,6 +27,8 @@ profile gnome-logs @{exec_path} {
/{run,var}/log/journal/@{hex32}/user-@{uid}@@{hex32}-@{hex16}-@{hex16}.journal r,
/{run,var}/log/journal/remote/ r,
owner @{PROC}/@{pid}/stat r,
include if exists <local/gnome-logs>
}

2
apparmor.d/groups/systemd/journalctl
View file

@ -33,6 +33,8 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
/var/lib/systemd/catalog/database rw,
/var/lib/systemd/catalog/.#database* rw,
/var/log/dmesg w,
/{run,var}/log/journal/ r,
/{run,var}/log/journal/@{hex32}/ r,
/{run,var}/log/journal/@{hex32}/system.journal* r,

4
apparmor.d/groups/systemd/loginctl
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/loginctl
profile loginctl @{exec_path} {
profile loginctl @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/bus-system>
@ -27,6 +27,8 @@ profile loginctl @{exec_path} {
@{PROC}/sys/fs/nr_open r,
owner @{PROC}/@{pid}/cgroup r,
/dev/rfkill r,
include if exists <local/loginctl>
}

2
apparmor.d/groups/systemd/systemd-networkd
View file

@ -29,7 +29,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
network packet dgram,
network packet raw,
unix (bind) type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network,
unix bind type=stream addr=@@{udbus}/bus/systemd-network/bus-api-network,
#aa:dbus own bus=system name=org.freedesktop.network1

4
apparmor.d/groups/systemd/systemd-udevd
View file

@ -42,7 +42,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
@{bin}/*-print-pci-ids rix,
@{bin}/alsactl rPUx,
@{bin}/ddcutil rPx,
@{bin}/dmsetup rPUx,
@{bin}/dmsetup rPx,
@{bin}/ethtool rix,
@{bin}/issue-generator rPx,
@{bin}/kmod rPx,
@ -56,7 +56,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
@{bin}/perl rix,
@{bin}/setfacl rix,
@{bin}/sg_inq rix,
@{bin}/snap rPUx,
@{bin}/snap rPx,
@{bin}/systemctl rCx -> systemctl,
@{bin}/systemd-run rix,
@{bin}/unshare rix,

2
apparmor.d/groups/utils/chsh
View file

@ -24,8 +24,6 @@ profile chsh @{exec_path} {
network netlink raw,
unix type=stream addr=@@{udbus}/bus/chsh/system,
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
@{exec_path} mr,

2
apparmor.d/groups/utils/login
View file

@ -32,8 +32,6 @@ profile login @{exec_path} flags=(attach_disconnected) {
signal (send) set=(hup term),
unix type=stream addr=@@{udbus}/bus/login/system,
ptrace read,
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind

2
apparmor.d/groups/utils/su
View file

@ -19,8 +19,6 @@ profile su @{exec_path} {
signal (receive) set=(int,quit,term),
signal (receive) set=(cont,hup) peer=sudo,
unix (bind) type=dgram,
@{exec_path} mr,
@{bin}/@{shells} rUx,

1
apparmor.d/profiles-a-f/console-setup
View file

@ -12,6 +12,7 @@ profile console-setup @{exec_path} {
@{exec_path} mr,
@{sh_path} r,
@{bin}/uname rPx,
@{bin}/mkdir rix,

9
apparmor.d/profiles-g-l/hugo
View file

@ -37,10 +37,17 @@ profile hugo @{exec_path} {
owner @{user_cache_dirs}/hugo_cache/{,**} rwkl,
owner @{user_config_dirs}/git/*config r,
owner @{user_config_dirs}/go/telemetry/mode r,
owner @{tmp}/hugo_cache/{,**} rwkl,
owner @{tmp}/go-codehost-@{int} rw,
@{PROC}/sys/net/core/somaxconn r,
@{sys}/kernel/mm/hugepages/ r,
@{PROC}/sys/net/core/somaxconn r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mountinfo r,
include if exists <local/hugo>
}

4
apparmor.d/profiles-m-r/qemu-ga
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/qemu-ga
profile qemu-ga @{exec_path} flags=(complain) {
profile qemu-ga @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
@ -24,7 +24,7 @@ profile qemu-ga @{exec_path} flags=(complain) {
/dev/vport@{int}p@{int} rw,
profile systemctl flags=(complain) {
profile systemctl {
include <abstractions/base>
include <abstractions/app/systemctl>