felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refractor(abs): move common and app abstraction to their own abstractions subfolder.

Browse source 
As the number of abstraction is increasing, it is valuable to separate "base" abstractions to programs specific ones.
This commit is contained in:
Alexandre Pujol 2024-03-27 15:11:21 +00:00
parent 92f83d9e8d
commit b88b8b8c26
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
158 changed files with 226 additions and 198 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/profiles-s-z/sensors-detect
View file

@ -41,7 +41,7 @@ profile sensors-detect @{exec_path} {
profile udevadm {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/common/systemd>
capability sys_ptrace,
@ -67,7 +67,7 @@ profile sensors-detect @{exec_path} {
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include <abstractions/app/systemctl>
include if exists <local/sensors-detect_systemctl>
}

2
apparmor.d/profiles-s-z/snap
View file

@ -112,7 +112,7 @@ profile snap @{exec_path} {
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include <abstractions/app/systemctl>
include if exists <local/snap_systemctl>
}

2
apparmor.d/profiles-s-z/snap-failure
View file

@ -25,7 +25,7 @@ profile snap-failure @{exec_path} {
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include <abstractions/app/systemctl>
include if exists <local/snap-failure_systemctl>
}

2
apparmor.d/profiles-s-z/spotify
View file

@ -16,7 +16,7 @@ include <tunables/global>
profile spotify @{exec_path} {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/chromium-common>
include <abstractions/common/chromium>
include <abstractions/dconf-write>
include <abstractions/desktop>
include <abstractions/graphics>

2
apparmor.d/profiles-s-z/steam
View file

@ -11,7 +11,7 @@ include <tunables/global>
profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain) {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/chromium-common>
include <abstractions/common/chromium>
include <abstractions/consoles>
include <abstractions/dconf-write>
include <abstractions/desktop>

2
apparmor.d/profiles-s-z/steam-game
View file

@ -24,7 +24,7 @@ include <tunables/global>
profile steam-game @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/audio-client>
include <abstractions/bwrap>
include <abstractions/common/bwrap>
include <abstractions/desktop>
include <abstractions/devices-usb>
include <abstractions/fontconfig-cache-write>

3
apparmor.d/profiles-s-z/su
View file

@ -11,10 +11,9 @@ include <tunables/global>
profile su @{exec_path} {
include <abstractions/base>
include <abstractions/app-launcher-root>
include <abstractions/sudo>
include <abstractions/app/sudo>
capability chown, # pseudo-terminal
capability dac_read_search,
signal (send) set=(term,kill),
signal (receive) set=(int,quit,term),

30
apparmor.d/profiles-s-z/sudo
View file

@ -11,11 +11,9 @@ include <tunables/global>
profile sudo @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/app-launcher-root>
include <abstractions/sudo>
include <abstractions/app/sudo>
capability chown,
capability dac_override,
capability dac_read_search,
capability mknod,
capability sys_ptrace,
@ -27,32 +25,26 @@ profile sudo @{exec_path} flags=(attach_disconnected) {
signal (send,receive) peer=cockpit-bridge,
signal (send) peer=@{systemd},
signal (send) set=(cont,hup) peer=su,
signal (send) set=(winch),
# signal (send) set=(winch),
signal (send) set=(winch) peer=child-pager,
signal (send) set=(winch) peer=journalctl,
@{exec_path} mr,
@{bin}/@{shells} rUx,
@{bin}/@{shells} rUx,
@{lib}/** PUx,
/opt/*/** PUx,
/snap/snapd/@{int}@{bin}/snap rPUx,
/var/db/sudo/lectured/ r,
/var/lib/extrausers/shadow r,
/var/lib/sudo/lectured/ r,
/var/lib/sudo/ts/ rw,
/var/lib/sudo/ts/* rwk,
/var/log/sudo.log wk,
owner /var/db/sudo/lectured/@{uid} rw,
owner /var/lib/sudo/lectured/* rw,
owner /var/lib/extrausers/shadow r,
/var/lib/sudo/lectured/ r,
owner /var/lib/sudo/lectured/@{uid} rw,
owner @{HOME}/.sudo_as_admin_successful rw,
@{run}/ r,
@{run}/faillock/{,*} rwk,
@{run}/systemd/sessions/* r,
owner @{run}/sudo/ rw,
owner @{run}/sudo/ts/ rw,
owner @{run}/sudo/ts/* rwk,
@{run}/ r,
@{run}/systemd/sessions/* r,
include if exists <local/sudo>
}

2
apparmor.d/profiles-s-z/udisksd
View file

@ -141,7 +141,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
profile systemctl {
include <abstractions/base>
include <abstractions/systemctl>
include <abstractions/app/systemctl>
include if exists <local/udisksd_systemctl>
}

2
apparmor.d/profiles-s-z/x11-xsession
View file

@ -114,7 +114,7 @@ profile x11-xsession @{exec_path} {
profile udevadm {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/common/systemd>
@{bin}/udevadm mr,