felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): revisit the gparted profiles

Browse source 
fix #697
This commit is contained in:
Alexandre Pujol 2025-03-23 15:17:25 +01:00
parent acf423fd86
commit bc422ab5b8
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
2 changed files with 28 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

49
apparmor.d/profiles-g-l/gparted
View file

@ -8,41 +8,35 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/gparted @{exec_path} = @{bin}/gparted
profile gparted @{exec_path} { profile gparted @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
ptrace (read), ptrace read,
@{exec_path} r, @{exec_path} r,
@{bin}/ r, @{bin}/ r,
@{coreutils_path} rix,
@{sh_path} rix, @{sh_path} rix,
@{bin}/{,e}grep rix,
@{bin}/{m,g,}awk rix, @{bin}/killall5 rCx -> killall,
@{bin}/cut rix, @{bin}/systemctl rCx -> systemctl,
@{bin}/id rix, @{bin}/udevadm rCx -> udevadm,
@{bin}/ls rix,
@{bin}/mkdir rix, @{bin}/pidof rPx,
@{bin}/pidof rix, @{bin}/pkexec rPx,
@{bin}/rm rix, @{bin}/ps rPx,
@{bin}/sed rix, @{bin}/xhost rPx,
@{bin}/touch rix,
@{bin}/gpartedbin rPx, @{bin}/gpartedbin rPx,
@{lib}/gparted/gpartedbin rPx, @{lib}/gparted/gpartedbin rPx,
@{lib}/gpartedbin rPx, @{lib}/gpartedbin rPx,
@{lib}/{,udisks2/}udisks2-inhibit rix, @{lib}/{,udisks2/}udisks2-inhibit rix,
@{run}/udev/rules.d/ rw, @{run}/udev/rules.d/ rw,
@{run}/udev/rules.d/90-udisks-inhibit.rules rw, @{run}/udev/rules.d/@{int}-*.rules rw,
@{bin}/udevadm rCx -> udevadm,
@{bin}/killall5 rCx -> killall,
@{bin}/ps rPx,
@{bin}/xhost rPx,
@{bin}/pkexec rPx,
@{bin}/systemctl rCx -> systemctl,
# For shell pwd # For shell pwd
/ r, / r,
@ -57,7 +51,6 @@ profile gparted @{exec_path} {
# file_inherit # file_inherit
owner /dev/tty@{int} rw, owner /dev/tty@{int} rw,
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm> include <abstractions/app/udevadm>
@ -80,11 +73,9 @@ profile gparted @{exec_path} {
@{bin}/killall5 mr, @{bin}/killall5 mr,
# The /proc/ dir is needed to avoid the following error: @{PROC}/ r,
# /proc: Permission denied @{PROC}/@{pids}/stat r,
@{PROC}/ r, @{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/stat r,
@{PROC}/@{pids}/cmdline r,
include if exists <local/gparted_killall> include if exists <local/gparted_killall>
} }
@ -93,6 +84,8 @@ profile gparted @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/systemctl> include <abstractions/app/systemctl>
capability net_admin,
include if exists <local/gparted_systemctl> include if exists <local/gparted_systemctl>
} }

10
apparmor.d/profiles-g-l/gpartedbin
View file

@ -14,7 +14,9 @@ profile gpartedbin @{exec_path} {
include <abstractions/desktop> include <abstractions/desktop>
include <abstractions/disks-write> include <abstractions/disks-write>
include <abstractions/fontconfig-cache-read> include <abstractions/fontconfig-cache-read>
include <abstractions/nameservice-strict>
capability dac_override,
capability dac_read_search, capability dac_read_search,
capability ipc_lock, capability ipc_lock,
capability sys_admin, capability sys_admin,
@ -44,12 +46,11 @@ profile gpartedbin @{exec_path} {
@{bin}/dumpe2fs rPx, @{bin}/dumpe2fs rPx,
@{bin}/e2fsck rPx, @{bin}/e2fsck rPx,
@{bin}/e2image rPx, @{bin}/e2image rPx,
@{bin}/fsck.btrfs rPx, @{bin}/fsck.* rPUx,
@{bin}/fsck.fat rPx,
@{bin}/lvm rPUx, @{bin}/lvm rPUx,
@{bin}/mdadm rPUx, @{bin}/mdadm rPUx,
@{bin}/mke2fs rPx, @{bin}/mke2fs rPx,
@{bin}/mkfs.* rPx, @{bin}/mkfs.* rPUx,
@{bin}/mkntfs rPx, @{bin}/mkntfs rPx,
@{bin}/mkswap rPx, @{bin}/mkswap rPx,
@{bin}/mtools rPx, @{bin}/mtools rPx,
@ -60,11 +61,14 @@ profile gpartedbin @{exec_path} {
@{bin}/swaplabel rPx, @{bin}/swaplabel rPx,
@{bin}/swapoff rPx, @{bin}/swapoff rPx,
@{bin}/swapon rPx, @{bin}/swapon rPx,
@{bin}/tune.* rPUx,
@{bin}/tune2fs rPx, @{bin}/tune2fs rPx,
@{bin}/xfs_io rPUx, @{bin}/xfs_io rPUx,
@{open_path} rPx -> child-open, @{open_path} rPx -> child-open,
/etc/fstab r,
@{HOME}/.Xauthority r, @{HOME}/.Xauthority r,
owner @{HOME}/*.htm w, owner @{HOME}/*.htm w,