felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-03 20:13:11 +01:00
parent 8142ad657d
commit c32b19a808
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
40 changed files with 218 additions and 196 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/systemd/bootctl
View file

@ -24,12 +24,14 @@ profile bootctl @{exec_path} {
/{boot,efi}/ r,
/{boot,efi}/EFI/{,**} r,
/{boot,efi}/loader/{,**} r,
/{boot,efi}/EFI/BOOT/.#BOOT*.EFI[0-9a-f]* rw,
/{boot,efi}/EFI/BOOT/BOOTX64.EFI w,
/{boot,efi}/EFI/systemd/.#systemd-boot*.efi[0-9a-f]* rw,
/{boot,efi}/EFI/systemd/systemd-boot*.efi w,
/{boot,efi}/loader/.#bootctlrandom-seed[0-9a-f]* rw,
/{boot,efi}/loader/.#entries.srel* w,
/{boot,efi}/loader/{,**} r,
/{boot,efi}/loader/entries.srel w,
/{boot,efi}/loader/random-seed w,
/etc/machine-id r,

6
apparmor.d/groups/systemd/networkctl
View file

@ -11,12 +11,11 @@ include <tunables/global>
profile networkctl @{exec_path} flags=(complain) {
include <abstractions/base>
# To be able to manage network interfaces,
capability net_admin,
# Needed? (#FIXME#)
audit deny capability sys_resource,
audit deny capability sys_module,
audit capability sys_resource,
audit capability sys_module,
signal send peer=child-pager,
@ -49,6 +48,7 @@ profile networkctl @{exec_path} flags=(complain) {
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/stat r,
@{PROC}/filesystems r,
@{PROC}/sys/kernel/random/boot_id r,
include if exists <local/networkctl>

9
apparmor.d/groups/systemd/systemd-hostnamed
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2018-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -17,7 +17,11 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
@{run}/systemd/notify rw,
@{run}/udev/data/+dmi:id r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/bios_version r,
@{sys}/devices/virtual/dmi/id/board_vendor r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/virtual/dmi/id/product_name r,
@ -25,7 +29,6 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/dmi/id/uevent r,
@{run}/udev/data/+dmi:id r,
@{sys}/firmware/dmi/entries/*/raw r,
/etc/.#hostname* rw,