felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-06-03 20:13:11 +01:00
parent 8142ad657d
commit c32b19a808
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
40 changed files with 218 additions and 196 deletions
Download patch file Download diff file Expand all files Collapse all files

67
apparmor.d/profiles-m-r/mkinitramfs
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -19,37 +20,36 @@ profile mkinitramfs @{exec_path} {
@{exec_path} r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}sbin/ r,
/{usr/,}bin/ r,
/{usr/,}{s,}bin/ r,
/{usr/,}lib/ r,
/{usr/,}lib64/ r,
/{usr/,}bin/getopt rix,
/{usr/,}bin/basename rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/chmod rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/cp rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/dirname rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/tsort rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/id rix,
/{usr/,}bin/sort rix,
/{usr/,}bin/env rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/tr rix,
/{usr/,}bin/cpio rix,
/{usr/,}bin/gzip rix,
/{usr/,}bin/basename rix,
/{usr/,}bin/bzip2 rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/chmod rix,
/{usr/,}bin/cp rix,
/{usr/,}bin/cpio rix,
/{usr/,}bin/dirname rix,
/{usr/,}bin/env rix,
/{usr/,}bin/getopt rix,
/{usr/,}bin/gzip rix,
/{usr/,}bin/id rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/lzma rix,
/{usr/,}bin/lzop rix,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/sort rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/tr rix,
/{usr/,}bin/tsort rix,
/{usr/,}bin/xargs rix,
/{usr/,}bin/xz rix,
/{usr/,}bin/zstd rix,
@ -87,20 +87,21 @@ profile mkinitramfs @{exec_path} {
/var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.{order,builtin} rw,
owner /var/tmp/mkinitramfs-* rw,
@{PROC}/modules r,
owner @{PROC}/@{uid}/fd/ r,
@{PROC}/modules r,
profile ldd {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
/{usr/,}bin/ldd mr,
/{usr/,}bin/kmod mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}lib/@{multiarch}/ld-*.so rix,
/{usr/,}lib{,x}32/ld-*.so rix,
/{usr/,}lib/@{multiarch}/ld-*.so* rix,
/{usr/,}lib{,x}32/ld-*.so rix,
}
@ -110,7 +111,10 @@ profile mkinitramfs @{exec_path} {
capability sys_chroot,
/{usr/,}sbin/ldconfig mr,
/{usr/,}{s,}bin/ldconfig mr,
/{usr/,}{s,}bin/ldconfig.real rix,
/{usr/,}bin/{,ba,da}sh rix,
owner /var/tmp/mkinitramfs_*/etc/ld.so.conf r,
owner /var/tmp/mkinitramfs_*/etc/ld.so.conf.d/{,*.conf} r,
@ -148,11 +152,14 @@ profile mkinitramfs @{exec_path} {
profile kmod {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/openssl>
/{usr/,}bin/kmod mr,
@{PROC}/cmdline r,
/etc/depmod.d/ r,
/etc/depmod.d/*.conf r,
/etc/modprobe.d/ r,
/etc/modprobe.d/*.conf r,

2
apparmor.d/profiles-m-r/qemu-ga
View file

@ -12,6 +12,8 @@ profile qemu-ga @{exec_path} {
@{exec_path} mr,
/etc/qemu/qemu-ga.conf r,
owner @{run}/qga.state* rw,
/dev/vport[0-9]*p[0-9]* rw,

24
apparmor.d/profiles-m-r/rsyslogd
View file

@ -16,25 +16,12 @@ profile rsyslogd @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice>
# Needed to remove the following error:
# rsyslogd[]: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
capability syslog,
# For remote logs
capability net_admin,
# for creating new log files and changing their owner/group
capability chown,
# downgrade privileges on Ubuntu
capability setgid,
capability chown, # For creating new log files and changing their owner/group
capability net_admin, # For remote logs
capability setgid, # For downgrading privileges
capability setuid,
# Needed?
deny capability sys_nice,
# capability sys_ptrace,
# ptrace (read),
capability syslog,
@{exec_path} mr,
/{usr/,}lib/@{multiarch}/rsyslog/*.so mr,
@ -47,6 +34,7 @@ profile rsyslogd @{exec_path} {
owner @{run}/rsyslogd.pid{,.tmp} rwk,
owner @{run}/systemd/journal/syslog w,
@{run}/systemd/notify rw,
# log files and devices
/var/log/** rw,