felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-07-18 11:36:16 +01:00
parent 081308db2f
commit c750cb1b77
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/profiles-a-f/apparmor.systemd
View file

@ -11,6 +11,8 @@ profile apparmor.systemd @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability mac_admin,
@{exec_path} mr,
/{usr/,}{s,}bin/aa-status rPx,
@ -19,6 +21,8 @@ profile apparmor.systemd @{exec_path} flags=(complain) {
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/getconf rix,
/{usr/,}bin/ls rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/sort rix,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}bin/xargs rix,
@ -28,6 +32,7 @@ profile apparmor.systemd @{exec_path} flags=(complain) {
@{sys}/fs/cgroup/systemd/ r,
@{sys}/kernel/security/apparmor/{,**} r,
@{sys}/kernel/security/apparmor/.remove rw,
@{sys}/module/apparmor/ r,
@{PROC}/@{pids}/fd/ r,

2
apparmor.d/profiles-a-f/apparmor_parser
View file

@ -25,6 +25,8 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
owner /var/cache/apparmor/{,**} rw,
owner /var/lib/docker/tmp/docker-default[0-9]* r,
owner /var/lib/snapd/apparmor/{,**} r,
owner /tmp/cri-containerd.apparmor.d[0-9]* r,
owner @{sys}/kernel/security/apparmor/.{remove,replace,load,access} rw,
@{sys}/kernel/security/apparmor/{,**} r,