felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial support for zsys

Browse source
This commit is contained in:
Jeroen Rijken 2022-07-30 11:32:42 +02:00 • committed by Alex
parent 33ff1abc35
commit d083e927a4
11 changed files with 88 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/apt/apt
View file

@ -88,6 +88,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/snap rPUx,
/{usr/,}lib/cnf-update-db rPx,
/{usr/,}lib/needrestart/apt-pinvoke rPx,
@{libexec}/zsys-system-autosnapshot rPx,
# For building the source after the download process is finished (apt-get source --compile)
/{usr/,}bin/dpkg-buildpackage rPUx,

2
apparmor.d/groups/apt/apt-listbugs-aptcleanup
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/libexec/apt-listbugs/aptcleanup
@{exec_path} = @{libexec}/apt-listbugs/aptcleanup
profile apt-listbugs-aptcleanup @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/apt/apt-listbugs-migratepins
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/libexec/apt-listbugs/migratepins
@{exec_path} = @{libexec}/apt-listbugs/migratepins
profile apt-listbugs-migratepins @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

5
apparmor.d/groups/apt/unattended-upgrade
View file

@ -49,7 +49,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=StateChanged,
member={CheckPermissions,StateChanged},
@{exec_path} mr,
@ -74,11 +74,14 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
/{usr/,}lib/apt/methods/http{,s} rPx,
/{usr/,}lib/needrestart/apt-pinvoke rPx,
/{usr/,}lib/update-notifier/update-motd-updates-available rPx,
@{libexec}/zsys-system-autosnapshot rPx,
/usr/share/distro-info/* r,
/etc/apt/*.list r,
/etc/apt/apt.conf.d/{,**} r,
/etc/update-manager/{,**} r,
/etc/update-motd.d/{91-release-upgrade,92-unattended-upgrades} r,
/etc/machine-id r,

1
apparmor.d/groups/ubuntu/do-release-upgrade
View file

@ -35,6 +35,7 @@ profile do-release-upgrade @{exec_path} {
/etc/machine-id r,
/etc/update-manager/{,**} r,
/var/lib/ubuntu-release-upgrader/release-upgrade-available rw,
/var/lib/update-manager/* rw,
/var/cache/apt/pkgcache.bin{,.*} rw,

2
apparmor.d/groups/ubuntu/release-upgrade-motd
View file

@ -15,11 +15,13 @@ profile release-upgrade-motd @{exec_path} {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/date rix,
/{usr/,}bin/expr rix,
/{usr/,}bin/id rix,
/{usr/,}bin/stat rix,
/{usr/,}bin/do-release-upgrade rPx,
/var/lib/ubuntu-release-upgrader/release-upgrade-available rw,
@{PROC}/filesystems r,
include if exists <local/release-upgrade-motd>
}