felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial support for zsys

Browse source
This commit is contained in:
Jeroen Rijken 2022-07-30 11:32:42 +02:00 • committed by Alex
parent 33ff1abc35
commit d083e927a4
11 changed files with 88 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/profiles-s-z/sudo
View file

@ -37,6 +37,7 @@ profile sudo @{exec_path} {
signal (send) peer=unconfined,
signal (send) set=(cont,hup) peer=su,
signal (send) set=winch peer=apt,
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager

4
apparmor.d/profiles-s-z/zpool
View file

@ -22,7 +22,7 @@ profile zpool @{exec_path} {
/etc/zfs/*.cache rwk,
@{run}/blkid/blkid.tab rw,
@{run}/blkid/blkid.tab.old l,
@{run}/blkid/blkid.tab.old rwl,
@{run}/blkid/blkid.tab-* rwl,
@{sys}/bus/pci/slots/ r,
@ -34,5 +34,5 @@ profile zpool @{exec_path} {
/dev/pts/[0-9]* rw,
/dev/zfs rw,
include if exists <local/zfs>
include if exists <local/zpool>
}

34
apparmor.d/profiles-s-z/zsys-system-autosnapshot Normal file
View file

@ -0,0 +1,34 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/zsys-system-autosnapshot
profile zsys-system-autosnapshot flags=(complain) @{exec_path} {
include <abstractions/base>
@{exec_path} rm,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/cp rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/zsysctl rix,
/{usr/,}bin/zsysd rix,
/{usr/,}lib/locale/locale-archive r,
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
@{run}/zsys-bootmenu.unattended-upgrades rw,
@{run}/zsys-snapshot.unattended-upgrades rw,
@{run}/unattended-upgrades.pid r,
@{PROC}/filesystems r,
/dev/pts/[0-9]* rw,
include if exists <local/zsys-system-autosnapshot>
}

40
apparmor.d/profiles-s-z/zsysd Normal file
View file

@ -0,0 +1,40 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/zsysd /{usr/,}{s,}bin/zsysctl
profile zsysctl @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/dbus-strict>
@{exec_path} rm,
/{usr/,}bin/zsysctl rix,
/{usr/,}bin/zsysd rix,
/etc/hostid r,
/etc/passwd r,
/etc/nsswitch.conf r,
/etc/zsys.conf r,
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
@{run}/systemd/notify rw,
@{run}/unattended-upgrades.pid r,
@{run}/zsys-snapshot.unattended-upgrades rw,
@{run}/zsysd.sock rw,
@{PROC}/@{pids}/mounts r,
@{PROC}/filesystems r,
@{PROC}/sys/kernel/spl/hostid r,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/dev/pts/[0-9]* rw,
/dev/zfs rw,
include if exists <local/zsysctl>
}